Latest / Identity at the Center / #424 - IDAC Mailbag for May 2026

Transcript

#424 - IDAC Mailbag for May 2026 · Identity at the Center

• 0:04
  This is identity at the center. Welcome to the Identity at the
• 0:11
  Center podcast. I'm Jeff, and that's Jim.
• 0:12
  Hey, Jim. Hey, Jeff, how are you?
• 0:15
  Oh, not so bad yourself. Good.
• 0:17
  I've been waiting to hear you with this one for a while, so
• 0:19
  here you go. Jeff, Jeff, Jeff for Rooney.
• 0:23
  Jeff Stedman making copies. Wow, that is old school little
• 0:28
  Rob Schneider, Saturday Night Live.
• 0:31
  Just so hilarious. I was watching it the other day
• 0:33
  and I'm just like, you know, you can watch those old SNL clips
• 0:37
  and just crack up. It's just, it's so good.
• 0:41
  I think everybody has like the era that they grew up with.
• 0:43
  And so for me it would have been like mid to late 90s, early
• 0:47
  2000s, you know, like Phil Hartman through Will Ferrell,
• 0:51
  right? Stuff like that.
• 0:52
  But honestly, I still watch every episode.
• 0:55
  I still enjoy it. It turned out all fantastic, but
• 0:58
  there's still some gems that are coming out.
• 1:00
  Yeah, I'm, I think the, to your point, like the original OG
• 1:06
  Saturday Night Live was like trying to think of Eddie, Eddie
• 1:13
  Murphy and Dan. Aykroyd a bunch of.
• 1:15
  Other Dan Aykroyd and like you watch this and you're like, I
• 1:18
  maybe like you missed it, right, But I'm sure people seen that
• 1:22
  stuff for the first time. Just bust a gut.
• 1:26
  Yeah, I mean, there are some good stuff too, but I think I, I
• 1:28
  still think like you develop an affinity for your era of SNL.
• 1:32
  So for me, you know, mid to late 90s is probably where I, I
• 1:35
  really first started to like, you know, get it.
• 1:38
  But I still, I still watch it today.
• 1:40
  And have you seen the new SNLUK version?
• 1:43
  No. It's really good.
• 1:46
  Like it might be better than the US version right now.
• 1:49
  The writing, there's only I think 4 or maybe 5 episodes that
• 1:54
  are out so far. And it just started maybe like a
• 1:56
  month ago. You know, they do the same kind
• 1:57
  of cadence, obviously Saturday Night Live, but in in the UK and
• 2:02
  it's, it's good. The writing is on point, the
• 2:05
  content is edgier. I think part of that is just
• 2:07
  because of US broadcast rules, so there might be some language
• 2:11
  that we normally wouldn't hear in the US, but you can you know,
• 2:14
  you can see it on the streaming services.
• 2:15
  But I I've been really impressed with at least the 1st 4 episodes
• 2:19
  have been really good. The last one was a little bit of
• 2:21
  a clunker, but you know, I'll forgive it so far.
• 2:23
  But those they've been good do. You remember that show in living
• 2:27
  color of? Course.
• 2:29
  Fire Marshall Bill. Fire Marshall Bill.
• 2:32
  Yeah. And Denise said she never saw
• 2:34
  that show. And I was like, what?
• 2:36
  OK, we have to go on that binge of watching those on YouTube
• 2:40
  because I don't know. I watch them again.
• 2:43
  I watch something like Fire Marshall Bill and like, I laugh
• 2:47
  like I laughed when it was coming on the first time.
• 2:49
  And maybe that's just me or maybe it's just like the
• 2:52
  nostalgic kicking in, but I think that show was great.
• 2:55
  I I'll go as far as to say it was on par with starting to
• 3:00
  Live, if not more funny. I don't know if I would go that
• 3:05
  far, but there were definitely some memorable characters.
• 3:08
  It it just wasn't long enough and it wasn't on long enough to,
• 3:12
  you know, have that sort of that sustained success.
• 3:14
  I mean, SN LS been around since the 70s and, you know, here we
• 3:17
  are 50 years later, still going. You could argue whether or not
• 3:20
  the quality is there or not, but the fact that they've had a show
• 3:22
  going for 50 years is pretty incredible.
• 3:26
  Yeah, I was on a conference call with somebody the other day and
• 3:30
  their background was the living room of The Simpsons.
• 3:35
  And I'm like, dude, they are still making new Simpsons
• 3:38
  episodes. And I remember that was just
• 3:41
  like a thing on the Tracey Ullman show.
• 3:43
  But that was when I was like a little kid.
• 3:45
  Like that show is amazing. Man, you are like really digging
• 3:49
  in the past. What's next?
• 3:50
  You're going to talk about like Gunsmoke?
• 3:52
  No, now I was actually going to, but I this is my last TV show
• 3:56
  thing. The, the, the other thing that I
• 3:58
  wanted to bring up is just actually futuristic.
• 4:01
  It's like AI, it feels like all these releases are coming out
• 4:06
  like the latest Gemini release and the latest Open AI release.
• 4:11
  What is the latest one with Open AI 5.5 and?
• 4:16
  Yeah, 5.5 or is it 5.7? I can't remember.
• 4:19
  It's like, that's the thing, you can't remember they're coming
• 4:21
  out so quickly. And if you're like us, you'd
• 4:23
  like to try to dabble on all the different models.
• 4:26
  And maybe you think some models are better at certain things
• 4:30
  than others. Like for example, I've been
• 4:32
  using Gemini whenever I have to do any kind of image creation or
• 4:37
  image editing. I just think it does like such a
• 4:40
  fantastic job. You need to check out the new
• 4:43
  Open AI image generator because I've been using that for the
• 4:46
  last few days. The new version of that is
• 4:48
  pretty pretty good. I think it's better than
• 4:50
  Gemini's Nano Banana. Yeah, the nano banana.
• 4:54
  So you're saying it's better? OK, I've got.
• 4:56
  To go into the last week or so, I actually used it for the
• 4:59
  LinkedIn post I made today. So it's April 30th, and I made a
• 5:03
  post today talking about our ID Pro discount and I, you know,
• 5:09
  it's clearly, it's an AI picture, but it's a newspaper
• 5:11
  headline. The text is readable.
• 5:13
  Our logo is on the coffee mug. The URLID pro.org/IDAC is, you
• 5:18
  know, on the coffee mug. Things look pretty, you know,
• 5:22
  pretty good for that kind of thing.
• 5:24
  Yeah. That was the new ChatGPT model.
• 5:26
  It's been really impressive. Yeah.
• 5:29
  And now I think probably because we have paid accounts, it's
• 5:32
  extra good, but I kind of feel like, so here's a good question
• 5:37
  for you. If you can only have one paid
• 5:40
  subscription, what model would you go with?
• 5:44
  You're hurting me right now. You know, if you'd asked me a
• 5:49
  week ago, I would have said Claude.
• 5:53
  Before that it would have been Gemini.
• 5:54
  Before that would have been Chat GPTI find that I keep running
• 5:57
  into too many usage limits with Claude, especially during prime
• 6:00
  time, that Gemini has sort of kind of become my default backup
• 6:05
  when, you know, I run into usage things to Claude.
• 6:08
  But I'm starting to dabble more again with the new ChatGPT
• 6:11
  model. So I don't think you can just
• 6:13
  pick one and say, this is the one I'm going to use.
• 6:16
  If you have to pick one, just go monthly and change your
• 6:19
  subscription cancel. And then, you know, as each one
• 6:22
  pulls ahead, you know, figure or figure out which one you seem to
• 6:25
  like the best. But yeah, I I don't think you
• 6:28
  can just say one right now and ride it 'cause you're going to
• 6:32
  miss something. What do you mean by useless?
• 6:36
  Maybe this is like where I'm like all right, I'm not here to
• 6:39
  get hard enough, but I've never run into useless limits with
• 6:43
  anything. I don't have a claw subscription
• 6:46
  yet. So I have a claw subscription.
• 6:48
  I have, you know, the $20 one or whatever it is.
• 6:50
  And between the hours, I believe their prime time hours are 8:00
• 6:53
  AM to 3:00 PM US Eastern Time. And if you're using it during
• 6:57
  that period, you know, you will you, you run the risk, I think
• 7:01
  of running into more usage limits.
• 7:03
  And typically it's either like long documents or, you know, if
• 7:05
  I'm vibe coding up some little app that I'm working on, right?
• 7:08
  Things like that, you know, things with long context
• 7:11
  windows, lots of tokens meet basically lots of characters and
• 7:14
  words and things like that, you tend to run into it sooner, You
• 7:19
  know, just from a comparison standpoint, I, I very rarely
• 7:21
  would run into anything like that on the Gemini side.
• 7:23
  And I have a page Gemini count as well and I have a page at
• 7:26
  GPT. So just for, you know, and I
• 7:30
  think part of it might have been just Claude's success over the
• 7:32
  last couple months and them getting really big, especially
• 7:34
  with things like open Claw and like the craze around that.
• 7:37
  And it's a very impressive model.
• 7:38
  It does a lot of neat stuff. But yeah, I, I, of all of the
• 7:42
  three major services that I, that I use, Claude is the only
• 7:45
  one that I consistently will come up against usage limits.
• 7:48
  And they make it really easy to spend money.
• 7:50
  They're like, it's a little thing that says like, click here
• 7:52
  to continue and your credit card gets charged, you know, for
• 7:54
  usage. And next thing you know, you've
• 7:56
  got 50 extra dollars and like, oh shoot, you know what?
• 7:59
  Why did I pay for that? Well Speaking of like charges,
• 8:04
  it sounds like the Chinese models, DeepSeek, Kimmy are the
• 8:09
  two that I've heard the most about are very low cost to
• 8:17
  almost free. Have you messed with those at
• 8:21
  all? Not substantially.
• 8:23
  You know, I've poked around a little bit, but I tend to stick
• 8:25
  with the, at least in the US, the three kind of major
• 8:28
  commercial models. I would say.
• 8:29
  I tell you what I don't play with is copilot at all really.
• 8:32
  They've kind of been out of sight, out of mind for a long
• 8:34
  time, even though they basically just have like a reskinned
• 8:37
  version of ChatGPT. And now they've got, you know,
• 8:40
  some of the clawed models in there, But it still seems like
• 8:42
  it's behind the the original versions.
• 8:45
  And I'm not sure why that is, but.
• 8:48
  I wind up using that a lot because our employer, my
• 8:52
  employer does use that model predominantly.
• 8:56
  That's the only reason I use it is just for that stuff.
• 8:59
  It has access to our corporate, you know, file shares and things
• 9:03
  like that. Hopefully I'm not sharing any
• 9:06
  private information. You know, they're just not
• 9:09
  really doing it. I'm sure a lot of our listeners
• 9:12
  are in the same boat. And so a lot of I, I feel like
• 9:18
  the security around what's available through Copilot is
• 9:23
  probably like, hey, you're not taking your private information
• 9:27
  and training a public model. I think that's fair.
• 9:31
  I think Microsoft is going to go done at least a decent job, if
• 9:34
  not good job of yeah, at least the messaging around the
• 9:38
  segmenting of how your your organizational data is being
• 9:41
  used and where it can, can go to within these frontier models and
• 9:46
  kind of what they're doing. So I think they've done a good
• 9:48
  job with that. It would surprise me if ChatGPT
• 9:52
  and Anthropics, Claude and Gemini didn't have the same kind
• 9:56
  of functionality. I just don't have any experience
• 9:58
  on like their enterprise, you know, kind of versions.
• 10:00
  I'm assuming that they do, otherwise they would have a
• 10:03
  really hard time getting any usage in an enterprise.
• 10:07
  But yeah, I think Microsoft is is sort of kind of like the
• 10:09
  enterprise de facto just because they have such a huge install
• 10:12
  base through things like Office and and Outlook and you know,
• 10:15
  Azure and stuff like that. Yeah, Yeah.
• 10:17
  I think, you know, when you're doing enterprise software, your
• 10:21
  monetization model becomes pretty clear.
• 10:24
  You sell some kind of. So you start.
• 10:26
  Slapping copilot and literally everything, including a keyboard
• 10:29
  button that nobody ever uses. Yeah, right.
• 10:33
  So I said I guess we should probably.
• 10:38
  We've gone from the 70s of watching reruns and TV shows all
• 10:43
  the way up to stuff that is happening now or is going to
• 10:47
  happen. Something else is going to
• 10:49
  happen is the conferences we're going to attend.
• 10:53
  Yep, we have. See by the time people listen to
• 10:56
  this, we'll have already come back from EIC victorious and
• 10:59
  champions of something, I'm not sure what yet and enjoyed that
• 11:03
  I'm sure. And then we've got identifiers
• 11:05
  coming up. So IDV 26 dash, IDAC 30
• 11:10
  percentage sign get you 30% off time is running out.
• 11:15
  If you are looking for that code, you'll find it on our
• 11:17
  website idacpodcast.com. Hopefully we see lots of
• 11:21
  familiar faces there. We're going to do some podcasts
• 11:23
  recordings and you know we're doing our majority rules game
• 11:26
  show there. So if you have checked that out
• 11:29
  either like Gartner or other CRA events like you know, back back
• 11:34
  last year or even if you're at sale point navigate, that was
• 11:37
  when I first debuted it. It was sort of like a test run
• 11:38
  and went really well. So it's a lot of fun.
• 11:41
  Everybody gets to play. You play on your phone.
• 11:43
  I kind of emcee it with Jim up on the stage.
• 11:46
  And we have prizes, right? So far, the only prize that I
• 11:49
  can announce so far is the top winner, and there can be
• 11:53
  multiple winners and there will be gets a free pass to next
• 11:57
  year's Identifiers conference. So that's a nice little thing
• 11:59
  that CRA is hooking up with us. So shout out to Shirley for her
• 12:02
  help with that. Yeah, yeah.
• 12:04
  Even if your employer's normally going to pay for you to go, I'm
• 12:08
  sure they'll be happy that you can say, hey, we don't have to
• 12:11
  buy a pass, or maybe we can send somebody else.
• 12:15
  And of course, if you're paying it out of your own pocket like
• 12:18
  so if you have to pay out of your own pocket, I recommend you
• 12:22
  go to Majority rules and try to win the darn thing.
• 12:25
  Yeah, Besides that, we're going to have other prizes too.
• 12:28
  Yeah, we're, we're trying to source other things, so, you
• 12:31
  know, stay tuned for that, but hopefully people come out and,
• 12:33
  and check that out. I, you know, before we get into
• 12:36
  today's, you know, discussion, which is going to be a mailbag
• 12:39
  episode, I do want to remind people about our ID pro.org/IDA
• 12:44
  website. And, you know, and I want people
• 12:46
  to know about it, but also gives me a chance to try out fancy
• 12:48
  graphics on the screen. So for people who aren't
• 12:51
  familiar, this is something we talked about over the last
• 12:54
  couple weeks. You can see that maybe on
• 12:55
  LinkedIn, but for the first time ever, we have a discount for
• 12:58
  IDAC listeners and really anybody who can take advantage
• 13:01
  of it. But if you go to idpro.org/IDAC,
• 13:04
  all new members signing up for their membership will get $25
• 13:07
  off their first year. So very cool that ID Pro is, is
• 13:12
  continuing their partnership with us.
• 13:14
  We're the official podcast for them and you know, obviously you
• 13:16
  and I are big supporters of the organization and, you know, take
• 13:19
  part in it in in various ways. Yeah, I mean, anything we can do
• 13:24
  to encourage people to go and join ID Pro.
• 13:27
  And if you're not sure, like they have a lot of resources on
• 13:30
  their website that are available free to the public, like the
• 13:34
  body of knowledge. So go out there, check that out,
• 13:37
  but really consider, you know, supporting the professional
• 13:42
  association for identity practitioners.
• 13:45
  This is I mean, in my book, it's the maybe it's the only it's the
• 13:52
  only one I think about, you know, go ahead and support them,
• 13:55
  become a member. It's not just a donation either,
• 13:59
  right? You get a lot out of it.
• 14:00
  They have the Slack channel, things like that.
• 14:04
  The other thing I wanted to also say is just, you know, CRA and
• 14:09
  Cooper and Coal, they done a really good job of, you know,
• 14:12
  supporting the podcast and, you know, making sure that we're
• 14:16
  able to go to their conferences and we have places to set up and
• 14:20
  do the podcast. And, you know, without their
• 14:22
  support, it would be much harder for us to kind of bring that
• 14:27
  inside view of what's happening at the conference to the people
• 14:30
  who listen to this podcast. And you know, I think since
• 14:33
  we've started going to conferences and recording on
• 14:36
  site and we've been doing it like 3 years now, not everybody
• 14:41
  can go to these conferences, right?
• 14:42
  So hopefully we can bring a little bit of flavor of like
• 14:45
  what it's like to be there to the folks.
• 14:48
  Yeah, live vicariously through US.
• 14:50
  Or as vicarious as as we get, anyway.
• 14:53
  Yeah, exactly. All right, let's get into kind
• 14:56
  of the chunk of the episode here.
• 14:58
  We got a lot of questions. We're going to try and get
• 15:00
  through up to five, but we may skip a little bit for time just
• 15:03
  to kind of keep this reasonable. But let me start off with the
• 15:07
  first one. This one is from Isabel in
• 15:09
  Amsterdam, one of my favorite cities based on my trip last
• 15:12
  year. So shout out to Amsterdam.
• 15:14
  With so much IAM vendor consolidation happening right
• 15:18
  now, how should practitioners think about their existing
• 15:21
  stack? I feel like I just finished an
• 15:23
  implementation and now my vendor is being acquired.
• 15:26
  How do you evaluate whether to stay, migrate, or wait it out?
• 15:31
  This is a very timely and excellent question.
• 15:33
  Jim, do you have thoughts on this one?
• 15:36
  Yeah. So I, I, I think, you know, one
• 15:39
  of these types of questions, it's all about the context and
• 15:43
  all about the details of where you're starting out.
• 15:46
  So I'll take Isabel's question and pull it apart.
• 15:50
  One of the things was we just finished the implementation, so
• 15:53
  there must have been something that drove you to the product.
• 15:56
  Usually, I think the biggest things that drive people to
• 15:59
  products is they're impressed with the product, but they're
• 16:02
  also impressed with the leadership of that that vendor
• 16:07
  organization. So maybe you got to meet people
• 16:10
  who are like the CEO and CTO, but also your account manager
• 16:19
  and people who you're going to support you going forward.
• 16:21
  So let's make the assumption you have done that and that you have
• 16:26
  some trust in them. Obviously, you also thought the
• 16:29
  product would do a good job in terms of supporting your use
• 16:32
  cases. So I think acquisitions are
• 16:37
  either inevitable or they're always a risk that you face in
• 16:41
  this space. I mean, my original starting
• 16:43
  point in Identity was implementing a technology called
• 16:48
  Oblux. I mean, it got bought by Oracle
• 16:51
  not very long after we finished the implementation.
• 16:55
  It turned out to be a good thing in, you know, for a couple of
• 16:58
  years. Eventually we wound up changing
• 17:01
  horses and going with a different technology.
• 17:04
  I think in this space, you almost have to assume that's
• 17:06
  going to happen, but I wouldn't try to take evasive actions just
• 17:12
  based on the fact that your vendor that you implemented got
• 17:17
  acquired. I'd say let the dust settle.
• 17:19
  See, are they going to be as supportive?
• 17:22
  You know, did they fire all the people from the organization or
• 17:26
  are those people maybe playing important roles going forward?
• 17:29
  So I think context matters in this type of situation.
• 17:33
  What do you think, Jeff? Yeah, I think you're kind of
• 17:36
  think the same thing I was thinking is, OK, things happen,
• 17:39
  let's figure out where we go next.
• 17:42
  You know, in my experience, it takes a good two years even
• 17:45
  after an acquisition has started or even, you know, officially
• 17:48
  closed, I guess would be the right way to put it for really
• 17:51
  anything to happen. So you've probably got some
• 17:54
  runway to your next step. You know, maybe it's staying
• 17:59
  there, maybe it's not. Look, you're the customer, you
• 18:01
  know, make your feelings known with, you know, the the company
• 18:04
  of what your expectations are. It's on them to keep you as a
• 18:07
  customer. I understand that, you know,
• 18:09
  pulling technology out might be tough, but you know, things
• 18:13
  happen. And then I'll be another
• 18:14
  question that we'll be talking about, you know, later here.
• 18:16
  But you've got time to think about it and use that time to
• 18:20
  think about what your next steps are in game plan and figure out,
• 18:24
  OK, well, let's say this thing doesn't work in two years.
• 18:26
  What's our road map off of this? Or maybe things are going well
• 18:30
  and it's OK. Yeah, we're fine, right.
• 18:31
  You want, you kind of want to be like Littlefinger.
• 18:33
  You know, you're fighting every battle everywhere all at once.
• 18:35
  You're not surprised. I I love that quote, despite him
• 18:38
  being a horrible person. And that's, that's kind of my
• 18:42
  thought process on it. Where you'll get your biggest
• 18:45
  sense of how things are going is the people.
• 18:48
  If you start noticing people that you've been dealing with
• 18:51
  leaving the new organization, you know, that is a warning sign
• 18:55
  to start thinking about. You know, I've bought products
• 18:58
  that have been acquired and new sales people show up and hey,
• 19:02
  we're here to assure you and everything's going great.
• 19:04
  And then I never heard from them again.
• 19:06
  And guess what? That product was, you know,
• 19:08
  pretty much butchered and gone a couple years later.
• 19:10
  So I would keep an eye on the personnel, the people, the
• 19:14
  people that you've grown hopefully to like and trust at
• 19:17
  your vendor. If they start disappearing, that
• 19:20
  is a warning sign that, you know, maybe the things are not
• 19:23
  going where it needs to go. And you should definitely make
• 19:25
  your voice heard as a customer to make sure whoever your vendor
• 19:29
  is that they're aware of it and they need to be keeping you as a
• 19:33
  customer. You don't need to keep them as a
• 19:34
  vendor. You need to keep them.
• 19:36
  They need to keep you as a customer.
• 19:38
  That's right. And if you think about the
• 19:39
  motivation that companies usually have to acquire another
• 19:44
  vendor, it's like hey, they want to acquire the customers.
• 19:47
  They don't just want the technology.
• 19:50
  Often times it's about getting the customers.
• 19:53
  I would say that's probably the large majority of the instances
• 19:57
  is like, hey, we have a total cybersecurity offering if we go
• 20:03
  and acquire this technology that makes our footprint more
• 20:08
  complete, but we also can sell into them more things.
• 20:11
  So I think that just kind of supports the point that you're
• 20:15
  making, which is, you know, they need to keep you as a customer.
• 20:19
  In fact, they probably want to grow your relationship so.
• 20:24
  The other thing I would say is I just thought of this as you were
• 20:27
  talking, like, go ahead and ask the blunt questions.
• 20:30
  Like you don't have to beat around the Bush.
• 20:32
  Just ask them like, hey, I talked to another one of your
• 20:36
  customers and they said that they had these support issues
• 20:41
  and you weren't, you know, if it's true, right?
• 20:44
  Don't make up issues, but they said that, you know, they got
• 20:47
  the run around. Like what are you doing about
• 20:50
  that? Like how do I, how do I, how can
• 20:52
  I be sure that that's not going to happen to me?
• 20:56
  So I think you can be very blunt with them, and I'm talking about
• 21:01
  being very blunt with the new management too.
• 21:04
  Yeah. I, you know, you bring up
• 21:07
  something that I still want to think about is what is the
• 21:09
  motivation for the acquisition? And you talk about one right, is
• 21:13
  buying customers, you know, sometimes that it's actually for
• 21:16
  the technology and they want to, they want to get into that
• 21:19
  technology space. And you know, maybe there's
• 21:21
  patents that you can't get around and you know, somebody's
• 21:23
  done a good job of kind of building the technology around
• 21:25
  it. But you know, especially when I,
• 21:27
  you know, I will kick down the 4th wall, right?
• 21:30
  Especially in consulting, when you see another consulting firm
• 21:33
  buy another consulting firm, they're usually buying that per
• 21:37
  that consulting firm's book of business, meaning their
• 21:39
  customers. The.
• 21:40
  People who are doing the work are sort of kind of coming along
• 21:43
  for the ride. And, you know, the hope is that
• 21:45
  things work out. But generally speaking on at
• 21:47
  least in the consulting and the services industry, you know, we
• 21:51
  work for one, right? We're always looking to grow,
• 21:53
  you know, the services that we do.
• 21:55
  That is an area where you want to be concerned about because
• 21:57
  sometimes that that causes some challenges.
• 21:59
  Technology is more in addition to the fact that not only do you
• 22:03
  want to buy the book of business that, you know, you're that the
• 22:05
  new technology firm acquiring the the other technology firm,
• 22:09
  you're getting access to them from their customer standpoint.
• 22:13
  But there is also the added like, yeah, maybe they actually
• 22:15
  do have a good technology and it it does make sense for them to
• 22:18
  acquire. You know, it'd be weird if like,
• 22:20
  you know, some, you know, technology firm, I'll say like,
• 22:22
  you know, Microsoft, you know, went out and bought something
• 22:25
  that had nothing to do. Well, Microsoft's not a bad, not
• 22:28
  a great example because they do so much.
• 22:29
  But, you know, let's say an IGA firm goes out and buys something
• 22:33
  that's like totally unrelated to identity or security, right?
• 22:37
  They get into like making hamburgers, like, OK, what is
• 22:40
  the point of that, right? So the motivation is a great
• 22:44
  angle. I'm glad you brought that up.
• 22:46
  Yeah, no, and I agree 100% of it.
• 22:48
  There's not a whole lot to add, but it did make me think about
• 22:51
  being on. The.
• 22:53
  Well, no, I mean different angle, which just really doesn't
• 22:58
  answer Isabel's question at all. But if you are in the consulting
• 23:03
  firm or in the tech firm and you wind up being acquired, right?
• 23:07
  So now you're the person who's going to have a new employer,
• 23:11
  sometimes you get messaging which probably doesn't align
• 23:16
  with reality. So and thinking of like, hey,
• 23:19
  they bought that book of business.
• 23:20
  But they're telling us that, yeah, we made this acquisition
• 23:23
  because we want the people. And I'm not saying it's never
• 23:28
  true, but they could just hire the.
• 23:32
  So yeah, it's something to think about.
• 23:37
  I I don't want to go on here and.
• 23:39
  I have some experience in this space, I think, but just leave
• 23:42
  it at that. Try to understand the
• 23:44
  motivations, keep an eye on the people around the product that
• 23:48
  you picked, you know, whether the product is actual product or
• 23:50
  services, you know, but also take a look at where does it fit
• 23:53
  strategically for the acquiring company?
• 23:55
  Like what? What do you think their plan is
• 23:56
  going to be for? And yeah, be blunt.
• 23:58
  Ask the questions. Like refreshingly, I love it
• 24:00
  when people just ask me straight up instead of beating around the
• 24:02
  Bush, like, OK, well, here's the answer, right?
• 24:04
  Let's have an honest conversation around it.
• 24:05
  And hopefully you'll get an honest conversation.
• 24:07
  But bring up some good points there.
• 24:11
  All right, let's get to question #2 from, I hope I pronounced
• 24:14
  this right, Rajan Rajan from Mumbai, India.
• 24:19
  Raj, we'll shorten it. We are seeing more and more
• 24:22
  attacks that use AI generated deepfakes to bypass identity
• 24:25
  verification, especially during remote onboarding.
• 24:29
  Is this a solved problem and what should organizations
• 24:31
  actually be doing to defend against it?
• 24:34
  I will point Raj to a previous episode that we did earlier this
• 24:38
  year around the reports kind of analyzing the Q1 sort of
• 24:40
  identity reports that are out there.
• 24:42
  And I think it was was it Hyper that had like the one that was
• 24:45
  like 70% of their customers or something had already been, had
• 24:50
  already seen a deep fake attack. And I was kind of blown away
• 24:52
  about that number. But that leads me to believe
• 24:55
  that this is not a self problem. But what do you think, Jim?
• 24:58
  Well, I think the the issue is when you're doing this a scale,
• 25:02
  I mean, that's where it becomes where the deep fakes might slip
• 25:06
  through the cracks. But it's a, it's just a very
• 25:09
  real problem. I think it used to always be
• 25:11
  like, hey, this, this is what might happen in the future.
• 25:15
  But then you hear about people who wind up getting jobs and
• 25:20
  really it's just a, a backroom office of people doing the work.
• 25:24
  And it seems like you have a legitimate human being.
• 25:28
  I think it's an arms race between the identity
• 25:34
  verification software, which is required to do this at scale,
• 25:38
  and the deepfakes that could come along with it and
• 25:42
  identifying those. I also think that if that's all
• 25:46
  you're going to rely on is the arms race, that means you're
• 25:49
  going to lose some of the battles.
• 25:52
  When you lose some of the battles, that can be very
• 25:54
  costly. So I don't think you can accept
• 25:57
  just relying on technology identifying or flagging
• 26:02
  deepfakes. You're going to have to also
• 26:06
  rely on, you know, process and people.
• 26:09
  So having a process where you have fail safes or you know,
• 26:14
  people checking work, you'll have to also educate people to
• 26:19
  what to look for. It's just like phishing, right?
• 26:22
  You, you have software that takes phishing emails and you're
• 26:26
  getting millions of emails today.
• 26:28
  If you didn't have software that tried to catch the phishing
• 26:32
  emails, you would just have an inbox full of junk mail, right?
• 26:36
  So it gets those and it quarantines them.
• 26:39
  There's still some get through the cracks, right?
• 26:41
  And now you're relying on people in process.
• 26:44
  So it's like the people like hopefully identify like, hey,
• 26:47
  this looks like a phishing e-mail.
• 26:49
  And then the process becomes they're supposed to report that.
• 26:53
  So the the cycle becomes a update the software and I think
• 26:57
  it's very much the same kind of operation here.
• 27:01
  Like you, you need the technology so you can do hiring
• 27:04
  at scale. Hopefully it catches most of the
• 27:08
  deepfakes, but you need to have a backstop to that.
• 27:11
  What are your thoughts? Yeah, I think the, I don't think
• 27:14
  this is so much a technology problem anymore.
• 27:17
  I think there's plenty of solutions, you know, out there
• 27:19
  that will help with identity verification, you know, whether
• 27:21
  it's document or liveness detection, right, or things like
• 27:24
  that, you know, will it catch everything?
• 27:27
  No, but I think this is where the layers come in, right?
• 27:30
  If you have multiple steps, it's probably your identity
• 27:32
  verification process. Now you've got a fighting chance
• 27:35
  against it. The again, I don't think the
• 27:37
  problem is technology. I think the problem is we
• 27:39
  didn't, we haven't made investments yet holistically as
• 27:41
  sort of like a collective, we meaning everybody to to
• 27:45
  implement identity verification into our processes, whether it
• 27:48
  is authentication or calling a help desk and saying, hey, this
• 27:52
  is Jeff, reset my password. And guess what?
• 27:54
  I you just got social engineer because that's still the number
• 27:56
  one way that people are getting, you know, breached and have
• 28:00
  account compromises. It's not the technology we did.
• 28:03
  What we did is we didn't buy the technology yet.
• 28:05
  Technology exists. We just haven't got it into the
• 28:08
  enterprise budget cycle to say, OK, this year, now we're going
• 28:12
  to set aside some money to do identity verification.
• 28:15
  For the last few years. If it was working on identity,
• 28:17
  you were probably working on privileged access management or
• 28:20
  IGA or, you know, before that would have been like MFA, right?
• 28:23
  And authentication with, you know, people working, you know,
• 28:25
  more remote than they had ever before.
• 28:27
  It takes a time for enterprises to catch up with the cycle, you
• 28:32
  know, unless you're a well funded, maybe you're in a high
• 28:34
  risk, high regulatory environment like a bank, you
• 28:37
  know, finance, education, healthcare, right, things like
• 28:40
  that. Government, right, where there
• 28:42
  are more reasons to do it sooner.
• 28:44
  It takes time for that, you know, the rest of us to kind of
• 28:47
  catch up. So if you don't have identity
• 28:49
  verification on your radar as a technology investment, you
• 28:54
  probably should be looking at that sooner rather than later.
• 28:57
  I don't know if you need it right this second.
• 28:59
  Only you can decide what that means, you know, from a risk
• 29:01
  perspective for your organization.
• 29:02
  But tools are out there. You know, they've, we've had
• 29:05
  many on our show, a lot of our sponsors, you know, play
• 29:07
  Netspice, you know, go back and look at some of those episodes.
• 29:10
  But it is my mind, it is a solved technology problem.
• 29:14
  It's not, it's not a solved implementation problem because
• 29:16
  there's not enough people using it.
• 29:18
  Does that make sense, Jim? Yeah.
• 29:20
  I, I want to follow up on something I was talking about,
• 29:23
  which was kind of those framework of having the
• 29:25
  backstop. And I've been a kind of a vocal
• 29:28
  critic of user access reviews, identity governances, like, OK,
• 29:33
  well if you're doing things right, then send me out a bunch
• 29:37
  of reviews to people to go through.
• 29:41
  You know, we had a guest on. Who called it?
• 29:43
  Anthony, right. Anthony Viggiano.
• 29:45
  Yeah, exactly. He called IT security theatre.
• 29:49
  And I was like, dude, that is the quote of the year.
• 29:52
  I think it can be security or yeah, security theatre, but I
• 29:57
  also think you can have real value.
• 29:59
  Like the reason we always did it in the past is that the reality
• 30:03
  is, is that processes breakdown. But I think we're in a case here
• 30:07
  also. I think you always have to have
• 30:09
  the mindset of like, OK, we're especially when you're doing it
• 30:12
  things of scale and relying on technology is like, what if the
• 30:16
  technology misses some things and if onesie twosie getting
• 30:20
  through doesn't matter or it's not that big of a deal, fine,
• 30:24
  just live with that. But as far as like you hire
• 30:28
  somebody who's not a real person, like how many of us can
• 30:31
  you afford to let's slip through, right?
• 30:33
  So having kind of that approach, I think is important.
• 30:38
  I also wanted to just point to I called it an arms race.
• 30:42
  So what was that kind of meaning by that is I've been watching
• 30:46
  these AI videos lately. It was like, you know, I like
• 30:50
  taking a period of history like the Black Plague and the
• 30:54
  somebody will create this narrative in an AI video.
• 30:59
  And these things are incredible. Like I am very grateful for the
• 31:05
  people who put them together, but they're so entertaining.
• 31:08
  But weird things happen even in these videos, right?
• 31:12
  So I was watching 1 the other day and the person, they were
• 31:16
  doing something with a broom and then they turned around and it
• 31:19
  turned into a mop and they were mopping like there were and I
• 31:23
  had to rewind to play it again. I'm like, that really happened.
• 31:26
  It's just like magically turned into one.
• 31:29
  And I've seen other. I don't know what you would call
• 31:32
  these things like blips. And I remember seeing a video
• 31:35
  where someone was like, oh, here's how you detect fake AI
• 31:39
  videos. Like watch this one where the
• 31:41
  person standing there talking and a car goes and then it never
• 31:44
  comes out the other side and like, OK, dude, what?
• 31:49
  You know, in a year from now, that's not going to happen
• 31:51
  anymore. Or maybe it's not a year.
• 31:53
  Maybe it's a year. At some point, the AI video is
• 31:56
  going to get better. And these modes for figuring out
• 32:00
  what's fake, like if we're relying on stuff like that, like
• 32:03
  minor flaws, you know, those Meyer flaws are going to be
• 32:07
  fixed and then the deepfakes are going to get better.
• 32:10
  The technology has to get better at detecting the small little
• 32:14
  things. And I'm telling you, when it
• 32:17
  gets to that, more and more of these things are probably going
• 32:20
  to get through. Obviously, the technology will
• 32:23
  continue to get better and the arms race will continue on.
• 32:26
  But that was a little bit more about my thinking.
• 32:32
  I think those are good points. I want to move to the next
• 32:33
  question because it kind of it kind of ties into this slightly,
• 32:36
  but this one is from Caleb in Austin, TX.
• 32:39
  We have a huge contractor and 3rd party population that
• 32:42
  touches sensitive systems and honestly our Denny governance
• 32:45
  for them is nowhere near what it is for full time employees.
• 32:47
  How are mature organizations actually solving this and where
• 32:50
  do you start? I mean, this kind of ties into
• 32:53
  the fact that you know, do you know who you're onboarding,
• 32:56
  right? Have you done any verification
• 32:57
  as part of that process? And you know, this is, I think
• 33:01
  this has been sort of a classic example where, you know,
• 33:04
  organizations have historically done a decent job of knowing
• 33:07
  where their employees were, but the non employee population has
• 33:11
  sort of been left behind. I do think it's gotten better
• 33:14
  over the last few years. I would say over the last seven
• 33:17
  or eight years, I've noticed a bigger shift where what I'll
• 33:21
  call like HR departments, right, or their equivalents, whatever
• 33:24
  your group calls them is. OK.
• 33:26
  Yeah, there's kind of been the war that was been fought where,
• 33:29
  you know, human resources only really tackled employees and
• 33:33
  contractors and non employees were like, well that's the
• 33:36
  business's problem and it ended up being IT's problem.
• 33:39
  And if it was IT's problem that became the identities team
• 33:41
  problem to to try to figure out how to track these people.
• 33:44
  I see a better job of HR teams for using just a common name of
• 33:51
  taking those folks into account. Part of it is technology.
• 33:54
  Now people have modern ERP systems that do support
• 33:57
  different personas right within it.
• 34:00
  Licensing has also caught up with some of that.
• 34:02
  You know, instead of paying for a full employee license, some of
• 34:06
  these software vendors also now have light licenses that might
• 34:09
  be more applicable for contractors or vendors or things
• 34:11
  like that. So I do think it has been a
• 34:15
  challenge, but I do think it's getting better.
• 34:16
  And IGA solutions have been tackling this for a long time.
• 34:19
  This is been a feature of a lot of IGA solutions where they do
• 34:22
  have like a non employee management system of some sort,
• 34:25
  right? They can, a person can go in and
• 34:28
  input it. Not as good as getting all your
• 34:30
  data from one source, but sure, sure, better than like a
• 34:33
  spreadsheet, right? Or an Access database or or
• 34:36
  something like that. What are you seeing when it
• 34:38
  comes to the management of non employees with an organization?
• 34:42
  Let's see if we can help Caleb out here.
• 34:44
  Yeah, I mean, so Jeff, I'm sitting here shaking my head the
• 34:47
  whole time I was off camera. But you and I have worked
• 34:51
  together for so long. We used to call those one of the
• 34:54
  holy wars in identity, right. And you rightly pointed out HR
• 35:00
  groups. And I, I could say if you're
• 35:02
  bash on HR, because I've always thought like, if you're not in
• 35:07
  charge of who works here, then like, what is, what's your
• 35:12
  functions is just payroll? Like, do you want to have such a
• 35:17
  closed mind? And guess what?
• 35:18
  The reality of like who works here is the future is going to
• 35:22
  be 90% machines work here. So your role becomes very, very
• 35:27
  small if you're not including humans beyond it full time
• 35:31
  employees or, you know, employees that get a paycheck.
• 35:36
  What is what is HR going to be called the future?
• 35:38
  It's human resources. What is it you know, Just
• 35:41
  resources is it? Payroll.
• 35:44
  People and talent OR like all these other crazy names, it's
• 35:47
  they all mean the same thing, right?
• 35:48
  It's like entity resources maybe?
• 35:51
  Yeah. So what I've always thought
• 35:55
  about this and I think you're right.
• 35:56
  Like we're seeing a lot of organizations where the HR
• 36:01
  groups have stepped up and said, all right, we are going to be
• 36:05
  responsible for this bigger group.
• 36:07
  And to give them credit, this bigger Group A lot of times has
• 36:10
  a lot of nuances. But them saying that we're not
• 36:14
  going to take ownership of it doesn't make the problem go
• 36:19
  away. You just mean somebody else has
• 36:21
  to solve it. And I think it's usually winds
• 36:25
  up being a team that's less equipped to solve it.
• 36:28
  Often times this, IT has to solve it.
• 36:31
  Sometimes just finance, but they only have a part of the picture,
• 36:35
  which is how do you give people access or how do you make sure
• 36:39
  that these people get paid? Further compounding things,
• 36:44
  every company seems to have employees, right?
• 36:46
  They all have employees that they make paychecks to.
• 36:49
  So it's like, you know, how you manage employees and employee
• 36:53
  life cycle and their access, It's kind of solved and it's the
• 36:58
  same solution just about everywhere.
• 37:00
  But these non employees that are human beings, not talking about
• 37:04
  the ages here, these non employees are, they're different
• 37:10
  from organization to organization.
• 37:11
  So you think about a healthcare organization versus a university
• 37:17
  versus a government versus, I don't know, you name like a
• 37:22
  restaurant or something. Some of them have like the
• 37:26
  public has to have I DS am I sitting here saying that you
• 37:30
  should put members of the public in your HR system?
• 37:34
  Absolutely not right, Like there has to be some line right?
• 37:38
  And I but I I think that's what the discussion often becomes is
• 37:42
  like, all right, well, we can't put those people in our work
• 37:46
  day. Well, no one said you had to put
• 37:48
  the people in your work day, But you know, if they break some
• 37:52
  kind of rule, like they're harassing somebody else, like,
• 37:57
  are you just as responsible as an organ, as a as a company in
• 38:01
  the eyes of the law, whether a contractor did that or an
• 38:04
  employee did that? So that's why I've always been a
• 38:07
  fan of saying HR should own the issue.
• 38:10
  But sometimes it does go and it becomes like, hey, much bigger
• 38:16
  than just contractors who work for, you know, tech systems or
• 38:21
  something. I'm not picking on tech systems.
• 38:23
  They're just often a a big company within this big realm.
• 38:29
  There's like different solutions you've named.
• 38:32
  IGA systems often have special functionality for non employees.
• 38:39
  Delegate administration often becomes a big thing when you
• 38:42
  say, hey, we have a, you know, a lot of people who work for this
• 38:45
  big consulting firm. So many people that are coming
• 38:48
  in and out and they do, you know, they might have to reboot
• 38:52
  a server and might have to have access.
• 38:56
  You can't keep track of who those people are.
• 38:58
  So you turn over that delegated administration function to
• 39:02
  somebody who works for it, who's outside of your company.
• 39:05
  So truly at at that. And that kind of use case, the
• 39:10
  situation might be like, the only reason we're really
• 39:13
  managing these people is so that they have access to the systems
• 39:18
  versus like that, that true kind of contractor population.
• 39:23
  But these are all the difficulties that go into it.
• 39:26
  I'm sorry, I don't have like 1 silver bullet answer.
• 39:28
  It might be federation. It might be some kind of module
• 39:32
  in your IGA system. It might be putting those people
• 39:35
  in your HR system. It might be some combination of
• 39:38
  all of them. And this is where like applying
• 39:41
  your experience, wherever your experience is and pulling
• 39:45
  together subject manager experts within your company, that's
• 39:49
  where it's going to be important.
• 39:51
  Sorry, I kind of rambled there, Jeff.
• 39:53
  No, man, you got in your soapbox and you preached so good on you.
• 39:57
  You you put up a couple options there.
• 39:59
  You know, I think here's what you here's what you cannot do
• 40:02
  ignore it. Like if you ignore it, that's
• 40:04
  just going to become a bigger problem down the road and.
• 40:07
  Yeah, it's not going to make the organization more secure.
• 40:09
  It's not going to make it any more efficient, and it's just
• 40:12
  going to become a nightmare and continue to become a nightmare.
• 40:14
  Further evolve is a nightmare, I should say.
• 40:16
  So you cannot ignore it. Have the discussion, figure it
• 40:20
  out. At the end of the day, I don't
• 40:21
  care where they, you know, where, where they're coming
• 40:24
  from, as long as the organization has a plan for it.
• 40:28
  We know that this set of population is coming from this
• 40:30
  area. Maybe just federation, maybe
• 40:32
  this set of the population will go into, you know, the HR
• 40:35
  platform or an ERP platform or whatever it may be so we can
• 40:37
  track them. Maybe there's part of this is an
• 40:40
  IGA, right? I don't care.
• 40:42
  It doesn't necessarily have to be centralized, but they should
• 40:45
  be some accountability and some, you know, ownership over that
• 40:49
  process. If you're a very large
• 40:50
  organization, maybe it's not HR, maybe it is like a third party
• 40:54
  vendor management team, right? Because you're so large, because
• 40:56
  you have so many different vendors, but you just, you
• 40:59
  cannot ignore it. Have the conversation, fight the
• 41:03
  good fight, document the conversations.
• 41:05
  I've been there. It took me years and a prior
• 41:08
  employer to have our HR team finally see the light and
• 41:12
  actually build into a custom ER pieces there into our custom ERP
• 41:15
  system there a module to track contractors.
• 41:18
  It took years and in the meantime, you know things aren't
• 41:21
  getting any better, but at least starts conversation rely on your
• 41:25
  relationships. But if you ignore it, you're
• 41:27
  just you're you're never you're never going to catch up.
• 41:30
  It's just going to continue to be a problem for you.
• 41:32
  Yeah. You know what I always think is
• 41:34
  like, you were there at that company, what, a decade or more
• 41:38
  ago? They're probably still using
• 41:40
  that module and no one knows like that.
• 41:43
  You helped like heck you. They still probably be fighting
• 41:47
  that fight if you didn't do that, but I.
• 41:50
  I want to hope that they would have figured it out at some
• 41:52
  point. But, you know, we were rolling
• 41:55
  an IJ platform and, you know, it would have been, I guess late
• 41:57
  2000s. And yeah, it was, it was a
• 42:02
  battle. It's because I was on, you know,
• 42:04
  I'm leading the team, you know, the ID administration team that
• 42:06
  was dealing with having to track all these vendors and
• 42:09
  contractors manually. It was an access database.
• 42:11
  Literally, that's like what we were doing.
• 42:13
  And any time you have to manually update something,
• 42:17
  forget it, right? It's just, it's going to, it's
• 42:19
  going to get out of date and problems abound.
• 42:21
  So the more you can become data-driven, the better.
• 42:24
  I miss Microsoft Access. That was like, what were you
• 42:28
  talking about with like Saturday Night Live?
• 42:30
  Like, oh, you just you have like some nostalgia for your era.
• 42:35
  Well, Microsoft Access was in my era.
• 42:39
  It was a simpler time, but I don't miss that.
• 42:40
  I don't miss Lotus Notes. If I never see another Lotus
• 42:44
  Notes database, I'm OK with that.
• 42:46
  So let's get to the next question here.
• 42:49
  I don't know who sent this in because it clearly had like a
• 42:51
  fake e-mail address. It was submitted through our
• 42:53
  form online. And I'm pretty sure Barack Obama
• 42:56
  is not looking at for identity information from us.
• 43:00
  If he is, hey, come on the show. I'd be happy, you know, to to
• 43:03
  talk through how how he got into identity, but let's just call
• 43:07
  this anonymous location or parts unknown.
• 43:10
  I think would be a deep vague if that happened.
• 43:12
  Probably. Maybe it'd be a good test if
• 43:14
  somebody can get us like that. Let's see, we're going through
• 43:17
  an IJ modernization and keep running into the joiner mover
• 43:20
  lever conversation as if it's solved.
• 43:23
  In practice, the lever process is still where we see the most
• 43:27
  risk where what are organizations consistently
• 43:30
  getting wrong. My initial thought here is if
• 43:34
  you are in an IGA deployment and you are tackling joiner mover
• 43:38
  lever, typically the biggest gap I see is the scope of what is it
• 43:44
  that you have connected to IGA. So low hanging fruit should be a
• 43:48
  termination and the more systems you can connect to IGA, the more
• 43:52
  you can automate all of that stuff.
• 43:54
  Not saying you can automate all of it, but that should be like
• 43:57
  one of the easiest things to do. And that really just takes time,
• 44:01
  you know, to meet with the different teams, set up
• 44:02
  connectors or flat files or however your integration, you
• 44:05
  know, works for whatever IGA tool you're using.
• 44:08
  But that is typically the gap I see is you start off like really
• 44:12
  strong and say, OK, you know, we've just signed up this
• 44:14
  product and we've got the services firm that's helping us
• 44:16
  implement it. And the scope is we're going to
• 44:18
  do the 1st 10 and then the customer is going to do the, you
• 44:23
  know, take it from there. And then they never do it.
• 44:26
  And their IGA platform only has 10 things connected to it
• 44:28
  because they never kept up that sort of factory of connections
• 44:32
  into their IGA platform. The whole point of IGA is to
• 44:35
  connect as many things to it as possible so that it can do these
• 44:38
  things. And that is the biggest gap.
• 44:40
  It's not a technical issue. It's typically time, resources,
• 44:44
  you know, in the runway to do it in a timely manner.
• 44:48
  What do you? Think well, I heard I heard
• 44:49
  somebody make the statement recently that organizations
• 44:53
  usually start their internal IM with single sign on, right?
• 44:58
  And so a lot of times what they'll do is they'll try to
• 45:01
  take their Microsoft environment and connect apps to that and
• 45:08
  they have a good list of users in that.
• 45:11
  Then they'll go and do IGA. And I think, you know, my
• 45:17
  assumption would be is like, most of the time, Active
• 45:20
  Directory is going to be kind of a central hub for access.
• 45:26
  And that's probably the purse's most important account.
• 45:30
  If that's not the case, if you literally just have 100
• 45:34
  applications all over the place, I don't think you're probably
• 45:37
  starting at the right point. You need to start getting, I
• 45:41
  mean, you're you're IDP platform connected to your app so that
• 45:46
  you have one place that really when you shut off that account,
• 45:50
  it shuts off that person's access.
• 45:52
  If you're relying on IGA to do that, I don't, you know, to, to
• 45:57
  connect to 100 systems. I don't think that's the right
• 46:00
  move. So if you have Active Directory,
• 46:03
  that's got to be in the scope for getting that account on or
• 46:06
  off. You got to make sure that your
• 46:08
  Active Directory is clean enough that you know that it's got a
• 46:11
  good set of accounts in it. But then I think you also have
• 46:16
  to realize that even though AD is going to be then your most
• 46:21
  important account to turn on or turn off is 2 things.
• 46:26
  One is there's going to probably be some applications that are
• 46:30
  not connected and #2 is, you know, the, the major shortcoming
• 46:35
  I think is like two things. One is if it's not being used
• 46:39
  for authorization, which is the case for most Active Directory
• 46:45
  connected apps. In other words, you use your
• 46:48
  Active Directory to sign in, but then there's a profile or
• 46:52
  something within the app that gives you, here's what you can
• 46:56
  access within the app. And then #2 is any kind of
• 47:00
  accounts that exist completely outside of AD, usually for
• 47:05
  administration? Those are very concerning to me
• 47:09
  as well. And that might be more your
• 47:11
  privilege access concern, but that's where IGA eventually had
• 47:15
  something has to inventory those apps in terms of what accounts
• 47:19
  exist. So you're going to have all your
• 47:21
  Active Directory accounts that can access that app, but you're
• 47:25
  also going to then potentially have like machine accounts and
• 47:30
  administrative accounts. And you have to make sure that
• 47:32
  those are being accounted for and that you know about them and
• 47:35
  that, you know, ideally you're controlling them.
• 47:38
  So I think that, you know, IGA like that initial MVP
• 47:43
  deployment, usually you're starting with like your heavy
• 47:45
  hitters, but if you think you can just stop there like you,
• 47:49
  you're in for a rude awakening. And and by the way, I just
• 47:52
  pointed out one other thing. I totally agree that shutting
• 47:55
  off access is the most important thing you can do.
• 47:59
  So, you know, shutting off the AD access might seem like, OK,
• 48:03
  now the person can't get to their e-mail, they can't get to
• 48:06
  the travel system and 99 other systems that are connected,
• 48:10
  great. But if they have those
• 48:13
  administrative accounts and things like that, darn it, like
• 48:17
  that person's being separated from the company and they can
• 48:20
  still cause you a lot of pain. Lots of ping.
• 48:23
  And I think there's a little bit of a trap that people fall into
• 48:25
  with, well, we've got things connected to our SSO.
• 48:27
  So if we do shut down their SSO account, whether it's AD or
• 48:31
  Entra or Octa or ping or whatever it may be, well, they
• 48:34
  can't access it. So, you know, that solves the
• 48:35
  problem. Well, doesn't really solve the
• 48:38
  problem because there's still potentially an Ave. for access.
• 48:41
  There's an Ave. for a license being taken up.
• 48:44
  So I would caution against, you know, that's a pretty common
• 48:46
  thing, like from an audit. I, I've, I've written many audit
• 48:48
  responses in my time. And one of the things was, well,
• 48:51
  we shut down their AD account. So even though they existed in
• 48:54
  this, you know, other application, they can't
• 48:57
  authenticate to it. So it's unusable.
• 48:59
  True, technically, but I feel like it's a trap because like
• 49:03
  you're relying on just that one layer of, you know, the
• 49:06
  authentication not being there. What if that account gets
• 49:08
  breached? What if it becomes, you know,
• 49:10
  hijacked, guess what? Now all the applications that
• 49:12
  that account had access to, now they have access to everything
• 49:15
  that was downstream that was just relying on it for
• 49:17
  authentication. So, you know, definitely setting
• 49:20
  up for a lot of pain. I get it, these things take
• 49:22
  time, but don't lose focus. Keep going.
• 49:25
  And when I say termination and, and I would throw this into this
• 49:28
  as well, is when you're terminating access, it's not a
• 49:31
  straight up termination. It's also a movers.
• 49:34
  So if someone is changing their role within the organization,
• 49:37
  their access should change as well.
• 49:39
  However you do that, whether it's a role or an attribute
• 49:41
  based access control or a policy based access control or a
• 49:44
  straight up manual, open a ticket and figure it out.
• 49:47
  That's another area where, you know, it's kind of like the
• 49:50
  access snowball that I kind of call it is.
• 49:52
  We're really good at giving access and really bad at taking
• 49:55
  it away, especially for people who have been with the
• 49:58
  organization for a while, right? They just keep accumulating
• 50:01
  access, and next thing you know, they're like Thanos with their
• 50:03
  Infinity gems of access, and they do a lot of a lot of damage
• 50:07
  if someone else gets that gauntlet.
• 50:09
  I know you appreciate a good Marvel reference, Jim.
• 50:11
  Yeah. Well, there's analogies to all
• 50:13
  kinds of sci-fi that come from Jeff, and I love them all.
• 50:17
  Do you even know who Thanos is? I think he's like a like a
• 50:21
  superhero, right? No, he's not a superhero.
• 50:25
  He's a super villain. That's what I meant.
• 50:28
  OK, yeah, he's a bad guy. Well, depending on your point of
• 50:31
  view, which is whatever, but yes, he's a, he's a villain in
• 50:34
  the Marvel Universe. Anyway, let's get to our last
• 50:38
  question here. This is from, I think it's
• 50:41
  pronounced Thomas from Berlin, who we will where we will be in
• 50:45
  a couple weeks as we record this.
• 50:48
  We have been running our IAM environment for over a decade
• 50:52
  and the technical debt has become impossible to ignore.
• 50:55
  Legacy connectors, custom code holding everything together and
• 50:59
  platforms we have outgrown. How do organizations actually
• 51:02
  start tackling IAM technical debt without blowing up what is
• 51:06
  already working? Wow, that is a loaded question,
• 51:10
  Jim. Go for it.
• 51:13
  Yeah, I mean, this is something we all face.
• 51:16
  If you're in this space long enough, you're going to get to
• 51:19
  the point where it's like we've either outgrown this system or
• 51:24
  kind of the vendor. It feels like the vendor's
• 51:26
  walking away from the problem. So you kind of get to the end of
• 51:30
  your rope. I think there are some steps you
• 51:34
  need to go through because look, we, I don't like to talk about
• 51:39
  like, hey, organizational politics all the time, but it is
• 51:42
  a real thing. And if you, if you're due to an
• 51:47
  organization, might feel easier to say, hey, we need to RIP off
• 51:51
  this Band-Aid and just move from vendor A to vendor B.
• 51:56
  But a lot of times people do with the organization.
• 51:59
  They were a part of the original team that pick that technology.
• 52:03
  And I mean, Tomasa's situation sounds like they've been on this
• 52:06
  platform for a long time. But there are times also where
• 52:10
  you start with the technology in like two or three years down the
• 52:14
  road, you realize that you've either outgrown it or it's just
• 52:19
  you're not happy with it for one reason or another.
• 52:21
  I think you have to do your due diligence and show that you were
• 52:26
  not just pulling the plug because you just were sick of it
• 52:30
  or you didn't like it or something like that, that you
• 52:33
  actually tried to fix the problems, but you still reach
• 52:37
  the point where it's like we're just not fixing these problems.
• 52:41
  I know I'm leaving that very broad, but I think that depends
• 52:45
  on what your problems are. It's like, what do you have to
• 52:47
  do to to fix them? So I think that's important.
• 52:51
  But you know, eventually I do think that there are times where
• 52:56
  it's like, hey, the technology has maybe gotten so old, doesn't
• 53:00
  have a place in the market. The approach has changed and
• 53:04
  these guys haven't changed with the times.
• 53:06
  Like for example, the big thing I remember in in my career in
• 53:11
  identity was going from identity management to identity
• 53:15
  governance. And a lot of the identity
• 53:17
  management firms tried to just bolt on some kind of identity
• 53:22
  governance solution that they bought just to make it look
• 53:25
  like, Oh yeah, we've got all the features too.
• 53:27
  But it wasn't a well integrated platform and certainly didn't
• 53:31
  say that identity governance was the most important feature of
• 53:35
  their platform. So in my own experience, having
• 53:39
  to kind of RIP one of those systems out and move over to an
• 53:43
  identity governance platform was the right move.
• 53:47
  But you have to kind of show the due diligence of, hey, we tried
• 53:51
  to make this work or we looked at their platform offering.
• 53:55
  We've really need to move away from this thing.
• 53:57
  So that's Step 1. And I think Step 2 is like,
• 54:00
  don't throw the baby out with the bathwater.
• 54:03
  Look for what are the things that that are really good about
• 54:06
  what you did and try to apply those with your new system,
• 54:11
  knowing that you're probably moving to a new system because
• 54:15
  the new system is better. Better means also that it
• 54:19
  probably does things out-of-the-box in a better way
• 54:22
  than you've been doing them. So also be open minded that you
• 54:26
  may need to change some of your processes like you might have,
• 54:30
  like you might think you have the best way to onboard people,
• 54:34
  but this new technology might, that might not be a fit for how
• 54:37
  it works. Be open minded to potentially
• 54:41
  onboarding people in a different way.
• 54:43
  Other words, like a simple process I'm thinking of like,
• 54:46
  how do you get them their password?
• 54:48
  Like it might not be the way you've been doing it for the
• 54:51
  last 10 years, but that might be all right.
• 54:54
  It might still be better to exit process.
• 54:59
  And then there are other times where I'd say, you know, maybe
• 55:02
  not last thing I want to say. So I'm also thinking of the
• 55:07
  scenario because I, I kind of like, part of my thinking about
• 55:11
  this question was like, OK, well, what if you had a big
• 55:15
  legacy system and you, you built a bunch of custom code to
• 55:19
  connect all your systems. You might not want to just think
• 55:25
  about like, hey, we're throwing that away and we're going over
• 55:27
  to this new system. But you might need the
• 55:29
  functionality of that new system.
• 55:32
  Look for a way to bring it in and run them side by side and
• 55:37
  have a transition path to, you know, remove or retire
• 55:42
  functionality from the old system and move it on to the new
• 55:45
  system. And then when you get down to
• 55:48
  the end, it's like the race is on.
• 55:50
  Like you really have to get the last things moved over so you
• 55:53
  can shut it down and stop paying for the licenses.
• 55:56
  I will tell you that a lot of times where I see organizations
• 56:00
  finally decide to pull a plug on something, it's like, hey, we've
• 56:03
  been on this technology for 10 years.
• 56:06
  We all hate it and they're saying it's the end of life in a
• 56:10
  year. Well, if you hated it, why did
• 56:14
  you wait until like, like the critical red light was flashing?
• 56:18
  So I think sometimes, you know, don't wait till the critical red
• 56:21
  light's flashing as far as like, hey, the support is ending, or
• 56:25
  usually support doesn't just end.
• 56:27
  It's like you can have the same support, just have to pay double
• 56:31
  for it. Nobody wants to do that.
• 56:33
  So it's always like, hey, let's get off this system.
• 56:36
  ASAPI would encourage you if it's not too late, don't wait
• 56:40
  until that point. If you hate the system already
• 56:42
  start thinking about this and already start mapping out your
• 56:46
  potential exit plan. I said a lot.
• 56:49
  That was my last soapbox. Jeff, what do you think?
• 56:53
  I'm with you for a lot of that. I think, you know, if there's,
• 56:56
  if there's one behavior that I would love to normalize in the
• 57:00
  industry and the stretches beyond just I am, but just IT in
• 57:04
  general is making it OK to RIP and replace a product.
• 57:09
  A lot of times people look at that as sort of like, you know,
• 57:12
  a career ending move at an organization or career limiting
• 57:15
  or you know, whatever it may be. But I think we need to normalize
• 57:19
  that products change, business needs change and it is OK to
• 57:23
  shift from one product to another.
• 57:26
  I can understand this maybe a decade ago where a lot of
• 57:30
  software was sold as perpetual license, you had a big upfront
• 57:33
  cost and then you'd play a maintenance fee.
• 57:35
  And guess what, everybody's doing subscription now and
• 57:37
  you're on either A13 or five year term, most likely one of
• 57:41
  those options. And so you already have an exit
• 57:44
  path every time your contract becomes, you know, time for
• 57:48
  renewal. If the vendor that you're
• 57:50
  working with is not meeting the needs, figure out where you're
• 57:55
  going to go next. It has become significantly
• 57:58
  easier from a financial standpoint to shift contracts
• 58:02
  from one vendor to another. The money we're spending with
• 58:05
  Product A was a subscription. Well, OK, you still need the
• 58:09
  capability, but maybe product B does it better.
• 58:11
  Well, guess what? Now you need, you need some
• 58:14
  money, right, to make the transition happen, but it's no
• 58:17
  longer this insurmountable. Well, we just spent, you know,
• 58:20
  $7,000,000 on this gigantic IGA purchase and we're not going to
• 58:25
  just throw that away. Three years later.
• 58:27
  You're not doing that anymore. Now you're probably spending,
• 58:30
  you know, 10s to hundreds of thousands, maybe millions for
• 58:33
  your very large organizations. But that's money you're spending
• 58:35
  anyway. So I feel like, you know, now is
• 58:38
  the time to to normalize. It is OK to recognize that a
• 58:42
  product is no longer meeting your needs.
• 58:44
  I'm not saying don't do your due diligence.
• 58:46
  You know, go find the product that meets your needs.
• 58:48
  Go find and do demos and talk to customers and do all that stuff
• 58:52
  and show the reasoning of, of why, you know, you've purchased
• 58:56
  a particular product. But we got to get out of this
• 58:59
  mindset of like, well, we're stuck with it.
• 59:00
  No, you're not. You've got some, you know,
• 59:03
  sometime within the next three years, you're going to be able
• 59:06
  to get out of what you have. It'll cost a bit of money to
• 59:09
  shift over, right? You're probably going to have to
• 59:11
  hire, you know, some professional services firm to
• 59:13
  help you with the transition and there will be some work.
• 59:17
  But the good news is you've already done it once.
• 59:19
  So the second time you do, it should be easier because now
• 59:22
  you've gone through a deployment of that type of product before.
• 59:25
  So you know what to expect. The first time is always the
• 59:28
  hardest one. Things will change.
• 59:29
  There will be wrinkles. Not saying go perfect, right?
• 59:32
  But it's, it's so much easier now to swap out one product for
• 59:35
  another, which is one of the few benefits of a subscription
• 59:40
  licensing model when it comes to the software and everybody's
• 59:42
  pushing you towards it. If you're on a perpetual license
• 59:44
  now, guess what? Your vendor is trying to figure
• 59:47
  out how to move you to a subscription.
• 59:49
  And so you might be able to stick around with a perpetual
• 59:52
  maintenance fee, you know, for a while, but at some point you're
• 59:54
  going to have to shift into the into the SAS world.
• 59:57
  And you know, that provides at least an Ave. for to escape.
• 1:00:01
  If you feel like you're not getting what you need for any
• 1:00:04
  reason, you know from the event that you've picked Jim, you're
• 1:00:09
  nodding, and you're. It might.
• 1:00:10
  That was my soapbox. Yeah.
• 1:00:12
  No, I think those are fantastic points.
• 1:00:15
  I think so too. Thank you.
• 1:00:17
  Let's go ahead and end this episode.
• 1:00:20
  Hopefully that helped the folks that we had there.
• 1:00:22
  Keep sending those questions in LinkedIn, our form on
• 1:00:26
  idacpodcast.com. You know, if you find us at a
• 1:00:28
  conference, you know, come up, say hello, ask us questions,
• 1:00:31
  stuff like that. These are the types of things
• 1:00:33
  that really kind of get our juices flowing and start to
• 1:00:35
  figure out. OK, Yeah.
• 1:00:36
  Like, what is, you know, have we seen this before?
• 1:00:37
  And if we haven't, give us an opportunity to go research it.
• 1:00:39
  And if we have seen it, we can share, like what our experience
• 1:00:41
  has done through that. So definitely appreciate it.
• 1:00:44
  We have a lighter note question from Luca in Milan.
• 1:00:49
  What is your most unpopular opinion about the identity
• 1:00:53
  industry that you would actually be willing to say out loud?
• 1:00:58
  Are you going to be brave first, Jim, or should I be brave first?
• 1:01:02
  Either way, But I will say I think it's unpopular to who,
• 1:01:08
  Right. It's I doubt you're going to
• 1:01:10
  offend everybody. Some people are going to be
• 1:01:13
  like, yeah. I'm sure I can figure out a way
• 1:01:15
  to offend everybody. Well then, let's go.
• 1:01:17
  You go first then. I, I don't think mine will.
• 1:01:20
  I'm just saying if I, I'm sure I could find a way to do it.
• 1:01:22
  But my first one was that normalization of like, yeah, RIP
• 1:01:26
  and replace. It should not be like a bad
• 1:01:28
  stain on anyone's, you know, career that they picked a
• 1:01:31
  product and you know, 3-5 years later, it's not the right
• 1:01:34
  product anymore. I'm like, that should not be a
• 1:01:37
  thing anymore at this point. So I've already said that one.
• 1:01:39
  My other one is, is for the theater that is an RFPID test RF
• 1:01:47
  PS I think they serve almost no value whatsoever because by the
• 1:01:51
  time an organization's like, OK, we need to do an RFP for a
• 1:01:55
  product, why are you doing it? It's like a procurement
• 1:01:58
  checklist somewhere because it met some sort of dollar
• 1:02:00
  threshold and there's some sort of governance thing that says if
• 1:02:03
  you spend more than $10, you must go and get 3 vendors.
• 1:02:06
  And you must have them submit a spreadsheet full of answers that
• 1:02:09
  they've answered so many different times before that
• 1:02:11
  their answer this time is not going to be any different than
• 1:02:13
  the 100 times that they've done it before for other companies.
• 1:02:16
  Like what is the value of an RFP?
• 1:02:19
  Like at that point, you've probably already know what
• 1:02:21
  product you want to go with and it just wastes time.
• 1:02:25
  And so that would be my soapbox item is get rid of RFPs.
• 1:02:29
  I don't see that as bribing any value whatsoever.
• 1:02:33
  You can do all the work of due diligence of selecting a
• 1:02:36
  product, a service, whatever it may be without an RFP.
• 1:02:40
  That is just so completely useless in my mind that, you
• 1:02:45
  know, I feel very strong about that.
• 1:02:49
  Yeah, I don't. I don't like RFPs, that's for
• 1:02:53
  sure. But mostly it's on the side of
• 1:02:57
  somebody who's had to respond to RFPs.
• 1:03:00
  I've also been on the side of creating the RFP and I think it
• 1:03:05
  can be beneficial to the issuing client where it's like, hey, all
• 1:03:11
  these companies are going to take my RFPs seriously and
• 1:03:15
  they're going to respond to give me all this information and then
• 1:03:20
  after they. They're not going to take it.
• 1:03:22
  They they will take it seriously, but they're going to
• 1:03:24
  send you the same answers that they've sent to every other
• 1:03:26
  client. Tell me about your company.
• 1:03:29
  It's copy paste. Boom.
• 1:03:31
  Tell me about your product and service.
• 1:03:33
  It's we connect to, AD we connect to.
• 1:03:35
  That's all the same information. They're saying you're not
• 1:03:38
  getting anything unique or specific as part of that
• 1:03:41
  process. Sorry I just had again, I feel
• 1:03:44
  very passionate about this one. Yeah, OK, It's a good one.
• 1:03:48
  So I'm going to kind of move on to my controversial opinions.
• 1:03:53
  And so it's two statements I've heard a million times.
• 1:03:57
  So one, I'm going to try to phrase it without using the
• 1:04:02
  company name, but it's nobody ever got fired for hiring XYZ.
• 1:04:07
  I'm not going to say, but it is a three letter acronym.
• 1:04:11
  And not even to pick on that company, but just that mentality
• 1:04:14
  of like, hey, if I pick this company, nobody's going to blame
• 1:04:18
  me. Dude.
• 1:04:19
  Your job is to make it work to succeed, not to cover your butt.
• 1:04:27
  So if your if your goal is just to survive and cover your butt,
• 1:04:31
  like go work somewhere else, that's my this one thing that
• 1:04:37
  bothers me Good. One that's a strong one.
• 1:04:38
  I mean, that's that's accurate as well.
• 1:04:40
  I mean, yeah, I'm with you. Yeah, and.
• 1:04:44
  Separates the people who are in this for the profession, the
• 1:04:49
  growth versus it's just a job. That's why the first things that
• 1:04:53
  was look at people like, is identity a career or is it just
• 1:04:56
  a job for you? That's going to tell me a lot
• 1:04:58
  about kind of how you're thinking about from an identity
• 1:05:01
  perspective of how you are approaching protecting the
• 1:05:04
  organization you work for. And that leads me to kind of
• 1:05:08
  that same kind of question. Yeah, so the other one that this
• 1:05:13
  also pissed me off is like I want one throat to choke.
• 1:05:18
  I was like, you join me here in the reality like that is not the
• 1:05:23
  way it works. Like if you have one vendor,
• 1:05:26
  that one throat choke model rarely works out for you.
• 1:05:30
  And I won't, you know, So if you're thinking about it from a
• 1:05:35
  support standpoint, you might be right.
• 1:05:37
  Or like, hey, I've got this one big boss who I can call and
• 1:05:42
  complain to and Hell's going to rain down.
• 1:05:45
  I'm going to get my issue solved.
• 1:05:47
  I can kind of see that. I think that's more of the
• 1:05:49
  services side. I think on the services side,
• 1:05:52
  the 1/3 to choke model might get you a little bit further.
• 1:05:57
  But on the product side, like a big product company, if you
• 1:06:00
  think that one throat to choke is going to stop the finger
• 1:06:04
  pointing, I don't, that's not been my experience.
• 1:06:07
  The other thing is usually the one throat to choke model leads
• 1:06:12
  you down the the path of making a bunch of compromises.
• 1:06:16
  So we're not going to look at like all these upstarts because
• 1:06:20
  we're going to then have too many vendors to deal with.
• 1:06:23
  So I'm just going to take a lesser product that checks the
• 1:06:28
  check boxes. I'm going to live with basically
• 1:06:30
  a turd because that way I only have to pay one bill.
• 1:06:36
  Like that is to me that's like do your job again, do your job,
• 1:06:41
  you know, get the best product for the best price for your
• 1:06:46
  company. Now you're taking the turd
• 1:06:49
  because it's like all you can afford or it's the cheaper
• 1:06:52
  route, fine. But if it's just that you only
• 1:06:55
  have, you know, one throat to choke and now you piss me off,
• 1:07:00
  obviously. I love it.
• 1:07:03
  That's great. I, I, I agree with you, I think
• 1:07:06
  the one throat to choke only works if you are extremely
• 1:07:10
  powerful and you, I have that throat to choke is also
• 1:07:13
  extremely powerful. And even then you're not going
• 1:07:15
  to see immediate change, especially, you know, what are
• 1:07:17
  you going to do? Tell something, something going
• 1:07:18
  to call up, you know, Tim Cook and say, Hey, I don't like the
• 1:07:22
  way this thing works on my Apple iPhone.
• 1:07:25
  How think about how important you need to be to actually
• 1:07:28
  affect that change and how long it'll take.
• 1:07:30
  Tim. Right.
• 1:07:31
  Who's is on his way out. Yeah.
• 1:07:32
  To to affect that change in the organization.
• 1:07:34
  Like it's not going to happen soon.
• 1:07:36
  And, you know, if I were to send that e-mail, it would not get a
• 1:07:39
  response and nothing would happen.
• 1:07:41
  So I'm with you. Yeah, those are those are my
• 1:07:45
  controversial opinions. I'm sure I pissed somebody off.
• 1:07:49
  This is probably somebody who used one of those quotes today
• 1:07:53
  and they're like, oh, that gym guy.
• 1:07:55
  But that's OK. Yeah, that's fine.
• 1:07:57
  As long as you subscribe. As long as you give us a five
• 1:08:00
  star rating, we're all good. Hopefully I've provided a little
• 1:08:04
  bit of entertainment with that. Yeah, I'm sure, I'm sure people
• 1:08:10
  are entertained. We get on our soapboxes
• 1:08:11
  sometimes. But yeah, we have, look, we have
• 1:08:13
  opinions. You know, these are opinions are
• 1:08:15
  our own, blah, blah, blah, blah, blah, right?
• 1:08:17
  And I'm happy to change your opinions if you, if you present
• 1:08:20
  me with facts that are, you know, that 'cause that.
• 1:08:24
  So if somebody out there is like, I think RFPs are value and
• 1:08:28
  you can make a legitimate case that changes my mind.
• 1:08:31
  Go ahead. You know, give me give it a
• 1:08:32
  shot. I don't think you will.
• 1:08:33
  But yeah, you never know. I'm happy to entertain the
• 1:08:36
  thought. You know, hit me up at
• 1:08:37
  ideniverse and see if if you can change my mind about RFPs.
• 1:08:41
  There you go. I don't think there's going to
• 1:08:44
  be a lot of procuring people at Ideniverse and I think those are
• 1:08:48
  the ones who would argue for it. I don't think I didn't need
• 1:08:51
  people like building the RF ES, reviewing the RF ES, but
• 1:08:55
  procuring people is like, hey, we were told this is going to
• 1:09:00
  cost $3,000,000 and we paid $490,000.
• 1:09:05
  So we just saved the company 2 and a half million dollars.
• 1:09:08
  They don't understand maybe all the trade-offs that happened.
• 1:09:11
  That doesn't make the headline. For the fact that you could have
• 1:09:13
  gotten that deal regardless of whether you went through an RFP
• 1:09:17
  or not. Exactly.
• 1:09:18
  But if you, if you came up to any software vendor, you said
• 1:09:21
  here's my budget, what can I get for this?
• 1:09:24
  They would they would actually figure out how to work within
• 1:09:27
  that budget. Like they're not going to go
• 1:09:29
  with list pricing. That's a joke.
• 1:09:30
  Nobody pays list price. But I know if somebody says,
• 1:09:34
  hey, our budget this year is $200,000 or $10,000, you might
• 1:09:39
  not be able to get anything right.
• 1:09:40
  But at least if you, if you're willing to share that
• 1:09:43
  information, you will get, you will get the deal that you need.
• 1:09:45
  Nobody wants to lose on price. And I'm talking to your top
• 1:09:48
  competitor and I want you to come in and like do APOC and all
• 1:09:53
  that. Yeah.
• 1:09:55
  Yeah. OK, I'm done.
• 1:09:58
  Let's go ahead and wrap it up for this episode.
• 1:10:00
  Thank you. To those folks who sent in
• 1:10:02
  questions, you know, connect with us on LinkedIn, send them
• 1:10:05
  there. Use our form at idacpodcast.com
• 1:10:08
  and you can send them there. I guess feel free to use fake
• 1:10:11
  emails. Generally, you know, it will
• 1:10:14
  ignore most of them, but if I find a good one, I might
• 1:10:16
  represent it. So shout out to Barack, if you
• 1:10:18
  actually did send that e-mail to the center.
• 1:10:20
  That would be a very, that would be a highlight, at least for me,
• 1:10:22
  to get somebody that big to send us something.
• 1:10:26
  Let's see what else. Yeah, we'll see at Identiverse
• 1:10:29
  and keep an eye on the website for future discounts for future
• 1:10:32
  conferences that we're working with.
• 1:10:33
  So thanks everybody for watching and or listening and we'll talk
• 1:10:37
  with you all in the next one. You've been listening to
• 1:10:42
  Identity at the Center. We hope you've enjoyed the show.
• 1:10:46
  Make sure to like, rate and review, and we'll be back soon.
• 1:10:50
  But in the meantime, hit the website at
• 1:10:53
  identity@thecenter.com. See you next time on Identity at
• 1:10:59
  the Center.