Latest / Identity at the Center / #398 - Solving the AI Identity Challenge with Martin Kuppinger

Transcript

#398 - Solving the AI Identity Challenge with Martin Kuppinger · Identity at the Center

0:04
This is IDENTITY at the Center. Welcome to the Identity Center
0:11
podcast. I'm Jim McDonald.
0:13
Unfortunately, Jeff Stedman is under the weather today, could
0:17
join us. And it's really his loss because
0:20
we've got a fantastic guest, a return guest, Martin Kupinger.
0:24
He's the principal analyst at Cooper Cole.
0:28
You may just know him as Martin. So that's how I know him.
0:32
Martin, welcome back to the show.
0:35
Yeah, Trim pleasure of being back here and thanks for
0:39
inviting me again. Absolutely.
0:42
And also, I guess it's welcome to 2026 for all of us.
0:46
We're just getting back from the holidays and getting ourselves
0:50
wrapped around, wrapped back into the identity space again
0:55
and having to, you know, solve a lot of the same problems that we
1:00
were in 2025. I want to talk about a lot of
1:05
things. I guess I haven't seen you since
1:07
EIC in 2025. We're also looking forward to
1:11
being there again, Jeff, and I'll be there in 2026 in Berlin.
1:16
I'm sure preparations are underway from your perspective.
1:21
They, they are so, so I'm not that much involved with the
1:25
agenda work. So, so my, my works will start a
1:28
little later on, mostly when, when it comes to.
1:30
So I did a lot of, gave a lot of input to the for the agenda.
1:35
But then when it, when we're getting closer to EIC, then the
1:40
one thing will be scheduling. So it's always a tough thing to,
1:46
to squeeze everyone in the tight schedule.
1:49
And the other thing will be preparing my own presentations
1:52
and talks. Well, I got to say it's, it's
1:55
just a fantastic time. Obviously if you're in Europe,
1:59
it's the number one conference covering the identity space.
2:02
If you're from outside of Europe, if you can make the
2:06
trip, I highly recommend it. We had a fantastic time this
2:09
past year. Looking forward to doing it
2:11
again this year. And by the way, we will have a
2:14
discount code on our website. I don't know if we have it out
2:18
there yet, but look for it within the next couple of weeks
2:21
if you're looking to register for the conference.
2:24
It'll save you some money. And we're going to talk about
2:27
EICA little bit later in the agenda.
2:29
But while I have Martin here, I want to pick his brain on a few
2:35
topics. And Martin, I, you know, Jeff
2:40
and I always say it's like, it wouldn't be identity at the
2:42
center if we didn't talk about AI.
2:44
And sometimes we joke around and call it AI at the center.
2:47
But it's, I mean, this went from, I'd say this time last
2:51
year where it was like, Oh yeah, that's something that's going to
2:53
happen in the future too. It's happening right now with
2:57
the AI agents and companies building them and identity
3:02
practitioners trying to figure out like, what is our framework?
3:06
What is our approach for managing AI identity?
3:12
Yeah. And, and as we also see that
3:16
there's a lot going on with AI, there's also, I think some, some
3:20
disillusion starting when, when, when organizations feel they,
3:25
they either don't have the, the results they that were promised
3:31
at the very beginning or that they feel some things can't be
3:35
done easily. So because we, we hear this,
3:39
especially in regulated industries that organizations
3:42
are, are shy of deploying solutions agents, for instance,
3:47
and, and within business processes because they feel they
3:51
don't have, have enough control and sufficient control about
3:55
these agents. And that means, yes, we have
3:57
have an interesting challenge here.
3:58
I I would dare to say in, in all the yeah, 35 plus years.
4:05
I'm in the identity space right now.
4:07
This is the most, I would say intellectually challenging
4:15
evolution I've seen over all these years.
4:19
So it's an incredible amount of complexity and I think we need
4:25
to be very careful of on one, on the one hand, finding short term
4:32
solutions to to address challenges, but not believing
4:37
that we have solved everything with the first whatever MCP
4:41
server authorisation solutions, because this is trust a piece of
4:47
the puzzle. So that that will be very
4:50
interesting. How can we deliver quick
4:53
solutions that that help, but not sort of tapping in into the
4:59
trap of thinking as oversimplifying the challenge?
5:05
Yeah, not oversimplifying the challenge, but I also feel like
5:11
we also have to make sure as practitioners that we are not
5:16
stopping the business progress. We have to from obviously from
5:21
our, our main charter is securing the environment, but we
5:25
also have to not be the progress prevention department.
5:31
Where, where security is a really good in, I think we've
5:33
proven that for decades that security is tends, tends to, to,
5:39
to hinder business in, in, in progressing.
5:42
And I think that's exactly the balance we need to find.
5:45
So how can we at the end of the day, I think this AI sometimes
5:50
we're, as I've said, we businesses are in the situation
5:53
that they feel they, they lack a certain level of security and
5:58
control and governance to proceed in what they want to do
6:03
in the business. So, so this puts us in some
6:07
sense much more in an enabler role than ever before.
6:11
Because I think from what I hear is that a lot of businesses are,
6:16
are really, I would say, insecure about what they can do
6:24
and whatnot. And they feel a risk of losing
6:26
control potentially. So that means that the, the
6:32
businesses asking for a certain level of security and control,
6:38
usually it is that they, they don't ask much they feel hinders
6:42
them. In this case, it feels this is
6:44
what they need to, to, to be able to proceed in their
6:47
initiatives. And, and I think from that
6:51
perspective, it might be a better situation for security or
6:55
cybersecurity identity people than than in most cases before
7:00
where, where we were trust the the ones coming in and saying,
7:03
Oh, no, we can't do it that way. And we need to make it more
7:06
complex and slower and more expensive.
7:09
In this case, it's really made me say, OK, if you do that and
7:12
that and that you can at least sort of have a, a, a better, a
7:20
stronger risk control. And that that again goes back to
7:24
what I said before. I think we need to find a good
7:27
balance between solving certain of these challenges, the ones we
7:32
can solve now. But we, we, we, we must not
7:38
believe and and also not leave the impression that this is the
7:41
finite solution already. Because to solve everything, I
7:45
think there's so many pieces that will take us quite a while
7:49
and it will require quite a lot of innovation.
7:52
We probably will need new types of standards or or improvements
7:57
and product protocols and all that stuff to cover all the
8:01
challenges. Yeah, I think that's exactly the
8:05
way I was looking at. The problem too is that there's
8:09
so many use cases. I think of myself as kind of a a
8:13
productive employee and I want to build my own agents and what
8:19
identity do I use or allow those agents to run under?
8:23
Do I just give them access to run like me or run with my
8:28
credentials? Well, that's obviously a no, no.
8:31
There's also the use cases where you're building enterprise level
8:35
applications with AI. And I think the at least, I
8:41
think the point that you're making is like trying to solve
8:45
all these problems at one time. That's very difficult to do.
8:49
Yeah. But but it's I think the the
8:53
same challenge we have with with many other we had in many other
8:57
areas in the past. I think we need to sort of
9:05
deconstruct this, this problem domain to smaller pieces, figure
9:10
out solutions for the smaller pieces and then bring them
9:12
together. But every, every, every element
9:16
we, we, we address will help us in the overall security.
9:21
We also probably will have points on use, but we then need,
9:24
for instance, an over sort of an end to end governance.
9:28
So not only saying, OK, we have a bit of security year and year
9:32
and year. We need an over over all
9:34
governance across all the pieces, which then brings things
9:37
together or which helps us understanding anomalies across
9:41
the entire chain. And I think one of the big, so a
9:44
couple of things. One thing is I think it's not a
9:48
good idea to sink in the identities of AI agents is trust
9:58
a non human identity? I think so.
10:01
I, I, I'm not a big believer in the term non human identity
10:04
because I think it's an umbrella term that's we covers a lot of
10:09
different things. So the, the real machine
10:11
identities for IIOT or OT the, the workload identities, which
10:16
some call machine identities. And then we have compared to
10:21
workload identities, agents have a way higher level of autonomy,
10:26
which means they are in many areas different.
10:29
What I think also comes into this, this or what adds to the
10:34
problem domain is we we are used in in saying there's a human or
10:40
maybe a workload accessing a system right now.
10:43
We say, OK, there's a human or a non human that there's an agent
10:55
that works on behalf that impersonates, that has been
11:01
delegated to do whatever. There are very different ways to
11:06
to, to between just the human and the agent.
11:09
And that agent then can work with other agents.
11:11
There might be a chain of agents and then we have all the systems
11:16
that these agents try to access to, to to respond to the
11:21
requests. So it's, it's a, it's a much
11:25
more networked, much complex relationship challenge than we
11:29
had before, which also means, for instance, from an
11:32
authorization perspective, we have, we have a lot of different
11:34
points of authorization. So there is the agent to the MCP
11:38
server, but there's also the the relationship.
11:44
This is an interesting authorization field between the
11:47
human and the the agent. So that that is what where,
11:52
where I always say, OK, you know, there there might be the,
11:54
the situation that the agent can do more than the human will
11:59
allow. So travel booking, the agent can
12:02
book you any, any travel, but maybe the corporate policy says
12:06
you're only allowed to go in hotels up to that price tag or
12:11
you're only allowed to, to fly, fly economy or whatever else.
12:19
But it could be also the other way around that you, and we've
12:21
seen these cases enough that someone asks, requests the
12:25
agents to, to do things the agent is not entitled to do.
12:30
So, oh, give, give, give me the construction plan for a nuclear
12:36
bomb or things like that. So I, I think we have way more
12:40
complex relationships and authorization challenges and we,
12:46
we can clearly mitigate a certain part of the risk, for
12:51
instance by, by MCP server authorization handling it and
12:54
probably, but it's just an element of the overall solution.
13:00
Yeah, the MCP server, just thinking about that, that in the
13:05
enterprise architecture perspective, there's an MCP
13:08
server and it's managed by IT, right?
13:12
But if I am a knowledge worker, to use a very old term, I'm a
13:17
knowledge worker and I'm building an AI agent to do
13:21
something and I want to connect to services that let's just say
13:27
I want to connect to work day, right?
13:29
And I have a work day account. I can get into work Day and I
13:32
can see certain screens and I just want to be able to take
13:38
information from those screens and pull them into a
13:42
spreadsheet, right? I'm trying to create a very
13:44
simple example, it seems to me, and I, I'm, I'm painting a very
13:49
specific use case here, but do I have to go back to the
13:54
enterprise and say, hey, I need the MCP server to connect to
13:58
work Day so I can do these things?
13:59
Or maybe Work Day is not a great example because most companies
14:04
are probably connecting their MTP server to work Day.
14:07
But maybe it's a a legacy business application.
14:11
But I teach the AI to do something to fetch my data so
14:15
that I don't have to do that myself.
14:17
I for day I come in and they populate some spreadsheet with
14:20
all the information I need. I feel like I want to give it my
14:27
credentials, but at the same time then it, you know, from a
14:31
security standpoint that looks like I'm the one who's doing the
14:34
clicking and all that. But actually it's the agent.
14:37
So we should have an agent identity to do that.
14:43
This is kind of a theory of my own, which is that there should
14:46
be some kind of self-service process to create a, an agent ID
14:53
for me to do that rather than having to go through, you know,
14:57
having one issue to me, etcetera.
14:59
What are your thoughts and what is the the industry direction in
15:03
terms of how to solve use cases like that where you have
15:07
knowledge workers, you want them to use AI to be more productive,
15:11
but then this security layer makes it almost impossible to do
15:16
it right. That's, that's a great tricky
15:18
question because I, as I said, I think that there did so many
15:24
different scenarios behind that. So I, I think that the point is,
15:34
is the knowledge worker using an existing agent, then, then it's
15:39
a very different thing than when, when we think about.
15:42
I really hate this democratising term in in IT, especially in
15:47
security if it's more that everyone can create own agents,
15:54
which I think raises some some other questions first, like like
15:58
how do we keep control about these when when someone does it
16:06
sort of decentralised and and not within a sort of a managed
16:12
environment. And I think, but especially for
16:16
these areas, I think it makes a ton of sense to have identity
16:20
and access and all the stuff as a service.
16:24
So I, I think the worst thing would be that that someone tells
16:28
the agents what the agent is allowed to do.
16:32
I think it's better than to consume it from from a from a
16:37
service that is sort of centrally managed and sets the
16:41
rights sort of limits and delivers the rights types of
16:47
policies and identities to to agents that are are built
16:51
decentrally. So I think the worst thing is,
16:54
is having super user type of self constructed agents popping
17:02
up at scale and without any control.
17:06
Yeah, I see your point. And I guess I, I, I don't fear
17:12
that. In fact, I'm, I'm the, I could
17:15
come from the other perspective because I'm working on a project
17:19
inside of my company right now and it's a training project and
17:24
I want to pull data from various different places to populate and
17:29
to educate the ages. So I've got a kind of a scheme
17:33
in my mind and it's like I understand it.
17:36
I don't want to have to spin up the big project.
17:38
I want to do like proof of concept and etcetera.
17:42
So, but I, I think this whole topic maybe ties back to what
17:47
you're talking about with governance.
17:49
So I've kind of feel like governance is all about setting
17:54
the guardrails. It, it's the, the paper and
17:57
pencil side to information security.
18:02
And it would behoove, I think organizations to maybe start
18:07
there where you have a governance committee or
18:10
governance body that overseas AI.
18:15
What are the use cases that are relevant to your organization
18:19
and what are the rules of the roads in terms of what people
18:23
are allowed to do and what information security protocols
18:28
apply? Is that where you're getting at
18:30
with with governance was kind of like the rules on the road and
18:34
the guardrails? You know, I think, I think maybe
18:38
to explain my, my perspective, I have a quite some legacy in the
18:42
Lotus Notes Domino field where where hundreds frequently
18:48
thousands of databases were constructed pretty much
18:51
decently. And still still for many
18:55
organizations still our challenge in migrating these.
18:58
So no one knows what why no one knows what they are they are
19:01
doing, which data is kept etcetera.
19:03
So I, I think and, and, and maybe another, another point to
19:08
bring in this, which may explain mass thinking.
19:14
We in, in many areas we have that situation that people, for
19:20
instance, developers just want to do to solve a problem and
19:25
security for them is not the first priority.
19:28
And it's interesting to see that that approaches like OPA or
19:33
them. Unfortunately, you're still
19:35
relatively decentralized Hashicorp walls and others
19:38
became very attractive because it removed some burden from from
19:42
the developers by saying, I just can't consume a service.
19:46
And that means you have an option to bring these things
19:49
under control to at least ensure what is to understand what is
19:54
what is out there, how is it working?
19:56
Where are your security risks and, and for instance, manage
20:01
the identities, bring things under control.
20:03
And I I think for when we create agents, then certain aspects
20:09
should be also always be considered as a service.
20:12
So it doesn't make sense that that decently everyone decides
20:18
about whatever the access the agent should have to data.
20:25
I think that that is usually the the one who who owns the data.
20:29
Should be the one who who decides about that access.
20:34
Because if you want to solve the problem, you may go out to and
20:36
and try to reach out to too many, too much data.
20:40
And that in some sense multiplies because it's in the
20:44
nature of the of generative AI to try to gain access to as much
20:51
data as it can. So, so I, I think in that sense,
20:54
it even multiplies with the sort of traditional over entitlement
20:58
challenges. And so, so I, I would say I, I
21:02
would prefer something which goes more into a delivering
21:09
identity, security, etcetera, as a service into that world of, of
21:16
ancient development and ensuring that that agents, for instance,
21:21
in some way maybe are registered with the organization, maybe
21:25
even even beyond the organization to always
21:28
understand which, which you can trust or not.
21:32
So I, I think there's a really good conversation where we talk
21:36
about identity for AI, in other words, for agents, we also have
21:43
the conversation of AI for identity.
21:45
And what we're starting to see is a proliferation of basically
21:50
almost every identity tool now has 50% more AI.
21:55
But there are actually some tools that are bringing AI to
21:59
the forefront for identity. I think you're seeing it with
22:05
one of our sponsors that we had on the past, the Yamans.
22:08
They have a a chat interface to administer your IGA system to be
22:15
an end user. We have a a recent sponsor on a
22:19
red block where they use AI to kind of do that last mile of
22:24
provisioning. So rather than opening a ticket,
22:27
you train the AI so that it can go out and automate that
22:31
provisioning stuff. What excites you when you look
22:36
at that this landscape of how AI is being baked into identity
22:41
products? And one more comment that I'll
22:42
make is that I feel like a year ago it was like, oh, it can AI
22:48
can make these suggestions about whether to approve access or how
22:52
much access a person could get. And I was never excited by that.
22:56
But when I you know those two examples they just laid out like
22:59
that shows me technology that just wasn't available in your
23:04
fast. Yeah.
23:06
So I think many of the early sort of AI for identity type of
23:12
solutions were not overly innovative.
23:17
So my, my favorite example was whatever Rd. proposals and stuff
23:23
like that. So everything around, I would
23:25
say Rd. mining, hey, we did it with Excel 2 decades ago.
23:29
So that's what was going to really, really the, the thing
23:31
which, which which delivered an large added value.
23:37
So, so I think we start to see new things like, like, like all
23:41
the, the augmentation or building, building connectors,
23:45
which can be, can be massively simplified by, by AI, different
23:53
types of you access of, you know, So when I go back a couple
23:57
of years, I think I'm still, for many organizations, it's still
23:59
one of these tells us that when the auditors ask for certain
24:03
information that it takes them a lot long and it takes a lot of
24:07
work to compile all that information.
24:09
AI can do that much faster, put together data from different
24:14
sources, deliver the results, respond to, to certain
24:17
questions. And I think that that's
24:18
something where we see, see a benefit.
24:20
I think we also see a lot of things.
24:22
So I'm, I'm, for instance, not a big believer in all these bots
24:26
that then pop up. And so a bit like, like a lot of
24:31
the box. So you know, you're opening
24:33
whatever your, your, your user interface and then the, the, it
24:39
pops up and says, Hey, can I help you?
24:41
And you shut it down and then you click on the next link and
24:46
it comes back and says, Hey, can I help you?
24:48
Ideally placed very centrally so that you don't see what you
24:51
really are interested in. So I think we need to we are
24:54
just scratching different surface in many areas.
24:57
So I would envision that that AAI understands when I need
25:02
help. So what when I'm stuck when,
25:05
when the way I'm using a tool is changing because I'm obviously
25:08
searching for whatever menu, I'm obviously searching for
25:12
something. I am slower than I'm usually
25:15
then then AI may may understand, OK, this is Martin's stock.
25:20
This is he's stuck in that area. And then it might might start
25:24
delivering me valuable hints in the context of what I'm
25:28
currently doing. Sounds a little bit weird and
25:32
and a bit of has too much supervision.
25:36
But you know, when, when, when I look at the, the my, my car,
25:43
that that car can would probably, I never tested it, at
25:48
least it, it's ass. It would do an immerge stop if I
25:52
fall, if, if I fall, fall to sleep and don't sort of don't
25:58
react. So, so that car is constantly
26:01
watching me. So we, we have it in, in our
26:04
everyday life. Why should we do it in software?
26:07
And it's probably beyond, beyond identity, but it also relates
26:10
to, to the sort of the UX improvements we see overall.
26:14
I think we see some, some really interesting stuff here, which
26:17
which is helpful. As I've said, application
26:21
onboarding, one of these huge challenges we, we are seeing
26:26
that's where AI can be super, super helpful.
26:31
I think also AI can help us a lot in, you know, one of the
26:35
things I've said to a couple of vendors when they came up with
26:37
their first, oh, we have this AI thing and it helps you
26:41
understanding which entitlements you have and where you're
26:44
whatever over entitlements are, etcetera.
26:47
And I said, you know, AIAI lives from data.
26:51
So why, why don't you look at all the usage data and use it
26:56
for instance, to tell me which 90% of the entitlements the
27:00
users have are never used. That would be a real benefit
27:05
because then you can reduce the the the number of of or can
27:12
passively you reduce your level of over entitlements very
27:16
quickly. That would be a huge benefit
27:19
from a, from a security and governance perspective and maybe
27:22
even understand when someone will need certain entitlements
27:28
that could be more sort of time or sort of based on other
27:34
triggers like whatever the finance department needs certain
27:39
specific entitlements during the around the end of the fiscal
27:44
year because they do certain things they only do once a year.
27:49
Same holds true when you're in factory and for, for, for the
27:54
machines, the, the suppliers come in and do all the software
27:58
updates etcetera. During the, the whatever two or
28:00
three-week summer break. Then you have a defined period
28:04
where things happen or maintenance periods in, in, in
28:08
a, in a, in a data centre, all that stuff.
28:10
They are well defined. But it also could be that again,
28:15
clearly a bit scary, but maybe AI understands what will be the
28:20
next thing you will do because you did it always the same way.
28:23
It's, it's a bit, a bit again, going back to my car.
28:26
My car predicts what would be probably my, my next target for.
28:35
So for the, for the GPS, it predicts, OK, you're probably
28:39
will go there next because it knows where I'm driving.
28:43
So I whatever at certain times in the week I attempt to, to
28:47
pick up my daughter or bring her back to her to her flat.
28:51
And that it knows, OK, most likely Martin will drive there.
28:54
And when he's there, he most likely will drive back to his
28:57
home. So the same we can do in IT.
28:59
Also, we have probably way, way more indicators because we have
29:03
our outlook or other calendar and all that information we
29:06
could use. And then we could provide access
29:10
just in time. We, we just do it sort of the,
29:13
the millisecond ahead of of when it's needed and we remove it
29:21
when the action is done. That could be a playing field
29:25
for AI. Yeah, I agree.
29:29
That's where AI where you give tremendous value, it's because I
29:35
think the zero standing privileges seems unachievable
29:41
without something like AI that can scale.
29:44
I think for me, where AI really revolutionizes identities when
29:51
they can make decisions for people.
29:54
So we've spent the last 10 years complaining about access reviews
29:58
and we give the people too much to review it.
30:02
And then it's like, how do we get away from rubber stamping?
30:04
And and a lot of it was like, OK, let's just send them the
30:08
priority stuff. So that delegated out, let's do
30:12
all these things, but. But I have this.
30:14
Letting AI decide AAI, we don't have a good idea.
30:18
We don't need AI for getting rid of accessory recertifications.
30:23
We, we can do it much simpler. You know, the, the easiest way
30:26
is that we, we trust say, OK, you have time limited access.
30:31
So if you're in the well for recertification, 6 is 6 months
30:35
only give access for up to six months and you're done with
30:40
their own little recertification stuff.
30:42
You probably will give give much less entitlement.
30:49
So a lot of things would be solved, but that's, that's again
30:52
a different theme. So, so I say, but but yes, AI
30:58
can help us to, to fix some of the problems.
31:00
But we also should be like like this recertification, we also
31:03
should be careful of do we cure the symptoms or do we address
31:11
the cause. And you know for roles for
31:14
recertification etcetera, cure the symptoms might be helpful.
31:18
But I think the industry would be also well advised to look at
31:22
what is the cause of the problem and how do we really address it
31:27
at that level. Yeah, and I use the example of
31:32
recertification. The other example I was going to
31:34
use was authentications, you know, having AI play a greater
31:39
role in identifying the person on the way and making the
31:44
decision that it is the person or it's not the person.
31:49
I think ultimately it needs to trace back that if needed, you
31:54
can see what the decision was based on what were the what was
31:58
the basis for alliance, you know, approving someone to have
32:02
access or giving or authenticating an account, an
32:06
account or making that access review decision if it's say a
32:11
compliance driven process and you just can't get around doing
32:16
it for now. But I do think AI is going to
32:19
have to provide the paper trail. But you know, overall as I think
32:25
about AI for identity, I think it's going to continue to be
32:31
important. I think it's like you mentioned
32:33
kind of within that framework of non human identities.
32:37
There's this whole space now of software solutions focusing on
32:43
non human. There is, it's just a number of
32:47
spaces or what should I call it, like sub sectors within identity
32:53
that keeps popping up. And it's like new acronyms like
32:57
IVIP, which is I'm not discounting the importance or
33:03
how cool these different technologies are, but as a
33:06
practitioner, like how am I supposed to keep track of all
33:09
this? IVIP, non human identity, Kim,
33:14
ISPMITDR, you name it. How do we as practitioners
33:22
identify which of these is going to be ones that we need to pay
33:27
attention to that we need to invest in?
33:29
Or what are the ones that we should wait a little bit because
33:34
we, we still have the disciplines like IGA access
33:38
management or privilege access management.
33:41
But eventually organizations get to the point where it's like,
33:44
OK, we're, we're, we're solid with those things.
33:47
We, we've gotten them too much to the point where it's like,
33:50
yes, we do enhancements. Yes, we do add, change, remove
33:55
as needed, but we're ready to take that next level.
34:00
And you know, how do, where do people invest?
34:04
What is the? Yeah, What's your framework?
34:07
Yeah. So, so, so the framework we are
34:09
propagating for for many years is the identity fabric.
34:12
I think we came up with this some 7-8 years ago at least.
34:18
And and it's increasingly popular also right now used by a
34:22
lot of auto parties, a lot of vendors, some other analyst
34:25
firms, etcetera. And I think the identity fabric
34:28
is very helpful for, for that, because with the identity fabric
34:33
approach, you, you can think about, you have a sort of a
34:37
capability based approach. So you don't start with the
34:40
tool, you start with the capability.
34:43
So which are the capabilities you you need for certain use
34:46
cases? And then you can look at sort of
34:50
do I do you already have these capabilities?
34:54
You can prioritise capabilities and then you can think about
34:58
which are the services where I put together certain
35:02
capabilities and then you can think about the tools that
35:06
factually delivered that service.
35:09
And I think we we need to be very careful with this.
35:14
We have a problem, we need a tool.
35:17
It doesn't make that much sense. I think what we should do is
35:20
think about what are the capabilities that will be added
35:25
by sort of new technologies that already helps us to understand.
35:32
I would say for with a little bit of of good human sense,
35:35
whether this is a something which is likely to exist as a
35:42
separate tool category over the next years and maybe decades, or
35:48
whether it's something which most likely will converge into
35:52
other categories, always other evolutions.
35:56
So, so I take Keem and, and what we call nowadays non human
36:00
identity management. A lot of those Keem in some
36:04
sense is non human access and the other is non human identity.
36:09
And I think there's a logic that things like that converge to to
36:12
an extent see how some convergence to to Pam and other
36:16
things. I think for I whip, honestly, I
36:19
whip for me is, is, is a bit of a added capability to access
36:24
governance and, and I think the first question is you should ask
36:29
yourself that goes beyond the capabilities is why do I need
36:35
it? So, so you may say I need it,
36:37
but the question why is much more interesting when we look at
36:40
iweb because you don't have sufficient insight into your
36:43
into your entitlements. In a perfect world of access
36:48
governance and IGA, you would have that information.
36:52
So it probably also means that you have challenges in your IGA
36:57
program and you need to think about, do I need Iowa
37:02
temporarily to overcome some of these things to be able to to
37:07
have some insights? Or is it that that maybe this is
37:11
sort of my next evolutionary step where I wait for my IGA
37:14
vendor to edit because there are some edit functions I have.
37:18
Or is it that I better go back to my IGA program and think how
37:22
I fixed the cost to to really have all the publications on on
37:27
board, etcetera. So what can I do here?
37:30
Because I would be at the end of the day, sort of deliver
37:34
something you should have with a, it's a good IGA program.
37:39
A lot of what I've promises to deliver should be there already.
37:43
And so I think the capability based approach helps you.
37:46
And then you also, if you take this broader perspective, as in
37:49
the fabric, you also have, have a better understanding of these
37:52
are the different bits and pieces that that may be lacking.
37:57
And you can prioritize it because no organization can
38:00
handle to, to, to do all these projects in peril to add more
38:05
and more tools. And I don't want identity to, to
38:08
end up in the state of today's cybersecurity where most
38:11
organisations have far too many cybersecurity tools and still
38:15
far too many gaps. So without a, a concept behind,
38:20
we will end up in a similar scenario.
38:24
And and then also, I think it makes a lot of sense to to be to
38:28
look at one of one of this is marketing or analyst type.
38:32
Oh, clearly it's cool for an analyst to bring up a new
38:36
category of tools that the analyst hasn't wended, but is it
38:41
really helpful to the end users? Probably not.
38:46
But you've bundled something there about having too many
38:49
cyber security tools. And let me just speak from my
38:53
experience. So I've been in IT identity for
38:58
over 20 years, 20 / 25 years. I don't want to date myself too
39:02
much, but all in the United States.
39:06
And so I remember working on projects called vendor
39:09
rationalization, right. So you, you take all the IT
39:12
products that you're using across the enterprise and you
39:15
look for, hey, we have 7 customer relationship management
39:20
systems and we only need one. So let's just pick one.
39:25
And even these others might be better in something.
39:28
We're just going, if this one does something, we're just going
39:33
to do that. So that's, I feel like that's
39:36
AUS approach, which is minimizing vendors or one throat
39:41
to choke or however you want to term term it.
39:45
Whereas what you've been talking about is identity fabric, which
39:49
I love that concept. I love the idea that you can
39:52
take some kind of technology that is maybe more innovative,
39:58
bring it into the environment, it becomes part of the
40:00
environment and you can connect it into the central services,
40:06
potentially leveraging it. Yeah, but it's not.
40:09
Contributory dancing or is that? No, I think, I don't think so.
40:12
I, I think, I also don't think that it's contradictory to when
40:17
rationalist rationalization, because when you look at the
40:20
capabilities and, and you map, map it down to the tools you may
40:24
already have in place. So that the first thing is you,
40:29
you may, when you, when you look for a capability and say, OK,
40:33
there's something new. You, you, you may understand
40:36
this February concept. This capability is already
40:38
available in some form. It might be not the perfect
40:42
implementation, but you may have it.
40:44
And then you already have something where you say, OK,
40:47
then I can use that capability. The other thing is if you feel
40:50
and start analysing it, you see that that same capability is
40:54
delivered by multiple solutions. Then you can use exactly this
40:58
approach to start your rationalization and think about
41:03
does it make sense to to reduce it.
41:05
I think this is always a balance that sometimes the the cost of
41:08
rationalization is higher than the benefit of rationalization.
41:12
Again, something to to think about carefully, but it also
41:15
helps you to understand where, where, where is the potential
41:18
for rationalization. When you look at your existing
41:21
infrastructure, What do you already have?
41:23
Which capabilities do you have? Can I not use these same
41:27
capabilities for the other use case, be it from the same
41:32
instance or a different instance of the same tool?
41:35
But the fabric, I think fits very well to that because it
41:39
needs are it gives you the flexibility that the part is.
41:43
I think that the main thing is really this understanding of, I
41:46
take a broader perspective and this is nothing which takes you
41:50
months or years. You can't do this very, very
41:52
fast. And then you can understand what
41:56
is, where's my redundancy, redundancy or where are my
42:02
redundancies? Where are my gaps?
42:05
Are these gaps of relevance or not?
42:08
You know, you don't need everything in that in identity
42:11
management, you and, and the other element is this what we
42:15
frequently commonly uses our reference architecture, which
42:17
lists the different building blocks and bringing these things
42:21
together helps you to understand, OK, this, this is
42:25
these are all the elements that you made and end up saying, OK,
42:28
I have all the elements in in there.
42:29
So if you have a consumer identity management if and an
42:32
employee or workforce identity management, you basically have
42:36
all elements for partner identity management already
42:41
available. So you can ask yourself the
42:43
question, does it make sense to add another solution?
42:45
Is it maybe even that that my access management piece can
42:48
serve those customers and employees?
42:51
But the the B to B part always would be sometimes closer to the
42:56
consumer, sometimes closer to the to the workforce, but you
42:59
would have everything as a capability already there.
43:03
And then you can think about, does it make sense?
43:06
Is there a benefit in adding another tool if you have certain
43:11
elements of visibility, Is there a benefit of adding another
43:15
tool? Or is it maybe even that you
43:19
say, I can't rationalize because I have already too many
43:22
overlaps. And the, the point, the identity
43:25
fabric really the, the, the starting point was especially
43:29
exactly in these these days where beyond workforce identity,
43:34
we saw consumer identity emerging and then we saw the B2B
43:37
stuff. And my thinking was, hey, it
43:40
doesn't make sense to have a ton of identity silos over time.
43:46
And this is exactly this rationalisation thing which was
43:49
therefore I would say from the very beginning in the thinking
43:51
of the of the identity fabric all.
43:56
Right. I, I think with the, the fabric
43:59
too, you can have the coexistence of multiple
44:03
generations of technology and not feel like, hey, every time
44:08
you want to add some new capabilities like ripping off
44:11
the Band-Aid and starting with a full migration project, that was
44:17
always one of the benefits that I saw in the fabric.
44:21
I just wanted to ask you like on those spaces that we talked
44:25
about, are there any of that you feel like people need to be
44:28
playing really close attention to like IVIP, which is identity
44:33
visibility and Pelagist platforms?
44:37
So we had a sponsor on recently Nexus, who's in that space
44:43
ITDRISPM. We have we've had Silver Ford in
44:48
the on the past. There's feel like compelling
44:51
solutions. Are there any that kind of jump
44:55
off? And I'm not talking about like
44:56
vendors, but are any of these spaces ones that you feel like
45:02
organizations ought to be taking a close look at now?
45:05
Yeah, I think that the most important area clearly is
45:10
everything around is workloaded entities and AI identity or a
45:16
identity as I then to call it. So this is the section of AI and
45:19
identity. I think this is this is the the
45:23
the most relevant field of all of these.
45:28
And that that automatically brings in a certain level of
45:31
ITDR for instance. So you can handle that the, this
45:35
huge amount of of sort of new, new or naturally new identity
45:40
types without a certain degree of automation and detection
45:45
response. So, so you need these
45:48
capabilities there. But I, I think from, from, from
45:53
the risk and, and complexity perspective, I probably would,
45:56
would put my focus on these. And I, I would say, you know,
46:01
when you look at the EDI we've enters, most of them are in a,
46:05
in a sense or many of them have a have their roots in the access
46:08
governance space. So it's an innovation, I would
46:11
say, plus a new password mainly in an existing space where it's
46:15
about continuous improvement. And yes, there might be a need
46:18
for these capabilities. The same I think holds true for
46:22
ITDR also with the relationship clearly to XDR.
46:26
The, the, the biggest really new challenge, untackled challenge
46:31
in that sense clearly from my perspective is workload
46:34
identities and JDKI identities. And if you have anything in
46:40
hardware that has identities like industrial, IoT and
46:45
traditional OT, this is also a huge field where things can go
46:49
horribly wrong. So you should you should put
46:51
your focus on that. Yeah, for sure.
46:55
So all these topics that we talked about today are ones that
46:59
are going to get a lot of attention at the EIC, which is
47:03
coming up in May in Berlin, Germany.
47:06
I'll be there. Jeff will be there.
47:09
Martin, tell us a little bit about what to expect.
47:12
Is there going to be anything different in this year's EIC
47:16
than in years past? So, so I think EIC the, the,
47:21
the, the concepts will remain the same.
47:25
So we have a lot of tracks, keynotes on the first afternoon,
47:29
workshops on the 1st morning, the morning keynotes, evening
47:32
keynotes, a lot of interaction. I think a lot of conversations
47:37
as usual on the floor where people meet and discuss and
47:42
exchange. And we also will have what I
47:45
know again, our food trucks outside and so for the breaks,
47:51
all that stuff. Topic wise, I think we've
47:54
touched several of these topics. A identity will be very
47:58
important. Regular identities will be very
48:02
important. I think also other, other
48:06
evolutions will be important. The identity fabric will play an
48:09
important role. We will again look at the
48:12
decentralized identity stuff where a lot of things are going
48:15
on. So the EUDI wallet is sort of
48:18
coming closer. We have the Apple Wallet and the
48:21
Apple ID stuff and and other initiatives and, and it's
48:25
clearly about and also understanding how does display
48:28
into does display into the broader identity field.
48:32
We will look at some some of the other kind of more consumer
48:34
identity related topics like like content.
48:37
So we are preparing, I believe, a very, very interesting keynote
48:41
section around that with some, some really, really smart people
48:46
discussing about what could be the future of concert because no
48:49
one likes the cookie concert stuff.
48:52
So it's, it's really annoying. So we need to figure out better
48:55
ways to do that. And, and so, so I think that
49:01
will be also be a scene. Might we probably also have a
49:03
look because in this EIC term, there's also this cloud element.
49:07
I think the, the sovereign cloud discussion clearly is something
49:10
which is important especially for European conference.
49:14
But when you look at trust, I think today's announcement of
49:17
AWS for sovereign clouds where they will spend billions again,
49:22
it means it's relevant for everyone.
49:25
And so, so we will see I think have a very broad set of themes
49:31
again, we will discuss we, we will be again fully hybrid.
49:37
So sessions will be available on site app, but also you can join
49:42
virtually, which I think a lot of people really, really
49:47
appreciate sometimes because they would ever have to break
49:51
to, to do a call sometimes in the morning at the hotel and
49:53
then watch some sessions remotely while they then move to
49:57
the when you later on. All that stuff will be the same
50:00
food hopefully also will be as good as at all the other
50:04
conferences we we were running. Hopefully the weather is good.
50:11
I mean, so my experience from attending last year was the
50:16
keynotes were fantastic. I mean your keynote, I'm not
50:20
just saying that because you're here, but your keynote was
50:24
really good on their dandy fabric.
50:26
It really got me, I think again as like I think I have kind of a
50:33
American centric view sometimes, right?
50:36
And you know, maybe with the way we talked about it today, I'm,
50:40
I'm softening on that and I feel like maybe it's not so much an
50:44
American centric view in terms of product or, you know, picking
50:51
a, picking a solution versus being comfortable with multiple
50:57
solutions in the enterprise. So the vendor rationalization
51:00
piece, regardless the the I, I felt like that really got the
51:05
wheels turning. A lot of the sessions as well.
51:08
You had a lot of people from the ID Pro community come from the
51:12
United States as well as from within Europe attending.
51:17
There was an identity beer in Berlin that kicked it off.
51:22
I'm going to be in Italy the following week and we're going
51:26
to set up an identity beer. Andrea Rossi and Marco are going
51:31
to, you know, work with me or I'm going to probably do the
51:35
very minimal versus them and getting that identity or set up
51:39
in Rome. It'll be the first one.
51:42
So look for that on on LinkedIn. If we're not connected on
51:45
LinkedIn, please let's connect. And I'm sure Martin's the same
51:49
way, but also the the after hours events and things like
51:54
that. It's just one of the one of my
51:57
favorite conferences of all time.
52:00
Thank you. Yeah, absolutely.
52:02
And I also want to give a shout out to Marina from your team.
52:07
She was working on the back end, making sure that we get podcasts
52:11
and we had a good set up and we had discount code, which is very
52:15
important to our listeners. So definitely shout out to
52:19
Marina doing a great job and look forward to working on this
52:24
year's event with her. OK, yeah.
52:27
Looking forward to meet you again in Berlin and me.
52:31
Absolutely and really appreciate you taking the time.
52:35
Thank you for doing this, Martin.
52:37
Any final words for for our audience before we depart?
52:44
You know, I think that the most important thing I believe is we,
52:47
we should as an industry, and I think in many organizations
52:51
sometimes just take a little time step back and think about
52:55
are we curing symptoms or are we fixing the cause?
53:01
And I think that that would be really helpful.
53:04
So is this something we just do as an interim solution or is
53:08
this really the, the, the, the sort of the longer term
53:15
solution? And, and also also always think
53:18
about do we need this added capabilities?
53:21
What is the first thing we need? Where do we spend our time and
53:24
resources? And yeah, being a bit conscious
53:29
about so so not blindly follow every new bathroom.
53:35
I think that helps a lot. Good advice.
53:39
Thank you, Martin. I'm going to wrap up the show
53:41
everyone, so you can find us on the web at idcpodcast.com.
53:46
There's the listen function. If you go into listen function,
53:49
you can search all of our past episodes.
53:51
So if there's a topic that you're interested in or a
53:55
particular person within the industry that may or may not
53:59
have been on the show, you search for their name, you
54:01
search for Martin, you're going to find a lot of episodes.
54:05
He's been on the show quite a number of times.
54:07
We certainly appreciate that. We're also on YouTube, so you
54:12
can go to idacpodcast.tv, takes you right to our YouTube page.
54:17
And of course, we're on every podcasting platform.
54:21
So if you're on Apple Podcast or Spotify, I think we're getting
54:26
to the point where you type that identity.
54:28
We're going to be the first or the second option, but it
54:32
obviously if you search for identity at the center, you're
54:34
going to find us. If you have a moment and you
54:37
feel like we've earned it, please give us a five star
54:40
rating and leave a review for the show if you've got the time.
54:43
We always appreciate those, and Jeff and I and Martin are all on
54:48
LinkedIn. We'd love to hear from you.
54:51
Any comments you have about anything that was discussed
54:53
today, Please, you know, good, bad, or indifferent, send them
54:57
our way. Again, thank you, everyone, and
55:01
we'll see you on the next one. You've been listening to
55:06
Identity at the Center. We hope you've enjoyed the show.
55:10
Make sure to like, rate and review, and we'll be back soon.
55:15
But in the meantime, hit the website at
55:17
identity@thecenter.com. See you next time on Identity at
55:23
the Center.