Latest / Identity at the Center / #323 - Identity Security with Silverfort’s Hed Kovetz

Transcript

#323 - Identity Security with Silverfort’s Hed Kovetz · Identity at the Center

0:00
The old perimeter is gone and people are walking from
0:02
anywhere. And I think there's more
0:04
understanding even at the even at the board level and the CEO
0:07
level that identity is, is critical.
0:10
They can actually understand it. I think more than themselves.
0:13
Some other areas of security they, they, they get it like
0:15
they think that's one of the advantages and also
0:19
disadvantages of identity. It meets the end user more than
0:21
any other category of security. Like every, every employee,
0:26
every, you know, the CEO logs in and has to do like multi factor
0:30
authentication and all these things.
0:31
Like they actually see them as opposed to some of the stuff
0:34
that like other categories where it's much more behind the
0:37
scenes. So they understand the
0:39
importance and the way to put more budgets on it.
0:42
I, I hear from a lot of companies that identity is now
0:44
like the number one priority or the number one budget item,
0:48
which is, which is great because I do believe, and I'm, I'm, I'm
0:53
biased, but I, I honestly do believe that it is the most
0:55
important element of security these days.
1:03
This is identity at the centre if it has anything to do with
1:09
IAM. This is the go to podcast now
1:13
your hosts Jim McDonald and Jeff Stedman.
1:23
Welcome to the Identity of the Center podcast.
1:25
I'm Jeff, and that's Jim. Hey, Jim.
1:26
Hey, Jeff, how are you? Not so bad yourself.
1:28
Good. What do you think of the get up
1:30
today? I'm waiting for the magic tricks
1:33
to start. Like is there a a dove going to
1:35
fly out of your? Why not?
1:37
I don't have the magician jacket.
1:39
I've got everything else. I don't have the hat either, but
1:42
I've got a cowboy hat just right from Texas.
1:44
Yeah, we're at the Gartner Gartner IM Summit here in Texas.
1:48
The other thing is you know other magician, maybe dealer at
1:51
like a casino table with the other option it's.
1:53
In like 1876 or something like that.
1:57
That's right, you've seen the movie A Tombstone.
1:59
You know you're sitting there and Whiter walks in and takes
2:02
control of things. Yeah, yeah, no, actually I've
2:05
been watching the series, Deadwood began, which I remember
2:08
the first time I watched it, like thinking, Oh my God, that's
2:11
so violent. And this was TV for 20 years ago
2:14
and now? Game of Thrones had not yet
2:16
aired at that point. Yeah, yeah.
2:17
No, we've been hardened. Well, you look like you belong
2:20
in the Deadwood sort of environment, right?
2:23
You got the beard, you got the long hair.
2:25
I could see you absolutely with a cowboy hat.
2:27
You pull that off for sure. All right.
2:28
I'm going to wear one tomorrow, so we're going to set for that.
2:31
That'll be our first episode of the year.
2:33
This is going to be our last session.
2:34
So this is the year. Last episode of 2024 and it's
2:38
been a ride. Another big year for us.
2:40
I'm sure we're going to do a lot of things.
2:41
We're going to talk about a bunch of different things today.
2:44
But yeah, this is it for us. And we're going to take a couple
2:47
weeks off and then, yeah, come back.
2:48
I think first or second week of January I can't move up the
2:51
schedule. Makes sense.
2:52
One last conference, one last episode.
2:55
So I think we should jump into it.
2:57
What do you think? Yeah.
2:58
So I mentioned we're at the Gartner, I am Summit and
3:00
definitely want to give a shout out to RSM, the ones that are
3:02
helping make as possible. Also shout out to Silver Fort.
3:05
We are in their suite right now. Sweet, sweet, sweet suite.
3:08
And we're sitting here with Hed Kubetz.
3:09
He's the CEO and Co founder of Silver for It.
3:11
Welcome back to the show, Head. Thank you.
3:13
Great to be here and will be an honor to be here for the last
3:17
episode of the week of the year. Just of the year, we're going to
3:19
keep going until next year. It was so we actually met the
3:23
first time at a Gartner a couple times ago.
3:25
So it would have been Gartner. I think at the end of 2022.
3:28
We did Episode 166, we talked with you, we learned more about
3:32
any threat detection response at ATR.
3:34
We're definitely going to get into probably saw that and then
3:37
more today, but definitely encourage people to go back and
3:39
check out episode 166. We're not going to make you
3:42
relive your, you know, tell us how you got that any story,
3:45
people go back and listen out, but why don't we start with,
3:47
hey, what's new? Like silver fork has been the
3:49
news, you know, a couple times over the last year and a half or
3:52
so, two years almost. What's new with silver fork?
3:55
What's been going on in your room?
3:56
Yeah, there's been a lot going on.
3:58
I mean we're lucky to to really see huge course in this time.
4:02
So you know, and a lot of exciting things.
4:05
So we just announced a couple of weeks ago that we acquired the
4:09
company for the first time, which for me personally and for
4:12
the company is you know, a big step.
4:14
We acquired a company called Resonate that is focused on
4:18
cloud identity security. Great company, great people.
4:22
And now, you know, we're really kind of integrating the
4:25
platforms together. So that was some recent really
4:29
exciting news. Earlier in the year we we
4:31
announced a big funding zone. So we raised the CSD pound of
4:35
$116 million. That's it.
4:39
So yeah, that's, you know, we had to figure out now what do we
4:43
do with all this money? Like we need to build a big
4:45
company I guess. You need a podcast.
4:49
Yeah, yeah. It's, it's, it's exciting.
4:51
So a lot of things going on. And then just today we announced
4:56
a new product that we that we released on privileged access
5:00
security. So really a new way to secure
5:04
how, you know, privilege access kind of fit is protected across
5:08
all the different environments. So there's the lot going.
5:11
And sounds like it. And there's a lot of money
5:13
pouring into the space. So I'm curious 'cause you were
5:16
kind of talking before I get recorded, like do people really
5:18
care about the entrepreneurial side of, of identity?
5:21
I'm interested in it. So I'm going to ask questions
5:23
anyway. So whether or not people
5:25
listening are interested, I want to get into it a little bit.
5:28
You know, having founded and run this business and now you've
5:31
made an acquisition to resonate, I guess what is it like to start
5:35
something up like that? And 2nd follow up question is
5:38
there's a lot of money being raised yourself one of them.
5:41
What are VCs looking for when it comes to products in the space?
5:45
Because it seems like identity is so hot, right?
5:47
Now where it's become a lean house festive.
5:48
Yeah. So first of all, it wasn't
5:51
always hot. I have to say, you know, I
5:55
probably had a different experience than what
5:57
entrepreneurs that start today probably see.
6:00
And, you know, that was how do. But I guess I'm also thankful
6:05
for what kind of how it helped us mature.
6:08
When we started eight years ago, it was a pretty tough
6:13
experience. I mean, we went to a lot of VCs
6:16
to talk about what we want to do.
6:17
We want to, you know, do something in identity security.
6:20
We had a couple of ideas and the reaction we got from almost
6:24
every VC was that's just not an interesting category.
6:28
Identity. What do you mean like
6:30
authentication? And it's like, isn't that like
6:33
20 years ago? That was already done.
6:36
Companies, you know, already have that and we were trying to
6:39
explain that yeah, the the they did that, but then look at how
6:44
many attacks of still using compromised identities.
6:47
I mean, it's only glory. So something must be missing,
6:49
right? And we want to solve that.
6:53
Luckily, we were able to find someone who who actually
6:56
believed in that, but it wasn't easy.
6:59
And you know, if you want to know a bit about the, the
7:02
entrepreneurial experience, that's like a really tough part
7:06
of it, like hearing no so many times and having people doubt
7:11
what you do and is it even worth your time and obviously their
7:15
money. It's tough.
7:16
And, and one of the biggest tasks I think is you have to get
7:21
up after every time that someone tells you it's not a good idea,
7:25
it's not the way to work. You need to somehow get yourself
7:29
back to, to optimism, you know, because that's kind of the key
7:33
to, to building a startup. You need to be optimistic and
7:36
you need to get back on your feet every time.
7:40
And luckily we did. We, you know, got up enough
7:42
times to the point for now, it's actually, it's happening and
7:46
it's growing and it's, it's, it's doing really well.
7:48
But I, I don't forget that beginning it was a much
7:53
different time. Now it is getting very hard
7:55
though. So I'm, you know, glad.
7:57
I think it's, it's the right thing.
7:59
I I think when you walk around the exhibitor hall at this
8:03
conference, you just, I mean, I'm blown away by how many
8:07
start-ups there are. Yeah.
8:09
Side by side with the big players in the space.
8:12
What was your impression? Yeah, there are a lot of
8:14
start-ups. I think it's a very good thing
8:17
because the innovation will mostly come from the start-ups.
8:20
I mean, you, you hear about some of the big vendors trying to do
8:22
new things. It, it can happen to a degree,
8:26
but I think that just like in any other category, the, the
8:30
real disruptive things will come from start-ups.
8:33
They just have a better ability to take the risk.
8:36
You know, I, I used to open a big up and I'm so many people
8:40
know that, you know, even if you come up with new ideas, the
8:43
ability of a large company to just throw away everything
8:46
they've done and, and go for this whole new approach, it's
8:50
hard. You know, they, they need to
8:51
meet the quarterly goals and it's just harder to do when you
8:55
start a company, you could take a huge risk.
8:57
And you know, I remember we, we thought, hey, you know, either
9:00
this will work and we'll have something amazing, or it will
9:02
not. And you know, let's fail fast,
9:04
you know, and figure that it's not the right thing and go do
9:07
another thing. That's a risk that you can only
9:10
take as a, as a startup. So a lot of startups are now
9:14
kind of paving the road in, in, in many areas of identity
9:17
security, which is great. I mean, we are kind of lucky to
9:23
be in that sweet spot. I I feel between being still a
9:26
start up that can move fast and innovate and build.
9:29
But also we're big enough at this point that we can really,
9:32
you know, execute when we have a big customer base and we're
9:35
trying to enjoy both worlds for as long as we can before we
9:38
become a, a big corporate. And I think at least, at least
9:42
like now, it feels like it is in that sweet spot.
9:44
How do you defend against that position of, OK, that spirit of
9:48
innovation and entrepreneurism versus, you know, big company
9:52
and very slow to react and I got to imagine that would probably
9:55
keep you up at night. Yeah, it's one of the things
9:57
that's gonna be the most to to lose that innovation.
10:01
So we invest in it a lot. I think that especially this
10:04
year, I think everything that is happening in the space, all
10:08
these new start-ups that have these really cool new
10:10
technologies, what kind of a wake up call for us.
10:12
We need to be ahead of the market not only because we we
10:16
are getting the, you know, all the traction in the, the big
10:19
customers, but also in, in innovation.
10:21
So this year we've actually innovative more than ever
10:24
before, more than in the early years we've had.
10:26
And we built, I mean it across some organizational adjustments,
10:31
right. So we built really good
10:34
innovation team and we divided our R&D into smaller teams that
10:39
each focus on a different port. So there's a team building ITDR,
10:43
there's a team building, you know, privilege access security.
10:45
It was a team building, not human identity, security,
10:48
ISPMMFA, all these different things now have smaller teams
10:54
that can operate more like a startup.
10:56
Because what happens in a big or even medium sized companies,
11:00
you, you get this huge R&D organization at some point and
11:03
every person does the tiny piece of it.
11:06
So they use some of the motivation and, and definitely
11:08
the innovation by dividing it and, and keeping small teams
11:12
that act more like startups. And, and if you manage to build
11:16
the platform as a tool platform, I mean kind of shared
11:21
infrastructure that all these products can operate on, but
11:24
they don't need to worry about it.
11:27
You know, like in all of the enterprise features, I mean, you
11:29
need, you know, you need to be with security and compliance and
11:33
scale all these things. If you if you manage to push
11:36
them down to a certain platform and build all these products on
11:40
top, you can still keep those as, as almost like small
11:43
start-ups. And we've managed to to do it
11:46
this year, which was a big organizational effort, but I
11:50
think it was worth it. And now we're moving very fast.
11:54
And still, you know, I see start-ups that are doing really
11:56
cool things and I think it's great.
11:59
I mean, we all, I think we've been enough time in this market
12:03
to know by now that it's not a bad thing.
12:06
You know, I think that it was much worse being back then at
12:10
the time when nobody thought it's even interesting, right.
12:12
So I actually prefer to have a lot of start-ups then pushing us
12:15
to innovate, pushing us forward, pushing the industry forward
12:18
over, you know, if you look five years ago that nobody thought
12:22
it's even that interesting you. Mentioned identity security a
12:27
few times and as I walked in vendor hall, it's like identity
12:30
security, identity security. And it's like, yeah, under that
12:33
company, they have been doing the same thing for five years,
12:37
but now they're calling it identity security.
12:39
Is that just that's just what happens, Just like zero trust.
12:42
I mean, everybody's now zero trust.
12:44
And then that's not popular anymore.
12:47
Now it's identity security. I mean, I think identity
12:50
security has a real meaning, right?
12:51
So yeah, in your mind, what is that real meaning?
12:54
I, I think that identity security is, is one of the best
12:56
things that can happen to this industry is that, that
13:01
platformization, let's call it, because if you think about the,
13:06
the history of identity security for many years, it was just a
13:09
feature of the identity infrastructure.
13:11
I mean, we talk about IAM, right, a lot IAM, which to me is
13:16
the identity infrastructure, you know, it manages your identities
13:20
and, and it's, it's not really a, a security offering.
13:24
I mean, to me it's more like, you know, it's related to
13:26
productivity to, to IT security was always a feature in that.
13:32
So if you had like Active Directory or Octa or Entrac, you
13:36
might have some security features in there.
13:40
I think that what's happening now is finally these security
13:43
features are decoupling on the infrastructure to become the own
13:46
stand alone layer that that can operate on top of all of these
13:51
identity infrastructure solutions.
13:53
And that's really important because as long as there are
13:55
features, they only see their own island.
13:59
If you think about it, I can log in to Okta and I, I failed the
14:05
authentication, right? It's not me, right?
14:07
I failed the MFAI can still then go and log in to enter or to the
14:13
onto MAD and nobody will stop it because those solutions don't
14:16
even talk to each other. It's it's all islands that are
14:18
are looking at security as a silo.
14:21
And I think that only by decoupling security from it and
14:24
creating a layer that understands the whole picture,
14:27
all these silos, all these islands, you can really do
14:29
security effectively. If you think about it, it
14:32
already happened in other categories of security.
14:36
Think about the cloud security. In the early days, you were
14:39
buying cloud security from AWS and Azure and Google.
14:43
And after a while people understood it doesn't make
14:45
sense, you need it to operate on all the clouds.
14:48
So then companies like Whiz came and created a cloud security
14:53
platform. You don't buy it anymore from
14:55
the cloud providers. Same for Android, like you don't
14:57
buy Android security from Lenovo and Apple and Dell, you might
15:01
form a company that can work on all the endpoints, all the types
15:04
of endpoints. I think the same is finally now
15:07
happening to identity. And that is to me identity
15:09
security, it's a stand alone layer that can operate on top of
15:13
all the islands of identity infrastructure.
15:16
And that's the only way that we can ever, I think make this
15:19
effective and and really be ahead of the of the attackers.
15:23
And it just took longer in identity, but I think it's
15:27
finally happening, which is really exciting.
15:29
Is Identity a platform in your mind, or is it a component of
15:33
something else? Identity security or in general
15:37
identity? Identity.
15:39
I think it's absolutely a platform.
15:42
I think that identity is one of the biggest elements of
15:46
security. And also ITI think that in many
15:50
ways identity is becoming the most important element.
15:54
If you think about it now that everybody's walking from
15:56
anywhere and they use devices that are not necessarily the
16:00
company's device. I mean, if I can log in from a
16:04
cafe in Thailand using my device, and as long as I prove
16:09
who I am, I'm part of your organization, your virtual
16:12
network, it means that the identity is pretty much the the
16:17
only remaining line of defence. So I think that the identity is
16:20
becoming, I mean at, at the centre right there's.
16:24
A little bit of a leading question, yeah.
16:26
Yeah. You did a webinar recently with
16:27
Jim around that idea of identity being at the side of security.
16:31
Oh, it's very true. I I think that is becoming the
16:33
biggest piece really. And I think that people finally
16:35
recognize it. So what is the difference
16:37
between I AM and Identity security?
16:41
So I am. To me is, is the infrastructure,
16:45
it's managing the identities. You know, like when you start in
16:51
a company, they need to create an identity for you.
16:53
And it's almost like an an IT of an agile feature.
16:57
I mean, it doesn't mean necessarily security.
17:00
There's a different question of how do you secure that identity?
17:03
How do you prevent someone from stealing it?
17:04
But the identity itself is not a security element.
17:08
It's just, you know, it's just like saying that your device or,
17:12
or the data or the cloud, our our security, no, the, the
17:15
pieces of the, the, you know, the infrastructure, the digital
17:19
infrastructure that you have. And then there's a question of
17:22
how do you secure it? So I think that the IAM the
17:25
infrastructure is something that includes single sign on and it
17:31
includes like on boarding and off boarding of employees.
17:35
That includes what do people have permissions to access?
17:40
I think it also includes a password less authentication,
17:43
which many people view as a security feature.
17:46
I I don't think so. I think that, I mean, obviously
17:49
password less involves authenticity with some second
17:51
factor that's security, yes. But removing the first factor,
17:56
that alone is not a security functionality, It's actually a
17:58
user experience functionality. So I think a lot of these things
18:02
are to me part of the identity infrastructure.
18:04
That's what companies like Octa and Bing and Microsoft are doing
18:09
now. Security again was always mixed
18:12
up with that. So it's almost hard to separate
18:14
the Bitcoin. But I think that we can have a
18:16
think, a discussion around what is what is not really part of
18:21
that, what should be a security functionality that sits on top.
18:26
Some things are obvious like ITDR, right?
18:30
I think privilege access security is part of it and you
18:36
know, non human identity security, which is now a very
18:38
hot category, stuff like that. But there's also questions
18:41
around areas that might need to almost like kind of split IGA,
18:47
for example. Is that an infrastructure
18:51
feature? Because some of it is like like
18:53
onboarding and offboarding users, things like that?
18:55
Or is it a security feature because achieving least
18:59
privileged for them, making sure people don't have too much
19:01
access, that's a security goal. So I think.
19:04
Here's also the appliance aspect accessories, and that's really
19:07
where the IGA field started was, you know, we got tired of
19:10
sending spreadsheets around and so the idea was to, OK, well,
19:14
how do we comply with our socks or HIPAA or other things like
19:17
that too. But I think that the whole
19:19
market will need to go to this evolution now, because the only
19:23
way to do security effectively is if you if you separate it
19:27
from the infrastructure, because the infrastructure people have a
19:30
few different solutions. They have active director of
19:33
them, they have been Octa in the cloud.
19:36
They have maybe some SAS applications that manage
19:38
identities over the, you know, the cloud infrastructure.
19:42
Some people have more than that because they acquire the company
19:44
and that company is using Ping, So now they have that too.
19:48
If all those islands will have their own local security, again,
19:53
it will be as if we would have different endpoint security for
19:56
every type of laptop. Doesn't make any sense.
19:58
So we have two separate security.
20:01
And that is to me, identity security.
20:03
It's that layer on top that does the security that requires the
20:06
overall context, you know, like understanding all the the
20:09
identities and all the access and then not only understanding
20:12
it, but also enforcing security policies.
20:16
I think that has to separate and that is identity security.
20:19
I'm actually very glad that more people are using that too.
20:22
I do feel like I walked around the that so, so many people are
20:26
saying it. The outcome is finally saying
20:28
it, which they told me for years that they, they, they don't
20:31
agree that there's such a thing. Now they're saying it.
20:34
Some of the analysts told me. Yeah, we, we understand that the
20:36
like this is happening. And I don't think, you know,
20:39
today. I, I think that the people have
20:41
spoken. Yeah.
20:43
So we just which is very good. And it took a while, but I think
20:46
it it's very important, not just for us as a company.
20:49
I honestly believe that it's important for the industry if we
20:51
want to stay ahead of the of the threats.
20:54
It's, it's, it's not going to be possible to handle the the
20:59
evolving threats and, and they are evolving fast and this is
21:03
even before AI fully kicked in. We will not have a chance if we
21:08
don't really start taking treating identity security as a
21:13
as an overall thing and not as a local feature.
21:16
Yeah. So you presented this morning at
21:20
the summit. I think one of the main themes
21:22
that you talked about was this idea of legacy IT and modern IT
21:29
coexisting. I mean, I have a friend who made
21:33
the observation, you know this, the modern CIO has one foot in
21:37
the past and one foot in the future.
21:39
So they're thinking as like, OK, well, from an identity security
21:42
standpoint, what do they need to secure the past of the future?
21:46
Obviously they need to secure both.
21:49
So given that context, you know, you've got to secure both.
21:54
How do you do that from an identity standpoint?
21:58
You think about the legacy platforms, they were built to
22:01
secure the on Prem networking. When I say legacy is not just
22:06
mainframes, but it, it's, you know, could be modern
22:09
applications or running an on Prem environment.
22:13
Now you have applications that you're hosting in platform as a
22:17
service or infrastructure as a service, as well as, you know,
22:21
SAS applications. The deployment models are
22:24
evolving, so you have all these things going on.
22:27
How do you secure it all? How does the modern CSO or CIO
22:31
look at this problem? Yeah, it's a big problem,
22:34
honestly. And, and it's getting even more
22:36
complex when you think not just about applications, but think
22:38
that companies have, you know, databases and, and servers and
22:42
file systems and OT environments like those, all these other
22:47
things that are not even web applications and use all kinds
22:50
of protocols to, to authenticate to.
22:54
I think that we have to solve both because attackers are
22:57
looking at this as as one attack surface.
23:00
I mean, we think, OK, we'll, we'll protect these applications
23:03
and not these. So we are half protected.
23:04
No, you're, you're 0 protected because an attacker can choose
23:08
where to, to log into. So, you know, we've seen a lot
23:12
of attacks where an attacker will compromise the weakest
23:15
link, which is often the legacy, the on Prem, you know, by just
23:19
taking advantage of how vulnerable and Active Directory
23:21
is and you know, getting user credentials over there with
23:25
brute forcing there or Kerberos thing or all kinds of thing.
23:29
Now once you do that, because most organisations sync the
23:32
password between AD to the cloud, you actually have the
23:36
cloud password now because it's the same password.
23:38
So we think about those as two different islands, but you know,
23:42
if I compromise one of them, I compromise the other.
23:46
And, and that's something that I think people understand more and
23:49
more. Now it's it's even more complex
23:52
than that because even if you secured some of the ways to
23:56
authenticate to the legacy systems, let's say that you
23:58
deploy a multi factor authentication portal or your
24:02
servers, right? And it protects the, the windows
24:05
login screen, because that's what these agents often do.
24:08
You install don't want to name the vendors, right, But all the
24:11
think about all the common MFA vendors and now everyone logging
24:15
into that server is getting MFA on the on the login screen
24:18
instead of just a password. But as an attacker, I can choose
24:22
a different way to log in. I can log in with remote
24:25
PowerShell, you know, I can log into a shared folder on that
24:28
server. I can log in with so many other
24:30
tools that it's it's, it's a joke.
24:33
You know, it's like you lock the front door but the window is
24:35
open. And I think that people
24:37
understand more and more now that if you don't secure
24:40
identities everywhere and all of the access, it's meaningless
24:44
because the attacker get to choose how they log into your
24:47
system. And they're not going after the
24:49
the shrimp tour. They're not, they prefer the
24:51
command line tools, right? Yeah.
24:53
We, we spoke to a company that got breached and they were using
24:56
one of the top like, you know, MFA and, and and, you know, and
25:01
Pam solution and they deployed everywhere.
25:05
You know, it was on all the servers and all the accounts.
25:08
Then the attacker just went in and he was using one of these
25:11
alternative interfaces, which attackers use anyway, and every
25:14
ransomer is using anyway. I don't even think that's the
25:17
sad part. I don't even think the attacker
25:19
knew that there was an MFA solution in place.
25:22
It's not that they knew it and tried to avoid it, They just
25:26
didn't even know because the way they log in, I mean, the way
25:30
ransom was spread and that's the reason it was CLI.
25:33
Exactly, Exactly. It's with command line tools
25:35
anyway. So if we don't secure those
25:38
things, which is probably the hardest, the fact that we have
25:42
MFA on our web applications or RBP or VPN, it's almost
25:48
meaningless. And, and that's why we really
25:50
believe that you need to cover all the, the darkest corners of
25:54
the IAM infrastructure. And there is a way to do it
25:57
again, we'll, maybe we'll talk, you know, in in the future.
25:59
I don't want to go too deep into the technology, but there are
26:03
ways to do it. It's just, it took actually
26:06
investing a long time in, in understanding how do things even
26:09
work. And you know, why do you do it?
26:11
And it's, as I said before, it's not sexy.
26:14
So when we went to, to VCs to talk about that, you want to do
26:18
what you want to protect the, the legacy.
26:24
So now obviously we also protect the cloud.
26:27
And with the resident acquisition, we, we do even more
26:29
and more though, but when we started, we only focused on
26:33
those dark corners. It's not will investors want to
26:37
focus, but it is will companies have a problem.
26:39
Yeah, it's interesting. You know, part of my thinking
26:43
when I asked the question was thinking of that legacy
26:46
environment. It in other words, on Prem
26:49
environment, organizations have been investing in identity
26:55
solutions for that environment. Clouds like obviously
27:00
overwhelming and it's been overwhelming for a long time for
27:04
a lot of organizations. There are still organizations
27:06
that are, you know, kind of beginning their journey.
27:10
But my wonder is, OK, so as AC so or the CIO is my approach to
27:18
this is the right approach to say, take those platforms and
27:21
try to solve for my hybrid situation?
27:26
Or do I need different tool? So I, I think that until
27:30
recently you'd needed different tours.
27:32
I think that what's finally happening is, is consolidation.
27:35
I mean, we are part of it. I think other companies are
27:37
trying to achieve the same. Hopefully protecting the dead is
27:40
end to end. I think that's how you have to
27:42
do it. So on them and cloud, humans and
27:45
machines, privileged and non privileged just end to end.
27:48
Because if you don't look at it end to end, you're, you're
27:52
missing the, you know, you're missing some of the, the
27:55
critical areas. I mean, and then you know is
27:57
again the attackers will find the the blind spot.
28:01
Well, let's expand the question is so we talked about the one
28:04
foot in the past, one foot in the future as kind of like this
28:07
major divide and they just reference another major divide
28:11
and it's as far as an identity topic could be right now, which
28:15
is non human identities. So we kind of we know how to
28:19
manage human identities. We've been doing it for so long
28:23
and we've been ignoring the non human identities.
28:26
You know, I'm part of that. I'm guilty too.
28:28
It's not that we didn't know it was important.
28:31
It's that we didn't have the tools.
28:33
Yeah. And like, I think it is that it
28:37
is one of the biggest problems. So I think it it makes sense
28:40
that a lot of companies are trying to focus in it out.
28:43
I agree that the main issues that people didn't think it's
28:47
possible to protect them for a long time.
28:50
Even if you think about the older types like service
28:52
accounts in Active Directory, they've been around for decades,
28:56
right? But people didn't think there
28:58
was an effective way to secure them.
29:00
I think most organisations will try to do that with Pam tools
29:04
and with Pam tools, you, you have to change the password.
29:07
That's kind of how Pam works, which I think is a pretty old
29:10
approach, but that's what we had for for the last decades.
29:14
And when you change a password on a non human identity, it
29:17
breaks things in in many cases it breaks applications because
29:21
they have them, you know, they have hard coded somewhere in the
29:25
script or somewhere in the application those those the
29:27
password. So I think people got scared of
29:30
doing it like they tried. I spoke to CSO, tried to do it
29:34
once with these type of tools and took down a whole data
29:37
centre and then he stopped the you know.
29:40
That's a very real fear. I mean, a lot of organizations
29:43
struggle with that fear is what if?
29:45
What if I changed that password? What if I shut down that
29:48
account? They know it exists, and yet
29:50
they still let it sit there. Yeah.
29:52
And when we came out with our solution to protect service
29:57
accounts, I think it was 3-4 years ago it was.
30:01
We thought it's just a small thing like we thought one
30:03
customer suggested today, if you can do this for humans, why
30:06
don't you do the same for non human?
30:09
And we did. And we thought it was going to
30:10
be a a feature. We didn't even we didn't even
30:12
charge money for it in the beginning.
30:15
And it became one of our best products because it it is a huge
30:18
problem and it takes a different approach.
30:20
You can't just try to use the the tools that use for human
30:24
identities on it. I think that the best approach
30:28
with non even identities is obviously visibility is a big
30:31
part of it. You need to discover them, see
30:33
what they're doing, who owns them, where they're being used.
30:35
That's a huge part of it. People don't even know.
30:37
That the kind of the governance of it.
30:40
Yeah, they don't even know. And they don't even know that
30:42
some of them are being abused for completely different.
30:45
Like, you know, somebody created the service account once and now
30:49
they're just using it for 10 different applications.
30:51
That would never. Both people use their personal
30:56
account to one application instead of asking for a service
30:59
bar. It happens a lot.
31:03
I think I, I, I told that story in the past.
31:05
I don't remember well. Well, we had a, a customer that
31:09
we were, we were installing our product for and we need the
31:13
service account just, you know, like regular, you know, domain
31:16
use of service card in order to, to run our product.
31:19
And, and he said, Hey, can you go create a service card for us?
31:22
And he just said, no, no, just let's use my on account.
31:25
It's like, that's what you invited us to fix, like.
31:29
And it's, it's so built into the way people work that he didn't
31:33
even realise that he's offering this to the vendor that came
31:36
here to fix this problem. Yeah.
31:38
So people do it all the time. So visibility is a big part of
31:41
it and finding all these these bad, you know, behaviours.
31:44
But then the second part is how do you secure them?
31:47
So all they think puzzles is, is sometimes the light.
31:50
And so usually it's not. So you need to figure out how do
31:54
you basically prevent any use of this identity outside of what it
31:59
needs to do. So if you built a non even
32:02
identity that only needs to connect from A to B every two
32:06
hours, let's somehow lock it down to only be able to do that.
32:11
So if somebody will try to use it anywhere else, it should be
32:13
unusable and it should trigger that.
32:15
Very narrowly defined scope. Yeah, that is all it can do, but
32:20
it's difficult to do sometimes when, you know, I'm going to
32:23
play the the advocate for the customer.
32:25
And some on the security side is I've asked security vendors, you
32:28
know, a lot of times they'll say, oh, we need a domain admin
32:31
account and they just leave it at that.
32:33
OK, well, you push back on that and you say, OK, well, what do
32:36
you really need? Yeah.
32:37
And being able to have that conversation in a way to say,
32:40
OK, we don't really do domain admin, which you need are these
32:43
three permissions and a lot of security vendors take the easy
32:46
way out and just to just just just give.
32:47
Yes, I agree. And, and, and not only security
32:50
vendors, the the things security vendors are actually more well
32:52
within some other IT vendors that just ask for it no matter
32:55
what. I think that part of it is also
32:59
look at all the identities you have today, look at what
33:02
permissions they have and look at what are they actually doing.
33:05
And let's correlate that. Let's correlate that
33:06
continuously to see that, you know, this account has the
33:10
permission as to do X things, but it's only doing a small
33:13
portion of that and all the time let's automatically recommend to
33:17
reduce what they can do. So it's, you know, it's just in
33:21
time access, but it's also just enough access that we need to
33:24
achieve all of these things. I don't think on you to people
33:28
like the fact that you should do it.
33:29
I think that they just didn't know that it's possible.
33:31
And I think that vendors kind of stayed in the comfort zone for a
33:35
very long time, kind of doing the same thing.
33:37
And now finally, there's almost like a renaissance in eternity
33:40
security. But think about it, for how long
33:42
did we just have the same port, the same technologies, while
33:46
other categories of security got to have such amazing innovation,
33:51
you know? And I envied that.
33:54
Like, I looked at some other categories of security where
33:56
there was so many new things going on.
33:58
And in identity, it seemed like nobody wants to do anything
34:02
differently than how they did it for the last decades.
34:06
Now the finally is willingness to do it.
34:08
And the technology is the, I mean, the technology is, is
34:11
possible. I mean, if people are willing
34:13
to, to consider doing things in a better way.
34:16
The technology is the. I think it's evolving very fast
34:20
now. Yeah, you said something scary
34:22
and I think this is part of the inertia, which was OK.
34:27
The existing tools can can't do what we need something to do for
34:32
non humans. Layer on top of that, they're
34:36
probably more complex to matters than people.
34:39
You mentioned governance, then you also have secrets
34:43
management, authentication, monitoring.
34:47
So layer all that on. You've got your IGA Pam single
34:51
signed on. So you have all these features
34:55
on top of the fact that it's not solved.
34:58
So now it's a more complex population and I think you said
35:03
in your in your talk, another thing that I agreed to it, which
35:08
is that the non human identities need to be tied off to people.
35:11
So great. That's part of that, that
35:13
solution. So now you can't use your your
35:17
tools, your, your existing tools can't do the job and you need to
35:21
solve multiple tiers of functionality in order to really
35:26
get your arms around this population.
35:28
It's not an overnight solution. It's not going to be solved by,
35:32
you know, waving a magic wand. It's very hard there, I have to
35:35
say, like as someone who's, you know, I feel like we're
35:39
innovating in this space and we have like a lot of things that
35:41
we're doing, I think in a better way than before.
35:43
It's complex like the the whole mission of security identities,
35:48
I think one of the most complex in, in cybersecurity in general.
35:51
Like I have obviously a lot of friends that run companies in
35:54
other areas of cybersecurity. I think that identity is one of
35:57
the most complex. I think that the fact that
36:00
there's so many solutions already doesn't help because the
36:04
fact that you already have 20 different solutions, I mean, it
36:08
makes it even more difficult because we're not just coming in
36:11
with this amazing new platform and you have nothing today and
36:14
we just come and install it for you and you're you're done.
36:17
You also have like 20 different things that you already have in
36:19
place that we need to deal with and integrate with and work
36:21
with. It makes it a little more
36:23
complex, but I think that that's part of the mission.
36:26
Like how do we work with the existing stack while it's
36:28
gradually being replaced? Because it will be like a lot of
36:31
these old pieces. They'll do for now all the time.
36:35
There will be next Gen. solutions for all of them.
36:37
I mean, a lot of start-ups are already doing amazing things and
36:40
I think the technology is there. Companies need to be open to
36:45
looking at new ways of doing things, better ways of doing
36:49
things. And I think that they finally
36:51
out, at least that's what I'm feeling from talking to a lot of
36:53
even the largest companies. And we all already work with
36:56
like a lot of the Fortune 50 Even so even the largest
37:01
companies that were always like a little slow are opening up to
37:05
the idea that, hey, we OK, we can't do this with the old
37:08
tools. So what's new?
37:10
What's what's I'll do? I think we can see that in the
37:13
conference a lot like even the the companies that that two
37:18
years ago, three years ago, I remember talking to them and
37:20
said, so we were like, it may be a better way, but we're kind of
37:24
stuck with how we do things. Now they're coming back and
37:26
saying OK, like we understand this is evolving and we need to
37:30
catch up. What do you attribute that to?
37:33
Because I think there's this real, you know, fatigue that
37:36
comes with, I need another tool to do this thing, right?
37:39
Why can't Axe do this thing that I already have in place?
37:43
What do you think has changed over the last year or so where
37:46
those companies have started to make those investments because
37:48
these things cost money? I think that one thing is that
37:51
the the new generation of technologies matured a little.
37:55
I mean when we started, I mean even last time we spoke a couple
37:58
of years ago when we were still growing, we had some big
38:02
enterprise customers which was kind of early.
38:04
A lot of the customers that started working with us in the
38:07
early days took a bet on us. I think that now that it's much
38:11
more established and you got we, we have like 1000 enterprise
38:15
customers using this. So it's a little less of a of a
38:18
risk for them and and they don't like risk, right, at least many
38:22
of them. So I think that's one thing.
38:24
Second thing is the fact that the threats are evolving.
38:27
I think people understand that they're going to get breached a
38:30
lot if they don't figure out what to do.
38:35
So I think that's partly part of it.
38:37
And again, there's the overall priority that identity is
38:41
getting over other categories of security because the old
38:45
perimeter is gone and people are walking from anywhere.
38:47
And I think there's more understanding even at the, even
38:51
at the board level and the CEO level that identity is, is
38:54
critical. They can actually understand it.
38:57
I think more than themselves, some others of security, they,
39:00
they, they get it like they think that's one of the
39:02
advantages and also disadvantages of identity.
39:05
It meets the end user more than any other category of security.
39:09
Like every, every employee, every, you know, the CEO logs in
39:13
and has to do like multi factor authentication and all these
39:16
things. Like they actually see them as
39:18
opposed to some of the stuff that like other categories where
39:21
it's much more behind the scenes.
39:23
So they understand the importance and the way to put
39:26
more budgets on it. I, I hear from a lot of
39:28
companies that identity is now like the number one priority or
39:31
the number one budget item, which is, which is great because
39:36
I do believe, and I'm, I'm, I'm biased, but I, I honestly do
39:39
believe that it is the most important element of security
39:42
these days. So this idea of identity being
39:45
the new perimeter, I struggle with that because it's not going
39:48
to different, but around for 15 years at this point.
39:52
You know, there's there's this idea.
39:54
Yeah, just doesn't make sense to me.
39:56
I want to do a little bit of the lightning round here because
39:58
you've been very jazzed. You're trying to want to get you
39:59
back out onto the conference. Let's do a quick round.
40:03
Let's start with shared signals and shared signals framework.
40:06
I think it's an area that's showing a lot of promise, but
40:08
I'm obvious to hear what your thoughts are as someone who's on
40:11
the vendor side of this, and this is an idea this, you know,
40:13
the idea here is that products being able to talk to each
40:16
other, which sounds good on paper, but probably more complex
40:19
behind the scenes. What are your thoughts on that?
40:22
No, I completely agree. I I think that this is, we have
40:26
to start working better as an industry between all the
40:29
products because customers are not going to have one product.
40:32
You know, some of the big vendors like to believe that
40:35
they can just be the only cybersecurity product that the
40:37
company has. I think the 99% of the company
40:40
is just not going to work. They don't want to put all the
40:42
eggs in one basket. They want some the cartridges
40:46
that are are good for each space.
40:48
We all have to understand how to work together.
40:51
So I think it's a great initiative, you know, very
40:55
compelling to us. And I think that it's one of the
41:00
things that as as our company grows, we understand more and
41:02
more that are are super important to our customers
41:06
because early on we only thought about what, what will make our
41:08
product the best and what best features we can build.
41:11
The more we meet more real customers and deploy little
41:15
environments, we understand that integrating with all the other
41:18
tools they have is top priority because otherwise it's just
41:22
another tool that you need to go to and log into.
41:24
And then there's a cool UI. It's like, cool, but I'm not
41:28
going to log into it because I have 100 other tools.
41:31
So we have to figure out how to work together, I think.
41:34
Yeah, I'm really glad that these initiatives are getting action.
41:37
Yeah, In the real world, that ends up being let's take the
41:40
logs and just stick them in our sin.
41:42
Yeah, Yeah. And then it's to die, right?
41:45
And it just sits around. We started this conversation two
41:48
years ago. We started it with identity
41:50
threat detection or response. So here we are two years later,
41:53
and it was kind of a newish term back then.
41:56
Is ITDR and is in identity security?
42:00
Is identity security an evolution of ITTR?
42:02
Was it always identity security? We're just finding better ways
42:05
to talk about it. Where do you see that
42:07
intersection between ITDR and this concept?
42:11
Maybe of identity security? No, I think, I think ITDR is one
42:15
element for identity security in our platform.
42:18
It's one of seven different products.
42:22
I think it's a very important element.
42:25
But at the end of the day, ITDR is only about detecting attacks
42:29
that are happening right now. It's not about preventing future
42:34
attacks, not about solving vulnerabilities.
42:35
It's not about protecting different types of fidelities.
42:37
It's only about telling you that you're under attack right now.
42:40
So it's one element, I think that IDL did do something
42:44
important. I think it what it was one of
42:46
the first sub categories of identity security that got
42:50
everybody to agree that there's need to be identity security
42:55
category. Do you see it as like the killer
42:57
app for identity security? Is it the thing that put it on
43:00
the map? I think that this together with
43:03
maybe NHI security now non human identities, I think were both
43:09
both played a very important role.
43:11
Although there are two very specific elements of identity
43:13
security. I think what was good about them
43:16
is I think people agreed that those should be kind of
43:21
decoupled from the infrastructure because think
43:23
about ITDR, does it make sense to do ITDR only within one IAM
43:28
solution without understanding what behaviours are happening in
43:32
the other? Obviously not.
43:33
And I think it was so obvious that it got people to generally
43:37
accept the idea that they didn't.
43:39
Security has to be a layer on top.
43:41
So even though ITDRONHI are not the only pieces, I think the
43:46
fact that they got action the last couple of fields did a lot
43:49
of good service to the to this market.
43:52
ITDLI think is gradually becoming a feature in, in bigger
43:58
identity security platform. And that's what I think what
44:00
what I think it should be. So it's served a very important
44:05
role. It still serves as a very
44:07
important functionality. We deal an identity security
44:11
platform, but I don't see it as a standalone category.
44:15
I don't think many companies would buy an ITDR product these
44:20
days. I think they'll they will look
44:21
for a platform that also has ITDL in it.
44:24
It's kind of like how I think UEBA evolved in the past.
44:28
You know, we thought about it as a product and then it kind of
44:30
got merged into other products and it became almost like a
44:33
master feature in other products.
44:36
I think ITDL is that same thing in identity, but still a very
44:41
important functionality. So when this episode airs, going
44:47
to be two weeks from 2025, which blows my mind.
44:51
So a little bit of let's think about the future.
44:54
What's the future for identity security?
44:59
No pressure. Yeah.
45:00
No, I think about it a lot. It's, it's a very good question.
45:04
I think that a few things that I think will happen in 2025 and
45:08
beyond. One is I think that
45:10
consolidation will continue. We have too many products in
45:13
this market. The fact that people need 20
45:15
different products to do identity security is a problem.
45:19
Most companies can't afford it and can't manage it.
45:22
So consolidation will continue to acquisitions to companies
45:26
building more and more products. I think there are a lot of
45:30
companies that you used to think about as a Pam company or an MFA
45:35
company or ITR company. Now you go to the website and
45:38
you see identity security. It's a bigger story now.
45:40
I think it's a good thing. 2nd is I think that AI will start to
45:45
have much bigger impact in, in a few different ways.
45:49
I think 1 is obviously attackers will start using it more.
45:52
We, we already hear about more attacks.
45:55
Well, somebody's using like deepfake to take someone into
46:00
thinking that they're the boss or someone from IT and get them
46:04
to give them the credentials or pull the MFA.
46:07
It's very concerning. There's also opportunity to use
46:10
AI to our benefit. But I think even more
46:14
interestingly, there's a question of how do we secure the
46:17
identities of AI agents? Because AI agents are and you
46:22
type of, let's call it non human identity.
46:26
That is very different from what we used to call it non human
46:29
identity. So this category of NHI was
46:32
barely even born and how it has to reinvent itself.
46:34
It's funny, but I think that will be a big task that, you
46:38
know, as a as a as an industry, I think is actually pretty
46:41
exciting because we get to play a big role in what will the
46:45
future of AI look like in order to to make it secure, which I
46:50
think is part of a bigger thing. I mean, the last couple of years
46:53
we've all been excited about Gen.
46:54
AI. Think now as it matures, there's
46:57
a whole ecosystem that develops around like the infrastructure
47:02
for Gen. AI.
47:03
How do you secure it? How do you do compliance for it?
47:05
How do you, you know, like companies that are building the
47:08
actual AI, but they're building all the ways that organisations
47:12
will be able to use it, you know, safely and, and, and
47:16
effectively. So I think that the identity
47:19
industry actually have a huge opportunity to be part of it,
47:21
you know, to to create something that will enable organisations
47:24
to use AI better by securing the identity and the access that AI
47:30
agents are doing within the environment.
47:32
That's a pretty exciting. Thing I think about like is it
47:36
more risky to use AI or is it more risky to not use AI?
47:43
In my opinion, it's always good to not use AI these days.
47:45
I mean, that's my view as ACEO, not even as a as a security
47:49
vendor. I mean, I have part of my job is
47:54
as a, as a, you know, someone who leads the security company
47:58
to think about obviously the, you know, how do we help secure
48:03
AI And there's a lot of risk, a lot of questions, though on the
48:07
other end, there's ACEO of, of, of any company, I think that you
48:11
cannot afford to not adopt AI fully.
48:15
I'm not just saying like try and test it.
48:18
I think that any CEO was not jumping in to adopt AI as much
48:24
as they can. I don't think we'll be able to
48:27
exist in a few years because the effect that this has on
48:30
productivity is so big. I don't even know if all
48:35
companies understand it. I think some companies obviously
48:38
do and you see what they're doing.
48:40
We're adopting it a lot internally like so many things
48:44
that we are now starting to do with AI and we are only
48:46
sketching the the surface. So I think that it will be
48:51
almost not competitive to not adopt AI to its full potential.
48:56
And now as security vendors, we have a job.
49:00
How do we help organisations do IT security.
49:03
But I think that we have to run very fast because nobody's going
49:05
to wait for us. Like the impact on on the
49:08
business is so big if you adopt AI well that people are going to
49:13
do it whether it's secure or not.
49:14
So we just need to make sure that we help them do it
49:16
securely. I don't think they'll be able to
49:18
afford to to not do it. Yeah, I think that if data is
49:24
your crown jewel and you have competitors, if you use AI,
49:29
there's a real scope. They have to open it up to our
49:32
data, to our crown rules, they get stolen.
49:35
That could ruin our business. But if we don't use AI to get
49:39
the most out of that data and our competitors do, and there's
49:43
not a breach, we're going to smoke us.
49:45
Yeah, we'll, we'll be very secure losers.
49:48
It's very secure. Losers, right?
49:50
It sounds very much like the cloud conversation for 20.
49:52
Yeah, well, you know what I'm doing because someone else is
49:56
going to have it now. Yeah, although I think that this
49:59
is much bigger than the cloud revolution.
50:03
You know, I think this is going to be huge and I, I don't need
50:06
to, like, I'm sure enough words have been said about this, but
50:10
I, I'm really, I, I believe in it.
50:12
You know, I've seen already and also like talking to other CE OS
50:16
of other companies, not even in cybersecurity, just in general.
50:19
I'm already seeing the impact and, and we are only starting,
50:22
like this is only the beginning. So it's, it's hard to even
50:28
understand how much this is going to change everything.
50:30
And I think that we have a chance as a security industry,
50:34
as I think especially as, as identity and the identity
50:38
security industry to have a play a role in how can we make it
50:43
secure. I think it is possible.
50:45
I think there is a way to make AI secure.
50:50
And that's something that I'm, I'm, you know, very passionate
50:53
about and I'm talking to other vendors and customers about.
50:55
And I think there's, there's so much we can innovate and do in
50:59
this space. So that's one thing that I think
51:02
I don't think we're fully get to its full potential in 2025, but
51:05
it will definitely make a big step, yeah.
51:08
So here's my prediction for next year, 2025.
51:11
I don't know if I'll go to RSA, probably not, but I'm going to
51:15
guess I'm going to walk through the vendor halls and see a whole
51:18
new cottage crop of AI security units, right?
51:23
It's, you know, it's out there, it's going to happen and it's
51:25
going to be, you know, but that'll be the RSA, the
51:28
conference trend for last year and maybe the year after that,
51:30
right? Just like we saw with Zero Trust
51:32
and AI, right? Half of them would be called
51:34
something AI, right? Yeah.
51:36
Because you don't want to miss the the fact that the AI
51:38
companies. So it's important to put it in
51:40
the name. Yeah, I think, I mean, if you
51:44
look at how investors now choose where to invest, I think that
51:48
it's very hard for an investor these days to even even justify
51:52
investment in a company. It is not about AI even to their
51:56
investors, you know, to their LP's because it's it's such a
52:00
game changer. Everybody want to be part of it.
52:02
They don't know even like where where to put the money split
52:05
every. But yeah.
52:06
So that's that's the strategy. Like let's just put it
52:09
everywhere. But I think that it is becoming
52:13
more difficult. If you were startup, early stage
52:15
startup, not in AIII kind of I'm happy that we started backward.
52:20
Not being an AI company was was OK.
52:23
And now because our business is, is, is big, we get to, I mean,
52:28
raise money based on our performance and not just based
52:31
on an idea, because I think these days raising money for an
52:34
idea that is not related to AI, it's actually pretty hard.
52:36
The investors are very embarrassing.
52:39
I, I, I don't think it's just another trend that will be
52:42
replaced in a year. I think it's going to be with us
52:44
for the next, you know, long time.
52:47
Oh, so AI is not going away? OK, interesting.
52:49
No, it's a full state. I don't mean.
52:52
I mean that the, the fact that investors, yeah, almost solely
52:56
you want to invest in it, I think is, is going to change the
52:59
way it's, I mean for, for for a long time, the way that
53:02
start-ups even come up with what idea they're going to go after,
53:07
which is which is pretty crazy. So yeah, I, I think it's going
53:13
to be an interesting year in general for I mean all
53:16
technology, but but also an identity.
53:19
There's so much going on. And I think that with the
53:22
momentum that is now kind of coming to identity security, I
53:26
think it's, it's really the most exciting time that that I mean
53:30
that we have since we started at least eight years ago to be in
53:33
this market. It's it's what we've been
53:35
waiting for for years, honestly. It's exciting spot.
53:39
I am very bullish on AI. We've choked about turning this
53:42
into the AI the center podcast. I want to get you back out
53:46
there, but we always enter the lighter note and we're hidden
53:49
night. And for your course, hey, you
53:50
know, what kind of hobbies do you have?
53:51
He said, well, I used to have hobbies.
53:54
And you mentioned things like being an artist and being a
53:56
bartender. And I was, I used to be a
53:58
bartender as well. We started talking about that.
54:00
Tell me about give me your craziest or wildest bar story
54:05
because I feel like we all have something like that.
54:07
Oh yeah, those, no, those too many.
54:11
Yeah, it's, you know, it's been the, for me, not even before I
54:19
joined the, the security industry, it was kind of in the
54:21
middle because I was in 8200. It's like a technology unit for
54:27
enough like doing cyber offence. And then when I left the
54:31
military, that's where I I did this.
54:33
So I was, I was doing it almost as a break.
54:36
You know, I didn't want to jump right straight into to
54:38
technology again. And I, I just walked as a
54:41
bartender and yeah, it was, it was pretty insane.
54:45
I, I, I had, you know, a couple of years Will, Will, you know,
54:50
I, I only worked there and it was honestly amazing.
54:53
Like, I used to meet so many, you know, amazing people and
54:58
have like, crazy stories and then wake up at noon and, you
55:02
know, it was a very different life.
55:03
I feel like you're dodging the question a little bit.
55:05
Yeah, yeah. Give me a story.
55:08
Yeah, yeah. No, it's, I mean, there, there
55:11
was some obviously some crazy nights, like I think we'll,
55:15
we'll leave it at that. And and, you know, once that
55:18
they don't even remember sometimes I have to admit, but
55:21
it was it was awesome. I I'm I'm glad that I've I've
55:25
done it. And I think that I learned so
55:27
much about like how to treat people and work with people even
55:32
more than I learned in the tech industry that I took with me to,
55:36
you know, managing a company and, and, and the sales, right?
55:40
And managing people. I feel like it was such a good
55:47
lesson on, on just how to communicate with people of all
55:51
kinds and, and, and create friendships very quickly, right?
55:53
Because that's what you do as a bartender.
55:55
You need to talk to someone and almost immediately become the
55:59
friend, right? And I think that's such a great
56:02
skill that sometimes technology founders are missing because
56:06
they, they, they care so much about the technology and they're
56:08
so focused on it, so passionate about it.
56:10
And I, I am too, they missed that element, the human element
56:14
of like building a good bond with, with someone that at the
56:19
end of the day, even in the colleges, still the, the most
56:21
important thing because we're all people.
56:24
And as much as everyone is like could be excited about your
56:26
technology, I think that as a founder, you need to also build
56:30
relationship like really quickly with investors, with customers,
56:32
with employees and, and know how to treat them.
56:36
And I think that's one of the biggest advantages we have as a
56:38
company in Silapolis is the, the people element and the culture.
56:42
So that's part of it. And by the way, we just moved to
56:44
a new office, like really big office space.
56:48
And one of my projects that even some of my team may find out
56:53
about only in this, in this episode is that I actually want
56:56
to build a small bar in the, it's a big office.
56:59
We have like a big dining room and there's this small room next
57:04
to it that we didn't know what to do with.
57:06
We said, hey, maybe we'll just put a few shells there because
57:09
it's like a small, tiny room. And I said no, no, we're going
57:11
to do a small bowl in the office.
57:14
And that to me would be like a little closer.
57:17
So when you build that and you get that set up, what's the
57:20
first drink you make to sort of christen the, you know, the, the
57:24
big, the opening of the bar, so to speak?
57:27
That, that's a good question. I, I, I change my favorite drink
57:29
every few years, but right now for the few years it's been
57:32
there in Gwani. OK, yeah, I, I like it a lot.
57:36
And I also drink whiskey a lot. Yeah, there'll be something for
57:41
everyone, but hopefully not as not as many crazy stories
57:44
awfully in in the office. Not in the office we got, which
57:46
are policies now, all that kind of work.
57:49
We'll keep it lighter there, but but no, you need to enjoy, walk
57:53
a bit. I mean, I, I generally believe
57:55
that in a start up, you need people to do amazing things,
57:58
right? To go above and beyond and build
58:00
innovative amazing things. And I think people can only do
58:03
that when they're happy, you know, when they actually enjoy
58:05
what they do and who they do it with.
58:08
I mean, you can go and walk in in a company and do your job,
58:12
but to really do amazing things, I think that you can't do that
58:17
unless you really enjoy the people that you do it with.
58:21
You know that you kind of want you want to make this happen,
58:23
not just because you want to get paid because you can't get paid
58:25
even if you do average walk, but if you really care about the
58:29
people that do it with and you all that all of it to succeed.
58:32
So I really do believe that it's important to create an
58:36
environment where people actually love what they do and
58:38
love the people they do it with. And that's like the the most
58:42
important thing you can do to build a successful start up.
58:44
Because all the rest of it now, the technology and the, the
58:48
cells and all, all of that will happen if the people that work
58:52
for you actually love what they do and they're happy where they
58:54
are. Because the, the other ones we
58:56
need to do it like I have 400 employees right now.
59:00
If I close another deal or, or, or think about another feature
59:04
that that's almost meaningless. The people that work in the
59:08
company, the other ones who need to, to do all these things.
59:11
And you know, they, they will probably never like show by how
59:16
much I care about the company. But but if I can get them to
59:19
really feel at home in this company and to really feel like
59:22
it's, it's theirs and, and, and they care, I think that that's
59:24
the thing that makes start-ups successful.
59:27
So, you know, if part of that is having the best ball in town,
59:33
you know? Sometimes it's the little
59:34
things. That's all it takes you.
59:36
Know I was at a very large technology company recently and
59:41
they had like a prohibition era Speakeasy.
59:46
It was hidden behind a false wall, so it was like bookshelf.
59:50
I was wondering, but I know exactly you're talking about.
59:52
Yeah. He was like, I'm not sure how
59:53
how to bring that up, but. Yeah, you'll have to tell me
59:55
more about it, because that's exactly what I want.
59:57
To do, but if you have enough space, I mean, yeah.
1:00:00
Yeah. Yeah, we'll do that off the
1:00:02
recording, install it, OK. I'll shoot, I'll invite you.
1:00:05
Maybe the next episode we can shoot the drink.
1:00:08
I would have I I don't remember how to bartend, but I'll do my
1:00:12
best. It's, it's funny that you you
1:00:15
come from that back onto it. I think it's.
1:00:17
Ten years in food service, you know, a lot of people, you know,
1:00:19
just kind of assume I've been in this forever is like, no, I had
1:00:22
a full career, you know, waiting table.
1:00:24
There's, you know, there's nothing as stressful as A5 table
1:00:29
section on A at a Chili's on a Friday night outside of a movie
1:00:33
theater. That's the most stress that I've
1:00:35
ever been in any job ever and any nothing has ever come close.
1:00:38
I, I actually agree. I think that people
1:00:40
underestimate it. I think that the amount of like
1:00:43
what you learn about, you know, about service and about sales
1:00:49
and about people in, in the, you know, in the service and for the
1:00:53
industry is so much more. I, I think that the, it's
1:00:58
actually a really good background that I also have like
1:01:00
a few employees that come from this.
1:01:02
And I, I, I actually see this today as a huge advantage when I
1:01:04
see it in some of the resume, which most people wouldn't think
1:01:07
about. I think everybody should have to
1:01:10
serve one way or another and that and just that.
1:01:14
That's the service. Everyone needs to understand
1:01:16
that. Ian.
1:01:17
All right, Jim, last statement for the year 2024.
1:01:22
Let's go 2025. OK, we'll go ahead and wrap it
1:01:26
up there head. Thank you so much.
1:01:27
Yeah, thank you. Yeah, we're going to get that
1:01:29
fun. I'm going to put your LinkedIn
1:01:31
back in our show notes so people can reach out by the vice of
1:01:33
macaroni recipes or whiskey any, or, you know, whatever.
1:01:36
Anyone who wants to talk about the Saudi city, I'm really happy
1:01:39
to talk, so feel free to reach out.
1:01:41
So that's great. We're going to leave it for this
1:01:43
week and for this year, which is crazy to say.
1:01:46
We have the YouTube channel, we're at idacpodcast.com.
1:01:49
If you go to idacpodcast.tv, you can find our YouTube channel.
1:01:53
So for now, we're planning to continue to that.
1:01:55
We'll see, but like and subscribe that shows support for
1:01:58
that as well. And of course, you can connect
1:02:00
with any of us on LinkedIn as well for any thoughts, ideas,
1:02:03
clients, concerns, it's we read them all.
1:02:06
So with that, we'll go ahead and leave it.
1:02:07
Thank you everybody for watching and we're listening this year
1:02:10
and we'll talk with you all the next one.
1:02:14
You've been listening to Identity at the Center.
1:02:17
We hope you've enjoyed the show. Make sure to like, rate and
1:02:21
review, and we'll be back soon. But in the meantime, hit the
1:02:25
website at identity@thecenter.com.
1:02:29
See you next time on Identity at the Center.