Latest / Identity at the Center / #363 - Sponsor Spotlight - Natoma

Transcript

#363 - Sponsor Spotlight - Natoma · Identity at the Center

0:04
This is identity at the center. Welcome to the Identical Center
0:11
podcast. I'm Jeff and I am falling solo
0:13
today. So today we've got a sponsored
0:15
episode for you. We have these conversations from
0:18
time to time with some of our partners in the industry to get
0:20
some more insights into how they approach the market, maybe some
0:23
of the technologies and tools and capabilities and thoughts
0:25
and ideas that they bring to the table.
0:27
So without further ado, let me introduce today's sponsor.
0:30
We've got Natoma, It's Natoma dot IDNATOMA and I want to
0:34
welcome to the show for the first time, Paresh Bhaiya.
0:37
He's the Co founder of Natoma. So welcome to the show, Paresh.
0:40
Thank you, Jeff. Thank you.
0:42
Really an honor to be here. Been listening to IDAC for a
0:46
really long time. Really, really a big fan and I'm
0:51
glad to be joining you guys today.
0:53
Yeah. Well, we appreciate you taking
0:54
the time. I know that you're currently in
0:55
India, so it's like two or three AM is the time we're recording
0:58
this. So we're kind of joking before
1:00
we hit record here. That's like, all right, it's the
1:01
middle of your day. And so it's either uphill or
1:03
downhill from here, depending on which way you want to look at
1:05
it. I have no idea which way is
1:08
going to go, but it all depends on how how the next 30 minutes
1:12
go. All right, fair enough.
1:14
Well, why don't we start with your background?
1:16
So one of the things we'd like to ask our guests the first time
1:19
they've been on the show with us is how they got into identity.
1:22
So I'd love to hear your identity origin story.
1:24
Is it something that you chose or did it choose you?
1:28
I would have to definitely say the the field chose me.
1:33
It it's sort of both, but it definitely the field chose me.
1:38
I mean by background, just as a quick background, I'm engineered
1:42
by education was a software developer.
1:46
I was in secure networking, network security, wireless
1:50
security, and I was working at Salesforce under the Seesaw
1:54
organization. And that's where like, you know,
1:59
cloud was the transition from like network security to cloud
2:03
security and identity was like, you know, that's the next big
2:06
thing and identity security is becoming big and somehow just
2:10
got into identity. And the next step from sales was
2:14
was at Octa. Of course, Octa is identity
2:18
company was PMM leading PMM product strategy for the new age
2:23
products in a way. Having said that, I definitely
2:27
agree the field kind of picked me as much as it was very
2:33
concentrated effort on my end to go into identity.
2:37
I definitely have to give a shout out to Identity at the
2:39
Center. I've been listening to you guys
2:42
for a really long time during my Twitter days, if you may.
2:46
When I used to run, I used to put on IDAC and go for a quick
2:51
run, and that was some always. As I was thinking of Identity
2:55
and Identity becoming the center of the security world listening
2:59
to you guys, I felt like maybe I should really somehow try to get
3:03
into Identity. But here I am.
3:06
Well, I appreciate that flattery will get you everywhere on this
3:08
show, so definitely off to it. It's a.
3:12
It's a true story. Trust me.
3:13
I do remember even I had actually even at sales force I
3:18
took and taken identity role or I was working under Ian's
3:23
leisure. Of course everybody knows Ian
3:25
and the identity ward was working with him and I was
3:28
trying to get into the identity side and I used to listen to you
3:32
guys and I actually leverage stuff that heard I heard on this
3:37
podcast over number of sessions, so over the period of time, so.
3:43
That's super cool. I, I mean, that's very
3:45
flattering for me. So I, I definitely appreciate
3:47
that you're kind of coming on at a momentous time for us.
3:50
So when this airs will have been around for about 6 years now,
3:54
which is pretty crazy if you think about it.
3:56
And I would have thought we'd have run out of stuff to talk
3:58
about that like 50 episodes, but here we are.
4:00
This should be, I think, episode 363.
4:03
You're kind of around there. I do want to talk a little bit
4:06
about Natoma itself because I've seen some of the things you guys
4:09
have working on. I met up with Mira and some
4:12
others in Idanoverse recently and you've got a great team
4:16
there that you're kind of working on this.
4:17
But I want to give you an opportunity to kind of tell us
4:19
about Natoma itself. So tell me, you know, give me
4:22
the the elevator pitch for what it is that Natoma does in the
4:25
market, especially for the identity stuff.
4:28
No, actually, Natoma, we basically help enterprises
4:33
accelerate their AI adoption without really compromising
4:37
security. And we really think of it as I
4:41
was been saying, identity is at the center of security.
4:45
So how do we really kind of think about all of that identity
4:51
pieces as you accelerate AI agent adoption?
4:54
How do you really make sure security is not compromised?
4:58
And that means authentication, authorization, the access.
5:02
And we are going into a world of where these agents will start
5:08
acting on behalf of humans, doing stuff on its own.
5:13
And if you get into that part, you really want the right level
5:16
of authentication authorization and that's what Natoma does
5:20
really help exploit AI agent adoption, but security being
5:26
that that amount there. I mean, it seems like it's a
5:29
pretty good time to be getting into that considering the the
5:32
way that a Jetta guy has really exploded recently here.
5:35
Yeah, I definitely agree to that.
5:37
I mean, I don't know if it's the right time to get into it, but
5:39
we are definitely at at that inflection point where you
5:43
really need to make sure you have right security guardrails
5:47
as you're thinking about. I mean, Gen.
5:49
AI definitely changes the game in many, many ways.
5:53
And especially if you think about it, we've just been using
5:57
from a consumer standpoint as enterprises start really
6:00
adopting Gen. AI, be it for Productivity
6:03
Tools, be it for like, you know, simplifying all the work flows
6:07
that you have, it really, really elevates the game.
6:12
And if it if you're really thinking about, as I was saying,
6:14
the world where these agents start operating and executing
6:17
and planning for you, security, authentication, authorization,
6:23
all of that becomes super critical tell.
6:26
Me about the name Natoma. I almost always curious about
6:29
the names of products in this space.
6:31
What does natoma mean? Does it mean anything?
6:33
Like, how'd you come up with that?
6:34
It's a great name, right? What do you think of the name?
6:37
I don't even know what to think about.
6:38
It's so unique that I don't have like a a definition or even
6:42
associated with in my brain. That's why I'm like, where did
6:45
this come from? So I'll tell you the actual
6:50
meaning of the name. So Natoma actually means
6:53
Clearwater in Native American language.
6:55
There's a lake called Lake Natoma near Sacramento and
7:01
that's very unique name. One of the criterias was to make
7:07
sure the name that we pick for the company, it's very easy to
7:11
pronounce. And coming from India, English
7:15
as a second language, the world is flat.
7:18
You're working with lot of different parts of the world.
7:22
It should be no matter where you are from, what accent you have,
7:26
it should be very very easy to pronounce.
7:29
But the real story if you want to know.
7:32
Of course, yeah. Yeah, it there is the bar called
7:35
Natoma Cabana right behind of Octa.
7:38
As I mentioned, I was at Octa and right behind Octa, my Co
7:42
founders are also from Octa and we used to go to the bar and
7:47
that's where we used to go. Think about this talk about
7:50
this. There's a street called Natoma
7:52
right behind Octa, which leads to that bar called Natoma
7:55
Cabana. And we used to walk there and
8:00
walk to the bar. Lot of different, lot of long
8:02
chats, lot of long meetings, lot of different meetings meeting
8:07
different people around the AI space on how to do it, of course
8:12
with a glass of beer in hand. And as you were kind of starting
8:15
off, you were thinking of a name for the company.
8:17
And we said, why not Potomac? It's all the criterias that I
8:22
put in place like a, it should be very easy to pronounce it
8:25
short. It should be unique.
8:27
And we said this is the name, we love it and we go there.
8:32
That's super cool. I love hearing like these
8:33
stories behind the scenes. So I got to ask this bar.
8:36
The bar is named Natoma as well. The bar is called Natoma Cabana.
8:41
All right, so do you use the Natoma like company name to like
8:44
try to get free drinks or something Like, hey, we're going
8:46
to name our company if you know you'll give us a little
8:48
something at the bar every once in a while.
8:49
You know, I've met so many people at the bar.
8:53
The actually literally couple of weekends back I met someone, I
8:58
was at a wedding and the person was like, you remember, Yeah, we
9:01
met at that bar. We were talking about it.
9:03
What was the bar name? I'm like, yeah, Natoma.
9:05
That was the bar we used to everybody meet.
9:08
We haven't told the bar yet that we called ourselves behind them
9:12
on inspired by the name. Hopefully they don't come back
9:16
and sue us, you know, or come back for some check saying hey
9:21
you guys, we were the inspiration, so pay us back.
9:25
OK. Well, I'll get off that subject
9:26
just to not draw any more light to that, just to kind of protect
9:28
that. Let me put my Jaden CSO hat on
9:31
though here because I feel like there's so many different
9:33
security tools out there, it is impossible to keep up with
9:37
everything and especially in the identity space that seems like
9:39
there's something new all the time.
9:42
I'm going to ask you a hard question here.
9:43
If you maybe use some of those flattery points is so tell me
9:46
what is it that makes Natoma different or special or unique
9:49
on how you approach the problems you're solving versus the others
9:53
in the market that that you would consider?
9:55
I have to say, I would say these things that really makes us puts
10:00
us apart, right? It's uniquely blending that
10:03
efficiency with security, right. Our platform is we really
10:09
believe in that one click deployment model, right.
10:13
You know, Amazon kind of started that and everybody wants to do
10:18
it. So have that one click
10:19
deployment model, but also with like flexible deployment, like
10:23
you know, it's not just a hosting platform, you're not a
10:26
infrastructure, but then you blend that with like the right
10:31
level of security, right level of authorization, right level of
10:35
access controls in place, right? So that's number one.
10:39
Number two is we are really, really focused on end to end,
10:43
right? Like the end to end user
10:45
experience, not only just from like an admin experience, but
10:50
even from like end user employees of an enterprise
10:54
trying to use that making sure that end to end user experience
10:58
is really good. I hate to use this analogy, but
11:02
we've taken the the iPhone approach right.
11:06
You don't need a manual to use an iPhone.
11:10
In fact, my being in India, my grandma also uses an iPhone,
11:14
right? Anybody can use an iPhone.
11:17
That's the approach you've really taken.
11:19
And the biggest and the best part is policy enforcement,
11:22
right? Like you really need, as this AI
11:27
agents get bigger and bigger and as the proliferation happens,
11:32
you really need like that dynamic access controls.
11:34
You want to ensure like every agent has the right level of
11:39
access and the humans interacting with that agent have
11:43
the right level of authorization on the actions they are taking.
11:47
And as the world gets into like, you know, agentic AI where the
11:52
agents are acting on behalf of humans, they have the right
11:55
level of authorization. So it's that policy enforcement
11:59
point. We that is where we kind of
12:02
bring in the the unique selling point differentiation for us in
12:07
a way. They talk about that sort of
12:10
explosion of the number of AI agents that are out there.
12:12
And I guess as we get into this world of agentic AI that is
12:16
being thrust upon us, really there are so many different
12:19
things. Is that is that the main
12:20
problem? Is it, is it the scale, Is it
12:22
the volume that these things are happening?
12:24
Are there other parts of the broader landscape of agentic AI
12:27
that we also need to solve? Like what are your thoughts on
12:29
just what are the problems to solve for agentic AI from an
12:33
identity perspective? I mean, it's the, if I were to
12:41
think about it a little bit more, right, even before the
12:44
scale and all of that piece, it's it's the discovery, right?
12:49
Like you have your shadow AI that's happening these days.
12:54
What do I mean by a shadow AI? It's like you're AE going and
12:58
connecting something to your zoom and going and connecting
13:01
something to your sales force. And you think that, hey, that's
13:06
what's the big B that, but it's, it has access to what Jeff has
13:10
access to, right? And what is it?
13:13
Where is the data? What data is pulling?
13:15
What kind of things you put? So that that shadow AI, the
13:19
shadow MCP discovery, that becomes really, really important
13:24
first and foremost. And then once you kind of go
13:27
beyond that, once you start getting, you know, a little bit
13:31
control around it, the the second piece that really comes
13:36
in is like, how do you make sure it's super easy to use?
13:39
And it's, it's actually delivering value from like an
13:44
enterprise perspective, not just that, Oh, it's, it's so cool and
13:47
it can look what it can do, but can it really actually go solve
13:52
some of these problems in a way? And the the last piece that is
13:59
definitely top of mind is like, you know, with with new
14:02
technologies, with new protocols, new threats coming.
14:08
And how do we really before this becomes like such a big problem
14:12
and such proliferation happens. How do you really make sure that
14:16
you have the right level of guard rails and right level of
14:20
security in place for the new threats that are emerging?
14:23
And new threats. Some of them we know.
14:26
Some of them we don't even know about, you know?
14:30
Yes, yeah, it's, it's very hard to protect against the unknown
14:32
right now. But there are certainly things
14:34
that we know. You mentioned things like MCP
14:37
model, contacts protocol and there's new, that's a new
14:40
standard that's coming around. There's A to a you also
14:43
mentioned the time to value. And before I get to MCP and A to
14:46
AII, do want to understand like, how is it, how does Natoma, you
14:50
know, the customers you've got, how do they measure success when
14:53
it comes to getting that value out of a deployment of Natoma?
14:57
Like what are some of the, you know, key performance indicators
15:00
or key metrics that are like, Oh yeah, this is worth the
15:03
investment that we've made in it.
15:04
Do you have some things you want to share with the audience on?
15:07
That no, yeah, definitely they're, they're two folds,
15:09
right. I mean, I keep going back to
15:11
that ease of use cases. If you look at what our mission,
15:15
our mission even on our website, it's how do we accelerate AI
15:20
adoption without compromising security.
15:23
So it's that acceleration piece, right?
15:25
That ease of use and that acceleration is what we double
15:30
click on every single time we talk to a customer and every
15:33
single time we go and do a pilot and go and convert a customer.
15:39
It's that is the value they get. It's like, hey, OK, how easy was
15:44
it and how did we really help you increase the productivity,
15:48
right? If you think about like the
15:50
journey that enterprises are today in terms of like adopting
15:55
agentic AIRAI agents is everything is around the
16:02
productivity and improving productivity.
16:05
So a simple use case would be leveraging these AI coding
16:10
assistance, right? You did, you can leverage those
16:16
AI coding assistants as a developer.
16:19
It does improve productivity, everybody agrees to it, but it
16:23
can really enhance it if you're connecting this to enterprise
16:26
tools and data, right? So if you have like, let's say a
16:29
GitHub Copilot or if you're looking at a cursor and how are
16:32
you connecting back to your GitHub and to your JIRA and your
16:39
linear tickets and Atlassian world, How easy do we make it
16:46
for admins to give the right level of controls to make sure
16:49
that how easily does these tools are getting connected?
16:53
But then from the other side, also, how easy it is for end
16:57
users to make sure they're like, you know, developers tools are
17:02
connected to these enterprise things.
17:05
So if you tie those two back together, so that becomes like,
17:08
you know, what is the value it's really delivering how quickly
17:12
they were able to accelerate and how much did the productivity
17:16
input, right? So that that exploration piece
17:19
of hard and also depends. I mean, that's one specific use
17:22
case. If you think about like AI
17:23
agents, right? What kind of what is the end
17:27
user enterprises goal? What are the use cases they want
17:31
to solve? So it could be anything from
17:33
like, you know, IT operations or security operations and like
17:38
trying to simplify some of those things.
17:41
So what is the number of tickets that they have reduced and how
17:44
much like you know, security operations, how much did it
17:47
really help you, how quickly you were able to go solve a new
17:52
alert and get into the bottom of the new alert.
17:55
So depending on basically we always, always, always die back
18:00
the success of our platform back to what the customer wants to do
18:05
it wants to do with it. And that means understanding
18:09
customers use cases and understanding what are their
18:13
goals. If their goals is that IT
18:16
operations and reducing the number of IT tickets, did we
18:19
help them deliver that? And if we measure the the
18:22
success there boom, we are successful.
18:25
If it is employee productivity, did we really quantifiably
18:29
improve that productivity? Boom, we are successful.
18:32
So you mentioned MCP and sort of tying things together.
18:35
I, I think this is still a new terminology for a lot of people
18:38
out there with MCP and model context protocol and then A to a
18:42
or agent to agent and the West. I guess the way I can't describe
18:45
it is this is sort of like the connective tissue or the glue of
18:49
how different AIS supposed to talk to each other and resources
18:52
again to you. But you're probably more of an
18:55
expert than I am on that. So I'd love to hear like your
18:57
definition of what MCP and A to A is and then how does that
19:01
relate to the kind of stuff that you work on?
19:04
Well, I'm not an expert by any means, you know, I'm like
19:08
definitely not an expert, but I'll take a I'll I'll try my
19:11
best. If I were to take you, you want
19:15
to understand why we need MCP and what is MCP like?
19:19
I always like to start with the why, right?
19:22
Like like as Mr. Simon Sinek always says, start with the why.
19:26
I truly believe in that. Why do we need MCP?
19:32
So we have to take like a step back.
19:34
Let's go back like couple of years, right?
19:35
I mean, or maybe even few years back.
19:38
This whole thing basically started with Google coming out
19:41
with, you know, Google Brain team coming out with the the
19:46
Transformer models and chat GPD come openly and comes out with
19:49
Chat GPD in 2022. Was it 22 in December or
19:54
whenever? And that completely changed the
19:57
game, right? And but it changed the game from
20:00
a consumer use case. It was like AQ and a it was
20:02
like, Oh my God, look, it can do this.
20:04
Oh, Oh my God, I can go actually search and get better search
20:08
results and it's you know what, it was a game changer, but it
20:13
was very consumer driven. Even if you look at like the
20:15
worldwide. Conference from Apple recently,
20:19
right, They were talking about Apple intelligence and what is
20:22
Apple intelligence? It's talking about like hey,
20:25
tell me when is my what's the status of my mom's flight That
20:29
was the example they use and what were they doing behind the
20:32
scenes Apple intelligence was going and talking to your e-mail
20:37
figuring out what was the schedule your mom was supposed
20:40
to come in goes online figure out like what your what's the
20:47
status of the flight and it's kind of giving responses back.
20:50
So point being all of these were great for end user consumer use
20:56
cases where MCP comes in or where AIO Jennya was lacking was
21:05
around around enterprise use cases.
21:09
And what do I mean by that? You get real actual benefit.
21:14
Like, you know, I mentioned like these use cases, number of
21:17
tickets and like, you know, some of these automated stuff you
21:20
could really reduce. You can really do that when you
21:25
connect Gen. AI we enterprise rules and datas
21:30
and applications. This is where the brains of the
21:34
enterprises. This is where everything is
21:37
posted. So if you're really connecting
21:39
your, if you really want to connect your AI agents, your
21:44
LLMS, your models to enterprise tools and data, that is the
21:49
biggest challenge. That is when you really unlock
21:53
the power of a Gen. AI.
21:56
That is also the biggest. And that's where MCP comes.
21:59
That's where it kind of changes the game.
22:02
So let's talk about it. How was it done before MCP
22:07
connect your LLM models to your enterprise tools and data.
22:11
You were leveraging API calls, right?
22:14
You were just doing like bespoke API integrations and connecting
22:19
to that. So if you have want to build
22:22
like 10 agents, right, or 10 clients and you have 10 data
22:28
sources or 10 applications on this side, every single time you
22:32
you may build A use case with one agent and you're connecting
22:35
to this ten data sources and boom, this is powerful.
22:38
It's like a very bespoke manual integration.
22:41
You try to go build another one, you have to redo all of those 10
22:45
again. So it was that M cross N
22:47
problem. You have 10 on this side, 10 on
22:50
this side. So you're looking at 100
22:52
different integrations and API proliferation and won't even get
22:56
me started. The challenge is there right
23:00
where MCP comes in. It's an RPC protocol.
23:04
So it is still a client server protocol, but what it does is
23:09
actually is a wrapper on APIs and it actually leverages that
23:17
line to server integration. So for all your like the ten
23:21
data sources or applications or services that you had, you can
23:26
create servers for that, MCP servers for that.
23:29
And now you can have all these agents just talking to these
23:32
servers. So if you have this one use
23:34
case, one agent that you build for these, once you start, you
23:38
do a build another agent, you don't need to restart and
23:41
recreate all of those things. So you go from the 10 cross 10
23:45
to 10 + 10. So it's a model need a way to
23:49
provide context to all of your LLMS in a way.
23:53
So these LLMS, they become powerful when you provide your
23:56
data context to them, right? So that's that's the magic of
24:01
MCP. The other big, Big Magic, in my
24:04
opinion is what they call as dynamic self discovery.
24:11
I think this is like a very underlying unknown power.
24:15
If you say, what do I mean by that?
24:17
It's like when these agents, they start, they boot up without
24:21
changing any code. You can just tell them that,
24:24
hey, this there is this MCP server.
24:26
So it boots up and it goes and say, OK, I see there's some MCP
24:29
server. Let me go and figure out what
24:33
that server can give. And overnight without doing any
24:37
changes, you can add actions, you can connect different data
24:41
sources or data tools, applications, but you can also
24:44
provide different actions to it, right?
24:47
So it can actually add boot up time, do that dynamic self
24:50
discovery and automatically become more powerful.
24:53
And that's why I've really believe this MCP is like a
24:57
massive game changer in terms of like how you can provide that
25:01
context to your LLMS and things like that.
25:05
And that's where, where the world is going.
25:08
If you think about it from A to a perspective, that's when the
25:12
agents to agents start interacting with that, right?
25:14
MCP was started, developed like it's such a young protocol to
25:19
begin with. It was started and it was
25:22
announced in November 25 by Entropic.
25:25
And here we are six months in. Like it has been like adopted by
25:30
the community. There's been so much it's an
25:33
open source protocol, so much community development has
25:36
happened on to it and build on top.
25:41
Google came out with A to a protocol and what's the theory
25:45
there? Awesome.
25:48
MCP is great when you want to collect or connect your LLMS and
25:51
your agents to your enterprise data sources.
25:56
But the world is going where these, as I was saying, these
25:58
agents will kind of interact and talk with each other and they'll
26:04
like plan, strategize, execute on its own.
26:07
So you really want domain specific smaller agents, right?
26:12
So think about like agents which are small agent that's connected
26:17
to your sales force and doing some sales stuff.
26:20
And then you have a different agent which is going and doing
26:22
its marketing stuff. And when these agents need to
26:26
talk to each other, they end up leveraging the agent to agent
26:30
protocol in a way. But I'm sure as you're thinking
26:33
through all of this and like agent identity and like human
26:37
identity, like it opens up a massive identity access
26:42
authorization can of bombs. But it's not only just that with
26:46
newer protocols, it opens up newer security challenges, newer
26:51
vulnerabilities as well. I mean, the explosion of this
26:54
has been crazy and I think we've used the word explosion like 5
26:57
times so far. It's conversation, but it's
26:59
probably the most accurate way to describe it because it's
27:01
accelerated so quickly. And to see and yeah, and to see
27:04
the technical, you know, groups get behind this.
27:08
I mean, I've seen standard developments in the past that
27:10
takes years, but this is moving very quickly to all of a sudden
27:13
say, OK, well there's a bunch of big names supporting MCPN and A
27:17
to A and all that good stuff. I, I'm just curious, like how do
27:20
you navigate, you know, developing product at the same
27:24
time these things are still being developed and you know,
27:27
maybe they're not even on solid ground yet, or maybe I'm wrong.
27:30
I'm, I'm not as closer to it probably as you are.
27:31
But, you know, is there a common set of rules that have been
27:34
established that you can effectively start building
27:37
capabilities and services on top of those things while they're
27:39
still building sort of the rest of the boat?
27:41
Yes and no. I mean, it has it does like, you
27:45
know, we as technologies when we start building new stuff, we
27:49
always just want to move 1000 mph, right.
27:53
So is the protocol like solid and it's like being like taught
27:58
through and there are no holes to it?
28:01
Absolutely not. Having said that, is the
28:03
protocol well adopted and here to stay 100%.
28:08
Will it keep evolving? Will will it keep changing 100%?
28:12
But that's the, I mean, that's that's the magic of like a start
28:19
up, right? Like you are really at the
28:21
bleeding edge and you are really thinking through like where this
28:26
can go, right? Nobody knows.
28:28
Everybody is trying to figure the puzzle out.
28:31
And here we are also trying to figure the puzzle out.
28:35
So does it make you nervous? It does, but it also makes you
28:40
think harder and it actually makes you like, I feel that
28:45
passion and that excitement. It's like we need to go figure
28:48
this out. Like nobody has figured it out,
28:50
like, you know, So we'll be probably the first one to figure
28:53
it out in a way. Well, if you wait for a
28:56
perfection, it'll never happen, right?
28:57
Like we waited for Olaf to be done?
29:00
Like the problem would have been insurmountable, yes.
29:03
Absolutely, absolutely you. So true.
29:06
And even for MCP though, there are certain RFCS for award that
29:10
needs to be adopted and could potentially change, you know?
29:16
Let's talk a little bit about that facilitating of the
29:18
connections between LMS and agents.
29:22
I feel like this is an area that is sort of now coming to light
29:26
because everyone like you know, says like Chachi BT comes out
29:28
and you got Gemini and Claude and you know you name it, it's
29:31
out there. What is the powerful part is, is
29:34
connecting to that data. Now me as an enterprise user or
29:39
owner of enterprise data, I got to make sure that I am really
29:42
secure and really sure that whatever is access, my data is
29:45
correct and they are authorized to access that particular data.
29:49
I think this is where those connections between a, you know,
29:53
let's say a generative LLM versus a resource or a company
29:57
specific data repository, you know, you may you, you've got to
30:01
make sure that connection is secure.
30:02
And then you've also got to make sure the connection to the
30:04
agents that might be interacting with either of those things is
30:07
secure as well. Can you talk a little bit about
30:09
how Natoma approaches that, that connectivity and that
30:13
facilitation? No, absolutely.
30:16
Yeah. So that's where that's where we
30:17
really play, right. That's really ensuring that as
30:21
these LLMS, these agents are kind of interacting those
30:23
enterprise data, as you said for enterprises, that is your IP and
30:28
that is what like is, is your secret sauce in a way, right.
30:35
And as you're trying to connect these models, NLMS, these AI
30:41
agents for your use cases to the data, we kind of play in that
30:45
middleware. And what we provide that Natoma
30:49
agent access provides is basically 3 layers of
30:53
authentication and authorization control.
30:55
So Step 1 is basically, of course, we leverage more author
30:59
on the way. But Step 1 is like, but you
31:02
will, is this agent even allowed to talk to a certain data?
31:06
So let's take GitHub as an example, right?
31:10
You have like agent 1 is agent one allowed to talk to GitHub.
31:14
So you can configure that Tunatoma that a only agent one
31:20
in your enterprise is allowed to talk to GitHub.
31:23
But it's not only that we don't stop that.
31:25
Then we provide the next layer of it, like OK, Agent 1 can talk
31:29
to GitHub, but agent 1 can only do such and such actions.
31:35
So you can control what rules have been passed back as NLMS,
31:40
recorded tools, what agent this agents LMS, what actions can you
31:45
take in your downstream applications.
31:48
And the third pieces is what you were talking about.
31:51
When users interact with these agents or when users are like
31:57
when these agents are acting behalf of users, what can they
32:00
do, right? So like, let's say we take
32:02
continuing on that GitHub example, let's say only agent 1
32:05
is allowed to talk to GitHub. You say, hey, you can actually
32:09
do list commit with this agent, but you can't do batch commits,
32:14
for example. And then when Jeff is
32:17
interacting with this particular agent, you can actually go and
32:22
do Jeff can do this summits, but it should be able to do this
32:26
summits of only the repos Jeff has access to versus when
32:31
separation is going and doing list summit, it should do only
32:34
for the, you know, repos that paration is access to.
32:39
So really tying back that authorization, fine grain
32:44
authorization of the end users indoor and that is where we
32:48
really play. It's at 3 levels of access and
32:52
fine grain authorization because you are sitting into a yeah.
32:57
No, please go ahead. No, I was just going to say
33:00
that, you know, you are getting into a world where eventually
33:03
these agents are going to act on behalf of Jeff and they are
33:08
going to become smarter. They are going to start
33:10
executing the, you know, when to like we're moving away from
33:13
like, you know, the enterprises work in that workflow
33:17
environment, right? Like there is like, hey, new
33:20
employee comes in so that triggers like, OK, somebody
33:23
needs to create a user and work day and then that's going to
33:26
push down into Octa and new laptop needs to be shipped out
33:30
and new to provide like medical insurance and water.
33:34
So there's some chain of events. We are going getting into a
33:37
point where enterprises are going away from that workflow
33:40
strategy into like doing some works and that will become
33:44
conversation, right? Like LLMS are doing this.
33:47
You don't need to have like, oh, somebody's going to join it.
33:51
It can completely change that workflow model in my opinion,
33:56
and that's when having that right level of controls is very
33:59
important. That opens up a question of, OK,
34:02
so if I have a bunch of agents that are acting on my behalf,
34:06
how to, how to, how to me as the user, you know, direct those
34:11
agents on to what they can and can't do.
34:13
And, you know, how ephemeral does that access even live?
34:16
Because maybe these agents are, you know, they only live for
34:19
maybe a few milliseconds to perform a specific task and they
34:22
are shut down or decommission or whatever you want to call it.
34:24
I mean, that's, that's part of the challenge.
34:26
You're right. It's not only the, the scale,
34:27
right, the number of them, but it's the speed with which these
34:30
things can be created, destroyed, recycled, whatever
34:33
you want to call it. Is that right?
34:35
Yep, absolutely true, absolutely true.
34:37
And this is where we really come in and play as well.
34:40
It's like if you need to have those identities associated with
34:45
those agents, so you really need to keep a list of that.
34:48
But also like when, when these these become ephemeral, we
34:53
really need to make sure that like, you know, we provide you
34:59
controls, we provide enterprises controls that if the agent is
35:02
going to act on behalf of Jeff, it can only take certain
35:06
actions. And if it really wants to take
35:08
certain other actions, you need step up off like basically
35:11
everything that we've learned in our identity practice over the
35:16
years. How do we deploy that in a way,
35:19
right? So bringing that wearing that
35:21
Octa hat back on or like wearing those things.
35:23
Hey, if the agent needs to do a certain action, we need human in
35:29
the loop still, Jeff needs to come in and like, you know,
35:33
provide that biometric so you can control what actions the
35:36
agent can take on behalf of as an impersonation versus when
35:41
it's it can't take on acting on behalf of it and or human in the
35:46
loop is there. I'm glad to hear that.
35:48
Like we're getting smarter on how we approach some of these
35:50
things. It's not like you can give a,
35:52
you know, a, a token to, you know, an agent AI and had to
35:56
pull out this little key ring and say, OK, give me the 6
35:59
digits in there. You know, I'm talking physically
36:01
and I'm sure digitally that's probably the way to do it.
36:03
But I, I'm glad to hear they're getting smarter.
36:05
And so now I'm like, OK, so this sounds pretty cool.
36:08
How do I actually set this up? Like what's it like to deploy a
36:12
product like this into my environment?
36:14
Is it? Does it sit there and I I give
36:17
it a bunch of access and kind of reads the environment and gets a
36:19
discovery And then how do I manage policies and and things
36:23
like that? It's super easy.
36:26
Customers have been able to do this in less than two hours with
36:29
us. It definitely discovery of
36:32
course takes a little longer like you go to platform goes and
36:37
actually does all the discovery of like shadow MCP servers or
36:40
like shadow AI and really bring that in.
36:43
But then also that's where we kind of started, right?
36:46
Like the first part of our company's history was really
36:49
focused on doing that shadow AI discovery in a way.
36:54
But where we've been really better can really make it easy
36:58
is like, again, remember everything I was staying at the
37:02
beginning, ease of use and one click deployments and things
37:06
like that. Admins can come in there.
37:09
They've been we've had customers able to do this in less than two
37:13
hours, control this out in in their organizations.
37:18
Of course, controlled environments, not like like, you
37:21
know, how can gold it's done in wild, Wild West.
37:25
There's obviously this world is changing so fast and but we've
37:30
made it absolutely easy and giving you the right set of
37:33
controls to rule it out. Literally, we've had customers
37:37
successfully launch it in less than two hours and to a point
37:40
where in certain cases we've they've just given them a here
37:43
it is. You can just go create this
37:45
tenant and go play with. I literally last week, I wish I
37:49
could have shared some of those slacks that I got.
37:53
The person was able to use it connected and he said, oh,
37:57
everything was quite intuitive. This is awesome.
37:59
And the reason we actually enforced him to do that because
38:03
of that, the iPhone analogy I was trying to make, you do not
38:07
need a manual for it. We don't.
38:09
We want to build a product that nobody needs a man at the end,
38:14
at the end of it. We had in the age of here and we
38:16
are trying to build a product we solve for here.
38:18
If we need a manual for that product, we've failed somewhere
38:21
miserably, you know. That's a pretty quick, you know,
38:25
time to value to deploy, be able to deploy so quickly.
38:28
Once I've got it deployed, I'm curious, like what are some of
38:30
the things that I can do maybe from like a policy standpoint as
38:33
administrator, do I define and say, you know, here's a list of
38:37
my resources or am IA different AIAI agents?
38:40
Or like what does this look like for me as a, let's just call it
38:43
a security administrator? I don't even know what the great
38:45
role would be, but to say, OK, I've got Natoma installed, now
38:49
what? You get it, you get it up and
38:52
running. You can control like you can
38:54
create these MCP servers, whatever you want to connect
38:58
your, let's say your, let's pick cursor as an example.
39:02
You want to connect cursor to whatever tools you can do that
39:05
one click deployment of your MCP servers and roll it out to your
39:11
end users. And like, you know, just the end
39:14
users see these servers that are available to them that they can
39:18
go and connect back to connect their courses of the world back
39:23
to those tools like linear or Atlassian or GitHub or whichever
39:28
1 you want. Or on the flip and whatever IT
39:33
operation tickets you're trying to connect, like, hey, you want,
39:36
you want your chat GPD or like enterprises have these wrappers
39:41
around chat GPD. You want to go connect to Octa
39:44
and sale point and like, you know, cyber Ark and service.
39:48
Now we solve some of those common use cases and like, you
39:51
know, like a lot of these use cases that can automatically be
39:56
reduced having like an AI coding assistant.
40:00
So you can create these spin off these MCP servers.
40:03
They are kind of managed by like the IT admins and they can go
40:08
connect back to your GPTS and users can connect to their
40:13
coding assistant tools. And boom, now all the data is
40:16
kind of going through it. But not only that, we can, as we
40:20
go and connect to it, we can discover any shadow MCP servers
40:24
or shadow AI that's out there. Any of those that have some
40:28
people might have already ruled out.
40:30
So from security profession, they start getting some of these
40:33
controls there. And the other benefit, you know,
40:37
as I was kind of mentioning, there are a lot more other
40:40
Security benefits, right? Like if you think about it like
40:43
what are the new age vulnerabilities that are coming
40:47
into like shadow MCP? So I'm sorry, malicious MCP
40:54
servers, tool poisoning, tool hijacking, rug pull attacks.
41:00
So having like a platform that has actually verified MCP
41:04
stores, we've actually built like MCP scanner, security
41:08
scanner and contributed back to the community.
41:11
So we scan, make sure that all of those vulnerability exists,
41:15
making sure that all of these are doing vulnerability
41:20
management, version management, all of that you get
41:23
out-of-the-box straight away. Yeah.
41:25
It sounds very interesting. I was going to ask you about the
41:27
sort of what happens if I have my own MCP servers, but you pull
41:30
those in. I think this is probably
41:32
something that might be getting overlooked is what happens if a
41:35
rogue MCP ends up getting out there.
41:37
You're able to detect that and then, you know, surface that for
41:40
somebody to do something about it, either block it or.
41:43
Whatever even before, yeah, we even before we on board like an
41:47
host and MCP. So we will make sure that we
41:50
have a scanner and check and make sure they kind of fit in
41:53
that there are no vulnerabilities.
41:55
We find those vulnerabilities, we make sure that hey, these are
41:58
fixed again, depends on like it's community developed who's
42:03
contributed to it. So we look at those MCP like
42:06
those vulnerabilities. Lot of times we've actually,
42:09
because it's such an early in the game, we've actually taken
42:13
back those and we said, hey, we need to fix all of these things.
42:15
Let's go ahead and fix it. And then we have them the right
42:19
hosted 1 and we have like version controls on top of that
42:24
as well. Enterprises have actually also
42:28
build their own MCP servers for their own custom applications.
42:32
We've been able to bring those as well.
42:34
We are also building MCP servers for different agents as well.
42:40
So I have to ask, I'm kind of curious and kind of my last
42:42
question for you here is this idea of Shadow AI and Shadow
42:47
MCP. I'm curious if you're customers
42:50
and I don't want you to name and shame or anything like that.
42:52
But this is more of a, are they discovering like shadow MCP
42:55
servers out there where developers have something?
42:57
Because I'm, I'm not finding a lot of regulation and governance
43:01
yet within organizations on how to even tackle the governance
43:05
of, you know, how do we set up AI within our own organization?
43:07
You know, those sort of things. I'm so glad you cannot ask this
43:11
question. That was a super smart and they
43:14
will try out these new protocols and they'll download random MCP
43:18
servers without thinking about security, without thinking about
43:22
access. So when we go connect week, we
43:25
go and find so many of these shadow MCP servers.
43:29
So you're climbing this giant mountain of AI.
43:31
And so that's my perfect segue into sort of ending the
43:34
conversation here. And I'll let her know we were
43:36
talking as we're getting into each other, you know, before we
43:38
hit record here. And you mentioned that you like
43:40
the outdoors and hiking and sort of things like that.
43:44
And I'm curious, like what is your most memorable hike or
43:48
climb or whatever way you want to describe it?
43:51
My most memorable definitely would be the Mount Whitney hike.
43:55
That's that's the the highest peak in Lower 48 country
44:01
continuous United State. It is.
44:06
It took us, believe it or not, like we were, we were slow.
44:09
We were hiking with the group, We made sure we did it with the
44:12
group. The entire group made it up,
44:14
came back down. It took us more than 24 hours.
44:18
We were hiking for 26 hours non-stop.
44:21
Generally people take like 18 to 20 hours is the norm, but we
44:28
were a bit slow. But it was one of those hikes
44:31
that really challenges you and very, very vivid memories of the
44:39
entire fight. But though the funny story to a
44:44
point where like it, it became so painful that coming down not
44:49
be somebody else, they were so tired, they were actually hiking
44:54
backwards. So if you've been hiking down
44:58
for too long, it does get hard on your knees.
45:00
Of course, I think backwards it is actually a little bit easier.
45:05
So of course, not on the rocky parts and not on the switchbacks
45:08
that are like some 120 switchbacks on the top near the
45:12
top. But eventually when we were
45:14
hiking down the car, we just started hiking backwards.
45:18
OK, so this is new to me. I've never heard of hiking
45:20
backwards. So you're you're you're
45:22
essentially walking backwards down the mountain.
45:24
Is that it might describe that. I mean, it seems almost like a
45:26
comic book. It doesn't sound funny, but you
45:29
actually see it is quite funny. We still give, but it's better
45:33
to give more. Harder, I guess it's where
45:35
you're more comfortable or something like that.
45:38
I guess it's just better for your knees because you are
45:41
constantly hiking down. It just keeps hurting.
45:43
Knee keeps hurting and 26 hours, it was a long, long day for
45:50
sure. And like 26 hours.
45:52
All of those 26 hours we would be at least hiking for maybe 23.
45:57
We spent like good 3045 minutes on the top at the summit.
46:03
It was, but it was truly worth it.
46:05
We did. We did light up a cigar.
46:07
We did take some alcohol. Did not did not have the energy
46:12
to drink it, but we did definitely light up the cigar.
46:15
So you must have some really good pictures kind of being, Oh
46:17
my God. There, of course.
46:19
Of course. How about animals?
46:22
Did you come across any bears, Mountain lions?
46:26
Yeti. Fortunately, no, fortunately,
46:29
no, I don't. Nothing actually that's it's
46:31
very close to. I don't know if you know, but
46:33
Mount Whitney is close to it's like Central California.
46:38
So it's. Like east of, it's like east of
46:41
San Francisco, kind of like in between San Francisco and Las
46:44
Vegas and like that area. Exactly, exactly.
46:46
It's southeast of San Francisco and it's near Death Valley.
46:51
Basically it's very close to Death Valley.
46:53
So it does get kind of doesn't get hot or anything, but it's,
46:57
it's a very barren land as such. So you don't really get any of
47:03
those, or at least fortunately we did not see any of those.
47:07
That sounds pretty fascinating. If you're hiking Half Dome, you
47:10
might end up with bears and stuff, which also I've done.
47:12
Half Dome was also good. But yeah.
47:15
Well, see, I don't need to hike anywhere because I have bears in
47:17
my yard here in in Ashland, North Carolina.
47:18
So, you know, I have I have black bears.
47:21
So they're not typically, you know, looking for trouble mostly
47:23
for food and things like that. OK, So I think I guess, you
47:28
know, that's it for today as we exit the conversation here.
47:32
What is something that you want the audience out there to know
47:35
about Natoma and the way you guys are thinking about
47:38
approaching this agentic AI explosion again, there's the
47:41
word again that we've been seeing here.
47:44
We are definitely at an explosion inflection point.
47:48
No, I mean, I, you know, generally there has been this
47:54
apprehension about like, oh, what will AI do and how it's
47:58
going to kill jobs and like, it's going to like have massive
48:03
problems. Don't, I would say do not be
48:07
afraid of it. Like this.
48:09
We went through as a like as a society, We did the same thing
48:14
back in 70s, eighties when like, you know, computers were kind of
48:19
coming up. There was this fear that Oh my
48:21
God, what's going to change? And then in 90s when Internet
48:24
was coming up and it's like, Oh my God, it's going to take away
48:26
all these jobs and things like that.
48:29
We are at a similar inflection point, so adopted.
48:33
But hey, as you are adopting and accelerating, Natoma can truly
48:38
help you accelerate without actually compromising security.
48:43
Well, I love that message because I think this is
48:45
something we can't stick our heads on the sands.
48:47
We have to understand it. It is a tool and we'll figure
48:49
out how to use it. Like you said, we've been
48:51
through this cycle before with computers, electricity, indoor
48:54
plumbing, right? These things go on the Internet,
48:56
right? All these things come.
48:57
Along and. We just have to figure out how
48:59
to adapt to it. So Paresh, I really appreciate
49:02
you taking the time with us today and definitely want to
49:04
encourage people to go out to your website, Natoma dot
49:06
IDNATOMA. We'll have links in our show
49:09
notes for be able to find that website as well as connect with
49:12
you Paresh on LinkedIn so people can share hiking stories or you
49:16
know, what the heck are you talking about with MCP servers
49:17
help, you know, things like that.
49:19
So again, really appreciate Paresh and for everyone
49:22
watching, listening, you can find us on the web
49:24
idacpodcast.com. Don't forget that like and
49:27
subscribe button and we'll go ahead and leave it there.
49:29
Thanks everyone for watching and or listening and we'll talk with
49:31
you all in the next one. You've been listening to
49:36
Identity at the Center. We hope you've enjoyed the show.
49:40
Make sure to like, rate and review, and we'll be back soon.
49:44
But in the meantime, hit the website at
49:47
identity@thecenter.com. See you next time on Identity at
49:53
the Center.