The old perimeter is gone and people are walking from
anywhere. And I think there's more
understanding even at the even at the board level and the CEO
level that identity is, is critical.
They can actually understand it. I think more than themselves.
Some other areas of security they, they, they get it like
they think that's one of the advantages and also
disadvantages of identity. It meets the end user more than
any other category of security. Like every, every employee,
every, you know, the CEO logs in and has to do like multi factor
authentication and all these things.
Like they actually see them as opposed to some of the stuff
that like other categories where it's much more behind the
scenes. So they understand the
importance and the way to put more budgets on it.
I, I hear from a lot of companies that identity is now
like the number one priority or the number one budget item,
which is, which is great because I do believe, and I'm, I'm, I'm
biased, but I, I honestly do believe that it is the most
important element of security these days.
This is identity at the centre if it has anything to do with
IAM. This is the go to podcast now
your hosts Jim McDonald and Jeff Stedman.
Welcome to the Identity of the Center podcast.
I'm Jeff, and that's Jim. Hey, Jim.
Hey, Jeff, how are you? Not so bad yourself.
Good. What do you think of the get up
today? I'm waiting for the magic tricks
to start. Like is there a a dove going to
fly out of your? Why not?
I don't have the magician jacket.
I've got everything else. I don't have the hat either, but
I've got a cowboy hat just right from Texas.
Yeah, we're at the Gartner Gartner IM Summit here in Texas.
The other thing is you know other magician, maybe dealer at
like a casino table with the other option it's.
In like 1876 or something like that.
That's right, you've seen the movie A Tombstone.
You know you're sitting there and Whiter walks in and takes
control of things. Yeah, yeah, no, actually I've
been watching the series, Deadwood began, which I remember
the first time I watched it, like thinking, Oh my God, that's
so violent. And this was TV for 20 years ago
and now? Game of Thrones had not yet
aired at that point. Yeah, yeah.
No, we've been hardened. Well, you look like you belong
in the Deadwood sort of environment, right?
You got the beard, you got the long hair.
I could see you absolutely with a cowboy hat.
You pull that off for sure. All right.
I'm going to wear one tomorrow, so we're going to set for that.
That'll be our first episode of the year.
This is going to be our last session.
So this is the year. Last episode of 2024 and it's
been a ride. Another big year for us.
I'm sure we're going to do a lot of things.
We're going to talk about a bunch of different things today.
But yeah, this is it for us. And we're going to take a couple
weeks off and then, yeah, come back.
I think first or second week of January I can't move up the
schedule. Makes sense.
One last conference, one last episode.
So I think we should jump into it.
What do you think? Yeah.
So I mentioned we're at the Gartner, I am Summit and
definitely want to give a shout out to RSM, the ones that are
helping make as possible. Also shout out to Silver Fort.
We are in their suite right now. Sweet, sweet, sweet suite.
And we're sitting here with Hed Kubetz.
He's the CEO and Co founder of Silver for It.
Welcome back to the show, Head. Thank you.
Great to be here and will be an honor to be here for the last
episode of the week of the year. Just of the year, we're going to
keep going until next year. It was so we actually met the
first time at a Gartner a couple times ago.
So it would have been Gartner. I think at the end of 2022.
We did Episode 166, we talked with you, we learned more about
any threat detection response at ATR.
We're definitely going to get into probably saw that and then
more today, but definitely encourage people to go back and
check out episode 166. We're not going to make you
relive your, you know, tell us how you got that any story,
people go back and listen out, but why don't we start with,
hey, what's new? Like silver fork has been the
news, you know, a couple times over the last year and a half or
so, two years almost. What's new with silver fork?
What's been going on in your room?
Yeah, there's been a lot going on.
I mean we're lucky to to really see huge course in this time.
So you know, and a lot of exciting things.
So we just announced a couple of weeks ago that we acquired the
company for the first time, which for me personally and for
the company is you know, a big step.
We acquired a company called Resonate that is focused on
cloud identity security. Great company, great people.
And now, you know, we're really kind of integrating the
platforms together. So that was some recent really
exciting news. Earlier in the year we we
announced a big funding zone. So we raised the CSD pound of
$116 million. That's it.
So yeah, that's, you know, we had to figure out now what do we
do with all this money? Like we need to build a big
company I guess. You need a podcast.
Yeah, yeah. It's, it's, it's exciting.
So a lot of things going on. And then just today we announced
a new product that we that we released on privileged access
security. So really a new way to secure
how, you know, privilege access kind of fit is protected across
all the different environments. So there's the lot going.
And sounds like it. And there's a lot of money
pouring into the space. So I'm curious 'cause you were
kind of talking before I get recorded, like do people really
care about the entrepreneurial side of, of identity?
I'm interested in it. So I'm going to ask questions
anyway. So whether or not people
listening are interested, I want to get into it a little bit.
You know, having founded and run this business and now you've
made an acquisition to resonate, I guess what is it like to start
something up like that? And 2nd follow up question is
there's a lot of money being raised yourself one of them.
What are VCs looking for when it comes to products in the space?
Because it seems like identity is so hot, right?
Now where it's become a lean house festive.
Yeah. So first of all, it wasn't
always hot. I have to say, you know, I
probably had a different experience than what
entrepreneurs that start today probably see.
And, you know, that was how do. But I guess I'm also thankful
for what kind of how it helped us mature.
When we started eight years ago, it was a pretty tough
experience. I mean, we went to a lot of VCs
to talk about what we want to do.
We want to, you know, do something in identity security.
We had a couple of ideas and the reaction we got from almost
every VC was that's just not an interesting category.
Identity. What do you mean like
authentication? And it's like, isn't that like
20 years ago? That was already done.
Companies, you know, already have that and we were trying to
explain that yeah, the the they did that, but then look at how
many attacks of still using compromised identities.
I mean, it's only glory. So something must be missing,
right? And we want to solve that.
Luckily, we were able to find someone who who actually
believed in that, but it wasn't easy.
And you know, if you want to know a bit about the, the
entrepreneurial experience, that's like a really tough part
of it, like hearing no so many times and having people doubt
what you do and is it even worth your time and obviously their
money. It's tough.
And, and one of the biggest tasks I think is you have to get
up after every time that someone tells you it's not a good idea,
it's not the way to work. You need to somehow get yourself
back to, to optimism, you know, because that's kind of the key
to, to building a startup. You need to be optimistic and
you need to get back on your feet every time.
And luckily we did. We, you know, got up enough
times to the point for now, it's actually, it's happening and
it's growing and it's, it's, it's doing really well.
But I, I don't forget that beginning it was a much
different time. Now it is getting very hard
though. So I'm, you know, glad.
I think it's, it's the right thing.
I I think when you walk around the exhibitor hall at this
conference, you just, I mean, I'm blown away by how many
start-ups there are. Yeah.
Side by side with the big players in the space.
What was your impression? Yeah, there are a lot of
start-ups. I think it's a very good thing
because the innovation will mostly come from the start-ups.
I mean, you, you hear about some of the big vendors trying to do
new things. It, it can happen to a degree,
but I think that just like in any other category, the, the
real disruptive things will come from start-ups.
They just have a better ability to take the risk.
You know, I, I used to open a big up and I'm so many people
know that, you know, even if you come up with new ideas, the
ability of a large company to just throw away everything
they've done and, and go for this whole new approach, it's
hard. You know, they, they need to
meet the quarterly goals and it's just harder to do when you
start a company, you could take a huge risk.
And you know, I remember we, we thought, hey, you know, either
this will work and we'll have something amazing, or it will
not. And you know, let's fail fast,
you know, and figure that it's not the right thing and go do
another thing. That's a risk that you can only
take as a, as a startup. So a lot of startups are now
kind of paving the road in, in, in many areas of identity
security, which is great. I mean, we are kind of lucky to
be in that sweet spot. I I feel between being still a
start up that can move fast and innovate and build.
But also we're big enough at this point that we can really,
you know, execute when we have a big customer base and we're
trying to enjoy both worlds for as long as we can before we
become a, a big corporate. And I think at least, at least
like now, it feels like it is in that sweet spot.
How do you defend against that position of, OK, that spirit of
innovation and entrepreneurism versus, you know, big company
and very slow to react and I got to imagine that would probably
keep you up at night. Yeah, it's one of the things
that's gonna be the most to to lose that innovation.
So we invest in it a lot. I think that especially this
year, I think everything that is happening in the space, all
these new start-ups that have these really cool new
technologies, what kind of a wake up call for us.
We need to be ahead of the market not only because we we
are getting the, you know, all the traction in the, the big
customers, but also in, in innovation.
So this year we've actually innovative more than ever
before, more than in the early years we've had.
And we built, I mean it across some organizational adjustments,
right. So we built really good
innovation team and we divided our R&D into smaller teams that
each focus on a different port. So there's a team building ITDR,
there's a team building, you know, privilege access security.
It was a team building, not human identity, security,
ISPMMFA, all these different things now have smaller teams
that can operate more like a startup.
Because what happens in a big or even medium sized companies,
you, you get this huge R&D organization at some point and
every person does the tiny piece of it.
So they use some of the motivation and, and definitely
the innovation by dividing it and, and keeping small teams
that act more like startups. And, and if you manage to build
the platform as a tool platform, I mean kind of shared
infrastructure that all these products can operate on, but
they don't need to worry about it.
You know, like in all of the enterprise features, I mean, you
need, you know, you need to be with security and compliance and
scale all these things. If you if you manage to push
them down to a certain platform and build all these products on
top, you can still keep those as, as almost like small
start-ups. And we've managed to to do it
this year, which was a big organizational effort, but I
think it was worth it. And now we're moving very fast.
And still, you know, I see start-ups that are doing really
cool things and I think it's great.
I mean, we all, I think we've been enough time in this market
to know by now that it's not a bad thing.
You know, I think that it was much worse being back then at
the time when nobody thought it's even interesting, right.
So I actually prefer to have a lot of start-ups then pushing us
to innovate, pushing us forward, pushing the industry forward
over, you know, if you look five years ago that nobody thought
it's even that interesting you. Mentioned identity security a
few times and as I walked in vendor hall, it's like identity
security, identity security. And it's like, yeah, under that
company, they have been doing the same thing for five years,
but now they're calling it identity security.
Is that just that's just what happens, Just like zero trust.
I mean, everybody's now zero trust.
And then that's not popular anymore.
Now it's identity security. I mean, I think identity
security has a real meaning, right?
So yeah, in your mind, what is that real meaning?
I, I think that identity security is, is one of the best
things that can happen to this industry is that, that
platformization, let's call it, because if you think about the,
the history of identity security for many years, it was just a
feature of the identity infrastructure.
I mean, we talk about IAM, right, a lot IAM, which to me is
the identity infrastructure, you know, it manages your identities
and, and it's, it's not really a, a security offering.
I mean, to me it's more like, you know, it's related to
productivity to, to IT security was always a feature in that.
So if you had like Active Directory or Octa or Entrac, you
might have some security features in there.
I think that what's happening now is finally these security
features are decoupling on the infrastructure to become the own
stand alone layer that that can operate on top of all of these
identity infrastructure solutions.
And that's really important because as long as there are
features, they only see their own island.
If you think about it, I can log in to Okta and I, I failed the
authentication, right? It's not me, right?
I failed the MFAI can still then go and log in to enter or to the
onto MAD and nobody will stop it because those solutions don't
even talk to each other. It's it's all islands that are
are looking at security as a silo.
And I think that only by decoupling security from it and
creating a layer that understands the whole picture,
all these silos, all these islands, you can really do
security effectively. If you think about it, it
already happened in other categories of security.
Think about the cloud security. In the early days, you were
buying cloud security from AWS and Azure and Google.
And after a while people understood it doesn't make
sense, you need it to operate on all the clouds.
So then companies like Whiz came and created a cloud security
platform. You don't buy it anymore from
the cloud providers. Same for Android, like you don't
buy Android security from Lenovo and Apple and Dell, you might
form a company that can work on all the endpoints, all the types
of endpoints. I think the same is finally now
happening to identity. And that is to me identity
security, it's a stand alone layer that can operate on top of
all the islands of identity infrastructure.
And that's the only way that we can ever, I think make this
effective and and really be ahead of the of the attackers.
And it just took longer in identity, but I think it's
finally happening, which is really exciting.
Is Identity a platform in your mind, or is it a component of
something else? Identity security or in general
identity? Identity.
I think it's absolutely a platform.
I think that identity is one of the biggest elements of
security. And also ITI think that in many
ways identity is becoming the most important element.
If you think about it now that everybody's walking from
anywhere and they use devices that are not necessarily the
company's device. I mean, if I can log in from a
cafe in Thailand using my device, and as long as I prove
who I am, I'm part of your organization, your virtual
network, it means that the identity is pretty much the the
only remaining line of defence. So I think that the identity is
becoming, I mean at, at the centre right there's.
A little bit of a leading question, yeah.
Yeah. You did a webinar recently with
Jim around that idea of identity being at the side of security.
Oh, it's very true. I I think that is becoming the
biggest piece really. And I think that people finally
recognize it. So what is the difference
between I AM and Identity security?
So I am. To me is, is the infrastructure,
it's managing the identities. You know, like when you start in
a company, they need to create an identity for you.
And it's almost like an an IT of an agile feature.
I mean, it doesn't mean necessarily security.
There's a different question of how do you secure that identity?
How do you prevent someone from stealing it?
But the identity itself is not a security element.
It's just, you know, it's just like saying that your device or,
or the data or the cloud, our our security, no, the, the
pieces of the, the, you know, the infrastructure, the digital
infrastructure that you have. And then there's a question of
how do you secure it? So I think that the IAM the
infrastructure is something that includes single sign on and it
includes like on boarding and off boarding of employees.
That includes what do people have permissions to access?
I think it also includes a password less authentication,
which many people view as a security feature.
I I don't think so. I think that, I mean, obviously
password less involves authenticity with some second
factor that's security, yes. But removing the first factor,
that alone is not a security functionality, It's actually a
user experience functionality. So I think a lot of these things
are to me part of the identity infrastructure.
That's what companies like Octa and Bing and Microsoft are doing
now. Security again was always mixed
up with that. So it's almost hard to separate
the Bitcoin. But I think that we can have a
think, a discussion around what is what is not really part of
that, what should be a security functionality that sits on top.
Some things are obvious like ITDR, right?
I think privilege access security is part of it and you
know, non human identity security, which is now a very
hot category, stuff like that. But there's also questions
around areas that might need to almost like kind of split IGA,
for example. Is that an infrastructure
feature? Because some of it is like like
onboarding and offboarding users, things like that?
Or is it a security feature because achieving least
privileged for them, making sure people don't have too much
access, that's a security goal. So I think.
Here's also the appliance aspect accessories, and that's really
where the IGA field started was, you know, we got tired of
sending spreadsheets around and so the idea was to, OK, well,
how do we comply with our socks or HIPAA or other things like
that too. But I think that the whole
market will need to go to this evolution now, because the only
way to do security effectively is if you if you separate it
from the infrastructure, because the infrastructure people have a
few different solutions. They have active director of
them, they have been Octa in the cloud.
They have maybe some SAS applications that manage
identities over the, you know, the cloud infrastructure.
Some people have more than that because they acquire the company
and that company is using Ping, So now they have that too.
If all those islands will have their own local security, again,
it will be as if we would have different endpoint security for
every type of laptop. Doesn't make any sense.
So we have two separate security.
And that is to me, identity security.
It's that layer on top that does the security that requires the
overall context, you know, like understanding all the the
identities and all the access and then not only understanding
it, but also enforcing security policies.
I think that has to separate and that is identity security.
I'm actually very glad that more people are using that too.
I do feel like I walked around the that so, so many people are
saying it. The outcome is finally saying
it, which they told me for years that they, they, they don't
agree that there's such a thing. Now they're saying it.
Some of the analysts told me. Yeah, we, we understand that the
like this is happening. And I don't think, you know,
today. I, I think that the people have
spoken. Yeah.
So we just which is very good. And it took a while, but I think
it it's very important, not just for us as a company.
I honestly believe that it's important for the industry if we
want to stay ahead of the of the threats.
It's, it's, it's not going to be possible to handle the the
evolving threats and, and they are evolving fast and this is
even before AI fully kicked in. We will not have a chance if we
don't really start taking treating identity security as a
as an overall thing and not as a local feature.
Yeah. So you presented this morning at
the summit. I think one of the main themes
that you talked about was this idea of legacy IT and modern IT
coexisting. I mean, I have a friend who made
the observation, you know this, the modern CIO has one foot in
the past and one foot in the future.
So they're thinking as like, OK, well, from an identity security
standpoint, what do they need to secure the past of the future?
Obviously they need to secure both.
So given that context, you know, you've got to secure both.
How do you do that from an identity standpoint?
You think about the legacy platforms, they were built to
secure the on Prem networking. When I say legacy is not just
mainframes, but it, it's, you know, could be modern
applications or running an on Prem environment.
Now you have applications that you're hosting in platform as a
service or infrastructure as a service, as well as, you know,
SAS applications. The deployment models are
evolving, so you have all these things going on.
How do you secure it all? How does the modern CSO or CIO
look at this problem? Yeah, it's a big problem,
honestly. And, and it's getting even more
complex when you think not just about applications, but think
that companies have, you know, databases and, and servers and
file systems and OT environments like those, all these other
things that are not even web applications and use all kinds
of protocols to, to authenticate to.
I think that we have to solve both because attackers are
looking at this as as one attack surface.
I mean, we think, OK, we'll, we'll protect these applications
and not these. So we are half protected.
No, you're, you're 0 protected because an attacker can choose
where to, to log into. So, you know, we've seen a lot
of attacks where an attacker will compromise the weakest
link, which is often the legacy, the on Prem, you know, by just
taking advantage of how vulnerable and Active Directory
is and you know, getting user credentials over there with
brute forcing there or Kerberos thing or all kinds of thing.
Now once you do that, because most organisations sync the
password between AD to the cloud, you actually have the
cloud password now because it's the same password.
So we think about those as two different islands, but you know,
if I compromise one of them, I compromise the other.
And, and that's something that I think people understand more and
more. Now it's it's even more complex
than that because even if you secured some of the ways to
authenticate to the legacy systems, let's say that you
deploy a multi factor authentication portal or your
servers, right? And it protects the, the windows
login screen, because that's what these agents often do.
You install don't want to name the vendors, right, But all the
think about all the common MFA vendors and now everyone logging
into that server is getting MFA on the on the login screen
instead of just a password. But as an attacker, I can choose
a different way to log in. I can log in with remote
PowerShell, you know, I can log into a shared folder on that
server. I can log in with so many other
tools that it's it's, it's a joke.
You know, it's like you lock the front door but the window is
open. And I think that people
understand more and more now that if you don't secure
identities everywhere and all of the access, it's meaningless
because the attacker get to choose how they log into your
system. And they're not going after the
the shrimp tour. They're not, they prefer the
command line tools, right? Yeah.
We, we spoke to a company that got breached and they were using
one of the top like, you know, MFA and, and and, you know, and
Pam solution and they deployed everywhere.
You know, it was on all the servers and all the accounts.
Then the attacker just went in and he was using one of these
alternative interfaces, which attackers use anyway, and every
ransomer is using anyway. I don't even think that's the
sad part. I don't even think the attacker
knew that there was an MFA solution in place.
It's not that they knew it and tried to avoid it, They just
didn't even know because the way they log in, I mean, the way
ransom was spread and that's the reason it was CLI.
Exactly, Exactly. It's with command line tools
anyway. So if we don't secure those
things, which is probably the hardest, the fact that we have
MFA on our web applications or RBP or VPN, it's almost
meaningless. And, and that's why we really
believe that you need to cover all the, the darkest corners of
the IAM infrastructure. And there is a way to do it
again, we'll, maybe we'll talk, you know, in in the future.
I don't want to go too deep into the technology, but there are
ways to do it. It's just, it took actually
investing a long time in, in understanding how do things even
work. And you know, why do you do it?
And it's, as I said before, it's not sexy.
So when we went to, to VCs to talk about that, you want to do
what you want to protect the, the legacy.
So now obviously we also protect the cloud.
And with the resident acquisition, we, we do even more
and more though, but when we started, we only focused on
those dark corners. It's not will investors want to
focus, but it is will companies have a problem.
Yeah, it's interesting. You know, part of my thinking
when I asked the question was thinking of that legacy
environment. It in other words, on Prem
environment, organizations have been investing in identity
solutions for that environment. Clouds like obviously
overwhelming and it's been overwhelming for a long time for
a lot of organizations. There are still organizations
that are, you know, kind of beginning their journey.
But my wonder is, OK, so as AC so or the CIO is my approach to
this is the right approach to say, take those platforms and
try to solve for my hybrid situation?
Or do I need different tool? So I, I think that until
recently you'd needed different tours.
I think that what's finally happening is, is consolidation.
I mean, we are part of it. I think other companies are
trying to achieve the same. Hopefully protecting the dead is
end to end. I think that's how you have to
do it. So on them and cloud, humans and
machines, privileged and non privileged just end to end.
Because if you don't look at it end to end, you're, you're
missing the, you know, you're missing some of the, the
critical areas. I mean, and then you know is
again the attackers will find the the blind spot.
Well, let's expand the question is so we talked about the one
foot in the past, one foot in the future as kind of like this
major divide and they just reference another major divide
and it's as far as an identity topic could be right now, which
is non human identities. So we kind of we know how to
manage human identities. We've been doing it for so long
and we've been ignoring the non human identities.
You know, I'm part of that. I'm guilty too.
It's not that we didn't know it was important.
It's that we didn't have the tools.
Yeah. And like, I think it is that it
is one of the biggest problems. So I think it it makes sense
that a lot of companies are trying to focus in it out.
I agree that the main issues that people didn't think it's
possible to protect them for a long time.
Even if you think about the older types like service
accounts in Active Directory, they've been around for decades,
right? But people didn't think there
was an effective way to secure them.
I think most organisations will try to do that with Pam tools
and with Pam tools, you, you have to change the password.
That's kind of how Pam works, which I think is a pretty old
approach, but that's what we had for for the last decades.
And when you change a password on a non human identity, it
breaks things in in many cases it breaks applications because
they have them, you know, they have hard coded somewhere in the
script or somewhere in the application those those the
password. So I think people got scared of
doing it like they tried. I spoke to CSO, tried to do it
once with these type of tools and took down a whole data
centre and then he stopped the you know.
That's a very real fear. I mean, a lot of organizations
struggle with that fear is what if?
What if I changed that password? What if I shut down that
account? They know it exists, and yet
they still let it sit there. Yeah.
And when we came out with our solution to protect service
accounts, I think it was 3-4 years ago it was.
We thought it's just a small thing like we thought one
customer suggested today, if you can do this for humans, why
don't you do the same for non human?
And we did. And we thought it was going to
be a a feature. We didn't even we didn't even
charge money for it in the beginning.
And it became one of our best products because it it is a huge
problem and it takes a different approach.
You can't just try to use the the tools that use for human
identities on it. I think that the best approach
with non even identities is obviously visibility is a big
part of it. You need to discover them, see
what they're doing, who owns them, where they're being used.
That's a huge part of it. People don't even know.
That the kind of the governance of it.
Yeah, they don't even know. And they don't even know that
some of them are being abused for completely different.
Like, you know, somebody created the service account once and now
they're just using it for 10 different applications.
That would never. Both people use their personal
account to one application instead of asking for a service
bar. It happens a lot.
I think I, I, I told that story in the past.
I don't remember well. Well, we had a, a customer that
we were, we were installing our product for and we need the
service account just, you know, like regular, you know, domain
use of service card in order to, to run our product.
And, and he said, Hey, can you go create a service card for us?
And he just said, no, no, just let's use my on account.
It's like, that's what you invited us to fix, like.
And it's, it's so built into the way people work that he didn't
even realise that he's offering this to the vendor that came
here to fix this problem. Yeah.
So people do it all the time. So visibility is a big part of
it and finding all these these bad, you know, behaviours.
But then the second part is how do you secure them?
So all they think puzzles is, is sometimes the light.
And so usually it's not. So you need to figure out how do
you basically prevent any use of this identity outside of what it
needs to do. So if you built a non even
identity that only needs to connect from A to B every two
hours, let's somehow lock it down to only be able to do that.
So if somebody will try to use it anywhere else, it should be
unusable and it should trigger that.
Very narrowly defined scope. Yeah, that is all it can do, but
it's difficult to do sometimes when, you know, I'm going to
play the the advocate for the customer.
And some on the security side is I've asked security vendors, you
know, a lot of times they'll say, oh, we need a domain admin
account and they just leave it at that.
OK, well, you push back on that and you say, OK, well, what do
you really need? Yeah.
And being able to have that conversation in a way to say,
OK, we don't really do domain admin, which you need are these
three permissions and a lot of security vendors take the easy
way out and just to just just just give.
Yes, I agree. And, and, and not only security
vendors, the the things security vendors are actually more well
within some other IT vendors that just ask for it no matter
what. I think that part of it is also
look at all the identities you have today, look at what
permissions they have and look at what are they actually doing.
And let's correlate that. Let's correlate that
continuously to see that, you know, this account has the
permission as to do X things, but it's only doing a small
portion of that and all the time let's automatically recommend to
reduce what they can do. So it's, you know, it's just in
time access, but it's also just enough access that we need to
achieve all of these things. I don't think on you to people
like the fact that you should do it.
I think that they just didn't know that it's possible.
And I think that vendors kind of stayed in the comfort zone for a
very long time, kind of doing the same thing.
And now finally, there's almost like a renaissance in eternity
security. But think about it, for how long
did we just have the same port, the same technologies, while
other categories of security got to have such amazing innovation,
you know? And I envied that.
Like, I looked at some other categories of security where
there was so many new things going on.
And in identity, it seemed like nobody wants to do anything
differently than how they did it for the last decades.
Now the finally is willingness to do it.
And the technology is the, I mean, the technology is, is
possible. I mean, if people are willing
to, to consider doing things in a better way.
The technology is the. I think it's evolving very fast
now. Yeah, you said something scary
and I think this is part of the inertia, which was OK.
The existing tools can can't do what we need something to do for
non humans. Layer on top of that, they're
probably more complex to matters than people.
You mentioned governance, then you also have secrets
management, authentication, monitoring.
So layer all that on. You've got your IGA Pam single
signed on. So you have all these features
on top of the fact that it's not solved.
So now it's a more complex population and I think you said
in your in your talk, another thing that I agreed to it, which
is that the non human identities need to be tied off to people.
So great. That's part of that, that
solution. So now you can't use your your
tools, your, your existing tools can't do the job and you need to
solve multiple tiers of functionality in order to really
get your arms around this population.
It's not an overnight solution. It's not going to be solved by,
you know, waving a magic wand. It's very hard there, I have to
say, like as someone who's, you know, I feel like we're
innovating in this space and we have like a lot of things that
we're doing, I think in a better way than before.
It's complex like the the whole mission of security identities,
I think one of the most complex in, in cybersecurity in general.
Like I have obviously a lot of friends that run companies in
other areas of cybersecurity. I think that identity is one of
the most complex. I think that the fact that
there's so many solutions already doesn't help because the
fact that you already have 20 different solutions, I mean, it
makes it even more difficult because we're not just coming in
with this amazing new platform and you have nothing today and
we just come and install it for you and you're you're done.
You also have like 20 different things that you already have in
place that we need to deal with and integrate with and work
with. It makes it a little more
complex, but I think that that's part of the mission.
Like how do we work with the existing stack while it's
gradually being replaced? Because it will be like a lot of
these old pieces. They'll do for now all the time.
There will be next Gen. solutions for all of them.
I mean, a lot of start-ups are already doing amazing things and
I think the technology is there. Companies need to be open to
looking at new ways of doing things, better ways of doing
things. And I think that they finally
out, at least that's what I'm feeling from talking to a lot of
even the largest companies. And we all already work with
like a lot of the Fortune 50 Even so even the largest
companies that were always like a little slow are opening up to
the idea that, hey, we OK, we can't do this with the old
tools. So what's new?
What's what's I'll do? I think we can see that in the
conference a lot like even the the companies that that two
years ago, three years ago, I remember talking to them and
said, so we were like, it may be a better way, but we're kind of
stuck with how we do things. Now they're coming back and
saying OK, like we understand this is evolving and we need to
catch up. What do you attribute that to?
Because I think there's this real, you know, fatigue that
comes with, I need another tool to do this thing, right?
Why can't Axe do this thing that I already have in place?
What do you think has changed over the last year or so where
those companies have started to make those investments because
these things cost money? I think that one thing is that
the the new generation of technologies matured a little.
I mean when we started, I mean even last time we spoke a couple
of years ago when we were still growing, we had some big
enterprise customers which was kind of early.
A lot of the customers that started working with us in the
early days took a bet on us. I think that now that it's much
more established and you got we, we have like 1000 enterprise
customers using this. So it's a little less of a of a
risk for them and and they don't like risk, right, at least many
of them. So I think that's one thing.
Second thing is the fact that the threats are evolving.
I think people understand that they're going to get breached a
lot if they don't figure out what to do.
So I think that's partly part of it.
And again, there's the overall priority that identity is
getting over other categories of security because the old
perimeter is gone and people are walking from anywhere.
And I think there's more understanding even at the, even
at the board level and the CEO level that identity is, is
critical. They can actually understand it.
I think more than themselves, some others of security, they,
they, they get it like they think that's one of the
advantages and also disadvantages of identity.
It meets the end user more than any other category of security.
Like every, every employee, every, you know, the CEO logs in
and has to do like multi factor authentication and all these
things. Like they actually see them as
opposed to some of the stuff that like other categories where
it's much more behind the scenes.
So they understand the importance and the way to put
more budgets on it. I, I hear from a lot of
companies that identity is now like the number one priority or
the number one budget item, which is, which is great because
I do believe, and I'm, I'm, I'm biased, but I, I honestly do
believe that it is the most important element of security
these days. So this idea of identity being
the new perimeter, I struggle with that because it's not going
to different, but around for 15 years at this point.
You know, there's there's this idea.
Yeah, just doesn't make sense to me.
I want to do a little bit of the lightning round here because
you've been very jazzed. You're trying to want to get you
back out onto the conference. Let's do a quick round.
Let's start with shared signals and shared signals framework.
I think it's an area that's showing a lot of promise, but
I'm obvious to hear what your thoughts are as someone who's on
the vendor side of this, and this is an idea this, you know,
the idea here is that products being able to talk to each
other, which sounds good on paper, but probably more complex
behind the scenes. What are your thoughts on that?
No, I completely agree. I I think that this is, we have
to start working better as an industry between all the
products because customers are not going to have one product.
You know, some of the big vendors like to believe that
they can just be the only cybersecurity product that the
company has. I think the 99% of the company
is just not going to work. They don't want to put all the
eggs in one basket. They want some the cartridges
that are are good for each space.
We all have to understand how to work together.
So I think it's a great initiative, you know, very
compelling to us. And I think that it's one of the
things that as as our company grows, we understand more and
more that are are super important to our customers
because early on we only thought about what, what will make our
product the best and what best features we can build.
The more we meet more real customers and deploy little
environments, we understand that integrating with all the other
tools they have is top priority because otherwise it's just
another tool that you need to go to and log into.
And then there's a cool UI. It's like, cool, but I'm not
going to log into it because I have 100 other tools.
So we have to figure out how to work together, I think.
Yeah, I'm really glad that these initiatives are getting action.
Yeah, In the real world, that ends up being let's take the
logs and just stick them in our sin.
Yeah, Yeah. And then it's to die, right?
And it just sits around. We started this conversation two
years ago. We started it with identity
threat detection or response. So here we are two years later,
and it was kind of a newish term back then.
Is ITDR and is in identity security?
Is identity security an evolution of ITTR?
Was it always identity security? We're just finding better ways
to talk about it. Where do you see that
intersection between ITDR and this concept?
Maybe of identity security? No, I think, I think ITDR is one
element for identity security in our platform.
It's one of seven different products.
I think it's a very important element.
But at the end of the day, ITDR is only about detecting attacks
that are happening right now. It's not about preventing future
attacks, not about solving vulnerabilities.
It's not about protecting different types of fidelities.
It's only about telling you that you're under attack right now.
So it's one element, I think that IDL did do something
important. I think it what it was one of
the first sub categories of identity security that got
everybody to agree that there's need to be identity security
category. Do you see it as like the killer
app for identity security? Is it the thing that put it on
the map? I think that this together with
maybe NHI security now non human identities, I think were both
both played a very important role.
Although there are two very specific elements of identity
security. I think what was good about them
is I think people agreed that those should be kind of
decoupled from the infrastructure because think
about ITDR, does it make sense to do ITDR only within one IAM
solution without understanding what behaviours are happening in
the other? Obviously not.
And I think it was so obvious that it got people to generally
accept the idea that they didn't.
Security has to be a layer on top.
So even though ITDRONHI are not the only pieces, I think the
fact that they got action the last couple of fields did a lot
of good service to the to this market.
ITDLI think is gradually becoming a feature in, in bigger
identity security platform. And that's what I think what
what I think it should be. So it's served a very important
role. It still serves as a very
important functionality. We deal an identity security
platform, but I don't see it as a standalone category.
I don't think many companies would buy an ITDR product these
days. I think they'll they will look
for a platform that also has ITDL in it.
It's kind of like how I think UEBA evolved in the past.
You know, we thought about it as a product and then it kind of
got merged into other products and it became almost like a
master feature in other products.
I think ITDL is that same thing in identity, but still a very
important functionality. So when this episode airs, going
to be two weeks from 2025, which blows my mind.
So a little bit of let's think about the future.
What's the future for identity security?
No pressure. Yeah.
No, I think about it a lot. It's, it's a very good question.
I think that a few things that I think will happen in 2025 and
beyond. One is I think that
consolidation will continue. We have too many products in
this market. The fact that people need 20
different products to do identity security is a problem.
Most companies can't afford it and can't manage it.
So consolidation will continue to acquisitions to companies
building more and more products. I think there are a lot of
companies that you used to think about as a Pam company or an MFA
company or ITR company. Now you go to the website and
you see identity security. It's a bigger story now.
I think it's a good thing. 2nd is I think that AI will start to
have much bigger impact in, in a few different ways.
I think 1 is obviously attackers will start using it more.
We, we already hear about more attacks.
Well, somebody's using like deepfake to take someone into
thinking that they're the boss or someone from IT and get them
to give them the credentials or pull the MFA.
It's very concerning. There's also opportunity to use
AI to our benefit. But I think even more
interestingly, there's a question of how do we secure the
identities of AI agents? Because AI agents are and you
type of, let's call it non human identity.
That is very different from what we used to call it non human
identity. So this category of NHI was
barely even born and how it has to reinvent itself.
It's funny, but I think that will be a big task that, you
know, as a as a as an industry, I think is actually pretty
exciting because we get to play a big role in what will the
future of AI look like in order to to make it secure, which I
think is part of a bigger thing. I mean, the last couple of years
we've all been excited about Gen.
AI. Think now as it matures, there's
a whole ecosystem that develops around like the infrastructure
for Gen. AI.
How do you secure it? How do you do compliance for it?
How do you, you know, like companies that are building the
actual AI, but they're building all the ways that organisations
will be able to use it, you know, safely and, and, and
effectively. So I think that the identity
industry actually have a huge opportunity to be part of it,
you know, to to create something that will enable organisations
to use AI better by securing the identity and the access that AI
agents are doing within the environment.
That's a pretty exciting. Thing I think about like is it
more risky to use AI or is it more risky to not use AI?
In my opinion, it's always good to not use AI these days.
I mean, that's my view as ACEO, not even as a as a security
vendor. I mean, I have part of my job is
as a, as a, you know, someone who leads the security company
to think about obviously the, you know, how do we help secure
AI And there's a lot of risk, a lot of questions, though on the
other end, there's ACEO of, of, of any company, I think that you
cannot afford to not adopt AI fully.
I'm not just saying like try and test it.
I think that any CEO was not jumping in to adopt AI as much
as they can. I don't think we'll be able to
exist in a few years because the effect that this has on
productivity is so big. I don't even know if all
companies understand it. I think some companies obviously
do and you see what they're doing.
We're adopting it a lot internally like so many things
that we are now starting to do with AI and we are only
sketching the the surface. So I think that it will be
almost not competitive to not adopt AI to its full potential.
And now as security vendors, we have a job.
How do we help organisations do IT security.
But I think that we have to run very fast because nobody's going
to wait for us. Like the impact on on the
business is so big if you adopt AI well that people are going to
do it whether it's secure or not.
So we just need to make sure that we help them do it
securely. I don't think they'll be able to
afford to to not do it. Yeah, I think that if data is
your crown jewel and you have competitors, if you use AI,
there's a real scope. They have to open it up to our
data, to our crown rules, they get stolen.
That could ruin our business. But if we don't use AI to get
the most out of that data and our competitors do, and there's
not a breach, we're going to smoke us.
Yeah, we'll, we'll be very secure losers.
It's very secure. Losers, right?
It sounds very much like the cloud conversation for 20.
Yeah, well, you know what I'm doing because someone else is
going to have it now. Yeah, although I think that this
is much bigger than the cloud revolution.
You know, I think this is going to be huge and I, I don't need
to, like, I'm sure enough words have been said about this, but
I, I'm really, I, I believe in it.
You know, I've seen already and also like talking to other CE OS
of other companies, not even in cybersecurity, just in general.
I'm already seeing the impact and, and we are only starting,
like this is only the beginning. So it's, it's hard to even
understand how much this is going to change everything.
And I think that we have a chance as a security industry,
as I think especially as, as identity and the identity
security industry to have a play a role in how can we make it
secure. I think it is possible.
I think there is a way to make AI secure.
And that's something that I'm, I'm, you know, very passionate
about and I'm talking to other vendors and customers about.
And I think there's, there's so much we can innovate and do in
this space. So that's one thing that I think
I don't think we're fully get to its full potential in 2025, but
it will definitely make a big step, yeah.
So here's my prediction for next year, 2025.
I don't know if I'll go to RSA, probably not, but I'm going to
guess I'm going to walk through the vendor halls and see a whole
new cottage crop of AI security units, right?
It's, you know, it's out there, it's going to happen and it's
going to be, you know, but that'll be the RSA, the
conference trend for last year and maybe the year after that,
right? Just like we saw with Zero Trust
and AI, right? Half of them would be called
something AI, right? Yeah.
Because you don't want to miss the the fact that the AI
companies. So it's important to put it in
the name. Yeah, I think, I mean, if you
look at how investors now choose where to invest, I think that
it's very hard for an investor these days to even even justify
investment in a company. It is not about AI even to their
investors, you know, to their LP's because it's it's such a
game changer. Everybody want to be part of it.
They don't know even like where where to put the money split
every. But yeah.
So that's that's the strategy. Like let's just put it
everywhere. But I think that it is becoming
more difficult. If you were startup, early stage
startup, not in AIII kind of I'm happy that we started backward.
Not being an AI company was was OK.
And now because our business is, is, is big, we get to, I mean,
raise money based on our performance and not just based
on an idea, because I think these days raising money for an
idea that is not related to AI, it's actually pretty hard.
The investors are very embarrassing.
I, I, I don't think it's just another trend that will be
replaced in a year. I think it's going to be with us
for the next, you know, long time.
Oh, so AI is not going away? OK, interesting.
No, it's a full state. I don't mean.
I mean that the, the fact that investors, yeah, almost solely
you want to invest in it, I think is, is going to change the
way it's, I mean for, for for a long time, the way that
start-ups even come up with what idea they're going to go after,
which is which is pretty crazy. So yeah, I, I think it's going
to be an interesting year in general for I mean all
technology, but but also an identity.
There's so much going on. And I think that with the
momentum that is now kind of coming to identity security, I
think it's, it's really the most exciting time that that I mean
that we have since we started at least eight years ago to be in
this market. It's it's what we've been
waiting for for years, honestly. It's exciting spot.
I am very bullish on AI. We've choked about turning this
into the AI the center podcast. I want to get you back out
there, but we always enter the lighter note and we're hidden
night. And for your course, hey, you
know, what kind of hobbies do you have?
He said, well, I used to have hobbies.
And you mentioned things like being an artist and being a
bartender. And I was, I used to be a
bartender as well. We started talking about that.
Tell me about give me your craziest or wildest bar story
because I feel like we all have something like that.
Oh yeah, those, no, those too many.
Yeah, it's, you know, it's been the, for me, not even before I
joined the, the security industry, it was kind of in the
middle because I was in 8200. It's like a technology unit for
enough like doing cyber offence. And then when I left the
military, that's where I I did this.
So I was, I was doing it almost as a break.
You know, I didn't want to jump right straight into to
technology again. And I, I just walked as a
bartender and yeah, it was, it was pretty insane.
I, I, I had, you know, a couple of years Will, Will, you know,
I, I only worked there and it was honestly amazing.
Like, I used to meet so many, you know, amazing people and
have like, crazy stories and then wake up at noon and, you
know, it was a very different life.
I feel like you're dodging the question a little bit.
Yeah, yeah. Give me a story.
Yeah, yeah. No, it's, I mean, there, there
was some obviously some crazy nights, like I think we'll,
we'll leave it at that. And and, you know, once that
they don't even remember sometimes I have to admit, but
it was it was awesome. I I'm I'm glad that I've I've
done it. And I think that I learned so
much about like how to treat people and work with people even
more than I learned in the tech industry that I took with me to,
you know, managing a company and, and, and the sales, right?
And managing people. I feel like it was such a good
lesson on, on just how to communicate with people of all
kinds and, and, and create friendships very quickly, right?
Because that's what you do as a bartender.
You need to talk to someone and almost immediately become the
friend, right? And I think that's such a great
skill that sometimes technology founders are missing because
they, they, they care so much about the technology and they're
so focused on it, so passionate about it.
And I, I am too, they missed that element, the human element
of like building a good bond with, with someone that at the
end of the day, even in the colleges, still the, the most
important thing because we're all people.
And as much as everyone is like could be excited about your
technology, I think that as a founder, you need to also build
relationship like really quickly with investors, with customers,
with employees and, and know how to treat them.
And I think that's one of the biggest advantages we have as a
company in Silapolis is the, the people element and the culture.
So that's part of it. And by the way, we just moved to
a new office, like really big office space.
And one of my projects that even some of my team may find out
about only in this, in this episode is that I actually want
to build a small bar in the, it's a big office.
We have like a big dining room and there's this small room next
to it that we didn't know what to do with.
We said, hey, maybe we'll just put a few shells there because
it's like a small, tiny room. And I said no, no, we're going
to do a small bowl in the office.
And that to me would be like a little closer.
So when you build that and you get that set up, what's the
first drink you make to sort of christen the, you know, the, the
big, the opening of the bar, so to speak?
That, that's a good question. I, I, I change my favorite drink
every few years, but right now for the few years it's been
there in Gwani. OK, yeah, I, I like it a lot.
And I also drink whiskey a lot. Yeah, there'll be something for
everyone, but hopefully not as not as many crazy stories
awfully in in the office. Not in the office we got, which
are policies now, all that kind of work.
We'll keep it lighter there, but but no, you need to enjoy, walk
a bit. I mean, I, I generally believe
that in a start up, you need people to do amazing things,
right? To go above and beyond and build
innovative amazing things. And I think people can only do
that when they're happy, you know, when they actually enjoy
what they do and who they do it with.
I mean, you can go and walk in in a company and do your job,
but to really do amazing things, I think that you can't do that
unless you really enjoy the people that you do it with.
You know that you kind of want you want to make this happen,
not just because you want to get paid because you can't get paid
even if you do average walk, but if you really care about the
people that do it with and you all that all of it to succeed.
So I really do believe that it's important to create an
environment where people actually love what they do and
love the people they do it with. And that's like the the most
important thing you can do to build a successful start up.
Because all the rest of it now, the technology and the, the
cells and all, all of that will happen if the people that work
for you actually love what they do and they're happy where they
are. Because the, the other ones we
need to do it like I have 400 employees right now.
If I close another deal or, or, or think about another feature
that that's almost meaningless. The people that work in the
company, the other ones who need to, to do all these things.
And you know, they, they will probably never like show by how
much I care about the company. But but if I can get them to
really feel at home in this company and to really feel like
it's, it's theirs and, and, and they care, I think that that's
the thing that makes start-ups successful.
So, you know, if part of that is having the best ball in town,
you know? Sometimes it's the little
things. That's all it takes you.
Know I was at a very large technology company recently and
they had like a prohibition era Speakeasy.
It was hidden behind a false wall, so it was like bookshelf.
I was wondering, but I know exactly you're talking about.
Yeah. He was like, I'm not sure how
how to bring that up, but. Yeah, you'll have to tell me
more about it, because that's exactly what I want.
To do, but if you have enough space, I mean, yeah.
Yeah. Yeah, we'll do that off the
recording, install it, OK. I'll shoot, I'll invite you.
Maybe the next episode we can shoot the drink.
I would have I I don't remember how to bartend, but I'll do my
best. It's, it's funny that you you
come from that back onto it. I think it's.
Ten years in food service, you know, a lot of people, you know,
just kind of assume I've been in this forever is like, no, I had
a full career, you know, waiting table.
There's, you know, there's nothing as stressful as A5 table
section on A at a Chili's on a Friday night outside of a movie
theater. That's the most stress that I've
ever been in any job ever and any nothing has ever come close.
I, I actually agree. I think that people
underestimate it. I think that the amount of like
what you learn about, you know, about service and about sales
and about people in, in the, you know, in the service and for the
industry is so much more. I, I think that the, it's
actually a really good background that I also have like
a few employees that come from this.
And I, I, I actually see this today as a huge advantage when I
see it in some of the resume, which most people wouldn't think
about. I think everybody should have to
serve one way or another and that and just that.
That's the service. Everyone needs to understand
that. Ian.
All right, Jim, last statement for the year 2024.
Let's go 2025. OK, we'll go ahead and wrap it
up there head. Thank you so much.
Yeah, thank you. Yeah, we're going to get that
fun. I'm going to put your LinkedIn
back in our show notes so people can reach out by the vice of
macaroni recipes or whiskey any, or, you know, whatever.
Anyone who wants to talk about the Saudi city, I'm really happy
to talk, so feel free to reach out.
So that's great. We're going to leave it for this
week and for this year, which is crazy to say.
We have the YouTube channel, we're at idacpodcast.com.
If you go to idacpodcast.tv, you can find our YouTube channel.
So for now, we're planning to continue to that.
We'll see, but like and subscribe that shows support for
that as well. And of course, you can connect
with any of us on LinkedIn as well for any thoughts, ideas,
clients, concerns, it's we read them all.
So with that, we'll go ahead and leave it.
Thank you everybody for watching and we're listening this year
and we'll talk with you all the next one.
You've been listening to Identity at the Center.
We hope you've enjoyed the show. Make sure to like, rate and
review, and we'll be back soon. But in the meantime, hit the
website at identity@thecenter.com.
See you next time on Identity at the Center.