Latest / Identity at the Center / #399 - Navigating Identity Security in the Age of AI with Jeff Margolies

Transcript

#399 - Navigating Identity Security in the Age of AI with Jeff Margolies · Identity at the Center

0:04
This is Identity at the Center. Welcome to the Identity of the
0:11
Center podcast. I'm Jim McDonald.
0:13
Unfortunately, Jeff Steinman was not able to join us today, but
0:17
I'm joined by a fine classic guest, Jeff Margolis.
0:21
He is the chief product and strategy officer at Sabian.
0:25
Welcome to the show. Jeff, thanks, Jen.
0:27
It's great to be here. It's great to have you.
0:31
We last spent time together at the Identity Bier at the
0:35
Grapevine Gartner IM conference. What did you think of the event?
0:40
Was it your first Identity Bier? It was actually my second
0:44
identity bier. I happened to attend one in
0:46
Berlin a couple of years ago around the EIC conference, but
0:50
first one in the US and it's a great event.
0:54
Yeah, standoff to Espambaco is like the Identibier godfather,
1:00
if you will. What what was your take away
1:04
from the Identibier? I mean, what's the state?
1:07
Can you get a state of the industry or is it just a good
1:09
time to, you know, have a beer and and talk shop?
1:14
Yeah, it's a great place to talk shop.
1:16
I see these events a little bit like reunions sometime and that
1:21
maybe not a family reunion, but I feel like identity is a bit of
1:25
a family. And so getting the opportunity
1:28
at conferences like Gartner identity or RSA or EIC and and
1:33
then, you know, maybe more specifically at the identity or
1:37
events, it's it's just great to to see everybody in the industry
1:41
to see old friends. I mean, some of the some of the
1:43
people there, I go back. To.
1:46
Almost 3 decades and so it's, it's, it's fantastic to to
1:50
reconnect with colleagues. Yeah, it's a great community of
1:54
so many people that I I so many relationships that you build,
1:58
like you said, over decades. It's not even just over years,
2:01
and that's one of my favorite things about it.
2:04
So you've been in this industry for a couple decades.
2:07
It's kind of surprising we've never had you on the show.
2:10
We're getting off towards 400 episodes.
2:13
I was wondering if you could kind of follow our tradition,
2:17
let us know how you got into identity.
2:20
Did you choose it or did it choose you?
2:24
I, I would say it shows me, I started my career at Accenture
2:31
as a consultant in the security practice.
2:34
I was a goofy consultant or a goofy major.
2:38
I, I was quantum electronics, electrical engineering.
2:41
Accenture didn't know what to do with me.
2:43
So they said go figure out that security thing.
2:46
And so I found myself in the security practice and it was
2:49
probably my 3rd project where I really started to get into
2:54
identity, did network security 1st and that really rolled into
2:59
more directory activity and that directory led to more single
3:03
sign on web access control. And, you know, so it was
3:08
probably 1998 when I did my first identity specific project
3:14
as part of a, a larger security implementation.
3:18
And strangely enough, that project we did role engineering,
3:22
we did privileged access management, we did identity
3:25
governance, we did fine grain entitlements.
3:27
We, we did the whole gamut of identity security before there
3:33
were any tools, before there are any, you know, anything other
3:37
than our, you know, Perl and, and scripts and, and building
3:41
our own apps and doing things like pseudo and, and, you know,
3:45
that, that got into building up a practice at Accenture.
3:49
So I, I wrote the first PowerPoint where we sat and
3:52
deliberated, what are we going to call this thing?
3:54
Is it identity? Is it identity management?
3:57
Identity and access management. You know, we, we narrowed in on
4:00
IN AM and, and basically built that practice from, from a
4:05
PowerPoint presentation up to 700 plus people, you know, over
4:09
a period of 8-9 years. So that that's how I got my
4:13
career started. But then I kind of went on and
4:17
did cloud security and cyber defense and and broader security
4:20
things, particularly in the financial services industry,
4:23
high tech. So that's probably why we didn't
4:27
meet for a while, because I left and then I came back to identity
4:31
about five years ago when I came to save you.
4:36
Yeah. So tell us about that.
4:37
What what drew you back to those fees?
4:42
Yeah, I was a a few things. One, I live in Los Angeles
4:45
savings headquartered in Los Angeles.
4:47
There aren't a lot of security companies in Los Angeles.
4:50
And so, you know, having a a local company to work at,
4:54
particularly in the beginning of COVID felt like a just amazing
4:58
opportunity. The leadership team here with
5:02
Sachin and, and Ahmed and others have have been just people I've
5:06
known and, and admired for a long time and was excited to
5:09
come work with. And then I think identity, I
5:14
wasn't done right. This, this problem is just still
5:18
out there. You know, our, our customers are
5:21
still struggling to solve this problem.
5:24
And it and it felt like something that I, I really had
5:28
something to add to and could, could come back and make a
5:31
difference. Yeah, normally what I'd ask you
5:34
now is like you're the chief product and strategy officer as
5:38
Sabian. What does Sabian do?
5:40
But I'm assuming most of the folks who are listening to this
5:43
podcast know that. I guess the bigger question is
5:48
like, how is saving changing with all that's going on in AI?
5:52
And I'll, I'll compound the question.
5:54
So, you know, how do you see AI affecting the identity security
6:01
industry? Obviously, it's affecting
6:05
everything around us, right? I mean, you can't go anywhere
6:07
without talking about AI, but bring it home to folks in the
6:11
identity industry. Yeah.
6:14
Well, for those playing buzzword Mingo, right, we hit it at at
6:17
about the one minute mark for for AI, yeah, I, I think the way
6:22
that AI is changing identity is profound, right?
6:29
So the way I think about AI, it's helping people do things
6:36
that are hard to do, make them make it easier to do, helping
6:41
people do things that are very repetitive, do them over and
6:45
over again. And there are a ton of areas and
6:49
identity that are still very manually intensive, that still
6:54
require a lot of very deeply skilled people and that still
7:01
require just a lot of information in order to, to
7:05
solve the problem, you know, so, you know, take it, take the, the
7:10
end user example. Like we, we make users and
7:14
managers and, and the business, we make them make decisions all
7:19
the time. Can this person have access to
7:22
this thing? What should all of your sales
7:25
people get access to? You know, we, we ask these
7:28
questions and, and, you know, if you think about the, the, the
7:33
lols and their ability to help you get more context and, and,
7:39
and really help ease the cognitive burden on, on the
7:43
deciders. So they have a lot more
7:45
information to make a good decision.
7:48
You know, so I think that's, that's one area that that we've
7:51
really focused on is, is improve the decisions that humans make
7:55
by giving them more data, but giving them in a way that they
7:58
can consume it and, and ultimately reduce your risk and
8:02
be more compliant because you're making more effective decisions.
8:06
You know, I think another area is, is stuff that's just a lot
8:09
of Labor. You know, you're in the
8:10
consulting industry. I spent a lot of my career in
8:12
the consulting industry. Historically, identity projects
8:16
were five to 1/4 to 1/3 to one services to software.
8:23
So any, any time you spent, you know, hundreds of thousands of
8:26
dollars on, on software to solve an identity problem, you're also
8:30
spending millions of dollars on services to solve an identity
8:34
problem. And all of those things from,
8:37
you know, how do you configure the software?
8:39
How do you integrate it with all of your systems?
8:42
It's just a lot of work and an AI is an area that can really
8:46
start to to give the consultants, give the
8:50
implementers more tools to be able to to do that job and and
8:55
do it more productively and, and really start to solve a much
8:59
broader problem. Yeah.
9:01
For example, like our customers on average have maybe 50-60 apps
9:06
integrated into their identity governance solution, but they
9:09
have thousands of apps. And so, you know, at giving them
9:15
the AI tools to be able to integrate thousands of apps with
9:17
maybe the same or even a little bit more people, you know, much,
9:20
much better ability to manage their identity, security
9:23
posture. Yeah, I feel like, so I do want
9:27
to tap into the services. So I've been in the services
9:30
industry for a decade and you've seen it happen.
9:35
I mean, from my first identity implementation, which was like
9:40
you said, it was like services was a multiplying factor of
9:43
software costs. And you've seen without AI that
9:48
driven down to maybe it's a one to one ratio and in some cases
9:53
it's much less like depends on the company.
9:56
I wonder is do you think AI spells the end of services?
10:04
I, I don't think so. You know, I think that right now
10:10
if you want to do a Savient deployment or any product, you
10:16
need to have a PhD in identity security and you have to have a
10:21
PhD in Savient or whatever that technology is.
10:26
I think what AI will allow us to do is remove the need for that
10:31
PhD in the technology platform. And so identity security people
10:37
can do it now. There still aren't enough
10:39
identity security people, you know, let alone enough identity
10:43
security people who know Savient.
10:45
And so, you know, the value of of consultants and services is
10:50
that you do the same project over and over and over again.
10:53
All right, So you do it at company A and then you do it at
10:55
Company B, then you do it at company C.
10:58
There's still value regardless of whether you needed to know
11:02
the technology platform or not. In the fact that you've done
11:06
this project multiple times for multiple customers and multiple
11:10
industries or maybe multiple customers in your own industry.
11:13
You know, you can be more efficient and help teach that
11:16
company how to do it. Maybe the mix of resources
11:20
changes a little bit. You know, maybe the nature of
11:22
the work that you're doing changes.
11:25
I absolutely believe that, you know, what we do with AI is
11:29
going to be different than what we did without AI.
11:32
But I I think the need for services is still there.
11:35
It's just changing. For example, when I first was
11:39
doing identity projects, we tended to do projects on Thor,
11:43
which became Oracle Identity Manager.
11:46
We spent a lot of time just installing software and
11:49
installing databases and installing web servers and web
11:53
app servers. And like 30% of the project was
11:56
just the technical architecture In a SAS world, that all goes
12:00
away, right? The SAS company does that.
12:03
And so you don't need the services people installing 50
12:07
OIMCDS anymore, right? You know, it's just dumb.
12:11
But but they can do more higher level work, more policy work,
12:17
more change management, more process reengineering, more
12:21
integration with all the application teams.
12:24
And all of those things are still areas that will be work to
12:29
do aided by AI and and I think value and services companies who
12:34
bring methodologies, who bring processes, who bring best
12:37
practices, who who have done that and and it can de risk your
12:41
project. Yeah, being in this industry, I
12:45
feel like the challenge is going to be with AI, we should be able
12:50
to do more for the same money. I mean, I, I feel like that's
12:55
always been a restriction is that you can only go so fast
12:59
because you can only spend so much money.
13:02
Well, if the software lets you go faster for putting in the
13:06
same level of effort, you know, whatever that equation looks
13:10
like, you get more done, you connect more systems, you have
13:13
more visibility, you can protect the enterprise better for the
13:18
same investment. Yeah, that's right.
13:21
You know, the cost of benefit analysis and we've changed the
13:25
cost side of the equation to where the the costs are much
13:28
cheaper. And so you know what, you know,
13:31
if you, you maybe only were integrating with 50 apps before
13:35
and the 51st one, it just didn't make sense to, it was just too
13:38
costly to integrate. Well, now maybe, you know, you
13:41
flip that curve and it makes sense to integrate the 51st app
13:45
and the 500th app and maybe the five thousandth app.
13:49
I wonder if anybody's asked you this question or in this way, is
13:54
AI going to kill software as a service?
13:59
Because I think this is like one of those other views that you
14:02
hear best rounds, like you look at even the stock prices, some
14:06
of the biggest software as a service companies and they've
14:09
been under pressure, whereas these AI companies are just, you
14:13
know, up and to the right and their valuations are insane.
14:18
And I believe you, this is not a investment show.
14:20
This is not investment advice. But I'm wondering like you know,
14:24
is that because people believe that everything will be done
14:27
inside the large language model and that you won't need software
14:31
as a service that HR processes the CRM processes and maybe I've
14:36
been these security processes are all done within the LLM.
14:41
And you see where I'm going with this.
14:44
Does it does that make sense? Does that resonate at all or are
14:47
you? Do you hear that from people and
14:50
what is your response? Yeah, I will.
14:53
You know, quip sometimes that we have to transform from being a
14:58
legacy SAS platform now to being a modern AI platform.
15:03
And you know, if we decompose that quip a little bit, a modern
15:09
AI platform is generally what we're all thinking about
15:14
building. And so you build apps on top of
15:17
a platform, you're we're going to have an identity security app
15:22
or multiple apps on that platform.
15:25
And and that has a lot of things that we leverage from the SAS
15:32
world, but we also need to think about what is the overall AI
15:38
platform look like, how what's going to run in the browser or
15:43
on the endpoint, what's going to run in the customer's
15:48
environments, whether that's a cloud environment or a SAS
15:52
environment. And then what's going to run in
15:55
our cloud environment. I think that looks different
15:59
than the SAS world where you had browser and then a whole bunch
16:04
of stuff running in the cloud. I think you're going to have
16:07
some compute that shifts to the edge more, a lot more
16:12
processing, a lot more of the AI agents are going to run in a in
16:16
a more distributed fashion. And so that AI platform is
16:19
probably going to be more distributed than the SAS
16:22
platforms were just given the nature of where you want to do
16:26
compute, where the data is, where you want your AI agents to
16:31
be. All of that stuff is different.
16:32
So the the platforms will shift. I think it'll have a significant
16:37
SAS component, if I can call it that.
16:40
But it it's going to, it's going to change fundamentally from how
16:43
today's SAS apps look. Yeah, it's interesting.
16:47
I've given thought to even LLM and the prompt just like that to
16:54
use their interface. It feels like we're back to the
16:56
C prompt in some ways, but it's, it's, it has to be less
17:00
structure. You remember the C prompt being
17:03
that you had to put in the commands exactly, right.
17:06
Whereas with an LLM, it interprets your misspellings and
17:11
you know, kind of what you might think.
17:12
You can give it very little information.
17:14
You give a lot of information, but it's the prompt.
17:18
The, the way of the future, right?
17:20
Is that an interface that works for people?
17:23
Is that an interface that works for businesses or, you know,
17:28
there's certainly five years ago you never saw SAS roll out where
17:32
I was just like, here's a box, just type in what you want.
17:35
And maybe it was because the technology wasn't there, or
17:38
maybe it was because that's not an interface that really is
17:43
human friendly. I don't know.
17:46
Yeah, I I have the pleasure of having a pretty nice or a pretty
17:50
great design team that that works for me.
17:54
And I think a lot of the, there's still a lot of questions
17:58
around what is the, the human AI interaction going to look like
18:03
and what's the, what's the model?
18:06
Generally speaking, we've had more of, you know, like
18:10
Microsoft Copilot sort of model. And I, I think they've done a
18:13
great job from a design perspective of, of positioning,
18:17
both an ability to chat as well as show visuals and graphics and
18:22
things like that on a, on a different panel.
18:24
And so, you know, you're your interface of, of putting in
18:29
commands like our, our old scripting C prompts were, you
18:34
know, in a more natural language.
18:35
And maybe that evolves to be more voice and less command line
18:39
over time. I still don't know, like if I'm
18:42
going to ever be comfortable talking to my computer versus
18:47
typing at my computer. But having that panel that's
18:51
showing you graphs and and visuals and images and, and,
18:56
and, you know, much more rich sort of interaction.
18:59
I think it's still going to be how we how we interact, you
19:02
know, so, you know, some of some of the things that we're doing
19:06
that look more like, you know, show me a graph of this, right.
19:12
And, and, you know, rather than meeting the no sequel and
19:16
generate sequel statements now I can just do natural language
19:19
interface. I still want to see the graph.
19:21
I want to see trends. I want to, I want to be able to,
19:24
to get insights out of that data.
19:27
I don't just want a stream of data coming at a in a command
19:30
line, but I want to be able to tweak it and ask for it without
19:35
needing to have that, that deep knowledge of sequel, you know,
19:38
or that back to my PhD in saving.
19:41
And I shouldn't have to know all of all, all of that technical
19:44
junk. I should be able to just tell it
19:46
what I want want to see and have it show up.
19:49
That's right. So we talked about AI affecting
19:53
software services, but probably the most important one is the
19:59
practitioners. So I think we all hear the
20:03
doomsday, the fear about. AI is going to take all the
20:08
white collar jobs. Then eventually we'll have
20:11
robots and they'll take everybody's job and everybody I
20:14
guess will sit at home watch TV and eat bon bons all day or live
20:19
a life of leisure. Who knows?
20:20
It depends on we get the Terminator come to life or we
20:25
get some kind of Oasis that comes out of this will probably
20:29
be somewhere in in between. You're a girl dad.
20:33
I'm a boy dad. My son is in cybersecurity.
20:36
I mean, I'm telling you, he's going into a senior year and I
20:40
remember telling him at the beginning like there are is way
20:43
more demand for cybersecurity professionals than there are
20:48
jobs. That was three years ago.
20:50
I think of you know, sometimes I'll let the fear get to me.
20:55
Maybe today I'd tell him go be a Carpenter.
20:58
At least you have, you know, 10 years before some robot takes
21:03
over your job. That's probably too much fear,
21:07
right? What?
21:08
What do you think is going to happen?
21:09
Are you optimistic or pessimistic about the
21:13
practitioner given where AI is and where AI is going to be over
21:18
the next decade? I think fundamentally I'm an
21:22
optimist. You know, I said as a
21:25
technologist, I've, I've always been driving change and driving
21:30
new programs. And you know, that that's just,
21:33
I think fundamentally who I am, you know, at any time in in
21:39
human history, as we brought on new productivity enhancing
21:44
tools, you know, like, I don't know, take the automobile for an
21:48
example, right? You know, that that has vastly
21:52
changed how our country is laid out, how any city is laid out.
21:59
You know, it's changed the nature of the jobs.
22:01
There certainly aren't the buggy drivers and the, and the horse
22:05
barriers and you know, and all, all of that industry there were
22:08
before, but it completely transformed our, our
22:12
transformation, our transportation.
22:15
And he has created tons of jobs that are out there, you know,
22:18
building cars, servicing cars, driving cars, you know what,
22:23
whatever all those things are. And, and I think, you know, in
22:26
an AI world, we're going to have the same thing.
22:29
We're not going to have as many buggy drivers as we did before,
22:34
you know, whatever were the mechanics of maintaining the
22:37
last version of these technologies.
22:40
But we're going to have a whole bunch of new jobs and and new
22:44
capabilities that that we need to think about.
22:47
Some of those, you know, like I was talking about before, now we
22:51
can factory on board thousands of applications rather than
22:55
dozens. So there's a whole bunch more
22:59
work there to do AI will help do some of that, but there will
23:05
still be plenty of work for, for people to do.
23:08
There's still lots of policy work to do.
23:11
You know, take take my my example, like most companies
23:15
that have implemented or integrated with 50 apps,
23:19
primarily those are 50 Sox apps, right?
23:23
So financial apps and then maybe a handful of high volume apps
23:29
that everybody gets access to. Well, that that's like one
23:33
business process, you know, it's the business process of how do
23:37
we figure out who gets access to the critical financial
23:41
applications and systems. Well, with 5000 apps now I've
23:45
got lots of process I've got to figure out and lots of policy
23:48
I've got to figure out and lots of different things that I
23:53
didn't have to think about when I was just focused on Sox apps.
23:56
And so there's, there's lots of work for, you know, consultants
24:00
and, and, and identity security people to, to really think
24:04
about. So, you know, fundamentally
24:07
different jobs, but there will be more of them and you know, in
24:11
the at the macro level, right, macro level, more work, more
24:16
things to do at the micro level at, you know, what are our kids
24:20
going to do? Well, you know, they're not
24:23
going to do the same jobs we did.
24:26
Those those jobs are probably gone.
24:29
They're going to do some jobs you and I have never heard of
24:32
and hasn't been invented yet. So it's, it's tough.
24:36
You know, how I think about counseling my kids is make sure
24:39
you're, you're learning the, the, the foundations of how to
24:43
learn how to solve problems, how to do projects, how to work in
24:47
groups. All of those things are, are
24:50
super important skills to learn and, and you know, like I, I was
24:55
quantum electronics. I have not done anything with
24:57
quantum electronics in my, my third years, but I, you know, I
25:01
learned how to think and I learned how to solve problems
25:03
and, and lead people and communicate well.
25:06
Maybe not communicate very well, but the rest of them I've
25:09
learned how to do. Well, I went to school for
25:12
political science. I got into identity and access
25:15
management and I use my political skills all the time.
25:20
Is just something we all have to do in the work world, but not
25:24
politics like Democrats and Republicans.
25:28
But what I always advise my son is get whatever job you can
25:34
working on cybersecurity and add value.
25:39
Find a way to add value. We talked about AI for identity
25:44
or I'm sorry, I yeah, AI for identity, how a is won't change
25:48
identity, but there's also identity for AI.
25:52
How do we control this feast or how do we manage how it uses
25:57
how, how would we provision access to it, making sure that
26:01
it's only doing what it's supposed to do.
26:03
So maybe we could talk a little bit about that angle because I
26:06
think that's going to be the great opportunity, the great job
26:11
opportunity for that next generation of practitioners.
26:16
Yeah, you mentioned Terminator earlier and I constantly think
26:21
of this as how do we make sure Skynet doesn't happen or Skynet
26:24
doesn't take control, you know? So I think there's a couple
26:28
things to it, right? Just in, in general as you, you
26:31
think about the identity problem as it exists today.
26:37
I've got the user, they want access to an application or some
26:41
system. I decide, OK, can they have that
26:44
access? What level of access?
26:47
Maybe at a granular level, which specific data sets or things can
26:50
they see? You know?
26:51
And so we, we have policies that look like, you know, all sales
26:55
people can have access to sales force for the systems they cover
26:59
or something like that, right? Or the accounts and customers
27:02
they cover. All right, now I'm going to say
27:08
salesperson and their agent can have access to that.
27:15
And so that now that agent can have access to Salesforce and
27:21
all the accounts that they're, you know, the original human had
27:25
access to. Or that agent can delegate to
27:29
another agent that can delegate to another agent that could
27:31
delegate to another agent that can ultimately get access to
27:35
some subset of what I, what I would have had originally.
27:40
And we want to make policy decisions at each level of
27:45
delegation to another agent. We want to be able to say, you
27:49
know, this agent doesn't have everything I want.
27:51
I don't want to give that agent everything I have.
27:54
I want them to have a specific amount to do a task.
27:58
And then if they're going to delegate to somebody, some other
28:01
agent, I want them to delegate a smaller amount that's just a
28:04
specific amount. So we're applying a least
28:06
privileged concept, two agents as we're delegating authority
28:10
down, you know, end levels of of delegation.
28:14
And that's just a very different model all happening at runtime,
28:19
not in a delegated admin sort of model where we used to think
28:23
about it from a administrative standing privilege perspective.
28:28
We're saying, Nope, I'm spitting up this agent right now.
28:31
It has a task, it's going to go do something for me.
28:33
And I only wanted to be able to do this task and not anything
28:36
else. And it's just a very different,
28:40
you know, a thought process, a different architecture, a
28:44
different way of thinking about policies than we've had in the
28:47
past. There's a tremendous amount of
28:49
work going on around to the industry on, on all of these
28:52
different problems. And, and this is probably just
28:54
one example of 1 area of, of identity security that we're
28:58
going to need to think about for AI, you know, we need to be able
29:02
to discover it wherever it's being used.
29:05
And, and, you know, get visibility of, of all this AI,
29:09
what everybody's doing and make sure policies being enforced and
29:12
make sure that, you know, that we can identify and authenticate
29:18
that AI and, and, and everything in between that is, you know, is
29:22
a challenge that it's exciting, right?
29:26
It's, it's exciting to build a, a new set of identity
29:29
capabilities and hopefully not bolt it all on at the end, like
29:33
we tend to do in security. You know, let's, let's try to, I
29:37
don't, I don't know if we can get ahead at least run alongside
29:40
of all the innovation that's going on.
29:43
I think that framework that you mentioned though is as relevant
29:48
today as it was 20 years ago, which is I can't give an access
29:53
that they don't have myself, right?
29:56
I can't spin up an agent and say, oh, you have access to
30:00
delete the HR list. You know, I get I can't do
30:05
things beyond my control. And that, you know, as it goes
30:08
further down the line, it gets narrower and narrower and never
30:13
broader. So I think that that was one
30:16
thing that jumped out that you said.
30:20
But something else I've kind of thought about is that, Jeff, you
30:23
could send up an agent that does many of the things that you do,
30:28
like what's your time in at the end of the day or whatever the
30:31
example might be. But it can't, it can't show up
30:37
in the system log that you did that that thing, right?
30:41
I mean, we have to have some separation or audit abilities
30:45
that it was the agent, the AI agent made that decision or went
30:50
out and did that thing that it wasn't the human Jeff who did
30:54
it. Yeah, I think we need to
30:56
maintain some level of Providence, right?
31:00
We need to know that that was an agent acting on my behalf.
31:04
I want to, I want to know all of that.
31:06
I don't want to just know it was an agent, right.
31:08
And to your point, I want, I want to know more than it was
31:11
Jeff. I want to know Jeff instantiated
31:14
this agent, this agent did this thing.
31:16
I probably want to know more more information about that
31:19
agent, like what LLM was it? And and you know, try to, you
31:23
know, mostly try to figure out things like if something went
31:26
wrong, how can I then go back and figure out well, what went
31:30
wrong? Did Jeff give it back prompt?
31:33
Did the agent hallucinate? Like what led to whatever the
31:39
that maybe identity security breach that happened here, You
31:42
know what, what led to that breach and how do I, you know,
31:45
figure out what happened to make sure it doesn't happen again?
31:48
Right. Yeah, that's that's absolutely.
31:51
So I think AI and the agents, that's definitely one of the
31:55
areas that identity is going to impact AI.
32:00
And maybe this, I'm not sure which direction this one would
32:04
go, but it's kind of like new use cases that AI is going to
32:09
enable and maybe creative these time, which is like, you know,
32:14
the example I take of is these deep fakes, because I think more
32:17
and more authentication and what we do in the world is going to
32:23
be be via video. And you know, whether it's
32:27
identity verification or, or what have you.
32:31
And the risk of having a deep fake, you know, AI can enable
32:36
the deep fake. AI can also potentially identify
32:42
that it is a deep fake, right? So there's all these new use
32:44
cases that Identity is going to create for AI as well.
32:49
Yeah, it's, it's interesting. I, I think it'll be extremely
32:54
difficult for us to play this arms race of AI detecting, you
33:02
know, malicious, fraudulent, whatever stuff.
33:05
I think we actually have to do it the other way, other way,
33:08
which is we need to prove what's real and then assume anything
33:15
that's not real is fake and so on a, on a, you know, an
33:21
identity verification perspective.
33:23
That means that, you know, we need to verify that, you know,
33:26
I'm really mean. I'm not just some AI deep fake
33:29
talking on this podcast, right? And so, you know, the identity
33:33
verification capabilities that'll verify my government
33:38
issued identity and and me and, and come to some level of
33:41
assurance that I'm actually me and I'm not some threat actor
33:45
pretending to be me, right. And then stamp that as real and
33:49
then tie everything that I and all my agents do, you know, to
33:52
the fact that we verified Jeff was real at the beginning.
33:57
You know, same thing with, I don't know, deep fake videos or
34:01
deep fake images. Like we need the cameras to
34:04
verify, like I really took this in the real world and stamp that
34:09
it's real and assume that any video we see that doesn't have a
34:12
real stamp is fake. Yeah.
34:16
Yeah, like that's going. To work.
34:19
Yeah, right. It's kind of like sounds like
34:21
zero trust to me. Yeah, or.
34:25
Trust with verify, Yeah or. Verify.
34:28
Trust later, yeah. Don't trust, just verify.
34:32
That's right. Yeah.
34:34
So I mean, there's so much going on besides AI.
34:37
Can, you know, with AI being such a exciting topic, ceasing
34:42
to forget that there's something going on with like ITTRISPM,
34:48
what are some of the areas that you get excited about that you
34:51
actually feel like they can change, change the game?
34:57
Yeah. I, I think posture, ISPM
35:02
visibility, I know we're all still as an industry narrowing
35:06
on what, what the right words to use.
35:08
I call it ISPM, identity, security, posture management,
35:12
that that's new. I think this is not something in
35:16
the identity industry that was a core part of the stack, you
35:21
know, as it existed in the last generation of technologies.
35:25
I think of it fundamentally as an AI.
35:28
It is about, you know, the AI that can see everything that's
35:34
going on and the algorithms that can detect malicious behavior
35:39
that that can can, you know, really hunt in all of this vast
35:43
amounts of data, you know. And so, you know, the old adage,
35:47
you can't manage what you can't measure, you know, is, has
35:52
always been, I think a challenge in the identity world.
35:54
We just have not had the breadth and the depth of visibility that
35:58
we need in order to manage the problem.
36:02
We also haven't had the ability to maybe split, you know, our
36:09
our roles and responsibilities between what's centralized and
36:12
what's decentralized in a large enterprise, in many C cell
36:17
organizations, they're not responsible for managing,
36:21
governing and forcing all of these identity security
36:24
policies. But they are responsible for
36:26
making sure that they're compliant, that they're managing
36:30
their risks, that they're responding to threats, that
36:33
they're helping the OR helping the rest of the enterprise be
36:37
efficient and effective in, in the application of those
36:39
controls. So that first line, second line
36:42
of defense in the identity history, we've only ever really
36:46
had first line tools. And I think ISPM is a great
36:49
second line tool. It's a great capability to be
36:52
able to see is everybody across all of my applications and all
36:57
of my systems, are my policies in place, Am I compliant?
37:02
Do I have risk? Am I effectively managing them?
37:06
Am I under attack? Can I detect those threats?
37:09
Like all of those questions are, are like fundamental Cecil
37:13
questions that they haven't been able to answer unless they
37:16
centralized at all and integrated with everything.
37:21
And so it gives an ability to maybe have 100% visibility, but
37:25
maybe only, you know, 1020% governance or enforcement
37:29
capabilities. And, and I, I think that's,
37:32
that's a, a game changer. It, it kind of requires AI.
37:36
It doesn't require AI. You could do this with, with
37:39
kind of last Gen. technology, but I think it makes it a lot
37:42
easier having AI to, to give you all that visibility and then to
37:45
run all those, those algorithms that you want to run to identify
37:50
risk, identify threat, seek, umm, violence.
37:53
And so super excited with, with where, where, where we're all
37:58
taking the industry, you know, with, with ISBN and, and ITDR,
38:03
you know, and I, I think between those two posture and then
38:05
activity or the, are the key differences, you know, whether
38:09
that's one product or multiple products, it doesn't really
38:11
matter. I think they're, they're all
38:12
very similar. I collect a bunch of data,
38:15
visualize the data and actually get, you know, get insight and
38:19
be able to make decisions from that data.
38:22
Yeah. You know, it feels to me like,
38:25
yeah, then the industry kind of what we do as practitioners has
38:31
expended so much in the last, I'll call 5 years.
38:36
It went from administration and governance access management,
38:40
which we did just call authentication to keep it simple
38:44
and privilege access management was like that was what identity
38:48
was. And now you take posture
38:52
management, which I'm a little less excited about myself,
38:56
Foster management, but I think the ITD are even less about
39:01
where it's at now, but where it's heading.
39:03
I think about just kind of like shared signals kind of that
39:09
communicate. It's kind of like what's
39:11
happening in the environment now rather than setting things up to
39:17
kind of the traditional lines of defense.
39:21
To me, that's like that's that mindset is just like a total
39:26
game changer. And it almost, I've asked this
39:31
question many times. So does this expand the role of
39:35
the identity practitioner? So does the identity
39:37
practitioner do more, or does it just make a bigger tent that the
39:42
people who do these things now find themselves in the identity
39:46
tent? I don't know the answer to that
39:49
and I'll, I'll tell you why, right?
39:51
I, I think that what ISPN and ITDR fundamentally do is they
39:57
start to bridge traditional identity and security in the
40:01
CSO. And so you know what what I can
40:07
now do in my security contacts or in my security world as a
40:12
CSO. Is posture gives me identity
40:15
security context, right? So and I, I have a goal here to
40:20
make it you more excited about posture.
40:22
So I'll see if I can, I can do that right.
40:26
If, if I'm in the SoC and I see an endpoint has maybe been
40:32
compromised with identity context, I can say who has
40:37
access to that endpoint? What could they potentially move
40:42
laterally to compromise and how can I shut down that lateral
40:49
movement opportunity? How can I reduce the blast
40:52
radius knowing that this endpoint might be compromised?
40:56
In order to do that, I need visibility of all the end, the
41:01
identities and all the assets they have access to and that,
41:04
that full graph and, and be able to see that and making that
41:08
context available to a SoC operator, you know, available to
41:13
in the, in the, in that incident to be able to leverage can help
41:17
me be more effective and efficient in, in my response.
41:21
So I, I think there's a ton of things that ISPN can, can make
41:27
the security world more efficient knowing that identity
41:32
security contacts. So I think just just that alone.
41:36
Now that, you know, your question, is that an identity
41:38
security person that's now part of the SoC doing something
41:42
different or is that a SoC operator who's now got identity
41:45
skills? I don't, I don't know.
41:48
I don't know if we're going to create like an identity sock
41:51
next to a cyber sock. I imagine no, but maybe some
41:57
industries will say, of course we will, you know, think of our
41:59
use case. And, and so it, it's quite,
42:03
quite possible that, you know, it'll be a little bit of both.
42:06
But it, it's now the, you know, this merging of identity and
42:10
security into a much closer, you know, collaboration than
42:16
happened before. And the same thing with ITDR.
42:19
And I, I think of ITDR as synonymous or able to do what
42:23
EDR did to the endpoint security world where you can only do so
42:28
much if you're just protected, right?
42:31
If, if everything is black or white, on or off, right, Either
42:35
allow it or you deny it, right? There's only so much you can do.
42:39
But once you start to be able to also detect and respond to
42:42
things that might be unusual and you start to look into the Gray
42:46
and be able to make decisions around the Gray that are not
42:51
binary. And so if you start to look at
42:55
that, you know, from an ITDR perspective is it's really OK,
42:59
we're going to have to allow some things to happen.
43:02
But if we actually are monitoring what's happening, we
43:05
can start to look for malicious activity.
43:07
And it's not just you have access or you don't have access
43:10
right there. We're starting to look at the
43:11
activity of what you're doing with that access and and then
43:15
making runtime decisions about, you know, whether or not
43:18
something malicious is happening.
43:20
And that's, so that's a name changer, I think for Identity.
43:23
So did you accomplish your goal? Yes.
43:26
I mean, you got me thinking, OK, I sounded a little grumpy about
43:31
posture management. It really just didn't help me
43:34
make my case. So I kind of pushed it to the
43:37
side. But I, I do kind of feel like
43:40
within the space of identity, we take these cybersecurity
43:45
capabilities, we tag some identity on to it and say, Hey,
43:49
this is, and then you go to identity conferences and
43:52
everybody's talking about this new thing, identity XYZ.
43:57
And it's basically something we're doing like penetration
44:00
testing and scanning of the environment.
44:02
But now we've had identity angle to it.
44:06
I sound grumpy. It's important.
44:09
So I, I'm going to say you win. But I here's a, here's a tough
44:13
question for you. You know, if you were fired as
44:19
CISO for an organization, they grew drastically and they've
44:25
never had a security guy or the security guy like didn't really
44:29
do his job. So they didn't have an
44:32
administration. They had a tool for
44:35
administration governance. They had single sign on, but it
44:37
wasn't, you know that well done. They have some semblance of
44:43
privileged access management. Maybe it's a spreadsheet, the
44:47
password, I don't know. Do you spend your time fixing
44:51
those things or do you put in some of the tools that you know
44:57
detect in real time like the my organization is under attack.
45:02
I've got these posture issues. I've got, you know, to get
45:07
control in my master source, like my Active Directory, and an
45:12
ITDR tool helps me do that. Like which one do you do first?
45:16
Or you try to do them both at the same time?
45:18
Or do you get your fundamentals, you know, solid?
45:23
Yeah. I think more and more we're
45:25
advising customers to start with posture.
45:29
And the reason that I think that's important it's, it's
45:33
really focusing on, you know, where is the best business case
45:40
and basing that on data, right? And so if you're, you're
45:45
starting out with collecting a bunch of data, you know, what is
45:49
our current situation? What does our posture look like?
45:52
Where do we have the biggest risks?
45:55
Where do we have compliance issues?
45:57
Where do we have ineffective controls or inefficient controls
46:02
in place? If you can answer those
46:05
questions from a posture perspective with data and be
46:09
able to to use that data to then plan out your road map, I think
46:14
that's a much more effective way than using PowerPoint,
46:18
spreadsheets, gut feelings, whatever it is that you're using
46:23
to prioritize your initiatives now.
46:27
Now you're always going to come up with quick hits right away.
46:30
I know this is a really big risk and it's a pretty low cost thing
46:35
I need to get done. And anytime you come up with a
46:37
road map, you're going to have quick hits first and then your
46:41
more strategic things and then stuff that you're probably never
46:44
going to get to. And so maybe now you know, you
46:48
say like, OK, well, I've got quick hits.
46:50
I know I'm not complying in this area.
46:53
I know it's a really high risk. I know I just need to get that
46:56
thing done and, and spin that off.
46:59
You don't need posture to tell you, you can do that in parallel
47:02
or, you know, maybe it's the second you get posture signal
47:05
and you start doing it. But in general, I think you
47:09
know, if you, if you, if you lead with posture, now you're,
47:12
you're really starting to, to make wise decisions based on
47:15
the, the data and the information you have, you know,
47:18
rather than experiential decisions or, or, you know, just
47:23
I'm, I'm doing this because I'm. Feeling Yeah.
47:27
Well, like you said, you can't manage what you can't measure.
47:30
So this episode's going to drop right around Valentine's Day,
47:35
give or take. And I wanted to know what it is
47:40
that you love about the identity industry or what's happening in
47:44
the identity industry, and what could make you want to break out
47:48
with it? Yeah, I, I think, you know, one
47:54
thing I've always loved about identity, you know, we talk
47:58
about power and protect or you can think about it as you know,
48:02
security and enablement. It is one area of security that
48:09
really has a lot of impact on the end user in a way that a lot
48:14
of other security doesn't. And I, I, I love the fact that
48:19
we can spend a lot of time with the business, whether that's,
48:23
you know, dealing with internal identities and what, what
48:28
employees get access to or your suppliers or your vendors or
48:32
your business partners or your customers or your citizens or,
48:36
you know, whatever it is. I, I love the fact that identity
48:41
interacts with that and as a product guy, you know, we spent
48:45
a lot of time with who are the personas that we're building
48:47
product for and, and what do they need.
48:50
It is unique, I think in the identity world that some of our
48:54
main personas are everyone, not just the security team.
49:00
So love that about it. What makes me want to break up
49:04
with the identity industry right now?
49:09
Not a lot. You know, I, I think I'm, you
49:13
know, I'm, I'm still happily in love.
49:15
I can't imagine what's going to, you know, make me move on to the
49:18
next thing unless we just solve this problem and it's done and
49:21
then we can all move on to the next problem and solve that.
49:24
It's hard to imagine that happening, but you know, I'll,
49:26
I'll punt and say like, no, I'm, I'm fully like, you know,
49:30
happily in love with identity right now.
49:32
And and you know, I, I, I can't complain.
49:35
You've been a great cast, so I'll let you take the easy way
49:38
out on that one. But what I did want to ask you,
49:41
so Sabian has had a lot of success, especially over the
49:46
past decade. And what I really wanted to know
49:50
is what is the secret to the success of a company?
49:55
So we, we talked to a lot of practitioners through this
49:58
platform. It's, I always think of
50:01
practitioners as people who are in the trenches fighting the
50:04
good fight, You know, whether you, whoever signs your paycheck
50:08
like you're trying to make identity work somewhere.
50:13
And a lot of people who are founders for companies started
50:17
in the trenches at some point, right?
50:19
We always get that. How'd you get into identity
50:21
stories usually? Like I used to edit LDAP files
50:25
or, you know, I was a Java developer or something like
50:28
that. And now they've they've taken
50:30
their big idea and turned it into they've taken their passion
50:35
and their big idea and turned into their company.
50:38
So what's your advice to them, if you can say this is one thing
50:41
that you have to do to be successful?
50:45
Yeah, I think there's one thing it's, I mean, it's, it's kind of
50:49
lame, but if you got to focus on the customer, the customer
50:51
problem, and as long as you're solving real customer problems
50:55
and bringing value to them, I think that's the one thing.
50:59
If I, if I had a second thing, we're a company that is founded
51:04
by and and and populated with practitioners.
51:08
I'd tell your your point about starting with practitioners.
51:12
I mean, we, we've all been doing identity.
51:15
I'd, I'd love to see the stat of the number of years at saving of
51:19
identity. It would probably be in the
51:20
millions of years of, of, you know, identity experience here
51:25
and certainly in the, in the leadership team, it's well into
51:29
the hundreds of years of, of experience of doing identity
51:33
projects and helping customers be successful.
51:36
And, and that, that mindset of, you know, solve the problem for
51:40
the customer, keep making it better and better, you know, and
51:43
make sure that above all else that they're successful.
51:47
That's, that's, I think it's been our, our biggest secret.
51:50
You know if you do all that, the rest will come.
51:53
Fame, fortune, glory, whatever. Whatever you're looking for,
51:57
that is your customers are happy.
52:00
Yes, build a great team and Jeff, I really enjoyed those
52:04
time with you today. You know we always like to end
52:07
on the leg. You know I'm talking about AI.
52:10
It's the potential Skynet. And if you don't know what I'm
52:14
talking about, you, you played the episode too fast.
52:18
My letter. No question for you, like before
52:20
we start, before we hit record, you mentioned your girl dad.
52:25
You've got a 16 year old and you bought her a Tesla, which is a
52:29
pretty nice car. Take back my first car and it
52:32
was a beater and it definitely didn't have a big screen.
52:36
But you, you chose a Tesla and my legend, no question for you,
52:41
is like, why did you choose the Tesla?
52:44
Yeah, there's a couple of reasons.
52:45
I have a Tesla and my wife has a Tesla.
52:47
So it's a third Tesla now it is a used Model 3.
52:50
And I think if you go out in the market right now and look at the
52:54
best value cars and you aren't, you know, you, you kind of, you
53:01
can get past whatever political or, or whatever feelings you
53:05
might have about Tesla and, and the, and the ownership
53:08
structure. You know, it, it's just a, it's
53:11
a great car. It's a safe car.
53:13
I don't ever have to worry about my daughter at a gas station And
53:16
I don't have to worry about, you know, her like getting her
53:19
credit card skimmed it at some, you know, gas station credit
53:23
card machine or, you know, being in some place, you know, dark.
53:26
It's, you know, we're in the ecosystem.
53:29
I have two chargers at home. She can charge, you know, right
53:31
next to me and my wife and, and don't have to worry about that.
53:36
I can track her. So I, I know where the car is at
53:41
any given point. I know how fast it's going.
53:43
I know what route it's on. I, you know, so that there's a
53:47
lot of things that I can do that, that I, my, my car was a
53:52
beater too when I, I, when I was first driving.
53:55
There's a lot of things you can I do, I think, you know, as a
53:58
parent, I can limit how fast it goes.
54:01
I can limit how fast it accelerates.
54:04
You know, there, there are a lot of features that you know, as
54:07
the, as the parent of a 16 year old, you look at that and say,
54:09
yeah, OK, I can, I can get my head around, you know, spending
54:14
a little bit of money for that Peace of Mind.
54:17
Yeah, yeah, my, I have a 16 year old boy and he has a BMW Saxus 7
54:24
Series, which sounds like, oh, you guys are rich.
54:27
No, he got it for $10,000. So it was a great value.
54:32
But that car has a lot of horsepower and 16 year old blue
54:37
with the car with a lot of horsepower.
54:39
I just think of the stupid decisions I would have made.
54:43
But I, I do think, you know, I always think of this podcast
54:47
like this is going to be a time machine for, or what do you call
54:53
it, like a time capsule for our industry during this time
54:57
period. And somebody will come back.
54:59
Maybe it'll be aliens or people whom to speak for.
55:02
Listen to this episode and they'll be like, oh, Jeff got
55:04
this right and that right, but he bought a car.
55:07
Let's go look at what's that means.
55:09
You know, like people drove their own cars back then.
55:12
That's crazy. That's right.
55:14
Yeah. I I didn't do self driving for
55:17
full self driving for for I use it all the time.
55:21
But you know, I, I want her to get better at driving first.
55:25
Yeah, it it'll be interesting to see by the time, you know, their
55:28
kids are around, you know, is, is she going to have a, a self
55:32
flying quadcopter Tesla? I hope so.
55:36
I want to see it. Yeah, that'll be fun.
55:39
That'll be fun. Well, Jeff, thank you so much
55:41
for doing those. And to close out this episode,
55:44
everyone, thank you for listening.
55:46
If you want more, you know, check out our website,
55:50
idacpodcast.com or also on YouTube at idacpodcast.tv.
55:57
Certainly connect with myself and Jeff Sedman.
56:01
Jeff, Mark Margolis. So I get that right.
56:06
I'm sorry if I keep mispronouncing your name, but
56:10
yeah, can people reach out to you on LinkedIn as well?
56:13
Connect to you. Absolutely.
56:15
You know, if I'm at J Margolis. All right, perfect.
56:19
Well, that's it for this one. Thanks everyone for listening
56:23
and we'll see you on the next one.
56:27
You've been listening to Identity at the Center.
56:30
We hope you've enjoyed the show. Make sure to like rate and
56:34
review and we'll be back soon. But in the meantime, hit the
56:38
website at identity@thecenter.com.
56:42
See you next time on Identity at the Center.