Identity, AI Agents, and the Session Token Time Bomb | Carey Frey (CSO, TELUS) on Cybersecurity Today
In this Cybersecurity Today weekend edition, David Shipley interviews Carey Frey, Chief Security Officer at TELUS, about the evolution of identity security and why it's a growing risk in the age of generative and agentic AI. Frey recounts his career from Canada's Communications Security Establishment to leading TELUS's internal security and managed cybersecurity services, then explains how convenience-driven identity decisions led from PKI's unrealized promise to passwords, bearer/session tokens, and today's widespread session cookie theft. He describes lessons from TELUS's deployment of FIDO2 phishing-resistant tokens, the dangers of long-lived SSO tokens across SaaS ecosystems, and how agentic "auto-browse" could amplify harm via the "lethal trifecta" and ephemeral agents with poor auditability. Frey highlights the Syne/SignNet CISO Identity Handbook and calls for stronger cryptographic roots of trust, proof-based tokens, re-authentication across trust domains, and fine-grained delegation guardrails.
Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at Meter.com/cst
00:00 Sponsor Message
00:24 Weekend Edition Intro
00:32 Meet Carey Frey
02:07 Carey's Cyber Origin Story
03:47 Telus Security Two Hats
06:22 Identity's Broken Legacy
08:43 Why PKI Didn't Win
11:25 Passkeys Missed Moment
14:10 SSO Tokens Surprise
19:50 Session Theft Reality
23:18 Agentic AI Stakes
24:17 Building Identity Playbook
25:24 Identity Maturity Model
25:49 Fixing OAuth and SAML
27:00 Industry Call to Action
27:37 Where to Find the Handbook
28:06 Not a Vendor Pitch
30:13 Agentic AI Identity Gaps
31:30 Auto Browse Threat Scenario
33:12 Lethal Trifecta Explained
34:31 Ephemeral Agents and Forensics
37:08 Supply Chain Agent Malware
38:20 Crypto Roots of Trust
39:35 Proof Tokens and Reauth
40:17 Delegation Guardrails
42:34 Regulation or Market Forces
44:25 Practical Risk Decisions
46:20 Wrap Up and Next Resources
48:00 Sponsor and Closing Credits
