EP 34 — Cyderes’ Stephen Fridakis on Ephemeral Credentials and Just-in-Time Access

Stephen Fridakis, CISO in Residence at Cyderes, comes to this conversation with a framework that cuts against how most security teams still operate: stop thinking about perimeters, start thinking about consequences. His argument is that the question of "are we secure or not" is not just unhelpful, it's the wrong unit of measurement entirely, and he offers a more honest alternative built around what an organization can afford to lose versus what must never leave.Stephen makes a precise and underappreciated case for why shadow AI is fundamentally different from every other control problem a CISO has faced. Once sensitive data is submitted to a public model, it is embedded, transformed, and learned. There is no rollback. The most effective response is not detection after the fact but building organizational awareness before the decision to submit is ever made. He also breaks down why static trust models have collapsed under AI, arguing that just-in-time data access and ephemeral credentials are no longer aspirational, they are necessary, and why past behavior can no longer serve as a proxy for future safety.Topics discussed:Reframing CISO governance around consequence management rather than perimeter defense or binary secure/not-secure assessmentsApplying the afford-to-lose framework to prioritize finite security budgets against the data that matters mostUnderstanding AI irreversibility as a distinct control problem where sensitive data submitted to public models cannot be retrievedShifting shadow AI strategy from post-submission detection to pre-decision awareness building across the organizationReplacing static role-based trust models with context-driven identity evaluation that accounts for data stage and purposeMoving toward ephemeral credentials and just-in-time data access as the foundation of modern security architectureEvaluating where AI delivers real operational value versus where uncontrolled use produces unreliable and unexplainable outputsAdvising new CISOs to build both technical depth and business fluency to avoid the most common leadership failure points