Latest / Identity at the Center / #269 - IDAC Sponsor Spotlight - Zilla Security

Transcript

#269 - IDAC Sponsor Spotlight - Zilla Security · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:24
Hey, Jim. Hey, Jeff, how are you?
0:26
Oh, not so bad yourself. I'm doing great, man.
0:29
I feel like we have a real treat here today.
0:32
I think identity at the center is the the home of the identity
0:36
legends. We've got another identity
0:38
legend with us here today. This man, you look at his
0:41
LinkedIn profile, it's like, it's like if Tom Brady had a
0:46
LinkedIn profile. Now, I know maybe I'm overhyping
0:49
it a little bit, but he's also from Boston, so I figured, you
0:52
know, there's a little bit of a connection there.
0:54
But I mean, I don't want to give away all the details, right?
0:57
That's what the show's for. But I mean, this is going to be
1:01
a fantastic episode. I mean, it's in the show title,
1:03
so at this point you really can't spoil it.
1:04
But yeah, we, we definitely have a great get today.
1:07
So we like to say the business we've got another sponsor
1:10
Spotlight episode for those aren't aware these are special
1:13
episodes that we create with our sponsors.
1:15
It's something we do in collaboration, gives us more of
1:18
an opportunity to kind of deep dive into special products,
1:21
services, whatever it may be in the industry.
1:23
So kind of gives us you know a little more deeper than we would
1:27
normally go in a in a in a normal episode so fully
1:29
sponsored. Today's sponsor is Zilla
1:32
Security. They are working on making
1:34
identity security simple for all of us.
1:36
And joining us today we do have Deepak Teneja.
1:39
He's ACEO and Co Founder at Zilla Security.
1:42
Welcome to the show, Deepak. Thank you.
1:43
Hi, Jeff. Hi, Jim.
1:45
Great to be here. Thanks for having me on the
1:47
podcast. So Jim mentioned that you're the
1:49
you might be the Tom Brady of I am I don't I that feels like
1:52
that is either good or bad depending on who you might be in
1:55
the world because there's a lot of love and hate for Tom Brady.
1:58
But let's start with your identity background, because it
2:00
is long and illustrious and we'll probably have some
2:02
questions about that along the way.
2:04
But tell us a little bit, how did you get into the world of
2:07
identity and access management? Is it something that you chose
2:10
or did it choose you? Yeah, Well, thanks for the kind
2:12
words first. Yeah.
2:14
And the comparison with Tom Brady, I don't know about that.
2:17
He's not, he's not super popular in Boston these days, but so I
2:22
got started in identity management back in the 80s.
2:26
I was a a developer working on security and authentication and
2:33
directory services before there was a security space.
2:38
So and I found it intriguing. It was the idea that you know
2:46
all of these network services, file services, print services
2:50
and so on. This was the early days of the
2:52
Internet that they were all coming up and the idea that at
2:56
the center of it all was identity was was super
3:01
intriguing to me. And that's that's sort of what
3:03
got me into it. So you've been working on
3:05
identity for let's see 40 some years.
3:08
I feel like Jim and I, you're like 20 years each I there's
3:11
there's a lot of identity. Know how on this on this session
3:14
right now I guess tell us a little bit more about Zilla
3:17
security. You're CEO and a Co founder.
3:20
First of all for people who aren't familiar with Zilla, tell
3:23
us about Zilla and then tell us a little bit about your role.
3:25
What does ACEO and a Co founder do for an identity company?
3:30
Yeah. So let me sort of link up the
3:33
dots there. So you know, as I said, I was
3:36
started out as a developer in the identity, security, identity
3:40
and security space. But I've been doing startups now
3:44
for for 25 years and this is actually Zilla's actually my
3:47
third identity startup. So starting with a company
3:51
called Nitigrity way back in the early days of the Internet where
3:57
we we actually created the 1st LDAP enabled single sign on
4:02
solution out there and our our products did very well in the
4:06
market. And then Natality was acquired
4:09
by Computer Associates started another identity company called
4:13
Avexa which was perhaps the first first company in the
4:18
identity governance space. So we called it access
4:20
governance back then and this was of course the mid 2000s when
4:25
Compliance was starting to become a big deal and Identity
4:28
compliance was something everyone needed.
4:30
So you know Avexa as well sort of the Avexa products did really
4:38
well in the marketplace. Ultimately we were acquired by
4:40
RSA. So Zilla is a company that my Co
4:46
founder and I started in 2019 realizing that Identity had sort
4:52
of become much more business critical than it was 10/15/20
4:56
years ago. You know, the cloud had made
4:59
Identity the new security perimeter and that that fact
5:03
brought with it this notion of organizations really needing to
5:08
think about identity as as not just in terms of an identity
5:14
provider, not just in terms of establishing the identity of a
5:20
security principal, but also in terms of locking down the access
5:24
that identities had. And so we we, we came up with
5:29
the idea that this is really identity security.
5:33
So while the last 10-15 years in the cloud era has been about
5:37
identity providers, the next 10-15 years are going to be,
5:41
it's going to be about identity security providers, right.
5:44
And in some sense that's the next generation of identity
5:48
governance. So the identity governance and
5:50
administration space was driven by compliance and driven by life
5:55
cycle management of access. But what's changed now with the
6:00
new security parameter is, you know, identity security has
6:04
become a key piece of that of that equation and cloud scale
6:08
demands automation beyond what the last generation of identity
6:13
governance solutions needed to provide.
6:15
So, so a lot has changed and really Zilla, the idea behind
6:19
Zilla is think in terms of locking down the permissions,
6:24
locking down the access that people, machines and AP is have
6:29
to enterprise resources and do that in a way that supports
6:33
security initiatives, compliance initiatives and IT initiatives
6:37
around provisioning, deprovisioning and so on.
6:40
So I'm curious about the name Zilla Security.
6:42
I'm always fascinated by how these names get picked.
6:46
How did the name Zilla Security come to be?
6:48
What's the the genesis behind it?
6:51
Yeah, so there's actually 2 two reasons why we picked that name.
6:55
First, we wanted to be the Godzilla of of the identity
6:58
space and the Godzilla of of identity security.
7:01
Right. So, so that Godzilla got
7:03
shortened to zilla. And 2nd, the word zilla in in
7:09
South Asia means district. So you know we thought it was
7:14
quite appropriate to think about district security, right?
7:19
So it was zilla security. So so we kind of came up with
7:22
that from from 2 angles and and the name was sort of bandied
7:26
around for a while and then it just stuck.
7:29
I don't want to keep bringing up the legend term and maybe we
7:33
won't use Tom Brady, Maybe it's Roger Federer.
7:36
I knew you're a tennis guy, so maybe we'll just use that.
7:39
But to me it was like what really jumped out about that
7:42
was, you know, Nettegrity was one of the biggest people on the
7:47
block. When I had my very first
7:50
project, it was like Nettegrity obliques and I think IBM
7:56
solution was already out at that time, right?
7:58
I mean those are the big like choices in identity and there
8:02
really wasn't much else. I think Sun had something at
8:04
that point already too. So around like O3O4 and then
8:08
Avexa, I mean Avexa was the next big kid on the block was
8:12
Sailpoint, right? And now you're creating a new
8:15
startup that's going to go ahead and compete in that.
8:19
Really, what's a crowded market? That identity governance market
8:22
is kind of crowded and you're going to be competing against
8:25
one of those firms that you know originally or products that you
8:29
originally started up. I guess I'm wondering how does
8:32
Zilla differentiate itself from the others in this space and
8:38
what what's kind of the gap that you're solving?
8:41
What is the gap in the market that you saw, saw and said OK,
8:44
we can come up with a better mouse trap to solve this
8:48
problem. Yeah, that's a really good
8:50
question. You know the space as we as we
8:54
just discussed, identity governance has been around for a
8:57
while, but it's been, it's been you know it was the design
9:02
center was on Prem, it was very professional services centric,
9:07
very the solutions, most solutions in this space are very
9:10
hard to deploy, very hard to use, very hard to integrate with
9:15
with enterprise applications and as I was saying focused mostly
9:21
on compliance and life cycle management, right.
9:24
So in this cloud era, the opportunity we saw was to bring
9:28
security into the mix to add a whole lot of automation.
9:32
So the whole company is focused on innovating in terms of
9:37
automation and we've started, you know, without AI and now
9:42
we're infusing the platform with AI.
9:46
And then finally, you know, making identity governance
9:49
simple, right. It's it's been too hard to
9:52
deploy. It's you know, organization
9:55
stock in terms of an identity journey.
9:58
In fact, the vendors talk about an identity journey, and the
10:02
word journey really is a euphemism for pain, right?
10:05
It shouldn't be a three-year, five year, eight-year journey.
10:08
Yes, you know these solutions and large organizations, there's
10:13
a there's a fair bit of organizational complexity and it
10:17
takes a while to herd the cats and get everyone on the same
10:21
table. But organizations should be
10:23
getting value inside weeks, inside two months, three months,
10:27
six months, right? So our solution was designed
10:32
from day one to be really easy to use, really easy to deploy
10:36
something you know, we think the whole world is going to need.
10:39
Businesses of all size are going to need an identity security
10:43
solution just like businesses of all size need identity providers
10:46
today, right. That identity is the security
10:50
perimeter. If you don't lock down that
10:51
perimeter in terms of access, if you if you don't have your
10:56
privilege controls in place across the enterprise, you know
11:00
you're you're asking, you're asking for a breach and and
11:02
that's what's playing out out there.
11:04
If you look at all the data breaches happening across the
11:07
world, they're all rooted in identity and access exposures of
11:10
some kind or another, right. So so how does how does how do
11:15
all these organizations of different sizes truly go off and
11:19
deploy a a solution that can lock down the perimeter, lock
11:23
down the perimeter and at the same time you know serve the
11:27
compliance needs, serve the IT needs around joiners, movers,
11:33
levers. You know there's identity is
11:37
this holistic is now this holistic layer that has to get
11:41
deployed properly across the organization and identity
11:45
providers are a key piece of that.
11:47
We see ourselves being the identity security provider
11:50
that's going to step out of the mix and complement the identity
11:54
providers out there. Deepak, you threw a lot of good
11:57
brick crumbs out there. We'll get to all of those.
12:00
But before we go down that route, I want to bring you back
12:04
because one of the things, OK, you've got this crowded market
12:08
and I'm wondering what your approach was.
12:11
It's not like you went and acquired some company that had a
12:15
customer list, right, and that you're just basically building
12:18
from there. So my question to you is what's
12:22
kind of what was your approach to the market?
12:24
Did you go for the, you know, are you focused on the Fortune
12:28
500 or even bigger organizations?
12:31
Did you start with going after like building a solution for the
12:34
middle market? What was the approach for Zilla
12:37
Security? Yeah.
12:39
So our approach was, you know let's start with the companies
12:43
that care about the cloud the most, right.
12:46
So let's start with cloud centric companies and and over
12:50
time will address the hybrid organizations, right.
12:54
So and and if you if you go back, so we started in 2019 and
13:00
if you go, if you go back and think about where most companies
13:04
have been, the really large companies still have lots of on
13:08
Prem applications but it's these smaller organizations you know
13:11
the mid market, the low end of the enterprise that's almost
13:15
entirely cloud centric today. So that's sort of where we
13:18
started and we said OK let's go to them, let's not take on the
13:22
on Prem mess inside most companies, right.
13:26
Let's provide those cloud centric companies with with
13:30
identity security, with identity governance with the security
13:34
compliance and join a mover lever automation they're looking
13:37
for. But over the last year and a
13:40
half we've been going up market right and so now we're starting
13:44
to go into the hybrid organizations.
13:46
We're starting to support the on Prem environments, the on Prem
13:49
applications and we're starting to tackle the broader needs of
13:53
larger enterprises and and that you know we're still not going
13:57
after the the massive organizations in the world, but
14:01
you know in in 2024 we're going to start heading in that in that
14:06
direction. Yeah, I mean I was introduced to
14:08
Zillow security actually by one of my clients and they started
14:11
showing me around the the platform and you know, I don't
14:15
think you'll have to go after the large mega corporation.
14:20
I think they'll come after you you know they'll find the the
14:24
solution and reach out to you but kind of what you just went
14:29
through there and I think it it's probably obvious to me the
14:32
benefit to the buyer is really like OK you you've everybody's
14:37
trying to be cloud first I shouldn't say everybody but the
14:40
majority of organizations are and I think a lot of that on
14:44
Prem infrastructure for a lot of organizations is things that
14:48
don't translate well to the cloud.
14:50
But if you're kind of taking that to clients that you've
14:55
already kind of solved most of the cloud space, I would imagine
14:59
that's a large part of the the value proposition as you as you
15:04
move through that strategy, would you agree with that?
15:07
Yeah, absolutely. You know the the larger
15:10
organizations have a growing cloud presence.
15:12
They're using infrastructure platforms like AWS, Azure, GCP.
15:17
They're using SAS applications. They still have the on Prem
15:20
infrastructure on Prem data, but what they need is essentially
15:26
identity fabric. Fabric's a popular word these
15:30
days that works across the board, right.
15:33
It doesn't really make sense to have a a solution that just
15:36
works on Prem and a solution that just works in the cloud.
15:39
It's it's identity is a holistic, it needs to be a
15:42
holistic solution. So, so our approach is while our
15:47
you know while we run out of the cloud ourselves is to provide
15:51
ways to to actually integrate seamlessly with with
15:56
applications and infrastructure both in the cloud as well as as
16:00
well as on Prem. And that that integration issue
16:04
actually is perhaps the biggest differentiator we have right.
16:08
We make that, you know the last mile has all has always been a
16:12
huge pain in identity management.
16:14
So we focused very hard on making sure that integrations
16:18
are drop dead easy. You know it doesn't matter
16:21
whether an application has a REST API or not.
16:24
You know, we can integrate with it and we can integrate with it
16:27
so easily that in 5 minutes someone can build a connector to
16:30
an application that's driving, in addition to the simplicity of
16:34
the solution and the automation, that that integration issue is
16:38
driving a lot of our success. So I think that's a perfect
16:41
segue into, I want to ask some questions around the product
16:44
itself. And I think one of the key
16:46
features that I've seen out of it and when I remember I saw it,
16:48
I was like, oh, that's pretty neat, was this idea of
16:52
introducing RPA or robotic process automation into tools
16:56
like this, which is not something that I've seen before
16:58
with, you know, other other players in the market.
17:01
And you've got this thing called Zeus, which one excellent name
17:04
can't go wrong with that Zus, Zilla.
17:06
Universal Sync, I guess for people who aren't familiar with
17:10
what that is, can you talk a little bit more about Zeus and
17:13
how that fits into sort of the master plan for for Zilla?
17:18
Yeah. The challenge for us, you know,
17:21
in the early days was if we're going to provide an identity
17:24
security solution, it has to work with the entire tax
17:28
surface, right? So when we started connecting
17:30
with companies, they said, you know, I've got, I've got
17:34
applications, home grown applications, I've got legacy
17:37
applications, I have applications, lots of
17:39
applications that don't have REST APIs.
17:42
And what all the vendors are talking about is, is REST API
17:46
integrations. We need you to help us with, not
17:49
just with REST APIs, but with all the apps that don't have
17:52
REST APIs, right. So that's where the robotic
17:55
process automation came in, right?
17:57
We spend a lot of time trying to figure out, OK, how do we
18:00
seamlessly and easily extract the accounts and entitlements,
18:05
the granular entitlements, the group memberships, the roles,
18:08
what have you from applications of all kinds, right?
18:12
And infrastructure elements of all kinds.
18:14
And that led us to this idea that the one place where that
18:19
information is always available is in some sort of
18:22
administrative console or administrative user interface
18:26
for that, for that system, right.
18:28
So, and we said, well, since the web has become, you know, the
18:34
common user interface for these applications, if there's a way
18:38
for us to parse HTML and figure out what the most common themes
18:44
are, what the most common approaches are to displaying
18:47
accounts and entitlements and roles and so on, we can actually
18:51
crack the snot. And so we spend a long time
18:53
trying to figure that out and you know, the result is, is
18:58
Zeus, right. So it is, it is, it is very cool
19:03
robotic automation that just works.
19:06
You can, you know, deploy it super easily.
19:09
You can authenticate with with whatever your authentication MFE
19:14
environment is that can bring up, bring up systems, extract
19:19
the data and send it securely over to Zilla.
19:22
And that that helps us deal with all kinds of systems that that
19:27
organizations are struggling with today.
19:30
I'm going to barge. In here because this was what
19:33
was demonstrated to me again by client, someone who was
19:37
responsible for access reviews. And I said, look, can you show
19:40
me what this Zilla tool can actually do?
19:44
And he brought me and he said, yeah, sure.
19:46
So imagine I have this application that I need to do an
19:51
access review of and it's this cloud application.
19:53
And I go in here and Dezilla and it's like within 30 seconds he
19:57
had kind of the campaign defined.
19:59
And then he went out to the app and like, I don't remember
20:03
exactly what it how it worked, but I think there might have
20:07
been like a ribbon bar over the app and they went into user
20:11
management for the. App.
20:13
And then it asked them like highlight the area where the
20:18
users are or usernames are and highlight the area where the
20:22
e-mail addresses are and highlight the area where the
20:25
entitlements are. And then it was like, now it
20:28
just basically created a access review based on, like, you know,
20:35
a business user going in there, not writing a script of like,
20:39
hey, hit this API and and take this Jason file and tear it
20:43
apart. It was like, just go into the
20:45
page and like, draw these squares over the data.
20:49
And it was like, I've never seen anything like that.
20:51
I mean, and Deepak, I know I'm like probably oversimplifying it
20:55
a little bit, but, you know, I think I was more technical than
20:59
this user. And I know I'm not the most
21:01
technical person, but it was like, you know, OK, pretty much
21:05
anybody who knows how to use a computer these days can do that.
21:09
Am I describing it? Well, yeah, you.
21:11
Described it very well and that's what our customers love.
21:15
You know, it's very easy for for for an application owner or or a
21:20
security staff or anyone to just create a web recipe for, for
21:26
bringing data out of out of a system that doesn't have a REST
21:30
API. And it sort of goes back to the,
21:33
you know the idea of automation. It's you know this is automation
21:38
that that enables comprehensive integration across the
21:42
enterprise. But we've we've tried to kind of
21:45
infuse the the product, our solution with with automation
21:49
across the board. Automation to make it easier for
21:52
stakeholders to deploy our solution, automation to to
21:56
enable IT reviewers to make decisions more easily, security
22:02
people to define policies more easily.
22:05
Automation to leverage tools like identity providers or ITSM
22:10
systems or or security operation centers automation to measure
22:15
business outcomes. So you know that's I think
22:18
that's the direction the space is taking it is you know
22:22
organizations have certain outcomes, business outcomes in
22:26
mind and you know they need to get, they need to get to those
22:31
quickly right. So no one has the time to or the
22:35
money to go hire an army of professional services people to
22:40
to do all this work over over three years or five years.
22:43
You know, people want QuickTime to value and they want something
22:47
simple that just gets them there.
22:49
I mean, can you? Ask for a better commercial than
22:51
having like one of your customers talk through like
22:54
yeah, this is how easy it was to set up, right.
22:55
And and and they're talking to a seasoned identity expert.
22:59
You know, Jim, I know you're not saying you're not technical, but
23:02
20 years in identity is nothing to to sneeze at.
23:04
I mean that's that sounds to me like that's you know a CEOs like
23:08
dream, right, is to have advocates from the customer
23:10
standpoint telling others in the space about the product.
23:13
I mean it seems like I remember when I saw that I was like Oh
23:15
yeah, I've never seen anything like that before.
23:18
Like how does that work and does it work and what you know, what
23:22
happens when screens changes and and all things like that.
23:26
I guess I I'm not even sure what the question is here because I
23:29
remember being so fascinated by it.
23:31
And I remember thinking, OK, like a lot of this is based on
23:33
automation that I'm not even sure what the engineering effort
23:37
was to actually develop something like Zeus.
23:40
I mean, how do you, how do you even think about the different
23:43
permutations that might be out there from an automation
23:46
standpoint is OK, we want to, yeah, highlight this area of
23:49
text and this area of entitlements and even navigate
23:52
pages and things like that. I mean, that must have been a
23:54
pretty significant undertaking. I'm thinking from an engineering
23:57
aspect. To pull that together, it was.
23:59
It was, it took us, it's taken us many man years of effort.
24:03
It's it's patent pending and we're still taking it forward.
24:06
So there's there's a lot more we can do with it.
24:11
So it's going to, it's going to continue to evolve but but it
24:14
is, it is a huge differentiator for us and it really makes our
24:17
customers lives easier. So I.
24:19
Don't ask you a a hard question because I think this is top of
24:23
mind for probably people is when they see and hear things like
24:26
this. And I would definitely encourage
24:28
people go to the Zilla website, zillasecurity.com, sign up for
24:31
the demo and watch how this works.
24:32
But what happens if the screen changes?
24:35
Is it easy enough for me to go back and sort of fix the the
24:39
automation or the script or whatever it's running that says
24:42
OK, it used to be called this or maybe the interface changed
24:46
because I'm a SAS provider and you know they like to mess
24:48
around with their interfaces. How do I get around that fact?
24:51
Because I feel like that's the first thing that comes to mind
24:53
and say, OK, well, you know, screen scraping, which is kind
24:56
of people have that nasty reaction to it.
24:59
But you've figured out a way, I think, to make that a little bit
25:02
easier. And I want to give you an
25:03
opportunity to talk about how that might work.
25:05
Yeah. That's a great question.
25:06
So screens do change. Now it turns out that the
25:10
administrative side of of an application doesn't change as
25:15
often as you might think. So people, you know, developers
25:19
try not to muck around in that too too often, but they do
25:22
change occasionally. Now the nice the great thing
25:25
about having a / 100 customers now is when a when an
25:29
applications administrative screen changes it, you know, we
25:34
find out about it, you know immediately, right?
25:37
Cause 'cause just think about that, it's the data collection
25:41
is going to fail and we're going to get pinged and we're, you
25:44
know, the Zilla support site is going to find out instantly that
25:48
something's gone wrong with this particular application and the
25:51
HTM LS changed, right? So, so our engineers would
25:54
overnight will overnight kind of jump on that issue and beef
25:58
typically before a customer even realizes that that a certain
26:01
integration has failed, a Zeus integration has failed, we've
26:04
got, we've got a solution for it, right.
26:06
And that that once, you know, once the solution is in place,
26:09
then it's really easy for the customer to go pull that, pull
26:12
that new recipe in and restart, restart the restart the Zeus,
26:17
the Zeus integration. So it it, you know, it sounds
26:21
like, Oh my God, these things are probably breaking all over
26:24
the place, but they're not. Do they break occasionally, yes.
26:28
But when they break, they can get, they get fixed almost
26:30
immediately as well. I love that.
26:32
Idea of sort of almost crowdsourcing some of the
26:35
information that's out there, but this idea of recipes, you
26:38
mentioned it earlier in our conversation and you just
26:41
brought it back again. So it leads me to believe that
26:43
there is some sort of, I don't know, Rolodex, I don't know what
26:46
the right thing a recipe card holder is.
26:49
If I is that how myself as a client, I would pick that up and
26:53
say, hey, I'm a customer of Zilla and I have this recipe
26:56
that I need to pull down for an application.
26:58
Is that how it works or is there a different way?
26:59
Like, how do I how do I take advantage of that recipe well?
27:04
You actually don't see the recipe.
27:06
So when the integration is built and you might be the one
27:10
building it, you're really building it with the Zilla's
27:14
with Zeus. And so it's in some sense a a
27:20
zilla recipe, right? But it's a Zilla recipe for that
27:23
application. And that recipe gets saved, and
27:27
that recipe gets saved in a way that enables it to be used by
27:32
you, but also potentially used by by other people.
27:36
Not with your data, of course, but but with with their own
27:39
data, their own applications. So I I you know the word recipe
27:43
is sort of the underlying technology tidbit, but it really
27:50
doesn't surface to to a typical customer Deepak I was.
27:55
Asking you questions earlier about how you to market, but I'm
28:00
also wondering like who's your buyer in most organizations
28:03
because you did mention the compliance fees.
28:07
I know that the person that showed it off to me was doing
28:11
the access reviews kind of governance focus.
28:13
So I'm wondering about these different personas within an
28:17
organization that buy and use Zilla.
28:20
So is it like auditors, GRC leaders, identity practitioners,
28:27
or are you selling to Cisos? Like who contact Zilla or who do
28:32
you contact at those orgs? Yeah, so the.
28:34
Economic buyers are the chief security officers, the Csos or
28:40
the CIOs or the heads of IT. But invariably there's, there's
28:44
folks that report into those, those, you know, those leaders
28:49
who become champions of of our product, right.
28:52
So if you think about the compliance driver, it would
28:56
typically be someone on the identity team or someone on the
28:59
GRC side who's responsible for access reviews or responsible
29:03
for segregation of duties. If you think about the security
29:07
team or the security operations team, it'll be someone who's
29:11
who's involved in, you know in nailing down the, the security
29:16
posture for the organization or in in identity threat detection,
29:20
something like that. And then if it's if it's join a
29:25
mover lever management or access request for employees, that's
29:30
probably something that folks in IT will get involved in right.
29:34
So. So you know the thing about
29:36
identity is and the thing about our approach to locking down
29:41
access, locking down permissions is it becomes one holistic
29:45
identity solution that then gets leveraged by different teams in
29:50
the organization. So you know the Identity team
29:53
certainly gets involved, GRC team gets involved, auditors get
29:57
involved, security team gets involved, SEC OPS and of course
30:02
the the folks in IT, you know we we actually leverage popular
30:08
ITSM systems for a lot of our workflow.
30:11
So we've tried not to reinvent the workflow, reinvent workflow
30:16
for our own purposes. So we work very closely with
30:19
systems like ServiceNow and and fresh service and JIRA service
30:23
management and so those teams get involved as well, right.
30:26
So there's a lot of stakeholders which which kind of makes sense
30:30
because Identity is is unique in that it's one area of security
30:34
that touches every aspect of of a of a business, touches so many
30:38
business processes. So the stakeholders across the
30:41
board, right, But the people who actually, you know, become
30:46
champions of our solution are are typically on the identity
30:50
team, the security team or the OR the IT team.
30:54
You brought up an interesting thought for me, which was around
30:59
integrations. And so I know a lot of
31:02
organizations say all right, we're going to, you know here's
31:06
all the requirements or use cases that we have and when it
31:09
comes to integrations to 3rd party applications, those that
31:13
you can provision to or pull data from, you know what is your
31:17
approach to that? Is it that you have a lot of
31:19
name connectors like hey we have a sales force connector and a
31:22
work day connector and these fifty applications or is it more
31:27
of like a standards based or is it really come back to the Zeus
31:32
model or is it a a mix or hybrid of those?
31:37
Yeah. So there's a lot of different
31:38
ways and way in which to integrate with the systems,
31:41
right? So we talked about Zeus, we
31:43
talked about REST APIs, there's some applications, legacy
31:47
applications and so on that that simply have file imports.
31:51
There's no, there's really no other way to get at the data.
31:54
The only way to get at it is to export some sort of report or
31:58
export some sort of a CSVA comma separated file.
32:02
And then sometimes particularly with on Prem systems or on Prem
32:07
applications, you'll find databases that have that have
32:10
permissions in them and of course you use Sequel to get at
32:12
those at those permissions. So.
32:15
So we have a lot of different ways in which we could we could
32:18
bring data out. It really depends on, it depends
32:22
on the application and when you walk into a large organization
32:24
typically they've got so many applications that you use one of
32:29
you know you use 30 REST API integrations, 30 Zeus
32:33
integrations, you know twenty of those integrations you use all
32:36
the different types. And so our approach to that is
32:40
we've got you know over 900 at this point built in
32:43
integrations, they're just part of our platform.
32:46
You can just start to use them immediately, but then you can
32:49
build your own, right, because it's so easy to build your own
32:52
right. And and a lot of our customers
32:56
will just go off and and start, they'll use the built in
33:00
integrations. They'll have 10 apps that 20
33:02
apps that don't have built in integrations.
33:05
They'll go create no code REST API integrations or they'll
33:09
create you know the Zeus integrations we were talking
33:11
about earlier. So what we're trying to do is to
33:14
make that process really, really simple and and build a community
33:18
around it. So over time there's there's
33:21
always a Zilla integration for any application out there,
33:25
right? And if you've got some homegrown
33:27
applications or web portals that only you know about or digital
33:30
through digital transformation, you've built your own apps that
33:34
no one else has, well, you can build your own integrations for
33:36
those as well. I think I I.
33:38
Like that question a lot, Jim, because they think, you know, we
33:40
saw Zeus and they're like, OK, that's pretty cool, but it's not
33:43
the only way, right? I'm looking at the website now
33:45
and you've got API integrations and you can search, right?
33:48
You got file imports and as cool as Zeus is, it's not the only
33:53
way to integrate with an application.
33:54
I just think it seems to be like it's it's sort of that missing
33:58
link, right? We see a lot of vendors in the
33:59
space who have API integrations. We have A and they also
34:02
typically have some sort of file import, but there's really not
34:05
anything in between that. And I think that's where the
34:07
differentiators that I've seen Deepak from you from Zilla, is
34:10
that Zeus offering right to be able to go in and sort of bridge
34:13
that gap in a low code, no code way to really kind of solve that
34:18
that in between issue, I'm probably not as articulate as
34:21
saying it, but it does that resonate with kind of what
34:25
you've been seeing from, from your clients and out there in
34:27
the field? Yeah, that's exactly.
34:28
Right, that's exactly right. They leveraged SU state, which
34:32
makes it easy for them to to bring in the data.
34:35
And as I said, it all kind of comes together in, in the
34:40
context of more and more automation to very quickly get
34:45
to value, you know, QuickTime to value, make it, make it simple,
34:49
make it easy, right. That's that's the idea here.
34:53
So let's talk about. That QuickTime to value because
34:55
I'm always interested in finding out.
34:56
OK, sounds cool. You know I'm a little bit jaded
34:59
when it comes to security tools. Yeah.
35:01
Sounds really neat. Deepak, you know how long does
35:04
this actually take to get set up?
35:05
What do I need to put in place? I guess.
35:07
Can you talk me through? Sort of what does it actually
35:10
take to get this up and running? Can you kind of walk me through
35:13
that? Maybe in a very high level, step
35:14
by step, we've got a. Process.
35:17
We realize that particularly in larger organizations there needs
35:21
to be a deployment methodology that that that's well understood
35:27
and guardrails for for for a deployment like this.
35:30
But you know, the basic steps are very simple.
35:33
You know, you first tell Zilla about your environment, right?
35:37
And that could be as simple as saying, well, we're using Okta
35:41
for single sign on, or we're using Microsoft Azure AD for
35:45
single sign on. And you know, Zilla can pick up
35:49
the apps from from the single sign on solution, but that
35:52
that's perhaps only half the apps you have.
35:55
The others you, you, you tell us about individually or you tell
35:59
us, well we've got this information sitting in a
36:02
database somewhere. We can pull it in from there.
36:04
But the first step is essentially tell us about what's
36:08
out there, what is your environment like?
36:09
And then one by one you start integrating, integrating those
36:14
apps. Now I mentioned the directories
36:16
and single sign on solutions because that in you know that's
36:21
where you you get your your basic notion of identities in
36:25
the environment right. It doesn't tell you about about
36:29
the machines, all the machines you might have or all the APIs
36:32
you might have. But it certain certainly tells
36:34
you about all the users and the workforce and.
36:38
And so as you start to bring all of this together, the system
36:43
starts to now correlate the accounts and entitlements and
36:47
all that granular information it's getting from the various
36:50
applications or infrastructure elements or systems.
36:54
It starts to correlate that to the identities from the
36:57
directory, right? And it starts to create this
37:00
complete picture of of who or what has access to what, right.
37:05
It starts to identify you know what's what's what's third
37:09
party, what's privileged, you know, what's a service account,
37:12
what's an unused account, you know.
37:14
And now that correlated identity and access map of the enterprise
37:19
becomes a foundation for the compliance processes, the
37:23
security processes, the join a mover lever processes, right.
37:27
So that's how the the identity, governance and security features
37:32
that we provide are essentially layered over that that access
37:35
map. So you start.
37:36
Talking about your direct resources and and I now I'm
37:39
going back to the recipe. It's like, OK, you're you're
37:41
collecting your ingredients you've got your process.
37:44
What is the. And here 2 questions.
37:47
What is the fastest time to value that you've seen to get
37:50
something out of Zilla that's usable and the and you know, the
37:53
client or the customer's happy with it?
37:54
And then what's the average time 'cause I know we we all times
37:57
hear stories of like, Oh yeah, I got this deployed in 36 hours,
38:00
like, OK that sounds really neat, but is that realistic?
38:04
Is it more like, you know, from an expectation settings
38:06
standpoint, is it generally around 2 weeks, 4 weeks, six
38:10
weeks? Like what do you typically see
38:11
as like a normal sort of setup? Yeah.
38:14
Typically it's the order of, it's in the order of weeks, but
38:18
there's a lot of variability. And you know, the biggest issue
38:21
often is who really has the knowledge and the credentials to
38:26
set up those integrations right 'cause we don't need much.
38:30
But if you think about a REST API integration, for example,
38:33
we're going to need something to get that going.
38:37
And and often times the person we're working with on the other
38:40
side isn't the one who has access to that, to that data and
38:44
has to get an application, the technical owner of that
38:46
application involved, even if it's just for 30 seconds, right.
38:51
So that's that is often the biggest hurdle in in getting
38:56
going quickly but usually it's of the order of weeks.
38:59
You know in a in a mid sized organization it might be just
39:02
two or three weeks. In a large organization with
39:05
30,000 employees, you know it might be 6 or 8 weeks.
39:09
If you've if there's a organization with 200
39:12
applications, it might take you know three months, but it's it's
39:16
typically in the weeks and or or or a couple of months before
39:21
organizations start to get get real time to value Do you find.
39:25
That there's a particular use case or something that people
39:29
tend to start with when they're implementing Zilla.
39:31
Do they focus on access reviews? Do they focus on kind of
39:34
plumbing, maybe onboarding, offboarding.
39:36
Like what's been the go to for for folks so far?
39:39
Yeah, the. In the early days for us, it was
39:41
access reviews, right, 'cause we, our initial product was had
39:48
a compliance module, was focused on visibility and compliance,
39:52
but all of that has started to change over the last year.
39:55
So now it kind of depends on the organization.
39:57
Some folks will start with just compliance with access reviews
40:01
or segregation of duties. Others will start with
40:04
visibility and security posture. They want to nail down the, the
40:08
security exposures, the access exposures they have from a
40:11
security standpoint and and and we see some organizations that
40:15
are starting now with with you know life cycle management with
40:20
provisioning with access requests so.
40:22
It kind of depends on on the on the company depends on you know
40:26
what, what they're looking for. But I would say that visibility
40:30
is almost always that's kind of a a common denominator across
40:34
the board because everyone's looking for, well, how do I, how
40:38
do I just get to see what I've wrought on my enterprise, right,
40:42
What, Because folks don't even know all of the applications
40:46
that they're using. And so bringing all of that
40:50
information into one place starts to give them that sense
40:53
of, yeah, I've got my arms around this and now I can do
40:55
compliance, I can do security, I can do, you know, life cycle
40:59
management. Deepak, I mean just thinking
41:03
back through your history again. Integrity, one of the original
41:08
web access management platforms, AVECSA, one of the original
41:13
identity, governance and administration platforms.
41:18
Now we're thinking about Zilla's security.
41:20
What's the, what's the next chapter look like within Zilla's
41:23
story? I mean you've got IGA, do you
41:26
continue to just make a more kick butt IGA platform or do you
41:34
go down this converged identity route that's so popular?
41:38
What? What's the next chapter?
41:40
Or a few chapters? Yeah, awesome question.
41:46
You know, I think that Identity security itself, the way we've
41:51
just been talking about it, has a long way to go.
41:55
I think organizations of all sizes are going to need a
41:59
solution like this that's automated, that's simple, that
42:03
just plugs into their environment and works, right.
42:07
And so when we think about the future you know we're we're
42:10
always thinking about how do we make this simpler, how do we
42:13
make it more automated. I think AI is going to is going
42:17
to change is going to make this that you know so much better
42:21
than it is than it is even today.
42:24
I think the other, the other thing to consider, the other
42:27
thing we think about is you know identity has been, hasn't really
42:32
been a core security concern and we've been talking about
42:36
security posture management and identity threat detection and so
42:40
on. But if you go and talk, talk to
42:42
most SEC OPS teams today, they really don't understand identity
42:46
that well. And I think that's going to
42:48
change over the next five years and it's going to change partly
42:52
because solutions like ours will will evolve so that they fit
42:58
right in to the to the whole SoC ecosystem, you know all of the
43:02
tools that that SoC teams are working with.
43:05
So. So I think I think it's all,
43:07
it's really all about more automation and and more
43:12
simplicity and more more sort of security more kind of fitting in
43:18
with the security ecosystem and providing A streamlined solution
43:23
for for identity security, right.
43:25
So the governance, again, I don't, I don't see the
43:28
governance requirements changing dramatically.
43:31
There's always more regulation, but the fundamental requirements
43:35
are probably going to stay the same.
43:37
There's going to be more and more requirements on the
43:39
security side, right? And I think automation, there's
43:43
going to be more and more automation needed.
43:45
And so that's that's what we think about when we think about
43:48
the future. I love the idea.
43:49
Of making things simpler because I think this is something that
43:52
the identity industry and maybe security in other industries as
43:55
well, but identity specifically struggles with very complex tool
43:58
sets and things that are being done to simplify everything from
44:04
the deployment to the usage to the, you know, the the consuming
44:08
of the information coming out of it.
44:10
I love the idea of that. So, you know, I'll definitely
44:13
be, you know, supporting you guys from as far as like, yeah,
44:15
make it easier for people to do this stuff because that's
44:18
probably the biggest complaint that I see from a lot of a lot
44:20
of areas, not just, you know, from the the, the process, the
44:23
technology side of it. But it's great.
44:25
I have this tool. I'm not getting the maximum
44:27
value out of it. It's not easy to use.
44:29
I think it's a common thing that I hear quite a bit.
44:31
So I love the idea of, you know, making identity security
44:33
simpler. If it's simpler, people are
44:35
going to get more value out of it.
44:37
Is that fair? Absolutely.
44:39
You know. It's interesting Gartner says
44:41
that the 50% of IGA deployments are in distress.
44:45
So the legacy solutions just haven't served the industry that
44:49
that well. I mean and you know they were
44:51
fine for an on Prem era. I think here we are in 2024 with
44:57
with you know rapid adoption of cloud systems all around us and
45:01
those solutions just just aren't working.
45:04
You know you mentioned the word converged and I just want to
45:07
comment on that. I think this idea that you know,
45:10
organizations can, can, you know, go down this vendor
45:14
consolidation spree and simply use converge platforms for
45:18
everything is a myth, right? Yes, some things make sense to
45:23
converge, some consolidation makes sense, but but you have to
45:27
think about which features hold together.
45:30
It goes back to you know, there's a natural, a natural way
45:36
about this. There's holistic solutions that
45:39
hang together very well together.
45:41
You know you you, you bring feature sets together when it
45:44
makes sense. Naturally you don't.
45:46
You don't just throw things into a platform and say I've got to
45:49
convert solution. So although there's, you know,
45:53
big vendors are always talking about how their platforms can do
45:56
XYZ and ABCI think most Csos see through that and best of breed
46:03
is still very much alive and kicking.
46:07
It's interesting. I was going to say something
46:09
else, but then you brought up that piece and it made me think
46:12
back to the Integrity was acquired by CA and they also had
46:18
Identity. So they had Site minder,
46:22
identity minder and Governance Minder.
46:25
They're all products and just because you put them under one
46:28
brand name doesn't mean it's an appealing product.
46:32
I mean, it really has to all work together or we're not.
46:35
And I'm not going to ask you to comment on that, but feel free
46:37
to. But the other thing I was going
46:39
to bring up, Jeff was going to steal one line that used to say
46:42
all the time, I haven't heard you say it in a while, but
46:45
around this user experience, nobody teaches anybody how to
46:49
use Amazon. You go into Amazon and you
46:52
figure it out. And why can't identity systems
46:55
be that way? Because if you're going to have
46:57
self-service out there, and I think self-service and
47:00
automation kind of a theme for today, it just makes the whole
47:06
thing work better. You can make your whole identity
47:09
ecosystem work with fewer people and have it be more efficient.
47:15
Customer satisfaction goes up because people can do things
47:19
themselves, get quicker results. So I think this user experience
47:23
pieces not to be looked past you you.
47:26
Described our vision for identity security very well,
47:30
right. People should just be able to go
47:32
up and start using it just like they use Amazon, right.
47:36
That is what that is what folks in IT security and compliance
47:41
want today. Something that is easy to use,
47:44
they can just start working with it.
47:47
So it's a great, that's a great. That's a great point we're not
47:50
going to top. That so we'll start to wrap
47:52
things up. I I love the idea of
47:54
self-service and my cheesy segue from that is tennis and service.
47:59
Get it? Ha ha ha.
48:02
Deepak, we were talking before the show started and you
48:04
mentioned that you're into tennis, you've been playing for
48:07
a long time. One of the things I could do is
48:09
end up kind of on a wider note and I I'd love to talk a little
48:11
bit more about tennis with you. I I'll be honest, I'm a newbie.
48:14
I have no idea what's going on in the world of tennis.
48:17
I don't even think I'm trying to think.
48:19
I don't think I've ever swung A racket.
48:21
I did play racquetball, which is about as close probably as I
48:23
I've gotten to tennis. But tell me about your tennis
48:26
career. Do you have a favorite tennis
48:29
player? Is it a rememberable match or
48:31
something that you've played? Take me into the world of Deepak
48:34
and tennis. Oh, I love tennis.
48:37
I've been playing for a long time.
48:39
I've been playing since I was a little kid.
48:42
It's a lot of fun. It's you know you forget about
48:45
it gets you gets me into the zone you're out there on a
48:48
tennis court and you're hammering away on the on the at
48:52
the balls. So it's it's just it's a great
48:57
hobby memorable matches memorable players that I like.
49:03
You know there's a a kid he's a sensation right now.
49:07
Carlos Alvarez, he is awesome on the on the tennis circuit and I
49:13
remember a match that he played, I think it was last year at
49:16
Wimbledon. Carlos Alvarez beat Novak
49:20
Djokovic. It was a five set match and it's
49:22
one of the best matches I've ever seen so and I've seen quite
49:25
a few. But yeah, it's a great, it's a
49:29
great hobby. I'm not a pickleball fan.
49:33
I know we were chatting about pickleball earlier.
49:36
I think pickleball's probably a fun game as well, Fun sport as
49:40
well, but I think Dennis has has more finesse, so I was gonna.
49:45
I was gonna say, you know, the most challenging question I was
49:48
gonna ask you today was about pickleball.
49:50
I'm gonna come back to that in a second.
49:51
But what is the strongest part of your tennis game?
49:55
The strongest part of my game happens to be my backhand, which
49:59
is unusual. Most most people have a have a
50:02
great forehand. I'm not a great player by the
50:04
way. I'm I'm just a club level
50:05
player. But my backhand is is something
50:09
that I developed when I was a teenager.
50:11
There was this, there was this concrete wall, it wasn't really
50:15
a tennis practice wall or anything.
50:17
It was just a wall in the neighborhood and I'd go hammer
50:20
away on my backhand with a with a ball on that wall.
50:24
And so I I managed to develop a strong a strong backhand.
50:28
I wish I wish my forehand was as good as my backhand but it
50:31
isn't. Can you play with?
50:32
Just backhands. I imagine that's a lot more
50:34
running, no? That.
50:36
That. Yeah, that I I know people who
50:39
do that with their forehand, right?
50:40
They run around their backhand. But somehow I haven't figured
50:45
figured out how to do that with my backhand Jim.
50:48
How are you with tennis? Not a very.
50:51
Good tennis player, but you know when you brought up tennis, I
50:54
started to think about, you know, Serena Williams was the
50:58
guest, one of the guest speakers at Octa Octane 2 years ago.
51:04
And man, what a fantastic person.
51:07
It made me think of the time that, I don't know, she's like
51:11
complained and got loud on the court a few times.
51:15
And then it got me thinking about John McEnroe and how many
51:19
times he's gotten loud on the court.
51:22
And it what I really loved about John McEnroe is like, now he
51:26
totally makes fun of himself, right?
51:27
He he totally uses that as like a comedy tool.
51:31
I think that's fantastic. The other thing that got me
51:34
thinking of is like, I don't. So I don't play much tennis, but
51:39
I've golfed a lot. And what I found was the more I
51:42
golf, the better I got. But the more angry I got.
51:46
If things didn't go the way I wanted to, wanted them to, or if
51:49
I missed a shot, it's just like I would get completely angry.
51:54
So I can totally see how you know a professional tennis
51:57
player can totally lose, lose their cool when something
52:02
doesn't go right or you have. I mean everything is with these
52:06
like high tech cameras now, but before all that existed, if you
52:10
felt the ref got the call wrong, blow a gasket.
52:13
I could see how that could. Happen, Deepak?
52:15
Any tips for For Jim on how to keep calm on the tennis court?
52:20
I don't know, but you're absolutely right about about
52:25
McEnroe. He's perhaps the most I'll
52:27
tempered player ever, right. Who is a?
52:30
Who is a bigger bad boy of tennis, John McEnroe or Andre
52:33
Agassi? I think John McEnroe Agassi was
52:39
was the was a rebel, right? He was.
52:45
He wasn't. I mean, he could, he could lose
52:47
his ghoul as well. But McEnroe was a repeat
52:51
offender many, many, many, many times.
52:54
All right. I wanted to ask you about
52:56
pickleball, and I saved the most controversial question for the
52:59
very end here. Tell me about your thoughts on
53:01
pickleball 'cause I think you kind of alluded to it before,
53:03
but I feel like, you know, in the Asheville area of where I
53:06
live, North Carolina, there is this very, very much a struggle
53:11
between the tennis players and the pickleball players.
53:14
I'm not sure what the struggle is, but I'm hopeful that you can
53:17
demystify it for me. I think pickleball is probably a
53:21
great sport. I've never played.
53:23
I just worry that all the tennis courts in my neighborhood will
53:26
get taken over by pickleball folks so that I don't want.
53:30
So I, you know, but it's a great sport.
53:33
I know it's there's a lot of people who've started playing
53:36
pickleball. There's a mall near not so far
53:40
from my house where they now have an anchor store's been
53:44
replaced by 16 pickleball courts.
53:46
So you know, that sort of thing is probably going to happen in
53:51
in lots of neighborhoods around the country, but where I will
53:55
get word is when when my Dennis cords start disappearing and
53:58
getting replaced by by pickleball courts.
54:01
So that would not be good. So it's really more of a.
54:03
Real estate question at this point, yes.
54:06
OK, let's. I think that's a good spot.
54:08
We can leave it. Deepak, thank you so much for
54:10
taking the time with us. I would definitely encourage
54:12
folks to reach out. We'll have a link in our show
54:15
notes for people to reach out to you on.
54:17
On LinkedIn, we'll have links to Zilla Security, ZILLA
54:21
security.com where people can check out more that you guys are
54:25
working on. There is a very shiny green
54:27
button in the upper right hand of the website Zilla Security
54:30
where you can book a demo. So we talked about kind of
54:32
seeing as believing. I think that would be, you know,
54:35
great for people to go check out and actually see how this works.
54:38
And definitely I think people will be impressed by what they
54:41
see. So I think we've had a great
54:44
show. I always like to leave on a high
54:46
note, so we'll go ahead and wrap it up for this week.
54:50
Again, links in our show notes. Deepak, thank you so much for
54:52
being here. And thanks again for sponsoring
54:54
this episode. You can find Gemini and LinkedIn
54:56
as well. So if you've got feedback about
54:58
this or anything else, feel free to drop it on us and you can
55:01
find us on the web, idacpodcast.com and on Twitter
55:04
or X or whatever it's called when people listen to this at
55:07
IDAC podcast. So with that, thanks everyone
55:10
for listening and we'll talk with you all in the next one.
55:14
You've been listening to Identity at the Center.
55:17
We hope you've enjoyed the show. Make sure to like, rate and
55:21
review and we'll be back soon. But in the meantime, hit the
55:25
website at identity@thecenter.com and find
55:29
us on Twitter at IDAC Podcast. See you next time on Identity at
55:36
the Center.