Latest / Identity at the Center / #353 - Sponsor Spotlight - Duo

Transcript

#353 - Sponsor Spotlight - Duo · Identity at the Center

0:00
60% of attacks have identity as a key component, meaning that
0:04
without the identity piece, the attack would have never
0:06
happened. And probably 80 to 90% involve
0:09
identity in some way or another. And so like this identity crisis
0:13
has been going on for several years, and it's just getting
0:17
worse and worse and worse. And unfortunately, for whatever
0:21
reason, our customers and identity practitioners out there
0:25
haven't found an easy button to fix it.
0:28
And and that's where we stand today in this identity crisis
0:31
that we live in. I think you just summarized
0:33
perfectly this whole identity security space and why it exists
0:37
and why it's so important. You've talked about security
0:42
first, IAM, and I want to know from your perspective, what does
0:47
this, what does that mean? Yeah.
0:50
So security first, IAM. And if you missed it, last week
0:54
we announced Duo identity access Management and Social Security
0:58
First IAM is really the reason why we did it.
1:01
We felt that most of the IAM or identity players out there in
1:05
the market were more focused on like helping people get to work
1:08
and get access to the things they need and single sign on or
1:10
reducing friction, which is all really good useful stuff.
1:14
But security has always been sort of an afterthought in add
1:18
on on the back burner to honest the Duo security first IAM is
1:23
really about making security the default secure by default,
1:27
making so that you can start from day zero with no passwords,
1:30
make it really easy to go password list and doing that all
1:33
within kind of the cost envelope with the base tier.
1:36
So that's what we mean by security first.
1:38
I am is like we're making that security set of capabilities
1:42
part of the basic functionality. OK, and So what do you say to
1:47
the pessimist who says, oh, another identity solution?
1:51
We have a bunch of identity solutions.
1:53
What's going to be different here?
2:00
This is identity at the center if it has anything to do with
2:07
IAM. This is the go to podcast now
2:12
your hosts Jim McDonald and Jeff Steadman.
2:20
Welcome to the Identity of the Center podcast.
2:22
I'm Jeff, and that's Jim. Hey, Jim.
2:24
Hey, Jeff, how are you? Oh, not so bad yourself.
2:27
Doing great man. I'm glad to be back in the Home
2:29
Office and excited for this episode.
2:32
Yeah, this is a good one. We got a sponsored episode today
2:35
brought to us by our friends over at Duo and you can find
2:37
more about them at duo.com. We're going to welcome back a
2:40
guest here in a second. But just to make it very crystal
2:42
clear, right, they've sponsored this entire episode.
2:44
So we do these from time to time in collaboration with our
2:47
sponsors to to help apprise the industry of some of the things
2:50
that they should be thinking about from AI.
2:52
Guess you should say people in the industry about what they
2:53
should be thinking about from an identity standpoint, security
2:56
standpoint and some of the capabilities that are out there
2:59
that people might want to take a look at by a trip over my own
3:02
tongue right now. So let me go ahead and get right
3:04
into it. Let's introduce Matt Caulfield.
3:05
He's the VPO duo and identity at Cisco, all things identity.
3:09
Welcome back to the show, Matt all.
3:12
Right. Thank you, Jess and Jim.
3:13
Good to see you guys again. Happy to be back.
3:16
Yeah, it's been a little while. So I think the last time you
3:18
were on was episode #247 we talked, I, I, I called the
3:22
episode big areas of identity to solve, right?
3:24
It was very thought provoking. I would encourage people to go
3:26
back and listen to that because I'm not going to make you say
3:28
how did you get into identity? You've already answered that
3:31
you're a pro's pro for us. But it's been about a year and a
3:34
half since then. So what have you been up to over
3:36
that last year and a half? Yeah, what's new?
3:40
A lot. I came back to Cisco about two
3:44
years ago with the ORT acquisition.
3:45
And then recently about a year ago, I started as the head of
3:49
product for, for Duo, which I think a lot of people, a lot of
3:53
the listeners here in identity understand that Duo has a
3:56
storied past in identity and authentication and, and they
4:00
know the Duo brand really well. And so I, I've been really happy
4:03
to work with that team in particular.
4:04
The Duo team is known in Cisco for its culture, for its ability
4:08
to ship product, for its ability to be kind of market leading,
4:11
focused on users. And so like, it's just been a
4:13
real blessing to take over the leadership of the product team
4:17
for Duo and help craft what we've been doing over the past
4:20
year, which I'm also very excited to talk about.
4:22
Yeah, I'm real excited to talk about it, Matt.
4:24
And I was going to quote something that I've heard you
4:28
say, which is that we have an identity crisis in this space.
4:33
And you know, when you hear identity crisis, obviously it
4:35
has, you know, there's, there's other meetings outside of
4:39
digital identity. So I'm assuming you mean a
4:41
digital identity crisis. And I'm wondering what is it
4:44
that's contributing to this crisis?
4:46
What? Why is that a major theme?
4:49
Yeah. No, your assumption is right
4:51
that it is a digital identity crisis and not so much like a
4:53
personal like existential identity crisis, although some
4:57
of us have those digital identity crisis.
5:00
You know, it's really a couple of things.
5:02
One piece is the rise in identity based attacks.
5:05
And I feel like we've been talking about this for years,
5:07
but it's still happening. So we're still talking about it.
5:10
Fortunately now at Cisco, I get access to all this like really
5:14
cool data. So we have this whole team
5:16
called Cisco Talos and they go out and they study these things.
5:19
They they deal with things like instant response and looking at
5:21
threats out in the wild. And one thing that they've
5:24
picked up on is that now it's not 60% of attacks involve
5:28
identity, 60% of attacks have identity as a key component,
5:33
meaning that without the identity piece, the attack would
5:35
have never happened. And probably 80 to 90% involve
5:38
identity in some way or another. And so like this identity crisis
5:43
has been going on for several years and it's just getting
5:46
worse and worse and worse. And unfortunately, for whatever
5:50
reason, our customers and identity practitioners out there
5:54
haven't found an easy button to fix it.
5:57
And and that's where we stand today in this identity crisis
6:00
that we live in. I think you just summarized
6:03
perfectly this whole identity security space and why it exists
6:07
and why it's so important. You've talked about security
6:11
first, IAM, and I want to know from your perspective, what does
6:16
this, what does that mean? Yeah.
6:19
So security first, IAM. And if you missed it, last week
6:24
we announced Duo identity access Management and Social Security
6:28
First IAM is really the reason why we did it.
6:30
We felt that most of the IAM or identity players out there in
6:34
the market were more focused on like helping people get to work
6:38
and get access to the things they need and single sign on or
6:40
reducing friction, which is all really good useful stuff.
6:43
But security has always been sort of an afterthought in add
6:47
on on the back burner to honest the Duo security first IAM is
6:52
really about making security the default secure by default,
6:57
making so that you can start from day zero with no passwords,
7:00
make it really easy to go password list and doing that all
7:02
within kind of the cost envelope with the base tier.
7:05
So that's what we mean by security first.
7:07
I am is like we're making that security set of capabilities
7:11
part of the basic functionality. OK, and So what do you say to
7:16
the pessimist who says, oh, another identity solution?
7:20
We have a bunch of identity solutions.
7:23
What's going to be different here?
7:25
Yeah, it's a good question. We get that a lot.
7:27
For a long time, Duo has been known as MFA and like it's kind
7:31
of built into the name like 2F AM FA.
7:34
And for the longest time Duo has been really good at that.
7:37
We have over 100,000 customers that use us for MFA.
7:40
There are lots of other identity solutions.
7:42
So you might ask and other people have asked the question
7:45
like why would Duo get into the identity space?
7:49
And a big part of it is because we saw that gap in that there
7:53
are still attacks going on, they're still being successful.
7:56
Traditional players are more focused on making single sign on
7:59
and access management work and less focused on the security
8:02
aspects to it. So we saw the need to come in
8:04
with kind of security first approach.
8:07
And the way that Duo is special is some of the end to end
8:10
fishing resistance capabilities that we brought in in addition
8:13
to the security first capabilities.
8:15
Really sets it apart from a lot of the other options that are
8:18
out there. Plus the reasons why people pick
8:20
Duo today, which is it's a solution that our customers love
8:25
because it focuses on the intersection of usability and
8:29
security for admins and for end users.
8:32
You know, I'm, I'm playing the role that Jeff normally plays,
8:35
which is like the pessimist. But you know, I've seen over
8:38
time, I've been in this space for 20 years and I was a big
8:42
customer of both Oracle and CA. And they usually don't name drop
8:46
in like any kind of negative light.
8:48
But the big tech industry has kind of a history of going deep
8:54
into acquiring different pieces of identity, of the identity
9:00
stack, putting them together and then R&D dies on the vine.
9:05
And so, you know, given that history that none of that
9:08
implicates you, but given that history, what would you say
9:13
that's not going to happen again?
9:15
Yeah, that's a good question. So Cisco makes a lot of
9:19
acquisitions. You mentioned like the number
9:21
247 episodes, Cisco's done about 250 acquisitions over its
9:27
history. So it's a lot, you know, it's
9:29
averages, you know around 10 per year over the past few years
9:33
give or take a few. Over time, those acquisitions
9:37
get brought in and made part of the bigger portfolio with Duo
9:41
and with ORT in particular. So we acquired A Duo six years
9:45
ago, still going today. We're still investing, we're
9:47
still making big launches, and we're still just as relevant as
9:51
ever in the industry, especially in the authentication market.
9:54
And then with ORT, which I was part of, I was the founder and
9:57
CEO there. And we were an identity threat
9:59
detection response company that was acquired 2 years ago.
10:01
We've now made that part of Duo and Identity Intelligence, and
10:04
we're continuing to invest in those capabilities.
10:06
And we just announced a new capability as part of Identity
10:09
Intelligence as well, which is this trust scoring mechanism
10:12
that lets you pinpoint individual users and figure out
10:15
which ones are actually compromised inside your
10:18
organization. So you could have like 10,000
10:21
users. And this will narrow it down to
10:22
like, hey, these three accounts, you need to go scrub those.
10:25
Like it's almost like a laptop. You need to go wipe that laptop
10:28
with that account and start over again because those are
10:30
definitely taking over at this point.
10:32
So anyway, just some examples of Cisco does bring in companies
10:36
and make them part of the bigger story, but at the same time
10:39
continues to invest where it's needed, especially in areas of
10:42
identity, because there's this realization that identity is a
10:46
core pillar of security. It's the foundation of zero
10:49
trust. And the whole industry has woken
10:51
up to that. Yeah, I, you know, I think one
10:54
of the one of the things that I recognize anyway is, you know,
10:59
when you talk about ORT, you guys were kind of an innovator
11:03
and a leading company. And now look, you got your as an
11:08
individual running the show there in terms of duo identity.
11:15
That's pretty telling. I mean, are you bringing with
11:18
you that culture of innovation that you had or let's talk,
11:22
let's talk about that for a minute.
11:23
It was kind of that transition you made from, you know, founder
11:28
and CEO at ORT and now you're a part of a bigger tech company.
11:33
Would you bring the innovation or was it like you brought it,
11:36
you came over and you're like, wow, this is a really innovative
11:39
company. Yeah, it's, it's a really good
11:43
question. I think you're picking up on a
11:44
pattern that does exist. And it's not just me.
11:46
Like plenty of other founders get acquired into Cisco and then
11:51
get put into bigger roles, bigger responsibility expressly
11:54
for the the value that they bring in terms of driving
11:59
urgency and bringing in new ideas and innovation.
12:02
And it's not because Cisco lacks that at all.
12:05
It just really helpful to have new fresh ideas constantly
12:08
coming in. And that's one of the ways that
12:11
bigger Cisco and now Duo has done it is kind of bringing in
12:15
talent through through acquisition.
12:17
So myself, we've had other leaders, you know, just in the
12:20
year that I was acquired, like Armor Blocks was acquired on the
12:23
e-mail side. And DJ Sampath is running a lot
12:25
of the AI strategy now for Cisco overall.
12:28
So G2 Patel, who's our chief product officer and you know,
12:32
president at Cisco now is really creating this, this culture of
12:36
we need to think like a startup, even though we're a gigantic
12:39
100,000 person company. Like we need to think like a
12:42
startup, act like a startup, and bring startup people in in order
12:45
to drive and continue to drive urgency.
12:48
Yeah, I mean, that's that's kind of the answer I was expecting
12:52
because, you know, when you talked about something like
12:54
Tallows, I started to think, wow, like, imagine having the
12:59
insights that they have and you can just sit down and have
13:03
coffee with the people that are making it happen there.
13:07
Tell us a little bit about Telus and some of that intelligence
13:10
that they're bringing to the table that's influencing.
13:15
You know, look, you guys are taking on some big bold stuff,
13:20
and it sounds like that having that intelligence was kind of at
13:23
the center of making some of these decisions.
13:27
It is so understanding what's really going on for customers on
13:32
their worst days when they're suffering from security breaches
13:35
is the type of insights that the Talos team brings to the table.
13:38
And then that that team is just for a while also came in through
13:40
acquisition. I've looked through the Source
13:42
Fire acquisition, which was one of our, you know, firewalls that
13:45
we acquired. So that continues to this day
13:47
and they've expanded from like just a focus on networking and
13:50
network intelligence and network focused response into also
13:54
things like understanding what's going on in the identity world,
13:57
just because that's such a, a big aspect of the breaches that
14:02
are occurring. It's a, it's a, it's a key
14:04
component. And that's really the, the
14:06
research that we're highlighting here.
14:07
It's not just this year or just Talos saying it.
14:10
We've, we've seen kind of corroborating evidence coming
14:12
from like Verizon, DPIR and some of the research that crowd
14:16
strike puts out. So it's, it's definitely not
14:18
just us who are into it. But yes, I kind of get an inside
14:21
track on, on getting the real details on what's happening in
14:24
these attacks and what are the, what are the vectors through
14:27
which these attackers are coming in so that we can build controls
14:31
and detections into our products, into Duo, into
14:33
identity intelligence to put a stop to that.
14:36
Yeah. And I'm wondering, you know, so
14:39
to me, the 2 interesting angles would be that piece, which is
14:44
all the other companies within Cisco or, or products, however
14:49
you want to, you know, call the structure, but then also the
14:53
customer insights that you must be getting, be able to come into
14:57
customer conversations. And I'm wondering like, what are
15:01
some of the, the challenges you're seeing?
15:03
Are you coming into clients and finding a lot of laggers?
15:07
Are you seeing some clients that are just like, you know,
15:12
innovating in ways that you're learning from?
15:15
Kind of what are you seeing in that landscape?
15:18
Yeah, customer insights are at a totally different scale at
15:22
Cisco. So Duo alone has over 100,000
15:25
customers. So much as I'd like to, I can't
15:27
talk to all of them in a single lifetime Even.
15:30
So we rely a lot on data and then select, you know, customer
15:34
interviews. We just held one of our first
15:36
duo customer advisory boards, strategic advisory boards in New
15:39
York a few weeks ago. And that was really insightful
15:42
because we got to sit down with 20 customers and really dig in a
15:46
bit more into the problems that they're having in identity and
15:49
that the common themes are things like fishing resistance.
15:53
How do I get the password list? How do I deal with like non
15:58
employee populations, like contractors, little bit of non
16:02
human identity, little bit of agentic popping up.
16:06
And we can talk, maybe say that for the end, but these are the
16:09
things that are kind of top of mind for our customers.
16:12
And, and, and going from, you know, what they have today,
16:16
which might be like a mishmash of different identity
16:18
technologies to an architecture that they feel confident in from
16:22
a security perspective. That's really what they look
16:24
into. A Cisco Duo 4 is like, OK, help
16:26
me with these specific projects like fishing resistance and like
16:30
password less. And then also help me think
16:32
bigger picture of like, how do I tie this whole identity thing
16:35
into my zero trust initiative, my zero trust architecture?
16:38
And so this was really well positioned to help with both
16:41
those things, those kind of tactical things as well as the
16:43
strategic bigger picture because we have this much broader
16:46
portfolio. Yeah, whenever we get a thought
16:48
leader like yourself on, I wanted to ask some questions
16:53
that are like maybe sound basic, but are are we solved?
16:58
You brought a pastor list. Is authentication more or less
17:01
solved and now it's just tactical getting it rolled out?
17:06
Or is there still innovation to be had I.
17:10
Think there's still innovation to be had?
17:11
So if you look at it, how do you get to like NIST AAL 3 fishing
17:16
resistance today? Usually you have to go buy a
17:20
bunch of hardware tokens. And I have no issue with the
17:22
folks who manufactured hardware tokens.
17:24
They're a good product and I use them myself.
17:26
But for organizations when they're staring down, you know,
17:29
a $50 per token priced AG and then having to provide two of
17:33
them for everybody in case they lose 1, like it's a really hard
17:37
pill to swallow for most organizations that aren't, you
17:41
know, maybe financial services, let's say.
17:45
So that in particular is an area of innovation where Duo with
17:49
recent announcements around and then fishing resistance, we've
17:52
stepped into, we've announced this thing called proximity
17:56
verification where you can get AAL 3 phishing resistant
18:00
authentication where your your phone is your key.
18:03
You've got Duo Mobile on the phone.
18:05
It's using Bluetooth Low Energy between the phone and the
18:08
device. And by virtue of them being near
18:10
each other and the fact that I've registered both devices, my
18:13
laptop and my phone, and by virtue of me doing a Face ID or
18:16
Touch ID on my device, I now have enough factors to say, OK,
18:20
this is phishing resistant. And an attacker would need to be
18:22
in the room with me kind of pulling up a chair to my desk in
18:26
order to insert themselves from the flow.
18:29
So there is innovation in authentication still.
18:32
That's good to hear because you know the it's not like the
18:34
threats stop innovating either, right?
18:35
So you kind of have to stay ahead of it as well.
18:37
Yeah. And, and we do see that the
18:39
attackers continue to innovate. But you know, we thought MFA was
18:42
the silver bullet for the longest period of time where
18:45
MFA, as long as you have MFA on your account, they're like,
18:48
you're good, you're golden. But then we have things like SIM
18:51
swapping or even more basic like push bombing, push fatigue.
18:55
And so then we move to like number matching and you know,
18:58
OTP and you know, other one time codes.
19:02
And then you have attacker in the middle where they created
19:04
proxy and put it in the middle. So it looks like your sign in
19:07
Page and you put in your 4 digit or 6 digit code and then they
19:11
steal that. And so we're constantly being
19:13
pushed further and further towards eventually getting to
19:16
where we are now with phishing resistant and hope is that this
19:20
new dual proximity verification capabilities sort of the easy
19:24
cheaper way to get to fishing resistant versus shipping
19:27
everybody their own little Harvard key.
19:29
I want to talk about the product here in a second, but I'm
19:31
curious what your thoughts are from AAI perspective and some of
19:36
the threats that we're seeing, You know, what using AI to
19:38
leverage against some of the identity security that maybe
19:41
we've built out over the decades.
19:43
You know, gone is the poorly written e-mail from the poor
19:46
Nigerian Prince. And now it is a very well
19:49
crafted, very believable, you know, text or message or
19:53
whatever it may be that AI is really empowering the the other
19:58
side, right, to be better at that.
20:01
How do you see AI impacting identity security, you know, as
20:06
it stands today? And then what it what scares you
20:07
the most when you start to think about these types of things and,
20:10
and how you're going to defend against it or help others defend
20:13
against it? Yeah, of course, I think it's
20:17
twofold, right? There's there's one piece of it,
20:19
which is like how do we think about identity for AI?
20:21
And like identic identity or identic AI is almost like a
20:27
human identity in that it's somebody that your organization
20:29
hires and you need to give an identity to them.
20:32
Let's set that aside for a second because that's probably
20:33
it's own kind of can of worms which we can get to.
20:36
The more pressing thing right now is AI has enabled attackers
20:41
to do social engineering at scale.
20:43
So they can find and literally use tools like chat, TPT and
20:48
say, hey, go find me all the profiles on LinkedIn who have
20:52
like a Microsoft certification for intra ID And they look like
20:56
they've been in the industry for a few years.
20:57
So they're probably a global admin and help me figure out
21:01
like their home phone number. So I can try to call them up and
21:03
convince them to turn over their, you know, their OTP or
21:07
convince maybe their help desk to allow me to add my phone to
21:12
their account so I can sign in as the attacker.
21:14
And then once I do that, maybe I'll set up federation with my
21:17
own IDP so I can persist in their environment and continue
21:20
to log into their apps. Like those types of social
21:23
engineering at scale and kind of doing the research part,
21:25
Intelligence part just got a lot easier because like every
21:28
individual attacker now has an army of bots, chat bots that
21:32
they can go out and say, hey, do the research for me to figure
21:36
out who I should go after and where the soft targets are and
21:38
then even help me get in the front door.
21:40
So you're kind of screening those targets.
21:41
It's almost like hiring, right? You're like using an army of
21:44
people to go find like good candidates and then screening
21:47
them, except it's an attacker going and trying to find
21:50
candidates or victims really. You know, I, I, maybe I'm one of
21:54
those people who's just like taking in all the hype.
21:58
But I heard a recent one, I think it was Open AI was hiring
22:02
1000 developers and those thousand developers will each
22:06
manage 1000 AI developers. So essentially, they're going to
22:11
have a million developers if you do the math and you believe the
22:14
height. I mean, are you guys leveraging
22:19
AI in a way that you kind of like are now able to build the
22:23
product faster, ship enhancements quicker, things
22:27
like that? Does that resonate with you?
22:30
It does. So I think the most immediate
22:31
thing that comes to mind is that we just shipped the Duo AI
22:34
assistant. So if you you're logging into
22:37
the Duo admin console, there's an AI assistant there that you
22:40
can ask questions to. So like, hey, why, you know,
22:42
Jeff's having trouble logging into his account.
22:45
Why can't Jeff log in and the AI assistant will go and kind of
22:49
virtually click around the admin console.
22:51
It's really talking to the API, but it's figuring out like, OK,
22:54
what was Jeff's last error message?
22:56
Why did that happen? What was it a policy?
22:58
Was it some issue with the device he was coming from?
23:00
Figure out what the issue is and then kind of spit out an answer
23:03
is like, OK, Jeff couldn't log in because he was coming from an
23:06
unregistered device. You know, something like that.
23:08
Getting to those answers really quickly is a benefit that we see
23:12
AI providing to do admin so that it can answer questions about
23:16
how to set up the product or how to troubleshoot really easily
23:19
and kind of write it there right at their fingertips.
23:22
And then internally, we're also using AI for a whole slew of
23:26
things. I think everybody is content's a
23:28
good example. It makes it easier to write
23:30
documentation for the product. It makes it easier to do a
23:33
little bit of like market research.
23:35
And then of course on the actual software engineering side, Cisco
23:39
software engineering practice has kind of fully embraced AI
23:42
and is trying to leverage it as much as possible to maximize and
23:45
it's it's efficacy for for speeding up the software
23:48
development process. That's such a super cool use of
23:52
AII love being able to like say, OK, let me log in as an admin
23:55
and say, OK, well, why doesn't Jeff work right rather than
23:58
hunting around and pecking through?
24:00
Now that might be a more existential question, but let's
24:02
just focus on me not being able to authenticate, you know, for
24:04
that scenario. So talk to me a little bit
24:06
about, I guess Duo from a product perspective And you
24:10
know, is, is Duo shifting kind of the mindset here?
24:13
It sounds like it may be to a more broader identity and access
24:15
management or is it, you know, you still focus on the
24:18
authentication space? Like where do you see Duo kind
24:21
of fitting today? Because everybody likes to be
24:23
put into a box, right? Are you authentication?
24:25
Are you IGA, are you Pam? You know what is Duo today and
24:29
where do you think it'll be, you know, in the next few years?
24:32
Yeah, I think I can answer that with it is a repositioning of of
24:36
Duo really. You know, historically, whether
24:38
we like it or not, the perception of Duo has been MFA
24:41
and that's been a blessing and a curse because Duo is MFA and MFA
24:45
is Duo. It's almost in the name.
24:46
Like I like I said earlier, this is really a repositioning and
24:52
reinvention of what Duo is to our customers.
24:56
It's not just multi factor authentication, it's not just
24:59
how you add MFA to your account. It's still that.
25:01
And like we do that really well, exceptionally well.
25:03
But this is the expansion of what Duo is into Duo identity
25:07
and access management. We're really entering that
25:09
broader IAM market and tying that to the broader Cisco
25:14
portfolio in a, in a big way, which is our, you know our
25:17
broader strength as a company. So it is a more of a revolution
25:22
than an evolution of how you think about duo.
25:24
So I've always noticed that Duo is very sticky with
25:27
organizations, which is a real testament I think to the use
25:30
case that it's been solved traditionally, right?
25:32
The MFA side, you see a lot of organizations that have an IDP
25:35
that has MFA capability, but they like Duo and they just stay
25:39
with it. I'm curious from a, a product
25:43
standpoint, given how your customers maybe have measured
25:47
success in the past around this might have been, you know,
25:49
enrollments or things like that number of MFA prompts, you know,
25:53
whatever that might be how? Do you see that shifting in the
25:56
future as part of this, you know, evolution of of the duo
25:59
sort of identity security stack? Yeah, I think that how we
26:03
measure success is an important question.
26:05
It's one that we hold our product management team too.
26:08
We have lots of individual contributor product managers and
26:12
the question for them is, OK, you want to build this feature,
26:16
what is the metric of success? And so the metric of success
26:20
for, you know, this launch that we've done and for our customers
26:24
who are starting to adopt these features, especially on the
26:26
password this front, it's almost the inverse, which is how many
26:30
authentications have we saved because we're now gone password
26:33
less. How can we make it so that each
26:35
individual on average has one or fewer authentication,
26:39
interactive authentications per day?
26:41
And so the ideal kind of dream state scenario is you walk into
26:45
your office, you put your phone down on your desk next to your
26:48
laptop or your, your desktop, whatever you're using, you log
26:51
into the operating system through this kind of proximity
26:53
verification that I described earlier.
26:56
And then you're on with your day.
26:57
You don't need to when you log into your browser or that
27:00
browser or this, the client need to go through another
27:03
interactive auth. You've already established like
27:05
Matt's in his office in front of his computer, like let's just
27:09
go. And I think that is now our
27:11
metric of success. So Cisco itself, Cisco, IT
27:14
rolled this out with Duo over the past couple years.
27:17
They get early access to all the things that we build.
27:20
And we're now at a point where the number of authentications
27:24
for employees are less than 5 per week per employee on
27:28
average. And like that is a major win for
27:31
me personally as an employee here at Cisco.
27:33
It's great. Like that user experience is
27:35
really good. Was a big, it's a big win for
27:37
for Duo and for the Cisco customer base more broadly.
27:41
I love that procs card and really what the description you
27:45
made there kind of reminds me just like continuous
27:48
authentication that can happen in the background and it's more
27:53
than just, you know, logging in and you walk away, someone pops
27:57
into your cube and does this set or the other.
28:00
You can really use the technology that you're talking
28:03
about to prevent a scenario like that.
28:05
And the reason I chimed in was I wanted to ask, is your IM
28:11
solution going to be focused on that workforce internal
28:16
population or is it going to be the customer side or both?
28:21
Yeah, it's a good question. There are plenty of good
28:23
solutions out there for the, you know, the customer side, you
28:27
know, and plenty of awesome start-ups in that space as well
28:30
that we, we talk to you frequently.
28:32
What was launched here is, is for two major use cases.
28:35
One is workforce, but then there's also extended workforce
28:38
and B to B. We have a ton of customers using
28:41
Duo for partners, contractors, vendors, third parties and how
28:47
they log in to, to, to, to, to, to solutions inside the
28:52
environment. We do have some customer IM use
28:56
cases that are more on the B to B side than the traditional Siam
29:00
stuff that you would expect. So for example, you can imagine
29:03
that if I'm building a SAS product which is more
29:06
infrastructure focused and so that I have like admins who need
29:09
to log into it. We've seen Duo embedded for
29:12
those use cases as well where you want to provide a really
29:14
easy to adopt an MFA for privileged access for certain
29:19
types of infrastructure. Often times we'll see Duo used
29:23
for access like network devices because you know, Cisco is like,
29:26
hey, I need the SSH into that router or that switch over there
29:30
to change the the configuration on and you know, update the
29:33
routing table, whatever. I will often put Duo in line for
29:37
those types of use cases as well.
29:38
So yeah, really workforce, extended workforce and sprinkle
29:42
of of kind of B to B Siam as well.
29:46
I love this idea of proximity based authentication.
29:48
I think this is something that it's, it's not new.
29:51
It's been around for a little bit.
29:52
I, I can think of like Windows has had it built in for a little
29:56
while, but frankly, it hasn't really worked very well for my
29:59
from for when I've tried to use it.
30:01
Talk to me about this idea of proximity based authentication.
30:04
Is it I enroll my phone and I sit down and there is a
30:09
Bluetooth beacon and you know, whether it's in the laptop or
30:12
maybe some sort of add on or something that is picking that
30:14
up. Can I use something other than a
30:17
phone to authenticate that same way?
30:20
Like maybe a ring? I mean, I wear a smart ring or
30:22
maybe an Apple Watch or something else like that.
30:24
Yeah, it's a great question. So the the way that this
30:27
proximity verification works is yes, exactly right.
30:30
It is Bluetooth low Energy. So you do have the laptop in a
30:35
beaconing out a or broadcasting out a cryptographically signed
30:40
nonce that is specific to the user and their their phone.
30:44
And so your phone will pick up on that when it's, it senses,
30:48
hey, I'm, I'm getting this Bluetooth low energy signal.
30:51
It's this nonce. It's for me in particular.
30:53
And then it will allow you to then use the phone to prove that
30:57
it's you and, and dance between the phone and the laptop allows
31:00
you to then log into the operating system or into the
31:02
application that you're trying to access.
31:05
This is great because it, unlike other solutions that rely on
31:09
like GPS, for example, like that's not very reliable or it
31:13
relies on IP address, also not reliable.
31:15
Easily spoof both of those. You can't really spoof being in
31:19
the same kind of radio frequency distance, you know, within like
31:22
20 ish feet of of the laptop. So like that is fairly unique
31:27
compared to these other approaches for proximity that
31:29
have been tried in the past. We're relying on the physical
31:32
medium between between the two of them.
31:35
And yeah, we're not stopping here.
31:37
Like this is one of many kind of frictionless experiences that
31:41
we're providing for authentication.
31:43
But there's a whole set of other problems to solve, especially in
31:47
spaces like retail and healthcare where you want to
31:50
provide frictionless access to systems without having to take
31:53
your phone out of your pocket, for example, where we're going
31:56
to continue to innovate and then everybody else will get the
31:58
benefits of of all that you mentioned, like the, you know,
32:02
Apple Watch in particular, who has an Apple Watch, you know,
32:05
app on today, as well as an Android watch app.
32:09
And you can use those today if you want to unlock, you know, or
32:12
go through push based authentication.
32:14
I think we'll continue to see more innovation around that.
32:17
Other areas that are interesting are like NFC and trying to
32:20
figure out if we want to do something in that space or other
32:23
types of like badge based access.
32:25
So more more to come. And this all strikes me as a
32:29
really good way to get to that sort of passwordless Nirvana
32:32
that I think everybody's been trying to get to.
32:34
And, you know, you've got your phone or some sort of, you know,
32:36
possession based authentication. It strikes me as very fishing
32:40
resistance to where, you know, if it's based on especially
32:43
proximity to something, it's going to be kind of hard to like
32:47
fish if you have someone sitting there in front of you and try to
32:50
block your, you know, Bluetooth signals.
32:53
Talk to me about phishing resistance and and where does
32:55
that play in in sort of the strategy of rolling out things
32:58
like proximity based authentication or maybe other
33:00
methods that Duo was looking at too?
33:03
Yeah, so phishing resistance is really what's important here.
33:05
And we've seen, you know, phishing at every part of the
33:09
user's journey, whether it's enrollment or it's operating
33:12
system, log in, application, log in, mid session security like
33:15
session hijacking or for recovery use cases, attackers
33:19
have phished every step of the way.
33:21
So when we came out with phishing resistance, it wasn't
33:23
enough to say, hey, we've got proximity verification now.
33:26
Like we're good. There's there's more to it.
33:29
Like for enrollment, we had to go with identity verification.
33:33
And so we're partnering on the kind of government ID based
33:37
enrollment flow. So you can use your government
33:39
ID in a selfie in order to enroll into an account for same
33:43
thing is true for help desk use cases and for recovery use
33:46
cases, you use a government ID because you're now missing your
33:49
phone that you're using before you.
33:50
So you need a new kind of root of trust.
33:52
And we just went through a whole hackathon with the California
33:55
DMV to use verifiable credentials that the state
33:59
issues in order to verify. Oh, that's really you.
34:01
You have a verifiable credential from the state of California and
34:04
you can, you can prove it to me. That's a really cool way to
34:07
bootstrap into the process as well.
34:09
But once you're in it, then we can rely on these cool things
34:12
like, OK, I'm in it. I've registered my laptop, I've
34:15
registered my phone on my account.
34:17
Both of those are trusted devices with, you know, some
34:20
sort of certificate built into the TPM.
34:22
So I know cryptographically it's really that device.
34:25
I know they're near each other and I know that, you know, it's
34:27
me log into the device because I have my fingerprint or my face
34:30
ID. Those kind of four factors
34:33
really combined to make it phishing resistant because at no
34:35
point along the way there are you entering something in
34:38
whether username, a password or a code.
34:42
And at no point along the way in there is it easy to man in the
34:44
middle or attacker in the middle between any step of that flow.
34:48
And so like that's really what gets us to that fishing
34:52
resistance for application and OS login.
34:54
And then the last piece I want to mention is the mid session
34:58
security. So session hijacking.
35:01
So great. You did all this work to go and
35:03
build a kind of foolproof fishing resistant enrollment
35:05
process and application login process.
35:09
But what if the attacker is on your device and in your browser
35:13
and they just steal your your session cookie out of there like
35:15
it was all for nothing? Because the session cookie is
35:17
basically with the credential at that point, and it's easily
35:19
fishable. It can be replayed no matter
35:21
what device it's coming from. We've gotten rid of cookies with
35:25
this latest Duo announcement. We've gone to a cookieless
35:29
architecture for our session management.
35:32
So if you're logging in for Duo, you're not getting a, you're not
35:34
getting a cookie. You are setting up the kind of
35:37
cryptographic trust between your device and our back end, and
35:42
then we're relying on that for subsequent authentication.
35:44
So never is there a point in time where we're storing
35:47
something that can be replayed in your browser such that an
35:51
attacker could pull it out and put it into their own browser.
35:55
So you kind of stole my my question that I was going to
35:57
follow up with was that, you know, how do you how do you
35:59
prevent session hijacking and man in the middle attacks and
36:02
kind of things like that. So you got that.
36:03
So I'm going to pivot to something else that Jim, I think
36:06
touched on earlier was around this idea of continuous identity
36:09
or continuous authentication. It seems to me like this is
36:12
another area where something like this could be very handy
36:14
and not just the point in time login, but as long as, you know,
36:18
I think I've heard it referred to as butts in seats or, you
36:21
know, something along those lines is like as long as you are
36:23
still in that same area, you're constantly emitting signals of
36:27
some sort to say, yes, this is Jeff versus maybe, you know,
36:32
someone else who maybe has come over to that same device or
36:34
something like that. How do you feel about that sort
36:37
of idea of continuous authentication and leveraging
36:40
those signals? Yeah, it's really interesting.
36:43
There's a few things that we do on that front, especially with
36:46
posture. So for a long time Duo has had
36:49
Duo, a health agent which is now part of Duo Desktop that
36:51
provides continuous posture signals from the device to the
36:55
back end. Such as if the posture changes
36:58
or any aspects of what the user's trying to do changes, we
37:02
can kill that session and force a reauthentication.
37:04
Same thing is true with risk based authentication.
37:06
At the time of authentication, we're able to see, OK, here are
37:09
these IP address, the Geo information, the device
37:13
information. And so we can say for each
37:15
authentication for any application like, all right,
37:17
something's different here. Let's step up authentication or
37:20
block entirely if it looks a little bit weird.
37:23
So that's a piece. Risk based authentication is
37:25
part of this. The posture based authentication
37:29
is part of this. Identity intelligence is where
37:32
we not just don't just get signals from Duo.
37:35
Duo signals are great. See a lot of information, but
37:38
identity Intelligence is able to pull information from your other
37:42
identity priors from ACTA, from ENTRA, from you can pull data
37:47
from your HR system, you can pull data from specific
37:50
applications to really form a user 360 profile.
37:54
And so we might get a much stronger signal on like a user
37:57
trust score, so that if that score changes over time, we know
38:00
that the reputation of that user's account isn't as
38:03
trustworthy as it used to be. So that's important.
38:05
And then to kind of pull all this together, we've invested a
38:08
ton into shared signals. So SSF on the shared signals
38:12
framework and, and, and the Cape standard.
38:15
We've been working with quite a few other companies in these
38:20
Gartner IAM interops that they've been holding in order to
38:24
understand, hey, does, does our solution work with your
38:27
solution? So we work with like signal with
38:29
App Omni. And we've shown like, yeah,
38:31
there's real interoperability here when we all implement
38:34
shared signals. And so even if Duo can't detect
38:36
something today on its own through shared signals, we can
38:40
get signals from other providers that say, hey, it looks like,
38:42
you know, something's fishy here.
38:43
Something's a little bit unusual.
38:45
Maybe you should log the user out of their session or or have
38:48
them re authenticate. We don't have to just solve, you
38:52
know, the whole problem on our own.
38:53
We can work with industry partners to build up a pretty
38:58
robust solution that can find these kind of behavioral
39:01
differences in terms of what users are doing.
39:04
That really pulls it all together from an identity
39:07
security perspective. It's interesting.
39:11
As you're talking and I was off camera, I was thinking, man,
39:14
this sounds a lot like the Sassy framework, especially with the
39:18
continuous authentication piece. So I went out.
39:22
I googled to try to, you know, see if I can find a good concise
39:26
summary. The 1st result that came back
39:29
was from Cisco. So there you go.
39:33
I guess her marketing team is doing a good job.
39:36
Yeah. So Sassy secure access Service
39:38
Edge, A big part of that is identity.
39:40
But what most companies don't provide is the identity piece.
39:44
A lot of the sassy vendors out there, they're just doing
39:46
networking for you. It's like, hey, get my packets
39:48
from point A to point B. Not realizing, like the
39:52
foundation of zero trust is identity.
39:55
So Cisco is literally the only solution in the industry that
39:59
has an integrated identity stack now with our Sassy solution.
40:02
So you can take all that from Cisco and integrate super
40:05
tightly and you get end to end of Sassy with Identity.
40:10
So you establish trust using identity and then parlay that
40:15
into the network so you can then get access to just the resources
40:18
that that user or that IoT device or you know that.
40:23
Agents running in the cloud need access to that can all go
40:27
through Sassy backed by Identity.
40:29
Well, you heard it here first. You know, the, the thing I was
40:33
talking about earlier, Matt was kind of, you know, this whole
40:36
innovation piece R&D and you brought up something about
40:40
shared signals framework. And I was like, man, to me,
40:45
that's like where things are heading.
40:47
And you must kind of see it the same way to say, because it's, I
40:53
wouldn't say it's like in the here and now, it kind of feels
40:57
like the most innovative companies, it's in the here and
41:01
now for them. But when you look at like most
41:07
organizations, I don't think they're that far in terms of
41:10
adopting, adopting Cape in the signals framework for you to be
41:15
investing in that, that's really innovative.
41:19
Talk to us a little bit about that and why you made it, why
41:23
you felt like that was important to invest in.
41:27
Yeah. So that I mean among other
41:29
things, we're always trying to solve this kind of complex
41:32
equation for where we should spend our kind of limited
41:34
engineering bandwidth. And that that's the problem that
41:37
product management is is tasked with with solving, right.
41:40
It's like where should we spend, you know, limited resources.
41:43
That one in particular I think is super important for two, two
41:47
reasons. 1 is we need that internally.
41:51
So Cisco has dozens of products that need to share signals about
41:55
identities all the time. I for a long time, identity
41:59
services engine, which is a product that I'm I'm familiar
42:02
with here at Cisco, is how we tied identity into the network.
42:05
And they had a published, you know, published subscribe
42:08
mechanism called PX Grid, which does pretty much exactly that.
42:11
And shared signals we see as a kind of natural successor or
42:15
complementary technology to how that technology operated.
42:18
So for a long time we've known like you need this kind of
42:21
shared bus to share identity signals.
42:25
So like that, that's nothing new.
42:26
But yeah, back, back to your question of like how do we
42:28
continue to innovate in the face of all these different
42:31
technologies, It's really the ones that drive our connectivity
42:34
into what a customer might have showed.
42:37
So things that that really work with other things in the
42:40
industry and that's very much because that's how Duo has
42:42
always operated. We are sort of an ecosystem
42:45
player. We understand we are not just a,
42:48
you know, an island in a much bigger industry.
42:51
We integrate with other solutions in identity, other
42:55
solutions in networking. And so it's really important
42:57
that we do invest our limited engineering bandwidth into
43:02
building stronger bridges so that we can do more with them.
43:05
Not just, you know, sample, but also OIDC and Skim and SFF and
43:11
and and so on and so on. Like we need to make sure that
43:14
these bridges are really strong and we invest in the protocols
43:17
that make them possible. Maybe model context protocol is
43:20
the next one, Who knows? So you can kind of tell I
43:23
dropped the pessimistic angle about 1/2 hour ago, right?
43:27
I'm sitting, I'm literally sitting here thinking we should
43:30
be paying Matt for being on here with us and like sharing this
43:33
knowledge. So I'm going to pick your brain
43:35
a little bit more. What, what should we be thinking
43:38
about as the identity practitioners are listening to
43:41
you? What should we be thinking about
43:43
for the future? Yeah, I think the seizures hard
43:46
to predict this fishing resistance thing.
43:49
I even know we're talking about it here and now is like it's
43:51
going to be a long road, but we got to start implementing that.
43:53
That's really important if we want to see that 60% number drop
43:57
down to, you know, below 50 and hopefully closer to like 10 or
44:00
zero. I the investment in password
44:03
list fishing resistance, you know, biometric based
44:06
cryptographically secure password list like I can't
44:09
emphasize that enough. Like there's the here and now
44:11
and we've got the tools now to go and do it and that that's
44:14
really important. But if we look out input on, you
44:16
know, or goggles for what's happening 5 to 10 years in the
44:19
future, there's a lot of interesting innovation happening
44:23
both in terms of human identity, but in terms of machine and
44:27
agentic identity. And they're all super
44:29
interesting. Machine identity is kind of,
44:31
it's been up and down in the hype curve like a few different
44:34
times. I think it's like ping ponging
44:35
back and forth about whether there's a real market there and
44:39
enough to go after. I think there is.
44:42
There's there's such a need for strongly identifying and
44:47
authenticating devices, not just when they connect to the
44:50
network, but also when they go and access resources and whether
44:53
the devices or workloads. There's a ton of innovation
44:56
that's required around machine identity.
44:58
Same thing's going to be true for identic identity.
45:00
If I'm hiring a team of 10 agents to do various things for
45:05
me, I need to give them identities.
45:07
I need to figure out what permissions I can delegate to
45:09
them and when to delegate them to them, and then let them have
45:14
the connectivity to go and access resources, but really
45:17
closely watch what they're doing with the access that I gave them
45:21
so I can quickly take it away. Then the thing that's really
45:23
interesting is, you know, you can corrupt a person, maybe by
45:26
bribing them or figuring out what their intentions are and
45:29
and manipulating them. Agents, it's just like so much
45:33
easier. Their value system is, is
45:35
written in, in plain English and they they're easy to corrupt in
45:39
such a way that we need to worry about the insider threat thing
45:43
all over again, because each agent has the potential to
45:46
easily become an insider threat just because it read like a
45:49
weird PDF at some point in the past day.
45:52
It's like, oh, he'd accidentally read this PDF and now it's
45:54
malicious. Like that doesn't happen to
45:56
people, it happens to agents and it, it's just bananas.
45:59
And I think that's, that's a really interesting problem to
46:01
solve from an identity perspective because it gets to
46:03
like, yeah, that agent is who it says it is.
46:05
It still is. We can still authenticate, it
46:07
still has that certificate, but like it's gone off the walls.
46:11
It's crazy. We we need to shut down what it
46:14
can do. Those problems around the Gentic
46:16
identity and Gentic AI are, are fun to think about.
46:19
I think we'll see how much of it really comes to fruition, but
46:22
I'm, I'm pretty excited about that in particular.
46:25
I mean, there was a whole movie about this called The Matrix.
46:27
So we've got Neo and, you know, Agent Smith.
46:30
And if you think about it, both are a gentic AI is kind of
46:33
battling each other right through all the different levels
46:35
of of the Matrix. I want to project us from the
46:38
here and now into the future. I'm going to wrap up the episode
46:41
here and you know, we're at Ideniverse as this goes live.
46:47
So, but we're not there physically yet, right?
46:49
So we're going to use the power of time travel for the three of
46:52
us. What is something that you are
46:54
hoping to see at Ideniverse this year?
46:57
Is there a specific topic, any sort of trends that you want to
47:01
see? I have to imagine like AI is
47:02
going to be kind of everywhere in this idea of non human
47:05
identity. But like, what are you most
47:06
looking forward to hearing more about at the Identifiers
47:09
conference that we are all at right now?
47:12
Yes, here we are. So there's a ton of things and
47:17
and yeah, you can't ignore AII think I'm interested to see what
47:20
start-ups emerge around the agentic identity space.
47:22
I'm already seeing a few really interesting ones.
47:24
And you know, from my ventures point at Cisco, I, I get a sneak
47:27
peek into like what's going on in the startup industry and
47:29
that's pretty cool. The machine identity stuff.
47:32
We've been talking about non human identity for a couple
47:34
years now. There's been a crop of start-ups
47:35
that came about. I'm really interested to see
47:38
where that goes. It's like, do we get beyond just
47:41
visibility and observability there?
47:43
It feels like we're, we're, we're there like when are we
47:45
going to get an IDP for machines and when are we going to get an
47:48
IDP for agents? And what are the sort of things
47:51
that would make this happen? So then those things in
47:53
particular. Interesting.
47:54
I think the identity governance problem is still very real.
47:57
It's like we still don't have least privilege authorization.
48:00
One hypothesis that I find super interesting that I'm going to be
48:04
looking out for an Identiverse or am looking out for since
48:07
we're there is whether this agentic AI problems forces us to
48:12
finally solve the hard problem of authorization that
48:16
everybody's been kicking the can down the road on for for so
48:19
long. Because it's hard.
48:20
It's hard to figure out beyond the application level what
48:23
permissions people should have and how to grant them and take
48:25
them away in, you know, in an instant.
48:28
But with agents, like we were talking about, things can go
48:31
wrong in an instant, and they can go wrong at scale, and you
48:34
can cause really, really big problems if you don't have
48:37
control over it. I think we might finally see
48:40
solutions to authorization that not just work for agents, but we
48:44
actually get the benefit from them for humans as well, and
48:47
it's going to make our lives easier and more secure.
48:49
Jim, what are you looking forward to at the Identiverse
48:51
that we are currently at right now?
48:53
Yeah, well, look, I'm going to force the lighter note.
48:58
I'm looking forward to improvements in the swag.
49:03
I think it's very important that each booth give away something
49:06
good. I don't need any more squeeze
49:09
balls. I don't need one of those like
49:12
window dealings that covers your camera when you don't want to be
49:15
on camera. What I would like I I'm a fan of
49:19
socks. Like I think giving away socks
49:22
is a good thing. I know you're that's not your
49:23
thing. I don't understand it.
49:25
Everybody likes socks like I I have 0 interest, less than 0
49:29
interest. I would give them away if I had
49:30
someone give them to me. So socks I think is good because
49:34
you, you know, you wear them a few times and then like you got
49:39
them for free so you can just throw them away.
49:41
I think somebody should have scarves, like how much would it
49:45
cost to have a custom scarf or do something a little bit
49:48
different. You want to say you think
49:51
different than give away different swag at the at your
49:54
booth? That's my pro tip.
49:57
Matt, any response to that as as a vendor?
49:59
Yeah. No, I think the scar scarves in
50:02
Vegas, in the in, in, in, in June is like really?
50:06
That's going to be really good. It's going to be like 100° or
50:10
when you're listening to this, it's probably 100° outside, but
50:13
you get to stay inside in the it's.
50:16
Chilly. No, I'm with Jim though, on
50:17
socks. I I love the socks.
50:20
Sorry, Jeff. No, hey, that's fine.
50:21
Look, I know. I know what's super popular.
50:23
We have a lot of folks that have, you know, expressed
50:26
interest in that. You know, I just, I don't get
50:28
it. I think the most important thing
50:30
for any type of swag is that you don't want to be the piece of
50:33
swag that gets left behind in the hotel room because like, I'm
50:37
not going to use this thing. That's just a waste for
50:39
everybody. So it also means that your swag
50:42
was not memorable enough to, to, to throw in the suitcase or into
50:45
the bag or whatever you're doing.
50:46
So pro tip for all the vendors out there, right?
50:48
Come up with something good. Who I appreciate most are
50:51
vendors who give me stuff that I can give to my kids as
50:54
souvenirs. It just like saves me a trip.
50:57
I was at RSAA few years back and somebody was giving out like
51:01
lightsabers. And so of course that was a very
51:04
popular, you know, giveaway for people.
51:07
And I'll never forget getting on to the flight back home from San
51:10
Francisco and just that time we've been going back to
51:11
Chicago. So United flight and I get on
51:13
the flight and I just see a whole bunch of lightsabers on
51:17
the seats with all the people who had attended RSA and they
51:19
were carrying back this thing. I don't know what company it
51:21
was, but it was a very memorable swag on them.
51:24
So, you know, a unique memory as part of business travel of, you
51:28
know, getting on board with what I assume are a whole bunch of
51:30
Jedi and Sith Lords, you know, going back to Chicago.
51:33
So you never know. Hey, I should mention though,
51:37
Identity Center is recording. We're at a booth in the Expo
51:41
hall and we will have stickers. So even if we're recording and
51:45
can't stop and talk and grab a sticker, and if we are there and
51:52
we're not recording, we'd love to say hi.
51:54
Yep, always. All right, let's go to wrap it
51:57
up. Matt, any final words of wisdom
51:59
that you'd like to impart upon the global identity community
52:02
that you're talking to? No pressure.
52:05
OK, check out the new Duo. You know, go to duo.com, there's
52:09
Duo Identity access management is pretty cool.
52:11
We've got a directory now that's the big news.
52:13
Let's go check that out. If it's not Thursday yet of
52:16
Identiverse, check out my keynote on Thursday.
52:19
I'll be talking in the morning and if it's past that date, you
52:22
know, feel free to check out the other recording of it
52:24
afterwards. But no, that's that's I
52:26
appreciate you guys having me on.
52:28
Well, Matt, it's always a pleasure having you here.
52:30
We're going to give you a virtual fist bump for now and
52:32
hopefully make that a real fist bump in a couple days there.
52:35
Yeah. So we'll have links in our show
52:36
notes, duo.com, duo.com and connect with us on LinkedIn and
52:42
what else like and subscribe to all that fun stuff and show
52:45
appreciation for the guests that we get on like Matt.
52:47
So with that, we'll go ahead and wrap it up for this week.
52:50
Thanks everyone for watching and or listening and we'll talk with
52:53
you all in the next one. You've been listening to
52:58
Identity at the Center. We hope you've enjoyed the show.
53:02
Make sure to like, rate and review, and we'll be back soon.
53:06
But in the meantime, hit the website at
53:08
identity@thecenter.com. See you next time on Identity at
53:15
the Center.