Well, hey folks, welcome to another episode of the Identity Matters podcast. I'm Mark McClain, CEO and founder here at SailPoint, and I am very privileged to be joined today by my friend Fran Rosch. Fran is the CEO of Imprivata, and as you'll hear in our talk today, Fran's done a lot of other stuff. So, Fran, welcome. Good to have you.
Thank you, Mark. It's great to be here.
Well, we've got some time together, Fran. You and I have known each other for a bit now, but let's even roll back a little bit. We're going to spend a few minutes maybe on some of the industry stuff, I guess, here first. Our Identity Matters brand here says let's talk about things related to identity. You've been in identity-related companies for quite a while now, like I have, and we've certainly seen a lot of things in and around the security market, the identity market. You know, was there a particular draw for you in this realm of security and identity, or did it kind of just evolve over time? Just kind of how did you end up in this part of the industry with so many options you could have, obviously?
Sure. You know, I have been in identity a long time. Really going back quite, you know, like 25 years-ish. Yep. I joined Verisign in 2000, which was obviously kind of early identity authentication, really PKI-based. I've rolled through there. And I think the thing that attracted me most, Mark, was that identity has got a lot about security, obviously. It's a cybersecurity program. Um, you know, it's escalating threats, all of those, you know, you got to stay ahead of the bad guys, which I like that. But identity's also a lot about user experience, right? How do we make it easy for the user to access applications and services? How can identity not be a barrier? And I think those two sides of that coin of I really like to think about user experience, and product design, and all those great things along with cybersecurity. So, I like identity, it's not pure cybersecurity, and that's really what attracted me, I think, initially.
That's, boy, you and I hadn't even, I think, ever had this conversation, Fran. I exactly mirror your thinking on that. I've always said to people the fun part of this part of the security landscape is it's not only about security, right? Like we are doing things that help protect the organization, protect the data, protect the individuals, and to your point, we're also kind of enabling and ideally, you know, even making quite a bit better the environment for the folks trying to get things done with technology in the organization. So, it is this dual value thing as opposed to, look, pure security of I'm just here to protect against the bad guys. That's great, right? We need those technologies, but there's this like, oh, we're doing that, too.
That's right. And then on that, by focusing on the user experience, then you can really drive productivity of the user base, which can lead to better business outcomes, more revenue for the customer. So, you're not only like an insurance provider of cybersecurity, you can actually help drive the bottom line of that company, which I think is exciting.
Yeah, that idea that there's this seamlessness, frictionless. We've all had these kind of thoughts of you're trying to make folks safe so they can go really fast to get their work done without either going fast and being unsafe or slowing down to be safe. It's kind of this tension we all feel, right? Like I want to enable you to get your work done cuz that's why you come to work to get stuff done. Like I say, nobody comes to work to be secure. That's not why they get to work, right? They come to work to get work done, but we need them increasingly with what's happening in the market, we'll talk more about it, to be very secure as they do their work and especially with the technology evolution we're seeing all around us today, um, you know, lots of reasons to try to keep them very safe. Well, let's talk a little more about your journey, Fran. Like I said, it's been fascinating. Particularly, your last stop before here was ForgeRock, an amazing story, you know, 400 I think percent growth, a SaaS transition, a few of us got to have those joyous journeys, an IPO, a sale into private equity. You and I have some very common heritage here. Um, you know, just tell about kind of what did this last chapter and even the chapter you're in now at Imprivata, how did it continue to evolve sort of what you see happening around us, particularly in identity?
Sure. You know, one of the things that those of us that are in identity, like you and I for so many years, we understand that it's really not been static. There's been so much change in the identity space, right? You know, we think of it used to be very much of a workforce, like how do we enable our employees? Then it became about consumer identity. We sometimes don't think enough about third parties and temporary access and contractors. We think about usernames and passwords being around forever, but there are so many different ways to do access management, authentication, identity now, going passwordless, doing risk-based approaches. So, identity has been this ever-changing, which, you know, part of the technology sector, it's just really exciting for me to always be learning something new and changing. And when I went to ForgeRock, my first time CEO, and you know, I always say you never know what's going on inside a company until you get inside a company. You go through a job interview and they say, 'Oh.' And then it's like it's very different when you get inside, but what I learned about ForgeRock is that it had a very solid technology stack. A lot of the identity came out of Sun Microsystems. So, it was a very like proven, large enterprise, scalable stack. Um, but it hadn't gone through a lot of innovation or refresh in the past. So, you know, I think as you come in as a CEO, it's like, 'Well, what can I do to really kind of refresh and focus the company?' And I think there were really kind of many different drivers at ForgeRock, but I would highlight three. First, there was really that focus on CIAM, or the consumer identity and access management, right? That was a growing space in the teens when I was there, and it just became so important for large finance banks, how do I make it easier to work with my customers? E-commerce, education, just everybody was looking at on that consumer identity, removing friction and improving security, like we talked about. So, it was great to be able to really dive into that CIAM. The other thing for ForgeRock was it was a pretty, you know, on-prem heavy piece of software. And so, we were hearing more and more from our customers, you got to get to B2C, you got to get to the cloud. And so, it was great to be able to rally the whole company around this one huge goal to get to the cloud and that's a lot what drove that growth you talked about. It was that ability to move, you know, to the cloud. And then, the third thing for me, which is very aligned with what you do at SailPoint, is the power of partners and ecosystem. And when these big organizations were going to roll out a brand new consumer identity platform, they were relying on partners and trusted advisors that they had. So, developing those relationships in that partner ecosystem, many of the same partners, you know, you guys use at SailPoint, that was really critical. So, it was really fun at ForgeRock to dive into that consumer space, that whole cloud migration and really connect with and understand the power of those partners.
Well said. Yeah, nicely said. I think that you're right. I think we all end up having philosophical approaches, I think, based on some of the stuff we live through. To your point, I lived through early in my career a great company, but had kind of had a partner orientation that they ultimately kind of said, 'Ah, you know what? We can make more money by doing some of this ourselves.' And they kind of pushed some of their partners aside and I saw the long-term, frankly, negative effects of that. And so, what philosophical void here and you had it there, which is like, we're going to be very partner oriented and never kind of turn on those partners because they're hyper-sensitive to that. Like, they know as the software vendor, you sort of do have kind of almost a first right of refusal on delivering the services around that, but you also limit yourself if you say I'm going to do all the services work. If you build a massive ecosystem to deliver your technology, you've opened up way more opportunity, but you really do have to get the whole company understanding these folks are an extension of our business. We got to treat them that way. We got to partner in a way that they always trust us. And inevitably there are bumps, right? Like, some folks in a deal get crossways, and because we work with multiple partners, just like you, well, I was friends with partner A in that deal, partner B brought me into this deal, so now partner A in this deal is a competitor, right? That's one of the hard things we have to navigate in our world, right? Like that old really helpful technology phrase, you got to dance with the one that brung you, right? Like, this idea that like, if I partnered with you here, I'm sticking with you here, and you'd want me to do that with you in the next deal. So, yeah, anyway, so I'm glad you mentioned it. I think folks outside our space don't know how critical that is to I think some of the more successful businesses in our space cuz it's very complex tech. It isn't drop-in and work stuff. You've got to have people that help you work it. So, yeah, and Fran, gosh, boy, we could spend a whole podcast on the SaaS transition. A whole lot of us went through. And we'll get to what's happening in AI, which is the next big wave, of course, it is. So, that's great. And I guess the last thing I find interesting cuz this is where you're an expert in a way I'm certainly not. We have a good healthy business in healthcare. Your business has had a really primary focus in healthcare for a long time. And it's such an interesting market because on the one hand, all of us as consumers sometimes feel like, 'Gosh, health tech can be pretty slow and backwards.' And yet, also quite advanced in other ways. Like, what do you see evolving particularly in this super dynamic space that you guys are so strong in? I know you do other industries now as well, of course, but that's sort of your historical focus. And just any interesting nuances you think are that you've learned about in the identity landscape particularly in the healthcare market?
Yes, it's been fascinating joining Imprivata and really digging into essentially a single vertical. We're over 90% healthcare as far as our customers, 95% from a revenue standpoint. So, we really have a chief medical officer, we have a chief nursing officer. We're really all in on that extension of how technology can solve for better clinical outcomes, better patient care. It's really our mission as a company. So, that's been great. And I didn't have a huge focus in healthcare before joining Imprivata. Um, and what I see from a technology adoption is that in some ways they are really behind. No doubt about it. Budgets are tight in healthcare, even though in the US it's 80% of our GDP, there never seems to be enough money. Uh, you know, having worked with some of the large banks where nobody had every security tool available. Um, you know, people are more choosy, more selective. But, it doesn't mean they won't do it if it can prove in value. And one example in healthcare, ambient listening. That went from zero to 100 miles an hour because doctors and nurses could very quickly see the benefit. Love, you know, very much healthcare there's burnout because they spend more time looking at the computer than they do the patient cuz they're typing notes and going clicking through Epic or Cerner Oracle instead of talking to the patient. And what ambient listening does was allow them to free up that time in front of the screen to face the patient. So, it's really adopted really amazingly very quickly. And bring that to identity, Imprivata made some really smart decisions back about 12, 14 years ago, long before I joined the company, which was to focus on these shared device ecosystem. So, in all my other experience with identity, it was much more like one user, one machine. You show up at work, you're given your computer, right? Or if it's your mobile phone, if you're a consumer user. But in healthcare, you could have 30, 40, 50 people use the same computer every single day. Um, or as a doctor, you could, you know, log on 70 times a day across a lot of different computers. And that brings a lot of technology challenges of how to do that fast user switching, how to log on the operating systems, the VDI, the browsers, understanding all those healthcare workflows. And so, Imprivata really kind of pioneered that shared user with a called tap and go with the badge, you get right into that healthcare record and removes that friction like we were talking about. In my head, yeah. And it really got super fast adoption. Again, healthcare will adopt if it brings value to that clinical outcomes, if the doctors, the nurses, the technicians are asking for it. CIOs are like, let's do it. But if they're not asking for it, it's really hard. It's, I would say, more than any other technology business I've been part of or our customer base I've been part of, the end user, the doctor, the nurses, they have a lot of power, as they should, as they should in improving patient care, on what gets implemented. So, we very much focus on that user to drive our roadmaps and what we do.
In some ways, you almost wish, cuz I know you've served across a lot of industries over your career like I have, you almost wish more industries thought that way. Sometimes like, are we really focused on technology that's going to advance the cause of this business's mission as opposed to sometimes we're all guilty of tech for tech's sake like, well, this is just more modern, newer, cooler tech. Like, does it really advance the mission? And that's such a, I've ever since I learned about kind of what Imprivata did like, oh my gosh, that's awesome, right? It's just so right down the fairway of you're saving costs, you're improving the patient experience, the doctor experience. Like, it's just a win-win-win, right? Like, and they ran away with it, like you said. They just ran away with that. So, super fun. Okay, and now we'll zoom back out again, Fran. You've been even more so than I across a broader array of identity, right? Workforce, consumer, some of these different use cases, but there's a common thread here and you've talked about a little already, which is a lot of what we do in identity, as we said, is enablement of helping people get their work done and also how to think about risk, how to minimize risk. What do you think is underestimated, especially in today's world as we're evolving so fast, about risk in the identity space? Why don't people understand as well as we'd like them to where the risk really lies in these identity ecosystems?
It's a great question and, you know, we think a lot about risk, you and I and people in identity and we have terms for it, right? Risk-based analysis, whatever we do, but I think that people still think of identity and I'm focusing a little bit more on access management, right? Which is kind of a commodity, is not as broad as what you're doing with identity. That's a valid point, but in the access management, I think people have gotten used to over the past 65 years of this concept of a username and password. You either have it or you don't, right? If you have it, you get in. If you don't have it, you don't get in. And we're trying to change that paradigm over the past 5 or 10 years and we did it for, I know Okta and Ping has been focused on this. You guys have as well, is that it's not necessarily that simple. What we should be doing is collecting a lot of different signals of user behavior. Having your credentials is just one of them, but looking at patterns of user behavior, is this their device? Is this their geolocation information? Is this their normal pattern? In healthcare, that really matters. Is this typically how that doctor and nurse, you know, acts within that healthcare system? So, that we can really develop a more of a complex confidence score that it really is the user we think they are and if they are, we can give them enough frictionless access. If not, we can kind of do more of that stepped-up authentication. So, I think it's like we always understand the risk, but let's make risk-based decisions by not just looking at one thing, but a collection of signals over a period of time to really help our customers make the best choices on access management decisions. And, you know, because what we know is that a username and password is not secure. And it's stupid that we're still talking about phishing. Um, but with AI, you know, it's only getting more compelling. So, let's not rely on that as the sole access management credential. Let's take that risk-based approach, and that's been building in the industry, and I think it's really coming to the fore here today.
Yep, and perfect segue to where I want to go next, cuz to your point, this concept we've been talking some about a term that we'd like to see the industry adopt more, which is adaptive identity, right? Yeah, like you said, so much of what we've done is static. It's like I'm going to set you up, I'm going to configure you correctly, especially as you said, in most of the world it's a one-to-one. So long as you have your device and your password, you can get in, right? And like you said, this idea that there's all kinds of context, and in some ways, there's additional static context, meaning where are you, what device you're on, things we didn't even ask. It's just like, do you have a password? You're in, right? But now, like you said, I think the fast emerging part is the behavioral context, not just all the static context of what device you're on, what network you're on, where are you located, blah blah blah blah blah, but is that the pattern of behavior I've seen before? Cuz that could be a signal that something is awry, you know? I always like to say, if you go back to that very, very famous at the time Snowden case of the guy who exported lots of data to the Russians, right? Like, he was a legitimate user on a computer he was supposed to be on, on a network he was, everything was normal, except his behavior all of a sudden went nuts. He's downloading massive amounts of data that should have thrown a flag to somebody, right? Like this is behavior that I should not be seeing. What's going on here, right? So, to your point, Fran, this context, all the words you said, I think that's the next wave. And now we'll, you know, good for us. We're 15 minutes in and we're really getting to AI now instead of in the first 30 seconds. And just one other point before we jump to that AI. What we see, and many of us see, is that ultimately all those other risk signals become so accurate and so valuable that you can then actually do away with the password. And it's just move to passwordless, which I think is what we've got to do as an industry. And I think biometrics have a big part of that. You know, we rolled out like a facial biometric solution. So, we call tap and smile.
Your doctor can just like tap, smile, and they're in that system really quickly. So, I think it's this, you know, this risk-based approach, this... Yeah. Uh, you know, gets us away from that password completely, which improves the experience and improves security cuz it can't be phished and whatever users are going to know it. So, uh, I think it's an exciting time for us.
Can't be phished and I will stay very shallow here cuz I can only go shallow here. And with quantum, it can't be cracked cuz the other thing we're all worried about is this whole massive, you know, under the iceberg, you know, of millions, gazillions, billions of passwords that are all over these systems, what if all of a sudden they're not at all safe cuz they can just be cracked with quantum computers. So, we got multiple dynamics going on in the industry, right? That like you said, all of which are forcing us to say there's got to be a different way to think about this whole problem than a password, like you said. Um, yeah, okay, fun. Thanks for bringing that back up. 100% agree with you. Um, on the AI thing, I think what's interesting again is we all know massive technological shift in our industry, every industry with this technology, generative AI particularly. Obviously, you know, for computer science fans, we all knew, yes, AI's been around a long time, but generative and what it's allowing is a pretty new thing for all of us. But I think what's really interesting, Fran, in that this identity part of landscape, again, so many interesting aspects of this technology, is but what about these quote non-human identities? So we've been mostly talking about humans and their phishing and passwords and all that stuff. And now we're going to have a whole lot of identities that don't log in because they're not going to sit at a keyboard. They're not human. Right? And I think that's the next obviously very significant wave happening in our industry as an identity industry, right? And again, whatever perspective you want to bring here, the perspectives you've come from, your particular perspective in healthcare, just the whole realm of this new explosion of non-human identities. What do you think that's doing in our industry today?
I think it is a blessing and a curse. Um, I think it's going to introduce a lot of benefits, particularly in healthcare, um, but it does risks as well. And the example I would give is around writing and refilling prescriptions. So right now within the healthcare system with HIPAA rules, there's a very specific process you've got to go through to authenticate a doctor before they write or approve a prescription. Um, there's a program called EPCS, the electronic prescribing of controlled substances. You've got to follow all these things, right? But there's a lot happening where instead of doctors going to refill the prescription, they're going to have an agent do it for them. And that agent is going to log in and they're going to make the decision. The agent, the AI-driven agent is going to make the decision on whether that prescription should be rewritten or not. And so that's like what? Okay, maybe that's good, right? Because we are seeing places in healthcare where, you know, in radiology, there's some examples where the AI systems are doing a better job identifying cancers early. Yes. There is a lot of these benefits to that. And, you know, doctors are really busy, nurses are really busy people. They're over subscribed, right? They work in really, if you've seen The Pitt, I hear it's like really realistic. They work in some really tough environments. So, as this AI can help them make better decisions, that's great. But, when they turn over the decision-making to the agents, how do we know that? How do we know that it's the agent making the decision and not the doctor? How do we know like do you still have to have the doctor or the nurse involved at some point to do a double check? Um, so you really got to have an identity access management system that looks at those agents as independent players within the ecosystem. Um, it's just like we have to have high assurance that that user is who we think they are and they have permissions to do this activity, we need to do the same thing. And I think it's early days, yeah, a lot of looking at it and, you know, Mark, I'm kind of two minds of this, you know, having been around many, many, many years in the space, and I remember in the 2000s there was a lot of talk about, you know, uh, IoT. And the identity of things and everything was going to have an identity, right? We solved that as an industry a very different way than we solve identities for people. And much simpler, much cheaper, much easier in a lot of ways. So, when we look at these agents, I wonder are they more like people or are they more like machines? And they're neither. And I feel that they're leaning more toward people cuz they're making these independent decisions. So, I think it's really interesting time in general, it's a very interesting time in healthcare. We want to embrace the upsides of it, but also understand we can't have these rogue, you know, like if the wrong prescription gets written... Who's accountable? Who's responsible?
Who's accountable? That's why we always say what we're sure is going to be true of the great majority of these autonomous agents is some human will have to take responsibility for that agent because to your point, if in an environment, that's a great example, I wasn't even familiar with that one, Fran, like, well, if a bad prescription gets written and something bad happens, you're not suing the agent, you're suing the doctor, the hospital, whatever, right? Like, there's... You're going to get a lot of this.
100%, 100% and a lot of lawsuits and a lot of... What we know is true is we will hold some human up some part of that chain of command accountable for something if something goes awry. You can't say, 'Oh, not my fault, the agent screwed up,' right? Well, sorry, that agent was taking action on your behalf, right? So, yeah, I think in the autonomy, you said that word, I think, yeah, the autonomy is what makes these things so interesting. It's the hybridness, so to speak, of, right? Well, they're not exactly like a machine cuz they can morph and learn and change, but they're certainly not reasoning like a human. I think we're all trying to figure out just how reasoning is AI at the end of the day, but um, there's this weird like you said no man's land where some of the disciplines will still apply, but how we enforce or make these things work in the environment is going to continue to evolve, like you said. It just, you know, yeah, in some cases, there will be a login-like process, in...
In other cases, there really won't be a login exactly, and like you said, static, I think is one of the biggest things that's going to shift here, right? There will be such ephemeral... you didn't, you never signed identity to people very often and assume they might have it for seconds or minutes or hours. Like, you're going to be in this job, Fran, for years. Here's all your accounts and passwords to do your job. What if these agents like literally ephemerally only exist for seconds or minutes and only need access for seconds or minutes? How do we manage that kind of concept? So, I just, there's some fascinating things happening in our space, so it's really fun. So, any other thoughts on identity because I was going to shift this to some culture and leadership topics, but didn't want to get off too soon.
Yeah, I would just say the last one on that AI. I really feel like, you know, that old adage of kind of storming, forming and norming. For sure. We're in that storming phase right now and I think we have to be okay with that. Like we don't have all the answers, but that shouldn't stop innovation and people experimenting and trying things because I worry we're going to get, you know, the compliance people in too early. And so we're really trying to encourage people within Imprivata and within our customer bases, let's experiment. Let's try things, see what works and then we can kind of formalize it and make sure we have the right security identity controls around it.
100%. I can't remember who else was involved. Of course Elon's name sticks in my mind, but there was that effort a few months and maybe quarters into when we first started hearing a lot about GenAI, hey this is moving too fast, it's out of control, we need to slow down. And very quickly there was a reaction from the industry like look, the bad actors who are not subject to regulation and things are not slowing down. We can't slow down all the quote good actors. We're just going to fall further behind because as you said, I get the is AI good or bad for your industry? And I say yes, right? Like, you know, both and, you know, we know it's enabling the bad guys to do what they do better and it's certainly going to help us we think fend off those things and like you and I said, make people more productive, get them better tools, all that good stuff. So fun. Yeah, I like to say in baseball, and I know globally people don't always know baseball, but like we're barely even in the bottom of the first inning. We, I think we might be in the top of the first inning. This is so early in this game, right? So we got a long way to go. Well, listen, this is awesome. I wanted to shift us because again when I get folks with again some seasoned leaders of many years, decades even, you know, it's fun to talk about you've gone through IPOs, acquisitions, you know, lots of stuff, organizational changes. You've been in very large companies, pretty early stage companies. Let's just kind of talk some leadership stuff. What are some of the key leadership principles that you've kind of honed in on at this, you know, later stage of your career, not at the end, obviously, but later stage of kind of hey, you probably got some pretty strong views on what good leadership looks like.
Sure. That's a big question. I guess, you know, I've had a chance to take on some big different jobs over the years. And what I would talk about maybe to start out, I feel like leadership as you change jobs is kind of following a pretty solid process. And what I mean by that is I think as any leader, your first obligation is to listen and learn. And even though I am old and I've been around, I got a lot of experience, I do recognize that every environment I walk into is unique and different. And there are a lot of people who have been there and they care about where they've been and so I always try to spend the first whatever it is 30, 60, 90 days just listening. You know, I listen to my employees, going out on the road and talking to customers, partners. Just trying to say like don't jump to any conclusions. Don't bring all just your history. Listen and write down and read back. And I think a good old-fashioned SWOT, right? Like this is what I heard, right? Here are strengths, here's our weaknesses, here are opportunities and threats. And get acknowledgement from everybody. And kind of like close that process. Okay, we're done that. We never stop listening, but like we're done enough. Now let's go into our brainstorming. Let's say, okay, given that's where we are, we know all of these things, let's really define the next step as this brainstorming. Open the aperture. All ideas are good. Throw everything on the whiteboard, you know? And then the third process is kind of like narrowing it down and then aligning it and selecting a strategy. Like for ForgeRock, it was like go after that time space, move to the cloud as quickly as you can and engage those partners, right? With Imprivata, it was okay, we've got this great tap and go. But we had a lot of customers using it. What are the other technologies in mobile and third-party vendors? What spaces look like? Lock that strategy down and then drive that execution, right? Like and as a CEO, I love an operating cadence, right? To drive that execution across of that. So, I think it's a good thing to take each one of those steps separately, complete them, and kind of move on and constant communication through all of that. And that's, you've obviously been at SailPoint for a big part of your career. I've had a chance to kind of move around. I feel like when I take that with me, it seems to resonate with the team and end up with a better outcome.
