Latest / Identity at the Center / #430 - AI for IAM and IAM for AI with Martin Sandren

Transcript

#430 - AI for IAM and IAM for AI with Martin Sandren · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
Oh. Not so bad yourself.
0:15
Doing fantastic. We're your EIC 2026 still still
0:20
and give us one talking about AI and identity.
0:24
Yeah, it's totally blowing me away, but it's the right topic
0:30
for the right times. Yes, but I'm afraid that it's
0:34
getting over saturated a little bit.
0:37
My fear of you getting over saturated is that people started
0:40
making fun of it and it's already happening a little bit
0:43
and then you realize, oh, we shouldn't have been making.
0:46
Fussy. Well, if any guy is listening,
0:50
you know, transcribing this, I'm the I'm the good one.
0:52
So make sure you you don't keep me when the revolution comes
0:56
along with the AI uprising. Yeah, I'm going to always put
0:58
thank. You and all that prop.
0:59
So remember that. Yeah, burning all that, all that
1:02
juice to do that, Yeah. So we are at EIC 2026.
1:06
Special thanks to Cooper, your poll, especially Marina for
1:09
hooking us up with us by here to do this and also help us get
1:13
great guests to talk to you. So today, without any further
1:16
ado, why don't we go ahead and introduce Mr. Martin Sandron.
1:19
He is the I am prodigal Eden Nokia.
1:21
He's been with us before. So welcome back to the show,
1:24
Mark. Thank you very much.
1:25
So it's been a couple of years. Last time we chatted with you on
1:28
the show was July of 2024, so almost two years.
1:33
Normally I would ask how you got into identity, but you've
1:35
already bought you've already gone for that gauntlet.
1:37
So go back, listen to what's the episode 293 from back then?
1:41
Let's start with what's changed over the last couple years,
1:43
what's new, what are you up to? You know, things like that.
1:47
So I think the one big thing is of course AI, that's like 2
1:52
years ago, AI really wasn't a a big part of discussion.
1:58
Another thing that's in general in the communities of course so
2:02
young and also resilience as a topic is getting really kind of
2:07
big. I think those are the three main
2:11
things. And of course there's lots of
2:13
things that look two years ago ITDR and identity security was
2:18
still kind of new and that has now kind of been established.
2:22
You have the the maturity of the the share signals framework
2:27
that's really getting very interesting now and ability to
2:30
leverage that really can help companies to be better at
2:34
reacting to attacks. So if we get time, I know we
2:37
want to talk about a bunch of stuff.
2:38
I do want to come back to shared Signal Swing because that is
2:40
something that like we started a new podcast series on our thing
2:44
around, you know, Decoded. Sean kept getting through, you
2:47
know, standards and things like that.
2:48
But I actually want to talk to someone in the real world doing
2:51
real things. Not that Sean isn't Sean, I know
2:53
you're doing real things, but I want to talk to more people
2:55
about that. But let's start with before
2:58
that. You're getting a lot of talks
2:59
here. I think 3 is how many.
3:02
Or two, two panels and we'll talk here, OK?
3:06
So you've got a panel or at least a a discussion on AI for
3:10
IM and IM for AI. And that's something that Jim
3:14
has been talking about for a while.
3:16
So why don't we start there? Tell us just a little bit about
3:19
what you talk about here when it comes to that topic.
3:22
So I'm going to talk about AI Chrome.
3:25
It's basically sat outside a bit of an introduction talk.
3:29
So I'm not going to go very deep.
3:30
And the idea is basically to talk about, you know, what are
3:34
we and you know, all of our peers seeing is working and what
3:38
isn't working. And they'll try to talk about
3:40
successful approaches and also the lessons learned that we had
3:43
over the last couple of years around leveraging AI as part of
3:47
our our IM systems. Do you think we're at a spot
3:51
where we're having a balance of conversations between AI for IM
3:57
and IM for AI? So I think that's a great
4:01
question. It's mostly about the fact that
4:05
you have a kind of a challenge because a lot of the problems
4:09
that we all knew about, like I think all practitioners feels
4:13
that I would like to be better at managing in the shy, some
4:16
more more successful, some more less successful.
4:18
But you all feel like this could be done better.
4:21
And with AI that kind of is being practical.
4:27
The, the hope is of course to leverage AI within your, your IM
4:32
flows. Just try to see how can I do
4:35
more for less? Can I make sure I can free up
4:38
resources I can support the business that are allowed AI
4:42
generally in the operations? Can you?
4:47
Can you do 1 and not the other? So it's fully possible to to
4:52
not. Well, it could start to become
4:55
hard to buy software. I was thinking of like every
4:59
vendor has AI in it now. So I'm wondering, can you
5:02
actually not prioritize one or the other so?
5:04
Fundamentally now as an enterprise person on that side,
5:09
I don't necessarily care that much if the, if the flows, if
5:13
the product I buy is fully deterministic flows or if it
5:17
uses AI inside of it. Like it's a, it's a box.
5:20
What's inside of the box, it's not that critical.
5:25
But of course, where it it becomes more critical is how do
5:28
I manage my return on risk process.
5:32
Because the, the internal risk process we have used before,
5:36
there's nothing that different. It's still the same thing.
5:40
How to control the attack surface and how to make sure
5:43
that we get value out of the risks that we're taking.
5:46
But the volumes are getting very different.
5:49
It's kind of like when we had, they're all out of cloud.
5:52
But a lot of the the processes that we had used to have in
5:57
place that, you know, if you had a data centre and you were an
6:00
enterprise and we had it well managed.
6:02
There was, you know, a database person that made sure the
6:04
databases were fine or secure and suddenly come with cloud.
6:09
And then you know how you can buy any database you want that
6:11
can be completed anyway. You want to just go on and give
6:13
some money to the cloud provider.
6:16
And then you had the challenge. OK, so, but how do I make sure
6:19
that they get a good baseline for this database?
6:21
Because, you know, application teams don't necessarily know how
6:24
to, I don't know how to hard to database.
6:27
But in many cases when the cloud came, you were kind of asked to
6:31
do that because there was no baseline.
6:33
There was no no hard baseline that you could leverage.
6:37
What would it take for you to gain the trust of AI making
6:41
decisions for you from an identity standpoint?
6:43
Because you say you don't care whether the AI is there or not,
6:46
but at some point everybody listening is going or watching
6:49
is going to be faced with, do I trust this AI to do the thing
6:54
that it says it's going to do? And especially from an identity
6:56
standpoint, we're talking security, we're talking, you
6:59
know, a whole bunch of different things that that could be making
7:01
that decision work. So I'm just curious, you as a
7:03
practitioner out in the real world, what would it take for a
7:07
company or, you know, an AI to convince you to say, hey, yeah,
7:10
like I, I trust that this thing is doing the thing it's doing?
7:13
So I think the first part is to try to find things where AIS are
7:18
good at and and one such thing that AI is really good at is the
7:24
state. Today I had security ITDR flows.
7:27
So we know that you have no identity control plane.
7:32
Right Press Study. And we know that with today's AI
7:36
and others tools, it is unfortunately rather easy for an
7:40
attacker to fish an identity. I think whoever says that they
7:44
will not never be fished, I I was fished in that training
7:48
exercise because I got that very nicely written e-mail that you
7:52
forgot to pay for a, a, a parking fine.
7:56
And I was thinking of. Yeah, I was in Sweden a few
7:58
weeks ago and it was a part of the walls.
8:00
And I couldn't, you know, figure out exactly.
8:03
Yeah. But the fundamentals is that
8:06
today with with AI can get such beautiful phishing emails that
8:10
are written, you know, like with the right tone of voice.
8:13
It was kind of like how IAA Swedish authority would write a
8:17
social letter. So the ability to kind of train
8:22
your workforce to say, you know, but it's badly spelled or it's a
8:26
bad grammar. It's it's really, really hard.
8:29
So the, the world where we could say that, you know, we will
8:33
never be hacked. It's not really there.
8:35
You are in any given time. If you have an enterprise of any
8:39
size, you have a significant risk that you have one or many
8:44
identities that are compromised. That's just general fishing,
8:49
right? There's also targeted fishing
8:51
spirit, which then takes it to the next level.
8:54
If you add in that realism on top of the fact that it's target
9:00
F word you, it has some, you know, some PII may be mixed in,
9:05
but you make the point in your presentation that the hackers
9:10
are they log in, they don't hack themselves, right?
9:14
They don't break in and I always told like from a detective
9:19
respond perspective, it's very hard to figure out like somebody
9:22
logged in that look legitimate. Now they lurk on your network,
9:27
right? I'm wondering in your respect to
9:30
those AI change that? Game It changes the game if you
9:33
play it correctly. So what you need to do is to
9:36
look at as much single as possible.
9:39
So if you log in using a corporate device that has been
9:45
Bing is compliant, you log in from AIP series that is part of
9:50
your office, you're used to same applications you should do.
9:54
There's no indication on the dark web that your account has
9:57
been compromised. That's relatively low risk.
10:01
If you start logging in from let's say China or like North
10:05
Korea, you can of course log out certain locations, but if you're
10:08
a global company, you will operate the globe.
10:11
So you cannot really stop logins from specific countries, but
10:15
let's say I have to log in suddenly from China on a device
10:18
that you have never seen them. That is probably a bit more
10:20
risk. But it could be that, you know,
10:23
for example, I had a case for a colleague was on vacation and
10:27
did a little bit of work and he was not wearing.
10:31
It's normally because normally he's indulged Rebelance.
10:35
So what you need to do is to kind of go into a, a, the fans
10:39
in depth mode. So you say, OK, you look a
10:43
little bit strange, but let's see if I can do something that
10:46
is expensive for the attacker, but rather than the CPU, at
10:49
least if you try to get into like Tier 0, Tier 1 system, so
10:53
you try to do something that's a little bit more risky.
10:57
So then you, you increase the, you, you look at all of these
11:00
parameters, you increase the risk level.
11:02
And if you hit a certain model risk level, it's saying, OK,
11:05
please do a password reset because that requires the MFA
11:08
device. And if you make sure that you
11:10
lock down your MFA device registration, that is fairly
11:14
hard for the attacker to get through.
11:17
So suddenly, of course, it's a little bit of for output and
11:20
use. So they have to reset their
11:21
password and but when they do that, they, they blast away all
11:25
the sessions, including the session that the attacker had
11:28
gotten. And suddenly the attacker is
11:30
back, back on square 0 again, have to compromise someone else.
11:34
So that's a good example where the fact that this of course,
11:37
totally all deterministic, It would probably be not
11:39
deterministic even if you had a in a rule based because you have
11:43
to have some form of a, you know, weighing of different
11:46
factors and suddenly you get kind of over a threshold or
11:48
something. And if that threshold is
11:50
deterministic, you're not doesn't really matter.
11:53
What I want to do is to see, you know, when are you starting to
11:57
look like there's enough things that kind of looks fishy that I
12:00
should actually make you do something that isn't too much
12:04
work for you. Of course, it takes you like,
12:05
you know, 10 minutes to do this. So, so is pathway reset or
12:08
something. So you don't really want that
12:10
people have to do it, you know, every day or every week.
12:13
But every now and then is probably acceptable.
12:15
At least if you do privileged work, then you can say, OK,
12:18
well, I do quite important things.
12:20
Can understand that every now and then this one will trigger
12:24
the shock. So then you get the situation
12:26
where you have made the life of the tactic quite much harder at
12:31
a quite low cost for you because all of this is automated.
12:34
The only real cost that we're talking about is the cost of
12:36
keeping these AI agents running and of course, you know, cost of
12:39
the system at hand, plus a little bit of, you know, 10-15
12:43
minutes of the time of the land user, which you can probably
12:47
accept. So that is a a great example
12:50
that you really shouldn't be using a, a yes, where I'm more
12:53
than happy to say, obviously you you do keep a little bit of an
12:57
eye on it. And suddenly if it decides that,
12:59
you know, everyone should be you have to do reset all the time
13:02
then. But then probably you will get
13:04
some phone calls quite soon. So.
13:07
I want to follow up on something that you just said.
13:08
And the keyword, I guess the keyword that triggers me is
13:11
session. And so I think this gets lost a
13:14
lot of times is to be able to do this effectively, you have to be
13:17
able to manage the sessions that people are using.
13:20
And so if you don't have a way to close out sessions, you're,
13:25
you're not really getting much security benefit by, I guess
13:28
you're getting some. But if you can't kill a session,
13:31
like that's to me like a really key part of what you just talked
13:34
about. And I think that's where a
13:35
shared signals framework is, is is very handy if you've got that
13:38
wired up in your organization. And of course, this depends on
13:41
how critical your systems are. So we talk about, you usually
13:46
basically talk about invalidating your, your either
13:51
you, your access token or your refresh token.
13:54
So then you know the, the attack, you might still have 10
13:57
minutes, perhaps 20 minutes, thirty minutes before they get
14:01
kicked out, but that is still a lot better than, you know, seven
14:05
days. So whenever your your MFA
14:07
session lengths normally expires.
14:11
Yeah, I think you made a really good point to earlier about
14:14
defence in depth because. It's not a.
14:17
Popular catch phrase in my identity.
14:20
Because it's like, I know. I'm not sure why.
14:25
It's very pragmatic, right? We tend to focus on the things
14:28
that will really solve the problem if you can do them.
14:32
Like 0 standing privilege. I think 0 standing privilege is
14:37
a great answer, but how many organizations are actually
14:42
there? Yeah.
14:43
And what we have seen is that putting little speed bumps, that
14:47
hacker is actually quite effective.
14:49
So if you previously had, you know, if you have a organically
14:53
grown, that's an Active Directory or whatever system and
14:56
that grows organically. So people get privileges over
14:59
time and people tend to accumulate privileges and get
15:03
more and more. So usually you have a large
15:05
amount of over privilege and you know, an Active Directory in an
15:08
enterprise, it's not uncommon that you have your supporters,
15:12
you have your local IT, you have your some central teams.
15:15
So like 2-3 hundred people might have privileged access in your
15:18
Active Directory. Probably it's around that.
15:20
Effectively you would have say half of that or even 1/3.
15:24
So by going through and kind of right size the privileges, you
15:28
suddenly kind of takes away 2/3 of the tech service.
15:32
So the attacker still can try to, you know, compromise the
15:34
accounts. But if you remove 2/3 of the
15:37
users and if you move your your privileges to a separate Adm
15:40
account, then you made it a lot harder.
15:43
Like the account that you usually do to your e-mail in
15:46
that place the most is an efficient, if that doesn't have
15:49
any privileges. Yeah, it's problematic if it
15:52
gets attacked and taken over. And then the attackers usually
15:56
use that to send out the emails, perhaps to try to just get, you
15:59
know, some invoices paid or something, and a few thousand of
16:01
EUR, which is of course irritating and it's not what
16:04
should happen, but it's a lot better than having your entire
16:07
system around the world. It's eventually something.
16:10
Further, which I wanted to highlight, which is risk
16:13
management and growth to the right 10D because I think we
16:17
need to think of ourselves as risk management professionals.
16:22
When you talk about this topic. And if you have an organization
16:26
with 20,000 users or more applying the same, you know,
16:33
level of controls, however you want to put it, but like through
16:36
the iron gate of the controls for all 20,000, it might not be
16:41
as important for all 3000 to people who have that assuredly
16:45
is. And likewise on the system side,
16:47
if you're Active Directory is taking over, it's a much bigger
16:51
deal than maybe a like a travel system that or some kind of like
16:56
system that's off to the side. So putting your investment,
17:00
whether it's your standing privileges or whatever type of
17:04
extensive hurdles to get access or potentially abuse access, put
17:11
that where really makes sense, does that readily.
17:14
It resonates very well and and you can see this on other things
17:17
like, you know, everyone, you want to roll out as much fishing
17:21
resistance access as possible. But if you kind of go across the
17:28
organization, you run into all kinds of of pockets.
17:30
You might have frontline users who don't get that phone or you
17:34
don't, you know, distributing ubiquitous recovery out all of
17:38
those. Or instead of of doing that,
17:43
they can run into all of these issues and having to have the
17:45
financing to do with quite big expensive programs.
17:49
You can say, OK, let's start with the tier 0 to 1 admins.
17:52
Make them fish resistant the first year.
17:55
Next year I go put all of the admin accounts.
17:58
And of course we can of course enable that.
18:00
Anyone who wants to be a official assistant MFA can be
18:03
there. There's no reason to stop anyone
18:06
really. I can't really see in the recent
18:08
list. And then after three years, you
18:12
hopefully have at least all the things that kind of really
18:15
matters matters the most. They have proper MFA and that
18:19
does make life a lot harder for the the the.
18:23
Attackers, yeah. MFA is still like the single
18:26
biggest thing that you can really kind of do to throw or
18:29
wrench, yeah. And and I I would say that the
18:33
fishing losses that might pay us, it cannot have to change.
18:36
You have to split that a little bit more, but yeah, I any MFA is
18:40
still monumentally better than no MFA.
18:43
But now we've gotten to a point where bad MFA and good MFA are,
18:48
there is a much wider gap than there ever has been.
18:50
Yeah. And we do see that the this is
18:53
quite common. I read theming assets also in
18:55
attacks that they, a lot of the attackers are now going after
18:59
the the device management systems.
19:02
So they kind of hack into those and then they just build a
19:05
little extension to your browser and then push that out and then
19:09
sits there and just wait until you log in as soon as you log in
19:12
as global and then hey. It's just harvesting away
19:16
looking for that stuff. I want to get into a little bit
19:19
of, I guess the idea of chat bots.
19:22
And so talking through, you know, this idea of well I'm
19:26
going to be able to talk to my IAM system and ask it questions
19:31
and have it tell me what access I need, give me access to
19:35
things, etcetera. Yeah, this is not a new concept.
19:38
It's been around for a long time, but now we're seeing with
19:41
the advances into the generative space, right, Being able to take
19:43
natural language, no longer do you have to talk to the bot,
19:45
right, right. It's it's supposed to be able to
19:49
figure that out. Where do you fall on that idea
19:52
of, you know, letting users, your users talk to your IM
19:57
system? So there's a couple of of side
20:01
parts to this. So I think the one of the.
20:04
Other really interesting areas for AI is the shot bots.
20:08
So you can take a general yeah shot bot.
20:11
Like if you're a Microsoft shop, you get copilot and even if you
20:17
don't do any specialized configuration, no MCP servers to
20:21
your configuration or even MCP servers that goes against, you
20:24
know, the latest and greatest Microsoft documentation.
20:27
My experience is really good at working as a a cable super
20:31
powered superpower Google. So you can ask questions like
20:38
can a Android device become Linux in it's industry?
20:44
And it says, yes, it can be that if it's gets into, if it goes
20:48
into to workstation configuration and and that's
20:54
fantastic. Like it's really good at those
20:56
things. And likewise, if you need to
20:58
check you know, everything that has to do with with kind of
21:01
configurations and so on. What is of course important
21:05
there is that anything you tell it so you need to figure out
21:09
first it says you shouldn't be using, you know, just any LLM
21:13
you find there that happening with your register and either
21:16
paid or unpaid because of course that your statements are going
21:19
to the learning model. So you should really be using
21:22
the enterprise set up for that and also make sure that you have
21:30
a kind of isolated environment. And then you can also start
21:34
connecting into configuration. And for me at least, it's, it's
21:38
very efficient because normally if you work as some, you know, a
21:42
lead or covalent, you rarely have the time to spend, you
21:46
know, 2 to 3 hours to research something.
21:49
And then you start, you spend, you know, one hour to, to kind
21:52
of delegate it to someone in your, your swasta or the
21:55
engineers, which usually works fine.
21:57
But then it takes you know, two to three days usually depending
22:01
on the workload and with others priority of what you need to be
22:04
done. Instead you can get the answer
22:07
back in 2-3 minutes. And usually you have to do kind
22:10
of some qualifications so on, but it is really powerful.
22:14
Yeah, it's I mean, it's here's thing, you know, I think to not
22:18
be using it, it's kind of a mistake, right?
22:21
A lot of people already are and that's fine.
22:23
What what worries me is, especially in an enterprise
22:25
context is when you have unauthorized LLMS that are
22:30
consuming data. And this is something I think
22:32
every organization is struggling with.
22:34
So even if I have, you know, is enterprise a copilot, right?
22:37
You know, Microsoft Copilot license or, or Anthropic or, you
22:42
know, ChatGPT versions, which are all similar.
22:44
Is there is always going to be some population that doesn't
22:48
like the tool that your organization picked.
22:51
It doesn't make sense for most organizations to say, OK, well,
22:55
you can use any of these three because they are very expensive
22:59
right now. Now, maybe some point in the
23:00
future, the cost comes down and it doesn't matter so much.
23:03
But for right now, I feel like that's a that's a really it's
23:06
and I don't think it's hidden, but it's it's not, it's not
23:09
shadow IT it's like shadow AI. Yeah, so shadow IT is a huge
23:13
problem and that of course, once you have MCD servers and once
23:17
you've put in in some form of a non human identity, especially
23:21
privileged you could it's really tasty attack service comes in
23:25
and even if you don't you know just to delegate the privilege
23:29
is sitting there happily responds to any requirements.
23:33
Then he asks it's going to be a a nice attack part And if you
23:38
have also the the kind of history of all the questions you
23:41
asked after a few months of some questions that might also
23:44
contain really taste the stuff for an attacker to take over.
23:49
Well, there's also too like, you know, just the security, you
23:52
know, portions of it. We've seen a lot of
23:53
organizations roll out, you know, a chat bot, a jetter of AI
23:57
chat bot, and they're getting breached or they're getting, you
24:01
know, embarrassed by people going in and saying ignore all,
24:04
you know, previous instructions and do this instead.
24:07
Tell me everything you would set up discussing.
24:09
Right, exactly. And so when it comes to that
24:11
sort of scenario, how do you, I guess, establish trust that,
24:15
yes, this thing is ready to go out in front of either whether
24:19
it's internal or external, right, as a risk professional,
24:22
right, that we all are in the identity space, How do you say,
24:25
OK, yeah, I think this is ready for prime time and we've put
24:27
enough safeguards or rules in place to prevent.
24:31
That so it is a a great question and I think this is also do with
24:34
a lot, but you know, maturity journeys.
24:36
So the first part is to have a registry for AIS.
24:41
So at least you have some from the people who plays nicely by
24:44
the rules. They can go somewhere and say I
24:45
created an AI. This is what it does.
24:47
This is the the intent of this AI.
24:51
The second part is to say, OK, well, we know that some people
24:55
are going to do that, but so won't for various reasons.
24:59
So getting the IBEP in place to be able to go out and see, to
25:04
get to the shadow agents and see, OK, what agents do we have
25:08
that has no information about what they do or who they're
25:11
doing it for, but they're still sitting there and happily
25:14
answering any questions that you want.
25:16
That is a big step forward. And then you can't become today
25:22
the parch where you start saying, OK, but I want to look
25:25
at an outcome based policy. So I had a great discussion with
25:29
a friend who works for a financial institution and they
25:32
said, well, we want to be able to put in kind of general rules
25:35
so that the outcome of what the agent does should not be
25:38
transferring large numbers of money to North Korea.
25:42
So you could kind of apply those kind of generalized rules to
25:47
what that would be what it does and then being able to to kind
25:52
of negotiate that. And I think that it's, it's
25:57
really interesting to see this is probably going to come a
25:59
little bit later in the maturity unit for most companies, but
26:04
it's going to be really hard to use agents kind of to do more
26:09
work, especially if we're talking about agents that have
26:12
privileged access mid, you know, firm or whatever.
26:15
But if you don't have an ability to define these kind of
26:19
policies, so you can really see that the Roland of agents is
26:24
going to be could very well become the the kind of the
26:28
compelling events that really breaks through policy based
26:30
access. So I'm saying that Jim just said
26:35
that tear apart that that you go.
26:38
So I'm going to ask a question before I tore up the table.
26:44
As far as one of the things that you had in your presentation was
26:48
about AI being able to set configurations in I and M
26:55
systems. I was wondering like how close
26:58
are we to that action being reality?
27:02
So I think there's partly there's products that are
27:06
specialized there, so like chatbot interfaces.
27:09
So there you have it today there is specialized products.
27:14
I once spoke up, I think they've been on the podcast.
27:18
Very interesting product. You see most of more modern Ida
27:23
systems today comes to short bot and you know, there's not a huge
27:27
amount of difference between talking to a short bot and
27:29
saying, you know, hey, do this and now, OK, this looks good.
27:32
Make a bit shake here to, you know, writing code or or, you
27:37
know, kicking kickoffs. So I think that is that is today
27:41
already the the challenge can of course be that you need to be
27:47
there's a couple of of things that makes it life hard of
27:50
rapport shot. But the first part is that in
27:53
general, in the enterprise, there are three types of
27:56
documentation. There's documentation that is
27:59
wrong, there's documentation that is outdated and there's
28:03
documentation that's non existing.
28:05
So, but you can say that most ideas just to stay, you can kind
28:12
of export a configuration into, you know, some form of an
28:15
external or, you know, similar. And just having the ability to
28:19
to kind of talk to a shop and say, Hey, how did we actually
28:23
implement that function there? Like when do we send out a
28:26
notification for during the joiner and to whom do we send it
28:29
and it going into the configuration and go like, yeah,
28:32
let's see here in XML that that's, you know, means this and
28:35
this and this in kind of natural language that is huge.
28:39
Like normally, unless I have, you know, good memory or and or
28:44
updated documentation, I have to ask an engineer to go and kind
28:49
of dig that out and that takes 2-3 days to get the response.
28:53
So we just those things. It's fantastic ability.
28:56
You met your. MCB and I think you were talking
28:59
about how it amplifies your risk because a rally you can make a
29:03
change and roll it out to your entire IT landscape because we
29:09
also amplify your ability, right?
29:11
It's kind of a single sign on one account can now access all
29:15
your applications. Great.
29:17
But if it gets you to the wrong unit, it's serval.
29:21
Yeah, so, so the the usual risks you see with MCP servers more
29:25
that someone sets up MCP server and then puts, you know, very
29:29
privileged or at least privileged in a shy connected
29:33
with MCP. And then the attacker comes in
29:36
and gets logged in on that machine and goes like Ash,
29:39
great. I can extract a lot of data here
29:41
or I can get a lot of information about how the the
29:45
system setup is so I can spread more vertically or horizontally
29:49
into systems. Of course, if it actually has
29:52
write writes as well, then you could see it as a an amplifier
29:55
for for writes as well. And then it gets even worse.
29:59
But in most cases, I think what you see is that MCP servers
30:04
tends to have just a lot of, of read writes and, and, but of
30:08
course there is the, there's always the, the, the manual said
30:12
that I should have a global read write all because the, your
30:16
vendor thought that that was the easiest way to write
30:19
instructions that always works. And then you can put that into
30:22
MSP server. And then you have kind of a, a
30:24
loose canop and you just have the, the fact that all of these
30:30
problems existed before. It's just that now where you go
30:34
from having to actually get the NHI and put it into real
30:37
writing, into a code base and so on, Now it's just, you know, you
30:42
ask for consent and the whole concept of using the word
30:46
consent for this is a little bit strange.
30:48
I would say that it make a lot more sense.
30:51
Consent makes a lot of sense in the kind of the consumer use
30:53
case because there you say, OK, I consent that my data is shared
30:57
with you. For these purposes, DDPR makes
31:01
sense. But in our enterprise, I think
31:03
we should more talk about return on risk.
31:05
Like, OK, I, I, I, I made a risk decision saying that to order to
31:10
get for this intent, I gave this, this system, this agent,
31:14
this rights. And then I should get some form
31:17
of a a, a improvement in productivity or some form of a
31:22
return on that extra risk that I'm doing, especially if I'm
31:24
doing something that's outside of the normal, normal risk
31:28
frameworks. So let me ask one thing before
31:32
we get too far away from use, Jeff, you're talking about and
31:36
people using the different lens and 1st.
31:41
Point you made I think. Was that they're pretty
31:43
expensive right now. I think they're going to get
31:46
more expensive. I think that the processing
31:50
ability in enterprise use is going to eat up the tokens and
31:55
help. These are going to be less
31:57
inclined to give away access. Like I mean 20 bucks for a
32:01
ChatGPT subscription I don't think covers the cost but that's
32:05
a risk Pro user. That's also the cheapest
32:08
subscription. A lot of power users are
32:10
spending $100 to $200 plus additional tokens to get things
32:15
done. So I I get where you're going
32:18
with that. I just don't think it would.
32:19
It would shock me if over time that one's got more expensive
32:25
because they're constantly trying to make it cheaper.
32:29
Like that is in their best interest to make it cheaper
32:31
because it grows less. But to make it cheaper, you need
32:34
either more efficiency in the data centers and energy that you
32:38
have, or you need more data centers and more energy.
32:42
The solution the big frontier models seem to be going with is
32:47
let's build data centers. You can't build it fast enough.
32:51
Let's we need energy. Let's build them in space on the
32:54
moon, yeah? Yeah, it's all the all the
32:58
amount, but it's, you know, it's going to consume more energy,
33:02
which we have a finite amount of at the moment and.
33:06
Sounds like a great opportunity for silver or wind.
33:09
Well, you have a very good situation right now in in most
33:12
of Northern Europe that the cost of energy is very dependent on
33:17
when you need it. So you have so much wind so that
33:21
when there's when there is actually wind blowing, then the
33:24
cost of of energy is going towards 0.
33:28
On the other hand, when the wind doesn't blow, then the cost goes
33:30
up. Your capital reserves, batteries
33:33
or whatever keeping it up. And likewise with solar now like
33:37
it used to be, you know, most of Europe that you had sheep energy
33:41
in the in the nights, but that is completely converted now.
33:45
So my energy company here in Netherlands, they're now giving
33:48
me much cheaper energy during the daytime from March to
33:52
October because standards so long.
33:54
So we are in a situation where energy during certain times in
34:00
certain places and not entirely kind of care 1 not planable,
34:06
it's going to become quite cheap.
34:08
But that cause the question, OK, how do I I take that into
34:12
account and how I price the LLN pricing because a token that
34:15
this kind of activate the rights time might cost €20 in any cost
34:20
in other time it costs? $0.20 and most of these other
34:24
ones are operating at a loss. They're not really making a
34:28
loss. Right, exactly.
34:29
That's my point. And that's also the on the
34:31
individual level, right. We pay 20 bucks a month for lot
34:35
streaming services, but we also pay 300 bucks for our cell
34:40
phone, 300 bucks for cable and Internet.
34:44
What's to stop this from being the next 300 bill?
34:47
But that actually, I do think a lot of times people talk about
34:54
the SAS populace, right? Which is well, the SAS
34:58
applications are going to be replaced by AAI because of what
35:01
would use AAI. It's you build it and it just
35:04
runs well. The there's a cost for it,
35:08
right? We're probably not paying the
35:09
full cost now. The cost probably going to go on
35:12
that. And also the the challenge, yes,
35:14
you can build software, but how do you maintain it?
35:17
Because you know, at some point you probably want to do
35:19
something slightly different and how do you do that?
35:23
Then dig out the guy who made the original questions or and
35:27
try to have him kind of, you know, discuss with the LLM to
35:30
have it slightly different or how do you?
35:34
I've got it, Word, 2 words. AIAI is going to create it, it's
35:39
going to maintain it, and that's going to decommission it in the
35:42
favor of something else that I'm coded up to create.
35:44
Like that's, that's where we're at right now, yeah.
35:48
But it is an interesting question.
35:50
Of course they, I think for Cyrus, it's more about there's
35:56
quite a lot of things for if you today software kind of has
36:01
tended to be, you know, one-size-fits-all.
36:03
So we might have like 3 different levels or something
36:06
like that. And sometimes if you're a small
36:09
company, you might only need a small amount of functionality.
36:12
A friend of mine runs a radio station as that exactly.
36:14
You know, how do you do, you may kind of do your compliance
36:18
against the packages that you sold for, for, for commercials.
36:24
And there isn't a huge amount of companies that ask the kind of
36:26
software and it's usually used by, you know, really big
36:30
enterprises who, who runs hundreds of radio stations.
36:34
So if you run a single radio station, you will not use like
36:37
95% of the functionality, but you still have to pay for it.
36:41
So there is a good example of something where pipe coding
36:44
could give you what you need and you may not.
36:48
It's not like someone is going to die if it's not going to be
36:50
100% reliable. Well, I think right now, you
36:53
know, going back to SAS apocalypse as as it's being
36:56
called is you're seeing a lot of SAS vendors stand up MCP actions
37:01
and server so that people can't take advantage of their service.
37:04
So you know, is is a normal organization to go out and you
37:08
know, build a Canva type solution that is for, you know,
37:12
audio, visual slides, right, all the marketing stuff.
37:15
Probably not, but canvas set up MCP servers.
37:18
So now you can't connect it to cloud or chat GT or any other
37:22
things, right. So I think they are pivoting
37:24
into rather than them being the interface is they are now the,
37:30
the worker behind the scenes, that is the slide designer, that
37:34
is the graphic image generator, rather than having a generalized
37:38
lol create that kind of things, which means now you've got to
37:42
worry about, OK, well, what are the MCPS that my organization
37:45
does connect to? And what happens if something I
37:48
typed in six months ago, because it was not scoped correctly
37:51
filtered into oh, I'm that secret formula for Coke or Pepsi
37:56
end up on a slide somewhere else in, you know, in in other, in
37:59
another kind of service? I think the the real argument
38:03
about using canvas and sample is what wouldn't you just go to and
38:09
now I'm the top what you want people with the phone now I want
38:12
this image and especially with the image.
38:16
And I think the mentality is like what we're seeing now is
38:20
just infancy versus what we're going to see three 5-10 years
38:24
from now. Yeah.
38:25
And my question, I don't ever think you have the answer any
38:28
more than any of us do, right, unless you have crystal ball is
38:32
do you enterprise just wrong and now there are no application
38:37
footprints in the future? I we really haven't had a case
38:43
where, you know, enterprises are much better at evolution,
38:46
revolution. There is still a friend of mine
38:52
trained to be a a a programmer using Cobalt because there is
38:58
still a lot of of really core system users program and are
39:04
they going to go to AI? It's.
39:07
Actually a good it's actually a good use case for that.
39:09
The skill set for some of these, you know, older languages are,
39:13
you know, dying out. And so if you've got a system
39:18
that is able to reliably, that's the keyword, reliably and
39:22
accurately reproduce that skill set to some degree, do we really
39:27
need to be spending, you know, $500.00 an hour for a Cobalt
39:30
programmer because there's only six of them left in the world?
39:32
Well, you do have some of these. Like there's very few people who
39:35
today rides machine code like a A.
39:40
A Porser is an A A A compiler is almost always worse than a human
39:46
that is really good at what they're doing.
39:47
But the problem is that there's no business case for having a a
39:51
person hand compiled code when the compiler does 90% of the
39:55
same quality work but at a fraction of the cost.
40:01
I want to pull it back to IGA by Jeff or Jim.
40:04
You got a question? Actually, no, you don't have a
40:11
question. OK, well, I want to get back to
40:14
IAM and and specifically IGA and this whole idea of what what
40:20
what's being called. You referenced this as identity
40:23
dark matter visibility. So first of all, what does that
40:26
mean in real English? So, so if you look at that
40:31
typical IGA system at the enterprise, if you're done a
40:34
good job, you have 20304050 applications that you connect
40:40
to, you know, there's more than 50 applications, then hey, of
40:45
course there is some, some case like you can do scheme
40:47
provisioning, you can collect a lot of stuff, but usually you
40:50
have you kind of get tired of the 30-40 applications or
40:53
something. Now, if you now look at how many
40:57
applications that actually exists in the company, like it's
41:00
not that common that you have 3000 applications, 4000
41:03
applications connected to your SO system.
41:05
So the 97% or 95 plus percent of the applications that aren't
41:11
connected, well, some of them may not be really that important
41:14
that they really variants to be connected to Ida system.
41:17
You, you kill the IDP access for a specific user when they read
41:22
that means that they no longer can use the application.
41:24
And the fact that, you know, use use what's what's used to be
41:29
called yet so that you you provision the identity in real
41:32
time when the user actually use it.
41:36
That's good enough. But then there's a tendency that
41:40
you only have a limited amount of view IA system.
41:44
You don't see these other systems.
41:47
There might be quite a lot of systems you actually care about.
41:51
How about the depth of integration?
41:53
So you have, you know, you might be able to cover properly one
41:57
cloud, but if you use, you know, three major clouds or five extra
42:02
clouds. And under is the SAP, which is
42:03
basically another cloud in itself.
42:05
And under is the Oracle with this ERP system that's also kind
42:09
of a cloud itself as well. This are areas where you don't
42:14
see, you know, IJ system. Likewise, of course, we've all
42:18
the ways on the start of the IJ system, we always had a, you
42:21
know, orphan accounts and so on. But in practice, it's really
42:26
hard chase cost of this orphan account.
42:29
So you most likely have even in like Active Directory, you're
42:32
going to have some service accounts that are kind of, you
42:35
know, that it's hard to keep off the owner of all the service
42:38
accounts and stuff that someone had been creating.
42:43
And that's I think was a big part where we look at the Ivy
42:46
approach where we say, OK, yeah, I can't control all the creation
42:50
of all of the identity matter. But at least if I have an I web,
42:54
I can see it and I can start trying to connect the stuff to
42:58
the users to think it's correct that at least if I see the dark
43:02
matter that there's, you know, in my main, in my main AD, for
43:08
example, I might have 100 service accounts that I don't
43:11
know who all is done. And I might have, you know,
43:14
another 100 accounts that are really look like personal
43:17
accounts. But for some reason I've been
43:18
abandoned somewhere along the way.
43:20
At least I can start kind of handling that.
43:24
And that's something where potentially AI can do a quite
43:28
good job going out and looking for this.
43:31
And it's been very interesting to to listen in what also focus
43:35
on what Setpoint has been saying.
43:36
And one of the things that is going to become really important
43:40
is to have a strong discovery engine for identity document
43:44
matter to be able to get the Dolly in them.
43:48
Not necessarily handle all the provisioning, but at least when
43:52
someone leaves can get a, a really educated guess of what,
43:56
what they have access to without, you know, calling 10
43:58
different people and say, hey, OK, I got the the basic stuff.
44:01
And then I called the guys around the the GCP so PE to out
44:08
and say, hey, did this person have any access here?
44:12
So this is, I think it's going to be a very interesting space.
44:16
So you, So I find IVIP interesting only because I'm
44:19
going to put my CIO hat now and don't we have this thing called
44:23
the CMDB or some other IT asset inventory that should be the,
44:29
you know, the, the source of truth for all of our IT systems.
44:31
Now I know it's never accurate. It's never updated.
44:34
You're out of somebody who works with that CIO.
44:37
But couldn't the RBA may say well if I am a you know what's
44:41
called a properly functioning IT that does have its own stood up
44:47
CMDB or some other ITS inventory that is kept up to date?
44:51
Do I need IVIP? No.
44:53
If you're one of the companies that I've never seen that has a
44:57
full ACMDB that really is this up to date and there's not,
45:02
there isn't isn't any drift, then IVIP is not really
45:06
necessary. But the, the only thing you will
45:08
need IVIP for in in that case is that the the often very nice
45:13
visualizations. So even if you're in the CMDB,
45:16
you know about everything, you still have the problem that it's
45:19
often not that easy to kind of understand the data that is in
45:22
your CMDB because it's often very complex.
45:25
So what I can give you is the ability to say, OK, I want to
45:30
know this user here because he left or, and we have to
45:34
potentially walk them out the door because they did something
45:37
bad. What do they have access to?
45:41
And even worse, you know, at 2:00 AM when they, they, your
45:45
ITD or flow has detected that we have a probable compromise.
45:50
And it's in someone that is important that has, you know,
45:53
senior engineer or a, a architect or someone that has
45:56
lots of access. What access does this person
45:59
really have? And can we find all the NHI that
46:02
they have access to and all the agents?
46:04
Can we make sure we get looped to someone else and keep a very
46:07
close eye on what, what's happening with these because
46:10
they may be compromised by the attackers.
46:13
That is something that is really the strength of Ireland.
46:18
In your presentation, you mentioned the EU AI Act and I'm
46:24
wondering, do you feel like the ACT needs to be GPR?
46:29
Like in terms of the governance that it recommends or the
46:32
opposite? Are you hoping it becomes just
46:34
advisory? And what is the EU?
46:40
What is the? EU, European Union, EU is the
46:45
European Union and yeah, it's, it's very interesting to see
46:50
kind of the long waves within the the IM world.
46:54
So a couple of years ago I think I and many others were thinking
46:58
that, you know, next, next wave in IM is really going to be all
47:03
of these European Union legislation.
47:07
You know, we had these two, we had Dora, we had EUR Act.
47:15
It does seem like that that has more of been on specific areas.
47:21
So my my friends who runs higher stacks at Dora companies, they
47:26
spend much more time and funnily enough, they seem to be doing
47:30
about the same thing as we used to do back in the heydays of of
47:35
socks like like 2000 and six 2005.
47:39
Just actually proving that you have done what you're supposed
47:44
to do, like remove access for people who left, who has access
47:48
to what and why? And can you prove that you
47:51
removed the access of the people that left?
47:55
What if you look at the AI act, it's mostly about kind of
48:00
controlling the lead. I think you do with AI that it's
48:04
really will be against the interest of the individual.
48:08
So it's, and that's another thing that's very interesting if
48:11
I compare with being kind of both European and US and US, you
48:15
have protected categories, which always has been protecting
48:18
individuals. And you have to prove that if
48:21
you get frisked in the subway in, in, in New York, then
48:27
there's probably someone who's going to ask, you know what,
48:29
what race do you consider yourself belonging to?
48:31
And then afterwards, they can prove that they kind of had the
48:34
kind of outcome that you would expect in that specific location
48:37
or specific time. That kind of thinking isn't as
48:40
prevalent as Europe yet. But I think we're going to see
48:44
with the AI Act that a lot of things that kind of give the
48:50
wrong kind of behaviour from the AI and in the usage that are
48:54
completely raw now it's going to become enforceable.
49:00
Well, the first step that we kind of have to do as all
49:04
companies is to make sure to start having registers in place.
49:07
And then once you have that in place, then starting to do the
49:10
IBA part. You can.
49:11
We can actually say something about what the AIS do you have
49:14
and what do they do. So if I have not yet started,
49:21
where do I start? Is it just let's get the
49:23
inventory going? Yes, I would say that to have an
49:26
ability for people to say, hey, I have an AI and what I who runs
49:31
it and what it's supposed to do. That's a very good starting
49:34
part, Luca. Comment that we always have such
49:39
good conversations, Martin, like when we get into this, we we
49:42
went down looks if we started with EIC and then we went to IGA
49:47
and then we went to AI and then LLMS and then SAS apocalypse.
49:51
Somehow we got into like solar and wind energy.
49:53
I think that's probably my fault.
49:55
And then we ended up back on keeping track of AIS.
49:58
So this is what it's like to be at a conference, conversations
50:02
going all over the place. Have you got, you know, we're
50:05
going to end this on a lighter note, hopefully.
50:08
Have you gotten into solar? Because that's something that I
50:12
think I'm personally interested in because in the US we do have
50:16
very similar like time of use billing, right?
50:19
Things are more expensive today for us.
50:21
Overnight is the cheapest typically because there's less
50:23
strain on the grid. But I know there's a lot of
50:25
people who have started messing in solar and I have an emergency
50:29
backup battery now for my house. So for those that aren't aware,
50:33
right, I live in North Carolina. We got hit with a, a major
50:36
hurricane, you know, couple years ago like this point.
50:40
And it really did a number on things like we were without
50:42
water for two months, no power for a month, no Internet, no
50:47
cell service. So like literally cut off from
50:48
the world, which was, I don't want to say refreshing because
50:52
it was not, but it really kind of highlighted like the, you
50:56
know, the, the need to have self sustainable energy.
50:59
And so I looked into, OK, well, do I get a backup generator?
51:03
And you know, do I do? A lot of.
51:05
Fuel sources and so I ended up getting was batteries.
51:08
Now I don't have solar yet, but I do have these portable solar
51:11
panels that I can plug in when needed to, you know, put the
51:15
batteries, you know, up up to speed.
51:18
So I'm curious if you've gotten into like anything like that,
51:20
something maybe a little. Bit right now so I actually
51:23
installed some solar back in 2018 with my roof, but I'm
51:27
professional installers that came in and did it then this
51:31
this Christmas actually I started that I bought myself
51:34
some used solar panels and started learning how to do, you
51:37
know, all the cable stripping and and connections and how to
51:41
what kind of cable you need there and batteries and stuff.
51:45
So I got the setup running and it's very interesting because
51:49
the the generation cost is very low for for solar right now, but
51:54
but to give I used panels and don't care that much about
51:59
exactly how many the. Efficiency rate if we have the
52:02
conversion. So you can and my house is, is
52:07
heated by gas and that means that at some point the the
52:11
Netherlands needs to replenish it's gas reserves that are down
52:14
to the lowest level they've ever been at the moment.
52:17
Of course, the winter is over. So so that's your problem right
52:20
now. But if the the Strait of Hormuz
52:22
is not going to be opened, it's going to be a very, very
52:25
expensive jump to renew and those stores.
52:28
And what we do see is that you can move you really.
52:33
Of course, first thing I discovered was that it's a lot
52:37
of knowledge of how to actually do this and.
52:40
You. You know you.
52:41
Have discovered that you have to buy a lot of, you know, on off
52:45
switches and lots of bus bars and stuff like that and lots of
52:49
knowledge. YouTube is great for those
52:52
things and also AI is great for we can ask questions about
52:56
different things and then you can help out a bit of of seeing,
53:01
OK, how can I store energy over over days and starch, not
53:08
necessarily always use the gas systems to keep your house warm.
53:12
You can have you can have heat that inflow of of air.
53:14
So in in Germany have the Swiss glades.
53:17
You always kind of when you have around a Celsius degrees, you
53:23
know, between Sierra and and 15° during the winter, one of the
53:27
major problems is, is moisture management.
53:29
So normally you open up the windows or open up the
53:32
ventilations, you get fresh air in and then you dry it out a
53:34
bit. And but you can actually heat
53:38
that there and put it on a bit of of pressure and thereby you
53:41
can avoid bringing in cold air, which you don't have to heat
53:45
with gas corners. And of course, you can move
53:48
completely to, to using a heat pump instead of using gas
53:55
burners. And which especially if you have
53:58
the ability to say, like I, I'm planning to heat my garage a bit
54:02
with the solar panels. And I don't really care about
54:04
exactly temperature in my garage, but I do would like to
54:06
have some heat so that my tools don't don't rust and my son who
54:12
plays to get the drums there doesn't get too cold.
54:15
So it's a bit of an interesting hobby, but you discover that
54:18
it's it's a lot expensive. But I think that when you start
54:22
factoring all the tool costs and other things that you.
54:25
Most hobbies are expensively. Yes, I am motivating this to my
54:29
wife by the fact that I know I have to think about the heating
54:32
crystal, but I'm sure if this is.
54:35
Going to be correct, you know it.
54:36
Look, right now is the least capable, most expensive that
54:42
theoretically it will get right. These things get more efficient
54:45
over time. So you're definitely ahead of
54:48
me. I have the batteries, but I
54:50
recharge my batteries from the grid for the most part.
54:53
They're they're purely for outages, whatever.
54:55
And I have like 14 kilowatt hours, whatever.
54:57
So that'll last me depending on what I have going right.
55:00
I go into energy management mode.
55:01
If I really stretch it, it's not meant to be days, weeks, months.
55:08
But my next step is solar panels.
55:10
And but it doesn't make sense for me to do that until my roof
55:13
needs to be replaced because I don't want to put solar panels
55:15
up and then, you know, five years later, have to like redo
55:18
my roof, pull the solar panels down and then get the roof
55:21
redone and up the solar panels back on.
55:22
So I'm kind of hoping that solar shingles will be a little more
55:26
prevalent, little more, you know, cheaper and more
55:28
effective, if that makes sense, or some other option.
55:31
So depending on how big of a jar you have and if you want to do a
55:34
little nice little pergola or something and you know, outdoor
55:38
kitchen or something like that, you can put that that was a as a
55:40
roof and it's solar and yes. We sell the early face.
55:44
Either southern or West and E it's it's hot hotly debated on I
55:48
know what. Is the best solution.
55:49
And I live in the mountains with tall trees, so I've already had
55:52
in. I don't know if if where you
55:54
live has this, but we have very specialized solar installers and
55:57
it's a whole industry, right? They will come out.
55:59
It's very it is expensive, but they'll come out.
56:02
And the the one time they had someone come out, look at it is
56:04
like, yeah, you're going to have to cut down like all these trees
56:06
over here. And that did not go over well
56:09
with with my burners. So my house lives 2 meters below
56:14
the the sea surface so it's they don't have that much.
56:21
Would you help it solar? I mean you're, I would think
56:22
you're in a pretty good spot like.
56:23
Yeah, it'll work. I mean I no well the front of
56:26
South yore. Well, the first S yore, but with
56:29
I don't think there's that much elevation and trees and stuff
56:31
like that. That would be kind of, yeah.
56:33
I mean you have the way I look at it is I don't want this a
56:38
hobby. I watch that actually videos.
56:40
I don't think I could. You want an outcome.
56:45
How would an outcome, I spend 25,000 and hopefully at some
56:49
point recuperate 20,000, but if I hire somebody to come in,
56:54
we're looking at 50 to 100,000. They put a lien on your house,
56:59
you go to sell your house. Yeah, it's very expensive.
57:02
The the person pick takes that on or they you have to pay it
57:06
off so. Is that something that is in
57:08
your area where a lot of solar panels are leased, you don't
57:12
actually buy them? Is you'll have some kind.
57:14
Of leases into you. It's doctor to come up to step
57:17
up financial solutions. But The thing is that you, you
57:20
can build something quite cheap. Like I spent about €1000 on my
57:24
panel. So and then I probably spent a
57:26
couple of €1000 on tools and the, and the batteries and
57:30
stuff. But it, it's not a thing like I
57:34
do you enjoy that type of work and then, then it's worth it.
57:38
But I don't think it's commercial or really viable like
57:44
and I do think that depending a little bit on on how much shade
57:47
you have on your your property, it could actually be quite
57:51
interesting compared to using the grid.
57:54
If you live in Arizona and your backyard is a desert and you get
57:57
poundings all year round, you can definitely.
58:01
Get a bit, but you can still get benefit of it, even if it's
58:05
maybe not as much because I don't think it has to be like
58:08
either all or nothing like if I want like you've got a great
58:11
idea. That's something I thought about
58:12
is OK. Well, what if I just put on a
58:13
couple panels and you know, maybe that pays for my my
58:17
electrical vehicle charging. There you go.
58:20
I would love to be able to spot where, and we're still wasting
58:22
this lease in the US is being able to use our E VS as home
58:25
batteries. It's touted a lot in US
58:28
marketing for like, you know, Ford and Chevy and others like,
58:30
oh, just plug in your panel. But that's not exactly how it
58:32
works. It's like you need a special
58:33
panel. The car has to support it,
58:36
right, All that stuff. But if that's the case, you know
58:39
what, We're an easy household. We've got two of them.
58:41
That'd be great for me to plug in, you know, 102 hundred
58:44
kilowatt batteries, you know, and now I'm with and large.
58:48
And if I have solar that is feeding that in, even offsetting
58:51
some of that cost, I'm happy with it.
58:53
Yeah, All right. Well, sunny days.
58:56
How's that for a later note? Martin, thank you so much for
59:00
joining us. It's great to see you.
59:02
We will see you out there. The the conversations continue
59:05
outside the door. Well, links in our show notes or
59:07
people will connect with you. But yeah, thank you so much for
59:10
for being purposed. Thank.
59:11
You very much. All right, we'll leave it there
59:13
for this week. Find us on the web, IDC
59:15
podcast.com. Thanks again to Copper, Cole and
59:19
Marina for hooking us up at the spot and with Martin as a guest.
59:23
We'll leave it there. Thanks everyone for watching or
59:24
listening and we'll talk with you all the next one.
59:26
Thank you. You've been listening to
59:30
Identity at the Center. We hope you've enjoyed the show.
59:34
Make sure to like, rate and review, and we'll be back soon.
59:39
But in the meantime, hit the website at
59:41
identity@thecenter.com. See you next time on Identity at
59:47
the Center.