[00:00:00] Simon Moffatt: They aren’t good enough really. So we, we have to think differently, which is why we’re seeing this collision, I think. It’s time for change. It’s time for transition. You get more specialized categories. All the acronyms
[00:00:10] Rob Ainscough: that really only add to that confusion. These things don’t last forever.
[00:00:14] Simon Moffatt: We are looking at the next identity operating system.
[00:00:17] It’s, it’s moving away from these individual pillars to something much more horizontal. I need to verify all of my identities, authenticate everything, authorize everything, monitor everything, coverage, performance, effectiveness. Pick a metric which is under your influence, and it’s always back to, is this helping the business?
[00:00:34] Is it hindering the business? Is identity or security helping or hindering get to that top point? Identity is strategic. It’s not a tactical thing. It’s, it … If you get identity right, your business is productive. If you get it wrong, you’ve got a problem.
[00:00:50] Roy Akerman: Identity isn’t just an operational problem, it’s a security one, and most teams are figuring out in real time.
[00:00:56] Rob Ainscough: This is the podcast where we reverse engineer the meaning of [00:01:00] identity security, sharing candid conversations about the people building, fixing, and rethinking identity security from the inside.
[00:01:07] Roy Akerman: I’m Roy Akerman.
[00:01:08] Rob Ainscough: And I’m Rob Ainscough.
[00:01:09] Roy Akerman: Let’s dive in.
[00:01:10] Rob Ainscough: Let’s do it.
[00:01:17] Hi, everyone. Uh, welcome back to Identity Decoded. Another episode here recorded at Identiverse. And we’re here today with Mr. Simon Moffatt, founder of The Cyber Hut.
[00:01:26] Simon Moffatt: Hi. Great to be here.
[00:01:27] Rob Ainscough: Very good. As always,
[00:01:28] Simon Moffatt: chatting with you guys. The man and the legend.
[00:01:30] Rob Ainscough: Yeah, absolutely. Oh, I don’t know about
[00:01:31] Simon Moffatt: that. Don’t know about that.
[00:01:33] Rob Ainscough: Very good. So today we’re gonna be talking a little bit about, you know, categories and identity, about, you know, how we’ve got to where we’ve got to today, about where we’re going tomorrow with that. Yeah. What’s important, what’s durable, what can we rely on, right? And how can practitioners really make sense of what’s going on.
[00:01:48] Mm-hmm. But Simon, um, normally this is the other way around. Just last week Roy and I were on a, uh, webinar with you hosting, and now you get to be on our podcast.
[00:01:59] Roy Akerman: It’s, it’s
[00:01:59] Rob Ainscough: role [00:02:00] reversal. It’s fantastic. It is. Yeah. I feel like I’ve got the easy job today, though.
[00:02:04] Roy Akerman: Does sound
[00:02:04] Rob Ainscough: sorry. I’d agree with that. I, you normally have the difficult job.
[00:02:07] True, true, true. So maybe we’ll start with a bit of background, right? Mm-hmm. So, um, so as I say, founder of The Cyber Hut. Can you tell us a little bit about what you do at The Cyber Hut and your role as an analyst?
[00:02:16] Simon Moffatt: Absolutely. Yeah. So I, I, again, I feel like I’ve got an easy job as an analyst. Yeah. I, I’ve founded The Cyber Hut five, six years ago, and then the idea was let’s look at all the emerging exciting categories within identity, the use cases, all of the sort of next generation, uh, sort of technologies and requirements that are developing.
[00:02:34] And I feel as an analyst, it’s, it’s a very privileged job. You know, I get to, uh, analyze the market, look at new vendors, new technologies, some of the new problems, and that’s, it’s a really, it’s a really exciting, uh, role to have because identity is now so fundamentally important. And then prior to that, sort of 20 odd years working for vendors- Wow
[00:02:56] working for the likes of ForgeRock and Oracle and, and a few others over the years. And [00:03:00] I think, yeah, it’s, look- looking back at that time, identity has just changed fundamentally. Yeah. Agreed. Not, not just from being held up and being on premises. We have cloud, we have AI- Mm-hmm … we have all of this security stuff to deal with.
[00:03:15] So I feel very privileged to, to now be hopefully trying to enable the market and explain some of this complexity.
[00:03:21] Rob Ainscough: And I think such an interesting time to be doing that, right? So I’ve worked in identity for probably 12, 13 years now, and I’ve thought, look, probably the last 10 years and probably particularly the last five- The pace of change has been so rapid.
[00:03:35] The threat landscape’s- Yeah … changed so much. Such an interesting time to be doing that, right? Yeah.
[00:03:39] Simon Moffatt: Yeah, it really is, and it’s… I think the, the really good thing is, you know, 25 years ago, you had to explain, A, what identity was, what it did, what impact did it have on, on the business, whether that was- Right
[00:03:50] employees or customers, and I guess customers weren’t really a thing 25 years ago. But now it has so many tentacles into security, productivity, [00:04:00] compliance, sharing, the whole data thing with AI. You, you don’t need to say, “Look, identity’s important. This is- Mm … the value it provides.” Mm. Counterpoint, of course, is the bad guys also know that, so the bad guys go after your identity world as well.
[00:04:15] So I think that’s, that’s a really exciting time, both for- Mm … vendors and, and for organizations. Yeah. Because if, if they get identity right, you can sell more, do more, share more, your staff can be more effective and more productive. Mm. And that is… I think that’s a real, really exciting time.
[00:04:32] Roy Akerman: And, and you’re, like, in a very special, uh, position, right?
[00:04:35] You c- you’re speaking with vast number of vendors. You’re speaking with tons of customers. You’ve been in both sides, and you can spot the patterns, you can spot the repetitive, kind of like, uh, misunderstandings. Uh, you saw categories, like, uh, invented, born, collide. Um, and by the end of the day, if I’m not mistaken, category is just, you know, like, a, uh, the, the trio of a [00:05:00] process, the people, the products, and, or maybe the quartet, or, and of course the desired outcome or the, the problem we’re trying to solve, right?
[00:05:07] In this point in time, it seems that everything is colliding, everything is under pressure and under tests, right? Regardless of which part of identity is it, the, uh, the, the, the fine process of IGA versus the, uh, detection and response of all of those. Did you feel, like, the, that pressure that, I don’t know, AI age, MiFA age, all of those things are putting on the definitions that we’ve feel convenient with?
[00:05:30] Simon Moffatt: Absolutely. No, absolutely correct. And I think that’s… I think that it’s, it’s confusing, I think, for- Yeah … for, for the buy side- Yeah … for consultants, for, for vendors as well. But I think it also shows it’s time for change. It’s time for transition, to move away from our, I guess, version one or version two of identity, where we, you know, you invested in a, a privileged access product, and it was a, a s- a, a pillar-based product, and it integrated in a certain way on premises with certain systems.
[00:05:56] Rob Ainscough: Yeah.
[00:05:57] Simon Moffatt: And that’s what you did. And then you bought an MFA [00:06:00] product that integrated in this way, and I think w- we- we’re sort of seeing the limitations of, the natural- Yeah … limitations of that world. And you add in clearly AI, but you add in more, I guess, things like cloud as well and zero trust. You know, these are still transformative and- Agreed
[00:06:16] incomplete transitions. So you have all of, of this meta change happening. Yeah. I think it’s, it’s just ultimately putting pressure on, on those original identity pillars, and they, they aren’t good enough really. So we, we have to think differently, which is why we’re seeing this collision, I think.
[00:06:32] Rob Ainscough: No, I’m interested in that because, um, this was my experience, right?
[00:06:35] I spent five years, uh, I used to call it applying the recipe, right? Right. IGA PAM access management.
[00:06:41] Simon Moffatt: Yeah.
[00:06:41] Rob Ainscough: And that will lead me to secure, right? Mm. That must. If I do enough of it, eventually I’ll get there. And that wasn’t the reality, right? That wasn’t reality. But I really feel like we’re kind of, we’ve got these disciplines.
[00:06:55] Mm. We’ve got technologies around them. We’ve built teams of people around those [00:07:00] technologies that then cement that in. But I still don’t see most companies kind of moving beyond that
[00:07:06] Simon Moffatt: thinking. They’re kind of stuck. Yeah. Yeah. And that’s, it- it’s difficult. It’s difficult to criticize because- If you sort of zoom back a little bit, i- identity’s so tied to the business process.
[00:07:18] Agreed. Whether you are in manufacturing, financial services, retail, whatever process you have, and that’s back to, um, the original point earlier around it’s people, process, and technology. Right. So whether your onboarding process works in a certain way, whether your off-boarding process works in a certain way, your identity technology has to resemble that.
[00:07:37] So you build identity workflows. You buy products, uh, in certain linear fashions. And you have budgets, and you then have operators or whatever, engineers, architects, who are familiar with those technologies. So this… Look, this stuff isn’t easy. No. It is complicated stuff. And to learn PAM and authorization and OAuth 2 and these sorts of things takes a long time.
[00:07:58] Right. So you have these [00:08:00] linear pillars- Yeah … as you described, and th- they are very difficult to remove because they’re so tied to how the business does business. And I think- Mm … it’s, it’s, it is very common to invest in identity and those technologies to be there five, six, eight years. They’re not gonna get ripped out in, in a very rapid fashion.
[00:08:18] Long period. So there’s a bit of a business, um, transition aspect, and there’s a technology investment side as well. Mm. If, if you invest in PAM, IGA, MFA, passwordless, you want to see that,
[00:08:29] Roy Akerman: you know, you want
[00:08:29] Simon Moffatt: to see that add some value before you then consider change.
[00:08:33] Roy Akerman: Well, I, I have so many questions around that.
[00:08:35] Um, so sorry for, like, the, uh, choose one thing that I’m going to ask, right? But- Goosebumps. So, so we said that everything is under pressure, and, uh, the people that are part of the category start to feel that it’s kind of closing on them, right? The old technologies, the old process, everything is there. And then thousands of vendors and VCs and investors and whatever are trying to do the next gen, kind of like think of this in existing categories.
[00:08:59] Others are [00:09:00] trying to just build a separate category or, I don’t know, collide a few and all, like, play with them together, right? Shrinkage. Which one, I mean, do you feel that is under very strong pressure right now that you see the buyer’s confusions. Mm. That you see so many angles of solutions that are coming by.
[00:09:19] Mm. And maybe, uh, you know, frozen buyers trying to figure out, “Okay, let’s wait and see.” See how things are stabilized a little bit. Yeah. Where’s the pressure? Where’s the- I
[00:09:28] Simon Moffatt: think unfortunately, there, there, there are several, I think. Uh, look- I
[00:09:31] Roy Akerman: was hoping that you’ll say that.
[00:09:32] Simon Moffatt: Okay. It makes, makes it a bit easier for the podcast, I guess.
[00:09:34] Well, I think, you know, non-human identities is one. A- and by that, two, three years ago, there’s massive, um, interest in this area. Right. And it’s not always a new area. We had machine identities and, and sort of PKI and certificate lifecycle management 15 years ago even.
[00:09:49] Roy Akerman: There’s like one h- like a few hundreds of startups and companies that trying to solve these problems.
[00:09:55] I saw, like, very big companies buying three, four NHI companies, trying to shuffle them together- Yeah … [00:10:00] blend them together- Yeah … to solve the problem, and it’s still, you think that it’s under pressure.
[00:10:02] Simon Moffatt: Well, indeed, but let me explain a little bit more, because you then start to say, “Well, okay, well, um, let’s talk about lifecycle management for NHIs.”
[00:10:09] So then your IGA providers go, “Well, we, we can do that. So we can do the lifecycle management side.” And then you may have behavior monitoring companies go, “Well, hmm Identities for people and NHI, oh, we can do that as well. So you suddenly, the Venn diagram of capabilities starts to overlap a little bit. Can they…
[00:10:27] Are, are they competing? Not necessarily, but they are delivering capabilities in that space. So I think that, that, that is, that is one a- Clearly agentic AI is another. You, you see- Yeah … PAM providers, you then see, uh, vaulting credential management technologies. You then see lifecycle management technologies.
[00:10:44] They’re all trying to jump into the agentic space. So this, this huge Venn overlap, I think for NHI, for agentic, um, privilege and, and authorization management as well, and it is confusing, and I think it does, it does add to the uncertainty or the [00:11:00] delay, if you like, from the buy side.
[00:11:02] Rob Ainscough: And I, I think if I think about it, like, my take on this is, uh, you had those big three traditional that we talked about, IGA, PAM, access management.
[00:11:10] Mm-hmm. And then they started not quite doing what we wanted them to do, so then you get more specialized categories coming in, the NHIs of this world, right? Um, and then we get into like RTDR, IVIP, ISPM, all the acronyms. And that only seems to be increasing in pace- Mm-hmm … of the generation of new-
[00:11:29] Roy Akerman: Mm-hmm
[00:11:30] Rob Ainscough: I call micro categories-
[00:11:31] Roy Akerman: Mm-hmm …
[00:11:32] Rob Ainscough: within that, that really only adds to that confusion. So I guess my question for you, Ov, i- is that the way you’re seeing it in terms of the acceleration of this kind of specialization of products? And then how do we come back to what matters and what’s robust- Mm … and what will persist over time?
[00:11:50] Because these things don’t last forever.
[00:11:52] Simon Moffatt: No, they don’t. Uh, uh, look, I think historically, I, I don’t wanna criticize the, the category creators and p- leave both vendors and, and [00:12:00] other, uh, industry contributors to do so. Yeah. It does help with things like language. So- Right … if you have IVIP and ISPM and NHI, if you have a relatively well-known definition for those things, it does help with communication.
[00:12:14] Yeah. Um, helps you to go to market, helps you to look at RFPs and, and the like.
[00:12:19] Rob Ainscough: Right.
[00:12:19] Simon Moffatt: I think are they stable? They’re never really stable because there’s always this word wars and competition around. Mm. “Oh, what they mean? Well, we should be in that category because there is budget there.” And if you talk about, um- Yeah
[00:12:32] passwordless or you talk about IGA, you know that’s a well-known, well-defined area. Now- I think what we’re typically getting towards now is it’s quite easy to add capabilities to existing platforms, be they vendor platforms like yourself or be that stuff you’ve built internally within an organization.
[00:12:50] It’s… If you want to add in an extra capability- Yeah … that is becoming easier. So you may invest in some privileged access stuff from 10 years ago. You may [00:13:00] augment that with some homegrown- Yeah … whatever technology, and you may say, “Well, do you know what? I can use, um, I can use Claude or whatever to just quickly add in a few more bits of glue or bits of capability there.”
[00:13:11] And you sort of define your own mini category within your enterprise. Mm. So I think that is becoming quite common. But I think ultimately back to your question around what happens next, I think we are looking at the, I guess, the next identity operating system, if you like- Mm … where we have these composable components around- Oh, I like it
[00:13:29] discovery, runtime, behavior, uh, whatever it is, and it’s all across all of your different identity types. Looking at the data, looking at the runtime, looking at different ways of, of integrating against those systems. And it’s, it’s moving away from these individual pillars to something- Mm … much more horizontal, if you like.
[00:13:47] Looking at the information flows, looking at- Agreed … at gaining access to, to downstream systems. I think that- Mm … if we zoom out a little bit, I think we’re starting to see the, the emergence of, of that way of thinking.
[00:13:56] Roy Akerman: Yeah. I, I, I wanna try to [00:14:00] do, like, to make together, like, an open heart surgery for, like, one of the categories.
[00:14:04] I don’t wanna even… I, I will imply which, but then, you know, like, let’s, let’s all pretend that we don’t know what it is. So we had kind of like an access enablement, right? We’re connecting A to B. You can go through my portal and get access to a specific app or anything else. So that was, like, pure access enablement.
[00:14:21] Then we started to put controls across this process to verify the identity, right? Mm. Tell me that you know this secret MFAS or whatever. Then we started to add another, uh, layer of security- Mm-hmm … into that process. But by the end of the day, the process that, that we’ve kind of like intervened it is access enablement.
[00:14:40] Mm-hmm. All the rest were features to that journey that will allow us to make it more secure, more, like, uninterrupted, things like that. So I think that what you’ve just said that, uh, is that a lot of the, the new operating system for identity is going to collapse everything into th- that process. Mm. And that, what, someone, something new is going [00:15:00] to be born based on that, and then the, the people and the products will adhere to that.
[00:15:06] But the, the main point or the main surface is that process, right? Access enablement, uninterrupted access enablement. Mm-hmm. So where does it take us? I mean, are we, are we should expect to see again five different categories, life cycle, admin time, connectivity, or is that everything will be collapsing into the same place?
[00:15:25] Simon Moffatt: I’d like… Hope… In an ideal world, I’d like to think we, we talk more in that, that, in that framework. And by this, you’re defining the requirements, you’re talking about the capabilities, but they don’t exist within these, “Oh, well, we, we need PAM, and then we need IGA, and then we need IDV.” I think that, that linear thinking has, has to, has to change.
[00:15:43] Agree. So you, you’re back to say, “Well, okay, what identity services and functions do we need? Okay, how do we get to that conclusion?” Okay. Life cycle. Well, you need to understand what the business wants to try and do. What, what, what the bus- real business objectives. Are they trying to sell banking services?
[00:15:59] Are they a [00:16:00] retailer? Are they a manufacturer? And then what type of identity world do they need? You know, where’s identity going to help them, hinder them? That needs to be secured. It needs to be visible, compliant, all those, those sorts of things. So you start to say, “Well, the- these are my objectives. These are the constraints I have to work against.”
[00:16:18] Yeah. Money, time, compliance, competitors, all sorts of things. And then in the middle you say, “Well, okay, I need to, um, verify all of my identities.” Okay. People, NHIs, agents, customers. Okay. I then need to authenticate everything. I then need to authorize everything. I need to monitor everything. So you start with these almost, um, identity-free concepts and constructs, and you start to then build out as an operating system, or is it a composable layer?
[00:16:46] Yeah. What that, what that looks like. And I think, are we there yet? No, we’re not. But I think as a enterprise architect or a security architect, I think you’re starting to think in those sorts of terms, and it’s not a case of, right, we’re gonna have one [00:17:00] massive identity platform that does everything. Yeah.
[00:17:02] But you know, for all of your identities, I need them verified. All of your identities, I need, uh, authentication. All of my… Yeah. So you start to have this matrix, an end-to-end matrix for people, NHIs, agents, customers, partners, you know, all of those lifecycle events, and you sort of, you pull them together as part of your design when you need them, ’cause you won’t need everything on day one.
[00:17:24] Mm. And from there, I think you have much, much more control over the identity functions. You can, you can measure them effectively. You can invest in them effectively. So important. I… We’re not there, but I think that ideally will be, hopefully, will be the, the strategic way of- Yeah … getting, getting some sort
[00:17:38] Roy Akerman: of positive- Like it’s training my thoughts, right?
[00:17:40] Like, you have kind of like an app store of capabilities to that fabric, and then you can, you know, everything is decomposable and you can play with it. Mm-hmm. But by the end of the day, you need to play the business, and you need to, you know, like to, to, to be able to explain or at least to, to know where are we going to, and then- Yeah.
[00:17:55] Right … you know, categorize them. Some of the access can be unsecured. Some of the access have to be secured. Some of [00:18:00] the access should not be enabled in s- specific circumstances. Then you need to play with those features in order to-
[00:18:05] Rob Ainscough: I, I- … enable them … dude, I’m just gonna say, I love this term, the operating system for identity.
[00:18:09] I love it. It’s like such a good way to think about it.
[00:18:12] Roy Akerman: Yeah.
[00:18:12] Simon Moffatt: And I think it’s-
[00:18:13] Roy Akerman: I almost,
[00:18:13] Simon Moffatt: you know- And the one, one, one little add in there is you need to be able to measure it as well. Sorry. ‘Cause if it’s measurable- True … A, you’re gonna get budget, which is good, but B, you can improve it. Right. And, and to say, “Well, okay, well, we invest in some PAM.”
[00:18:24] How do you know if your PAM’s working if you’re not measuring it? Yeah. And so, and some of those capabilities are really subtle and they’re quite difficult to measure, onboarding or monitoring- Yeah … or whatever else. So composability, measurability, and you, you start thinking in those terms, it’s a very different sort of landscape, I think.
[00:18:40] Rob Ainscough: Um, so something that I’ve been thinking a lot about over, you know, the past few years kind of having done this job is there is a real deficit in measurement, right? Mm. There’s a lot of conviction-based security going on, where it’s like, “I’ve done a thing, I must be okay,” right? Mm. “I did this. Com- project complete.”
[00:18:58] Right? But it’s, I was [00:19:00] always like, “Well, but are we?” Right? And that was through learning the hard way. Mm-hmm. Of feeling like we were g- in a good place, and we weren’t, and it showed in the outcomes that we gained. And, and I just think, like, identity and maybe cyber security as a whole, I think it’s a little bit behind something like software engineering- Mm
[00:19:16] in terms of, like, the routing in data, the routing in performance, the routing in observability to really understand and measure your performance. But kind of we’re, we’re trying to move beyond that, right? So we’re trying to get to this measurable composable future.
[00:19:30] Roy Akerman: Yeah.
[00:19:30] Rob Ainscough: How do we measure the success of identity, identity security?
[00:19:35] Oh, wow. Big question.
[00:19:36] Simon Moffatt: H- how long have we got? You know, it’s, you could have a whole podcast on this. Yes, 100%. So in, in, in a, in a, in a few sentences, I suppose, it’s back to the business thing. So l- if you look at the business’ objectives, strategies, and tactics, it’s nothing to do with technology, but how a business operates in, in those, those types of terms.
[00:19:52] In each of those layers, they, they have success metrics, key performance indicators, outcome driven metrics or whatever. First of all, that needs to be [00:20:00] done, ’cause if that isn’t done and known across the stakeholders within different parts of the business, your identity stuff will fail. You know, just stop.
[00:20:07] Why,
[00:20:07] Roy Akerman: how, and what? Like-
[00:20:08] Simon Moffatt: Pr- pretty much, yeah. And, and that, that essentially will filter down into, um, individual technology tactics and, but some things that are more strategic. But I guess specifically for identity, you always try and try and think in, in sort of three buckets, if you like, and th- these buckets of, of metrics, you have to pick things you can control.
[00:20:27] Now, that seems really obvious. It’s
[00:20:28] Rob Ainscough: hard, yeah.
[00:20:28] Simon Moffatt: But from an identity and security perspective, we often get obsessed with attacks and attackers and, and what they do and how they behave. Mm-hmm. We, we can’t, we can’t control that. We, we can manipulate it maybe, but whether you get attacked by an attacker and what the attacker does, well, that’s-
[00:20:43] Rob Ainscough: Yeah
[00:20:43] Simon Moffatt: you know. So you have to think slightly differently around, around that. So the, yes, there’s three main buckets. One is coverage, one is performance- Agreed … one is effectiveness.
[00:20:52] Roy Akerman: Agreed.
[00:20:52] Simon Moffatt: So take something easy like, um, uh, multi-factor authentication.
[00:20:56] Roy Akerman: Right.
[00:20:57] Simon Moffatt: How can you measure that? Well, you can say, “Oh, well, [00:21:00] we’re going to pick a, um, a multi-factor authentication which has good coverage,” which means how many systems and identities is that MFA modality impacting?
[00:21:09] Yeah. So if it’s only impacting 10% of your user population- That doesn’t seem a good security control. So the coverage, how many identities, how many systems? That’s a really controllable metric. Mm-hmm. Yep. Performance. How’s the MFA performing? This is looking at numbers here, throughputs, how long it takes.
[00:21:25] So you could have the most secure multi-factor capability on the planet, you know, Mission Impossible style, Tom Cruise thing. If it takes 10 minutes to log in, no one’s gonna use that, are they? Agreed. Yeah. So y- you got performance throughput aspects in there as well. And then the effectiveness. So is it effective?
[00:21:41] Is the end user happy? Did they need to contact the help desk? That’s a good point. Did they complete that thing in a self-sufficient way? Uh, in the B2C world, did it impact their journey? Right. Would they recommend or criticize this, this component? Mm-hmm. So you’s got thinking in those sorts of, of layers, but it’s gotta be something you [00:22:00] can control.
[00:22:00] Pick, pick a metric which is under your influence, and then you can look at the coverage, performance, effectiveness, and that, that I think is a good starting point.
[00:22:07] Rob Ainscough: I think MFA’s an interesting one, ’cause just to kind of add to that and deepen it, ’cause this was something that I, I kind of- lived through a little bit, and we matured in our, in our view of this when I was doing the job, is, well, we said things like, um, “Of the challenges we, uh, we made,” right, “to prove that you are who you say you are, um, X percent of them were passed.”
[00:22:28] Simon Moffatt: Mm-hmm.
[00:22:29] Rob Ainscough: And I was like, “There.” And I was like, “Okay, great.” Mm-hmm. Like, on the one hand, you’re implying that that must be secure.
[00:22:36] Simon Moffatt: Yeah.
[00:22:37] Rob Ainscough: On the other hand, I was thinking, “Hang on, though, but, like, what proportion of those did we not need to challenge?”
[00:22:42] Simon Moffatt: Mm-hmm.
[00:22:43] Rob Ainscough: Were we over-challenging?
[00:22:44] Simon Moffatt: Mm-hmm. Mm.
[00:22:44] Rob Ainscough: Was that right for the, for the user at that point in time?
[00:22:47] Was it right for security? Did we need to do that? Mm. And I think it really makes you think about the structure of those, as you say, those metrics. What’s controllable, and what behavior do you wanna drive- Mm … and what do you wanna improve? Yeah. And getting the definition of them [00:23:00] right is so important. And I think in identity what I commonly see is instead of outcome-based metrics, you go to process-based metrics.
[00:23:07] Mm. I’ve reviewed this many things, so I must be okay. Yeah,
[00:23:11] Simon Moffatt: yeah.
[00:23:12] Rob Ainscough: Y- you know, this was approved, so it must be okay. And I think that’s certainly something for me, whatever the metrics are we settle on, and it’s far from likely
[00:23:19] Simon Moffatt: universal- Well, it’s, a- again, it’s always back to, is this helping the business? Is it hindering the business?
[00:23:24] Really noddy sort of stuff there.
[00:23:25] Rob Ainscough: Yeah, no, it’s so
[00:23:26] Simon Moffatt: important. It’s really simple. And, and you again get back to the situation again. Object- what’s the objective of the business, and how does that filter down to my team or my area or my department? Right. And what, what top objective, lower level functional objective is identity or security helping or hindering get to that top point?
[00:23:43] Because i- i- if, if it’s, if it’s not measurable or it’s not impacting, get rid of it. Mm-hmm. If it’s helping, brilliant. If it’s hindering, also brilliant- Mm … because you can improve it.
[00:23:52] Rob Ainscough: Yeah.
[00:23:52] Simon Moffatt: So it’s being able to, uh, put
[00:23:54] Rob Ainscough: them in those buckets. But measure first. Yeah. Measure first. Yeah. That’s the key here, right?
[00:23:57] That’s the key. Yeah. And that’s- And that’s a big change in mindset. [00:24:00] For a lot of teams, that is a big change in mindset
[00:24:01] Roy Akerman: 100%. It is, it is. I wanna throw us back to the category world for a second. Mm-hmm. I mean, for me it was always a matter of market dynamics, poli- uh, politics- Mm … of, of, of categories, right?
[00:24:12] There’s category makers, there’s category kings. There are revolutions in a category or whatever. Um, is it? I mean, is it h- how things are running? I mean, for me, you know, as a buyer- Category is something that, I don’t know, Gartner, Forrester, you name it, kind of like invented. Mm-hmm. Right? Um, I didn’t know what’s the reason.
[00:24:31] Did they spot a top performer and then define the market by them? Mm-hmm. Um, I don’t know. A- analyst sits in the lab and then thinks about the right way to figure things out. Are the, I don’t know, PWC, Deloittes, whatever firms in the world are u- using, like, sitting on a mountain building this upon all the things that they just saw and…
[00:24:48] Like, how does it goes?
[00:24:51] Simon Moffatt: Oh, well, I think, th- there’s, there’s a lot to unpick in this. I think, ultimately, categories are, they aren’t always bad, first of all- No, no, no … ‘
[00:24:58] Roy Akerman: cause it does help with that communication sometimes. No, no, I’m not, it’s not- But, and, and- It’s not [00:25:00] frustration of a vendor. No, I know, I know.
[00:25:00] Yeah But if somebody’s trying to, I don’t know, like, get into a new category and, like, revive it, change it a little bit, you know, the level of acceptance of the market depends on that, right?
[00:25:08] Simon Moffatt: It does. It does. So I guess ultimately you do have that empirical mindset and, and that’s more looking back. Look at the evidence.
[00:25:14] Mm-hmm. You know, what, what are people talking about? What features do we have? How are vendors delivering capabilities? What capabilities are needed in the market and also wanted in the market? Right. They’re certainly different, different things. Yep. And, and, uh, uh, from there you then do start to see an overlap, and these things don’t happen overnight.
[00:25:32] No, no, no. You know, you talk about the identity operating system for identity. Um, like, it’s not something that’s been heard till this- Well, there’s still there. Well, y- good. So that, that proliferates conversational too. But what I mean is that might take 18 months, two years- Yeah … for it to be relevant. But I think then you then, i- if you do have a, um, a foundation of a category grouping, you then have the innovation life cycle against this, which is more, is it incrementally changing?
[00:25:54] So you’re adding in additional features at the edge of that capability and it’s, it’s a bit like, I, I like my craft ale. Just it. My craft, [00:26:00] my craft beers. So at one, and w- you can pick as many different beers as you can possibly have, and it’s like when does a, a session IPA that’s a little bit cloudy become a hazy IPA?
[00:26:10] That’s a great question. But, uh, when, when does a, when does a hazy IPA which is a bit clearer become a session? So you have these hyper differential aspects. So it’s a matter…
[00:26:18] Roy Akerman: It’s not em- empirical. It’s like, it’s a matter of taste or what?
[00:26:21] Simon Moffatt: But it is. But equally, the, the brewers will say, “Well, that’s a hazy IPA, and this is a, a New England IPA.”
[00:26:26] And so they, they will describe something in a certain language. So, uh, just to this, close that off, though, o- once you have a semblance of a, a bucket or a category, you th- you do then have this incremental innovation, slight, subtle changes, and then you also have radical innovation. So that, take your beer example.
[00:26:44] Your hazy IPA becomes, uh, even more hazy, and that becomes a, I don’t know, a deeply cloudy IPA. But then you may have a radical innovation, which is these really hyper-strong 10, 15% beers. And that’s- Double
[00:26:56] Rob Ainscough: IPAs?
[00:26:57] Simon Moffatt: Is that, is that a double IPA, or is that almost a [00:27:00] wine? I, uh- So you get, end up with these big leaps and smaller leaps, and it’s, it, it, they take time, essentially, but they are constantly changing, I think is the important thing.
[00:27:08] Roy Akerman: For me, that’s fascinating, right? Like, I, uh-
[00:27:10] Rob Ainscough: What, the beer bit or the-
[00:27:11] Roy Akerman: No, like the ability- It’s all fascinating … someone come into the market and say like, “This is what I’m radically changing. This is what I’m, uh, I’m… ” And, and, and by the way, by, by customers as well, like, uh, “I’m looking for a radically different solution.
[00:27:22] I feel that this,” and I don’t wanna name the category, “is not really addressing 80% of my problems,” or that it takes too much effort. Yeah. So all the things that you just, like, decomposed. Clearly, it’s important to understand, um- So it’s, uh,
[00:27:33] Simon Moffatt: back, back, the classic analogy really is, is the, um, in- invention of the car versus getting a faster horse.
[00:27:39] Faster horses. See, a faster horse is a incremental innovation, or do you want a car? Sure. And it’s, it’s, you don’t talk about the car. You talk about the, the, the speed of the horses, and it’s, it’s quite a subtly different thing. But it must be rooted in what is needed. What, what does, what does the customer need?
[00:27:53] Are they willing to pay for it? And that’s, they’re, they’re quite often overlooked features of things. I agree. So,
[00:27:58] Roy Akerman: so we wanna use your own [00:28:00] analogy- Against your first, second. I’m, I’m not forcing you, but like, uh, you know, like let’s try to, uh, take it down to a specific category or things like that. So we see a lot of categories trying to stretch themselves right now into the agentic- Yeah
[00:28:12] world, right? Yeah. So like 12% of, uh, I don’t know, haziness, 15% of haziness, like toward this radical change. Can you give us an example of one category that’s trying to stretch right now, um, and I don’t know, you’re not sure, uh, where it’s going to be, if it’s going, I don’t know, like to collide or to expand too much, or to go off the initial offerings?
[00:28:32] I mean, we know about companies pivots.
[00:28:34] Simon Moffatt: Yeah.
[00:28:34] Roy Akerman: We know about how, how market changes. Um-
[00:28:37] Simon Moffatt: I think it’s a, a few things to consider, though. Not… You, you can’t necessarily have all the categories running simultaneously. I think there’s, there’s always a finite field- Yeah … with categories. So for a, a brand-new category to emerge, and I know vendors, you know, you, you love to chase categories and own them, and all this sort of stuff.
[00:28:53] So for that to occur, you probably have to have some categories to disappear, because there’s only a finite number of businesses- Yeah … spend [00:29:00] use cases- Mm-hmm … that can be done. So you have to sort of think, well, first of all, what may become obsolete?
[00:29:05] Rob Ainscough: Yeah.
[00:29:05] Simon Moffatt: You know? Some, some things just become obsolete, you know?
[00:29:08] It’s funny, I was just looking at the, um, in the hotel room before I came out, I was charging my, my phone up, and there was a panel against- Oh, it’s so
[00:29:15] Rob Ainscough: obsolete … the wall … that panel.
[00:29:15] Simon Moffatt: Yeah. I won’t, I won’t name the company who makes these panels. But I started thinking, gosh, I bet 10, 15 years ago, the factory that made these- At the same time
[00:29:23] um, these panels, with all these different connectors, like a VGA, a HDMI- SCART … USB. Uh, there wasn’t a SCART. But those audio cables, I’m thinking none of that gets used. It’s all, it’s all utterly dead. But obviously to make that was a huge investment, which is now obsolete. And now we do Bluetooth or whatever, you know, we cast things, and so you don’t need wires.
[00:29:41] So that, that is a very incremental, um, or a very gradual shift, but then it happens rapidly. Yeah. And no one’s ever gonna invest in a VGA cable to do that sort of thing now. So first of all, you’d see some obsolescence of, of some categories- Yeah … use cases, requirements. AI will accelerate that massively- Yeah
[00:29:59] and it will make [00:30:00] so many things redundant. And you talk about the sort of the big leap, it probably isn’t gonna be NHI, agentic, whatever, competing with, to add in new stuff. It’s probably gonna be something much, much more ahead of that. Agreed. Probably looking at the operating systems of identity- Interesting
[00:30:15] or the ontology of security, and it’s gonna be a very different, different thing, I think.
[00:30:19] Rob Ainscough: I think it’s, uh, it’s the difference between buying Into trends
[00:30:24] Simon Moffatt: Mm
[00:30:25] Rob Ainscough: versus buying into, you know, robust enduring capability. Mm-hmm. And that’s, like, an incredibly difficult, difficult thing to recognize and spot in the market with the number of vendors out there- Yeah.
[00:30:36] Yeah … and all of that good stuff. But I think that’s something that I always thought about as a practitioner, like am I buy cer- buying something durable that’s gonna last? Yeah That’s gonna be
[00:30:45] Simon Moffatt: a key
[00:30:46] Rob Ainscough: building block. Well, in terms of your
[00:30:46] Simon Moffatt: operating system- Is this a good part of that building block? … we, we talk about is, is, is something a trend or is it trendy?
[00:30:51] Rob Ainscough: Yeah.
[00:30:52] Simon Moffatt: Now, trendy, is it fashionable? That’ll have gone in six months, 12 months. Is it a trend and being able to do- Yeah … some sequence analysis and say, “Well, okay.” Absolutely. [00:31:00] “There’s, there’s so many signals we’re seeing here, but we think as a signal it’s going in this direction.” Yeah. The, the, the only being a trend typically has quite distributed signals, which aren’t all grouped together, which makes it very hard to say, “That’s, that’s where we’re heading to.”
[00:31:12] Rob Ainscough: Agreed. And it was something that I thought in my role in terms of, like, what I was looking for coming back to Compose MP is what are the key building blocks? And coming away from, like- Not IGA or anything like that, but I am gonna need a method of managing life cycle. Mm-hmm. I am gonna need a method- Rob is
[00:31:28] Roy Akerman: building the operating system as we speak and all the capabilities, right?
[00:31:31] Rob Ainscough: I, I tried my best in my previous role. Yeah. I tried my best, but- I
[00:31:34] Roy Akerman: can interview you in the next podcast if you want
[00:31:36] Rob Ainscough: to. Look at, looking for those enduring building blocks- Yeah … that then start adding together- Mm-hmm … as you say, and self-reinforcing, and that’s, I think, something that’s really important.
[00:31:45] You know, what’s my runtime layer gonna look like? Mm-hmm, yeah. What do I need there? What capabilities do I need, and where do I need it applied? And we’ve gotta start thinking like that, and kind of- Yeah … to me, that means not moving beyond categories, but categories are a great, um, you know, language [00:32:00] setter- Mm-hmm, mm-hmm
[00:32:00] as you say. They’re a great indicator, but ultimately it is seeking that, those robust, enduring trends. It
[00:32:06] Simon Moffatt: is, it… But again, it’s b- back, I guess back to the matrix of this is, this is my business. These are my apps, my services. Look at the matrix of identity capabilities. Yeah. So again, end-to-end verification, creation, storage, session management, auth N, auth C, uh, behavior management, response, all of that end-to-end stuff, and then you start to go deeper because you need to do that for people.
[00:32:26] Yeah. So that’s gonna be staff, partners, contractors, B2B, whatever, customers and citizens and consumers of your product.
[00:32:32] Rob Ainscough: Yeah.
[00:32:33] Simon Moffatt: NHI, workloads- Yeah … APIs, agentic. So suddenly you have end to end, but then you have depth.
[00:32:38] Rob Ainscough: Yeah.
[00:32:38] Simon Moffatt: And again, not all organizations will need every single identity type and every single capability.
[00:32:44] You say, well, let’s pick back to MFA again as a, a good example. There’ll be some systems that organizations have which will use password authentication. And do you know what? That is probably just enough because at some point those apps will become obsolete, and you can just get rid [00:33:00] of them.
[00:33:00] Rob Ainscough: Yeah, yeah.
[00:33:00] Simon Moffatt: And all the applications that are left use passkeys or whatever. Yeah. And at the cost of migrating, do you know what? I’m, I’m just not gonna bother. Yeah. Because… And that’s okay. It’s okay to have that, and it’s okay not to have every single capability. You may not have agents. You may not have customers- Yeah
[00:33:16] that need B2C, so it’s okay not to have everything all at once.
[00:33:19] Roy Akerman: Yeah. I think that, that was the, the perfect decode of our episode. By the end of the day, like, for me, it was a very, like, eye-opening session of, like, speaking the macros of this world and then understanding where it coming, uh, where it goes.
[00:33:31] Um, yeah, there’s a lot of, like, uh, uh, questions that were left open, right? A lot of unknowns that we’re marching to, but I think that, uh, and I wanna thank you, Simon, for giving us the, the framework for how to think about that- It’s about thinking, yeah … to give our audience, whether it’s buyers or vendors or, or others, consultants, right?
[00:33:48] How to think about this. Uh, I mean, for me, as a former vendor and buyer that was, like, so into the process trying to understand to solve problems, it was, like, very, like a very eye-opening session. And we wanna, uh, [00:34:00] close with a tradition that we have here in the podcast with the rapid fire questions.
[00:34:03] Simon Moffatt: Okay.
[00:34:04] Roy Akerman: Uh, so-
[00:34:05] Rob Ainscough: Yeah … the stage is yours. Four, four rapid fire questions to you, Simon. Okay. Four. Okay. Wow, wow. Are you ready?
[00:34:09] Simon Moffatt: I’m ready, I
[00:34:10] Rob Ainscough: think. Right. Myth, let’s start with a myth. What’s one identity or security myth?
[00:34:15] Simon Moffatt: Oh my goodness. Um, one, I don’t, um, you need more than MFA.
[00:34:21] Rob Ainscough: Good. Should we move on? Yes. Enough said. Uh, malpractice, what’s one thing, uh, leaders get wrong?
[00:34:30] Simon Moffatt: Measurement, I think. Yeah. Yeah. Not, not measuring. Not, not- Agree with that … not even considering about measurement, I think. Yeah. Yeah.
[00:34:35] Rob Ainscough: Conviction-based security.
[00:34:36] Simon Moffatt: Yeah. Just understanding you need to, you’re investing millions of dollars, you need to think about how you’re gonna measure success.
[00:34:41] Rob Ainscough: Yeah, 100%. So then we’ve got a hard truth.
[00:34:45] What is one hard truth?
[00:34:47] Simon Moffatt: Identity is strategic. It’s not a tactical thing. It’s- Very true … if you get identity right, your business is gonna be efficient, productive, make revenue. If you get it wrong, you’ve got a problem. [00:35:00]
[00:35:00] Rob Ainscough: Completely agree with that. And finally, over-hyped. What’s one trend that’s like-
[00:35:04] Simon Moffatt: Oh. What is trendy but not trend?
[00:35:07] That’s difficult. That’s difficult. I think it’s, um, there, there are lots of technologies, I think, often, lots of capabilities looking for a home. I think- Yeah … starting with a solution is never a good thing. You always, always, always start with the problem statement. And there are, there are lots of technologies in cyber, in identity, where there’s lots and lots of effort talking about the solution.
[00:35:27] And I think soon as you talk about the solution, you probably haven’t got an audience. You, you describe the problem, the solution describes itself. And I’m, I’m not gonna pick on a- Yeah … on a particular technology. Come on. Come on. You, you can find- Come on, Simon. … you can fi- you can find them yourselves. But any technology where the effort is spent on explaining what it is probably hasn’t found a buyer yet.
[00:35:45] Interesting. That
[00:35:45] Roy Akerman: is my,
[00:35:46] Simon Moffatt: that is my, my end point. Very interesting.
[00:35:47] Roy Akerman: That was good. Great session. Thanks very much for, like, uh, willing to go to the other side of the, you know, the role play over here, for interviewer and interviewee. It was a great discussion. We have a lot to build. We have a lot to discuss.
[00:35:58] Absolutely. And hopefully we’ll find [00:36:00] this, uh, conference fruitful. Thanks so much for the time. Thanks,
[00:36:02] Simon Moffatt: guys. Thanks, guys. Thanks, Simon.
[00:36:03] Roy Akerman: Appreciate
[00:36:03] Simon Moffatt: it. Cheers.
[00:36:04] Rob Ainscough: That’s it for this episode of Identity Decoded.
[00:36:06] Simon Moffatt: If this conversation changed anything that you thought about identity security, share it with
[00:36:11] Roy Akerman: someone who’s working through the same challenges.
[00:36:13] Rob Ainscough: And don’t forget to follow the show so you don’t miss what’s next.
