Latest / Identity at the Center / #389 - Sponsor Spotlight - Aembit

Transcript

#389 - Sponsor Spotlight - Aembit · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:16
Not so bad yourself. Doing great.
0:19
We got a awesome episode lined up for today with a special
0:23
sponsor we're recording and we're going to drop this episode
0:27
less than a week before Gartner I Am Summit in Grapevine.
0:31
Our guest is going to be there. I think this is a perfect entry
0:35
point to go into Gartner I Am Summit.
0:37
With Yeah, we've got a lot of things to cover today.
0:40
So let me go ahead and introduce our our guest today.
0:42
So just make it clear, right? This is a sponsored episode.
0:45
Our friend David Goldschwag, who is the CEO and Co founder at
0:47
Ambit is joining us today. So welcome, David.
0:51
Thank you, Jeff. Thank you, Jim.
0:52
It's really great to be with you.
0:53
Yeah, so let me get the website out because I've heard this name
0:56
pronounced a couple different ways.
0:57
So it's Ambit and it's a E MB IT dot IO slash IDAC.
1:04
So that's a lot of letters. It will be in our show notes and
1:06
it will be in this YouTube description, all that so and the
1:08
sort of things. So let me ask what I'm going to
1:11
assume is the source of this is, is it ambit?
1:15
I've also heard it pronounced as Aimbit, which is the correct
1:18
way? OK, so it is ambit just like the
1:22
word A MB, IT would be spelled would be sounded out OK.
1:27
Of course because of trademark and other people with websites,
1:30
we added an E in OK, that E is meant to be skipped over.
1:36
OK, so it's still ambit and it's ambit dot IO.
1:40
I'm adding the Ian had the advantage of moving us up
1:44
alphabetically. Okay, so that's an advantage
1:47
too. Okay, and I give all the credit
1:51
to my cofounder, Kevin Sapp. He's picked all the names of the
1:54
companies that you know, we've been built together.
1:56
Okay, and he's really good at it.
1:59
So this is one of those rare companies where, you know, you,
2:01
you see a lot of like, you know, Silicon Valley where they're
2:03
trying to get rid of all the vowels because all those things
2:05
are taken. You guys went and added one for
2:07
differentiation. I love it.
2:08
That's novel and and and from what I've seen.
2:11
Hi, you know, we're we're East Coast.
2:13
What can you do? OK, so.
2:15
Tell us a little bit about Ambit and tell us a little bit about
2:18
your background. How did you get into the space
2:22
of digital identity and identity and access management, and how
2:26
did that culminate into Ambit coming around?
2:29
OK. So Kevin and I have been doing
2:31
companies together for about 20 years, all security companies
2:35
and almost all till Ambit were focused on securing user access
2:41
to applications. So it's all enterprise security.
2:44
And so for instance, we did an MDM company that was supposed to
2:47
be users on a mobile device getting e-mail and other
2:50
services, OK. Then we did the ZTNA company, OK
2:54
that was became Netsco Private Access.
2:57
The company name was New Edge Labs.
2:59
That was you're on your laptop, you're trying to get to behind
3:01
the firewall applications. How do you do that with
3:04
something as a service instead of AVPN and but all of those
3:08
were, how do you secure access from a user to an app, OK.
3:12
They were all both about identity, but about something
3:16
else in addition to identity, right?
3:18
The mobile or you can get me past the firewall, etcetera.
3:22
OK, When we were ready to start Ambit, we said we've been in
3:26
this user space for a long time. O let's talk about nonhuman
3:30
access, right? Software accessing other
3:32
services. That's turned out to be a big
3:34
deal, and we'll talk about that for the rest of the episode, OK?
3:38
But what we also said is all of these questions about firewalls
3:42
and VPNs and all this were not the core problem.
3:46
The core problem was identity, OK?
3:49
If you're trying to access a service on the Internet, OK,
3:52
this is not a network reachability problem.
3:54
This is purely an identity problem.
3:57
So over the course of 20 years of doing enterprise security, we
4:00
landed at the core problem and everybody knows identity is the
4:03
new perimeter. Turns out it's the new perimeter
4:06
for things, right? As well as people, OK.
4:10
I'm glad you had that caveat because every time I hear
4:11
identity is a new perimeter, I just kind of want to yell into
4:13
the screen. No, it's not.
4:15
It's been that way forever. I guess not forever, but at
4:19
least for the last decade I feel like identity has been really
4:23
one of the main perimeters to defend against.
4:25
And, and, and one of the things that we have, one of the
4:28
advantages we have at Ambit is everybody's familiar with that,
4:31
right? They know how you log in with an
4:33
IM system, OK? So we can take advantage of lots
4:36
of analogies of how do people, employees at an enterprise, you
4:42
know, authenticate, login. And then we say, well, what
4:45
happens if it's an AI agent? What happens if it's a Python
4:48
app, OK, how do you help that log into the service?
4:52
And the answer is this. It's the same, but different.
4:55
OK. And that's how tech is many
4:56
times. So I gotta ask, does ambit mean
5:01
anything? Like what's the story behind the
5:03
name? I, I get the extra E in there
5:05
now, but like, what does ambit mean?
5:07
Like how did you come up with the name of the company?
5:08
I guess you know, how did your cofounders come up with it?
5:10
Yeah. So ambit means scope or
5:13
boundary, OK. And a particular use case that
5:17
we're focused on is where access crosses A boundary, OK.
5:22
So let's say you have an AI agent, right, running in your
5:25
enterprise that needs to do work in Salesforce.
5:28
OK. So this is no longer accessing
5:31
resources as within your AWS account, rather it's crossing a
5:35
boundary and going to a third party that's Salesforce.
5:38
And the same thing applies for any most accesses within the
5:41
enterprise. You're going to a database, it
5:43
could be Oracle database in your network, but it could also be
5:47
Snowflake or data bricks which lives someplace else.
5:50
And so this cross boundary authentication problem is hard,
5:54
OK and it's not solved by the cloud providers and that's where
5:58
Ambit. Shines.
6:00
So I find it somewhat interesting that you're working
6:04
with an identity company now, but we were getting into each
6:07
other here before we hit record. And you mentioned that you
6:09
worked on Tor, the Onion router a long time ago, which is
6:13
probably the furthest thing possible that I can think of
6:15
that where you'd want to have an identity.
6:17
So tell me, what about your Tor background and I guess what what
6:22
caused you to do the 180? OK, so so it was wonderful, but
6:27
back in the mid 90s, I was working at Naval Research lab.
6:30
I had left in National Security Agency and I was working with
6:34
two colleagues there, Paul Cyberson and Michael Reed.
6:37
And we had this idea OK, right, which is wouldn't it be good to
6:41
be able to do anonymous browsing on the Internet, OK, And there
6:46
that there's there's lots of stories about how why the Navy
6:49
funded OK, right. And all this, OK, but it did
6:52
become really important, OK, this ability to visit something
6:57
on the web, right, Without, without somebody being able to
7:00
attribute it to you using the IP addresses or whatnot were really
7:04
important. And my background at NSA made it
7:08
clear to me that this was important because NSA both tries
7:12
to understand the traffic of what's going on, right?
7:15
What are people talking about? But more importantly, it's who's
7:19
talking to whom, OK? And there's lots of data.
7:22
Justin, who's talking to him call records at a phone company,
7:25
you know, if we go back to Oldham times, OK, we're also who
7:29
was talking to him, OK? So, so so Tor onion routing at
7:34
the time was trying to solve this problem of saying, let's
7:38
make sure that we can communicate, but that the act of
7:41
communication does not give away who's talking to him.
7:44
Now, that doesn't mean that you can't say who's talking to him
7:47
within the connection. OK?
7:50
So we call this anonymous connections rather than needing
7:53
to be anonymous, right, when you're doing a transaction, OK,
7:57
right. So that's what we did.
7:58
OK. Now, of course, commercially,
8:01
OK, you need to be able to authenticate, OK, right.
8:04
And so, so, so in in the real world, right, you may want
8:08
anonymous connections, but even within that connection, you do
8:11
want to authenticate. Because if I'm talking to you,
8:13
Jaffer to Jim, you should be able to know then who, who I am,
8:18
OK, Even if it's not observable to the rest of the world, OK.
8:22
And like you said, right, this is 1995, right?
8:25
So that's going on 30 years, OK. So identity has been pretty
8:28
important for a very long time, OK.
8:32
Yeah, no kidding. And you know, I think it's, it's
8:35
interesting to see where Tor has evolved over time and how it's
8:39
being used. I Did you ever imagine that
8:43
people would be using Tor the way that they are today?
8:47
So, so it's hard to imagine any technology that's still in play,
8:52
right, 30 years later, OK. That's pretty rare, OK.
8:56
What we did know, OK, was another colleague of ours coined
9:01
this term. Anonymity loves company, OK?
9:04
If only the government were using Tor, you'd know when
9:08
they're searching for public source, open source intelligence
9:12
about Iran, that it was the government looking for Iran.
9:15
OK. So you need all sorts of other
9:18
traffic to be noise to cover that traffic.
9:22
OK. So the design of the system said
9:24
we can either generate our own noise, right, or we can leverage
9:28
the rest of the world. So we opened up the system.
9:30
And I think that that's that's created, you know, kind of an
9:34
interesting play over these years, right?
9:36
I think interesting is is a very light, easy way to put it.
9:41
Let me get back to ambit though. So, you know, let me put my CSO
9:45
hat on, right? And I think we've got just so
9:47
many products in this space. So my question that I ask every
9:52
vendor that I talk to is what makes you guys special?
9:55
Like what is it that you think sets yourself apart from, you
9:58
know, competitors in the market or contemporaries or things like
10:01
that? Help me understand that and
10:02
educate our audience as well. OK.
10:04
Yeah. So like you said, there's lots
10:06
of identity companies out there, major companies, right?
10:09
So Okta, right. And Microsoft Antra are the IAM
10:15
dominant IAM players for human access workforce login to
10:19
services. We don't do that.
10:22
Ambit does not do that. Ambit is login for software
10:26
logging into services where that software could be AI agents, OK,
10:31
or other client applications trying to reach services.
10:34
This is in the enterprise OK. So the first distinction between
10:37
what we do and what other people do OK is we're not focused on
10:41
human access. We're focused on what people are
10:44
now calling non human access OK. And that's that's a big
10:48
difference against the the existing large players OK.
10:52
The thing that's different about us than other newer players, OK,
10:56
is we, we aim to solve the, the, the enforcement side, the
11:02
runtime side of this problem, OK, So just like Okta helps you
11:07
log into a service, OK, And if Okta doesn't let you log in, you
11:11
can't access the service. Ambit is the thing that lets the
11:14
AI agent where the I am that lets the AI agent log into
11:19
Salesforce or Snowflake or whatever service it's trying to
11:22
do. And without Ambit being in
11:24
runtime and authorizing the connection and issuing A
11:27
credential and logging it OK, we the the that access cannot
11:32
happen. So we're critical to the
11:34
infrastructure and we're fundamental to the operation of
11:37
the of the environment. So David, everyone's creating AI
11:41
agents now. I'm creating them, Jeff's
11:43
creating them. People we work with are creating
11:46
AI agents, and I guess the default mode that people tend to
11:53
tend to use is when they need to make a machine to machine
11:56
connection, they're using their own personal credentials.
12:00
I got to imagine that's not what we want, right?
12:03
Yeah, that, that's absolutely true, okay.
12:05
But we're seeing that happening in lots and lots of places,
12:08
right? The obvious way to solve this
12:10
problem, okay. The obvious way to make things
12:12
just work, okay, because that's what we will just want to do,
12:15
right, is you're running an agent, goes to Salesforce,
12:18
you're going to give it your credentials, your username and
12:20
password, and the agent will do it.
12:22
And then that just is easy, OK? And it's not unlike how people
12:26
would've been securing machine to machine access for a long
12:29
time. You had a username and a
12:30
password for a service account, right?
12:32
Maybe if you were diligent, it was a different service account,
12:35
right? But it was still the username
12:37
and password. And the irony here is this, this
12:40
has a bunch of cascading effects.
12:42
One is is you probably have to shut off MFA at Salesforce, OK,
12:46
right. Because your username and
12:47
password, right, wouldn't generally be enough for a user.
12:50
So you're trying to do it easy. And then you put the username
12:52
and password in. Incidentally, you shared your
12:55
username and password and we've been teaching people not to
12:58
share usernames and passwords. And then you shut off MFA and
13:02
all of a sudden the bar on compliant access has been
13:07
lowered, OK, right. So you have these in just, you
13:10
have these enterprise thresholds, right, for secure
13:15
access that you've trained your employees and all of your
13:18
systems to work on for now for 10 years, OK.
13:22
And now you're weakening those controls.
13:23
Now why is it bad to weaken those controls?
13:26
OK, well, one is is username and passwords can be stolen, right?
13:30
So phishing, right? And now the bad guy can use
13:32
that. And notice that would be true,
13:34
Jim, even if it wasn't your username and password, let's say
13:38
it was just a username and password for that agent.
13:41
OK, that's not enough because we know that phishing is a problem.
13:45
And now the bad guy could reuse the static Long live
13:48
credentials, OK, Another problem is attribution.
13:52
If you're sharing your credentials with an agent now
13:55
when the access happens, we don't know if the agent did that
13:58
access or you did that access or you and the agent did that
14:03
access together, OK? And we should keep coming back
14:06
to attribution, right? As we're talking for the next
14:09
few minutes, OK? Because attribution and audit is
14:12
sort of fundamental, OK, To be able to run your enterprise
14:17
responsibly, OK. And we're where that brings us
14:21
is in the ambit solution, OK? We want to make it easy to do it
14:28
the right way because why are people taking shortcuts?
14:30
Because it's easy. We just want to say you should
14:33
manage access in and by managing access policies instead of
14:38
managing secrets. That's what's on my shirt.
14:40
Manage access, not secrets, OK? And the idea there is, is
14:44
replace this whole notion that you enable access by sharing
14:49
their credential, OK, saying you're enable access by sending
14:52
a policy, OK. And then you can do what IAM and
14:55
zero trust have done for user access, which is you can move to
15:00
identity based policies, you can do strong access control.
15:03
You can move away from from long lived secrets, usernames and
15:08
passwords to short lived credentials.
15:11
And you can add conditional access.
15:12
All of the things that we've learned that work well when
15:15
strengthening user access. OK, so all that said, Jim,
15:19
you're building these agents because they're useful, OK?
15:22
So our ultimate job is to make it easy for the developers, The
15:26
people are building these things to do things the right one.
15:29
So it's even worse than I thought, but I, you know, I
15:34
grabbed a great line to use their manage access, not
15:38
secrets. And I think you did a great job
15:41
of kind of laying out the base problem with what you just said
15:45
there. What I'd like to know is, I
15:48
mean, you got to be working with a lot of customers.
15:50
I'd like to hear about what are the kind of use cases that your
15:54
customers are running into on this topic.
15:58
OK. So I think it's good to start.
16:00
Let's even ignore identity, let's just talk about things
16:02
like you said, you're building agents, OK?
16:05
So for instance, we have one customer, they're a financial
16:07
company, OK, Financial services company, They have lots of
16:11
analysts who are responsible for various accounts from their
16:15
customers, OK? And one of the things they need
16:17
to do is the analysts need to do portfolio reviews on a periodic
16:21
basis, OK? And that portfolio review is a
16:25
high level job, OK, Where the data in the portfolio is mixed
16:30
with data from third party sources and public sources and
16:34
proprietary information to be able to understand the
16:37
portfolio. So this this company is using
16:42
LLMS, right, agents and LLMS in order to routinize some of that
16:47
analysis, right and make the analyst job easier.
16:51
And So what happens is is you set up this LLM with prompts
16:55
against whatever you set up the agent with pumps against
16:58
whatever LLM it's using, but it needs to access these SAS
17:03
applications that have the data or the in the on network
17:08
applications that have the portfolio information or other
17:11
third party proprietary information.
17:14
And that login is fundamental here, right?
17:17
Do you want that LLM, the agent to be logging in as its own
17:22
identity, OK? Or should it do take the
17:24
shortcut right and login as whoever that analyst is?
17:28
And the answer is, is they wanted to log in with some of
17:33
the analyst's rights, but its own identity.
17:39
Does that does that make sense? Right.
17:41
Because the analyst has a certain rights that it's allowed
17:44
to do. But that doesn't mean that you
17:46
should give the analysts identity to that agent because
17:50
that's too much rights. And then you couldn't
17:52
distinguish between the agent and the analyst himself.
17:55
OK, so that's an example of A use case and the problem that
17:58
they're trying to solve and and it solves that problem.
18:01
Yeah, that's really interesting and I'd like to hear more.
18:04
I mean what are these customers pain points?
18:08
So I mean what's bothering them? What makes them pick up the
18:11
phone in the 1st place? Probably not the phone, write an
18:15
e-mail or the go to your website, but what's causing them
18:18
to do that in the 1st place, David?
18:21
Yeah, so, so we, we have another customer, a large a large
18:25
retailer, OK. And their their motivation here
18:30
was the business wants to innovate and take advantage of
18:34
agentic AI. And just stepping back for a
18:36
minute is really amazing, right? How much perceived and actual
18:40
value, right enterprises are saying right.
18:42
The revenue and the, and the, the, the use of agentic AI,
18:47
right is really very real in the enterprise, OK, for all the
18:51
complaining about hallucinations and all this, OK, these things
18:55
are really very useful, OK? So there the CSO called us and
18:59
the CSO said is my enterprise wants to innovate with agentic
19:03
AI and in order to innovate those need to access various
19:08
sensitive data sources in the enterprise.
19:10
We talked about Salesforce, we talked about Snowflake, you
19:13
could talk about ServiceNow, OK. And the problem is, is he is
19:17
responsible for compliant access to those enterprise data sets.
19:22
And now these agents need access.
19:25
And the question is, is how do you provide access, OK, with a
19:29
bar that's similar to the levels of of access control that you
19:35
have for user access? Because you don't want a
19:38
personnel agent, right, To get enterprise OPS data, OK?
19:42
You don't want an HR agent to get mental health information,
19:46
OK, Right. And how do you assign those
19:49
rights, OK. And you can see if things go
19:52
sideways there, right? You can actually create lots of
19:55
problems for yourself, OK? But for me, and I've always
19:59
liked this, when we build companies, we're trying to build
20:01
security companies that enable things, OK?
20:04
And here authentication is enabling the enterprise to do in
20:08
a responsible way the things that it wants to do.
20:11
That'll help it be more effective.
20:14
You know, you made a statement like people in the enterprise
20:16
and enterprises are building these agents.
20:19
And I kind of feel like this is one of those IT trends that even
20:23
though we saw it coming, I feel like it almost caught me by
20:26
surprise where I went from not having seen agents in many
20:31
organizations, client organizations, my own
20:34
organization to I'm building a just like 6 months later.
20:39
And now this is, this is really an identity issue.
20:43
And I'm comparing that to certain other areas of identity
20:47
like decentralized identity. I feel like I've been talking
20:50
about decentralized identity. We've had guests on, but I
20:54
haven't had my hands on it, right?
20:56
But like this AI agent thing is very real in my world.
21:00
And when anything moves with that velocity, I think like the
21:06
whole organization has got to be on its toes, right?
21:09
Including the audit function. And I wanted to ask you about
21:13
the audit function because I've got to believe that this is like
21:18
becoming like in their wheelhouse overnight.
21:21
Yeah, yeah. So audit and attribution, right,
21:24
are fundamental here, right? You want to be able to know
21:27
what's happening, OK, Both to know, you know, accountability
21:32
and responsibility and also when things go wrong, you got to undo
21:35
it. And then things go wrong in soft
21:37
ways, just operations. So audit helps you there too.
21:41
But what's really interesting, Jim, is you talked about the
21:43
change here, right? That's quite astounding.
21:47
I think we can all look back a couple of decades, the change
21:51
that's like this adoption of AI, it's akin to the change that
21:55
happened with cloud or before that was say the adoption of the
21:59
iPhone. OK, do you know what I'm saying?
22:02
And it's very likely that this will change businesses in even a
22:06
stronger way than those previous, OK, than those
22:09
previous things because the adoption is just, is just so
22:12
beneficial, right to the enterprise.
22:15
And we all know, right? We all remember when, when 30
22:18
years ago, what? No.
22:19
When was it in? In 1990, Seven.
22:22
Right when the iPhone came out was No, 2007 when the iPhone
22:27
came out, people said you can't have a device without a
22:30
keyboard, right? OK.
22:32
But you know how wrong they were, how long they were, right?
22:38
You also point out here, Jim, is that this development of agents
22:41
is occurring, right, sort of organically within the
22:44
enterprise, OK? People are just innovating, OK?
22:47
And that's something we should encourage, right?
22:49
Because if you want people to help their organizations work
22:52
better. Well, I think if whether you
22:55
encourage or not, it's going to happen.
22:57
So why not make sure that you put the proper guard rails
22:59
around it. And I think what I'm hearing
23:01
from you, David, is you don't think AI is a fad and it's going
23:03
to be around for a while. No AI is useful and we're using
23:07
it right. You probably use it in your
23:09
personal life instead of Google search.
23:11
OK, right. In the enterprise, it's it's
23:13
accelerating the ability to do things coders, right?
23:16
It's all moving. So and I I like the word
23:18
guardrails, right? And So what we're trying to do
23:21
here is we're trying to give a platform and I am platform for
23:24
agents and other pieces of software where it lets
23:27
developers do less work because authentic is hard, right?
23:31
You were saying, right, Jim, let's put our usernames and
23:34
passwords. So let's avoid that whole
23:36
problem. Let's authentication be part of
23:38
the platform so developers can focus on the parts of the code
23:42
that matter, OK. And incidentally, it happens
23:46
compliant with company access policies.
23:50
So we've been kind of talking about AI and agents
23:53
specifically, almost like it's a generic term, an agent, but
23:56
there are multiple types of agents that are out there,
23:59
right? So can you explain, you know,
24:01
maybe like what are some of the different types of agents and
24:05
why is it important? I, I don't know, maybe is it
24:07
important to have different guardrails for different types
24:10
of agents? Or maybe it's the same or
24:12
similar guardrails. Talk to me about that.
24:15
O So all agents are pieces of software, OK.
24:18
And you might give that column an application or call them a
24:21
workload, right? And in this sense, they're a
24:23
client workload, right? They're the thing that's
24:25
accessing something else. We're seeing three kinds of
24:28
agents in the enterprise, OK? We're seeing the use case I
24:31
described to the financial analyst.
24:33
Those agents are what we call hybrid agents.
24:35
They're working. The user works with an agent to
24:39
do some tasks, OK? We also see autonomous agents,
24:43
right? Where the agent is doing
24:45
something on its own that a user or somebody else, some other
24:49
machine may have done, OK. And those two are different
24:52
scenarios, right? Because the autonomous agent,
24:55
the agent needs an identity, OK, and it needs access rights, and
25:00
you need to be able to attribute any action that it does, whether
25:03
it's data access or tool set access or changing something in
25:07
the infrastructure, OK, to that agent.
25:10
The hybrid agents need that sort of blended identity that we
25:13
talked about, OK? The effective rights for that
25:17
agent is some combination of what the agents entitled to do
25:21
and what the controlling user is entitled to do.
25:23
We should work through some examples there, OK?
25:26
But even when you do have sort of entitlement, you need to know
25:30
when it was the agent operating and when the user was operating.
25:34
And when the agent operates, you need to know what's operating on
25:36
behalf of that user. Now there's another use case job
25:40
where it's agent to agent kind of chained agents, OK?
25:44
And that one is sort of an expansion of that hybrid agent,
25:48
right? Because instead of the agent
25:49
being called by a user, the agents called by an agent, which
25:53
may be autonomous or may itself be a hybrid agent, OK?
25:56
And in all of those cases, the attribution for upstream context
26:00
is really very important. So wouldn't it just be simpler
26:03
to just say, OK, well, I've got an identity for an agent and an
26:06
identity for a human, rather than try to do like an inference
26:10
of, well, this agent has some subset of me as the, you know,
26:13
the assignable actionable person for that agent, whatever that
26:17
looks like, right? I'm accountable for it does.
26:19
Why not just have two different identities?
26:22
Or, or maybe that's what you're talking about.
26:24
I'm just trying to understand, you know, why, Why would we make
26:27
a differentiation there? So, so we, we believe entirely,
26:32
Justin, every entity should have its own unique identity, OK?
26:36
So a human who is using the agent, the agent should have an
26:39
auditable identity. The human should have the
26:41
auditable identity, and the transaction that happened should
26:44
be attributed a little to both of them, OK, Where the agent did
26:47
the work on behalf of the human, OK.
26:49
But the real question is, is what's the rights the agent has,
26:53
right? It's not the identity, it's the
26:55
access rights that it has. So take an example.
26:58
Let's say an HR person is using an agent to get HR information
27:04
from ServiceNow OK. That agent should have
27:08
permission to the HR information in ServiceNow OK.
27:12
And an IT person accessing service now through that agent
27:15
should have permission to that IT to the IT asset information.
27:21
And so you see it's this blending, right, where it's the
27:24
rights of what the ServiceNow agent can do.
27:27
Maybe it's only allowed to read the data, OK, right.
27:30
And then the data set in this case, right, depends upon what
27:34
user it is, OK. And so it's not that the
27:37
identities are sort of are sort of combined, is that their
27:43
access rights, right, are combined.
27:46
I mean, what you described there almost sounds a little bit like
27:48
a privileged access management use case where you've got this
27:51
agent that is going and accessing, you know, a certain
27:54
resource, whether it's, you know, direct on behalf of a
27:57
delegate or some sort of inference of of whatever.
28:00
I mean, it seems to me like is the right way to have each
28:04
person has their own agentic version of themselves?
28:08
Or is it? I have a shared, you know, maybe
28:12
it is an HR agent that a bunch of HR people share.
28:16
And based on whoever's invoking that agent at that, at that
28:20
runtime, it's saying, OK, well, because Jeff invoked it,
28:23
whatever Jeff has access to, I now have access to for this time
28:26
limit. Or if I'm in iti have a
28:28
different scope of permissions or whatever maybe?
28:31
Right, so, so I think what's what's quite beautiful about
28:34
everything we're talking about are the analogies OK, right.
28:38
So people should be able to draw on the concepts of IAM or Pam,
28:42
right, in order to start to talk about what this should look
28:46
like, OK, right. And, and it does it does start
28:50
to smell right, like fine grain control, right, that you would
28:53
want to do in Pam. But the difference is OK is
28:57
whether you have an agent for a particular person or agent
29:01
that's shared among people, OK, The user may get the effective
29:07
rights, OK, of that agent, maybe not only the on behalf rights of
29:13
the user. OK, Let's take a very trivial
29:16
toy example, OK? In that ServiceNow use case, if
29:20
the agent operated on behalf of the user, then the agent could
29:24
read the user's calendar. OK, that's not what you want,
29:29
right? The agent is a ServiceNow agent.
29:31
You're smiling, but that's, that's sort of a toy example.
29:34
So the on behalf of relationship is not sufficient, right,
29:38
Because you don't want the agent to do everything that that user
29:42
could do, OK, right. The agent should do what that
29:45
user could do within the scope of what the agent is allowed to
29:48
do, OK. And we call this notion sort of
29:52
a blended identity, OK, right. Where what you're doing is
29:56
you're blending the access rights that are entitled to the
30:00
user and the agent in order to figure out what the effective
30:04
rights of the agent are. I think there's a few people
30:07
listening who would love to have an agent read and respond to all
30:09
their e-mail for them. Maybe they're brave right now to
30:13
do that right to. I think eventually, you know, we
30:17
get to that spot. But it's probably different
30:19
agent than the ServiceNow agent, right?
30:22
You would certainly hope so. That that's right, right.
30:25
And I, you know, we'd all like that, OK, right.
30:27
But but I think again, it's these the agents will have a
30:30
task, right? And then the task that it's
30:33
doing will get right based on the user that's invoking it.
30:38
So let me ask you a, a future looking question is, and we're,
30:43
I think we're all familiar with like birthright provisioning,
30:45
right? Things like that.
30:46
And I kind of joked about an agentic version of myself.
30:49
How long do you think it is that it would be where as a standard
30:53
birthright role or birthright provisioning, not only am I
30:56
getting my account, I'm getting an agentic version of myself.
31:00
Is this a one year, three-year, five year, 10 year out that you
31:04
think you'll start to see agentic Jeff being provisioned
31:07
at the same time as real Jeff? So, so, so I think that that
31:13
it'll be more the tooling, the the tooling that we talked about
31:17
that they'll be things out there, right, that will do
31:20
specific tasks, OK, more than somebody that'll operate, you
31:24
know, sort of as as as my clone. OK, there's there's lots of
31:29
ways, right, that I think you want probably a little bit
31:33
shorter leash. OK, right then, then and then
31:36
the agent being able to do everything on your own.
31:39
On the other hand, we all said right, this is moving very, very
31:42
fast, okay, right. And the fact that we can
31:45
entertain questions like that shows just how close, right?
31:48
It's actually possible. Okay, right.
31:51
So, yeah, we we were some friends and ours were talking,
31:55
you know, it's will agents sort of be your persona, right?
32:00
Do do you know what I'm saying? Right.
32:01
I'm not sure how I get the experience right from the agent
32:05
being, you know, being my persona.
32:07
But that's treading on philosophy and science fiction,
32:10
so. I loved a lot of the questions
32:13
that Jeff asked. Like I kept thinking in my mind
32:15
about if you had a humanoid robot, would you want him or her
32:21
or it to be able to do anything that you can do?
32:26
The answer might be yes. I don't know.
32:28
I'm just got to give that one some thought.
32:32
But David, what I really like about Jeff's questions is that
32:36
he kind of started to help me understand a little bit more
32:40
about how ambit works. And the question I have for you
32:45
is like, who uses ambit? Is it me and Jeff as agent
32:50
developers? Is the IM group like the
32:54
identity practitioner, the the the administrator of the system
32:59
is that who uses NBIT? Both of us?
33:03
How's that work? OK.
33:04
Yeah. So generally we have two
33:06
stakeholders in the enterprise. We have the security function,
33:09
OK, whose job it is to make sure that resources in the
33:13
enterprise, whether they're data or systems or tools, are only
33:17
accessed by authorized users or agents, OK.
33:20
And then there's the developers who build those agents, OK?
33:24
And for them, our job is to make being compliant with policies
33:28
and make access OK, authentication, authorization
33:32
easy, OK. And we have an aspect of our
33:35
stuff which is no code. OK, So people can include our
33:38
stuff in the agent and they don't have to modify their code.
33:42
And what would have been the stops of authenticate the agent
33:46
in the hybrid case, authenticate the user, then check and access
33:50
policy and then issue a credential and use that
33:52
credential. That all gets taken care of, OK
33:55
by our stuff without the developer needing to write any
34:00
code. And then of course everything is
34:02
logged, both successful attempts and not and and and denied
34:06
attempts. OK.
34:07
So the two stakeholders? You know, David, I, I heard you
34:11
say in one of our conversation, I wrote it down.
34:14
Identity helps folks on the front end.
34:17
And now that I've got you here for the interview, I wanted to
34:20
ask you what you meant by that. OK.
34:22
Yeah. So so there's there's two places
34:26
where identity, well, there's three places where identity
34:29
happens, OK, there's policies, right?
34:32
This agent can access ServiceNow, OK.
34:35
There's how ServiceNow enforces those policies and identity or
34:40
an access token comes in and ServiceNow knows that it can go
34:44
to HR data, right, and not IT data.
34:47
But then the question is on the left hand side of the picture,
34:50
how does the agent get that access token so that it can use
34:55
that? OK.
34:56
And that's the part of the problem that and it solves.
34:59
And it says set a policy and we can authenticate the agent and
35:03
the user and then deliver a token that that agent can use.
35:08
And the interpretation of that token is left to the system
35:12
you're accessing, OK? Now, if you think about it,
35:14
that's exactly what happens with Microsoft Antra or Okta, right?
35:18
They're not trying to give sales force a fine grained
35:21
authorization mechanism, OK? They have sales force's job.
35:25
The job of Okta is to deliver to the user, right?
35:28
The sales person, the token that maps them to a certain set of
35:32
rights, OK. And that's what I meant by the
35:35
left side of the picture, the guy doing the access, rather
35:38
than the right side where the resource is.
35:41
Very cool. You know, I, I think the whole
35:45
AI agent wave feels a lot like the cloud platform wave.
35:52
Remember, organizations started standing up Amazon Web Services
35:58
accounts and they just have development servers at first.
36:03
Then you check back in a year later and there were like 30
36:06
accounts and all kinds of production applications and it
36:09
moved so quickly just became a thing that made sense for the
36:13
business. And we identity practitioners,
36:16
we were I think in many cases late to react, right.
36:20
We didn't get ahead of it and we couldn't hold back the business
36:24
from, you know, taking on this great technology.
36:27
Just like today you're seeing probably in my organization,
36:32
there are probably thousands of agents that have already been
36:34
built. So I, I think the, that maybe
36:39
not because of just the size of the wave this time, but maybe on
36:44
how quickly it came on. I think it caught a lot of
36:47
identity practitioners, probably flat footed, I guess.
36:51
What's the advice you have for them now?
36:53
If you're an organization, you've got thousands of agents,
36:57
you know, how do you get your arms around this beast?
37:01
Yeah, so, so I think that's, that's a good question, but I
37:04
think you want to look that even if there's thousands of agents,
37:07
it's relatively Greenfield, OK? Right.
37:10
So let's look at 3 examples, OK? Right.
37:14
We've spent probably a dozen years getting control over user
37:17
access, right? By introducing IM systems and
37:21
multi factor and conditional access and a path to zero trust.
37:25
OK, Machine access, however, is still stuck in the world sick
37:30
secrets management management, okay, right, So most service
37:33
accounts that machines log into are API keys or username
37:38
passwords for those service accounts.
37:40
And that's where you have Jim, like you said, lots and lots of
37:44
years and years, right? Of of of of debt, okay to clean
37:50
up, okay. On the other hand, agents are
37:53
relatively nascent, OK. And what we're hearing from the
37:56
enterprise is it's this combination of push pull.
37:59
We need to innovate, but we need to create the platforms, right
38:03
that prevent us from getting into this problem that we're in
38:07
with machine access, right? Where it's just credential
38:10
sprawl and Long live credentials, right?
38:13
Doing all the things the way you wouldn't do for users, OK,
38:17
right. But you didn't because you
38:18
didn't have the plumbing along the way.
38:20
And so now what we're hearing for agents, it's the time to
38:23
start in doing doing it better, OK, using modern authentication.
38:29
And that's what Amit does. We're IAM for agentic care.
38:33
So you've made a compelling case and now I think I'm OK.
38:36
Well, I need to do something about the identity and the
38:39
access for my agents. What are some of the things
38:42
that, as I put my jaded Siso hat on again, is that right?
38:45
It's going to cost me money, right?
38:46
So how do I, you know, how do I make the case to the board or
38:51
the CIO or whoever, right to get the budget?
38:55
How do I measure success with ambit and then say, OK, this is
38:58
what the return is looking like that.
39:00
Do you have any any metrics that you typically are seeing from
39:04
your customers or things like that, that can help me make the
39:06
case as somebody who's interested in delving into this
39:09
more? Yeah.
39:10
So we're seeing metrics 1 is, is a hard metric, right?
39:13
How much, how hard is it for developers, right?
39:16
How much time do they say by not having to code up all OK.
39:20
The second metric that's that's also a hard metric is if you did
39:25
it the way Tim you said, right, with usernames and passwords or
39:28
dedicated usernames and counts. We all know the overhead
39:32
associated with rotating credentials and all that, right?
39:35
So there's, there's there's just hard cost associated with that.
39:38
And then of course, there's just compliance, OK, Right.
39:41
You can't say that I have, you know, Snowflake available to
39:45
every user through Okta, OK, in a controlled, gated way, OK, But
39:51
my agents can get to Snowflake, right?
39:54
With username, password, OK, Right.
39:56
That just that doesn't withstand board scrutiny either, OK.
39:59
So I think it's a combination of dev work, OK, the the management
40:05
of the hygiene of the environment, OK, Now we don't
40:08
manage secrets, you manage policy.
40:10
And the third one is, is we should do this the right way,
40:13
OK. And with agents, we're finding
40:16
Jeff, you'll like this, right? Since people sort of think of
40:19
agents as people, it's easy for them to imagine that the agents
40:24
should have authentic care authentication characteristics
40:27
like we do for people, OK? But then you ask yourself the
40:30
obvious question, OK, is I have MFA for people.
40:33
I text A4 digit code to my phone, right?
40:37
I can't do that OK, to an agent because even you, we didn't ask
40:40
that we should give your proxy agent proxy a a a an iPhone, OK,
40:46
right. So how do you do strong off
40:48
right dynamic policies, ephemeral delivery, just in
40:51
time, just in time, deliver ephemeral credentials, OK for
40:55
these agents like you would for people, OK.
40:59
So what does it look like? Get started with this?
41:01
Is this you know code that I insert as a developer into my
41:05
agent? You know, workflow, is it some
41:09
sort of UI that's going out? And just like, tell me like how
41:11
I get started down this journey. Yeah.
41:15
So our our system is, is a SaaS based policy console, OK.
41:19
So that's where you set access policies.
41:21
This agent with this user can access service now in this way,
41:25
OK And in order to make that live, then you need to be able
41:29
to establish trust relationship so that service now we can issue
41:32
credentials to service now that would be just like you would do
41:35
with Octa. And then the idea is of course
41:38
is that then you need to integrate it into the agents,
41:41
OK? And for the most part, our
41:42
deployments are code free, OK right.
41:45
The agent is configured to use Ambit, but the developer doesn't
41:49
have to do anything, anything extra, OK.
41:52
We always recommend that people start small, OK, You know what
41:55
I'm saying? Never or mandate something new
41:57
across the whole organization right away, OK, Here you're
42:01
starting on use cases, OK, And that use case can either be app
42:05
by app, right? You're choosing to secure access
42:07
to Salesforce or Snowflakers, right?
42:09
Or service now or it can be with the the agent developers, right
42:14
who are using particular services and then you start
42:17
there and that becomes patterns for other people to deploy, OK.
42:22
I mean, we all know developers love to be told what to do and
42:25
how to do it. So, you know, guardrails.
42:29
Guardrails so so coding up off is hard, OK coding up off well
42:36
is harder, OK, right. And you can either, you know,
42:40
code it up yourself, right, or you can get it for free, OK, and
42:45
you know. Where do you want to spend?
42:48
Your time. Building the cool app?
42:49
Or is it doing the things and solving problems that have
42:52
already been solved elsewhere? And it is actually amazing job
42:56
that off is still a application level function, OK, right.
43:01
It's so fundamental that it should just be part of the
43:03
platform, OK. And that's what Emma tries to
43:06
do. That's great.
43:08
So we started the conversation with onions and onion routing.
43:12
We went to Identity for Agents and I was looking through your
43:16
background as we kind of close out the conversation here today.
43:19
You did work on Divx and I had to explain before I hit record
43:24
with Jim to Jim, like what Divx was.
43:27
And I think it was like late 90s.
43:28
And so, you know, we've got a lot of, you know, folks in our
43:31
generation who might be familiar with it.
43:33
But talk to me a little bit about Divx itself, what it is or
43:37
what it was. I guess I'm not even sure if it
43:38
still exists. Maybe you can help me with that.
43:40
And then talk to me about some of the identity components maybe
43:43
that went into Divx, because that was really one of the first
43:47
maybe Internet of Things, things that people kind of might be
43:51
familiar with at that point in structure.
43:54
Yeah, So Divx was really very cool business.
43:56
OK, so we're all going to date ourselves here, OK?
44:00
Right. So Divx existed when Blockbuster
44:02
existed, OK, Right. And how did you rent a movie?
44:05
It was Avhs tape. OK, Right.
44:08
And you'd go to Blockbuster and there'd be all these movies and
44:11
the popular ones were gone, of course, right, Because they
44:14
weren't available. And then you'd pick the movie
44:16
that you wanted, OK. And then you'd bring it home and
44:20
then you'd watch it and then you'd return it probably late
44:24
and pay a late fee. Okay, right.
44:27
And a lot of the revenue was from those late fees.
44:30
Okay, so you made two trips, okay, paid a rental fee and late
44:35
fee. Okay, So Divx, not the Divx
44:38
codec. Okay, that was the name was sold
44:41
to after it closed OK, but Divx was when DVDs were coming out
44:46
OK, the the founders of Divx, which was owned by Circuit City,
44:52
another blast from the past OK right, So today they were
44:56
competitor to Best Buy OK, I feel.
44:58
So much white coming in into all of our beards as we're talking
45:01
about. This if like amazing, OK, right.
45:03
And so, so, so, so DVDs were coming out and, and the, the
45:08
founders of Divx said one, wouldn't it be cool if we can
45:12
sell you a DVD instead of for $25, whatever it would cost you?
45:17
We could sell you a DVD for the price of a rental $3, OK.
45:22
And more importantly, that DVD could be available at a retailer
45:27
instead of a store that knew how to rent and process a return.
45:31
OK, because that was complicated.
45:34
So imagine you're at the checkout aisle in your grocery
45:36
store, in the top 20 movies are there, and they cost 3 bucks
45:39
apiece. And you buy it, and then you go
45:41
home and you watch the movie, OK?
45:44
And then you can put it on your shelf and watch it again and be
45:47
charged another $3, but you don't have to return it, OK?
45:50
No more late fees, OK? Right.
45:53
So this was really a very cool idea.
45:55
And for all of the young people on the call, this is before
45:58
Netflix had streaming, OK? Right.
46:01
You know, Netflix actually had a DVD rental business by mail when
46:06
they first started, right? So dad had the same plumbing
46:09
problem, right? It had to work directions.
46:12
So this is an identity problem. OK, Right.
46:14
How do you know who the rental renter is?
46:16
How do you know what DVD player is playing it?
46:19
OK, and how do you know what disc you're playing?
46:22
OK, And that knowing which disc you're playing, I don't mean
46:26
which which movie you're playing, right?
46:28
Remember when you paid $3? That first play was free.
46:34
So how did you know that a disc was played only the first time
46:40
and the second time you would charge for it?
46:43
So what what Divx did is DVDs are all clones OK right there
46:47
stamped OK. But post stamping they would
46:51
etch a serial number into the DVD that could be read by the
46:55
machine. And the first time ADVD serial
46:58
number showed up that consumed the purchase price, the rent,
47:03
the the built in rental price. And if you played it again a
47:07
month later, OK, then you would be charged again, OK.
47:11
And so this is very interesting because you were giving at at a
47:15
large scale an identity to a DVD, OK.
47:19
And it flowed through the whole system.
47:21
And there were the other identities that we talked about
47:23
in watermarking and all this stuff.
47:25
A really cool business, OK, They had deals with all the studios,
47:30
almost all the studios. And then then they shut it down.
47:33
And that's a story for a conversation over a beer.
47:36
OK, so. I think we just said Circuit
47:40
City for the first time ever on this podcast, 380 some episodes
47:44
and for the first time in that combination, in that sequence,
47:47
Circuit City just came up. So, David, that's a blast in the
47:50
past. It's great, OK, And it was cool
47:53
to be talking and you you recognizing that that's like the
47:56
coolest thing. OK, so.
47:58
I'm a nerd, what can I say? That's fine.
48:00
Jim, do you remember Divx at all?
48:02
Does any of this ring a bell for you?
48:03
Like, you know, back back in the days of your.
48:06
So I do remember the Divx codec. Now one of the things I would do
48:11
is take DVDs and you know, copy them to other DVDs and you
48:16
basically had to reverse out the Divx codec and save this MP4
48:21
file, etcetera. So I think I just admitted to a
48:25
federal crime, but. Statute of limitations.
48:28
Well, nobody's going to come after me.
48:29
I think the statute of limitations has gone by.
48:34
I do remember one thing, my grandfather used to rent movies
48:37
and record them and then like the whole family would come over
48:41
and he was like the Blockbuster video like.
48:44
But there was no late fee and no rental fee.
48:47
He just borrowed Terminator 2 and keep it for a week.
48:52
This is the good old days. The good old days, right?
48:55
And, and you're lucky you had a grandfather like that, OK?
48:59
Because he did the work to make it free, OK, But for most
49:02
people, if it was 3 bucks, OK, you know, it was all right, you
49:06
know, so. Well, we're just this the way
49:09
that the industry has evolved over time, right?
49:11
So we had, you know, Blockbuster Video, you know, you'd go pick
49:15
up your video. For me it was pick up video
49:16
games, Super Nintendo, Nintendo, whatever it may be, right?
49:19
Get that stuff. And then you had things like
49:22
this DVD, Divx type approach, Netflix when it was, you know,
49:25
mail order. And I think Red Box was around
49:28
for a little while at some point as well.
49:29
It's kind of another idea. And then it became subscription
49:33
based. It was like, OK, now it's a
49:34
buffet because people I think got sick and tired of being sort
49:36
of nickeled and dimed, right. So it had like the iTunes
49:39
stores, like, OK, $0.99 for a song, and then it was, you know,
49:42
$1.99 I think, to rent a movie. And then people started wanting
49:46
to own the digital media themselves.
49:49
And now we're in this era of subscription, you know, hell, so
49:53
to speak, where you've got a subscription for like 8
49:55
different services and you don't actually own anything.
49:58
But you have the right to consume as much of this as you
50:01
want. And I consume, you know, quite a
50:03
bit of it, just like I'm sure everyone else does.
50:05
But now we're seeing those subscription prices go so crazy
50:09
that now it's like people want to actually buy the thing and
50:11
put it on a shelf. So now you have things, you
50:13
know, people are buying DVDs and, you know, trying to think
50:16
of other ways to archive their media so that they don't have to
50:19
keep paying subscriptions and things.
50:21
Like that? Just think about this chef in
50:23
your 20s. Did you have more than or less
50:26
than 100 C DS? I had more than 100 and then I
50:30
undertook. I had hundreds of C DS at one
50:33
point I undertook that the challenge of digitizing them
50:37
all, turning them into MP threes.
50:39
And I think the highest codec at that point or bit rate would
50:42
have been 128, maybe 192 bits. And now you've got things like
50:48
lossless and you know, 320 and variable bit rates.
50:52
And you know, I had so many DVDs and CDs that were burnt that
50:57
turned into trash because the buffer overflow or buffer under
51:00
on, I can't remember which it was.
51:02
It was. It was a real mess, man.
51:04
Yeah, but The funny thing is though, you felt like you own.
51:07
Right. You own that music in the CDs,
51:10
right? But ultimately now you have
51:13
Apple Music or Spotify or something like that.
51:17
And aren't you happier? Don't.
51:19
Isn't it better? It's like, oh, you heard this
51:21
new song and it's like, I want to hear that song 15 times
51:25
today. You can do it.
51:27
Well, define better. I think the convenience is
51:30
certainly there. I'm perfectly willing.
51:33
I mean I have been for years at this point to pay some certain
51:36
amount of money, typically somewhere between 13 and $18.00
51:40
a month, right, For a media service of some sort.
51:43
I feel like you get the value out of it.
51:44
I am not interested in having my background be all these
51:49
different, you know, C DS and things like that I used to have.
51:52
But you've got people who are now interested in collecting
51:54
vinyl. They want to go back to that old
51:57
school kind of fidelity of the audio itself.
52:00
And you know, there I think there is something a little bit,
52:02
you know, romanticized about having the album right, and the
52:05
album cover and the artwork and the lyrics and all that stuff.
52:09
You don't get that in the digital world.
52:11
And so I can kind of see it both ways.
52:13
Yeah, you're right. I'm going to isolate that you
52:16
just said I was right. And that's just how it went over
52:18
and over again, right? All right, we're going to go
52:21
ahead and wrap it up for this week.
52:22
David, thank you so much for taking time with us.
52:24
I definitely want to get people out there to visit Ambit and
52:27
I'll spell it out here a E MB IT dot IO slash IDAC.
52:33
We'll have a link in our show notes.
52:34
I'll put a link to your LinkedIn profile as well for people to
52:37
kind of reach out there either to, you know, ask questions
52:40
about Ambit or maybe just reminisce about Divx or, you
52:43
know, whatever it may be. And yeah, we'll leave it there
52:46
for this week. We are on the web, IDC
52:48
podcast.com. Thank you David again for
52:51
sponsoring this episode. And yeah, do all the things
52:54
like, like and subscribe, share with all your friends and let
52:56
people know the gospel who I am. So thanks everybody for watching
53:00
and or listening and we'll talk with y'all in the next one.
53:04
You've been listening to Identity at the Center.
53:08
We hope you've enjoyed the show. Make sure to like, rate and
53:12
review and we'll be back soon. But in the meantime.
53:15
Hit the website at identity at the center dot.
53:18
Com see you next time on identity at the center.