So how do we do ensure that this all is kept under control? I think this entire field, I tend to call it a identity. So the intersection of AI and identity is still a pretty much a wide space on our technology map. We see a lot of start-ups around AI security nowadays, but I think we need start-ups around a identity. It seems to me that technology, the functionality is going to blaze way past security. So it happened with cloud infrastructure, I think, and I think it'll happen again.
I think the fall back will be some sort of leveraging legacy permissions, which we already know are not good enough. I think that's maybe what you're referencing. You have these super users administrate system administrators. Does that mean the System Administrator can start using AI to find out all kinds of information about the company or information they they shouldn't
have access to? Even think about someone having access to the AI. Which all, by the way, brings us back to the initial theme, identity, verified identities. So is it really Martin using the AI? And what is the AI supposed to do in the context of Martin? And if it's not Martin or if someone is is using the AI in different contexts, there might be way more information that is to discuss or even if the AI is is sort of constrained in what it can do in the context of the individual.
I think this is a very interesting field to think about for 2025. This is identity at the center if it has anything to do with IAM. This is the go to podcast now your hosts Jim McDonald and Jeff Steadman. Welcome to the Identity of the Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Oh, not so bad yourself. Doing great. This episode is going to drop on January 20th, which is also the same day as the college football national championship game.
So in honor of that, I wore my Georgia Bulldogs T-shirt. But. Unfortunately, the Georgia Bulldogs will not be playing in that game. But I, I can always dream. There's always next year. You're you're a Chicago fan. You've got to be used to saying that by now. Well, I am a Chicago fan. I don't really follow college football, so I could care less
what's going on there. But I am a Chicago Bears fan and, well, you know, there's always next year has been our our phrase throughout the last 40 years. So. So, yeah, I can advise that. You know, when you stood up there for a second, I thought you were like going to like flash us or you had like, you know, your chest pain or something like, like a super fan. I'm a little disappointed that we didn't get to see that side. Are you trying to drive people to YouTube or what? Yeah, exactly.
Yeah. Hey, anything we can do to go viral, Jim, come on, do it. Do it for the views. Yeah, right. Yeah, we'll we'll talk about identity, we'll talk about AII. Think that'll have to drive our views for now. Yeah, let's focus on the conversation, but I think before we get to that, let's talk about EIC 2025 because you and I are going to be there for the first time in Berlin, Germany. It's May 6th, the 9th. And like I mentioned, Jim and I will be there.
We've got a discount code for everyone who is willing to show their support and partake in that. The code is ID, AC25 MKO and I get you 25% off. Don't worry about remembering that right now. I'll have it in our show notes and you'll be able to find it easily on our website. It's right on our home page. So I'm looking forward to that first time in Berlin.
We're going to ask our guests some questions about that probably towards the end of our conversation around what should I be doing Berlin, first time there, but I'm looking forward to it. What about? You, Jim. Oh, I can't wait. I've never been to Berlin either. I've also never been to Munich, which I think is where EIC was in past years. So maybe in the future if it's moved to Munich, we'll get to go there as well. But I'm excited. I've never been to Berlin.
I've been to Frankfurt. That's about it. So yeah, you know, I love experiencing new cultures and I love German food. There's a German food restaurant near me at home. And, you know, I'm kind of bored. I get the Schnitzel every time. But I do that at at every restaurant. Once I find what I like, I kind of stick to it. Yeah, I'm the same way with chicken and waffles. So maybe we'll see how that works. You're way ahead too. You've already like booked your flight. I have not.
And I'm still my wife and I was trying to figure out how we're going to do all this because she's probably going to join me out there. And then, you know, we're planning on trying to hit other areas. So we I have not even, we have not even figured out what we're going to do yet. And so I know I'm behind where you're at right now, Jim. Yeah, I'm going to be out there the week before flying into Oslo, meeting a bunch of identerati and Oslo the the local identerati.
I haven't figured out exactly what we're going to do after that, but I'm thinking we're going to, I'm leaning toward like an urban vacation, right? So this is like a vacation week, definitely meeting folks from Norway the first couple of days.
And then we weren't sure if we're going to drive through the countryside of Norway, which is absolutely spectacular from what I've seen in YouTube and things like that, or we're going to go to Stockholm and Copenhagen. That's kind of option 2. I guess there's a third wild card option, which I don't know what that is, but if we do Stockholm and Copenhagen, I'd like to try to find local identity in those locations.
So if you're listening and you live near those cities or in those cities, reach out to me on LinkedIn. I'd love to, you know, meet and have a beer. I'm sure you'll have stickers with you too, right? Oh, of course. Yeah, you gotta stock up my bag all. Right, well, why don't we get to our guests? He is the founder and principal analyst with Koopinger. Cole, welcome back to the show for the 5th time, Martin. Really #5 already?
#5 Yep, for joining me look, we always like having you on it seems like we have you on every maybe like 9 to 12 months kind of seems to be kind of the, the thing you've been very gracious along with EIC to invite Jim and I to come out there and we're looking forward to again our first time being there. We have actually a lot that we want to cover today. So I'm not going to ask you about your background on that stuff because you've been on the show five times.
Go back and listen to previous episodes of Martin if if that's what they interest you. But why don't we just jump right into it? Because if there's a lot of topics that people are interested in and seem to be gaining steam in this space, and the first one is identity verification, It seems like the last couple confidence I've been to Gartner Identity Week and last year's Identiverse seem to have much more prevalent prevalence of these types of
identity verification tools. And I think it's starting to pick up at least in the US, especially around things like fraud and being able to after identify who's on the other end, right? Kind of the know your customer type thing, but it seems to be expanding. I'm curious from your perspective as someone who really knows, you know, the IM space at large, where do you see the identity verification market? And how does this look for 2025? Do you think it is still
ascending? Is it sort of reached a peak or are we kind of in a stable platform now? Yeah. So before we come to that, maybe just a few comments on Germantowns. OK. So Berlin, Berlin is great. It's its largest town. It's it's a bit actually, but it has has has something Munich also nicely off the mountains close to it, etcetera. Frankfurt, we we may discuss about it, but I personally believe the place to be a
Stuttgart where I live. I'm just as a little adword for my hometown, really, really nice town, but clearly a lot of nice places. If you ever travel in Germany, let me know. I usually know some quite nice places to go in Germany and Europe. Anyway, identity verification, it is essential because at the end of the day of everything we do in security or most we do in security at least. And when you look at zero trust, for instance, it starts with identity.
It's Martin using a device to authenticate. But is it really Martin? And I think this is the big question behind identity verification. This is really Martin. Can we assure that it is him or someone or something else? So, so identity verification is important that we, we need different levels of assurance for depending on what we are doing. So it's not everything is based on a super, super strong
verification there. There clearly are different levels and we have this in, in the concepts or level of assurance etcetera. So it's, it's nothing fundamental in you. I personally believe that that we're will see a strong uptake. We definitely will see a strong uptake over here in Europe because when the EU digital identity wallets, UDI wallets come out in 2026 or a bit later, then a verified identity will be an essential element within this decentralized identity and wallet concept.
So we will need to do the verification. We also, I think we need to move forward and this is what, what, for instance, decentralized identity will allow to, to be able to reuse identity verification. We need to make it also or simplify it. Especially what I really don't like is, is everything where, where you have a human involved in the verification. So because these things tend to be cumbersome even for me and I would say I'm, I'm a somewhat experienced IT user.
And if, if I feel this is this is really cumbersome and complex, then it's probably not an ideal solution yet. So yes, we, we need to do it. The question I, I would raise is how will will this look like in the future? So, So what do do we do? How we do we reuse it?
Maybe at some point when you look at all the shared signal stuff, maybe even have enough or sufficient signals that we can be assured that it is Martin because it's a device, it's the location, it's the things that are done, etcetera. Maybe we can at some point use signals and maybe even that need to authenticate in a traditional manner anymore. So I think there are a lot of things we can can think about, we can discuss where we are just still at the beginning.
So I think identity verification is a market that will grow because we need it. We need a short identity, but we need to also to to make it very smooth, very simple and reusable. Because, as I've said, the most annoying thing is if you have to go through cumbersome processes again and again and again. Yeah, right. It's an interesting how you started off with the focus on
levels of assurance. My first use case that I ran into regarding identity verification was with the university in the US and actually I don't think that it was University of Texas, right? So all people who are on campus had to show up and present their driver's license or some other government issued ID in order to get a school ID and then in order to get a set of credentials or I'm sorry, to elevate their credentials so they can access certain applications. This was around the 2013
fourteen time frame. So this was quite a while ago, 10 years ago. The all that was not a big deal because it was all very pre COVID and it was a very on premise group of people. However, they did have satellite locations. I believe one was in Israel and the folks there in Israel, they, they still had to go through this identity verification process, but they couldn't fly all the way to Austin, TX to do it. So required like faxing and you know, scanning their IDs and
things like that. So it became such a, a cumbersome process for those folks. Now Fast forward to today, you talked about the process where we do identity verification for, you know, in the United States, we have to do it for submitting our taxes online or to, you know, to access the IRS website. It, it can be very cumbersome. I mean, the process itself is pretty smooth, but if it can't recognize your ID or doesn't recognize a match, then it needs
to go to a human. You might have to wait 45 minutes to get in with a human. It's very cumbersome. So kind of in my book anyway, it's like the the level of assurance we'd like to have identity verification for anything that's more than maybe social media. Yeah. But it's too cumbersome. Yeah, and interesting. You know, when you take your IRS use case, it is something you must do. When you apply for a job, it's something you want to do or for the university, for the higher education.
But if you go to e-commerce, you trust may say, OK, then I go somewhere else. If you go to, if you deal with Tychos, with banks, all these use cases. So if bank account opening is too complex with the one bank, you go to the next one. Maybe these are things where where it's really about the business. In some scenarios it is just that you're obliged to do it. So they they, they, so to speak, a government can afford to keep it complex because people must do it, others can't.
And so we need to make it to simplify it. I think this is this is a very important point, but you bring up also an interesting aspect when I go back to my keynote, I think it was last year's Eici talk about decentralized identity. And one of my samples was a flow that goes from the sort of the initial verification to access to IT systems when you're working for instance, as a
consultant at a, at a customer. So, so you have the verification, your wallet and then you can onboard to an employer because you have a verified identity. In that case, you can do the onboarding to the employer. That employer adds additional verifiable credentials like you're at coping and Co analysts, you're the principal analyst or a principal analyst with that information. Then you may say, OK, I'm in a project at company X and the company X then says, OK, you're employed there.
You're you're really Martin Copinger. They have the data, which saves them, by the way, a ton of money when you you also have been working at consulting at other companies. And sometimes you you spend really hours for just getting a badge. You can automate everything. You can simplify this process and you don't pay advice for a consultant half a day for nothing. That doesn't make sense, but you can we can avoid it. And then then you could say, OK.
And right now, Martin isn't this project and this role. And in an ideal world, the access to whatever the tools, the websites, the information would be granted automatically based on all the attributes, 0 friction by just one identity verification, real massive process, cost savings, higher security, all doable. So we need it and we need to get much better on that. And we we need, I think again,
back to the level of assurance. What, what, what I feel is also around the UDI wallet frequently is, is the challenges that a lot of people, especially in Germany being a bit more paranoid on that side. Maybe on average we're thinking about always the highest level of assurance. We don't need the highest level of assurance for everything.
We need to only for very few use cases, even in government interactions for many of the things we don't need the highest level of assurance we can do today a lot of things where we don't need the the highest level of assurance. And that that is where we should think about what is it really? How can we do this created. But clearly if we have a reusable verifiable identity in place, it's super powerful. What I fear is that we end up with 100 wallets from 100 banks.
Doesn't make sense. It just doesn't make sense. Don't go for individual wallets, go for reusable identities. Yeah, that's where I, I share that same fear because at any given point people are going to trust or not trust any of these wallets. And so what's the point of having multiple wallets, the whole point of one wall and to keep everything if I have to carry around 7:00 or 8:00 or 10 different wallets that totally defeat the purpose.
Now we just created another version of the password. And that's what I'm, that's what I'm most afraid of in this decentralized sort of idea is trust at any given point, and I'll just speak on the US side, half the population doesn't trust the government, doesn't matter who's who's in charge. The other half doesn't like that. So, you know, if government isn't an option, then what is? Is it education? Well, not everybody is an education. Is it healthcare?
Not everyone, at least in the US, has healthcare. Is that finance? Not everyone, you know, may have the same financial, you know, access things like that. So I am concerned about that, about that just like you mentioned, Martin. I honestly I I've heard don't believe that we only will have one wallet. It will be probably more than one wallet. And we also probably should should think about is not really as a wallet because there will be so much in that.
It's way too big for a wallet. It's it's, it's, it's really more than that. It's a drawer or or even a a set of this. But I believe that we will have more than one, partly for the trust reasons. You may use the government one only for the things where you deal with the government, but you don't want to have many. So the number will be, I will personally believe a relatively low number. It's not a lot about us. I could envision that that we will see also very much purpose
built. Well wallets like a travel wallet that not only sort of holds the information but helps you managing all the travel etcetera, which could be interesting business case things like that. I think this is this is probably more likely to happen when we look at this this world of of of wallets. The the other thing is trust. I think what we also should think about is. How can we build trust?
We can't build a trust by having one sort sort of one strong proof, OK, we trust the government or not. And we could also say if we have a lot of college signals again that hint in the same direction, you also can build trust because I think that's not exact mathematics because there are there are overlaps there. So, but at the end of the day, if, if one signal has a 90% probability, it also means it has a 10% probability of failing.
If you have a 2nd signal that also has a 10% probability of failing and these are these are not overlapping, then the probability of failing would be not 10% but 0011 percent. So if you have many signals and combine them and they hit in the right direction, this is clearly a lot of algorithm stuff etcetera and thinking about how do you do it properly but and what is when when some signal hints in the opposite direction. But basically, you can't build a lot of trust on weaker signals
if you have enough of them. I think, what can I think the only thing that can build trust in the current world is openness, Open standards, that you can't go and hide things behind the scene, that there is some kind of agreed upon standard. Maybe there's some independent third party or multiple third parties that verify that this wallet meets the standard. So I wanted to. Again, again, again, the standard is one thing, but then you have a verified identity in the wallet.
The wallet complies to the standard, but do you trust the verification? That's again the point. Who was the verifier? If you're that, that's maybe something, you know, if we if we go through the verification more than once, so we have a reusable identity, but we have three independent verifications in the same wallet, then then you know, someone can pick and say, OK, I don't trust that party. But oh, if this and this also verified it, then it probably is
correct. So that might be the way we we should think about it. That's right. You know if. You're if. You're talking about like age verification or something like that. Whether or not you trust the government, you probably trust the driver's license that says the person's 21 that can buy this bottle of liquor or something like that. So you might not inherently say I trust the government with all my private information.
Yet we, most of us go and get government issued IDs because you can't do anything in the world without it. You touched on the enterprise use case for identity verification. I, I feel that's something that has always resonated with me where I could bring in a new employee. No lives, nowhere close to an office. You know, I know I've joined companies and not gone to offices for the first year or more without going to one of the physical locations.
I've always thought like if you could do the identity verification process for those people especially, but also like to fill in. You know, we have a form in the US called I think it's the I-9 where it's like basically you get into the tax system that hey, you now work here and all that. The data is the same. If you could bring that and just plug it in.
I think that the idea is great, but I don't see many companies saying, all right, that's a big enough of a problem for me to go out and buy a product to solve that issue. Even if I have a lot of employees, say 100,000 employees, I probably don't have a big enough of A use case in one central HR system where you know, that wouldn't be an
integration nightmare. Now, however, if it was a feature of a product that I already own, I might flip the switch and start using that feature, at least for some subset of the use case. So long way of getting to my question, which is identity verification. Is it a standalone product or should it be, or a feature of something else like your identity management system? Service short answer. So you had this long questions or I decided for the? Yeah, yeah, the answer is
fantastic. I almost missed it. You must be a service that can be consumed and integrated. Yeah. So a service that can be consumed and integrated into your onboarding, however that takes place. Correctly. OK. So I don't think that it makes sense to to build take the technology again and again and again. So my colleague Annie currently is working on the leadership composite identity verification and I think her her preliminary list was in this 300 plus vendor
range. 300 plus vendors. OK, wow. OK, so and and all doing it a bit different. So, so selecting the ones and and saying, OK, this is the ones we look at all AT and and this leadership compass is not not an easy thing. Yeah. OK. So this gets speed.
Thank you. So I think what you're basically talking about is like orchestrating some kind of onboarding workflow to tap into a third party service that would then, you know, verify the credential, redirect back, let the company know the person's BeenVerified, etcetera. Unless you do it with decentralized identities, which would be definitely for the future the smartest way to do it. OK, so Speaking of the.
Future that that would be I I believe the smartest, smartest way to do it and you know it. It's like like you have have whatever a batch, a corporate batch etcetera for entering the building etcetera. You also can either add something to a wallet makes more sense or or issue your corporate wallet if you already want to go down that path. But but it's still then you, you do you have ways to do to do that in a in a smart manner and re reuse things.
And then the service would be basically serving sort of the, the ones who are issuing the credentials into the wallets or to the holder correctly. I think it's also something we we need to be very, very precise on the, the the basic decentralized anti model is not a wallet model. It's a issuer to hold or to verifier, but the wallet is trust the technical means to hold verifiable credentials. So we anyway put way too much emphasis on on the wallet and
not on the holder. And that's also why I believe we, we should think always about people having more than one wallet, having the same credential, multiple wallets that are giving them the choice, because this is really the holder focused on the thinking, which makes more sense than the wallet thinking of today. Interesting. So I've been wanting to figuring out how to bring up this topic. So I've been watching a lot of videos lately around AI agents.
The idea is that the AI agents are, you know, like people. They can do things, but they're also like applications. I saw a video with Satya Nadellam, the CEO of Microsoft, talking about AI agents. He says AI agents are going to replace SAS. That's a that's a big statement. By coming from him, I put some trust in that, right? I mean, he's a visionary. It gets me to also think, you know, I'm going to shortcut to, OK, go to a lot of identity conferences. Every product is now AI enabled.
I noticed on your website, All right, I'm sorry, on one of your announcers, Cooper Cole's now AI enabled as well. So in November, you announced Martin the Chat bot. I was wondering if you could tell us about Martin the Chat bot. Yeah, so, so first I have to say it. It wasn't me who announced it and it wasn't me who came up with the name. So. So when I heard about that, they they intend to call it Martin. I said, Oh no, come on.
But yeah, I gave up on this conversation basically, to be honest, our cooking a call website, we we hadn't a good search functionality for many, many years. It was really, really not good. So I myself tended to use Google or Bing to look for content on our website. Right now I only use our search function because it's it's really great. So we had have a new search functionality. We have to chat bot which provides as a relies on ALM model and it uses this retrieval
augmented generation thing. So it it uses the the content we have on the website which is in a lot of places like like YouTube etcetera, which is really a ton of content in different formats to provide the answer.
So this is basically what what we did and I think it simplifies really the access to our information, which is also very important because you're pushing out this membership and then or pushing the membership model more these days, enabling people to get access to all of our research in a very flexible manner. So, so I think if you, if you clearly, if you have this membership, then you also should enable people to find what they need to get the answers they
need. And talking to this virtual Martin Chile is one element in that. While the membership also offers a lot of other benefits, like the ability to talk to the real market and even things like that, which may even be more interesting. But I think it, it makes very clear where I see AI it it's in that sense of augmenting intelligence, it helps people to
do things better. Like the like it doesn't in most areas where we use AI and and assistance system and a vehicle, which is usually in some way AI powered, basically augments the driver, helps doing the job of a driver in this case, safety, for instance, better. So yes, that's there. To your point around will AI replace SAS? I think it's, it's, it's a bit of an oversimplification.
Sorry, Sacha, because there are elements which you clearly can do better and different when it comes to looking up data, when it comes to to accessing information etcetera, searching for information, combining information out of different sources, there's a clear advantage. But there are a lot of things which are really form based processes like invoicing, stuff like that, which are commonly run a SAS, which probably will not be easily replaced.
But you don't have that kind of innovation that, you know, a lot of things we do with IT, service management, for instance, basically, at least we'll run through a very different interface and I'll see, see some interesting start-ups these days, for instance, in the identity management space, which come up with, in fact, AI layers that allow you to, to get all what you need, like the report, the data, the stuff out of your world with a simple natural language query.
So these are things. And we, we are also covering some of these vendors in our new format, the rising star format, where we look at, at vendors that are very innovative, young, relatively small, but, but growing and, and have a very strong product market fit. And this is where we already covered one or two of these because I think this is another area where, where I see a huge potential for that.
So I I think it will not replace everything, but it will clearly have a huge impact, especially when it comes to getting data out of all these sources we have. Yeah, I kind of feel like if Martin and I came up, here's one thing you have to do. If you're an identity, you have to come up with the right acronym. So I came up with an acronym for you. I'm not saying it's the final one, I just thought of it. MARTN stands for Machine and AI Research Trained Neuro Network
and was a tough one, right? Neuro Network was the IT buzz term for a while and never became anything right so. Maybe you, you, you. You just say nerd. There you go, trained nerd because like a person.
But here's here's my thought. So you take you're, you're taking Cooper Cole's complete body of research or whatever you have in terms of research, and then you let the AI loose on it in terms of learning it. Now, one thing, I don't know if you heard the study that that happened recently where they said they, they took sick patients and they had a doctor analyze them to come up with, you know, here's what illness you have and here's the treatment plan.
They had an AI do it and they had a doctor with an AI. And that was the order that they or I'm sorry, the order that finishes the most accurate was AI was the most accurate. The doctor by himself or herself was the second most accurate. The third most accurate was the doctor with the AI. So potentially the doctor over ruling the AI and inserting the wrong answer and it got. Or or or or or not really trusting the AI and things like that.
I think for AI we need a very proper quality assurance. So we need to to look at the results. I've heard the belief that humans add a value to AII think there are things where AI is excellent, There are things where AI is horrible. So for instance, when when I use the the bottom on the KG website, then then the links are
correct. When, when I ask ChatGPT to generate a list of links to some research of co.com, then there's a bit of a tendency of ChatGPT to hallucinate and coming up with links where I would say, hey, these are great research topics. We should do that. But all of them lead to an four O 4 message not found. So I think I think I, I, I would be careful with with studies which say that the AI is always the best. I think a well trained AI in, in medicine definitely provides a,
a huge value. And, and so I think there, there are really use cases where, where, where it's super, super powerful to, to just bring up an anecdote and that everyone may like that anecdote or the theme of the anecdote. But I, I am, I'm in an age where you have to do a colonoscopy. I think it's the term every couple of years. Some of you may have undergone that already. And, and I did this, this time being awake.
So there was this huge monitor, there was the doctor that was me and I could visit it and I could then see situations where the AI hinted on something. So there was nothing severe or anything by that, but the AI hinted on something which the doctor didn't spot. And so AI done right in medicine
is, is super powerful thing. And I found it by the way, I found it super, super interesting to do to do this awake because it, it's really, really interesting, I believe, but not everything likes the the, the sort of doing colonoscopy being awake anyway, I think that there there's a huge value, but we also know, I think everyone of us using AI knows that sometimes results are better, sometimes they are
worse. So, but I, I, I think if, if we, we, we should learn to, to make the right use of it. I think this is the, this is the point if, if a good doctor will understand where it delivers value and where he or she still is needed with, with the other knowledge. And the other thing is creating something new. Thinking beyond this is or is not really the domain of something that relies on existing data. So it's refactoring, combining, lesser than inventing.
It can't help in inventing, it cannot help in creating things. But it I think they're still plated for for humans. Yeah, I I kind of feel like AI, if you give it enough information, it can learn the information and kind of have rate values and rate answers better than a human can, just like a calculator can perform better than any human when it comes to doing mathematical equations.
I also think so I, I thought about the Martin the chat bot and number one, it's available 24 hours a day, right? So your clients can get in there and they can answer questions 24 hours a day. But I was interested to see whether you would say that the chat bot could replace the analysts in those terms in terms of answering questions for your customers or if you thought because I I think when it comes.
To I think. It's research level, yes, I think that is what where it's really about deep interaction workshop really where it's about generating new ideas very, very rapidly. Like I do for instance, when we do, we do when we run advisory workshops etcetera. Then it's, then it's really that I think it's, it's a, it's for a lot of standard questions, wonderful and even complex
standard questions. But really there's a point where where the human interaction, the conversation, the, the, the thinking also adds to the So I, I don't see that I, I will be replaced. I, I think it's great not to that there's something which does a lot of work, but there's also an area where I believe it's relatively difficult to replace a smart analyst. Hopefully I'm smart and and so, so, so I think that's at the end. As of that, I think it's about using it the right way.
Yeah. So I wanted to switch topics a little bit because around the same time, November time frame, you guys released the Leadership Compass for Access Governance. You released Leadership Compasses throughout the year, but specifically Access Governance, which is more or less like what some folks call identity governance, but, you know, doing recertification of access that's already been provisioned. This is a market that has been
in existence for a long time. Is there anything exciting here? You know, I think the the perspective on what, what someone perceives as exciting, they are, they're very different. So clearly probably exciting is a big term here. So it's basically what we did. We released on leadership commerce, on IGA identity governance and administration. Then we released another one on IHED identity and access governance, which is basically a
subset of the broader IGA field. And we just did a separate one because we still see in the market demand by a lot of organizations for, for specialized IHE solution. Basically we we see even the demand for two types of IG.
So uses the general purpose IG so to speak that are more on the IGA side of things serving sort of every type of application to a certain level, providing role management, recertification also usually some level of access request and approval, stuff like that, auditing, analytics, blah, blah, blah. And then we have the the other specialized form which really focuses on the the ERP, the line of business applications.
So the stuff which is frequently called Application Access risk management or whatever the ARMARA A/C application access control application. Talking like SAPGRC. Something like SAP Access Control which is commonly referred to as SAPGRC, but isn't named SAPGRC.
But yes, totally correct. So, so this is, this is really funny in some, some way because this product, the name changed many years ago, but I, I would say it's still the, the vast majority calls it SAPGRC and that SAP access control.
And then by the way, SAP has another second product in this domain as well as the cloud IAG cloud identity access governance, which is the sort of the the, the, the the pure product to SAP access controller TRC covering it different systems at a bit in a bit of a different form. So for free coverage, you would probably need pose. So we have we have this need for specialised solutions still.
And that is the reason why we did the leadership combust that for instance, companies that have an A legacy or let's say long established to avoid this actually term legacy. A mature identity provisioning solution blaze for for many years a day may may see the need for quickly adding some more access governance capabilities, for instance for regulatory compliance for that type of organizations that there's a need for specialized IH solutions.
Yeah, I, I've seen a lot of the new vendors in the space focus on I AG or access governance, identity governance as a kind of stepping stone toward becoming a full-fledged IGA solution. I think that's what we're going at. But they tend to have some kind of specialized focus on governance. So it's the use of AI or the ability to drill down and say who has access to what data elements. It is something different than just, you know, roles, entitlements there.
The other end of the spectrum is large identity vendors or large vendors that have an identity product that are saying, oh, that's a gap in our solution. Now we need to do IGA and, and from what I've seen, mostly they provide governance over what's in their data store, what's in their directory. So I think of Okta, I think of Microsoft. I'm actually wondering what your your view is on how much progress Microsoft has made in this area.
You know, to the extent that you know, where are they heading and how far are they into that journey. Yeah. So I think we we must not underestimate Microsoft's never a good idea. I think history tells that Microsoft is sort of is enduring also in what they are doing. So they they have have a long term stretch in identity and security is a very important field of business nowadays for Microsoft.
When you look at the entry suite of products, the PureView products, etcetera, it's, it's really I think about 40 plus products they have in the identity and security space that also contribute quite significantly to Microsoft revenue. And Microsoft has a ton of developers working on these products. So they're working on that. I think we, we, we should be just clear that Microsoft As for as some of the other large vendors don't have the strategy of deep integration with a lot
of proprietary other solutions. So they they usually rely on standards or partners, external parties doing the deep integration with some exceptions, which I think is fair. And I think which leads also to to solutions that might be very, very capable for certain types of organizations, certain types of sizes or organizations, certain types of complexity, but also leaves room for others for specialists that provide more capabilities, more depths,
etcetera. So when when I look at most of the the end user organizations, I talked with them, many of these have Microsoft or Google or someone else in in place from the very large sort of IT vendor software vendors, but usually complement this in certain defined areas with other solutions, especially when when these are larger organizations than this is very common. I think this this also fits very
well. So we were just yesterday, so given the time of the recording, so just mid January, we we released our newest version of our identity fabric and of our AM reference architecture. And I think these are paradigms and approaches that clearly show how that you usually will have more than one component and that orchestration that integrates a
key element. So also for our upcoming leadership composite identity fabrics, which will be published around EIC, I'm currently working on that identity orchestration gets a much higher value because at the end of the day, even while you when, when you say some say this is whatever my preferred vendor, you usually will have other components from the past or to fill gaps. And then orchestration is a very essential capability to bring all these bits and pieces together.
Also sometimes to have fall back solution. So So what happens if your your primary IDP goes down for a while? Or if you need to move away from your primary IDP? You have your fall back that at least helps your your critical applications running. Yeah. I mean, that's the basic pillar of business continuity, right? Is that question everything? So you mentioned there that you have a piece coming out. If you provide us a link, we can put it in the show notes.
Mark, you've been super generous with your time. I did have one other question which I was going to ask broadly, but I'm going to narrow it down. And so we're sitting here January 20th, look ahead to 2025. But I'm only going to ask you to pick out like one thing to really focus on what is one of the the hallmarks of 2025, that in 2026, we're going to say 2025 was the year of you fill in the blank. OK. What is the hottest theme? I think very visible non human identity management, a lot of
stuff going on there. So you could argue that also came up in 2024 already. I will think we'll see more more around policy based access. We'll see. This is maybe the 2026 decent resident when all the wallets, the EU, the initial identity wallets come out. So a couple of scenes there. So is that there anything totally entirely new? I, I think what we, what we see maybe from the things we don't have on the radar that much yet, that is something we already touched.
I think we will see a ton of innovation when it comes to natural language interfaces for existing types of applications. Also an identity management and cybersecurity etcetera. Where we have these are separate solutions or layers on top that allow us to to, to simplify a lot of tasks by just saying, oh, I need access to that. And that's searching for which roles and entitlements do I need. This is my task. I want to do the task, give me
the access. And then the system asks the manager, oh, is this already something Martin should be allowed to do? Oh, only until only for the next three months. He's just a temporary replacement done that. That will be, I think probably of the things we, we don't have to measure.
The radar will be one of the, the areas that will be big in 2025 beyond the, the stuff we, we, we commonly have on our radar already, which also, by the way, will raise some interesting questions like least privilege for AI or for Atlantic AI. So and and that will be something which is, which is very interesting because it depends on in which context is the ancient working for which purpose. There are a lot of elements which will make this way more dynamic, I would say.
So what is the least privilege needed to answer a question in a rightful manner for Martin? I think no one's thought about this before, at least as I I didn't, but I think this will be a a really interesting area for Iami. Didn't think about it in terms of least privilege for AI, but I've been really focused on, OK, well, how do you secure the AI? So you're the CEO, somebody else's an analyst in your company, Do they have access to the same data today?
No. With AI or how will AI determine what data Martin can access or or if your employees? Yeah, that's that's the one thing. And the the other thing is how do we ensure, you know, if we haven't, if you have a chanting AI that is work that is used by a lot of people, how do we ensure that we don't have super users there which are way too powerful. So how do we do ensure that this all is kept under control? I think this entire field, I tend to call it a identity.
So the intersection of AI and identity is still a pretty much a wide space on our technology map. We see a lot of start-ups around AI security nowadays, but I think we need start-ups around a identity. It seems to me that the technology, the functionality is going to blaze way past security. So it happened with cloud infrastructure I think, and I think it'll happen again. I think the fall back will be some sort of leveraging legacy permissions, which we already
know are not good enough. I think that's maybe what you're referencing. You have these super users administrate system administrators. Does that mean the System Administrator can start using AI to find out all kinds of information about the company or information they they shouldn't have access to? Even think about someone having access to the AI. Which all, by the way, brings us back to the initial theme, identity verified identities. So is it really Martin using the
AI? And what is the AI supposed to do in the context of Martin? And if it's not Martin or if someone is is using the AI in different contexts, there might be way more information that is to discuss or even if the AI is is sort of constrained in what it can do in the context of individual. I think this is a very interesting field to think about for 2025.
Yeah, I was thinking the exact same thing of we started off the conversation with identity verification and now we're ending it essentially with identity verification. And we talked about AI in the middle and a bunch of other stuff. And I was thinking the exact same thing as, yeah, this, this, this contextual awareness, this identity awareness of who is making the request.
Or maybe you know what is making the request because it could be a non human identity querying another non human identity. What are the rules for the different data sets that each can have access to and the types of queries it can makes and it work. We're back to identity verification is OK. Well, how do we make sure whoever's on the other side of the phone, the API, the text, whatever it is, is authenticated to do that transaction and the type of transaction you're trying to do?
I was thinking the exact same thing, Martin, when we were talking. Why don't we go ahead and wrap up? Martin, you have a gesture time, but I do want to pick your brain for just a couple minutes. You started off mentioning Stuttgart. It is my first time to Germany other than the Frankfurt Airport on a way over to Chennai, India. So I'm not going to count that because I never left the airport.
But if I'm going to Germany for the first time and I know I'm going to be in Berlin for a week, what is something that I have to do as a first timer in Berlin? And then from there, would you recommend I go South to like Munich or Stuttgart, you know, kind of go southwest or go north and sort of Oslo and Copenhagen or go West to like, you know, Brussels or Amsterdam or think something like that? Like what would be your recommendation?
Yeah. So, so it depends a bit of whether you want to stay within in Germany or whether you want to do Europe in three days or something like that. I, I, I think that that, that is a, that is a big question. So I, I, I think all, many of the places you've mentioned take Paris way more to the South, Rome and all the other wonderful Italian towns, etcetera. They, they, they, they deserve more time. So, so I, I, I wouldn't try to
squeeze in too much of that. I think when, when you're in Berlin and you say, OK, I stay within Germany. So I, I just, and then I think the first question was, so it's for trim. It's very clear trim needs to go South in Germany because trim is into good German food and the food on average is becomes better on average when you go Southwest and Germany. So probably I'll get some comments on that by people who live in other regions. But but basically I would say that that is the direction
Southwest in tendency. You have a lot of good restaurants in other areas as well. But so that's the standard and generic food. So if you go to the local, the traditional local food, then I would say the Swabian food. So this area around that is probably best one. That's where I live, by the way. So if, if you're, if you're into landscape, then there are, there are plenty of nice places, but I think it's probably more that you say, OK, which towns are, are really beautiful to visit.
The, the actually the, the typical touristic traditional towns, Heidelberg, Rotenberg, etcetera. If you like that, if you're up to that. As I said, I'm, I'm a fan of Stuttgart. It's full of hidden secrets, which makes it a bit more, more difficult for visitors. So there are some, some wonderful things, Mercedes museum, perfect museum, which are very visible. There's for instance, the the 1st TV tower in that has been built out of concrete.
So it's the frost worldwide in Stuttgart, it's not the tallest anymore, but it's the 1st and it ever will be the first. So things like that when you other towns, Hamburg is great. I, I learned to laugh during the pandemic when we were not weren't allowed to travel abroad. I learned to laugh some areas of the Baltic Sea, but that's probably more for when you want to do a bit of a longer vacation at the coast. There's this region which is called fishland ducks things very complicated.
Basically it has has been three islands which converged over time due to floods, etcetera, which is a wonderful area. So, so really a lot of things to be Munich, yes, no doubt. Can be very interesting. So I think a lot of lot of interesting places and it really depends a bit on what what your preferences are, how much time you have, what you want to see and to you and and also the the ones listening to the podcast. If you want travel tips to Germany, which are biased, sure.
I I admit that I'm biased and my bias goes a bit towards the card and some other towns, then I feel free to reach out to me. And that's a fact. If you go picture my, one of my absolute favorite towns is Paris. Martin Will EIC be back in Munich in the future? I have no clue. So I'm, I'm, I'm not in the organization team of the EIC anyway.
So I don't know whether we will go back to Munich, really no clue about it. OK, Jeff, I guess my, my input, I've been to Germany a couple of times that I've been to Frankfurt. But one thing that stood out to me that I know I'm going to do is go to, I think I'm getting the term right, like a beer hall, you know, with the the raised tables and they bring out these big glasses of beer and it's a very German experience. There are beer halls in the US and some of them were very much like that.
But I figure like if you get the real experience in Germany and then you go back to the US, you can compare and contrast. I, I, I, I have to admit, I think the last time I have been in a beer hall probably is about 15 to 18 years ago and the second last probably more than three decades or so. So I, I, I think they, they, they are, they are, you find them especially in the, some of the Bavarian areas where if the weather is good, always would prefer a beer garden or the beer
hall. So when you're can go outside that, that's really cool. But they are they are probably a bit more Bavarian overall. You're giving me a lot to think about here. And you, you may more Americans there than Germans. That's. What I was wondering if it's more like a a tourist thing than a local thing. I think it started as a local thing, This phrase it has. Been taken over, but gotcha. OK, All right, why don't we go ahead and leave it for this week? But what we don't like.
Anyone else in trouble here? Martin, you're always suggesting your time and really do appreciate you joining us. And again, thank you for the invite out to Berlin. We're looking forward to seeing in a couple months and finally give you a fist thump of gratitude for being on the show so many times and sharing your knowledge.
It'll be an interesting year. I, you know, with between AI identity verification and everything in between and I'm, I'm, I'm continually excited by all the innovations that are still happening in the identity space. I think there's this idea. It's like, oh, well, we've been doing identity for so long. Like, you know, where does it go to next? There's always something new to learn, something's going to change, etcetera. So it keeps it fresh, which is, which is always what I enjoy
about this industry. So thank you so much for sharing your thoughts with us. Thank you for inviting me and looking forward to finally meet you in person in Berlin. Oh, we, we will hope, hope to not disappoint, right, Jim? Let's go ahead and wrap it there. Thank you so much everyone for watching and, or listening. We'll have links in our show notes for discount code for EIC as well as connecting with Martin on LinkedIn.
You can share your thoughts about the, the, the, the current state of beer halls or beer gardens or anything else I'm sure that that Martin has talked about today. And you can find us on the web, idacpodcast.com. And yeah, so thanks for watching and or listening and we'll talk with you all in the next one. Thank you. Bye. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon.
But in the meantime, hit the website at identity@thecenter.com. See you next time on Identity at the Center.