Mark, you mentioned in your keynote that today we're in an identity crisis. I agree, but tell us a little bit more about what you mean by that and why you think the industry needs to evolve.
Yeah, I think partly what's happening is kind of three dimensions of the identity landscape that I think are changing pretty dramatically today, Cole. I think one is we would call it, I guess, scale, which is just the sheer volume — the volume of identities, the volume of those entitlements that those identities are trying to get to, or the application environments they need access to, and increasingly directly to data, whether that's large data sources like Snowflake or Databricks, whether that's LLMs. There's just this, on almost all those dimensions, just a sheer scale explosion. Almost the second we would refer to as shape — maybe that's not the perfect term, but I think it captures it — which is the complexity and nature of the identity landscape, which was at one point when we started the industry 20 years ago mostly employees, and certainly non-employee humans became part of that landscape: contractors, third-party contractors, and business partners, things like that. But then now, of course, the big hot topic is non-human identities, which we tend to divide into the machine identities — bots, you know, service accounts, RPA, you know, even some of the IoT devices — and then the world of agentic, which we all, I think, see as the potential largest tidal wave of all, and maybe a different kind of identity than we've ever seen before. So that would be the shape, and then the last would be the speed, right? The rate of change. So just the speed at which all these things are unfolding and changing. I think almost anyone you talk to in the realm of AI says, 'Wow, this is changing quarter by quarter, if not month by month, you know, not year by year.' So the scale of things happening, the shape of the identity landscape, the speed — that's together, we think, creating kind of an identity crisis, and then the industry needs to adapt by becoming far more real-time and dynamic in how we manage these things. Not kind of what we used to call admin time. Not every so often, 'Hey Cole, you changed jobs, time for some new access.' It's like day-to-day, hour by hour, maybe minute by minute, you might need different levels of access.
Yeah. Yeah. So some of that's been there for a while, like, you know, both of us have been doing this for a bit. You know, I know from the enterprise clients that I have worked with in the past that, like, the volume of the entitlements especially has always been huge. I think authorization is having a moment, though. Like, it feels like right now we're finally starting to care about that in a way that we never have been before. Like, talk us through that a bit and how that fits into the context of the three different dimensions that you were talking about.
It's a great point. Yeah, I think you and I have got some security background. I know a lot of our listeners will as well. You know, there was some confusion, I think, early on, especially in the non-identity deep parts of the industry, both security and even broader, to say, 'Oh, this whole SSO MFA thing is about identity security.' And you and I know that's the authentication piece, right? Which is, I just need to prove you're really who you say you are. Great, got it. Now you can log into a bunch of stuff. Matter of fact, I'll make it easy. I'll let you log into a bunch of stuff as long as you securely authenticated to me first. Now, Okta, Microsoft, Ping, things like that can get you in, right? Matter of fact, Cole, I don't know if this is helpful. We often compare this to the analogy of a building, like going to a New York skyscraper, right? Where you go check in at the bottom floor, you see a security guard, you show him your license, but once you go past that security guard, he's strongly authenticated you. You're in the building, which is like logging in. The security guard loses track of — he doesn't know where you go in the building, what floor you're on, what room you're trying to get into. To us, that's the difference between authentication, which is an important first step — can you even get into the building? — but once you're in the building, where you can actually go and what you can do, that's authorization. And to your point, that's where everybody's mind is shifting to because it's really protecting all that data we care about in our enterprise, which is in all those rooms, to keep the metaphor for a second, right? That's what's really hard, and it's just going to get harder when it's not a bunch of people trying to access that data. It's a bunch of these non-human identities trying to access that data.
Yeah, I think that exactly captures the nuance. I mean, to me, authentication is necessary and important, but insufficient for fully controlling access. Like, authorization is really where it's at. You've been doing that for a while, and you know the way that apps work and you know the way identities work. I think that's going to matter a lot more in this new world.
Well, and you're so familiar with the industry, Cole. I think another thing we've also had to educate folks that are newer to the space is, well, they hear about privilege and they think, well, that's important, it's really deep. And we say, if you want to keep our building metaphor for a second, that's like you have really tight control over three rooms in the building. You know, like privilege is super important in the enterprise today, but it's usually a very limited set of important things, like databases or Unix systems or Windows systems. But it's a very limited set of users over a very limited set of assets or resources. Again, the realm we're heading into, like you said, is much more the whole building, all the rooms and places where you can get interesting data. That's changing the mindset of it's not just a handful of things we need to tightly control. We really need deep controls over everything, maybe at a point in time, and that's going to change how we think about it.
Yeah. Yeah. Why do you see identity moving beyond just a security control to becoming a real business enabler? Like, this is a thing we've talked about for a while, and you kind of hear business enablement ad nauseam, but I think there's something unique and special happening here. I'm curious what your take is on why.
Well, again, I'll start with the human analogy because I think that helps people get it, which is, you know, the whole lifecycle management or the joiner-mover-leaver, these terms we've all used in our space for a long time, was sort of about that, right? Hey, you just joined our org either as an employee or signed along with a contract or a business partnership. Well, now I'm going to set you up with the access you need, right? Okay, great. That seems like an important thing to focus on. Let's do that. Well, that was an enablement function effectively to do your job. I've got to enable you to get the stuff you need to do your job, right? Well, I think again getting into that non-human world that's exploding all around us now, just think of the enablement that can happen if you have good controls and can do that rapidly and securely. And the lack of those controls may cause you to be hesitant and maybe overly cautious. And I told folks in my experience in this industry for so many years now, I've never seen a situation where I feel like customers have their foot on both the gas and the brake at the same time, right? They're trying to press the gas, go faster. We got to adopt these new technologies. They're going to change everything. It's going to make us more effective, more efficient, competitive in our business. And then the brake is just about as heavy right now with people going, 'Whoa, whoa, whoa. This is risky. We don't understand it. We don't know what this is going to expose.' So there's this sense of customers literally like part of the organization pressing on the gas, part is pressing on the brake. And I think that's the tension we're feeling in these companies.
Yeah, I think that's true. And I think the unique thing about agents specifically, if you've used any of the really good ones and the powerful ones, they kind of pull you into putting your foot on the gas, right? Like there's this different level of inertia there that you're not used to just using a regular application. Like it's innocent and it's addicting where they want you to do more and their sole purpose in life is to complete work on your behalf, right? And so, you know, that's the part that makes you, I think, want to get on the gas. But the flip side is that, you know, they can go off the rails once in a while and then, you know, then you sort of get pulled back into reality and realize like, hey, we do need guardrails on these things.
100%. Yeah. The whole — I mean, one of the funniest moments for me in the last six months, whenever I first heard the term hallucinations, I'm like, what? Like, wait, technology can hallucinate? Is it taking the wrong drugs? What's happening here? You know, but I think at the end of the day, this idea that you're right, it kind of draws us in a good way. A lot of sense like, oh well, if I change the prompt or the question or what I'm asking the agent to do a little more, I might get far better information. Like you said, it's in a good way drawing you in to get more depth, more insight, but then occasionally you'll find, oh, that was an insight that wasn't accurate. Uh oh, what do I do with that? How do I manage that? So I think, yeah, there's a tension there where people want to move fast to adopt these things, to learn, to get great insights from their data, and they're just not quite sure they totally trust it yet.
