This is identity at the center. Welcome to the Identity at the Center podcast. I'm Jeff, and that's Jim. Hey, Jim. Hey, Jeff, how are you? Not so bad yourself. Doing great. We got a awesome episode lined up for today with a special sponsor we're recording and we're going to drop this episode less than a week before Gartner I Am Summit in Grapevine. Our guest is going to be there. I think this is a perfect entry point to go into Gartner I Am Summit.
With Yeah, we've got a lot of things to cover today. So let me go ahead and introduce our our guest today. So just make it clear, right? This is a sponsored episode. Our friend David Goldschwag, who is the CEO and Co founder at Ambit is joining us today. So welcome, David. Thank you, Jeff. Thank you, Jim. It's really great to be with you. Yeah, so let me get the website out because I've heard this name pronounced a couple different ways. So it's Ambit and it's a E MB IT dot IO slash IDAC.
So that's a lot of letters. It will be in our show notes and it will be in this YouTube description, all that so and the sort of things. So let me ask what I'm going to assume is the source of this is, is it ambit? I've also heard it pronounced as Aimbit, which is the correct way? OK, so it is ambit just like the word A MB, IT would be spelled would be sounded out OK. Of course because of trademark and other people with websites, we added an E in OK, that E is meant to be skipped over.
OK, so it's still ambit and it's ambit dot IO. I'm adding the Ian had the advantage of moving us up alphabetically. Okay, so that's an advantage too. Okay, and I give all the credit to my cofounder, Kevin Sapp. He's picked all the names of the companies that you know, we've been built together. Okay, and he's really good at it.
So this is one of those rare companies where, you know, you, you see a lot of like, you know, Silicon Valley where they're trying to get rid of all the vowels because all those things are taken. You guys went and added one for differentiation. I love it. That's novel and and and from what I've seen. Hi, you know, we're we're East Coast. What can you do? OK, so. Tell us a little bit about Ambit and tell us a little bit about
your background. How did you get into the space of digital identity and identity and access management, and how did that culminate into Ambit coming around? OK. So Kevin and I have been doing companies together for about 20 years, all security companies and almost all till Ambit were focused on securing user access to applications. So it's all enterprise security.
And so for instance, we did an MDM company that was supposed to be users on a mobile device getting e-mail and other services, OK. Then we did the ZTNA company, OK that was became Netsco Private Access. The company name was New Edge Labs. That was you're on your laptop, you're trying to get to behind the firewall applications. How do you do that with something as a service instead of AVPN and but all of those were, how do you secure access from a user to an app, OK.
They were all both about identity, but about something else in addition to identity, right? The mobile or you can get me past the firewall, etcetera. OK, When we were ready to start Ambit, we said we've been in this user space for a long time. O let's talk about nonhuman access, right? Software accessing other services. That's turned out to be a big deal, and we'll talk about that for the rest of the episode, OK?
But what we also said is all of these questions about firewalls and VPNs and all this were not the core problem. The core problem was identity, OK? If you're trying to access a service on the Internet, OK, this is not a network reachability problem. This is purely an identity problem. So over the course of 20 years of doing enterprise security, we landed at the core problem and everybody knows identity is the new perimeter. Turns out it's the new perimeter
for things, right? As well as people, OK. I'm glad you had that caveat because every time I hear identity is a new perimeter, I just kind of want to yell into the screen. No, it's not. It's been that way forever. I guess not forever, but at least for the last decade I feel like identity has been really one of the main perimeters to defend against. And, and, and one of the things that we have, one of the advantages we have at Ambit is everybody's familiar with that,
right? They know how you log in with an IM system, OK? So we can take advantage of lots of analogies of how do people, employees at an enterprise, you know, authenticate, login. And then we say, well, what happens if it's an AI agent? What happens if it's a Python app, OK, how do you help that log into the service? And the answer is this. It's the same, but different. OK. And that's how tech is many times. So I gotta ask, does ambit mean anything? Like what's the story behind the
name? I, I get the extra E in there now, but like, what does ambit mean? Like how did you come up with the name of the company? I guess you know, how did your cofounders come up with it? Yeah. So ambit means scope or boundary, OK. And a particular use case that we're focused on is where access crosses A boundary, OK. So let's say you have an AI agent, right, running in your enterprise that needs to do work in Salesforce.
OK. So this is no longer accessing resources as within your AWS account, rather it's crossing a boundary and going to a third party that's Salesforce. And the same thing applies for any most accesses within the enterprise. You're going to a database, it could be Oracle database in your network, but it could also be Snowflake or data bricks which lives someplace else.
And so this cross boundary authentication problem is hard, OK and it's not solved by the cloud providers and that's where Ambit. Shines. So I find it somewhat interesting that you're working with an identity company now, but we were getting into each other here before we hit record. And you mentioned that you worked on Tor, the Onion router a long time ago, which is probably the furthest thing possible that I can think of that where you'd want to have an identity.
So tell me, what about your Tor background and I guess what what caused you to do the 180? OK, so so it was wonderful, but back in the mid 90s, I was working at Naval Research lab. I had left in National Security Agency and I was working with two colleagues there, Paul Cyberson and Michael Reed. And we had this idea OK, right, which is wouldn't it be good to be able to do anonymous browsing on the Internet, OK, And there that there's there's lots of stories about how why the Navy
funded OK, right. And all this, OK, but it did become really important, OK, this ability to visit something on the web, right, Without, without somebody being able to attribute it to you using the IP addresses or whatnot were really important. And my background at NSA made it clear to me that this was important because NSA both tries to understand the traffic of what's going on, right? What are people talking about? But more importantly, it's who's
talking to whom, OK? And there's lots of data. Justin, who's talking to him call records at a phone company, you know, if we go back to Oldham times, OK, we're also who was talking to him, OK? So, so so Tor onion routing at the time was trying to solve this problem of saying, let's make sure that we can communicate, but that the act of communication does not give away who's talking to him. Now, that doesn't mean that you can't say who's talking to him within the connection. OK?
So we call this anonymous connections rather than needing to be anonymous, right, when you're doing a transaction, OK, right. So that's what we did. OK. Now, of course, commercially, OK, you need to be able to authenticate, OK, right. And so, so, so in in the real world, right, you may want anonymous connections, but even within that connection, you do
want to authenticate. Because if I'm talking to you, Jaffer to Jim, you should be able to know then who, who I am, OK, Even if it's not observable to the rest of the world, OK. And like you said, right, this is 1995, right? So that's going on 30 years, OK. So identity has been pretty important for a very long time, OK. Yeah, no kidding. And you know, I think it's, it's interesting to see where Tor has evolved over time and how it's
being used. I Did you ever imagine that people would be using Tor the way that they are today? So, so it's hard to imagine any technology that's still in play, right, 30 years later, OK. That's pretty rare, OK. What we did know, OK, was another colleague of ours coined this term. Anonymity loves company, OK? If only the government were using Tor, you'd know when they're searching for public source, open source intelligence about Iran, that it was the government looking for Iran.
OK. So you need all sorts of other traffic to be noise to cover that traffic. OK. So the design of the system said we can either generate our own noise, right, or we can leverage the rest of the world. So we opened up the system. And I think that that's that's created, you know, kind of an interesting play over these years, right? I think interesting is is a very light, easy way to put it. Let me get back to ambit though. So, you know, let me put my CSO
hat on, right? And I think we've got just so many products in this space. So my question that I ask every vendor that I talk to is what makes you guys special? Like what is it that you think sets yourself apart from, you know, competitors in the market or contemporaries or things like that? Help me understand that and educate our audience as well. OK. Yeah. So like you said, there's lots of identity companies out there, major companies, right?
So Okta, right. And Microsoft Antra are the IAM dominant IAM players for human access workforce login to services. We don't do that. Ambit does not do that. Ambit is login for software logging into services where that software could be AI agents, OK, or other client applications trying to reach services. This is in the enterprise OK. So the first distinction between what we do and what other people do OK is we're not focused on
human access. We're focused on what people are now calling non human access OK. And that's that's a big difference against the the existing large players OK. The thing that's different about us than other newer players, OK, is we, we aim to solve the, the, the enforcement side, the runtime side of this problem, OK, So just like Okta helps you log into a service, OK, And if Okta doesn't let you log in, you
can't access the service. Ambit is the thing that lets the AI agent where the I am that lets the AI agent log into Salesforce or Snowflake or whatever service it's trying to do. And without Ambit being in runtime and authorizing the connection and issuing A credential and logging it OK, we the the that access cannot happen. So we're critical to the infrastructure and we're fundamental to the operation of the of the environment. So David, everyone's creating AI
agents now. I'm creating them, Jeff's creating them. People we work with are creating AI agents, and I guess the default mode that people tend to tend to use is when they need to make a machine to machine connection, they're using their own personal credentials. I got to imagine that's not what we want, right? Yeah, that, that's absolutely true, okay. But we're seeing that happening in lots and lots of places, right? The obvious way to solve this
problem, okay. The obvious way to make things just work, okay, because that's what we will just want to do, right, is you're running an agent, goes to Salesforce, you're going to give it your credentials, your username and password, and the agent will do it. And then that just is easy, OK? And it's not unlike how people would've been securing machine to machine access for a long time. You had a username and a password for a service account, right?
Maybe if you were diligent, it was a different service account, right? But it was still the username and password. And the irony here is this, this has a bunch of cascading effects. One is is you probably have to shut off MFA at Salesforce, OK, right. Because your username and password, right, wouldn't generally be enough for a user.
So you're trying to do it easy. And then you put the username and password in. Incidentally, you shared your username and password and we've been teaching people not to share usernames and passwords. And then you shut off MFA and all of a sudden the bar on compliant access has been lowered, OK, right. So you have these in just, you have these enterprise thresholds, right, for secure access that you've trained your employees and all of your systems to work on for now for 10 years, OK.
And now you're weakening those controls. Now why is it bad to weaken those controls? OK, well, one is is username and passwords can be stolen, right? So phishing, right? And now the bad guy can use that. And notice that would be true, Jim, even if it wasn't your username and password, let's say it was just a username and password for that agent. OK, that's not enough because we know that phishing is a problem.
And now the bad guy could reuse the static Long live credentials, OK, Another problem is attribution. If you're sharing your credentials with an agent now when the access happens, we don't know if the agent did that access or you did that access or you and the agent did that access together, OK? And we should keep coming back to attribution, right? As we're talking for the next
few minutes, OK? Because attribution and audit is sort of fundamental, OK, To be able to run your enterprise responsibly, OK. And we're where that brings us is in the ambit solution, OK? We want to make it easy to do it the right way because why are people taking shortcuts? Because it's easy. We just want to say you should manage access in and by managing access policies instead of managing secrets. That's what's on my shirt.
Manage access, not secrets, OK? And the idea there is, is replace this whole notion that you enable access by sharing their credential, OK, saying you're enable access by sending a policy, OK. And then you can do what IAM and zero trust have done for user access, which is you can move to identity based policies, you can do strong access control. You can move away from from long lived secrets, usernames and passwords to short lived credentials. And you can add conditional access.
All of the things that we've learned that work well when strengthening user access. OK, so all that said, Jim, you're building these agents because they're useful, OK? So our ultimate job is to make it easy for the developers, The people are building these things to do things the right one. So it's even worse than I thought, but I, you know, I grabbed a great line to use their manage access, not
secrets. And I think you did a great job of kind of laying out the base problem with what you just said there. What I'd like to know is, I mean, you got to be working with a lot of customers. I'd like to hear about what are the kind of use cases that your customers are running into on this topic. OK. So I think it's good to start. Let's even ignore identity, let's just talk about things like you said, you're building agents, OK?
So for instance, we have one customer, they're a financial company, OK, Financial services company, They have lots of analysts who are responsible for various accounts from their customers, OK? And one of the things they need to do is the analysts need to do portfolio reviews on a periodic
basis, OK? And that portfolio review is a high level job, OK, Where the data in the portfolio is mixed with data from third party sources and public sources and proprietary information to be able to understand the portfolio. So this this company is using LLMS, right, agents and LLMS in order to routinize some of that analysis, right and make the analyst job easier.
And So what happens is is you set up this LLM with prompts against whatever you set up the agent with pumps against whatever LLM it's using, but it needs to access these SAS applications that have the data or the in the on network applications that have the portfolio information or other third party proprietary information. And that login is fundamental here, right? Do you want that LLM, the agent to be logging in as its own
identity, OK? Or should it do take the shortcut right and login as whoever that analyst is? And the answer is, is they wanted to log in with some of the analyst's rights, but its own identity. Does that does that make sense? Right. Because the analyst has a certain rights that it's allowed to do. But that doesn't mean that you should give the analysts identity to that agent because that's too much rights. And then you couldn't distinguish between the agent and the analyst himself.
OK, so that's an example of A use case and the problem that they're trying to solve and and it solves that problem. Yeah, that's really interesting and I'd like to hear more. I mean what are these customers pain points? So I mean what's bothering them? What makes them pick up the phone in the 1st place? Probably not the phone, write an e-mail or the go to your website, but what's causing them to do that in the 1st place, David?
Yeah, so, so we, we have another customer, a large a large retailer, OK. And their their motivation here was the business wants to innovate and take advantage of agentic AI. And just stepping back for a minute is really amazing, right? How much perceived and actual value, right enterprises are saying right. The revenue and the, and the, the, the use of agentic AI, right is really very real in the enterprise, OK, for all the complaining about hallucinations and all this, OK, these things
are really very useful, OK? So there the CSO called us and the CSO said is my enterprise wants to innovate with agentic AI and in order to innovate those need to access various sensitive data sources in the enterprise. We talked about Salesforce, we talked about Snowflake, you could talk about ServiceNow, OK. And the problem is, is he is responsible for compliant access to those enterprise data sets. And now these agents need access.
And the question is, is how do you provide access, OK, with a bar that's similar to the levels of of access control that you have for user access? Because you don't want a personnel agent, right, To get enterprise OPS data, OK? You don't want an HR agent to get mental health information, OK, Right. And how do you assign those rights, OK. And you can see if things go sideways there, right? You can actually create lots of
problems for yourself, OK? But for me, and I've always liked this, when we build companies, we're trying to build security companies that enable things, OK? And here authentication is enabling the enterprise to do in a responsible way the things that it wants to do. That'll help it be more effective. You know, you made a statement like people in the enterprise and enterprises are building these agents.
And I kind of feel like this is one of those IT trends that even though we saw it coming, I feel like it almost caught me by surprise where I went from not having seen agents in many organizations, client organizations, my own organization to I'm building a just like 6 months later. And now this is, this is really an identity issue. And I'm comparing that to certain other areas of identity like decentralized identity. I feel like I've been talking
about decentralized identity. We've had guests on, but I haven't had my hands on it, right? But like this AI agent thing is very real in my world. And when anything moves with that velocity, I think like the whole organization has got to be on its toes, right? Including the audit function. And I wanted to ask you about the audit function because I've got to believe that this is like becoming like in their wheelhouse overnight. Yeah, yeah. So audit and attribution, right,
are fundamental here, right? You want to be able to know what's happening, OK, Both to know, you know, accountability and responsibility and also when things go wrong, you got to undo it. And then things go wrong in soft ways, just operations. So audit helps you there too. But what's really interesting, Jim, is you talked about the change here, right? That's quite astounding.
I think we can all look back a couple of decades, the change that's like this adoption of AI, it's akin to the change that happened with cloud or before that was say the adoption of the iPhone. OK, do you know what I'm saying? And it's very likely that this will change businesses in even a stronger way than those previous, OK, than those previous things because the adoption is just, is just so beneficial, right to the enterprise. And we all know, right? We all remember when, when 30
years ago, what? No. When was it in? In 1990, Seven. Right when the iPhone came out was No, 2007 when the iPhone came out, people said you can't have a device without a keyboard, right? OK. But you know how wrong they were, how long they were, right? You also point out here, Jim, is that this development of agents is occurring, right, sort of organically within the enterprise, OK? People are just innovating, OK? And that's something we should encourage, right?
Because if you want people to help their organizations work better. Well, I think if whether you encourage or not, it's going to happen. So why not make sure that you put the proper guard rails around it. And I think what I'm hearing from you, David, is you don't think AI is a fad and it's going to be around for a while. No AI is useful and we're using it right. You probably use it in your personal life instead of Google search.
OK, right. In the enterprise, it's it's accelerating the ability to do things coders, right? It's all moving. So and I I like the word guardrails, right? And So what we're trying to do here is we're trying to give a platform and I am platform for agents and other pieces of software where it lets developers do less work because authentic is hard, right? You were saying, right, Jim, let's put our usernames and passwords. So let's avoid that whole
problem. Let's authentication be part of the platform so developers can focus on the parts of the code that matter, OK. And incidentally, it happens compliant with company access policies. So we've been kind of talking about AI and agents specifically, almost like it's a generic term, an agent, but there are multiple types of agents that are out there, right? So can you explain, you know, maybe like what are some of the different types of agents and
why is it important? I, I don't know, maybe is it important to have different guardrails for different types of agents? Or maybe it's the same or similar guardrails. Talk to me about that. O So all agents are pieces of software, OK. And you might give that column an application or call them a workload, right? And in this sense, they're a client workload, right? They're the thing that's accessing something else. We're seeing three kinds of
agents in the enterprise, OK? We're seeing the use case I described to the financial analyst. Those agents are what we call hybrid agents. They're working. The user works with an agent to do some tasks, OK? We also see autonomous agents, right? Where the agent is doing something on its own that a user or somebody else, some other machine may have done, OK. And those two are different
scenarios, right? Because the autonomous agent, the agent needs an identity, OK, and it needs access rights, and you need to be able to attribute any action that it does, whether it's data access or tool set access or changing something in the infrastructure, OK, to that agent. The hybrid agents need that sort of blended identity that we
talked about, OK? The effective rights for that agent is some combination of what the agents entitled to do and what the controlling user is entitled to do. We should work through some examples there, OK? But even when you do have sort of entitlement, you need to know when it was the agent operating and when the user was operating. And when the agent operates, you need to know what's operating on
behalf of that user. Now there's another use case job where it's agent to agent kind of chained agents, OK? And that one is sort of an expansion of that hybrid agent, right? Because instead of the agent being called by a user, the agents called by an agent, which may be autonomous or may itself be a hybrid agent, OK? And in all of those cases, the attribution for upstream context
is really very important. So wouldn't it just be simpler to just say, OK, well, I've got an identity for an agent and an identity for a human, rather than try to do like an inference of, well, this agent has some subset of me as the, you know, the assignable actionable person for that agent, whatever that looks like, right? I'm accountable for it does. Why not just have two different identities? Or, or maybe that's what you're talking about.
I'm just trying to understand, you know, why, Why would we make a differentiation there? So, so we, we believe entirely, Justin, every entity should have its own unique identity, OK? So a human who is using the agent, the agent should have an auditable identity. The human should have the auditable identity, and the transaction that happened should be attributed a little to both of them, OK, Where the agent did the work on behalf of the human, OK.
But the real question is, is what's the rights the agent has, right? It's not the identity, it's the access rights that it has. So take an example. Let's say an HR person is using an agent to get HR information from ServiceNow OK. That agent should have permission to the HR information in ServiceNow OK. And an IT person accessing service now through that agent should have permission to that IT to the IT asset information.
And so you see it's this blending, right, where it's the rights of what the ServiceNow agent can do. Maybe it's only allowed to read the data, OK, right. And then the data set in this case, right, depends upon what user it is, OK. And so it's not that the identities are sort of are sort of combined, is that their access rights, right, are combined.
I mean, what you described there almost sounds a little bit like a privileged access management use case where you've got this agent that is going and accessing, you know, a certain resource, whether it's, you know, direct on behalf of a delegate or some sort of inference of of whatever. I mean, it seems to me like is the right way to have each person has their own agentic version of themselves? Or is it? I have a shared, you know, maybe it is an HR agent that a bunch of HR people share.
And based on whoever's invoking that agent at that, at that runtime, it's saying, OK, well, because Jeff invoked it, whatever Jeff has access to, I now have access to for this time limit. Or if I'm in iti have a different scope of permissions or whatever maybe? Right, so, so I think what's what's quite beautiful about everything we're talking about are the analogies OK, right.
So people should be able to draw on the concepts of IAM or Pam, right, in order to start to talk about what this should look like, OK, right. And, and it does it does start to smell right, like fine grain control, right, that you would want to do in Pam. But the difference is OK is whether you have an agent for a particular person or agent that's shared among people, OK, The user may get the effective rights, OK, of that agent, maybe not only the on behalf rights of
the user. OK, Let's take a very trivial toy example, OK? In that ServiceNow use case, if the agent operated on behalf of the user, then the agent could read the user's calendar. OK, that's not what you want, right? The agent is a ServiceNow agent. You're smiling, but that's, that's sort of a toy example. So the on behalf of relationship is not sufficient, right, Because you don't want the agent to do everything that that user
could do, OK, right. The agent should do what that user could do within the scope of what the agent is allowed to do, OK. And we call this notion sort of a blended identity, OK, right. Where what you're doing is you're blending the access rights that are entitled to the user and the agent in order to figure out what the effective rights of the agent are. I think there's a few people listening who would love to have an agent read and respond to all
their e-mail for them. Maybe they're brave right now to do that right to. I think eventually, you know, we get to that spot. But it's probably different agent than the ServiceNow agent, right? You would certainly hope so. That that's right, right. And I, you know, we'd all like that, OK, right. But but I think again, it's these the agents will have a task, right? And then the task that it's doing will get right based on the user that's invoking it.
So let me ask you a, a future looking question is, and we're, I think we're all familiar with like birthright provisioning, right? Things like that. And I kind of joked about an agentic version of myself. How long do you think it is that it would be where as a standard birthright role or birthright provisioning, not only am I getting my account, I'm getting an agentic version of myself.
Is this a one year, three-year, five year, 10 year out that you think you'll start to see agentic Jeff being provisioned at the same time as real Jeff? So, so, so I think that that it'll be more the tooling, the the tooling that we talked about that they'll be things out there, right, that will do specific tasks, OK, more than somebody that'll operate, you know, sort of as as as my clone. OK, there's there's lots of ways, right, that I think you want probably a little bit
shorter leash. OK, right then, then and then the agent being able to do everything on your own. On the other hand, we all said right, this is moving very, very fast, okay, right. And the fact that we can entertain questions like that shows just how close, right? It's actually possible. Okay, right. So, yeah, we we were some friends and ours were talking, you know, it's will agents sort of be your persona, right? Do do you know what I'm saying? Right.
I'm not sure how I get the experience right from the agent being, you know, being my persona. But that's treading on philosophy and science fiction, so. I loved a lot of the questions that Jeff asked. Like I kept thinking in my mind about if you had a humanoid robot, would you want him or her or it to be able to do anything that you can do? The answer might be yes. I don't know. I'm just got to give that one some thought.
But David, what I really like about Jeff's questions is that he kind of started to help me understand a little bit more about how ambit works. And the question I have for you is like, who uses ambit? Is it me and Jeff as agent developers? Is the IM group like the identity practitioner, the the the administrator of the system is that who uses NBIT? Both of us? How's that work? OK. Yeah. So generally we have two
stakeholders in the enterprise. We have the security function, OK, whose job it is to make sure that resources in the enterprise, whether they're data or systems or tools, are only accessed by authorized users or agents, OK. And then there's the developers who build those agents, OK? And for them, our job is to make being compliant with policies and make access OK, authentication, authorization easy, OK. And we have an aspect of our
stuff which is no code. OK, So people can include our stuff in the agent and they don't have to modify their code. And what would have been the stops of authenticate the agent in the hybrid case, authenticate the user, then check and access policy and then issue a credential and use that credential. That all gets taken care of, OK by our stuff without the developer needing to write any code. And then of course everything is logged, both successful attempts and not and and and denied
attempts. OK. So the two stakeholders? You know, David, I, I heard you say in one of our conversation, I wrote it down. Identity helps folks on the front end. And now that I've got you here for the interview, I wanted to ask you what you meant by that. OK. Yeah. So so there's there's two places where identity, well, there's three places where identity happens, OK, there's policies, right? This agent can access ServiceNow, OK.
There's how ServiceNow enforces those policies and identity or an access token comes in and ServiceNow knows that it can go to HR data, right, and not IT data. But then the question is on the left hand side of the picture, how does the agent get that access token so that it can use that? OK. And that's the part of the problem that and it solves. And it says set a policy and we can authenticate the agent and the user and then deliver a token that that agent can use.
And the interpretation of that token is left to the system you're accessing, OK? Now, if you think about it, that's exactly what happens with Microsoft Antra or Okta, right? They're not trying to give sales force a fine grained authorization mechanism, OK? They have sales force's job. The job of Okta is to deliver to the user, right?
The sales person, the token that maps them to a certain set of rights, OK. And that's what I meant by the left side of the picture, the guy doing the access, rather than the right side where the resource is. Very cool. You know, I, I think the whole AI agent wave feels a lot like the cloud platform wave. Remember, organizations started standing up Amazon Web Services accounts and they just have development servers at first.
Then you check back in a year later and there were like 30 accounts and all kinds of production applications and it moved so quickly just became a thing that made sense for the business. And we identity practitioners, we were I think in many cases late to react, right. We didn't get ahead of it and we couldn't hold back the business from, you know, taking on this great technology.
Just like today you're seeing probably in my organization, there are probably thousands of agents that have already been built. So I, I think the, that maybe not because of just the size of the wave this time, but maybe on how quickly it came on. I think it caught a lot of identity practitioners, probably flat footed, I guess. What's the advice you have for them now? If you're an organization, you've got thousands of agents, you know, how do you get your arms around this beast?
Yeah, so, so I think that's, that's a good question, but I think you want to look that even if there's thousands of agents, it's relatively Greenfield, OK? Right. So let's look at 3 examples, OK? Right. We've spent probably a dozen years getting control over user access, right? By introducing IM systems and multi factor and conditional access and a path to zero trust.
OK, Machine access, however, is still stuck in the world sick secrets management management, okay, right, So most service accounts that machines log into are API keys or username passwords for those service accounts. And that's where you have Jim, like you said, lots and lots of years and years, right? Of of of of debt, okay to clean up, okay. On the other hand, agents are relatively nascent, OK. And what we're hearing from the enterprise is it's this combination of push pull.
We need to innovate, but we need to create the platforms, right that prevent us from getting into this problem that we're in with machine access, right? Where it's just credential sprawl and Long live credentials, right? Doing all the things the way you wouldn't do for users, OK, right. But you didn't because you didn't have the plumbing along the way. And so now what we're hearing for agents, it's the time to start in doing doing it better, OK, using modern authentication.
And that's what Amit does. We're IAM for agentic care. So you've made a compelling case and now I think I'm OK. Well, I need to do something about the identity and the access for my agents. What are some of the things that, as I put my jaded Siso hat on again, is that right? It's going to cost me money, right? So how do I, you know, how do I make the case to the board or the CIO or whoever, right to get the budget?
How do I measure success with ambit and then say, OK, this is what the return is looking like that. Do you have any any metrics that you typically are seeing from your customers or things like that, that can help me make the case as somebody who's interested in delving into this more? Yeah. So we're seeing metrics 1 is, is a hard metric, right? How much, how hard is it for developers, right? How much time do they say by not having to code up all OK.
The second metric that's that's also a hard metric is if you did it the way Tim you said, right, with usernames and passwords or dedicated usernames and counts. We all know the overhead associated with rotating credentials and all that, right? So there's, there's there's just hard cost associated with that. And then of course, there's just compliance, OK, Right.
You can't say that I have, you know, Snowflake available to every user through Okta, OK, in a controlled, gated way, OK, But my agents can get to Snowflake, right? With username, password, OK, Right. That just that doesn't withstand board scrutiny either, OK. So I think it's a combination of dev work, OK, the the management of the hygiene of the environment, OK, Now we don't manage secrets, you manage policy.
And the third one is, is we should do this the right way, OK. And with agents, we're finding Jeff, you'll like this, right? Since people sort of think of agents as people, it's easy for them to imagine that the agents should have authentic care authentication characteristics like we do for people, OK? But then you ask yourself the obvious question, OK, is I have MFA for people. I text A4 digit code to my phone, right?
I can't do that OK, to an agent because even you, we didn't ask that we should give your proxy agent proxy a a a an iPhone, OK, right. So how do you do strong off right dynamic policies, ephemeral delivery, just in time, just in time, deliver ephemeral credentials, OK for these agents like you would for people, OK. So what does it look like? Get started with this? Is this you know code that I insert as a developer into my agent? You know, workflow, is it some
sort of UI that's going out? And just like, tell me like how I get started down this journey. Yeah. So our our system is, is a SaaS based policy console, OK. So that's where you set access policies.
This agent with this user can access service now in this way, OK And in order to make that live, then you need to be able to establish trust relationship so that service now we can issue credentials to service now that would be just like you would do with Octa. And then the idea is of course is that then you need to integrate it into the agents, OK? And for the most part, our deployments are code free, OK right.
The agent is configured to use Ambit, but the developer doesn't have to do anything, anything extra, OK. We always recommend that people start small, OK, You know what I'm saying? Never or mandate something new across the whole organization right away, OK, Here you're starting on use cases, OK, And that use case can either be app by app, right? You're choosing to secure access to Salesforce or Snowflakers, right?
Or service now or it can be with the the agent developers, right who are using particular services and then you start there and that becomes patterns for other people to deploy, OK. I mean, we all know developers love to be told what to do and how to do it. So, you know, guardrails. Guardrails so so coding up off is hard, OK coding up off well is harder, OK, right. And you can either, you know, code it up yourself, right, or you can get it for free, OK, and
you know. Where do you want to spend? Your time. Building the cool app? Or is it doing the things and solving problems that have already been solved elsewhere? And it is actually amazing job that off is still a application level function, OK, right. It's so fundamental that it should just be part of the platform, OK. And that's what Emma tries to do. That's great. So we started the conversation with onions and onion routing.
We went to Identity for Agents and I was looking through your background as we kind of close out the conversation here today. You did work on Divx and I had to explain before I hit record with Jim to Jim, like what Divx was. And I think it was like late 90s. And so, you know, we've got a lot of, you know, folks in our generation who might be familiar with it. But talk to me a little bit about Divx itself, what it is or what it was. I guess I'm not even sure if it
still exists. Maybe you can help me with that. And then talk to me about some of the identity components maybe that went into Divx, because that was really one of the first maybe Internet of Things, things that people kind of might be familiar with at that point in structure. Yeah, So Divx was really very cool business. OK, so we're all going to date ourselves here, OK? Right. So Divx existed when Blockbuster existed, OK, Right. And how did you rent a movie? It was Avhs tape. OK, Right.
And you'd go to Blockbuster and there'd be all these movies and the popular ones were gone, of course, right, Because they weren't available. And then you'd pick the movie that you wanted, OK. And then you'd bring it home and then you'd watch it and then you'd return it probably late and pay a late fee. Okay, right. And a lot of the revenue was from those late fees. Okay, so you made two trips, okay, paid a rental fee and late fee. Okay, So Divx, not the Divx
codec. Okay, that was the name was sold to after it closed OK, but Divx was when DVDs were coming out OK, the the founders of Divx, which was owned by Circuit City, another blast from the past OK right, So today they were competitor to Best Buy OK, I feel. So much white coming in into all of our beards as we're talking about. This if like amazing, OK, right.
And so, so, so, so DVDs were coming out and, and the, the founders of Divx said one, wouldn't it be cool if we can sell you a DVD instead of for $25, whatever it would cost you? We could sell you a DVD for the price of a rental $3, OK. And more importantly, that DVD could be available at a retailer instead of a store that knew how to rent and process a return. OK, because that was complicated.
So imagine you're at the checkout aisle in your grocery store, in the top 20 movies are there, and they cost 3 bucks apiece. And you buy it, and then you go home and you watch the movie, OK? And then you can put it on your shelf and watch it again and be charged another $3, but you don't have to return it, OK? No more late fees, OK? Right. So this was really a very cool idea. And for all of the young people on the call, this is before Netflix had streaming, OK? Right.
You know, Netflix actually had a DVD rental business by mail when they first started, right? So dad had the same plumbing problem, right? It had to work directions. So this is an identity problem. OK, Right. How do you know who the rental renter is? How do you know what DVD player is playing it? OK, and how do you know what disc you're playing? OK, And that knowing which disc you're playing, I don't mean which which movie you're playing, right?
Remember when you paid $3? That first play was free. So how did you know that a disc was played only the first time and the second time you would charge for it? So what what Divx did is DVDs are all clones OK right there stamped OK. But post stamping they would etch a serial number into the DVD that could be read by the machine. And the first time ADVD serial number showed up that consumed the purchase price, the rent,
the the built in rental price. And if you played it again a month later, OK, then you would be charged again, OK. And so this is very interesting because you were giving at at a large scale an identity to a DVD, OK. And it flowed through the whole system. And there were the other identities that we talked about in watermarking and all this stuff. A really cool business, OK, They had deals with all the studios, almost all the studios. And then then they shut it down.
And that's a story for a conversation over a beer. OK, so. I think we just said Circuit City for the first time ever on this podcast, 380 some episodes and for the first time in that combination, in that sequence, Circuit City just came up. So, David, that's a blast in the past. It's great, OK, And it was cool to be talking and you you recognizing that that's like the coolest thing. OK, so. I'm a nerd, what can I say? That's fine. Jim, do you remember Divx at all?
Does any of this ring a bell for you? Like, you know, back back in the days of your. So I do remember the Divx codec. Now one of the things I would do is take DVDs and you know, copy them to other DVDs and you basically had to reverse out the Divx codec and save this MP4 file, etcetera. So I think I just admitted to a federal crime, but. Statute of limitations. Well, nobody's going to come after me. I think the statute of limitations has gone by.
I do remember one thing, my grandfather used to rent movies and record them and then like the whole family would come over and he was like the Blockbuster video like. But there was no late fee and no rental fee. He just borrowed Terminator 2 and keep it for a week. This is the good old days. The good old days, right? And, and you're lucky you had a grandfather like that, OK?
Because he did the work to make it free, OK, But for most people, if it was 3 bucks, OK, you know, it was all right, you know, so. Well, we're just this the way that the industry has evolved over time, right? So we had, you know, Blockbuster Video, you know, you'd go pick up your video. For me it was pick up video games, Super Nintendo, Nintendo, whatever it may be, right? Get that stuff. And then you had things like this DVD, Divx type approach, Netflix when it was, you know,
mail order. And I think Red Box was around for a little while at some point as well. It's kind of another idea. And then it became subscription based. It was like, OK, now it's a buffet because people I think got sick and tired of being sort of nickeled and dimed, right. So it had like the iTunes stores, like, OK, $0.99 for a song, and then it was, you know, $1.99 I think, to rent a movie. And then people started wanting to own the digital media themselves.
And now we're in this era of subscription, you know, hell, so to speak, where you've got a subscription for like 8 different services and you don't actually own anything. But you have the right to consume as much of this as you want. And I consume, you know, quite a bit of it, just like I'm sure everyone else does. But now we're seeing those subscription prices go so crazy that now it's like people want to actually buy the thing and
put it on a shelf. So now you have things, you know, people are buying DVDs and, you know, trying to think of other ways to archive their media so that they don't have to keep paying subscriptions and things. Like that? Just think about this chef in your 20s. Did you have more than or less than 100 C DS? I had more than 100 and then I undertook. I had hundreds of C DS at one point I undertook that the challenge of digitizing them all, turning them into MP threes.
And I think the highest codec at that point or bit rate would have been 128, maybe 192 bits. And now you've got things like lossless and you know, 320 and variable bit rates. And you know, I had so many DVDs and CDs that were burnt that turned into trash because the buffer overflow or buffer under on, I can't remember which it was. It was. It was a real mess, man. Yeah, but The funny thing is though, you felt like you own. Right. You own that music in the CDs,
right? But ultimately now you have Apple Music or Spotify or something like that. And aren't you happier? Don't. Isn't it better? It's like, oh, you heard this new song and it's like, I want to hear that song 15 times today. You can do it. Well, define better. I think the convenience is certainly there. I'm perfectly willing.
I mean I have been for years at this point to pay some certain amount of money, typically somewhere between 13 and $18.00 a month, right, For a media service of some sort. I feel like you get the value out of it. I am not interested in having my background be all these different, you know, C DS and things like that I used to have. But you've got people who are now interested in collecting vinyl. They want to go back to that old school kind of fidelity of the audio itself.
And you know, there I think there is something a little bit, you know, romanticized about having the album right, and the album cover and the artwork and the lyrics and all that stuff. You don't get that in the digital world. And so I can kind of see it both ways. Yeah, you're right. I'm going to isolate that you just said I was right. And that's just how it went over and over again, right? All right, we're going to go ahead and wrap it up for this week.
David, thank you so much for taking time with us. I definitely want to get people out there to visit Ambit and I'll spell it out here a E MB IT dot IO slash IDAC. We'll have a link in our show notes. I'll put a link to your LinkedIn profile as well for people to kind of reach out there either to, you know, ask questions about Ambit or maybe just reminisce about Divx or, you know, whatever it may be. And yeah, we'll leave it there for this week. We are on the web, IDC
podcast.com. Thank you David again for sponsoring this episode. And yeah, do all the things like, like and subscribe, share with all your friends and let people know the gospel who I am. So thanks everybody for watching and or listening and we'll talk with y'all in the next one. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review and we'll be back soon. But in the meantime. Hit the website at identity at the center dot.
Com see you next time on identity at the center.