Latest / Identity at the Center / #426 - Sponsor Spotlight - Crowdstrike

Transcript

#426 - Sponsor Spotlight - Crowdstrike · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. I'm doing great, man.
0:17
I'm so excited for today's episode 1 because our guest
0:21
Scott is just, you know, he gets it.
0:24
And the second, I think this overall stories of validation
0:28
that identity is at the center of cybersecurity.
0:31
Yeah, we're going to be talking with Scott Chris here in a
0:33
second, but you have to make it clear, right?
0:35
This is a sponsored episode. Sponsors like Scott and company
0:38
from Signal, who've been on a few Times Now at this point and
0:41
now Crowdstrike are really the reason we're able to do what we
0:43
do. So we definitely appreciate
0:45
that. So let's go ahead and introduce
0:48
the man, the myth, the legend, Scott Chris.
0:50
He's the GM of continuous identity at Crowdstrike.
0:53
Welcome to Identity, the Center, Scott.
0:55
Yeah. Thanks, Jeff.
0:56
Good to be here. So.
0:57
A little bit of news, right, for Signal over the last couple
0:59
months. You guys joined, you know, Crowd
1:02
strike pretty recently. We've had some conversations
1:04
around that with some of the others, but I think this is the
1:06
first time, right, You've been on the show with us, so we're
1:08
pleased to have you here. We want to introduce you to the
1:11
world, right? Who's listening and why don't we
1:13
find a little bit more about your identity background?
1:15
So let's start there. How did you get into identity?
1:19
Is it something that you chose or did it choose you?
1:21
Yeah, I think it probably chose me in the form of in the form of
1:27
frustration. And at the time it was about
1:30
2011 and my Co founder and I were working as leads of product
1:34
and engineering departments at various startups.
1:36
And the one that we were at was actually building fantasy sport
1:39
games, which has nothing to do with what we ended up pursuing.
1:43
And we had a lot of employees coming and going and we really
1:48
had a challenge with how people got access to things.
1:51
And that was really the first I think awareness I had that
1:55
identity was even an industry. And we evaluated a, a small
1:59
company called Okta at the time to allow people to easily just
2:03
sign into the things they need to get to.
2:04
And they were really early just raised a Series A and we thought
2:09
it was just OK. And we knew that it worked well
2:11
with Microsoft products, but not with, with other directories
2:17
and, and it and we were not a Microsoft shop at the time.
2:20
So really it came out of that frustration of no one's doing
2:24
this well. And as we were packaging up that
2:26
company to sell it, it was a venture backed company.
2:29
My Co founder and I said, why don't we go and see if we can do
2:31
a better job at what what Octa was trying to do.
2:34
And that was really the start of of my adventure into identity.
2:39
That's a bold strategy, Cotton. Let's see how it pays off from
2:42
them. I guess success is, I'm assuming
2:46
that's where signal came from and that was kind of where
2:48
things are you talking about something else?
2:49
Yeah. This was actually a company
2:50
called Bidium. And and Bidium, we ran for six
2:53
years and ended up competing directly with with Okta.
2:57
And I remember it was the same month that Okta went when filed
3:01
to go public that we beat them at 2 competitive contracts.
3:05
One of them was a large insurance company, the other was
3:07
a large bank. And we really thought things
3:10
were going well. And when we saw them file to go
3:13
public, we had no idea what it meant for us.
3:15
And it ended up that people noticed that this was not just a
3:19
product and a feature, but it was actually a a company and a
3:21
business. And so to make a Long story
3:25
short, we ended up being pursued by a couple of the largest
3:29
software companies around and ended up selling the company to
3:31
Google Cloud. And that was a a great four
3:35
years of building identity internally at at Google and at
3:40
all of the Alphabet companies been also building that stand
3:43
alone product and and this was really focused on
3:45
authentication, provisioning and directory.
3:48
And so that that actually predated signal on the signal.
3:52
Signal was inspired by the lot of the work that we did at
3:55
Google. And I'm, I'm thinking that's
3:56
probably where you met folks like Atul and and others.
3:59
Yeah, our, our CTO was working on the Cape Standard.
4:03
So he had just, I just saw a, a draft and a Google doc of what
4:08
he was proposing. And I thought, this seems really
4:12
simple. And I think that was where it
4:14
occurred to me that sometimes the most elegant, simplest
4:17
solutions are actually the hardest to get to.
4:20
And so, yeah, that's where we met.
4:21
We met Otto and Eric, my my Co founder at Bidium and I were,
4:25
you know, working on all these things inside of of GCP.
4:28
He owned directory. We did own the what's now called
4:31
Google Cloud Identity and that's their Federated authentication
4:34
product. And I was pulled into internal
4:38
efforts which became the inspiration for Signal.
4:40
It was really recognizing that as many great security things
4:45
that you can have in place at a company at scale, there still
4:48
seem to be something something missing.
4:50
And that's that was really where the idea for Signal came up.
4:53
So let's talk about that. Something missing.
4:55
So signal, if I'm in an elevator with you, Scott, and you have to
4:58
tell me what signal does you know, what is the, the pitch for
5:01
that? Yeah, I think the simple version
5:03
is that in a, in a world where security is really important and
5:07
especially 1 now with, with the agents making that even more
5:10
apparent. The only way to really feel like
5:13
you've secured things the right way is to take a stance of
5:16
having no standing access to anything.
5:19
And you can and, and making sure that every time you try to get
5:22
into something that you're evaluated based on the context
5:26
that you know, And you could think of that in real world
5:27
terms, you know, walking into a building or, you know, how do
5:33
you get into your car and having that right context of you are
5:36
the right person trying to do the right thing.
5:39
And then making sure that once you've accomplished the thing
5:43
you were trying to do or the parameters change that make that
5:46
thing no longer accessible to you, that in that instant you're
5:49
no longer allowed to be accessing it.
5:51
So it was this really, it was really inspired by what was
5:56
happening in Hong Kong and China at the time where Hong Kong was
5:58
being pulled in very closely to China.
6:01
And Google had a couple of of large buildings and offices
6:05
inside of of of Hong Kong. And they want to make sure that
6:08
employees or anyone in the office could not get to customer
6:11
data unless unless the customers also physically located in Hong
6:15
Kong. And that sounded like an easy
6:17
thing to do. But when you take into account
6:20
that there are thousands of different surfaces, it includes
6:22
infrastructure, applications, CRMS, that that was actually a
6:27
really challenging thing to accomplish.
6:28
And then and then I think that led us to really believing that
6:32
it had to be solved in a, in a larger way that wasn't a one off
6:35
where you could drop everything and figure out how to fix that
6:38
one thing. But how do you create something
6:39
more to scale? And it was, it was actually
6:42
surprising to me that nothing in industry existed that we could,
6:45
you know, find a vendor to, to buy.
6:47
And so we ended up doing a lot of work there internally at
6:50
Alphabet and that, you know, it got my team all promoted, which
6:53
was great, but it inspired me to to figure out how to solve it on
6:56
more of a global scale. So with your long history in
6:59
this space, how has your like viewpoint on identity changed
7:03
over time? Has there been any sort of like
7:06
significant aha moment or an evolution at some point where
7:09
you're like, oh, OK, I used to think this and now this is where
7:12
I'm at? Yeah, I there, there's been just
7:14
a lot of evolution. I mean, if you think about what
7:16
I described as that single sign on problem, if I can't get to
7:20
what I need to get to, that really came out of enabling
7:24
people to do their job. And it wasn't really my thought
7:28
at the time that it was a security product, that identity
7:31
and security were the same thing.
7:33
But as it, as it evolved and, and we started to realize that,
7:37
yes, it's great to enable people to get their job done.
7:40
We also realized that you can go too far without, if you're
7:43
enabling too much access or not removing the access when
7:46
necessary. So my, a lot of the, I'd say the
7:50
IT, it probably wasn't new to people that have been in the
7:52
industry at the time, But for me personally, moving into this
7:55
world of, you know, philosophical differences
7:59
between how things should be in and not tact, not tactics around
8:03
it. I think was, was really mind
8:06
mind opening. And and that really LED us to
8:08
like, how should the how should the world function?
8:11
And some of the things that we had looked at people attempting
8:13
in the past, these weren't new concepts, but there were always
8:17
technical constraints and I think productivity and security
8:20
at all. These always been at ends where
8:23
you know, and, and this another evolution of thought was that
8:26
they don't have to, you don't have to have the security person
8:28
creating friction that the user notices.
8:32
And if you do security correctly and you handle identity
8:34
correctly, it's actually not not creating friction.
8:37
It's it's as long as you're doing what you should be doing,
8:41
it's really a seamless process. I love how you explain these
8:44
things, Scott. I was kind of thinking as you're
8:46
talking, it's like, oh, see, all seems so obvious in hindsight,
8:51
right? But I, I wanted to kind of pick
8:55
on something I thought of within your title, which is that you're
8:59
the GM of continuous identity at Crowd Strike.
9:02
And by the way, to learn more, go to crowdstrike.com.
9:06
But this term continuous identity, I was wondering if you
9:11
could kind of explain that to. Us, yeah, if there's been a real
9:14
evolution in naming, and I think others on this program have
9:17
probably shared that there's just not enough nouns in in
9:20
identity. And so in that world, how do you
9:23
define conceptually what you're trying to accomplish?
9:25
So continuous identity is not a specific use case or a thing.
9:30
It's a representation of a number of different components
9:34
of how we think about authentication and access.
9:38
And so on the access side, being able to be authorized in real
9:42
time, evaluating levels of context and thinking of it as
9:46
real ephemeral access where it's for that moment in time to do
9:50
something specific. And when the and when the
9:53
parameters are no longer met, when the context changes, being
9:56
able to revoke that access. So it's a continuous evaluation
10:00
of what's happening across the company, the telemetry that you
10:04
get, things that you might consider device posture and when
10:07
they change and being able to in real time take action.
10:10
And you can see that word continuous makes a lot of sense
10:13
when you think about how we're interacting with those, those
10:16
levels of access for users, for non users, for agents, etcetera.
10:20
Yeah. And it feels like that real time
10:22
nature of things is what differentiates it from
10:26
traditional approaches like IGA and Pam, which are kind of, you
10:32
know, in preparation for or post facto kind of analysis.
10:37
Would you say that's the the main difference between the two?
10:40
And what is kind of what is it that you gain by being real
10:43
time? Yeah, I think if you, if you
10:46
look at the buckets that Gartner has put companies in over the
10:50
past and you, you consider Pam and IGA, they were brought about
10:55
for good reasons. Identity governance, really
10:58
Sarbanes, Oxalene, being able to to let auditors look at the the
11:03
route, the logic behind who has access to what to look at lists
11:06
and groups of users. That makes a lot of sense.
11:10
However, as the as things evolve, you start to recognize
11:15
that that the real function of having the right level of access
11:18
is really hard to do in a static way.
11:20
And So what existed 20 years ago made a lot of sense and it's and
11:24
we still need that level of compliance, but maybe the
11:27
compliance changes to looking at the underlying logic of the
11:31
context that's taken into account for access.
11:33
And then on the privileged access management side, I find
11:38
it really interesting that in a post single sign on world,
11:41
people are still using some of the older technologies.
11:45
And what I mean by that is if you take your typical Pam
11:49
software vendor, they really view the world that you have
11:52
multiple identities. 1 is a privileged identity and one is
11:55
your own identity. And at the same time we have
11:58
single sign on providers like Idiom which which I built with
12:02
my Co founder Eric or Octa and Ping and they've just now built
12:07
single sign ONS. We clearly know who the user is.
12:09
Why would you need to have another a set of credentials
12:13
being checked in and out if you understood the telemetry around
12:17
how around why they were trying to get access.
12:20
So I view Pam as, as an industry that serves a purpose, but it
12:25
never evolved along with single sign on and the modern world.
12:29
So I think we've, we took a step back when we created signal and
12:33
we said, how should the world work?
12:35
And I think a lot of large companies were thinking about
12:39
how do we evolve our existing architecture versus how do we
12:43
rethink where we want to be. And that was really the the the
12:47
key to how we created something new that solves the same
12:50
problems as few other industries, but in a very
12:54
different way. And we wanted to pull ourselves
12:56
out of those buckets. And that's where continuous
12:58
identity, the naming, really came from.
13:00
I definitely hear what you had to say about the analyst firms
13:04
kind of identifying this need. I kind of feel like a lot of
13:08
times approaches in the market are focused on, you know,
13:14
solving things with their product, but you guys really
13:17
take a an approach, which is, hey, we have to connect to all
13:22
these different sources for signals for what's going wrong
13:27
or where we're seeing these compromises.
13:28
So I think that it was, you know, it created a vacuum where
13:33
like, hey, who's going to put together a solution that
13:36
actually does span this? And I was wondering if that was
13:40
kind of the market opportunity that led you to solving things
13:44
in this way or, or what if or correct me if I'm like thinking
13:48
about this wrong. I think the when we really
13:51
recognized it was after building something that worked internally
13:55
at Alphabet, we wanted to validate that this was actually
13:58
a problem the rest of the world had.
13:59
So going out to chief information security officers in
14:03
the largest companies we could find and asking them, how are
14:05
you solving this problem? The answers were pretty much
14:08
across the board the same thing. That's a really hard problem.
14:12
We don't know how we're going to solve it.
14:13
We would imagine that we're going to do the same thing that
14:15
you did and hire a bunch of people because it's so nuanced
14:18
and specific. And I think that was one of the
14:21
biggest challenges is convincing the market that this was
14:25
actually achievable. There were a lot of people that
14:27
said that sounds amazing. I don't think it's possible.
14:30
And so it really took a couple of very large customers to prove
14:34
that it was possible and to get on the stage at, at conferences
14:37
like Identiverse and talk about how they had solved the problem.
14:40
You almost had to show people that it worked rather than just
14:43
talk about it because it seemed theoretically amazing, but but
14:47
logistically not possible. And when you mentioned like
14:50
pulling in signals, that was specifically the, the thing that
14:53
seemed complicated. And the question was always that
14:56
that sounds great, but where do we start?
14:58
And so being able to ground it in a very simple use case was
15:03
where we ended up deploying most of the early solutions.
15:06
I want to talk a bit more about that continuous identity
15:08
landscape that we've got. First of all, you're preaching
15:10
at the choir, right? This is a continuous identity
15:14
friendly show. We've had a lot of discussion
15:15
around it. For me, where it starts is the
15:18
data. You need data to generate those
15:21
signals and then you need infrastructure and pipelines and
15:25
messaging, right? And all these different
15:26
connectivity to them pick up on that kind of stuff.
15:29
I think there is sometimes a a feeling that when we cite, when
15:33
we talk about continuous identity that people think it's
15:35
just authentication. But I feel like it's more than
15:38
that. I'm just curious, how do you see
15:40
sort of that broader landscape? What are the capabilities that
15:42
fit underneath continuous identity?
15:45
Yeah, I, I think some of the early versions of continuous
15:48
identity were exactly that. They were just, let's make
15:50
someone re authenticate every single thing they do.
15:53
And when they re authenticate, we'll look at telemetry and
15:56
decide, yes, you can get in. Yes, you can't.
15:59
What we realized is that it might be better to sit at the
16:01
authorization layer. And so you're exactly right that
16:05
that data is a requirement and good data is a requirement in
16:09
order to accomplish any goals. And I think that's been the case
16:12
for authentication as much as it is for authorization.
16:16
I remember doing deployments for single sign on for those large
16:19
companies that we, you know, won against Okta.
16:22
And even then the, the quality of data in Active Directory was
16:27
the gating factor for when they were able to actually sensibly
16:30
deploy a single sign on solution.
16:32
And now that I think that that companies have emerged and
16:35
they're further along in, in their life cycle and their
16:38
maturity from an identity perspective, it's still data
16:41
that's the underpinning requirement.
16:43
And when the, the way that we usually go about this to, to
16:47
think about how can we solve problems and how can we become
16:50
outcome based like selling identity products is not
16:53
interesting. Selling the, the results is
16:56
what's really interesting. And so when we talked about with
16:59
early customers, let's get you to, no one has standing access
17:02
to your cloud infrastructure and they only have access if someone
17:05
is on call and they have a support ticket assigned to them
17:09
and their device is compliant. And they said, OK, well, that's
17:11
interesting, but how do we, how do we get that data?
17:14
And what we ended up doing was, was figuring out that most
17:20
initial policies were very deterministic and you could
17:23
write them down on a piece of paper.
17:24
And there was usually someone in the company that said, I would
17:27
love to have this deployed. I just don't know how that we
17:29
would do this technically and existing solutions don't work.
17:32
So we, we basically took those policies.
17:34
And in that example that I mentioned for a dev OPS engineer
17:38
that needs a ticket and on call and compliant device, we'd
17:42
figure out, well, where are the systems of of record that have
17:45
that data and how do we pull those into a central place?
17:49
And then by doing that, we could essentially say that a policy
17:53
like that, all it really was was a query across a database of, of
17:58
deciding whether or not the parameters were not.
18:01
Now you can change that and make it a little bit non
18:03
deterministic, but most policies today, you get extremely far on
18:08
looking at those aspects of the data.
18:11
And one that that came up almost always was device compliance and
18:16
telemetry coming from the end point.
18:19
And so naturally we had almost all of our customers, I think
18:26
very few that were not Crowd Strike customers as well.
18:30
And we we were unknowingly partnering with Crowd Strike
18:33
just from an integration standpoint when it really
18:35
occurred to us that, you know, identity and security are
18:39
following very similar paths here.
18:40
And so, yeah, so you're right, it started with the data and the
18:45
other parts of of you know, continuous identity have to do
18:49
with interoperability. They do have to do with re off.
18:54
But instead of sending someone full through the full cycle of
18:57
going back to their Octa login screen, it might be something
19:00
more like a push to to a mobile device.
19:02
And you know, this is something that crowd strike has as well.
19:05
So you can tell that a lot of the end to end is is really a
19:10
crowd strike products. But in addition to that, it's a
19:14
very partner friendly ecosystem. So, you know, if a, if a
19:18
customer has a preference on, on something that they, a vendor
19:21
that they love for whatever reason, it, it has a better
19:23
integration, they like the salesperson, it doesn't really
19:25
matter. Being able to work with the
19:27
solutions that they want was really important.
19:29
So one of the things that I will see when I talk with vendors is
19:31
the Better Together story, right?
19:33
It's like a couple vendors have kind of banded together to be
19:36
like, Hey, we're all buddies and we share stuff.
19:38
But it's still historically been more of like a proprietary
19:41
sharing, right? A connector between an IG and a
19:43
Pam or what you know, whatsoever.
19:46
You, you guys have a more interesting story because
19:48
you're, you're really the Better Together story.
19:51
When I talk about continuous identity with folks, it's
19:54
generally not like a RIP and replace.
19:56
You're not ripping and replacing the investments you've already
19:58
made in some of these other technologies.
20:00
What you're doing is you're helping connect those together
20:03
and you're using things like shared signals framework and
20:06
Cape and wrist, right? And a bunch of other stuff that
20:08
the industry at large has really kind of come together on how do
20:12
we want to share information with each other?
20:13
So I'm curious, does that? Does that Better Together story
20:17
make sense from from from my viewpoint as sort of on the
20:20
outside looking in? Yeah, I think I.
20:22
Think that's right? I mean, every start up of course
20:25
wants to say they Better Together because that's a much
20:27
easier thing to say than you should consider replacing a
20:31
technology you've worked with for 10 years for us.
20:33
And, and practically speaking, that's not going to happen.
20:36
If you look at a, you know, a, a cyber ark customer as an
20:40
example, they spent a long time setting up these systems and
20:43
they have deep integrations into everything from switches to
20:48
infrastructure. And so you can't just really
20:50
yank it out. So I think a lot of it is
20:53
augmenting existing solutions and making them better.
20:58
And, you know, slowly does that move things from old platforms
21:02
to new platforms? Sure, I think it naturally does.
21:04
And so in the things that you can be the, the best or the
21:07
second best vendor, I, I think you'll end up owning that set of
21:11
outcomes, But it doesn't mean that you're, you know, full
21:14
stock replacing something I think, you know, to be a little
21:18
bit controversial. I'd say that my view on, on, on
21:22
the existing Pam solutions is they get reduced down to very
21:25
few things. And I'd say the two things that
21:27
stick out in my mind are password vaulting and session
21:30
recording. And the reason that those don't,
21:33
don't go along with it is people just don't want to build those.
21:35
They're not interesting, they're not fun.
21:38
So I think that some of these industries or some of these
21:41
incumbents get reduced to their, you know, minimum value that
21:44
won't go away. And I think that's an OK thing.
21:46
They can evolve in other areas and expand different markets.
21:48
Yeah, I was kind of. Doing the same thing, session
21:50
recording immediately kind of jumped to my mind is like OK, no
21:53
one really wants to build that so why not use that as a
21:55
product? Is there a reference
21:58
architecture for continuous indenting?
22:00
I feel like it's still pretty conceptual and I don't know if
22:02
there's like a standard yet other than, hey, there's a bunch
22:05
of data in the middle and then just like spider webs, yeah.
22:09
I think you're right. It is it, it, although I will
22:12
share that the largest customers tend to share what they they
22:15
consider their reference architecture for two to three
22:17
years out. And maybe surprisingly they're
22:22
very consistent and they're industry agnostic.
22:24
So, you know, a large automotive company and a large
22:28
entertainment company at scale the that there might be
22:31
different use cases, but the problems are pretty similar.
22:34
So we will see a lot of times that there is this reference
22:37
architecture. There are, there are aspects of
22:40
it that are known vendors that they don't want to move.
22:42
There's aspects that are proprietary that they just say
22:45
we want to own this piece ourselves.
22:47
And then they typically have, you know, the the newer things
22:50
that they're looking to solve. And that's, that's speaks to the
22:53
augmenting of existing solutions as well.
22:56
And so we, we like to partner with our, our biggest customers
22:59
to figure out how do we get the solution that you want the, the
23:03
reference architecture as a map to that.
23:05
And you know, we, when we have experience helping one large
23:08
enterprise move in a direction, we can without sharing the
23:12
details of another customer, we can share kind of the learnings
23:15
of where they might consider moving.
23:16
And so I think, I think continuous identity is, is a
23:21
path that you travel and you know, we see iterations of
23:25
identity and there is no, there is no dumb state in identity.
23:30
You know, you don't know what's going to happen in 20 years,
23:32
right? I think 20 years ago, did we
23:34
know that agents were going to be the number one topic and then
23:37
everything was going to be around, well, what's the
23:39
implication for identity? What's the implication of
23:41
security? I think you could have
23:42
hypothetically said that's possible, but until it becomes
23:46
real, you don't truly know what existing solutions are going to
23:50
be durable and and which ones are going to be more brittle.
23:55
You know, Scott. When I think back to what you
23:56
talked about in the beginning of our discussion was reveal
24:00
emphasis on in real time. And when I think about real
24:05
time, I think about authentication.
24:07
We spoke to Andy Handel recently.
24:09
He's the conference chair over at identifiers.
24:11
And we said last year you told us that authentication was done
24:16
right. That was the big statement.
24:18
And do you still believe that? And I, I'm paraphrasing here,
24:23
essentially he said, you know, probably on the human side, it's
24:27
incremental progress from here. But if you think about the two
24:30
big things that are happening, it's non humans and AI and it's
24:36
continuous identity. And then he went on to kind of
24:39
link the importance of the two. And it totally was a light bulb
24:42
moment for me because if you think about non humans, if you
24:46
think about how they authenticate, you can't add MFA.
24:51
You can only go so far and like kind of improving the way those
24:54
things authenticate. But you can use signals and you
24:58
can use kind of like, hey, this thing is non human is doing
25:04
things that's not supposed to be doing.
25:06
And it might be the answer to not only improve human access,
25:11
which is is probably like the where a lot of the incremental
25:14
goes from here beyond like pass keys and things, but also it
25:18
becomes the path to make authentication an important
25:22
event for non humans. What do you think of that?
25:25
Yeah, I think the. Dynamics totally changed with
25:28
with humans creating agents and then even agents spinning up
25:30
other agents. And so and then it's compounded
25:35
a little bit by where do these things exist?
25:36
Do they actually exist on the endpoint?
25:38
Do they exist on on your computer or are they in
25:41
containers? Are they in in the cloud?
25:43
And so I think there's going to be some fundamental rules that
25:48
people create for themselves around who can create an agent.
25:51
Or does an agent have to be attributed down to the user that
25:55
was the origin, even if it was spun up by the second or third
25:58
level agent. And then on the on the
26:01
authentication side, I think it changes the dynamic to leverage
26:05
a lot more of the standards that were, I think interesting, but
26:08
never deployed in production for most companies.
26:12
And so it's things like Spiffy Inspire that allow you to do
26:17
create tokens and do identity chaining where you can
26:21
understand exactly the path that led to an agent being created
26:26
and the and the permissions that go along with that.
26:29
Do they inherit user permissions to agents, inherit other agents?
26:33
Can agents be loaned to other people?
26:35
You know, is it an org structure and they just happen to not be
26:37
human. So there's a lot of these, I
26:39
think conceptual things that, you know, in the next six months
26:42
to 12 months, I think we're going to see real solutions.
26:47
It's fascinating that the a lot of the concepts that that are
26:50
enabling us to actually have a road map that makes sense.
26:54
They've been done, but for whatever reason, they were never
26:58
a priority for the human use case.
27:01
And to, to take that a little bit further, when we started
27:04
talking about the MCP gateway, which every company now seems to
27:08
have an MCP gateway and what we could do for, for agents, we
27:14
that, that really got conversations with some of the
27:16
largest companies in the world. And when they sat down with us
27:19
and, and learned about it, they learned about continuous
27:22
identity because that really is the, the key to, to putting this
27:26
in the right spot where there's no standing access to anything.
27:29
Everything is contextual. But inevitably what the next
27:32
step would be would, would be a different conversation around,
27:35
wait a minute, shouldn't we be doing this for our human users
27:38
as well? So I think we have some catching
27:40
up to do in, in the user identity space.
27:44
And I, I, I believe that that is going even faster because the
27:48
problems that occur in not doing it are very obvious when you
27:52
take the scale and efficiency and persistence of agents you
27:56
mentioned so. Many different and interesting
27:58
use cases there. And you said next three to six
28:01
months these things will get figured out.
28:03
My question and I started to wonder was, well, who figures it
28:07
out? Is it those folks on the
28:09
frontier who are trying to solve this?
28:12
In other words, the customers are figuring out or are you
28:16
saying three to six months down the road you start to see
28:19
solutions that are available on the market?
28:23
Or do you have the opinion of how to want to put words in your
28:27
mouth that it doesn't matter as long as the signals are strong?
28:31
You're finding OK, this agent, whether it's a human or an agent
28:36
or an agent of an agent, doesn't matter, right?
28:39
The signal should be solving the issue.
28:43
Yeah, I mean. I think you will see solutions
28:45
in the market. Look, when I when I sat down, we
28:49
were solving a lot of these problems when I first met the
28:51
the CEO and President of of Crowd Strike in August last year
28:55
and we were sitting around talking about the origin story
28:57
of the companies. It was really amazing to hear
29:01
that, you know, years ago there was a, a similar thought process
29:06
with Crowdstrike building a company that was rethinking how
29:10
an existing industry existed. I felt like we did the same
29:13
thing with, with Signal, rethinking how identity existed.
29:17
And now I think there's an opportunity with the right
29:19
mindset to think about what this means for, for the agentic
29:23
world. And so maybe the best suited to
29:27
solve are the ones that that have that mindset or maybe you
29:32
know, maybe they're large companies that are experiencing
29:35
that problem themselves. But I do think there will be
29:37
solutions in the market in the next 6 to 12 months.
29:41
You know, it's certainly, it certainly speaks to why identity
29:45
and security are so tightly coupled today.
29:47
And I think it just becomes more obvious.
29:49
So I'm I'm excited about what we're going to see in the next 6
29:51
to 12 months and that conversation.
29:53
I would love to have been a family on the wall.
29:55
And I'm sure Jeff feels the same way.
29:57
And the thousands of people listening, I mean, you guys are
30:00
talking about what your origin stories were and I'm sure you're
30:04
talking about what's coming next, right?
30:07
And it's got to be a lot of it's got to be about AI and agents.
30:12
And I actually thought like, OK, I want to ask a question about
30:16
in the AI agent heavy environment, like what is the
30:21
impact of continuous? But I almost think that every
30:26
environment becomes AI agent heavy in the future.
30:30
So this is this is the path. And it seems to me, I mean, just
30:36
as a, as an observer that this kind of concept around signals
30:43
is the only path that kind of makes sense.
30:45
It's kind of like you seen this big shift in the identity market
30:49
away from kind of controls that mimic paper and pencil
30:54
processes. Like we didn't have computers,
30:57
right? Identity governance and
30:59
privileged access management would be on like a paper Ledger.
31:04
But the shift in the industry is now toward real time.
31:08
That's what excites me about it. But anything I said there that
31:13
you want to comment on? Yeah, I think.
31:15
You're exactly right. I think we're realizing that
31:17
when when you when you build products for the problem today,
31:22
you are either intentionally or unintentionally building brittle
31:26
products. And it reminds me also of I grew
31:31
up outside of Boston and there was a project going on the
31:35
entire time I was growing up, and it was called the Big Dig.
31:39
And if you haven't heard of the Big Dig OH.
31:41
Of course we have. So it's, you know, they, they
31:44
and what they realized when it got when it got completed and it
31:47
was, you know, they buried the freeway under Boston and then
31:49
tore down the really ugly green overpass.
31:54
What they realized pretty quickly was that there was still
31:59
a really big traffic problem. And what that and and the reason
32:03
for that is that they designed the new project for the
32:08
population of the city when they designed the project.
32:11
And so I think that's a lot of what's been happening with these
32:15
stopgap solutions and they haven't been thought of as
32:18
future proof. So I think the incumbents who
32:22
have thought about future proofing have thought about
32:24
concept versus just build the fastest thing you can to solve
32:28
the problem that we realized today are going to be in a tough
32:31
spot. And I think companies like
32:32
Crowdstrike, who the origin of the company is thinking about
32:35
how the world should be, not what's the next step in the
32:40
process. I think they're well suited to
32:43
to address a lot of these problems.
32:44
So let's talk. A little bit about Crowdstrike,
32:46
because I think most people are probably familiar with them
32:48
from, you know, device management and point management,
32:51
right. And sort of being sort of on the
32:52
edge of things. How does identity fit into that
32:55
broader strategy of being able to to secure not only devices,
32:59
but maybe the identities that live on those devices?
33:01
Yeah. It's, I mean, it's a
33:03
foundational part, either knowingly or unknowingly.
33:05
I think, you know, security is about identities doing specific
33:11
things, right. So whether that identity is a,
33:15
is an adversary that, you know, is a nation state or a group of
33:19
hacking hackers from Russia, like those are, those have
33:24
identities. And what they're doing is
33:25
they're usually assuming the identity of a, of another user
33:28
to do accomplish some behavior. And so I, I, I think that that
33:34
the behind the scenes has always been a very security's always
33:37
been identity centric. And so the, the realization that
33:42
that these things are just different sides of the same coin
33:46
is, is now becoming obvious. And if, if you pay attention to
33:49
what's happening even in, in large organizations to their org
33:52
structures, you're seeing a lot of, you know, budgets are now
33:55
identity security and there's identity security groups and
33:58
those titles exist. And I think that was like for a
34:01
lot of people, a, a new and interesting thing.
34:04
But these things are so if you think about the purpose of
34:07
identity, it revolves around security.
34:10
And you know, you could get into the religious argument as is it
34:13
all identity or is it all security?
34:14
It doesn't really matter. It's all solving the same
34:16
problems, which is making sure that you know, the right people
34:19
or right identities, whether it's machine or or agent can
34:23
only do the things that they're supposed to.
34:25
And I think the other part is when identities are are being
34:29
run by another identity, making sure that lateral movement is
34:33
something that can be addressed. And those are kind of, you know,
34:36
known problems that just get a lot worse with with the new
34:40
concept of what people are trying to do with with agents.
34:43
So it's only been a. Couple of months since Signal
34:45
joined Crowd Strike, have you had a chance to sort of dig into
34:48
like telemetry data and, and maybe things that maybe he had
34:51
didn't have access to before and start to inform on like where
34:55
are you able to maybe leverage some of those capabilities into
34:58
where things go next for you? You know, amazingly enough, we
35:01
had that level of access pre acquisition.
35:03
And I think that's one of the reasons why we, we love the idea
35:07
of joining forces with Crowdstrike is that, you know,
35:10
we talked a little bit about the Better Together story, but I
35:12
think it really does exist. And I, I've met so many
35:15
different start-ups now that call me and they reach out and
35:18
they say, hey, I would love to get in touch with you now that
35:19
you're part of Crowdstrike. We've already done integration
35:22
with these different systems, whether it be the next Gen.
35:24
SIM or whether it be through getting telemetry data or device
35:29
posture. And so it, it maybe it really
35:32
occurred to me that we already had access to the things we need
35:36
to. And that even was a stronger
35:38
reason for us to have that acquisition conversation.
35:41
Because that is, in my opinion, the right way to see the world
35:44
is focus on the things that you're good at and enable the
35:47
rest of the ecosystem to augment or provide where you might not
35:51
be the, the number one or #2 And so, and ultimately that comes
35:55
down to an intense focus on what the customer wants and the
35:58
solutions that they wanted to let to deliver versus just, we
36:02
want to sell everything to everyone.
36:04
And our, our competitors should never sell anything.
36:06
I think, you know, in a lot of cases, our, our competitors
36:09
coexist, although there's, there's definitely, you know,
36:12
mutual, mutually exclusive technology.
36:15
And, and of course, we like to work with the best customers.
36:19
And like any company, right? Like when you're all in on
36:21
something, you do have some, some benefit of, of the
36:24
connective tissue that goes along with that.
36:27
So, so, yeah, it's, it's been a great, it's been a great three
36:30
months and I haven't, I haven't like uncovered something super
36:34
secret that the world doesn't know about, but I think that's a
36:36
good thing. I think that, you know, there
36:38
there's, it's still, it's still really amazes me that that crowd
36:44
strike has such an intense focus on protecting their customers
36:48
and the, the, the level of talent is, is, is amazing.
36:55
And, and I like this is, this is actually similar to when I
36:58
joined Google. I have no problem uploading all
37:01
of my personal information to things that are managed by
37:04
Google. I have a lot of faith in their
37:06
ability to execute and, and they're one of the biggest
37:08
targets because of that, But I still have that level of, of
37:10
trust. And I think joining Crowd
37:12
Strike, it's really refreshing to have that kind of similar
37:14
experience where I say, you know, in fact, we weren't, we
37:18
were not a Crowd Strike customer.
37:20
Granted we were only, you know, 50 people or so, but it makes me
37:24
think maybe we should have been a Crowd Strike customer you
37:26
mentioned. Just recently here you were
37:28
talking about budgets and how identity and security have sort
37:31
of got intertwined. Look, you're on the Identity
37:34
Center podcast. So we, you know, we're identity
37:35
people. We're also identity security
37:37
people. What is it that you think has
37:39
really kind of shifted the mindset from that budget cycle
37:42
and that budget allocation to say, oh, to do security, we do
37:46
need to tackle identity? Is there something you can point
37:48
back to? Was it like, you know, the many,
37:51
many reports over the last decade that I'll say like 80% of
37:53
breaches are because of identity, you know, or is it
37:55
something else maybe that that I'm just not picking up on?
37:58
Yeah, I mean selling. Selling identity and, and, and
38:00
security is one of those things where when you talk to the
38:03
people that are boots on the ground actually doing the work,
38:05
they're going to want to buy everything because the more
38:07
secure, the better it is. But at the end of the day, I
38:10
think there's a real ROI calculation that comes into
38:13
buying anything and identity or anything in security and with
38:17
the level of breaches and the consequence of a breach, that's
38:21
real dollars. So I don't think that this is
38:23
like all of a sudden everyone wants to just be more secure.
38:25
They're recognizing that there's real evidence in companies that
38:29
have even done the best solutions and, and bought from
38:32
the best vendors where bad things can still happen.
38:35
And that could be internal malicious.
38:38
It could be, I think in the future they'll be some
38:40
interesting AIS that are doing doing funky things.
38:43
So I think the evolution is more just a it's become more obvious
38:48
that this is just tied to the business and it's not just we
38:51
need to be more secure. And so to that end, like, you
38:54
know, you hear things about mythos and, and you know, what
38:58
if code isn't hard in the way that it should be?
39:01
And, and I think the, I think it's amazing technology and, and
39:04
that's all real. But I would also return to like,
39:08
are you really going to have a hacker spending $4 million on
39:12
tokens in order to exploit like, you know, a, a small org org
39:17
structure and e-mail addresses? Like probably not, right.
39:20
So there's a big like prioritization exercise that
39:24
occurs in like, OK, we can do a lot of interesting things, but
39:28
what's the reality? And, and I think that's a, a
39:30
big, big way to look at like both identity and security is,
39:33
is from an ROI perspective. And, and moreover, I think the
39:37
successful companies and crowd strike and signal being one of
39:40
those, we're not just focused on, on revenue generating for
39:45
the sake of growing the company. It's more about the outcome
39:47
based. And and I think that, you know,
39:50
there will be budgets moving from things like the existing
39:55
incumbent industries over into a solution.
39:58
And I hope that that means the customer also saves money in
40:00
addition to having less, less vendors to manage.
40:03
One of the things that. Strikes me about this world that
40:06
we're living now with agentic and, you know, now we're talking
40:10
continuous identity is, you know, there is.
40:12
I think you can brute force the problem when we're working at
40:15
human scale, right? You can always add more
40:17
administrators to provision accounts, deprovision accounts,
40:20
do things like that. Can't really do that in an
40:23
agentic world where you've got, you know, AIS and all sort of,
40:27
you know, workload identities and NHIS that are all spinning
40:30
up and down within a matter of milliseconds.
40:31
So to get ahead of that or even just to keep pace, maybe you you
40:35
do need to invest a certain level of automation.
40:37
Yeah. And, and that's what's happening
40:39
right now. I think they're the dust will
40:41
settle at some point. But right now people are
40:43
throwing everything they can at trying to solve the problems.
40:46
And you feel that I, I think the first place we're all seeing
40:48
that is the first phase of AI adoption is everyone should use
40:54
AI in our company. And you hear about like, you
40:56
know, judging your employees based on how many tokens they
40:58
consume. And you know, that probably is
41:01
not the right way, but it, you know, because it's not really
41:03
efficient. And does that mean that they
41:05
should be using AI to like, you know, ask, ask the most
41:09
expensive model, what time of the day it is 20 times a day,
41:12
like just to waste money and show that they're using tokens.
41:15
But I, I think it will eventually settle back to what
41:18
is the actual efficiency that we're gaining out of it?
41:20
What's the output of an engineer that's using cloud code as an
41:23
example? And so these and so to that
41:26
point, like I, I, I don't think it's going to be agents run
41:30
running around wild. I think it's going to be, but I
41:32
do think that it's going to continue to expand.
41:35
And the more that you connect your agents to data sources and
41:39
internal systems, the more that you really need to get identity
41:43
and security, right? Because if you don't, you're not
41:45
even have any idea what's happening and it will just
41:48
emerge one day and they'll be a, a catastrophic failure of some
41:51
type. You know, I think we're.
41:53
To kind of continue on with what you're saying, I think we're in
41:56
this golden age of AI where, you know, most of us have a $20 pro
42:02
license on all the models and you can ask unlimited questions.
42:07
You can just play with the thing as much as you want.
42:10
The price is still 20 bucks, and it's like, that's almost like
42:13
free. So it's easy to start thinking
42:15
like, hey, the hackers are for free, just going to send out
42:20
millions of emails and they're going to do all these things.
42:23
Or that, you know, you're not going to need any kind of
42:27
software companies because you could just do all these things
42:29
for free with AI. It's like, yeah, well, do you
42:33
really think it's going to be free?
42:35
These companies are going to IPO around a trillion dollars.
42:40
It's not going to be free, right in the long term.
42:42
And I'm not saying they're we're being set up or anything.
42:44
I guess what I'm saying is like we're living in this golden age
42:47
where we get to use these models and we're not paying the value
42:51
of what actually we're doing for most of us anyway.
42:55
I mean, I'm on ChatGPT constantly, right?
42:58
And I'm sure they're not making a ton of money on me with what
43:01
the infrastructure probably cost in the back end.
43:04
Sorry, total, total aside to, but you got me thinking there.
43:09
But I did want to ask, you know, 'cause I always, I've talked to
43:13
a lot of folks who had a crowd strike infrastructure and they
43:17
always thought about it, this pre signal, they always thought
43:20
about it as part of their identity architecture, part of
43:24
their identity solution. So the, the way I wanted to ask
43:28
this question was what did the signal acquisition mean to crowd
43:32
strike? But also what did the crowd
43:35
strike acquisition mean to signal?
43:38
Yeah. It's a great question.
43:40
I think you know, the Crowdstrike was starting to do a
43:43
lot in identity and obviously identity was the underpinning of
43:46
a lot of the security controls. One of the examples that I would
43:50
give that was pretty common is based on on device compliance or
43:57
on telemetry. Crowdstrike already had the
44:00
ability to like brick a machine or to log someone out of Antra,
44:03
right. And so these are, that's a
44:06
valuable piece of functionality because it really does stop the
44:09
lateral movement or the spread of a breach because it actually
44:12
takes whoever sitting in front of that machine at that time,
44:15
they can't do anything at all. But that does get in the way of
44:20
business. And so I think a lot of the
44:22
early use cases that we had were kind of being the scalpel to
44:27
that sledgehammer where you could say if we're detecting
44:31
something specific or if a device changes compliance by a
44:34
specific amount, then what we're going to do is set a policy.
44:38
And those policies can be customized by the customer that
44:41
says remove them from every bit of production infrastructure
44:44
that they have access to and make sure they can't get back
44:46
into it, but leave access to Slack and and e-mail.
44:50
Because we want them to be able to remediate without having to
44:54
take that computer and put it into a, a U PS: box and send it
44:58
back to the office and not be able to work for three days.
45:02
So that that's kind of, you know, the beginning of, of that,
45:05
that Better Together value that our customers were seeing what
45:10
it, what it means for Signal is really exposure to an enormous
45:14
customer base. That is our exact target market.
45:19
And when I mentioned before that our early customers, we'd have
45:23
to convince that this wasn't magic, that this actually does
45:25
work. It does help to have customers
45:29
telling that story and we were off to a a great start doing
45:32
that. This just adds more validation
45:35
to to what we were building. And I think the customers that
45:39
have trusted crowd strike in the in the past and continue to look
45:43
at this as as an opportunity to gain functionality from an
45:47
existing vendor versus I think a lot of the comparable solutions
45:52
are just other start-ups trying to solve these problems.
45:54
The less so the customers of, you know, of, of Cyber Ark as an
46:01
example, because that's still, you know, it's an older product
46:05
for an older purpose. So I, I don't know that they
46:06
viewed that as the real competition here.
46:09
But you know, like I said, I'll, I'll call it out.
46:12
We do, we do a better job at protecting infrastructure than
46:16
than those Pam providers. And so I think we will see
46:19
natural migration now that we are part of a large public
46:22
company and the credibility that comes along with that with
46:25
customers that are saying, yes, we're actually, we, we would
46:27
prefer to work with Crowdstrike on that.
46:29
Yeah, I. I, I kind of think, I mean, just
46:32
my perspective is that having the Crowdstrike name kind of
46:37
lends some credibility from the standpoint that their customers
46:40
obviously trust them. So they're now going to open the
46:44
door, listen to the story. But I always felt that Signal
46:48
had a strong enough story standing on its own.
46:52
I guess what I'm also wondering is, you know, are there actually
46:57
features or capabilities that Signal brings to the table that
47:01
are actually going to change or impact what would have been the
47:07
signal road map or product strategy?
47:10
Yeah, I, I. Think we're we're following the
47:12
same road map that we were as an independent, but with the the
47:16
advantage of being a larger company.
47:18
So I don't, you know, I don't, I don't think there's much road
47:20
map change there. And, and the question about the
47:23
stand alone, it was the probably the hardest decision of my
47:27
career to decide that we wanted to go ahead and agree to be
47:31
acquired. We did not seek out acquisition.
47:34
We were not looking to be acquired.
47:37
Everyone in the company was so passionate about innovating and
47:40
solving a problem in a new way that you know, it's yes, of
47:44
course businesses are there to, to generate profits and to pay
47:48
back investors and return multiples on their money.
47:51
And that's a consideration. But it was a really hard
47:54
decision. And when we went through and
47:57
learned more about the, the values of Crowdstrike as a
48:00
company, of the technology, the leadership, it became a real
48:05
consideration. I think, you know, we were
48:06
actually pretty surprised that we, we even went down that
48:09
route. And so I, I think that that
48:13
speaks to what, you know, how we view Crowdstrike as a company,
48:17
the values, the technology, the people, the opportunity that we
48:21
were really willing to, you know, take what we thought was
48:25
an amazing trajectory and our investors thought we were on
48:28
amazing trajectory too. And to say, maybe it's better to
48:32
fulfill the promise of what we're trying to achieve with a
48:36
company that has this type of footprint, capabilities, values
48:40
and trajectory as a public company.
48:42
So it was, it was a hard decision, but I can say after
48:46
three months across the board, my team is very happy about
48:49
where we, we landed. And we feel like, you know,
48:52
George, the CEO always talks about when they went public that
48:55
that was the green flag, not the checkered flag.
48:57
He's a, he's a big F1 person. I feel the same about the
49:00
acquisition. It wasn't a, a destination.
49:03
It was really the start to a, a new race.
49:05
And so that's a pretty consistent, it's the consistent
49:09
feedback I received from everyone on the team.
49:11
I love that I. Love that.
49:12
And I, I, I sense that enthusiasm and excitement for
49:17
the future from you. It's not like, hey, we've made
49:20
it and I'm going to just move to the beach and, you know, park my
49:26
butt in a, in a chair or something like that.
49:28
You're personally, I feel like invested in.
49:32
Obviously I don't want to speak for you, but that's what I'm
49:35
hearing. I wanted.
49:38
To ask one more question before we wrap up, you talked a little
49:43
bit earlier about how you were seeing some of your clients
49:46
where they had line items in their budget for identity
49:51
security. And I thought to myself, yeah,
49:54
I've seen that. And you know, the the bigger one
49:56
that I've seen is zero trust where it's like, hey, we've got
49:59
a zero trust budget now we're going to pursue zero trust.
50:03
And it feels to me like this is the epicenter of zero trust.
50:08
And I'm wondering like, do you see the same thing?
50:11
And you talked a little bit about like customers building
50:13
their own architecture and crowd strike is a piece of that.
50:19
It seems to me like signals a a piece of that as well.
50:23
What do you think? Yeah, I, I.
50:25
Definitely, I, I feel like we are a fundamental component to
50:29
yeah, what, what companies see as their architecture and where
50:33
they want to go in, in the future.
50:34
And I, I, again, that's another reason why I think we're so
50:37
tightly aligned with with how crowd strike approaches
50:41
approaches their, their customers and the value that
50:43
they provide to them. You know, I, I.
50:44
Also just wanted to say one other thing, which is I think
50:49
zero trust gets the knock that it's just another buzz term.
50:53
Like, hey, our product now is 100% more zero trust.
50:56
And I get that because the terminology gets abused.
51:00
It's kind of like identity security, honestly.
51:03
It's like, hey, we're now an identity security.
51:05
Probably it's like what last year you weren't, it's just an
51:08
industry buzz term, but it does have a real meaning behind it.
51:12
And I think zero trust is probably one of the most
51:16
important cybersecurity architectural frameworks or
51:20
approaches that we've come up with.
51:23
So even though it's kind of like fun to, to poke at, I think it's
51:27
a real thing. Yeah, it's.
51:29
It's a real thing. I think the reason it's fun to
51:31
poke at is like any like I I said earlier with the not enough
51:36
nouns in in identity. When you say something like zero
51:39
trust and all of a sudden there is budget in an enterprise
51:41
that's under a zero trust moniker, every start up and
51:45
every vendor on the planet all all of a sudden now has a zero
51:48
trust solution. And so it, in addition to being
51:51
accurate, it also creates, unfortunately a lot of noise in
51:54
the market. You know, start-ups is
51:58
specifically are very scrappy. So when they hear there's a
52:00
budget and they can, they can kind of put a name to what their
52:04
product is. And, and you're seeing this with
52:06
AI now, right? People are like, even if they're
52:08
not an AI native company, it's, it's always AI.
52:11
And so I, I, I agree with you that zero trust is a huge or 0
52:15
standing privilege is a huge component of, of the industry.
52:19
I think we need to be careful about, you know, making sure we,
52:23
we, we test the, the vendors to make sure that they actually
52:25
fall in the category versus just something to align to a budget.
52:29
I'm looking forward. To you know, RSA next year or
52:32
some other big conference where every vendor is the zero trust
52:36
agentic identity, you know, blockchain based cloud security
52:40
multi guard solution. Well, I mean.
52:43
Identity will come up. Yeah, Ideniverse will be.
52:45
I'll be curious because typically Ideniverse tends to be
52:49
mostly practitioners and a real identity folks.
52:52
And so it'll be, I'm curious who's trying to pitch the
52:57
primarily AI angle versus, you know, solutions based outcomes,
53:02
you know, I've seen. A ton of AI and agentic security
53:05
products, right? They've existed for a while and
53:08
now on their website they've got some for some form of agentic
53:12
security, you know, included. Does that frustrate you when you
53:16
see like all that out there maybe and it's not even really
53:19
about the product itself, right? It's the OR the capability, it's
53:23
the marketing term. Does that get in the way of
53:25
actually trying to solve the problem?
53:27
It doesn't. I think it would frustrate me if
53:29
I was a, a buyer looking for a solution because I'd be like,
53:32
you know, going up to booths at conferences saying, well, what
53:35
do you actually do? Like, because you all have the
53:37
same words everywhere. I think the advantage of being
53:40
part of a larger company is, is it's not frustrating because we
53:43
can talk about outcomes and then the, the, the, how you achieve
53:47
the outcome is the question and being very clear with, you know,
53:51
the things that you solve versus the things that might be more
53:54
applicable for, you know, for other vendors to supply.
53:58
So I think it's around clarity. You've been very generous.
54:00
With your time, but this is Identity Center.
54:03
We always like to end shows on a lighter note.
54:05
We were kind of getting to know each other yesterday when we're
54:07
kind of prepping for this and kind of getting In Sync.
54:09
And you mentioned that you get into skiing as something you do
54:12
on in your copious amounts of free time, which I'm sure you
54:15
have. You mentioned taking helicopters
54:20
though, to ski. I've never been skiing at all in
54:23
any form or snowboarding for that matter.
54:26
So the idea of taking a helicopter, I'm guessing up a
54:30
mountain. Are you jumping out of
54:31
helicopters, you know, with skis?
54:33
Are you, you know, a a daredevil, you know, kind of
54:36
person when it comes to that? Explain more like what is when
54:39
you talked about taking helicopters and going skiing?
54:41
Yeah. And it, and it's not something I
54:43
do often, I would not suggest it's people that aren't, you
54:46
know, avid skiers or and I remember the last time, the last
54:50
run I took, I was standing next to another guy and I said, so
54:53
you do this every year. And he said, yeah, I do it every
54:55
year. And I said, it doesn't seem like
54:56
it's that dangerous. And he said, are you kidding?
54:58
This is one of the most dangerous things you can do.
55:00
I and I had a little bit of a reflection.
55:03
So I think, you know, being a little bit ignorant to how how
55:07
dangerous it is to even just get into a helicopter, nonetheless
55:10
get dropped off. And no, I don't jump out of a
55:12
helicopter, but they, they, they give you about 15 seconds to
55:16
unload and then another 15 seconds to get back in when
55:19
you're at the bottom. I don't consider myself a a
55:22
daredevil, although I guess, I guess if you look at the things
55:27
that interest me, maybe they would be in that category.
55:30
Look for me like I'm thinking, and this sounds strange, but I
55:34
think about identity like almost all the time I think about
55:36
security, I think about work, think about solving problems and
55:38
what's broken. And for me, like the getting out
55:44
of a helicopter, getting off a ski lift, it's it's kind of
55:46
similar. You're focused on one thing and
55:49
whether that's not dying or whether it's just having fun and
55:51
being in the moment, it's all the same because it means you're
55:54
not thinking about the things that occupy your brain most of
55:56
the time. And so I think that's maybe why
55:59
I choose activities and things to do that I can be.
56:02
I have no choice but to be 100% present.
56:05
It's a, you know, it's forced on me because if I start to get
56:08
distracted, maybe bad things can happen.
56:10
Well, you're you're. Definitely amongst your people,
56:12
right? We eat and sleep and breathe
56:13
identity all the time as well since we do this on nights and
56:15
weekends. I love the idea of thinking
56:18
about not dying, right, and being, you know, focused on the
56:23
mission, right, get down the hill safely or whatever it may
56:26
be. I mean, it's I, I was going to
56:29
ask, like, what do you think about when you're skiing?
56:30
Is it technique? Are you solving problems while
56:33
you're going down the slope? Is it just you're rocking out
56:36
to, you know, the, the soundtrack?
56:37
Like tell me, you know, take me inside the mask or the helmet or
56:43
whatever it is that you're wearing and it kind of put me in
56:44
your shoes. I do wear a helmet.
56:46
Some people do listen to music. I do not.
56:48
I actually love the sound of, of the snow of carving turns.
56:52
I like the sound of my own breath.
56:53
I, I and I like being in that in the moment.
56:56
So what I'm generally thinking about is, yeah, it's, it's
57:02
everything that involves what's actually happening at that time.
57:05
And so, you know, you can only think two or three turns ahead,
57:08
but you have to watch out if there's a tree or a Cliff and
57:10
make sure you're not going off of it.
57:13
The, the technique and the turns, you know, absolutely.
57:16
It's, it's in, in, in grooming runs, it's going to be like the
57:20
nuance of how you carve and the actual ski and, and you're, when
57:23
you're in the Backcountry, it's more you're, you're a lot more
57:27
focused on, on not going to the dangerous places and falling in
57:31
tree wells and things like that. But there's nothing more fun
57:34
than kind of just being alone in nature and drifting down the
57:38
mountain. I love that it's not a
57:40
competitive sport if you're doing it recreationally, it's
57:45
it's just something that you're enjoying yourself.
57:47
And you know, people that I ski with talk about, oh, I need to
57:51
improve here, I need to do this or can I, how do I get better at
57:55
car? And, and I always say to them,
57:57
look, this is skiing is not a competition.
57:59
It's one of those things where it's personal and it's about
58:03
enjoying yourself and being in the moment.
58:06
So there is no, in my mind, there's no difference between a
58:09
good skier and a bad skier other than maybe if you're a little
58:11
bit more skilled, you have the ability to to get out of your
58:14
head more and just be in that in that flow moment.
58:17
Yeah, you were. Talking about like jumping off
58:19
of cliffs when we found out that you're an avid skier, here's the
58:24
way I always looked at it. It's like I'm not even a good
58:26
enough skier to do this right. I think you have to be like a an
58:31
excellent skier, but then there's still things that could
58:35
kill. Probably shouldn't put it that
58:37
way, but like just think of an avalanche or something, right?
58:41
That doesn't matter how good of a skier you are, if avalanche
58:44
comes, you're toast, right? Well, I think you.
58:47
Know there there's preparation. So if you know what to do in
58:50
that situation, you should increase your odds of something
58:53
bad not happening. Also, like, you know, there's
58:57
usually guides with you when you're in those situations and
58:59
generally they're going before you, which means that they make
59:02
sure that you're trained because they're the ones that are going
59:04
to likely be the person that gets buried and you're going to
59:07
have to dig them out. And to be clear, I don't jump
59:09
off cliffs. It's it that does not interest
59:12
me. It's that terrifies me.
59:13
But you even with that, you do encounter spots where you just
59:18
end up, you know, having to kind of navigate off of one or two.
59:22
But but yeah, it's it's it's AII recommend that everyone find
59:28
something if you don't already have it, that that kind of gets
59:32
you into the moment and you don't have to think about about
59:36
death or avalanches. And hopefully you never
59:38
encounter any of that. I will share that I've, I've
59:41
only experienced 1 avalanche and it was a long time ago in high
59:44
school on, on Mount Washington and New Hampshire.
59:48
And it was at Tuckerman's Ravine, if you know where that
59:50
is. And there's often avalanches and
59:53
there's people sitting on the rocks ready to run up and dig
59:55
people out. And the closest that I've come
59:59
is is my brother who was next to me got kind of buried up to his
1:00:02
waist in an avalanche. And it was amazing to me how
1:00:04
hard it was to dig him out because that snow is so heavy.
1:00:07
And so if that's not enough to, to scare me into not wanting to
1:00:10
be a part of an avalanche, I don't know what is.
1:00:12
Because it would be absolutely terrifying to be trapped under
1:00:15
heavy snow and not knowing if you're going to, you know, be
1:00:19
lucky enough to have someone. Find you with a shovel?
1:00:21
Well, as someone who? Hasn't skied.
1:00:23
I was thinking, oh, this sounds pretty pleasant and then you had
1:00:25
to go and tell that story and you know what now I'm back to I
1:00:28
think the closest I'll get will be, you know, the video game SSX
1:00:30
on PlayStation a while back and snow and snowboard down a
1:00:34
virtual type of environment. Well, and Jeff, thanks.
1:00:36
For scaring me out of. That No, I'll, I'll.
1:00:38
Tell you you should try to ski because it is fun and when
1:00:40
you're on a ski hill it's set up for safety and you're not going
1:00:44
to encounter these dangerous things.
1:00:45
There's, you know, a lot of people whose full time jobs are
1:00:48
to make sure that everyone's safe and having a good time, all
1:00:51
right. I'll give it a shot.
1:00:52
I'll try anything once. So I appreciate that you've been
1:00:55
great and, you know, with your time and sharing all this out
1:00:58
with us and kind of getting to know you.
1:00:59
So we're going to let you get on with your evening and enjoy it.
1:01:03
Thank you so much for being part of the podcast.
1:01:05
And we'll have links in our show notes for people to check out.
1:01:07
So you can go to crowdstrike.com more and more about all the cool
1:01:10
stuff that Scott and his team are working on.
1:01:12
We'll have your LinkedIn connection information as well
1:01:14
in our show notes that people want to reach out, ask
1:01:16
questions, maybe share, you know, scheme tips, whatever it
1:01:19
might be. And, but we just appreciate
1:01:21
that. And thank you again for for
1:01:22
sponsoring the podcast means a lot to us, helps us do this on
1:01:25
nights and weekends and, and everything in between, you know,
1:01:28
outside of our day jobs and things like that.
1:01:29
So definitely appreciate it. We'll go ahead and wrap it up
1:01:32
for this week. Thanks everyone for watching and
1:01:35
or listening and we'll talk with you on the next one.
1:01:39
You've been. Listening to Identity at the
1:01:42
Center? We hope you've enjoyed the show.
1:01:45
Make sure to like, rate and review, and we'll be back soon.
1:01:49
But in the meantime, hit the website at
1:01:51
identity@thecenter.com. See you next time on Identity at
1:01:58
the Center.