Latest / Identity at the Center / #346 - Sponsor Spotlight - Veza

Transcript

#346 - Sponsor Spotlight - Veza · Identity at the Center

0:00
Tell me the top 50 people in my organization that have the most
0:04
privilege and you can almost guarantee, and I'm, I'm sure
0:07
you've had experience in this is in most organizations which they
0:10
just ask that question. Tell me the top 50 people or the
0:13
top 100 people that have the most privilege.
0:15
The answer when you see that is like, holy cow, who gave them
0:19
all that access? And, and so the nice thing about
0:23
a scaled solution as opposed to one of these more traditional
0:27
solutions that's just kind of in a people review, doing things in
0:30
spreadsheets or going through AGRC tour or going through
0:33
something that's like human reviewing other humans accesses.
0:38
You need to be able to ask these questions like who's got this
0:41
privilege? Who's got the most access?
0:44
If this credential is compromised, what's the chain of
0:47
attacks through the the identity graph that could result on an
0:51
action on a critical resource, all of that kind of stuff.
0:55
I mean, one of the things that's fascinating and then you know,
0:57
Tarun knows this as much as anybody is every to be use case
1:00
of the Vaser. It's like every customer almost
1:03
invents their new set of questions that are peculiar to
1:06
their risks that other customers can learn from in terms of, wow,
1:11
that's a really interesting way of getting to the most risk and
1:14
figuring out how to reduce their risk.
1:15
The time, time is here for us to really, you know, not just lift
1:21
one boat and there's something I, you know, shared with you and
1:24
our teams. Let's not shift the boat, move
1:27
the boat of visibility or move the boat of intelligence.
1:31
You know, let's try to build something which can, we can lift
1:33
all the boats together at a, at a singular time.
1:36
So whether it be IGA, whether it be Pam, whether it be NHI, we
1:39
believe the fundamental of that is rooted in just completely
1:43
rethinking identity from the scratch.
1:50
This is identity at the centre if it has anything to do with
1:56
IAM. This is the go to podcast now
2:00
your hosts Jim McDonald and Jeff Steadman.
2:10
Welcome to the Identity at the Center podcast.
2:12
I'm Jeff, and that's Jim. Hey, Jim.
2:14
Hey, Jeff, how are you? Oh, not so bad yourself.
2:18
I'm doing great. You know, I'm super excited.
2:20
We've got two of the top gurus in the identity security area
2:26
today on the podcast. I'm ready to get into it.
2:29
Yeah, Why don't we get into it? No, no whole no use.
2:32
Like, you know, trying to wait and figure it out.
2:34
If people read the title, they already know what they're in
2:36
for. But again, to make it very
2:37
clear, right, this is a sponsored episode.
2:39
This is what gives us access to people like Tarun and Phil and
2:42
others to really kind of dive deep into those technology
2:45
conversations, especially when we start getting into products.
2:47
So they have generously, you know, spending their time with
2:51
us and educate us on a few different things, but why we go
2:53
ahead and get some introductions.
2:54
So today we're sponsored by Vesa BEZA or the Identity Security
2:58
Company totally stole that from their website.
3:00
And we're going to hear more about what that means.
3:02
But if you go to the website, veza.com/I DAC, vasa.com/I DAC,
3:08
we'll have some more information for you there.
3:10
So with that, let me go ahead and introduce both of our
3:13
guests. Today we've got Tarun Thakar,
3:15
he's the Co founder and CEO of Vasa.
3:18
Welcome to the show, Tarun. Very nice to be here.
3:21
Thank you, Jeff and Jim, Appreciate.
3:23
Appreciate the opportunity. Yeah, thanks for taking the
3:25
time. And then he's joined by Phil
3:26
Venables. He's a strategic security
3:28
Advisor with Google, and he's also a Board Director for VASA.
3:31
So welcome to the show, Phil. Yeah, great to be here, looking
3:34
forward to. It so we have tradition around
3:36
here that when someone joins us the first time is we like to
3:38
find a little bit about their identity backgrounds and how
3:40
they got in the space. Tyrone, I'm going to start with
3:43
you and Phil. Just get ready because you'll be
3:45
Next up in the wings. How you know, Tyrone, how did
3:48
you get into the identity space? Is it something that you chose
3:51
or did it choose you? Yeah.
3:53
No, Jeff, it's, it's, you know, I remember talking about this
3:56
question with you before when we when we met at Gartner.
3:59
I am. It's definitely the latter.
4:01
You know, I, I, I don't come from the, come from the, from
4:04
the identity backgrounds. You know, I've grown up in, in a
4:08
systems distributed systems background and, and, and, you
4:11
know, spent the past 20 years of my career building distributed
4:14
systems at scale. So, you know, my, my background
4:17
is definitely how to build systems at scale and how to
4:19
think about, you know, all the way from, I remember my first
4:23
job was writing assembly language code to building
4:26
globally distributed file systems and then globally
4:28
distributed databases. So is definitely the latter.
4:31
But, but I would say, you know, fascinated by this space, five
4:34
years in, I, I feel like identity has so much to be done
4:39
that, that you're just barely scratching the surface.
4:41
But thanks for asking. Yeah, there's so much to do and
4:44
and learn in this space. I feel like I'm never, I'm never
4:47
going to get caught up. And I think that's a great
4:49
thing, because then it doesn't get stale.
4:52
Yeah. And also it feels like, you
4:53
know, identity is very much it's own island.
4:55
You know, it's, it's, it's so critical, but yet, you know,
4:58
when you get into that space, it has its own, you know, weird
5:02
nuances. Maybe that's true for network
5:04
security. Phil will probably know, and
5:05
maybe that's true for endpoint security.
5:07
But Identity definitely has lots of, you know, lots of threads
5:11
here. So I'm going to ask you about
5:13
basically here in a second, but I want to get to know Phil.
5:15
Phil is the first time that we've met.
5:17
I feel like we've been at a lot of conferences together.
5:19
I've seen you speak, so I kind of feel like I know you a little
5:22
bit, but at a distance. But now's my chance.
5:25
Phil, tell me about your background.
5:27
How did you get into that? Any space?
5:28
Is it something that you chose or did it choose you as well?
5:32
Well, it's, I've been a CSO for companies, for major global
5:38
organizations over about 30 years.
5:41
I'm I'm giving away my kind of my, my generation there.
5:45
And if every one of those CSO roles as, as most people in
5:48
security teams can imagine, it's, it's hard to avoid
5:51
thinking about identity and access and access management is
5:54
CNR, as I'm sure we're going to talk about today, it's one of
5:57
the, the calls to security. But over many of those roles,
6:01
over over many years, it, it became, you know, a significant
6:06
part of being able to just ask and answer the question, what
6:11
are all the identities I should care about?
6:13
What are all the things they can access?
6:15
Is that access appropriate? And if not, what can we do about
6:19
it? And then to do that, that
6:21
massive scale. And so, and you know, and Tyrone
6:24
knows this story because this is kind of how we first met is, you
6:27
know, one of my prior organizations, I was really
6:30
struggling to, this is like a decade ago, really struggling to
6:33
find any solutions that could help me solve this problem at
6:37
scale. So we ended up building
6:39
something and we, we built it wrong first, learned from how
6:45
not to build things at scale and then built it at scale with a
6:49
very similar architecture to what Vaser has, although it had
6:52
none of the sophistication, none of the bells and whistles.
6:55
And you know, if I'd have been around, you know, if Vaser had
6:58
been around, then I'd have bought that solution because it
7:01
was all of a scale problem. And so I've been immersed in
7:05
this at the sharp end for, for decades, decades.
7:08
And it's, you know, it's so good to be partnering with Vaser on,
7:11
on their journey and just figuring out how to solve this
7:14
in the right way. So I have to imagine it was
7:17
probably equal parts validating and frustrating that someone
7:21
built what you built and it's like, Oh yeah, that's oh wait,
7:24
that's maybe better. You know, I remember this, Jeff,
7:29
this is 2021. I got introduced to Phil.
7:31
This is like, you know, we're only like 12/14/16 months old
7:35
and we just had very rough sketch MVP kind of ideas.
7:38
And, and you know, we started sharing with Phil that, you
7:41
know, hey, here is what you're thinking, here is a graph, here
7:43
is, here is here is access permissions, Here is how you
7:46
bring it together. And, and Phil looked at it.
7:48
It was a 30 minute introductory call.
7:51
And that call, I don't know Phil, if you remember, it ended
7:53
up being a 2 hour call and, and you know, we talked about lots
7:57
of challenges and Phil is like, OK, let's see if you, you know,
8:00
we put our head down for two years and, and we, you know, had
8:03
the opportunity to meet Phil again.
8:05
And I remember 2023 and just so, so lucky and so fortunate, so
8:09
privileged to have Phil on our board and and guide us pretty
8:13
much on a weekly basis. So this is probably a good segue
8:16
for people who aren't familiar with Visa.
8:18
Tell us something about the company, You know, what is it
8:21
that you guys bring into the market?
8:23
And then most importantly, and I'm going to put my jaded Cecil
8:25
hat on, is why are you guys different?
8:27
Why are you guys, you know, setting yourself apart?
8:29
How do you set yourself apart from from your competitors and,
8:31
and things like that? No, I think there are three
8:33
questions packed in Jeff. There's something to go fast, I
8:36
think. I think look with ways of what
8:38
you're building is really, you know what we call internally the
8:40
next generation identity platform.
8:42
You know, we, we, we came to this conclusion back to your
8:46
question of, you know, identity, definitely choose us or me
8:50
specifically. And, and I think the, you know,
8:53
the observation that we made on why we started this company, the
8:57
insight and the intuition was, you know, we were simply just
9:00
asking questions, what I call the -1 journey of a startup
9:04
before you actually found the company, which is what's top of
9:08
mind. You, you said a seesaw, what's
9:10
top of mind when it comes to securing the biggest asset in
9:13
your organization, which is your data, right?
9:15
At the end of the day, if you're buying any tool with buying to
9:18
really secure that asset and, and you know, the feedback was
9:22
that, hey, look, we've, we've solved lots of problems from
9:25
endpoint to network to securing multi factor, but we really
9:29
haven't solved the hardest problem in identity, which was
9:31
principle of least privilege. And and so, you know,
9:34
essentially with these are what S S Phil noted, you know, we
9:37
started the company in 2025 years old, really have taken
9:41
that mission to heart on on helping organizations really
9:44
thrive towards the principle of least privilege, which is in
9:47
simple words, who's Jim and what can he delete in snowflake or,
9:50
or who's Jeff and what can he delete in article table?
9:53
And so that's essentially what, what what Wiza started with,
9:55
what we want to go build is a, you know, our long term vision
9:59
or act one, act two, Act 3 is really rooted in how can we
10:03
build that next generation identity platform, which takes
10:07
me to your question of differentiation, you know, which
10:10
was as we started digging into principle of least privilege,
10:15
you know, what became very clear to us is the world believes
10:18
directories and identity and, and how fallacy that that that
10:22
thought is because that's not the truth.
10:24
The truth is, you know, the purest form of access is
10:28
actually permissions and entitlements.
10:30
And so we said, you know, look to back to your differentiation,
10:34
the way we speak with CIOs and Csos and Ctos is like, look,
10:37
identity has to go beyond a directory service.
10:40
We believe the purest form of identity is in permissions and
10:43
entitlements. We have built this beautiful,
10:46
what we call a durable data model and and data model, which
10:49
is realized as access graph really to help understand who
10:53
are the humans and the non humans or even third party
10:56
identities and what can what action can they perform on
10:59
critical systems, whether it be SAS, whether it be data systems,
11:03
whether it be cloud systems and now agenda AI apps.
11:06
And so essentially our differentiation, Jeff, is really
11:09
in that data model, we call it the access graph, which really
11:14
brings the entitlements for that individual into this beautiful
11:20
data structure, for lack of a better word on which you have
11:22
built. Lots and lots of apps.
11:24
Visibility, intelligence, access, reviews, we have built
11:27
these apps on top of that data model to really again go solve
11:30
business use cases and business problems.
11:33
So the other thing that is you guys are making some news today,
11:37
you know, when this episode releases.
11:38
Tell us a little bit about what's happening in the world of
11:40
Asia. Yeah.
11:41
No, look, we, we, as I noted, we've been very hard at work for
11:44
the last five years. You know, you know, as Phil
11:46
noted, we have, we have had the Fortune opportunity to partner
11:50
with some very large Fortune 100, Fortune 10 organizations.
11:54
It's become very clear, you know, after partnering with such
11:58
organizations across both enterprise and commercial that
12:01
we truly are solving a critical, critical problem in, in, in
12:05
cyber at large, right. Again, principle of free
12:07
privilege. So, you know, the time had come
12:10
for us to really double down, triple down.
12:12
You know, we start-ups are all about product market fit.
12:15
We feel like we have a great product market fit.
12:18
And so, you know, we're announcing today our CDSD
12:21
investment of $108 million financing which you know, double
12:24
s our valuation from from the last time we did our CDC.
12:29
And, and really this investment is, is, you know, a very
12:32
grateful to the to the new investors, NEA and Aaron
12:35
Jacobson and Hillary from, from the NEA team to, to sort of
12:38
believe in the mission and the vision of the team, but also to
12:41
sort of double down and triple down what could be what we
12:44
believe could be a very, very long lasting company.
12:48
Tarun, congratulations on that and I'm glad you're finally on
12:53
the podcast. We've had Rich Dandelaker on a
12:56
couple of times. Those have been some of our best
12:59
episodes. And you mentioned how we bumped
13:02
into each other at Gartner. And I've got to say, your booth,
13:07
there are probably two companies that made the most noise of
13:09
Gartner and, and Basil was one of them.
13:12
And your booth just constantly had people there.
13:16
I mean, First off, your, your logos, even on your website were
13:21
out of this world, but I knew a lot of the people who were
13:23
coming to your booth and it was like super impressive.
13:26
So congratulations big time. I think it's, you know, you're
13:31
on to the right thing at the right time.
13:33
Now, what do I mean by that? The identity security company,
13:37
right? And so that this is the time for
13:40
that. That's what everyone's talking
13:41
about and there's good reason for that.
13:45
And I'm going to actually turn this into a question for Phil.
13:49
So identity security, it's like identity is front and center
13:53
when it comes to security. And Phil, I wonder if why is it
13:58
that now this is hitting so hard?
14:02
But yeah, I mean, I think it's it's really to do with just the
14:06
breadth of what identities and missions and access and
14:10
entitlements companies have to deal with.
14:13
So they've got their traditional on premise environment, they've
14:17
most often got multiple cloud environments.
14:19
They've got multiple SAS services, some of which are big
14:22
data warehouse services. There's a whole array of things
14:26
now and coming with AI that has a whole series of human and non
14:33
human identities. So when you take a step back and
14:36
you think about this problem, there's a set of human and non
14:40
human identities that have access to various resources and
14:44
organisations just need to answer the the relatively simple
14:48
question of of what, you know, what or who has got access to
14:52
war and is that appropriate? And is that actually implemented
14:56
according to the intent that we have now, all of us and probably
15:00
a lot of the audience today have, you know, been in this
15:03
battlefield of identity security for long enough to know that.
15:06
Yeah, just stating the problem quite simply like that.
15:10
When you put that against the backdrop of the scale that even
15:14
small to medium enterprises have to deal with in terms of their
15:18
number of systems that contain access and privilege and
15:21
identity and all of the external services that you then need to
15:25
just handle that scale in a way that doesn't require manual
15:29
reviews or tedious updates. You just kind of manage this and
15:34
automated systematic way and to what Taroom was saying before.
15:38
Ultimately, and this is where a lot of organizations have failed
15:42
in the past, if you don't architect this for the scale of
15:47
trillions of combinations of accesses that can only be
15:51
encoded in like an access graph like they have, then you're
15:55
ultimately, even if you've got a great little system for dealing
15:58
with a small number of privileges, ultimately is going
16:00
to fail. If you can't scale that kind of
16:03
graph scale processing of of the massive amount of combinations
16:07
of accesses that you have to monitor adherence to, even in
16:12
just the smallest of enterprises.
16:13
And that's really, I think what what everybody's dealing with.
16:16
And I think why to your point, people are flocking to the Boo
16:20
that things like Gardner is they've tried solutions that
16:23
don't scale and they just need a solution that scales to cover
16:26
all of their identity and access requirements.
16:28
And that comes down to the data model.
16:31
Yeah, I definitely have sent the data model.
16:33
But you know what I really love with you said there, and this is
16:36
what I I love about you, Phil, is that you can take these big
16:40
difficult concepts and put it down to something simple, right
16:44
And and. So true.
16:46
Yeah, yeah. So that, that is super cool.
16:50
That's true. What what might you add to what
16:52
Phil just said? If you can add anything.
16:55
Yeah, no, no, no, I think, I think Phil is actually spot on.
16:57
You know, this this whole gem, maybe I can just share a couple
17:00
of examples from, from organizations that that we work
17:04
with, you know, just sort of give some examples.
17:08
You know, we, we, we see sort of, you know, to me, you know,
17:12
for lack of better or these sort of use cases, right.
17:16
Who has access to what and what can they do with that access is
17:20
like #1 in your any organization, like whether it's
17:23
a Fortune 500, Global 2000 or a commercial organization, right?
17:28
So we see, you know, use cases sort of in the following order,
17:31
Jim, just to give you some couple of practical examples,
17:34
working with a very, very large financial organization and their
17:37
entire use cases about identity hygiene.
17:40
And they're like, look, we have these users, users about part of
17:43
groups and groups have roles, as Phil noted below before.
17:47
And you know, roles are embedded within roles.
17:49
Can somebody just, you know, demystify this and give us a
17:52
very simplistic view on, on who has access to what role in,
17:56
let's say a system like Salesforce, right Second.
17:59
So 1 is very high hygiene, identity, hygiene, AD hygiene #2
18:05
you know, an example of, of an organization like a Blackstone,
18:08
right? There were a large Fortune 500
18:11
organization where they were doing all their access
18:13
governance, their identity governance on, on, on
18:16
spreadsheets. You know, as, as Phil noted,
18:18
there are, there are not many people have cracked this
18:20
problem. And so people are either living
18:23
in, in, in, in PowerShell scripts or they're living in
18:26
Excel spreadsheets, or they're architecting their own solutions
18:29
for organizations that can, that can do that.
18:31
And so Blackstone had architected a solution clues
18:34
together in ServiceNow and we've completely transformed them in
18:37
three years here. There were about 5 to 500 apps.
18:41
Think of a Fortune 500 organization configured on Visa
18:44
for things like access reviews, things like access provisioning,
18:46
deprovisioning, give you another example of a large organization.
18:52
You know, think of an Intuit like they are are first of the
18:56
10 customers, 1st 10 customers for us.
19:00
And they're like, look, we love this access graph you have, We
19:02
love this data model. Can you go and apply this to us
19:06
to help us secure our GitHub? And we're like, why, Why do you
19:09
want to us to apply this to GitHub?
19:12
And they're like, look, it's the biggest asset we have in the
19:15
organization. All our cord is in GitHub And so
19:18
all our IP is in GitHub. We, we cannot let it get into
19:21
bad hands. And so we want to, you know, we
19:24
want to measure the permissions and the entitlements who has
19:27
access to it. And we want to keep driving what
19:29
they're called as over permissioning access score.
19:32
We need to keep driving that access score of over
19:35
permissioning down to 10%. So just a few examples to to Jim
19:38
to to add to work fill share. So I, you know, this, this
19:42
concept of least privilege sounds simple, but it is
19:45
actually pretty hard to do in the real world.
19:47
And this is how I know we got serious.
19:49
Jim Tarun took off his glasses. It's like now we're really
19:52
getting into like the deep end of it.
19:55
Tarun, this is such a hot spot right now.
19:58
Is this whole concept of identity security right?
20:00
And obviously we're big fans of it here.
20:02
You mentioned some of the issues that you typically see and Phil,
20:05
you mentioned some as well. It's kind of like why we're
20:06
having this moment in the sun. But I'm curious, what do you see
20:11
as like the biggest identity challenge today that you're
20:14
seeing in organizations Immediately?
20:16
I think of things that are coming up this year that are
20:19
also having moments on like NHI, non human identity.
20:22
It seems like it's the buzzword at every conference.
20:24
It's like everyone's kind of talking about.
20:26
But I also think about it from a less technical standpoint of
20:28
just the fragmented ownership of the way that organizations may
20:31
typically be structured from like a governance perspective.
20:35
You know, you'd be surprised how many organizations go into and
20:37
say, so who's responsible for identity?
20:39
And, and people don't know, right?
20:41
Or it's fragmented and this person's responsible for this
20:44
part of it and that person's responsible for that part of it.
20:47
I'm curious if those examples make sense.
20:49
Do you see additional challenges that are out there and, and what
20:53
should you know people be aware of and cognizant of say, OK,
20:56
these are some of the challenges that that other people are
20:58
seeing as well? Phil, you want to take that for
21:00
us? Yeah, Yeah.
21:01
I, I mean, I think you know what's, what's fascinating is,
21:04
is again, it's this combinatoric explosion of all of the possible
21:08
accesses. So I mean, every time a new
21:12
system is brought online, the new SAS provider is signed up, a
21:17
new cloud provider is signed up to a new device is added, or
21:22
it's just another set of identities.
21:24
If they're not human identities, they're the non human identities
21:27
you bring up and then you add that and then all of those
21:32
things, they connect to the human or the other non human
21:35
identities. All of them connect to resources
21:38
that have emission various degrees of permissions, often to
21:41
Tyrone's point before that are nested very, very quickly.
21:45
This just explodes and the ability to encode all this in a,
21:51
in a, a data structure like a grass, it doesn't just give you
21:54
the ability to think about whether that is conforming at
21:58
the scale of what any reasonable enterprise is.
22:01
It lets you kind of pivot up and down the questions.
22:03
So like, for example, you can say, you know, is this
22:07
particular access appropriate? Or you could actually invert the
22:11
problem and say, tell me the top 50 people in my organization
22:16
that have the most privilege. And you can almost guarantee,
22:19
and I'm, I'm sure you've had experience of this is in most
22:22
organizations, if they just ask that question, tell me the top
22:25
50 people or the top 100 people that have the most privilege.
22:28
The answer when you see that is like, holy cow, who gave them
22:32
all access? And and so the nice thing about
22:36
a scaled solution as opposed to one of these more traditional
22:40
solutions, that's just kind of, you know, people reviewing
22:43
things in spreadsheets or going through AGRC tour or going
22:46
through something that's like human reviewing other humans
22:49
accesses. You need to be able to ask these
22:52
questions like who's got this privilege?
22:55
Who's got the most access? If this credential is
22:58
compromised? What's the chain of attacks
23:01
through the the identity graph that could result on an action
23:05
on a critical resource? All of that kind of stuff.
23:08
I mean, one of the things that's fascinating and you know, Tarun
23:10
knows this as much as anybody, is every customer use case
23:13
advasor it's like every customer almost invents their new set of
23:17
questions that are peculiar to their risks that other customers
23:22
can learn from in terms of why that's a really interesting way
23:25
of getting to the most risk and figuring out how to reduce their
23:28
risk. No, absolutely.
23:30
And, and Jeff, if it's OK with you, just to add, add to what
23:33
Phil just shared, you know, you're absolutely right.
23:36
First of all, non human identity is definitely top of mind #1 #2
23:41
you know, I'm here in Seattle meeting some of some of the,
23:43
some of the large organizations and, and you know, just just
23:47
today, just finishing a few discussions, you know, it was
23:52
the four use cases, you know, that come out every day that we
23:56
hear. Number one, there is no
23:58
centralized non non human identity store.
24:01
So can you please help us just understand the access tokens and
24:04
the service principles and the service accounts and even things
24:07
like local users who gave, for example, Jim in local user in
24:13
GitHub, like who did that right? And and finding that for So
24:16
that's number one. Number two that we're hearing on
24:19
non human is, is age, age of a age of a non human.
24:22
When was the last time we we rotated the key and and and the
24:27
third one is, you know, association of human to non
24:29
human, right? It's a very hard problem
24:32
actually too, because non human is many times, if not majority
24:35
of the times, efferminal in nature.
24:37
And so you know, Jim, for example, is is in Active
24:40
Directory. He spins up an EC2 instance,
24:43
logs into a cube instance and and wants to go access
24:45
something. You know, if you if you think of
24:48
again to the first point of that chain of chain of attack, you
24:51
know, which is which is what is top of mind of customers is like
24:54
look who who actually owns this non human, because we need to go
24:58
and and clean that relationship and and figure out how do we get
25:01
back to least privilege. Yeah.
25:03
And actually that's fascinating because This is why I think it's
25:06
important for identity solutions to deal with human and non human
25:11
identities together. One of the things you get if you
25:14
go back a few years, you they they were often somehow and
25:18
maybe still out today, different product sets.
25:21
And one of the things I think Vase has done that's interesting
25:24
is bring this together because often when, as Truman points
25:28
out, when you're reasoning about a non human identity, you're
25:31
connecting it often to a human identity that has the control
25:35
and ownership over a set of resources that are accessed by
25:40
the NHIS. And I.
25:41
And I think it's it's it's they have to be managed to get and
25:45
that's going to be even more important in a world of AI
25:49
agents where the humans are delegating privilege to agents
25:55
that will act on their behalf, that will in turn interact with
25:58
other non human identities to fulfill goals on resources.
26:03
And so this is going to be even more important to make sure it's
26:06
a holistic management of identity and access, governance
26:10
and security. So, Tarun, you know me.
26:16
You trust me with standing privileges, right?
26:19
I'm trustworthy. No, we don't want to hear about
26:22
the Zero Trust. No, we hear it.
26:24
You know, we, we heard two things right on those words.
26:27
Zero trust is incomplete without principle of least privilege.
26:30
And you know, my, my deepest thanks to Phil.
26:33
You know, he's the one who helped us think through this
26:35
very clearly. As you said, Jimmy's.
26:38
That's the pleasure of partnering with Phil.
26:40
He says things in such a simple way #2 the residual access and
26:44
persistent access needs to go away to to your point.
26:49
That's right. It's, it's what you just said
26:51
there. And then when you think about
26:53
the non human identities and then look as as a practitioner,
26:58
I've been a practitioner for over 20 years, you think, well,
27:02
well, I've got a toolbox. It's got XYZ tools in it.
27:07
I'm going to choose from my tools to solve this problem, but
27:11
the problem is different than what your tools were built to
27:15
solve, right? And so when I look at NHIS, not
27:21
literally, but I think about it, I'm like, OK, that seems the
27:24
most like privileged access management.
27:27
So maybe can I just throw a privileged access management
27:29
tool at it? But I, so I have a question for
27:32
Phil because I think for a practitioner perspective, just
27:35
think about privileged access management.
27:37
It seems like the landscape is changing, or maybe it's not.
27:41
Maybe I'm thinking about it wrong, but it's always been
27:45
notoriously hard to solve privilege access management.
27:50
So I wanted to get your perspective on why is that so
27:54
hard to do, especially at scale. Like why do why do the wheels
27:57
come off when you try and do privilege access management in a
28:01
large enterprise? Well, well, it, it's
28:04
interesting, it kind of touches on where we were going before,
28:06
which is it's hard to unpick these identities these days.
28:10
So like, you know, if you go back, I don't know, 10 years ago
28:13
when you talk about Pam, really what you're talking about is
28:17
managing say root access on unit on Linux servers, managing
28:23
significant privileged accounts on Windows infrastructure or
28:27
managing SSH, you know, credentials for significant
28:31
privileged access. And I think the interesting
28:34
thing now is when you look at how all of those privileges have
28:38
been broken up into service account keys and machine
28:43
credentials and all of this other environment, it's hard to
28:47
distinguish between what's Pam and isn't Pam because, you know,
28:51
sort of beauty is in the eye of the beholder.
28:53
It's like you could have something that's classically not
28:55
Pam that suddenly becomes a very highly privileged account
29:00
because the way you've overloaded the privileges onto
29:03
it. And therefore it just almost
29:05
makes no sense anymore to have like a patent solution and a non
29:09
human solution and a human solution and this solution.
29:13
You've got to deal with it all together because at any one
29:15
moment a historically non privileged account could become
29:20
a civilly privileged account. And unless you're picking that
29:23
up and controlling that as part of the whole identity graph, you
29:28
know, it's hard to stay ahead of that.
29:30
And I think ultimately we just got to think about identity and
29:33
access security is this, it's the whole environment.
29:38
And you ask some questions of the identity graphs that you've
29:42
built up to let you control the whole thing, because otherwise
29:45
you just curve to living in silos.
29:48
And as we all know from brutal experience, sometimes personal
29:52
experience, the attacks come in the seams between the silos, not
29:57
full from all onto your controls.
29:59
And so having this evasive view of everything is just absolutely
30:02
critical. Yeah, through the seams.
30:05
I, I like to use the analogy as the attacks are like water.
30:09
They find the cracks. They they, they find their way
30:12
in and then of course, if you're in a cold environment, they get
30:15
in and then they freeze and break up your foundation.
30:19
And I think you're right. And I, I, I think back to some
30:22
of the early days with Pam where we, you start getting into,
30:25
well, are you DVR style recording your sessions?
30:29
It's like. Who cares?
30:32
Right, that's like. Yeah.
30:35
No, we. We.
30:36
Term. What do you add to that?
30:37
Yeah, No, no, I was, I was going to take that word of recording.
30:40
You know, we, we, you know, we live used to live 10 years ago,
30:42
maybe 15 now. You know, we used to live in the
30:45
world of or we still probably live in the world of session
30:48
recording and session management.
30:50
But you go back to those customers and have those
30:52
discussions with them as like for work, right.
30:56
And, and this architecture of going back to the, you know, we
31:00
have this point of view that at the end of the architecture will
31:03
sort of win at the end, which is, you know, take an example of
31:07
Snowflake, take an example of data breaks.
31:10
You cannot go deploy an agent in a cloud native system like a
31:14
Google big Query, right? And so who's going to do session
31:17
management and session recording?
31:18
My point I guess is a gym privilege access in the cloud or
31:22
Pam in the cloud or Pam for SAS or Pam for a gentek is not going
31:27
to have the architecture that we had before.
31:29
I'm going to deploy a proxy in an Oracle server.
31:32
It's going to record every action that I'm performing.
31:34
That world is not going to be going forward.
31:38
That's right. No, I mean, I think I think
31:40
you're right on that because you know, we all know the immutable
31:43
infrastructure patterns and the need for declarative controls of
31:48
code policies, code infrastructures, code 1 of the
31:51
things I think, well, there's still use cases for session
31:55
recording and other things. They're typically seen in legacy
31:59
environments where organizations are for whatever reason, not
32:03
been able to adopt these kind of immutable infrastructure
32:06
patterns. And then when you've got those
32:09
immutable infrastructure patterns, it even further
32:12
highlights not just the need but also the opportunity for least
32:15
privilege. Because then you you're making
32:17
sure that the slight reliability engineers, the cloud
32:21
orchestration engineers, the development engineers, the
32:24
security engineers are all working on the same page to
32:26
actually minimize the privilege that drives not just improvement
32:29
in security, but also consequent improvement in reliability.
32:34
Because you're then minimizing privilege to force people
32:36
through the immutability infrastructure patent as well.
32:39
Correct, correct. And, and Jim, I'll just say last
32:41
thing quickly there. You know, the same customers we
32:43
speak to, they're like, look, you know, we're buying a Pam
32:48
solution because it says so in, in a, in a NIST playbook or some
32:52
form of a playbook. But, but nowhere it says you
32:56
need to do so, you must do session recording.
32:58
Nowhere it says you must do session management.
33:01
You know, it just says you must do privilege access.
33:02
Well, that doesn't mean you have to do session recording.
33:05
It could be simply Ganesh or Vartic, right?
33:07
So, so it's just, it's I think that that world of just back to
33:12
identity, you know, evolving very fast pace.
33:14
Similarly, the world of privilege access is evolving at
33:16
a very fast pace. I'd like to get a little bit
33:19
about axis graph because as I mentioned a couple times here,
33:22
it's obviously secret sauce. I think maybe a little bit for
33:24
how this works. Tell me a bit about axis graph.
33:28
What makes it unique? What can I see with it?
33:32
What can I do with it? And then the bonus part of that
33:35
question is you mentioned least privileged earlier, so how do I
33:39
use access graph to get to least privilege?
33:42
Yeah, I know. I think those, you know, thank
33:44
you. Thank you Jeff for, for, for
33:45
asking. So, so I think look, first,
33:47
first with the access graph as, as you know, Phil, I had noted
33:49
earlier, you know, access graph is a manifestation of a data
33:54
model of the data structure, right?
33:55
So, so just to zoom back and then we'll zoom in.
33:58
You have entitlements everywhere you know, Phil has access to 30
34:02
different systems, let's say so Phil has entitlements to 30
34:05
different systems. And so you know, applying a
34:08
first principles thinking, if we are truly want to ask the answer
34:12
the question who can perform what action on what data?
34:17
You just start breaking their problem down in first
34:18
principles. Who comes from your identity
34:21
systems like an Active Directory or an Octa or a ping or a duo
34:26
or, or pick your, pick your critical identity systems.
34:29
And wherever Phil has access to, he has, he belongs to certain
34:32
roles. We used to have this framework
34:34
called role based access control.
34:36
That paper, the Seminole paper was written in 1982.
34:39
I think of, you know, if anybody needs access to a system, you go
34:43
through what is called role based access control.
34:45
So, you know, we, we said, OK, if you want to take who can take
34:49
what action on what data, apply first principles.
34:53
And, and that became the data model.
34:55
And, and we called the data model.
34:57
Not many people can understand data model.
34:58
So we ended up calling it an access graph.
35:01
But but think of access graph under the horde is, is a data
35:04
structure, a normalized, A canonical data model, which
35:08
takes entitlements from 10 different unique systems and
35:12
brings it down to a normalized data structure, right?
35:16
So that's what an access graph is.
35:18
Now you can imagine the, the, the art of innovation, the, the,
35:22
the IP and, and the Seminole innovation is, you know, as as
35:26
fully used the word combinatrix, right?
35:30
A user belongs to a group. Well, you could belong to 10s of
35:33
groups. You have access to hundreds of
35:35
systems. Every system could have 10 or
35:38
different roles. Each role may give you M number
35:41
of entitlements to perform to N number of resources, right.
35:44
So if you think about in a in a classical computer science,
35:47
you're, you're, you're thinking about a data structure where
35:50
every element is to the log of scale, right?
35:54
And so you're thinking about NP hard problems, you're thinking
35:57
about, you know, computational problems, which are at a log or
36:04
an exponential scale, right? So, so that's where that's where
36:07
our, our, our so-called the secret sauce.
36:09
And see is the word is, you know, how do you, how do you
36:13
stream the data? How do you parse it?
36:15
How do you store it in a, in a data store?
36:18
And how do you query it in near real time?
36:21
Imagine that data set, right? I'll give you an example.
36:24
Our access graph only up to 18 months ago, Jeff, was 200
36:28
million nodes and edges, 200 million nodes and edges.
36:33
Today our access graph has 16 billion nodes and edges.
36:38
And and you know something Phil and I talk about all the time,
36:42
you know, the pace that we're going will have 100 billion
36:45
nodes and edges in less than two years.
36:48
So, so that you know, that problem is of cardinality is the
36:52
word we use the the problem is of very intelligent algorithms,
36:58
graph traversal algorithms, and the intelligence is how to
37:01
define the scheme of the data model.
37:03
So that's where our core of the IP and and we believe, you know,
37:07
speaking very humbly, we believe it's industry first.
37:10
You know something Jim said earlier, you know, back to NHIS,
37:14
if I can bring it here in this, this, this, this security leader
37:18
said it in a very beautiful words that on real problem and I
37:22
have no tool that can solve that problem.
37:24
And this is like Fortune 100 actually Fortune 10.
37:28
I want to know where my NHIS are.
37:30
I have every tool in my toolbox, the Pam solutions, the IGA
37:34
solutions, the IAM solutions, the and I have no tool and
37:38
therein lies the opportunity, right?
37:40
Taking that graph and applying it and sorry, what was your
37:45
second question, Jeff? I got, I got fashioned about.
37:48
I think you covered, I think you covered all of it.
37:50
I was curious like what is this thing?
37:52
How does it work? And.
37:53
Oh, sorry. Yeah, I remember.
37:54
I remember your question. Sorry.
37:56
Yeah, I got your question of how to release.
37:57
So, you know, once you have that baseline of who has access to
38:00
work. And again, there's something,
38:02
you know, Phyllis coaching, I said, you know, once you have
38:04
their baseline is not enough Phyllis on our board.
38:06
And and so the other board members are like, you have to
38:09
get into actionability very quickly.
38:11
And so our phase are Act one, you know, very classical startup
38:15
language or Act 1 was visibility intelligence is working very
38:18
well for us. And our Act 2, which we started
38:20
about 18 months ago is about actionability access reviews.
38:24
You define a baseline, you define a policy and you monitor
38:28
the deviation or a drift or a creep and and you and you do
38:33
active operationalization on it, right.
38:35
Could be a service, not ticket, could be AG re ticket, could be
38:39
a solar platform orchestration. So that's how we're we're we're
38:43
in the process of sort of pruning the over permissioning
38:45
access. You know, I'm so interested in
38:48
this topic of identity security. So if I can pull the
38:51
conversation back to that and ask Phil, you know, kind of from
38:55
from what he's seeing in his own organization, talking to his
38:59
peers, you know, I'm, I'm thinking about identity security
39:03
and OK, I'm going to start with my extra credit question.
39:06
Phil, my extra credit question is, is it the identity
39:10
practitioner who needs to change, adapt, learn new skills
39:16
to do identity security or is it folks in other areas of
39:22
cybersecurity who need to learn identity?
39:26
The, the other question is, OK, when you start to put together a
39:30
program around identity security, like what are you,
39:34
what are you driving toward in terms of key metrics, OK, Rs
39:40
KPIs like what, what is it that you want to show the
39:44
organization that hey, I talked to you about we're going to do
39:48
identity security, assuming that's how you have the
39:50
conversation and we're going to send a couple of $1,000,000.
39:53
What? What do we get for that money?
39:56
Yeah. I mean, I think what's
39:57
interesting about this problem is identity is in many
40:03
organisations is kind of split up across various teams and
40:07
there's often, no, very rarely is there consistent organization
40:11
on that. So you may turn up at a bank and
40:13
they've got like an identity security team inside the CSO
40:17
function. You then go to a different bank
40:19
and they've got it in the. DTO or the support function,
40:23
then you go to a pharma company and they've got in a different
40:26
team. I think the main thing we're
40:28
seeing though is for most organizations since they
40:31
recognize this has become such a challenge or they did recognize
40:36
that and then they're solving it.
40:38
And essentially what they're doing is they're building this
40:41
into their environment rather than bolting it on after the
40:44
fact. And so a combination of the CSO
40:48
and the CTO or CIO are driving an integrated identity and
40:53
access governance process that's treating this as an enterprise
40:57
wide risk management problem that not only manages security
41:01
risk, but it delivers transformational efficiency
41:04
gains. Because often in getting this
41:06
right, they're reducing the need for Dublin, if not hundreds and
41:12
in some cases the thousands identity and access
41:14
administrators that are doing all this manually.
41:16
And so this is one of those beautiful spaces compared to
41:21
some other spaces in security where you can do security
41:24
productivity efficiency and save money all in one go rather than
41:30
having to just increase all of them when doing security.
41:33
And I think to your question about the metrics, So one of the
41:36
risks though with this is, you know, as I'm sure everybody
41:39
knows, it's easy to drown in hundreds of different metrics on
41:44
these things. And I, I, I like to kind of
41:47
elevate this up. And now you do have to get to
41:50
the detail. But the simple level though,
41:52
success or failure for me of identity programs in, you know,
41:57
small, medium and, and especially large organisations,
42:00
it's really about three things. It's like 1 is coverage, but
42:05
what percentage of your universe of identities do you have under
42:10
central management or at least central visibility in a tool
42:16
like Vaser or, or something else?
42:19
So that's coverage. And, and as you know, if you
42:21
know, you could probably kill yourself nearly trying to get to
42:24
like 100% coverage. So many of these things may not
42:27
the goal may not be 100%. It may be 100% of your most
42:30
critical systems, 70% of these other systems, then a long tail
42:34
of other things to pick up. But it's important to understand
42:38
where you're at on, on the percentage of coverage.
42:40
Then once you understand the percentage of coverage, it's
42:43
what's your percentage of adherence to enterprise
42:47
policies. These could be least privileged
42:50
policies, it could be privileged scoping policies, it could be
42:55
our back, a back separation of duties.
42:57
But basically once you've got all your coverage, you need to
43:00
know what of those identities and access conforms to your
43:04
enterprise policies. Now the third and final thing is
43:08
what you might call accuracy, which is Harlow's enterprise
43:12
policies that you're driving adherence to, do they actually
43:15
represent what your business risks are?
43:18
So like for example, you could have everything under control,
43:22
everything under access management and it looks great,
43:25
but everybody's massively over permissioned because we didn't
43:28
express your business rule according to your actual risk.
43:31
But I think ultimately, if you an organization just really
43:34
understand where they're at percentage wise on that journey
43:38
to full coverage, full adherence and then an accurate statement
43:44
of whether your policies conform to your business risks.
43:47
I mean, that's that's a decade worth of work there.
43:50
But hopefully Vaser makes that like 18 months or two years
43:54
rather than a decade. And and Tarun, I'll follow up
43:58
with you and we got to make a quick answer here because if we
44:01
don't get this next question in, Jeff might up and quit because I
44:04
know he wants to talk about AI, but can Visa basically provide
44:10
the information that Phil just went over in terms of?
44:12
Coverage absolutely no. We, we you know, we have taken,
44:15
we've taken that construct of access policy and a set of
44:19
access policies and we have codified.
44:20
So you know, meaning the user journey to to to simple answer
44:24
to your question, the user journey that we aspire to give
44:28
as you connect wizard to your 5 or 10 critical systems.
44:31
And we want to give you very quickly those access policy
44:34
risks, right? And they are baselined against a
44:38
least privilege risk and over permission risk in on human
44:41
identity risk, a global admin risk that you can then go act
44:45
very quickly, Jeff to your point of least privilege.
44:48
OK. So I'm glad Jim is giving me
44:49
just a minute to ask an AI question.
44:51
And so I want to turn to you because I, I'm curious what you
44:55
think is going to be the biggest impact that AI and specifically
44:59
maybe generative AI is going to have on an identity security
45:02
practice. What should I, what should
45:04
people be listening for when it comes to these are impacts we
45:08
should be aware of? Well, I think it's, it's, it's
45:11
two things, it's opportunities and risk, just like with most
45:13
things to do with AI. So first, on the the opportunity
45:17
side, I mean, I think the the use of AI tooling to analyze
45:23
large amounts of data to be able to translate human express
45:28
expressible policies into machine readable code that can
45:33
help you manage your access policies.
45:36
We're just seeing that all the time.
45:39
And it may not even just be things like large language
45:41
models to help with that. One of the nice things about
45:44
having an access graph data model is this technology like
45:47
graphs, neural networks that let you look for anomalies of access
45:52
and clustering of privilege that may be anomalous at graph scale.
45:57
And so there's a lot of opportunities to apply AI to
46:00
help people productivity productively manage the risks
46:04
associated with, with all of their complex privileges.
46:09
On the flip side, though, one of the things we're seeing, and I'm
46:12
sure everybody's starting to kind of project this forward in
46:15
a world of, of AI agents acting on behalf of people or behalf of
46:22
systems. We're going to see an even
46:25
bigger amount of non human identities, identities
46:29
associated with with agents, identities associated with back
46:32
end systems. And we're again just about to
46:35
see an explosion over this year and the coming years on the
46:39
amount of AI agents that individuals have, that companies
46:42
have, that systems have. And it's again, things like the,
46:47
the model context protocol standards that that, that that
46:50
came out late last year from Anthropics that many companies
46:54
are adopting provides this standard layer by which services
46:59
can implement accessibility and connectivity from AI agents is
47:03
going to even further add to that.
47:05
One of the things that's going to be fascinating is on things
47:08
like MCP, the model context protocol.
47:10
There's much work still to be done on identity access and
47:15
authentication in that layer. And I think that's where a lot
47:19
of solutions are going to be needed.
47:20
And again, like we talked about before, you can't really think
47:24
about that as a unique solution just to manage AI identities.
47:28
And it's so intrinsically embedded.
47:30
For example, if you have an NCP server that's going to connect
47:34
to a tools API gateway, that's a bunch of non human identities,
47:40
you can't all of a sudden have an AI, you know, privilege
47:43
management system that has no concept of all the other non
47:46
human identities. It just, it would be yet another
47:49
silo like we talked about before.
47:50
And so positioning an environment where you've already
47:53
got your your human identities, your non human identities to add
47:57
into the mix, your AI agent identities that act as delegated
48:01
permissions from your human identities or your system non
48:04
human identities. Having that in the mix and the
48:07
graph is going to be important. And if you can't scale that, the
48:11
scale of AI agents is just going to be, you know, off the charts
48:14
even compared to where we're at today.
48:17
And I don't think there's many solutions out there,
48:19
particularly the ones that haven't built for this scalable
48:22
grass that are going to be able to cope with that.
48:25
So I think that MCP or model context protocol is one of the
48:29
more important developments to come along because otherwise we
48:32
run into the risk of data silos again, which is kind of where
48:35
we've been. It's almost like, you know, that
48:37
group and I'm going to simplify it for my fetal brain and we're
48:40
going to have to do a whole separate episode on this.
48:41
But it's, it's almost like you're developing a standard for
48:44
how should these AI's talk to each other?
48:47
Can they speak the same language?
48:48
It's, it's like USB, everybody uses a USB port or, you know,
48:52
it's like Olaf or SAML or something like that, right.
48:54
Where there is a, there is a common way to talk to each
48:57
other, which I think is hugely important to be able to share
48:59
information back and forth. So I am totally all into having
49:03
a, a conversation about that. But I want to pitch the last
49:06
question to Tyrone and this is my, my AI at the center
49:10
question. Where is Ibiza at from AAI
49:14
perspective? How are you guys leveraging it?
49:16
What is your overall look forward on on how you see this
49:19
impacting your organization and your product?
49:22
Yeah, Well, thank you. Thank you, Jeff.
49:23
I, I will try to again keep it, keep it quick.
49:25
You know, again, having having somebody like Phil on the board
49:30
sort of helping us think through N + 2 N +3.
49:33
You know, we launched a brand new product called Access AI.
49:38
You know, Phil is a big proponent for for me and my Co
49:40
founders to be thinking about those things very early.
49:42
So we launched Jeff to to your question, we launched Access AI,
49:47
which is which is our generative AI solution.
49:50
You know, again, if you go back to the fundamental question that
49:53
you're trying to answer, who can take what action on what data,
49:57
you know, imagine that as natural language.
49:59
Imagine that what you do on ChatGPT and prompt engineering
50:02
based, right? So, so we launched a new
50:05
product. It was geared, the first app
50:08
that we built on Access AI is for search.
50:10
So now you can come and ask a question.
50:13
My AD user whose location code is in China, can they access
50:17
data in Salesforce? Access AI allows you to ask
50:22
those data sovereignty questions, right?
50:25
And, and so the next, you know, the, so we're building apps on
50:28
top of access AI. It's, you know, built on top of
50:30
bedrock. You can, you can imagine all
50:32
the, all the good things that enterprises care about.
50:35
The next app you're thinking, of course, is, you know, we are now
50:38
customers saying that look, you've done so much for access
50:41
reviews, you know, approve and reject.
50:45
I belong, you know, I have access to something and did
50:47
approve my access or not. And they're like, can you apply
50:50
access AI where if I get a quarterly access review, I hit
50:55
the access AI button, it tells me from the 100 entitlement
50:59
reviews I have to do, I only have to pay attention to the
51:01
five, you know, again, filter for, you know, signal and noise.
51:05
So it's a really good product. It's a new beginning for us.
51:08
And now if you think of the agentic AI Jeff, with, with
51:11
what, what Phil was sharing earlier, you know, now we're
51:16
going into the world, we get a notification.
51:19
Now we can respond to it, right, with the agents versus just a
51:23
notification that you're running late for a meeting.
51:26
Now you can start to talk to it. And if those two agents, the
51:29
only common entity, the only common attribute is actually
51:33
permissions of entitlement. So we're actually very
51:35
fascinated, You know, I'll even spill some beans, you know, just
51:40
just three weeks ago, 4 weeks ago when we met with Phil, you
51:45
know, he encouraged that, look, this is going to be such a
51:47
transformational Seminole force that you should perhaps think
51:52
about, you know, setting up subsidiary and just heads down
51:55
focusing on on access here. That's the focus that will be
51:59
needed. So there's something on that.
52:01
Maybe the future, you know how much we're going to embrace, you
52:04
know, by by by by putting our focus and team around it.
52:08
It's clear that there is so much more room for innovation at this
52:10
point. And I love what you guys are
52:12
doing. And I'm a big fan of the AI
52:14
stuff. So things that make our lives
52:17
easier are things that I'm interested in.
52:20
And there are so many people out there that are still spending
52:23
their time pouring over spreadsheets.
52:26
Phil, here's a list of 500 people who have access to this
52:30
weirdly named Active Directory group that nobody knows what it
52:34
does. And it's nested in underneath
52:35
four other different things. Hey, Phil, does that look right
52:38
to you? And Phil, you know, no offense
52:40
to you, you don't know what you're looking at, right?
52:43
So I think there's a a huge opportunity to humanize the way
52:47
identity's done. And I love what you guys are
52:48
working on. So it's super cool.
52:50
I know we're running out of time, but I want to give Tarun
52:52
and Phil one last chance here. Any final thoughts you want to
52:56
take with Tarun? I'll start with you and then
52:57
we'll end with Phil. No, Jeff and Jim, thank you so
52:59
much. You know, been wanting to be to
53:02
do this together and it came together very well with Phil.
53:05
Thanks for thanks for really an exciting conversation.
53:07
And you know, I would say, you know, the time time is here for
53:14
us to really, you know, not just lift one boat.
53:18
And there's something I, you know, shared with you and our
53:20
teams. Let's not shift the boat, move
53:23
the boat of visibility or move the boat of intelligence.
53:27
You know, let's try to build something which can we can lift
53:30
all the boats together at A at a single time.
53:32
So whether it be IGA, whether it be Pam, whether it be NHI, we
53:35
believe the fundamental of that is rooted in just completely
53:39
rethinking identity from the scratch.
53:41
So again, very happy for the very grateful for the
53:45
opportunity and I'll give the baton to Phil to to help close.
53:49
Yeah. I mean, it just just to build on
53:51
that, I mean, I think we've covered a lot of this since
53:53
we've gone through the session today, but just really
53:56
encouraging everybody to just think about this problem more
54:00
simply and in bigger terms. Like thinking of it as a simple
54:05
way of, do you know where all your identities are?
54:09
You understand all of the resources they can access?
54:12
Do you have a record of all of that?
54:15
And everybody of course knows they should be doing that.
54:18
And then when you look at the reasons they've not done that,
54:20
it's because of complexity, it's because of scale, it's because
54:24
certain systems couldn't be brought together.
54:27
And one of the things that I think, you know, the laser team
54:29
have done such a great job on is figuring out the technology and
54:33
the secret source that had to bring all of that together so
54:37
that all different types of identity problems and access
54:40
problems and management problems can be solved from the same
54:43
structure. And that's why I'm, I'm very
54:46
optimistic about the challenges of managing the even bigger set
54:51
of AI identities and connecting them to the axis graph is going
54:57
to be so critical. Fundamentally, this is the, this
55:00
is the, this is the scale problem.
55:01
Then being able to interrogate that access and understand the
55:06
adherence and the policy conformance at the scale
55:09
organizations actually work, as opposed to the Gale of some old
55:13
legacy system that could only deal with like a hundredths of
55:16
it. Now is the time, as Tarun was
55:19
saying. So with that, I thank you guys
55:21
for spending some time with us and we'll have links in our show
55:24
notes for people to check out, both for both your LinkedIn, but
55:27
as well as to learn more about vasavasa.com/I DACVEZA and Phil.
55:33
I'll put a link to your blog as well 'cause you're a prolific
55:36
contributor to the body of knowledge that that we have in
55:38
the identity. Space.
55:39
All of us wait on Sunday morning to read Phil's blog.
55:41
At least I do. All right, so with that, we'll
55:46
go ahead and leave it for this week.
55:47
Thanks everybody for watching and or listening.
55:49
You can find us on the web, IDC podcast.com and you'll share
55:53
this with your friends, like and subscribe to all that fun stuff
55:56
and we'll talk with everybody in the next one.
55:58
Jeff, thank you so much. You've been listening to
56:02
Identity at the Center. We hope you've enjoyed the show.
56:06
Make sure to like, rate and review, and we'll be back soon.
56:11
But in the meantime, hit the website at
56:13
identity@thecenter.com. See you next time on Identity at
56:19
the Center.