[00:00:00] Roy Akerman: AI adoption is here. It’s fast-paced. There’s a lot of pressure and budget around that
[00:00:04] Mark Kraynak: The number of identities dramatically increases two or three orders of magnitude, and it’s too big to manage with those old technologies. If you hire a person to work for your company, you don’t really have to tell them, “Don’t break the law.”
[00:00:15] That is not a reasonable assumption with agents. You can turn it off, but you can’t put it in jail. So, like, that ethical boundary that is baseline background radiation for hiring humans doesn’t exist. The cloud native application architecture has sort of, like, dominated, and it has really changed the landscape.
[00:00:29] Roy Akerman: You’re in a very monumental position to actually observe the market trends and how things are shaped, and you’re actually tasked with finding the next companies that is going to actually solve the incoming problems.
[00:00:40] Identity isn’t just an operational problem, it’s a security one, and most teams are figuring out in real
[00:00:46] time.
[00:00:46] Rob Ainscough: This is the podcast where we reverse engineer the meaning of identity security, sharing candid conversations about the people building, fixing, and rethinking identity security from the inside.
[00:00:57] Roy Akerman: I’m Roy Akerman.
[00:00:58] Rob Ainscough: And I’m Rob Ainscough.
[00:00:59] Roy Akerman: Let’s [00:01:00] dive in.
[00:01:00] Rob Ainscough: Let’s do it.
[00:01:07] Roy Akerman: Welcome again to our podcast on identity security. Today, we have Mark Kraynak, uh, a founding partner in Accru Capital, uh, where he invests across cybersecurity, data, enterprise technology, and his recent investments, uh, includes Ambient, EdBay, Cato Networks, ProtectAI, Radiant, and of course, Silverfort. Hey, Mark, thank you for joining our show today.
[00:01:29] Mark Kraynak: Yeah, it’s great to be here. Thanks for having me.
[00:01:31] Rob Ainscough: And through all that, right, a really kind of interesting and privileged position to have seen, you know, the development of, of security over that, what, 25-year period, something like that, um, and, and seeing all these different facets of security, and now as an investor.
[00:01:46] So super privileged position and, and really interesting for us to, to kind of dive into what you’re seeing and what you’re seeing that, you know, practitioners and people in industry will be worried about and seeing from product side in kind of three, [00:02:00] five years’ time, right, to help them be ahead of the curve.
[00:02:02] Roy Akerman: We would love to, you know, like, to spend a quick moment, uh, of, like, telling us how you ended up being a VC, a, a, like, a investor i-in cybersecurity as identity, as you started with product and other things, and what led you down to this path?
[00:02:16] Mark Kraynak: You know, I was probably a little bit of a weird kid, but I remember telling somebody in eighth grade that someday I wanted to be a VC.
[00:02:22] And I’m not sure if I really knew what it was, but what I thought VCs did was work in small teams on interesting, hard technology problems. Um, and so that actually, I did kind of follow that path a little bit. I went to gra- I went to college as an, as an engineer. I actually also got a second degree in poetry, but, uh, became an engineer.
[00:02:40] And then it’s, and I didn’t, you know, you don’t really come out of college and go into VC. I went to work as a consultant, but then I decided to take a little tangent to become a, to at least try to become a poet, so I went to graduate school for poetry, which was great. And the, and the reality is I use, I use some of the stuff I learned writing poetry, uh, every day.
[00:02:57] I think there are a lot of lessons for how to talk to [00:03:00] people that you learn from being a poet. And I, I talked to a lot of my founders about that, uh, pretty frequently, to be honest. Um, and then when I left grad school, I, I started teaching writing, and that is a terrible job. Uh, it’s probably much harder today.
[00:03:12] I found a lot of my students cheated, and I would catch them, uh, using s- like, search engines from the day. AltaVista was great for finding exact text matches. And about the third time that that happened, I w- I remember thinking to myself, “What,” you know, “what am I doing with my life? Why am I here with an 18-year-old kid looking at their paper and going f- like I don’t, this is not what I want my days to be like.”
[00:03:33] So I, I quit that, came out to the Valley during the dot com bubble, and started working in cyber again. I had worked in cyber before grad school, too. And then I did work, worked at startups, which was working on small teams doing hard, interesting things. Um, Imperva was a great, rewarding experience. But before I went to Imperva, this is a very long story, I met my current co-founder, Teresa Gao Who was the Series A investor in Imperva, and I told her, “I’m thinking about maybe becoming a VC or going to work at a startup.”
[00:03:58] She said, “Well, there’s really two paths to [00:04:00] becoming a VC. One of them, go to business school.” And I’m like, “Stop right there. What’s the other path?” Because I’m like, “I am done with school.” Uh, and, and the other path was go work at a startup and then come back in like five years. And so I went to work at one of her startups.
[00:04:13] I had actually met Shlomo and the Imperva team separately, but she was on the board there. And, uh, I thought it would be five years. It was 13 years, and then when I was ready to be done at Imperva, I wanted to start my own company. And I was talking to Teresa and she’s like, “Well, come hang out, you know, be an EIR,” which stands for entrepreneur in residence, “and, uh, see how things go.”
[00:04:32] And I did that. I decided I didn’t want to become a founder, um, and the reason is I, I really like the, the variety that I get to work with a lot of different kinds of companies as a VC, as opposed to like the one thing if you’re a founder of a one, of one company. So, uh, I decided to be an investor full time.
[00:04:46] Ironically, I became a founder of a VC firm because we kind of reconstituted the firm in 2019, um, and here, here we are. Um, and actually the idea that I had, just to make the story a little bit longer, was an identity idea. I mean, at Imperva [00:05:00] we had customers, um, and there’s one in particular that sort of like crystallized it for me, that asked us to do a lot of hard things for us.
[00:05:05] We were ap- that part of the business was application security, so protect websites from attacks. And we had a customer that was in the vacation rental space, I guess I won’t name the name, and they had a ton of fraud where people were taking over the sort of owner accounts, so, so the people who owned the, the assets being rented out, the condos and whatnot.
[00:05:23] And they wanted us to help protect that, and it, and it was a pretty simple authentication problem, like just use, just use two-factor authentication was essentially our first answer to them. And they said, “We tried that.” And I’m like, “Well, can you tell me a little bit about what you did?” And it turns out they had pretty old, like the, the clientele that owned, owns properties is older.
[00:05:41] So like older people, not very technically savvy, they couldn’t get them to use two-factor in the right way, so they just did it all in the same web session. So like you went to log in, it would send you the token and I’m like, “Well, that, that’s not really two-factor guys. Like that’s why it’s not working.”
[00:05:54] And uh, and they weren’t willing to try real two-factor. And they were, and what they were [00:06:00] probably correct about is that their owners would have left and been like, “Screw this, I’m gonna go to some other site.” And I thought that was a real incentives problem, something you could solve. All the technology existed.
[00:06:09] Um, but the, I don’t think the market was, was ready. So it was the kind of… It was trying to address that sort of consumer authentication problem. That, eventually all that work is what led me to Silverfort. And I, um, got in- introduced. I, I almost didn’t take the first meeting ’cause it sounded like a two-factor company.
[00:06:25] And which at some point it is, but it doesn’t sell that second factor, and I always thought second factor is gonna be completely commodity. And I feel like I was right about that. But what I liked about Silverfort was that they don’t care what your second factor is. Like, you know, well, you can use whatever you want.
[00:06:40] Uh, we’ll treat it as commodity, but like actually making it work with systems is pretty hard, and they’re very good at that. Um, and so they kind of… That was a big unlock, I think, for a lot of enterprises. And, and then the way that they do that is technically very impressive. Um- Feel like I’m going on a bit, but my s- my CTO at Imperva, his name’s Amichai [00:07:00] Shulman, um, I have probably asked him to look at hundreds of technology companies of pot- as potential acquisitions at Imperva in my life.
[00:07:08] So I asked him about it, and he’s only come back to me two times, two times, and said anything other than, “We could build it better.” And Silverfort was one of those two times. So I decided that was enough technical diligence for me to move forward. But that, but that way of doing it unlocks a whole lot of other things, and that’s kind of what the future of Silverfort became, which is something much broader than, like, two-factor enablement, but, like, a really broad platform for things you can do around identity security.
[00:07:34] Kind of made a bet on that, and pretty happy about it so far.
[00:07:37] Roy Akerman: Sounds like we’re going to have a very interesting episode. Mm-hmm. I have so many questions out of the lineup, for example, like, you know, about entrepreneurs and, uh, and poetry and, like, how a pitch can be a poetry and others. But we need to speak about identity today- Yeah
[00:07:49] uh, and o-overall. So, so, uh, like, if you’re fast-forwarding, uh, you know, like, your days at Imperva and your initial ideas for a startup, um, I mean, let’s go back for a second and, like, um, you know, understanding [00:08:00] what has changed in, in identity since then, and how did it shape the way that you’re investing right now?
[00:08:05] Because you have a quite an extensive portfolio in all sorts of angles of identity and more than that. Uh, what, what, what was this evolution, this change, uh, and where are we right now?
[00:08:15] Mark Kraynak: Yeah. I would say a lot has changed. One… Probably the thing that most people on the street will notice is, like, two factor’s pretty, uh, pretty common these days.
[00:08:23] Passkeys are really being pushed hard by the market, and I think they’re overall pretty good for, for, for the last decade’s problems. They’re pretty good at better authenticating users, and they’re pretty good at letting users authenticate, you know, where they send their credentials, so I think they can really reduce phishing of humans.
[00:08:40] Unfortunately, something else is happening which is making passkeys, I think, not work, which is agents. You know, if, if, if a human wants to have a-an agent or anybody really, even, like, my assistant, you know, who’s a human, not an agent, um, wants to do something on my behalf, it’s really hard to do that in a world with passkeys.
[00:08:58] It’s almost impossible with [00:09:00] agents. So I think passkeys are a really good solution for, but kind of late, to be honest, in terms of adoption to, like, solve, you know, 2010 type problems. I think they’re not gonna solve the, the next gen. So that’s something I think is really important. The other thing that’s happened is that the cloud native, um, application architecture has sort of like dominated, taken over, and it has really changed the landscape for what people call non-human identities.
[00:09:25] I don’t really like that term, uh, but I’ll, I’ll kind of come… Because I think agent identities, like AI identities, are technically non-humans, but they’re different than what really the non-human identity market’s about. Machine workloads and, and when you had monolithic applications before cloud native, you didn’t have that many, so you didn’t have to have that sophisticated technology.
[00:09:43] You know, so you have like password vaults. But when you have cloud native and you break down those applications into lots of small components, all of which have to talk to all the other ones essentially- the number of identities dramatically increases, like two or three orders of magnitude, and it’s too big to manage [00:10:00] with those old technologies.
[00:10:00] So there’s a lot of people out there trying to solve that problem. It’s a hard problem. But so there’s like been a Pretty decent amount of change, um, and even in the last, like, eight, eight years.
[00:10:09] Roy Akerman: So we’re speaking about the type of identities- Yeah … we’re speaking about the type of credentials or passkeys that can, you know, like be an outstanding solution for humans, but when it comes to workloads and to, uh, agents that are, you know, like we’re swarmed with, uh, you know, like we need to find a better-
[00:10:23] Rob Ainscough: Mm
[00:10:24] Roy Akerman: a better solution. And that’s interesting. I mean, you’re, you’re seeing entrepreneurs every day trying to solve tomorrow’s problem or, like, the emerging problems. Um, and I think that it leads us to, like, um, a-another interesting question is that, so what do you think that the existing unsolved problems right now when it comes to, to those areas?
[00:10:40] Like you spoke about passkeys are not, you know, like, uh, you know, they’re good until a point. Uh, but what other things, uh, you know, are you seeing? And, and maybe, maybe it would be good to tie it up to, like, uh, a Forbes article that you wrote about, you know, this race condition between functionality and capabilities to [00:11:00] security features for big software companies, right?
[00:11:02] And we know who wins, right? Capabilities wins over there. Yeah.
[00:11:05] Mark Kraynak: So what that article’s about, I mean, I think it does apply to identity, is I– One of the most common complaints I get from security practitioners and identity practitioners is, how come people didn’t build in, you know, really common sense, basic security controls from the beginning as they started to build new technologies?
[00:11:23] I think the article taught, is talking a little bit about MCP, which is a protocol for allowing, uh, essentially AI agents to, to access tools. It’s like a tool calling protocol, so that if you want an agent to do something useful, it should be able to call your enterprise tools. MCP is the protocol for that.
[00:11:38] It has absolutely no security technology and functionality associated with it. And the reality is, it– that’s kind of what it has to be. You know, if you think about, uh, as I think about my career and every new generation of technology, there’s been this same kind of desire from security people who are saying, “This time, with cloud native or with mobile, uh, or with big [00:12:00] data, we’re finally gonna build in security from the start.”
[00:12:02] And it’s never happened. Um, and the reality is, there’s a reason for that. It’s like market forces. If you’ve got two companies trying to deliver value to the market, and one of them spends time building the features that their customers want functionally, and the other one slows down even a little bit to do security, that’s the one that loses.
[00:12:22] Uh, so there’s sort of like, there’s some sort of physics of the market that the ones that don’t do security and identity right to begin with m-meet the demand of the customers better and faster, and they win. And then you end up with a scenario where they didn’t build in security up front because they couldn’t.
[00:12:36] They wouldn’t, they wouldn’t be the one that won. And, uh, and so that causes a lot of angst. It does create a lot of mess and problem. But it’s sort of like that is fundamental to the way security markets and identity markets work. I think it’s not gonna be different for MCP. And I don’t– And I actually, what I try to tell people is if– stop for a second and reframe how you’re thinking about that.
[00:12:56] That’s actually why you have a job. You know, I know it- [00:13:00] There’s a lot of angst and, like, friction because of it. But if you think of it differently, your real job is to figure out how to let those things work and deliver value without, without breaking them. And the companies and the people that do that are the ones that have the most
[00:13:11] Roy Akerman: success.
[00:13:11] So Mark, if secure by design or, like, security in design phase is, is not a thing, and we’re just, like, admitting that it’s not, right? We’re seeing this all over. Uh, and, and maybe Rob, I’m referring this to you as well as, like, an IM leader in the industry. So what is, right? Like, what is this, like, level of security that we should add, or we’re actually adding in order to make sure that, again, security will not lag behind, right?
[00:13:34] Like, a new capability will come, then, uh, you know, like, attackers will take advantage of that gap in time that it’s not secured, and then everybody will realize. They will f- you know, flash with the statistics about it will be 80% of the attacks are something else right now. Mm. And then somebody will come with a security company, and then it’ll be commoditized or, like, platformized.
[00:13:53] Right. Mm. What is it that we should do now when it comes to security and to identity so that, I don’t know, like, this [00:14:00] MCP evolution or L2L’s evolution, or others will be secured?
[00:14:04] Rob Ainscough: Well, I, I think I’m just gonna add- Yeah … my perspective quickly, which is particularly when it comes to MCP and AI agents, and, uh, I think what we’ve learnt from, from previous waves, and I’d be really interested in getting your take on this, Mark, is, you know, we, we often have a habit, or the market maybe has a habit, of treating those problems as, as unique, isolated problems that need to be solved in and of themselves.
[00:14:27] Roy Akerman: Mm-hmm.
[00:14:28] Rob Ainscough: And if we think about identity, identity is a system, right? It can sync humans, machines or non-humans, and agents as well, right? And I think for us, from an identity perspective, it’s, it’s making sure that we don’t treat them as, as a different part of the system that needs its own unique thing to solve that problem to get on top of this inherent insecurity, and it’s, it’s part of a bigger whole.
[00:14:50] Mm-hmm.
[00:14:50] Right? And I think that’s a really key thing, particularly when we think about AI agents and MCP, for us to, to build in this time to how we’re thinking about this problem. Yeah. But [00:15:00] I’d love your thoughts on that, Mark.
[00:15:01] Mark Kraynak: Yeah. And not to be argumentative, I totally disagree. Um, um-
[00:15:08] But I’m gonna start at a different place. My job is easy. My job is to figure out what companies to invest in and, uh, and it, and timing was really important. So with, with MCPS and a- and agents, uh, or even if I was building products at a company, there is a real challenge, which is you don’t really know the patterns that you’re trying to protect until they exist.
[00:15:29] Like, you, you know, it kind of goes back to this imperative that you have to start with a, something that’s not security. At first, there has to be value b- before you can secure the value. So nobody, nobody buys security for its own sake. They buy it because it’s protecting a thing that they care about. But that thing that they care about has to exist first.
[00:15:45] So from a se- from an investor standpoint, you know, you have to be careful about investing too early in security for a new market because it might, market might not be ready or it might change before the thing that they built is relevant and might not be relevant. So [00:16:00] there’s a real timing question. On the other hand, there is a, a, a real problem, which is what, what really happens is that that thing gets built and the attacks happen.
[00:16:08] They become very public and everybody, you know, loses their mind and tries to solve it. So you have to be there with a product when that inflection point happens, and it’s usually some sort of disastrous attack event, which is kind of a dark thing, but that’s kind of what usually works. Uh, so that’s how I think about what’s next.
[00:16:23] So I am looking actively at companies and trying to encourage, you know, um, my existing companies to build for what they think the patterns are gonna be, but not, but not overextend and be very flexible if those patterns change for how the way AI works. But when you think about changes to the way compute works, and I guess this is a fine point, so I was a little, little aggressive about totally disagree.
[00:16:44] It depends on how big the change is. When the computing paradigm changes, usually completely new markets form and product sets form around that. Now, so there’s a question, is that true for AI? I think it was pretty true for cloud native. Like the way that you secure your infrastructure in the cloud native [00:17:00] world is pretty different than the way you did before cloud.
[00:17:03] Um, before cloud, you used appliances on site at your locations, and you… There’s nowhere to put appliances in the cloud, so that technology change is dramatically different. And you see like some of the big companies out there, like Palo Alto is probably one of the biggest network security companies out there.
[00:17:18] Their products for cloud are not even in the same business unit as their on-prem firewall products. I think identity might, might or might not follow that path with AI. We don’t know. Like that’s where I’m saying like we don’t really know where the patterns are. I think AI is a pretty different way of using compute, and it’s likely to, to create new infrastructures, and that for identity, that would be new kinds of identities.
[00:17:38] And I think there are at least three different kinds. There’s people, there are machines, like dumb machines, I guess we’ll call them, and then smart machines, AI. I don’t think those things are all similar, so I think you’re gonna need different stacks to do a, the identity for those things. And then I think there’s an opportunity that, that, that can be unifying across that.
[00:17:58] That’s kind of where I, I see Silverfort [00:18:00] being able to play. So in that sense, I’m agreeing with you. Uh, there should be a layer that looks at everything in a way that is You know, cross those stovepipes or boundaries. But at the, at the, at the core level of infrastructure, AI infrastructure’s very different than cloud native, uh, than cloud native applications.
[00:18:16] It uses a lot of cloud native in- infrastructure, so the infrastructure might be pretty similar, but the applications are quite different, and they’re quite different from analytics applications and big data. Um, so the kinds of things you would need to do to secure an ML infrastructure, I think are actually potentially pretty different than what you need to do to support, to, to secure an AI application.
[00:18:36] Roy Akerman: It’s super interesting. So like, you know, I, and I, I really, like, I- I’m really fascinated by reading this, like, f- you know, I’m an entpr- entrepreneur, like, you know, I, I’m just, like, seeing a problem, and then I’m hunting down, you know, the adequate way to, to solve that problem and then to expand it to a platformic, uh, you know, like, uh, like expansion, like all the follow-on markets and things like that.
[00:18:54] But the shift in paradigms, like in computational paradigms, as you’ve, as you’ve put it, it’s fascinating when you’re speaking about [00:19:00] AI, and I’ll be very happy to, uh, spend a little bit of time around this and identity. So if we’re trying to be a little bit of, like, obstructive, um, the main change that for now we can see and feel is that, um, the models are so non-deterministic to us users, right?
[00:19:15] To, to the end users, so as you cannot really expect what type of privileges, what types of access paths, what types of data and resources the agent will need to use in order to do something, right? And then, you know, like you, you s- you talk about this a little bit in the article, right? About inline, um, um, controls or, like, or, or context aware controls over there.
[00:19:36] Um, can you take us a little bit, like, uh, deeper in your thoughts about how this changed the paradigm of protection and, and identity, or at least what can you see in the entrepreneurial markets, right? Like the emerging, uh, approaches to solve those problems, like what are the claims? Um, and from the other hand, you see like other big platform players trying to retrofit the [00:20:00] current, I don’t know, NHI solutions to agents, right?
[00:20:04] So what’s your take on that?
[00:20:05] Mark Kraynak: So it’s, it’s a relatively nuanced thing. I– But I’ll start with AI and what it changes about the paradigm, and it does a lot of human-like things and which means, meaning non-deterministic. Humans are very non-deterministic, but it does it at machine scale. So to contrast that with like workloads that are not AI workloads, they don’t do human-like things, but they do work at scale.
[00:20:27] Um, and they d- both of those things tend to access very sensitive components. Like if for them to be useful, they have to access the sensitive stuff in your organization. And, um, so that’s a kind of dangerous recipe. Um, I don’t think we… And, and they’re d- but they are definitely different than humans in that humans can’t operate at the same scale, so you can, you have s-some, some implicit guardrail on them because they can only do so much manually, where agents aren’t bound by that.
[00:20:53] But humans also have things you can assume about them. If you hire a person to work for your [00:21:00] company, you don’t really have to tell them, “Don’t break the law.” Um, because they know that. They grew up, they understand there are laws, there are consequences for breaking laws. They might still break them, so you, you know, you don’t wanna blindly trust them.
[00:21:11] But it’s a reasonable assumption that most of your employees, not all of them, uh, are gonna mostly follow the law. That is not a reasonable assumption with agents unless you like specifically train it on what the law is and how, and how you want them to follow it. And they, and they, and the incentive structure doesn’t exist there.
[00:21:26] You can’t put an agent in jail. You can turn it off, but you can’t put it in jail. So like that ethical boundary that is like baseline background radiation for hiring humans doesn’t exist, and then now these, now you’ve got human-like things with lots of access. The other thing that doesn’t exist is common sense.
[00:21:42] So you don’t really have to tell somebody not to do absolutely stupid things. They might still do, like humans do a lot of dumb things, but generally speaking, you can expect your humans to do like reasonable, like to, to behave like a reasonable person. It’s not true for agents. My favorite example of this is Taco Bell, this is a fast food [00:22:00] restaurant here in the States, uh, had an order taker that, uh, at their drive-through that was AI driven, and somebody came through and ordered 18,000 waters.
[00:22:08] And the AI order taker didn’t know to not do that. A human had to step in and stop it. So like that common sense level, it’s not something you can actually assume in your agents I think that’s probably an identity problem. It’s probably an, uh, uh, at least in part, an entitlement problem. Um, it might also be a functionality problem for the builders of the applications.
[00:22:31] Um, so there’s a little bit, maybe there’s a little bit of gray area there. But that is a very different way of thinking about what you have to put in place for entitlement than you had to think about with humans, or that you had to think about with, you know, dumb workloads. So I think it’s a different, it’s like, it’s a different category of entitlement problem.
[00:22:49] Um, the other thing is those agents don’t work in a vacuum. They, they have to work with all those other things. Like, agents to be useful, they’re gonna call those dumb workloads. Those dumb workloads are your sensitive, you know, you know, transaction [00:23:00] systems or whatever they are, and they, and you… And we’re only really just getting to a point where we’re starting to better understand how to put controls around those.
[00:23:07] That’s what the NHI market mostly is. But now you’ve got this new thing that, you know, is unpredictable accessing this other thing, which has a bunch of sensitive access, and you gotta secure that. And that’s the part where I think, um, to Rob’s point, like, that’s where you, you have to be able to see both sides of that and look at it as a unified whole and do something effective about it.
[00:23:28] Rob Ainscough: Yeah, I think it’s really interesting ’cause I, I think this from two angles, right? And I think one thing you kinda touched on previously, like, all of that’s gonna happen faster and faster and faster and faster, right? That’s the trend in identity is, is things are getting quicker. These cycles are getting quicker.
[00:23:42] You know, the, the things you’re having to protect are interacting much, much faster than ever before. So that in itself brings a whole new dynamic and set of requirements in terms of what’s possible, what’s feasible, and what you need as a practitioner to win in this, in this new landscape, right? It’s, it’s [00:24:00] radically changing things just from a, a speed perspective as well as introducing yet more complexity, right?
[00:24:06] Roy Akerman: So, so yeah. And, and th- these are like, uh, like investment, like thesis, uh, b- and again, a lot of like accumulated knowledge, like across the years of like watching the markets. But I wonder, like if we’re taking this to the practitioner world, right, that see those incoming troubles, uh, that comes from, again, NHI, d- dumb workloads, as you stated, Mark, or, uh, from the smart agents that are coming in, like a little bit manipulative, lack of common sense or have their own common sense.
[00:24:33] I mean, AI adoption is here, right? Like it’s, uh, it’s in every board initiatives. It’s fast-paced. There’s a lot of pressure and budget around that. Mm. And still IAM needs to protect, and we’re not necessarily having the tools to do that.
[00:24:45] Rob Ainscough: And I think that’s really interesting ’cause the way, the way I read, you know, the technologies available, if we think about those dumb workloads and NHI, right- It took us a long time to kind of realize what had happened, right?
[00:24:58] Realize the extent to which they [00:25:00] were exploited, and for, I think, the technology landscape to start to catch up. Yeah.
[00:25:04] Roy Akerman: Yeah. Mark, Mark wrote it as like, it was like, “First you need something to protect.”
[00:25:07] Rob Ainscough: Right.
[00:25:08] Roy Akerman: Right? Even if it’s like, uh, something that breaking everything that you thought about computing at all.
[00:25:12] Rob Ainscough: Right. Right? Right. But it, it, it took… It was a, a long, you know, that lapse time was, was significant when it came to NHI. And I think with, with AI it’s a really interesting one, because we do have an opportunity to be a bit more ahead of the game, and maybe learn from that last big change that we saw around cloud computing and NHI, in terms of what we need from, from the next generation of products, and I think that’s a really interesting thing to think about.
[00:25:39] Mark Kraynak: Probably a mental framework that would help if, kinda going back to that point, like instead of saying, “Why the, why didn’t they do this the right way?” Just recognize that didn’t, it didn’t happen. There’s re- maybe there’s reasons for it, you could agree with me or disagree, but didn’t happen. So like kinda get over that, and move forward on how, how to, how to put something around it like a- I
[00:25:57] Rob Ainscough: completely agree.
[00:25:58] I, I think when I speak to [00:26:00] practitioners, you often get this kind of us and them attitude of, you know, “The world’s against me. They’ve developed something insecure again. This has gone wrong again. You know, they’re out for me.” But that’s not the reality, right? Everyone’s trying to do their jobs. You know, engineers are paid to ship code and features to build the business, right, and move it forward, as you say.
[00:26:20] And, you know, n- no one’s trying to create a world deliberately that’s difficult for identity, but it’s about moving past that and saying, “Right, okay. Well, there are new requirements,” right? “There’s a new set of threats that I have to worry about. How am I gonna face into that, and how am I gonna start that journey of, of figuring that out,” right?
[00:26:38] Because the sooner you start, you’re gonna need to go through, as you say, you know, the first attempt at securing that, and try and fail, learn from it, and then go to the second attempt at securing that. And I think doing that and, and, and starting that journey now is really important for practitioners when it comes to, to AI agents and agentic as a whole.
[00:26:57] Roy Akerman: By the end of the day, if it’s an agent, like, a- as you [00:27:00] spoke about, again, changing the paradigm, like, the co- computational paradigm. Um, so, like, we’re authorizing an agent or empowering an agent, which means, like, a smart, non-predictive, uh, computer, like, computational resource. Now I’m afraid that I’m insulting the AI agents, and it will go after me.
[00:27:16] But, like, we are actually empowering them, and like, entitling them, and doing something. So the first thing is, like, how can we empower and give them that freedom of action, laying the, I don’t know, the guardrails. But the second thing is, like, the points of control. How can we control them in case of they’re getting very close to something or we don’t want them to do or whatever.
[00:27:34] Mm. And again, the control plane and of appreciating the… Not just, like, building the controls in, but being able to do something more holistic- Mm … right, uh, that can work with this, like, inline approach is something that I think that, I mean, I would look, like, for- Mm … for as, as a buyer. And I think that maybe, maybe this is a good segue, uh, to go back to poetry.
[00:27:55] And again, I’m, I’m usually writing the melody, so somebody else smarter is, is writing, you know, like, [00:28:00] the, the, the words, or the wordsmithing. Can I trick you, Mark, with, with, uh, with, with an ask? Um- Sure … are you still writing?
[00:28:10] Mark Kraynak: From time to time, yeah. You, you mean writing poetry? Yes.
[00:28:13] Roy Akerman: So, so, so if, like, I’m an entrepreneur and I gave you a very boring pitch, like, uh, on the same time you’ll just, like, write some, some song about me or whatever.
[00:28:20] Like, I, I wonder if, if something can come up to your mind when you’re speaking about identity or security, maybe inspire us with, with- Some words. Yeah, with some words.
[00:28:30] Mark Kraynak: I’m gonna write a haiku for identity security. It’s a little different, which is, “A snowball in hell. Achieving least privilege. Mythical concepts.”
[00:28:40] Roy Akerman: That’s deep
[00:28:40] Rob Ainscough: Cutting
[00:28:41] Roy Akerman: That’s deep
[00:28:41] Rob Ainscough: Cutting. Cutting
[00:28:42] Roy Akerman: Rob, you’re the IM person. I’m just the security person over here, but like-
[00:28:45] Rob Ainscough: I have to say, I love it, and I completely agree with it. I used to… I think I invented a word. I called least privilege unobtainium, because it’s just… I, I rarely say things are impossible in life, but it’s very, [00:29:00] very, very close to impossible to do in practicality.
[00:29:02] So I love the haiku, uh, and, uh, I completely agree with it. Um, and I, I just wanted to surprise you, ’cause I’ve actually prepared a masterpiece for you, um, as not just a poet- A poet … but a poetry teacher. So, um, you can relive the moment that you thought, “Why am I sitting here looking at rubbish poetry from kids?”
[00:29:23] Um, so if I can share that with you, um- Yeah … w- if I can find it on my phone. Um, it’s a masterpiece. Brace yourself. Uh, so this one is about, um, access reviews. Um, so it goes, “Access reviews, access reviews. Don’t think, select all and press renew. Attackers find it a joke, systems up in smoke. Maybe, oh maybe, you should have hit revoke.”
[00:29:50] Mark Kraynak: I like that. It reminds, actually reminds me of a story. We had… Like, we did access reviews for customers at Imperva for database access, and, uh, that’s exactly what they would do. They would [00:30:00] get, like, 25,000 pages of things to review from the system, and they, uh… Nobody’s gonna review that, so they didn’t.
[00:30:08] And we wanted to, and the customer wanted to, like, instead of giving them 25,000 pages, just give them the things that look, like, odd, like anomalies, and that would’ve been, like, maybe If they were lucky, less than 25 pages, but 25 pages, not 25,000. And, and that I think would’ve been a really good security outcome.
[00:30:27] But the comp- the, the, the auditors didn’t wanna let that happen. Like it was a big fight with the auditors. Um, and, um, and we… I think eventually they might’ve won that fight, but it took years. So, um, it’s, I kinda, I agree with the, the nature, the, the sort of generative force of your poem is good. I like it.
[00:30:42] Roy Akerman: In your case, it was how many? Like how many pages?
[00:30:46] Rob Ainscough: Oh, I, I mean, we, we pushed one up to our CIO that included all the access of all his direct reports, and he just rung my boss and was like, “Turn it off.”
[00:30:56] Roy Akerman: Yeah. ”
[00:30:57] Rob Ainscough: I, I can’t do this. I can’t do…” It’s, it’s just an impossible [00:31:00] task, right- Yeah … when it comes to that level.
[00:31:01] It’s, it’s not practical.
[00:31:02] Roy Akerman: Yeah. Hopefully that as agents are the trouble, they can be part of the solution. Absolutely. And I, and I think that, you know, like that’s, that is fascinating to see like, well, like and be part of like shaping that world of how identity will help to, you know, protect that, that, um, you know, like realm of new form of, uh, computational power, like coming at us and helping us, or, you know, I don’t know, disrupting all the way that we worked like before then.
[00:31:25] And with that, Mark, we really wanna thank you for joining us today. I think that, again, you brought a very interesting perspective, you know, all the, the secrets of the future together with, uh, you know, like the, um, the, the approaches of the past, what worked and whatnot. So we really wanna thank you for like, uh, sharing us a little bit from your wisdom.
[00:31:41] Mm. And like, cheers for a lot of other, uh, poems that we’ll, you know, write together.
[00:31:46] Mark Kraynak: That’s good. Awesome. Thanks, guys.
[00:31:48] Rob Ainscough: That’s it for this episode of Identity Decoded.
[00:31:51] Roy Akerman: If this conversation changed anything that you thought about identity security, share it with someone who’s working through the same challenges.
[00:31:57] Rob Ainscough: And don’t forget to follow the show so you [00:32:00] don’t miss what’s next.
