Where do you think you are now? You're probably way behind the curve. You're probably like, you know, getting breached and stuff like that. You can't take a vacation from investing. Hey, I'm not saying I agree. I'm just trying to play AI advocate here. I'm trying to think really hard because budgets are tough. And if you have magic IAM people, IAM heroes is what I like to say, running around behind the scenes,
just making it work. And the organization doesn't feel the pain of not having modern tools, let's say. Could you have gotten away with it? I would argue, yes, it happens. It still happens today, right? But should you? You can get away, Jeff, you can get away without buying life insurance. But if you die, then your family will have no money. Well, that's their problem, not mine. Yeah.
Yeah. This is identity at the center. If it has anything to do with IAM, this is the go to podcast. Now your hosts, Jim McDonald and Jeff Steadman. Welcome to the identity at the center podcast. I'm Jeff and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad yourself. I'm doing great, man. I'm in a good mood. How are you feeling? Oh, all right, you caught me. I'm a little crabby and I
don't know why. I just have one of those days, I think. You know, whenever I'm feeling crabby, I think about crabby patties and how they're like the jam. I never actually had a crabby patty, but that was like the hamburger looking thing that they had on SpongeBob. Any time to have a crab cake? No, no, like the hamburgers on SpongeBob that they made at Mr. Crab's restaurant. Jim. Have you ever watched SpongeBob? Jim,
I'm a grown ass man. I have never seen SpongeBob. Oh, you're missing out, bro. You're missing out. It's not, it's not, it's like the Simpsons. It's a cartoon, but it's something like hidden. I've seen pictures of it. I've seen like memes or something like that. It's funny, whatever, but no, I've never, I've never sat down and I don't think I've ever seen more than three seconds of a SpongeBob thing. Oh, yeah. I'm
missing out, man. So is this something you're doing? Just watching SpongeBob all the time? Well, no, I guess I did have kids that were in the right age range for that show for a while. So I'd wind up watching it. But then I realized that, oh, there's one of those cartoons that's meant to keep adults entertained as well, like Simpsons. See,
there you go. I don't have kids. So I never, I never have not gone through any of those phases. Just keep just watching a pursuit or two. Like, what do you have to lose? I don't know. You're not in the right mood for that kind of suggestion. Yeah, yeah, don't try and don't try and solve the problem, Jim. I just want to be crabby. Crabby
patties. Well, you know, one thing that I'm not crabby about, and this is kind of a milestone for us this morning, was we crossed over 300 ,000 downloads of this tiny little IAM podcast, not so tiny anymore, I guess. I know. I'm going to sound like a broken record to say. I remember when we had 20 downloads of the first episode and we knew all 20 people were. But we literally just started
by you saying one day, let's start a podcast. I was like, OK, thinking this won't last. We're coming up on 300 episodes and 300 ,000 downloads. Pretty amazing. Well, it's pretty amazing as it took. Yeah, we had no idea we were doing 100 ,000. And it took four and a half years, roughly, to get to 100 ,000. Because I remember we celebrated
that at Adeniverse last year. And we're at 300 ,000 and it's less than a year later, which is absolutely bananas. And we saw a ton of growth just within the last several months and stuff like that. But it's a lot of fun. We still do it. You know, this is not our job. We do it because we like doing it. And, you know, thank you, everyone who's listened, subscribed, shared, you know, all that fun stuff.
And yeah, it's kind of fun to take a step back and, you know, that'll probably put a smile on my face now here for a little bit. Yeah, well, you know, just thinking about it, like that doesn't include our YouTube stats. So if you count those in, we have like 301 ,000 downloads. No, 300 ,000 and one, you mean? Our YouTube channel is still very small, but we are
putting more emphasis on it. Starting to think about how we're going to do video episodes. Still a little bit of a challenge from a timing perspective, just, you know, forth, forth, forth wall here is we're recording this on a Friday. And this needs to go out Monday. I have other stuff to do and I still need to get this edited once we're done and trying to figure out how that quick turnaround will
work. So this might end up being only an audio episode, but if it, if I have time, I can figure out a good workflow and get better at it. There may be video episodes showing up on YouTube. So go to our YouTube channel. Subscribe, like, do all that stuff the same way we'd built up the audio podcasts. We're going to keep doing that, but we're going to start
doing video as well. Um, as time permits and hopefully time will be more permitting in the future. Yeah, because the real thing is like, I think when people find out about the podcast, probably half of those people will continue to listen or in the future, watch the podcast. So when people go out and like and subscribe, it helps more people find the podcast and. You know, hopefully, I mean, the way I look at it is
it's a community. I depose a community. I think the listening of identity center is a community. I see a lot of people, you know, really get a lot of value out of it. And we get to meet folks and introduce those folks to other folks. And it's, it's everything I hoped it could be. Yeah, it's a lot of fun. We're having fun doing it and we try to keep it fresh. So we'll keep doing it until one or both of us gets
bored. And then that'll be it. Let's see, it's a Friday night. What do we want to talk about this week? I think, well, first we have to talk about like all the conferences that are coming up. The first one is identityverse. As everyone knows, it's like the one of the biggest conferences within the digital identity industry. It's May 28th through the 31st at the ARIA. We've got a 25 % off discount
code. It's IDV24 -IDAC25. It's kind of a long code. But hey, when you get 25 % off, I think it's worth using. And you pretty much go to identiverse .com and you can figure out how to go through the registration process. I know early bird pricing is up soon and might already be up. But the longer you wait, the more expensive it gets. So I'd say get out there and register as soon as
possible. Jeff and I are going to be there. We'd love to meet every one of our listeners or as many people as want to come up and introduce themselves. We'll be at multiple places. So we're having a happy hour. I think it's Tuesday night, but reach out to Jeff Rai on LinkedIn. Choose the DM if you're interested in meeting us and going to the happy hour. It's going to be with TALUS. It's going to be at the one of
the bars in the ARIA. I think, do you remember what it's called? I don't remember, but it's with TALUS and RSM, right? I think that's the plan. Yeah, TALUS and RSM. We're also going to be recording live episodes. So there's one room that's kind of like a fishbowl recording studio. And folks can stand outside of that, look in and they have headphones available that people can put the
headphones on and listen to what's going on. I know you're laughing, Jeff, but that's a huge improvement versus what we did last year where nobody could hear us. Yeah. I mean, there's two options, right? You can either, I think that's going to be in between both of the expo halls. There's two expo halls this year.
It'll be a fishbowl. We're kind of sharing it with the CRA, TV folks, the folks who help put on a number of cyber risk alliance. We've been great partners throughout this. So we'll kind of be using unused time from them and we'll also have a
conference room somewhere. I don't know exactly where it is yet, but there will be a sign outside of it where people should definitely be able to hear us then because it'll be a little bit further away from everyone. We'll be kind of in a room. We'll have different guests. I hope we'll have some chairs, maybe one or two people will show up and watch us kind of record one of these things live. And
yeah, that'll be a lot of fun. Yeah. So the third thing, we had a third thing going on as well for people, we're going to be with RSM and TALIS at the TALIS booth or whatever. Yeah. Was that the booth or whatever it is on the expo floor? Expo hall. So there's going to be an opportunity to drop by and
meet us there as well. Again, if like you're interested in any of those things, just reach out to us with DMs or play it by ear. We'll drop by any of the things. Just like we do here on the podcast, just we'll do it live. Just yeah, just wing it. Yeah. I'm also hosting a or moderating a panel, I guess, probably a good way.
So former guests on the show, Sean O'Dell and a tool, Toolshed Bagway, are going to be talking about CAPE, C -A -E -P, Continuous Access Evaluation Profile. And they've asked me to moderate a panel that they'll be on. So I will be the everyday man trying to figure out what the heck they're talking about as I moderate the session. So that'll be on Wednesday, May 29th at 1140 AM. So I hope people come out and
check that out too. I've not done a lot of moderating for conferences. I guess maybe my second or maybe third time. So watch me be nervous up on a stage with a bunch of people. Yeah, that was such a good episode that we did. I mean, those guys are really on some of the cutting edge stuff. So I think a lot of us in our day to day, we're
doing things that have been kind of established. I always think of identity as like, for the most part, you're kind of like doing things that have been proven to work. People call it best practices. I don't like that term, but they're proven technologies. These guys are kind of like moving into areas that are, I wouldn't call it bleeding edge, but they're newer. Like
CAPE is newer. So you can learn a lot because I think, if it picks up steam and gets more folks adopting, it's going to be proven technology. You know, Sean would probably already argue it is proven technology, right? But he's out there proving it. Yep, exactly. So then let's see, after a Denver, we've got people probably hopping on a plane going straight to European identity and cloud
conference that is June 4th or the 7th in Berlin. We have a discount code for that as well. EIC 24 IDAC 25 gets you 25 % off. We'll have a link in our show notes for that one. We will not be there, but fortunately we have a code that we can share with folks. Well, we will be back later this year is identity week and there's a handful of conferences throughout the year. So there's Europe, which is in
Amsterdam, June 11th and 12th. There is Americas, which is Washington, DC, September 11th and 12th. That's the one Jim, you and I will be at. And then Asia, October 22nd, 23rd IDAC 30 gets you 30 % off of all of those conferences. So looking forward to that. So kind of cool. One of the things we should do is kind of try to highlight the different conferences that are happening throughout the
year. I think we'll have authenticate coming up at some point later this year. I mean, it'll be happening, but we'll have, I hope a discount code for that one. So that people can reach for that. And Andrew Shikiar will come back on the show and help us understand like what's going on there. We'll play a part in that with the podcast. I also wanted to mention RSA
is coming up. We don't have a discount code for that, but how many times have you been asked so far, Jeff, if you're going to be at RSA? I think everybody has asked and I, I have been in the past. I think this is the second year in a row that I haven't gone, but I think there's probably a streak of like three or four that
I went to, but just not this year. So here's my approach to it. I mean, I'm not looking to ask you to try to put it down or anything or pump it up. But what is your, what's your thought on RSA? I think it's great for meeting folks. I'll be honest. I don't think I've ever
actually attended a session. The way that I go, and this is a pro tip for folks is if you want to go to RSA and it's expensive, for sure, get just the business hall pass and go walk to the expo hall. You can literally spend two days just exploring it, seeing what new technologies are out there and stuff like that. That's usually what I go for is that kind of thing.
Everyone wants to know you might be able to sneak into a side room or something like that to catch a session. But I don't remember, I don't know what it cost this year, but it was like 50 bucks a couple of years ago. You know, maybe it's gone up in price, probably like
everything else. But that was all as my pro tip for RSA was just even, you know, if, if you're looking to save some costs, the money you save on travel or the money that you save on the, on the conference pass can be for the travel that's a little more expensive for services. Let's go. Yeah. My problem with San Francisco is like $400 hotel rooms per night. I mean, they would move it to Vegas. You
could get a lot cheaper. I mean, $200 and now you can get a nice hotel room. Yeah. Let's Vegas. It's built for that, but some people don't like Vegas either. So can't win. Can't win. You can't make everyone happy. Yeah. Well, let's see. How can, how can we make some people happy this week, Jim? Mailbag? We can, we can respond to their questions. Okay.
And you have this crazy idea of how we're going to respond to these questions from listeners out in the world. Explain your idea here so that we can kind of set the stage because this is definitely going to have visual as well as audio components to it. And we're trying to make sure this comes off well for audio too. Yeah.
Yeah. So considering the audio podcast aspect of it, we're going to read off the questions that we've gotten, uh, these are real questions and we'll put them into an AI engine. So we're going to use gem, Google's Gemini, not just Gemini, Gemini advanced. Cause I should pay for it. We're going to use the advanced version. So I have no idea what's
going to happen, but we'll enter them in. Jeff is very good at like command line prompting or prompt engineering. They call it, right? There you go. So he'll get us to as tight of a answer as possible or say it's a bit of an answer and it's like two pages long. We're not going to bore you by reading that. I'm going to get down to kind of like, you know, top five or, you know, short descriptions. Then
we're going to read them off. Obviously, if, if we get this out to YouTube and you can see the questions, you can see everything, the AI outputs. But I mean, I think the takeaway from doing this is like folks can start to get the idea of like, all right, this is what you might be able to get from AI. If they're not using it already, like we are, and, you know, put in like top five of this or top 10 of
that, see what comes back. And then my thing with AI is like, I kind of felt like my first start using it, like the answers were so super generic that anybody who had been in the industry for five or more years, but would know more nuance than what it was spitting out. So I'll be real interested, like literally we're entering these for the first time as we go. So we'll be evaluating how good the answers are and
whether or not we agree with them. Yeah. And hopefully helping out some listeners who actually sent some questions in. So your mileage is going to
vary based on whichever AI model using. I just happened to pick Gemini Advanced is the one we're using today, but if you're using Claude or if you're using open AI, AKA chat, chat GPT or Microsoft's version of, of chat GPT, the reason I like Gemini is it's tied to Google, which means theoretically it should pull back more current information than some of the other models that are
not trained on anything that's like within the last year or so. The only exception to that, I think is meta put out their AI model this week, meta .ai. You can go to the website and that's supposed to be connected to both Google and Bing, but I have not really tried it out yet to see how good it is. So we're going to just go with Gemini. I just know that mileage may
vary. So let's see here. I'm going to put this question for you just to start. What is the top identity or digital identity podcast? Are you going to make me take this out? What is the top identity and access management podcast in the world? Yeah, this is going to be very embarrassing when it comes back with no idea who you're talking to. Yeah, there is no top. All right. So it's not even giving like
answers. So it's, you know, basically saying, okay, well, where subjectivity, evolving landscape, consider your interests, and then where to find podcasts like, oh, we're on here. Where to find podcasts. So podcast directories like Apple Spotify, blogs, some popular IAM podcast gets you started in no particular order. Just something called identity and access management. I don't know what that is. Let's
talk about digital identity. That's by the folks over at Ubi Secure. I know I've heard about that one. Manage engines, identity and access management podcast series. I am pulsed by Biokey International. I'm not sure if I know what that is. The identity brief and there we are. Identity at the center. So hey, I'm going to guess. No particular order, but we're last. Yeah. So all right. Well, that was a good warm up. Let's
take the first question. This one's from Jay in the USA. And let me go ahead and paste this in here. Jim, you want to read the question while I'm getting this set up? Sure. So the question is, what are the top IAM metrics an organization should collect, track or monitor for? Okay. And so the way I've done this is. Yeah. What you added was give
this, go ahead. No, no, go ahead. I was going to say what you're going to do is for like a comp engineering perspective, give this an executive summary format with no more than five points. Yeah. And hopefully that keeps it to like one page. So there's not a lot of scrolling and stuff like that. But yeah, there we go. So that was kind of the idea
was, okay, take the top five points here. So one of the top IAM metrics and organizations should collect, track or monitor for an executive summary format with no more than five points. Let's see. So to ensure effective identity and access management, organizations must prioritize the tracking of crucial metrics. Here are the breakdown of the top five. All right, Jim, you read them off. All
right. First is time to provision and deep revision. Second is privileged account activity. Third is failed login attempts. Fourth is number of inactive or orphaned accounts. And number five is IAM policy compliance. Okay. So I'm going to pick on some of these and say what I think about them. Like number one, time to provision and deep
provision. If you're just talking about fully automated processes, like what's the point of tracking the amount of, yeah. Like, oh, that took like 12 seconds. Right. If you're talking about something that's disconnected, probably you're having to go out to an outside ITSM system to get the information. And that's a kind of a complicated thing. And you may not have all that automated to pull that
metric. Are you going to do all the figuring of that out just to provide a metric? I just, you might have to. That might be the reason why you go for, if you're not automated today, we're spending way too much time on tickets, creating active directory accounts or email accounts or X accounts, whatever it may be. Well, let's do the analysis. How much time did we spend
when was ticket created? What's the dwell time or how long has the ticket been open between when it was created and when it was resolved? You know, does it, is it four hours, two hours, 48 hours, three weeks, you know, whatever it may be. So I think it's, I still think it's a relevant metric, even though you should be automating chances are you're not automating
everything. And that metric might give you either a piece of mind to say, okay, we've automated as much as makes sense, or we're deprovisioning accounts within what we said was a policy, we will turn off accounts within 24 hours of notice, eight hours of notice immediately. Are you actually doing that for the automated ones? Yes. Because it's programmatic for the manual ones, theoretically, right? Those
probably go into a ticket queue. Does someone get paged in the middle of the night to say, oh, Jeff's gone. I've shut down his account and make sure that he doesn't have access over the weekend, right? Things like that. Yeah. So in my mind, one of the things you can do with metrics is show how you're improving over time. And so I think that one potentially could show
improvement over time. But here's what I don't want to do, which is, all right, right now I'm at two minutes to provision everything I provision. Now, I'm thinking about like bringing these other apps into my scope, they're going to have to be manually provisioned. That's going to screw my metrics.
Maybe I'll just like say they're not, I'm not going to do that, or I'm going to do one at a time so it doesn't affect my metrics too much. So are any of us that devious? No, of course not. But it's like a, the motivation is a negative motivation to doing it. Well, if you're working in a large call center, ticket resolution time is a metric
that staff gets measured by. I know because I got measured by it when I was in the call center. So that's why I background was how long did it take you to do it? That can be a negative, right? Cause you're now motivated to hang up the phone and that call. Get the person to agree that they, you know, I can't help you. Can
we hang up the call? Like, all right. What really matters is was the person's issue resolved to
their satisfaction. Now you could just kick them out to some kind of survey, but however you wind up gathering that metric, I think when it comes to provisioning or onboarding or and it takes two days or three days, if you go from three days to two days, yeah, that sounds better, but if the person feels like in the three day scenario, they knew what was going on and like, they're getting
constant updates versus the two day scenario where, you know, they weren't getting updates or they just felt like nobody cared. You know, then your customer satisfaction score is going to be potentially worse than in a two day scenario. I mean, it's all about customer satisfaction when it comes to something like this. Well, that's why most taking systems have a stat, have different statuses of resolved versus closed
resolved means we think the problem is resolved. And you have X number of days or hours or whatever it is to reopen that ticket and say, no, this is not resolved, whatever troubleshooting or whatever thing you did did not work, right? Or in this case, the access provided is still not in place or isn't working correctly. You can reopen the ticket. So ideally you would measure
the final status, which is closed. Now, if I think I've done the work correctly, you know, and I mark it as resolved and no one tells me that something's not right or not working, I'm going to
assume it's correct. So you could measure, you know, how many tickets were, you know, marked as closed and shouldn't have been, but then how do you kind of match a new ticket to the old ticket because you don't really want to reopen a closed ticket, be
able to measure that time. So it gets a little bit sticky within that regards, but I still think it's a valid metric just to be able to articulate how much time do we spend in identity and access management. If you had to sit down and like track, you know, like a consultant, let's say, Jim, like, you know, how many hours or days or minutes do we spend on
each task? And if you're out there in the real world, you know, doing identity stuff, track it for one day. And I think you'd be shocked on how much time you're spending on each individual task. It probably adds up quite a bit. It's like people have full -time jobs on this. I kind of think that you
need to incentivize the right behavior. And if what you're incentivizing is potentially shortcuts or if you're trying to get off the phone, I think we've all been on the receiving end of that. Your customer satisfaction, your satisfaction level goes down. And really that's what you're driving for is, you know, and a lot of organizations say, Hey, we're going to outsource this part of our
organization. Maybe it's the help desk, for example. And then the help desk is kept to like, if you don't end the calls on average, time of 10 minutes, then you're going to lose 20 % of your money. So then the manager within that call center is like, close those darn calls. And if you have to like provision part of the access because you don't know what the full access
is, provision part of the access and close it. Now, the customer is going to be like, okay, I still, yeah, you closed my ticket, but I still don't have the access I need. That's a huge fail. So it's all about incentivizing the right behavior, just like bonuses. When you pay bonuses to people, it should be because we're doing the behavior that you want them to do, not just that, you know, we're doing
extra. The extra might not be helpful. All right, we're never going to get through this entire list. And in one show, if we spend 10 hours at each point. One question, everybody. So not one question, one question, one point. Yeah, right. So let me move on. All right. The second one is privileged account activity. I'm going to read this one out. Monitor's the use of accounts with
elevated permissions, Ergo administrators. This is vital in detecting potential misuse or breaches targeting sensitive data. Personally, opinion like big red X, this is not, this is not a top I am metric to track. Not tracking privileged account activity. It's not a metric. What's the metric? How many times you're like, how many admins do you have? How long were sessions,
privileged sessions running? Okay. How many admins you have potentially, but if you go from 70 privilege admins to 71 or 75, like, are you doing things poorly? Or if you go from 70 to 65, are you doing things well? I don't know that that adds up to me. That's not a good metric. This is how people gain access to systems as they elevate, right? Up
and over. So let's say you're a small organization and you have 10 domain administrators, even that might be actually might be too many for, for even a large company. Let's say you have five domain administrators and you have a learning set up to say, Hey, if there's any domain, a new domain administrator account pops up, we have six. That's immediately a problem because we should only have
five at all times. The keyword used there was alerting. Absolutely. That, but that's not a metric to track. To me, a metric to track is like something that shows progress in one direction or the other. I, that's why I don't think that's a good one. Well, the next one failed. Collect, track and monitor or monitor for. Or monitor. What are the top line metrics an organization should
collect, track or monitor for? I do think you should be monitoring your privileged access. I think you should know who is privileged. You should have a count on that somehow. You should be able to identify when there is weird behavior taking place, whether it's session length or maybe it's kilobytes, megabytes, gigabytes transferred in a session.
What if I'm dumping an S3 bucket through a privileged session that I shouldn't be doing like things like that. Those are things that I would want to monitor for. I don't know if I put that in an executive summary dashboard. And this is, you know, the wrong format for that, but I do think it's a valuable
metric. Well, you sold me on what you just said there, but it just feel like you colored outside the lens a little bit versus like metrics, but yeah, no, I, I agree with everything you said. I found log in attempts, I think is a good one, but I also think it's. So I think so many of them progress over time. It doesn't even make a sense.
I mean, anybody who has a Microsoft personal account, go to your Microsoft personal account and look at your account, log in attempt history. And I bet you, you will find thousands, hundreds of thousands, millions of attempts that are just automatically blocked and, you know, they're just, it's just, you know, password spray attacks. People are just trying to get in, you know, brute force,
whatever it may be. And Microsoft just blocks by default. So yeah, this is definitely not Jeff trying to log in from X country, you know, 48 ,000 times within the last minute, right? Stuff like that. Yeah. Right. I agree. Yeah. I know you're right. I didn't even think of that point, but to me that, that one's not a good one. A number of inactive or orphan accounts. Now
this one I like. I like this one too. This is now I, I do think if you're doing identity governance and you're adding say 10 systems per quarter, you're going to increase the number of orphan accounts each quarter when you add those applications. So you have to understand that with growth of that platform, you're going to find more orphans and more inactives, but steady state.
If you can somehow adjust for that increasing orphaned accounts, increasing inactive accounts, like that's some, that just shows that's work that you need to do. And if you can reduce that number over time and you're keeping your environment clean. So I think actually that's a good metric. And then the last one is I am policy compliance. Absolutely something that should be tracked. I don't think it's easy to
track within an I am system. I think there are ways, you know, like that's one of my big things in life, which is that you're, you know, the policies that you create are the rules of the road and whether systems are leveraging your central I am systems or not, they still need to apply comply with the policies. You have to have some way to test the adherence to those policies or track the adherence at least. But
that's very hard to do with an I am system. Yeah, that's more like a, I don't know, that's something I would definitely see a kind of a manual dashboard somewhere, percentage of applications using single sign on percentage of applications using MFA, maybe even, you know, critical apps using MFA, non -critical apps using a different type of MFA right over the media. But yeah, that was a little
more wishy washy. I don't know if I would. It's good to know, is it executive worthy? Probably not. Unless there's some sort of risk that you're not able to get by and for it to say, Hey, we're trying to get this thing on single sign on. And XYZ group is really not being a good partner with us to help that happen. Exactly.
If that's a major issue that you're trying to resolve is that, Hey, we're putting out these policies and various businesses are taking them seriously. They don't think they apply to them. And you can say, Hey, within this business unit, 50 % of the applications are not compliant with our SSO, our password policy or whatever, any of the policies, then you can start to bring light, shine light on the darkness. Okay. Okay. Not
bad. If you had to give us a score from zero to 100, Hunter being perfect. It just replicated the mind of Jim McDonald, which is a scary thought. And zero, meaning you're probably safe from any sort of replacement Jim. How do you would you score this one? I think I'm going to get this like a 50%. That's
what I was thinking. I would be real embarrassed to just highlight those, paste it into a deck and then show it to executives because they started picking on you with questions. You're, you're going to be exposed. Yeah. You have to know your content. I think I think it's good for us for a starter, but yeah, I was thinking this is about halfway there. Good start. It's
good to writing prompts. Okay. Now let me start thinking about why these matter or why do these answers make sense versus just here's information. Okay. Right on. Who cares? Like what are you trying to do with it? All right. Do you want to read the next one from Maria in Spain?
Yeah. What are the biggest challenges when it comes to implementing a successful IAM strategy in a large multinational company, give this an executive summary format with no more than five points. By the way, that less sentence is something that, that Jeff had, right? Yes. Yeah. All these, I, I had to give this an executive summary format, no five, no more than five points just to have it be something. None
of our mail bag questions came in with that. It's right. Yeah. Uh, although I would be impressed if somebody did that. Um, so I started a new chat also just so it wouldn't get confused with a prior question. So that's probably a good thing for if you're switching topics is to start fresh every time. Yeah. So biggest challenge is when it comes to implementing a successful IAM strategy in a large multinational company. So
it looks like it's got the five here. Key challenges, global regulatory complexity. That's number one. System integration and legacy infrastructure. Number two. Number three is managing decentralized identities. Number four, achieving cross departmental buy -in and number five, balancing user experience and security. What do you think, Jim? Really good. Um, I mean, sitting here looking at the first three,
I'm like really impressed. So I did get hung up a little bit on the third one, because when I saw managing decentralized identity, we're not talking about like, um, self
-sovereign identity or verifiable credentials. What we're talking about is when an organization says, you know, we're not going to have just one central approach to manage all the identities in one place for enterprise, all the active directories that exists from all the companies and all the octa universal directories and ping directories and LDAPs and
databases. Identities are spread everywhere. And it might even be managed by different teams and different, you know, systems and different rules and all kinds of stuff. Yeah. So just looking at the first one, global regulatory compliance. Is
this one of those no particular order? Because I think that is one of the toughest ones for, uh, I am practitioners like you and I is that, um, you know, the, these talk about things like GDPR, CCPA
areas that I'm not an expert in. We have to go as practitioners and pull in the experts and really get guidance in terms of, you know, do we have to maintain identities in countries or certain countries where you do and the privacy of a person's data, you just can't take some of those things for granted. It doesn't all work the way it works in your country and other places throughout
the world. So I know I learned a lot about that. Um, when I was, you know, earlier in my identity career and working with groups in Western Europe, like for example, Germany and France had very strict privacy laws in terms of you actually couldn't take some of that identity data from their HR system, for example, and move it into systems in the United States. And you actually couldn't even ask for some of the
information, right? It was like, they had like, I forget what the workers' councils, I think, is what they called them in Germany. It's kind of like a union where like you could only ask certain types of questions, only collect certain types of data. So I think this is actually like a very important topic. What do you think? No, I think it's, it's a
reality, right? And the world we live in is data sovereignty, sovereignty, or whatever the word is, where, you know, where does it stay? And this might be a reason why you do have to have multiple active directories, multiple tenants, right? Just to keep data within specific regions. I mean, you try not to, I think you look for reasons. Do
you have to do that? First of all, and then if you have to, what are the rules you have to play by? And, you know, just go from there. But I think it's a good thing for a high level discussion and to say, hey, okay, yeah, we need to think about what are our regulations? Um, you know, number two is good too. All the different integrations,
legacy infrastructure. Your answer to the first one about what regulations may actually answer, what can you integrate and what needs to stay and, you know, what can you modernize or do you need to keep around, right? Things
like that. Yeah. And I don't know if I can specifically tie this one to identity, except my experience in working in a large multi -national company was that there were a lot of legacy systems, mainframes and old systems that were hard to integrate to. Um, and I just, I think part of being part of a large multi -national corporation is like, that's a fact of life. And when you have to integrate, I am into those systems,
sometimes it's a very difficult thing to do. Um, you know, regardless of, if you're talking about provisioning identities, provisioning passwords, you know, if you want to use MFA on some of the systems, it's just, it's not even a possibility. And so, or, or to do it, you have to like jump through so many hoops that it becomes a near impossibility. So yeah, that one hits home
for me as well. So then like I said, the next one was managing decentralized identities and the idea of that it's not all central command and
control, usually large multi -nationals. Um, and I've seen some of that break down over time, you know, in my, my consulting career is going into large multi -nationals where they have made the move to one active directory for us. And that is a great indication that they're saying, look, even though we have to have some level of division of autonomy, you know, put some autonomy in various
places, some of the enterprise services just doesn't make sense to completely delegate control, administrative control at that level. So it's finding the right level. Each organization tries to figure that out for themselves. It used to, a lot of it used to be driven by, you know,
the speed of networks from continent to continent. Uh, I don't think that's as much the case anymore, but I do think language time zone and just the fact of, well, you just like, right? Things like that. And the way that different countries in the world approach different things. I think it ties in with number four a little bit,
which was achieving cross -departmental buy -in. If you don't have cross -departmental buy -in, or even this case may cross -country buy -in, how are you even going to try and figure out how to manage all those decentralized accounts, identities, teams, right? Et cetera. I think there is, you know, that's, I think that's, I think that's actually pretty good insight for an AI to
answer with that here. Achieving cross -departmental buy -in is not a technical thing. It is more of a psychological thing, right? How are we going to convince Jim sitting in Germany to adopt the way of Jeff sitting in, I don't know, Italy? Right? Is, are there things that are lining up like teeth where it's like, okay, yeah, it makes sense, like from a gear perspective, there might be missing, you
know, links as well. How do we make that work? I think it's actually pretty insightful for an AI to include that as part of the answer. So I'm somewhat impressed by that. Yeah, I think that's an excellent point. I think at the most basic level, you've got information security policy. It has to respect local regulations and local laws
and cultures and customs. But I think that's the underlying is like, if you can get a common policy that applies across the organization, and then I think it starts going layer by layer into the technology, and that's where you can start to run into more of the pushback. I found it's very hard to drive major technology gains
across the globe without support from the top. If you're doing, trying to do things always at a grassroots level, and trying to make major changes across the board, you're going to face a lot of resistance. You need support from the top. And usually it's got to like, say, for example, the CIO gets behind. And it's security initiative like having one active
director. If you have an organization, there are 50 active directories and business units and geographies have their own, you know, trying to be the active director team and corporate and say, Hey, why don't we make this one big active directory, show me five thumbs. The CEO has to get behind it. And the CEO has to know he has the back of the CEO. In my experience, that's kind of what is required for driving it. I
think there's one exception. I think there might be a scenario where it might be a global organization, but the vast amount of revenue is driven by one business area that can really, you know, impose its will on the rest of the company, because people are very upset to rock the moneymaker. So it could be a situation where, you know, you really need to be thinking about what are the financial impacts, where is the money
being made? Chances are that's one thing you want to think about is you need the moneymakers on board with whatever strategy is that you're trying to adopt. Yeah, excellent point. The last one is probably just as good as the rest. Like I. It's not what you're doing though. User experience and security. I'm like, OK. You did ask for an executive summary. So the being fair, I think that's a very good one. And
this is the lifelong battle. And we would love to say, OK, if I do two security keys or five to two. Help me out here. But I don't know what you're going. I don't know where you're going with it. Like pass keys. Pass keys. OK, thank you. Had a little brainstorm there.
It's Friday night. One of the few security tools out there where you get an improvement in both because everybody hates dealing with usernames passwords and, you know, getting to possession based authentication, like having control of your device and then having a device ecosystem where you just get away from passwords. All that's great. But usually when you're deploying. And. Cyber security system of
some sort. It. Has the negative if it is improving security, it's having a negative impact on user experience like we talk about DLP all day. To get should be improving security. It's making it harder to exotrate information from the organization. But whoever sat there in their desk is like, that DLP is blocking me from copying my files to the jump drive. I love this thing. No one, no one's ever said that. Yeah.
All right. Well, that was a very long way to just say, yes, consider user experience and security. Yeah. Well, that's part of the show. We're almost 45 minutes. Do I do one more? Should we get one more? We can only do one more. All right. Carlos from Brazil. Go ahead and read it while I set this up. What are some trends in I am that you think will become more important in the near
future? I'm trying to stay ahead of the curve in my industry. Executive summary format with no more than five points. All right. Survey says zero trust. OK, I guess I don't that's future, but more like current. AI and behavior analytics, of course, is going to say AI is important. Cloud centric. I am. OK, I feel like that's kind of where we're at right now. Prioritizing user centricity and number
five, identity governance becomes essential. So my first question to you, Jim, of these five, zero trust, AI and behavior analytics, cloud centric, I am a prioritized user centricity and identity governance being essential. Do you think these are near future from a trend perspective? Because that's the question. I can't take my eye off. I can't take my eye off the last one. Identity governance is becomes
essential in the near future. Ten years ago, maybe. Exactly. Like running water in your house is going to become folks. That's the trend now. Well, let's play. Let's play devil's advocate, right? Could you have gotten away with manual processes ten years ago if you're, you know, let's say you're not a super complex organization that has multinational implications? Yeah, you probably could have
gotten away with it. Is there a better way? Sure. But are we at the point where IGA essentially is mandatory to even be considered doing OK at identity? Here's the thing, Jeff. You can't take time off of investing in technology and information security. If you're ten years ago and you're like, hey, we're doing manual processes. We have 5 ,000 users. We just got, you know, these folks who they just take care of it. Where
do you think you are now? You're probably way behind the curve. You're probably like, you know, getting breached and stuff like that. You can't take a vacation from investing. I'm not saying I agree. I'm just trying to play AI advocate here. I'm trying to think really hard because budgets are tough.
And if you have magic IAM people, IAM heroes, as we like to say, running around behind the scenes, just making it work and the organization doesn't feel the pain of not having, you know, modern tools, let's say. Could you have gotten away with it? I would argue, yes, it happens. It still happens today, right? But should you get away, Jeff, you can get away without buying life insurance. But if you die, then your
family will have no money. Well, that's their problem, not mine. If you own your car outright, you can maybe not have comp and collision. And then you hit a stop sign. Stop sign jumps out in the middle of the road and you hit it. And now you've got a busted of car. And that's what's happening. Like companies are getting breached. If they knew what they need to do, they would have
obviously done it to prevent the breach. But under investing for years, like you're just passing, you're just kicking the can and then the next leader is going to, I don't know, I can't get out of that mode on that question. So look, I'm just trying to be the other side of the coin. I think, I agree with this. And that's only because really, IGA within the last 10 years has been solved for the most part. It's
a mature space. Gartner doesn't do magic quadrants on it for the last, what, four years, five years since 2019, I think. To me, that tells me it's done. And so within the last five years, there really isn't an excuse to say, oh, we can't do IGA. There are plenty of price points, you know, options for this space. It's somewhat commoditized. There's
always new ones coming up, right? We've had some of them on our show that are really good as well. But I feel like this is an area where if you're really going to do identity and access management as a program, you need to be doing some form of IGA identity governance. You know who has access to what and you know why they have the access and whether it's appropriate. That's
it. Yeah. I think you, okay. So going through the list again, zero trust takes center stage. I think you can still make the argument that it's still on the way up. AI and behavior analytics. To me, that's like, that's a pure winner right there. I mean, listen to the show, right? We're using it. It's the best one. Cloud -centric IAM, I think you can make the argument that that's still growing. Team,
team, CIM. Yeah, I mean, well, just even the idea of like, even organizations that I've worked with that are doing a very excellent job in the cloud can still do better. Prioritizing users, centricity. How can you argue with that one? It's kind of like, you remind yourself, be a good person, be a good person, right? Even if you are a good person, generally, you just have to keep reminding yourself, be
a good person. But when it comes to identity governance, becomes essential. I'm not buying on that. I want that old hat. That should have been, but for you individually, if you're not doing it or you're underinvested in that area and you just know you're not doing a good job with it, do a good job. Okay. Well, I disagree. I think it is mandatory or let's just say, I think
it's essential now. I think there were, I think there were arguments to be made that it wasn't necessarily as essential 10 years ago with some very big asterisks next to it. It's not like, finance regulatory reasons, right? Things like that. But I think as identity becomes much more the new perimeter, it's at the center, right? It's the name of a podcast. You have to have governance around that. You
have to have things like single sign on. You have to have MFA. You have to know that kind of thing. So I'm going to, I'm, this is a hill I'm around. You can't say you disagree. You said, identity governance is essential now. But that's not what it says. It says identity governance becomes essential. Meaning it's not essential now. It will become essential.
That's not true. Well, I think it's based on the maturity organization, the sizing industry. So let's read the rest of it. So identity governance becomes essential as organizations sprawl keeping track of who has access to what becomes difficult. I would agree with that. Identity governance tools will gain priority allowing you to visualize and manage access rights and enforce lease
privilege. Right? I don't, you know, that's a little bit too floaty for me at the end there. But the idea of you do need to know who has access to what the larger your organization and as the organization sprawl. Yeah, I would agree with that. You'd need automation too. Otherwise it becomes. I kind of want that. You do as much as you can with the people you have.
I did want to bring up AI and behavior analytics because it's on the interday jobs we work for RSM and one of our peers put on a presentation about AI governance. Was that Dave Mahoney, the man? Dave Mahoney? Were you on that? No, I wasn't able to catch that. I got to watch for replay on it because I was in middle of another meeting. But yeah, Dave's the man. So Dave, you're listening. I'm looking forward to see what
you put out there. But Jim, go for it. No, it was really good. So, um, he's talking about like, you know, companies really need to have, you know, starting point is you have to have a policy around AI. And I asked the question like, what are, there's so many use cases for AI, right? There's AI in products that you buy. So let's say you buy an IM system and it's got AI or N number of tech systems.
It's got AI, right? Maybe it really has AI or maybe they're calling it AI either way. You know, you start plugging information into it. You should know, I think, what's happening with it. Other use case for AI is people doing like what we're doing. You're typing a bunch of information into an AI prompt. What's happening with that information? Does your company trust or want your employees doing that
or not? Do you want to put some rules around it? Etc. There's, um, you could be deploying IT systems that you build your own AI into. Let's say I'm building a website for our clients to go to and they can start using a chat bot to solve their issues. And I wrote some kind of AI formula or maybe I use some open source AI and you have policy around
like, you know, who's I have to go through? The last use case is let's say we build, build products and we build AI into it. So I make smart home sensors and I want to build AI into that. You know, you should have policy around that. So I just think it's such a fascinating area and we're really like, it's just like the cloud actually where I kind of feel like the cloud was out there and devs went out and said,
wow, this is great. We can build these apps and then they started building things that went from pre production to okay, now we're going to use it for production. And then information security comes along and you're like, oh, we got to put some guardrails on this thing. I feel like that's what's going to happen with AI. It's like, you know, people are
using AI every day. People are building AI into their products, deploying software into their enterprise that uses AI. It's about to get an interesting. Yeah, I mean, already is, I think, and I think that's, it's a wave that's coming. I don't think you can stop it. What I think you can do is
educate about it. Make sure that your, your workforce or your users or employees or contractors or whatever, understand the ramifications of how they can use it. Yeah, but all the guardrails in the world, you want, okay, we can access our computer. Guess what? I'll
put it up on my phone and do it there. There are always ways around it. So I think the education is super important right now to make people aware of, yeah, if you type in people's names into Google and Gemini Advanced, guess what? They're in a learning model now somewhere. That's why I don't have the names
listed here, right? I just still it down to just a question and, you know, should be relatively benign, but you need to be aware of what's being put into those models. And I think it's important for education. Okay, it's Friday night. I'm ready to be done. Should we end on a lighter note? I would love to. Okay. Would you rather have the ability to teleport or the
ability to read minds? I would love to be able to read minds, but I'm a little afraid of what would happen. Like if I started realizing people. Yeah, what am I thinking right now, Jim? Yeah, exactly. Well, I'm sure it's not great. And so I think I would like it, but I'd like to be able to turn it off and on. Teleporting would be pretty awesome, man. I
wonder if you don't get any miles. How are you going to get platinum status or diamond status with Delta or whoever? If you're just teleporting, what's the fun in that? Just think about it. You would not need miles. Can you imagine a commute? It'd be a truly global, you know, thing if we could figure out teleportation where, you know, my job is in Amsterdam, but I commute from Asheville, North
Carolina every morning. So here's a better question. I don't think mind reading is likely to. I shouldn't say that. Put that aside. Do you think that someday humans will figure out how to do teleportation? I don't know because I'm not smart enough to know if it's within our understanding of science and physics and all the things
that could happen. But what I am, and I feel like I read something within the last year or so that talked about teleporting like a single atom. I don't know exactly what it meant. I'm too dumb to even figure out what the article is about. So I feel like if it's within the realm of possibility, eventually we would figure out something like that.
But if it truly is like an unbreakable rule of the universe, whatever that means, then obviously I don't think it would ever happen. But I'm not going to rule it out. I mean, I'm, you know, we're carrying around cell phones. You know, we're recording this podcast through the internet and we can see and talk to each other. I mean, that would have been magic, you know, 10 years ago, even 15 years ago. Yeah.
I mean, if you if you think about it, the the laws of the universe, one of the laws of the universe, nothing can travel faster than light, which means we'll never be able to get to other galaxies. Then unless you figure out some sort of wormhole folding space, right, sci -fi stuff
like that. Hundreds of thousands of years with the technology that we have right now, I think to answer the question myself is that if you were to take this cap and you were to teleport it, what you'd actually teleport is a copy of it. So to our eyes, it'd be maybe indistinguishable. But I think the thing with with a person or an animal
is that it would also be a copy. And the thing with personal animals that you have electrical and chemical signals going from your brain. So I kind of feel like you can make a copy of the mass, but probably not of the energy and that you probably be transported and then like, what would happen? Probably.
Interesting. Drop dead. Or yeah, what if it's more of a instead of a of a teleporter, a replicator, right now I'm now taking Star Trek, you know, T Earl Gray Earl Gray hot. Right. No, I'll take that. I bet honestly, that would be that'd be enough for me. So I'm gonna change my answer and I'll just take the replicator. Well, that wasn't the question. It was teleportation or the ability to read minds. My
gut reaction is of course read minds. I'd always want to know, okay, what's going on so I can kind of figure things out and make sure that, you know, I'm on the, but that I'm on the good side of whatever it needs to be. But then you did mention the thing about being able to turn it off. And I was like, oh yeah, that, you know, that could be pretty crowded in someone's
head for a while. Yeah. Yeah. So if I can turn it off ability to read minds, if I can't turn it off, then yeah, I'm going to sacrifice my Delta diamond status and go with teleportation. Have you ever, have you ever heard or have you ever seen the show True Blood? Yeah, of course. Okay, I only saw it because didn't use someone to watch it. It's not my kind of show. I liked it. I thought it was great. She
could read minds, right. And it like would drive her crazy sometimes. Yeah. I mean, that's, that's typically the drawback you see in any sci -fi thing is if you can read minds, how do you filter out like Professor X from the X men, right? Same thing. And, you know, other characters of the like that can do that kind of stuff. Okay. We got really fantastical. You're on a Friday. I
don't know what you're talking about anyway. Yeah. All right. Let's keep this under an hour. We'll wrap it up there. We're on the web IDCpodcast .com on Twitter X whatever it's called at IDC podcast. Mastodon at IDC podcast at info sector exchange reached out
on LinkedIn and connect with Jim and myself. If you're interested in attending the happy hour, whatever it is we're trying to do at IDeniverse reached out to Jim or I on LinkedIn and follow us on YouTube. We're starting to build up that channel. So like subscribe, get notified. All of our audio episodes are already there, but we're going to try to put some
more video stuff up there too. So you want to, you know, subscribe and hit that bell to be notified when new ones come in. So, all right, ring the bell, ring the bell. All right. That's it. Thanks everyone for listening and we'll talk with y 'all in the next one. .