Latest / Identity at the Center / #322 - Identity Security Posture Management with Saviynt’s Henrique Teixeira

Transcript

#322 - Identity Security Posture Management with Saviynt’s Henrique Teixeira · Identity at the Center

0:00
What is ISPN? It's a great question.
0:02
I was about to write and publish something on ISPN at Garner and
0:06
then I got hired and I left. But ISPN, Jim, is, is an Apple
0:14
Watch for your identity program. And, and the way I, I, I use
0:20
this analogy is to explain that is the first or perhaps the best
0:25
way of, of surfacing metrics, not to show you how good of a
0:30
job you're doing protecting your environment.
0:33
So that's the, the reason of, of ISPN to exist, right?
0:38
So are you improving your security status or are you
0:44
decreasing? Are you improving that?
0:46
Are you getting worse at that? So the same way to watch helps
0:50
you to remember, hey, you should take 10,000 steps a day.
0:54
You should take this amount of sleep every night.
0:57
So you healthier, you stronger. That's the same process with
1:01
ISPN. So the idea is ISPN is
1:03
everything you can do before an attack, right?
1:06
So are you taking the necessary steps to sustain an attack?
1:16
This is identity at the center if it has anything to do with
1:21
IAM. This is the go to podcast now
1:26
your hosts Jim McDonald and Jeff Steadman.
1:36
Welcome to the Identity Center Podcast.
1:38
I'm Jeff, and that's Jim. Hey, Jim.
1:39
Hey, Jeff, how are you? Not so bad yourself.
1:42
Man, I am happy you're back. Man, I am so happy you're back.
1:48
And today is that the Today when this episode drops December 9th,
1:54
Monday, first day of the Gardner, I am Summit.
1:58
So for those who are in Grapevine, TX and are, you know,
2:04
listening to the episode, you and I will be on stage on
2:07
Wednesday at 3:30 with Becky Archambault.
2:12
Really excited for that. She's going to be turning the
2:15
tables on us and interviewing us.
2:17
So that's going to be quite different.
2:20
And for those who aren't able to attend the conference but are
2:24
still listening to this episode, you know, we're going to record
2:28
a couple episodes while we're there, while we're here
2:30
hopefully, and we'll have that for you guys to listen to.
2:34
Yeah, it's going to be a fun week.
2:36
It's I feel like it's been a while since you are recorded
2:38
like in our normal sort of studio environment.
2:40
I've been traveling and had, you know, my real job has gotten in
2:44
the way of the podcast, so to speak.
2:47
So I'm, I'm glad I'd be back in a normal studio, neither not
2:50
recording like on site somewhere because you know, I've been
2:53
traveling over the place for conferences like authenticate,
2:55
etcetera. And yeah, so I'm back, baby.
2:59
Well, a lot of people think this is our full time jobs.
3:02
I mean, people ask me that all the time.
3:03
It feels like it. It does.
3:06
It feels like a second job, right?
3:08
You hear about people working 70 hours a week and it's like, oh,
3:11
that must be horrible. But then I think about the hours
3:14
that we put into the podcast and we're probably I don't think
3:18
we're a 70, at least I'm not. But and the other thing is like,
3:23
it's, it's funny, sometimes my family members members will be
3:26
like, oh, you know, you're such a hard worker.
3:29
I think, you know, yeah, I like, I'm very dedicated to my job.
3:34
I do a good job at it, but it's not like I work in a coal mine.
3:40
You're a hard worker. Not a good worker Jim, but a
3:42
hard worker. Oh, I wasn't going to say that,
3:44
Jeff, thank you very much. Yeah.
3:46
No, look, we do this because it's a lot of fun, and we'll
3:49
keep doing it until it's not, until it's not fun, and then
3:52
we'll figure something else to do.
3:53
So there you go. So we don't have any discount
3:56
codes to share with people today because this is probably, well,
3:59
this is the last conference of 2024.
4:02
As you know, Q1 is not a big conference time, but next year
4:07
we're going to be going to EIC Ideniverse.
4:10
We'll be coming out with discount codes for those early
4:13
in 2025. Yeah, stay tuned.
4:15
I'll put them on our our homepage at idacpodcast.com.
4:18
Just Scroll down a little bit and you'll see whatever the
4:20
current discounts are. And yeah, feel free to use
4:22
those. There is one for Gartner.
4:23
If you are in the lobby of the hotel in Grapevine, you can't
4:27
get in IDAC 375. So there you go, last minute
4:30
discount code. But yeah, why don't we get into
4:33
today's episode because I feel like we have so much to cover.
4:35
And this is a guest that took us a while to get on.
4:39
We had him on earlier this year. And now we're back.
4:41
We're going to talk about ISP M, We're going to talk about AI.
4:44
Of course, I am. And maybe get into some 2025
4:47
predictions on identity. So I want to welcome back
4:50
Henrique Teixeira. He is the Senior Vice President
4:52
of Sabians. And just the guy.
4:54
Welcome back, Enrique. I'm just a guy, just a guy.
4:58
Thank you, Jeff. Thank you, Jim.
4:59
It's always a pleasure to be back here.
5:01
The show, guys. Well, it feels like a lifetime
5:04
since last time we spoke, but thank you.
5:06
Thank you for having me. Well, anytime the door is always
5:09
open and I, I appreciate the mood lighting you've got going
5:11
on. It's a very dramatic effect.
5:13
You know, we're on video. So if you're, if you're not
5:15
watching a video, you can hover YouTube and kind of check that
5:17
out. But you were with us back in
5:19
episode 281. That was back in May.
5:21
So here we are about, you know, 6, maybe seven months later and
5:25
just curious, you know, what you've been up to since then.
5:28
And then I'm curious also, you shifted over from a role at
5:30
Gartner, obviously as an analyst and now you're with Savion.
5:35
Does anything surprise you with that that role change?
5:37
Oh, yes, and lots of travel, right, since I, I, I moved here,
5:43
my son jokes say that why are you travelling so much?
5:47
And we, we've launched this series of, of events throughout
5:53
the globe, all these amazing destinations.
5:57
And so wow, I, I got to support this company I work for now,
6:00
right? And I, I'm very grateful that we
6:05
have this opportunity. And I'm of course, I used
6:08
simpler words. He's 11, Lucas, my son, right.
6:11
And so, yeah, dad, I think you should go back to, to Gardner
6:16
and no, but it's being amazing. Just the opportunity to be
6:20
closer to the problem. That's that's exactly what I was
6:23
chasing right when I moved and and I know we are now close to
6:29
Garner the IM summit getting ready for that as well.
6:33
It it feels bittersweet. Of course, I I'll be meeting all
6:39
my my good friends at Gardner. It feels like the the whole show
6:44
right, which I used to be the chair of.
6:46
It's now an adult that has left the house, went away to college
6:52
and and took his own speed, its own pace.
6:55
And so I'm I'm super curious to see what Garner will be
6:59
delivering excited. I'm I'm I'm very happy to be
7:03
there and there's new capacity. Of course.
7:06
It's funny that I don't know if you noticed that the theme they
7:08
chose for the show, right. So for the Garner AM Summit 2024
7:12
is identity amplified and I can claim I was the person in the
7:19
room when, when we're choosing the the theme for that.
7:22
OK, let's choose identity amplified because I can see I
7:24
have amplifiers here, right? And, and, and, and guitars.
7:27
So this is part of my life and perhaps a little bit of Terravia
7:31
when I suggested that and there was a bunch of other
7:35
suggestions, amazing options. Every year we go through an
7:38
ideation process at Gartner to choose the, the, the theme of
7:42
the, the, the conference for the year.
7:44
And, and then I left right. And I, I don't know what
7:46
happened, but in my own branding, on my own LinkedIn
7:50
profile, I used the Enrique Teixeira identity amplified and
7:54
I, I kept using that. And then I got a phone call from
7:58
Gartner and they say, Enrique, guess what?
8:03
We, we chose identity amplified as the theme for this conference
8:07
in 2024. So good.
8:09
I feel flattered, right. That was my idea.
8:12
But would you mind switching your profile to something else
8:16
and say, OK, of course, of course.
8:18
So I I didn't make any any fuss and I changed now it's.
8:22
Where a good trademark comes in. All right, yeah, but it's it's
8:26
OK. It was not a big deal.
8:28
So now it's Enrique Teixeira identity driven because I have
8:31
an OverDrive here and everything else.
8:32
So identity driven, I think it's what I am as well.
8:36
And what we've been doing, it's saving, right.
8:38
So driving the importance of identity and and, and fixing
8:41
this problem. So, but to your question, yeah,
8:44
lots of surprises aside from the travel, which I I already
8:47
expected with, with, with them saving.
8:52
And I was surprised for the size of some departments inside of
8:57
Savient and how organized it is. And I had no idea, right.
9:02
And and I used to joke that Savient was this best kept
9:07
secret in the industry. So why, why, why don't you guys
9:10
speak more about this or that, this particular innovation that
9:14
you're launching? And because it was very much
9:17
driven by technical people and engineers.
9:21
But now we have a CMO, we have an amazing team, also marketing
9:25
and messaging what it does. So I was kind of surprised about
9:29
the thing in a good way about those things that, wow, even
9:32
myself as an analyst and I was paid to analyze you guys and
9:37
understand what you, what these vendors were doing.
9:40
I thought there was a lot that was kind of mysterious and I I
9:43
just learned after I joined the job.
9:47
So now this is like your first Gartner as a civilian and it's
9:51
freeing, right? You kind of mentioned of you're
9:52
not really in charge of it. So now you can kind of go as a,
9:55
as a normal attendee, right? Just a guy.
9:58
Yes. What is something that you look
9:59
forward to other than, you know, obviously relationships and
10:02
meeting people and you know, and stuff like that, But is there
10:05
like something specific that jumps out you, you know, this
10:07
week as we're all here, it is like, I'm looking forward to
10:09
this. I mean, obviously of course
10:10
then, you know, giving us fist bumps and stuff like.
10:12
That, yeah. And I had a little bit of a
10:15
taste of that when I was at SRM securing Risk Summit and
10:19
National Harbour. So I was able to reconnect and,
10:22
and, and, and feel that vibe again.
10:25
But little things that I used to care about when I was preparing
10:29
those conferences. Like for example, the tidbit you
10:32
just shared that now Rebecca will be interviewing you guys.
10:36
So I'm curious to say, OK, this is an interesting and fresh
10:40
approach to this or who are the other guest speakers that they
10:48
have picked, right? Because that was part of, of a
10:51
chair and choosing who are the, the guest speakers?
10:54
Who are the, the keynote speakers?
10:57
So I, I'm more curious about this, the, the background
11:01
choices they made. And I, I know it's a, it's a lot
11:04
of work and I'm, I'm curious to see how it pans out, but I'm
11:08
very excited for them as well. So I'm, I'm on the sidelines
11:11
cheering for them. I'm, I'm sure it's going to be
11:13
great, but also meeting my friends and, and, and our
11:18
clients as well and, and being there within the booth saving
11:23
it. We won't have Vans this year as
11:25
we had for for other events we had like a Vance store and Vance
11:30
shoes, but we have a nice surprise in store as well with
11:35
that. I've got my vans in my closet.
11:37
So that was a that's that's that's a memorable swag for
11:40
sure. And we've told Becky for our
11:42
session, like, hey, you know, you guys are really gracious and
11:44
we interviewed you guys on stage.
11:45
You're like, hey, we'll ask, can we ask anything?
11:47
And we've told Becky same thing like Turner vows, Fairplay.
11:50
So Becky, come at us, bro. We're happy to engage and where
11:54
that may be. You've got other copies you've
11:57
been to. I know you were at Hipcomp,
11:58
which I've never been to. Maybe you can give me kind of an
12:00
update of what was Hipcom full hyphen?
12:01
Is that something like that I should be looking at for next
12:04
year? Yes, that, that was my first
12:06
time as well. An amazing roster of speakers
12:11
and, and I think that's what drove me there, right.
12:13
So Alex Weinert and and Pamela Zingle and and a bunch of other
12:18
amazing people, right. And it reminds me of and, and I,
12:23
I've never been to Identiverse on its early days, but it
12:27
reminds me of that the early days of Identiverse, a very
12:31
practitioner oriented type of conference.
12:35
Pretty cool. I like the, the venue as well
12:37
was New Orleans by the, the actual space where they had the,
12:44
the whole Mardi Gras like Carnival type of thing.
12:47
So it was pretty cool. And, but like I said, they're
12:51
practitioner oriented, right, versus only Sisos and and
12:56
leaders who had like all kinds of people from different levels,
13:01
but also different type of content as well, which was
13:04
pretty interesting. Pretty, pretty cool.
13:06
I, I, I'd love to to go back. Yeah, I, I get excited for the
13:11
same thing, like find out who the different guest speakers are
13:14
going to be because I'm responsible for booking, booking
13:20
our guest, booking our talent that comes in.
13:22
I use those lists oftentimes for finding future guests who have
13:28
an interesting and unique perspective.
13:30
So, you know, it's part of the whole identity at the center
13:34
brand is bringing in great speakers like yourself.
13:38
I I know I don't have to sell folks that are listening on the
13:41
show because they're already listening, but I've gotten so
13:44
much feedback, you know, so many times where we're doing the
13:46
episodes where people say identity is at the center and I
13:51
feel like we just accidentally struggle or I shouldn't say
13:55
accidentally because we talked about identity as the center as
13:58
a concept, but we never thought once about changing the name of
14:03
the podcast. I think we just we kind of
14:05
nailed it with this concept. And trademarks are expensive,
14:08
Jim, so. Yeah.
14:10
Well, that's right. IDAC is something we trademarked
14:12
and that's a perfect segue because I was going to say we
14:15
want to talk to you about the latest and greatest acronym ISPN
14:21
Identity Security Posture Management.
14:24
It's something that you've been talking about and wanted to give
14:27
you an opportunity to kind of talk about.
14:29
First off, what is ISPN? No, awesome.
14:33
And it's a great question. I was about to write and publish
14:36
something on ISPN at Garner and then I got hired and I left.
14:42
But ISBM, Jim, is, is an Apple Watch for your identity program.
14:51
And, and the way I, I, I use this analogy is to explain that
14:55
is the first or perhaps the best way of, of surfacing metrics to
15:01
show you how good of a job you're doing protecting your
15:04
environment. So that's the reason of ISPN to
15:09
exist, right? So are you improving your
15:13
security status or are you decreasing?
15:17
Are you improving that? Are you getting worse at that?
15:20
So the same way to watch helps you to remember, hey, you should
15:25
take 10,000 steps a day. You should take this amount of
15:28
sleep every night. So you healthier, you stronger.
15:32
That's the same process with ISPN.
15:35
So the idea is ISPN is everything you can do before an
15:37
attack, right? So are you taking the necessary
15:41
steps to sustain an attack? Are you strong enough?
15:46
Right. And so?
15:48
The management part is kind of like understanding where you are
15:53
now and then improving it through me through evolution of
15:57
like fixing things. But I'm also wondering, is this
16:00
now a product space? So are there going to be ISPM
16:04
vendors that maybe dashboard all this stuff out?
16:09
What are your thoughts there? Yeah, and and exactly so that
16:12
the first step of it, it is about visibility, right?
16:15
Just surfacing that type of metric that say, hey, you're not
16:18
doing a good job here in in identity hygiene, right.
16:21
So you're not even enabling fishing resistant MFA to
16:24
everybody in your organization, like half of your employees
16:27
don't even have MFA. So this type of visibility is
16:31
super important. But yeah, as the remediation of
16:34
that is part of ISPN. So that's the M right, the
16:36
management part. So you, you remediate, you fix
16:39
this type of stuff getting stronger as you go and you
16:42
improve your security posture, right?
16:45
I think it's a great question to ask.
16:47
Is this a, a valid market? Is it I, I don't care and I
16:52
don't think buyers care about if it's a market or not.
16:55
The thing is, is it real? Is it not?
16:57
I think it's a, it's a type of discussion that as a gardener, I
17:03
remember having those type of discussions, especially because
17:06
when you have things like a market guide or a magic
17:10
quadrant, by definition, it has to exist as a market and and
17:16
Garner has very strict rules. What a market is now in in
17:21
reality, if I want to buy a a smartwatch or an electric car,
17:27
is it is to a car? Is it something else when like
17:31
a, a faster horse becomes a car? I, I think buyers, they will buy
17:38
what they need to solve a problem they have right now.
17:41
And so that's why I, I, I said not, not in any trying to be
17:47
facetious or anything, but it's, it's, I think it's just, it
17:52
might be a market. I, I, I know of companies that
17:55
they, they leave and die and that's the only product they
17:58
have. It's their, their, their MVP is
18:00
an ISPN product and that's what they're doing.
18:03
So the way I, I wrote research, it's more on the I, I, I make
18:10
the analogy almost like a sitcom, right?
18:12
I, I, I, I, I evaluate the situation.
18:16
I take a picture of what's happening right now and I write
18:22
about what's happening right now and what's happening right now.
18:24
Yes, there are companies that are building tools that they do
18:28
exactly that is to surface those type of metrics.
18:31
Savant is doing that. We we have announced our entry
18:35
into ISPM and I think it is different, right.
18:38
So, so no, it is something different than IGA, it is
18:42
something different than Pam. It, it is something else.
18:46
So we we could argue what the name should be, but I think it
18:51
is it is a category of different things for sure.
18:54
Is it different than ITDR? It is.
18:57
It is. How's it different than ITDR?
19:01
I I feel like the definition of ITDR is providing to secure your
19:07
identity systems. But then when companies go to
19:11
market with a solution A, solution A from company A and
19:19
solution B from Company B could be quite different and they
19:23
still fit into this ITDR bucket. And you know, whereas like IGA
19:30
is pretty much means closely the same thing to everybody.
19:37
Now, I, I would love it, feel free to disagree with me on any
19:40
of that, but I'm wondering, OK, what, you know, how does ISPN
19:45
become about or what is the bucket of ISPN?
19:49
And is it, you know, is there a clear definition over it or is
19:53
this something that you're still spitballing or the industry
19:57
hasn't like, you know, come to consensus on it, which is fine.
20:01
No, for me, Jim, it's very clear in my mind, right?
20:04
So, and the way I, I, I, I wrote this research on ITDR is that
20:10
this happens during an attack and after an attack, right?
20:14
So it's a, it's a runtime threat detections.
20:17
So you already have somebody shaking the gates, like forcing
20:21
the door open that they're trying to get in.
20:24
That's when ITDR gets in. So it's threat detection, it's
20:28
identity threat detection at the moment of the attack and
20:31
responding to that attack. ISPN, it's all about the
20:35
prevention. So if you go to NIST and other
20:38
type of frameworks, so those are the things that happens before
20:44
the boom, right before the attack, everything that you can
20:47
do to prepare for an attack. So take Mike Tyson for example,
20:51
and Jake Paul, right? So all the preparation they did
20:53
for the fight. So are you sleeping well?
20:56
What's your nutrition regim? Are you training hard?
21:02
Are you taking all the precautions so you don't die on
21:07
that ring? Right, So that's ISPM.
21:10
And yes, you're correct in the sense that IGA fits in that
21:13
prevention space as well. As a matter of fact, everything
21:17
that we did so far in Identity is preventive, right?
21:21
That's why the ITVR gap was so big, because MFA is preventing
21:25
bad guys from getting in. Pam is vaulting credentials and
21:29
not allowing it to be misused. So it's all about preventing an
21:34
attack. So ITDR happens when somebody is
21:37
already trying to break in, so it kicks in in the detection
21:42
mode and responding to that. And that's what ITDR is about.
21:46
ISPN is the prequel to that, right?
21:49
So everything that you do before the fight.
21:52
I feel like this is not to disagree, this is probably more
21:56
to agree, but just the thought is that I mean, I've seen
21:59
Gartner has like the Venn diagram on this and I think the
22:03
third, so it's ISPMITDR and I think the third is IGA.
22:08
I'm going by memory. This is something I saw a long
22:11
time back. But some of the stuff you're
22:13
talking about prevention is in some of the ITDR platforms, like
22:17
for example, Sempress, they, they do some analysis of here's
22:25
the configurations within your Active Directory that are
22:30
potential cracks in the in the foundation.
22:34
So I feel like still companies are kind of built bundling all
22:41
these things into their solution.
22:43
They're not being purist, which I'm not advocating that they be
22:47
purist, but I think it does make it hard to wrap your brain
22:52
around, OK, ITDR, it doesn't necessarily mean one thing, even
22:57
though you're giving a very clear definition.
23:00
I just kind of feel like we're still in this churning period,
23:03
which leads to a lot of clients, in my experience saying, OK,
23:08
well, is this really the right time to jump?
23:10
In yeah, and, and, and I, I think it's a great analysis what
23:17
you just made, right, Because when we are writing research
23:21
and, and the market takes that idea and runs with it, it may be
23:27
hey, this is not the whole thing.
23:29
And, and, and yes, a lot of vendors that were doing ISPN
23:34
because I didn't have the chance to publish things about ISPN
23:37
before. So now this is, this is ITTR.
23:39
What we're doing is ITTR and I can remember 3 or 4 vendors that
23:42
did that and say, guys, this is not ITTR stop.
23:45
But then the word was out. The cat was out of the bag,
23:49
right? So no, but we like ITTR.
23:51
We're going to be using this label.
23:52
So but this it's, it's wrong. That's right.
23:56
I'm going to be right about ISBN next, which is the prevention.
23:59
Then what you're doing is about prevention.
24:00
It's finding the cracks and fixing the cracks.
24:03
You're not being attacked. So we're not detecting threats,
24:07
right? So to your point, it is kind of
24:13
very enlightening to see that the power of writing research
24:20
and and what the vendors do with that, but also the buyers,
24:24
right? And and yes, the buyers get
24:25
confused because, OK, this, this is like the DRI thought, this is
24:29
more preventive. But when we talk about those
24:35
things at Sabian and say, guys, no, this is like the Dr. this is
24:38
ISPN. So that's part of the job of
24:41
being a strategist is to be clear about those things.
24:45
But I, I don't fault those other vendors.
24:48
They, they say, OK, no, this, this is a cool concept and, and
24:51
we can run with this and, and this is good for positioning and
24:54
messaging, say, well, more power to you.
24:58
But it, it can get confusing. That's I think is a
25:03
characteristic of our game, if you will, or our trade.
25:06
Yeah. I mean, that's exactly, I feel
25:08
like we're, we're getting into almost a little bit of
25:10
semantics, right. We're throwing out, we're really
25:12
good at creating acronyms. It's funny.
25:14
And Enrique, I was going to, I was going to interject when Jim
25:17
asked you, what's the difference between basically ITDR and ISP
25:21
M? And I was thinking about it very
25:23
similarly. ISP M is all the stuff that
25:25
happens before I get attacked. It's, it's your plan, right?
25:28
It's your hygiene of your identity program, your systems,
25:31
your capabilities, your data, right?
25:33
All that stuff, and I don't think there's ever a bad time to
25:36
do that. You don't need a tool
25:38
necessarily to. Do exactly that's that's a
25:40
day-to-day training. It's an idea.
25:42
It's hey, should we have MFA? Yeah, well, guess what?
25:45
You just improved your posture management for an attack because
25:49
now you've got a second level of authentication, right?
25:51
And I think there are things like that where we can look at
25:53
it and say, hey, here is here is what is my i.e.
25:56
SPM look like. And yes, maybe there are
25:58
productized versions of that that have a very, you know,
26:01
structured approach to it. And it's a checklist.
26:03
And maybe it bleeds over into a technology where it's like, OK,
26:06
here's your checklist. And oh, by the way, if you click
26:08
this button, it will do this thing for you and keep it In
26:12
Sync maybe with whatever you define as your i.e.
26:15
SPM, because not every organization is going to have
26:17
the same level of risk tolerance or capabilities or things like
26:20
that. So I feel like ISPN is more like
26:23
a framework and idea set to say, hey, here's how we're going to
26:26
manage our threat level and our posture to protect against
26:29
identity. Secondary to that is exactly
26:32
what you said is OK, something bad has happened.
26:35
It got through our posture management approaches.
26:38
Now what do we do? And that's the detection
26:39
response. And of course, there's plenty of
26:42
technology now in that area, you know, to help with that.
26:44
But that's kind of how I was thinking about it in my head.
26:47
And that's exactly, and you said perhaps even better than I
26:49
could, But yeah, that's, that's, it's about training and, and
26:54
things, and things that you got to do regardless, right?
26:57
You got to eat and got to sleep. You got to train and, and, and
27:00
the more you do of that and, and eat healthy, you're going to be
27:04
better prepared for a gang day. Gang day is you are attacked
27:07
right now, right? So all the drills, all the
27:10
training that you do, that's a posture management.
27:13
So you you're becoming stronger in that sense of protecting your
27:16
identity infrastructure and your identity systems.
27:22
So I did find that that Venn diagram and it was a Gartner
27:26
diagram published in 2024 and the two overlapping circles
27:33
there were not 3. So I don't know if it's
27:35
technically a Venn diagram, but it's overlapping circles.
27:38
We got to get Yvonne. She's our expert on Venn
27:40
diagrams. So Eve, if you're listening.
27:44
Yeah, exactly. We have to.
27:45
We have to have Eve's input on that.
27:49
We could put a link in the show notes, but it was prevention and
27:55
ITDR and the overlap. And you can see pretty much to
27:59
my point, there are companies that are trying to play in both
28:03
spaces. Now, whether or not they call it
28:05
one product or not, I. Don't there is an overlap that
28:07
that's a that's a good point. When I was writing about this
28:10
with Mary Ruddy, which is now chief of research and Gardner,
28:12
right. And, and, and between the
28:14
prevention things and then posture management and and
28:18
detection response, you could detect a change in posture,
28:22
right. So I, I don't know if you guys
28:24
saw on the iPhone now they have this vitals thing now metrics
28:28
that say, hey, your vitals changed.
28:32
So there was not an attack, you're not having a heart
28:34
attack, but your vitals change like you had a change in
28:37
posture. So a little bit of detection
28:39
changes of posture. But then, but I, I, I, I think
28:45
for the benefit of the industry, right?
28:47
So this semantics discussion, I think it's important, but we
28:52
shouldn't be just focusing on that.
28:54
But I think, and Rebecca talks about that too, focus on the
28:59
outcomes, right? I think it's super important.
29:02
So the outcome of ISPM is to be stronger for the attack.
29:07
That's right. And the outcome of ITTR is to
29:10
detect things faster and respond faster to those things.
29:13
I think that's simple as that. I think this is a great segue to
29:17
because I feel like this is where AI is really starting to
29:19
shine. What we called maybe machine
29:21
learning before and AI and all that's coming together now we've
29:24
got things like Co pilots and agents and bots and you know,
29:29
all kinds of stuff going on where, you know, where do you
29:32
stand on this from like an AI perspective?
29:35
And especially I think this terminology of copilot agent
29:38
bot, is there really a difference or is it really
29:41
again, we're back into semantics of it's still this, you know,
29:45
non human identity performing an action on something.
29:49
Yeah. And, and I'll get to that when,
29:51
when we talk about difference between AAI agents and, and, and
29:55
AI Co pilots, but when we think about AI, right?
30:00
And before AI, it was cloud. And, and, and one of the things
30:05
I've been talking a lot in those different Rd. shows that we're
30:08
delivering is that if we look at the trends that driving change
30:12
in 2024-2025, man, cloud has been around for more than 20
30:17
years. Cloud was invented around the
30:20
year 2000, right? So almost like 24 and and which
30:25
is crazy to think about how long it took here to so we get to the
30:31
cloud security of Wiz and and Palo Alto, the CSPMS of the
30:35
world. The reason I bring this up is
30:37
that now we have this other inflection point or a second
30:41
wave happening, which is AI, which happened two years ago,
30:44
right? And and, and, and, and
30:46
generative AI becoming mainstream and, and even like
30:50
people like my mom, she's in healthcare and, and she's what
30:54
have you used this Chachi PT thing?
30:55
Yeah, it's amazing, right. So it's now it's in the hands of
30:58
the people. So this new inflection point, I
31:03
think gives you the, the perspective what is driving
31:06
innovation in companies today, the same way that cloud drove
31:11
innovation for the last 20 years.
31:13
It's undeniable cloud drove that type of innovation.
31:15
So you, you pay money to AWS, you pay money to Azure and you
31:19
run your workloads in the cloud. It's, it's better than in so
31:21
many ways, right? And more elastic and resilient,
31:24
etcetera. AI is driving this, this other
31:27
wave. And when we think of of, I think
31:32
was during the Salesforce event and, and Marc Benioff was
31:38
bashing Microsoft because no Co pilots are dead.
31:41
The, the cool thing now is AI agents.
31:43
That's that's that's why AI has to exist.
31:46
And now man, it's again, it's a, it's a semantic type of
31:52
discussion that I think it's not very productive.
31:55
But those are different things. And, and, and there's not better
31:58
or worse thing, but a copilot is an assistant, right?
32:03
That that's by definition, a copilot is an assistant that
32:06
helps you generate code. It helps you to to generate
32:11
photos or or code or generate text.
32:16
So this an assistant. It could be also a chat bought
32:19
in a sense right translating natural language in a sequel
32:25
type of statement like a Claude and other models that can do
32:30
that very well. An agent is going to be
32:34
performing actions, so it could be a workflow or executing a
32:39
remediation or a lawyer type of agent or a marketing type of
32:47
agent. So this becomes more of an agent
32:51
in that way that execute tasks versus an agent that creates
32:57
content. So I think it's just a category
33:01
of of two types of of things that is not one better than the
33:06
other. There are applicability that you
33:08
got to have an assistant will be the best application.
33:11
An agent will be a better application for other things.
33:14
So that that's that's my interpretation of that.
33:17
What's interesting, however, in that push to innovation, right?
33:22
So there's a lot of opportunity for us to still profit from that
33:26
cloud innovation curve. So how many start-ups can launch
33:30
their own products in in the cloud?
33:32
And that's still happening, right?
33:35
AI is going to be the same thing.
33:37
However, my prediction is that that curve is not going to take
33:41
20 years to maturity. Cloud today is mature, right?
33:45
Especially infrastructure as a service, even SAS, it's mature
33:49
AI. We're going to see that curve
33:52
going much faster. There's an an author called,
33:57
what's his name, Ray Ray Kurzweil.
34:01
I think that's his name, Ray Kurzweil.
34:04
And he's a, a futurist Ray Kurzweil.
34:07
He predicted that AI or technology singularity would
34:13
happen in 2040, five, 2045. But now this, this person
34:22
revised his prediction. No, no, it's not 2045 anymore.
34:25
It's going to be 2029. So and I, I was bang on and I,
34:30
I, I, I, I made my prediction before I saw his and I was just
34:35
looking for evidence. OK, who always agrees with this
34:37
crazy stuff I'm talking about here.
34:38
But I think the wave for maturity in AI is going to
34:41
happen in the next 5 years. So Henrique, I think the whole
34:46
idea with agents or bots or Co pilots, I think it's going to
34:52
sharpen my point on this holy war and the holy war.
34:57
Jeff and I use this term, right, and we prime example of the holy
35:01
war is where should contractors be managed in the HR system or
35:06
something else? And you know, it's like each
35:10
time you go into a client, you talk to them about how they're
35:13
going to manage things going forward or where they are today,
35:17
it becomes a holy war. HR doesn't want to manage these
35:20
people or yadda, yadda. I don't want to talk about that.
35:24
What I want to talk about is a different holy war, which is
35:28
what should be the front end to your I, your access request
35:34
process. So many companies say we want it
35:39
to be our ITSM, our ticketing system.
35:42
We want to take ServiceNow where you go and request everything
35:46
else in the organization. That's where you go to get a
35:48
parking pass or a new iPhone or etcetera, etcetera.
35:53
Why can't you go there and ask for access to a folder?
35:58
Personally, I think it's a terrible idea.
36:01
And I'll tell you, I think that the AI future is going to put an
36:06
exclamation point on why I think this, which what I've always
36:10
felt was the change management for this is a nightmare.
36:14
But I think the bigger issue is going to be you're not going to
36:18
get to take advantage of all these things that are going to
36:21
be built into the front end with an IGA system.
36:25
So now I go into an IGA system and it tells me, well, you know,
36:30
you should request this access or you shouldn't request that
36:33
access, etcetera. Or even better, we get into a
36:39
generative interface where I say I need to give Henrique.
36:43
I just hired Henrique. I need to give him access to the
36:47
accounting system similar to what Mark has.
36:50
And then it starts asking me questions and we going back and
36:54
forth to have a question, a conversation until we get to the
36:57
point where it's a well formed for quest that I submit.
37:02
If you're using some intermediary front end, I just
37:05
don't see how you ever get to the point of being able to do
37:08
that. Yeah, but isn't this just the
37:10
March of progress and technology?
37:13
We, there really wasn't an option to request access in this
37:17
scenario until let's say 10 years ago.
37:21
It was you had to call the help desk, right?
37:24
Or walk down to a desk or something like that, right?
37:27
Somebody could do it. And then it became, oh, why
37:30
don't we try to Amazon this and make it more of an e-commerce
37:32
style. Let's create a shopping cart.
37:34
And then you have things like service now, right where you
37:36
have or other ticketing systems, right, where you have like all
37:39
your services listed and you can make a request.
37:42
Now we're in the age of AI and we're seeing identity governance
37:47
vendors pull in some of that, right?
37:49
They've, most IGA players have had a request interface of some
37:53
sort, right? Whether it's Savient or Sale
37:55
Point or Armada or Fisher or whatever it may be, right?
37:58
They all have that. Now we're looking to this AI
38:00
future is what if your IGA didn't have a web interface and
38:04
it was a chat interface of some sort, natural language
38:07
processing, right? Things like that.
38:09
The whole goal of those interfaces are to do what?
38:11
To request the access, to make sure that it's appropriate and
38:15
to log the proper approvals and receipt trail, right, so you can
38:19
audit it, those sorts of things. Yeah, if you have to make like a
38:23
yeah, a wedging bat here. Yeah, I, I think Jim, and I'm
38:27
sorry, I agree with Jeff here. I think I, I, I agree that the
38:31
future of IGA and then all the things around life cycle, it
38:37
should live in a, in a more natural language, chat oriented.
38:41
So I'm a big proponent of chat OPS.
38:43
If you guys are familiar with what chat OPS is, but for the
38:46
sake of the audience here. So chat OPS is the ability of
38:49
using Slack or Jira or service analysis, whatever.
38:53
So we already have those apps in your phone that you can check
38:58
messages and respond to those messages.
39:00
So interacting with your IJ tool through Slack and, and, and it's
39:06
funny that we are also announcing that within saving
39:08
it. So there's a company called
39:10
Pronoassis and they developed a chat bot, a chat bot for Slack
39:16
that front faces saving it. And I think that's brilliant.
39:19
I don't want to build an iOS app.
39:23
I don't want to build a, a, an Android app because you already
39:26
have an app, you already have teams, you have teams, you have
39:29
Slack. So I think that's the future of
39:33
the human interfaces for today. It may change into the future to
39:37
be even more natural language, but I think I only see the
39:42
benefits of doing it that way, right.
39:44
So people, they are already used to use Servsina or is it teams
39:48
or, or, or slack. So why not embrace it?
39:52
And of course, we, we still have all the controls for segregation
39:55
of duties or separation of duties for fine grain
39:58
entitlement and, and, and all, the, all the things that we need
40:01
to do from a security standpoint.
40:03
And yeah, as IJ can continue to do that.
40:05
But from a front end, I think the future is on chat OPS.
40:09
It doesn't replace things that we that exist today either,
40:11
right I think. We're in this transitional
40:13
state, right? It's that's.
40:14
Exactly. Another arrow in the quiver.
40:16
It's like, OK, yes, you can interface with my web interface,
40:19
or you can my chat bot, or send me an iMessage or RCS message or
40:22
whatever it is you're using, right?
40:23
Those sorts of things. That's kind of how I always
40:25
think about it too. Yeah, exactly.
40:27
So my point is, OK, where I'm confused is, is what you're
40:32
saying that if I'm a client now, a customer of yours now and I'm
40:38
implementing my IGA system for the first time or maybe I had
40:43
one that was like 20 years old, something like that, and now I'm
40:47
going to buy your software, I'm going to implement it.
40:50
Would you tell me? And I tell you, I want to use
40:53
ServiceNow because ServiceNow is where people go to request
40:57
everything, parking pass, etcetera.
41:00
I don't want to give them a new place to go.
41:04
Are you, are you going to discourage that because.
41:07
If you say let's go, let's do it, let's do it, let's use
41:10
Servsenal, let's use Servsenal. And we have a native integration
41:13
with Savant, right? I think modern IJ providers,
41:16
even before I joined Savant, I was recommending vendors say
41:19
this is the future. We, we, we should not fight this
41:23
holy war anymore, right? So you have this front end, you
41:26
have trained thousands of employees to use service now, So
41:30
why are you trying to train them in something else?
41:33
So they are training using that interface.
41:35
Don't fight against that tide, right?
41:38
And we connect in the back end. So we have service catalog
41:41
integrations, right? So the same way you can request
41:44
your laptop to be fixed, you could request this new package.
41:47
Now there's the whole AI thing. And I agree with you, Jim, in
41:50
that one that we can use RBAC up to a point, right?
41:56
So you package everything, you make that package requestable
42:00
within ServiceNow. You get to the point where
42:03
things get so granular. And I think we're not there yet,
42:06
but we get to the point where you're going to open a SaaS
42:09
application on your phone or in a browser and say it looks like
42:15
you're trying to access this app and you don't have access.
42:18
Would you like to open request right now, Right.
42:21
And, and and then things happen even before you know it's
42:24
already a flow going on, right. I think that's where we're going
42:27
to go. So you're saying it's kind of a
42:30
multi channel way to go ahead? And very much.
42:33
Omni channel identity and access management request.
42:37
That's the future guys, absolutely yeah and I and I I
42:41
can't force everybody going through my own interface all the
42:44
time. That's not kids these days,
42:47
right? So they they are they're multi
42:48
channel. They they're they're using
42:51
Roblox to chat. Come on.
42:53
So we we got to keep up with the times.
42:56
You know, Jimmy bring up an interesting point, because they
42:57
think this is a a struggle that a lot of organizations faces.
43:00
Yeah, we are deploying an IGA. And I think by default, I think
43:04
a lot of folks are like, yeah, let's put it, make it part of
43:07
our, our ITSM system, which Henrique, to your point, right,
43:10
we've, we've trained our users already how to do that.
43:13
But I think it's an interesting approach to say, hey, you know,
43:16
why don't we do a little bit of both?
43:18
Yes, let's do the ITSM integration, but why don't we
43:21
also consider some sort of chat bot type approach, right?
43:24
Or a conversational approach of how do I do this?
43:28
Maybe it's a little thing that it's in the corner and it's
43:30
like, hey, it's not replacing anything.
43:32
But hey, do you want to try the future, right?
43:33
Or do you want to test it, right?
43:35
Or, you know, do things like that.
43:36
I think there's an opportunity here where, you know, products
43:39
in this space could layer on some sort of conversational, you
43:44
know, approach to requesting access.
43:46
Because the, the biggest concern that a lot of people have when
43:49
it comes to this is I don't know what I'm requesting access for.
43:52
I don't, I don't know any. All I know is I need to get to
43:54
this file. And if there is something behind
43:57
the scenes that translate that to say, hey, Jim, I need access
44:00
to the, the logo file for the Identity Center podcast, you
44:04
know, oh, OK. You know, the the robot figures
44:07
that out for me, handles all the approvals and maybe you get a
44:10
text message and it's like, hey, Jeff wants to access this file,
44:13
is that okay? And you just say, yeah, through
44:14
a text message, right? Or something like that.
44:17
Yes. Exactly.
44:18
And then it's like, okay, you've got all the things that you
44:20
would normally do through an ecommerce type approach.
44:24
Traditional I will say is still logged and happening.
44:27
But anything that removes that friction I think is really
44:29
interesting. And I would be curious to see,
44:31
you know, what are the some of the solutions out there that can
44:33
layer on that chat bot type approach Because I don't think
44:35
ServiceNow as it exists now is going to be the way ServiceNow
44:38
does it in the next 5. Ten years there already.
44:41
Yeah, yeah, to your point, I think multi channel is is the
44:44
answer, right. It it really depends on on
44:46
culture what your users are more familiar with it it if if they
44:53
use a lot of Slack right. And having that integrated with
44:57
Slack, we had IBMIBM is using Savant internally for their own
45:01
employees. They built their own chat bot,
45:04
this AI chat bot based on Watson, whatever Watson acts
45:09
that interacts with Savant, right?
45:11
So they also built this, this, this thing because well, now we
45:14
are IBM, we're using Watson, that's it.
45:16
Good. So I think having this openness
45:19
right to to communicate through multiple channels, I think it's
45:23
the direction of the future. I'm not going to be strong
45:26
arming users. Yeah, you got to use through my
45:29
own interface. I think that's the wrong way to
45:30
do it. Enrique is not going to show up
45:32
at your desk and put you in a headlock and say submit this
45:35
form. Yeah.
45:37
Maybe he will, maybe he will. I don't know that you know
45:40
Henrique well enough to say that he won't do that.
45:43
Here's my gift to you, Henrique. You need a trademark Henrique I
45:47
and then make a chat bot. Enrique, I love.
45:50
It thank you. Thank you, Jeff.
45:52
So think about it. Henrique, let's shift topics a
45:56
little bit because I think it's fair to say, at least I'm going
45:59
to say you don't have to agree, is that you're an influencer
46:03
within this space. You a lot of people follow you
46:07
and look to your vision, your strategy for the identity space.
46:13
And I I've got to think that you're pulling inspiration from
46:17
others, right? I mean, that's how it works.
46:18
Oh, yeah. I want to know who are some of
46:20
the other influencers that you're following and what
46:25
they're talking about that excites you and kind of like
46:28
informs you to build your perspective on the world.
46:33
No thank. It's a great question, Jim.
46:34
And it's funny that sometimes I find people that say, oh, why,
46:39
why haven't I met this person yet?
46:41
Right. So one of them is and because of
46:45
my job today, I'd say I'm in charge of strategy.
46:49
So I'm thinking about strategy a lot.
46:51
I'm, I'm, I'm studying more about the discipline of
46:55
strategy. So there's this guy named Eric
47:00
Leach. He used to work at Strata
47:02
Identity and he writes a lot about strategy.
47:07
And I think if, if you, I think he has his own blog on Medium
47:14
and, and stuff like that. But there's one thing that it
47:16
really stuck with me and perhaps with the audience would be
47:18
interesting as well to understand that.
47:20
So one of the things that I do is to think about the vision of
47:23
saving long term and etcetera. And it said something even
47:27
before we, we, we stop to write and think and, and, and
47:30
communicate vision. We got to think about purpose.
47:33
That really stuck to me. So what are we trying to do with
47:36
this? What is the problem we're trying
47:39
to solve? Oh, oh, we were trying to
47:42
prevent things or we're trying to detect things.
47:44
OK, now with that purpose in your mind, you can draw a, a
47:49
vision where you want to be, right?
47:53
So OK, we're, we're protecting this or we're doing this, we're
47:57
detecting that and then vision comes.
47:59
So Eric Leach is one that I, I, I strongly recommend people to
48:04
follow. The other one that come that
48:08
comes across is one of the founders of Netflix, Mark
48:13
Randolph, and he's very active on LinkedIn as well.
48:17
And I wish I could meet him one day, but he seems a very
48:20
interesting guy. And he said this thing that
48:23
stuck with me as well, especially because strategy,
48:25
right? So a good strategy is not about
48:28
having that great idea that one idea.
48:31
It's about having a a system that allows you to test as many
48:36
ideas as you can, right? So being inclusive, not to be
48:41
constrained by my own thoughts because I, I, I joke to say I'm,
48:45
I'm just a guy. I'm one guy, right?
48:47
I'm, I'm, I'm too limited in my own capacity.
48:51
So I, I really like that concept.
48:53
OK, creating that system of just testing very quickly as many
48:58
ideas as possible and coming up, well, OK, now you have like 10
49:03
amazing ideas. I think that's really eye
49:05
opening. So we're coming up here at the
49:07
end of 2024. It's always good to look back
49:10
and say, you know, what got accomplished.
49:12
What do you think it will be remembered for?
49:14
Things like that. How do you think identity is
49:16
going to be remembered for in 2024?
49:19
Were there any specific trends or topics or or things that jump
49:22
to mind? I think 2024 was the year of
49:26
ITDR, if you will. I think it became very
49:30
mainstream. We spoke about that HIP
49:33
conference, the Hybrid Identity Protection Conference.
49:37
Man, it was a whole conference, like 2 1/2 days, just about ITDR
49:43
basically. Wow, this is crazy.
49:46
So I think if I had to choose one thing that was very, very
49:50
popular this year and identity will be remembered.
49:52
Yeah, the identity breaches, right, That happened all, all
49:56
the stuff that we did to protect our systems against those type
50:01
of breaches. I think that's what the year is
50:04
going to be remembered for. Jim, what about yourself?
50:07
What does 2024 bring for you? You know, I, I feel like the
50:12
recognition or the creation of identity security as a concept,
50:17
which has a lot to do with concepts like ITDRI.
50:22
Think if we look back on this year though, it's like a
50:25
formulation era. There's a lot of things being
50:27
put out there. ITDRISPM wallets.
50:33
Machine identities, right? Machine identity, blockchain
50:36
identity. Yeah, yeah, Non human identity
50:38
is like, well, I feel like non human identity has always been
50:42
there. It's just like the recognition
50:43
all of a sudden that, Oh my gosh, there's a problem.
50:46
Oh, you got to protect that too. That's an art scope.
50:51
So there's all these things like what's going to actually, you
50:57
know, stick around and be a part of the future and what's going
51:00
to kind of fall off the plate. To me, that's the year.
51:06
I don't know that it's 2024 specific, but it feels like
51:09
we're at that point where it's like we're up to here with ideas
51:14
and some of them, you know, nothing ever comes to a clean
51:18
death in the identity space. Think about UEBA, right?
51:22
It was like all we could talk about 3 or 4 years ago.
51:25
Nobody talks about it now. But has anybody declared it
51:28
dead? Or is it now just like?
51:32
It evolved into, you know, ITDR. Almost.
51:35
OK, yeah, yeah, I agree. It kind of evolved and like
51:39
nobody declared it dead. It, it becomes a, a capability
51:44
of something else, right? And I think that's, that's what
51:46
may happen with active Dr. as well.
51:48
It are becoming a capability of, of bigger markets like XDR or,
51:52
or SIM or whatever, you name it, right?
51:54
So you're building this tool and it has ICDR capabilities in it,
51:57
right? And that's something that I I
51:59
had predicted before as well. I think the health of the
52:02
industry is that you're seeing the leaders continue to invest
52:08
in their platforms, bring in new things and hopefully get
52:13
stronger. But also the startup community
52:16
is as vibrant and as strong as ever.
52:18
You go to conferences in the identity space, but I think in
52:23
cybersecurity overall, and there's like just so many
52:27
startups out there, and it's not like they are, you know, just
52:31
trying to add a feature on to something else.
52:33
Like some of them are incredible and they're taking on big
52:36
problems and taking them on in new ways.
52:39
And that, I think, is an indication of like how healthy
52:43
the industry is. I think for me, you guys have
52:47
both really good answers. I think it's, it's still AI like
52:50
it seems like everything, every topic this year that we talked
52:54
about had some infusion of some level of AI and how are we going
52:58
to plan for this? How are we going to integrate
53:01
it? How are we going to leverage it,
53:02
right? How are we going to protect it?
53:04
How are we going to protect against it?
53:05
I feel like AI is sort of like the this thing that's sort of
53:09
like the shark beneath the the waters.
53:12
Or maybe it's the iceberg, right?
53:14
You've got this. Little no, it's the wave, man.
53:16
It's the wave rising cloud is the now is the, the AI wave.
53:20
So absolutely everything that we spoke about, I think they're,
53:22
they're, they're surfing the wave of AI.
53:25
So I, I agree 100%. So the same way we surfed the
53:28
cloud wave and and we had the start-ups way back like autumn
53:32
eyes and cloud knocks and Airmatic for that cloud wave.
53:36
We're going to have that. That's going to happen again,
53:38
man for AI, And I think that's the the the push of innovation
53:42
identity itself, it's protecting that and that's the constant,
53:47
right? The constant of all the waves
53:49
sees the mainframe through the decentralized compute to cloud
53:54
to AI identity as a constant, right, Like Jem said, but even
53:59
machine identities, it's been there forever.
54:01
It's just now we have this different type of pushes or
54:05
waves, like I said this, this shark now in, in the water.
54:10
I, I still think 2024 being that year of threat became like
54:16
mainstream. But at the same and, and, and I
54:19
spoke exactly about that, Jeff. Two things that happened in
54:21
2022-2023 with real exploit 2024 was AI and identity threats.
54:28
Those two things that can happen at the same time.
54:32
So what about 2025? Any predictions for next year?
54:35
Are we still going to be talking about AI the same level we are
54:37
now? What do you think, Enrique?
54:39
Yeah, I think we're going to still surfing that wave, right,
54:41
at least for the next until 2025, until 2029 when we hit
54:46
singularity and AI becomes more powerful than us.
54:49
And in humans, I think that the big prediction for next year is
54:53
going to be identity or machine identity security, which is
54:58
something that we briefly spoke about here in this episode
55:02
today, is that it's being there forever.
55:05
But now people, OK, I think we've done a decent job with
55:09
workforce. We didn't, we've done a decent
55:10
job with CIM and externals. Oh, what are those machine
55:14
doing? And it will become like
55:17
undeniable. We can't ignore this problem
55:19
anymore. So I think for next year, I do
55:22
predict that organizations that invest more time and money into
55:27
finding basic things like visibility and hygiene of
55:31
machines, they will improve their resilience in cyber like
55:35
considerably. I'm, I'm, I'm, I'm estimating
55:39
from 30 to 50% efficacy of, of protection or being stronger and
55:45
more resilient. I like that prediction because I
55:48
feel that spot on, you know, and again, it tails back into this
55:51
AI, there's going to be this explosion of non humans doing
55:55
things in our environments. We have to manage those things.
55:57
So I feel like this whole, whatever you want to call it,
56:00
machine identity, non human identity, I think, I think we
56:02
need to settle on what that definition might be as an
56:05
industry. But that whole idea of like, OK,
56:07
there's going to be little bots running around and there might
56:09
be, they might be so ephemeral. They only exist for a
56:13
millisecond because their whole task is to do one thing and it's
56:16
gone. And being able to track all
56:18
that, it's going to be really interesting and I think really
56:21
compute intensive to try and track all that type of stuff.
56:24
Jim, what about you? What do you want to predict for
56:26
2025? I got something but I want I
56:30
first wanted to say. So we did a podcast with David
56:33
Motti recently and we talked about non human identities.
56:36
And one thing he argued for is that we shouldn't define
56:41
something as what it's not. So saying that is a non human is
56:47
defining by something by what it's not.
56:50
And anyway, so that's a little side note.
56:52
Yeah, but let's talk about that real quick.
56:54
Two minutes if I may. That's a that's a good point.
56:56
And see, that's why I like David, he says Mark Guy defining
57:00
things by whether or not is like a like a Turing machine.
57:03
It's called a Turing Turing machine.
57:05
It's like a Turing non human, right?
57:09
But non human is not wrong in the sense that we have humans
57:13
and we have non humans. In that category of non humans
57:15
are cats, they're dogs, right? They're animals or bacteria.
57:18
There's ghosts and there is machines, right?
57:23
So I see machine as a subset of non human machines.
57:27
Machine. You could break that down into
57:29
workloads and devices. So I think non human is not
57:34
completely wrong. It's just that it's a, it's a
57:37
much bigger scope of things that we're not talking about.
57:40
I'm not talking about cats and dogs, I'm talking about
57:43
machines. So it's a non human but it's a
57:46
machine and then with the machine it's either workload or
57:49
a device. It helps group this concept
57:53
which I don't think is well managed as people.
57:56
And when you look at enterprise people, there's kind of a way to
58:00
manage them. They start an HR system, they go
58:03
into your IGA system, they get provisioned access, etcetera.
58:08
Machines like what's the authoritative source for machine
58:12
accounts that there's really not?
58:15
And the kind of identity or machine or account that Jeff
58:19
mentioned that is created for in an ephemeral nature is a lot
58:24
different than the Active Directory Service account that
58:28
is used by the SQL Server that was set up 12 years ago.
58:32
Yeah, yeah. So the way we're defining that
58:36
Savient, it's it's and this is important, right.
58:40
So the the the hierarchy or the taxonomy of that.
58:44
So we we categorize it as a machine identity, a machine
58:48
account and a machine credential, three different
58:51
levels. And we can talk about that
58:53
perhaps some other day, but there's a, yeah, some lack of
58:57
clarity of what are we talking about here.
58:59
And to your point, yes, there's no alternative source for
59:02
identities that are machine based most of the time.
59:07
All right, here's my bonus 2020. 5I I got to answer this 2025
59:10
because I did. I'm sorry I took this off track
59:12
there, but so you know me, Jeff. Doom and gloom.
59:18
So here's my doom and gloom prediction for 2025 S Nobody.
59:23
Great, everything's going to work.
59:25
New Year's Eve, you should be celebrating the year behind, not
59:29
the year forward. The So here's my concern is as
59:34
humans, we react to things that happen.
59:37
You know, people fly planes into a building.
59:42
We start screening people better.
59:44
We don't think, oh, somebody could fly a plane into a
59:46
building, so we better start screening people better to
59:48
prevent that. So it's very unfortunate.
59:51
That is human nature. And I kind of feel like identity
59:54
security is in the same place where people actually have to be
59:58
breach or breaches have to be on the front page of the Wall
1:00:02
Street Journal. More and more so that you can't
1:00:05
escape the issue for people to amass invest in identity
1:00:10
security. But that's what's going to
1:00:13
happen at some point, whether it's 2025 or later, I don't
1:00:16
know. But I think there is going to
1:00:18
be, you know, a sharp increase in breaches that drive the
1:00:24
identity security investment. It makes sense, right?
1:00:28
So what you're saying is that it's going to get worse before
1:00:31
it gets a little bit better, right?
1:00:33
It's going to get worse before people go and get behind this
1:00:36
thing. It it makes lots of sense.
1:00:38
No, I don't think it human nature of people thinking, yeah.
1:00:41
I don't think it it, I don't think it necessarily impedes
1:00:44
though the pace of innovation, right?
1:00:46
What we're talking about is, is investment.
1:00:48
And yes, you know, we are humans and budgets are limited and
1:00:51
people go where the fire is and they put out the fire.
1:00:55
There will still be people who are thinking about where will
1:00:57
the fire go next? And products will be developed
1:01:00
in anticipation of where those go.
1:01:02
And sometimes they're right and they make a billion dollars and
1:01:05
sometimes they're wrong and they fail or it wasn't the right, you
1:01:07
know, solution where it may be. And so, you know, I, I'm with
1:01:11
you, Jim. I'm trying to make it take a
1:01:12
more positive spin on it to try and end our show.
1:01:15
But I'm with you because it, it does take a bad thing to happen
1:01:18
sometimes to OK, well, we can't have that again.
1:01:21
We can't have another, you know, socks, you know, finding or we
1:01:24
can't have another regulatory finding or a breach or whatever
1:01:27
it may be. We have to invest and catch up.
1:01:30
And I think that's where a lot of companies fall into this trap
1:01:32
of what I call the peaks and valleys of their investments is
1:01:36
they didn't keep sustained investment to keep pace and keep
1:01:39
good security posture management in place.
1:01:43
They did a spend, caught up and then let it die slowly.
1:01:47
And then now they're doing another spend and they're going
1:01:49
back up again instead of having this this, this consistent
1:01:52
approach to it. I agree, which I I had a comment
1:01:57
on that the last thought of how we keep things interesting,
1:02:01
right. So posture management becomes
1:02:03
day of your life. And one thing that I caught up
1:02:06
during my, my recent travels, which has, they have been quite
1:02:10
intense is Duolingo, right? I, I, I'm, I'm learning French
1:02:15
and I, I can order tea in French now.
1:02:17
It works. It works and, and, and that type
1:02:19
of gamification. So I'm, I'm thinking perhaps
1:02:21
that we could do that, something like that for identity posture
1:02:24
that becomes something more acceptable, right?
1:02:29
Yeah. Nobody likes to wake up in the
1:02:31
morning and work out. But that's basically what we're
1:02:34
describing that identity security posture management
1:02:36
requires. If you can figure out how to
1:02:38
turn World of Warcraft into some sort of, you know, gamification
1:02:43
of identity management, I am right there with you, baby.
1:02:46
There you go, man. Start up time, yeah.
1:02:49
All right, let's go ahead and start wrap things up.
1:02:51
I, I got to ask because you mentioned it earlier, Henrique,
1:02:53
Mike Tyson versus Jake Paul. You know, they, they fought a
1:02:56
couple weeks ago at this point, you know, what are, what are
1:02:59
your thoughts on that? Man, it, it is crazy because my
1:03:02
son was asking me about this because when I say, hey, I'm
1:03:05
going to do this podcast today and say, OK, are you going to be
1:03:07
talking about Mike Tyson? Say what?
1:03:09
No, I so now I I think I'm I have but now.
1:03:12
You can say you kid, you did. Yeah, we did talk about Mike
1:03:15
Tyson, man, what I think was amazing is that how many
1:03:18
generations were watching that thing from from Gen. alphas all
1:03:22
the way to boomers and and and and different preferences.
1:03:27
Of course I, I, I wanted Mike Tyson to win.
1:03:30
I think people, my generation would would perhaps OK, yeah.
1:03:33
There's no, no way this YouTube will, will, will I, I thought
1:03:38
Jake Paul would will lose that one on points, but I think
1:03:41
there's a lot of the controversy came in about the things he said
1:03:44
after the fight, right. And so, yeah, I that he took it
1:03:47
easy on, on Mike and, and which is kind of weird, but before all
1:03:53
the the hype came in, I thought, well, man, this guy's going to
1:03:56
be destroyed. I think Mike Tyson's going to
1:03:57
kill this guy. And and there was a fight before
1:04:02
the main match. I don't know if you guys saw it.
1:04:04
Did you guys watch it Was a was a Brazilian was a Brazilian
1:04:08
comedian was a Brazilian comedy called Winderson Nunes the
1:04:11
Winderson is a is a stand up comedy comic in in Brazil turn
1:04:16
into fighter and now and then and he got demolished right by
1:04:23
this this Indian boxer. And I thought yeah, that that's
1:04:27
that's what I would expect to happen with with Jake Paul, but
1:04:32
I was wrong. I think as many people, I think
1:04:36
a lot of people. That was a weird.
1:04:38
Fight. I mean, it was an exhibition,
1:04:40
right? I mean, let's look, Father Time
1:04:42
is undefeated, right? Tyson is 58 years old.
1:04:46
You know, I sneeze and sometimes my back hurts.
1:04:48
He got into a ring and went 12 rounds with a young man who is
1:04:53
a, you know, a, a, an established fighter.
1:04:55
I don't know how good he is, but he's been in the ring and he's
1:04:58
been fighting. You know, he's got some success
1:04:59
there. But 58 years old, Hey, man, you
1:05:03
know that's off to you. I would have loved to see Tyson
1:05:05
win only because I think it's like a generational thing,
1:05:08
right? You grew up with Mike Tyson, you
1:05:10
grew up with Michael Jordan, you grew up with Walter Payton,
1:05:12
right? All these sports heroes of your
1:05:13
time, you don't wanna see them get dethroned.
1:05:17
And hey, Tyson made what, $20 million?
1:05:21
I I don't need to go 12 rounds, you know, someone can, someone
1:05:24
can push me and I'll take the $20 million and I'll fall down
1:05:26
and take the TKO. Right, exactly.
1:05:29
But but I'll tell you what, also hats off to to that guy, Jake
1:05:32
Paul, just to orchestrate this, this whole endeavor, right.
1:05:36
And he has this vision of OK, I'm, I'm gonna number one, I'm
1:05:39
gonna learn a new sport and I'm gonna fight perhaps the, the,
1:05:43
the GOAT. And, and to make that happen,
1:05:45
yeah, it takes a lot of yeah. Jake Paul got 40 million for the
1:05:50
fight and Enrique I don't. And Jeff, I don't know if you
1:05:54
guys watched the fight or not, but Jake Paul definitely could
1:05:58
have pummeled Mike Tyson. First off, he was like 6 inches
1:06:02
taller and bigger. Exactly, his reach was.
1:06:05
For my my fellow 50 year old and plus, you know you're not going
1:06:11
to beat somebody in their 20s who's more fit than you.
1:06:14
It's just. Not good to.
1:06:15
Happen, you know, if it was a one round fight, Tyson might
1:06:19
have been OK, but your VO2 Max, which is like your ability to
1:06:23
move oxygen around your body at 58 years old versus a young man
1:06:29
in his 20s and his prime, that's just.
1:06:33
Did I say Father Time? The idea of him lasting, I think
1:06:37
it was an 8 round fight, the idea of Tyson and and he was
1:06:41
exhausted by the end. But Tyson said one thing at the
1:06:45
end which is he doesn't know if that's his last fight.
1:06:48
Why would it be? Who amongst us wouldn't go in
1:06:51
the in the ring for $20 million and just let Jake Paul kick the
1:06:56
crap out of us? As long as you live, you got 20
1:06:59
million bucks. So, Jim, maybe this is our our
1:07:02
future endeavour. We did, you know, Fido feud at
1:07:04
authenticate. Maybe we do a identity boxing
1:07:07
circuit or some sort. If there's anybody who's
1:07:10
listening who wants to beat me up for $20 million, I'll take
1:07:13
your money, right? I will not get into a cage match
1:07:17
with David Mottie however, so this this is where I draw a
1:07:19
line. Even for 20 million.
1:07:21
That guy that this, that guy is massive so.
1:07:23
Yeah, he is. He's he's he's really.
1:07:26
Built well, but but back to to Tyson and Jake, just to to close
1:07:30
that up my what my son told me right this morning, he said, but
1:07:34
that you know that that fight was scripted right.
1:07:37
I said, what do you know about scripts?
1:07:39
I don't know very interesting either.
1:07:41
Yeah. I mean, everyone has the plan to
1:07:43
get punched in the face, I think Tyson.
1:07:45
Said that once. Tyson Yeah.
1:07:49
Yeah, it was an exhibition match.
1:07:51
It was interesting to watch. You know, it was a spectacle if
1:07:53
you could watch it. I know Netflix had trouble
1:07:55
streaming and I didn't watch it. I didn't really care so much.
1:07:58
But hey, just to be in the ring for 58 years old and to go the
1:08:02
distance and, you know, be up there, like I said, you know,
1:08:05
sometimes I sleep wrong and my neck hurts.
1:08:08
You know, I'm not going to criticize any of those guys.
1:08:13
You know, hats off to them. They made their money, you know,
1:08:15
time to move on. All right, why don't we go and
1:08:18
wrap it up there for this week? Enrique, it's always a pleasure
1:08:20
having you on open door policy. Anytime you got something you
1:08:22
want to come on and and talk about, you know, the door is
1:08:25
open, come on in and you know, we can get to it.
1:08:28
We're going to go ahead and leave it there for this week.
1:08:30
Enrique. I'll put a link in our show
1:08:31
notes to your LinkedIn profile. So people want to reach out,
1:08:34
connect, you know, they'll be able to do that.
1:08:36
Also have a link to Savient so people can check that out.
1:08:38
If you haven't heard of Savient, not sure who you might be if
1:08:40
you're listening to this podcast, but go check them out
1:08:42
as well. And yeah, we'll have links for
1:08:45
Jim and I as well to connect. Helps us, you know, if we get
1:08:47
feedback, say what works, what's not working.
1:08:49
So we're always looking for stuff.
1:08:50
If you have ideas for shows, drop us a note there.
1:08:53
You know, that's always good. And then of course, you know,
1:08:54
we're still on the YouTube. idacpodcast.tv takes you
1:08:57
straight to our episodes there. Do us a favor, like and
1:09:00
subscribe. That helps out the show.
1:09:02
And yeah, we'll leave it there. So thanks everyone for watching
1:09:05
and or listening and we'll talk with you all in the next one.
1:09:10
You've been listening to Identity at the Center.
1:09:13
We hope you've enjoyed the show. Make sure to like, rate and
1:09:17
review, and we'll be back soon. But in the meantime, hit the
1:09:21
website at identity@thecenter.com.
1:09:25
See you next time on Identity at the Center.