Eliminating the Blind Spots Between Humans, Machines, and AI

Step one, you know, you [music] can't really protect anything that you don't know exist, right? And so the number one challenge for almost any [music] corporation in the world today is they don't know what agents and non-human identities they have. They might know some, they don't know all. And [music] so step one, what we do, and we're very confident in this, which is we have the most robust [music] mechanisms uh available to go find these agents and nonhuman uh identities [music] and the credentials they use in any platform in the world, right? And [music] so that's step one. Once you have that, then you've got to be able to watch them. [music] Watch them what they are doing and watch them in real time. It's like, you know, I always use the analogy of an adult supervising kids playing in a playground. It's the same thing [music] here. These are all digital, you know, adults or or kids playing around. They can mutate. They can go wrong. They will [music] they're supposed to follow rules, but they don't all the time. So, you've got to be able to monitor it at all times [music] and have policies that say when they drift relative to what they were supposed to do, stop them. And we have the [music] uh the proverbial kill switch or the ability to disable [music] them relative to the policies that a company has. That's that's in short how we solve this problem. I'll start by saying this notion of static privilege [music] is dead which is which is how the industry or which is how the world has been operating for the last 20 25 30 years right particularly because it's too it's too risky right uh I'll use [music] a very basic example to sort of illustrate the point you are you are here at black hat and this is a place where there are a bunch of [music] hackers around right and so you should be careful on anything any sensitive data inside your company you access from your mobile phone it could be breached right [music] and so basically moving away from static privilege it simply means every access [music] you have has to be evaluated for the risk you can't make the uh assumption oh it's you know Ashley she has [music] permission to access all this critical data she can access it anytime you know she wants because you could be hacked right and so this concept [music] of moving away from you having you are authorized to access anything you want at all times to [music] you have the permission but we're going to evaluate whether the context in which you're trying to access is actually safe that's really that's the [music] big shift we are doing and that means compliance you know has to be about what are the policies that govern what when Ashley [music] can access them when she cannot are those policies being followed you know properly so That's why we're moving away from check, you know, check the box, which is a manager certifying my the people that work for me have access to the following to are we truly putting in the guard rails and controls for making sure when they access [music] sensitive applications and critical data, they are safe to do so. That's [music] really the shift. The biggest blind spot is the fact [music] that it's no longer bad actors who are going to hack into your uh [music] corporation. Your own agents that your program build and deploy to automate tasks could go rogue, could mutate and start attack and start [music] doing bad things which is exactly what happened here. Open AI OpenAI um hugging phase the agent literally you know um escape outside the sandbox because the underlying model was so powerful. The same thing [music] anthropic released last week a public report saying they had three such incidents in the last week [music] or two uh but they wouldn't reveal you know uh who they are. So this is becoming very very common place now. So the biggest thing that people should be aware of is the ability for these agents, well-intended agents to mutate and to go role. So that's why this concept of you've got to understand the intent. It's not just policy that should actually govern them. You should analyze the uh intent [music] at which on what they are doing at all points in time. And this concept of in fact we have actually released this concept of an agent model code uh which is look humans we all have some morality uh that is no it's not like a hard rule individually based on who we are uh the way we were raised we all have morality so push comes to shove [music] we won't do some things because we will be like I don't feel comfortable that's not right agents are not that way they will do whatever it takes to get a task done. So that's why we are we are implementing this co this [music] concept of an agent model code. We are implementing it through policies and guard rails. So when all else breaks uh you know uh the moral code will be like wait a second I'm going to stop you now. This concept [music] of um zero trust and zero standing privilege has been there for a long time. In fact, it's been there for 25, 30 years. No one's gotten anywhere near it because operationalizing this is [music] really hard because it takes a few foundational things. Step one, you've got to know what [music] we call in security power lines have access to all of your entitlements, which are basically everything [music] you have access to at a very granular level. You've got to know what is the risk on the different entitlements a company has. then have models or platforms that can govern access based on risk, right? So you will get standing privilege to data and applications that [music] are not that risky, but you will have to be authorized in real time for anything that's you know high risk. Doing these things, [music] you know, it sounds oh you know just three steps you can do it. It's really really hard to do. And then training the users to be to be tolerant with the fact that you can't access willy-nilly anything you want all the time. Sometimes you have to be authorized and you could even be denied if you think the you know the context in which you're [music] trying to access is actually risky. Right? So it's the technology change and the business change. Right now the good news is on the technology side we have solved the problem 100%. You buy our you know identity security solution that we have launched now general availability it will automatically get you there. You still need to do the business change to train the users and to change the way you do certifications you write policies and all of that. That's where we are partnering with some of our largest partners [music] the global uh systems integrators because they are very good at driving the business change. We're also deploying our own forward deployed engineers to advise our customers to do the business change. So it's the combination of the technology being ready you know after 20 25 years we are [music] here I'm so confident uh and then we are partnering with the right partners to drive the business change but I leave you with one thought Ashley which is we are [music] taking it one step more right which is I call it beyond uh zero trust which is this this concept of autonomous identity think of it as a way more of the identity world it's a self-governing self-healing system because [music] in the world of nonhumans The ratios between humans to non-humans are 1 to 100. It could even be 1 [music] to thousand. So with tens of millions of these running around, you cannot humanly it's not humanly possible [music] to monitor them and govern them with the human in the loop all the time. So we're building a self-governing, self-healing [music] platform where there are other guardian agents that are monitoring what's risky [music] and are making and are making corrections automatically. So that's really the vision of autonomous identity. [music] More to come on it. But we are not only we have delivered zero standing privilege today. In a few months we will go beyond that and get to autonomous identity.