Latest / Identity at the Center / #279 - AI in IAM with Patrick Harding of Ping Identity

Transcript

#279 - AI in IAM with Patrick Harding of Ping Identity · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:22
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:26
Oh, not so bad yourself. Good.
0:28
It's been an interesting week so far.
0:31
And then we're early in the week.
0:32
You and I have been working on the business of a nonprofit.
0:38
And I remember we were talking about, OK, how do we set this up
0:41
and said nonprofit. Yeah, that sounds easy.
0:44
Let's do that. But I mean, if you think about
0:48
it, I mean five, almost five years ago, so our unofficial 5
0:54
year anniversary is July 2nd, right?
0:57
That was when we launched our first episode of the podcast
1:00
that was truly pirate radio and we operated for a couple years
1:04
just producing podcasts. And then we said, look, we want
1:08
to do some more things, bring some more content to our
1:12
listeners, and we want to go to conferences like EIC.
1:16
And none of that stuff is cheap. I mean, just running a podcast
1:19
of high quality is not cheap. And so here we are, right?
1:24
We have the nonprofit organization to set up to cover
1:28
a lot of that. And it's it's a lot of work.
1:31
It is. It has consumed my life I think
1:33
since December. I usually take the last couple
1:36
weeks off of December to kind of like recharge and going to get
1:39
ready. And I spent that entire time
1:41
getting trying to get things off the ground.
1:44
I really wish there was a like, here's some, here's, here's a
1:46
plea, right, for somebody out there like make an easy button
1:49
for this. Like, hey, I want to start this
1:51
and if you have a service that like helps do nonprofit in a
1:55
box, reach out to me because I I would definitely consume that
1:59
service. But it is a lot of work.
2:01
Well, the other the other big effort now is we're putting more
2:05
attention on our YouTube. And so I've been going out and
2:10
watching like, how do you grow your YouTube channel?
2:12
How do you make better videos? What's the key in here?
2:16
OK, it's thumbnails and it's this, but really it's the things
2:20
that we've been doing, focusing on the niche, which ours is
2:23
digital identity and being consistent.
2:26
So we publish an episode every Monday and then a lot of weeks.
2:30
It's more than that. So I think we're doing the right
2:33
things now. It's, it's tweaking.
2:36
But there are also like, OK, well here's you know, you can go
2:40
from what we have now like 250 subscribers to thousands.
2:46
You can have 100,000 subscribers if you got the credit card
2:49
you're willing to swipe. And I I propose a resolution
2:53
that we never do that because I don't think that's what we're
2:56
all about. I just want to have a a
3:00
organically grown YouTube channel just like we did with
3:04
the podcast. But I also would say that I'm
3:08
not against like asking folks who listen like go out and
3:11
subscribe to our YouTube. This is a shameless plug.
3:13
Subscribe right is. That I don't mind.
3:16
I don't mind doing the shameless plug.
3:18
I just don't want to swipe the credit card.
3:21
That that does not surprise me based on expense reports that
3:24
I've been looking at. Yeah, I don't.
3:27
I don't really enjoy spending money aimlessly.
3:32
No, I don't think anybody does. But yes, doing more on the
3:36
YouTube channel, go like subscribe to all that fun stuff
3:38
took us a while to build up the audio here.
3:40
We are now trying to build the video.
3:41
So we'll see how it goes. But you know we are, we are a
3:45
niche podcast. I think we're just helpful.
3:46
It's Identity access management, but we are worldwide, we have
3:49
listeners 10s of thousands around the world at this point.
3:52
And I forget the last count, but I think we were heard in just
3:54
about every country in the world, including North Korea,
3:57
which I find really interesting. Yeah, we've got one listener
4:00
there, I think, Kim. Jong is a IS.
4:03
Listening, the Supreme Ruler has somebody in in some office like
4:07
making sure that we don't talk negatively about his country and
4:11
and we won't if if you help us grow the subscriber piece there.
4:15
If you subscribe, we we turn a blind eye to issues like that.
4:18
Is that what you're saying, Jim? I hope.
4:19
Not, yeah, no. It has some integrity.
4:22
Well, you always finish the shows by saying share it with a
4:25
friend, share it with an enemy, we don't care as long as you
4:27
share it. But also in this, in this day
4:31
and age of where we're doing more video, if you look behind
4:33
me, if you're listening to audio, you probably, you
4:36
obviously can't see it. But I only have one diploma on
4:40
the wall. Now I'm going to put the other
4:41
one under it and then I'm going to take our Identiverse banner
4:46
from last year and put it there. And I mean the biggest thing was
4:51
this identiverse banner. It was really cool, you know,
4:54
having a room and Identiverse last year.
4:55
We're going to have spaces this year to do it again.
5:00
But that placard, you know, I valued us so much.
5:04
I carried it home all the way from Vegas, back through Atlanta
5:08
into Augusta, GA. On foot?
5:10
In the snow? Uphill both ways?
5:13
No, but. I was on that tram in Atlanta,
5:17
which you know, like how many people get on that tram and
5:20
don't hold onto a pole or onto something.
5:23
And then it comes to the hard stop and they fall all over.
5:26
Happens every single time. And like, I'm guarding this
5:30
thing with my life to make sure that people fall into the the
5:35
Styrofoam placard. Well, it's like, you know, we'll
5:38
we'll keep collecting those like Thanos collecting Infinity Gems.
5:42
Since we're going to be at Identiverse later this year, I
5:44
think we'll have some signings there too.
5:45
So hopefully you'll be able to get another one home.
5:47
Let's just start building like you know your background, just
5:50
be all conference identiverse or you know conference identity at
5:54
the center type type stuff behind.
5:55
You. My entire home.
5:57
My entire home. On the outside, yeah, speaking
6:02
Identiverse, we are going to be there. 2024 is coming up and
6:06
we've got a discount code for folks so time is running short I
6:09
think. I'm not sure if early bird
6:11
discount. It's really not early bird at
6:13
this point since we're less than a month away.
6:14
But if you're a a late attendee you can use the code IDV 2 four
6:20
Dash IDAC 25 and then I'll get you 25% off of your
6:24
registration. We'll have a link in our show
6:26
notes because I know that's really easy to remember.
6:28
But if you just check the show notes for us, or if you're
6:31
watching on YouTube, I'll have it in the, you know, the thing
6:33
below. You'll be able to to grab it
6:35
from there. But that is coming up May 28th
6:38
to the 31st. Jim, you and I will be in Vegas.
6:40
We'll be podcasting and I'll be moderating a panel with our
6:44
friends Sean and Atul and others, and just generally
6:48
gallivanting around town. As the Upright Gentleman Podcast
6:52
too, we're going to be recording podcasts and there's going to be
6:55
live listen options. We have two locations we're
6:58
going to be podcasting from. So I guess we haven't really
7:02
talked about how we're going to, where we're going to publish
7:05
those schedules. But I'm thinking on our website,
7:08
idacpodcast.com, we can schedule, you know, put out the
7:11
schedule so people can either sit in the room with us or
7:15
there's another one, which I've been calling the fishbowl
7:17
because it's a room with like, glass walls and they're putting
7:21
headphones outside of that fishbowl that people can listen
7:26
to the conversation that's happening inside.
7:29
You know what? I just.
7:30
Created more work for me to update the website with a new
7:32
schedule and a new apparently a new page and keeping it updated
7:36
in case things change throughout the week, which they will.
7:39
So thank you for that. How about you do it on LinkedIn
7:42
or Twitter or something like that instead?
7:44
I'm well, I'll definitely do that.
7:46
Definitely. I'll commit to doing that.
7:49
But here's the thought I was having is we're going to be in
7:52
this fishbowl with the headphones.
7:54
Is there going to be some Sandy wipes?
7:56
Sanitary wipes to? Because I don't want to put
7:59
headphones on that may have been used by several people before
8:03
me. Sorry, I just.
8:05
I don't want to. That's why I bring my own
8:07
monitors, so I'll just use those.
8:09
OK, well everyone else will have to use use those, so.
8:14
Yeah, the filthy unwashed peasants around us watching.
8:20
Yeah, that's not the only conference we have coming up,
8:22
right. We've got the a discount code
8:25
for folks who are going to be going right to the European
8:28
identity and Cloud conference EIC in Berlin which is the week
8:34
after I dinner versus June 4th through 7th in Berlin.
8:38
Discount code is EIC 24, IDAC 25 gets you 25% off.
8:45
The link will be in the in the show notes.
8:49
Or you can go to Cooper Coal dot com and navigate your way there,
8:54
but the discount code will work the same either way.
8:57
And then Identity Week. We'll be at the Identity Week
9:01
America in Washington DC September 11th and 12th.
9:05
There's also one in Europe June 11th through 12th in Amsterdam
9:11
and Asia. Identity Week Asia is in
9:14
Singapore October 22nd and 23rd. Discount code IDAC 30 which will
9:21
give you 30% off. It's a nice round Number.
9:24
You're getting better at reading these off this is.
9:26
I'm getting better. It's getting better.
9:27
The first time I tried it was like reading it word for word
9:29
and I was like never doing that again.
9:32
I'm trying to read off like a a super long URL.
9:35
That's a real bad idea. My favorite is when you gave the
9:39
wrong code for the wrong conference and I was just
9:41
sitting here like Nope, Nope, that's not right.
9:45
Hey, you always said we can call time out and we can.
9:48
Yeah, we can always do it now. We'll do it live.
9:50
We'll figure it out. What else do we want to talk
9:52
about before we introduce our guest?
9:55
Well, I think we should introduce our guest because
9:57
we've been going for quite a while now.
10:00
Yeah, let's get to it. Patrick Harding, he's a Chief
10:02
product architect at Ping Identity.
10:04
Welcome to Identity at the center, Patrick.
10:06
Thank you guys. Appreciate it.
10:08
Yeah. Thanks for taking the time.
10:10
Let's start with a little bit about your background.
10:12
How did you get into the IAM industry?
10:14
Is it something that you chose or did it choose you?
10:17
A little bit of both. I used to be way back in the
10:20
day, a enterprise security architect at Fidelity
10:24
Investments in Boston, and I was doing security pen testing,
10:29
firewalls, things like that, you know, back actually before it
10:33
was called cyber. So we're going to talk today a
10:35
little bit about artificial intelligence.
10:37
I know it's kind of a fad. It's probably not going to stick
10:39
around for a while, but I'd like to talk about it a little more
10:41
detail. One of the things that I find
10:44
interesting is the definition of AI because I feel like my
10:46
definition has changed, you know, within the last couple
10:49
years with you know large language models and and things
10:52
like that where it was. It's not just kind of behind the
10:56
scenes right now we're using to generate, generate things
10:58
generative AI. We want to talk about, hey, how
11:02
AI is impacting identity space. But before we get there, how do
11:05
you define AI today? Sure.
11:08
So I think you know we've been sort of doing and talking about
11:12
gene learning and I suppose many people might have called that or
11:15
would have called that AI. But I think the term AI now is
11:19
more associated with generative AI or Gen.
11:22
AI. We're thinking about the use of
11:24
generative AI, you know, basically.
11:26
Jim, how does your definition of AI stand today?
11:30
It's evolving. You know I thought you said to
11:33
Patrick was a degenerate AI and I was like, oh, that's something
11:37
I could get behind. That actually reminded me of the
11:40
presentation that Andre Durant did last year at identiversity
11:44
kind of showed the the bad side of AI.
11:47
Well, how it could be used as a weapon and I thought that's a
11:50
good term degenerate AI. But you know, I here's my, my
11:57
hold up with AI really is that I feel like it has the potential
12:04
to be a misused term where it's like, you know, tied laundry
12:08
soap. Now with AI you throw it around
12:13
too much then what does it really mean?
12:15
But I think you know Patrick let us down the right path error,
12:20
you know thinking of it around this generative AI more than
12:24
just hey, we we can do business intelligence with large data
12:28
sets because I think that's not really what AI was all about is
12:33
around using natural language and a system being able to
12:37
interpret that into something it can work with, right.
12:43
And then I love the iterative capability with the language
12:47
models, large language models as they call it, where you can keep
12:50
ask refining questions and either zooming in or or leaning
12:55
back to get the right answer what you're really looking for.
12:59
But I also do think what one of the things for me that that that
13:06
still surprised me about AI is that you could ask you something
13:10
like a math question and it can get it absolutely wrong and you
13:16
know it's wrong, right, because it's like not even close to what
13:18
you were expecting. And then you ask it, Are you
13:21
sure about that? Oh, sorry, I made a mistake.
13:24
And then we're going to fix the problem.
13:26
And what other computer technology do you know that does
13:30
stuff like that? It's almost like degenerate AI.
13:33
So there's another use for that term.
13:36
I mean one of the other ways to think about it is that you know
13:39
with Gen. AI, we're now talking about
13:41
stuff that can pass the Turing test.
13:43
And prior to prior to that I said I I think when we talked
13:46
about machine learning, that wasn't the case.
13:48
And you know now when you're interacting something and it's
13:51
human like, it's actually quite exciting to be honest.
13:54
Yeah, yeah. I mean, it's really cool.
13:55
This is finally like a technology you could see putting
13:58
inside a robot and now it's like more humanizing of the whole
14:02
experience. But one of the things you said
14:06
yesterday, Patrick, as we were talking through and preparing
14:10
for this call, was AI is going to be everywhere.
14:15
And I was wondering if you could explain to us what you meant by
14:18
that. Sure.
14:20
So I I just think that AI is going to emerge in you know all
14:24
products and services that we end up you know leveraging.
14:28
I think it's going to actually be fairly quickly adopted
14:31
whether you know, whether it's into, you know things we, you
14:35
know things, we drive the services, we're interacting with
14:40
the, you know, everything. Yeah.
14:42
And part of everything is how it's affecting the digital
14:46
identity industry. I was wondering if you could
14:49
expand a little bit on how you see AI fitting into the
14:54
industry, the good and the bad. So the conversations we've had
14:58
and turned that into the keynote, funnily enough, really
15:01
from from an identity standpoint, the way we've been
15:03
thinking about it, it sort of breaks down into two areas.
15:05
One is to improve our products and identity capabilities in
15:10
general, both for administrators and end users.
15:15
Also, it's how AI can be used for bad like dark AI, dark side
15:19
of AI. And that's really, you know the
15:22
realm of how AI can be used. Everybody knows and understands
15:26
deep fakes, things like that. But also how AI can be used to
15:31
perform other fraud. You know, whether it's
15:34
automating the generation of phishing emails, using
15:37
information that the AI can go and collect off the dark web, or
15:40
or just off the web in general in ways you can't imagine.
15:44
No longer are you going to see emails from Nigerian fraudsters.
15:48
Basically that misspells words and stuff like that.
15:51
So again I see it both the good but going to be used for fraud
15:55
too. Yeah, I mean, you're seeing that
15:57
already, right? The phishing emails are becoming
16:00
less obvious. Let's say that it's I I always
16:04
like, shake my head. Like the attacks are still
16:07
social engineering and phishing. They're still one and two, and I
16:14
kind of feel like, you know, on the social engineering side, the
16:17
use of video and voice over, you know, that seems to be probably
16:24
the most dangerous combination when it comes to AI for bad.
16:28
An employee in Hong Kong was joined on Zoom by a deep fake
16:33
video of their CFO and was basically talked into moving $25
16:38
million do a you know, fraudulent account basically.
16:41
So it's extremely real and a survey I think that were
16:45
released today or imminently where you know over 50% of the
16:50
respondents are very concerned about deep fakes right now.
16:54
And so it's it's a very top of mind issue across the across the
16:58
lobe right now. So we definitely have to get on
17:01
top of this. Yeah, absolutely.
17:03
And Jeff, I mean are there, do you have any thoughts in this
17:07
area about where you're seeing AI for either good or evil?
17:13
Well, the, you know, the the best example was our show opener
17:16
for April 1st where I took AI voices and turned that into sort
17:20
of how we open up the show. But sure, it's like anything
17:23
else, right? AI is a tool.
17:24
It will be used for good. It will be used for bad.
17:27
Patrick, you mentioned the Hong Kong scenario.
17:28
I mean 25 million or whatever. It was out the door because of a
17:32
very heavily invested attack. That's not cheap to do to get
17:36
like a bunch of people deep faked on a team's call and then,
17:42
you know, have to target essentially one person.
17:44
That seems to me like that was pretty targeted.
17:46
I know what they wanted to do there.
17:48
That took a lot of investment. But I mean A is everywhere now
17:51
at this point. It's helping us write emails, It
17:54
is helping us configure our security tools.
17:57
It is, you know, cleaning up voices and now people are
18:01
starting to use it to generate videos.
18:02
So I'm still a glass half full person when it comes to it, but
18:08
I think we do need to be careful about how it's used and to be
18:11
able to identify the provenance of how some of these things are
18:14
coming along. You know, is this really Jeff
18:16
talking on the screen, you know, and what you're hearing or is it
18:20
AI, How, how do you confirm that?
18:21
Is there a way to kind of, you know, make make that
18:24
authenticity known? So I you're landing in that in
18:28
that area, I I completely agree Jeff.
18:31
It's just going to be a constant cat and mouse game like it has
18:33
been in security for, you know, 20 years.
18:37
What we're going to actually, I think, have to actually change
18:40
the way that we think about using certain channels of
18:44
communication. Traditionally we've had this
18:47
implicit trust where the voice I'm listening to, I recognize
18:51
therefore it must be Jeff or it must be Andre.
18:54
The face or the the face I see on the screen looks like Andre.
18:58
So it's Andre. Basically.
19:00
We're going to have to start to get used to I think looking to
19:04
establish explicit trust but but doing it out of band.
19:07
So actually you know if I'm on a a voice call with Andre sending
19:13
me something out of band to say hey it's me Andre, I'm like that
19:18
we're seeing it a little bit in in in sort of that to me is like
19:21
peer-to-peer interactions. We're seeing it a little bit
19:23
more in sort of business to consumer interactions to a
19:27
certain extent where you know even though I'm talking to the
19:33
bank, the bank still needs to confirm it's me.
19:35
So they might ask me for a voice authentication for some sort of
19:38
other transaction. They might basically ask me for
19:40
a PIN. Yeah I think there's there's a
19:42
lot of good points and you think about the approach you just
19:45
talked about there reminds me of multi factor authentication.
19:50
You know it's multi factor and and realistically just like with
19:56
social engineering, just like with phishing, none of the
20:00
safeguards we put in place are going to be catch alls unless
20:04
people are skeptical enough to ask themselves a question.
20:09
Really. Should I click on the link and
20:11
type in my credentials and give this information?
20:14
Should I do secondary checks? Should I be skeptical and just
20:19
think a little bit of skepticism before sending 25 million even
20:23
though at all the people on the phone?
20:25
How about a text message to one of the people you know?
20:28
How about a a follow up phone call?
20:31
I don't think it, it doesn't necessarily need to be all the
20:33
time, but it's recognizing on certain certain interactions
20:36
transactions, requests that maybe that's worthy of an
20:40
outbound thing and exchange essentially to to confirm and
20:45
it's that confirmation step that I think it's important but it's
20:49
difficult. I mean it's it's going to we're
20:51
going to have to retrain people to not.
20:53
No, we don't. We tried to train people not to
20:55
trust every e-mail they see. We're going to have to, you know
20:58
train people not to trust every phone call, every video call,
21:01
stuff like that they see too. So that's again, it's going to
21:05
be challenging, which is why we need to set up sort of
21:09
established processes where people get used to the notion
21:12
of, you know, confirming out of band that they're interacting
21:15
with certain people and stuff like that.
21:17
It it's going to have to become second nature to them, otherwise
21:19
they'll forget. Let's talk about AI governance
21:22
because they, you know, I feel like the first time this topic
21:26
came up was really around things like ChatGPT becoming available
21:31
on the Internet and folks like us kind of discovering them and
21:35
being able to start to query information.
21:38
Then you start to think about, well, everything we're feeding
21:42
into this becomes part of the model, right?
21:46
And if we start putting proprietary information either
21:50
on purpose or by accident proprietary information, it
21:54
becomes part of the model. And so you know that's where I
21:58
first kind of became aware of where companies need to put
22:02
together some kind of governance, some kind of policy.
22:06
But I also see now AI is much bigger than just ChatGPT.
22:11
It's we're implementing products that have AI kind of baked into
22:16
them. We are maybe building products
22:19
that have AI built into them, maybe our end products that we
22:22
sell to consumers have AI. So given all that, where do you
22:26
see the AI governance, what's important and who are kind of
22:32
the the folks that need to be involved when you think about a
22:35
corporation? We ended up realizing that we
22:38
already have data governance like policies in place.
22:41
So we added some AI governance and then got everybody to sort
22:44
of re sign the data governance policies.
22:47
That's grown a little bit because it's it's expanded
22:49
beyond chat. GPT now where we've asked people
22:52
to basically let us know, are you looking what other services
22:55
are you looking at using to understand what their terms and
23:00
conditions look like the how they leverage you know the data
23:03
that we provide and share with them.
23:05
So again we, you know again we're being very cautious and
23:10
careful there. We definitely want to use Gen.
23:13
AI with confidential data, not PII but confidential data.
23:18
And in that case we're you know we're looking at just using
23:21
services like Open AI sort of enterprise capability where they
23:26
isolate the use of that data just to a model that's under
23:32
under sort of our control. So there's no leakage of that
23:34
information into other areas. So we're being very, very
23:37
cautious there. Obviously we can take it a step
23:38
further and say look we're not comfortable with any of that.
23:41
We're just going to run the open source models ourselves and
23:44
that's something else we'll we're we're evaluating too.
23:47
Is that realistic? I mean, in your mind, because I
23:50
I kind of expected the answer you just gave there, which is
23:53
that say you're building an identity management solution,
23:57
leveraging one of the big AI tech platforms for your AI
24:02
engine and then kind of carving out some kind of tenant if you
24:08
will, for lack of a better term. But is it realistic to think
24:11
that a company that specializes in one area of technology that's
24:18
not AI could build enough robust AI?
24:23
Or you're only looking at that because that's potentially the
24:26
only solution. When you're talking about the
24:29
use of say open A, let's say the GPT 4 APIs for example, they're
24:35
they're not, I mean they're they're slow.
24:38
They respond very, very slowly today, obviously likely that
24:41
will improve over time, but they they don't respond very quickly.
24:45
That's OK if we're talking about you know, sort of natural
24:48
language processing queries and stuff like that where people are
24:50
comfortable you know waiting for that response to come back.
24:53
But for other real time use where we're talking about
24:57
needing to get responses back in, you know milliseconds,
25:01
that's where we might need to evaluate the use of models that
25:04
might have been trained by the bigger models like the the, the
25:07
larger LLMS. But but you know where we're
25:11
running them locally ourselves and again these things don't
25:14
actually have to be very big but they can respond faster and they
25:17
become the. The way I think about it is, you
25:20
know I say ChatGPT, it is a is a an encyclopedia of knowledge.
25:25
It has vast knowledge of across lots and lots of things.
25:29
But you can start to think about trading models with far more
25:32
localized knowledge that might be very, very specific but very
25:35
good to certain tasks and you ask them to become experts in
25:39
something much narrower. Therefore they can respond much
25:42
quicker. And that and and being an expert
25:45
in something very narrower, maybe we can use an open source
25:47
model to do that and and run it locally ourselves.
25:50
Yeah, it yeah. So open source model makes
25:52
sense. I guess what I'm it's
25:55
interesting going back to when Jeff asked me what's my
25:59
definition of AI? And I don't think it gave great
26:01
answers. Like I know it when I see it and
26:04
I know when it's fake AI. Like fake AI to me is like, hey,
26:09
did you know that 80% of the people who are like Jeff Sedman
26:14
also have this, this role? And why don't you just give that
26:17
role to Jeff Stedman that's not AI.
26:20
Because then if I say, well, what if I give Jeff Stedman the
26:23
role, then what's going to happen is sorry, that input is
26:26
invalid. Like you've totally lost
26:27
credibility with me. And that's to me like the state
26:31
of of AI in identity products that I see.
26:35
There are other ways to think about how AI might be used in in
26:38
identity. And for example if you have a
26:42
set of prisation policies that are applicable to a certain
26:48
regulation and that regulation gets updated, you could ask the
26:53
AI to, you know, reread that regulation and make the
26:57
suggestions on how the authorization policies get to
26:59
change. Basic dated regulatory framework
27:01
it sees and therefore you start to basically just provide you
27:07
know it. It eliminates a lot of the human
27:09
work and allows you to basically, you know, get to,
27:13
yeah, get to get get to meet the requirements and to compliance
27:16
more quickly in those situations.
27:18
So I I think it's very good at looking at these data sets,
27:21
whether it's you know, regulatory frameworks, security
27:24
policies, things like that, analyzing it and making
27:27
recommendations much like a business analyst might do who
27:30
has been asked to actually learn and understand these things as
27:32
well. I think this whole topic of the
27:36
idea of like so for me and here would be a great example of what
27:42
an AI could do. If I could say, hey, tell me all
27:45
the people who can place orders on this system and it's like OK,
27:49
I don't know. And then you start asking you a
27:52
follow up questions or maybe giving you a follow up
27:55
information to define what roles can place orders on this
27:59
systems. Now I can tell you, OK, yeah,
28:02
these people have these roles and then you could say, all
28:05
right, well, you know what else is included in those roles?
28:09
Like you can start actually getting meaningful information
28:12
by having a conversation like with AAI interface.
28:19
Now here's where I was going with the walls need to be
28:22
defined. What if I were to say I'm used
28:25
ping for an example since that that's your company?
28:28
What if I were to say OK how many of my users have multi
28:34
factor authentication? Says 80%, how does that compare
28:38
to other ping customers? Now if it said 75% have 80% or
28:45
more of their users with that, I don't think that violates any
28:51
kind of non confidentiality that you would have with your other
28:54
customers, at least for my money.
28:56
But if I were to say, hey, I know that corporation XYZ is on
29:00
Ping and I said how many corporation XYZ users use multi
29:06
factor authentication Were giving you the answer that would
29:09
not be good. So there's not only just my
29:12
opinion or not only like Ping's tenant, but it would be each
29:18
customer has. You'd have to have some data
29:21
segmentation within those customers and the AI would have
29:25
to be smart enough to basically apply rules to make sure that if
29:32
you were going to have any kind of like cross customer
29:37
information that it would be generic enough not to be
29:40
revealing anything that's proprietary to those customers.
29:45
That's that's what I wanted to throw out there.
29:48
I actually agree with you. I think that's a great example.
29:52
Asking for that in terms context of like, you know, locally it's,
29:55
you know, my organization. But how does that compare to
29:56
other organizations? Is completely reasonable use of
29:59
the tech, the notion of having an assistant for access
30:02
certifications or access reviews or an access review on someone
30:06
to be able to query. All right, when you know, when
30:08
was this person granted that access in, in what's in who
30:11
granted it, what was the, you know, what was the
30:14
rationalization for it? How much have, how much have
30:16
they used it in this period of time?
30:18
Being able to sort of query and ask for, ask me for that
30:21
information to very quickly be able to reach a decision I think
30:24
would have huge utility. Actually, we're talking about
30:27
being able just to ask natural language queries that can be
30:32
parsed and actually turned into, you know, real, real questions
30:36
you ask of the system. It becomes very much more of a
30:39
interface that people can be comfortable with.
30:40
Just, you know, asking for asking for information is going
30:43
to help them make decisions in certain ways.
30:46
What do you see as a is destiny when it comes to the identity
30:51
and access management space? And then what do you think is
30:54
going to hold it back from achieving that destiny?
30:57
One of the things that we've been thinking about here a
31:01
little bit is recognizing that AI Gen.
31:04
AI is a little different to some of the other core capabilities
31:08
we've been relying on to deliver identity services.
31:11
Things like you know compute and storage and CPUI think it's
31:16
going to look very different in 18 months and very different
31:18
again in three years. So it it it's really like a
31:23
little we're sort of like moving in a little bit to the unknown
31:26
because we haven't necessarily thought about the art of the
31:28
possible here based on where Gen.
31:30
AI might be in 18 months. So, you know, realistically,
31:35
could we be talking about authentication and authorization
31:40
services that really can just be queried and they recognize who
31:47
you are and are able to essentially return a
31:51
authorization decision based on who you are in the context of
31:55
what you're going to try and do without necessarily having to
31:57
write any rules? All right.
31:59
Can the Gen. AI be as smart as what a
32:01
security admin might be if you was to be given that query or
32:05
the person writing the security policies or the business
32:07
analytics for the business application.
32:11
Could the AI be smart enough to be able to respond here in real
32:14
time? And the other thing is we talk
32:16
about the identity infrastructure sort of being
32:19
Gen. AI based.
32:21
What does it look like for a bank Ledger to now be basically
32:24
you know based on a Gen. AI that's the bank Ledger or
32:27
ACRM application interacting with an identity infrastructure.
32:30
So it it completely reshapes the way we think about I think how
32:36
applications are actually going to interact with each other.
32:38
The AI is become, they evolve, they become even smarter and
32:43
they become faster at responding stuff like that.
32:46
I I'm very concerned about them becoming self learning, like
32:50
recursive self learning where they become smarter on their own
32:53
sort of thing because that's you know what was it war games circa
32:58
1985 that like that movie or something like that.
33:02
How, how does this evolve and how do we put some checks and
33:04
balances in place basically as well.
33:07
So again I I think this is going to happen over the next few
33:09
years. What you know I I think the
33:11
second-half of this, what's going to hold it back, I I think
33:14
it is going to be people's natural aversion to significant
33:18
change. And you know, it's a little like
33:21
the late 2000s, early twenty 10s where a lot of, you know,
33:26
generally a lot of smaller businesses that were less risk
33:29
averse were willing to adopt the cloud because they saw the cost
33:33
benefit of doing that. And over time as the cloud
33:37
infrastructure basically, you know, they put more security
33:39
around it, you know, more regularly, you know, regulation
33:42
around it and they got comfortable with it.
33:44
You started to see larger enterprises taking advantage of
33:46
it. I could see similar things of
33:48
all these here in Gen. AI as well.
33:50
I'd be remiss if I didn't ask you the question.
33:54
I'm sure that's on everybody's mind is that, you know, paying
33:57
Identity and Ford Rock came together to create this super
34:01
company, super identity company. And with everything that's going
34:05
on with AI as a little thing that's happening in the
34:09
background, what does the product road map look like?
34:14
Is it a merger of these two platforms?
34:17
Is it they each have their own road map?
34:19
How? How's it going to work in the
34:20
future? Ping and Ford Rock had sort of a
34:23
common base sort of actor between our products.
34:27
We can you know both be innovating.
34:29
So the core access management functionality we have, we're
34:34
basically continuing to support that across our customer base,
34:39
whether you're on the Four Drop, original 4 Drop platform or
34:43
whether you're on the original Ping platform, sort of Ping
34:46
Federate or you know Access Manager, those will continue to
34:50
evolve and we'll invest in those going forward.
34:52
So they're not going anywhere. We also had tenant cloud
34:56
infrastructure that Four Drop had built out that we are
34:59
continuing to support as well as on the Ping side.
35:02
And then Ping had basically invested in our Ping One multi
35:05
tenant SAS platform that we're continuing to invest in.
35:08
So now that it's changing all of that is, is, is, is continuing
35:12
forward. On the Ping side, we've been
35:14
innovating more in the area of threat protection, identity
35:18
verification, whereas on the Ford Rock side, they'd be more
35:21
innovating in areas of identity management, life cycle
35:25
management, those areas. So we now basically bring all of
35:29
that stuff together and I I think we've got actually a
35:31
pretty exciting and fairly broad platform that we can actually
35:35
talk to people about. Right now.
35:36
Yeah, I agree. I mean, from my standpoint,
35:39
these were two really good products and each had their own
35:43
strengths and some overlap. But you know, each of them were
35:46
showing their own areas. I can't speak for your
35:50
customers, but if I were to try, I would say exactly what you
35:54
said, which is don't repeat what Oracle did because I was there
35:58
for that and you know I there were I I don't want to get
36:05
myself in trouble by by saying what I really think, but I'm
36:08
going to say don't repeat what they did and I'm sure you can
36:12
get plenty of perspective on what that was.
36:15
Ping sort of took an approach where we wanted to be very we
36:18
we're sort of expecting it. Was IT driven, Admin driven?
36:22
We need it to be fairly easy to use and configure essentially
36:25
with the approach, whereas we want to make it very flexible,
36:28
very easy for developers to interact and use it so they can
36:31
get comfortable. Now obviously there's overlap
36:33
here. This isn't the perfect
36:35
distinction. It's like kind of like a van.
36:37
But that's still why I I'm sort of comfortable that we have the
36:39
right tool no matter what situation that is.
36:42
Yeah. It's kind of a lot like the the
36:45
distinction you made there of IT driven versus developer driven
36:48
reminds me a lot of the Octa Auth 0 combination Octa, IT
36:54
driven, all 0 developer driven, a lot of similarities.
37:00
And obviously, a lot of their customers were kind of upset
37:02
that we didn't have something sooner, but we were sort of, you
37:07
know, trapped a little bit because we actually couldn't
37:09
talk to Ford Rock until we actually had permission, you
37:12
know, after the Justice Department approved it.
37:14
So we sort of had a standing start to actually make that
37:16
happen. But yeah, I think it's actually
37:20
turned out well. I culturally the the Ford Rock
37:23
and team teams are very, very similar culturally.
37:27
So that it it hasn't been an issue in terms of bringing
37:29
these, you know, everybody together and sort of now you
37:32
know working as one team. I've always been impressed by
37:34
the the the the the talent and the work at at at Ford Rock.
37:39
I've known a number of them for a long time.
37:40
So it's actually quite fun out of you working with a bunch of
37:43
these guys too. Guys and gals too, actually.
37:45
So it's great. It's never a dull moment in the
37:47
identity business. And this is what I like to say.
37:49
This is exciting when you see like companies come together
37:51
like that and and see what turns out of it.
37:53
But I think we'll probably leave it there, Patrick, because I
37:56
know you're a very busy guy, but we definitely want to end a
37:59
lighter note. I want to ask you a golf
38:01
question because I know you play golf.
38:03
If you could play a round of golf with any historical figure,
38:07
who would it be and why? So I had to spend a little time
38:10
thinking about that. So one of my heroes as a kid
38:13
watching golf was a guy called Greg Norman who's kind of like a
38:17
kind of got a little bit of a issue going on right now with
38:19
live golf. But back in the day he was
38:22
pretty good and he he, he obviously had some challenges
38:26
and ups and downs and stuff like that.
38:28
But I it would be fascinating to be able to spend some time with
38:31
him, just, you know, learning about what his experiences were
38:34
like, the challenges he faced back in the day.
38:36
So that'll probably be the guy I I'd be most interested in
38:39
playing with, I think called a hero of mine.
38:40
So that's kind of why. It's interesting you selected
38:42
another golfer, which I think is kind of cool.
38:44
Jim, How about yourself? Who would you pick to play
38:46
around in golf with? It's great that you said that
38:49
because I was thinking the same thing because I picked a a
38:52
person who I'm pretty sure could beat in golf.
38:56
But it's probably my favorite historical character, which is
39:00
Abraham Lincoln. I mean if you obviously all the
39:04
things he did, but also the the things he said, you've realized
39:08
this person was operating at like a genius level
39:13
intelligence. But I also think I could wolf
39:17
them pretty good in golf, because golf wasn't even the
39:19
concept back in the 1860s. So but we'd have a good time
39:25
together. Maybe enjoy a few beers during
39:28
the during the rounds as well. What about you, Jeff?
39:31
Let's see, I would I'm, I'm going to go back to Leonardo da
39:35
Vinci only because I want to see where the human race would be
39:39
with some of the concepts that we're bringing from golf with
39:42
like dynamics and physics and things like that.
39:46
And just see how much, how, how how further along could we've
39:49
accelerated human, human beings with that knowledge shifted
39:52
forward, you know, a few 100 years.
39:55
That's the way that I would look at it.
39:57
I think that's probably a good spot where we'll be at for this
39:59
week. Patrick, thank you so much for
40:01
spending time with us today and looking forward to
40:03
conversations. Hopefully we'll see you at an
40:05
upcoming conference. Jim, as always, a pleasure.
40:08
You can visit us on the web, IDC, podcast.com and go to our
40:12
YouTube channel. It's really easy to find, just
40:14
type at IDAC podcast into the search at the top and our
40:18
YouTube channel will pop right at the top.
40:19
But like subscribe to all that fun social media stuff that
40:23
helps us grow the channel and grow the show and get great
40:25
guests like Patrick. So we'll have links in our show
40:28
notes for people to connect with Patrick.
40:29
Going more about Ping as well as all of the discount codes that
40:32
we talked about early on in the show.
40:34
So it'll be all there in a nice neat little package for people
40:37
to check that afterwards. So with that, we'll go ahead and
40:40
leave it for this week. Thanks everyone for listening
40:42
and we'll talk with everyone in the next one.
40:45
You've been listening to Identity at the Center.
40:48
We hope you've enjoyed the show. Make sure to like, rate and
40:52
review and we'll be back soon. But in the meantime, hit the
40:56
website at identity@thecenter.com and find
41:00
us on Twitter at IDAC Podcast. See you next time on Identity at
41:07
the Center.