Name: The Future of IAM with Eric Olden & Eve Maler
Uploaded: 2026-08-13T19:18:53.097Z
Duration: 46 min 16 s
Description: The Future of IAM with Eric Olden & Eve Maler

Transcript for "The Future of IAM with Eric Olden & Eve Maler": Hello. Hello. And welcome today to our conversation about the future of identity and access management. I'm Kalal Dubaib, principal technologist here with Rubrik, and I am so excited about having these two gems of a human, with us today to unpack identity. So I've got Eric Olden, who is our new chief identity architect, and joined us recently with the acquisition of Strata, and Eve Naylor, who is one of the legends in the field of identity. And between the two of them, they've they've actually written a good amount of the playbook. But before we get started, I'm a data scientist by training, and I am now excited about identity because we've had this proliferation of AI in the enterprise. And that's totally changing the game. Before we dive into the conversation, let's let's do, some intros, and maybe we'll start with you, Eve, and then we'll we'll come back over here Sure. I am so excited to be here. In fact, I was told it was an AMA, so I present I prepared this little thing just to prove that I'm doing an AMA. Eric. So couple bookends of my career. So way back when in, like, 2000, 2001, along with Eric, I worked on the security assertion markup language standard, which turned out to be seminal. Fast forward to pretty recently, I was the CTO of ForgeRock, big I'm provider. And now at VEN Factory, I help the tech world develop irresistible identity strategies. So I'm excited to be here. Thanks for joining us. Eric? Yeah. Thanks for having me. Looking forward to this. And I, it's just great to to be here today and, you know, with new friends and long friends and, you know, my background's been in identity. I was sharing with Cal, be careful what you become good at because that's what everyone wants you to always do. And in my case, I kind of fell into identity management and never really left. So it's been, you know, a lot of fun seeing it evolve throughout all of these generations from, you know, the nineties when the web came out to AI today. So, yeah, just been, fortunate to be in a lot of these early innings on these different generations and, really happy to be here today. Awesome. Awesome. Well, thank you both. And to our audience, thank you for spending part of your day here with us. This is a live AMA. I've got a few questions that I find interesting, but we really wanna hear from you. So, as we as we go throughout this conversation, just drop your questions in the chat, and we'll we'll prioritize them as they come up. So it's funny. What's old becomes new again, especially when, the same old problems we used to deal with get maybe exasperated by the scale and speed of automation. With the introduction of AI in the enterprise, some of these old challenges are really now bubbling up and confronting us. And I wanna start with a spicy question. Eric, we'll start with you, and then we'll go to Eve. But, what's one thing you've personally changed your mind about with respect to identity in light of this AI adoption? Well, one thing about identity is that, it goes through redefinition, it seems like, every number of years. Right? So we have a lot of new terms. And, fundamentally, we're talking about the same thing, but the context shift. And what I think has really happened in the last, let's say, year and a half, it's been, you know, with AI, people are starting to expand the definition and, how big is the tent at which identity covers. And now, it's long and for always, you know, started with covering humans. And then we had to think about service accounts and the nonhuman identity, but those were kind of a midpoint to I think the really remarkable stuff is with the agentic and where you pair something that's nonhuman with a human and seeing that intersection is fascinating because, it brings all of the things that we've had to do over eras gone by, bring them back now to how do we do authentication, how do we do authorization, how do we, understand and govern what's happening. So what's old is new, and it's it's really interesting how it's shaped up today. Eve, how about you? Anything to add to that? Yeah. You know, it's funny. You started by talking about how we had these problems, and now they're just kind of, you know, enhanced. And, there was a there was a session that I ran with my colleague, Justin Richer, who's another identity standards geek, at this Internet identity workshop that's held twice a year. And it was literally called all of our old problems now have AI in them, but there's still problems. So, like, I totally hear you about that. I I kind of the thing that came to mind talking about, like, what I've changed my mind about, it's sort of the interaction of AI with all of the security controls that we were trying to put on it. I have come to believe that guardrails as a key mechanism are doomed to fail, and there's lots of things that we can bring to bear. And, you know, identity has a lot to do with a lot of those things. But this method of just sort of, kind of shackling your model, it it just it makes it less useful at. the same time as provably not being something that is really keeping it from doing anything. It's just really easy to get around. So I don't think it's the right method of going about things. So that's something I I I was open to guardrails a year ago, and today, I'm. too cynical. It's, you know, it's funny. I was just at the AI security summit. It's a group of CISOs. And and the one thing that, like, was loud and clear is everyone's like, yeah. You know what? Maybe a prompt isn't the best way to get a nondeterministic system to follow deterministic rules. But yeah. Yeah. Yeah. So we're we're finding our way through this. And I I love that these new models, are unfolding of how we think about bringing identity to AI and controls to AI, but we'll we'll get to that in a little bit. Stripping AI out of this. Right? A lot of the growth. in nonhuman identities has come from service accounts and automation. So can you talk to us a little bit about what's been getting complicated with identity even without AI in the picture? Yeah. I'll, I'll start, but I think one of the the big things that are challenging people today is their definition, going back to definitions. You need to update them and change them. But when you go from thinking about identity as a human centric thing, you know, big enterprises have millions of customers. Right? So you're, on one end of the scale, you're used to dealing with a lot of, you know, entities. Yeah. But then when you start to look at how many, nonhuman identities like service accounts and, you know, various things that need identity but aren't human, it's on a several orders of magnitude more. And so I think that's really straining the mental models that people have and certainly the tooling that people have, was built for before nonhuman identity, and now we gotta rethink the scale and the speed. And I think the other piece that, nonhuman identity often gets conflated with agents, and agents are nonhuman identity. While that's true, I think the, I guess, maybe the syllogism on that is that, like, bananas are fruit, but not all fruit are bananas. And so agents are nonhuman identity, but not all, you know, nonhuman identity are agents. And I think a lot of people miss that, and they think, oh, everything I do for a service account is the same way I'm gonna do it for an AI enabled, object or entity. So it's been really interesting seeing how these all come together. Yes. So I, you know, going off of that, what are some of those things, Eve, that AI systems can do differently, than, what, you know, your typical nonhuman identity would have done? That makes it harder. to So so I I really love the bananas or fruit and fruit all fruit aren't bananas. Actually, This is true. agents are pink bananas, actually. Well, it I will say it's funny. Lately, I've been asking I've been asked the question, alright. Do you think that, you know, AI count it counts as an AI agent's identity counts as nonhuman identity? I'm like, I actually was thinking of, is a tomato a fruit? Because the joke about that is, you know, you need the knowledge to know that tomato is a fruit, but the wisdom to know that you don't put it in a fruit salad. So it's obviously not a human, but it has some human characteristics. And to your question, I would say what makes it different is obviously the the nondeterminism. So I think of an AI agent as a marriage of the API economy, everything we learn. to do kind of the 20 tens where you, like, make a call and you could do things, Marry that with human mimicry and the ability to be creative. And now you've got something that can act obviously at scale and speed, that can act like an insider and do insider attacks because it has no morality. So that's the really big part of the equation. Like, automation is a great topic to look at, and much of what we talk about when we first talked about Gen AI before Agentic came into the picture was really 90% about automation only. But deterministic automation is one thing. You get the same result every time. Nondeterministic automation is, like, wild. So that creativity at runtime is, like, that's where we are now. So we're all trying to get our heads around it. Like, oh my god. They act like people that we don't trust in our So coming at this from the data science world, like, obviously, organization. we realized, okay. These things operate in in nonpredictable ways. We gotta monitor them. We gotta control them. And observability is starting to get much, much more complicated. But, in our in our prep conversation for this, we kinda talked about a unique distinction. Right? That runtime monitoring is not the same thing as runtime access control. So can you unpack that a little bit? We'll we'll start with you, Eve. Yeah. I mean, to me, it's it's a really good question. Monitoring is about detection, and runtime access control is about prevention. So monitoring needs to be paired. You know, you'll talk everybody talks about XDR, detection and response. So you need to be prepared to have a response when you detect something. That pattern, pairing monitoring with some sort of response, is a great heuristic risk based adjunct to deterministic controls that you'd like to apply with with access control. So so I see them as complimentary and not the whole picture. Got it. Yeah. I'd I'd add to that. I think the when you're monitoring something, it's almost a very passive type of thing and you can see things that happen and you can monitor the data that you see. So what's in scope, right? You may see some kind of telemetry or some log kind of data. But when you still you look at the problem now with, agents and delegated authorization, what you're monitoring is like the last hop. It's what the agent. is doing, and what's missing oftentimes is, well, what about the human that started this chain reaction? And if you don't have a way to get that whole delegation telemetry, like, think of it like tracing, you are only able to monitor the tip of the iceberg. And what's really relevant is the context and the intent. And so I think we have to really rethink what we're monitoring Yeah. And not get confused by, oh, I see the logs. I must be covered. You're really only seeing, part of the story. So and that ties into, well, if you wanna change the authorization, are you trying to change what an agent can do, or are you trying to change what the human that drove what the agent behavior is? So it becomes a lot more compounded, I think. Yeah. So what you're describing is not just, like, the identity of this nonhuman, you know, machine identity and not just the identity of the human, but almost like an intersection Mhmm. Of the two and and how that can compound. That's right. Yeah. So I and and, Yev, I was reading one of the papers that you shared with me. And, unlike most other facets of tech spend, at scale, identity spend actually goes up as a proportion of overall spend, Yes. if. I understood correctly. Yeah. Right? So this. is something that gets more complex the the more scale we get, and it's it's a network, interaction. So, there's been twenty years of tech debt building up in identity, in this patchwork of access across systems, and and now we're throwing AI into the mix. So this was already at a breaking point, and now we're adding agents. Where does I mean, I'm gonna be positive and see this as opportunity. this, go? actually, there were some really interesting reasons why we see some of that that spend ramp up and some of the cases are lack of investment. And I'm gonna give you an example from it's the before times now, like, two years ago, before agents really became a thing. We had this sudden, crisis of remote worker onboarding and North Korean fake workers. You know, North Korea is doing this to make money and infiltrate and be generally annoying. They're we're getting into to companies as employees because there weren't great identity verification techniques being used. Now the techniques and the technologies are really quite good now and they've been even getting better in this, you know, little era. You simply have to apply them. Now that means some work. It means some tech refresh. But what you get is, like, you can squash that kind of fraud, like, a 100% if you apply the best practices and the best technologies. So I think we have opportunities right now to do some leapfrogging faced with some of these challenges. There was, you know, the saying that I've been going around sort of popularizing about, you know, AI is the balloon payment on tech debt. And I found out who actually said this first. It was Dan Stalker. And so I just wanna give a shout out to him because I think it's a very trenchant observation. Like, okay. You have to invest. You knew all this time you had to invest, and now you have a really good reason to do it and make make headway. Awesome. Yeah. Well, building on that, the, the tech debt, balloon payment, it it's kind of a tricky thing to unwind because there's, like, a whole host of reasons why it happened in the first place. Nobody wanted to slow down and and do the you know, pay down the principal and refactor, a new application. So they're like, oh, wait. Next kinda Mhmm. move forward at all cost and direct all your budget to the new new thing. But now we're at a point to your earlier statement that we're at a breaking point. We've been at a breaking point, and now we're seeing these things start to, collapse in, unexpected ways. And the good news out of this, kind of likely likewise find the silver lining, is that now you can take the budget for AI enablement and say, well, to really enable this, we gotta put this into the infrastructure and not frame it like, oh, we're paying down someone else's past mistakes or cutting corners, but saying, look. In order to do this in a way that's not gonna collapse, we gotta make this investment in this thing called identity. And Mhmm. framing it as enabling versus paying off your tech debt, is, I think, more palatable with decision makers today because they don't feel like they're throwing money into the past, but, there's it's quite a big bill. Just my experience, it's it's something needs to happen. Well, something know, I've, oh, go ahead, Eve. Yeah. I just say you're singing my song. I just I just love it because this is it's kind of the theme of my book, Mastering Digital Identities about, like, no compromises. And I feel like we're at this moment where market dominance is everything. And with AI in the picture, you have to go fast so that your average CEO is like, show me how I can do more of this, not how I have to do less of this. So I love that identity is actually at the table in this conversation because it can accelerate if if done right. Absolutely. I mean, I think right now in most enterprises, we're we're underpricing the total cost of ownership of these AI systems. I mean, token economics is its own thing, but a big part of also being successful with these internal deployments is is all of the overhead that goes into controlling it and and doing it in a sensible way. Mhmm. Because just using foundation models to to govern foundation models is a quick way to five x your spend on any individual thing. So I'm I'm really glad that we're we're talking about this here. But you you don't hear a lot of folks talking about, identity as an enabler for AI. Why is that? Why is it not yet the raging thing? You wanna start, Eve? I've got But Yeah. I mean, everybody wants to talk about the Wizzy stuff. Yeah. And if if you talk about it like it's old problems, it doesn't hit the same way as if you talk about, you know, the the joke about, you know, cars having brakes is so that they can go fast, not so they can stop them. Right? So if if you actually, put it in terms of enabling people's access, enabling people's personalization, so I I use this framework mentally of the four p's of what identity. does. So protection is the first one always. It's a big one. But personalization, just people getting access to the correct stuff. Payment so that, you know, the transactions actually have a counterparty that you can trust. I mean, there's a lot of new transaction value flowing that needs to be kind of identity guarded. And then people, what do people actually want? Like, even with nonhuman identities, we're still doing it this doing this at the end of the day so that humans and humans working for companies are getting something valuable out of it. So so I think there's so many different jobs that identity can do. It it needs to be at the seat for all of those. And and why we don't talk about it is because, you know, things that have multiple impacts are confusing. Fair enough. Eric, anything to add to that? Yeah. And I think what I would add is that stories that come out that make people think, oh, shoot. If that happened to us, would we be in a good spot? And, you know, some of the the things that agents have done are are happening in unexpected ways. And there's, Yeah. an airline, I think it was in Canada, that had a chatbot on their website, and that chatbot gave away a refund that was outside of the human or I'm sorry, outside of, policy, but the one thing led to the next. And the judge told the airline, you have to honor that, that refund policy. And They attempted to argue at that agency. Yeah. And and they said and the judge said, well, that's your website. Yeah. It's an agent for you as a company, so pay it. Yeah. And, you know, some might say, okay. Well, let's fix the agent and make sure that that doesn't happen again. Another way to do that is let's get rid of the agent altogether, which is what they did. And, you know, talk about throwing the baby out with the bathwater. It's like this didn't have to be that way. You could solve that in a, using software and, you know, a deliberate framework and identity management model, with delegated authorization. And if you need, bring in a human in the loop. So there are things that people, don't necessarily think, oh, if I had this capability from an identity standpoint, we could have had a different outcome. I think right now, they're just afraid of, oh, shoot. I don't wanna be a headline. So key off the headlines, and that means we step back in what we can do. Whereas I think the people who are gonna lead are ones that try and figure out not just how to reduce risk entirely, but how to structure things so that they can have both progress and. protection at the same time. This kinda connects, I think, to what you were saying earlier about guardrails. And, you know, the guardrails are are very much a mathematical thing, which we need. Yeah. But they're they're like almost fuzzy logical, you know, machine learning based controls that we're using to try to derisk these systems. But what you're talking about here is pairing both. Right? Having the determinism of these access gates and controls in addition to the guardrails that we have in place. Yeah. Yeah. And and those those things can get quite, quite sophisticated. They may be deterministic, but you add up enough of these systems plus. some risk based solutions. So, you know, for humans, we do behavioral modeling, Yep. to look at, you know, whether we have a confidence level that it is the right person doing the right thing. We can apply this by analogy, very close analogy to agentic interactions and and do the same kind of heuristic checks in addition to the deterministic checks that we would do around, you know, are you doing what you said you were gonna do, what the person agreed you were gonna do, and to the resources that you needed you said you needed access to. There's there's a number of things that can be applied there. I know, I've been hearing more and more zero trust. But to the point of, like, take that to the extreme now and, by default, trust no agentic action. And so you both talk a lot about planning for failure modes. So what does that look like in the context of identity today? Well, I'll maybe I'll start and, you know, I think a couple of the failure modes is, one big one is assume breach. And Yeah. If you are, able to understand what's happening and have control over things that you know in advance, that gives you a level of, you know, confidence to, you know, go and do things. And I think when that doesn't come cheap, doesn't come for free, you gotta make an investment, you gotta have your process, you gotta have your, you know, whether it's a tabletop exercise or whatever. But I think a lot of times, if you're getting surprised because, some change happened and you didn't have a way to model it, then that's that's on you. Right? Yeah. You should assume things are gonna happen and as opposed to everything's gonna work magically and nothing bad will ever go wrong, I think Murphy's Law is is very, very much in play. That's, a good point. why would you. add to that? Couple thoughts. Those are both great. Those are all great. First one is, to me, looking after failure modes means not just breaches, but exhaustive modeling of all unhappy paths. And when there are humans anywhere in the loop or as they're. now saying on the loop kind of looking looking over the shoulder of policy, there there can be a lot of sort of little used paths like user interaction, you know, user journeys that have not been sufficiently protected. So you've got uneven protection across different ones. Even just login, you see that problem all over the place. So there's a number one, model those very, very closely and and get them all up to a quality level. The second one is, thinking about how, there's a colleague in the identity world, Vlad Shapiro, who's been talking about using the analogy of nuclear energy and how you manage a nuclear reactor and how they've planned for failure modes. And it's it's layers and layers of defense and depth. There's another concept of zero trust that I really love that doesn't get as much play. I love assume breach. I also love the concept of a protect surface. So the attack surface is infinite, and that's sort of the problem. So if you. simply work on protecting your protect surface, so figuring out what's valuable and standing up, you know, protection right in front of it, this notion of getting closer to the resource, closer to the servers, closer to the actual things of interest, the data of interest, I I think is a very productive, thing that we can do at this moment. So we we we kinda touched on this a little bit with identity resilience, but there's this there's two things happening here. There's one, your your autonomous tools are now great targets for threat actors to turn into autonomous insiders, and that's that's a big risk. I've been seeing a lot of folks in the security community kinda holding their breath over. Then there's a second thing of, like, you know, once an identity is compromised, if it's a mission critical process, that could shut down an entire organization. So we've got two concepts here, identity resilience and identity continuity, which can almost seem like, you know, the same thing. But how are how are these things different for the uninitiated? Do you wanna start, Eve, or have you got thoughts? Yeah. I'll do a couple. I think this one really belongs in your in your court. Resilience means you can bounce back from a failure. demonstrably. Right? Continuity. means that your tier zero services don't stop running. And because identity has all of those jobs to be done, it's literally the front door to your business. It cannot stop. So continuity is a really critical thing that you have to solve, and and it's one of the ways in which identity actually starts looking a lot more like IT infrastructure. than like a security control. Not that it can't be both. It can not that it can't be many things, but that's one of those things where it it has to have those protections. Well, Eric, you know, in addition to that, like, you have a very close lens to the organizations farther ahead. So, tell us also, what what are they doing differently? What do they know that the rest of us don't? I think the, you know, the world needs more acronyms. Right? So Of course. Or or mnemonic devices or heuristics, whatever they're called. But, you know, in in you've got the r's in, Rubrik, and I've been seeing a lot about, you know, recovery and resilience. And I think maybe another way to think about continuity is redundancy. Right? In that kind of from a technical standpoint, these are three distinct things. They're generally in a common area, right, of concern, but they they serve different things. Right? So in the case of, where you have a you know, what what more advanced people are doing is they're thinking about it as an end to end thing, right, before there's an issue, during an issue, and after the issue. And so when you look at the the spectrum of, an an incident or an outage or whatever the the circumstances are, if you break it into those three things, then you wanna think about what tool are you using to accomplish one of those, different things. And the function of recovery is that if there's something that's been, you know, breached or damaged, that you can restore it and bring it back to, you know, a good state. If you're talking about resilience, you've gotta have more of a business lens on that. Right? Can we keep our minimum business functionality going? And then redundancy is a bit more of like, well, hey. If I have an outage on system a, how do I fail over to system b? Got it. Because our cost of downtime is so high that I need to have redundancy so that I have my business still running, but I can do the recovery and the resilience, at the same time, but I don't have to take the business offline. So it's really using those three patterns together in that before, during, and after kind of mindset. That's what I'm seeing people who are leading these five nines kind of, organizations. That's how how they're thinking about it. And that that sounds non trivial. Right? Everything that you're doing now to set up automation is now being redirected to the the human over the loop, so to speak, is setting up what that needs to look like before an event actually occurs. Yeah. And and I think a lot of times, a movie comes to mind, it's an oldie but a goodie, it's a Disney movie called Fantasia and there is a segment where it's the Sorcerer's Apprentice and Mickey Mouse, he becomes, he's the kinda like the intern for the Sorcerer, and one thing leads to the next. And he, brings a broom to life, and he thinks, oh, I'm gonna have this agent, this broom, go do all this work for me. And, then he takes a nap and realizes that the broom was doing what you asked him to do, but led to crazy outcomes. So Mickey says, oh, I'm gonna fix this by cutting this broom into pieces and that just spawned infinite numbers of rooms. And it just went from automation with good intention turned into this thing that got out of control and not everybody has the sorcerer who can come in and, you know, wave a magic wand and all goes back to, you know, a good state. And I it's a very it's funny. Like, I'll have that scene play. in my mind when I'm talking to people, and they're like, oh, no big deal. We'll just automate it. And it's like, you know, the automation actually isn't a magic bullet. It can create a a really much bigger mess, but sometimes people have to go through it to see it, and then they realize that sometimes the automation is the problem. It's not the answer. I can't unsee that now. Mickey needed identity resilience, it turns out. I think about that scene every day, in fact, so I'm glad she talked about it. But it's old as new. Right? Yeah. I think? that came out a. long time ago. So so speaking of, identity resilience and agentic identity and how automation exasperates things, hot take. Start with you, Eve. What's one thing that's overhyped right now with agent agentic identity and one thing that deserves a little more love? So, you know, I I've given names to categories of trend like things, and I call the first an overhyped thing is a trope. And an. underhyped thing is a transparent because you're looking through it and you're missing it, and you really ought not to. So for me, agent identity itself, like identification, is a little bit overhyped at this point versus what I would call agent qualifications. So who asked you to do something? What was their right to even ask you? What exactly is it that you're capable of, like, basically the descriptors, not just the identifier. So I think that that's a little bit, Yeah. too much leaned on when it comes to usually the NHI conversation. And and if you're looking for something underhyped, so my transparent would be that agent intent is still underhyped. Most see it as, like, just do authorization harder, and it's actually more subtle than that and in part. different from that. So I think we we miss those things at our peril. Love it. Yeah. And I I agree with what Eve said, but I would add also that I think there's this focus right now on agent discovery, and I hear people asking about it. And they're conflating knowing what the problem is assuming that knowing your inventory is a version of governance. And while it's true, you can't govern something you don't know is there, I think a lot of times people are thinking, oh, if I can do discovery, I'm done. It's like, well, that's literally step zero and a much longer governance journey that, is is in front of people. So I think discovery is overhyped because it makes people think that that's all you need to do, and I think that's gonna lead to, some negative surprises. Things that are underhyped or, you know, transparent to, to Eve's framework, I think the notion of delegation, and I and I have conversations regularly trying to, distinguish like we did earlier in this meeting is the nonhuman identity and agents. And the point that I like to bring up is that an agent isn't doing things on its own. It's doing somebody else's bidding. And if you're trying to understand where the scope of control should be, it's literally not just with this agent. You have to look at the the human driving the, the accountability. Yeah. And, you know, I've worked with companies in the insurance world as an example. And, you know, as we were talking about the need for human in the loop in that case, one of the things that kinda raised the issue was, well, we can't have agents issue, insurance policy quotes because in the real world, you need to have a a license at the state that you're issuing these things in and humans get all this specific training and all of that. And so even though software can, you know, AI generative AI can make a quote, that's not the same as a person who can be held accountable if the quote is wrong. Right? You can't just get out of this situation like the airline. Yeah. Oh, well, the agent did it. That's not on me. Well, the trusted it's there. It's it's it's clearly on the company now. That's right. Yeah. And so I think really people thinking how do we connect the dots from the intent of the human leading all the way through to the action of the agent, whether it's calling it API or a tool or what have you. Like, it's it's a much broader thing than just that what shows up in the log. In our prep call, we were we were kind of nerding out over the legacy Strata had, and you were punching well above your weight class. Right? The identity community is is small, but it's having a disproportionate impact on enterprise tech right now. I I'd love to hear from you, Eric, with the the acquisition, and joining Rubrik. What are some of the unlocks that, you know, the this play kind of gives you and the team, that synergizes with Rubrik's focus on resilience? Yeah. It's been it's been an awesome, combination because one of the things that Rubik has in DNA is deep capability in both kind of, disaster recovery and resilience and security. It was a perfect match to Strata's experience in that, from an identity standpoint. So joining Rubrik was really an opportunity to bring a lot of the identity DNA that is deep at Strata into this phenomenal organization with resources that startups don't have. And, you know, I'm a serial entrepreneur, so I'm used to working anything from a, you know, a two people in a garage all the way to hundreds of employees. But at the same time, being now part of Rubrik, we've got, you know, much greater global reach and also the things that come with that. So being able to take this software and bring it to thousands of customers is, really a way for us to meet the opportunity right now, and, we've been having a lot of fun doing it at the same time. I love it. I know the the Rubik way is jumping on a rocket ship that's being built, from from day zero. Eve, you've been an adviser to Strata for some time now, and so you're new to the family. here too. From from your lens as an adviser, what are some of those technical synergies that that you're excited about? Yeah. Looking at it from, like, the 100,000 foot view, I I'm actually really excited because it's a new kind of synergy that we haven't seen in in in any of the industries that we're involved in before. So I'm gonna use an analogy from authorization policy to explain what I mean about the synergies. People talk about park when working on authorization standards. Right? So principle, action, resource, and context. And so the principle and there may be multiple principles because of the delegation chain that you have to do. That's. the kind of identities remit. Right? And Strata has deep, deep roots in identity from the beginning, really. And Rubrik is mastering data and data hygiene, data security, data resilience. There's all sorts of ways in which that kind of resource view of the world is. is really properly coming into the picture. And so what that means for, you know, all of the new AI innovations and freak outs that are to come is a really great new way to have a protect surface like I was describing before. So I'm super excited about about the the synergies here. Awesome. I I love it too. I mean, with my my experience on the AI side of the world, I'm seeing more and more this really does come down to two things, protecting the data and securing the data and then securing the routes to that through these automated systems. So I love seeing these building blocks come together. It looks like we've got a couple of minutes here for questions. If we've got questions from the audience, I'm also happy to keep, nerding out with these folks. So, alright. It looks like we've got a question here from Robert. Having guardrails where an agent needs essentially quorum with a human seems to be a helpful thing. Assuming the agent isn't in a loop like the one I saw yesterday. Any any reactions or or thoughts to that? know, this is a really interesting concept, this quorum authentication. or quorum consent or permissions is something that, I don't know, in my in my work with the user managed access standard we've talked about for quite some time, looking at really, all over the map delegation scenarios between legal entities, like legal parties. So, like, what if you're talking about data that is owned by multiple parties? So a non AI example would be DNA data in which multiple family members have a stake. So you could do quorum consent around sharing it, for example. So imagining that you've got an agent that is somehow empowered to provide a take on that, but it is not a 100% take. You need the human to come in or maybe multiple humans, by the way. It might be a supervisors that are doing approvals. So I love the idea of of quorum permissions, basically. Yeah. I I think you said it well. I, so I I think this is so interesting. A new a new term to me is this idea of not just zero trust but zero custody. And it's already hard enough to govern a single agent, let alone having multi agent workflows. There's been some recent research into this that once you get past a handful of agents collaborating on a task, the task performance starts to degrade. And, oh, by the way, that's if you control all of them. Mhmm. Now let's say, you know, you have an agentic workflow like, ordering an item from another b to b supplier, that in turn also has an agent handling that process on their side. You don't have shared access over that, over the the guardrails or the access controls, and you're kind of operating half blind. And so I I think this is a really exciting space to be building in. Any any thoughts? Because I you you're both standards nerds. What are some of these new standards that that need to be built to arrive at this occasion? We're proud. of it. Exactly. Exactly. You know, there there's, I think, a couple things I'd say on it. One is that standards as a strategy is generally always the right thing to do, And there's a temptation many times to say, oh, that standard's already done. Let's move on to something else. And I think where people need to recognize is that, if you don't have a standard, it's hard to collaborate and hard to trust. And so I think at the end of the day, pick a standard as a strategy, but also recognize that standards evolve. I mean, how many iterations did it take for SAML to get to be, you know, two point o? And even then, you know, how many people were waiting to deploy because they had to have someone on the other end, have the ability to communicate and collaborate. Right? So you had this kind of pent up inverse of the network effect where the the network barrier is like the fax machine problem. It's only valuable if both people have a fax machine. And the, I think the way that we need to think about standards today is even more urgent because we're seeing more fragmentation and more need to cross boundaries, and that means that, what you do inside of one organization, you can't assume it's gonna happen the same way elsewhere. So I guess in the end of what I'm saying is continue to use standards, evolve them to fit the modern requirements, but, don't go down the path that, oh, we'll just do this proprietary version that's kinda like a standard, but no one else is gonna use it. That's gonna end up it's gonna end poorly. Well, Yeah. 100%. folks, it looks like we're we're almost at time here, and I I could keep talking to you both all day. And I, for one, am glad to have you in the Rubrik family of experts. For those of you tuning in, actually, there are some great opportunities coming up where you can talk with both Eric and Eve some more. Eric, do you wanna give a plug to some of these upcoming events? Yeah. Yeah. So later this month, the end of August, we'll be at, CrowdStrike's FalCon conference in Las Vegas, and, we'll have a booth there. And, also, I'll be there and, love to I don't know. If you wanna have a good conversation about strategy and architectures and all of that, I'll be there. And then, in September, there's an identity resilience, conference. And, so it's gonna be all about, you know, how do we think about resilience in addition to recovery and redundancy. So a lot of a lot of hot topics coming up right here in the next couple weeks. Awesome. Awesome. Well, Eric, Eve, thank you both. This has been a fantastic conversation. For those of you tuning in, if you look in the documents, you'll be able to see more info on how to, join our identity resilience summit. We look forward to continuing the conversation. Take care. Thanks so much.