From IPs to people

Detection fails without identity. When activity isn’t tied to a person, anomalies stop telling a story - they’re just signals without context. And when your logs only show IP addresses, your security team is left responding to shadows, not real risk. In this Threat Talks Deep Dive, Rob Maas (Field CTO, ON2IT) and Nicholai Piagentini (Technical Enablement Engineer, ON2IT) show how identity-based firewalling fixes that-by enforcing policy based on who the user is, not where they connect from.The result: stronger network access control, cleaner zero trust firewall enforcement, and better enterprise security decisions. (00:56) - Intro - Detection fails without identity (01:02:07) - Identity signals - users, devices, tags (02:15:43) - Why identity-based firewalls win - zero trust & threat detection (04:48:01) - Why teams skip it -“as-is” migrations & fear of complexity (07:08:13) - Terminal servers - a network access control blind spot (08:17:11) - NAT & service accounts - who is the real identity? (10:15:12) - When user ID feels impossible - the wireless workaround (11:12:12) - How to start safely - turn it on, validate, tighten policy (14:16:30) - Not optional anymore - zero trust firewall due diligence (15:30:01) - Best advice - start imperfect, identity data wins (17:09:58) - Wrap - stop guessing, know who’s acting Key Topics Covered• Why anomaly detection breaks without identity correlation in firewall logs• How identity-based policy improves network access control and reduces lateral movement• Common failure points: terminal servers, NAT, service accounts, AD timeouts• A low-risk rollout: enable for visibility first, then enforce zero trust rulesRelated ON2IT content & explicitly referenced resourceshttps://threat-talks.com/https://on2it.net/https://www.ams-ix.net/amsThreat Talks connects cyber threats to operational reality-so CISOs and architects can make decisions faster.Subscribe, follow, and turn on notifications to stay ahead of what changes enterprise security next.Click here to view the episode transcript. 🔔 Follow and Support our channel! 🔔=== ► YOUTUBE: https://youtube.com/@ThreatTalks► SPOTIFY: https://open.spotify.com/show/1SXUyUEndOeKYREvlAeD7E► APPLE: https://podcasts.apple.com/us/podcast/threat-talks-your-gateway-to-cybersecurity-insights/id1725776520👕 Receive your Threat Talks T-shirthttps://threat-talks.com/🗺️ Explore the Hack's Route in Detail 🗺️https://threat-talks.com🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX