Latest / Identity at the Center / #327 - Sponsor Spotlight - Andromeda Security

Transcript

#327 - Sponsor Spotlight - Andromeda Security · Identity at the Center

0:00
The right way to look at this problem is that identity is a
0:02
data problem. What I mean by that is because
0:05
we have so much fragmented data, there is so much context out
0:08
there. If you can put all of that
0:09
together in a single data lake. And that's what Andromeda does,
0:13
ingest all data from all the data sources, IDPHR systems,
0:18
cloud providers, most importantly activity logs.
0:22
And then once you have everything in a single space,
0:24
you can run models on top of it. So we done machine learning
0:28
models around risk scoring or behavioural analysis, peer
0:33
behaviour, your past behaviour and so on.
0:35
And then all the use cases really come out of that data and
0:40
the models. So what does Andromeda do?
0:43
Well to start with, it gives you visibility.
0:47
So it discovers all identities, human and non human, and builds
0:50
a risk model, a score across posture, behavior and
0:54
permissions and tells you which identities to focus on, which
0:58
are your high risk identities, and gives you built in
1:01
remediation steps. This is identity at the center.
1:11
If it has anything to do with IAM, this is the go to podcast
1:17
now your hosts Jim McDonald and Jeff Steadman.
1:27
Welcome to the Identity at the Center podcast.
1:29
I'm Jeff, and that's Jim. Hey, Jim.
1:31
Hey, Jeff, how are you? Not so bad yourself.
1:34
Happy 2025 is our first Sponsor Spotlight episodes of of the
1:38
year. It is, and we're starting off
1:41
with a bang. Like you mentioned, this is a
1:42
sponsored episode, so we're very fortunate to have one of the key
1:46
members of the Andromeda Security team here with us.
1:49
They are. So it's Andromeda Security.
1:52
You saw that in title as we were as we're rolling this out.
1:55
They're an AI powered identity security platform.
1:57
You can find out more about them at andromedasecurity.com/idac.
2:02
And I mentioned it, we've got one of the Co founders here, Co
2:05
founder and chief product officer of Andromeda, Ashish
2:07
Shah. Welcome to the show, Ashish.
2:10
Thanks, Jeff and Jim, really excited to be participating in
2:13
that. Thank you.
2:14
Well, thanks for joining us. We definitely appreciate it.
2:18
You know, we have a lot of stuff going on in the identity space
2:21
and I always love to hear origin stories of where did people come
2:25
from when it comes to their digital identity journey.
2:27
So why don't you tell us about yourself?
2:29
How did you get into the digital identity or IM space?
2:32
Is it something that you chose or did it choose you?
2:37
Great question. So most of the founding team at
2:40
Andromeda came from a company called Avi Networks.
2:44
Avi was a software load balancer web application firewall company
2:48
founded in 2013, acquired by VM Red in 2019.
2:52
And we saw the journey of our customers at Avi into cloud and
2:57
SAS and we saw identity, especially permissions
3:01
management was a key problem that our customers were facing
3:04
as they moved to cloud. It's very different than what's
3:07
on Prem versus cloud. So that's where the the genesis
3:11
of the company started. And then as we started looking
3:14
into the problem space, we saw that a lot of unsolved problems
3:20
out there. There are lots of vendors there
3:21
of course, but there are lots of problems out there that are
3:24
unsolved. And so if you just when we
3:27
started and Ramadan, we started looking at, OK, what are the top
3:30
challenges that we have to that are still unsolved.
3:34
I think the biggest one that I think all we know about is
3:38
identity is at the center of attack, no pun intended, but
3:42
it's it's a primary attack vector today.
3:46
It's not if it's when it'll get compromised.
3:49
And so the attack surface really is determined by the over
3:54
privileges of the permissions that any identity has, human and
3:57
non human. So that was the biggest problem
4:00
we want to solve this. Can we get to a state where even
4:03
if you have a compromise that is 0 or minimal business impact?
4:08
So that was the first problem we wanted to solve.
4:09
But there are other day-to-day problems such as even today, the
4:13
access management is manual. When somebody joins or leaves or
4:17
moves, the manual work flows and and especially in cloud, people
4:21
don't have patience to wait for hours to get that accesses
4:25
compliance is a pain today. Frankly, there's a lot of rubber
4:29
stamping going on. And all of these issues are
4:31
relevant for both human and non human identity.
4:33
And I'll just leave with one last thing, which is NHI, a non
4:37
human identity has a additional unique problem, especially with
4:41
the automation and and and and adoption of cloud and DevOps is
4:47
discovery what's out there. So this was the kind of the
4:51
landscape with which we saw that.
4:55
We realized that this is a problem space that we can, it's
4:59
a hard problem space, but it's a problem space that we can add
5:02
value to and differentiate. And so that's where we started
5:05
Andromeda. Give me some ideas of what the
5:08
Andromeda platform does, because I'm sure there's a lot of
5:11
different problem solved. You mentioned NHI or non human
5:13
identities. You mentioned the human aspect
5:15
of things like rubber stamping when it comes to, you know,
5:18
compliance and access reviews and everyone's favorite, you
5:20
know, IGA activities and things like that.
5:22
Tell me a lot about the platform.
5:23
I know we're going to dig a little bit more detail, but give
5:25
me just kind of a quick high level to to whet my appetite.
5:28
Sure, sure. So if you want to see a tagline
5:31
Andromeda as an identity security platform for both human
5:34
and non human identities, right? And the the ultimate goal is
5:38
that we automate your permissions and life cycles of
5:42
human and non human based on risk context and behavioral
5:46
analysis so that even if your identity is compromised, that is
5:49
minimal to 0 business impact, right?
5:51
That's what we started with. But but what does that mean?
5:54
So before I answer the questions, what Andromeda does
5:57
in detail, let let's understand why it's broken today.
6:02
So if you look at the the vendor landscape today, they're very
6:06
fragmented. They're NHI only vendors.
6:09
And then there are even within human identities, you hear the
6:11
buzzwords ITDR or ISPN or Kim Jit and IGAI think the right way
6:20
to look at this problem is that identity is a data problem.
6:24
What I mean by that is because you have so much fragmented
6:26
data, there is so much context out there.
6:28
If you can put all of that together in a single data lake.
6:31
And that's what Andromeda does, ingest all data from all the
6:35
data sources, IDPHR systems, cloud providers, most
6:39
importantly activity logs. And then once you have
6:43
everything in a single space, you can run models on top of it.
6:46
So we done machine learning models around risk scoring or
6:50
behavioral analysis, peer behavior, your past behavior and
6:54
so on. And then all the use cases
6:57
really come out of that data and the models.
7:00
So what does Andromeda do? Well to start with, it gives you
7:06
visibility. So it discovers all identities,
7:08
human and non human, and builds a risk model, A score across
7:12
posture, behavior and permissions and tells you which
7:17
identities to focus on, which are your high risk identities
7:19
and gives you built in remediation steps.
7:22
So that's step one. Think of it as a journey of your
7:25
identity security maturity to start with visibility,
7:30
recommendations, remediations. The next thing we do is real
7:33
time visibility into who has access to what roles and
7:38
permissions and more importantly who's using what so that you can
7:43
right size the roles based on not just usage, but more
7:48
importantly risk. Because our theory is that only
7:51
frequently used permissions that are low risk should be part of
7:54
somebody standing privilege. Everything else moves to just in
7:57
time access. So the least privilege is the
7:58
second set of use cases that we do that moves us to just in time
8:03
access. There are lots of JIT vendors
8:04
out there. The way we differentiate in JIT
8:07
is use context. Use behavioral analysis.
8:10
If Jim requests a privilege role and if he's always done it, same
8:15
location, same devices, why ask Jeff?
8:17
Who's going to rubber stamp it anyways?
8:19
Automatically approve it, take the human out of the loop and
8:21
the risk is low. But if Jeff is asking for this
8:24
for the first time or is in a different location, then add
8:28
friction, ask Jeff and tell Jeff what to look for so you can make
8:31
a more informed decision. That's how we do intelligent
8:34
jet. And then the final piece is IGA
8:36
user access reviews based on activities, past behavior and
8:41
life cycle management of identity.
8:43
So it's a platform and we can go into the each of these in
8:46
detail, but hopefully that gives you an idea on what we do.
8:50
I think it's helpful because it, it really kind of, I guess it
8:53
spans the Galaxy, pardon the pun on that.
8:57
You know, there's this this concept of being data-driven for
9:01
an IAM program. When I say program, I mean the,
9:04
the way the program itself operates, the people, the
9:06
process, the governance, etcetera.
9:08
A lot of organizations are sitting on a treasure trove of
9:11
data that sits in a system and really never gets used for
9:15
anything beyond, oh, great, we got a new onboarder, a new
9:18
joiner, a new believer, things like that.
9:20
I feel like there's so much more that could be done with that
9:22
data, especially if you're able to contextualize it, bring it
9:25
into the system and then combine it with automation and say, oh,
9:28
OK, because X, here's what's going to happen.
9:31
Why, right? And or else Z, right, Whatever
9:35
that looks, you know what that pseudo logic looks like.
9:36
So I love this idea of it. I want to let Jim ask some
9:40
questions instead of me hogging all the time.
9:41
But I've got one last question before I turn it over to Jim.
9:44
How do people measure success with Andromeda?
9:48
Because it feels like there's a lot of different ways it could
9:50
be done, but I'd love to hear straight from from you.
9:53
Excellent question. So customers buy a solution to
9:58
solve a problem, they don't buy a platform, right?
10:00
We have a platform doesn't mean we sell a platform, right?
10:03
We sell use cases. So we meet our customers in
10:07
whichever step of their journey they are in, right.
10:10
So we have customers who are in the early stage of the journey
10:13
where well I don't have visibility into how many
10:17
identities are there and who are the risky ones especially than
10:20
NHI side, right. And the other extreme of the
10:22
maturity curve is, well, I am implementing JET.
10:26
I need something that is automated based on intelligence
10:30
and context and everything in between, from role right sizing
10:35
to least privilege or access reviews and so on.
10:38
So we meet our customers based on the current pain points, help
10:43
them solve those pain points better than anybody else.
10:46
And once that's done, then expand into a second use case
10:49
and 3rd use case. So success is frankly measured
10:52
by, well, what is the current problem statement that you're
10:55
trying to solve? How can we help you do that?
10:59
Let's take an example for just in time access.
11:01
Well, there's a customer who's do decided to deploy Jet and
11:06
they look at multiple vendors and decide an Andromeda.
11:09
So let's operationalize that in a phased manner.
11:12
Let's make sure Jet is deployed. Once that hits a certain
11:15
maturity curve, let's look at let's for example NHI use case
11:19
and so on. And we have a different customer
11:21
who says I'll get to JET in future.
11:24
I want to first solve my NHI use case.
11:26
Let's start there, right and then go on.
11:28
So that's how we we measure success based on the specific
11:31
use case the customers wants to deploy in and then land and
11:34
expand. So Ashish, you are were
11:37
tremendously popular. You're boothless popular at
11:42
ideniverse at Gardner, which was the most recent one we saw.
11:46
You and Jeff and I are regulars at this conferences every year.
11:49
You're hard to get much more than a handshake from, but you
11:52
had a lot of people. We wanted to hear your story,
11:54
understand what is it that you guys bring to the table.
11:58
Here's my perspective is that as customers, we want to put
12:05
everyone in a box. It's a, you know, we want to be
12:08
able to relate that to something we understand.
12:12
And when we have budget line items as practitioners, we have
12:15
a budget for IGA replacement or IDP replacement.
12:21
Where is it? Does Andromeda fit?
12:24
What's the closest bucket? Is it IGA is a privileged access
12:28
management? Is it ITDR Keem, you tell me,
12:34
you know, if somebody's going out and saying I got money for
12:38
IGA, is the Andromeda on that list?
12:43
Great. Question Jim and I, I understand
12:45
totally how we all like to bucket solutions, right?
12:49
Because it simplifies how we think about it, right?
12:53
Because there's so many vendors out there and you need a
12:55
structured way to bucket these and say, OK, this is this
12:59
category and this is that category.
13:01
So it's a fair question. We like to flip the question
13:06
slightly and say, OK, what is the current problem you're
13:08
trying to solve? OK, you're trying to solve an
13:09
IGA problem. Does Andromeda have a solution
13:12
in IGA? Yes, it does.
13:14
You are trying to solve a JIT use case.
13:16
So I'm looking for a JIT vendor. Does Andromeda fit into that
13:19
category? The answer is yes and so on.
13:21
So rather than putting Andromeda in one bucket, we like to think
13:26
that we had a platform that spans multiple use cases across
13:30
multiple of these buckets. And depending on what is the
13:34
current pin point, as I mentioned earlier, we would be
13:37
able to, if you're able to address that, then the customers
13:39
would would buy that. So, so that's why we look at it.
13:43
The, the reason this is an important distinction is that
13:45
because because of these bucketed vendors, we have this
13:51
fragmented landscape and we think that the right way to do
13:55
that is put everything in a single data lake and build
13:59
models on that. Let me give you a specific
14:01
example. One of the most common thing
14:03
today you see is lots of NHI vendors, which is great.
14:07
And I'm sure we'll, we'll talk more about NHI later on this
14:10
podcast. But our contention is that NHI
14:14
itself cannot be solved in isolation.
14:17
I'll give you 2 reasons. The risks of Nhis and the
14:21
corresponding human users are intertwined and the life cycles
14:25
are intertwined. If I left the organization, all
14:28
the Nhis that I managed or owned or used have to be the deleted
14:33
if they're no longer in use or re keyed and reassigned to
14:37
somebody else. Otherwise there is a Latin risk
14:40
of that NHI by the by the now exited employee.
14:44
So the life cycles and intertwine same thing around the
14:49
the risk right and a risk of a human user is not just
14:53
identified by the rules and the access to the application that
14:57
he or she has, but also the relevant roles and permissions
15:01
all the Nhis that he or she is managing right.
15:05
And finally, I would say that other than the discovery
15:09
component of NHI, which is unique because human identities
15:13
have a directory service and HR systems, Nhis don't.
15:17
Other than that, the permissions management, the governance, the
15:21
privilege access management are common to both human and non
15:25
human. So why have separated solutions
15:28
when you're trying to solve the same kind of problems?
15:33
So, so that's, that's why we don't like to bucket ourselves
15:37
that we are IGA or PIM or Pam or or Kim or so on.
15:42
We like to say, what is the use case you're trying to solve?
15:45
Let me let us show you whether we can address that better than
15:47
anybody else. And then if so, you can use
15:49
Andromeda. OK, that's a really cool
15:52
perspective. So let me ask the question then,
15:54
what is the ideal customer type? Because I work with some clients
15:59
who were mature or were very mature at one time and they kind
16:03
of reached some of the sticking points with the technology
16:08
solutions they have. They can't take on some of these
16:11
newer use cases that are presented from cloud
16:14
environments or maybe their scale has grown.
16:17
I also work with clients who, you know, they've really just
16:21
haven't invested in IM in the past decade.
16:24
And so they're more or less a Greenfield.
16:27
Even if they have an IGA solution, it might not be one
16:30
that, you know, people commonly talk about it anymore, might be
16:34
that old, right. So what is the ideal client who
16:38
comes to? Is it the the savvy client or
16:42
the client who's just getting their feet wet?
16:44
Or maybe it's a savvy practitioner who took a job and
16:48
it's, like I said, Greenfield. Yeah.
16:52
That's a great question. So I'll, I'll answer it with two
16:56
perspectives. What is an ultimate vision?
16:59
But as a start up, what is their current focus, right?
17:01
Because the end of the day, it's a matter of physics, right?
17:04
So as a start up to be successful, you have to make
17:07
sure that you are addressing the use cases in the right order and
17:12
not trying to boil the ocean. So let's start with the with,
17:17
with what, what, what we support today and what our ideal
17:19
customer today looks like our ideal customer today is anybody
17:24
who's trying to solve an identity security problem for
17:27
cloud and SAS. And whether and in each of the
17:33
buckets that we talked about, whether it's around visibility
17:37
and risk scoring of your identities, human or non human,
17:41
it's around least privilege, it's around just in time access
17:44
in cloud or IGA for cloud and SAS.
17:49
So in any of these buckets, if you're focused on your cloud and
17:53
SAS environment, that's our ideal customer today.
17:58
We do not have an on Prem solution today and so that's
18:01
that's the current focus. But segwaying into where we are
18:05
going, well absolutely we will scale into on premises as well
18:10
and that's a longer term story as we matured our product, our
18:15
integrations and so on. And so our vision is to be able
18:20
to be the identity security platform across human and non
18:24
human based on risk and context and behavioral analysis across
18:28
all of the use case. We talked about cloud SAS on
18:31
Prem today it's cloud and SAS you.
18:36
Mentioned non human identities said maybe we'll get it.
18:39
Yeah, we're definitely going to get to that.
18:41
Your website screams human and non human, but I would say 2024
18:47
was the year that we woke up and said, oh, if these non human
18:51
identities, they're a problem that we should deal with.
18:55
I've been an identity for over 20 years.
18:58
It's been there the whole time. The problem has been there.
19:01
But now everybody's talking about it.
19:03
Maybe 2025 is going to be the year that you know, you know,
19:08
all heck breaks loose. But my question to you, Ashish,
19:12
is why now? Why is it that everyone's waking
19:16
up to this problem now? It's, it's a great question.
19:21
You're right. I think my thesis there is that
19:25
we hit that, that maturity curve, we hit that inflection
19:30
point off NHI usage. So if you think about it, Nhi's
19:35
were there. It's not that the machine
19:37
identities or Nhi's were not there on premises, right?
19:40
It's that the cloud and SAS has increased the a use of
19:45
automation, DevOps and that has proliferated the use of Nhis.
19:51
And I think we try to bucket ourselves or we try to bucket
19:54
Nhis into all Nhis are equal. They are not that different
19:58
kinds of Nhis from service accounts to API keys, tokens to
20:02
even AD credentials used for on premises, right.
20:06
So I think. That's a podcast on Albert's
20:11
own. We just said that, right?
20:13
Yes, that's right. That's right.
20:16
But the reason I think the NHIS has taken up is because I think
20:21
we've hit that inflection point where the adoption of dev OPS in
20:26
cloud and automation has gone to a point where it's become a
20:29
serious problem. And the one of the biggest
20:34
challenges with NHIS that I think we referenced earlier is
20:38
there is no single source of truth that is not directly
20:41
service or an IDP equivalent for NHIS.
20:46
And so I think it's even a harder problem because you can't
20:48
gate all Nhis through a single funnel like we could do through
20:51
SSO and MFA for human users and look at HR as a single source of
20:55
truth. So I think that's the reason why
20:59
all of these things coming together, we are seeing a lot of
21:02
focus on NHI, yeah. And you know, I feel like we are
21:06
now experts in managing it's human identity, right?
21:11
I mean, it's, it's kind of boiled down to it's simple,
21:14
Simon, there's some authoritative stores, normally
21:17
the HR system for who works here, maybe there's a contractor
21:22
database. And then we have a IGA system
21:25
and this fits out Access. It's really these MH is that
21:29
they're hard to manage and with kind of what you were describing
21:34
earlier, sounds like you went right after the probably you
21:37
took on the hard stuff. What makes this so hard to to
21:40
manage these? Yeah.
21:42
I'll answer the questions, but I would also contend to your point
21:45
that HI is a solved problem, but human identity is a solved
21:48
problem. I don't think so.
21:49
It's not a solved problem because it's all manual and not
21:53
really based on context. I think the Igas today are just
22:00
mostly rubber stamps. They all the roles are over
22:02
provision, like 95% of roles are over provision even for human
22:05
users. So I don't think it's a solved
22:07
problem. But let's let's let's part that
22:10
for a second. Let's come back to an NHI
22:12
question, which is what makes the NHI hard.
22:15
So let's start with what are the aspects of NHS security that are
22:21
relevant? I think we all focus on the
22:25
first one, which is discovery, credentials management, life
22:29
cycle management. I like to put all that under the
22:32
authentication, roughly authentication bucket, which is
22:35
OK, what are all the Nhis? So do discovery because there is
22:39
no central place. What are the key rotation or
22:42
credential rotation hygiene? How often should we rotate them
22:45
and how should we cycle them? When somebody with the NHI is
22:51
deleted or, or the passwords are rotated or keys are rotated and
22:54
so on? That's what most of the vendors
22:57
are focused on. It's an important problem, but
22:59
that's not the only problem. There are two other aspects of
23:03
Nhis that are often overlooked. The the the the next one being
23:08
the permissions management. They're all right sizing because
23:13
just like human users, NHI has a role and a set of permissions
23:18
and if they're over privileged you have a large attack surface.
23:22
In fact, I would argue that there are types of NH is where
23:26
key management is irrelevant. I'll give an example.
23:30
Think of AWS EC2A. VMAVM has an inherent EC2
23:37
instance profile. It's a temporary credential that
23:41
AWS manages on your behalf. You as an enterprise don't have
23:45
to worry about key rotations for these kind of workload
23:48
identities. However, you absolutely have to
23:52
worry about the roles it's assigned.
23:53
Because if that VM is compromised, the attacker can
23:57
assume the role that that workload identity is able to
24:02
take, and if it has additional excessive privileges, all hell
24:05
can break loose. So the permissions, the role
24:08
rightsizing parts of NHI is equally important, in some cases
24:13
more important than the credential piece for some kinds
24:17
of identities. That's what makes it hard.
24:20
The four and final piece I will talk about a third type of
24:24
security is securing the client. Let me give you an example.
24:29
Let's say you have, let's focus on AWS.
24:32
You have a role in my, I'm an enterprise in my enterprise
24:37
account, I have an AWS role. I'm trusted a third party, it's
24:42
a another SAS service, their AWS role in their account and
24:48
there's a client applications that using the role to access my
24:51
my, my enterprise role. There is no credential exchange
24:55
here. It's a role to role trust.
24:58
What should you protect? Two things, the permissions in
25:01
the role so that there is Nexus, a privilege and the client
25:05
application, the third party applications which is using the
25:09
role, so protecting the client itself.
25:12
We often overlook this component, this part of NHS
25:15
security as well. So I think we're still in our
25:18
early phases of NHS security. There are multiple aspects, we
25:22
all focus on one, but there are many things, many hidden
25:24
dimensions to NHS security and that's what makes it hard, good.
25:28
Answer and I want to come back for the follow up on #2 but this
25:32
was a triggered question so bonus question.
25:36
I asked this one a lot Jeff and I don't agree on the answer.
25:41
Is there a nuance between non human identity and non human
25:47
account or do they basically mean the same thing it?
25:51
Is a tricky question because account word is so overloaded
25:55
right? And AWS account is an Azure
25:58
subscription is AGCP project right where the traditional
26:01
account means an identity. So we we think of account and
26:06
identity almost synonymously because the way to think about
26:10
it is that it doesn't have a set of permissions roles, which
26:17
allows it to do something. Then you need to worry about as
26:20
an identity. And and I think, I think, I
26:25
think if you if you apply those first principles, then you can
26:28
think that NHI and the non human account are are equivalent.
26:32
I was. Kind of thinking of the term
26:33
account in terms of, you know, the kind of the traditional
26:37
sense of they username and password kind of thing.
26:41
Not so much the AWS account, but I, I kind of feel like there's a
26:47
future and I don't want to think it's too far off track.
26:49
A future where you have AI worker robots and they can make
26:55
security decisions on what they're not account or, you
27:00
know, accounts. I'm called using the term
27:01
accounts again should have the permissions that they have.
27:07
I can basically make decisions like people.
27:09
So that is a an area where a non human to me would be an
27:14
identity. I digress.
27:16
Well, but I, I want to get to this because you, because we
27:19
definitely don't agree on this one.
27:20
And that's fine, right? We're, we're exchanging ideas
27:23
here. Where does account stop and
27:26
identity begin and vice versa? I think that's really kind of
27:29
the crux of the question is you have an identity.
27:32
I have an identity. We also have accounts.
27:35
Can a non human also have an identity because it also has
27:39
accounts or maybe it's its own entity, right?
27:42
Or whatever we want to call it. You know, Jim, in your example,
27:45
a worker bot, right? Or AI bot or chat bot or
27:48
whatever it may be. There's going to come to the
27:49
point where you're going to effectively hire AI workers to
27:55
do things. Do they, do they have their own
27:59
identity because they have account?
28:02
I don't know, right? I think that it's, it's an
28:04
interesting discussion in my mind because it's very semantic
28:07
and almost kind of like, you know, philosophical.
28:10
So so we have a perspective one I was.
28:12
Just going to say, I think we should have an episode and tap
28:16
into smart people like Ashish to answer that question in under 3
28:21
minutes. And then kind of like we did
28:23
with I Am versus digital identity, What's the difference
28:26
and make an episode out of that, yeah.
28:29
So if I may add one thing, we actually see some of the
28:32
practical implications on this even today.
28:35
So for example, I'm Ashish, but I'm logging into AWS through
28:41
SSO. OK, so that's an identity right?
28:44
But I might also have a local break class account within an
28:49
AWS account. Is it the same Ashish or is it a
28:53
different account? We, we, what we do is we put all
28:57
of that under a hierarchical umbrella.
28:59
We call it in we, we, we call it an I'm looking for the right
29:05
word here. It's an instance or it's, it's
29:10
an incarnation. So Ashish is the ultimate
29:14
identity. Ashish has multiple
29:16
incarnations. 1 is an SSO incarnation, 1 is a break class
29:20
incarnation. That helps us because you can
29:26
use the incarnation when it's makes sense.
29:28
Like who logged in, the specific incarnation logged in, Who does
29:32
it belong to? It belongs to Ashish.
29:35
So you can answer these questions depending on what
29:38
you're trying to. You can you can.
29:39
You can get to the right answers based on what you're looking
29:42
for. Similarly to AAI bot question,
29:46
the AI bot can be an NHI itself with its own incarnations, but
29:50
the ownership is Ashish's because Ashish manages it.
29:54
So you can do a combination of human and non human ownership
29:59
relationship and within the identities incarnation notion
30:04
where it's just one one identity but has multiple accounts,
30:09
multiple incarnations depending on which system it's used in.
30:13
That helps us in general, but it's a larger conversation.
30:17
It is and it I feel so, so, so semantic around this, right,
30:22
because you're right, we use accounts, we use identities, we
30:26
use IAM to mean a whole bunch of different things that probably
30:29
shouldn't. And words matter, especially
30:31
when you're talking to people and make sure you have the, you
30:32
know, you're using the same language, the same definitions
30:34
of those types of things. But I'm going to I'm going to
30:36
lay my, my, my Infinity gauntlet down here and I'm going to I'm
30:41
going to drop the mic on Jim real quick.
30:44
We don't call it non human accounts.
30:46
We we've been calling it this entire conversation, human
30:48
identities and non human identities.
30:51
So there you go, Jim. That's how that's so my my
30:54
comeback if you. Came to work at my company.
30:57
You just said man I gave you here's your login for your
31:01
e-mail, here's your login for the application 123, and here's
31:06
your login for application ABC. Would you say you have 3
31:11
identities or three accounts? I would say I have 3 accounts
31:14
that map back to my identity, my mastery record, whatever you
31:18
want to call it, Incarnation as she mentioned, like things like
31:21
that is you've got an identity, and then if you think about as a
31:25
tree underneath, if you double click an identity, you'll see
31:27
three folders for three different accounts there.
31:31
There's one Jeff Sedman and the world.
31:34
Doesn't need any more. And also, I think with with
31:37
identity, using the term identity when it comes to, you
31:41
know, hey, Terraform spins up 500 accounts a day.
31:46
It doesn't have 500 identities, doesn't create 500 Jeff
31:50
Steadman. So it creates 500, you know,
31:54
accounts that exemplify Jeff Steadman.
32:01
We're going off the deep end here and I have a better
32:05
question. I I think it's better, it's more
32:10
in target because you talked about this is a data problem.
32:14
And I totally agree, especially when it comes to authorization.
32:19
I mean, that's the the hard problem, right, is understanding
32:25
what an account or an identity has access to in total, what it
32:29
should have access to, which is usage patterns.
32:34
I mean, you think on this hard problem, talk to us about why.
32:39
I mean, to me it's like it gets down to like exactly what the
32:42
issue is. It's trying to drive toward some
32:47
some instantiation of least privilege, right 100.
32:50
Percent and and you can also call it zero trust for identity
32:54
right? What is the definition of least
32:57
privilege? What is the definition of 0
32:58
trust to us to at Andromeda? It means that any identity
33:07
should only have those set of permissions on it's standing
33:11
basis, on the standing basis that are frequently used and low
33:15
risk and why that matters that remember we said it's not if
33:20
it's when you'll get compromised.
33:21
So when you're compromised, if your tax surface is defined by
33:24
low risk permissions, then you don't have nothing to worry
33:26
about, right? And and everything else that
33:31
moves out goes to just in time access, which is again automated
33:35
based on context. But to achieve this true zero
33:39
trust or true least privilege, you have to understand two
33:41
things. You have to understand risk and
33:43
you have to understand usage. Usage is based on the actual
33:47
activity that that identity is doing, but not just that
33:50
identity, the peers. So that's where some of the
33:53
machine learning models come in. Well, if Jeff and Jim are part
33:56
of the same team, is there a peer behavioural model that can
34:00
also influence what should be part of standing privilege or
34:03
not? Because the end of the day,
34:04
remember we are trying to achieve two things at the same
34:07
time, security and agility or productivity anytime, especially
34:12
in cloud and SAS, if you slow down your developers and users,
34:15
they're not going to adopt the tool.
34:17
So we always trying to strike the balance and to do that.
34:20
Coming back to a data problem, Jim, if you can analyse the user
34:24
behaviour, the peer behaviour, the context, the locations, the
34:29
devices, the past history and then combine that with the risks
34:34
of the permissions. So each of AWSGCP Azure have
34:37
1520 thousand individual permissions.
34:40
They're not equal. There are view level permissions
34:43
and list level permissions to read, write and I am level
34:46
permissions. Can you give a different risk
34:49
levels, combine that the usage models and then derive the zero
34:54
trust or this least privilege? That's the Holy Grail and that's
34:58
what we are doing at Andromeda based on the data lake and
35:04
that's where the machine learning models, the AI models
35:06
come into play. That's why the hard problem, and
35:09
that's why it's more exciting. All right, so I smelled an AI
35:12
conversation. I knew it was coming and look,
35:15
I'm, I'm a little bit sceptical because now I start to see a
35:18
whole bunch of applications and products and vendors, you know,
35:22
jumping on AI and I guess help me understand, right.
35:27
You know, we had AI and I think of AI now as generative AI, not
35:31
machine learning, which is also AI.
35:33
Yes, but it's sort of like the what I'll call the legacy
35:36
definition, if you want to call it that.
35:39
Help me understand where does AI come into the Andromeda
35:43
platform? What is it used for?
35:46
You know, is it, is it really generative AI?
35:50
Is it ML or some mix of the two? Help frame that for me from a
35:56
contextual perspective. Definitely short answer, it's a
36:01
combination and it's not AI for the sake of AI.
36:04
It's not AI washing right. We we are genuinely trying to
36:08
figure out what is the best way to solve a problem.
36:12
So to give you an example, right, once you have all the
36:15
data in a single data like it's a graph based database, what are
36:19
the questions we're trying to answer?
36:21
So first is a risk scoring. So we have a three-part risk
36:24
model based on posture. So posture, risk configurations,
36:27
MFA, etcetera, key hygiene, behavioural risk, past activity,
36:32
behaviour, applications, logins, locations, etcetera and
36:35
privilege risk analysing the riskiness of the permissions and
36:39
the accesses and so on. So this is where as we use some
36:43
of the machine learning models to define the risk score in the
36:48
best possible way. Mathematical models, some of
36:50
their machine learning models for assigning risk score to
36:54
every role, every AWS account, every identity, every
36:58
application and so on. We also use behavioural machine
37:02
learning models for looking for anomalies, anomalies of a given
37:08
user compared to its past behaviour, anomalies of a given
37:11
user compared to its peers and so on.
37:15
And these are well defined machine learning models,
37:17
clustering models, anomaly models and so on.
37:21
We use models for so. So one place we do use
37:26
generative AI is for summarizing session activity locks.
37:32
So what we do is let's say you got a privilege sessions for two
37:35
hours. We look at the activity logs,
37:39
let's say it's AWS. We look at the cloud trade logs
37:41
of what Jim did in the two hour privilege session, every action
37:45
Jim performed and then the output of the model is an
37:49
English language. Somebody saying Jeff logged in
37:52
for two hours, he did these these, these actions, these were
37:56
anomalous, these were expected. And here is everything he did,
38:01
somethings was successful, something was not successful.
38:03
That summarization is where we use Gen.
38:06
AI models, but that's a very specific use case.
38:09
So again, it's the same data lake with the context, with the
38:14
behavior, with the activity logs.
38:15
And depending on what we're trying to do, we use different
38:18
ML and AI models. So as a as a customer, can I
38:23
tune the, you know, the models in a way to say, OK, here is
38:27
what I'm looking for or here what it here is What's risky?
38:30
I would imagine it takes time to develop whatever the access
38:34
patterns might look like, right? How do you know if something's
38:36
risky unless there is an outlier of data, right, for it to pick
38:40
up on What is, I guess one first question.
38:44
How do I tune some of these, you know, models to look for what
38:48
I'm looking for or make it more fine-tuned for my application or
38:51
whatever it may be? And then how long does it take,
38:55
you know, realistically to establish a baseline of what is
38:59
normal versus what is not normal?
39:01
Great question. Let me start with the second
39:03
question first. So when we onboard a customer,
39:09
if the customer has the last 90 days of log data, we use that
39:13
for baselining. So our, our current training
39:16
period is about is 90 days worth of data and we can always go
39:20
longer. And for most cases, customers
39:23
usually have that 90 days of data in the history.
39:27
So we can hit the ground running it with that 90 days of history
39:32
immediately, right. If the customers doesn't have
39:35
any data, then of course you have to wait for 30, sixty, 90
39:38
days for the baseline to be established.
39:40
But that's rarely happens. Now how we how we train our
39:47
models is we don't use customer data to train our models because
39:52
the good news is that especially in cloud and SAS, these are
39:55
standard applications and standard behaviour where you
39:58
know what is what is a risky behaviour of a certain certain
40:03
permissions and what is not. So we can use genetic synthetic
40:07
data to train our models. And similarly for the Gen.
40:11
AI piece where we send to to the LLM models to translate to an
40:17
English language, there is no customer data that's being sent
40:19
because. It's, it's the actions which are
40:22
generic AWS or Azure actions which are getting translated and
40:26
the context is getting translated.
40:28
Nothing that's customer specific, right.
40:29
So, so that that's a good part in terms of tuning.
40:34
There are multiple aspects of the model.
40:36
So the risk is impacted by the set of permissions as well as
40:42
the type of assets. Is it a production environment
40:46
versus a dev environment? Is it does it have PIO data or
40:49
not Those are tunable by customers today and that impacts
40:53
the risk score and so on the other aspects we will we are in
40:58
the process of exploring how we can make some of those models
41:01
more tunable, but that's again based on customers needs that
41:04
should be fairly straightforward for us to do.
41:08
Now, one of the biggest criteria for us to implement any ML or AI
41:15
model is explain ability. If we cannot explain what the
41:20
model did in an English language in a reasonable way, then we do
41:25
not want to put it in the product.
41:28
We do not want to offer that, right?
41:30
So explainability is a very, very important consideration
41:35
when we develop the product. And then finally, no models are
41:39
perfect. If we say I'm with 100%
41:44
probability, I'm telling you this is what the case is, you're
41:48
fooling yourself, you're fooling the customers.
41:50
That's not the right thing to do.
41:51
So a lot of our recommendations, lot of our summarizations and,
41:57
and, and analysis, we put up what we call it confidence
42:03
interval saying look, all confidence interval for this
42:07
analysis is 60 to 80%. Of course, if it's below a
42:12
certain threshold, we won't even show it.
42:13
But beyond certain threshold you can, you can configure and say
42:16
start showing me your recommendations and analysis as
42:19
long as this hits a certain threshold.
42:21
And then we'll show you what that threshold we have hit so
42:23
that you can tune that and say no, show me only after it's 80%
42:27
or show me anything about 50% and so on, right.
42:29
And then finally, we take input from the customer saying this is
42:36
not true, it's a false positive. So that goes back into the the
42:40
product, right? Because we're trying to strike a
42:41
balance between false positive and false negative, right?
42:44
And every customer has a different level of tolerance for
42:48
that. And that is something you can
42:49
tune and say, show me even if you're 50% confident, show me or
42:53
show me only up for 90% and so on.
42:55
And then take the feedback and tune the model again and so on.
42:58
Hope that helps. It does.
42:59
And I think 11 last question for me will be, I guess the security
43:04
of the AI models themselves. And I think you kind of
43:06
mentioned is you don't you don't put customer data right into
43:09
your model. But what are the what are the
43:11
guard lines or guard rails for? What stays, I guess on Prem or
43:16
in my specific cloud versus your cloud versus maybe a third party
43:21
cloud like an open AI or Anthropic or, you know, Google
43:25
or whatever it may be. How do you see those three
43:27
things mixing and how do you make sure that data doesn't
43:29
cross boundaries? Because I feel like that's an
43:32
area that needs to be explained. Anytime someone's saying you
43:34
know, AI, no. 100% right. So I think you, you, you, you
43:39
outline that framework very well, right.
43:41
So first of all, from the customer cloud or customer Prem,
43:46
we don't pick any data per SE. The only sensitive information
43:51
we are getting is of course user IDs and the emails because it's
43:55
it's, it's an identity product. But none of the data is pulled
44:01
into Andromeda. All of that, whatever we pull in
44:05
stays within Andromeda's cloud environment via SAS product.
44:10
And none of that goes into a third party, whether it's Open
44:15
AI or Anthropic or any any other model because what we are
44:19
sending and again, remember we're using the LLM models only
44:22
for a very specific use case, which is session summarization.
44:26
And if as a customer says, I don't want that feature, no
44:28
problem. It's it's, it's a very modular
44:30
product. So they're only the actions are
44:33
going in saying some anonymous user, user X perform these
44:37
sequence of operations, translate them to an English
44:40
language summary for me. So there is no data that's going
44:42
into a third party. But I think at a larger point,
44:45
this is a very, very important topic to us.
44:48
It's very near and dear to us because as I said earlier, if
44:51
you can't show the safety and security of our data in the
44:54
model and can't explain our our answers, then we can't build
45:00
trust in our customers, right, So, so.
45:02
Ashish, I wanted to say bravo on the explainability point.
45:07
I mean, I love that I, I've been a voice towards us for a while,
45:11
which is how can I sit in the witness chair and explain why a
45:17
decision was made if I can't explain it?
45:20
Some black box AI decided is not going to be an acceptable answer
45:25
in my opinion. So bravo on that.
45:29
You talked a lot about models and you know, I, I see this
45:34
trend that's happening in the market, which is you've got a
45:38
more savvy client. I.
45:41
Love the data lake concept. I think the client wants to have
45:44
a hand in, you know that data lake that their data, they they
45:49
want to help design it. They want to say, hey, my
45:54
business is a certain business and to us here's a certain data
45:59
element that is not important to anybody else in the world.
46:03
So you haven't figured out this use case.
46:05
This is specific to me. I want to have my product build
46:10
that into the risk score, which I'm assuming is part of a model.
46:14
So my question to you is like as a customer, do I have any
46:19
influence over how that model works or is it a black box to
46:25
me? It's a great question.
46:26
So I think the answer is in it depends.
46:30
We are, we do have certain tunable parameters that you can
46:34
influence to adjust the model. Having said that, we will be
46:39
looking in future where in your case you know as a customer
46:44
based on your data, these are the kind of models that might
46:48
make sense. And maybe you already have
46:49
developed the model and you are asking can you use this model
46:53
for me for example. That is something that we we we
46:57
were looking at potentially in the future.
47:01
The way we think about this is the following.
47:03
We cannot be the be all end all, of all the risk calculations and
47:07
all threat detection and so on. We build the product with doing
47:12
some of that on our own and ability to inject external
47:15
threat signals or external any kind of signals, risk signals
47:18
into Andromeda, right. So the product is built with
47:21
that capability. I'll give you a specific
47:23
example. Let's take an example of an EDR
47:25
and XDR solution. We're never going to be, we are
47:29
not an XDR solution, but XDR solutions have powerful signals
47:33
on devices and locations. Can that be inserted into
47:36
Andromeda? Absolutely.
47:37
That's something we'll do because the ultimate goal,
47:40
remember what is our core? Our core is permissions, right
47:44
sizing, automating permissions and life cycle, right?
47:48
So for example, if there is an external threat signal that says
47:51
this identity is compromised, we can near real time bring all its
47:58
permissions down to 0 and make all the JIT approval, the
48:02
privilege access go through multiple gates.
48:05
That is the power of Andromeda. That's the ultimate, which is
48:08
it's not if it's when you'll get compromised, but when you're
48:10
compromised, can you eliminate the attack surface as fast as
48:13
possible? Yes.
48:14
And that's where we shine and that's where we differentiate.
48:17
So I know I answered your question in in in a couple of
48:21
different ways. But to summarize, we have some
48:24
tunable parameters for risk models.
48:26
We will enable some more, but we are open to taking additional
48:30
signals, external signals into Andromeda to make more
48:33
intelligent decisions. Yes, that's the goal I love.
48:36
It I love it. I love your passion.
48:40
I think what makes identity companies go to that next level
48:45
is having somebody like yourself who's passionate and very
48:49
intelligent and a deep thinker. I wanted to ask two more
48:54
questions before we take it out. So 1, you mentioned earlier that
49:00
you set up a landing page. I'm sorry, Jeff may have
49:02
mentioned it. Andromeda security slash IDAC.
49:06
That's where people can go to get more information.
49:09
What, what will they find there? What are you going to have as
49:13
that landing page? Great question, Jim.
49:15
So it's it's an offer for a free discovery, risk coding and
49:21
permissions rightsizing. What does that mean?
49:24
We will, as part of this offer, give you full visibility, full
49:31
discovery of all your human. That's the relatively easy part.
49:34
But non human identities as well in a single dashboard give you a
49:38
three-part risk of each of those identities.
49:40
So you know which identities are high risk and why with built in
49:44
recommendations and remediation steps and right size the rolls
49:48
for you for all of those identities based on its activity
49:52
pattern and risk. That's the offer.
49:55
I love it, I love it. Final question to take you out
49:58
from the the hard part and then we'll do our lighter note.
50:01
So you're on the identity at this linear podcast and a lot of
50:06
our guests always wind up and accidentally falls out of
50:09
people's mouth, you know, because identity is at the
50:11
center. So when you first heard about
50:14
our podcast, relate that back to Andromeda security in your
50:18
platform identity of the center, what does that mean to you?
50:22
No. It's, it's very relevant.
50:23
I think I mentioned in the top of the podcast like identity is
50:27
at the center of security today because I think depending on
50:31
which you're 2320, four 2/3 to 3/4 of all attacks are related
50:35
to identity one way or the other, right.
50:38
So especially in cloud and SAS then there is no physical
50:42
perimeter. Identity is the perimeter and
50:44
your tax surfaces is the list of permissions you have.
50:48
So it's very, very relevant. So when I heard IDIC for the
50:51
first time, I said, wow, that's so true.
50:54
I, I don't think you started it when identity was the primary
50:57
attack vector, but that's where we are right now.
51:00
So we had. Plenty of foresight.
51:03
Yes, and. Luck.
51:06
Yeah, No, we knew it. Come on, Let's let's let's.
51:09
Help ourselves on ships like. We knew it was at the center.
51:12
We bought the domain name, trademarked it, copyrighted, all
51:15
that good stuff. So yes, we you're preaching to
51:18
the choir here. We feel like identity center.
51:20
That's why we named it show as it is.
51:24
All right, Jim mentioned. Like that's the hard part.
51:26
Now it's the even harder part where we talk about ending on a
51:30
lighter note, something that is, you know, maybe not identity
51:32
related or maybe it is, I guess, depending on how you look at it.
51:35
And we were kind of kind of spawn ideas for on this and I
51:38
kind of settled on this idea of books on tape.
51:42
And that's how old I am tape, right, Everything's recorded and
51:44
how etcetera. And we were kind of talking
51:46
about a couple of different sci-fi things that we were into
51:49
and stuff like that. You had a recommendation.
51:51
So I want to give you an opportunity to sell your
51:54
recommendation to everyone else, because you sold me on it.
51:56
And it's in my Audible queue waiting for me for my next
51:59
flight. And then I'm going to give a
52:01
recommendation. And then Jim's going to yell at
52:03
us, you know, from his porch, you know, saying get off my lawn
52:06
or something like that. Yeah, definitely so.
52:10
Before I give my recommendation, I think I got into listening to
52:13
books When, when I I love reading books, but I don't have
52:17
time. But when do you have time?
52:19
When you're commuting? And so that's when I got into
52:23
the books and then COVID hit. So when when we started working
52:27
from home, so I had to find time to commute.
52:29
So I can listen to the books, right?
52:30
But I got into the books a few years ago and I wanted to do
52:34
something that's not tech related at all.
52:36
Still intellectually stimulating, but nothing to do
52:39
with identity, nothing with cloud, nothing with tech.
52:42
And so I got into sci-fi and the best book I have listened to is
52:48
the Project Hail Mary by Andy Ware, same author who wrote
52:52
Martian and a couple other books as well.
52:56
But I highly recommend that book not to read, but to listen to.
53:01
Because if you see the book has not been read by, it's been
53:03
performed by, they've actually done a full production in a
53:06
studio with different accents and different dialects and
53:10
different sound effects. So highly, highly recommend
53:14
Project Hail Mary. So that's my recommendation.
53:17
You sold. Me on the performance then,
53:18
because I've listened to, you know, several audio books and
53:21
you're right, they're usually someone reading and it's usually
53:24
one person you know, and hey, more power to them.
53:27
They're trying to do different voices maybe sometimes and
53:29
things like that. It's like, OK, but you know, if
53:32
it's a full on production, sign me up.
53:34
I'm in and I'm a big sci-fi guy, so you know, this is kind of
53:36
right up my ally. I was like, all right, sheesh,
53:38
you got me downloaded. I'm in.
53:41
So I had a recommendation for you.
53:42
Now it's not produced, like you said, it is definitely someone
53:46
reading, but I think it does a good job.
53:47
And I think the story is, you know, at least from my mind,
53:50
very original at the time I read it several years back, but is
53:53
becoming, I think a little more relevant.
53:55
And it is a it is a series called, they call it Baba Verse.
54:00
And there's five different books and you can certainly listen to
54:03
them as well. We are legion.
54:05
We are many and kind of something that, you know, other
54:07
things like that. And the whole idea is basically
54:10
AI is sort of at the center of this conversation, but it's a
54:15
little more human type approach to it.
54:18
And I don't want to spoil it because they're really it really
54:20
does kind of pick up pretty quickly And then sort of like,
54:23
oh, you know, there's a lot going on here.
54:25
But I have my recommendation is Bob Averse.
54:27
It's by Dennis E Taylor, the 1st in the series is We are Legion.
54:30
It is my go to recommendation for anybody who is a sci-fi
54:34
junkie, you know, like myself. So hopefully people will check
54:38
that out. Jim, how about yourself?
54:40
Do you have any E audible, you know books on tape or you know
54:47
other recommendations? So I've had Audible accounts
54:50
over the years. I am not a sci-fi junkie and I
54:53
was reminded of that over the holiday break when I admitted to
54:58
my son that I've never seen any of the Harry Potter movies.
55:02
I don't. I'll make it a I'll admit to
55:04
I've never seen one either. And that might really, but I've
55:06
never seen one and I just don't have the interest either.
55:08
Lord of the Rings, give me, give me that.
55:10
I'm all in. But Harry Potter, not my gym.
55:13
As you could probably expect, I've never seen any of the Lord
55:16
of the Rings either. But I mean, this floored my son
55:20
and I was surprised he was a Harry Potter Potter junkie.
55:23
But you know, my, my overall recommendation is, and you've
55:27
heard me use this term a lot, Jeff, you need to sharpen the
55:30
saw. And to me, that's all about
55:34
getting outside of your normal zone.
55:37
I remember I had a, an Audible subscription to Harvard Business
55:44
Review and it's dry, it's pretty boring, but it gets you thinking
55:49
about the way the organization runs and a lot of articles on
55:55
strategy and you know, heck, now what we do is we help our
55:59
clients build their identity strategy and be able to align
56:04
that to the business strategy. I think it's so key.
56:07
So if you're not staying sharp, you're using old ideas, then
56:13
you're not going to be able to remain relevant.
56:15
You can take breaks year at a time, 2 years at a time.
56:19
You start taking five year at a time, breaks of continuing your
56:23
education, continuing to sharpen the saw.
56:26
You're going to be irrelevant very quickly.
56:29
You're. Always sharpening the saw I
56:31
need. I need a break, you know.
56:34
Here's the $1,000,000 idea is someone should write an
56:37
engaging, you know, story style approach that weaves in some of
56:42
those things. I know there was one.
56:44
I can't remember it. It's like an IT book that's
56:46
pretty famous, and it's the. Phoenix project or something
56:49
Phoenix? Project I need to see more
56:51
Phoenix Project style books where it's a story and it's, you
56:54
know, it's weaving in little parables along the way, you
56:58
know, that people can kind of get into then you sign me out
57:01
and then Ashish. We do like a full production of
57:03
it with like sound effects and, you know, different cast, voice
57:07
cast and things like that. Like I need to see more of that
57:11
in my sharpening the saw. You know, I think there's more
57:15
money in writing a book like Harry Potter.
57:17
Who? Knows, I mean, you know, you
57:19
were right. The identity at the center,
57:22
audio drama. I mean, that's what we produce
57:24
basically every week. Yeah.
57:27
All right, let's go ahead and leave it there for this week.
57:29
Ashish, thank you so much for joining us.
57:31
I'm going to have a link in our show notes for people to check
57:34
out Andromeda. It's Andromeda
57:37
security.com/idac. Take advantage of the offer that
57:40
Ashish mentioned that I think that sounds pretty awesome.
57:42
And then all the link also to your LinkedIn profile so people
57:45
can reach out if they have questions and things like that.
57:47
But thank you so much for joining us.
57:49
Any parting thoughts before we wrap this up officially?
57:52
No. Thank you for having me.
57:53
This was a fun and engaging conversation and I'm glad we are
57:58
all trying to solve the hard identity security problem in A
58:01
and and and having some fun doing that.
58:03
So Yep, looking forward to more fun coming up we.
58:07
Try to have fun, sometimes it works, sometimes it doesn't, but
58:10
we'll leave it there for this week.
58:11
Thank everybody for watching and listening.
58:13
You can find us on the web, idacpodcast.com, reach out, ask
58:17
questions, engage either on YouTube or podcast or LinkedIn
58:20
or wherever you find us. We always appreciate that.
58:22
So with that, thanks everyone again for listening or watching,
58:26
and we'll talk with you all in the next one.
58:29
You've been listening to Identity at the Center.
58:33
We hope you've enjoyed the show. Make sure to like, rate and
58:37
review, and we'll be back soon. But in the meantime, hit the
58:40
website at identity@thecenter.com.
58:44
See you next time on Identity at the Center.