Rob Ainscough 00:00:00
What’s one hard truth?
Eve Maler 00:00:01
Intent-based access control doesn’t look anything like doing authorization better. If you’re seeing identity as infrastructure, there’s a kind of ceiling that you reach if you manage it as tickets, or if you manage it only as incidents. Those things have a ceiling as to how well you can do.
Eve Maler 00:00:16
So, like, when we talk about single sign-on, if you’re in security, it means a way to propagate stronger authentication. If you’re in marketing, you’re seeing it as the way to enable people to get access to the stuff you want them to buy- Mm-hmm … better and faster. The same technology, completely different business purposes.
Eve Maler 00:00:33
Protection, personalization, payment, and people. Risk facing, market facing, transaction facing, and human facing. It’s usually the human facing part that gets us every time.
Rob Ainscough 00:00:43
Agreed.
Roy Akerman 00:00:43
Identity isn’t just an operational problem, it’s a security one, and most teams are figuring out in real time.
Rob Ainscough 00:00:50
This is the podcast where we reverse engineer the meaning of identity security, sharing candid conversations about the people building, fixing, and rethinking identity security from the inside.
Roy Akerman 00:01:00
I’m Roi Ackerman.
Rob Ainscough 00:01:01
And I’m Rob Ainscough.
Roy Akerman 00:01:02
Let’s dive in.
Rob Ainscough 00:01:04
Let’s do it.
Rob Ainscough 00:01:10
Hi, everyone. Day three of Identiverse here, and we’re joined today by Eve Maler. Hi, Eve. How are you doing?
Eve Maler 00:01:16
I’m doing great, thanks.
Rob Ainscough 00:01:17
Very good. So co-inventor of SAML, CTO at ForgeRock, and now founder of The Ven Factory- Yep … building irresistible product strategies in Identity.
Eve Maler 00:01:28
Yeah. Amazing. I love that word, irresistible. Who doesn’t like it? So
Rob Ainscough 00:01:31
you, you’ve really
Eve Maler 00:01:32
seen
Rob Ainscough 00:01:32
it
Eve Maler 00:01:32
all. Also, who doesn’t like a Venn diagram?
Rob Ainscough 00:01:33
I, we talked about Venn diagrams last week- Yes, we did. … when we met. Very big fan. Very big fan. We’ll try and come up with a new one today. So today we’re gonna be talking about a really interesting, I think, important and timely topic, right? So we’ve seen the evolution over the past, what, 10, 15 years of identity going from being about maybe compliance, enabling the business, to securing the business. Yeah. And through that, that’s put new requirements, I think, on leaders and people in identity to figure out how to talk about that. Yep. How to talk about why that matters, why it’s important, how to get funding- Mm-hmm to achieve the goals and ultimately get secure.
Eve Maler 00:02:07
Absolutely.
Rob Ainscough 00:02:08
Uh, that’s the subject of your new book.
Eve Maler 00:02:10
Yeah.
Rob Ainscough 00:02:10
Very exciting. We’ve got a copy right here. Roi’s got a copy. Oh, you gonna show it off? He always keeps it with him now. I’ve already read it. Always keeps
Roy Akerman 00:02:14
it with him. I, I read the Kindle version- … but I got my own signed copy.
Rob Ainscough 00:02:18
Yeah. There you go. There you go. So really we’re gonna talk about some of the themes that you pick up on in the book around that, around how we treat identity as a product, how we understand how to talk to the board about it- Yep … and ultimately achieve our goals.
Roy Akerman 00:02:29
Yep.
Rob Ainscough 00:02:29
Sound good?
Roy Akerman 00:02:30
It sounds awesome.
Rob Ainscough 00:02:31
Very good. Roi will- The
Roy Akerman 00:02:32
pain of explaining and navigating the pain,
Rob Ainscough 00:02:34
right? Yeah. And, and look, we see this, I see this, and I’m sure you do too, Roi, as you kinda talk around places like Identiverse and, and talk to practitioners, it really is a hot topic right now. It’s something I know a lot of companies and a lot of practitioners are struggling with in terms of just how to communicate this thing and communicate- Yeah you know, what it means and what the value is.
Eve Maler 00:02:54
I think it was something I discover when I talk to people when I was doing research for the book is that there’s a kind of ceiling that you reach if you’re seeing identity as infrastructure, if you manage it as tickets, or if you manage it only as incidents, if you’re coming from the security perspective. And those things have a ceiling as to how well you can do, and oftentimes we can see the, the possibility of how you can improve experience, which I- Yeah … sometimes I think of that as a UX vulnerability, if you will.
Rob Ainscough 00:03:21
Agreed.
Eve Maler 00:03:21
And, uh, so I like the idea of no compromises. That’s, that’s kinda my goal. And to get to that place, you need to think like a product owner.
Roy Akerman 00:03:29
Yeah. So I’m super excited about this discussion. And, uh, with your permission, I will offer a little bit of structure, right? Yep. Um, and I think that, you know, it’s all starts with where are we at right now? Identity is still a little bit of a messy world. We’re build it like- Oh, yeah … patch after patch with all the technology progression. And it’s interesting to understand, as the co-inventor of SAML- How do you get to that sp- to that, this point? Then I think that there’s an imbalance between identity as a security tool, or like in a security playground, versus, uh, identity as a business enabler- Mm-hmm … they, versus identity as a very important part of the business.
Eve Maler 00:04:04
Mm-hmm.
Roy Akerman 00:04:04
Uh, and then we can speak about a future and maybe a few frameworks that will help us to navigate this crazy shift- … that AI brings to the world, right?
Eve Maler 00:04:12
Crazy shift indeed.
Roy Akerman 00:04:13
Cool. Yeah, so do we have an agreement about the, uh, outline? Let’s go.
Eve Maler 00:04:16
Let’s go. Let’s go. We’re on
Roy Akerman 00:04:16
board. Yeah. Do it.
Eve Maler 00:04:17
We’re there. Okay. I feel like we can do an archeological dig, actually, to discover- … how incrementally identity grew into this messy thing that we know it- I will take it … to be today.
Roy Akerman 00:04:26
Yeah.
Eve Maler 00:04:26
Like, what I’m thinking about is, so for the book and just from, you know, whatever my, my identity lifetime of experience is- Sure … I started cataloging where identity responsibility lives in the organization. Right. And the funny thing is, it’s really all over. Like, you think CISO. Right. And that’s a kind of natural place- Right … particularly for workforce identity. Yeah. For customer identity, it’s much more variable.
Rob Ainscough 00:04:48
Right.
Eve Maler 00:04:49
Um, but even so, even workforce might be under the CIO somewhere in, in some shared services IT function. Right. But, like, I’ve seen, even at a bank, I saw customer identity owned in marketing, right? Why? That, that was kind of how I felt. Why?
Roy Akerman 00:05:04
Well, I can understand. You need data- Well- … in order to sell the new offers
Eve Maler 00:05:07
and other things, right? It’s the dirty little secret. Yeah. So, like, when we talk about single sign-on, you know, as a SAML-ite, whatever- I, you know, I’ve spent a long time talking about and teaching people about single sign-on.
Rob Ainscough 00:05:15
Right.
Eve Maler 00:05:16
But I learned, took me some time to learn, it means different things to different people.
Rob Ainscough 00:05:20
Right.
Eve Maler 00:05:21
So if you’re in security, it means a way to propagate stronger authentication across more of your thousand, maybe internal apps.
Rob Ainscough 00:05:28
Yeah.
Eve Maler 00:05:29
Uh, if you’re in marketing, if you’re in product, ’cause everybody has digital products now, every company is a tech company- Right … um, you’re seeing it as the way to enable people to get access to the stuff you want them to buy- Mm … better and faster, and a way to personalize the experience. Right. So, like, single sign-on uses the same technology, but it’s used for completely different business purposes.
Rob Ainscough 00:05:50
And I think with different thoughts about the user experience, right? Yes. I, I think from a workforce perspective, you know, I’ve been in that world, it’s very binary. It’s like, “You’re going to do this,” right? Yeah. Because that’s the way it works, and that’s what we need.
Eve Maler 00:06:03
Mm-hmm. Mm-hmm.
Rob Ainscough 00:06:04
In the consumer world, there’s much more kind of, “Okay, let’s bring you into this journey, and then at the point in time we need to step you up and do more- Yeah and understand more about you.”
Eve Maler 00:06:14
You have, you have
Rob Ainscough 00:06:14
to
Eve Maler 00:06:14
be
Rob Ainscough 00:06:15
nice
Eve Maler 00:06:16
to them, because- You have to be nice and
Rob Ainscough 00:06:17
considerate, right? … you’re not the boss
Eve Maler 00:06:17
of them. That is the, that is the truth. And you can really kind of abuse employees, and we shouldn’t be abusing employees. And one of the things that got me started thinking about writing a book-
Rob Ainscough 00:06:26
Sure
Eve Maler 00:06:26
years before, was learning that some of the more mature identity leaders- Mm … actually do AB testing around when they’re designing authentication journeys-
Roy Akerman 00:06:35
Right,
Eve Maler 00:06:36
right … even for their workers. Right. And I’m like, “Wow, I, I wanna work for your company.” The, it’s possible to do that, and when you think about the productivity gains- Mm and when you think about the loyalty gains of, you know, workers can walk too, eventually. Yep. So there’s a lot of benefits that you can get, and, and you’re, y- you’re starting to have that no compromises mindset- Right … that I really love.
Roy Akerman 00:06:57
So it’s a few, several products, uh, at once for the same, like, entity that we’re calling identity. Yeah. Right?
Eve Maler 00:07:03
Yeah.
Rob Ainscough 00:07:03
Yeah. I mean, I, I had a, just a, a great kind of little anecdote that I think sums up the- Where we’ve got to, right? Mm-hmm. I was at dinner, can’t remember if I’ve told this story on the podcast before. I hope not. We’ve only recorded about 10 of them. So I was at a dinner, and, um, we were talking about PAM, and this was, like, a financial services dinner. And one of them said, “I, I don’t have a vault.” And another one was, like, incredulous. “How do you not have a vault? Right, you’re a regulated industry. How do you not?” Mm-hmm. He went, “No, no, no. I don’t have a vault. I have an elaborate patchwork of workarounds.” Yeah.
Roy Akerman 00:07:36
Okay.
Rob Ainscough 00:07:37
Right?
Roy Akerman 00:07:37
Yeah.
Rob Ainscough 00:07:37
And I think that’s kind of applies to identity-
Eve Maler 00:07:40
Yeah
Rob Ainscough 00:07:40
like the way I think about it. There’s a lot of workarounds and things that have kind of grown up over the years- Yeah … that kind of do what we need it to do, but don’t really and, you know, we’ve got the- Did you say that
Eve Maler 00:07:49
proudly, or was he
Rob Ainscough 00:07:50
admitting something? Uh, he’d had a few glasses of wine. Yeah. I have to say at that point, so. Oh, dear. That’s how it
Eve Maler 00:07:53
can
Rob Ainscough 00:07:54
honestly
Eve Maler 00:07:54
come out. I mean, and I’ve heard similar stories about how, like, you know, in role-based access control, you have an awful lot of patchworks and, like- Yeah … role explosion is evidence of- Yeah … how hard it is to have a clean picture.
Rob Ainscough 00:08:06
Yeah.
Eve Maler 00:08:06
And so workarounds are everywhere in terms of- Right well, it turns out this one person needed access for something, and it was probably for a temporary thing- Yeah … but we didn’t treat it as temporary. And
Rob Ainscough 00:08:14
now
Eve Maler 00:08:15
it’s baked in. And once it’s baked in, like, to extricate it, you have to … One of the things I learned was thinking like a product manager and getting the voice of the customer and learning where the pain is. Mm. ‘Cause they were so wedded to it, not ’cause they loved it, but because they literally didn’t know how to extricate it. And if you can be the, the solver of that problem- Agreed … working on what felt like identity infrastructure before- I- … you are now their, you know, hero. Yeah. Agreed. That’s a much better place to be, much more satisfying.
Roy Akerman 00:08:40
I’m starting to understand the mess, where it comes from. So from the one hand, you need to connect a lot of things together, right? And you have SAML and other technologies that will allow you, or protocols that will allow you to connect things together. But then the demand, uh, from identity to serve- Right for so many purposes, kind of like throwing it out to so many areas that are hard to be settled, right? Yeah.
Rob Ainscough 00:09:00
Yeah, and I think for me, more than any other discipline in cybersecurity, I obviously count this as a security discipline, right, it’s about people. It’s about people doing their jobs. And, and to your point- Yes there’s so much fear around access and losing access.
Eve Maler 00:09:13
Yes.
Rob Ainscough 00:09:14
Will I be able to do my job, right? And that’s a really hard kind of balancing act, right- Yes … between security, usability, UX, product, right? And
Eve Maler 00:09:22
I have a theory about that, actually. Go on. So people talk about zero standing privilege as the new kind of Holy Grail. Right. Yeah. And it sounds great And if we think about how to make that possible, um, the biggest problem is not actually removing the access, although that is a big problem- Mm … ’cause every application is gonna have different semantics. Sure. The biggest problem is figuring out how to seamlessly and quickly give people access when they need it. And if we solve that- I agree … like if we think back to the iPhone 5S- Yeah … which added touch ID, it was very interesting ’cause they had a sort of a softer, you know, more tolerant of false positives version of fingerprint checking. Yeah. Yep. Mm-hmm. Um, but it created a kind of herd security mechanism- Yeah if you will, because it became so easy to unlock your phone- Yeah … you could now be willing to lock your phone. I agree. And we went from about 50% of people locking their phones to, like, 99% something. Yeah. So it’s an a, a great example of how making it easier to add the access makes it possible to limit the access and actually have something like least privilege.
Rob Ainscough 00:10:27
Yeah.
Eve Maler 00:10:27
So I’m, I’m waiting for that day when we get, like, really good- … at giving people access in the moment and having them be okay with it disappearing when they go away. Oh. A
Rob Ainscough 00:10:36
really interesting, uh, discussion we had a few weeks ago at EIC, right? We had a, a really good, uh, breakfast hosted, hosted by the Identity Underground. Great group. Yeah. Really good discussion that you were a part of. Oh, that was awesome. So good. But we, we kind of c- there was a coalescence around this concept of, well, instead of, like, managing all this access, what if it was just there when you needed it?
Roy Akerman 00:10:56
Mm-hmm.
Rob Ainscough 00:10:56
Yeah. And we made that decision at that point in time.
Roy Akerman 00:10:58
I smell agents over here, right?
Rob Ainscough 00:11:01
It was an agentic discussion. Ah,
Roy Akerman 00:11:03
yeah.
Rob Ainscough 00:11:03
Um, but that was where there was this broad coalescence around that, and that was mainly for- Yeah … this, like, UX perspective and treating it as product- Mm-hmm … and, and how do we move away from all the, kind of the baggage that we’ve gathered over the years and into something new and different, and that was a really interesting perspective.
Roy Akerman 00:11:17
So now it started to even grow faster and faster, and still we’re feeling that identity is under an identity crisis, right? Yes. There’s something there that is unsolved yet, and- Yes … uh, uh, many of the, uh, leaders that I’m speaking with in this conference are saying that we’re not sure what is this that we should be for the next phase, right? Yeah. So maybe for a second, just like what… So we, we have multi angles of identities that need to be settled together. How would you describe the situations today in most of the organizations that you’re advising to and that, that you’re visiting or speaking with?
Eve Maler 00:11:47
Yeah. Um, there’s a, a, I think of it as a moment of opportunity. Yeah. Like, we don’t even know the kinds of innovations that we’re gonna see, because now everybody can kind of be a product manager. But there’s just been a, sort of a back channel discussion here at Identiverse among some of the, I don’t know, snarky people- Yeah … um, talking about, like, well, now everybody can, you know, make an app. Right. And I’m dealing with that now in my organization because, you know, it’s, it’s, uh, they think they know what they’re talking about- Yeah … and they’re creating something that’s, you know, quite uncomfortably far from the mark- … in terms of all the ilities, if you will. But I’m actually excited about that because now- Product managers, real, real product managers who needed to describe what they wanted to somebody and maybe use Figma- Mm. Yeah … and do a mock and, you know, try and convey what market gap they’re trying to fill.
Rob Ainscough 00:12:34
Right.
Eve Maler 00:12:35
And we can take that metaphorically as well- Mm … with my notion of identity being a product and say, there’s some end user where we need to solve a hard problem. That’s kind of a, that’s a sort of a market gap too. If you have that mindset, there’s amazing things you can do. Really truly understanding it and then trying something, and at least you’re starting from a place of more than a mock. Yeah. And the person who has the idea starts to run into more of the issues-
Rob Ainscough 00:12:59
Right …
Eve Maler 00:13:00
and the real trade-offs that you have with product design.
Rob Ainscough 00:13:01
Right.
Eve Maler 00:13:02
And so I think it’s a, it’s, it’s a great time where we’re gonna see lots more clever solutions, both in the cryptographic area- Right … in, in the, the area of sewing together different parts- Right … kind of orchestration, but also around thinking of agents. Like human in the loop is absolutely a UX challenge. Mm-hmm. Mm-hmm. Like, you might not have a session at the time when you- Yeah … need to be brought into the loop, and bringing you in, that, that what I think of as ask me policy-
Rob Ainscough 00:13:28
Right …
Eve Maler 00:13:28
is a critical one to get right.
Rob Ainscough 00:13:30
Right.
Eve Maler 00:13:31
And you really need to go down to, well, why does somebody care?
Rob Ainscough 00:13:34
Mm.
Eve Maler 00:13:34
And how do I sew it into their, into their day? Right. Those are things that identity unavoidably gets you- Yeah … into the job of doing. I
Roy Akerman 00:13:41
agree. So that’s really exciting. A- and I think that, Rob, as an identity leader, right, that there’s so many opportunities. I mean, there’s so many needs around there. We’re still waiting for some things to be solved. How do you take this conversation to the next level, right? To communicate this with, you know, the C levels in the organizations, not just to justify the budget, but to actually embed identity products in- Mm … the entire business landscape? Like, how do you communicate that? They’re not tech guys. They’re outcome, like, facing. They’re risk managers, right? Yep. Like, when you’re in the C level, how do you maintain… How, how do you build a framework? How do you maintain this discussion ongoing? And not to mention boards, right, that you’ll need to, um, to push
Rob Ainscough 00:14:19
it. I mean, maybe we can tackle the board question- Yeah … like, as the next step. Yeah. But, you know, in terms of, you know, as you said, it’s far from settled where identity lives- Yep in the org.
Eve Maler 00:14:30
Yep.
Rob Ainscough 00:14:30
Right? But e- if you’re under CISO, you can guarantee the CIO is in their ear about UX, right? You can guarantee that’s happening.
Roy Akerman 00:14:39
I mean-
Rob Ainscough 00:14:39
That certainly was my experience. Not
Roy Akerman 00:14:41
in- Okay … an active involvement, but yes. Uh- I mean, it’s under, you know, their RNRs of, of that function, right?
Rob Ainscough 00:14:46
Exactly. So I think for me it was really about figuring out, you know, what each of those care about, how do I measure that? Right? And how do I measure UX in terms of, like, single sign-on or getting access and getting up and running, right? How do I have those temperature checks and sentiment checks in the org so I can describe it in ways that matter to them, right? And for me, it was things like particularly focused on business efficiency, right? How long does it take me from someone going in the HR system to me having them up and running with the access they need to do their job? Mm-hmm.
Roy Akerman 00:15:18
Mm-hmm. Or in other words, how much time they’re not working and, and then waiting
Rob Ainscough 00:15:22
for the- Right. Exactly. Then how much is that gonna cost the business, right? Yeah. Yeah. And how much might it cost me then you can have a sensible conversation about going from 48 hours to process to 24, right? ‘Cause there’s a business benefit there.
Roy Akerman 00:15:34
Okay, so that’s cost saving, right? In business, like- Yeah. Exactly … that’s cost saving, right?
Rob Ainscough 00:15:38
Exactly. Okay. But yeah, focusing on the cost aspect and the efficiency aspect w- of what the, say, CIO cares about. On the security side, we’re, we’re so far away- Mm-hmm … from having a standard set of metrics to describe- Mm-hmm … what success looks like in identity. For sure. Um, I think- Yeah … for me, my only piece of advice for anyone doing this is don’t focus on process metrics. Yep. How many things you reviewed or approved or did is not-
Eve Maler 00:16:02
the metric of security. It is not gonna be interesting- How is logically- … especially as you go upward. Like, you need operational metrics to know how, you know, if you’re rolling out a program- Yeah … how something is going. But, like, the reason for the program, the why of the program, has really gotta be a lot more evocative than that. Right. And I kinda wanna burst your bubble a little bit, ’cause, you know, I was finding- … examples of CISOs who were reporting to CTOs.
Rob Ainscough 00:16:23
Right.
Eve Maler 00:16:23
So, and, like, much more closely aligned with the product function. Right. So depending on, like, what the company does, there’s historical factors and cultural factors and how long they’ve been in existence- Right and M&A factors and all kinds of things like that. But, like, sometimes identity isn’t even really owned by the CISO, and sometimes when they’re owned by the CISO, they’ve got different pressures on them- Right … than the CIO’s pressures. But particularly when it comes to the CIO, you’re naming what, what I call the hidden fifth P in my four Ps framework which is productivity. So, like, you know, at the end of the day, everything has to be efficient- Right … and productive, and they care, and from the perspective of your workforce, you just want them to do the thing faster.
Rob Ainscough 00:17:04
Right.
Eve Maler 00:17:04
And that is quite different in nature from the making sure not to do the thing faster because you wanted to deprovision them immediately.
Rob Ainscough 00:17:13
Yeah.
Eve Maler 00:17:13
That’s an example I used, um, when we were together, uh, on, on Sunday, uh, at, at this event, talking about provisioning and deprovisioning. Yeah. And typically, the same hunk of software is doing both things. Correct. But the person who cares most about it being done efficiently and fast and accurately is kinda different, right? Yeah. Right. Yeah. Like, a CISO really cares about deprovisioning fast And provisioning fast is, I mean, it’s kind of a mixture. There’s some end users of the system that are gonna care about that. Agreed. Completely agree. You know, like an approver- Yeah … is gonna really care. Some manager is gonna care.
Rob Ainscough 00:17:49
Yeah.
Eve Maler 00:17:49
The person who wants to get to work, assuming they’re a good worker- … and wanna get started on day one, or once they’ve moved functions, um, is gonna wanna get going- Right … ’cause it’s frustrating-
Rob Ainscough 00:17:57
Yeah …
Eve Maler 00:17:57
otherwise. Um, but then you look at things like, all right, all the admin time stuff that you’re doing around- Yeah like IGA. Yeah. And now you have other, I don’t even like to use the word stakeholders, but, you know, so other customers for this identity solution- Right … that you’re deploying that have other needs out of it.
Rob Ainscough 00:18:14
Right.
Eve Maler 00:18:15
So, you know, the GRC person is gonna have a different take. Correct. They just, you know, they… It’s their kind of butt on the line, so
Roy Akerman 00:18:22
Agreed. How do you create an alignment? I mean, in, in your book you’re speaking of, it, it starts with a wake-up call for CEOs. CEOs like, “Listen.” Yeah. I’m trying. And it’s not just the cost of breach, it’s more than that. It’s like the lost opportunity of the business. It’s a lot of things. Yeah. Yeah. So starting from scratch, somebody calls you and say like, “Eve, I’m lost. Help me to build, you know, like a process, a framework, metrics- Yep … like all the way bottom up or top down.” Like how does it start? Yeah. If you can give us an example from any- Yeah … different industry it would be great.
Eve Maler 00:18:47
I, I, so I do something that I call a leadership alignment workshop, and it starts with just mapping kind of like, well, what were the historical and cultural factors that led to identity, either living in a place that’s maybe unexpected or possibly at a very low maturity level, not being a function at all. Mm. Like sometimes you’ll have-
Roy Akerman 00:19:05
Agree …
Eve Maler 00:19:06
um, I, I was talking to somebody from a big international bank, and sort of when they came into the picture, there was somebody that was given the title, you know, sort of identity strategist, but they’re an individual contributor with no authority and no budget, and they’re just sort of a roving person. And in reality, authentication lived here and access management lived there. Right. And like the functions were not alignable.
Rob Ainscough 00:19:30
Right.
Eve Maler 00:19:30
So you need to know where you sort of stand. Yeah. And I, I don’t advocate like moving it to a particular place. Right. It, it’s a fool’s errand to really do that. Yeah. But you can start to understand what KPIs have been used so far to judge success.
Rob Ainscough 00:19:46
Right.
Eve Maler 00:19:46
And then you can start to ask, “Well, how successful has it been? Have you had stalled programs?” Right. “Have you had, you know, pro- programs that were going on for three years and then failed and flamed out?” And, you know, you- It happens. Yeah. And sometimes you have some success stories about unification, uh, maybe after a merger or an acquisition or maybe just there’s some kind of big, you know, more, it feels more infrastructurey- Sure but it was intended to bring everything together. And so you find out sort of the story. Now you can start figuring out, well, who was disappointed? And-
Rob Ainscough 00:20:17
Who did we let down?
Eve Maler 00:20:19
Yeah. And that’s a market fit question to me.
Rob Ainscough 00:20:21
Yep. Agree. Mm-hmm.
Eve Maler 00:20:22
Wow. And so if you start to ask, okay, well, if you now understand that you- You’re, you can’t control everybody that you want to use your stuff. Like, if you’re appealing to, let’s say there’s 1,000 different applications- Right … that you want to use single sign-on for the most basic sort of thing.
Rob Ainscough 00:20:38
Sure.
Eve Maler 00:20:38
And maybe 30% of them have gotten there, and imperfectly, and you’re- Mm … really looking for more, or you’re rolling out a passkey program- Mm … and you really wanna see high percentages of success ’cause- Right phishing resistance is awesome.
Rob Ainscough 00:20:50
Yep.
Eve Maler 00:20:50
Um, you need to sort of ask, well, what are the barriers to the success? Because those- Yeah … people you wanna change their behavior, they owe you nothing
Rob Ainscough 00:20:57
Yeah …
Eve Maler 00:20:58
typically.
Rob Ainscough 00:20:58
Agreed. Yeah.
Eve Maler 00:20:59
They really- And so, you know, it, appealing to that market might involve things that look like product management and actual marketing, even if it’s entirely internal facing. Yeah. So to start that conversation is to figure out, let’s take an example of something that maybe failed or maybe succeeded, but somebody was left with a sad face, and you start there. Yeah, yeah, yeah.
Roy Akerman 00:21:17
And-
Eve Maler 00:21:17
Is there- Yeah …
Roy Akerman 00:21:18
is there a repetitive pattern for, like, an area of starvation, um, you know, areas in the organizations that usually are the, the, are the usual suspects of not being- addressed?
Rob Ainscough 00:21:27
Who, who we blaming?
Roy Akerman 00:21:29
Who we blaming? Yeah. No, no, no. Oh, that’s a great way to start. The other way around, the other way around. People that’s- Whose fault is it? That doesn’t even know, that don’t even aware that they can- … uh, get a lot of value out of it, or that they’re missing a lot of, uh- Yeah … like, business because of it.
Eve Maler 00:21:38
That’s what you wanna create, and one of the things I love to do is say, “Well, how can we create FOMO around this?”
Roy Akerman 00:21:44
Yeah. Right.
Eve Maler 00:21:44
Right? And this is why I talk about irresistible identity strategy. So, you know, for somebody who’s maybe a vendor with a particular solution, of course, they want their go-to-market to have that quality, but you need to have the same thinking around your identity programs. And so, like, how can you sit- have somebody say, “Ooh, I want me some of that”? And I’ve seen it work in practice. Like, one of the folks that I interviewed for the book, I, I wish I could name brands. It’s- … brands everybody knows. Um, but-
Rob Ainscough 00:22:11
What does it rhyme with?
Eve Maler 00:22:13
I have seen that trick. I am not gonna fall for that trick. Um, but it was really fascinating that you could have, like, an entire marketing campaign that is Actually employee facing about this new program that we’re doing because we’re gonna strengthen everything, but we’re not gonna take away from your experience. In fact, it’s been kind of a crappy experience. Yeah. You’ve had a different login to all these systems.
Rob Ainscough 00:22:33
Yep.
Eve Maler 00:22:34
And we’re gonna make it work, and we’re gonna make it secure, and it’s not gonna cost you any time or brain space.
Rob Ainscough 00:22:40
Yep.
Eve Maler 00:22:40
And if that, that’s a promise that you now have to live up to.
Rob Ainscough 00:22:44
Yep.
Eve Maler 00:22:44
And in this case, they picked, like, a lighthouse customer, which I would say is, like, you know, everybody phases- Yeah which apps you onboard first. Sure. Which communities you’re- Yeah … approaching first, and then you decide you’re gonna make them a wild success.
Roy Akerman 00:22:55
Yep.
Eve Maler 00:22:55
And you give them the white bl- glove treatment. Mm. And this is what they did.
Roy Akerman 00:22:58
Mm.
Eve Maler 00:22:59
And this with, like, a k- kind of a branded sort of product. Wow. And- Yeah, it’s
Roy Akerman 00:23:02
like the MVP. Yeah. So you have… I, I re- you actually took it to the end, through the end, huh? Yeah. That, that, that entire scope. I like
Eve Maler 00:23:08
it. I take this metaphor as far as I can. That, that, that’s cool. Because it’s so productive. Can I just
Roy Akerman 00:23:11
bring that- Yeah … to
Rob Ainscough 00:23:11
life a little bit from my perspective? ‘Cause I think as much as you’ve got different end customers, right? Mm-hmm. Whether that be the workforce themselves- Yep … authenticating, for example. Yep. Or getting access and getting up and running, or compliance or security or, or whatever they are. You’ve also got this, like, technical customer, right? Where, um, for me, right, we had this mandate, like every app is SSO and every app is under control of IGA. And it will have automated provisioning, all this stuff. Mm-hmm, mm-hmm. So we were putting that in place, and we were, I now come to understand, pretty successful, right? Mm-hmm. We’re talking thousands of applications- Mm-hmm … you know, from the most modern to the most legacy. We did really well. But when a new app came in, it was much, much easier for us to get them to go single sign on-
Eve Maler 00:23:57
Yep
Rob Ainscough 00:23:57
because they knew their users would thank them for it. Yeah. They didn’t have to manage the accounts. Yeah.
Roy Akerman 00:24:01
Makes sense.
Rob Ainscough 00:24:02
And thank you, it was standards-based.
Eve Maler 00:24:04
Uh-huh.
Rob Ainscough 00:24:05
Right? So it was dead easy, right? You’re welcome. And we had a, we had a paved road for them- Yeah … that was super simple.
Eve Maler 00:24:10
Yeah.
Rob Ainscough 00:24:10
Access governance, a little bit more complex, right? Maybe we could do an A- AD offload to a group, and that was easy, but in a lot of cases we’d have to do direct integrations. It was kind of hard. Oh, yeah. Yeah. We gave them paved roads, but really, like, they didn’t see the value of that quite so much. Yeah. And that was a much bigger technical lift for us-
Eve Maler 00:24:28
Yeah
Rob Ainscough 00:24:28
to persuade those people that it still was something important, and always it would be like, “Oh, we’ll do single sign-on. We’ll do that later.” Mm-hmm. “We’ll do governance later.”
Eve Maler 00:24:36
Mm-hmm.
Rob Ainscough 00:24:37
And you’ve got this kind of dual-sided marketplace of how do I adopt and, and bring on new services to the services I run-
Eve Maler 00:24:44
Yep
Rob Ainscough 00:24:45
to satisfy my customers on the other side. Yeah.
Eve Maler 00:24:47
Yes. Yep.
Rob Ainscough 00:24:48
And it’s a really interesting kind of double-sided marketplace in identity I found.
Eve Maler 00:24:51
Yeah. And, and, and congratulations for doing it so thoroughly, and that must have felt really good to, to be successful at it. He’s almost done, how m- how, how many years?
Rob Ainscough 00:24:59
I mean, I mean, I think we were probably onboarding new apps as quickly as we were retiring apps-
Eve Maler 00:25:05
Oh …
Rob Ainscough 00:25:06
by the end. So there was a big transformation. I mean,
Eve Maler 00:25:08
that’s an interesting operational metric right there- Yeah, what’s possible … is like you’re keeping up. So plumbers have a metric, actually. So I had a clogged drain, kind of a slow drain. Right. And he explained to me, I can’t remember the name of it, but if you just run the taps at full, and if it’s draining equally as fast as you’re running the taps, then that’s ex- the, the success marker.
Roy Akerman 00:25:27
Good.
Eve Maler 00:25:27
I was very happy that he achieved that for my, for my sink. Um, and that’s what you wanna see with applications. Right. And to be able to off-board ones comfortably and to be able to know that you’re keeping up because-
Rob Ainscough 00:25:37
Yep …
Eve Maler 00:25:38
there’s gonna be a lot more, there’s gonna be a higher volume of applications created in the future. Right. And a lot more of them will be internal.
Rob Ainscough 00:25:44
Exactly.
Eve Maler 00:25:44
So with owners that are quite diverse now- Yeah versus it used to be kind of like, “Oh, we don’t wanna do bespoke things.” Yeah. “We’re trying to do everything SaaS. It’s controllable.” Um, and there’s an explosion now of people who are making their own apps. Yeah. Yeah. And you want to, you want the right thing to do to be the easiest thing to do.
Rob Ainscough 00:25:59
That’s it. That’s it. You’ve gotta g- as identity, I think you’ve gotta get out of the way as far as possible- Yeah … whilst delivering those results.
Roy Akerman 00:26:05
Yeah. S- so going back to that boardroom, like your advisory meeting or like the, the- Mm-hmm … that you’re sitting there. So like we, we stopped at the MVP, right? You find the early win. Now everybody are excited. There’s a FOMO out there. Uh, you prove the value of- Mm-hmm … us being very organized and structured when it comes to identity. Then what’s next? I mean, there was impatient C-levels that are sitting there- Yeah … like down the room. Like, how do we make a progress and keep this as a product in the organizations? Is there… Are there any frameworks or anything that you found that they’re very easy to leave the organizations with so that they will keep operating on that manner? After the aha moment, after the epi- epiphany …
Eve Maler 00:26:38
Yeah, so- metric design is so hard, but I think it’s really key. Yeah. And, and you wanna tie it directly to the storytelling that everybody knows now that you have to do with folks who are not invested in the technology choices- Right and, you know, willing to geek out the way that we’re probably willing to geek out. Right. So designing metrics that are in some fashion, um, kind of a cross product of things that are normally in tension, that’s, that’s sort of well known to be good about designing, uh, metrics or, or key results. Common objectives, uh- Yeah. So, um, the example that I was using, um, that I, that I’ve been sort of playing with over the last few days has been you’ve got the business wanting to rush ahead because market dominance is everything when it comes to agentic But yet it’s terrifying to those of us who know just how quickly the attack surface is growing.
Roy Akerman 00:27:30
Yep.
Eve Maler 00:27:31
Um, well, then you need a metric that kind of finds a way to be the cross product of two things that are measurable, definable, um, able to be instrumented so you can watch them, but also unleash the business.
Roy Akerman 00:27:44
Mm.
Eve Maler 00:27:45
So I was proposing something like mean time to contain when you have a failure mode- Yeah in the agentic world.
Roy Akerman 00:27:52
Mm-hmm.
Eve Maler 00:27:52
And there’s starting to be some good resources that can help you- Oh, cool … define that for, for yourself. Times, um, what I’m calling accountable action results. So agents do actions. That’s what makes them different from chatbots, right? Right. Um, sort of as I, as I think of it, like the, the marriage of the API economy plus human mimicry.
Roy Akerman 00:28:13
So true.
Eve Maler 00:28:13
It’s scary, but- So true. Yeah … uh, but exciting. And so making any action produce a result, like, uh- Yeah … eventually you’ll be able to have really good ROI calculations, and we’re getting to that point, and some people are disappointed in what they’re finding. That’s another topic entirely. It’s a different thing. But it’s important to know if you’re gonna be measuring risk, you need to know how to measure value and respond to the fact that the business is getting value because it’s way more powerful an argument to the board- Yeah … which after all is deciding whether they’re gonna keep, keep the CEO on for another week or not. Yeah. Um, and so you have the, the combination of those two things. Now you can tell whether you’re in a place where the sink is draining as fast as you’re adding new water.
Rob Ainscough 00:28:54
Right. Right. There was a nice concept that, um, I always liked. Uh, one of the analysts at Gartner talked about, uh, protection level agreements was something he talked about.
Eve Maler 00:29:03
Hmm. Like SLAs?
Rob Ainscough 00:29:04
Like that for security.
Eve Maler 00:29:05
Yeah, yeah,
Rob Ainscough 00:29:06
yeah. And, and that was a really- The consultative model. Yeah … nice model, and that’s something they’ve been developing over the past few years. I like that. But it was a really nice clean way of describing these things that people care about in a way that says, “Hey, if you wanna take that mean time to contain from five minutes to two minutes- Yes or two minutes to one minute- Yes. Now you know what improvement looks like … that will cost you $10 million.
Eve Maler 00:29:25
Exactly.
Rob Ainscough 00:29:26
Is that worth it?
Eve Maler 00:29:27
And, and here’s the irony, you know, there are some fraud leaders who own identity or at least own au- authentication. Mm-hmm. It’s more and more common.
Rob Ainscough 00:29:35
Yeah.
Eve Maler 00:29:35
Um, and so, you know, pr- in financial services- Right you’ll see that, right? And so if you, if you do fraud mitigation for a living, you can quite precisely measure how much it costs-
Rob Ainscough 00:29:46
Right …
Eve Maler 00:29:47
to, to get less fraud.
Rob Ainscough 00:29:48
Yeah
Eve Maler 00:29:49
And, um, I, I tell this story a lot. Uh, once upon a time, I was at PayPal, and I was in the information risk management group under the CISO, and authentication wasn’t owned with us. It was owned by the- Wow … the fraud risk group.
Rob Ainscough 00:30:03
Wow.
Eve Maler 00:30:03
Now, I think that’s changed. It’s been more unified and everything. But they could precisely dial up exactly the amount of fraud they were willing to pay for.
Rob Ainscough 00:30:12
Yeah.
Eve Maler 00:30:12
We don’t have that with security or with identity breaches precisely because identity data that gets out there, just personal data that gets out there, you know, we don’t really attach a value to it.
Rob Ainscough 00:30:25
Agreed.
Eve Maler 00:30:25
And so I explore in the book a notion of an identity data balance sheet. That would make a lot of things easier if we had that. Yeah. Because now you know who all the customers are for that data.
Rob Ainscough 00:30:36
Yeah.
Eve Maler 00:30:37
And who’s in charge of protecting it, and, you know, they can make all the arguments in the world, but the customers are like, “I need that.”
Rob Ainscough 00:30:42
Yeah. Yeah.
Eve Maler 00:30:43
So that enables you to do something with it.
Roy Akerman 00:30:45
Well, let, let’s double down on this one, okay? Mm-hmm. I think that by the end of the day, if you can promise that there’s… Not promise, but, like, articulate a, you know, a, a better world in which we will know when we’re starting to win- … but in that realm. Like, so I, I really like the, the metaphor of, like, a balance sheet. Mm-hmm. How would this sh- things should look like, uh, as a navigator, at least a compass that we should go through? Like, what, this balance sheet, how does it look like?
Eve Maler 00:31:08
So this is something that can be explored once you have that map that I was talking about, kind of the leadership alignment map, because you could take one piece of data that is gonna be in every profile for some population.
Roy Akerman 00:31:21
Mm-hmm.
Eve Maler 00:31:22
Um, and we’re lucky, you know, in, in the case of i- IDPs, we’re gonna have 20-ish attributes. If we’re talking MarTech kind of profiles- Yeah … it’s, like, 20,000, so- Yeah … don’t go there for starters. But you find some piece of data and figure out, well, what systems does it touch? Who therefore cares? Why do they care? What is their interest in caring? Is it because they wish we didn’t collect it? Or privacy person might not wanna- Mm … collect it. Um, or is it HR is the single source of truth for it?
Rob Ainscough 00:31:56
Yeah.
Eve Maler 00:31:56
Um, which is, you know, likely for, for employees. And who else is using it in applications? Like, a lot of times we are not really very clear on the- Yeah the flow of the data. Downstream, yeah. Yeah. But now you know the actual customers for that piece of data.
Rob Ainscough 00:32:10
Right.
Eve Maler 00:32:10
It’s quite revealing because they get value out of it.
Rob Ainscough 00:32:12
Yeah.
Eve Maler 00:32:13
So- Agreed … and if you find very few customers for it, you’ve probably found something you can save a lot of money and risk in getting rid of
Rob Ainscough 00:32:21
To add to that, like what we’re talking about there at its core though, is a level of understanding and like specificity- Yeah about how your service is being used.
Eve Maler 00:32:33
Yeah.
Rob Ainscough 00:32:34
And, uh, I think where I was, you know, in terms of explaining this to the board, you know, there’s the storytelling, that’s really important, but the, the, the table stakes of it is if you’re measuring your identity program by things you’re doing-
Eve Maler 00:32:49
Mm-hmm …
Rob Ainscough 00:32:49
and you don’t have metrics for you-
Eve Maler 00:32:51
Mm-hmm that
Rob Ainscough 00:32:52
tell you how well you’re doing, you haven’t got a hope of telling that story upwards. Yeah.
Eve Maler 00:32:57
That’s right. It’ll remain infrastructure or a security kind of backwater.
Rob Ainscough 00:33:00
Yeah.
Eve Maler 00:33:01
And that would be sad. Yeah. I mean, really, I, I wanna accelerate people’s identity programs, and I wanna accelerate their impact, and- I
Rob Ainscough 00:33:07
agree
Eve Maler 00:33:08
the human part of the equation is, is actually the most important part. And I, you know, in my four Ps, which I don’t think I’ve named, but so protection, personalization, payment, and people. Risk facing, market facing, transaction facing, and human facing.
Rob Ainscough 00:33:22
Right.
Eve Maler 00:33:22
It’s usually the human facing part that gets us every time.
Rob Ainscough 00:33:25
Agree.
Eve Maler 00:33:26
Agree. It is under-invested in, and it’ll unlock so many great things.
Rob Ainscough 00:33:29
Yeah, absolutely. Absolutely. I, I was having a conversation last week, actually, a really interesting conversation about someone who was trying to persuade, uh, their CISO that, um, you know, passwordless supported by certificates and passkeys and all this stuff was the right way to go, and was very frustrated that the CISO was like, “No, I need a vault And, and I asked him, like, “Well, you know, just from the CISO’s point of view, is the vault successful? Does it do what they need?” Mm-hmm. He was like, “Well, yeah.”
Eve Maler 00:34:00
Well, that’s-
Rob Ainscough 00:34:01
I was like, “Well-” Yeah. You have another vault … you were never gonna walk into the meeting and get any other outcome except- That’s
Eve Maler 00:34:05
right …
Rob Ainscough 00:34:05
I am fine with what I’ve got. Because you didn’t index on… And my advice to this person was, “Index on something they care about.” Yeah. Right? How can I get a, a as good or better level of protection- Mm-hmm … the things you care about as a business- Yep … and maybe at a lower cost?
Roy Akerman 00:34:19
Yeah. Product outcome.
Rob Ainscough 00:34:21
Exactly.
Roy Akerman 00:34:22
I mean, that’s the point. Yeah. And you know, when, like we had another episode that we spoke about identity as the control plane, which is the new buzz. It always been, but then how do you build certain applications on top of that, put values to different stakeholders?
Eve Maler 00:34:34
Yeah.
Roy Akerman 00:34:34
I mean, nobody cares but your team of how efficient are you when it comes to your own, uh, the how of things, but again, like the why and how can we be better at the why.
Eve Maler 00:34:43
The why. Exactly, the why.
Roy Akerman 00:34:44
That’s great. And I feel that was the perfect natural decode, like decoding of, uh, what we’ve discussed about, and we left our audience, uh, with, uh, a metric system that they can, or, or at least a framework- Mm-hmm … uh, to go back to work on Monday and start to work, uh, you know, better with their, uh, uh, business partners or leaders. Agreed. And, and maybe if you agree with me, that will be the perfect timing for…
Rob Ainscough 00:35:06
Our rapid fire questions.
Roy Akerman 00:35:07
Yeah. Okay.
Rob Ainscough 00:35:09
Here you go. So we’re gonna start with a myth. What’s one identity or security myth, Eve?
Eve Maler 00:35:18
I suppose that identity is the login box.
Rob Ainscough 00:35:24
True, true. Yeah. That’s a good one. That’s a new one. That’s a good one. Not
Roy Akerman 00:35:26
the perimeter,
Rob Ainscough 00:35:26
not the box. We’re gonna start a leaderboard- Okay … of these, like a Top Gear style leaderboard of what we’re seeing the most. Oh, well, I’m- We haven’t had that one yet …
Eve Maler 00:35:32
I wanna be an unusual one- Right … that nobody else has come up with.
Rob Ainscough 00:35:35
Not yet, not yet, not yet. Yeah,
Roy Akerman 00:35:36
guess, guess which one is very close to you, like to the login box. Identity is…
Eve Maler 00:35:41
The new perimeter. For
Roy Akerman 00:35:42
sure.
Rob Ainscough 00:35:42
I talk about that in the book, yeah. Ding, ding, ding. Yeah. We have a winner. Yeah. Um, so second one, a malpractice. So what is one thing that leaders get wrong?
Eve Maler 00:35:49
That they need to go around and inform stakeholders. Um, it’s just the wrong frame.
Roy Akerman 00:35:56
Inform of what? How hard they’re working in order to
Eve Maler 00:35:59
make these things happen? Well, you know, that you need to just tell everybody. I mean, yes, RACI charts aside, like I just start to fall asleep when I say RACI charts. RACI charts, yeah. So sorry, but convert stakeholder thinking into customer thinking.
Rob Ainscough 00:36:10
Agreed.
Eve Maler 00:36:10
And that, then you become a servant leader, actually- Yeah … and you become- Right you start to get into that product mindset. And you
Rob Ainscough 00:36:15
generate pull.
Eve Maler 00:36:16
Yep.
Rob Ainscough 00:36:17
Yeah, absolutely. So my favorite one, personally, a hard truth. What’s one hard truth?
Eve Maler 00:36:22
All right, this is a rather abstruse one, but, uh, that intent-based access control doesn’t look anything like doing authorization better.
Roy Akerman 00:36:33
I totally agree. Goosebumps. But I mean, I, I think that, you know, like, if you look through the, the booths over here, like, people are still living their-
Eve Maler 00:36:43
They’re defining intent down, and intent is a new-ish problem- Right … for security. It looks a lot more like the privacy world. I liken it to the purpose of use constraints that are not well instrumented in the privacy world. Yeah. But we can do better now that we know it’s a problem. Oh.
Rob Ainscough 00:36:56
Very good. So final one for us, over-hyped. What’s one trend that’s over-hyped?
Eve Maler 00:37:01
Oh, I’m gonna take arrows for this one. Ooh. But I’m, I’m seeing that, you know, there’s a natural sort of hype cycle around things.
Rob Ainscough 00:37:05
Sure.
Eve Maler 00:37:06
And I think NHI, non-human identity, on its own, without adding agents to the equation, even though they’re different in kind- Mm-hmm um, is, it’s now starting to be sort of questionable, and I was part of the NHI summit here, and I noticed that magically it turned into the NHAI summit.
Roy Akerman 00:37:25
Yeah.
Eve Maler 00:37:25
So there’s been a kind of expansion of scope. A rebrand. And I think, you know, that, that’s fair game. Yeah. Yeah. I think it’s, it’s great.
Rob Ainscough 00:37:31
Totally agree. We’re certainly seeing a lot of movement in that category, right? Yeah. So I think a lot of evolution
Roy Akerman 00:37:34
there. We had a whole dinner about that, right? Yes, we did. Last night. Right. That people will still advocate that you need to solve it in a different way, but then, you know, like I s- I, I totally agree with that. And with that, thank you very much. We hope that you will enjoy you- the next two more days that we have here.
Eve Maler 00:37:47
Yeah.
Rob Ainscough 00:37:48
Absolutely.
Roy Akerman 00:37:48
Yeah. Thank you. It was an
Eve Maler 00:37:49
honor- Thanks … to speak with you both.
Roy Akerman 00:37:50
For the hours, four hours. And
Eve Maler 00:37:51
pleasure.
Rob Ainscough 00:37:52
Thank you.
Roy Akerman 00:37:53
Thanks.
Rob Ainscough 00:37:54
That’s it for this episode of Identity Decoded.
Roy Akerman 00:37:56
If this conversation changed anything that you thought about identity security, share it with someone who’s working through the same challenges.
Rob Ainscough 00:38:03
And don’t forget to follow the show so you don’t miss what’s next.