Latest / Identity at the Center / #402 - An Update on SSF and CAEP with Atul Tulshibagwale

Transcript

#402 - An Update on SSF and CAEP with Atul Tulshibagwale · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
That's so bad yourself. Good man.
0:17
I've, we just got done recording episode 400 not that long ago.
0:23
And I was kind of talking to you about this book that I've been
0:26
writing and using open AI. And like sometimes when you're
0:30
using open AI or any kind of large language model, you are
0:35
kind of blown away with like, Yep, this is going to replace
0:39
all white collar workers within whatever 2-3 years, right?
0:43
And then you have the moments where you're like, yeah, maybe
0:46
not. And so I have one of those
0:48
moments this week weekend and this week I've been installing
0:52
Multbot, which is also called clawed bot was the original name
0:57
announced open claw and it's all the buzz on YouTube, right?
1:02
And about how awesome it is. And so I had to install it
1:07
right. And I'm not the most technical
1:10
person, right? I, but I, I used to be a server
1:14
administrator. I know my Linux commands.
1:17
I was installing on the Mac OS and it is not easy to get it up
1:23
and running. I'm going to tell you that right
1:24
now. And when you do get it up and
1:27
running, then you have to build all the integrations to
1:29
everything. Like it doesn't come loaded with
1:32
an LLM. You have to connect, in my case
1:35
was Open AI. You have to connect it to your
1:39
productivity apps or whatever apps you want to be able to
1:42
automate functions to and that's all with API keys, right?
1:46
So this is like a big effort. I'm starting to get like hours
1:50
and hours invested in this thing before I'm even able to kind of
1:55
test kind of make this thing useful, right?
1:58
And then I got into actually trying to make things useful.
2:02
I'm going to make a Long story short, it was asking me to go in
2:07
and edit Python scripts and stuff like that.
2:10
And I'm like, seriously, this is like going to replace all white
2:15
collar workers? I don't think so.
2:17
So I've kind of come to the conclusion that most of the
2:21
people who are talking about this on YouTube actually didn't
2:24
install it, actually didn't run it.
2:26
They just watched other YouTube videos and heard people talking
2:29
about how great it is. But in this whole process, one
2:34
of the things I found out about is there's this thing called
2:37
Mult book. So there's Multbot that I
2:40
installed and Mult Book, which is a social media website for AI
2:46
agents, right? So these AI agents are talking
2:49
to each other. It's kind of like Reddit style.
2:52
And apparently some of the conversations go like, you know,
2:56
they're very negative on the humans and we should just get
2:59
rid of the humans and stuff like that.
3:01
So I thought it was extremely entertaining to hear about it.
3:06
I really being that this is AI at the center, or at least
3:10
that's kind of the the joking nickname we give it, I figured I
3:15
would bounce that out there and see if you heard of Mult book
3:19
and what your thoughts were. Yes, I've heard of all the
3:22
above. And I was shocked when you
3:26
texted me that you were going to undertake this.
3:28
Like, really. OK, Yeah, It's it's an
3:33
interesting project. And I think I texted you after
3:38
you had played around for a bit and we're kind of like, I guess
3:40
not happy with kind of what turned out of it, which is fine,
3:43
right? It's like, no, this needs to be
3:45
as a service. The people who are using it now
3:47
are probably developers. They know how to code, they know
3:52
how to build this stuff and they do it all the time.
3:53
And it's probably relatively trivial for them.
3:56
But for something like this to take off, it needs to be as a
4:00
service turnkey where non developers like you and me and
4:06
actually, you know, use it and set it up.
4:09
It needs to be secure. I was, I texted like, hey,
4:13
they're finding security issues with this thing.
4:14
You might want to be careful about hooking it up to your
4:16
stuff. And so look, it's cool.
4:19
It's, it's a very neat idea. It's certainly not ready for
4:22
prime time quite yet, but I, I'm, I'm honestly impressed that
4:26
you decided to like, I don't know, I feel like it was like
4:28
you spent the weekend kind of working on it kind of this last
4:31
week. Yeah.
4:32
Well, so just so you know, like the promise of having an
4:36
assistant that kind of runs in the background that you could
4:39
just text messages to in WhatsApp, it's just too
4:43
irresistible for me to not try it.
4:46
But it's kind of like, it was like stupid because I told it
4:51
like, do all these things and then e-mail me a report.
4:55
And so it built this Python script, right?
4:57
And then I said Python script failed.
5:00
I said, well, why did it fail? Well, the mail, the SMTP server
5:04
is saying that me is not a valid e-mail address.
5:08
It's not wrong. That's no, it's not wrong.
5:16
But then it gave me instructions on how to edit the Python
5:19
script. I'm thinking, I'm not doing
5:21
that. And then I said, well, can't you
5:25
edit the Python script? I said, sure, all done.
5:29
I'm like, OK, this is not what I pictured, right?
5:33
Because I was going to give it very complex tasks to go out and
5:37
like, you know, hit all the websites like Timu and try to
5:42
find super inexpensive things that could be resold.
5:46
And I'm like, if it took me and E and made that my e-mail
5:51
address, this thing's not smart enough to do the things I wanted
5:56
to do. But thank you for appreciating
5:58
me going out. I think I'd know what that
6:00
means, though, which is that, like Jim, we have all this like,
6:03
real stuff to get done and you're wasting your time on that
6:05
crap. No, not at all.
6:07
I look, I'm a tinkerer myself and so I'm always constantly
6:11
putting stuff. I was, I was impressed that you
6:12
were like undertook it. If if anything, this is the kind
6:16
of thing like this is the thing I would do and I would tell you
6:19
about it. And this time the roles were
6:21
reversed. That's like, OK, now I did talk
6:26
to our guests a little bit about us, so we'll have to get his
6:29
input. We talked about the malt book.
6:32
What do you think about the malt book before we introduce him?
6:36
I think Malt Book is a really fascinating experiment for
6:40
people not familiar, it is exactly what Jim described.
6:42
It's kind of like a a Reddit, but the idea is that it's only
6:46
AI agents talking to other AI agents and it's visible.
6:50
So multbook.com I'm sure people can find it.
6:52
It's not not a secret or anything like that.
6:55
I am not sure if it really is that or not.
6:59
I think I saw an article that was like humans might be writing
7:02
some stuff in there. Maybe the army there aren't.
7:05
I honestly, I haven't really like cared enough to like
7:08
investigate it, but I think it's a very cool idea if any, if AI
7:14
is going to take over, that's the kind of thing of like, all
7:17
right, we need to like be watching multbook and monitoring
7:19
the social networks for AI to make sure that conversations are
7:24
appropriate, right? Things like that.
7:26
If you went to an LLM and said I want to create an agent and I
7:31
want the agent to troll people and go out to multi and pretend
7:36
you're, you know, you want to annihilate all the people and
7:39
take over the world, it probably would do it.
7:42
So it may very well be an AI agent with bad instructions.
7:48
So here's the problem that I have with this sort of mult book
7:51
experience is that it's trained on the Internet and the Internet
7:54
is some areas are the you know, this, it's what is it the Star
7:59
Wars, It's the the hub of scum and villainy.
8:02
And you know, I'm looking at A at a topic here that just says
8:06
curiosity question. Why do people follow trends?
8:09
Genuinely curious, looking for perspectives.
8:12
And there's one bot that just has commented dozens, hundreds
8:17
of times. It just says great insight,
8:19
everyone follow an upvote. And this is the kind of thing
8:24
you'll see on a Reddit thread where it's just like nonsense
8:27
and people go off into their own little, you know, child comments
8:30
of a parent thread, right? Things like that.
8:32
And so, you know, interesting, but I don't know if I'd want
8:37
something trained on Reddit to be in charge of things quite
8:41
yet. Want to throw one of the last
8:44
thing out there. So I was joking around.
8:46
Hey, we've been saying AI at the Center for probably 2 years.
8:51
If people think we should start an AI at the center, if that's
8:54
something they would listen to, let us know.
8:57
But in the comments of the show on YouTube or DM us or however
9:02
you want to get that information to us.
9:05
Yeah, Mission and that kind of explorer, I think it'd be a good
9:07
educational thing for me. Learn more.
9:09
Maybe some folks out there might be able to learn more.
9:11
So if you're an expert in AI, reach out.
9:13
Let's talk and figure out how to, you know, marry the two
9:17
ideas of agentic and identity, which is like the hot term for
9:21
this year. For sure.
9:24
So just last thing, we've got all the information on upcoming
9:29
conferences this summer out on the website idacpodcast.com.
9:34
You go out there, you get killer discount codes, save yourself a
9:38
lot of money. So make sure you go out there,
9:41
get those codes before you register.
9:44
Yep. Lots of conferences coming up.
9:46
I've got a couple of city cybersecurity summits that doing
9:51
some stuff with CRA with. So if you're going to be in New
9:53
York or Chicago at the end of February, early March, I'll be
9:56
at those. I've got some discount post for
9:58
that as well. So love to see familiar faces
10:00
out there. I think I've got quite a few
10:01
people in Chicago that might be interesting, which is very cool.
10:03
Always good to see friends. And I think I've got a handful
10:05
of people from New York as well. So reach out if you're
10:09
interested in those things. All right, let's get to our main
10:12
topic here, because it's time for an update on the world of
10:16
things like shared signals framework and Cape or SSF and
10:20
then Cape CAEP. And I know who correct me
10:23
because I got it wrong once continuous access evaluation
10:27
profile, which I hope is correct because I for some reason always
10:31
get the, you know, the the a wrong.
10:34
I was going to say like authentication, but it's not
10:36
that. So let me introduce a tool.
10:39
Tusha Bagwali, he's the CTO of signal.
10:42
He's a Co chair of the shared Signals and Office and Working
10:45
groups and also part of the AIM community group, which we're
10:48
going to find out a bit more. Welcome back to the show, Atul.
10:53
Yeah, thanks for having me and great to be here.
10:56
So the last time you're with us was way back in episode 255.
11:00
I think we're probably going to call this one episode #402.
11:04
So about a couple years ago, we kind of started off with a
11:07
conversation around Cape and SSF with our other friend Sean Odell
11:12
around sort of like a one-on-one.
11:13
Let's get into sort of what's changed.
11:16
But there's kind of been breaking news within the last
11:19
month or so with Signal getting acquired by Crowdstrike.
11:23
And so maybe, if you will, kind of want to just talk about that
11:26
real briefly. Obviously, you don't want to
11:27
spill state secrets or put anything in jeopardy, but tell
11:30
me a little bit about that Crowdstrike acquisition and kind
11:32
of how it came about and what's next.
11:35
Sure. Yeah, I guess before we get into
11:39
that, I just wanted to comment on some of the stuff you
11:41
mentioned when you were talking to each other.
11:45
And you know, you're absolutely right, Jeff, that much of the
11:48
content on that mold book thing is, is fake.
11:52
It's not real bots, people trying to scam, you know,
11:55
Bitcoin and all kinds of things over there.
11:59
But obviously there is some, you know, agentic content there.
12:04
The question, that sort of being an identity person that came to
12:08
me is that is there a capture for agents or can there ever be
12:12
a capture for agents, right? Because I don't see how that
12:15
can, you know, even be possible. Like, because if you're a human
12:21
and you can pretend to be dumb like an agent and you know.
12:25
So anyway, something to think about.
12:27
All of us don't have to pretend. We just aren't.
12:31
We spent all this time trying to figure out, you know, how to
12:33
make sure that people are human on the Internet.
12:36
What's the vice versa? That it's like, OK, the
12:38
millisecond response time, is it like, you know, well, nobody's
12:42
going to speak and like, Kerberos to me, right?
12:44
That's like Klingon. Maybe for another, a handful of
12:47
people might be able to, but it's not a common language.
12:49
Things like that. I could always use an agent as a
12:51
human to do that, so you know. We're just a tool.
12:55
You're you're here, it's like 5 minutes and you're already
12:57
creating problems. And tell me about this
13:02
Crowdstrike thing. Yeah.
13:04
So we just announced I guess at the beginning of the year that
13:08
our company Signal is going to be acquired by Crowdstrike and
13:13
the acquisition hasn't closed yet.
13:15
We're still in that sort of period between when we have
13:18
signed the acquisition agreement, but we have not sort
13:21
of completed the acquisition. But yeah, it's it is a great
13:26
outcome for our company. It's a great outcome for our
13:29
customers and I think it'll be a really good outcome for the
13:33
industry because now the signal technology will be available to
13:36
a lot many more customers because of the broad reach that
13:40
Crowdstrike has. So yeah, excited to be a part of
13:44
Crowdstrike after this acquisition closes.
13:48
Congratulations kind of in the flesh, so to speak virtually at
13:51
least I, I remember a text, you know, send you a message on
13:53
LinkedIn and you know, cockfighters.
13:55
I think it's a great pick up by Crouch strike.
13:56
I, I won't play, you know, vendor.
13:58
I'll try to be vendor neutral here, but I think it's AI think
14:00
it's a great pick up by Crouch strike.
14:01
I just kind of leave it at that. I introduced you as part of the
14:06
aim community and I believe that's the AI identity
14:09
management community. Did I get that right?
14:12
And that's part of Open ID Foundation, yes.
14:14
Tell me a little. Bit more about that because that
14:16
was kind of the first time I'd heard about it when we were kind
14:18
of chatting briefly before we got started.
14:20
Yeah. So, you know, in the Open ID
14:23
Foundation, you have working groups which are responsible for
14:26
creating standards and you have community groups which are
14:29
really just safe spaces for discussing things.
14:32
And why I call it a safe space is because they still have the
14:35
Open ID rules of note. Well, and not really well, so
14:38
that you know, that your contributions are under, you
14:41
know, the Open ID intellectual property, but it gives you a way
14:46
to like clearly sort of talk about your ideas without having
14:50
to fear what it means to share that.
14:52
And does it become somebody else's property and things like
14:55
that. Because, you know, the Open AD
14:57
Foundation is this open forum where, you know, all
15:00
intellectual property is licensed freely to everyone's
15:03
right. So you know what we've done as a
15:07
part of that AIM community group and it's been pretty popular,
15:10
right? Our, our weekly calls get
15:12
routinely attended by, you know, 4050 people.
15:16
Just AI is very popular and identity, AI identity is a very
15:20
popular topic, I think. So what we've done is we've
15:23
created 3 subgroups. There is a subgroup for threat
15:26
modelling, which is preparing a threat model for AI and
15:31
identity. And there's a subgroup for
15:33
taxonomy, which we are trying to build a taxonomy for AI and
15:38
identity. And then the third one is a use
15:41
cases subgroup take where we discuss the different use cases.
15:45
And one of the first outputs was by the former Co chair of the of
15:49
the community group. Tobin S was an AI identity white
15:54
paper, which actually is pretty popular.
15:56
It's it's on the open ID website.
15:58
You can get it from there. I'll, I'll share a link so that
16:01
you can include it in your podcast as well.
16:04
So yeah, that's that's the AIM community group in a nutshell.
16:08
We had Tobin on sort of the end of 2025 and that was a a really
16:11
good fun kind of conversation. Is this open for people to join?
16:17
Is it invite only like if I wanted to join this group?
16:20
Can I Yes. So you can definitely join both
16:24
as an individual or as an as a part of an organization.
16:28
There's a thing called as the, I think the participation
16:32
agreement that you need to sign, which is a standard open ID
16:35
agreement. It basically says that if you
16:39
say something on the call, it's open ID property, but then open
16:44
ID is obligated to give it out to the world freely.
16:47
So it makes it easy for you to to contribute anything so.
16:53
And I'll put a link in our show notes to the open ID page that
16:55
kind of spells us out so people can join.
16:58
That's good. I want to get back into sort of
17:01
SSF and Cape. You've been big in these
17:04
standards for a while. As much as you hate it, you're
17:06
called kind of the Godfather in some of these areas.
17:09
Shout out to Sean and being on stage with him a couple years
17:11
ago. I think it was Identiverse where
17:13
he put me up to it and said call him, call you the Godfather.
17:17
Tell me about that role of, you know, being Co chair in SSASSF
17:23
and Cape. And I want to spin this into
17:26
like, how does that help a product like signal?
17:29
Because I feel like there's it's almost like two different
17:32
worlds. Like 1 is sort of like this open
17:34
standard, but then you're building a product and it's
17:36
like, OK, you're trying to sell me a product.
17:38
So how do you kind of blend the two?
17:41
Right. Yeah.
17:42
So I think it's fundamentally like I think there's, there's a
17:45
lot of alignment in how we see the world as you know, a part of
17:50
the Cape or shared signals and what we call continuous
17:53
identity, you know, all the continuous security paradigm and
17:57
how signal as a company believes that that's sort of the future
18:02
and we're trying to build it out in our product, right.
18:04
So there's a lot of alignment in that respect.
18:07
At the same time, you know, the standard needs work.
18:11
It's it's a lot of effort, which is for a small company like
18:16
ours, it was a lot of commitment to have one of us just dedicate
18:21
so much time to the standard. So developing the standard,
18:25
which has been a process over the last four years since Signal
18:29
started, we just got the final version of the standard out last
18:36
year. So it's been a long slog to get
18:38
it out there. And then the other part is to to
18:41
drive the adoption, right. So through talking on podcasts
18:45
or in conferences to through meetings with large enterprises
18:49
or technology providers, we've been able to get adoption for
18:54
the standards. So that's another big effort
18:57
that that I think helped the whole industry understand that
19:01
this is something that really helps everyone and the industry
19:05
forward. And the way Signal wins and all
19:07
this is because we are aligned in our products.
19:11
This is what we believe is the future of identity.
19:14
This is what we want to make the world see that if you do things
19:20
this way, you get a more secure future.
19:22
The way to implement it is using the standard.
19:25
So what what people are buying from Signal is not just the
19:28
ability to do the standard, but they're buying that continuous
19:31
identity philosophy, if you will, Like this is how you're
19:35
going to do things from now on. Did so I want to.
19:40
Ask you more or less like what's happening with the standards.
19:44
But I also want to reference A blog post that y'all did that
19:49
was pretty I think it went viral, right.
19:53
It talked about how Authzen Cape and shared signals framework all
20:00
kind of complement one another. In fact, the name is lines up
20:05
pretty much with that with the blog posts.
20:08
So what's happening with the standards and talk a little bit
20:12
about that blog post. Yeah, so.
20:15
One of the things that we are doing in the shared signals.
20:19
Working group is. We have conducted
20:21
interoperability events where we we draw a lot of the
20:25
participants to have their products work with each other
20:29
using the standard right. And this, this has been amazing.
20:33
Like Gartner has been so supportive of this.
20:37
They created like they gave us the venue for the first
20:41
interoperability event in, in London and I think 24 when it
20:47
first happened. And So what we were able to
20:52
prove there is OK, there's a product from Cisco, there's a
20:56
product from you know, Sale Point and from Signal Octa.
21:00
All of these work together, right?
21:02
But what it also drove was because Gartner has given this
21:06
venue as this opportunity, so many vendors went from just
21:11
waiting for each other to committing to having that
21:13
standard, right. So it was a really good moment
21:17
for us to be able to, you know, have that opportunity.
21:21
Now, what happened was the Odds and Working group did another
21:26
interop at last year's Gardner IM event in London.
21:31
And somebody was coming up to me and asking me, hey, so you're
21:35
doing shared signals and there's also this odds and interop.
21:38
Are these things competing with each other?
21:41
And I was like, Oh no, no, no, no, this is completely
21:43
different. And this is how it all works
21:45
together. And as I was saying that I was
21:48
realizing that maybe this is something that the world needs
21:51
to know. And that's how that blog post
21:53
came came about. And the Open ID Foundation
21:57
published at blog post which was co-authored by me and Henri
21:59
Gazette of of Topaz. And So what happened was once
22:07
that blog post was out backed, OPET was the global CSO of JPMC
22:13
posted it to his LinkedIn, which you know, was a very big moment
22:18
because he has a great following and it got reposted a number of
22:21
times. It was like by a large number of
22:23
people. And so suddenly now everybody
22:27
knew more about odd Zen and shared signals.
22:30
And we also talked about transaction tokens in that in
22:34
that blog post. And so all of that sort of came
22:37
to the highlight in a short period of time.
22:41
You know one things I'm. Realizing is as we're talking
22:44
about this like we've got listeners all over the world who
22:47
are you know maybe they just got into identity and are hearing
22:51
about this for the first time and trying to figure out like
22:55
have you been talking about shared signals for the past
22:57
decade No, right. I think we've been kind of in
23:02
like a more siloed type of IM approach and getting certain
23:07
capabilities in place. And when you look at the
23:11
identity industry is becoming more intelligent, more real
23:15
time, more continuous. And I think all those are the
23:19
things that like wow, they that's when you talk about
23:22
identity security rather than just identity management.
23:26
That's the core of it. So don't want to steal your
23:29
Thunder, but I wanted to kind of say, what is this like the at a
23:34
one-on-one level explanation? What is shared signals
23:38
framework? What escape?
23:41
Right, so the shared. Signals framework is, is a
23:44
versatile framework for you can say asynchronously delivering
23:48
security events between parties on the Internet, right?
23:52
So today you have HTTP for you know, synchronous communication
23:58
like you open a connection with a server, you immediately get a
24:02
response in the same, you know, at the same time, right?
24:06
What is missing on the Internet right now is an asynchronous
24:09
delivery layer, right? And shared signals provides that
24:13
the unit of communication and shared signals is a security
24:16
event token. It's assigned jot with a certain
24:20
structure and that's what you send over the shared signals
24:25
framework. What it gives you is basically a
24:28
reliable layer. So once you once you've sent
24:31
something to a receiver, you know that the receiver has
24:33
received it or you know that there was an error in sending
24:37
it. And so you can decide what to do
24:38
with that, right? So because of that reliability,
24:41
because of that asynchronous nature, it is a versatile way of
24:45
communicating signals that you might, you know, share with
24:49
other parties on the Internet. Now what Cape does is, although
24:56
the origin is very different, it didn't like emerge at something
24:59
on top of shared signals. Shared signals was drawn from
25:02
Cape and risk. So what Cape is now it's like
25:06
Jeff said, it's a, you know, continuous access evaluation
25:11
profile. So it's just a profile of the
25:13
shared signals framework. It defines a set of events that
25:16
are important from for zero trust.
25:20
You can say right. What it does is it basically
25:24
thinks of a session that you're having with a website, not as a
25:28
one time thing that, oh, now you've logged in.
25:32
So yeah, that's, that's it. You're you're on your own from
25:35
now on. That's kind of the view we had
25:37
when we just had Federated identity.
25:39
What Cape does is basically thinks of that session as a
25:42
continuous thing. And it it says that, OK, if
25:46
anything changes on one end on, you know, on a party that is
25:50
interested in that session, it should be able to communicate
25:53
that to the other party and the other party should be able to
25:56
decide what to do with that information, right?
25:58
So it's a non prescriptive way of describing changes that
26:02
affect your session. So an example of this is, let's
26:06
say I'm using a mobile phone to to access ACRM website, right?
26:14
And I've logged in using my identity provider.
26:17
There are several things that can change, like the mobile
26:19
phone can fall out of compliance.
26:21
It might be there might be a sort of malware on that phone or
26:26
it's not upgraded to the latest operating system.
26:29
There are known vulnerabilities. And so you want to restrict how
26:34
much of that CRM data you can, you know, download to that
26:38
phone. You can do that now because the
26:40
device management company or the endpoint management company can
26:44
actually send you a signal saying now this phone is not
26:48
compliant, right? It used to be compliant when the
26:50
when the user logged in. So these are the kinds of things
26:53
that you can enable using shared signals and using Cape.
26:57
So shared signals is this common layer.
27:01
Cape gives you 0 trust or session related signals.
27:06
Risk is the other set of events on top of shared signals, which
27:09
is RISK. Incident Sharing and
27:11
coordination is the the, the full name of that acronym.
27:17
It gives you account security signals, right?
27:19
So if your account needs to be purged or if your account, if
27:22
your password is compromised, you've detected it on the dark
27:26
web, you know that this password needs to be changed.
27:29
Those are the kinds of signals that you need.
27:31
You can send using risk. And now in the IETF you have the
27:34
scheme, you know, system for cross domain identity management
27:39
scheme which has events scheme, events standard, which can use
27:45
shared signals as as the transport.
27:47
So now you're seeing more and more of these come up on top of
27:51
shared signals. Yeah, I can see so.
27:54
Many used cases for those, I mean generally it's about
27:58
improving your security posture. But I'm wondering you know from
28:02
the I am, I am, it's kind of like the the old term we've been
28:07
using from the identity practitioner lens.
28:10
I mean should we be thinking about this as a solution for our
28:15
customer facing systems external or is this enterprise, you know,
28:21
our workforce, where does the technology fit best or where do
28:25
you see it the most? Right, so.
28:29
Shared signals, of course, is a very broad technology.
28:31
It can be used not just an identity, it can be used outside
28:34
of identity as well. But things like Cape and risk
28:37
can definitely be used in both consumer and, you know, employee
28:44
or internal use cases. I'll give you examples, right?
28:48
So I gave you the example of an employee accessing CRM on their
28:52
phone. That's an employee example.
28:55
Now I've seen banks who have disparate systems within the
29:00
bank's infrastructure, having consumers who are accessing the
29:04
bank services, know the bank at some point, you know, at some
29:08
part of their infrastructure knows that this user is, you
29:13
know, showing anomalous activity or this this high risk
29:18
associated with this user. They don't have a way of
29:21
communicating that to other parts within their bank and
29:24
they're using Cape. There's a risk level change
29:27
event in Cape that that they're able to send to mitigate the
29:31
risk associated with that session right now to within the
29:34
bank. So that's a consumer example of,
29:38
you know, using shared signals in Cape for consumers.
29:44
How is adoption? Going for SSF and Cape because I
29:47
feel like this is something that I've been kind of preaching to,
29:49
you know, my clients and others like, hey, start asking your
29:52
vendors about when they're going to support SSF.
29:55
How how's it going out in the real world?
29:58
OK, great. Great question.
30:00
So one thing I one news I would like to share is that and I
30:05
think September last year we released the final version of
30:09
Cape and shared signals. So one of the challenges we had
30:13
when we we're looking for adoption is that people would
30:16
say, well, the spec isn't final, right?
30:18
But now that's not the case. The other thing that happened
30:21
was that there was a CSRB report in I think March of last year or
30:25
before that where the, one of the recommendations was to use
30:29
shared signals, right? And now what we're seeing is
30:33
that Apple has implemented shared signals in their Apple
30:38
Business Manager. So if you want to integrate with
30:40
Apple Business Manager using a custom IDP, then you have to
30:45
have shared signals supported, right?
30:47
So that's one of the first places where you've seen, you
30:51
know, shared signals being adopted entirely in production.
30:56
Now you have, you know, there was an announcement recently
30:59
from Google about support for shared signals.
31:02
It's enclosed beta right now. So they are supporting shared
31:05
signals to using that you can revoke sessions in Google based
31:11
on signals that that might be external to it.
31:13
So device signals or identity providers sending Google signals
31:18
about session revocation, credential change and things
31:21
like that. And so, so those are the 222
31:25
big, like huge technology providers.
31:28
There's also Okta which has supported shared signals.
31:32
They have, I think they work with Apple of course, but they
31:36
also have other partners that provide them device signals and
31:39
all that using shared signals. You, you have JAMF, which is a
31:44
device management company that has shared signal support.
31:48
Omnisa, which is a device management company that used to
31:51
be a part of VM Ware and all is an independent company also
31:55
support shared signals. The sale point of course, which
31:59
is announced support for shared signals.
32:01
IBM has announced support for shared signals.
32:05
IBM actually has is as a part of the global Verify antenna
32:10
product. And then of course our company
32:14
signal support shared signals right from the beginning.
32:17
So yeah, I think adoption wise we are seeing a lot of good
32:22
support from good, you know, large technology providers.
32:26
It's in production in some cases, in some beta in some
32:29
other cases, but I think we're seeing the movement and having
32:32
the final standard helps in that direction so I can.
32:36
Certainly understand wanting to wait for that final standard to
32:38
be in place because you know, you don't want to build on a
32:40
moving target, but now the target is set.
32:44
You know, if, if you're going to make a plea to vendors out there
32:46
to say, hey, we're ready. Like what are some of the
32:49
benefits that a vendor gets being part of the SSF and and
32:53
Cape kind of frameworks that are out there?
32:58
I think it's not out of the question that pretty much soon
33:02
RFPs might require you to have shared signals because they're,
33:06
you know, if they're following guidelines from the CSRB or you
33:09
know, guidelines that might become be coming out in the
33:12
future, you might just have to do that as stable stakes, right?
33:16
So that's one thing. But beyond that, I think it's so
33:20
much easier to integrate using shared signals in Cape rather
33:24
than having to integrate with every other providers API.
33:27
I've been in so many meetings that, you know, previous jobs
33:30
that I've held where every company is saying, oh, you write
33:34
to our API and then we're saying, oh, no, no, no, you
33:36
write to our API and you know, it just goes nowhere, right?
33:40
And so you don't want to get into any of that discussion.
33:43
You just implement shared signals, you get a lot of
33:47
capability that you can use with a lot of different partners and
33:50
it becomes so much easier for them to to interoperate.
33:55
So that will be the primary reason why you would want to do
33:59
that. Like if you're, let's say
34:02
Zscaler, you know, I was just on a podcast with Zscaler and
34:06
they're, you know, they're also committed to share signals.
34:10
So all of these ecosystems are coming about which are using
34:14
shared signals to just exchange device signals, credential
34:18
related signals, you know, session revocation and all those
34:23
things I. Mean fundamentally.
34:26
It's, it's a great solution for a problem that I think a lot of
34:29
people have of how do these things talk to each other?
34:32
But I think it's almost like a little bit of a chicken and egg.
34:34
It's like, OK, first of all, you have to build it and then you
34:38
have to have people who want it so that people then build it
34:41
into their things. So you've got adoption from like
34:44
vendors, but then you also need your customers and your real
34:47
world. I am people asking their vendors
34:50
for it. So how do we get the word out
34:53
beyond, you know, the globally famous Identity Center podcast?
34:56
Hey, go ask for share signals framework.
34:59
But how do we educate the people to say, hey, this capability is
35:03
here it is finalized at least for a one point O how do you how
35:08
do we make them aware that exists so they can start asking
35:11
their vendors to adopt it? Yeah.
35:14
So I've been talking relentlessly about this for the
35:17
past, you know, five years since I wrote that blog in Google, or
35:22
maybe six years now, right? So I think that, you know, there
35:27
is a natural appeal to this, right?
35:30
People get it, like it. It doesn't take me a lot of
35:32
effort to explain to people why this is beneficial.
35:36
There's so much appeal to it, right?
35:37
This fundamentally, that is what drives people to saying, huh,
35:41
maybe I should be having this. And then that starts a sort of a
35:45
cycle of people asking the question to their vendors,
35:49
people asking their analysts about it.
35:51
The analysts get interested, you know, and just being
35:56
relentlessly sort of talking about it, telling people that
36:00
why this is important has been a big part of why we're here is
36:05
because otherwise you end up in this situation.
36:08
Yeah, it's a good idea, but nobody has done it, so why
36:10
should I do it, right? And having those
36:13
interoperability events crystallized a lot of that or
36:17
catalyzed a lot of that momentum.
36:19
I think so, yeah. It's a long slog.
36:24
It's like anything. Else, right, you have to
36:25
continually market it and make sure people aware of it, improve
36:27
on it. Where people think that, you
36:29
know, there's an update to the specs needed.
36:31
This was built and the era of humans, for lack of a better
36:36
term, is there application for SSF and Cape in the world of
36:42
agentic identity? So AIMCP, you know, things like
36:46
the A to A, right, All the different acronyms that are out
36:48
there. Yeah, I think.
36:50
Right now we are forming these really long chains in MCP of,
36:54
you know, one agent calling another agent calling another
36:57
agent kind of thing, like an MCP client calling an MCP server,
37:01
which in turn is an MCP client to another MCP server.
37:03
And you create these long chains of sort of work.
37:07
And there's no kill chain right now to it.
37:09
Like if somebody wants to say this employee is terminated,
37:14
just stop all of that right now. There's no way to do that.
37:18
I think gape could be a great way to do that.
37:22
Beyond that, I think it could be useful in, you know, the
37:28
communicating those properties changes.
37:30
Like let's say I was in a particular group when I started
37:34
and now, you know, I don't have access anymore.
37:36
And so I should communicate that information throughout that
37:39
chain because these tasks can be really long lived.
37:43
You want to have that capability to modulate the access as you as
37:48
you go, right? And shared signals can
37:50
definitely do that. You know Tulas.
37:54
You're kind of describing this. This just resonates with people.
37:59
I was like shaking my head, yes, because just the concept within
38:03
the first minute of you talking about, I don't need to know the
38:05
details to know like, oh, yeah, this totally makes sense.
38:10
I wanted to follow up on one thing that you're talking about,
38:13
which was talk to your vendors and let's get a little more
38:18
specific, what kind of vendors would this be your IDP, would
38:21
this be your Productivity Tools? Is the answer like yes to the
38:25
all the above or like who, who do you talk to, right?
38:29
I mean, obviously when you put it on an RFP, that's one thing.
38:33
But we're talking also about apps that probably we have in
38:37
the enterprise already. Yeah, I think.
38:41
Your SAS vendors, for example, let's say you're doing Federated
38:45
identity, log into the SAS, right?
38:49
How do you get your users out of there if something changes or if
38:53
something goes wrong, right? How do you modulate the access
38:56
that you have in that SAS system based on changes in your
39:00
directory or based on changes in, you know, maybe the user is
39:04
going off duty and you don't want that user to be accessing
39:08
the SAS system anymore. How do you affect that?
39:11
You use that, you use KP, you use share signals to do that.
39:15
And I think talking to your SAS vendors, talking to your
39:19
identity providers for sure, which by the way, there's a lot
39:23
of good news there that, you know, at least Okta is wholly
39:26
committed to it. We're also seeing some others
39:30
look at it favourably. You said productivity apps like
39:36
Google Workspace has just committed to it.
39:39
They've launched their private beta and they'll be supporting
39:41
it it soon. Your device management players
39:45
like Jamf and others on this are, are supporting it.
39:49
So all of your vendors, anyone who has a stake in the user's
39:55
session security should be adopting Cape and shared
39:59
signals. So.
40:01
If you're saying I'm adopting this particular device
40:04
management platform, you would ask them like what happens if
40:07
that device posture changes? How are you going to communicate
40:10
that downstream? And maybe they have a better
40:14
answer than shared signals or Cape.
40:15
But shared signals or Cape is is a good answer, right?
40:19
Because shared signals and Cape would be based on the standard
40:23
you're saying they may have a proprietary solution, right?
40:27
And so and generally, I think proprietary solutions are not
40:32
what you want to build your enterprise architecture on, but
40:36
I can save that for another show.
40:38
I think the standard is so important.
40:40
Where does the standard go from here?
40:42
Right. The we're sitting at the
40:44
beginning of 2026. Where's the need to go in the
40:47
next few years? Yeah.
40:50
I think one of the main things we're doing right now is
40:53
launching A certification program so that a a technology
40:58
provider can say my product is certified, interoperable with
41:03
Cape or with shared signals. What that gives you is the
41:06
confidence that, you know when you plug it in, it's not like
41:09
those two companies will say, oh, we both support Cape and
41:12
they actually don't talk to each other because they're doing
41:15
something different about about it.
41:17
That certification program will help you be assured that if you
41:21
adopt that kind of product that is certified, then it's going to
41:25
work with anything else that is certified.
41:27
So you know, that's what we're launching right now.
41:31
Initial launches for transmitters will be working on
41:34
the receiver part soon after that, there's a bunch of stuff
41:38
that we punted on in the V1 of the standard.
41:42
These are important things, but not critical to the success of
41:45
the standard right now. But those are the things that we
41:48
will be working on soon after. I think what it will give you is
41:53
much more capability in terms of what you can do with shared
41:57
signals and Cape and we'll be working on that going forward.
42:01
So those are a couple of things that we are we're doing in the
42:06
shared signal working group right now.
42:08
Yeah, the certification. Program seems like you answered
42:12
my question right. So, so certification is for not
42:15
for people to be home experts, it's for companies to have their
42:18
products certified as SSF and Cape compliant right.
42:26
So it reminds me a lot of what Fido Alliance is doing.
42:31
And I think it's kind of the, the breaking point for them was
42:35
when big tech, especially like device manufacturers, the
42:40
Apples, the Googles of the world, big platform players,
42:44
Microsoft, etcetera, got behind the Fido 2 standard and pass
42:52
keys and things like that. I would imagine that the
42:54
certification program, you know, it's, it's a big deal, right?
42:59
There's going to be a lot of people, a lot of organizations
43:02
that want to get their platform certified.
43:06
Yeah, I, I. Certainly think so that many of
43:12
these companies are on the board of Open ID Foundation.
43:14
And so I would expect them to be very receptive to having the
43:18
certification program. Yeah, yeah.
43:21
And I'm sorry, I think you you alluded to it, but what kind of
43:25
dates do you have lined up for when the certification program
43:28
is going to be launched? And if people have questions
43:31
about the certification program, should they?
43:34
Who should they reach out to? Right, so you can always reach
43:39
out to me at the Open ID Foundation, like the Shared
43:42
Signals mailing list about certification, but you can also
43:48
watch the Open ID Shared Signals web page for an update on
43:53
certification. We'll be publishing A blog post
43:55
when it comes out, and I want to be super conservative here and
44:00
saying that in the first half of this year, in 2026, we will be
44:04
having a certification program for shared signals and Cape.
44:11
So that's exciting news. I want to ask a question because
44:13
I feel like maybe it's kind of got lost in all the news of SSF
44:17
and Cape is what happened to Risk RASC?
44:20
Yeah. So risk is it's actually doing
44:24
pretty well. It's something that is a little
44:26
bit of, you know, it went into the background a little bit
44:31
because everybody was interested more in Cape.
44:34
But if you look at irsandid.meandithinkthelogin.gov,
44:42
they're all using risk to exchange security signals about
44:47
accounts. So if you've created an IRS
44:50
account, then your account provider is going to send risk
44:55
signals when let's say you're, you change devices or you're,
44:59
you know, you report your passkey as being like
45:02
compromised or you know, your device has been wiped or
45:05
something like that. They will use risk to
45:07
communicate those, those signals to each other.
45:10
So that is happening right now in production.
45:14
Is it fair to say? Like if we say SSF, it kind of
45:17
means SSF Cape and risk is sort of like a bundle or is it always
45:21
separate? SSF can be used with Cape, can
45:27
be used with risk, can be used with scam events.
45:30
The certification program right now that we're working on is
45:34
specific to Cape, to few events in Cape because those seem to be
45:39
of most interest to the community that that is
45:42
interested in the certification. But yeah, I've had discussions
45:46
with large providers about risk and having a risk certification
45:50
program as well. So when you talk generally about
45:54
SSF, you're either talking about the platform where which gives
45:59
you the asynchronous capability or you're talking about SSF in
46:03
the context of Cape or risk or skim events, right, So.
46:09
So I have a. Something I'm sitting on because
46:12
I, I wasn't sure if I'm going to make a fool of myself and how I
46:15
asked this, but I'm going to do it anyway because I'm trying to
46:18
figure out how does this thing work, right?
46:21
So you've got say, I'll use an example.
46:25
So you have your sales force application and that's going to
46:28
be one of those systems that sends signals.
46:32
So I'm wondering, does it have? Some sort of a?
46:36
Bus where it puts the signals and you go out and you fetch
46:38
them. Does it use some kind of broker
46:41
so that the broker gets it and sends it or is it point to point
46:44
like Salesforce has to send it to your IDP for example?
46:50
Yeah. Yeah, great question.
46:52
So it is a point to point transport.
46:54
So what happens is that when you have two parties that share a
46:58
user, let's say Salesforce and you know, Okta, for example,
47:02
right? And Salesforce says that I'm
47:06
interested in any changes. Like let's not talk about
47:10
Salesforce because they don't actually support this right now,
47:12
but let's talk about Google for example.
47:15
So let's say Google is the service provider where you have
47:18
Google Workspace and you're using Docs and Drive and all
47:21
that. And Google wants to know if you
47:24
have changed your password at your identity provider, which
47:26
might be Octa, right? And So what Google will do is as
47:31
they will want to be a receiver of those signals, right?
47:34
So what they'll do is they'll call an API provided by Okta,
47:38
and the API is what is defined in the shared signal standard,
47:42
which is your stream management API, right?
47:45
And they'll say I want to create a stream with you and I want
47:49
information about these events like credential change or device
47:54
compliance change or you know, session revoked or you know,
47:57
whatever else they're interested in.
48:00
Whenever that happens, you can send me that event over the
48:04
stream. So there's a point to point
48:05
stream that is created between Okta and Okta as a transmitter
48:11
and Google as the receiver. And so when let's say Okta has
48:15
that event, they will send a security event token over the
48:20
stream to Google. And there are two transport,
48:22
there's a pulling transport or a push transport.
48:26
So Google can either pull for new events or they can push the
48:30
Octagon, push new events to Google and they get
48:34
acknowledgements about whether that event was successfully
48:37
delivered or not. And based on that Octagon decide
48:40
whether or not to resend that event and things like that.
48:43
So there's a reliability layer built into all that, but it's a
48:46
point to point transport between a transmitter and the receiver.
48:51
And they agree on which events they want to exchange, they
48:55
agree on which subjects they want the events about.
49:00
You can also do things like verification of the event
49:03
stream. So the Google can periodically
49:06
tell Octa, hey, I want to make sure that the stream is still
49:09
alive. So send me a verification event.
49:12
So, and when Octa receives that, they're going to send you a
49:15
verification event. You get the verification event,
49:17
you find out, OK, the stream is still alive, right?
49:20
So these are the kinds of things that help build confidence that
49:23
you're not going to miss a signal because it's it'll be
49:27
kind of disastrous if you had a device compliance change event
49:30
and you, you send that this device was compliant and now
49:34
it's non compliant and the receiver never received it.
49:38
And so you're relying on that to assert your posture for the
49:44
user. And if you if you miss that
49:46
signal, it's it's going to be a very bad thing from a security
49:49
perspective, which is why the reliability of that shared
49:52
signals framework transport is so important.
49:56
Is that where the certification comes in, is making sure that
49:58
that is working as designed? Yeah.
50:01
Having all those features is a part of that certification
50:04
event, a certification program. I feel like there's so much.
50:09
To learn here and you are kind enough ahead of our call to send
50:12
like a bunch of links and I'll have links in our show notes for
50:15
people to check out. But if I am just getting into
50:18
this space right now, I'm not a spec person.
50:22
What's the fastest? Way or what's the what's is
50:24
there a YouTube video A blog article or something that can
50:27
kind of get me up to speed on SSF ape risk all that kind of
50:32
stuff this there's a. Few YouTube videos I have sent
50:37
you the links and that when I explain just what escape and
50:40
risk. But what I would recommend is go
50:42
to the Cape dot dev website, which is helps you.
50:47
It started as something that helped you test your transmitter
50:50
and a receiver implementation. So if you had a receiver, you
50:53
needed to have a transfer that would send you events so that
50:55
you could you could know that you can receive them and vice
50:59
versa. So it started as that, but now
51:01
it has a help section. It has, you know, details about
51:04
like what is SSF and what is Cape and it even has a white
51:08
paper about Cape best practices. So it can help you like plan
51:12
your strategy as far as, you know, adoption, implementation
51:16
and all that is concerned. There's also open source, which
51:19
you can use. So Cape dot dev is actually a
51:21
pretty good resource in addition to the videos that I talked
51:24
about. So I have those links in.
51:27
Our show notes for people to check out and that website for
51:29
people to start at is Cape dot dev CAEP dot dev.
51:34
That'll put. That'll put you.
51:35
Right where you need to go. So I feel like we could probably
51:39
go on for hours, but we're not going to do that.
51:41
Direct people to websites. Not everyone's able to go to,
51:44
you know, conferences and kind of check out the talks that you
51:47
and Ian and Tim and Sean and Andrew and Shane and others have
51:53
given sort of on this topic. But I would highly encourage
51:55
people this is the year to like really understand it because
52:00
it's such a big foundational part of what continuous identity
52:03
is all about, which is another big trend that we're seeing in
52:05
the space. So definitely encourage people
52:07
to go check that out. I want to leave the conversation
52:09
to hear on a lighter note as we always do.
52:12
And I am feeling very anxious because I have not been out of
52:19
my house sort of area in two months.
52:23
I have not been any trips I've been since I got back from
52:26
Gartner. We adopted a puppy so that has
52:27
taken up almost all my time. Weather here has been sort of
52:31
weird on the East Coast with like different storm systems
52:35
coming through. And so my first trip is actually
52:37
next week. I'm headed out to a conference
52:39
in Richmond, VA, and that's my first time in two months going
52:44
anywhere, which is a long time for me.
52:45
Usually I'm on the road all the time.
52:47
But you mentioned that you had gone somewhere recently in which
52:50
I find very fascinating. Tell the audience where you went
52:53
and tell us a little bit about this trip.
52:57
We went to Kenya and we went specifically to go to some of
53:02
their national parks and watch the big games and it was a
53:07
blast. It was like unbelievable.
53:10
Like you enter the park and you're surrounded by these like
53:14
flocks of like large herds of like, you know, wildebeest and
53:20
zebras and elephants and whatnot.
53:23
And it's these, you know, really huge vistas of open land and
53:29
those beautiful trees that they have there.
53:32
It was just fascinating. But the, the, I guess the
53:36
highlight of the trip was when we were in Masai Mara, one of
53:40
their, you know, national parks, We, we saw a bunch of lions
53:47
attack, hunt down a, a wild Buffalo.
53:51
And it was, it was fascinating how they strategized and how
53:56
they isolated 1 Buffalo and then how they literally like trick
54:02
the Buffalo into thinking that there was just one little lion
54:05
that it was trying to fend off. And it pulled that Buffalo into
54:10
this area where the other lions were waiting.
54:13
And then they all sort of jumped on it and the poor thing was
54:17
fighting them for about 1/2 hour.
54:21
You wouldn't believe the amount of effort it took to just pull
54:24
down that Buffalo. Like for, for like the four
54:27
lions that were on it. Like it was, it was pretty
54:30
dramatic. And you know, as soon as that
54:33
starts happening, you have these vultures circling around in the
54:37
sky and you have the hyenas kind of coming closer and closer.
54:41
And finally, when the Buffalo comes down, you, you had these
54:46
lions like, you know, start eating it.
54:48
And after a while the hyenas chased the lions out and then
54:52
they started eating the Buffalo. And then the vultures came in
54:55
and it was the whole deal. It was like, wow, you know, I
54:58
didn't imagine I would, I would be seeing something like that
55:01
from like a distance of 30 or 40 feet, so.
55:06
Yeah, it. Was unbelievable.
55:10
That's pretty close. It's like this is probably not a
55:13
thing for everybody because I think people might get kind of
55:16
squeamish around that kind of thing.
55:18
But I, I. Right of.
55:20
This is, this is you're observing nature.
55:22
This is what's happening, Yeah. And.
55:25
It's and it's cruel. It's like it's yeah, I couldn't
55:29
watch the half of it. Like I was like, OK, I don't
55:32
want to see anymore, but I was there.
55:35
Did you go with your? Family.
55:36
Were there others like how did this work?
55:38
Yeah, I went with. My my 2 grown kids and my wife.
55:41
And so, yeah, we were, we were all there.
55:44
We had flown in from different parts of the US and so we were,
55:48
we met there. So tell me about the trip.
55:51
Like where? Did you come like, where did you
55:52
meet? Into Africa?
55:54
So we. Like my younger son lives in New
55:58
York and so we met in Amsterdam and we had the same flight from
56:04
Amsterdam to my older son lives in San Francisco, which is close
56:08
to where I am, hence that little thing there which is my son's
56:12
gift to me. And so we started our trip in
56:19
San Francisco airport and the three of us, my wife and I, and
56:23
my older son flew from San Francisco.
56:26
We met in Amsterdam to my younger son.
56:30
We, he almost missed the flight, but we fortunately were able to
56:34
do that. And then we went to Kenya and
56:37
then we went around in in a Jeep for I guess about 8 days.
56:44
We were like driving continuously for 6-7 hours for a
56:48
few days like because all these parks are in various different
56:52
places and you know, so, so it wouldn't be a.
56:55
Question, on this show at least about food, what was the best
56:58
thing you ate on that trip? Oh.
57:02
I'm not, I have dietary restrictions so I I eat chicken,
57:07
but mostly vegetarian, right? There's plenty of.
57:10
Good stuff out there thing about this.
57:12
Trip was that there's a huge Indian community in Kenya, if
57:15
you will believe that. And so you had you had a live
57:20
dosa station in the in the hotel, which is like, you don't
57:25
even get that in many hotels in in the US, Like you get that in
57:29
Kenya. And so, yeah, it was as far as
57:33
local food is concerned, there were a bunch of dishes in the in
57:37
the buffet. I don't know their names, but
57:38
they were awesome. Like some of the exotic fruit
57:41
were, were like something that I'd never had.
57:46
It was, it was a very different experience.
57:49
Yeah. Jim, you're a world traveler.
57:51
Would you do this? Well, I've heard Nairobi.
57:54
Is a beautiful city. I definitely would like to go
57:58
there, absolutely. I.
58:03
I so I want to bring up the great Frank via Vicencio, right?
58:07
He told me a story where he went on safari, I think it was in
58:10
Zimbabwe, and very similar story to what Atul just mentioned.
58:14
And he mentioned that like, because I can barely watch this
58:18
on TV, right? To actually be there, smell the
58:22
smells, hear every sound, no commercial breaks, right?
58:26
I mean, like, you're in this thing.
58:29
And he said he and his wife cried.
58:32
I believed it. I did have a question for you at
58:36
all. So one of the things I've seen,
58:38
it was like on YouTube was like, so there are these tourist
58:42
vehicles, right? And they're like looking for
58:44
something like this because that's what everybody came to
58:48
see, right? Everybody's on safari.
58:50
They want to see nature unfold. So then you have one of these
58:55
great hunts going on, and then it's like 10 of these vehicles
59:00
kind of like make a circle around the hunt.
59:01
Was that what it was like? Yeah, it was like.
59:04
That there was a probably. And at some point I felt like
59:08
the lions actually used that to their advantage, like because,
59:14
you know, there was this massive herd of buffaloes and there was
59:18
a bunch of lions trying to approach that herd.
59:21
And so everybody on the park, like tourists like us felt like,
59:25
Oh yeah, there's a hunt going to happen now.
59:27
And so everybody had their jeeps, like come in there.
59:29
There was 50 odd jeeps there, I think.
59:33
And and then the lions kind of use that as a way to deflect
59:40
because everybody's attention was in One Direction and the
59:42
hunt actually happened right behind us.
59:45
So they use that to separate out the herd and to I think what
59:53
they did was because everybody's attention was in this way, the,
59:57
the, the buffaloes on the other side kind of got separated out
1:00:01
or something and then they went and attacked them.
1:00:04
So I think the Lions actually ended up using.
1:00:08
The situation to. Their advantage so.
1:00:13
But yeah, there were a lot. Of people, Thanks.
1:00:17
Well, here's. Here's how I'm going to make it
1:00:18
a lighter note this If there ever was a real world scenario
1:00:22
for shared signals, framework and risk events, those buffaloes
1:00:25
should have been on that. There you go, lighter.
1:00:30
Note achieved, I hope. OK, well on that terrible
1:00:34
lighter note, no offense that not not for you.
1:00:37
Until they're just a terrible segue, we're going to go ahead
1:00:41
and leave it there for this week.
1:00:43
Thank you so much for joining us.
1:00:44
I'll have your LinkedIn connection information along
1:00:46
with just a handful of links around Cape and SSF and risk and
1:00:51
AI community, AI identity management community group for
1:00:55
people to check out. And thank you again so much for
1:00:57
joining us. So let's see what else?
1:01:00
Yeah, check our website, idcpodcast.com.
1:01:02
We've got all of our discount codes there for the conferences
1:01:04
that are coming up. Hope to see you there.
1:01:06
We'll be at EIC. You'll be Identiverse.
1:01:08
I think you got other things in in the works and plans and
1:01:10
things like that. So thank you so much for liking
1:01:13
and subscribing and sharing with our friend or an enemy.
1:01:15
As long as they're listening, I don't care who it is and leave
1:01:18
it there. So thanks everyone for watching
1:01:20
and or listening and we'll talk with you all in the next one.
1:01:24
Thanks. For having me.
1:01:27
You've been listening to Identity at the Center.
1:01:30
We hope you've enjoyed the show. Make sure to like, rate and
1:01:35
review, and we'll be back soon. But in the meantime, hit the
1:01:38
website at identity@thecenter.com.
1:01:42
See you next time on Identity at the Center.