Latest / Identity at the Center / #431 - Tectonic Shifts in Identity Security with Martin Kuppinger

Transcript

#431 - Tectonic Shifts in Identity Security with Martin Kuppinger · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity of the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:14
Not so bad yourself. Doing great Hey, we're here at
0:16
EIC 2026. We've got the guest that we've
0:21
all been waiting for. The manual requires no, it's
0:24
your, don't you? But it's.
0:25
A1 anyway. It's a podcast, right?
0:28
Yes, it is. Yeah.
0:29
So we're at EIC in Berlin. This is our second year here,
0:32
another amazing conference. We've done a couple episodes
0:34
like this. This is, I think, the last
0:36
episode that we're released as part of our journey here and
0:40
some of the conversations. But yeah, let's welcome our
0:42
guest, Mr. Martin Kupinger from Kupinger Coal.
0:45
Let's say founder and distinguished analyst.
0:48
Hopefully I'm getting that correctly.
0:50
OK, So what does it mean? Let me ask you a question kind
0:53
of off the cuff here. So what does distinguished mean?
0:55
Distinguished Analysts. It means that I will focus more
1:00
on the thinking about France influence and trying to
1:06
influence the industry. Clearly there's a lot of
1:09
networking stuff, speaking with some, some advisory, more
1:14
strategic stuff overall than day-to-day business.
1:18
So that that is basically the shift being in that business for
1:24
more than 20 years. So stepping a bit back from the
1:29
frontline or to a different frontline sense because it's
1:32
really still a lot of visibility.
1:35
So that is the the change behind that.
1:37
Sounds like fun. How's the?
1:40
Yeah, I guess we'll find out right in real time.
1:42
So from your perspective, how many, how many times has this
1:46
conference been in play? It's #9.
1:49
Number 919, OK. And So what is something that
1:54
you think for people who haven't been able to come out here and
1:56
be part of this, like, what's something that they should take
1:58
away from those conference? I know we're gonna get into like
2:00
AI and fabrics and things like that, but why should people be
2:04
coming out of this conference? I think, you know, we in the
2:07
early days we had a tagline I still would love to see again,
2:11
which was so leadership and best practice and I think this
2:15
describes this event very well. So we focus on identity,
2:19
everything around identity cloud being quite important again
2:25
these days when it was all the debates around sovereign cloud.
2:28
And the related topics are the identity security thing, AI
2:30
security, data security, a lot of privacy following the
2:34
decentralized identity UDI wallet stuff since it exists or
2:40
since people started thinking about it in a way.
2:43
So this is really focused on certain topics with a lot of
2:49
solid leadership talks, but also a lot of best practice talks
2:53
from people from their projects and how to do it, how to make it
2:57
work. And I think this combination is
2:59
good. And we have a very dense
3:00
program, so up to 6 tracks in parallel, which means there's
3:06
something for everyone at every time.
3:08
We also have a lot of really networking opportunities, long
3:11
breaks, the great area outside of the venue with the food,
3:15
drugs, etcetera. So it's very interactive as
3:18
well. And I think this makes a
3:19
difference to many of the other events that exist.
3:24
Yeah. It's a very well run event.
3:26
So I can appreciate that. You know, we think with the
3:28
number of conferences we tend although too I think the
3:30
intention is always to like, OK, what we make next year bigger,
3:34
better, more efficient would it be, but it's it runs with very
3:37
good efficiency. The biggest problem that I have
3:39
with this conference is that there's too much good content,
3:42
so I have to choose, you know, which ones to go to.
3:44
I have taken advantage of the stream more than I thought that
3:47
I would have then I could think compared to last year.
3:50
So hats off to that. If people want to view the
3:53
content later, this is available for attendees, but it's also for
3:55
members. Yeah, exactly.
3:57
And that means if there are two or three things happening in
4:01
peril that you find interesting, you can always say, OK, I'll go
4:05
to this and then I look this one or this one later on in the
4:10
recording. So we make it all available
4:13
streamed and we recorded. And I think this is a Berlin
4:16
advantage. So let's talk a little bit about
4:18
your keynote and you talked about the idea of of AI acting
4:23
decentralized and autonomous. And this idea of a centralized
4:27
identity maybe isn't the way to go, at least maybe not specific
4:30
for agentic or NHI or workload, whatever we're calling non
4:35
humans. You know of our cohesive term.
4:38
Tell me a little bit about that that item.
4:41
And you know what's driving you with that mindset?
4:44
So maybe to just COVID even a little bit bigger.
4:48
We had pre conference workshops on the morning of first day,
4:52
very well attended. I think we had some more than
4:55
200 people in the room, a lot of people standing around tectonic
5:00
shifts that AI brings to identity and security.
5:06
And part of that is when we look at the air chantic AI that you
5:10
have these agents and these agents act rather autonomously.
5:17
So it's not that we have the same level of control as we have
5:21
in a traditional, for instance, workforce identity management
5:25
where we know these are our people and they have certain
5:30
types of access. This is not happening anymore.
5:32
It's, it's really autonomous, distributed, fragmented.
5:36
I think they are applying the decentralized identity thinking
5:40
can be extremely helpful here. Instead of saying, OK, we try to
5:44
to do traditional whatever LDAP stuff for agents, we should go a
5:48
bit, a little maybe over the top.
5:50
But this is I think not the, the thinking that can work in the
5:53
world that is way more volatile, dynamic, fragmented, partially
5:58
ephemeral when you look at the lifespan of certain of these
6:02
things. And so we need to to take a
6:04
different rule. I think this is behind that.
6:07
And we at the end, what I'd like to to trigger is that we really
6:13
do apply quite some shift left thinking and understand that
6:19
this is a very different in probably a more complex
6:26
challenge. I would even dare to say of all
6:28
the 35 plus years I'm an identity and security.
6:32
It's probably the intellectually most fascinating challenge I've
6:37
seen over all these years. So there's so much changing
6:41
because simply said, you know, we are used to say whatever
6:45
Martin or Trav or Jim, they have access to SAP.
6:49
That is directed Trav to SAP and it's deterministic to SAP.
6:57
Right now we have a situation that we do something that
7:03
triggers an agent that may trigger other agents that end up
7:07
at some resource service and the resource server not even have an
7:11
idea about which agent will knock on their door the next
7:14
minute and why. So it's non directed and it's
7:19
non deterministic by the way in in more than one meaning, it's
7:22
non deterministic because we don't know where it ends.
7:24
It's also non deterministic because if we have the next
7:27
version of the LLM, it may do it differently even with the try to
7:32
do the same thing. And that means it is a really
7:36
very different the way we need to do identity access and access
7:40
now than everything we did in the past.
7:45
And This is why I said, OK, it doesn't probably, I don't see
7:48
that it can't work just to try to use the same concepts from a
7:54
centralized identity world, the same standards, the same
7:57
principles to apply them to something which is different,
8:00
which is more autonomous or in a sense decentralized.
8:03
I think it's very worse to look at the stuff we developed around
8:07
decentralized identity, etcetera and, and think about where does
8:10
it fit? Where can it also maybe
8:12
complement things like O of etcetera to so to enable us to
8:17
solve this fascinating challenge, do you think?
8:22
So you think how I want to phrase this, So you talked about
8:25
this being one of the most momentous shifts in in your
8:28
career. I can certainly agree with that,
8:30
right? It's it's a huge shift from a
8:33
speed perspective. Where do you think we are from
8:37
really understanding what the problem is to actually getting
8:41
into a state where we feel comfortable from a governing
8:45
standpoint, especially when, yeah, a jet tech identity is
8:48
very hot, obviously. And you're talking about E
8:51
gentic networks inside of E gentic networks inside of E
8:54
gentic networks and so on, right?
8:55
It's like inception. You're going downwards through
8:57
these things. Are we at a spot where we think
9:00
that the pace of our thinking to address this, the pace of
9:05
vendors trying to figure out, OK, what are the solutions that
9:08
we think we can put in place to help their customer, things like
9:10
that. But I'm curious, like from a
9:11
speed perspective, where do you think we are?
9:13
We're moving too fast, too slow, about as best as we can do.
9:17
And as fast as we can do. But so, so behind that, I think
9:23
that the the one point is so when we take the clouds, this
9:28
was a very fundamental paradigm shift, which took years and with
9:37
quite some peaks and evolution, but it was a very long term
9:41
thing. During the pandemic, we had
9:44
certain things that needed to happen much faster.
9:47
Right now it's even faster and it's way, way more disruptive.
9:51
So this is a situation we are facing.
9:55
Are we lost? No, I think we can handle it.
9:57
We will learn. We need to understand what we
10:01
can do with what we have now tactically, but also work hard
10:07
on sort of delivering the more strategic, more comprehensive
10:12
approaches because some of the things like this apply
10:16
decentralized thinking will not be something we do in the next
10:19
two weeks that will take us a little longer, but we also need
10:22
to act now with technical measure.
10:25
We can look at us a little bit more in detail later on.
10:29
For, for the speed thing, I think what was interesting, just
10:32
anecdotal when we, so we did decided to do this pre
10:37
conference workshop roughly 10 days ahead of EIC.
10:42
And that was when I said I did one or two talks at at Wendor
10:47
events about the changes a identity and AI security bring.
10:54
And we need to think about it. I had 10 fundamental changes
10:58
back then when we started, we had the workshop 15 already a
11:05
few days later plus we had a backlog of I think nine others.
11:10
I would say the speed will will go down a bit.
11:13
So I think we are, we're getting closer to an understanding,
11:18
which at least means we have probably understood the most
11:22
aspects roughly the detail work still to be done.
11:26
But I think we're getting closer in the conversations to have a,
11:31
a good picture of what we need to do.
11:34
So when I go back half a year, I did roughly half a year maybe I
11:39
did a podcast with Patrick Harding, the CTO of Ping
11:42
Identity. It was or it was LinkedIn life.
11:45
And since then I think I have learnt an incredible lot of new
11:51
stuff and understanding and ideas.
11:53
But it's still so literally all of my business conversations
11:58
include AI and in many, many of these I still detect new facets
12:08
of this challenge that needs to be considered.
12:11
So it's, it's still a moving target, but we are getting
12:13
closer. And as I've said, we also I
12:16
think can do some things tactically now and we must do to
12:20
act. But it we also need to to speed
12:23
up things to to solve it more fundamentally strategically
12:29
rather fast, because The thing is moving very quickly.
12:34
I like Jeff's question about distinguishing our list because
12:36
I think the analysts takes a lot of information, does pattern
12:41
discovery and then helps people understand what's going on in
12:46
the industry and where things within the track are heading.
12:50
But I think use the word the term influence, right?
12:54
You're actually influencing. So last year you're talking
12:57
about identity fabric, this year you talked about AI security
13:02
fabric. And I think it was like, you
13:05
know, horizontally oriented, if you will, identity on
13:10
governance, explain ability and behavioral.
13:14
I got that right. Not, not exactly I think so the
13:17
fabrics all of them have a have a structure basically of The Who
13:23
to what and in between. At the center there are
13:25
capabilities you need services you, you then build and tools
13:31
that deliver this and for the AAI security fabric.
13:36
So, so the identity fabric, I think we brought it up in 2018
13:39
or so. Back then I, I at least started
13:43
my keynote with a slide from from the EIC 2019 where I had
13:46
the three main themes of EIC 2019, which were decentralized
13:50
identity, identity fabric and AI back seven years back.
13:56
So maybe a bit the trancing sometimes.
14:00
And so the, the, the, the AI security fabric, what we see
14:06
there is AI identity service giving identities to agents at
14:11
the intersection of AI and identity, AI security, safety,
14:16
governance and explain ability. These were the five capability
14:20
sections, the blocks of capabilities we need to look at.
14:23
We will underpin this with a reference architecture.
14:25
We go down more into detail in the building blocks and some of
14:28
them we have at a certain maturity level, some at a little
14:33
bit more mature level, some probably in the early stages,
14:36
some almost lacking still. But that will be the top of the
14:41
industry to deliver on that. And that that gives them a
14:44
guidance on what we need, which pieces of the puzzle we need to
14:49
deliver the full, so to speak, AI security picture over time so
14:55
that we can protect this fast moving complex and super, super
15:00
important and lots of business super helpful and powerful world
15:03
of Atlantic AI and such non Atlantic more traditional AI.
15:10
Yeah, it's interesting. You've run up Patrick Harding
15:12
and he's been on the show a few times.
15:14
I think he was one of the the first people to talk about the
15:18
importance of AI and I on our show anyway.
15:22
And now it's like we can't go in that episode without talking to
15:25
you about it, but you're kind of building these frameworks to
15:30
think about it for other people to organize their, their maps
15:35
around which that was my point on the distinguished analyst
15:38
piece. But what I was wondering, so
15:42
the, the different pillars that you mentioned, you talk to a lot
15:45
of identity leaders within their organizations.
15:50
Are there certain ones of those pillars where organizations tend
15:55
to be more strong, need to put more, you know, either they're
16:00
good or they need to put more emphasis where, where are the
16:04
strengths and weaknesses in terms of organization or do they
16:07
they need to grow in all the areas?
16:09
I think they need to grow everywhere.
16:10
I think what what are the common understanding with most of the
16:15
the practitioners is, is that there are some logical starting
16:20
points where we can or they now can get a grip on the entire
16:24
thing. And the one area to start with
16:27
obviously is discovery because we can't protect, we can't
16:30
govern what we don't know. So we need to get good on
16:33
discovery, which is not super easy, the discovery thing,
16:37
because we need to have discovery at quite a lot of
16:41
different places. So that might be the platforms
16:43
where we build actions on, but it might be also the browser,
16:46
the endpoint, the network. So we need to gather data from,
16:49
from, from different sources to bring it together to have an
16:53
understanding of what exists, what is managed, what is
16:56
unmanaged. If it's unmanaged, is it still
16:59
something which is good or is it malicious?
17:02
All that stuff. We, we, we need to.
17:04
So the discovery part is the one and this is where we can act.
17:06
And I think where we see by some evolution also from a truth
17:11
perspective. The other is the other side of
17:15
the edge, so to speak. So here we are the user and then
17:18
to the agents to discover the agents and then the agents go to
17:21
resources maybe via an MCP server.
17:24
And this is in in a sense the edge where we have a bit of a
17:27
control point. We need to to be clear about
17:30
that. This is if you do MCP server
17:32
authorization where we see a lot of vendors starting to offer
17:36
something around. This is definitely just the
17:38
first step. First, we have also some direct
17:43
resource access. We have not only MCP servers,
17:48
but in a way MCP server authorisation is a little bit
17:53
like what's CAA Sidebinder brought to us in the year 2000.
17:59
So we have a layer in front and we say, OK, we do some in that
18:03
case authorisation, very coarse grain and then you, we pass it
18:07
by. We need to work hard on going
18:09
really into the back ends because there's something behind
18:13
the MCP server and we must not forget that.
18:15
And this is the definitely the the more challenging, more
18:18
difficult thing to solve. But still, better start there
18:22
and do something than do nothing.
18:27
I think you're right and thinking organizations need to
18:30
focus on all of it. I wanted to pick on two things.
18:32
One was governments, because I've actually heard of some of
18:35
the big American banks where they were actually telling their
18:40
employees showing to only use an older version of the model
18:43
because that's what we've tested.
18:45
And it's like, I'm afraid of, you know, hey, we need to govern
18:49
this thing and we're going to do it in a way we don't know what
18:51
we're doing. So we're going to take old
18:54
models of governors and applied to this new technology and stunt
18:59
your Grange or stunt the growth of our business.
19:01
So I want to get your comment on that.
19:04
The other area is to explain ability.
19:06
I feel like identity 20 years ago as a practice of taking what
19:11
could be done with paper and pencil or Excel spreadsheets and
19:16
who gave access to this person or who logged in at this time
19:20
and tried to automate it right. Well, now it's happening so fast
19:25
and the volumes are so high does and AI potentially is making the
19:30
decision. So explain ability seems like
19:33
such a bigger challenge and probably I don't most I have
19:38
leaders hands maybe by explain abilities.
19:41
Just make sure that you don't forget that.
19:43
Make sure that your system was not making decisions that you
19:46
can't explain to a judge. Yeah.
19:49
So, so I think 222 huge and super fascinating areas.
19:52
So on the governance side, I think banks clearly are are a
19:55
bit of a special kind of beast in the sense of they have the
20:01
the biggest audit pressure. They also have the most mature,
20:06
usually the most mature governance approaches and risk
20:09
controls, etcetera. So I also hear it from from
20:13
European Caesars and, and, and leaders that they say, OK, we,
20:17
we are relatively restrictive. We run our own instances of
20:22
certain models in a controlled manner and you're only allowed
20:26
to to use these. So being very restrictive, I
20:30
think there's obviously a risk of still things going wrong and
20:36
someone bypassing it. I think this risk must have to
20:39
be underestimated. But I think that that makes
20:41
sense in a in in such an environment.
20:44
On the other hand, we clearly have in many, many areas the
20:46
situation of how can we move fast, how can the business
20:50
evolve fast? How can we use it for whatever
20:53
improving our speed and development of solutions and
20:55
whatever else optimise business pros, etcetera.
20:59
And still, I think it's important to understand, and
21:04
this goes all the back to discovery.
21:05
What do we have? What made us be allowed to do
21:08
and and how do we contain stuff? How do we keep it under control?
21:12
I'm for instance, wasn't and then, of course, into safety.
21:15
I'm not a big threat friend of the a lot of people then say,
21:18
oh, we need this ancient kill switch.
21:22
The kill switch is always is the last resort because you don't
21:26
know necessarily whether this is a super important ancient
21:31
effort, the function of the business.
21:34
And so better thinking containment in potential
21:39
isolation and slowing things down until you human the loop
21:43
could check it or stuff like that.
21:45
So I think we need to be careful.
21:47
So, but governance is is the logical starting point.
21:50
As I've said, it starts with understanding what we have for
21:52
this managed unmanaged, what's the purpose?
21:54
And then we will need to do a lot of things over time by under
21:58
setting proper guardrails, delivering that information with
22:02
the agent, having an agent lineage to understand the entire
22:06
chain of agents and humans and workload identities and all the
22:09
other stuff that comes into that.
22:12
As I've said, I'm not a big believer in the term non human
22:14
identity. I used it for a while, but I
22:16
never was 100% convinced. And in my keynote I proposed
22:20
maybe we think more about autonomous identities like
22:22
humans and agents versus dependent identities like
22:26
workload identities or IoT identities etcetera as a better
22:30
abstraction because yeah, the the non human is not not precise
22:37
enough from my understanding. Anyway, back to your question.
22:41
The other aspect is explain ability.
22:44
And I think this starts with. So we need to have the
22:49
understanding partially also from a legal perspective, from a
22:52
regulatory perspective of what, why was a certain decision made.
22:57
We have this in the traditional, so to speak, analytically, AI,
23:00
et cetera. We we already have this in
23:02
certain regulations, whatever price finding or is credit
23:07
scoring, stuff like that where, where this explainability is
23:11
required. And I think the the first thing
23:14
we will need is are a really immutable locks, the standard
23:18
for immutable locks so that we can trace what happened.
23:23
And so the traceability in effect is the foundation for
23:27
explain ability. And it's even more important in
23:30
this world of fast moving language models, be it large or
23:37
special as small language models.
23:39
I don't really believe that large language models will be
23:43
the normal. I think they are more the
23:47
standard tool for when you don't have a better thing.
23:52
Over time, I think this would change rather quickly because
23:54
LLMS are far too expensive from a compute cost perspective,
23:58
etcetera, and they're just inefficient.
24:00
So at the end of the day, I think we will see a clear shift
24:03
to, to, to, to specialized to small or language models with
24:08
lesser overhead, with better understanding and also better
24:12
training. You can also do some of this
24:14
security aspects much better. So I have in my, my governance
24:17
list, I have the learning governance.
24:19
So how do you ensure that things are learned that should be
24:23
learned but others not that shouldn't?
24:28
Retrieval augmented generations of RAG isn't the answer on that
24:32
Because this is black white. Either you learn or you don't
24:34
learn. Doesn't make sense.
24:36
If you have an SLM you own, then you can learn and then you also
24:40
have a lot of advantages for the explainability because it's your
24:43
model and you know what it does. So I think that will be also
24:46
part of the evolution we are seeing on, on, on various
24:50
fronts, on various areas, but it will definitely remain super,
24:54
super interesting the next couple of months.
24:56
And just when we think we've figured it out that it will.
24:58
Change, probably, yes, I think. But you know, isn't that what we
25:04
had an identity for decades? You know it's not.
25:06
A new problem. I remember when we did the first
25:08
EIC and that was in a market where there were maybe 50 or 80
25:12
vendors back in 2007, someone came to us and said why do you
25:17
do a conference for such a small market?
25:22
Right now we have truly not way north of 1000 vendors in this
25:28
identity security space without a specific cybersecurity
25:32
vendors. I think if you count them, we
25:34
are someone counted 12,000, be it 6 or 8000.
25:38
But it's a huge market. And one of the things that was
25:43
fascinating also in retrospective to me is when you
25:48
think it's calming down, it's settling, then the next big
25:53
evolution happens and that that is the case for the last 20 or
25:57
25 years always. Then do you think, OK, right now
26:01
we have a quite stable situation, Then workload
26:05
identities pop up or a identity pops up or in earlier times,
26:10
whatever. Then the Sovereigns X flags came
26:13
in into effect and we had access governance which changed meta
26:18
directories and user provisioning fundamentally and
26:21
so on and so on and so on. I feel like it's waves in the
26:24
ocean, right? There's periods of calm and then
26:26
something comes along that kind of breaks the surface.
26:29
OK, Right now everyone is, I don't say freaking out, but
26:33
let's say freaking out of OK, how are we going to control
26:36
these non human agentic workload, whatever we're going
26:38
to call them, right? But it's because it's relatively
26:41
new. The problem isn't new.
26:43
What's new is the scale of it and the speed with which these
26:47
things are proliferating. And so you end up in this kind
26:49
of race condition of OK, how are we going to catch up?
26:52
I. I I would say in this case we,
26:54
we probably maybe the first time we have something where the
26:57
problem is new because as I've said, this mesh of age and this
27:01
non directed, non non directed, non deterministic thing is
27:05
really something which is is different.
27:07
Interesting, so you think this is a new problem?
27:09
This, this, I think it's a new problem, yes.
27:12
It's not just the old problem on steroids, It's a new problem.
27:18
I I would say it's clearly there are things which are similar to
27:21
the old or the the known problem.
27:24
So the workload identity that was basically just an.
27:30
Like a service account? Yeah, it, it was something we
27:33
knew, but way more of these lesser control structures and,
27:39
and and different way to handle it, different parties involved
27:43
etcetera. But there wasn't that much
27:46
really fundamentally new in it right now.
27:51
As I've said, there's there's a lot of things which change
27:53
fundamentally. Clearly we could always say we
27:56
still need whatever behavioural analytics, but it's, and it's
28:01
just right now multidimensional and that's unidimensional.
28:04
So traditionally we say, OK, this is Martin's behaviour and
28:07
we detect anomaly. Right now we see the agent.
28:11
But if the agent works for you and then for me, we can't say
28:15
this is the correct agent behaviour because you may do
28:18
fundamentally different things with the agent than I do.
28:21
So it's more, more than one dimension.
28:24
And all these things sum up to something where I would say it's
28:26
a, it's really a probably more than a bigger dimension.
28:32
It's probably more a new dimension than a bigger
28:34
dimension. So the way I think about this is
28:37
the reason I don't think it's necessarily a new problem is
28:39
because it's a combination of existing problems with different
28:43
facets. So we've got, let's just break
28:46
it down into human and non humans just for simplicity.
28:48
Right now, humans and their behavior is not patterned.
28:53
There might be some loose patterns, but for the most part
28:56
they act in a variety of different ways.
28:58
I might log in from one thing, I might access the other
29:00
application, etcetera. A service account traditionally
29:04
is extremely repeatable, right? Service can't exist to connect A
29:08
to B and that's all it does. Trust some database core.
29:12
Exactly right. So it's doing whatever it needs
29:14
to do it's plumbing. When we talk about non human
29:17
identities though the behavior of a non human identity is much
29:20
close. Well, depending on the the non
29:22
human identity is can be much closer to a human behavior
29:26
pattern than a non human or a traditional service account.
29:29
And so that's why I don't think it's necessarily a new problem
29:31
is what we're doing. We're saying, OK, we've always
29:33
had a problem of trying to figure out what does behavior
29:35
look like for humans. We have some tools that will
29:38
help us to kind of determine what that looks like for a non
29:41
human. We're still establishing what
29:45
the behavior looks like. But if I say, OK, like the
29:47
example we were using where I have an agent that we both
29:50
share, isn't that any, how is that any different than a admin
29:54
or an analyst that we would both share?
29:55
We're both giving them different directions.
29:58
So if a human was performing that task, they would still be
30:01
acting in a way that's like, OK, well, I'm not quite Martin, I'm
30:03
not quite Jeff. I'm doing a little bit of.
30:06
Both. If you take a travel agent that
30:08
books travel for you and for me, your travel preferences might be
30:11
very different than my travel preferences.
30:14
But a good agent and a good admin would know what those
30:16
preferences. But but but but but for it, it
30:20
may learn it. And when we observe it, we still
30:23
need to understand who, what who is TH acting on behalf of which
30:29
is there? There are there's more than that
30:31
one dimension to look at. When we have whatever Linux
30:34
admin and you're using the same root account than me as me, then
30:41
you still do a certain. So if it's when, maybe it's not
30:44
the root account, but a more specialised backup.
30:47
So, so you do a backup, I do a backup.
30:50
There's not much room for deviations in the behaviour.
30:56
So I think it's probably a bit different.
30:59
But I, I see that there's a, the other side, you know, when we
31:02
look at it from an access perspective, we, until now we do
31:07
everything with the assumption that we know who will need which
31:11
access to which resource. And that is changing.
31:16
So there is, we can't predict who or what will ask for which
31:21
access to which resource. And so we, there's this intense
31:27
in coming in trying to, to understand the intent of, of the
31:32
query, which is a bit. So it's a backwards analysis in
31:37
a sense, probably not the final solution.
31:41
And this is really if sort of really a fundamental shift, I
31:46
believe so I, I and I think, you know, we, we, we are well
31:52
advised. So first taking tackling
31:54
measures to what we can do now, we do now.
31:57
But then we should look at how can we solve that, that problem
32:03
of, for instance, Asians acting relatively uncontrolled in the
32:08
mesh, including maybe unanimous Asian, if you have solved that.
32:11
We also have solved a scenario where we have a very purpose
32:15
build, very restricted agent, which in a sense still acts
32:18
directed and deterministic, because this is the trust, a
32:22
simple subset of the bigger challenge.
32:24
But let's wait and see where we end with this.
32:29
You throw a curveball at you, something that we've been
32:31
brought up in all is humanoid robots.
32:35
And I'm wondering do you think how far into the future we
32:40
talking about humanoid robots and the impact of humanoid
32:43
robots in identity and the humanoid thoughts in this?
32:48
I mean, does this something that because you're like a futurist,
32:51
I'm thinking this is ought to be something you thought out?
32:56
I I haven't thought about that much.
32:59
I think as of now, AI is is relatively good in a relatively
33:05
restricted use case. We are we are far away from for
33:09
instance, this is general artificial intelligence.
33:12
We're active. I have so AGI artificial
33:17
intelligence. I think this is still a long way
33:19
to go if it ever will happen. You know, when, when I was was
33:23
studying quite a quite a couple of decades ago, I read a books
33:29
from even a couple of years more ago, from the early AI saw
33:35
leaders and then it went calm. And then there's the next
33:40
enthusiasm and we we made massive progress.
33:43
But honestly, when, when we right now talk with and that's
33:47
not yet the robot, but when we talk with with a just a whatever
33:55
prompt on one of these Chinese, sometimes it's really reminds me
34:01
a bit like talking with a relatively young child and then
34:07
explain, no, not that way, blah, blah, blah, but no and so on.
34:13
Then sometimes you give up or not.
34:16
I, I think when we transfer it to human humanoid robots, I
34:21
think for, for we see them for certain use cases, we see them
34:25
for certain scenarios. We probably can combine us all
34:28
of these things. It still will be probably
34:31
somewhat restricted. And I think some of the AI
34:33
things also the smart things work when they have a very
34:36
focused problem to solve. Your assisted driving in a
34:42
vehicle in a modern vehicle that is something which works
34:46
reasonably well in most vehicles.
34:48
It's better than when they really put in enough sensors and
34:52
don't just rely on the camera and then they they really work
34:56
reasonably well. But they are really very, very
35:02
focused on a certain use case. And so building a humanoid robot
35:09
for certain specific use cases probably is anyway doable
35:14
happening today. The more that things should do,
35:20
probably the more complex is it especially I think you know,
35:23
when we look at AI today, AI is really not good in reasoning.
35:28
So this is. Yeah, it it.
35:33
It it, it doesn't understand the context, the reason if analysts
35:36
explain to it and it can learn it, but whatever if you have
35:41
have a system that analysis whatever the access in your
35:45
financial application and you start with this in February and
35:51
your fiscal year goes until December, what most likely will
35:54
happen in December, A lot of unknown things, a lot of
35:59
anomalies because your fiscal year ends that a year's end
36:03
bookings a lot of anomalies. If you let an AI look at it
36:07
untrained, then it's just anomalies.
36:11
If a human looks at it, how long will it take the human to
36:15
understand where the anomalies come from?
36:17
A second 5 seconds not long, at least it then can drain it.
36:24
But I think this reasoning, you know this, this broader context
36:27
understanding is still something which which is not not really
36:36
there and and why do we have after hallucinations?
36:41
Because something is lacking and then the system starts to
36:45
hallucinate, I think, which can be ignored in some cases, which
36:50
can go wonderful wrong in other cases.
36:53
When when it began gets public knowledge that something
36:57
hallucinated where it shouldn't. And it can be really a safety
37:00
issue. And the more we go into human
37:02
aid, robots may become a safety issue.
37:05
Yeah, so. You talk over the years about
37:10
decentralized identity and trust frameworks, and in your keynote
37:15
you kind of applied it to the AI world and they I inferred for
37:21
what you had to say that you think those things become more
37:24
important in a world with AI to get that right.
37:28
I didn't really get the first part of the question.
37:30
So talking about decentralized identity and be reusable trust
37:35
ring merits. So for decentralized identity,
37:39
my, I think we, we have have a way to to share information
37:45
about a lot of different actors or entities.
37:49
For instance, there's the DID decentralized and verifiable
37:52
credentials. So we have something that
37:54
logically fits into a world where we have a mesh of
37:58
different actors, different entities, human workload agents.
38:04
And so I think it makes a lot of sense to to think about how can
38:09
we or this is something which helps us to, to better solve the
38:16
challenges we are facing. And that, that is a bit the way
38:19
I'm thinking about it. As I said at the beginning, we
38:22
talked about this being a bit of a decentralized problem.
38:28
And then there's trust, trust this logic that it makes
38:30
potentially quite a lot of sense to apply the thinking because we
38:35
will need to deliver a lot of information to be able to
38:42
properly authorized at their resource and back end level.
38:48
So understanding my personal guardrails the the background,
38:56
so the contexts, maybe the intent, as I said is a difficult
39:00
term, the intent, etcetera, but also maybe a corporate guardrail
39:04
that comes into it. Certain restrictions and others
39:09
context information of the ages involve the entire agent lineage
39:13
and other whatever behavioural signals, fraud signals.
39:16
That means we, we may end up with whatever 50 or 100 or more
39:19
signals in a single interaction. And we need a means to deliver
39:24
them where where I feel that for instance, very fabric
39:28
credentials might be a good, good thing, maybe combined with
39:32
the OS token exchange and other stuff.
39:35
So think about how to bring these things together.
39:38
And then we need to, to, to do an authorization, which is a bit
39:41
different than the traditional way we did it because as a human
39:44
we, we may define a policy with three or four or five attributes
39:49
or signals. But when you're talking 50 or
39:52
100 or more than we probably need something that that helps.
39:56
Unfortunately, it's an AI. So we have a bit of a recursive
40:00
distrust problem where. We try to use AI to control AI
40:05
and we because we don't trust AI, which is a bit tricky.
40:09
So we end up a little bit philosophical problem, but we
40:13
still may may have a certain AI that is more the, the, the one
40:17
who, who looks at it and, and as a control instance and say, OK,
40:21
looks good, doesn't look good. So I think we can reduce that
40:24
risk quite, quite strong. And I think the other point is
40:29
the more signals we have, the more we move from a black,
40:31
white, whatever authorization approach to a gradient to a
40:37
where we can applied risk thresholds.
40:39
And the cool thing is that all the seasons can deal very well
40:41
with risk thresholds because that's what they do in any area.
40:46
So I think it can rob us from that perspective that we say,
40:49
OK, we understand that the risk level and depending on that we
40:53
didn't make a decision, then we can go back from this super
40:56
complex into a relatively static decision.
40:58
If the combined threshold is that level, then do that.
41:02
That will be mathematically quite interesting.
41:06
So. Keeps going back to this
41:09
identity verification conversation.
41:11
And I, I feel like personally I'm doing this maybe once or
41:15
twice a year. And I'm wondering as the the
41:19
technology got the head of the demand or where, where exactly
41:25
is the market you know with demand for identity and
41:30
verification technology versus where the technology actually
41:35
is? Is it the same like I think in a
41:41
sense it it might be close to identity verification.
41:43
I think there's the, the thing with, with all these signals
41:46
that also came up in, in conversations we had around
41:49
passive authentication with some people where, where you also
41:53
could argue if you have a lot of signals, then you probably don't
41:56
need to actively authenticate anymore because you have enough
42:01
that identifies you. So starting with whatever, when
42:06
I take my, my, my phone out of the, my suit, then I do it in a
42:11
certain manner and usually for some reason I hold in the wrong
42:16
direction. So I need to 1st flip it by
42:19
180°, then I swipe or do something.
42:23
And then this device already has a lot of signals.
42:28
And I think that way, yes, you, you could argue that, that we
42:31
are not that far away from that. And, and so I think we could
42:35
also argue that in a sense, there's way more identity
42:38
verification done than you feel, than you see, because a lot of
42:41
this already happens in background.
42:46
So in that, that sense, I, I would say it's this analogy is
42:51
probably quite similar and the, the, the technical approach is
42:55
quite similar. You have how do you deal with a
42:58
lot of signals to sort of know whether you've passed a certain
43:03
risk threshold or not. I want to take onto that.
43:08
Question with what does identity verification look like for a non
43:12
human identity? Is it just a simple matter of
43:15
looking at certificates? Does it get more advanced?
43:18
Does it look more like a human at some point where identities
43:22
for non humans also need to go through some sort of
43:24
verification process? Because that leads me to my next
43:27
question, which is consents. That was something that you had
43:30
a panel with Emailer and some others.
43:32
And I kind of want to talk about a little bit of sort of that
43:35
blending of identity verification for non humans.
43:39
And what does consent look like when we start thinking about
43:42
that? Is there is there a concept of
43:44
consent when it comes to a non human identity?
43:49
OK, that's a little. Philosophical, but I'm kind of
43:51
thinking here like, OK, what does this look like when it,
43:53
when Jim's AI robot watch in the room is a, is that really Jim's
43:56
AI robot? And is there a, is there a
43:58
matter of consent when it comes to that?
44:00
Yeah, I, I, I think the first thing is ownership.
44:04
So who owns the ancient? That's the one element you have.
44:12
And who is the ancient acting for that could be delegation.
44:22
So the agent says I'm doing this for Martin, I'm booking the
44:26
travel for Martin. And it could be impersonation,
44:28
which is very different, the agent saying I'm Martin.
44:32
The letter leads more to the question of in the old days of a
44:37
couple of weeks ago, we called it bot detection.
44:40
But at the end, it's not very different from that.
44:43
And but in most cases we don't need a a very specific agent
44:48
identity verification because at least when it's registered and
44:52
known and managed agent, we basically have in some way
44:57
assigned an identity. We can assign an identity to
44:59
instances of this agent. And we have ideally a sort of a
45:04
lineage which says, OK, this is the agent doing this for Martin
45:09
and these are the sub agents. And we understand how this
45:12
entire thing goes. I think it, it would be more
45:15
tricky to say, OK, what is this a new agents bringing agents
45:21
under management. I think this goes more of a bit
45:23
into the this, this field of identity verification, but it's
45:31
probably more ownership management to understand who
45:36
might be the owner and then finally bring it under
45:39
management. So I, I'm not exactly sure
45:41
whether we need identity verification in the narrow sense
45:44
for an agent or as this is more, more ownership management and
45:48
discovery, etcetera, charge. And then the second part of or
45:53
the second question was about consent.
45:58
And consent is something which is not so super far away from
46:03
intent. So we have an intent and we
46:09
consent the system or consent that the system does something
46:12
because we want to, to achieve something.
46:16
So in a sense there, there's a, there's an analysis in this
46:19
panel. It was quite interesting one
46:20
because we had as a third panelist, we had Max Schrems,
46:24
who is the lawyer who was doing all these lawsuits around
46:28
privacy finally leading to things like GDPR, etcetera.
46:32
And then we talked about basically, can we use technology
46:36
to, for instance, get rid of all these annoying cookie consent
46:40
boxes? I think you find a lot of people
46:42
in favour of that. Yes.
46:44
And and interestingly I believe we can use technology and I
46:46
think we we agreed on that. There are some things going on
46:50
and, and people like Max and Eve are much deeper into the
46:53
standards thing than I am, but there are things going on that
46:59
potentially can help us to balance privacy better in, in a
47:05
way with, with the usability or combine it with usability.
47:11
I think balancing is always a bit tricky as a term.
47:14
And so that was the part of the thing.
47:16
So what, what does it mean for, for, for an agent?
47:20
I I think it's the the concern is probably something which is
47:24
morphable on the human side of things where where it comes from
47:27
for an agent. I would better thinking
47:29
guardrails in what is this agent allowed to do or not.
47:35
That might be like if you have a travel agent, a logical
47:38
guardrail is the corporate travel policy, which basically
47:45
says we only consent in that sense to this agent doing travel
47:51
bookings that are within these guardrails, the corporate
47:54
guardrails, plus within further restrictions the human gave
48:00
consent for. I want to ask you one last
48:04
question and I want to, I hopefully I don't want to put
48:08
you on the spot. Is there anything that concerns
48:13
you, scares you about where the industry is heading when it
48:16
comes to how we're going to tackle this idea of identity
48:20
security in 20302035? I'm curious like is there
48:24
anything on your radar? I think who, like, that's a big
48:26
challenge and I'm not quite sure how we're gonna surmount that.
48:29
Or is there something else that just causes you concern?
48:32
And the reason I asked this because you're always so calm,
48:34
cool and collected, and I'm curious if there's something
48:38
behind the surface like I'm still kind of struggling with
48:40
this thing and where this might go.
48:42
Yeah, two things that scare me. The first thing is that we
48:54
oversimplify the broader AI identity, AI security challenge.
48:59
So I think we need to shift left thinking.
49:01
We need to understand the tectonic shifts, We need to act
49:04
upon it. Simple solutions may help
49:07
tactically, they may be a step on our journey, but we we must
49:12
not stop too early. This is the one thing where I'm
49:15
a bit scared that we just may fall short.
49:18
The other thing which really scares me is the incredible
49:23
weakness we have across the globe when it comes to securing
49:28
OT operational technology and critical infrastructures.
49:31
This is where I really feel that is something that is scary.
49:35
We had the book, it's right now also for a couple of years
49:37
available in English language. It was a German book called
49:40
Black Out by Mark Ellsberg. And this is a book that has been
49:44
written ahead of Fukushima and he describes an attack under
49:50
European power Critz. The scariest thing was that book
49:54
is you read it and say, OK, shit, there's some somewhat
49:58
cybersecurity expert. I have the strong impression
50:02
this can happen. This is really something very
50:05
well researched. And unfortunately, yes, that can
50:08
happen that way. And then it ends up in a really
50:13
disastrous situation. Very worse to read it from that
50:17
perspective. And we are still not good at all
50:23
in that respect. And this is I think where where
50:26
where I'm really scared that something goes really, really
50:32
wrong. OK, well, I we're going to end
50:36
on a lighter note, so we're going to bring it back up.
50:37
So a little more positive. I want to ask you what your
50:40
favorite thing about AI is right now.
50:43
And it could be anything, you know, it could be music
50:45
generation, it could be just the the value that it provides maybe
50:48
in drafting things. But I'm curious if there's like
50:50
a thing that's like, yeah, like they kind of like.
50:53
This thing assisted driving, it's assisted driving, assisted
50:57
driving. This is where I really benefit
50:58
from in my Drummond car. This is really something which I
51:03
like, you know, it's so much more safe and relaxed and it
51:10
really helps me. It's still that I'm when there's
51:14
a queue in front of me, I, my, my leg still moves and maybe my
51:17
wife also alerts me, but basically I, I trust more and
51:22
more that it works and it makes for many, many situations.
51:26
It really makes life so much better.
51:28
This is something where I feel AI is really.
51:31
Super helpful. I'm with you because I got, so
51:36
I, I drove a Tesla many years ago and the first time I turned
51:40
on sort of what they called autopilot, which is really just
51:43
lane keeping assistance and, you know, adaptive cruise control,
51:45
things that are relatively standard type now.
51:50
It was one of those events like, oh, like, yeah, this is going to
51:54
change the way people travel. The more people who have it
51:58
means now you've got more people on predictable behaviors on the
52:02
road, which means fewer accidents.
52:04
Theoretically, right? There'll always be some things,
52:06
but the more people using it, the better.
52:09
But it took me a while to trust it.
52:12
How long did it take you to not grab the wheel and try to like,
52:17
position yourself in the lane? Because I have a theory that the
52:20
way a person drives is a biometric factor.
52:24
Yeah, the point is my trauma vehicle, but when I don't take
52:30
the wheel, after a few seconds it starts alerting me and then
52:34
then starts alerting me more. So I can't, I have to have my
52:38
hand on the wheel anyway. But for instance, for for not
52:41
not putting a brake when, when there's a a queue ahead or so or
52:45
someone stopping ahead of you. That took me quite a quite a
52:49
while. Also, when then when I shifted
52:51
my or changed my car, it again took me a while to sort of
52:56
reconfirm that it works. It works better, by the way, in
52:59
my new car. I won't tell which is the old, I
53:02
won't tell which is the new one. But, but at the end it, it takes
53:07
a bit, but I'm, I would say the systems I, I, I started using,
53:12
I'm pretty confident in them. But if there's, for instance, a
53:21
situation where you need to so very, very fast, something
53:25
really unexpected and I have still act very quickly because
53:28
it's still double safety. Yeah, I've been fortunate to
53:32
drive many electric vehicles are typically where you see most of
53:36
these advanced systems and I've seen a big disparity in the
53:40
capability between all of them. Still, I think they're all
53:42
heading to the same direction of hands off.
53:45
You're a passenger more than you are a driver, which looking
53:50
there at some point, but I have noticed that there is
53:53
differences in the way that each of the different manufacturers
53:55
approach it. So, you know, I, I'm fortunate
53:57
and I have a Rythian vehicle and I have a pull star vehicle and
54:01
they're both relatively the same, but they have different
54:03
strengths and weaknesses. The Rythian I can be today, I
54:07
can be hands off and take a nice two hour commute to my, my local
54:11
day job office if I want to. And it works out really well,
54:15
but it doesn't do well in certain other roads.
54:16
Whereas my pull star, which is another vehicle actually works
54:19
in more roads, but doesn't have the same hands off mentality.
54:23
And it is super annoying when it comes to are you looking
54:27
straight ahead? Stop looking at this thing, that
54:29
thing. And they I find it interesting
54:30
to see these different vehicle manufacturers have different
54:32
approaches to what they're willing to release to the wild.
54:35
Going back to Sperry, do you know which data your vehicle
54:39
sent to whom? No, I mean, I know it's going
54:45
somewhere. I think, I think we, we, we
54:46
don't open that Cam right now, but also an interesting topic to
54:51
look at when we look at a lot of the security slings in the
54:56
world. It's a trade off, right?
54:58
It's it's a convenience factor. Do we need assisted driving?
55:01
No. Do we find benefit and value in
55:05
it? Do do we want to go back?
55:08
Probably not. Well, once you once you got used
55:11
to it, it's really, it's not only convenience, it's also
55:17
safety factor. And how much of that safety
55:20
factor are we willing to trade our personal data to, to
55:23
contribute to now we're getting into it?
55:26
Yeah, now we're getting into it. I don't want to trade that, but
55:32
at least I have a trauma. Jim, I don't think you've gotten
55:36
yet into like the self driving stuff.
55:38
Yeah, right. You're probably a, you're
55:40
probably driving A1980F-150 or something like that.
55:44
I do have. A pickup, but I also have a 2026
55:49
Lincoln Nautilus it's got they're called Blue.
55:52
People. And it only works on the
55:55
interstates, but it's full self driving, hands off.
55:58
It'll even pass cars. So yeah, I mean, I love
56:02
technology and that's what I was going to say.
56:04
My favorite thing about AI is the rate of change, right?
56:08
And on one hand it's great. It's like if you think about
56:12
what you can do in ChatGPT now versus 3 months ago, especially
56:19
from silly image generation or whatever The thing is that they
56:23
determine to put their focus on for fall.
56:26
It's incredible. And there's no reason to think
56:28
it's going to slow down, right? This whole idea of recursive
56:31
self improvement is that these models are building themselves
56:36
24 hours a day now. The limitation is how much you
56:39
compute your passes you can throw at them, right?
56:42
I'm personally also think the physical manifestation of AI is
56:48
humanoid robotics. I think five years, 10 years, 15
56:52
years is definitely within our lifetime if we died natural
56:56
causes, right? We see humanoid robots
56:59
everywhere. We're at EIC and humanoid robots
57:03
are walking all over the place. That's what I think, OK.
57:09
OK, let's see if that's all right.
57:10
We'll see. It happens in our lifetime.
57:12
We'll have to come back here and and see whatever I mean.
57:16
I I grew up in the era of the Jensen and I'm still waiting for
57:19
Rosie the Robot in my flying car.
57:22
Yeah. Well, again there, yes.
57:24
Will it happen in my lifetime? I don't know.
57:26
I would Star Trek say Earl Grey hot.
57:29
You can kind of say that now. With.
57:32
You know, a, a voice powered microwave of some sort, or maybe
57:36
some sort of the, you know, fancy espresso machine, right?
57:39
That is like automated in some degree.
57:42
It is very cool. I, I, I will, I'll say there's
57:44
one thing that I find really fascinating is in a very neat is
57:48
the idea of using some of these generative tools in the health
57:51
phase. So I'm not sure if you guys are
57:53
familiar with this story of this guy who has a dog.
57:55
A dog had cancer and he used essentially, I think it was
57:59
Chachimbuttine to owe into that, but it was one of these
58:01
generative AI systems to research and develop an mRNA
58:05
vaccine to cure his dog, which is amazing.
58:11
If it's true. Now I don't have any reason to
58:13
doubt it because I think he got a lot of press coverage, at
58:15
least in the US. Yeah, but but, you know, I, I, I
58:17
heard so many stories about all those things going wrong and
58:21
here and that and that and you always question what of physics
58:24
is through what not. Right, their side effects.
58:26
And and which excess or which excess you had to certain
58:30
sources others don't have etcetera, etcetera.
58:32
So I think, I think, but but yes, we, we see huge
58:36
improvement. I see AI anyway, you know, in,
58:38
in for instance, in, in curing cancer and curing other, other,
58:46
other stuff. I think there's an incredible
58:50
potential. I think it's also, you know, the
58:52
use of AI when you're whatever by doctors to for the screening
58:57
for, for skin cancer or so, etcetera.
59:02
It's it's a huge, huge improvement.
59:05
And I think that that that makes a lot of sense.
59:08
So yeah, I think there's, and I'm not, they're all negative
59:14
for AI. You know, I like I like change
59:16
because I think it keeps things interesting and I think we need
59:19
to be a bit careful with some of the things and we need to work
59:25
hard on AI identity and AI security you.
59:28
Know what I was saying in the consulting business, I'm sure
59:30
you've heard before is get comfortable being uncomfortable
59:33
and that's kind of where we're at right now.
59:35
You know that the whole thing, I think is very interesting
59:37
because it's not sometimes it's not about finding the answer,
59:41
it's about ruling out all the ones that you know are aren't
59:44
the answer that helps you get to that.
59:45
So I think it's a fascinating space.
59:48
It's AI think every generation says this.
59:50
We are living in interesting times and here we are yet again,
59:54
you know, saying that again. But Martin, you're you're always
59:56
so generous with your time. We really appreciate you coming
59:58
down and kind of staying with us.
1:00:00
Congratulations, another great conference.
1:00:02
You know, I know you got about a day roughly left or so of of
1:00:05
stuff to go through, but it's been a great conference.
1:00:07
Thank you again for for having us here.
1:00:09
We hope to see you again next year and I'm sure we'll we'll
1:00:11
talk, you know, virtually and you know before that as.
1:00:13
Well, thank you for being here and always a pleasure to be on
1:00:16
your podcast. No, but I appreciate it.
1:00:18
Thank you. We'll go and leave it for this
1:00:19
week. We'll have some links in our
1:00:21
show. That's where people check out
1:00:22
idacpodcast.com, like and subscribe.
1:00:25
That helps us do fun, cool things like this.
1:00:28
Yeah, we'll leave it there for this week.
1:00:29
Thanks, everyone for watching, and we're listening.
1:00:31
And we'll talk with you all in the next one.
1:00:35
You've been listening to Identity at the Center.
1:00:38
We hope you've enjoyed the show. Make sure to like, rate and
1:00:43
review, and we'll be back soon. But in the meantime, hit the
1:00:46
website at identity@thecenter.com.
1:00:50
See you next time on Identity at the Center.