[00:00:00] Rogerio Rondini: Every organization will be breached one day.
[00:00:02] Rob Ainscough: That is the hardest truth of hardest truths.
[00:00:04] Rogerio Rondini: And then this all siloed in, within organizations. Basically, we have different teams, each one work on their own, different tools, don’t talk to each other.
[00:00:15] Rob Ainscough: I’d argue it took us seeing, uh, deepfakes and, uh, fake employees joining for us to realize that workforce had the same problem- Yeah, same problem.
[00:00:23] Exactly … of needing to know who people are. What’s one identity or security myth?
[00:00:27] Rogerio Rondini: Identity is the new security perimeter. It’s a control plane, so the perimeter is broader now. I think it’s a control plane, 100%. If we don’t integrate these, uh, two worlds, like identity and cyber, you will continue having breaches for forever.
[00:00:46] Roy Akerman: Identity isn’t just an operational problem, it’s a security one, and most teams are figuring out in real time.
[00:00:53] Rob Ainscough: This is the podcast where we reverse engineer the meaning of identity security, sharing candid conversations about the people building, [00:01:00] fixing, and rethinking identity security from the inside.
[00:01:03] Roy Akerman: I’m Roy Akerman.
[00:01:04] Rob Ainscough: And I’m Rob Ainscough.
[00:01:05] Roy Akerman: Let’s dive in.
[00:01:06] Rob Ainscough: Let’s do it
[00:01:12] Welcome to Identity Decoded. Today we’re recording at Identiverse in Las Vegas. Very exciting. My first Identiverse, and it’s great to be recording our podcast here. So today I’m joined obviously by my co-host Roy, but importantly, Dr. Ruggero Rondanini.
[00:01:28] Roy Akerman: An identity doctor.
[00:01:29] Rob Ainscough: A doctor of identity, I hear Is that true?
[00:01:33] Roy Akerman: It’s not true.
[00:01:35] Rob Ainscough: Come on, come on. Embrace the myth. So Ruggerio, you’ve spent, what, 25 years in enterprise identity, working at PwC. You’ve kind of seen it all. You’ve seen what’s gone well, you’ve seen what’s gone badly, and that’s what we’re gonna talk about today, right? So we’re gonna talk a little bit about something you’re talking about at Identiverse in a few hours.
[00:01:54] You know, the silos that we’re used to in identity, how that can maybe lead us astray a little bit from a [00:02:00] practitioner perspective, and what you think we can do about that. How we can take a bit of a different path to breaking down these problems and being successful. So to start us off, can you just tell us a little bit about what you do?
[00:02:11] So you work at PwC, right? You work in Europe. What is it that you do there? What do you end up doing with companies?
[00:02:17] Rogerio Rondini: Well, first of all, thank you for having me here.
[00:02:19] Rob Ainscough: Oh, it’s our pleasure.
[00:02:20] Rogerio Rondini: So it’s a pleasure. I’ve been working in identity for about 16 years. Not 25, but 25 in IT in, in general. So I started more as a software developer.
[00:02:32] I took my career, uh, on the development, uh, side of, like very hands-on development. And then 2008, 2009, I decided to get into the identity and access management work, so where I’ve been working since. And what I do specifically, uh, is, uh, looking at, uh, supporting our clients on the, uh, their implementation, access management [00:03:00] implementation journey.
[00:03:00] I work as, um, a solution architect. I work for a long time specifically doing, uh, SCIM implementation. Starting from workforce then moving to SCIM implementation, and now as a head of innovation for PwC Netherlands, I’m looking more about the non-human identity, AI agent authentication. So all these new things that, uh, i- is around, uh, surrounded identity and access management, so I’ve been looking at and try to find the answer to support our clients.
[00:03:32] Rob Ainscough: You know, you’ve, you’ve come through a lot of years of doing this a- across different sectors, right? Different countries in Europe, and, um, you’re gonna talk later today, as I say, about some of those different disciplines that you’ve worked in, about, you know, privileged access management, about SCIM, and some of those silos that I think from, from your perspective hold us back, right?
[00:03:54] Can you talk to us a little bit about that?
[00:03:56] Rogerio Rondini: What I’ve seen in this, uh, in, in this, this field, [00:04:00] basically if we, we take a step back, we started identity and access management let’s say 25-ish years ago. It was mainly workforce, right? You grant access, remove access. Then we grew up to, uh, federation because we have partners, business-to-business partners.
[00:04:18] Then we move to a consumer p- device, and now we are, uh, again, uh, on this no human identity and agent KI. So this all, uh, evolution, but still the way organizations operating and implement their identity and access management program didn’t evolve too much. So we have new technology, great technologies coming, but the operating model, the strategy, it keeps still the same.
[00:04:48] So you look at, uh, basically at three different domains, as I call, like workforce, CIAM, and PAM, and you apply identity governance [00:05:00] specifically or mainly for workforce. Right So, and then this all siloed in, in, within organization. So basically we have different teams, each one work on their own. Different tools don’t talk to each other.
[00:05:16] It’s really difficult to escalate and move into the needs of this new type of identities, this new capability.
[00:05:25] Roy Akerman: So you’re, you’re implying that by the end of the day, IGA or like lifecycle management for the workforce should be different. Where does things start to fall apart?
[00:05:35] Rogerio Rondini: Yeah, I think that’s, that, that’s true, but it is different.
[00:05:38] Like I said, even in, even in the workforce, if you look at the IGA, it’s mainly for employee, right? But we live it in a, uh, in a new world, so different, uh, contracting model type of working. You have probably have heard about the gig economy, so it’s like a freelancer type of work. How do you apply the same governance for [00:06:00] this, this type of, uh, uh, users, the workers, right?
[00:06:04] So it’s not the same. Even within the same domain, we need to apply different capability, different things
[00:06:11] Rob Ainscough: like that. And I think that’s interesting because you ar- arguably, and, and in my, in my role at a retailer, right, even for permanent employees, you couldn’t just put them in one bucket and treat them the same, right?
[00:06:21] A knowledge worker is not the same as someone working in a shop or a warehouse. It’s just fundamentally different, right? And it’s important that we treat them differently, you know, even within those domains, let alone across them. But I think it’s something that I see that’s, that’s an interesting point because I think in terms of how I see identity and, you know, mainly for the workforce is, is where I think about.
[00:06:42] But, you know, you do still see there’s kind of those three big budget lines with teams assigned of PAM, IGA, access management, and that’s really what it still looks like for most companies, right? But as you say, the world is changing, right? NHI, AI, like all of this stuff that we’ve talked about, [00:07:00] it really is changing very fast.
[00:07:02] Can you talk to me maybe about the kind of v- more about that breakdown, about what that, that siloed or static thinking that’s kind of rooted in 25 years of doing different things like compliance or operational efficiency. Like, have you got any examples where you’ve seen that really cause problems for companies, that static thinking?
[00:07:21] Rogerio Rondini: To highlight one specific, uh, scenario that we have, uh, recently, it was specifically about a B2B, uh, scenario, right? The thing is organizations, they don’t, uh, use the same terminology as we do, right? There, there are some confusion sometimes. And, uh, and, and this was one of this case where, uh, they were applying the CIAM terminology.
[00:07:47] And when we get into– we got into the problem, we realized it was B-B2B. But why they were called as CIAM? Because on their perspective, the, it was their client. The
[00:07:59] Roy Akerman: other B is a client,
[00:07:59] Rogerio Rondini: [00:08:00] yeah. Exactly. So if you have another business buying your product, so it’s your client, so then it’s a client identity and access management.
[00:08:06] Roy Akerman: Oh, so they u- they used a CIAM solution or they try to use a CIAM solutions in order to authenticate
[00:08:13] Rogerio Rondini: another business partner? Exactly. That was the idea. And, and, and, and not only that, because when we, uh, we, we dug into the problem, we realized that there are many different, even it’s a B2B external, different type of actors, different type of identities.
[00:08:31] And what happened, uh, over the years, they grew their, uh, identity and access management landscape, fragmented different product, focused mainly on the Microsoft Entra ID. But the different tenants, uh, and data spread across multiple tenants, and it was just, uh, growing, uh, like a, just a natural grow within their organization, right?
[00:08:57] So that’s causing serious problem [00:09:00] to really implement identity and access management for B2B, for the problems that, uh, they have.
[00:09:06] Roy Akerman: I’m curious to hear about confusions or like, uh, misusage of technologies when it comes to non-human identities and human identities, right? When would you… Did you see the business units or the, the IAM teams trying to take technologies that were applied, like MFA or whatever, to humans and then try to force fit it into, into this NHI problem?
[00:09:30] And we’re not even speaking about AI agents. We’re gonna get there in a second. Any good example around there?
[00:09:35] Rogerio Rondini: Yeah, definitively. So we have examples in that, uh, perspective as well because, uh, there is some confusion about also the non-human identity and the PAM, right? So then we– when, uh, PAM traditionally was about password management, session recording.
[00:09:53] So and then we see still organization try to accommodate non-human identity [00:10:00] within this, uh, traditional PAM program.
[00:10:03] Rob Ainscough: Spoiler alert, I don’t think that works .
[00:10:05] Rogerio Rondini: No, that’s not, that’s not gonna work. I tried
[00:10:07] Rob Ainscough: it .
[00:10:08] Rogerio Rondini: That’s gonna w-work. And e-it, it’s even worse when you try to apply, like as you mentioned, MFA, multi-factor authentication, to a non-human identity.
[00:10:18] So it’s, it’s not really feasible. It doesn’t make sense, right? Uh, so the question is now, so how do you apply security to this non-human identity? And still using policies to block users or, uh, context based authorization, but without needing the MFA or step-up thing which is applied for human, right? So that’s, that’s the, the hard part.
[00:10:46] Rob Ainscough: Moving it forward a little bit. So there’s this, there’s this foundation that I think you’re probably saying in a really kind way is outdated and causes us problems And then we look at, you know, where could practitioners go [00:11:00] to really understand what is needed today? And then we go to things like identity fabrics and reference architectures and things like that.
[00:11:07] And I know that’s something that you think a lot about, but do you think those kind of things are helpful for practitioners who are trying to move beyond, you know, this siloed thinking? Do you think they, they help them? Do you think it’s, you know, a useful thing for them to start with?
[00:11:21] Rogerio Rondini: It’s useful, but I think it’s a little bit overcomplicated the way it’s, uh, it’s framed in the market.
[00:11:28] Uh, I think, again, there’s some misunderstanding on, uh, what it is about.
[00:11:33] Rob Ainscough: What is it all about then? What is a fabric all about? What’s it there for?
[00:11:37] Rogerio Rondini: That’s something that, uh, I spent, uh, quite of time trying to realize how to translate. Because if we look to the identity fabric, uh, on the market, uh, on the analyst, right, it’s a b- blueprint.
[00:11:49] So you have a Gartner, the topic call. They have their own view of identity fabric. But what I try to create is a way to translate this complexity of [00:12:00] this blueprint, this identity fabric, in something that is feasible for organizations to really implement, to really realize that, “Okay, so I can do identity fabric.
[00:12:10] I can leverage this, uh, new, uh, way of thinking without overcomplicate it.” So basically answering your question, what it is about, it’s basically what you need, what kind of a digital ser- uh, identity services you need to protect, uh, what kind of application for, from which type of actor, which type of users, and which capability do you need.
[00:12:35] So if we take this capability-based approach all the way from the what identity are you talking about, what kind of user, what kind of use case do you need, and then you map to the capability and, and finally to product. So that’s simplify the identity fabric i- uh, implementation. But it
[00:12:56] Rob Ainscough: also kind of flips it round completely, right?
[00:12:59] ‘Cause you’re [00:13:00] talking more, in my mind, the way I translate that, more of a product way of thinking, right? What capabilities do I need, for whom, to achieve what, and how am I gonna make that work? And then coming to the technology at the end. Whereas I think with identity fabrics, there is a risk of it becoming like a shopping list, right?
[00:13:17] Why do I need this? Because it’s part of the fabric, right? Because I’ve read about it. You told me a great story the other week where someone said to you, um, what was it? “I need IVBE, IVIP.” Why? Because it’s cool and it’s interesting, not because it’s necessarily useful, right? And I think it’s a really important flip in terms of how we’re thinking about this.
[00:13:37] Um, Roy, we were talking about this. A lot of our conversations for this podcast come back to a, a similar core kind of component, which is identity is a product And being successful in identity means treating it as a product with users, with use cases, with requirements that then lead you to technology. I think that’s really important, particularly in securing identity.
[00:13:58] Roy Akerman: Yeah, I think that a lot of, [00:14:00] uh, uh, organizations that I spoke with are kind of, like, focusing on understanding the playground other than u- understanding, you know, the actors, you know, and then treating identity as a product, right? Again, like, uh, buying a solution before even understanding, okay, so for what use case I’m going to solve it, right?
[00:14:16] Or, like, what are the subtle changes between use cases and other things? Maybe the vendors are, like, just, like, we’re very noisy, or, or that there’s no standards or, like, new practices that you can then teach and, um, and deploy or implement. I think that that’s, uh, there’s a lot of confusion in that market right now.
[00:14:33] Rogerio Rondini: Yeah, and then it’s, uh, still organizations, they, they just move it from project to project, right? There is no building up the capability, and their maturity is just based on project. So I wanted to do a PAM program or a PAM project, so then I’m gonna buy very PAM, uh, tool, and that will be okay. But it, it, it’s not the, the reality, right?
[00:14:58] So after you buy the [00:15:00] product, you, you, you need to say, “Okay, how, how I implement this now?”
[00:15:04] Rob Ainscough: And, and I think the problem behind that, right, is, um, okay, you go technology first and project mindset. Okay, great, I go and buy some technology. The problem is then often you build teams around the technology, right?
[00:15:16] So then you cement this siloed thinking into siloed organizations aligned to technology choices you’ve made in the past. That only compounds the problem you’re talking about, right? Because you only see it through a certain lens and you know it’s not my concern how it works for the workforce, it’s not my concern how it works for X.
[00:15:35] Roy Akerman: The, the way I think about it is that, or envision this, is that when you’re sitting with a new customer, right, with a new business, and you, you saw verticals, right? But each one is a different snowflake, right? Like, a little bit special. What is it? You’re trying to define the fabric first. You’re trying to understand the business first.
[00:15:52] I mean, there’s the confusion across the technological cov- uh, uh, kind of like silos. That’s one thing that we already covered. [00:16:00] But how do you understand the uniqueness of, of a business? How do you, uh, imply what you’ve just said?
[00:16:07] Rogerio Rondini: That’s interesting because this is something that we’ve been applying even before we think about identity fabric.
[00:16:14] We needed to talk to, uh, to board level, to the C-level. We need to talk to many people within organization to explain their situation, so we created a capability builder. It’s basically a capability framework where we map all the possible capabilities that we, uh, think it’s important at the moment. And then we create a maturity assessment over based on this, uh, capability.
[00:16:43] And we keep reviewing this, uh, capability, this required capability. What is the core capability? What is additional capability to apply this, uh, maturity assessment Uh, just a, an example, we are now, uh, about to release what we call the Zero Trust [00:17:00] Capability Model, and along with this new capability model for zero trust, we are also trying to apply to use agentic AI, uh, create agents for ourselves in a way that we can map actors into a specific agent.
[00:17:17] For example, you have a, a, um, a manager is, uh, uh, that needs to do a certification campaign every four months. So basically, this is a s- uh, one of the scenarios, right? So then we create agent representing this, uh, persona, and when we run this agent, we, uh, have a overview what is a good zero trust, what is a bad zero trust, what is a known zero trust.
[00:17:46] How it looks like, what kind of capability they should, uh, apply for a good zero trust. If you have a okay zero trust, then at least these capabilities you should have. So with this model, we tend to [00:18:00] talk to discuss with, uh, stakeholders.
[00:18:03] Rob Ainscough: Just to elaborate on that, can you give us some examples maybe of the kind of things you’re looking at in that Zero Trust Capability Model?
[00:18:08] Rogerio Rondini: So zero trust is not only about, uh, workforce or CIAM. So then basically the Zero Trust Capability is a combination of capabilities that eventually come from workforce, lifecycle management, for example, or it can come from the CIAM, strong authentication or identity verification, which is something really important for workforce nowadays.
[00:18:32] Uh, we can talk more about, for example, the, the, uh, the problems that organizations are having wh- when hiring or interviewing candidates with deep fake type of things. So then we move to the non-human identity or security, like real-time policy evaluation or real-time decision for during the authentication flow.
[00:18:54] So all this, uh, capability is part of the Zero, Zero Trust, uh, [00:19:00] Capability Framework. And then, then the next step, of course, is like to create a maturity model for this in a way that… Okay, so we go to a, a client, we can apply this model. We say, “You have a good or bad zero trust,” or, “You have no zero trust.” Is that what you
[00:19:17] Rob Ainscough: tell them?
[00:19:17] “You have bad zero trust.”
[00:19:20] Rogerio Rondini: Not like this. “Trust me,
[00:19:21] Rob Ainscough: this is the worst zero trust I’ve seen all week.”
[00:19:24] Rogerio Rondini: Not, not, not… Yeah. In a nice way. We need to be polite. Yeah. We need to be polite. Sure. But I think the most important is to show the, the s- the situation at the moment, the as is, and then what you need for the to be, right?
[00:19:40] Because the to be is not everything For, for one organization, the to be is the capability one, two, and three. For another organization, the to be is different. So that’s, uh, the, the most important, like how we understand the, the, the, the use case, the business, apply the capability model, and then we have [00:20:00] the target, uh, cap-
[00:20:01] Roy Akerman: So you, you’re coming into an organization and starting to work with the infrastructure and with the IM team.
[00:20:06] But by the end of the day, there’s, like, another security team or CISO organizations or security operation teams that are start- like working there, right? They’re touching the same controls. They’re touching the same plane. They have their own set. Like, they don’t even speak about zero trust. They’re speaking about detection, response, operations, like waiting for the bad guys.
[00:20:26] How do you apply those both conversations to the same control plane, to the same identity fabric, and who’s leading the discussion?
[00:20:34] Rogerio Rondini: That’s a good question. Uh, I think we still need to figure it out, uh, on- Variable … how,
[00:20:39] Roy Akerman: how we’re
[00:20:40] Rogerio Rondini: gonna do,
[00:20:40] Roy Akerman: do the balance. But you, we could play statistics, like who, who wins, the CISO organizations, the CIO- Yeah
[00:20:44] organizations, both.
[00:20:45] Rogerio Rondini: Yeah, but it’s also part of this idea of, uh, identity fabric and, uh, um, capability model to include the cybersecurity capability because identity and access management was always [00:21:00] out of the cybersecurity control. It’s like a completely different, uh, organization, and cybersecurity didn’t really look at the identity as something really, uh, important.
[00:21:11] So one of the things that we are trying to push is exactly this integration between identity and cybersecurity.
[00:21:20] Rob Ainscough: And that’s more than just like a reporting line, right? No. That’s an actual embedding-
[00:21:23] Rogerio Rondini: Actual embedding … of that capability- Exactly …
[00:21:25] Rob Ainscough: in the fabric.
[00:21:26] Rogerio Rondini: Exactly, exactly, and embedding certain id- uh, cybersecurity capability because it…
[00:21:31] when do… if we expand a little bit more, and if you talk about identity threat detection and response- It’s identity threat detection, but it’s not only about identity, right? So it’s a cybersecurity, uh, playbook to, or, or controls or real-time analysis or things like that to really detect and respond. And
[00:21:57] Rob Ainscough: bring it to life,
[00:21:57] Rogerio Rondini: right?
[00:21:58] Yeah, yeah, exactly. Yeah. So
[00:21:59] Roy Akerman: it- Like I said, [00:22:00] in real time, it, like in real time, runtime, if it’s like the most mature phase of zero trust. Phase.
[00:22:05] Rogerio Rondini: Exactly, yes. So if we don’t integrate these, uh, two worlds, like identity and cyber, it will continue having breaches for forever.
[00:22:17] Rob Ainscough: It’s always gonna be a battle. I, I think I’m interested in your take.
[00:22:20] As I talk to companies, I see identity teams sitting as part of security in reporting line. I see them sitting as part of security and integrated and working together. Yes. I see them as part of infrastructure. I see them moving from security to infrastructure. I see them moving from infrastructure to security.
[00:22:37] What do you think, from your experience, is the most successful model in how to really bring those teams together? Is it about reporting line? Is it about how they work? Is it about the technology to enable them? What, what do you think makes that work really well in your experience?
[00:22:52] Rogerio Rondini: Yeah, I think it’s about the culture, organizational culture and how they work.
[00:22:57] I don’t think it’s only about the, the [00:23:00] response line within the organization, but I think key is how this is applied on a daily basis, right? So it doesn’t matter who to respond, but what kind of culture you bring to your team to really work together.
[00:23:17] Roy Akerman: So I wanted to double-click on this one, culture, regions, right?
[00:23:22] Like, uh, I, I know as, as a vendor and as a buyer in my, my own life cycle that vendors always says that it’s, it’s different to sell technology in Germany or like in Ireland than selling it in some specific places in America, right? You, so you have the, the segmentations by sectors. You have the segmentations by countries and cultures.
[00:23:42] Do you ha- did you see any repetitive patterns in EMEA in general or like, I, I don’t know, uh, in, in some specific countries maybe based on the level of governance, maybe based on the acceptance of failure? I don’t know, some differences or some repetitive [00:24:00] patterns in EMEA?
[00:24:00] Rogerio Rondini: Yeah, I think in, in EMEA, uh, there, there are some differences.
[00:24:04] I think it ha- it, it was always there, but I think it’s been more, uh, emphasized now due to this geopolitical situation. And I think EMEA is pretty much looking at local, local partners, uh, local vendors, or at least someone in EMEA that can- Certainty,
[00:24:26] Rob Ainscough: right?
[00:24:27] Rogerio Rondini: Exactly. S- S- Certify the product that you have, I think.
[00:24:31] Uh, and when it moves to cloud, for example, then, uh, there, there is a massive movement right now to use European, uh, cloud providers, right? Because that is this trust, uh-
[00:24:43] Roy Akerman: Some sort of centralizing everything in a control point- Control … or, like, choke point that is- Control … I don’t know, geographically convenient to assume that no one will mess with this-
[00:24:54] uh, you know, when it’s in the cloud- They can’t, it’s in Europe … something like that.
[00:24:56] Rob Ainscough: It’s all good. A-
[00:24:57] Roy Akerman: And, like, still on that, so, like, but the [00:25:00] adoption, oh, I, I don’t know, the flexibility of adopting new processes or models, the speed, the acceptance of failure, are these, like, the same across, you know, your, your base or that you’re seeing that there are some other places that seeks for more clarity and, uh, solid solutions that proved themselves before?
[00:25:19] Rogerio Rondini: I think the European market, uh, at least from my perspective, it’s a little bit more conservative. They need to see maybe results. Uh, they need to understand the technology. I cannot speak about United States, although I, I work with US market, uh, 10 years ago, but, uh, I think it’s more conservative.
[00:25:38] Roy Akerman: In my experience in the US, there are some areas that will be very similar to EMEA, and others that will first solve, then think about the problem.
[00:25:45] Yeah. Yeah. Right? Or first buy the damn product, and then-
[00:25:47] Rob Ainscough: Then work out what it’s for.
[00:25:48] Roy Akerman: Yeah, yeah. And then, you know, after two years in the renewals, they will say, uh, “Oh, yeah, you know what? We haven’t used it, but, you know, there’s a ni- nice graph. Maybe I’ll keep it.” So yeah, I think that it’s… There are some similarities and differences, and [00:26:00] that’s interesting.
[00:26:01] Rob Ainscough: Yeah, absolutely. Uh, and sorry to kind of break the flow of what we’re talking about here, but I just wanted to come back to something that, that you talked about a little while ago is you talked about zero trust capability. So you talked about identity verification, and I think, you know, coming back to what we were talking about right at the start, that is probably the clearest example for me where this siloed thinking really falls down because, like, I’ve seen that firsthand in a company.
[00:26:25] Yeah. So I worked in Workforce. I did not look after customer. Customer. I did not look after partner. I had kind of touch points with them, but it was different. Yeah. But from a customer’s perspective, we had to do stuff to verify identity, right? And we’d start lightweight, and we’d step it up over time as we got closer to transaction.
[00:26:43] There was a lot of technology there and a lot of capability, and that was to make sure we were compliant, right? If I think in terms of Workforce, and I’m talking 2020, ’21 here, if I looked in the market- For a workforce, there was almost nothing on verification at that point. [00:27:00] Almost nothing. And that’s not because we didn’t need to verify our identity- Mm-hmm
[00:27:03] and do a really great job at that- Yeah … and secure things like password resets or account recovery. And so for me, that’s a really clear indicator of exactly what you’re talking about. Because we both have some requirement here, but in one field that’s mature, established market and technologies- Yeah … we had to go out and build it at that time because we just hadn’t thought about it in this joined up way that broke down those silos.
[00:27:28] Yeah. Yeah. And I think it really just brings to life exactly what you were saying- Yeah … about how these silos hold us back ultimately from building that capability in terms of securing identities, whether they’re workforce, partner, customer, anything.
[00:27:40] Rogerio Rondini: Yeah, exactly. And, uh, I, I think this identity verification is a very good example or, or the capability that’s was built for consumer identity for clients, but now is being used for workforce.
[00:27:55] Because in Europe, you know that we have this, uh, uh, identity wallet, [00:28:00] uh, thing, the EU wallet, and I think the EU, uh, ID wallet- Is the solution at the moment that organizations are looking at to support in this identity verification also for, for workforce. Let’s say th- this is, uh, the way, uh, organizations
[00:28:19] Rob Ainscough: are looking- The si- silos are starting to break down a little bit.
[00:28:21] Yeah. We’re starting to understand a little more.
[00:28:22] Rogerio Rondini: Starting to understand.
[00:28:23] Rob Ainscough: I’d argue it took us seeing, uh, deepfakes and, uh, fake employees joining for us to realize that workforce had the same problem- Yeah, same problem. Exactly … of needing to know who people are.
[00:28:32] Rogerio Rondini: Exactly. Yeah.
[00:28:33] Rob Ainscough: Which seems obvious to me
[00:28:34] Rogerio Rondini: now.
[00:28:34] Rob Ainscough: Yeah, yeah. But maybe it took me- Yeah … a lot of time to understand that originally. Yeah.
[00:28:38] Roy Akerman: So, you know, the inevitable question nowadays, how does Mythos and the, you know, the, the newly released unrestrained models or at least the hype around them impacts your job in building the right fabric and advising your, you know, your customers about how to build resilience a- around that?
[00:28:56] Rogerio Rondini: That’s a good question. I think, uh, resilience, uh, is a topic [00:29:00] that has been out of the identity team.
[00:29:02] Roy Akerman: At least giving a sense to their boards and, and to their, you know, like senior management that they, they can handle it.
[00:29:07] Rogerio Rondini: Yeah. I think the Mythos, it’s bad because it’s, uh, cause a, a security problem. But if we think to the good side, it come to, uh, for organizations and the leaders to think about what kind of a resilience they need.
[00:29:23] So we- we’ve been, uh, AIC. You saw my colleague talking about, uh, the minimum viable company, right? What is the minimum viable company? The minimum viable company is, is what you need to keep functioning when you have a crisis. And, and it cannot be without identity resilience, without an identity management system functioning all the time.
[00:29:47] Roy Akerman: For me, resiliency or, like, the minimum viable, you know, uh, organization is that, okay, what is the minimal function that I can still maintain under any type of pressure before [00:30:00] something that cannot be done is happening?
[00:30:03] Rob Ainscough: Yeah, absolutely. I mean, it, it’s the core to business. It’s what you need to protect. I think of resilience as how do I bend but not break under duress, right?
[00:30:10] Roy Akerman: Oh, nice. So flexibility.
[00:30:12] Rob Ainscough: Yeah, the ability to withstand is super important, and that means a lot in terms of identity. And as we have these conversations, and, and you alluded to conversations with board level stakeholders, right? We say, you know, identity security’s becoming a board level concern, but you speak to practitioners, and they have no clue how to have that conversation or, you know, have that make noise and make an impact for that community.
[00:30:36] And this is where I think resilience is so important to identity leaders because I think it’s the vehicle To talk to the board about what they care about most, which is their business running and operating
[00:30:47] Roy Akerman: So if you’re going back, so Mythos is actually compressing or, like, putting a pressure on everyone to figure this out at once.
[00:30:54] Uh, and maybe the definition of how goods look like has just been changed because agents or models [00:31:00] are pressuring the system that much that it requires us to rethink, you know, the technologies, the minimum viable organization, like all of those terms and-
[00:31:08] Rob Ainscough: And also what it’s here for, right? Yeah. It’s here to support your business operating.
[00:31:12] It’s fundamental to that, and that conversation is something you can have with an exec because it’s about something they care about, right? And identity’s not abstract then, right?
[00:31:22] Rogerio Rondini: So
[00:31:22] Rob Ainscough: it’s all wrong. Yeah. I’m interested in your take on this, Rogerio, right? You must see this every week in your job.
[00:31:27] Rogerio Rondini: You know, y- you cannot build a resilience if you don’t have a good identity foundation, right?
[00:31:34] So this is, uh, a must in, within organization. And identity resilience is not only about switching to the IDPA to B if the A goes down or whatever. It’s the capability to detect and respond quickly when you have, uh, a threat or attack in environment.
[00:31:57] Rob Ainscough: And those threats are only getting faster, right? Yeah.
[00:31:59] So it’s an [00:32:00] important one for businesses. It’s getting faster and faster. Yeah. Important one.
[00:32:01] Roy Akerman: I think that’s the perfect point for starting to wrap up.
[00:32:04] Rob Ainscough: Yeah,
[00:32:04] Roy Akerman: absolutely. And proceeding to our, uh, rapid-fire questions.
[00:32:07] Rob Ainscough: Absolutely. Rapid-fire questions.
[00:32:09] Rogerio Rondini: Wow.
[00:32:10] Roy Akerman: Wow.
[00:32:10] Rob Ainscough: Have you seen these yet, Rogerio?
[00:32:11] Rogerio Rondini: Yeah, I have seen, but I’ve never been on this.
[00:32:14] Rob Ainscough: No pressure. No pressure. No pressure. All right, we’re gonna start with a myth. What’s one identity or security myth?
[00:32:20] Rogerio Rondini: Should I go to the easy one or the more controversial one? No, overwhelm
[00:32:24] Rob Ainscough: us, please. Let’s go controversial, then easy.
[00:32:25] Rogerio Rondini: Yeah. Yeah. Uh, uh, identity’s the new security perimeter. Oh. It’s a myth.
[00:32:31] Rob Ainscough: So we’ve heard that.
[00:32:31] We’ve heard that. Yeah. That’s, that’s top of our leaderboard, I think- Yeah … of myths.
[00:32:34] Rogerio Rondini: So if it’s not the new perimeter, what is it? It’s a control plane. So the perimeter is broader now. I think it’s a control plane, 100%. Yeah.
[00:32:44] Rob Ainscough: Absolutely agree. The second is a malfra- malpractice. So what is one thing that leaders get wrong?
[00:32:51] Rogerio Rondini: The tools will be a silver bullet.
[00:32:54] Rob Ainscough: Agree.
[00:32:54] Rogerio Rondini: A tool will be a silver bullet, and it’s not.
[00:32:57] Rob Ainscough: People, process, and tools coming together. These tools
[00:32:59] Rogerio Rondini: come, coming
[00:32:59] Rob Ainscough: [00:33:00] together. To build capability. Completely agree with that one. So a hard truth. What is one hard truth?
[00:33:06] Rogerio Rondini: Well, looking at all the data that we have seen and the, the marketing, uh, the, the surveys, every one organization will be breached one day.
[00:33:16] Rob Ainscough: Yeah. That is the hardest truth of hardest truth. Okay, final one. Overhype. What’s one trend that’s overhyped?
[00:33:22] Rogerio Rondini: I would say that, uh, a- agentic AI is a little bit, a little bit overhyped, uh, right now. And I have, uh, some, uh, strong feeling or some personal strong opinion that we are using the agent term wrongly.
[00:33:38] So not that we, we are doing with AI is an agent, but everybody say that we have an agent
[00:33:46] Roy Akerman: It’s so true. You know, you’re not the first one to say that everybody are tired when the, this like, uh, kind of like, uh, disguise or like, uh, capsule or general term of agent. Everything that you’re doing without understanding what you’re doing, you’re calling this an agent, even if it’s kind of like a [00:34:00] building of a software.
[00:34:01] Uh, with your permission, my, uh, scholar friend, like, I would want to add one last question, okay? So we’re here in IdentityVerse, tons of vendors, a lot of good talks, a lot of confusion, a lot of like people seeks for a framework or whatever. Is there anything, I mean, only one or even more that, that excited you, that you hear here, that you heard here, that you’ve, uh, you, that you’ve learned?
[00:34:25] Rogerio Rondini: Yeah. I, I’ve seen some, uh, some presentation these days. Um, I think what I… Well, I like that most of the keynote from Noelle. That was a fantastic keynote for me, not only because of their way, her way of, uh, presenting.
[00:34:42] Roy Akerman: I wasn’t there, so happy if you could
[00:34:44] Rogerio Rondini: fill me in
[00:34:44] Roy Akerman: for a second.
[00:34:44] Rogerio Rondini: But, but the idea that the, she was talking about agents and the idea of a baby tiger.
[00:34:51] Yeah. And the baby tiger basically is something that you have, like your baby tiger, so like your, your [00:35:00] kids, everyone, and then it’s cute. It’s beautiful. And that’s, uh, the parallel that she made with AI, with AI agent. So that’s, uh, it’s beautiful. It’s ex- it’s cute, but it, it, it grows. One day it bite. It eat data and everything.
[00:35:15] So I think that was amazing.
[00:35:17] Roy Akerman: So this metaphor, this metaphor actually help, uh, in order to start to build the frameworks around different phases and, like, grow with the agent other than just try to fix it all at once.
[00:35:26] Rob Ainscough: Very cool.
[00:35:27] Roy Akerman: Fabulous.
[00:35:28] Rob Ainscough: Very cool. Well, Rogério, thank you so much for joining us today. Thank you.
[00:35:32] We really do appreciate it. Yeah. Was a pleasure. And, um, good luck with your talk in just a couple of hours.
[00:35:37] Rogerio Rondini: Yeah.
[00:35:37] Roy Akerman: Good luck. Yeah.
[00:35:38] Rogerio Rondini: Excitement. We’re gonna cheer you from the
[00:35:39] Roy Akerman: audience side, yeah.
[00:35:40] Rogerio Rondini: Thank you.
[00:35:41] Rob Ainscough: Very good. Thank you. Thanks again. That’s it for this episode of Identity Decoded.
[00:35:45] Roy Akerman: If this conversation changed anything that you thought about identity security, share it with someone who’s working through the same challenges.
[00:35:52] Rob Ainscough: And don’t forget to follow the show so you don’t miss what’s [00:36:00] next.
