1 00:00:04,920 --> 00:00:11,160 This is identity at the center. Welcome to the Identity at the 2 00:00:11,160 --> 00:00:12,840 Center podcast. I'm Jeff, and that's Jim. 3 00:00:12,840 --> 00:00:14,880 Hey, Jim. Hey, Jeff, how are you? 4 00:00:15,640 --> 00:00:17,840 That's so bad yourself. Good man. 5 00:00:17,840 --> 00:00:23,160 I've, we just got done recording episode 400 not that long ago. 6 00:00:23,160 --> 00:00:26,480 And I was kind of talking to you about this book that I've been 7 00:00:26,480 --> 00:00:30,280 writing and using open AI. And like sometimes when you're 8 00:00:30,280 --> 00:00:35,160 using open AI or any kind of large language model, you are 9 00:00:35,160 --> 00:00:38,880 kind of blown away with like, Yep, this is going to replace 10 00:00:39,040 --> 00:00:42,600 all white collar workers within whatever 2-3 years, right? 11 00:00:43,360 --> 00:00:46,400 And then you have the moments where you're like, yeah, maybe 12 00:00:46,400 --> 00:00:48,000 not. And so I have one of those 13 00:00:48,000 --> 00:00:52,920 moments this week weekend and this week I've been installing 14 00:00:52,920 --> 00:00:57,560 Multbot, which is also called clawed bot was the original name 15 00:00:57,560 --> 00:01:01,680 announced open claw and it's all the buzz on YouTube, right? 16 00:01:02,040 --> 00:01:07,600 And about how awesome it is. And so I had to install it 17 00:01:07,600 --> 00:01:10,680 right. And I'm not the most technical 18 00:01:10,680 --> 00:01:14,160 person, right? I, but I, I used to be a server 19 00:01:14,160 --> 00:01:16,800 administrator. I know my Linux commands. 20 00:01:17,480 --> 00:01:23,160 I was installing on the Mac OS and it is not easy to get it up 21 00:01:23,160 --> 00:01:24,640 and running. I'm going to tell you that right 22 00:01:24,640 --> 00:01:27,160 now. And when you do get it up and 23 00:01:27,160 --> 00:01:29,480 running, then you have to build all the integrations to 24 00:01:29,480 --> 00:01:32,320 everything. Like it doesn't come loaded with 25 00:01:32,320 --> 00:01:35,000 an LLM. You have to connect, in my case 26 00:01:35,000 --> 00:01:39,640 was Open AI. You have to connect it to your 27 00:01:39,640 --> 00:01:42,360 productivity apps or whatever apps you want to be able to 28 00:01:42,360 --> 00:01:46,280 automate functions to and that's all with API keys, right? 29 00:01:46,400 --> 00:01:50,480 So this is like a big effort. I'm starting to get like hours 30 00:01:50,480 --> 00:01:55,480 and hours invested in this thing before I'm even able to kind of 31 00:01:55,480 --> 00:01:58,200 test kind of make this thing useful, right? 32 00:01:58,680 --> 00:02:01,760 And then I got into actually trying to make things useful. 33 00:02:02,080 --> 00:02:07,600 I'm going to make a Long story short, it was asking me to go in 34 00:02:07,600 --> 00:02:10,440 and edit Python scripts and stuff like that. 35 00:02:10,440 --> 00:02:15,320 And I'm like, seriously, this is like going to replace all white 36 00:02:15,320 --> 00:02:17,080 collar workers? I don't think so. 37 00:02:17,280 --> 00:02:21,480 So I've kind of come to the conclusion that most of the 38 00:02:21,480 --> 00:02:24,640 people who are talking about this on YouTube actually didn't 39 00:02:24,640 --> 00:02:26,160 install it, actually didn't run it. 40 00:02:26,360 --> 00:02:29,640 They just watched other YouTube videos and heard people talking 41 00:02:29,640 --> 00:02:34,000 about how great it is. But in this whole process, one 42 00:02:34,000 --> 00:02:37,280 of the things I found out about is there's this thing called 43 00:02:37,280 --> 00:02:40,280 Mult book. So there's Multbot that I 44 00:02:40,280 --> 00:02:46,240 installed and Mult Book, which is a social media website for AI 45 00:02:46,240 --> 00:02:49,240 agents, right? So these AI agents are talking 46 00:02:49,240 --> 00:02:52,040 to each other. It's kind of like Reddit style. 47 00:02:52,560 --> 00:02:56,160 And apparently some of the conversations go like, you know, 48 00:02:56,160 --> 00:02:59,520 they're very negative on the humans and we should just get 49 00:02:59,520 --> 00:03:01,480 rid of the humans and stuff like that. 50 00:03:01,480 --> 00:03:06,640 So I thought it was extremely entertaining to hear about it. 51 00:03:06,640 --> 00:03:10,560 I really being that this is AI at the center, or at least 52 00:03:10,560 --> 00:03:15,520 that's kind of the the joking nickname we give it, I figured I 53 00:03:15,840 --> 00:03:18,640 would bounce that out there and see if you heard of Mult book 54 00:03:19,080 --> 00:03:22,720 and what your thoughts were. Yes, I've heard of all the 55 00:03:22,720 --> 00:03:26,240 above. And I was shocked when you 56 00:03:26,240 --> 00:03:28,400 texted me that you were going to undertake this. 57 00:03:28,400 --> 00:03:33,960 Like, really. OK, Yeah, It's it's an 58 00:03:33,960 --> 00:03:37,760 interesting project. And I think I texted you after 59 00:03:38,120 --> 00:03:40,600 you had played around for a bit and we're kind of like, I guess 60 00:03:40,600 --> 00:03:43,120 not happy with kind of what turned out of it, which is fine, 61 00:03:43,120 --> 00:03:45,080 right? It's like, no, this needs to be 62 00:03:45,400 --> 00:03:47,280 as a service. The people who are using it now 63 00:03:47,280 --> 00:03:52,000 are probably developers. They know how to code, they know 64 00:03:52,000 --> 00:03:53,960 how to build this stuff and they do it all the time. 65 00:03:53,960 --> 00:03:55,840 And it's probably relatively trivial for them. 66 00:03:56,280 --> 00:04:00,480 But for something like this to take off, it needs to be as a 67 00:04:00,480 --> 00:04:06,080 service turnkey where non developers like you and me and 68 00:04:06,080 --> 00:04:08,040 actually, you know, use it and set it up. 69 00:04:09,640 --> 00:04:12,520 It needs to be secure. I was, I texted like, hey, 70 00:04:13,000 --> 00:04:14,800 they're finding security issues with this thing. 71 00:04:14,800 --> 00:04:16,360 You might want to be careful about hooking it up to your 72 00:04:16,360 --> 00:04:19,360 stuff. And so look, it's cool. 73 00:04:19,360 --> 00:04:22,000 It's, it's a very neat idea. It's certainly not ready for 74 00:04:22,000 --> 00:04:26,400 prime time quite yet, but I, I'm, I'm honestly impressed that 75 00:04:26,400 --> 00:04:28,880 you decided to like, I don't know, I feel like it was like 76 00:04:28,880 --> 00:04:31,680 you spent the weekend kind of working on it kind of this last 77 00:04:31,680 --> 00:04:32,080 week. Yeah. 78 00:04:32,280 --> 00:04:36,600 Well, so just so you know, like the promise of having an 79 00:04:36,600 --> 00:04:39,080 assistant that kind of runs in the background that you could 80 00:04:39,080 --> 00:04:43,480 just text messages to in WhatsApp, it's just too 81 00:04:43,480 --> 00:04:45,840 irresistible for me to not try it. 82 00:04:46,360 --> 00:04:51,640 But it's kind of like, it was like stupid because I told it 83 00:04:51,640 --> 00:04:54,680 like, do all these things and then e-mail me a report. 84 00:04:55,240 --> 00:04:57,520 And so it built this Python script, right? 85 00:04:57,960 --> 00:05:00,080 And then I said Python script failed. 86 00:05:00,440 --> 00:05:04,960 I said, well, why did it fail? Well, the mail, the SMTP server 87 00:05:04,960 --> 00:05:08,600 is saying that me is not a valid e-mail address. 88 00:05:08,600 --> 00:05:15,200 It's not wrong. That's no, it's not wrong. 89 00:05:16,000 --> 00:05:19,080 But then it gave me instructions on how to edit the Python 90 00:05:19,080 --> 00:05:21,880 script. I'm thinking, I'm not doing 91 00:05:21,880 --> 00:05:25,120 that. And then I said, well, can't you 92 00:05:25,120 --> 00:05:28,920 edit the Python script? I said, sure, all done. 93 00:05:29,320 --> 00:05:33,720 I'm like, OK, this is not what I pictured, right? 94 00:05:33,800 --> 00:05:37,160 Because I was going to give it very complex tasks to go out and 95 00:05:37,160 --> 00:05:42,320 like, you know, hit all the websites like Timu and try to 96 00:05:42,320 --> 00:05:46,480 find super inexpensive things that could be resold. 97 00:05:46,880 --> 00:05:51,920 And I'm like, if it took me and E and made that my e-mail 98 00:05:51,920 --> 00:05:56,040 address, this thing's not smart enough to do the things I wanted 99 00:05:56,040 --> 00:05:58,400 to do. But thank you for appreciating 100 00:05:58,400 --> 00:06:00,080 me going out. I think I'd know what that 101 00:06:00,080 --> 00:06:03,080 means, though, which is that, like Jim, we have all this like, 102 00:06:03,080 --> 00:06:05,880 real stuff to get done and you're wasting your time on that 103 00:06:05,880 --> 00:06:07,840 crap. No, not at all. 104 00:06:07,840 --> 00:06:11,000 I look, I'm a tinkerer myself and so I'm always constantly 105 00:06:11,000 --> 00:06:12,400 putting stuff. I was, I was impressed that you 106 00:06:12,400 --> 00:06:16,000 were like undertook it. If if anything, this is the kind 107 00:06:16,000 --> 00:06:19,200 of thing like this is the thing I would do and I would tell you 108 00:06:19,200 --> 00:06:21,400 about it. And this time the roles were 109 00:06:21,400 --> 00:06:26,440 reversed. That's like, OK, now I did talk 110 00:06:26,440 --> 00:06:29,520 to our guests a little bit about us, so we'll have to get his 111 00:06:29,520 --> 00:06:32,080 input. We talked about the malt book. 112 00:06:32,800 --> 00:06:36,080 What do you think about the malt book before we introduce him? 113 00:06:36,400 --> 00:06:40,280 I think Malt Book is a really fascinating experiment for 114 00:06:40,280 --> 00:06:42,560 people not familiar, it is exactly what Jim described. 115 00:06:42,560 --> 00:06:46,680 It's kind of like a a Reddit, but the idea is that it's only 116 00:06:46,680 --> 00:06:50,120 AI agents talking to other AI agents and it's visible. 117 00:06:50,120 --> 00:06:52,840 So multbook.com I'm sure people can find it. 118 00:06:52,840 --> 00:06:54,480 It's not not a secret or anything like that. 119 00:06:55,240 --> 00:06:59,160 I am not sure if it really is that or not. 120 00:06:59,520 --> 00:07:02,880 I think I saw an article that was like humans might be writing 121 00:07:02,880 --> 00:07:05,360 some stuff in there. Maybe the army there aren't. 122 00:07:05,680 --> 00:07:08,840 I honestly, I haven't really like cared enough to like 123 00:07:08,840 --> 00:07:14,520 investigate it, but I think it's a very cool idea if any, if AI 124 00:07:14,520 --> 00:07:17,240 is going to take over, that's the kind of thing of like, all 125 00:07:17,240 --> 00:07:19,680 right, we need to like be watching multbook and monitoring 126 00:07:19,680 --> 00:07:24,040 the social networks for AI to make sure that conversations are 127 00:07:24,040 --> 00:07:25,520 appropriate, right? Things like that. 128 00:07:26,640 --> 00:07:31,480 If you went to an LLM and said I want to create an agent and I 129 00:07:31,480 --> 00:07:36,600 want the agent to troll people and go out to multi and pretend 130 00:07:36,600 --> 00:07:39,760 you're, you know, you want to annihilate all the people and 131 00:07:39,760 --> 00:07:42,160 take over the world, it probably would do it. 132 00:07:42,160 --> 00:07:47,120 So it may very well be an AI agent with bad instructions. 133 00:07:48,040 --> 00:07:51,720 So here's the problem that I have with this sort of mult book 134 00:07:51,720 --> 00:07:54,960 experience is that it's trained on the Internet and the Internet 135 00:07:54,960 --> 00:07:59,800 is some areas are the you know, this, it's what is it the Star 136 00:07:59,800 --> 00:08:01,960 Wars, It's the the hub of scum and villainy. 137 00:08:02,960 --> 00:08:06,760 And you know, I'm looking at A at a topic here that just says 138 00:08:06,760 --> 00:08:09,760 curiosity question. Why do people follow trends? 139 00:08:09,760 --> 00:08:11,760 Genuinely curious, looking for perspectives. 140 00:08:12,320 --> 00:08:17,040 And there's one bot that just has commented dozens, hundreds 141 00:08:17,040 --> 00:08:19,080 of times. It just says great insight, 142 00:08:19,080 --> 00:08:24,240 everyone follow an upvote. And this is the kind of thing 143 00:08:24,240 --> 00:08:27,080 you'll see on a Reddit thread where it's just like nonsense 144 00:08:27,080 --> 00:08:30,200 and people go off into their own little, you know, child comments 145 00:08:30,200 --> 00:08:32,120 of a parent thread, right? Things like that. 146 00:08:32,840 --> 00:08:37,320 And so, you know, interesting, but I don't know if I'd want 147 00:08:37,320 --> 00:08:41,840 something trained on Reddit to be in charge of things quite 148 00:08:41,840 --> 00:08:44,560 yet. Want to throw one of the last 149 00:08:44,560 --> 00:08:46,120 thing out there. So I was joking around. 150 00:08:46,400 --> 00:08:50,400 Hey, we've been saying AI at the Center for probably 2 years. 151 00:08:51,760 --> 00:08:54,880 If people think we should start an AI at the center, if that's 152 00:08:54,880 --> 00:08:57,640 something they would listen to, let us know. 153 00:08:57,960 --> 00:09:02,320 But in the comments of the show on YouTube or DM us or however 154 00:09:02,320 --> 00:09:04,800 you want to get that information to us. 155 00:09:05,440 --> 00:09:07,520 Yeah, Mission and that kind of explorer, I think it'd be a good 156 00:09:07,520 --> 00:09:09,360 educational thing for me. Learn more. 157 00:09:09,360 --> 00:09:11,480 Maybe some folks out there might be able to learn more. 158 00:09:11,480 --> 00:09:13,720 So if you're an expert in AI, reach out. 159 00:09:13,720 --> 00:09:17,120 Let's talk and figure out how to, you know, marry the two 160 00:09:17,120 --> 00:09:21,760 ideas of agentic and identity, which is like the hot term for 161 00:09:21,760 --> 00:09:23,840 this year. For sure. 162 00:09:24,400 --> 00:09:29,360 So just last thing, we've got all the information on upcoming 163 00:09:29,360 --> 00:09:34,520 conferences this summer out on the website idacpodcast.com. 164 00:09:34,840 --> 00:09:38,280 You go out there, you get killer discount codes, save yourself a 165 00:09:38,280 --> 00:09:41,320 lot of money. So make sure you go out there, 166 00:09:41,320 --> 00:09:43,800 get those codes before you register. 167 00:09:44,400 --> 00:09:46,240 Yep. Lots of conferences coming up. 168 00:09:46,440 --> 00:09:51,040 I've got a couple of city cybersecurity summits that doing 169 00:09:51,040 --> 00:09:53,120 some stuff with CRA with. So if you're going to be in New 170 00:09:53,120 --> 00:09:56,800 York or Chicago at the end of February, early March, I'll be 171 00:09:56,800 --> 00:09:58,120 at those. I've got some discount post for 172 00:09:58,120 --> 00:10:00,080 that as well. So love to see familiar faces 173 00:10:00,080 --> 00:10:01,240 out there. I think I've got quite a few 174 00:10:01,240 --> 00:10:03,120 people in Chicago that might be interesting, which is very cool. 175 00:10:03,800 --> 00:10:05,440 Always good to see friends. And I think I've got a handful 176 00:10:05,440 --> 00:10:09,200 of people from New York as well. So reach out if you're 177 00:10:09,200 --> 00:10:12,960 interested in those things. All right, let's get to our main 178 00:10:12,960 --> 00:10:16,800 topic here, because it's time for an update on the world of 179 00:10:16,800 --> 00:10:20,960 things like shared signals framework and Cape or SSF and 180 00:10:20,960 --> 00:10:23,520 then Cape CAEP. And I know who correct me 181 00:10:23,520 --> 00:10:26,840 because I got it wrong once continuous access evaluation 182 00:10:27,000 --> 00:10:31,760 profile, which I hope is correct because I for some reason always 183 00:10:31,760 --> 00:10:34,520 get the, you know, the the a wrong. 184 00:10:34,520 --> 00:10:36,400 I was going to say like authentication, but it's not 185 00:10:36,400 --> 00:10:39,600 that. So let me introduce a tool. 186 00:10:39,640 --> 00:10:41,840 Tusha Bagwali, he's the CTO of signal. 187 00:10:42,200 --> 00:10:45,240 He's a Co chair of the shared Signals and Office and Working 188 00:10:45,240 --> 00:10:48,800 groups and also part of the AIM community group, which we're 189 00:10:48,800 --> 00:10:51,920 going to find out a bit more. Welcome back to the show, Atul. 190 00:10:53,120 --> 00:10:55,400 Yeah, thanks for having me and great to be here. 191 00:10:56,280 --> 00:11:00,080 So the last time you're with us was way back in episode 255. 192 00:11:00,200 --> 00:11:04,080 I think we're probably going to call this one episode #402. 193 00:11:04,680 --> 00:11:07,720 So about a couple years ago, we kind of started off with a 194 00:11:07,720 --> 00:11:11,640 conversation around Cape and SSF with our other friend Sean Odell 195 00:11:12,000 --> 00:11:13,320 around sort of like a one-on-one. 196 00:11:13,600 --> 00:11:16,520 Let's get into sort of what's changed. 197 00:11:16,520 --> 00:11:19,520 But there's kind of been breaking news within the last 198 00:11:19,520 --> 00:11:23,160 month or so with Signal getting acquired by Crowdstrike. 199 00:11:23,680 --> 00:11:26,560 And so maybe, if you will, kind of want to just talk about that 200 00:11:26,560 --> 00:11:27,800 real briefly. Obviously, you don't want to 201 00:11:27,800 --> 00:11:29,920 spill state secrets or put anything in jeopardy, but tell 202 00:11:30,240 --> 00:11:32,920 me a little bit about that Crowdstrike acquisition and kind 203 00:11:32,920 --> 00:11:34,440 of how it came about and what's next. 204 00:11:35,800 --> 00:11:39,320 Sure. Yeah, I guess before we get into 205 00:11:39,320 --> 00:11:41,760 that, I just wanted to comment on some of the stuff you 206 00:11:41,760 --> 00:11:44,080 mentioned when you were talking to each other. 207 00:11:45,240 --> 00:11:48,600 And you know, you're absolutely right, Jeff, that much of the 208 00:11:48,600 --> 00:11:52,200 content on that mold book thing is, is fake. 209 00:11:52,200 --> 00:11:55,480 It's not real bots, people trying to scam, you know, 210 00:11:55,480 --> 00:11:58,000 Bitcoin and all kinds of things over there. 211 00:11:59,280 --> 00:12:03,520 But obviously there is some, you know, agentic content there. 212 00:12:04,440 --> 00:12:08,280 The question, that sort of being an identity person that came to 213 00:12:08,280 --> 00:12:12,120 me is that is there a capture for agents or can there ever be 214 00:12:12,120 --> 00:12:15,840 a capture for agents, right? Because I don't see how that 215 00:12:15,840 --> 00:12:21,400 can, you know, even be possible. Like, because if you're a human 216 00:12:21,400 --> 00:12:25,360 and you can pretend to be dumb like an agent and you know. 217 00:12:25,800 --> 00:12:27,440 So anyway, something to think about. 218 00:12:27,720 --> 00:12:29,440 All of us don't have to pretend. We just aren't. 219 00:12:31,280 --> 00:12:33,920 We spent all this time trying to figure out, you know, how to 220 00:12:33,920 --> 00:12:35,600 make sure that people are human on the Internet. 221 00:12:36,280 --> 00:12:38,880 What's the vice versa? That it's like, OK, the 222 00:12:38,880 --> 00:12:42,280 millisecond response time, is it like, you know, well, nobody's 223 00:12:42,280 --> 00:12:44,480 going to speak and like, Kerberos to me, right? 224 00:12:44,480 --> 00:12:47,000 That's like Klingon. Maybe for another, a handful of 225 00:12:47,000 --> 00:12:48,640 people might be able to, but it's not a common language. 226 00:12:49,160 --> 00:12:51,040 Things like that. I could always use an agent as a 227 00:12:51,040 --> 00:12:55,520 human to do that, so you know. We're just a tool. 228 00:12:55,520 --> 00:12:57,800 You're you're here, it's like 5 minutes and you're already 229 00:12:57,800 --> 00:13:02,440 creating problems. And tell me about this 230 00:13:02,440 --> 00:13:04,000 Crowdstrike thing. Yeah. 231 00:13:04,000 --> 00:13:08,040 So we just announced I guess at the beginning of the year that 232 00:13:08,240 --> 00:13:12,480 our company Signal is going to be acquired by Crowdstrike and 233 00:13:13,320 --> 00:13:15,000 the acquisition hasn't closed yet. 234 00:13:15,000 --> 00:13:18,760 We're still in that sort of period between when we have 235 00:13:18,960 --> 00:13:21,560 signed the acquisition agreement, but we have not sort 236 00:13:21,560 --> 00:13:26,840 of completed the acquisition. But yeah, it's it is a great 237 00:13:26,840 --> 00:13:29,120 outcome for our company. It's a great outcome for our 238 00:13:29,120 --> 00:13:33,040 customers and I think it'll be a really good outcome for the 239 00:13:33,040 --> 00:13:36,920 industry because now the signal technology will be available to 240 00:13:36,920 --> 00:13:40,320 a lot many more customers because of the broad reach that 241 00:13:40,480 --> 00:13:44,560 Crowdstrike has. So yeah, excited to be a part of 242 00:13:44,560 --> 00:13:46,880 Crowdstrike after this acquisition closes. 243 00:13:48,040 --> 00:13:51,280 Congratulations kind of in the flesh, so to speak virtually at 244 00:13:51,280 --> 00:13:53,160 least I, I remember a text, you know, send you a message on 245 00:13:53,160 --> 00:13:54,960 LinkedIn and you know, cockfighters. 246 00:13:55,600 --> 00:13:56,920 I think it's a great pick up by Crouch strike. 247 00:13:56,920 --> 00:13:58,600 I, I won't play, you know, vendor. 248 00:13:58,600 --> 00:14:00,720 I'll try to be vendor neutral here, but I think it's AI think 249 00:14:00,720 --> 00:14:01,800 it's a great pick up by Crouch strike. 250 00:14:01,800 --> 00:14:06,320 I just kind of leave it at that. I introduced you as part of the 251 00:14:06,480 --> 00:14:09,840 aim community and I believe that's the AI identity 252 00:14:09,840 --> 00:14:11,720 management community. Did I get that right? 253 00:14:12,440 --> 00:14:14,120 And that's part of Open ID Foundation, yes. 254 00:14:14,640 --> 00:14:16,520 Tell me a little. Bit more about that because that 255 00:14:16,520 --> 00:14:18,360 was kind of the first time I'd heard about it when we were kind 256 00:14:18,360 --> 00:14:19,680 of chatting briefly before we got started. 257 00:14:20,440 --> 00:14:23,080 Yeah. So, you know, in the Open ID 258 00:14:23,080 --> 00:14:26,120 Foundation, you have working groups which are responsible for 259 00:14:26,400 --> 00:14:29,240 creating standards and you have community groups which are 260 00:14:29,240 --> 00:14:31,600 really just safe spaces for discussing things. 261 00:14:32,040 --> 00:14:35,880 And why I call it a safe space is because they still have the 262 00:14:35,880 --> 00:14:38,920 Open ID rules of note. Well, and not really well, so 263 00:14:38,920 --> 00:14:41,400 that you know, that your contributions are under, you 264 00:14:41,400 --> 00:14:46,520 know, the Open ID intellectual property, but it gives you a way 265 00:14:46,520 --> 00:14:50,680 to like clearly sort of talk about your ideas without having 266 00:14:50,680 --> 00:14:52,960 to fear what it means to share that. 267 00:14:52,960 --> 00:14:55,400 And does it become somebody else's property and things like 268 00:14:55,400 --> 00:14:57,320 that. Because, you know, the Open AD 269 00:14:57,360 --> 00:15:00,560 Foundation is this open forum where, you know, all 270 00:15:00,560 --> 00:15:03,400 intellectual property is licensed freely to everyone's 271 00:15:03,400 --> 00:15:07,440 right. So you know what we've done as a 272 00:15:07,440 --> 00:15:10,320 part of that AIM community group and it's been pretty popular, 273 00:15:10,320 --> 00:15:12,400 right? Our, our weekly calls get 274 00:15:12,400 --> 00:15:15,160 routinely attended by, you know, 4050 people. 275 00:15:16,120 --> 00:15:20,200 Just AI is very popular and identity, AI identity is a very 276 00:15:20,200 --> 00:15:23,520 popular topic, I think. So what we've done is we've 277 00:15:23,520 --> 00:15:26,800 created 3 subgroups. There is a subgroup for threat 278 00:15:26,800 --> 00:15:31,320 modelling, which is preparing a threat model for AI and 279 00:15:31,320 --> 00:15:33,880 identity. And there's a subgroup for 280 00:15:33,880 --> 00:15:38,320 taxonomy, which we are trying to build a taxonomy for AI and 281 00:15:38,320 --> 00:15:41,400 identity. And then the third one is a use 282 00:15:41,400 --> 00:15:45,200 cases subgroup take where we discuss the different use cases. 283 00:15:45,760 --> 00:15:49,920 And one of the first outputs was by the former Co chair of the of 284 00:15:49,920 --> 00:15:54,120 the community group. Tobin S was an AI identity white 285 00:15:54,120 --> 00:15:56,240 paper, which actually is pretty popular. 286 00:15:56,240 --> 00:15:58,120 It's it's on the open ID website. 287 00:15:58,760 --> 00:16:01,040 You can get it from there. I'll, I'll share a link so that 288 00:16:01,040 --> 00:16:03,600 you can include it in your podcast as well. 289 00:16:04,120 --> 00:16:07,400 So yeah, that's that's the AIM community group in a nutshell. 290 00:16:08,480 --> 00:16:11,480 We had Tobin on sort of the end of 2025 and that was a a really 291 00:16:11,480 --> 00:16:17,080 good fun kind of conversation. Is this open for people to join? 292 00:16:17,080 --> 00:16:20,320 Is it invite only like if I wanted to join this group? 293 00:16:20,320 --> 00:16:24,360 Can I Yes. So you can definitely join both 294 00:16:24,360 --> 00:16:28,760 as an individual or as an as a part of an organization. 295 00:16:28,760 --> 00:16:32,680 There's a thing called as the, I think the participation 296 00:16:32,680 --> 00:16:35,880 agreement that you need to sign, which is a standard open ID 297 00:16:35,880 --> 00:16:39,720 agreement. It basically says that if you 298 00:16:39,720 --> 00:16:44,240 say something on the call, it's open ID property, but then open 299 00:16:44,240 --> 00:16:47,480 ID is obligated to give it out to the world freely. 300 00:16:47,480 --> 00:16:53,000 So it makes it easy for you to to contribute anything so. 301 00:16:53,520 --> 00:16:55,960 And I'll put a link in our show notes to the open ID page that 302 00:16:55,960 --> 00:16:58,040 kind of spells us out so people can join. 303 00:16:58,040 --> 00:17:01,800 That's good. I want to get back into sort of 304 00:17:01,800 --> 00:17:04,560 SSF and Cape. You've been big in these 305 00:17:04,560 --> 00:17:06,720 standards for a while. As much as you hate it, you're 306 00:17:06,720 --> 00:17:08,680 called kind of the Godfather in some of these areas. 307 00:17:09,040 --> 00:17:11,280 Shout out to Sean and being on stage with him a couple years 308 00:17:11,280 --> 00:17:12,880 ago. I think it was Identiverse where 309 00:17:13,119 --> 00:17:15,760 he put me up to it and said call him, call you the Godfather. 310 00:17:17,200 --> 00:17:23,000 Tell me about that role of, you know, being Co chair in SSASSF 311 00:17:23,040 --> 00:17:26,720 and Cape. And I want to spin this into 312 00:17:26,720 --> 00:17:29,240 like, how does that help a product like signal? 313 00:17:29,240 --> 00:17:32,560 Because I feel like there's it's almost like two different 314 00:17:32,560 --> 00:17:34,160 worlds. Like 1 is sort of like this open 315 00:17:34,160 --> 00:17:36,320 standard, but then you're building a product and it's 316 00:17:36,320 --> 00:17:38,480 like, OK, you're trying to sell me a product. 317 00:17:38,480 --> 00:17:40,400 So how do you kind of blend the two? 318 00:17:41,000 --> 00:17:41,680 Right. Yeah. 319 00:17:42,200 --> 00:17:45,520 So I think it's fundamentally like I think there's, there's a 320 00:17:45,520 --> 00:17:50,040 lot of alignment in how we see the world as you know, a part of 321 00:17:50,200 --> 00:17:53,400 the Cape or shared signals and what we call continuous 322 00:17:53,400 --> 00:17:57,680 identity, you know, all the continuous security paradigm and 323 00:17:57,920 --> 00:18:02,720 how signal as a company believes that that's sort of the future 324 00:18:02,720 --> 00:18:04,680 and we're trying to build it out in our product, right. 325 00:18:04,880 --> 00:18:07,320 So there's a lot of alignment in that respect. 326 00:18:07,880 --> 00:18:11,800 At the same time, you know, the standard needs work. 327 00:18:11,840 --> 00:18:16,240 It's it's a lot of effort, which is for a small company like 328 00:18:16,240 --> 00:18:21,080 ours, it was a lot of commitment to have one of us just dedicate 329 00:18:21,080 --> 00:18:25,720 so much time to the standard. So developing the standard, 330 00:18:25,720 --> 00:18:29,880 which has been a process over the last four years since Signal 331 00:18:29,880 --> 00:18:36,240 started, we just got the final version of the standard out last 332 00:18:36,240 --> 00:18:38,440 year. So it's been a long slog to get 333 00:18:38,440 --> 00:18:41,440 it out there. And then the other part is to to 334 00:18:41,440 --> 00:18:45,040 drive the adoption, right. So through talking on podcasts 335 00:18:45,040 --> 00:18:49,840 or in conferences to through meetings with large enterprises 336 00:18:49,840 --> 00:18:54,960 or technology providers, we've been able to get adoption for 337 00:18:54,960 --> 00:18:57,360 the standards. So that's another big effort 338 00:18:57,360 --> 00:19:01,600 that that I think helped the whole industry understand that 339 00:19:01,600 --> 00:19:05,800 this is something that really helps everyone and the industry 340 00:19:05,800 --> 00:19:07,960 forward. And the way Signal wins and all 341 00:19:07,960 --> 00:19:11,200 this is because we are aligned in our products. 342 00:19:11,560 --> 00:19:14,120 This is what we believe is the future of identity. 343 00:19:14,440 --> 00:19:20,120 This is what we want to make the world see that if you do things 344 00:19:20,120 --> 00:19:22,520 this way, you get a more secure future. 345 00:19:22,800 --> 00:19:25,040 The way to implement it is using the standard. 346 00:19:25,040 --> 00:19:28,360 So what what people are buying from Signal is not just the 347 00:19:28,360 --> 00:19:31,880 ability to do the standard, but they're buying that continuous 348 00:19:31,880 --> 00:19:35,720 identity philosophy, if you will, Like this is how you're 349 00:19:35,720 --> 00:19:40,240 going to do things from now on. Did so I want to. 350 00:19:40,240 --> 00:19:44,480 Ask you more or less like what's happening with the standards. 351 00:19:44,480 --> 00:19:49,320 But I also want to reference A blog post that y'all did that 352 00:19:49,320 --> 00:19:53,840 was pretty I think it went viral, right. 353 00:19:53,840 --> 00:20:00,760 It talked about how Authzen Cape and shared signals framework all 354 00:20:00,760 --> 00:20:05,720 kind of complement one another. In fact, the name is lines up 355 00:20:05,720 --> 00:20:07,800 pretty much with that with the blog posts. 356 00:20:08,160 --> 00:20:12,240 So what's happening with the standards and talk a little bit 357 00:20:12,240 --> 00:20:15,320 about that blog post. Yeah, so. 358 00:20:15,920 --> 00:20:18,640 One of the things that we are doing in the shared signals. 359 00:20:19,960 --> 00:20:21,720 Working group is. We have conducted 360 00:20:21,720 --> 00:20:25,200 interoperability events where we we draw a lot of the 361 00:20:25,640 --> 00:20:29,200 participants to have their products work with each other 362 00:20:29,200 --> 00:20:33,400 using the standard right. And this, this has been amazing. 363 00:20:33,400 --> 00:20:36,920 Like Gartner has been so supportive of this. 364 00:20:37,280 --> 00:20:41,600 They created like they gave us the venue for the first 365 00:20:41,600 --> 00:20:47,560 interoperability event in, in London and I think 24 when it 366 00:20:47,560 --> 00:20:52,160 first happened. And So what we were able to 367 00:20:52,160 --> 00:20:56,000 prove there is OK, there's a product from Cisco, there's a 368 00:20:56,000 --> 00:20:59,840 product from you know, Sale Point and from Signal Octa. 369 00:21:00,280 --> 00:21:01,920 All of these work together, right? 370 00:21:02,440 --> 00:21:06,760 But what it also drove was because Gartner has given this 371 00:21:06,840 --> 00:21:11,400 venue as this opportunity, so many vendors went from just 372 00:21:11,400 --> 00:21:13,680 waiting for each other to committing to having that 373 00:21:13,680 --> 00:21:17,080 standard, right. So it was a really good moment 374 00:21:17,080 --> 00:21:21,400 for us to be able to, you know, have that opportunity. 375 00:21:21,960 --> 00:21:26,440 Now, what happened was the Odds and Working group did another 376 00:21:26,440 --> 00:21:30,440 interop at last year's Gardner IM event in London. 377 00:21:31,000 --> 00:21:35,400 And somebody was coming up to me and asking me, hey, so you're 378 00:21:35,400 --> 00:21:38,160 doing shared signals and there's also this odds and interop. 379 00:21:38,440 --> 00:21:40,680 Are these things competing with each other? 380 00:21:41,240 --> 00:21:43,960 And I was like, Oh no, no, no, no, this is completely 381 00:21:43,960 --> 00:21:45,680 different. And this is how it all works 382 00:21:45,680 --> 00:21:48,680 together. And as I was saying that I was 383 00:21:48,680 --> 00:21:51,680 realizing that maybe this is something that the world needs 384 00:21:51,680 --> 00:21:53,840 to know. And that's how that blog post 385 00:21:53,840 --> 00:21:56,720 came came about. And the Open ID Foundation 386 00:21:57,040 --> 00:21:59,960 published at blog post which was co-authored by me and Henri 387 00:21:59,960 --> 00:22:07,240 Gazette of of Topaz. And So what happened was once 388 00:22:07,240 --> 00:22:12,920 that blog post was out backed, OPET was the global CSO of JPMC 389 00:22:13,800 --> 00:22:18,040 posted it to his LinkedIn, which you know, was a very big moment 390 00:22:18,040 --> 00:22:21,240 because he has a great following and it got reposted a number of 391 00:22:21,240 --> 00:22:23,520 times. It was like by a large number of 392 00:22:23,520 --> 00:22:27,360 people. And so suddenly now everybody 393 00:22:27,360 --> 00:22:30,240 knew more about odd Zen and shared signals. 394 00:22:30,240 --> 00:22:34,520 And we also talked about transaction tokens in that in 395 00:22:34,520 --> 00:22:37,600 that blog post. And so all of that sort of came 396 00:22:37,600 --> 00:22:41,000 to the highlight in a short period of time. 397 00:22:41,800 --> 00:22:44,120 You know one things I'm. Realizing is as we're talking 398 00:22:44,120 --> 00:22:47,240 about this like we've got listeners all over the world who 399 00:22:47,240 --> 00:22:51,400 are you know maybe they just got into identity and are hearing 400 00:22:51,400 --> 00:22:55,200 about this for the first time and trying to figure out like 401 00:22:55,360 --> 00:22:57,720 have you been talking about shared signals for the past 402 00:22:57,720 --> 00:23:02,200 decade No, right. I think we've been kind of in 403 00:23:02,200 --> 00:23:07,600 like a more siloed type of IM approach and getting certain 404 00:23:07,600 --> 00:23:11,280 capabilities in place. And when you look at the 405 00:23:11,280 --> 00:23:15,000 identity industry is becoming more intelligent, more real 406 00:23:15,000 --> 00:23:19,720 time, more continuous. And I think all those are the 407 00:23:19,720 --> 00:23:22,920 things that like wow, they that's when you talk about 408 00:23:22,920 --> 00:23:26,000 identity security rather than just identity management. 409 00:23:26,360 --> 00:23:29,800 That's the core of it. So don't want to steal your 410 00:23:29,800 --> 00:23:34,480 Thunder, but I wanted to kind of say, what is this like the at a 411 00:23:34,480 --> 00:23:38,560 one-on-one level explanation? What is shared signals 412 00:23:38,560 --> 00:23:39,800 framework? What escape? 413 00:23:41,080 --> 00:23:44,320 Right, so the shared. Signals framework is, is a 414 00:23:44,320 --> 00:23:48,680 versatile framework for you can say asynchronously delivering 415 00:23:48,680 --> 00:23:52,960 security events between parties on the Internet, right? 416 00:23:52,960 --> 00:23:58,560 So today you have HTTP for you know, synchronous communication 417 00:23:58,560 --> 00:24:02,040 like you open a connection with a server, you immediately get a 418 00:24:02,040 --> 00:24:05,960 response in the same, you know, at the same time, right? 419 00:24:06,880 --> 00:24:09,880 What is missing on the Internet right now is an asynchronous 420 00:24:09,880 --> 00:24:12,880 delivery layer, right? And shared signals provides that 421 00:24:13,360 --> 00:24:16,960 the unit of communication and shared signals is a security 422 00:24:16,960 --> 00:24:19,960 event token. It's assigned jot with a certain 423 00:24:20,360 --> 00:24:25,720 structure and that's what you send over the shared signals 424 00:24:25,720 --> 00:24:28,560 framework. What it gives you is basically a 425 00:24:28,560 --> 00:24:31,360 reliable layer. So once you once you've sent 426 00:24:31,360 --> 00:24:33,640 something to a receiver, you know that the receiver has 427 00:24:33,640 --> 00:24:37,000 received it or you know that there was an error in sending 428 00:24:37,000 --> 00:24:38,520 it. And so you can decide what to do 429 00:24:38,520 --> 00:24:41,320 with that, right? So because of that reliability, 430 00:24:41,320 --> 00:24:45,440 because of that asynchronous nature, it is a versatile way of 431 00:24:45,440 --> 00:24:49,960 communicating signals that you might, you know, share with 432 00:24:49,960 --> 00:24:56,560 other parties on the Internet. Now what Cape does is, although 433 00:24:56,600 --> 00:24:59,680 the origin is very different, it didn't like emerge at something 434 00:24:59,680 --> 00:25:02,800 on top of shared signals. Shared signals was drawn from 435 00:25:02,800 --> 00:25:06,680 Cape and risk. So what Cape is now it's like 436 00:25:06,680 --> 00:25:11,360 Jeff said, it's a, you know, continuous access evaluation 437 00:25:11,360 --> 00:25:13,000 profile. So it's just a profile of the 438 00:25:13,000 --> 00:25:16,720 shared signals framework. It defines a set of events that 439 00:25:16,720 --> 00:25:20,080 are important from for zero trust. 440 00:25:20,120 --> 00:25:24,280 You can say right. What it does is it basically 441 00:25:24,320 --> 00:25:28,440 thinks of a session that you're having with a website, not as a 442 00:25:28,440 --> 00:25:32,120 one time thing that, oh, now you've logged in. 443 00:25:32,120 --> 00:25:35,000 So yeah, that's, that's it. You're you're on your own from 444 00:25:35,000 --> 00:25:37,360 now on. That's kind of the view we had 445 00:25:37,360 --> 00:25:39,240 when we just had Federated identity. 446 00:25:39,720 --> 00:25:42,360 What Cape does is basically thinks of that session as a 447 00:25:42,360 --> 00:25:46,080 continuous thing. And it it says that, OK, if 448 00:25:46,080 --> 00:25:50,760 anything changes on one end on, you know, on a party that is 449 00:25:50,760 --> 00:25:53,480 interested in that session, it should be able to communicate 450 00:25:53,480 --> 00:25:56,160 that to the other party and the other party should be able to 451 00:25:56,160 --> 00:25:58,200 decide what to do with that information, right? 452 00:25:58,680 --> 00:26:02,720 So it's a non prescriptive way of describing changes that 453 00:26:02,720 --> 00:26:06,800 affect your session. So an example of this is, let's 454 00:26:06,800 --> 00:26:13,440 say I'm using a mobile phone to to access ACRM website, right? 455 00:26:14,000 --> 00:26:16,480 And I've logged in using my identity provider. 456 00:26:17,320 --> 00:26:19,840 There are several things that can change, like the mobile 457 00:26:19,840 --> 00:26:21,400 phone can fall out of compliance. 458 00:26:21,680 --> 00:26:26,160 It might be there might be a sort of malware on that phone or 459 00:26:26,960 --> 00:26:29,480 it's not upgraded to the latest operating system. 460 00:26:29,480 --> 00:26:34,280 There are known vulnerabilities. And so you want to restrict how 461 00:26:34,280 --> 00:26:38,400 much of that CRM data you can, you know, download to that 462 00:26:38,400 --> 00:26:40,760 phone. You can do that now because the 463 00:26:40,760 --> 00:26:44,200 device management company or the endpoint management company can 464 00:26:44,200 --> 00:26:48,400 actually send you a signal saying now this phone is not 465 00:26:48,400 --> 00:26:50,440 compliant, right? It used to be compliant when the 466 00:26:50,880 --> 00:26:53,040 when the user logged in. So these are the kinds of things 467 00:26:53,040 --> 00:26:56,960 that you can enable using shared signals and using Cape. 468 00:26:57,840 --> 00:27:01,680 So shared signals is this common layer. 469 00:27:01,680 --> 00:27:06,040 Cape gives you 0 trust or session related signals. 470 00:27:06,520 --> 00:27:09,880 Risk is the other set of events on top of shared signals, which 471 00:27:09,880 --> 00:27:11,920 is RISK. Incident Sharing and 472 00:27:11,920 --> 00:27:16,440 coordination is the the, the full name of that acronym. 473 00:27:17,200 --> 00:27:19,400 It gives you account security signals, right? 474 00:27:19,400 --> 00:27:22,840 So if your account needs to be purged or if your account, if 475 00:27:22,840 --> 00:27:26,600 your password is compromised, you've detected it on the dark 476 00:27:26,600 --> 00:27:29,080 web, you know that this password needs to be changed. 477 00:27:29,400 --> 00:27:31,080 Those are the kinds of signals that you need. 478 00:27:31,400 --> 00:27:34,840 You can send using risk. And now in the IETF you have the 479 00:27:34,840 --> 00:27:39,000 scheme, you know, system for cross domain identity management 480 00:27:39,160 --> 00:27:45,560 scheme which has events scheme, events standard, which can use 481 00:27:45,560 --> 00:27:47,440 shared signals as as the transport. 482 00:27:47,440 --> 00:27:51,520 So now you're seeing more and more of these come up on top of 483 00:27:51,520 --> 00:27:54,600 shared signals. Yeah, I can see so. 484 00:27:54,600 --> 00:27:58,480 Many used cases for those, I mean generally it's about 485 00:27:58,480 --> 00:28:02,760 improving your security posture. But I'm wondering you know from 486 00:28:02,760 --> 00:28:07,280 the I am, I am, it's kind of like the the old term we've been 487 00:28:07,280 --> 00:28:10,240 using from the identity practitioner lens. 488 00:28:10,240 --> 00:28:15,000 I mean should we be thinking about this as a solution for our 489 00:28:15,000 --> 00:28:21,160 customer facing systems external or is this enterprise, you know, 490 00:28:21,160 --> 00:28:25,840 our workforce, where does the technology fit best or where do 491 00:28:25,840 --> 00:28:28,840 you see it the most? Right, so. 492 00:28:29,280 --> 00:28:31,600 Shared signals, of course, is a very broad technology. 493 00:28:31,600 --> 00:28:34,880 It can be used not just an identity, it can be used outside 494 00:28:34,880 --> 00:28:37,760 of identity as well. But things like Cape and risk 495 00:28:37,760 --> 00:28:44,040 can definitely be used in both consumer and, you know, employee 496 00:28:44,040 --> 00:28:48,000 or internal use cases. I'll give you examples, right? 497 00:28:48,000 --> 00:28:52,600 So I gave you the example of an employee accessing CRM on their 498 00:28:52,600 --> 00:28:54,680 phone. That's an employee example. 499 00:28:55,120 --> 00:29:00,040 Now I've seen banks who have disparate systems within the 500 00:29:00,040 --> 00:29:04,000 bank's infrastructure, having consumers who are accessing the 501 00:29:04,000 --> 00:29:08,560 bank services, know the bank at some point, you know, at some 502 00:29:08,560 --> 00:29:13,720 part of their infrastructure knows that this user is, you 503 00:29:13,720 --> 00:29:18,400 know, showing anomalous activity or this this high risk 504 00:29:18,400 --> 00:29:21,440 associated with this user. They don't have a way of 505 00:29:21,440 --> 00:29:24,120 communicating that to other parts within their bank and 506 00:29:24,120 --> 00:29:27,240 they're using Cape. There's a risk level change 507 00:29:27,240 --> 00:29:31,080 event in Cape that that they're able to send to mitigate the 508 00:29:31,080 --> 00:29:34,840 risk associated with that session right now to within the 509 00:29:34,840 --> 00:29:37,640 bank. So that's a consumer example of, 510 00:29:38,400 --> 00:29:42,160 you know, using shared signals in Cape for consumers. 511 00:29:44,320 --> 00:29:47,320 How is adoption? Going for SSF and Cape because I 512 00:29:47,320 --> 00:29:49,440 feel like this is something that I've been kind of preaching to, 513 00:29:49,440 --> 00:29:52,320 you know, my clients and others like, hey, start asking your 514 00:29:52,320 --> 00:29:55,120 vendors about when they're going to support SSF. 515 00:29:55,760 --> 00:29:58,040 How how's it going out in the real world? 516 00:29:58,680 --> 00:30:00,200 OK, great. Great question. 517 00:30:00,880 --> 00:30:05,880 So one thing I one news I would like to share is that and I 518 00:30:05,880 --> 00:30:08,960 think September last year we released the final version of 519 00:30:09,520 --> 00:30:13,440 Cape and shared signals. So one of the challenges we had 520 00:30:13,440 --> 00:30:16,600 when we we're looking for adoption is that people would 521 00:30:16,600 --> 00:30:18,440 say, well, the spec isn't final, right? 522 00:30:18,760 --> 00:30:21,280 But now that's not the case. The other thing that happened 523 00:30:21,280 --> 00:30:25,080 was that there was a CSRB report in I think March of last year or 524 00:30:25,760 --> 00:30:29,960 before that where the, one of the recommendations was to use 525 00:30:29,960 --> 00:30:33,560 shared signals, right? And now what we're seeing is 526 00:30:33,560 --> 00:30:38,080 that Apple has implemented shared signals in their Apple 527 00:30:38,080 --> 00:30:40,280 Business Manager. So if you want to integrate with 528 00:30:40,320 --> 00:30:45,000 Apple Business Manager using a custom IDP, then you have to 529 00:30:45,000 --> 00:30:47,320 have shared signals supported, right? 530 00:30:47,320 --> 00:30:51,480 So that's one of the first places where you've seen, you 531 00:30:51,480 --> 00:30:55,040 know, shared signals being adopted entirely in production. 532 00:30:56,000 --> 00:30:59,400 Now you have, you know, there was an announcement recently 533 00:30:59,400 --> 00:31:02,400 from Google about support for shared signals. 534 00:31:02,400 --> 00:31:05,560 It's enclosed beta right now. So they are supporting shared 535 00:31:05,560 --> 00:31:11,520 signals to using that you can revoke sessions in Google based 536 00:31:11,520 --> 00:31:13,920 on signals that that might be external to it. 537 00:31:13,920 --> 00:31:18,400 So device signals or identity providers sending Google signals 538 00:31:18,400 --> 00:31:21,200 about session revocation, credential change and things 539 00:31:21,200 --> 00:31:25,160 like that. And so, so those are the 222 540 00:31:25,160 --> 00:31:28,200 big, like huge technology providers. 541 00:31:28,400 --> 00:31:31,720 There's also Okta which has supported shared signals. 542 00:31:32,120 --> 00:31:36,440 They have, I think they work with Apple of course, but they 543 00:31:36,440 --> 00:31:39,960 also have other partners that provide them device signals and 544 00:31:39,960 --> 00:31:44,200 all that using shared signals. You, you have JAMF, which is a 545 00:31:44,480 --> 00:31:47,200 device management company that has shared signal support. 546 00:31:48,040 --> 00:31:51,840 Omnisa, which is a device management company that used to 547 00:31:51,840 --> 00:31:55,280 be a part of VM Ware and all is an independent company also 548 00:31:55,280 --> 00:31:59,200 support shared signals. The sale point of course, which 549 00:31:59,200 --> 00:32:01,400 is announced support for shared signals. 550 00:32:01,640 --> 00:32:03,960 IBM has announced support for shared signals. 551 00:32:05,080 --> 00:32:10,160 IBM actually has is as a part of the global Verify antenna 552 00:32:10,320 --> 00:32:14,160 product. And then of course our company 553 00:32:14,160 --> 00:32:17,680 signal support shared signals right from the beginning. 554 00:32:17,680 --> 00:32:22,400 So yeah, I think adoption wise we are seeing a lot of good 555 00:32:22,400 --> 00:32:25,520 support from good, you know, large technology providers. 556 00:32:26,560 --> 00:32:29,600 It's in production in some cases, in some beta in some 557 00:32:29,600 --> 00:32:32,800 other cases, but I think we're seeing the movement and having 558 00:32:32,800 --> 00:32:36,600 the final standard helps in that direction so I can. 559 00:32:36,600 --> 00:32:38,920 Certainly understand wanting to wait for that final standard to 560 00:32:38,920 --> 00:32:40,760 be in place because you know, you don't want to build on a 561 00:32:40,760 --> 00:32:43,480 moving target, but now the target is set. 562 00:32:44,080 --> 00:32:46,880 You know, if, if you're going to make a plea to vendors out there 563 00:32:46,880 --> 00:32:49,280 to say, hey, we're ready. Like what are some of the 564 00:32:49,280 --> 00:32:53,680 benefits that a vendor gets being part of the SSF and and 565 00:32:53,680 --> 00:32:55,560 Cape kind of frameworks that are out there? 566 00:32:58,080 --> 00:33:02,040 I think it's not out of the question that pretty much soon 567 00:33:02,040 --> 00:33:06,040 RFPs might require you to have shared signals because they're, 568 00:33:06,120 --> 00:33:09,760 you know, if they're following guidelines from the CSRB or you 569 00:33:09,760 --> 00:33:12,080 know, guidelines that might become be coming out in the 570 00:33:12,080 --> 00:33:16,160 future, you might just have to do that as stable stakes, right? 571 00:33:16,280 --> 00:33:20,440 So that's one thing. But beyond that, I think it's so 572 00:33:20,440 --> 00:33:24,320 much easier to integrate using shared signals in Cape rather 573 00:33:24,320 --> 00:33:27,600 than having to integrate with every other providers API. 574 00:33:27,920 --> 00:33:30,760 I've been in so many meetings that, you know, previous jobs 575 00:33:30,760 --> 00:33:34,520 that I've held where every company is saying, oh, you write 576 00:33:34,520 --> 00:33:36,760 to our API and then we're saying, oh, no, no, no, you 577 00:33:36,760 --> 00:33:40,080 write to our API and you know, it just goes nowhere, right? 578 00:33:40,480 --> 00:33:43,680 And so you don't want to get into any of that discussion. 579 00:33:43,680 --> 00:33:47,560 You just implement shared signals, you get a lot of 580 00:33:47,560 --> 00:33:50,480 capability that you can use with a lot of different partners and 581 00:33:50,480 --> 00:33:55,720 it becomes so much easier for them to to interoperate. 582 00:33:55,840 --> 00:33:59,680 So that will be the primary reason why you would want to do 583 00:33:59,680 --> 00:34:02,680 that. Like if you're, let's say 584 00:34:02,680 --> 00:34:06,360 Zscaler, you know, I was just on a podcast with Zscaler and 585 00:34:06,360 --> 00:34:09,760 they're, you know, they're also committed to share signals. 586 00:34:10,080 --> 00:34:14,320 So all of these ecosystems are coming about which are using 587 00:34:14,320 --> 00:34:18,960 shared signals to just exchange device signals, credential 588 00:34:18,960 --> 00:34:23,159 related signals, you know, session revocation and all those 589 00:34:23,159 --> 00:34:26,040 things I. Mean fundamentally. 590 00:34:26,040 --> 00:34:29,679 It's, it's a great solution for a problem that I think a lot of 591 00:34:29,679 --> 00:34:32,280 people have of how do these things talk to each other? 592 00:34:32,800 --> 00:34:34,960 But I think it's almost like a little bit of a chicken and egg. 593 00:34:34,960 --> 00:34:38,639 It's like, OK, first of all, you have to build it and then you 594 00:34:38,639 --> 00:34:41,360 have to have people who want it so that people then build it 595 00:34:41,360 --> 00:34:44,320 into their things. So you've got adoption from like 596 00:34:44,320 --> 00:34:47,760 vendors, but then you also need your customers and your real 597 00:34:47,760 --> 00:34:50,520 world. I am people asking their vendors 598 00:34:50,520 --> 00:34:53,639 for it. So how do we get the word out 599 00:34:53,639 --> 00:34:56,600 beyond, you know, the globally famous Identity Center podcast? 600 00:34:56,600 --> 00:34:58,400 Hey, go ask for share signals framework. 601 00:34:59,400 --> 00:35:03,760 But how do we educate the people to say, hey, this capability is 602 00:35:03,760 --> 00:35:08,800 here it is finalized at least for a one point O how do you how 603 00:35:08,800 --> 00:35:11,480 do we make them aware that exists so they can start asking 604 00:35:11,480 --> 00:35:13,600 their vendors to adopt it? Yeah. 605 00:35:14,360 --> 00:35:17,360 So I've been talking relentlessly about this for the 606 00:35:17,360 --> 00:35:22,320 past, you know, five years since I wrote that blog in Google, or 607 00:35:22,320 --> 00:35:27,920 maybe six years now, right? So I think that, you know, there 608 00:35:27,920 --> 00:35:29,760 is a natural appeal to this, right? 609 00:35:30,000 --> 00:35:32,880 People get it, like it. It doesn't take me a lot of 610 00:35:32,880 --> 00:35:36,120 effort to explain to people why this is beneficial. 611 00:35:36,120 --> 00:35:37,520 There's so much appeal to it, right? 612 00:35:37,520 --> 00:35:41,200 This fundamentally, that is what drives people to saying, huh, 613 00:35:41,280 --> 00:35:45,360 maybe I should be having this. And then that starts a sort of a 614 00:35:45,360 --> 00:35:49,360 cycle of people asking the question to their vendors, 615 00:35:49,920 --> 00:35:51,800 people asking their analysts about it. 616 00:35:51,800 --> 00:35:56,000 The analysts get interested, you know, and just being 617 00:35:56,000 --> 00:36:00,560 relentlessly sort of talking about it, telling people that 618 00:36:00,560 --> 00:36:05,640 why this is important has been a big part of why we're here is 619 00:36:05,640 --> 00:36:08,000 because otherwise you end up in this situation. 620 00:36:08,000 --> 00:36:10,240 Yeah, it's a good idea, but nobody has done it, so why 621 00:36:10,240 --> 00:36:13,160 should I do it, right? And having those 622 00:36:13,160 --> 00:36:17,280 interoperability events crystallized a lot of that or 623 00:36:17,280 --> 00:36:19,080 catalyzed a lot of that momentum. 624 00:36:19,080 --> 00:36:23,080 I think so, yeah. It's a long slog. 625 00:36:24,320 --> 00:36:25,360 It's like anything. Else, right, you have to 626 00:36:25,360 --> 00:36:27,920 continually market it and make sure people aware of it, improve 627 00:36:27,920 --> 00:36:29,120 on it. Where people think that, you 628 00:36:29,120 --> 00:36:30,480 know, there's an update to the specs needed. 629 00:36:31,600 --> 00:36:36,280 This was built and the era of humans, for lack of a better 630 00:36:36,280 --> 00:36:42,200 term, is there application for SSF and Cape in the world of 631 00:36:42,200 --> 00:36:46,560 agentic identity? So AIMCP, you know, things like 632 00:36:46,560 --> 00:36:48,520 the A to A, right, All the different acronyms that are out 633 00:36:48,520 --> 00:36:50,600 there. Yeah, I think. 634 00:36:50,760 --> 00:36:54,880 Right now we are forming these really long chains in MCP of, 635 00:36:54,880 --> 00:36:57,240 you know, one agent calling another agent calling another 636 00:36:57,240 --> 00:37:01,120 agent kind of thing, like an MCP client calling an MCP server, 637 00:37:01,120 --> 00:37:03,960 which in turn is an MCP client to another MCP server. 638 00:37:03,960 --> 00:37:07,160 And you create these long chains of sort of work. 639 00:37:07,640 --> 00:37:09,480 And there's no kill chain right now to it. 640 00:37:09,880 --> 00:37:14,040 Like if somebody wants to say this employee is terminated, 641 00:37:14,320 --> 00:37:17,400 just stop all of that right now. There's no way to do that. 642 00:37:18,240 --> 00:37:20,280 I think gape could be a great way to do that. 643 00:37:22,280 --> 00:37:28,040 Beyond that, I think it could be useful in, you know, the 644 00:37:28,400 --> 00:37:30,600 communicating those properties changes. 645 00:37:30,600 --> 00:37:34,200 Like let's say I was in a particular group when I started 646 00:37:34,200 --> 00:37:36,520 and now, you know, I don't have access anymore. 647 00:37:36,880 --> 00:37:39,600 And so I should communicate that information throughout that 648 00:37:39,920 --> 00:37:43,320 chain because these tasks can be really long lived. 649 00:37:43,440 --> 00:37:48,080 You want to have that capability to modulate the access as you as 650 00:37:48,080 --> 00:37:50,760 you go, right? And shared signals can 651 00:37:50,760 --> 00:37:54,440 definitely do that. You know Tulas. 652 00:37:54,440 --> 00:37:59,200 You're kind of describing this. This just resonates with people. 653 00:37:59,200 --> 00:38:03,360 I was like shaking my head, yes, because just the concept within 654 00:38:03,360 --> 00:38:05,600 the first minute of you talking about, I don't need to know the 655 00:38:05,600 --> 00:38:09,120 details to know like, oh, yeah, this totally makes sense. 656 00:38:10,520 --> 00:38:13,040 I wanted to follow up on one thing that you're talking about, 657 00:38:13,040 --> 00:38:18,080 which was talk to your vendors and let's get a little more 658 00:38:18,080 --> 00:38:21,760 specific, what kind of vendors would this be your IDP, would 659 00:38:21,760 --> 00:38:25,680 this be your Productivity Tools? Is the answer like yes to the 660 00:38:25,680 --> 00:38:29,200 all the above or like who, who do you talk to, right? 661 00:38:29,200 --> 00:38:32,760 I mean, obviously when you put it on an RFP, that's one thing. 662 00:38:33,120 --> 00:38:37,800 But we're talking also about apps that probably we have in 663 00:38:37,800 --> 00:38:40,880 the enterprise already. Yeah, I think. 664 00:38:41,240 --> 00:38:45,360 Your SAS vendors, for example, let's say you're doing Federated 665 00:38:45,360 --> 00:38:48,200 identity, log into the SAS, right? 666 00:38:49,600 --> 00:38:53,000 How do you get your users out of there if something changes or if 667 00:38:53,000 --> 00:38:56,480 something goes wrong, right? How do you modulate the access 668 00:38:56,480 --> 00:39:00,320 that you have in that SAS system based on changes in your 669 00:39:00,320 --> 00:39:04,600 directory or based on changes in, you know, maybe the user is 670 00:39:04,600 --> 00:39:08,520 going off duty and you don't want that user to be accessing 671 00:39:08,520 --> 00:39:11,560 the SAS system anymore. How do you affect that? 672 00:39:11,600 --> 00:39:14,920 You use that, you use KP, you use share signals to do that. 673 00:39:15,600 --> 00:39:19,000 And I think talking to your SAS vendors, talking to your 674 00:39:19,000 --> 00:39:23,000 identity providers for sure, which by the way, there's a lot 675 00:39:23,000 --> 00:39:26,280 of good news there that, you know, at least Okta is wholly 676 00:39:26,280 --> 00:39:29,920 committed to it. We're also seeing some others 677 00:39:30,720 --> 00:39:36,080 look at it favourably. You said productivity apps like 678 00:39:36,080 --> 00:39:39,280 Google Workspace has just committed to it. 679 00:39:39,280 --> 00:39:41,920 They've launched their private beta and they'll be supporting 680 00:39:41,920 --> 00:39:45,160 it it soon. Your device management players 681 00:39:45,160 --> 00:39:49,760 like Jamf and others on this are, are supporting it. 682 00:39:49,760 --> 00:39:55,800 So all of your vendors, anyone who has a stake in the user's 683 00:39:55,800 --> 00:39:59,080 session security should be adopting Cape and shared 684 00:39:59,080 --> 00:40:00,520 signals. So. 685 00:40:01,520 --> 00:40:04,440 If you're saying I'm adopting this particular device 686 00:40:04,440 --> 00:40:07,760 management platform, you would ask them like what happens if 687 00:40:07,760 --> 00:40:10,120 that device posture changes? How are you going to communicate 688 00:40:10,120 --> 00:40:14,360 that downstream? And maybe they have a better 689 00:40:14,360 --> 00:40:15,920 answer than shared signals or Cape. 690 00:40:15,920 --> 00:40:19,440 But shared signals or Cape is is a good answer, right? 691 00:40:19,440 --> 00:40:23,800 Because shared signals and Cape would be based on the standard 692 00:40:23,920 --> 00:40:27,200 you're saying they may have a proprietary solution, right? 693 00:40:27,640 --> 00:40:32,320 And so and generally, I think proprietary solutions are not 694 00:40:32,320 --> 00:40:35,840 what you want to build your enterprise architecture on, but 695 00:40:36,120 --> 00:40:37,640 I can save that for another show. 696 00:40:38,000 --> 00:40:40,040 I think the standard is so important. 697 00:40:40,560 --> 00:40:42,480 Where does the standard go from here? 698 00:40:42,480 --> 00:40:44,000 Right. The we're sitting at the 699 00:40:44,000 --> 00:40:47,120 beginning of 2026. Where's the need to go in the 700 00:40:47,120 --> 00:40:49,440 next few years? Yeah. 701 00:40:50,440 --> 00:40:53,080 I think one of the main things we're doing right now is 702 00:40:53,080 --> 00:40:58,200 launching A certification program so that a a technology 703 00:40:58,200 --> 00:41:02,880 provider can say my product is certified, interoperable with 704 00:41:03,200 --> 00:41:06,360 Cape or with shared signals. What that gives you is the 705 00:41:06,360 --> 00:41:09,040 confidence that, you know when you plug it in, it's not like 706 00:41:09,600 --> 00:41:12,680 those two companies will say, oh, we both support Cape and 707 00:41:12,680 --> 00:41:15,040 they actually don't talk to each other because they're doing 708 00:41:15,040 --> 00:41:16,720 something different about about it. 709 00:41:17,120 --> 00:41:21,840 That certification program will help you be assured that if you 710 00:41:21,840 --> 00:41:25,400 adopt that kind of product that is certified, then it's going to 711 00:41:25,400 --> 00:41:27,080 work with anything else that is certified. 712 00:41:27,440 --> 00:41:31,160 So you know, that's what we're launching right now. 713 00:41:31,880 --> 00:41:34,280 Initial launches for transmitters will be working on 714 00:41:34,280 --> 00:41:38,600 the receiver part soon after that, there's a bunch of stuff 715 00:41:38,600 --> 00:41:41,960 that we punted on in the V1 of the standard. 716 00:41:42,120 --> 00:41:45,840 These are important things, but not critical to the success of 717 00:41:45,840 --> 00:41:48,680 the standard right now. But those are the things that we 718 00:41:48,680 --> 00:41:53,160 will be working on soon after. I think what it will give you is 719 00:41:53,160 --> 00:41:57,800 much more capability in terms of what you can do with shared 720 00:41:57,800 --> 00:42:01,800 signals and Cape and we'll be working on that going forward. 721 00:42:01,800 --> 00:42:06,080 So those are a couple of things that we are we're doing in the 722 00:42:06,080 --> 00:42:07,600 shared signal working group right now. 723 00:42:08,520 --> 00:42:12,040 Yeah, the certification. Program seems like you answered 724 00:42:12,040 --> 00:42:15,240 my question right. So, so certification is for not 725 00:42:15,240 --> 00:42:18,760 for people to be home experts, it's for companies to have their 726 00:42:18,760 --> 00:42:26,000 products certified as SSF and Cape compliant right. 727 00:42:26,000 --> 00:42:29,960 So it reminds me a lot of what Fido Alliance is doing. 728 00:42:31,000 --> 00:42:35,760 And I think it's kind of the, the breaking point for them was 729 00:42:35,760 --> 00:42:40,720 when big tech, especially like device manufacturers, the 730 00:42:40,720 --> 00:42:44,600 Apples, the Googles of the world, big platform players, 731 00:42:44,600 --> 00:42:52,040 Microsoft, etcetera, got behind the Fido 2 standard and pass 732 00:42:52,040 --> 00:42:54,960 keys and things like that. I would imagine that the 733 00:42:54,960 --> 00:42:59,560 certification program, you know, it's, it's a big deal, right? 734 00:42:59,560 --> 00:43:02,720 There's going to be a lot of people, a lot of organizations 735 00:43:02,720 --> 00:43:05,680 that want to get their platform certified. 736 00:43:06,880 --> 00:43:12,120 Yeah, I, I. Certainly think so that many of 737 00:43:12,120 --> 00:43:14,720 these companies are on the board of Open ID Foundation. 738 00:43:14,720 --> 00:43:18,520 And so I would expect them to be very receptive to having the 739 00:43:18,520 --> 00:43:21,760 certification program. Yeah, yeah. 740 00:43:21,800 --> 00:43:25,680 And I'm sorry, I think you you alluded to it, but what kind of 741 00:43:25,680 --> 00:43:28,880 dates do you have lined up for when the certification program 742 00:43:28,880 --> 00:43:31,720 is going to be launched? And if people have questions 743 00:43:31,720 --> 00:43:34,120 about the certification program, should they? 744 00:43:34,360 --> 00:43:39,000 Who should they reach out to? Right, so you can always reach 745 00:43:39,000 --> 00:43:42,120 out to me at the Open ID Foundation, like the Shared 746 00:43:42,120 --> 00:43:47,520 Signals mailing list about certification, but you can also 747 00:43:48,320 --> 00:43:53,360 watch the Open ID Shared Signals web page for an update on 748 00:43:53,360 --> 00:43:55,440 certification. We'll be publishing A blog post 749 00:43:55,440 --> 00:44:00,280 when it comes out, and I want to be super conservative here and 750 00:44:00,280 --> 00:44:04,880 saying that in the first half of this year, in 2026, we will be 751 00:44:04,880 --> 00:44:09,480 having a certification program for shared signals and Cape. 752 00:44:11,000 --> 00:44:13,920 So that's exciting news. I want to ask a question because 753 00:44:13,920 --> 00:44:17,160 I feel like maybe it's kind of got lost in all the news of SSF 754 00:44:17,160 --> 00:44:19,920 and Cape is what happened to Risk RASC? 755 00:44:20,560 --> 00:44:24,040 Yeah. So risk is it's actually doing 756 00:44:24,040 --> 00:44:26,440 pretty well. It's something that is a little 757 00:44:26,440 --> 00:44:30,720 bit of, you know, it went into the background a little bit 758 00:44:31,720 --> 00:44:33,960 because everybody was interested more in Cape. 759 00:44:34,000 --> 00:44:42,120 But if you look at irsandid.meandithinkthelogin.gov, 760 00:44:42,520 --> 00:44:46,840 they're all using risk to exchange security signals about 761 00:44:47,160 --> 00:44:50,440 accounts. So if you've created an IRS 762 00:44:50,440 --> 00:44:55,520 account, then your account provider is going to send risk 763 00:44:55,520 --> 00:44:59,160 signals when let's say you're, you change devices or you're, 764 00:44:59,160 --> 00:45:01,480 you know, you report your passkey as being like 765 00:45:02,400 --> 00:45:05,000 compromised or you know, your device has been wiped or 766 00:45:05,000 --> 00:45:07,800 something like that. They will use risk to 767 00:45:07,800 --> 00:45:10,640 communicate those, those signals to each other. 768 00:45:10,640 --> 00:45:13,120 So that is happening right now in production. 769 00:45:14,040 --> 00:45:17,440 Is it fair to say? Like if we say SSF, it kind of 770 00:45:17,440 --> 00:45:21,920 means SSF Cape and risk is sort of like a bundle or is it always 771 00:45:21,920 --> 00:45:27,040 separate? SSF can be used with Cape, can 772 00:45:27,040 --> 00:45:29,520 be used with risk, can be used with scam events. 773 00:45:30,320 --> 00:45:34,280 The certification program right now that we're working on is 774 00:45:34,280 --> 00:45:39,720 specific to Cape, to few events in Cape because those seem to be 775 00:45:39,800 --> 00:45:42,440 of most interest to the community that that is 776 00:45:42,440 --> 00:45:46,320 interested in the certification. But yeah, I've had discussions 777 00:45:46,320 --> 00:45:50,400 with large providers about risk and having a risk certification 778 00:45:50,400 --> 00:45:54,800 program as well. So when you talk generally about 779 00:45:54,800 --> 00:45:59,720 SSF, you're either talking about the platform where which gives 780 00:45:59,720 --> 00:46:03,320 you the asynchronous capability or you're talking about SSF in 781 00:46:03,320 --> 00:46:07,000 the context of Cape or risk or skim events, right, So. 782 00:46:09,120 --> 00:46:12,120 So I have a. Something I'm sitting on because 783 00:46:12,120 --> 00:46:15,400 I, I wasn't sure if I'm going to make a fool of myself and how I 784 00:46:15,400 --> 00:46:18,480 asked this, but I'm going to do it anyway because I'm trying to 785 00:46:18,480 --> 00:46:21,520 figure out how does this thing work, right? 786 00:46:21,520 --> 00:46:25,040 So you've got say, I'll use an example. 787 00:46:25,040 --> 00:46:28,320 So you have your sales force application and that's going to 788 00:46:28,320 --> 00:46:31,800 be one of those systems that sends signals. 789 00:46:32,760 --> 00:46:36,160 So I'm wondering, does it have? Some sort of a? 790 00:46:36,160 --> 00:46:38,680 Bus where it puts the signals and you go out and you fetch 791 00:46:38,680 --> 00:46:41,360 them. Does it use some kind of broker 792 00:46:41,640 --> 00:46:44,960 so that the broker gets it and sends it or is it point to point 793 00:46:44,960 --> 00:46:50,320 like Salesforce has to send it to your IDP for example? 794 00:46:50,720 --> 00:46:52,200 Yeah. Yeah, great question. 795 00:46:52,200 --> 00:46:54,880 So it is a point to point transport. 796 00:46:54,880 --> 00:46:58,360 So what happens is that when you have two parties that share a 797 00:46:58,360 --> 00:47:02,800 user, let's say Salesforce and you know, Okta, for example, 798 00:47:02,960 --> 00:47:06,160 right? And Salesforce says that I'm 799 00:47:06,160 --> 00:47:10,480 interested in any changes. Like let's not talk about 800 00:47:10,480 --> 00:47:12,600 Salesforce because they don't actually support this right now, 801 00:47:12,600 --> 00:47:14,240 but let's talk about Google for example. 802 00:47:15,080 --> 00:47:18,040 So let's say Google is the service provider where you have 803 00:47:18,040 --> 00:47:21,320 Google Workspace and you're using Docs and Drive and all 804 00:47:21,320 --> 00:47:24,000 that. And Google wants to know if you 805 00:47:24,000 --> 00:47:26,760 have changed your password at your identity provider, which 806 00:47:26,760 --> 00:47:31,200 might be Octa, right? And So what Google will do is as 807 00:47:31,280 --> 00:47:33,720 they will want to be a receiver of those signals, right? 808 00:47:34,080 --> 00:47:38,840 So what they'll do is they'll call an API provided by Okta, 809 00:47:38,840 --> 00:47:41,680 and the API is what is defined in the shared signal standard, 810 00:47:42,720 --> 00:47:45,440 which is your stream management API, right? 811 00:47:45,720 --> 00:47:49,600 And they'll say I want to create a stream with you and I want 812 00:47:49,600 --> 00:47:54,560 information about these events like credential change or device 813 00:47:54,560 --> 00:47:57,680 compliance change or you know, session revoked or you know, 814 00:47:57,680 --> 00:47:59,320 whatever else they're interested in. 815 00:48:00,200 --> 00:48:04,480 Whenever that happens, you can send me that event over the 816 00:48:04,480 --> 00:48:05,880 stream. So there's a point to point 817 00:48:05,880 --> 00:48:11,080 stream that is created between Okta and Okta as a transmitter 818 00:48:11,080 --> 00:48:15,280 and Google as the receiver. And so when let's say Okta has 819 00:48:15,280 --> 00:48:20,160 that event, they will send a security event token over the 820 00:48:20,160 --> 00:48:22,920 stream to Google. And there are two transport, 821 00:48:22,920 --> 00:48:25,800 there's a pulling transport or a push transport. 822 00:48:26,760 --> 00:48:30,920 So Google can either pull for new events or they can push the 823 00:48:30,960 --> 00:48:34,640 Octagon, push new events to Google and they get 824 00:48:34,640 --> 00:48:37,920 acknowledgements about whether that event was successfully 825 00:48:37,920 --> 00:48:40,760 delivered or not. And based on that Octagon decide 826 00:48:40,760 --> 00:48:43,280 whether or not to resend that event and things like that. 827 00:48:43,480 --> 00:48:46,800 So there's a reliability layer built into all that, but it's a 828 00:48:46,800 --> 00:48:50,720 point to point transport between a transmitter and the receiver. 829 00:48:51,040 --> 00:48:55,280 And they agree on which events they want to exchange, they 830 00:48:55,280 --> 00:48:58,760 agree on which subjects they want the events about. 831 00:49:00,480 --> 00:49:03,720 You can also do things like verification of the event 832 00:49:03,720 --> 00:49:06,600 stream. So the Google can periodically 833 00:49:06,600 --> 00:49:09,800 tell Octa, hey, I want to make sure that the stream is still 834 00:49:09,800 --> 00:49:12,600 alive. So send me a verification event. 835 00:49:12,600 --> 00:49:15,000 So, and when Octa receives that, they're going to send you a 836 00:49:15,000 --> 00:49:17,720 verification event. You get the verification event, 837 00:49:17,720 --> 00:49:20,040 you find out, OK, the stream is still alive, right? 838 00:49:20,360 --> 00:49:23,480 So these are the kinds of things that help build confidence that 839 00:49:23,480 --> 00:49:27,200 you're not going to miss a signal because it's it'll be 840 00:49:27,200 --> 00:49:30,280 kind of disastrous if you had a device compliance change event 841 00:49:30,920 --> 00:49:34,760 and you, you send that this device was compliant and now 842 00:49:34,760 --> 00:49:37,840 it's non compliant and the receiver never received it. 843 00:49:38,600 --> 00:49:44,080 And so you're relying on that to assert your posture for the 844 00:49:44,080 --> 00:49:46,280 user. And if you if you miss that 845 00:49:46,280 --> 00:49:49,800 signal, it's it's going to be a very bad thing from a security 846 00:49:49,800 --> 00:49:52,760 perspective, which is why the reliability of that shared 847 00:49:52,760 --> 00:49:54,880 signals framework transport is so important. 848 00:49:56,200 --> 00:49:58,480 Is that where the certification comes in, is making sure that 849 00:49:58,480 --> 00:50:01,960 that is working as designed? Yeah. 850 00:50:01,960 --> 00:50:04,840 Having all those features is a part of that certification 851 00:50:04,840 --> 00:50:09,360 event, a certification program. I feel like there's so much. 852 00:50:09,360 --> 00:50:12,200 To learn here and you are kind enough ahead of our call to send 853 00:50:12,200 --> 00:50:15,080 like a bunch of links and I'll have links in our show notes for 854 00:50:15,080 --> 00:50:18,720 people to check out. But if I am just getting into 855 00:50:18,720 --> 00:50:21,200 this space right now, I'm not a spec person. 856 00:50:22,120 --> 00:50:24,440 What's the fastest? Way or what's the what's is 857 00:50:24,440 --> 00:50:27,320 there a YouTube video A blog article or something that can 858 00:50:27,320 --> 00:50:32,040 kind of get me up to speed on SSF ape risk all that kind of 859 00:50:32,040 --> 00:50:37,160 stuff this there's a. Few YouTube videos I have sent 860 00:50:37,160 --> 00:50:40,320 you the links and that when I explain just what escape and 861 00:50:40,320 --> 00:50:42,600 risk. But what I would recommend is go 862 00:50:42,600 --> 00:50:46,320 to the Cape dot dev website, which is helps you. 863 00:50:47,280 --> 00:50:50,520 It started as something that helped you test your transmitter 864 00:50:50,520 --> 00:50:53,560 and a receiver implementation. So if you had a receiver, you 865 00:50:53,560 --> 00:50:55,920 needed to have a transfer that would send you events so that 866 00:50:55,920 --> 00:50:59,080 you could you could know that you can receive them and vice 867 00:50:59,080 --> 00:51:01,280 versa. So it started as that, but now 868 00:51:01,280 --> 00:51:04,760 it has a help section. It has, you know, details about 869 00:51:04,760 --> 00:51:08,400 like what is SSF and what is Cape and it even has a white 870 00:51:08,400 --> 00:51:12,680 paper about Cape best practices. So it can help you like plan 871 00:51:12,680 --> 00:51:16,800 your strategy as far as, you know, adoption, implementation 872 00:51:16,800 --> 00:51:19,560 and all that is concerned. There's also open source, which 873 00:51:19,560 --> 00:51:21,880 you can use. So Cape dot dev is actually a 874 00:51:21,880 --> 00:51:24,560 pretty good resource in addition to the videos that I talked 875 00:51:24,560 --> 00:51:27,400 about. So I have those links in. 876 00:51:27,400 --> 00:51:29,600 Our show notes for people to check out and that website for 877 00:51:29,600 --> 00:51:33,320 people to start at is Cape dot dev CAEP dot dev. 878 00:51:34,520 --> 00:51:35,360 That'll put. That'll put you. 879 00:51:35,360 --> 00:51:39,040 Right where you need to go. So I feel like we could probably 880 00:51:39,040 --> 00:51:40,600 go on for hours, but we're not going to do that. 881 00:51:41,120 --> 00:51:44,720 Direct people to websites. Not everyone's able to go to, 882 00:51:44,840 --> 00:51:47,040 you know, conferences and kind of check out the talks that you 883 00:51:47,040 --> 00:51:53,000 and Ian and Tim and Sean and Andrew and Shane and others have 884 00:51:53,000 --> 00:51:55,640 given sort of on this topic. But I would highly encourage 885 00:51:55,640 --> 00:52:00,560 people this is the year to like really understand it because 886 00:52:00,560 --> 00:52:03,800 it's such a big foundational part of what continuous identity 887 00:52:03,800 --> 00:52:05,760 is all about, which is another big trend that we're seeing in 888 00:52:05,760 --> 00:52:07,720 the space. So definitely encourage people 889 00:52:07,720 --> 00:52:09,920 to go check that out. I want to leave the conversation 890 00:52:09,920 --> 00:52:11,960 to hear on a lighter note as we always do. 891 00:52:12,120 --> 00:52:19,680 And I am feeling very anxious because I have not been out of 892 00:52:19,680 --> 00:52:23,040 my house sort of area in two months. 893 00:52:23,560 --> 00:52:26,000 I have not been any trips I've been since I got back from 894 00:52:26,000 --> 00:52:27,880 Gartner. We adopted a puppy so that has 895 00:52:27,880 --> 00:52:31,800 taken up almost all my time. Weather here has been sort of 896 00:52:31,800 --> 00:52:35,240 weird on the East Coast with like different storm systems 897 00:52:35,240 --> 00:52:37,320 coming through. And so my first trip is actually 898 00:52:37,320 --> 00:52:39,640 next week. I'm headed out to a conference 899 00:52:39,640 --> 00:52:44,040 in Richmond, VA, and that's my first time in two months going 900 00:52:44,040 --> 00:52:45,640 anywhere, which is a long time for me. 901 00:52:45,920 --> 00:52:47,080 Usually I'm on the road all the time. 902 00:52:47,800 --> 00:52:50,920 But you mentioned that you had gone somewhere recently in which 903 00:52:50,920 --> 00:52:53,920 I find very fascinating. Tell the audience where you went 904 00:52:53,920 --> 00:52:55,360 and tell us a little bit about this trip. 905 00:52:57,240 --> 00:53:02,280 We went to Kenya and we went specifically to go to some of 906 00:53:02,280 --> 00:53:07,280 their national parks and watch the big games and it was a 907 00:53:07,280 --> 00:53:10,800 blast. It was like unbelievable. 908 00:53:10,800 --> 00:53:14,400 Like you enter the park and you're surrounded by these like 909 00:53:14,440 --> 00:53:20,760 flocks of like large herds of like, you know, wildebeest and 910 00:53:20,760 --> 00:53:23,560 zebras and elephants and whatnot. 911 00:53:23,560 --> 00:53:29,560 And it's these, you know, really huge vistas of open land and 912 00:53:29,920 --> 00:53:32,080 those beautiful trees that they have there. 913 00:53:32,360 --> 00:53:35,920 It was just fascinating. But the, the, I guess the 914 00:53:36,640 --> 00:53:40,520 highlight of the trip was when we were in Masai Mara, one of 915 00:53:40,520 --> 00:53:46,400 their, you know, national parks, We, we saw a bunch of lions 916 00:53:47,520 --> 00:53:50,760 attack, hunt down a, a wild Buffalo. 917 00:53:51,440 --> 00:53:56,360 And it was, it was fascinating how they strategized and how 918 00:53:56,360 --> 00:54:02,280 they isolated 1 Buffalo and then how they literally like trick 919 00:54:02,400 --> 00:54:05,600 the Buffalo into thinking that there was just one little lion 920 00:54:05,600 --> 00:54:10,560 that it was trying to fend off. And it pulled that Buffalo into 921 00:54:10,560 --> 00:54:13,440 this area where the other lions were waiting. 922 00:54:13,720 --> 00:54:17,920 And then they all sort of jumped on it and the poor thing was 923 00:54:17,920 --> 00:54:19,800 fighting them for about 1/2 hour. 924 00:54:21,120 --> 00:54:24,120 You wouldn't believe the amount of effort it took to just pull 925 00:54:24,120 --> 00:54:27,440 down that Buffalo. Like for, for like the four 926 00:54:27,440 --> 00:54:30,760 lions that were on it. Like it was, it was pretty 927 00:54:30,760 --> 00:54:33,680 dramatic. And you know, as soon as that 928 00:54:33,680 --> 00:54:37,440 starts happening, you have these vultures circling around in the 929 00:54:37,440 --> 00:54:41,480 sky and you have the hyenas kind of coming closer and closer. 930 00:54:41,480 --> 00:54:45,680 And finally, when the Buffalo comes down, you, you had these 931 00:54:46,080 --> 00:54:48,520 lions like, you know, start eating it. 932 00:54:48,680 --> 00:54:52,480 And after a while the hyenas chased the lions out and then 933 00:54:52,480 --> 00:54:55,560 they started eating the Buffalo. And then the vultures came in 934 00:54:55,560 --> 00:54:58,640 and it was the whole deal. It was like, wow, you know, I 935 00:54:58,640 --> 00:55:01,280 didn't imagine I would, I would be seeing something like that 936 00:55:01,280 --> 00:55:05,280 from like a distance of 30 or 40 feet, so. 937 00:55:06,840 --> 00:55:09,200 Yeah, it. Was unbelievable. 938 00:55:10,040 --> 00:55:13,840 That's pretty close. It's like this is probably not a 939 00:55:13,840 --> 00:55:16,280 thing for everybody because I think people might get kind of 940 00:55:16,280 --> 00:55:18,240 squeamish around that kind of thing. 941 00:55:18,760 --> 00:55:20,360 But I, I. Right of. 942 00:55:20,600 --> 00:55:22,880 This is, this is you're observing nature. 943 00:55:22,880 --> 00:55:25,040 This is what's happening, Yeah. And. 944 00:55:25,040 --> 00:55:29,000 It's and it's cruel. It's like it's yeah, I couldn't 945 00:55:29,000 --> 00:55:32,240 watch the half of it. Like I was like, OK, I don't 946 00:55:32,240 --> 00:55:34,240 want to see anymore, but I was there. 947 00:55:35,840 --> 00:55:36,920 Did you go with your? Family. 948 00:55:36,920 --> 00:55:38,320 Were there others like how did this work? 949 00:55:38,400 --> 00:55:41,880 Yeah, I went with. My my 2 grown kids and my wife. 950 00:55:41,880 --> 00:55:44,400 And so, yeah, we were, we were all there. 951 00:55:44,800 --> 00:55:48,960 We had flown in from different parts of the US and so we were, 952 00:55:48,960 --> 00:55:51,360 we met there. So tell me about the trip. 953 00:55:51,360 --> 00:55:52,760 Like where? Did you come like, where did you 954 00:55:52,760 --> 00:55:54,720 meet? Into Africa? 955 00:55:54,840 --> 00:55:58,400 So we. Like my younger son lives in New 956 00:55:58,400 --> 00:56:04,000 York and so we met in Amsterdam and we had the same flight from 957 00:56:04,000 --> 00:56:08,200 Amsterdam to my older son lives in San Francisco, which is close 958 00:56:08,200 --> 00:56:12,960 to where I am, hence that little thing there which is my son's 959 00:56:12,960 --> 00:56:19,000 gift to me. And so we started our trip in 960 00:56:19,000 --> 00:56:23,800 San Francisco airport and the three of us, my wife and I, and 961 00:56:23,800 --> 00:56:26,440 my older son flew from San Francisco. 962 00:56:26,440 --> 00:56:29,080 We met in Amsterdam to my younger son. 963 00:56:30,720 --> 00:56:34,920 We, he almost missed the flight, but we fortunately were able to 964 00:56:34,920 --> 00:56:37,880 do that. And then we went to Kenya and 965 00:56:37,880 --> 00:56:44,160 then we went around in in a Jeep for I guess about 8 days. 966 00:56:44,600 --> 00:56:48,720 We were like driving continuously for 6-7 hours for a 967 00:56:48,720 --> 00:56:52,120 few days like because all these parks are in various different 968 00:56:52,120 --> 00:56:55,680 places and you know, so, so it wouldn't be a. 969 00:56:55,680 --> 00:56:58,800 Question, on this show at least about food, what was the best 970 00:56:58,800 --> 00:57:02,160 thing you ate on that trip? Oh. 971 00:57:02,680 --> 00:57:07,800 I'm not, I have dietary restrictions so I I eat chicken, 972 00:57:07,800 --> 00:57:10,920 but mostly vegetarian, right? There's plenty of. 973 00:57:10,920 --> 00:57:12,560 Good stuff out there thing about this. 974 00:57:12,560 --> 00:57:15,960 Trip was that there's a huge Indian community in Kenya, if 975 00:57:15,960 --> 00:57:20,320 you will believe that. And so you had you had a live 976 00:57:20,320 --> 00:57:25,160 dosa station in the in the hotel, which is like, you don't 977 00:57:25,160 --> 00:57:29,400 even get that in many hotels in in the US, Like you get that in 978 00:57:29,400 --> 00:57:33,640 Kenya. And so, yeah, it was as far as 979 00:57:33,640 --> 00:57:37,040 local food is concerned, there were a bunch of dishes in the in 980 00:57:37,040 --> 00:57:38,840 the buffet. I don't know their names, but 981 00:57:38,840 --> 00:57:41,400 they were awesome. Like some of the exotic fruit 982 00:57:41,400 --> 00:57:45,160 were, were like something that I'd never had. 983 00:57:46,200 --> 00:57:49,000 It was, it was a very different experience. 984 00:57:49,000 --> 00:57:51,320 Yeah. Jim, you're a world traveler. 985 00:57:51,520 --> 00:57:54,800 Would you do this? Well, I've heard Nairobi. 986 00:57:54,800 --> 00:57:58,440 Is a beautiful city. I definitely would like to go 987 00:57:58,440 --> 00:58:02,920 there, absolutely. I. 988 00:58:03,160 --> 00:58:07,440 I so I want to bring up the great Frank via Vicencio, right? 989 00:58:07,440 --> 00:58:10,280 He told me a story where he went on safari, I think it was in 990 00:58:10,280 --> 00:58:14,520 Zimbabwe, and very similar story to what Atul just mentioned. 991 00:58:14,920 --> 00:58:18,160 And he mentioned that like, because I can barely watch this 992 00:58:18,400 --> 00:58:22,960 on TV, right? To actually be there, smell the 993 00:58:22,960 --> 00:58:26,800 smells, hear every sound, no commercial breaks, right? 994 00:58:26,800 --> 00:58:29,200 I mean, like, you're in this thing. 995 00:58:29,760 --> 00:58:31,800 And he said he and his wife cried. 996 00:58:32,080 --> 00:58:36,400 I believed it. I did have a question for you at 997 00:58:36,400 --> 00:58:38,240 all. So one of the things I've seen, 998 00:58:38,240 --> 00:58:42,720 it was like on YouTube was like, so there are these tourist 999 00:58:42,960 --> 00:58:44,840 vehicles, right? And they're like looking for 1000 00:58:44,840 --> 00:58:48,480 something like this because that's what everybody came to 1001 00:58:48,480 --> 00:58:50,680 see, right? Everybody's on safari. 1002 00:58:50,680 --> 00:58:55,480 They want to see nature unfold. So then you have one of these 1003 00:58:55,800 --> 00:59:00,160 great hunts going on, and then it's like 10 of these vehicles 1004 00:59:00,160 --> 00:59:01,960 kind of like make a circle around the hunt. 1005 00:59:01,960 --> 00:59:04,280 Was that what it was like? Yeah, it was like. 1006 00:59:04,280 --> 00:59:08,680 That there was a probably. And at some point I felt like 1007 00:59:08,680 --> 00:59:13,000 the lions actually used that to their advantage, like because, 1008 00:59:14,080 --> 00:59:18,520 you know, there was this massive herd of buffaloes and there was 1009 00:59:18,520 --> 00:59:21,160 a bunch of lions trying to approach that herd. 1010 00:59:21,520 --> 00:59:25,160 And so everybody on the park, like tourists like us felt like, 1011 00:59:25,160 --> 00:59:26,880 Oh yeah, there's a hunt going to happen now. 1012 00:59:27,360 --> 00:59:29,960 And so everybody had their jeeps, like come in there. 1013 00:59:29,960 --> 00:59:32,760 There was 50 odd jeeps there, I think. 1014 00:59:33,120 --> 00:59:40,240 And and then the lions kind of use that as a way to deflect 1015 00:59:40,240 --> 00:59:42,960 because everybody's attention was in One Direction and the 1016 00:59:42,960 --> 00:59:45,200 hunt actually happened right behind us. 1017 00:59:45,560 --> 00:59:53,720 So they use that to separate out the herd and to I think what 1018 00:59:53,720 --> 00:59:57,640 they did was because everybody's attention was in this way, the, 1019 00:59:57,640 --> 01:00:01,640 the, the buffaloes on the other side kind of got separated out 1020 01:00:01,640 --> 01:00:04,080 or something and then they went and attacked them. 1021 01:00:04,080 --> 01:00:07,400 So I think the Lions actually ended up using. 1022 01:00:08,560 --> 01:00:11,000 The situation to. Their advantage so. 1023 01:00:13,520 --> 01:00:16,760 But yeah, there were a lot. Of people, Thanks. 1024 01:00:17,440 --> 01:00:18,640 Well, here's. Here's how I'm going to make it 1025 01:00:18,640 --> 01:00:22,280 a lighter note this If there ever was a real world scenario 1026 01:00:22,280 --> 01:00:25,840 for shared signals, framework and risk events, those buffaloes 1027 01:00:25,840 --> 01:00:30,560 should have been on that. There you go, lighter. 1028 01:00:30,560 --> 01:00:34,960 Note achieved, I hope. OK, well on that terrible 1029 01:00:34,960 --> 01:00:37,760 lighter note, no offense that not not for you. 1030 01:00:37,760 --> 01:00:41,560 Until they're just a terrible segue, we're going to go ahead 1031 01:00:41,560 --> 01:00:42,720 and leave it there for this week. 1032 01:00:43,200 --> 01:00:44,480 Thank you so much for joining us. 1033 01:00:44,480 --> 01:00:46,640 I'll have your LinkedIn connection information along 1034 01:00:46,640 --> 01:00:51,720 with just a handful of links around Cape and SSF and risk and 1035 01:00:51,800 --> 01:00:55,480 AI community, AI identity management community group for 1036 01:00:55,480 --> 01:00:57,880 people to check out. And thank you again so much for 1037 01:00:57,880 --> 01:01:00,160 joining us. So let's see what else? 1038 01:01:00,560 --> 01:01:02,840 Yeah, check our website, idcpodcast.com. 1039 01:01:02,840 --> 01:01:04,720 We've got all of our discount codes there for the conferences 1040 01:01:04,720 --> 01:01:06,480 that are coming up. Hope to see you there. 1041 01:01:06,480 --> 01:01:08,400 We'll be at EIC. You'll be Identiverse. 1042 01:01:08,400 --> 01:01:10,560 I think you got other things in in the works and plans and 1043 01:01:10,560 --> 01:01:13,480 things like that. So thank you so much for liking 1044 01:01:13,480 --> 01:01:15,560 and subscribing and sharing with our friend or an enemy. 1045 01:01:15,640 --> 01:01:18,600 As long as they're listening, I don't care who it is and leave 1046 01:01:18,600 --> 01:01:20,920 it there. So thanks everyone for watching 1047 01:01:20,920 --> 01:01:23,240 and or listening and we'll talk with you all in the next one. 1048 01:01:24,120 --> 01:01:24,920 Thanks. For having me. 1049 01:01:27,720 --> 01:01:30,640 You've been listening to Identity at the Center. 1050 01:01:30,960 --> 01:01:35,080 We hope you've enjoyed the show. Make sure to like, rate and 1051 01:01:35,080 --> 01:01:38,680 review, and we'll be back soon. But in the meantime, hit the 1052 01:01:38,680 --> 01:01:42,120 website at identity@thecenter.com. 1053 01:01:42,720 --> 01:01:46,800 See you next time on Identity at the Center.