Latest / Identity at the Center / #382 - Sponsor Spotlight - HYPR

Transcript

#382 - Sponsor Spotlight - HYPR · Identity at the Center

0:10
Welcome to the Identity at Center podcast.
0:11
I'm Jeff, and that's Jim. Hey, Jim.
0:13
Hey, Jeff, how are you? Not so bad yourself.
0:15
Fantastic Authenticate 2025. Here we are.
0:18
We got a great guest to start things off today, so why don't
0:22
we jump right into it? Yeah, we've got a sponsored
0:24
episode today, so we're joined by Bo Yan Simic from Hyper.
0:27
We're going to get to him in a second, but if you find out more
0:30
about what they got going on, you can go to hyper.com/I DAC.
0:34
That's HY pr.com/I DAC and just make it clear, right?
0:39
This is a sponsored episode. We do these from time to time to
0:41
have really smart people come on, tell us about sort of what
0:44
they're doing in the space and learn more about it.
0:45
But yeah, let's jump right into it.
0:47
So welcome to the show, Buen. Thanks for having me guys.
0:50
Yeah, so here we are. Authenticate.
0:51
You got the lovely pass key background, right?
0:53
We sacrificed that for our guests.
0:55
Want to make sure that you look good.
0:56
Tell us a little bit about your background.
0:58
So I think it's the first time we've had an opportunity to
1:00
actually meet and talk. I feel like we've been on phone
1:02
calls probably in the past, but how did you get into the world
1:05
of identity? Did they choose you or did you
1:08
choose? I, you know, I stumbled into it.
1:13
I started out as a software engineer.
1:15
That's why I went to school for and I was a mediocre software
1:18
engineer at best, I would say. But I wrote a piece of software
1:22
once for a large client in Cincinnati, OH, I will not say
1:26
who. And three months later, that
1:28
product got breached. And so that was my first foray
1:31
into cybersecurity. And then once I got into
1:33
cybersecurity, I grew my career there and it progressed well.
1:38
And I was running a security team at a financial institution
1:41
in New York City. And I was like, why is every bad
1:46
thing that happens here due to an identity related thing?
1:49
And so I, I figured, you know, I should jump head first into
1:53
that. So when we had an opportunity to
1:54
start this company, that's, that was my first official foray into
1:59
identity and the vast complexity that it entails.
2:04
And so it's been a amazing journey over the last 10-11
2:07
years and I'm looking forward to sharing it more with you all.
2:10
So for those not familiar with hyper, what is like the 30 to
2:14
62nd elevator pitch when someone says, hey, so hyper, what's that
2:17
about? Yeah.
2:18
Look, we believe that users want fast, consistent and secure
2:23
identity controls, right? Not relevant to what specific
2:26
identity provider they have or whatever else.
2:29
People just want fast, secure, consistent authentication,
2:33
identity verification, baseline security controls that any user
2:37
can understand and implement at scale and rule #1 is it's got to
2:42
work. And so we excel at that.
2:45
And so we typically really focus on complementing our customers
2:49
existing identity investments and solutions to get that best
2:52
in breed set of controls from an identity verification and
2:56
authentication perspective. So that's a good first rule.
2:58
It has to work. That's rule #1 and like, look,
3:02
many people in Identity kind of really learned that lesson way
3:04
too late, where identity it the reason why it's so hard or one
3:07
of the many reasons identity is so hard is because it has to
3:11
work all the time. And if especially the
3:14
authentication system, if it's not working, your customers
3:16
aren't working. And that is such a key component
3:18
to any product, so. Tell me about the name of the
3:21
company. It's suspiciously devoid of
3:23
vowels, so yeah. Lot of lot of consonants.
3:27
And it's not because I'm Eastern European.
3:31
It is because there is a there's a 80s book by Neil Stephenson
3:35
called Stone crash may have heard about it.
3:38
And in that book there is a thing called a hyper card.
3:43
And it's this thing that contains a significant amount of
3:47
knowledge or data information. And I'm a fan of that book.
3:52
My Co founder is a fan of that book.
3:53
So that's how we got here today. That's a cool little Easter egg
3:56
I love, like hiding out. Very cool Easter egg.
3:59
So we're here at Authenticate 2025 and you guys have a booth
4:02
out there. What's been sort of like the
4:04
buzz? Like what's the feeling like?
4:05
What is the sort of, you know, the word on the street so.
4:10
It's interesting, you know everybody, everybody that comes
4:12
to authenticate is laser focused on pass keys which we have here.
4:16
Everybody really wants to understand how do they deploy
4:18
this stuff at scale Every I think for the most part, most
4:22
organizations now are like on the pass key train.
4:25
They're just trying to figure out like, how do I go fast?
4:28
And so many of these companies, to use the train analogy, are
4:31
still kind of like in the, you know, shoveling coal into the
4:34
steam engine type of thing. And they want the bullet train.
4:38
So people are here trying to figure out what is the best way
4:40
to do that and in in a way that's as low risk as possible
4:45
to their careers. And then the second thing is
4:49
agentic AI is, is sweeping a lot of board level conversations
4:53
right now. And so there's a lot of smart
4:57
people here trying to figure out how do we securely authenticate
5:01
these agents and these things and what roles do passkey and
5:04
decentralized credentials play into that?
5:07
Because I think we all know that, you know, agents should
5:09
not be using passwords. Yeah, there's a lot of major
5:13
themes going on in this conference.
5:14
One of them is continuous identity, doing things in a
5:18
continuous manner. And when we got prepared for
5:22
this show, you and I were talking about like let's educate
5:25
people on something that is a big trend in the industry and
5:29
you talked about know your employee, that's the big trend,
5:32
but also doing it in a continuous manner.
5:34
So you're already on this trend. Can you talk a little bit about
5:38
what that's all about? Yeah.
5:40
Look, the reality is since the pandemic, pretty much every
5:44
organization has a significant chunk of their workforce that is
5:48
remote. And that's just a reality that's
5:51
not going to change anytime soon.
5:53
There's the big banks of the world that are now saying you
5:55
have to come in five days a week, but most of those people
5:58
just show up in the morning, tap their badge and then go home.
6:01
So they're still remoted. So, yeah.
6:05
So, so it's becoming increasingly important to
6:08
continuously verify individuals and, and this this is
6:12
particularly important on the enterprise side where you have
6:15
so many different personas working at any given
6:17
organization. So if you have a 10,000 person
6:19
company, you got a couple thousand contractors, you have,
6:23
you know, 3 or 4000 people who work remote, you have
6:25
individuals who are frontline workers and you have to figure
6:29
out like, what is the identity story across all those personas?
6:32
And that's not always easy. So being able to continuously
6:35
verify people both from a credential and authentication
6:39
perspective as well as an identity verification
6:42
perspective is critical because we've seen recently a lot of
6:45
instances where individuals are outsourcing their jobs.
6:49
So if you're if you're, if you go on Reddit, there's a over
6:53
employed subreddit, right where people are like talking about
6:56
how they're juggling 345 different jobs at a time.
6:59
There's also now nation state efforts like with North Korea,
7:03
where they have entire groups organized and basically set up
7:08
to do jobs on behalf of US employees.
7:13
And so every, I think people have read the article of that
7:16
Lady. I think it was in Tennessee or
7:18
Arizona somewhere where she had like 40 corporate issued laptops
7:22
in her house and you know, people are remoting into those
7:25
laptops and doing the jobs. I just don't have the litz for
7:29
to do something like that myself, but I'm I'm sure it's
7:33
happening. So what are companies doing
7:36
about this today? How are they solving this
7:38
problem? You mentioned?
7:39
It got hot at the beginning of the pandemic.
7:41
I remember was like we're all patting ourselves on the back
7:44
like, hey, in six, six weeks everybody got multi factor
7:48
authentication up and running. Is that what they're doing?
7:51
Is that was that the last chapter of that book?
7:54
Well, it was like. You know, typically before the
7:58
pandemic, it was like you get a job at a company, you, you start
8:01
on day one, you get verified, you get issued an MFA credential
8:05
and then that's it. Like that MFA credential is you
8:08
for the rest of your career there, right?
8:10
And so that's no longer the, the feasible way of doing identity
8:15
security at the employee level anymore.
8:17
Now you have to be able to continuously verify people to
8:20
make sure the person sitting behind that laptop is the person
8:23
who's supposed to be sitting behind that laptop.
8:25
And the person who has access to the MFA credential is the right
8:28
person who should have access to the MFA credential, right?
8:31
There's so many instances now of individuals like sharing their
8:34
MFA with others, right, or issuing new MFA credentials to
8:38
them. And so this concept of you, you
8:41
have like a seesaw type of thing where you have, you have to have
8:45
a strong MFA credential. I think that's what Passkey's
8:48
and the Fight Alliance have been working really hard towards and
8:50
vendors like us to make sure that that thing is not fishable
8:54
and all that, all that. But then you also have to make
8:57
sure that that credential is being used by the right person
8:59
at all times. So that's where the identity
9:01
verification piece is, is similarly important.
9:04
And so now what we're seeing companies starting to do is
9:07
things like, hey, if you're a contractor or a remote employee
9:10
at our company, you have to go through identity verification,
9:14
you know, at certain increments every three months, six months,
9:16
or maybe if the level of risk justifies it.
9:19
And, and this is the exciting part for me because we're
9:23
finally starting to see the convergence of identity and
9:26
security. You know, when we started hyper
9:30
10 years ago, I would ask the identity teams, like where do
9:34
you report into? And only about 10% of the time
9:38
would they say they're reporting to security.
9:40
Now it's like more than half the time, so it's really fascinating
9:43
to see how that's evolving. Yeah, I mean, definitely want to
9:46
jump into that. One of the things that comes to
9:49
mind is this kind of saying that's become popular, which is
9:53
hackers don't break in, they log in.
9:55
But it's so true when you're talking about something like
9:57
this, right? And you know, I also think of
10:02
the scatter spider example that happened recently where it's
10:05
like the same old stuff. Call the help desk and social
10:08
engineer your way in. I mean, is that why this kind of
10:12
this old paradigm is failing? Yeah, it's so dirt simple too.
10:16
You know, one couple of the big casinos had breaches related to
10:20
Scatter Spider recently, and I had an opportunity to listen to
10:23
one of those phone calls. It was nothing sophisticated,
10:26
right? It's like, hey, this is Bill.
10:27
I can't log in and help me out here, you know, and, and the
10:30
hackers don't have to be extremely smart, right?
10:33
The, the way that they do these things is pretty simple.
10:35
So they call up the help desk. They say, hey, it's Jeff, I
10:39
forgot my password or I'm locked out.
10:42
And they say, OK, Jeff, what's your manager's name and the date
10:45
that you started? And the hackers like, ah, damn,
10:48
I don't know. So they hang up, then they call
10:51
up Jeff and they'll hey, Jeff, this is your IT team.
10:53
We're just doing a routine audit of your security questions.
10:55
Can you confirm with me the date that you started in your
10:58
manager's name? You're like, sure, here you go.
11:00
Hang up, call up the help desk, answer the questions, get access
11:03
to the account. That is the level of
11:05
sophistication here. It is not some zero day Stuxnet
11:09
like crazy thing here. Like this is like a teenager can
11:12
execute it. And but what's changed in the
11:14
last couple of years in particular, these attacks are
11:16
scalable at a level like never heard before.
11:19
So I was talking to a chief security officer of a large
11:22
Japanese bank and he said I never had to worry about social
11:26
engineering and scattered spider at my help desk because most
11:31
hackers speak Chinese, English, Russian, they don't speak
11:35
Japanese. It's like, but now with with AI,
11:39
they speak fluent Japanese and my help desk can't tell the
11:41
difference. So all these companies that are
11:45
in Latin America, certain countries in Asia, Europe, where
11:48
hackers typically don't speak those languages because it
11:51
wasn't necessarily profitable. Now it's open season.
11:55
It's crazy. It's like the hack is
11:59
fundamentally simple. The answer, though, is you
12:03
better throw some technology at it, right?
12:05
It's not just, oh, we're going to change our help desk process.
12:09
You do need some technology behind it.
12:11
But I think there's also, it's not just that, you know, the
12:13
defenders are throwing technology at it, the offenders,
12:16
the attackers are also throwing technology.
12:20
So the the language one is interesting because, you know,
12:23
it used to be the, you know, Nigerian Prince with the poor
12:26
word e-mail. Now it's a well crafted AI
12:29
generated thing. There's things for voice.
12:31
Now there's even things for voice that will remove an accent
12:34
from somebody. So, you know, if I have, you
12:37
know, a thick accent in one language, I can in real time
12:41
speak my normal cadence, you know, whatever language I'm
12:44
speaking and have it be in real time translated into the
12:49
appropriate language and get rid of all that.
12:52
I posted videos on link to me speaking Japanese.
12:55
I don't speak Japanese, and I send it to my friends who are
12:58
Japanese and they're like, yeah, you sound like you're from here.
13:02
Perfect. Yeah.
13:03
Maybe that's a spoiler we can put in here and like, just make
13:05
this entire thing in Japanese, right?
13:08
Yes. OK, so who's on the hope when
13:11
something like this happens? I mean, in other words, it seems
13:16
like it's more than just an informational security problem,
13:19
right? Yeah, it's fascinating.
13:22
You know, like so if we break it down into a couple of areas, if
13:26
somebody bypasses MFA, it's typically the security teams
13:30
problem, right? But if somebody calls up the
13:32
help desk and tricks them into issuing a new credential, oh,
13:37
all of a sudden that's it's problem, right?
13:39
And then if a company interviews an individual and then the
13:44
person who shows up and is on board and on the first day is
13:47
not the person they interviewed for some reason, that's HR's
13:50
problem. So there is this like finger
13:52
pointing, not just in terms of who has to deal with it, but who
13:56
has to pay to fix it. And so this is where identity is
14:00
more complicated than ever because now you have to have the
14:04
ability to reach across the aisle and really work with other
14:08
key stakeholders within your organization to drive this
14:10
change more than ever. And that's always been the
14:13
hardest part of identity. And that's that's why I like
14:15
seesos are so scared of identity.
14:17
Like everybody talks about zero trust and the like, the five
14:20
pillars of zero trust. But like, conveniently, all the
14:24
seesos tend to like, ignore the identity one as much as they
14:27
possibly can until the, you know, until it hits them where
14:31
it hurts. Well, identity at the center.
14:33
Hello. The, the pay thing is
14:36
interesting angle because at the end of the day, the company
14:39
pays. And so you don't want to be in a
14:41
position where it's like, well, who's paying for the security,
14:43
right? Is it HR?
14:44
Is it, IT, is it, IT security is a compliance thing.
14:48
At the end of the day, someone's paying and guess what?
14:50
It's going to be the macro company.
14:51
So how do you, how do you articulate that with people that
14:54
are out there saying, well, it's not my problem, That's your
14:56
problem? No, no, it's our problem.
14:58
We need to fix this issue. Yeah, it's really all about
15:01
making sure that inside inside teams can find creative ways to
15:08
get the project prioritized and paid for, right.
15:11
And so sometimes they're charging it back to security or
15:13
to the business. Other times they have to have a
15:16
broader leadership level discussion.
15:19
But everything ultimately comes down to the business value.
15:23
And like, how can us doing this make sure that we better
15:27
differentiate ourselves from our competitors?
15:29
Doesn't matter what your industry is, right?
15:31
If you're a bank, you're in the, you're in the business of trust.
15:35
If an article comes out and, and you know, you hired somebody
15:38
from North Korea, like that's a problem for you, even if it
15:41
didn't have any material impact on your, on your business, it's
15:45
a trust issue. So I think being able to
15:49
socialize it and position it in such a way that like, hey, this
15:52
is going to help our business and we need to work together
15:54
here is, is key. And, and just being very
15:58
transparent here, Like when I talk to an identity team, one of
16:02
the first things I ask is how long have you been here and what
16:06
other change management have you been able to drive across the
16:09
organization in that time? Because if they don't have good
16:13
answers for that, like we know that we're going to really have
16:16
to work with them to help them drive that change.
16:20
So we know our primary listener is the identity practitioner.
16:23
Obviously, identity at the center is not a generalized
16:26
topic, right? We want to make this as
16:28
educational as possible. So what is the right solution?
16:32
What should identity practitioners be doing to
16:35
getting it to get ahead of this for their organization?
16:39
I think you have to think about it in two ways.
16:42
One is getting it prioritized and budgeted is the number one
16:45
thing, right? So being able to speak the
16:47
language of the business and put it in that context.
16:51
And then 2 is understanding what it's going to take to
16:53
operationalize it quickly, right?
16:56
So what we try to help our customers with is technology is
17:01
usually the easier part. It's the people part that's more
17:04
difficult. And so whenever we work with a
17:07
customer, for example, like we put together an entire change
17:10
management program for our product so that they can use to
17:14
implement it. I'll give you a really silly
17:16
example. So like we were deploying Pass
17:18
for list with a large company that has like 50,000 employees
17:21
across 40 countries and they got to like 33,000 employees in
17:27
three months. It was amazing.
17:30
But what they did was they spent as much money on the internal
17:34
marketing campaign as they did the technology.
17:37
So in any region, the 1st 100 people who signed up for
17:41
passwords got a T-shirt that says I'm passwords, right?
17:44
Or they got like a little Lego kit or or something that was
17:49
branded to their organization that they could use to show off.
17:53
And that internal marketing is every bit as important as the
17:55
technology. Yeah, it reminds me of Jeff,
17:58
your story right where you were rolling out.
18:00
This was back in the day, self-service password reset.
18:03
Yeah, which we would never do that to.
18:05
Any right? Yeah, give away an iPad.
18:08
Give away an iPad. Right, $400.00 that we spent on
18:10
iPad drove way more like self-service enrollments and I I
18:15
like the idea of making it like exclusive, right.
18:17
So maybe it's like a living time offer, like the first 100 get
18:20
something and when that thing is gone, it's gone.
18:23
So you create like artificial demand, right for the thing.
18:26
Now the thing has to be cool. I don't know if a T-shirt would
18:28
get for me, boy, I'm sorry, but you know, a Lego or something
18:31
that's like, you know, very unique would be very cool.
18:35
Yeah, what this customer did, they, they gave the country
18:37
manager because they were in 40 countries.
18:39
They gave the country manager an iPad or a drone if it when they
18:43
got to like 90% adoption and you'd be shocked.
18:46
Like what? Highly paid executives are
18:48
willing to do it for an iPad or a drone.
18:50
Yeah. Well, and The thing is, it's
18:52
like you're spending a lot of money when you roll out any
18:55
technology to 50,000 people. So that incremental spent on a
19:00
few iPads and a few Lego boxes like it's well worth the money.
19:05
Yeah. What we've done is we've
19:06
actually like packaged that into a solution essentially, right.
19:10
So we, we provide all the, all the marketing content for you,
19:15
right? So you don't have to think about
19:16
it. We're just like, here you go.
19:18
Here's what it could look like. Just let us know which of these
19:20
things would resonate with your workforce the most.
19:23
And so therefore like just meeting the customer where they
19:26
are is is critical how? Many of your customers take you
19:28
up on that like is that part of part of the deal?
19:31
Say, hey, we were getting a hyper in and here's the plan for
19:34
roll out? Like do they take that and kind
19:36
of run with it? I'm sure they probably tweak it
19:38
a little bit to some degree to fit their organization, but.
19:40
I mean, we're pretty. Involved as part of that.
19:43
We're pretty adamant about it because that's the, that's the
19:45
main way that we can get success.
19:47
Like look, the last, the last thing we ever want to be is
19:50
shelfware for any customer. And there's way too many
19:53
security solutions out there that companies will buy and they
19:56
just sit there and they never get implemented, right?
19:59
So how do you get an identity product implemented?
20:01
You get people excited about it, right?
20:03
And like when we first started this company, we're like, it's
20:06
pastoralists, Everybody's going to want to use it.
20:09
It's a no brainer. But that's not the case.
20:11
The fact is, people don't like change, even if it's a positive
20:14
change. And so you have to drive that
20:16
change some other way. Yeah, that's a great point.
20:18
So I think the other thing is like identity practitioners are
20:22
kind of wired to bring people together.
20:25
I mean it's one of them few technology I think in the
20:28
enterprise where it's like you touch so much of the business
20:32
even if even though you're doing like IT security.
20:36
So my question is what advice would you give for the practice?
20:40
Like who do they need to be reaching out to and building
20:43
these alliances and kind of what is the message that they take
20:47
along, I mean, leveraging that framework that you talked about?
20:51
Yeah, in terms of the internal stakeholders building alignment
20:54
there, that's key. So if you look at the typical
20:57
enterprise, right, do you have, you have the HR team who's who's
21:02
involved in the onboarding process, you typically have a
21:04
digital workplace folks, right? These are individuals who manage
21:10
things like, you know, the Windows 11 upgrade and stuff
21:14
like that, right? And, and they, they also tend to
21:16
have a stranglehold on what goes on the endpoint, right?
21:20
And then you have obviously the, the executive level team where
21:25
if somebody complaints about a change management thing, they're
21:28
the first ones who are going to, you know, go to the CIO or the
21:32
CEO and say, like, what the Hell's the identity team doing?
21:35
Like my, my users hate this, right?
21:39
And then and then you have the help desk, right, Because if
21:44
people have trouble with that technology, they're going to
21:46
pick up the phone and call the help desk.
21:47
If the help desk is not fully prepared to handle that request,
21:51
that's going to come your way really fast and it's not going
21:54
to be pretty. So building that consensus
21:56
within your organization of the individuals that you know are
22:01
going to need to be a part of this and starting early, like
22:04
especially, you know, some of these teams, they have, you
22:08
know, three month change windows.
22:10
So if you want to get something done in the next 6 months, if
22:12
you're not talking to them six months ahead, like it's not
22:15
going to happen or giving them the heads up.
22:18
So I think building that consensus early and, and often
22:21
is, is key. And you can't just show up at
22:23
the last minute say like, hey, can you do this for me?
22:25
Like that's not how it works. You know, Jeff and I, during our
22:28
day job, we worked with the clients implementing identity
22:31
solutions. I think one of the things that
22:33
we've seen for a long time is still around today is identity
22:37
sprawl. And So what did you get from
22:40
you? Like kind of.
22:41
What does that mean to you and why is that a problem?
22:44
This is one of my pet peeves of the identity industry is like
22:48
when when I talk to identity teams, they tend to tell me
22:52
like, we are working on foundational things right now.
22:56
And so we're going to take our five ID PS and we're going to
22:59
consolidate it into one. And then everything is going to
23:02
be great. And then what happens?
23:04
They get 20% of the way there and then they acquire another
23:08
company that has three more ID PS and then they're like, oh,
23:13
now we got to start all over again.
23:14
So then then they start planning and so on and so forth.
23:17
So the reality is consolidating everything into a single
23:21
identity source is a fallacy. Like it is it, it's possible in
23:26
smaller companies that don't change very much.
23:29
But guess what, if you're a smaller company, don't don't
23:31
change very much, you're not going to become a bigger
23:33
company. All right.
23:34
So you, you really have to think about how do you implement these
23:39
baseline security controls that are key to stop phishing and
23:43
social engineering across that identity landscape, right?
23:47
And so that also gives you flexibility because now if you
23:49
acquire another IDP for whatever reason or some line of business
23:53
decides to go rogue and just deploy another IDP because they
23:56
feel like it. Do that.
23:58
Come on. You can bring it into the fold
24:00
from an authentication experience really quickly.
24:04
And what that then provides you is if your authentication
24:07
experience is consistent across your identities.
24:10
Then if you do want to consolidate ID PS down the road
24:14
for whatever reason and you want to simplify that, it becomes
24:17
more of a back office function than something that is affecting
24:20
the end user on a day-to-day basis.
24:23
Is that what you're touching on earlier in the podcast to talk
24:25
about leveraging these existing tools, which I think is
24:29
something that every practitioner wants to do, right?
24:32
We spent this money, we put these tools in place.
24:35
We don't want to just have to RIP them out every five years.
24:39
Is that where you're getting at, or was there something deeper?
24:42
That's exactly it. And then there's an additional
24:44
part of it, right, which is, you know, I talked to, I talked to
24:47
identity and security teams. And sometimes they'll say, if I
24:50
could take the worst authentication experience in my
24:53
company and just make it consistent across all my users,
24:56
it will be way better than what we have now because the
24:59
consistency is so important. And then 2 is being able to
25:03
leverage existing investments. So you know what, if you're an
25:07
identity practitioner inside your company, you know what
25:10
security people really like to hear?
25:12
They like it when you go to them.
25:13
You say, hey, you guys just spent millions of dollars on
25:16
crowd strike. This identity thing I'm doing
25:19
over here can talk to crowd strike really well.
25:22
And I can actually take the data from the tool that you just
25:25
spent a lot of money and put your career on the line
25:27
investing in and I can get you more value from it.
25:32
That's the language that security teams speak and that's
25:35
what they like to hear. Instead of coming in and saying,
25:39
here's what we're going to do and here's how it's going to
25:41
impose this change management and here's like what you have to
25:43
do in order to make my project work.
25:45
All right, So it's a give and take.
25:47
Some may flip that. I think a lot of people it
25:49
resonates right to say, OK, let's get the most accountable
25:51
tools we have, but at some point those tools are not good enough
25:55
anymore. How, how do you know when that
25:59
is the case? Like when is it time to move on
26:01
and say, OK, we got X number of years out of this thing and it's
26:06
time to move on? Like how do you have that
26:08
conversation? How do you recognize that?
26:11
That's a really good question. And I think it's, it's a tough
26:14
one because often times individuals have built their
26:18
careers around specific tools, right?
26:21
You go on LinkedIn and the first line on somebody's LinkedIn
26:24
profile is I'm a sail point. So and so, right?
26:28
And it's like, wow, that's your career, right?
26:30
And, and I think that's a mistake.
26:33
I think, you know, most sophisticated identity and
26:36
security teams, they have programs that protect them from
26:40
being beholden to a specific vendor, right?
26:45
And, and those are the teams that I've seen be most mature.
26:48
So I think anytime you onboard A vendor, you have to think about
26:50
the exit plan for that vendor. And it's that exit plan a month,
26:54
a year or three years because depending on what you have, it
26:59
could be really, really long. Like most financial institutions
27:01
still run on Rack F, you're not moving off of that anytime soon.
27:06
So I think for identity especially, it's the same
27:09
because identity is, is the perimeter, as we like to say.
27:12
And so it's something that people interact with.
27:14
So I think if you have an existing vendor, you need to
27:17
have an exit plan for that vendor if you don't put one
27:19
together. And two is like any vendor
27:24
relationship is, is key and it's about trust at the end of the
27:29
day. So do they say that?
27:31
Do they do the thing that they say they're going to do if they
27:34
say they're going to have a specific feature that you
27:36
requested in three months or six months and they don't deliver
27:39
for two years, like writings on the wall there that like the
27:42
thing that they're doing, the thing that you need is not their
27:44
priority. And you should think about that
27:48
at the same time, like how resilient are your vendors?
27:52
Third party risk is probably the biggest area of risk of growth
27:57
in in the industry right now where, you know, most vendors
28:01
don't have the security that the bank that's buying that vendor
28:05
does, right? So how do you make sure that
28:07
your vendors have the third party risk controls in place
28:10
that they need to? Otherwise if they're not taking
28:12
it seriously like it's not, it's a non starter.
28:16
We talked a little bit earlier about identity verification.
28:19
I feel like this is one of the areas that from a technology
28:22
perspective is the most different from 5-10 years ago
28:27
where it's now document based verification technology tools.
28:32
I want to get to how, how prevalent should they be or will
28:37
they be in the enterprise? But before that, I just wanted
28:41
to give a recognition that you know, we're at the authenticate
28:44
conference and obviously it's like pass keys are the number
28:47
one thing. But you wonder, OK, where's
28:50
Fido? The Fido standards going to take
28:53
things in the future of Fido Alliance going to take things in
28:57
the future. And we had Nishant, their CTO,
29:00
on a few episodes ago and he talked about identity
29:03
verification. It's like having a verified
29:06
identity and then doing authentication in a strong way.
29:10
It's like now you're talking about the Holy Grail.
29:13
Yeah, look to tackle that. Like if you look at most
29:16
enterprises right now, identity verification means kDa.
29:20
This is what Street did you grow up on and what's your manager's
29:22
name? And I think we all know that
29:25
that's not acceptable anymore right now on the consumer side
29:28
of things, identity verification has been much more mature
29:33
recently, especially since the pandemic started, where if
29:36
you're signing up for an Uber account or something now or a
29:38
Lime scooter app, like you have to scan your driver's license or
29:41
a document, right? And so the issue is the
29:45
documented verification piece for identity verification
29:47
doesn't really translate as much to the workforce.
29:50
Like you need more flexibility because you have employees all
29:53
over the world. You have employees who don't
29:55
have driver's licenses, you know, or, or things like that,
29:58
where they can reliably use that as a source of proving
30:02
themselves. Additionally, in order to prove
30:05
somebody's identity. Well, if you look at the average
30:08
enterprise where the where's that person's information
30:11
actually stored that you need to verify, some of it is in work
30:14
day, they're human Capital Management system, some of it is
30:17
in their ID. PS Right.
30:19
Some of it is in their, their, their HR and healthcare systems.
30:24
So when you're proving an employee's identity, you have to
30:26
be able to go into all those things, pull it down and then
30:28
use that information to verify them.
30:31
So you have to have a lot more flexibility and orchestration in
30:34
the way that you're verifying employees identities.
30:36
And that's where we've really seen a good product market fit
30:40
to the point where now our our customers are regularly
30:45
verifying employees at scale. Yeah, seems like there's a
30:49
certain level of friction involved with verification.
30:53
I think in some of these cases, absolutely necessary.
30:55
But you know, I feel like in the enterprise the ability to insert
31:00
friction into the process would be a lot higher, but it seems
31:04
like there is a resistance there.
31:06
What what's your philosophy in terms of like inserting friction
31:11
into the process? Look on on the employee side, at
31:14
least here in the United States, it's a little bit simpler,
31:16
right? It's like you're a net will
31:17
employee and we give you a paycheck.
31:18
So you need to do it like that's, that's the mentality of
31:22
a lot of companies. But when you look at
31:23
international organizations, it, it varies and you also have to
31:27
have different levels of control for different personas within
31:30
the organization, right. So my employee who works in a
31:33
factory who logs into stuff twice a year to download their
31:36
W2, like do I need to put them through the same process as I
31:40
would my system engineer who you know has access to our AWS
31:43
infrastructure? No.
31:45
So that flexibility is is really important to have.
31:49
And then working with this is where identity is working with
31:52
the legal department to really help them have an understanding
31:56
of these processes is important because if you are doing
31:59
something like a biometric match or a document scan as part of
32:04
that verification process, your employee, your, your more
32:08
privacy conscious employees will write a letter to HR or to legal
32:12
and say, WTF is this? And they need to have a prepared
32:17
set of answers, right? Or, or tackle those upfront.
32:20
And so this is where another reason that identity has to work
32:24
with internal stakeholders more. OK, so I'm going to cross my
32:28
barns here and put my jaded Cecil hat on.
32:31
What is it about Hyper that makes you guys unique in this
32:35
space? Right, Because there's so many
32:37
different identity tools, there's a lot of overlap.
32:39
I'm sure you've got competitors out there.
32:41
What is it that you think that makes Hyper special?
32:44
So what makes Hyper a little bit different from most identity
32:47
companies is we started out as a security company and and we
32:51
started as a security company 11 years ago when there were very,
32:55
very few or none identity focused security companies,
33:00
right. So we started out in that
33:01
landscape from the get go. So what, what does that mean?
33:05
That means that we built resiliency trust controls into
33:09
the product from the get go. We built scale into the product
33:12
from the get go. We understood that if hyper is
33:14
not working, our customers aren't working, right?
33:16
And then we're really focused on the areas where there were
33:20
massive security gaps. So one of the first things we
33:22
implemented was what we call desktop MFA, right?
33:26
As we realized most companies don't have MFA when they're
33:29
logging into their endpoints. Let's build that, let's provide
33:32
that to the security teams and many banks purchase that and,
33:34
and use it today. The other thing that we did was,
33:38
which was very differentiating was we built our identity
33:40
verification capability focus for the workforce, right?
33:45
So we noticed we, we were talking to, this was like 5
33:48
years ago, we were talking to some of the Swiss banks.
33:51
We're like, what do you do if somebody forgets a password?
33:53
And they had the system where you could go to any two people
33:57
in your company and they could request a part of your password
34:01
for you. And then they can give you, you
34:06
know, your password and in those multiple parts.
34:08
And it's all tracked through an accountability system.
34:11
So we built a vouching system into our identity verification
34:16
product where other people you work with would vouch for you
34:19
over a video chat and then you could automatically be issued a
34:21
new credential, right. So we took these best practices
34:26
that were being implemented ad hoc or manually in the real
34:29
world at some of the most sophisticated organizations and
34:32
brought them to every business. And so we're not an IDP as a
34:35
company, we don't try to be. We think that is a well
34:39
commoditized space. We really try to fit into our
34:43
our customers existing ecosystems and bring them best
34:46
in breed controls such as password list, identity
34:49
verification for their employees, orchestration between
34:52
their security tools and their identity tools that they
34:55
typically don't have so they can fill those key gaps.
34:58
So what's it take to set this up then?
35:00
Is this let's say I've got a primary IDP already right?
35:03
Microsoft Ping, Octa, etcetera, right?
35:05
What does it take for me as AI am administrator to set up
35:10
Hyper? You log in, you choose which
35:13
identity tools you have. So you choose Octa, Antra, Ping,
35:17
and you provide authentication credentials to those.
35:20
AP is and then we pulled it, pull it all in, and then we
35:23
enable these capabilities for users.
35:25
So if you're like an Octa or Entre customer, you can have
35:29
users up and running with Hyper in 15 minutes.
35:32
That's pretty fast. How do people measure success
35:36
with this? So it's kind of one of those
35:38
things like, OK, why logged in, great.
35:39
Like that's the expected result. What is a way that your
35:43
customers have found to measure to say, OK, yeah, we are getting
35:46
what we're paying for from hyper?
35:49
Yeah, we helped them track with. So we have this identity
35:51
assurance score essentially within our product where you can
35:56
see the value you're getting from it in real time, right.
35:59
So we, we can show you like, here's how many of your
36:02
authentications that people are doing today are fishing
36:05
resistant and here's how many are vulnerable to fishing.
36:07
Here's how much money you're saving on credential resets
36:10
because people are no longer calling to help desk.
36:13
Here's how much money you're saving in productivity because
36:16
your employees aren't locked out because they typed in a password
36:19
wrong too many times that morning.
36:22
So having these hard metrics that people can like share with
36:25
their broader business is key because that's how ultimately
36:29
they justified the investment. And look, we, we like to start
36:32
with our customers smaller, sort of like let us prove our value
36:36
to you and then we'll grow together.
36:39
So you mentioned a few things to me that I just jotting notes
36:43
down as we were preparing and one that jumped off the page to
36:47
me was never leave use of Stranded.
36:50
I thought that was so cool. What does it mean?
36:54
So picture this. You're on vacation with your
36:56
family, right? And you lose your phone and your
37:01
phone has your MFA on it. And you know, you're, you're,
37:07
you really need to take care of an e-mail or send some report.
37:10
And you're like, oh, man, I can't get in.
37:14
So you don't have your phone. You know, you have your laptop,
37:17
but you need MFA to access things.
37:19
What do you do? Right?
37:21
And so call up the help desk and you say, hey, I know, I know, we
37:26
have corporate issued phones, but you know, my wife has her
37:29
phone. Can I get the MFA on her phone?
37:31
No, you can't do that. And so employees have to go
37:35
through so many hoops to prove that they are who they say they
37:38
are. And lots of times they don't
37:40
have the things available to them to prove that.
37:43
So what we built is a orchestration layer for identity
37:48
verification, where in the worst case you can always get through,
37:54
right. So if you don't have your phone
37:56
number and you can't do OTP, that's OK.
37:59
You can do something else. If you're in the wrong, if
38:01
you're, if you're not in the right location, it's OK, you can
38:05
do something else. If you can't scan your driver's
38:07
license, that's fine. Maybe you lost your maybe like
38:10
my phone has my driver's license on the back of it.
38:12
If I lose my phone, it's over. So then what can you do you?
38:17
Well, we can put you, we can use any browser at any hotel kiosk
38:21
to put you on a video chat with your manager or somebody you
38:23
work with who can vouch for you, right?
38:26
And so always having a way for an employee to get through and
38:30
never leaving them stranded is so key because us identity
38:33
people, we love to get hung up on the edge cases.
38:37
And so being able to always have a way through is so important.
38:40
But it's not going to work this 1% of the time.
38:42
So we got to hold everything up. Come on.
38:44
Football. And that tags along with the
38:47
next one that I took note of which was talked about it being
38:51
authentication being a Tier 0 capability.
38:55
In other words, it how many nines do you have has to be up
38:58
all the time. All the nines.
39:00
And people stranded. You can't have it work.
39:03
Well, everything except Sunday night at 2:00 in the morning.
39:06
It's just got to work. Yeah.
39:08
And that's that's where the resiliency piece comes into play
39:11
so much, right. It's like, does this thing work
39:14
across multiple regions, multiple multiple availability
39:19
zones? How does it fall back?
39:21
You know, like the word disaster recovery in most companies or
39:25
most vendors is a tabletop exercise at best.
39:28
And so how do you actually practice what you preach?
39:31
And and that part is so key and being able to prove that at
39:33
scale is important. So like many of the top banks in
39:38
the country use us and, and they have hundreds of thousands of
39:41
employees. And so if we're not working,
39:44
they're not approving loans, they're not, you know, opening
39:47
checking accounts, they're not doing anything.
39:49
And that that has a fundamental impact on our economy.
39:52
And so step number one is making sure that you're at peace with
39:56
that, and that's the reality. And two is making sure it's part
40:00
of your road map. And three is making sure that
40:01
every employee truly understands the criticality of them.
40:05
So I've been having a lot of conversations with my day job
40:08
about resiliency and Dr. plans and where does I am fit into Dr.
40:14
plans? Because I think most, most
40:15
larger companies will have like ADR plan, but what happens if
40:18
their IDP goes down? I don't know if a lot of a lot
40:21
of companies have really thought about like their identity
40:23
infrastructure as being that critical.
40:26
And so yes, it has to be up. Are you seeing more of a push to
40:31
make sure that identity is part of that Dr. strategy, that plan,
40:35
whatever may be where, if something does go down, here is
40:38
how we're going to recover from it.
40:40
Absolutely. And that's where a lot of
40:41
companies realize that they have gaps because your your ecosystem
40:45
is only the chain is only as strong as its weakest link,
40:49
right? And when companies do Dr. plans
40:53
and they execute those, they realize what the weak links in
40:56
their environment is. They're like, oh, shoot, we have
40:57
MFA. But for these key accounts, like
40:59
you, turns out you can bypass it.
41:02
And so, you know, like actually doing the exercise and finding
41:06
compensation methods that are still secure to address those
41:11
is, is key. And, and it's something that's,
41:14
yeah, it really started out in financial services as being a
41:17
key control, but now it's starting to get into critical
41:21
infrastructure and, and energy and, and a much broader set of
41:24
verticals. So this is not a really
41:27
fascinating conversation. Then we'll start to wrap things
41:29
up. But there was a note on our
41:31
notes here as we were getting set up as I, I think it's the
41:33
first time we've had this on the show.
41:36
There's a note that says that you're a competitive boxer in
41:38
the past. So I definitely have to get into
41:40
this. Keyword was it was £50 ago.
41:45
So how long ago was this? What was it like?
41:47
I think taking me into the mind of a competitive boxer because
41:50
this is the first time I think we've had had that on the show.
41:54
Yeah, I went to AI, went to a party in high school and and I
41:59
ran it, you know, I'm, I'm, I'm a tall guy.
42:01
I'm 6 foot 5. So I, I saw another guy that was
42:04
taller than me and we immediately start talking and he
42:07
told me it was a boxer. And so I, he invited me to join
42:10
this gym. So in high school I joined this
42:12
gym and I started boxing after that competitively and in
42:16
college I was decent. And, and the thing about boxing
42:22
is you have to, you have to get to a point where you truly
42:27
believe in yourself when you're doing something, because when
42:29
you get in the ring with somebody, like you look around
42:32
you and there's nobody there to help you, right?
42:34
So you have to be very confident in yourself to execute on your
42:38
plan. And as Mike Tyson says, you
42:42
know, everybody has a plan until they get punched in the face.
42:44
And running a startup, you get punched in the face a lot.
42:49
So how many fights like professionally in the
42:51
competitive circuit and what was your record?
42:54
I think I had like 18 fights. I think I won 12 of them and I
43:03
was a super heavyweight and super heavyweight is anything
43:06
over 195 lbs. And so I was like in the low 2
43:11
hundreds at that time. And it's fascinating because as
43:16
a super heavyweight, anything over 195 lbs is a category.
43:19
So as a 200 LB guy, you're fighting somebody who's £300 and
43:23
so you have to be very, very fluid in the way that you
43:28
approach things. So it's a it's a good skill to
43:31
have. So how much of a difference does
43:33
that 100 lbs make in in that sort of snare?
43:37
Right? So you're 200, someone else's
43:39
300. Is that 100 extra pounds of pure
43:42
muscle or is it, you know what? What?
43:45
Butter, butter, butter bean? What was the guy's name, right?
43:47
Like I said, like that, right? Like, you know, maybe that
43:48
heavier set. Yeah, I boxed this guy that was
43:51
like over 300 lbs and he was a NFL, He was a linebacker, right?
43:55
So his his NFL career wasn't going the way he thought it
43:58
would. So he was like, I'll try boxing.
44:01
And the good news is like he doesn't have the stamina, but if
44:03
you get hit, like I remember blocking a punch from this guy
44:07
and thinking like, I didn't block it.
44:09
So because it was so powerful. And, and so for for me, I think
44:16
it depends. Like, you know, the bigger guys
44:17
don't have as much energy. So if you can survive the first
44:19
two rounds, like you're good to go, but you got to survive.
44:23
Yeah, done. I mean, it's a workout, right?
44:26
Just to get out there for a couple months.
44:27
I remember I used to do Taekwondo for a long time ago
44:30
and I would, you know, do some light competitive stuff and man,
44:33
you'd be gassed after just a couple of rounds, you know?
44:35
The hardest part of boxing or any sport like that is, is I
44:39
forget. I don't know what the technical
44:40
term for it, but my coach called it like being able to see
44:44
punches coming. And so this whole concept of
44:46
when somebody's trying to hit you in the face, like not
44:50
freaking out or not holding your breath when that happens because
44:53
when you hold your breath, your muscles get tired really fast.
44:57
So seeing punches coming at your face and being able to breathe
45:00
through that process is the trick.
45:02
I. Mean.
45:03
That's like a physiological response rising.
45:05
Oh, here it comes. You're tensing up.
45:06
It's like being in a car, you know, a car accident.
45:08
Yeah, they talked about how like people who are drunk and they're
45:12
in a car accident, they don't break as many bones.
45:15
Because they're relaxed. Yeah.
45:17
So all right, last question. What is the hardest that you've
45:22
ever been hit? Like, do you remember something
45:24
that stood out like, oh, my God. Like you mentioned the block
45:27
where you thought you didn't block it.
45:28
Like is there something like that?
45:30
So one thing I was, I was an average boxer, but the one thing
45:32
I was very proud of is I never been knocked out.
45:36
In eight years of boxing I never got knocked out, so the closest
45:40
I've got we'll. Try now.
45:41
Folks who are listening don't want to have to go ahead and
45:43
say. OK, let's do this.
45:44
The closest I've gotten is I got it was I was fighting this guy
45:48
who's who's boxing for the Navy and I don't remember actually
45:54
being hit. So he hit me in my temple and I
45:56
dropped down to 1 knee and I got the stand EA count and I came
46:01
back. But I don't remember it actually
46:03
happening. I just remember my coach being
46:06
like, yeah, you got knocked down on and but you didn't like fall
46:09
over so. You're just like, stunned, I
46:11
guess. I mean, yeah, if I.
46:12
Finish the fight. So you're also married with
46:18
kids. So was the boxing career.
46:21
Was there overlap? Because I know that most wives
46:26
would be like done done. This is not happening.
46:29
Go be ACEO of a technology company if you want.
46:34
Yeah, look, I, I realized a while ago that I was not cut out
46:37
to be a professional boxer for the long term.
46:39
And, you know, I, I knew it because like I, I'd already had
46:43
a career in software development and a degree in computer science
46:46
and a job after college and I was still trying to box.
46:49
And I was just like, I'm just not in the right headspace for
46:52
this. And so I had to.
46:54
Plus I got plus my boss got tired of me showing up to
46:57
meetings with my face all busted up.
47:03
That was great. Well, well, thanks for being
47:06
here spending the time with us today.
47:08
That story at the end was probably worth the price of
47:12
admission. I'd encourage everybody to go
47:15
out to the website hyper.com. That's hypr.com/IDC.
47:22
There can be some unique stuff out there, so make sure you hit
47:26
that URL specifically and anything else.
47:30
Jeff No. Man, you were here taking it
47:31
away. It was great.
47:32
You mentioned the website idacpodcast.com.
47:35
And our YouTube channel idacpodcast.tv.
47:39
Yeah, like and subscribe and that helps us get great guests
47:41
like Bohans. So thanks for being here, being
47:43
part of this and we'll go and wrap it up for this week.
47:45
Thanks. For having me.
47:46
Yeah, thanks for being part of this.
47:48
Thanks for watching and or listening and we'll talk with
47:51
y'all on the next one. You've been listening to
47:55
Identity at the Center. We hope you've enjoyed the show.
47:59
Make sure to like, rate and review, and we'll be back soon.
48:04
But in the meantime, hit the website at
48:06
identity@thecenter.com. See you next time on Identity at
48:12
the Center.