#396 - Gartner IAM Summit - Majority Rules

This is identity at the center. Welcome to Majority Rules. Thank you very much for being here. The few, the proud, the ones that are left over here at noon on the last day of the conference. My name is Jeff Stedman. I'm the host of the Identity Center podcasts. I'm joined here by my Co host Jim McDonald. That's me Co host. I'm also a consultant during the day at. RSM. That's right, and so am I. And then the pickle in the middle. Rebecca Arshamble, the Gartner analyst here.

That's just here to have fun. All right, so the first thing is you want to get your phone device, whatever it is connected, Go to that website, CCG dot buzz, enter that code, enter a name. I see we've got some people who have already joined. We'll give folks a few minutes here to get set up while I explain the rules of the game. You can use whatever name you like, just, you know, maybe make it safe for work. That's totally fine. We're going to have a game show here.

And so I can almost guarantee you will learn absolutely nothing. The the only thing you're going to learn is what the people in this room around you are thinking around various topics that are coming up. So we're going to have some fun for the next 25 minutes or so. You're going to get questions that appear on the screen. We're going to talk about it, You're going to have a couple answers, and then you're going to vote as a group on your device as to what is your favorite answer.

So I cannot stress this enough. This is not a test of knowledge. This is a test of what is the pulse of the room feel like for these answers that you're going to see. So think it was more like favourites, preferences, things like that. I would say there are no right answers. There are always wrong answers to every question out there, but there are no real right answers to this. It's really more of a preference thing. We will be keeping score.

So the faster that you select the majority answer, the more points you get. And you'll see it on your screen. You only get points if you select the majority answer. And so we'll have a couple more UPS. It'll make sense after you get the first couple questions in. And so, oh, we've got sound effects. That's sweet. OK, so we've got eight people so far.

Let's see what we got 27. For those of you that just came in, you're going to go to this website over here in the upper right and put in that code to play. CCG dot buzz enter the code, then give yourself a name. No real names. Right, you can use it. Can be. Creative here, but you know. Safe for work? Safe for work? This might end up as an episode of our podcast. So you don't keep it, keep it, keep it clean.

As long as it's you're comfortable with me calling you by that name, that's totally fine. Mr. R, I'll, I'll keep your anatomy there. OK, so we've got people joined in.

There is going to be a twist coming up shortly. And I mentioned that we're keeping score. So we actually are playing for prizes. And I think given that we have, you know, maybe 30 people in here, roughly 31, we actually have some donations from both the company. Jim and I work for RSM as well as Signal. So we're actually playing for Amazon gift cards. It's sad. And it's no small chump change either, right? So the top three scores are going to be winners.

The top scorer at the end of this game is going to get a $500 Amazon gift card. So thanks to R7 Signal for that.

Second and third place get 250. And so we'll be tracking. We'll have the score, we'll see it. So now that you know, there's actually some some nice stuff on the line here, right? And also, I'm sure Jim has stickers for the podcast, So we'll have that. All right, so let's go ahead and get started. It's done an either or on the stickers. That's a little on. All right, OK, so we're going to see the questions here and let's get going. So the first question is real easy.

What's your favorite? What's your favorite identity podcast? Is it identity at the centre? Hence that's the right answer or other which is the wrong answer? No offense to other great identity podcases out there. And so I'm going to open this up for voting and while they're voting, Jim Shameless club for the podcast. But you got. To go with identity at centre. I mean, it's the right answer. Right.

It literally says it on the screen. OK. So this should be a layup for everybody and let's see what people came up with. Hey, look at that surprise, surprise, it's the podcast. So thank you very much. Appreciate it. So hopefully that first Test question, you know, makes sense. Let's see what that does for our scores. We'll just see who is the fastest person to click the button at this point. So Craig, Craig up front. All right, so Fabian is right behind Ashley Kirk.

All right there. So we're talking millisecond here from a response time. All right, let's get to the next one. All right, What is your primary goal for the conference? Is it networking?

Saw a lot of that in the bar last night or education? I'm going to open it up for voting here and we'll talk about that. What do you think? For me it's always networking. Networking, yeah. Yeah, I'm going networking for 1000. Final answer. Final answer. So you guys are picking what you think is the right, the most popular answer? Just as a reminder, yeah. Some people actually come to conferences to learn things. So weird. I get it.

I get. It all right, Let's see all right, pretty good splits OK all right so we're surrounded with people who actually want to learn things so congratulations. Unfortunately, you're not going to learn anything in this one. So, you know, maybe a poor choice for those. In the wrong side. We're. Just setting the right expectations here. Exactly. All right, So let's see what we're doing for scores. So if you didn't select the right answer, you're not going to get points on that one.

Craig is still in the lead. Dude, you were killing it.

Yeah, all right, let's see him. So you have policy enforcer, we've got an agentic AI is playing the. Game full names. Yeah. All right, so let's keep going here. Let's find out what is the most popular buzzword this year. All right, Is it a gentic identity or post quantum computing? So I feel like if you walk to the Expo hall down there, you know everything is a gentic ID identity. What do you think? Becky, I think I gentic 100%. It's got to be agentic.

Is it because people just don't really understand post quantum yet? Yes. And they need to. Or do they need to?

But yeah. OK, All right, let's see. Oh, yeah. Surprise, surprise. Everything is agentic. So there we go. Let's see what it does for our points. There's something hard. Craig's still in the lead. Fabian's hanging right there. Where's Fabian? Craig's already. Spending that on Fabian's over there. OK, All right, you got some, you got some, some competition there. Now I will say if you're behind right now, don't worry about it

because the twist is coming. Don't you worry. That's right. All right. Next question here. What is the primary use of user behaviour analytics? UBA, Becky, what is what do you think? Well, we, I used to call it UEBA. Oh yeah. That shows our age because it was UEBA, then UBA, and now I feel like it's like these. Are these are both good answers? Yeah. Jim, what do you go with? Fraud or begging? Both Good. I guess I'd go insider threat. Insider threat. OK, well, let's see. What then?

I got to go with the other. Yeah, there you go. That's fair. What'd you say? I'd go with the other. He's going inside or I'm going fraud. All right, let's see. Oh, pretty good. Split inside first change. OK, so fraud detection. Nobody cares if the. Well, less, I'd say not nobody, but fewer people care if they're getting ripped off. They're more concerned about the people on the inside. OK, All right, let's see. Craig, you still in first? Yeah, Fabian.

All right, Fabian. Fabian wants to go shopping on Amazon. All right, let's see.

The policy enforcer has moved up, Agentic AI has slipped back at the pseudo IMDU. OK, Neo, we're in the Matrix. All right, some interesting names. All right, so we're only showing the top 20 on here, but I'm sure there's interesting ones out there as well. OK, So what makes an Expo hall booth memorable? Is it cool demos, neat technologies or friendly experts? I know some people would say socks that I know socks. Friendliness. Socks is not an answer, but while you're.

Voting, but we'll go with friendliness. All right, so how many people while you're voting, how many people like socks to pick them up at these things? OK, maybe 1/4 of the room. Oh, OK, well, you're still in the quarter. Stuff like that. I'll admit I'm not a sock guy, but I'm not going to be grudge. All right, people want cool demos, preferably driven by

friendly experts. OK, so we've kind of warmed up here a little bit. Let's see what that does for our scores, Craig. Oh, wow. All right, so where's Jo? In the back? All right, my guy, I'm always sitting in the back, too. All right, so Craig and Fabian. So Jo, come, come in and out of there. So guess what? It's twist time. So it's time to go into a battle Royale mode. So the twist here now is instead of 2 answers, you're going to see 4 answers. Now the goal is still pretty similar.

You want to pick the majority answer, but you want to make sure you do not pick the least popular answer.

If you pick the least popular answer, even if it's a tie, you lose all your points. So everyone is going to have a chance, right to Lavarian to win some valuable prizes and also some Amazon gift cards. The sticker is the valuable price. OK, all right, so let's go with the next question. What is the true purpose of an analyst 1 to one session? I think there's only one person on the stage that can answer that one. Well, we're going to find out what people think.

Is it road map validation? Is it contract negotiation, peer

benchmarking, or is it therapy? The Therapy 100. Percent. All right, so a little insight into what's happening behind the scenes. Let's open it up for voting here and say. We're going to get blown up here because I think any of these can be the least popular. So remember, the strategy is not the right answer, It's what you think the rest of the room is going to pick. And I can guarantee you that there will be agents of chaos in here who are just picking

random. Things and there are some former analysts also in the audience. Yes, exactly. And they can probably vouch for the therapy session, right? Yeah, Yeah. OK. All right, let's see. Well, vast majority, are we on the right track from a road map perspective? But yeah, therapy showing strong. Showing strong. Easy for me. As for the record, we do do all. Of those, exactly.

I did my research. Yeah, There you go. All right, so if you picked contract negotiations, I'm sorry, but you're going to lose all your points here. The exciting thing is we see explosions. Boom. Sorry, Ashley, but don't stop playing. Remember, everyone can have a chance right till the very end. You're still accumulating the points as long as you don't pick the least popular answer. So Kirk has moved into the lead here.

Jo, Fabian, Steph. Let's see a a joker with the the very elite 3 as the E Cool. Let's go. I saw an I, I saw an ID theft on there as well. All right, how do you mitigate agentic AI risks?

Let's see if the options are is it non human identity policy behaviour monitoring, scoped permissions or let's pray that the bot doesn't learn the RMF commands and delete all your files. What do you think? I don't really like these answers. OK, well, you have to pick a favorite. I got to pick one, huh? Yeah. Oh gosh, it's got to be the monitoring one, right? I don't know. OK. Scope permissions I think is my favorite. Scope permissions. Well, let's open up for voting.

Let's see what people think. Yeah, I mean, I think, I don't know, all of these are important. I don't think you can be successful doing just one of these. Correct, Except for making sure that obviously you don't want your bot to delete your file structure. Exactly. Let's see what people are thinking. OK, pretty good split here. Non human identity policy.

Scope permissions right there. A couple of folks, you know, hoping for prayer to make sure the bot doesn't become sentient, which is always nice. All right, let's see what that does for our scores here. Let's see. Fabian. Oh, John. Sorry. John Oh, couple people. See, John, you've got you played with us a couple weeks ago in, in DC. So, you know, the audience is way more sincere. The audience is way more sincere. OK, the Gallway has been thrown down by John. All right, let's keep going

here. What is the best strategy for

the vendor hall? And apologies to any vendors who might be in here already solution mapping, competitor analysis, partnership talks or aggressively avoiding ICON with the sales Rep, which I'll tell you I'm a pro at. If you look past people, that's the that's the tip right there. All right, let's open up for voting. Jim, how do you avoid? No, I don't. I don't avoid. I need to have this conversation. So I'm going to go competitor analysis. What do you pick, Becky?

Talks. Talks, just talk. I'm a people. Person I want to talk. Swag. There's an office space reference in there, but I'm not going to go there. You're a people person. All right, let's see what the people think. OK. Yeah. Solution mapping. And yeah, apologies to the vendors in here. They're looking, you know, past you. Let's see what it does for our scores, people who are interested in partnership talks. OK, we left. We kept the top 20. That's good, a Gentek AI.

Is walking around. No, nobody got a. Nobody got with that one. Some people might have if on their phones. Just not. We'll just look at the. Top 20 yeah OK let's get to the next one here what is the future of IGA identity governance

administration is it autonomous governance, policy based access event driven or hey let's just replace one spreadsheet with three dashboards I. I would I would like Felix to answer this. Question #4 All right, well, let's vote. Let's see if he votes for that. Let's turn it out there. It's got to be #4. You take it #4 OK, some people might actually pick a real answer, so we'll see. I I'd pick event driven. OK, event driven. See autonomous government.

Can't read this audience. It's the lights.

It's hard to see out there, right? All right, autonomous governance, policy based event driven and nobody's on on on board with the spreadsheets and the dashboards. So let's see what it does for our our scores here. All right, no changes there. Where is Jo if I can see it? Oh, that's right. Right in the back. OK. There's Fabian, all right. Fabian Neo and the Agent are right there, neck and neck. All right, let's go. What is your favorite Gardner report?

And I know there's more than these, but we have 4 choices. Is it the Magic Quadrant? Is it critical capabilities? Is it the market guides or is it the hype sites? Give me MQ for 1000 MQ. For 1000, OK. Becky, what's your favorite? My favorite is Critical

capabilities. Critical capabilities. OK, well, let's see what the people think. I know there's other ones that are out there as well, but these seem to be like the ones that come up the most, at least from I've seen. All right, let's see what people think. No. One that one. Magic Quadrant 2/3. OK, so who's brave? The 3%? So it's maybe one of you that picked Hype cycles, John. OK. All right. Let's see John. And did you know that every major quadrant has a critical capabilities?

Everybody know that that's always there. Critical capabilities almost gets missed all the time but has really good stuff. Oh, yeah, because you just got a

fancy graphic and that's nobody reads past that, right? There's so much more to learn on that. All right, Fabian's there. No is out there and I'm emphasizing all the OS. So there you go, the pseudo IMDU. OK. I'm really surprised by people who score so high. I'd be right there with Steve Rennick, not on the screen. All right, let's get another one here. What is the benefit of just in time access?

Is it 0 standing privileges on its streamlining risk reduction or less time for the AI to hallucinate an admin task? Always love, I always love that #4. The number four, Yeah, You know, I had to sprinkle a little fun

fun into this. Yeah. Not that it can't happen. That means 0 standing. Yeah, let's. See what the people think. What are you voting for, Becky? I think the the most popular answer would be 0. Standing 0 Standing. I'm guessing you're on 0 standing as well. I haven't been very good though. OK, well, let's see. Oh, you're right. So there we go. That one, right? 2/3 the audience is 0 standing privileges. All right, let's see what that does for our scores. All right, Craig, back on time.

All right, All right. Where's a A?

Nobody's volunteering to be a A I've. Seen. It OK, Yeah, All right, all right, let's keep going. What should be prioritized when using AI in authentication? Do we minimize false positive, minimize friction, adaptive responses, or make that CAPTCHA less insulting? Becky, are you a robot? Can you pick all the motorcycles in this very grainy picture? Not yet, not yet. I'm not a robot yet, OK?

What's the worst CAPTCHA you've ever seen, Jim? Well, it's always like identify any stairs or identify the bus. It's like, oh, is that a? Bus It's this little tiny corner. Right, that a bus that might be a bus. I think it's a real art form. They have like a really bad CAPTCHA. Yeah, like. There's a lot. Of thoughts that probably. Goes into it. There should be bad UI battles on Reddit or if anybody. 'S interested. In Magic Quadrant on the worst CAPTCHA. I'm in favor of that.

You heard it here. Gartner 2025 Magic Quadrant worst CAPTCHA coming soon. All right, minimize false positives. OK, Yeah, that makes sense.

Let's see what we do for for scores here. See, we've got 37 people playing. Oh, we lost Steph and we lost Club 296. Sorry. I get a little tickle when I hear the explosions. I don't know for me that. Just does something. I do I, I, I like chaos and destruction. What can I say? All right, let's get to the next question. What is the best way to secure non human identities? Isn't short lived tokens a secret rotation workload identity federation or unplug the server because you can't

hack what's turned off. All right, what do you picking, Becky? I'm picking short lived tokens. Short lived tokens, Jimmy Ruth, Short lived tokens. All right, short lived tokens. OK, let's see what the people think is they're voting. We should ask. Craig. Craig. What's the Craig? What do you think? Yeah. Just vote with Craig. Let's see. Short lived tokens.

OK. Majority is the answer there. Let's see. All right. Craig's still there. We lost Fabian. Sorry, Fabian. Don't worry. There's still a chance to come back. All we need is Craig to slip up. Jo, the pseudo IMDDU. All right, a rod. I'm assuming that's not the baseball player. Yeah. What else could it be, right? What is the key to successful B to BI AM? Policy, delegation, standardization, trust framework, So federation. So when it breaks, it's the partner's fault.

What are you going to pick, Becky? I I don't really like this question very much. I'm going to I guess. I mean delegation is a big deal for B to B, so is trust. Delegated administration. So I don't see that there, but I'll go with policy delegation. Policy delegation. OK, let's see what the people think. Yep, most people are in policy trust frameworks. A couple of agents of chaos out there that are happy to blame the partner. Let's see what it does for our scores.

Yeah, we're going to have some blow UPS, I think. Yeah, here we go. Sorry, Carly. Oh, Mr. Renick. No, sorry. Thanks for playing. Keep playing. Everyone's still in it. A A has taken the lead. All right. What is the hardest part of role mining? Everyone's favorite project? Dynamic context over privileged roles, business ownership, or discovering that you've got 5000 employees and 6000 roles. That never happens, right? No, quadruple it. That's more of a common. That's right.

What what do you think is the what are you going to vote for here? If you were, If you were playing. Well, the hardest part of them, I guess, for me, ownership. Ownership. Definitely. Ownership, I see Jim shaking his head. All right, let's see the people think dynamic contexts. OK all right. And and there's only one truthful Lancelot here, which was the 5000 rolls. So, so the one person who has selected that, thank you for answering truthfully.

This is not the hardest part. That's the most realistic part. All right, a rod is now in the lead. Was quick on the buzzer that time. Let's get to the next one. Why is privilege access management for AI agents vital? Is it shadow AI model integrity? Data exfiltration? Or so Dave's bot doesn't accidentally delete prize. Everyone's. I always like the last answer best. Always thank you. You're welcome. Good job. What are you going to vote for?

Oh I guess, oh Jesus, all of the above data exfiltration or shadow AII would go with. So, AIA. I yeah, Exfiltration. Exfiltration. All right, Let's see what the people think. The audience says it is shadow AI. Yeah, I think that's a big problem right now, right? I mean, it's everyone is experimenting with these. Schools, it's a problem. People just don't know what's a. Problem. Yeah, All right, let's see what does for our scores here. All right, A a back in the in

the 1st. Is that a a Ron? Hopefully we got some key and pee Peel key, key and Peele fans here. All right, What is the main take away of the keynotes that we've heard so far this week? Is it future vision, strategic pillars, market direction, or new buzzwords to confuse the board? #4 always goes for me. Yeah, I was. Was it? IVIP is a new one. Ivip, Ivy. I call it ivip. Some people say IVIP. You know, tomato.

Tomato. Let's open up for voting, see if people think I think identity at the core was the theme for this one. You notice I didn't say because identity at the center was taken. And that's a lesson in trademark, folks. All right, let's see. Most people think future vision. Yeah. Where's Where's the industry going? That's a good message. Yep. All right. You think Holman's going to be happy with that? That's what the answers were, Sure. Yeah, got so much Holman, maybe Mike and Atkin.

Maybe. OK, All right. Yeah. All right. Let's see what it does for our scores here. Well, actually in the pseudo IMDU have blown up. No, very sorry. We're sorry. All right, let's see who comes up on the board. No. No background. Policy Enforcer Joker John is back on the on the leaderboard. Here we've got the Auth Enigma. That's a great name. Agentic AI is in the top five. Craig, you're still hanging around at #6. Craig, you're kind of lurking all the time, yeah. It could just.

All right, let's see. How do you measure I am success? Is it time to access automated remediation threat coverage or the Siso smiles? Just kidding, that never happens. The Siso never smiles. I do like that the answer though. Yeah, OK, yeah. Siso smiles. Let's open it. Up. I don't really just miss that last one, but I'm going to say threat coverage, threat coverage. Sounds smart. You're just saying all about risk, right? They're saying all the businessy

things. They're not in there well, but that's OK. Some Sisos are technical, some aren't. Or less technical I should say. I probably most people on time to access Yeah. How quickly you know, how quickly do you provision access right, things like that. OK, All right. We got about 5 minutes left. We'll see how many we can get through here. A rod first place. Who's Where's a rod? Yeah, where's a rod? Who's a rod? In the back as well. All right, a rod's going to go shopping.

All right. What is identity threat detection response ITD? Is it real time response? Is it signal sharing? Is it attack path analyst? Or is it just scrapping logs with a cooler name? What's What do you mean by graphing logs? So that's how you pull information fucking an Xbox graphing. Graphing, it's called. That's a nerd joke they make. How many people know what graphing is OK? All right, I clearly am. Shout out in the nerd class. Good, let's see what people

think. Real time response, signal sharing, Attack path analysis? How do you how would you define ITDR based on these? Choices all of the. Above all of the above OK, but all of the above is I'm like signal sharing. Yeah, that's how you detect. Yeah, let's. See what people say. Real time responses. Yeah, OK. I guess that's the detection part. Of the response, yeah. All right, let's see what it does for our scores. We've got a a. Oh, we lost Chris. Sorry, Chris, A A is on the

lead. A rod No. Back up there. Congratulations. All right, next question, what is the biggest lie in IAM sales? Is it fully autonomous, one click install legacy compatible or it's just one line of code? Let's open it up for Boeing. What do you think? Are you not allowed to say anything on this one? No. They don't lie, I. Have to deal with this so I. Love this card. Legacy compatible? Yeah. Number one. Let's see what people think. Fully autonomous, pretty pretty

wide margin. So if you picked legacy compatible and just went on code, there's a tie. So we might lose some people on this one. Little bit of hype on that. 1 All right, still in the league. All right, we've got about 3 minutes left, so anyone's game. What is your least favorite Gartner report? Is it the Magic Quadrant critical capabilities market guys or high cycles? Probably my favorite is going to be the least favorite. Your favorite is the least

favorite. Which I said before was critical capability, OK, but I just don't think people have read it. OK, so Jim, I'm going to put you in a spot. What is your least favorite? Garden magic fun you. You don't like magic fun. I said those my favorite. That's. Your thing you you like it and you don't like it. I like the image, I don't like the 60 page. The critical capabilities, all right, OK. Most people don't like the high cycles. Really. Is it really true or you? Have to pick 1 so.

I get it. I've got 4 choices. OK, all right, let's see if we differ our scores. All right, this is a little strong saying 20. All right, what is the best way to prepare for an audience? Do we use continuous compliance, automated evidence, policy adding or ask AI to generate plausible excuses? Which one do we pick? Which one do you like #1? Continuous compliance, gym, automated evidence. Yeah. OK. All right. I kind of like the idea of an AI. You're giving me a whole bunch

of excuses. We'll see, if anything. OK. Yeah. Continuous compliance. Yeah. They're right there with your denim. They're paying attention. They're going through your therapy sessions. Thanks. They're listening all right. Dad. All right, Let's see. I don't think you see changes here. Oh, John. John, you're coming and going. You're just kind of like in and out. Yeah. Like the wind? All right, what is the most

common lie in the vendor hall? Is it native integration, standard support, mobile scalability or best features on the road map for Q1? All right, what do you? Think I go with #4. It's on the road map, yes. Have you ever come across a product that did not have a feature on a road map? I haven't yet. So OK, let's see what people think. Is there any vendors in the room that don't? Say this, they're not that brave. OK, native integration, but a lot of people like the the road

map item. OK, all right, we're down to a minute left. A rod is still in the lead. A A is still right there. All right. Let's see if we get no just like that 20th spot. All right, what is the most dangerous access, right? Is it global admin, cloud owner root, or the interns test AI agent? Open up for voting here. Those interns are scary. Interns are scary. They're smart. Go Landon. Yeah, okay. You gonna go interns? No, no, I'll go globally. Okay, all right, let's see what

people think. Yeah, go away before with it. All right, we got 10 seconds on the clock, and I know that we're holding people off from lunch, so we're going to call it here a winner. Let's see what it does for our scoreboard. This is it. This is the winner. This is the winner. A rod. All right, where's a rod? Stand up. A rod. Where are you at? There you are. A densing AI. How do I know that you're gonna densing AI? All right. And then a a where are you? All right, all right.

Cool. All right, see us after class so we can get your information and get you valuable prices. Again, thanks to RSM and Signal for donating those to us. So it's very cool. Hopefully you had a good time. Again, I promised you wouldn't learn anything, maybe just learn something about yourself, which is really, you know, that's a great. That's a great story, right. Yeah, exactly. Enjoy lunch and thank you very much. And yeah, that's it.

Thank you very much everyone. You've been listening to Identity at the Center. We hope you've enjoyed the show. Make sure to like, rate and review, and we'll be back soon. But in the meantime, hit the website at identity@thecenter.com. See you next time on Identity at the Center.