Who Has Access to What? Identity Visibility and Intelligence Explained | Christian from Elimity

Hello everyone.

Welcome back to another episode of the Security by Default podcast.

I’m the host of the show, Joe Carson and it’s a pleasure to be back with you all again.

Always my favorite time.

It’s my favorite part of what I do is getting to talk to amazing people and learn and I’m really excited about today’s topic because it really drives home one of the areas that I focus on and specialize in, which is all about identities.

And I’ve got an amazing guest joining me today.

So Christian, welcome to the podcast for the audience.

Maybe since it’s the first time in the episode in the podcast, maybe you want to give the audience a bit of a background about who you are, what you do and your origin story, kind of, you know, how did you get into the industry?

Did you choose this path or is this a path that was kind of given for you?

So looking forward to hearing your insights and background.

Fantastic.

Joseph, thank you so much for having me.

Super excited for the things we gonna discuss today.

Yes, short.

Short background or short.

Who am I?

I’m Kristen and I’m the CRO at Alimity and for within the industry, or especially within the cyber industry, more than 10 years.

So started quite early.

So yeah, maybe to start from the beginning.

I’m originally from Germany and in Germany we have something quite specific which is called a dual study program.

So after university you can either go normally to university, you study for three or five years, you make a bachelor or master.

What we have in there is you go, you do the same stuff as a normal student does within three months instead of one semester.

And those three months you’re gaining, you work for corporate, hence you gain real life experience.

And it was a broader study program regarding business informatics, something like that.

And quite early I realized I was drawn to the.

I ended up with my first, first project within the IT governance.

So quite closely related to, to cybersecurity.

And it was something like you always say with a lot of the wings when it, once it gets a hold of you, it never let you go.

And from then I was drawn to that kind of thing.

I stayed with the company, I had my, my first job there as a security analyst.

And at the end when I left the organization I was the C. So I’m originally from the other side of the table and then I am, I gradually moved into more commercial roles and indeed at the moment part of the limited team and leading the commercial side over there, but also with a really product focused angle let’s say as I used to be on the customer side, of course.

So that’s why I always love to have those kind of dual position from the visionary part, from me having the boots on the ground in the role that the customers I’m serving today now.

So I have with them all a really close relationship also from strategic perspective to see what is next, what we can do also of course beyond the scope, what we do at Elimity.

Fantastic.

Tell me a little bit about Elimity.

The company itself, what does it focus on?

Where’s the base?

What type.

Of.

Customers do you look after?

Yes, so at Elimity we are in the space of identity, visibility and intelligence.

So IVIP or IBIP depending how you pronounce it.

It’s a rather new category.

Gartner defined that last year.

We are in that business already for more than seven years.

But basically what is it?

It’s.

It’s giving the customer an extremely fast and easy overview in who has access to what within the organization, combined with approval control so that you can prove to order, that you can prove the security that you’re having that.

We are a European company, we are based out of Belgium, but we have customers all over the globe.

Of course there’s a natural focus at the moment at.

At.

At Central Europe, but we have customers in North America as well, those kind of things.

So it’s.

It’s a bit all over the place.

And from an industry pers, let’s say we have a quite diverse part of customers.

But I would say the more organization has.

Yeah.

Not troubles, but is in a regulated business, let’s say that’s where they get the fastest benefit out of alinity.

Right.

Think about financial institutions.

Of course there is the highest regulation, there is the ISO certification, there is the Nistu, there is the Dora, of course in Europe in that regards.

We have also naturally a lot of service companies or software companies themselves that are due to supply chain regulations need to have a certain level of security, but on also defense based, those kind of things.

So the more regulated the better.

Because then that kind of provable control becomes even more relevant for those kind of customers.

Absolutely.

It’s.

Something that they have to do.

It’s not a choice that they want to do.

It’s that because of regulation and the proof of security controls, especially for governance and compliance, it’s a must.

Have ended.

So there is also the public sector, we have quite some organizations over there.

There are airplane control systems, those kind of stuff.

So it’s quite broad.

But the system or the challenge that we’re solving is also a broader broad one, let’s say.

So in that kind of regards it really helps.

Fantastic, that’s great to know.

And that’s one of the main themes today is all about identity security.

A lot of organizations, the question always comes into is, is what types of use cases you mentioned governance compliance.

Whenever they’re starting getting back to the basics and they start realizing that we need to do something and they may have done something in a point solution for some time.

Maybe it was Entra and that’s where their identity provider is and they’ve been using Entra and they start realizing okay, this is not sufficient enough for what we need to be able to do.

Because they might have multiple clouds, they might have SaaS based applications, what type of company, what’s the type of maturity they need to have and when do they realize what’s the type of challenges they have when they realize they need to go beyond some of those point solutions.

That’s a fantastic question because there are actually we have two customer segments in that rank regards depending on the maturity.

So we call them the we have for the one hand side we have those low maturity customers.

So those are exactly the ones you just described, right?

They know identity is an issue.

It’s either from a regulation perspective or they say, okay, typically the setup is we still have active directory on premise for certain stuff.

We try to move to Entra but it’s somehow a hybrid setup.

We don’t really have the overview anymore and we really need to, we know our identity maturity is low and we need to make our first steps and then having that kind of 360 view who and access what to see where the risks are, where the identity attack surfaces, where are my privileged accounts.

To just know what really the issue is and also kind of to measure it, right?

Because if you’re, if you cannot measure it, you cannot control it, then it’s always kind of a more a stomach feeling of someone who says I know those kind of issues.

And that’s quite interesting.

Whenever we deploy that we have those encounters, right, that they see.

I knew that Thomas had still access to that.

I always knew it.

But now I can prove it, right?

Because it’s not necessarily new information that you’re getting because you can go in all those different tools by themselves and figure out where the exit is.

But it’s just so much effort.

And we all know especially in cybersecurity, our life is so busy, it’s rather more work than less work.

Pressure is rising every day.

There’s something coming up, of course AI can help us.

On the other side, AI is making our job harder because just the sheer amount of volume is getting higher.

So you need something that makes your life easier.

So that’s the one side, let’s say, of the puzzle that we’re having with the customers that want to make their first step into maturity.

So if you’re an organization, I would say starting even from let’s say 100 employees, then it becomes interesting if you’re way smaller.

If you’re a company with 20, if you’re a startup with 20, 25 people, I would say okay, you can track that with the Excel file.

But as soon as you are, if you have a certain maturity, people start moving fast or you have to onboard a lot of people, then it becomes interesting that you have that kind of overview.

And then especially also regulation is making it more complex to track those kind of things.

So you want to have something automated.

On the other side we have those, we call them high maturity customers.

Those are typically big enterprises and they typically would here and there are some M and A activity, but I always say they won’t shock themselves due to every magic quadrant that is out there from Ghana.

Right.

So they have one or many TAM systems.

They have typically one of the latest IGAs, but there is still some legacy IGA somewhere.

They have 45 active directories.

Some of them are connected, some of them not.

Sometimes it’s one entra tenant for all different legal entity.

So even though they have a higher maturity and they have a way advanced tech stuff, the challenge is exactly the same as the customer segment we just discussed.

They don’t have that kind of 360 and they need it.

And of course, of course there might be some things we can get from the iga.

So there is some information already aggregated so it might be less connectors that need to be done, but it’s exactly the same challenge.

And also then of course as those enterprises are typically a little bigger, the question of self service arises.

Wayne Right, because then typically the identity team, as with all security teams under stuff, there are way too many questions business asking I need to know who has exited that kind of application.

And they say yeah, I mean typically a person is then busy answering those kind of questions and we would love to push that back to the business and offer them something self service.

And then again IVIP is a great part, especially now what we just released with the possibility to connect it with MCP towards your own LLM of choice.

It can be your local LLM can Be your trusted LLM, whatever that really opens that kind of gate in a really user friendly way.

Right.

So instead of saying here, Thomas from Identity, can you please answer where Mark has all access to and he has to kind of start looking those kind of things up, start building queries and all those kind of things.

Freud and all those different tools, you have Alinity there.

You connect it towards the Microsoft copilot if that’s their LLM of choice or if it’s Mistel or Claude or whatever and they say just ask the question to your agent and it will figure it out for you.

And that we see now that takes a lot of risk, not a lot of risk but a lot of burden, let’s say from those teams so they are able to focus again what really matters on the strategy, how to move things forward, how to get to the next compliancy level, how to decrease the.

I had the attack surface, those kind of things.

Absolutely.

And for these organizations, let’s say the first time and they reach out and they say hey Chrisim, we need help.

What’s the first starting place?

You know, who is the people that tend, who needs to be involved and what’s the main kind of initial roi?

What are they trying to achieve out of it?

So what’s the starting point?

What’s a good place to get started for this?

Well, it depends always a bit on the customer, right.

And also on the use case and where you’re ending up in.

Of course there are those customers that come to us and they say yeah, we literally filed an audit.

The Federal bank or the national bank or the European bank said if you don’t get that fixed by XYZ you will have trouble with your license.

Those are, those are, those are customers that we seeing.

Then it’s always really a talk.

There’s the ROI is really clear.

They have to prove that they’re in control and they have to prove within a certain timeframe.

And those projects are no brainer.

They are of course, let’s say not my favorite projects in the sense of it is always more lovely to be there before that that those kind of situations don’t occur.

But yeah, as we all know, some organizations don’t learn the easy way and they have to learn the hard way.

There’s also sometimes organizations where we are in contact with the Identity team or the CISO for years, right.

And they know that they need it but they don’t get the budget for it.

And suddenly then that kind of external factor comes and then they get asked why Is it not fix?

And they said yeah, we asked him for that for years.

Those are situations where we come in, but typically, let’s say it’s really about security and compliancy is an issue.

And nowadays also with the evolution of AI and I think we’re going to touch upon that more often is that the identity is a new attack surface.

I think that’s something we heard for the last 10 years, but now it’s really happening.

And also I feel like a little bit in waves, right?

So when I look back into the beginning of the year, it was all about what agents and those kind of things.

And we also see a lot of companies, we also do something in that space, of course about how to manage your identity, your AI agents and what is the identity of them.

And of course they are also identities.

But what we see just today in practice is we talked about our mcp, but the kind of MCP evolution of all those kind of tools and what is happening there is, what we see is, is it’s everything on behalf of the user.

So the kind of issue that we already seen for last 20, 30 years, even historically grown environments, historically grown roles, active directory groups and roles, this becomes really now a burning issue.

While before a user, as we say, typically doesn’t use 90% of the access rights, now you give that to an agent and the agent doesn’t care whether or not the context makes sense or not, in that sense technology is neutral.

So whether you supply an agent with context and it’s a context that I’m as Christian have all access to, well, it will act up in that kind of context, right?

So if I ask the question, can you tell me what my coworker is earning or why my co worker is sick?

It’s not that kind of.

There is not a kind of consciousness of that you say actually is that an ethical question to ask?

Yes or no.

If there is the context provided it will be assumed that that’s allowed and will give a kind of answer.

So that kind of that issue just becomes way more burning, right?

That it was the last, let’s say the last years and especially I would say the last 10 months, I think since beginning of the year and now the last three months where every tool gets their MCP and business asking are less connected because there is tremendous value getting all those kind of things together.

But you need also to enable those security teams to do it in a secure way because you don’t want to have a data breach, you don’t want to have those discussions internally.

If someone, everyone knows each other’s salary, that’s a different discussion if that’s good or bad, but you will face that.

Or suddenly the external consultants can see the board presentations or something.

Those are things that especially again highly regulated.

If you think that further think about stock listed companies.

If they’re information is released that will trigger away the questions that only may be unpleasant.

Internal data breaches that can have effects on the stock prices, insider trading, those kind of things.

So the question who has access to what becomes way more relevant just because suddenly it becomes accessible by machines.

Well, the risk always has been there, but I always say it.

People, they work consciously, they have ethical norms, usually they’re busy jobs so they don’t try out what kind of fault and for all as I can figure out in SharePoint.

So that won’t happen.

But with the trend that we see nowadays, that’s just naturally happening.

And that’s something you want to prevent, right?

Absolutely.

I do think AI agents are not really in reality the new internal insider risk.

Absolutely.

It’s something that we all and absolutely to your point, I think we’ve seen the evolution of identity over many years and I think we’ve got to the point where some areas we got maturity and then some new technology came out that kind of disrupted it.

You know, for many years it was users, it was humans using identities, access systems and applications and so forth.

And then we had the evolution and we got pretty good at managing that.

Then we had the evolution of cloud and bring your own device computing and therefore we had to diversify and we had new challenges of, you know, now we had multiple clouds and I think more in recent years the, you know, the rise of service accounts, you know, applications running behind the scenes and APIs and, and code is infrastructure type of, you know, a lot of those have meant that we’re started seeing not just the shift to service accounts, but the shift of dependent service accounts that were basically running larger systems.

And of course now you know, with the rise of agentic AI that move has become, you know, accelerated more.

So I just feel sometimes we just got good at doing one thing.

I think we’ve really got a really good handle at the human side of things.

But now that non human identities have just escalated and accelerated so much, the solutions that were designed for the human side don’t really easily fit well in the non human side.

And therefore we’re having to think of just in time ephemeral identities that just get created for these single purposes and then also just how to scale in a way that’s astronomically way more non human identities than there is humans.

So that’s the other challenge.

Challenge.

No, I agree 100% and I also still think I agree what you said, that we figured out the humans.

But that’s also in theory when you look in practice, there are so many organizations that still have to the solutions are there, the kind of things that are there, but they haven’t reached that point yet that they make use of the technology, of the process and all those kind of things.

Because at the end of the day, security is always a supporting function.

And especially now, there is also a natural reason why we have plenty of organizations that are highly regulated because they get the budget.

But that means all those, let’s say less regulated organizations, they also still need to catch up.

We also talk with those kind of CISOs on a daily basis.

And for them it’s really a struggle to get the budget, especially as we are now in, let’s say economically, if you open the newspapers, they’re not in the best phase at the moment.

It’s not exploding budgets and people getting everything they need.

It’s rather, okay, where we can we save on all those kind of things.

And if it’s, if there is no regulatory pressure, I get that the board will say, okay, maybe we kind of postpone that kind of thing and we have a certain risk appetite and we’re willing to take that risk.

But also there I’m always telling those CEOs, yes, that’s true, but it’s also kind of a life insurance, right?

Not only for yourself, but also for your job, but also for management.

Right?

Because imagine you get compromised, you get hacked for one way or another and you let the forensic team come and check and they figure out, yeah, actually you got reached by an account from an employee that isn’t working for you for three days, three days, three years anymore.

We have those kind of use cases, right?

And then also no cyber insurance will pay because they say that’s negligence.

That’s negligence.

You didn’t do your job if that’s the case.

So you can be perfectly insured.

But as we all know, insurances are in the business of not paying.

That’s how they, they are profitable.

So those are really the basic hygiene stuff, right?

So that.

Even.

And insurance companies also want to make sure that they’re only ensuring the companies that really actually are doing the things because more likely if their customers are putting the right controls in place, the less need that they might actually have to actually utilize insurance because they’ve gotten the right protection in place or the impact will be much, much less.

So even when they do need to use insurance, insurers more willing to pay out because they were able to reduce the financial impact of such incidents.

Absolutely.

So, you know, a lot of times, even when you’re getting insurance is the requirements are very similar to, to governance and compliance is that if you don’t have these in place, a lot of the ones that feel are the ones that do self assessments.

So insurers that says you do a self assessment, go and tell me that you’ve made all these check boxes and if you don’t do your due, your due diligence on that and you neglect to be honest and have the right controls in place, that’s the organization that’s going to be impacted with the insurer not paying.

It’s the self assessment ones which are always highly risk.

It’s just for that you need to know and you need to be shown that you did your homework, right, that you can,.

In.

Case something happens, you say, okay, shit happens, right?

There are only two kind of companies, as we know, the ones that have been breached and the ones that haven’t been breached yet.

However you want to be, be that organization that can at least prove.

But we did our homework.

There’s really something extraordinary happened and it’s not one of those kind of really basic things that it’s an orphaned account from a service provider or from something that kind of risk is covered, which will also invest, of course personally cover the CISO in a way or the security team in general.

But indeed then like you said, always also make sure that if you have an insurance, they say, okay, we step up for that.

They discovered because you went above and beyond or you at least are compliant with all those kind of checks and having them in place.

Absolutely.

And one of the things I do find as well to your point is in economic scenarios it’s always challenging to get more budget and organizations are having to be more efficient, more resourceful, more strategic into how they apply their budgets to technology to help the companies move forward.

And it’s always the ones that get sacrificed, which are the ones that don’t add Some type of return on investment, you find it.

If a CISO is looking at identity security as a cost, they probably are not looking at it in the right mind of the right return investment and strategy.

Because what I find is that if they look at identity and they apply it right, it becomes an enabler for the business.

It becomes something that if they’re doing mergers and acquisitions and they had to onboard many employees or they have to onboard new systems and technologies, a very mature, very strong identity strategy can help accelerate a lot of those.

It makes it much easier, they can move faster.

So I do see that CISOs who do see identity as a business enabler and also a great way of getting additional budget for maybe the other things that you might want to do, maybe multi factor authentication, maybe it might be, you know, a cloud solution or something that, you know, IDDR to be able to do threat intelligence.

It’s a great way to be able to fund a lot of those other initiatives if you can tie it back to the business outcomes and business impact.

And it’s one of the things that I do find as well.

If you go through, it’s also the right solution will also take away a lot of the friction from employees as well.

Absolutely.

Because a lot of these identity solutions that go out there, it causes friction.

It’s employees that can’t get access systems, it takes them longer, they have too many steps to get into a system and that becomes a friction.

So they look at security as this enforcer.

They’re making it challenging for them to do their job.

But the right solutions in place, the ones that take away friction, I always call it.

We talk about zero trust.

I always say that the biggest importance is zero friction is you want employees to enjoy using the solutions.

And identity can be one of those enablers if it has the right, you know, one is involving the employees early in the decision making as well.

So they see what’s coming and they, they know how to use it correctly and they had the right training as well.

100%.

No, I agree on that kind of thing.

So indeed it’s the one hand side, it’s indeed the business enabler part.

So we need to be able to do that.

And also of course the, the roi, that’s the ever ongoing discussion in cybersecurity.

Right.

How, how to.

If there are of course certain kind of solutions, certain kind of things where you can build up the story.

But that is the, the huge difference between cyber security and some other business case.

It’s not that you say ah, if you invest that this will give you, you save so and so and so much so and so much of €100,000 or whatever.

It’s always also when nothing happens, then it’s good or bad.

So that’s, that’s the kind of challenge we are always facing.

But I agree especially on the kind of enabling part and also the way how to do it.

One of our customers, they call it, I really like that freedom and the frame.

So they say, okay, they have a lot of M and A activities.

They have a lot of different countries with different organizations.

I said, okay, we are not there yet and probably never will be there that we are able to put them into a certain environment that everything has to go to our central organization.

However, we are responsible for them.

So we at least want to know what’s going on there.

Right?

And then we can kind of see them.

So we give them a certain frame to operate.

But in that kind of frame they have a lot of freedom to do business and to onboard new applications, those kind of things.

But if they’re on board, we want to at least know who is on there, what are the risks.

Correlate the data to see this increases the identity attack surface or it will reduce it.

So that’s something where I would say that is a really cool one.

And also like that kind of part, right?

Because if you’re not pulling up more walls and increasing the friction, but rather like you are actually able to tear them down here and there, as you know.

Okay, okay, this is not critical.

This is easy to go and we know what’s going on and we can give a certain entity more freedom that they do their stuff.

As long as we know what is going on there, are we able to control.

Control?

Absolutely.

And just kind of one of the things that I’d like to cover a little bit more as well is the outcome side of things as well is when an organization does get a solution like elimity in place and something like also with a privileged access the likes of Segura, what does their environment end up looking like if they get an audit?

How quickly can they respond to those challenging questions?

So what does the ideal scenario look like?

What are those companies able to achieve when they have everything?

Kind of, that’s,.

That’s, that’s.

A really.

Cool question.

Those are also my, my, my favorite conversations with customers.

Right.

So that there is indeed from, from an audit perspective, they really save hours and days and time.

Right.

So there, there’s, I always call it a bit the prior MCP phase and the phase that we are now with the just released module.

So before already they prepare their queries, they have those kind of things out there.

And I talk if someone asks that they go to the tool.

They either give access to the tool to the author themselves or they just download the replay port over they go.

So something that would cost them.

Yeah.

Sometimes days or weeks at work is really done within a half an hour nowadays now.

We have which.

Which is an amazing roi.

I mean you.

It’s an amazing.

And it’s.

Cost of alone.

The cost of that there.

Or they push it themselves or they push it to the business sometimes.

Okay, I had to go through.

I was writing some partial scripts here and there and getting stuff from here and there.

But yeah, of course you know how well maintained those are.

Then the person with the scripts left and then they have to build them on you those kind of things to get the data.

We all know those kind of stories.

So it’s something that’s maintained, that’s something that’s there that can go whatever there when there is an auditor or there.

There is a huge Orion that we see over there.

But what also I really like are those things that coming on top of that one of our customers is said yeah, actually we figured out because of elimity that there was a huge amount of people were MNA M and a MFA was not activated.

Right.

So even though they were in the MFA group but those was a group that were not active.

But this group got only activated once they were in the office and logged into the office network every other month or something.

And there was a group of like I think salespeople or mainly remote working people.

So they were in those groups.

So they thought ah, perfect, they’re compliant.

Actually it was never enforced to them.

So those kind of blind spots.

So the unknown unknowns that they have figured out, those are really cool things where I’m getting excited of.

So what we typically see within the first week hundreds of orphaned accounts removed, hundreds of privileges being cleaned up.

And indeed especially then when we’re talking about IVIP in comparison or in combination with pam we see a lot of our customers, especially from those we talked about those early stages that beginning they get typically if they don’t have a PAM yet, that will be one of the first extra funds they will go because they can then go to their cfo, their CIO or whoever is in charge for budget.

Look, we have an issue.

We have 3,000 employees, 1,000 per leached accounts.

With elimity we were able to clean that up and tear it down but now the 500, 200 remaining.

We need strong authentication, we need vaults, we need a proper PAM system for that.

Right.

So that’s something beautiful that I see.

It’s not only an error eye for the company itself, but also for our champions for the season that they are able to show towards business, towards the decision makers or budget owners.

It’s not because I want to have a fancy pen and I read an article or I just want it.

No, it’s really based on our own data and not only to be able to prove something to audit,.

You.

Can also prove internally and kind of defend certain business initiatives or budget initiatives within the company.

Absolutely.

That’s great to know because usually I, I mostly from my side, I always see it on the other side.

This is more of a proactive strategic approach to saying let’s do it before we get breached and let’s do it before we have an incident or let’s do it before we end up having to do a GDPR notification or whatever it might be.

A lot of cases I see it on the other side where it’s an incident, a data breach has happened and then those organizations are coming to me and saying hey, based on our assessment, our post incident assessment, we didn’t have the right privilege controls in these areas and this is a result of it.

They end up allowing probably elevation, it allowed lateral moves, it allowed access to the sensitive systems.

So it’s, I love hearing what you’re saying because you know, the worst case is trying to clean up afterwards after an incident and then put the controls in place.

Because of course that’s when you see that, you know, we, we should have had it.

Having this more strategic approach is a much more proactive, you know, it’s, that’s what helps reduce the impact of breaches and the financial.

Even, even if those organizations do have controls in place and something happens, it’s minimized, it’s isolated, it’.

Absolutely.

Less damage, less financial burden the organization because we’re able to catch it earlier and keep it at control to a specific area or system.

And that’s what’s critical.

What’s the future?

Where do you see this industry going?

What’s, you know, what’s on the horizon, what’s exciting for you?

What do you see kind of coming into.

2027?

Yes.

I think there are so many things nowadays.

So I think especially from an IVIP part I’m super, super bullish since we have the kind of MCT integration because it’s lowers the, it lowers the effort or it lowers the kind the maturity you need to have as an analyst or as a business user.

Right.

So our product naturally always have been one of the most user friendly ones out there.

But you needed to have a certain security mindset.

You need to have a certain level of being able to think technically to build your controls and to be able.

This fully falls away, right?

So with MCP you can tell it in natural language.

And we see also more and more business, business people or a lot of CISOs or security responsibles rehabbing, they don’t have the typical career anymore that they kind of from assist admin, make a year and then become security responsible for any organization.

We also see that it’s because it becomes a more attractive environment.

We have people that rather come from a semi technical background or from business background kind of joining those kind of organizations.

And for them it’s even more important to have kind of this explainable, understandable security.

And that really opens so many possibilities.

So this kind of gap just got kind of closed.

So I said okay, you can really start chatting with it.

Explain me what that is.

Map me that on risk matrix so I can understand or I can, I can translate that for kind of business.

What are the steps you can do?

You can map risks out from your own environment directly to your NIST2 or to your ISO or to your Dota compliance and system.

See what are the steps you still have to undertake.

So that’s something that is, that’s something I’m really excited of also.

Then the questions arise that we haven’t been answered yet, but it’s certainly a possibility.

Will that mean that ANVIP product might be a headless product in the future?

That might be something, right?

Because will you always at the moment, I think for the next couple of years probably yes.

Also do you want to verify what you see?

There is 100% trust in those LLMs, but the quality is so good.

And then I think also the next generation of employees that we have, they’re just so used to working through that LLM interface.

This will be your interface.

So I think there is a lot of great stuff ahead and another cool thing and that’s something that we’re going to release also really soon and this will be accelerating this even more.

Something that we call for history.

Hence that once you start elemity we keep on having the history of all those kind of things.

So when there is indeed when there is a creep or of more elevated risks within the environment, you’re able to see them.

That’s Also from an audit perspective and they’re probably not asking where I have has chosen access to today.

Maybe sometimes.

And then you’re like how can we go back in time?

So the possibility to having kind of, I always compare it a bit to Apple time machine that you can say how did it look at that kind of date from identity access management perspective.

And then you combine that with the, with the, with the power of your, of your own LLM.

That’s something where, where I see a lot of, lot of value will be created for the customers.

Absolutely.

I guess a couple of takeaways from me on that this really means that the, the better you are at historical data means that you can become better predictive as well.

Because a lot of LLMs and GPTs are predictive systems.

They’re all about using historical data to look in the future.

So this is something organizations can really start doing is if they get the right context and they get the right data, they can start saying are we improving our security?

Are we getting worse?

Are we becoming more efficient?

Are we getting worse?

It really allows you to start having this kind of glass ball into what direction are we heading?

And also it can also allow you to say what improvements or where do we need to focus on to make a difference as well, to make us more efficient, more strategic, more better ROIs in the future as well.

And another thing is it really sounds like as well that the onboarding of new employees into this area as well will be shorter because they don’t have to learn complex interfaces and configurations and integrations.

It’s somebody who’s just more simply about understanding the architecture.

I think we’ll have a lot more architects who understand more about how these systems work and therefore hard to interface with them.

So I believe that the onboarding in identity, it could sometimes take years for somebody to become really efficient in many different areas.

And if we all offboard that to many different skills, I’d have my identity skill, I’ll have my cloud skill, I’ll have my interoperability skill, I’ll have my privilege access skill.

And putting all of those skills in the hands of the right person who can interact and knows about how to get business outcomes will become very, very efficient and very effective very, very quickly.

They don’t have to learn.

It also means that switching technologies behind the scenes becomes much easier as well.

Is that so they don’t have to go and say oh, I need to go read this thousand page manual about how to use this complex product and now have to learn about how to upgrade it and integrate it.

It just means that a lot of that wasteful resources kind of time and you know, spent on that goes away because now I’ve got it on my fingertips and I can delegate it to my agent to do it for me.

Yes,.

It’s.

Exciting.

I’m really looking forward from the technology perspective there.

I think it’s great stuff coming over there.

Absolutely.

This is always a fast moving industry even for me.

I’m always, I’m just off the back of four, four conferences in one week.

I was doing four speak engagements.

So I’m off the back.

And you, I’m sure you’re off the back of, of Itza as well.

Big, big events.

So for me, you know, what, what’s, how do you stay up to date?

What’s some of the methods you do stay current for the technology?

Is there people that you look out to for mentors or for people who’s in the industry?

Who’s the leading voices that you look to that help you learn?

Is there analysts out there that also are shaping the industry?

What’s, what’s the method you do to stay up to date?

I think it’s a, it’s a combination of all those kind of things.

Right.

I think naturally in the position that I am, I’m yeah.

On a daily basis talking to CISOs from all over the world.

So I have those, those mini interactions every day.

So it’s, it’s I, I have my, my ear really close to the industry naturally just, just because of my job.

So we have that of course.

So there are the, the big conferences.

Right.

And there are indeed the Gartner conference I think especially in, in my space.

And Nathan Harris is a, is, is definitely a voice to, to have conversations with or to look out for the, the research he’s doing at the, the, the folks from Capriacol doing a good job especially in the identity security space.

So those are also nice to watch.

But I think it’s also ultimately what I found also back in the days, the most useful is those kind of peer conversations.

Right.

So if I would be a CISO, I would look at some CISOs that are within my industry and just reach out to them on LinkedIn and say that’s what I backed.

Had.

Yeah, I would not call it an advisory board.

It was not that kind of formal, but I had a handful of Caesars.

I was, and having every, every quarter I had half an hour to, to kind of exchange with them to see what are the challenges.

Because we all find this fight the same battle at the end of the day.

Right.

So that was something refreshing.

And usually what you also see, some of them will be far ahead from you or one or two steps in front of you.

And some things you will be more in front.

So that.

That always is something.

Something that helps.

That’s how I stay up to date.

What I also love to recommend here is as we are also approaching.

I mean, it’s November, so holiday season is almost around the corner.

In business terms, it’s almost tomorrow.

There’s a really cool book.

It’s from a German author, but it’s also there in English.

It’s called Blackout.

And what I like about it is, I don’t know if you know it, it’s a fiction book, but basically it is a simulation that was really well researched.

What would happen if our energy system in Europe will collapse.

And it’s of course based of a cyber incident, but it goes way beyond imagination of where having no electricity will all have an impact on.

So if you want to.

Of course it’s kind of scary because it.

Especially when you’re in the industry, it doesn’t feel so unrealistic nowadays, but it’s super interesting and also super entertainment to read.

So that’s maybe off a bit off topic because it won’t.

Probably not.

Matter professionally, but just if you’re in the industry, you like it, you understand what’s going on there.

And just to have a kind of idea what the impact on society on stuff is, that’s quite of an interesting read.

I’ll definitely make sure I’ll have it all included into the show notes.

It sounds a bit like Cyber Storm, the book that I read.

So which was.

Which is very similar, was a cyber attack which resulted in the blackout and people had to find ways in order to survive.

And it’s just.

Really well researched.

So it’s a German author.

But I also.

I used to enjoy a lot of Tom Clancy books just because they were so well researched and they were fiction, but they could eventually happen or some of the things he predicted actually happened.

It’s quite of the similar kind of level of research.

So that’s something I really appreciate in a good book.

So if you want to have a good read over the holidays, then this is something that.

I recommend.

Definitely gonna add it to my collection.

I’m in the middle of the second book of Dungeon Crawler Carl.

All.

Right,.

Nice.

Which is a fun series of Books a little bit more extreme than the losing energy.

This is literally an invasion of the entire planet and destruction.

But it is very sometimes in the world that we live in, you need to move away to something that look at something that’s fun and entertaining, take your mind off the chaos that we live in.

So.

Many thanks for joining.

If the audience do want reach out, let’s say what’s the best way for them to connect with you to ask questions?

If they have follow questions or want to learn more, how do they reach you?

100 So I think there are there we need two easy ways.

So either you connect to me on LinkedIn.

So I think that’s something we can also put in the show notes.

And of course there is there is a possibility just to.

To to check on the elimity website elimity.com and actually if you then if you have are interested in the conversation there is the book a meeting link and then goes at the moment straight to my agenda.

So if, okay, I want to have some sparing for half an hour or whatever, always open to do so and give my opinion on those kind of things.

So that’s something that we can, that we can for sure do.

I think those are the two most efficient ways.

Okay, fantastic.

Absolutely.

Well, I’ll make sure it’s all included in the show notes so it’s easy for people to reach out so they don’t have to go search.

Fantastic.

So Christian, many thanks for joining me on today’s episode and, and it’s been great and very insightful and great education for the audience.

So many thanks for joining me.

Yeah, thank you so much for having me.

It was a great conversation.

Time flew by as we already predicted.

So it was a blast.

It was fun.

It does indeed.

That’s the thing about these conversations because it’s just having a fun discussion in something that we’re very passionate about and seeing where the knowledge sharing goes.

So for everyone in the audience, hopefully this has been educational.

Hopefully if you’re looking really kind of, you know, getting started or maturing your identity security strategy, hopefully this will give you some ideas and some good takeaways in order to really make your, your, your career plan or your company much more safer and secure in the future.

So again, this is the security by default podcast, really bringing clarity out of the chaos world that we live in.

And really kind of the goal is to really, you know, bring thought leaders and bring knowledge to you to help further your career, to help make your world safer and sometimes bring a little bit of fun and enjoy in the world.

So tune in every two weeks for new episodes.

This is Security by Default podcast.

I’m the host, Joe Carson.

Stay safe, take care, and until the next time, thank you.