Eve Maler co-invented SAML, served as CTO of ForgeRock, and spent years as a Forrester security and risk analyst before founding Venn Factory, where she helps executive teams turn identity from hidden plumbing into a business advantage. Recorded live at Identiverse, this episode of Identity Decoded finds Eve joining Roy Akerman and Rob Ainscough to unpack the ideas behind her new book, Mastering Digital Identity: From Risk to Revenue. The conversation traces how identity work quietly grew into "an elaborate patchwork of workarounds," why treating identity like a product (not a ticket queue) raises the ceiling on what it can achieve, and why zero standing privilege is less about removing access than about making it just as seamless to grant. Eve introduces her four Ps framework, protection, personalization, payment, and people, plus the hidden fifth P of productivity, and makes the case for an "identity data balance sheet" that finally puts a value on the data identity teams protect. The discussion closes with a look ahead to agentic AI, board-level metrics like mean time to contain, and a rapid-fire round on Identity Security's most persistent myths. Key Topics 1. Why identity hits a ceiling when it's only managed as infrastructure, tickets, or incidents 2. How vaults quietly become "elaborate patchworks of workarounds," and what zero standing privilege really requires 3. Treating identity like a product: leadership alignment workshops, lighthouse customers, and building organizational FOMO 4. The Four Ps of identity, and the hidden fifth P nobody names 5. Metrics that win over the board: mean time to contain, accountable action results, and the identity data balance sheet 6. What agentic AI means for human-in-the-loop UX and "ask me" policies 🎧Episode Highlights [01:17]: Eve's path from co-inventing SAML to CTO of ForgeRock to founding Venn Factory [02:10]: Inside the new book: turning identity from risk into revenue [03:29]: The archeological dig — mapping where identity responsibility actually lives in organizations [07:11]: The vault confession — "I don't have a vault, I have an elaborate patchwork of workarounds" [09:22]: Zero standing privilege, Touch ID, and why easier access enables less access [13:01]: Human-in-the-loop as a UX challenge for agentic AI, and the "ask me" policy [16:17]: The hidden fifth P — productivity — and why it changes the board conversation [18:22]: Running a leadership alignment workshop from scratch [21:38]: Building FOMO with a lighthouse customer and "irresistible" identity strategy [26:05]: Designing metrics: mean time to contain and accountable action results for agentic failures [30:25]: The identity data balance sheet — putting a value on identity data [33:08]: The Four Ps: protection, personalization, payment, and people [35:09]: Rapid-fire round: identity myths, hard truths, and the most over-hyped term in the industry 🔑 Key Takeaways: ●Managing identity as infrastructure puts a ceiling on it. Treating identity purely as tickets or incidents caps how much value it can deliver, and the gap often shows up as poor user experience, what Eve calls a "UX vulnerability." Getting past that ceiling means adopting a product owner's mindset and aiming for "no compromises" outcomes rather than trade-offs between security and experience. ●Zero standing privilege isn't really about removing access, it's about granting it seamlessly. When access is hard to get, people build workarounds that quietly become permanent, which is how vaults turn into "elaborate patchworks." The bigger unlock is making access as fast and frictionless to grant as it is to revoke, the same dynamic that took phone-lock adoption from roughly 50% to 99% once Touch ID made unlocking effortless. ●Boards respond to metrics that pair risk with value, not process counts. Counting reviews or approvals proves activity, not security. Eve points to measures like mean time to contain for agentic failures and "accountable action results," alongside an "identity data balance sheet" that identifies who actually benefits from each piece of identity data, making it possible to argue for both new investment and cutting what nobody needs. ●There's a hidden fifth P behind identity's four Ps. Protection, personalization, payment, and people map to risk-facing, market-facing, transaction-facing, and human-facing needs, but there's an unnamed fifth P, productivity, that quietly ties them together. It's usually the human-facing part of identity, the one most under-invested in, that determines whether all the rest actually works. 👤 Guest Spotlight: Eve Maler Eve Maler is the founder and president of Venn Factory, where she helps executive teams turn digital identity from hidden plumbing into a business advantage, reducing fraud and account takeover risk, boosting signup and checkout conversion, accelerating delivery for product teams, and giving customers new ways to share and protect their personal data. Over the last thirty years she has co-developed standards-based frameworks used in business systems worldwide, including XML, SAML for outsourced authentication, and UMA for individual control over data sharing. She has provided expert testimony on API security to the US Health and Human Services agency and advised the UK Open Banking initiative on technology adoption. Drawing on her background as a former Forrester Research security and risk analyst and former CTO of ForgeRock, Eve helps organizations move beyond tool debates and reactive fixes to build irresistible identity strategies. She is the author of Mastering Digital Identity: From Risk to Revenue (April 2026), which reframes identity as a board-level business imperative and shows organizations how to design, own, and operationalize it as a profitable strategic capability. Stay Connected: ●https://www.silverfort.com ●https://linkedin.com/in/rob-ainscough ●https://www.linkedin.com/in/roy-akerman ●https://vennfactory.com