Latest / Identity at the Center / #374 - Sponsor Spotlight - SGNL

Transcript

#374 - Sponsor Spotlight - SGNL · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great, man.
0:18
I'm so excited for this episode. There are a couple of hot trends
0:22
in the identity space right now. Continuous identity that we're
0:25
going to talk about today is one that I really believe in.
0:30
I'm really excited to talk about and I'm just excited to jump
0:35
into things. Yeah.
0:36
So today we've got a sponsor spotlight episode.
0:39
We do these from time to time. It's a fully sponsored episode.
0:41
So we get into the mindsets of our sponsors and sort of the big
0:45
thinkers they've got on their side, get their perspectives on
0:47
I am market straight from the source, which is a little bit
0:50
different than our normal episodes where we are.
0:52
We try to be as vendor neutral as possible, right, not talk
0:55
product, but that is not one of these.
0:56
Today we're actually going to talk product and the product
0:59
today we're going to talk with is Signal.
1:01
And for those not familiar, you can find them on the web SGNL
1:04
dot AI slash IDAC. We'll take you to there.
1:07
I know it's like a lot of letters, but it's Signal.
1:10
And for that we've got Eric Gustafson.
1:12
He's the Co founder and CPO at Signal.
1:15
Welcome to Identity at the Center, Eric.
1:17
Hey, well, glad to be here. Yeah, thanks for taking the
1:20
time. So I, I, I, I kind of, I'm
1:22
joking a little bit because it's like SGNL dot AI slash igac and
1:27
yet somehow people will know that that is signal and identity
1:30
at the center, which is amazing. Yeah, brains are amazing.
1:34
So this is your first time being with us.
1:36
I always like to find out how people got into the identity
1:38
space. It's such a varied kind of skill
1:40
set and background. So let's start there.
1:42
Eric, how did you get into the IM space?
1:44
Is it something that you chose or did it choose you?
1:47
You know, in some ways I'd say it was both back, what was it,
1:52
2011? My Co founder, my current Co
1:56
founder, Scott and I were working running identity and
1:58
product at a, of all things, a fantasy sports gaming company.
2:02
We built games for the NBA. We're B to B, so we built and
2:07
operated the games under somebody else's brand.
2:09
So we did things like NB as games, World Cup games, we did
2:12
NASCAR's game. We did some TV shows like The
2:14
Bachelorette. It was a lot of fun.
2:17
We were using all SAS products. Basically people weren't even
2:21
using that term at that point. You know, you had the sales
2:25
forces of the world, they existed.
2:27
And you know, at that point we were, we were just hired guns
2:30
there. We were employees and the
2:32
company is being sold off and we were there to help transition it
2:34
over. We got done with that and we're
2:37
looking around going, well, what do you want to work on next?
2:39
Let's go, let's start a company. But what's the problem we can
2:42
solve? And we kind of realized, hey,
2:47
everything we're using is cloud based.
2:48
We have this whole IT department, they use Active
2:50
Directory, we've got Exchange, it's all running on our own
2:54
hardware that's in some data center.
2:55
We're managing it all. And that group has no clue about
3:00
any of the web things we're doing.
3:01
Like they don't know how people get access to them.
3:03
They don't have to remove people.
3:04
We were, you know, obviously transitioning the company to
3:07
someone else. You're removing access to
3:09
things. So you said how, how are people
3:11
going to solve this problem with these web applications?
3:13
There's going to be a million of them, which, yeah, at that point
3:17
wasn't the most popular consensus.
3:19
I got laughed at a few times for suggesting that.
3:21
It's like, Oh no, it's all going to be just sales force.
3:23
They're going to own everything. It's like there's no barrier to
3:25
entry to make a a web application.
3:28
And so we started looking around and we ran across this start,
3:31
this little start up called Okta.
3:33
And we looked at Okta where we're like, huh, this is kind of
3:35
what they do. But it seems really tied into
3:37
Active Directory. And I'm not sure about this.
3:40
Like we could do a better job. And so, you know, there were two
3:43
years into it or so we, we said let's go raise some money and
3:48
start a company we called that that was called Bidium.
3:50
And we built an identity platform.
3:53
We didn't actually even know much about identity at that
3:55
time. We were mostly focused on, you
3:57
know, credential vaulting what we came that, but we built in
4:01
all the typical things, single sign on, SAML, open ID, connect,
4:05
directory sync, provisioning, all that stuff.
4:08
And we did that for about 6 years.
4:10
So we kind of stumbled into it, but I guess of our own volition
4:14
because we are going down this path of starting this company,
4:18
you know, sort of Fast forward, that brings us to 2017.
4:22
We were fully competing with Octa.
4:24
We were winning deals. I think we won like Bank of
4:27
America against them and Liberty Mutual and they filed to go
4:30
public. Oh man, what's this going to
4:33
mean for us? Like what happens, you know,
4:35
we're, we're a lot smaller than they are now.
4:37
They're going to be a public company.
4:38
Like, are we going to be able to compete?
4:40
And that actually catalyzed the entire industry to go, hey, this
4:45
identity thing seems real is now a public company that's, you
4:47
know, an identity provider. And every one of the partners we
4:51
had. So we, we took, we took a very
4:53
cloud forward approach to things.
4:54
We weren't trying to tie back to traditional LDAP systems.
4:57
We were looking at HR systems, we were looking at skim, we were
5:01
looking at Google Cloud as identity sources to allow you to
5:04
authenticate. And so these partners all
5:07
reached out to us and we actually ended up selling the
5:09
company to Google and that became part of Google Cloud
5:12
identity, which is their single sign on provisioning directory
5:16
sync product. And I, I ran a big chunk of the
5:19
single sign on portion directory sync for about two years at
5:21
Google as Scott came along to and worked a bunch of
5:24
interesting things. So that's kind of how I got in
5:27
the identity space. I guess, you know, prior to that
5:29
I was just doing software, various kind of enterprise
5:32
software and it just it, it made sense to us and been on that
5:36
journey ever since. So as a recovering fantasy
5:39
football player, I don't know if I should be shaking your hand or
5:42
trying to tear it off because I've had good and bad seasons.
5:45
But I won't go over there with this one.
5:47
I introduced you as ACPO and that's a chief product officer.
5:51
Tell me about that role. What is what is ACPO?
5:54
And tell me a little bit like what is a normal day?
5:56
And maybe it's a normal week or average week, whatever you want
5:59
is portrayed as it's a so at signal.
6:04
What I do as a chief product officer is I oversee.
6:08
Both the engineering team and the product team.
6:10
So I have very solid product lead and engineering lead
6:14
underneath me and they take care of their respective teams, make
6:17
sure things get built, make sure our products released, talk to
6:20
customers, be happy. My job is really actually the
6:24
way I formulated is to talk to a lot of customers.
6:26
I try to talk to as many customers during the week as
6:28
possible. I try to go along on sales
6:30
calls. I try to talk to customers that
6:32
have been deployed, what are their problems?
6:34
And I try to, I'm trying to kind of see around the corner like
6:37
what's coming next? Like when someone says something
6:40
interesting or customer A says, hey, I want this sort of, I'm
6:43
trying to solve these problems and customer B will probably
6:46
tell me they're trying to solve completely different problems.
6:48
But I realized there's some Venn diagram overlap between those
6:52
things. I'm like, OK, my ears will perk
6:54
up and I'll bring that back to the team and we'll work on, OK,
6:57
how do we develop that? How do we turn that into product
6:59
road map and product features? So I think my job is to listen
7:03
as much as possible to the market, reflect that back
7:06
internally and then take what the teams are coming up with too
7:09
and bring it out and say, Hey, what do you think?
7:11
You know, customer X, what do you think of this sort of thing?
7:14
We built something like this. Is this interesting?
7:17
And then for pre sales, the customers who have we're not
7:20
working with yet. So prospects, I guess see if it
7:24
fits them. Where are they on their journey
7:26
in the identity space? What we're building at signals
7:29
pretty new. And so there's a lot of
7:31
education in the market. It's it's there's definitely
7:34
people out there who are way more advanced than we are in
7:37
their thinking and they're like, yes, this is what we've been
7:39
looking for, but there's also a lot there like what is signal to
7:43
wait? Like, isn't that some messaging
7:45
app? Like what do you guys?
7:45
Do so I want to start up with how did you get the company name
7:50
together there SGNL signal like how did you come up with that?
7:54
So Wes, we're thinking through this what we're now calling
7:58
continuous identity back in just probably mid 2021, we were about
8:04
to leave Google. We were Scott and I were sitting
8:08
down. We're like, hey, what do you
8:09
want to call this company? And we start thinking about this
8:12
is broadly in the authorization space where post login.
8:17
So we're not dealing with who the user is, not that part of
8:21
identity. We're the what can the user do
8:23
now once we know who they are that side of identity.
8:27
And a lot of what we thought about was this is a game of what
8:31
signals can you get in from existing systems?
8:34
Can you get threat intelligence? Can you get signals from
8:36
directories? Like thinking about as big way
8:40
of meshing the data together that's already living in the
8:43
enterprise and pulling it into a sort of what we now call a
8:46
fabric. Like bringing all those
8:48
relationships together to be able to understand what are
8:51
people allowed to be doing at this moment in time.
8:54
And so we knew we only used the word signal somewhere in the
8:57
name. So I, we spent probably like 2
8:59
weeks just texting random names back and forth to each other.
9:02
Like what do you think of this? What do you think of that?
9:05
And we'd then go look to see if the domain name is available.
9:08
So eventually we came up with like, hey, if we take the word
9:13
signal, I think I, I came up with this and remove the vowels
9:16
from it. That's a short, that's a nice
9:18
short domain name. sgnl.com. Somebody's got that and
9:22
squatting on it. O dot AI.
9:25
Let's do that then. This was pre open AI, like there
9:29
wasn't ChatGPT at this point and coming from Google DNA or like,
9:33
OK, machine learning AI stuff, that's a thing.
9:35
And eventually, you know, we want to bring some of that into
9:39
this system. So yeah, let's go with SGNL dot
9:41
AI. Like that kind of encapsulates
9:43
it. Some point later, one of our
9:49
customers pointed out to me, like, do you realize that you
9:52
just took the vowels out of the word signal and moved them to
9:54
the dot after the dot? I'm like, yes, I'm really
9:57
brilliant. No, I did not realize that.
10:00
Yes, of course. Yes, we planned that all along.
10:02
It's an. It's an anagram.
10:03
Don't you get it? Yeah.
10:06
We should also say Head of marketing then.
10:08
I don't know. You know, you probably have one
10:10
of those and I don't. Want we do.
10:12
Steal from that person. So, you know, usually Eric, or I
10:16
should say always when somebody has an idea for a company, a
10:23
solution, it's a solution to a problem.
10:26
So what is the? What is the problem that you
10:28
guys are solving? Yeah, absolutely.
10:32
So a lot of this has some roots inside when we were together at
10:36
Google. So Scott and I were both there.
10:39
You know, after we came in two years of stabilizing the
10:42
acquisition, Scott took a role inside Google to look at how do
10:47
you deal with authorization across the entire platform.
10:49
So this is everything from like Waymo to Google Maps to ads to
10:53
Nest, you know, every subsidiary that Google owns.
10:57
How do you deal with policy across the board on that?
11:00
And I was spending a lot of time with who's now our CTO, Otto,
11:04
And he was wanting to propose this thing that is now we call
11:07
Cape Continuous Access Evaluation Profile.
11:11
And he wrote a blog on that. I actually was the guy who
11:13
approved the blog being published in 2019.
11:15
His manager came to me and said, does this make sense?
11:17
I'm like, Yep, that is brilliant.
11:19
I want to talk to this Otto guy. And so we were thinking about
11:23
these these problems, specifically what Scott, the
11:26
pain points Scott was being asked to solve is Google has,
11:29
you know, they've got a couple engineers they can they can do
11:31
some stuff over there. And they've built for themselves
11:34
pretty much every possible type of security and identity
11:37
technology and probably own licensing to have like all the
11:40
other ones anyway. But they ran into this issue
11:43
where, you know, for geopolitical reasons, they
11:45
wanted to lock down user access in Hong Kong.
11:49
And they want to lock it down so that only customer data for
11:54
customers that were located their headquarters are in Hong
11:57
Kong could be accessed by employees who are assigned to
11:59
work in their very big building in Hong Kong at the time and
12:02
probably still do. There are a lot of engineering
12:05
teams from different parts of the company working in that
12:08
building. And so how do you actually do
12:12
that? And it sounds like a simple
12:14
problem, but it actually gets complicated is like, how do you
12:16
know the customer's base there? How do you know it's the
12:18
headquarters? How do you know the users not
12:19
just like passing through temporarily and then office,
12:24
they don't actually work this. You have to pull all these data
12:25
feeds in to be able to solve those kinds of problems.
12:28
And it wasn't something that could be done quickly.
12:30
And obviously, you know, geopolitics doesn't move fast,
12:32
but it does move, you know, in weeks, not in years.
12:36
And so realize, hey, this is a probably a blind spot to our
12:40
systems that we can't do policy fast.
12:43
How do we solve that? Hey Scott, you seem like the
12:45
delusional entrepreneurial type of guy.
12:47
Can you solve this? And so he went off and, and they
12:49
built this platform for like 2 years or so.
12:52
And when he got done with it, I was comparing notes with him
12:54
because I had been always kind of interested in the post
12:58
authentication, the post login problem.
12:59
Like how do you know what people are supposed to do right now?
13:03
Atul is obviously interested in this too with Cape being focused
13:06
on session transitions. And so we were comparing notes
13:09
like that seems like a really good problem to solve.
13:12
It doesn't seem like there's, you know, but is this just a,
13:14
something that you have to be Google or you have to be Amazon
13:18
to have these, this is that big of a scale issue or do sort of
13:22
mere mortal enterprises actually have this problem?
13:24
So we went out, we talked to some CSO's at large companies,
13:28
like, what are you all doing? And the answer we got back to
13:31
them was like, there's nothing good in the space that does this
13:34
for us. We were probably going to
13:35
assemble a team of people together and do this ourselves.
13:39
That's enough. We were at the time where we had
13:41
this sort of stick around at Google.
13:42
So like, hey, let's quit our jobs next week and let's go
13:46
found a company. You know, let's let's get the
13:49
band back together. So that's what we did.
13:52
So many questions based on what you said, and I'm going to stick
13:55
with the one that we entered the show with and talked about this
13:59
term, continuous identity. I mean, it has so much meaning
14:03
to me and it's something that has been, you know, needed for
14:10
such a long time. But I wanted you to get want to
14:12
give you an opportunity to put in your words what is meant by
14:16
continuous identity. What is the the dream behind
14:20
that? Yeah, it's a great question for
14:25
continuous identity and I'm really glad the market's
14:29
starting to, you know, customers are starting to use this
14:31
terminology. I heard it a lot at Identiverse
14:33
this year. I've heard it come up in just
14:36
natural conversations now because it hasn't had a name.
14:39
In some ways I think of it if if you think of the kind of
14:43
asynchronous, always on sharing first architecture that
14:47
something like Cape and the shared signals framework
14:52
envisions being there. Continuous identity is kind of
14:56
that solution. It is continuous identity is the
14:59
idea that you should be always pulling in signals and
15:03
information from your systems and they should be evaluating
15:07
that in real time whenever a user's doing something.
15:10
And on top of that, you should be broadcasting it back out so
15:12
everybody knows about it, all the other systems know about it.
15:15
So really simple example is, and I guess I should add, time is
15:21
important to this, right, The time factor.
15:23
And we'd often think, don't think about time when we think
15:26
about identity policies. We should think in terms of more
15:29
what I call static access. Like I can do a thing.
15:32
But now really you want to ask like I can do a thing right now.
15:35
So imagine your dev OPS and you're supposed to go out, You
15:41
know, today's the day I'm supposed to go to AWS and I'm
15:43
supposed to do ADNS update to deploy some new system into
15:47
production. Or maybe I'm supposed to do it
15:49
in staging it better. And I go there and I have
15:53
access. And now as soon as I get into
15:56
that environment, I realize like, hey, I have, I'm waiting
16:01
for something to happen. I click a link and I'm boom,
16:03
I've got malware on my device. I still have that session open.
16:06
That malware might be harvesting those credentials, getting me in
16:09
there. There's systems.
16:11
Crowdstrike does a great job of detecting those sorts of things.
16:13
But how does Crowdstrike tell my IDP to tell AWS that it should
16:21
cut me off? Or let's say I'm actually not
16:24
supposed to be in. I was supposed to be in staging
16:27
making this change, the prep for next week's production release,
16:29
and I accidentally clicked on the tile for production.
16:31
And now because I am the guy that deploys the production and
16:34
I'm in production, I make this change too and I break things.
16:37
All these problems have to do with standing axis and a problem
16:40
of not sharing information. So you think of continuous
16:43
identity as, hey, we pull the data in real time from systems,
16:48
we react to that changing state. You were OK from a crowd strike
16:54
point of view. You're no longer OK now from a
16:56
crowd strike point of view or you're on call this week, you're
16:58
not on call this week or you're supposed to be the tickets for
17:00
staging in service now, the tickets for production,
17:04
ServiceNow, these are all state changes.
17:06
And when that state or better, I think for a, a less nerdy way of
17:11
saying that is, you know, think about context, the context of me
17:15
doing my job, that changes our identity system should react to
17:19
that. This is a really common concept
17:22
in the kind of cybersecurity land.
17:24
We have threat detection and automation and sores and Sims
17:29
and all these tools. How do you bring that into the
17:31
identity play? And then how do you have the
17:33
identity? And for the security side,
17:34
these, you know, we've been treating these two industries as
17:37
separate for a really long time and I see them really kind of
17:39
converging. Yeah, I mean, the the podcast
17:45
name identity at the center has been all about the story that
17:48
you just relayed there. You know, I think a lot of
17:51
people think, OK, well, identity is new perimeter identity center
17:55
is kind of a play on that. But it's really that the
17:58
identity and what's happening in all these systems kind of comes
18:02
back to the center and drives things.
18:04
Because you made a great point there about, OK, crowd strike
18:08
detects us. Does that information just kind
18:11
of die there or does that become identity data that comes back to
18:15
the center? And I think, I think where we're
18:17
going with this is that then that data becomes usable for
18:23
making smart identity decisions. And not only just making smart
18:27
decisions or throwing information on a dashboard, but
18:31
in real time saying this is a session that looks like it's
18:35
from an identity that's been compromised over here.
18:39
Let's do something about, let's temporarily shut off access, for
18:43
example. Is that kind of what you're
18:45
getting at exactly? Exactly.
18:48
It's that idea of like and I, I like to think about it as that
18:51
identity comes from the perimeters back to the center
18:54
and then is processed mixed with other information from other,
18:58
other systems and then rebroadcast back out.
19:01
So not only are you getting all these superpowers of I can do
19:05
things in real time, I can take all this rich information that
19:09
we, hey, we already have inside the company and I can make
19:12
better use of it. But you actually make all your
19:14
other products better too. Because suddenly your, let's
19:17
call it your Okta instance or your Entre instance is suddenly
19:21
a lot smarter because now it's getting data feeds piped into it
19:24
from your Crowdstrike solutions. And Crowdstrike's smarter
19:27
because it sees somebody's probing at the at the IDP and it
19:32
can bring that stuff back into Crowdstrike or bring it to a
19:35
sore. And you can run a playbook
19:37
against that saying, hey, well, if Jim's keeps hitting the thing
19:40
that says deny, deny, deny repetitively, maybe that's not
19:45
Jim doing that. That's right.
19:47
Yeah. And by the way, so we you said
19:49
there with identity is at the perimeter comes back to the
19:52
center that goes back out to the perimeter.
19:54
We thought of that as a podcast name, but we decided just to go
19:57
with Identity center. It's a little long.
19:59
Yeah. It's a little long.
20:01
It's hard to search for, but yeah, kind of what I wanted to
20:07
get at is something that I think you're talking about.
20:11
And for me, this has been one of my big questions about Signal is
20:16
what are the systems that you want to collect this data from?
20:20
You met your crowd strike. Give us some more examples.
20:23
Yeah, absolutely. So there's probably 3 big
20:27
categories of data. I'd say there's traditional
20:29
identity data. So think your directories, your
20:32
HR systems, your groups policy information, that's all identity
20:38
data. There's security data.
20:40
So your crowd strikes, I'd say your device compliance data, if
20:44
you have a device management platform, if you like a jam for
20:48
an Intune, it's that's the security feeds.
20:52
Maybe you've got other sources of data, other types of
20:54
telemetry that you've wired up in the enterprise.
20:57
Maybe you've got VPN logs or something if you're still using
21:00
that type of topology. And then you get your
21:03
operational data. This is your tickets, your
21:05
ServiceNow, your pager duty. Hey, I'm on call this week.
21:09
I'm the guy that's supposed to be going in there.
21:11
If I'm not on call, well, I shouldn't be able to get access
21:14
to things. Or if I'm on vacation, you know,
21:18
unless I'm working for that kind of company where I'm should be
21:20
dialing in from Hawaii to do my do my work mostly, I probably
21:24
shouldn't have access. Because if, if I'm coming in and
21:27
work day says I'm actually out of office right now without any
21:31
other information, you should probably assume that I'm an
21:33
attacker. But I'm not actually me.
21:36
But somehow I've been compromised or from suddenly
21:38
coming from a strange IP address I've never shown up before in a
21:40
browser you've never seen. So it's that type of business
21:45
telemetry and all these things exist in the enterprise.
21:48
We just stick them in silos and don't ever talk to them again.
21:53
So that concept of silos leads me to a very interesting
21:58
question. I think is the concept of data,
22:01
is stale better stale data better than no data or is no
22:06
data better than stale data data, I can't even say it
22:09
correctly, you know, but the better or stale data or no data,
22:12
like what is what is the thought process behind that I think?
22:17
I usually try to flip this around when when customers bring
22:19
this up and I say, let's start with the policy instead.
22:22
What are you trying to accomplish and how if you had
22:25
like write that down, like literally write it down a piece
22:27
of paper. I only want on call engineers
22:31
who have a ticket assigned to them to go to a production
22:33
system. That's like the most basic
22:34
policy a company's going to have that gets them in trouble.
22:38
I think no one thinks their cloud systems are the most
22:40
secure they could be in that scenario.
22:44
How would you go about proving that?
22:45
Forget real time. Forget non real time.
22:48
Like actually, literally like if you had the if your job was to
22:51
go check out if Jeff's allowed to be in this system right now
22:55
by manually checking things, what systems would you go to?
22:58
OK, I need to know about tickets.
23:00
I I where would I go? Service.
23:02
Now I have some data there. Do I need all the data to be
23:04
perfect over in ServiceNow? No, I need some basic ticket
23:08
information available to me. Maybe I need a process that I
23:11
actually open tickets. But that's your policy.
23:13
I hope you're following your policy or else you've got
23:16
different problems. Do I need to go look at device
23:19
compliance? Yes.
23:20
OK. Like, should people be in the
23:22
production system if they're on their old unpatched Windows 2000
23:27
laptop that's sitting in their garage?
23:30
No, I probably want them to be on a company managed defeat
23:32
machine if I'm letting them do really serious things.
23:35
So I'd say you need some data. You need to have a good handle
23:40
on your data, probably more than you need to have good data.
23:43
Knowledge of data is probably the number one thing.
23:45
Just where are the systems? You can paper over quite a bit
23:51
by taking data from multiple systems and then organizing and
23:55
then signal helps you kind of stitch it all together.
23:58
And that creates a lot of power for you.
24:00
It doesn't need to be perfect. It doesn't all need to be
24:02
pristine. But if you know the different
24:05
systems that you you'd use to force your policy, like if you
24:08
can put your hands on that manually, then you can start.
24:12
And I think that's a better position than just saying, oh,
24:14
it's all in these silos. And I just not like, I, I don't
24:17
know, I'm not even going to go after it.
24:18
I'm not even going to try. So Eric, it seems to me what
24:23
you're talking about here is that most of the signal data
24:26
that you get the most value from is from your own IT systems,
24:31
whether they're stash systems. So what about getting data from
24:37
like big ID PS, like a Facebook or something like that?
24:43
Does that make any sense? Does it, do you ever see a
24:46
future where it's like, you know, you're you're getting this
24:49
from a broker, in other words, you're plugging into some kind
24:52
of central broker data hub, or does that just go against what
24:57
you're trying to achieve? I, I, I like to be more agnostic
25:01
about where the data might come from.
25:03
I think the easy, the low hanging fruit is your internal
25:05
systems, but you know, it's a sibling standard to Cape is
25:13
Risk, which is for account takeover feeds and Google
25:16
publishes one and the US government publishes one for
25:19
account takeovers. That's reasonable.
25:21
If you're dealing with consumer identities, that might be handy
25:25
to, to grab that data feed and use that in your policies.
25:28
There's lots of sources of IP reputation, data, threat
25:33
signatures, there's lots of vendors of that information.
25:36
And so I think for the the enterprise use case or the
25:39
second party like the contractors, vendors, use cases,
25:43
your internal systems are great for that.
25:45
For consumer use cases, which we're starting to see some more
25:48
customers tiptoe towards building those sorts of things,
25:51
Yeah, they might be good public sets mixing it all together.
25:54
Those the real, the real power comes from, because the more you
25:58
layer into the system, the more you map out the connectivity,
26:02
just this gets exponentially more powerful for you.
26:05
You have a lot more capabilities as you start to expand the
26:08
network of data that's coming into this.
26:11
What you know, we think of it, we call it the identity data
26:12
fabric. It's stitching.
26:14
You've got to weave all those threads in together.
26:16
So I'd say, yeah, I can see a world where there's going to be
26:19
public feeds. I don't necessarily think I'd
26:21
see a world where that's the only source of feeds.
26:23
Companies are always going to have their internal systems.
26:25
They're going to have their home grown things and they're going
26:27
to want to use those for their own business reasons.
26:31
I'd love that. Answer So one more, which is,
26:36
you know, around kind of whose signals built for, is it built
26:40
for? You know, who's going to use it?
26:43
I, I, I'd love the answer if it would be IAM practitioner.
26:48
I also think the role of the IAM practitioner is expanding, but
26:53
where in the organization do you see folks getting excited about
26:57
this and kind of reaching out to you and you know, being
27:02
interested in the product and potentially buying on?
27:06
I'll, I'll make your day at the identity partitioners.
27:08
It's really the IAM architects that we see.
27:11
We, we deliberately designed signal though to handle two
27:16
different personas in the organization.
27:18
So the identity partitioner is the main operator.
27:21
They, the architect, they manage the system, they define, we call
27:27
them policy snippets inside the system.
27:29
Think of them as like they're the nouns.
27:31
So they've built the Lego building blocks that we use to
27:34
assemble how signal operates inside your company, because we
27:38
want to do that because they understand the identity
27:40
principles that the enterprise wants to put in place.
27:43
But then we give an interface where a business analyst or
27:46
someone who's closer to the application we're trying to
27:49
protect, we refer to that as a protected system, that persona,
27:55
they should get a very simplified, not simplistic, but
27:59
easy to use way to say, here's what I want to do and do that by
28:04
taking those Lego blocks and then snapping them together.
28:07
I, if you're familiar with Mad Libs, it's kind of like Mad
28:09
Libs, like there's just the policy.
28:11
And let me throw in who's the principal?
28:14
What are the actions, what are the assets they're trying to
28:17
protect here and what are some conditions?
28:19
Those are all pre canned. My local identity architect has
28:23
already come up with those based on the data sets we've pulled in
28:26
the signal and I just seem to put them together and layer
28:28
that, hey, now I have a policy and let me go stack up a couple
28:31
policies. We really want to think about
28:33
reuse. So I want that policy like I can
28:37
go to the cloud if I have a ticket and my device and I'm not
28:41
a compromised device that should apply if I'm multi cloud.
28:46
That's literally the same policy we shouldn't care about.
28:49
Yeah, GCP uses a different identifier from Azure uses a
28:53
different identifier from AWS. Or even if I've got a couple
28:56
different ID PS in the mix, which is really common, the
29:01
person who's trying to put that policy in place shouldn't have
29:05
to worry about those details. Let this graph, let this fabric
29:09
handle that, let it do the on the on the fly translation.
29:13
And that's so the architect role defines the terms of use in a
29:17
way. And the business analyst or the
29:20
end person who's after maintain their job is to maintain a
29:25
system. That person is also a persona
29:28
and signal. So we usually come in and talk
29:30
to the architects first. They're kind of like the hero of
29:33
the journey, and then they bring it to their internal teams who
29:37
rely on them to get things done. You're pushing all my buttons.
29:40
In the right way, when you start mentioning things like Lego and
29:43
Mad Libs and things like that, I, you know, I think right or
29:47
wrong, the industry likes to put things into a box.
29:51
And so we already have boxes like IGA, Pam, Kim, and a whole
29:56
bunch of other ones that, you know, would take forever to kind
29:58
of list off. Where does Signal fit into that
30:01
ecosystem? Is this a new category or is
30:04
this creating something new? Does it complement things that
30:07
already exists? Tell me a little bit about like
30:09
where you see Signal fitting into the ecosystem.
30:12
Sure. In some ways it's a bit of all
30:14
the above. We do complement, so we go into
30:18
companies. They already own everything.
30:20
They probably already own 3 or 4 versions of everything.
30:23
Like I've got octoping onto running around, I've got
30:27
division over here that uses Curity, I've got sale point from
30:33
this thing and oh, this acquisition we made there on
30:35
Savvy and I've got Cyber Ark. So we work with all those
30:40
systems, we stitch them together and we make them all better.
30:43
I'd say the way I really think about it, it is a new way of
30:49
looking at the identity stack. And so there's some parts of IGA
30:55
in here in terms of the ability to deal with users and groups.
30:59
Like a lot of times in I when you're trying to solve this with
31:02
an IGA hat on, you go make more roles, you make more groups, but
31:07
really you're trying to emulate policies rather, but you're
31:10
doing it statically. And that eventually gets this
31:13
problem where you have like 3.3 groups per every user or
31:16
employee of your company and your, you know, Sarbanes-Oxley
31:21
quarterly access reviews start exploding because you just have
31:25
way too many things for all your managers to review.
31:28
Or you might approach it with a privileged access management
31:31
lens and go, all right, well, yeah, this is early.
31:34
I need to step up. I need a special token to go and
31:37
do something that that technology is very based on
31:42
credentials. It's passwords you're checking
31:44
in and out. Yeah, they might be piped
31:46
through something, but it's it's inherently different from the
31:49
single sign on workforce identity world that we live in
31:52
in 2025. So we pull some aspects of Pam,
31:56
we pull some aspects of IGA together.
31:58
But I really argue like we wouldn't build identity
32:02
solutions the way they're built right now.
32:04
Like these things came up over time.
32:07
Pam arose from pre cloud. This is like, how do I deal with
32:10
my Cisco routers and root passwords on Linux boxes, not
32:14
even thinking about single sign on at that point.
32:17
IGA that came out of Sarbanes-Oxley.
32:19
Like we're in this sort of generational change.
32:21
Like these technologies and techniques had been around like
32:25
25 plus years. It's kind of time to rethink how
32:29
we're doing stuff because we build this massive identity
32:32
edifice and yet we still have problems.
32:35
We still get hacked, we still get breached.
32:37
Like we're clearly we're not doing like everything's 100%,
32:40
there's never going to be 100%, but we're clearly not doing
32:43
something right in the identity space that we can't even keep
32:45
basic use it as a basic security tool for us.
32:48
So I do think this is a new way of looking at the problem.
32:52
I don't, I don't want to have the hubris that a startup can
32:56
define a brand new category and be like, tada, here's the silver
32:58
bullet magic beans. But I do see we're reflecting
33:02
the trend of where the industry is starting to go in terms of
33:04
thinking about these problems. And we want to help with that.
33:06
But we also, we will play nice with the existing stack.
33:09
We don't come in and say, hey, yeah, like we don't coexist with
33:12
these things. No, we coexist with everything.
33:14
Like, that's actually part of the.
33:16
It's a nice aspect of the way the system works, and the way it
33:20
works best is when it integrates everything together that has a
33:23
nice property of. Will work with what you have
33:25
too, so there has. The reason I bring this up is
33:28
because I know we have all these different acronyms and one of
33:30
the ones that's kind of newer, at least to me is this idea of
33:33
authorization and Gartner has a term for authorization
33:37
management platform or AMP. At the same time, we're seeing
33:41
things like P back policy based access controls kind of rearing
33:44
its head up again as people try to solve for, you know, well,
33:48
RBAC just stinks. It just takes forever to get it
33:50
right. And it's, it's outdated as soon
33:52
as you press, you know, submit. So where do you see, you know,
33:56
the, the industry going? But also how does signal like
33:58
aligned with things like AMP or PBAC or you know STAR dot back,
34:04
you know, whatever acronym you want to put in front of the the
34:06
access control? So I say we're pretty aligned
34:11
with this idea of amp. Like I really like when I was
34:14
Paul Mozzaro, who wrote that. If you have a Gartner
34:16
subscription, I highly recommend giving it a read.
34:18
It's it's, it's going in the right direction.
34:20
You know, if you talk to Paul himself, he'll, you know, it's,
34:23
this is evolving still. This is the first foray into
34:26
trying to find this movement that's happening in the identity
34:30
space. It hits on a lot of things that
34:32
really resonate with me and with signal.
34:35
So it it asked like Paul, like, hey, what's the what?
34:38
How do you differentiate this from what's come before?
34:40
And it's this orchestration layer.
34:42
And that's where the Cape side of things, that's where the
34:44
signals, the emitting of signals, that's the we send
34:48
information from the edge to the center and send it back.
34:50
That's the orchestration portion of this.
34:53
You need policy on top of that because you need that.
34:56
You need the rules of the road. How am I steering my car or, you
35:01
know, on my steering my ship? Pick your analogy.
35:03
That has to be part of it. And then you need the data
35:05
fabric underneath it. And those are the three main
35:07
legs of the signal stool policy engine orchestration layer,
35:12
which looks a lot like policy, but you, you think a little bit
35:15
more asynchronously with the orchestration and then the
35:18
fabric that powers both of them, which is the aggregation of the
35:22
data. You want to back up all your
35:24
policies. And you know, we call them
35:26
triggers in the in the orchestration tool.
35:30
All those things kind of come into play here for us.
35:32
And so, you know, P backs an interesting term.
35:35
I think there's lots of really solid P back tools out there.
35:39
But historically, like if you think back to like as ACMOL
35:43
days, like 25 something years ago, if you can remember that
35:46
long ago, those are kind of meant to be more developer
35:50
tools. Like I just want to build a
35:52
better framework within my application for dealing with
35:57
these problems. And what we've seen is a lot of
35:59
customers who are not successful trying to apply those concepts
36:03
horizontally inside their enterprise.
36:05
If you try to take a a classic, you know, Zac Amol tool, or if
36:09
you get to like alpha and stop having to deal with XML and you
36:12
can use Jason, it is, you know, 2025 now, it's still difficult
36:18
because they're not they weren't designed to think about the
36:21
enterprise state. You need to have these things
36:24
all work in concert, but you need that backbone saying like
36:26
this is what I'm trying to apply across horizontally, across the
36:29
board, not down into the application.
36:31
So you know, when, when you're all were asking about personas,
36:35
like I did not talk about developers, like we're not a
36:38
developer focused tool. I think they're great P back
36:40
tools out there like OPA that are good for a developer wanting
36:43
to do something better than hard coding authorization logic into
36:47
the system. But as soon as you need data
36:50
that's not resident to that application, who's on vacation?
36:54
Unless you're building an application that manages the
36:55
vacation schedule, you want to get that from somewhere else and
36:59
you don't want to deal with the stale data problem of that.
37:02
And how do I synchronize that information and maybe some of
37:04
that sensitive like, you know, obviously vacations might not be
37:06
that sensitive, but think of something like it's a legitimate
37:10
policy. Citizenship might come into
37:13
play. Maybe I have to be a certain
37:15
citizenship to see some piece of government data.
37:18
That's a very common regulatory policy, difficult to enforce.
37:22
And I don't think we wanna be pushing what citizenship my
37:26
employees are to every single one of the applications in the
37:29
enterprise. I'm sure that'll get you in
37:30
trouble in Europe, if if not in the US to do those sorts of
37:35
things. So feedback tools are
37:37
interesting and they're, I think they're a useful part of the
37:40
system, but it doesn't solve this problem.
37:44
And I think amps on the right direction as we start seeing the
37:48
space emerge and these architectures get real mileage
37:52
in the space and more adoption, I think that will also evolve a
37:55
little bit too. But it's, it's promising.
37:58
So Eric, I want. To go back to what you're
38:00
talking about with the agenda architects.
38:03
So the one that once that pull you in, they went under and I, I
38:08
realized like making the case to those folks is no easy task
38:13
because they need to really understand this.
38:16
So at that, at that point that you achieve like, OK, they get
38:21
it, they buy. And I'm thinking of like some
38:23
really smart people who could probably do both sides of this
38:26
equation. So you know, I'm thinking of
38:29
Shawn Odell, thinking of Andrew Cameron.
38:31
They first you have to sell them on the tech right after that.
38:36
These are guys who can speak the the language of business to make
38:41
the case. I'm wondering, you know what,
38:45
what does that sound like? Help us out for the people who
38:48
are listening who are like excited about this and maybe
38:51
when we dig into the tech, that's great.
38:54
Eventually you get them sold on that.
38:56
Now you have to explain it to somebody who's used nothing
38:59
about the tech and probably doesn't care and you have to put
39:02
it in the language of business. So how do they do that?
39:06
How are they successful? Yeah, absolutely.
39:10
I think, you know, it's kind of like what does it look like to
39:13
win in a company when we go into it?
39:15
And this is where I, I usually start with something.
39:18
I think Ian Glaser put this on a on a blog of his called, you
39:23
know, we endearingly inside a signal called the pyramid of
39:26
pain, which is if you think of all the applications in your
39:30
company that you're using, which ones are you the most worried
39:34
about? Like where is the biggest
39:36
problem gonna be start there. That's the top of the pyramid.
39:39
That's the most painful thing. And those are usually
39:41
applications that you're you're not in it every minute of the
39:44
day. It's not, it's not slack or
39:46
e-mail or your calendar. It's your production
39:48
environments, your your production systems, maybe your
39:51
financial systems, maybe it's your CICD pipeline.
39:55
So things that are like someone got in and just went haywire in
39:59
there. That's potentially a company
40:01
ending moment, if not at least a career ending moment for
40:04
someone. Those are the most difficult.
40:08
They require the most context. They require the the biggest
40:12
need to reduce access to them so that you're not always able to,
40:15
you know, it reduces the attack surface.
40:18
That's where we try to frame people to start there.
40:19
And then we look at, OK, can you reduce the number of roles and
40:23
groups in the system? Can you reduce the amount of
40:25
standing access? Can you be more responsive?
40:28
Like the problem of if your Crowdstrike or your other
40:33
security systems detect a problem with this user, can you
40:37
react to that? And can you pull them out of an
40:38
environment If the user's been no longer an employee, like they
40:42
were terminated in the morning or they resigned in the morning,
40:46
but they had an open session from the night before, or are
40:48
they still I'll get access to things like, can you shut people
40:50
off quickly in response to some type of HR event that goes on?
40:55
So then those become wins for the business because the
40:57
business recognizes this is a lot of risk.
41:00
Or if I've got a lot of groups, I've got to do access reviews in
41:04
those groups. And after I've got 100,000
41:07
groups for 10,000 employees, that's a lot of work for people
41:10
that's not really helping the business move forward.
41:13
And so we can start to show value.
41:14
It somewhat depends on who we're talking to.
41:16
So if I'm talking to application owners, we might talk in terms
41:20
of I give you dynamic access to things rather than, you know, I
41:24
talked to identity person. I talk about 0 standing access.
41:26
Like people don't have access when they're not supposed to,
41:29
but magically the access is there when they need to use it.
41:32
The business likes to hear it the other way around.
41:33
Like it'll be there when I want it and it's not there when I'm
41:36
not looking. That's the right stance to be
41:39
in. And that ultimately drives a
41:41
better security posture. I'm talking to kind of the CISO
41:44
persona. They tend to be the ones they
41:47
start thinking about. What are my risk signals in the
41:49
organization? How do I lower overall risk the
41:52
things and icing on the cake, can I make my business
41:55
operational processes simpler too?
41:57
Can I reduce access reviews? Can I reduce toil inside the
42:01
company? Those are all wins for us.
42:03
Yeah, that I. Mean that's a great business
42:05
story about reducing risk, reducing that kind of overhead
42:09
of things that help reduce the risk so that it makes it more
42:14
effective. You actually start to steal from
42:16
my next question, which was around what are the use cases,
42:19
right? Because you think of a good
42:20
picture there especially, and tied back to the continuous
42:25
identity because you talked about, you know, someone has
42:29
been terminated from the system, but maybe they have a a session
42:33
open. I mean, literally, I've run into
42:36
that before where it's like, well, yeah, we shut off their
42:40
access, but if they still have their laptop and they're already
42:43
logged in, you know, and we wouldn't know it.
42:46
And I'm like, that's terrible. That is absolutely terrible.
42:49
So this whole idea of, you know, being able to go in and like
42:53
surgically kill sessions. The one thing that you'd
42:58
mentioned earlier is I asked a question about what are the
43:01
sources of these signals and then, you know, obviously you
43:05
link that to them, we can take action.
43:08
And the example used was the IDP.
43:10
I'm wondering if you have any other examples, like is are
43:14
there examples about going into IGA systems or privileged access
43:17
management or anything else that, you know, maybe I didn't
43:21
mention that. Just seems like, you know, when
43:25
you want to brag about a little bit, yeah.
43:27
Absolutely. You know, the the IDP to to
43:30
cloud provider is probably our most popular use case.
43:34
Closely related though, CICD pipelines, I've got my GitHub.
43:37
If I can push code, I might as well have console access to the
43:41
cloud. So predicting that I can't push
43:44
unless I need policies. I have to be the release
43:46
manager. Right now I'm assigned to do
43:47
that and I'm on my a pash device and it's doesn't have malware.
43:52
All those things are important to me.
43:54
That's another popular use case. I'd say the other ones, API
44:00
gateways is a big one for us. So I'm making API calls.
44:04
This really comes into play. And I know we haven't used the
44:07
AI Buds word yet, but you know, MCP or model context protocol
44:11
that's just an API Gateway pattern protecting that we're
44:15
getting a lot of interest in. How do you put policy in place
44:17
for that, especially because it's really easy to vibe code
44:21
out one of these things without thinking about any kind of
44:24
identity security practices. Roll it out.
44:26
And now I've done all kinds of egregious things like embedding
44:29
tokens and not thinking about access control and not thinking
44:32
about deployment and no one knows about it.
44:34
So this is just a, a sort of accident waiting to happen here.
44:37
We got, you know, pits with spikes at the bottom of them in
44:40
this area. Working with IGA and Pam, those
44:45
are good ones too. So we've got some nice use cases
44:48
with say, sale point where maybe we want to do some of these
44:51
checks against security systems. When someone comes into Cell
44:55
Point and requests access to something, Cell Point could call
44:58
it a signal, look for a policy. The signal says, yeah, the
45:02
person, you know, Jeff looks good.
45:04
He's, you know, his everything's fine with him.
45:06
He's allowed to do this. Beyond this, the normal rules.
45:08
And then or flip that around, something changes in a system
45:12
and we could go say, hey, deeper vision Jim, like go take him out
45:16
of this Active Directory group because you've got that all
45:19
wired up anyway as part of your join remover lever settings in
45:24
Cell Point. Let's just trigger that.
45:26
We see something anomalous that comes in from the SoC.
45:29
We can go tell cell Point to do that.
45:32
And that can speed things up too.
45:33
That can make you more reactive and make your existing
45:36
investments better. Do something similar with Pam,
45:40
like, hey, we know it's someone's compromised.
45:42
We could tell it to rotate a credential or we can we could
45:44
even potentially block access to the Pam system itself for that
45:47
user so that they, if they they can't just go start doing X fill
45:51
against all the passwords that are in the vault.
45:54
So there's a lot that we can do in conjunction with those other
45:57
systems. And these are all we tend to see
45:59
people solve the and we encourage folks solve the easy
46:04
problems first, like solve those and then expand because the way
46:08
the platform's built, it's meant to keep going to more use cases.
46:12
And we just see customers follow that pattern.
46:14
They start with one use case or two, we nail them, we roll it
46:18
out, everyone's happy. We're all, you know, popping
46:20
champagne, celebrating. And then, hey, the next use
46:22
case, the next use case, the next use case and so forth, we
46:26
can pop some. Champagne in a little bit.
46:27
I got a couple more questions for you.
46:30
What is it that makes signal different from, you know, your
46:33
contemporaries in this space? Tell me what sets you apart
46:36
because this is my jaded CSO time where I say OK I already
46:39
got a bunch of tools, why do I need signal and why is it signal
46:42
over something else? I'd say there's really not much
46:46
out there that does this in the way we approach it.
46:48
So there are other tools out there that understand Cape
46:51
signals and protocols. There's other tools that'll pull
46:54
data in, like you could use Octa and they have a directory system
46:57
that they use provisioning. But these weren't men and they
47:01
weren't designed to think about it from an enterprise wide
47:03
scale. They have kind of their corner
47:05
and their main objective and they tiptoe into these other
47:07
areas. So all the IGA tools have some
47:11
kind of Pam module that can do some privilege stuff.
47:13
All the Pam tools out there have now acquired some IGA vendor and
47:16
they can do some simple IGA things.
47:18
Sokta just announced, I think, you know, the other day that
47:21
they've got, you know, they made an acquisition in the space and
47:24
they've got some IGA and Pam things.
47:25
So everyone's kind of tiptoeing around this, like refactoring of
47:28
the identity stack right now. We built this from day one to
47:32
solve this type of problem. How do I stitch my entire stack
47:35
together, not just of identity data, operational data and
47:39
security data, bring this all in one place and give you the
47:42
ability to have this continuous identity architecture within the
47:47
organization. That's what sets us apart is we
47:49
were purpose built for this problem.
47:51
We're not trying to retrofit this into an existing system.
47:55
In some ways it's kind of like the innovator's dilemma issue,
47:58
like you have to reinvent your IJ stacked work in real time or
48:01
you'd have to reinvent your Pam system to understand workforce
48:05
and single sign on none of these systems.
48:08
They all kind of want to play in their own sandboxes if no one
48:10
else exists. And I said, hey, this is 1 big
48:13
sandbox, we all have to work in it.
48:14
And maybe we should look, talk to the guys next door about the
48:17
security stuff because that seems kind of important to us.
48:21
Yeah, I can see. Definitely a lot of linkage with
48:23
things like, you know, security operations center and some of
48:25
the tools they have, right? It's, it's all data you're
48:28
trying to pull in. The more data that you've got,
48:30
the more interesting and educated decisions you can make
48:33
on how you want to leverage it, right?
48:35
Exactly. So let's take a look.
48:37
At the broader range, industry at large here from an identity
48:41
perspective, and I'm hoping I won't hear AI is the answer,
48:44
although it probably is. What are some of the big trends
48:47
that you see coming along that people should be keeping it out
48:50
for? So I kind of call this of like
48:52
skating to where the puck is going to be from an ice hockey
48:55
analogy. What's coming up that you know
48:58
that that is really kind of piquing your interest or is it
49:00
just, hey man, AI is here and we've really got to got to get
49:03
that figured out? I mean, definitely I'll, I'll
49:07
we'll put the AI one out of the way like AI is here.
49:09
We got to figure that out. I'm not smart enough to know all
49:12
the impact it's going to have in the identity space.
49:14
It's definitely having an impact and we'll continue to have one.
49:17
I probably the only thing I won't be surprised by is that
49:20
I'm going to be surprised about where we are in a 12 months in
49:24
the AI world. So putting that one to the side
49:26
for the moment, the two big trends that I see here right
49:30
now, one, we've been kind of dancing around a little bit
49:33
here, the convergence of identity and security together.
49:36
And I actually think some drivers of this are it's
49:39
becoming pretty common for your CSO to start taking over your
49:43
traditional CIO roles or your CIO taking over CSO.
49:47
This, those two leaders are morphing into one leader.
49:51
A lot of things that the CIO looked after before probably
49:55
live under like a COO, like what productivity suite we're going
49:59
to use? Are we going to be on Slack or
50:01
you know, teams? Are we going to be on Zoom or
50:04
Google meet or you know teams? Those decisions aren't don't
50:10
require a specialist as much as they require someone to
50:13
negotiate price points on a per user per month pricing concept.
50:18
So where's that leave the identity team?
50:20
Because if you're thinking about identity systems and
50:23
traditionally, you know, you guys know this probably better
50:26
than I do, your IGA tools, your IDP tools kind of live in the IT
50:31
world and kind of we're more like productivity things.
50:35
And your Pam tools, if they weren't in identity land, they
50:38
were more in the security land. And as those worlds come
50:42
together, it stops being about just productivity.
50:46
It starts being more about, OK, yes, single sign on gives me
50:50
productivity and reduces passwords and I get MFA and all
50:53
this goodness out of that. But I also started wanting to
50:56
use this as security controls, which has historically been the
50:59
sea sales world. So I think that's a massive
51:01
trend right now. It's just the convergence and
51:05
mind meld of those two sort of organizations together into one.
51:11
And I'd say it's probably not a surprise that of our customers
51:14
who are moving the fastest, who are the furthest ahead here and
51:17
of the industry voices you hear they probably work in an
51:20
identity security team. And obviously like you see, you
51:25
know, Palo Alto's acquisition of Cyber Ark, you know, that
51:28
happened a couple weeks back. They're talking about that as
51:32
identity security. So this is in the air.
51:36
The other big trend I see is this generational change.
51:40
It's been 25 years since we kind of came up with the IGA and Pam
51:44
things. It is that is a long time.
51:46
Like there's whole generations of humans who grew up after
51:51
those events, right after, you know, the Enron events of the
51:56
world that drove Sarbanes-Oxley. It's time to rethink how we do
52:00
things. And so that's the other big
52:02
trend to see is we are coming up on massive replacement cycles of
52:06
two entire sets of sort of the core identity stack.
52:11
I'd say ID, PS and pass through lists are probably the latest
52:14
generation and even those are like those are 15 year old
52:17
things. So it's it's natural that we're
52:21
coming up on rethinking this. Yeah, some of these.
52:25
Solutions are not old enough to vote.
52:27
Maybe you can drink exactly. They're old enough to rent a
52:30
car. You.
52:32
You. You've.
52:33
Been so gracious with your time. I want to kind of pivot here to
52:35
a little bit of a lighter note and kind of wrap the show up
52:37
here. We were talking before we hit
52:40
record and you mentioned that you are into cooking and I am
52:43
into eating. So I think this is going to be a
52:45
great conversation. So I would like to pose a
52:48
hypothetical to you. So let's say you've got to
52:52
create the perfect meal, and I'm going to put you on the spot
52:55
here. Not only create the perfect
52:57
meal, you have to create the perfect meal for me, OK.
53:01
What are you going to make? Why are you and why, you know,
53:04
why are you making decisions, decisions, you know, for what
53:06
you're going to make? And you can feel free to ask me
53:08
questions if that helps you in any way.
53:09
Yeah, yeah. Let me ask if you like, you
53:12
know, First off, like anything you don't like eating, like
53:15
what's you know, any, any areas to avoid?
53:18
Hey, I really hate, you know, spicy food or I don't eat fish,
53:23
you know, anything like that to be aware of.
53:25
Well, you hit two right there. So I'm not a fish person.
53:28
I'm generally not a seafood person with the exception of
53:30
shrimp. As long as the heads are cut
53:32
off. I don't, I don't dig on, you
53:34
know, the shrimp showing up with their heads on.
53:36
No, give it to me after the sushi.
53:38
I thought you liked sushi. Sushi is the one.
53:40
Exception, I will do something like tuna, maybe like a lighter
53:44
fish, but it has to be with like something else like in a roll or
53:48
something like that. Not spicy, although I can
53:52
tolerate a little bit of pain. And then mushrooms are just not
53:55
my jam at all. So other than that, I feel like
53:58
I've got a pretty open palette now that I've, you know, cut off
54:02
like a third of the of the menu. No, no, no.
54:05
So, yeah, So my thoughts are way out the window now.
54:07
No, I'm just kidding. I'd say let me think through
54:12
this. If tuna's on the menu, I'd say a
54:16
really nice piece of like ahi tuna that's just really well
54:21
seared, a little seasoning, a little salt, pepper, you know,
54:24
let the fish speak for itself. It'll probably be sort of I'd
54:26
anchor that around the main. Maybe a really good I I'm
54:29
thinking Japanese would be a a good venue to go down.
54:33
Go with a nice tuna over some nice rice, just like sliced up
54:39
for you. Like nice presentation.
54:41
Maybe a little seaweed salad on the side.
54:44
I'd probably think about a couple courses.
54:46
Make it really good miso soup to start with.
54:50
I like roasting vegetables a lot, so I'd probably roast up
54:53
some carrots. Look for some, you know, go see
54:55
what's fresh, what's interesting, what's going to be
54:57
colorful. Think about putting that
54:59
together and then maybe serving it out.
55:02
I like to do more family style, like put things out on plates,
55:06
share it around. I think that just makes for a
55:08
better conversation and it comes out nice because it uses a big
55:12
plate with lots of stuff on it looks always looks great.
55:14
So that's probably the direction I would take it in.
55:17
OK. So, Eric?
55:18
What time do I show up for this? Because you absolutely nailed
55:22
that. Like, that is totally my jam.
55:24
I am totally on top of that. So I'm going to invite myself
55:28
over for dinner at some point. Or maybe we'll just go out and
55:29
get a nice sushi dinner somewhere.
55:31
Yeah, no, whenever. Whenever you want, happy to
55:33
happy to cook for the both of you.
55:35
Next time you're up in the Bay Area, we'll, we'll make it a
55:37
date. Jim, how about?
55:39
Yourself like how does that strike you of like a dinner like
55:43
the AHI tuning as possible. Yeah, I'm pretty open minded.
55:46
The only thing I don't like is really strong cheese, like blue
55:51
cheese. I don't like feta.
55:53
It's just the smell turns me off and I've always been that way.
55:57
But other than that, I mean I'm pretty open.
56:00
I mean, I'll even eat like really strong meats, like organ
56:04
meat, like liver and stuff like that.
56:07
So yeah. And wild game, like, I know a
56:11
lot of people don't like that. I think it's interesting.
56:15
So yeah, I'm pretty much up for anything.
56:18
But if you put blue cheese on it, I might just leave.
56:22
Yeah, I'll leave the blue cheese off the nice piece of ahi.
56:25
So there you go that. Sounds good, I totally.
56:28
Appreciate that because blue cheese is one of the things I
56:30
absolutely detest because I spent the better part of
56:34
probably 7 or 8 years bartending and one of the things that we
56:36
had to do was stuffed blue cheese olives for our martinis.
56:39
And so if I never see blue cheese again, I will be totally
56:42
fine with that. I'll, I'll be the contrary and
56:45
say I I like blue cheese. I love a good piece of feta, but
56:48
I, I will probably eat most anything.
56:52
I early in my career, I spent a year in Hong Kong working on a
56:56
project. And yeah, before that I was a
56:58
little, I didn't eat as much seafood.
56:59
I didn't like eggs too much and I just went in with the mentai.
57:03
Like this is a totally new cuisine.
57:05
There's influences from all over Asia here.
57:07
I'm just going to eat whatever. So if it didn't crawl off my
57:09
plate, I'd eat it. And so now I'm a much, you know,
57:13
this has been a while now. It's been 20 plus years since I
57:15
was there, but it's definitely opened my palate quite a bit.
57:22
I was not always. An adventurous eater.
57:24
I would stay I'm, you know, starting to put my toe in the
57:26
water. I was very much like a grilled
57:28
cheese and, you know, chicken Nuggets growing up.
57:31
But as I found as I've gotten older, that I have been more
57:34
willing to try things. So I will try just about
57:37
anything once, just now. I know that like Daniel.
57:41
I mean you you either get experimental or you don't eat.
57:47
I will give a lot of. Credit to Daniel, so you know
57:49
our our boss here at RSM, but he has definitely taken me on some
57:53
excursions and I'm very grateful for that because I have tried
57:55
things that I would normally not have eaten and I've enjoyed some
57:58
of it. I won't say all of it.
57:59
I have enjoyed some of it I. Like, hey, I liked a lot of
58:02
things. I wasn't big on bone marrow, but
58:06
I mean, at the same time I could eat it again.
58:09
Just wasn't my favorite. Yeah, I hear you.
58:14
Yep. I think it's important to try it
58:15
once, see if you like it. You never know.
58:17
You'd be surprised. Yeah, that's how you.
58:19
Discover, you know, Hey, new things, you know, it's kind of
58:21
like music, right? You just like, oh, I didn't
58:24
discover The Beatles until I was 30, or I didn't discover
58:26
Metallica until I was, well, I discovered them, really, but you
58:29
get my drift. Exactly.
58:30
Exactly. Well, Eric, you've.
58:33
Been great and really appreciate you taking some time with us.
58:35
Thank you again for sponsoring an episode here with us.
58:37
I'm going to have links in our show notes here for people to
58:40
reach out to you on LinkedIn. Maybe, you know, share recipes
58:44
or other things, whether it's recipes for, you know, identity
58:46
data or other food items. Let's see what else.
58:50
Visit the website SGNL dot AI slash IDAC.
58:55
There'll be some information there that people can kind of
58:57
check out and that also show support for the show that hey,
58:59
you heard it here on on identity at the center.
59:01
So with that, we're going to go ahead and leave it for this
59:03
week. Thanks everyone for watching and
59:06
or listening and we'll talk with you all in the next one.
59:11
You've been. Listening to Identity at the
59:13
Center? We hope you've enjoyed the show.
59:16
Make sure to like, rate and review, and we'll be back soon.
59:20
But in the meantime, hit the website at
59:23
identity@thecenter.com. See you next time on Identity at
59:29
the Center.