Hybrid Identity Protection Podcast

This episode features Philip Keibler, Vice President and CISO at Meijer, one of the nation's largest privately held retailers.
With nearly three decades of security leadership, including CISO roles at Bass Pro Shops and Finish Line, Phil brings a rare long-view perspective on what the job actually requires day to day. He also talks about his feature in Semperis' upcoming documentary Midnight in the War Room, premiering at Black Hat on August 5.
In this episode, Phil explains why CISOs who struggle to get budget usually have a storytelling problem, how he defines success in a role where stopping every attack is impossible, and what it takes to lead a team through an active incident. He also dives into why fundamentals are what actually address most of an organization's risk.
This episode makes the case that the hardest parts of the CISO job are rarely technical, and that mastering the basics matters more than chasing the newest tool.
Guest Bio
Philip Keibler has spent nearly three decades at the intersection of technology, risk, and business building information security programs that work in the real world.
As Vice President and Chief Information Security Officer at Meijer, Phil leads security for one of the nation's largest privately held retailers, overseeing the protection of supply chains, customer data, and critical operations across hundreds of locations in the Midwest.
Phil's career spans industries where the stakes are high and the margin for error is low. Before joining Meijer in 2015, he served as CISO at Bass Pro Shops and previously held the CISO role at Finish Line. Earlier in his career he led security at Herff Jones, bringing security discipline to the manufacturing sector. He began his career at EDS and spent years consulting in the Aerospace sector where he got his start in security.
What sets Phil apart is not just longevity, it is perspective. He has watched information security evolve from a reactive, audit-driven function into a proactive capability that enables business velocity. His approach centers on integrating security into how organizations operate, not as a checkbox, but as a competitive advantage that lets teams move fast while managing risk in practical ways.
Beyond the day-to-day, Phil is a passionate contributor to the broader security community. He has served as a guest lecturer on cybersecurity and data privacy at the University of Chicago Law School, sits on the Institute for Cybersecurity Education and Research Advisory Board at Grand Valley State University, serves on the IT Advisory Committee at Kent County Technical Center, and is a board member the Meijer Credit Union. He is also featured in Midnight in the War Room, a Semperis documentary examining the human reality behind enterprise cyber defense.
Phil has held his CISSP certification since 2009, attained his MBA from Davenport University, and a career's worth of operational experience across retail, aerospace, insurance, and manufacturing.
Guest Quote
“A successful CISO understands that it's not about prevention, it's about resilience, it's about recovery, and it's about identifying those things in your program that you can do incrementally better every single day. We're in the pursuit of perfection, but we understand we'll never get there.”
Time stamps
02:46 Meet Philip Keibler: From Sysadmin to Security
04:35 Becoming a CISO
06:20 What CISOs Really Do
08:50 Defining Success and Resilience
10:41 Storytelling to the Board
13:29 Semperis' Midnight in the War Room
17:47 Team Care and Crisis Leadership
21:47 Advice for CISOs
24:24 The Case for Mastering the Fundamentals
31:02 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Phil on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis
HIP Conference 26 is coming to Nashville, September 8–10, 2026.
Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments.
If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Andre Priebe, Chief Technology Officer at iC Consult Group, the world's largest independent provider of identity security services.
Andre has spent more than two decades leading IAM projects for large-scale enterprises across workforce, customer, and device identity domains. As CTO, he steers iC Consult's Centers of Excellence, service portfolio, and vendor strategy, and advises strategic customers on shaping their identity programs.
In this episode, Andre explains why the gap between identity security awareness and actual maturity is growing every day, and how AI is making it faster and easier for attackers to find the weaknesses organizations already know they have. He breaks down why recovery is the most underestimated phase of the NIST cybersecurity framework and what it really costs when organizations haven't prepared for it.
This episode is a candid look at the state of identity security from someone who sees it across hundreds of organizations every year.
Guest Bio
Andre Priebe serves as the Chief Technology Officer at iC Consult Group, a vendor-independent system integrator specializing in Identity & Access Management and Identity Security with a global team of over 850 employees. Boasting more than two decades of experience managing IAM projects focused on workforce, customer, and device identities within large-scale enterprises, Andre steers the Centers of Excellence, the service portfolio, and vendor strategy at iC Consult.
Andre's role involves a deep focus on emerging approaches, trends, and technologies within the IAM sector, assessing their business value for iC Consult's clientele. He is an innovator with a patent in DevOps-related IAM methodologies, and he holds a B.Sc. and an MBA.
Guest Quote
 “Threat actors, for them, it's easier than ever before, faster, more efficient to identify that kind of technical debt, the weaknesses. They are not going for your latest Entra ID, conditional access, configuration with all the fancy stuff in place to really make sure that nobody else accessing that resource. No. They're going for the old systems, for old protocols, for areas that might be out of control, out of visibility. Third parties, contractors, unmanaged devices.”
Time stamps
0:40 Meet Andre Priebe: Veteran IAM Expert
2:43 The State of Identity Security Awareness
4:51 The Reality of Technical Debt
6:16 How AI Is Changing the Attack Landscape
10:37 Zero Trust Is Mandatory but Almost Nobody Has Achieved It
15:06 What Customers Are Actually Asking About Now
19:19 Planning for Identity Recovery
26:08 The Most Underestimated Part of Recovery
29:56 Return to Trustworthiness vs Return to Operations
39:42 AI Agents and Non-Human Identities
44:02 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Andre on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis
HIP Conference 26 is coming to Nashville, September 8–10, 2026.
Join us to explore this year's theme, Redefining Resilience, at the world's premier practitioner-led conference focused on securing hybrid identity environments.
If you love the conversations on the HIP Podcast, this is where the community comes together in person. Learn more and register at https://www.hipconf.com/.

This episode features Tim Wolf, Senior Solutions Architect at Semperis, and Tim Springston, Principal Product Manager for Recovery Solutions at Semperis.
Tim Wolf spent years as a Microsoft Premier Field Engineer helping enterprise customers architect identity solutions at scale. Tim Springston brings 25 years in identity and security and served as Microsoft's product manager for Azure AD recoverability, including direct involvement in building the Entra ID shared responsibility model documentation.
In this episode, they walk through what the shared responsibility model actually means for Entra tenant data, how token-based attacks sidestep phishing-resistant authentication, and what happens when a threat actor hard-deletes objects and locks you out.
They examine where Microsoft's new Entra ID Identity Resilience Recovery feature stops short, and why planning your recovery before anything goes wrong is the only call to action that matters.
Guest Bios
Tim Wolf
Tim Wolf is a Senior Solution Architect at Semperis. Tim's mission is protecting identities. Currently at Semperis, Tim ensures the resilience of Active Directory and Entra ID. Their background includes years as a Microsoft PFE, implementing Zero Trust and modern Authentication like Fido at an enterprise scale. Tim is an active speaker at multiple conferences, advocating for secure and automated identity architectures.
Tim Springston
Tim Springston is Principal Product Manager for recovery solutions at Semperis. He has over 25 years' identity and security experience with education, government, and Fortune 500 organizations from around the world. In his 25 years at Microsoft, he led services and support for Active Directory and later for Microsoft's cloud identity platform as it evolved from Windows Azure AD to Azure AD. At Microsoft, he was a recurring speaker at internal TechReady conferences and external events. Prior to Semperis, Tim was Microsoft's product manager for Azure AD (now Entra ID) recoverability and Sophos' IAM product manager for the Sophos Central cybersecurity platform.
Guest Quotes
 “The first step in resiliency is not just having a backup plan or a backup tool or capabilities to put things back. You need to know what's important to your organization. If you know what's important, you know what to put back, you know when it's broken.” - Tim Springston
 “If Entra ID is going down... This is business critical today. You're not available to sign in to Teams, to SharePoint, to Salesforce, to your business critical application.  So to really understand Entra ID is business critical.” - Tim Wolf
Time stamps
0:40 Meet Tim Wolf and Tim Springston
2:32 The Microsoft Shared Responsibility Model for Entra ID
6:22 How Entra ID Tenants Are Being Attacked
8:45 Token-Based Attacks Explained
12:26 What Happens When a Threat Actor Takes Over Your Tenant
19:05 Microsoft's New Entra ID Recovery Solution
25:24 The Difference Between Accidents and Adversaries
28:54 Semperis’ Disaster Recovery for Entra Tenant
39:27 Hard Delete and Tenant Cloning Limits
45:30 Resiliency Playbooks and Testing
49:58 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Tim Wolf on LinkedIn
Connect with Tim Springston on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis

This episode features Jim Bowie, VP and CISO at Tampa General Hospital, joined by co-host Courtney Guss, Director of Crisis Management at Semperis.
Jim began his career in EMS and law enforcement before moving into cybersecurity, giving him a grounded understanding of how operational continuity and human outcomes intersect during a crisis. At Tampa General, he leads teams spanning network security, operations, IAM, and GRC, and has built a training culture centered on adversarial simulation, monthly range of exercises, and regular DR drills.
In this episode, Jim argues that rehearsal is the highest-leverage move for resource-constrained security teams and explains why an outage is an outage regardless of cause. He covers why identity is consistently the weak point in every simulation and why the relationships you build before an incident are the ones that matter most.
If your organization is still treating recovery as an afterthought, this episode will change how you think about it.
Guest Bios
Jim Bowie
Jim Bowie is the Vice President and Chief Information Security Officer (CISO) at Tampa General Hospital (TGH). Jim is an accomplished leader with decades of cybersecurity experience and leadership in threat hunting, incident response, threat intelligence, and security operations. He is a strategist with demonstrated ability to bridge between security, infrastructure, and business needs and has experience leading multiple areas in information technology, including cloud infrastructure and security, with exceptional results in employee engagement and productivity.
Courtney Guss
Courtney Guss is the Director of Crisis Management at Semperis, with over 20 years of experience spanning cybersecurity, risk management, and crisis response. She specializes in helping organizations navigate high-impact incidents—from ransomware attacks to regulatory reporting—by orchestrating clear, business-aligned response strategies. Courtney is passionate about transforming crisis chaos into operational clarity.
Guest Quote
"You absolutely need a technology component to your program. But at the end of the day, that tech is surfaced to a person in the chair. And if that person's not up to speed, there's no amount of tech that's going to help them and help you get through a crisis."
Time stamps
01:45 Meet Jim Bowie: Veteran Cybersecurity Leader
02:38 Healthcare Crisis Management Challenges
04:18 Training Beats Budget
06:46 Clinician Buy-In
07:00 Community Ripple Effects
10:23 Mutual Aid Agreements
12:45 Hurricane Drills as Cyber Drills
14:39 Adversarial Practice Culture
17:30 Making Training Time Non-Negotiable
20:14 Recovery Focus and Identity
26:35 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Jim on LinkedIn
Connect with Courtney on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis

This episode features Geoffrey Mattson, CEO of SecureAuth, joined by co-host Sarah Cicchetti, Director of Product Management at Semperis.
Geoffrey has spent decades building and leading companies at the intersection of AI and cybersecurity, including MistNet.ai, an AI-native threat detection platform acquired by LogRhythm, and Xage Security, where he drove zero trust adoption across the U.S. military, global energy firms, and Fortune 500 enterprises. At SecureAuth, he leads a platform built around continuous, real-time identity authority across workforces, APIs, and AI agents.
In this episode, Geoffrey argues that agents combine the speed of automation with the unpredictability of humans, making real-time per-action authorization the only viable control model. He discusses why “friendly fire” from well-meaning employees is the biggest threat vector right now, how MCP vendors are ignoring their own OAuth spec, and what a practical agent rollout with real guardrails actually looks like.
This episode reframes authorization as the problem the identity industry has been deferring for years and can no longer avoid.
Guest Bio
Geoffrey Mattson is a serial entrepreneur and globally recognized cybersecurity and AI executive with decades of experience building market-defining companies and technologies that protect the world’s most critical systems.
He is currently CEO of SecureAuth, a leader in AI-driven identity and access management with its Continuous Authority, ensuring ongoing verification across workforces, customers, APIs, and AI agents. This is enabled through its Private Authority Platform, which puts authentication and authorization under your control through any deployment model (cloud, on prem, hybrid, air-gapped).
Prior to SecureAuth, Mattson served as CEO of Xage Security, where he led the company in Zero Trust for critical environments from energy to agentic AI. Under his leadership, Xage achieved rapid adoption across the U.S. military, global energy firms, and Fortune 500 enterprises.
Previously, Geoffrey Mattson was co-founder and CEO of MistNet.ai, an AI-native threat detection platform acquired by LogRhythm. He pioneered decentralized analytics and machine learning approaches for real-time cyber defense, and later served as SVP of Product at LogRhythm, driving global expansion and shaping the next generation of SIEM/SOAR solutions.
Earlier, he held senior executive roles at Juniper Networks, overseeing a $2B product portfolio and leading major M&A efforts, and at Huawei Technologies as SVP and CTO for networking and data center platforms. His engineering leadership at Corona Networks, Caspian, and Bay Networks helped build foundational technologies in network and security architecture.
Guest Quote
“With agents, you have the power and the speed of an automated process with the unpredictability of a human. And in fact, we are seeing their behavior and their psychology makes them even perhaps less predictable than a human.”
Time stamps
01:45 Meet Geoffrey Mattson: Serial Entrepreneur and Cybersecurity Executive
02:40 Why Identity Is Having a Moment
08:40 Defining Agent Identity
12:15 Behavioral Guardrails for Agents
14:37 Agent Identity Lifecycle
17:36 Just-in-Time vs. Standing Privilege
18:02 C-Suite Pressure and Friendly Fires
21:00 When Agents Live Off the Land
26:12 MCP, OAuth, and Token Pitfalls
28:04 Threat Models and Rollout Strategy
30:13 LLMs and Policy Authoring
31:23 Conclusion and Final Thoughts
Sponsor
The HIP Podcast is brought to you by Semperis, the leader in identity-driven cyber resilience for the hybrid enterprise. Trusted by the world’s leading businesses, Semperis protects critical Active Directory and Entra ID environments from cyberattacks, ensuring rapid recovery and business continuity when every second counts. Visit semperis.com to learn more.
Links
Connect with Geoffrey on LinkedIn
Connect with Sarah on LinkedIn
Connect with Sean on LinkedIn
Don't miss future episodes
Learn more about Semperis