WEBVTT 00:00:00.000 --> 00:00:04.400 I think it's important to understand that something like the Identity Fabric and the 00:00:04.400 --> 00:00:08.500 Reference Architecture is a joint venture to some point. 00:00:08.900 --> 00:00:14.000 And that's why I want to release a little shout out here to the community. 00:00:14.500 --> 00:00:17.300 Feel free to challenge what we have, what we publish. 00:00:17.700 --> 00:00:21.600 And if you think that there is something missing, let us know. 00:00:22.000 --> 00:00:23.600 Approach us, discuss with us. 00:00:23.600 --> 00:00:29.700 Let's understand collaboratively if that fits into the concept. 00:00:30.400 --> 00:00:31.100 Did we miss something? 00:00:31.400 --> 00:00:33.700 That's the major question here. 00:00:34.000 --> 00:00:48.500 And let's clarify that together. 00:00:50.000 --> 00:00:52.200 Welcome to the KuppingerCole Analysts chat. 00:00:52.300 --> 00:00:52.900 I'm your host. 00:00:52.900 --> 00:00:54.200 My name is Matthias Reinwarth. 00:00:54.400 --> 00:00:57.400 I'm analyst and advisor with KuppingerCole Analysts. 00:00:57.800 --> 00:01:00.815 We are continuing a series or brief series of 00:01:00.815 --> 00:01:04.500 episodes around the topic of the KuppingerCole Fabrics. 00:01:04.600 --> 00:01:09.530 So we started with an episode a few weeks ago with Martin Kuppinger, where we 00:01:09.530 --> 00:01:15.100 looked into the history of why we created, as KuppingerCole, something like the Fabric. 00:01:15.400 --> 00:01:18.766 We looked into the term, the concepts, the relationship 00:01:18.766 --> 00:01:22.500 between capabilities, services and tools, which is essential. 00:01:22.500 --> 00:01:25.000 And we promised we continue that message. 00:01:25.500 --> 00:01:26.000 And here we are. 00:01:26.300 --> 00:01:28.600 For this, I have invited two colleagues. 00:01:29.200 --> 00:01:33.600 It's again Martin Kuppinger and I've invited my colleague, Dr. Philipp Messerschmidt. 00:01:34.300 --> 00:01:36.400 So first of all, welcome, Philipp. 00:01:36.800 --> 00:01:39.800 Yeah, thank you for having me and looking forward to this episode. 00:01:40.000 --> 00:01:42.900 And welcome, Martin, again to continue that conversation. 00:01:43.600 --> 00:01:45.400 No, thank you for inviting me. 00:01:45.400 --> 00:01:49.626 So with this combination, we are perfectly set up to continue 00:01:49.626 --> 00:01:54.059 the conversation from the generic fabric concept that we covered 00:01:54.059 --> 00:01:58.700 in episode one of this series and move over to the identity fabric. 00:01:59.000 --> 00:02:04.618 And that is the tool, framework, architecture, concept, paradigm 00:02:04.618 --> 00:02:10.500 that we are using for, as we identified last time, seven years now. 00:02:11.100 --> 00:02:15.600 And we are using that for various purposes in research. 00:02:16.200 --> 00:02:21.137 And Philipp is the expert on the one hand, also supporting and 00:02:21.137 --> 00:02:26.553 creating next versions of the identity fabric where we are currently 00:02:26.553 --> 00:02:31.729 very busy at, but also applying that in actual client engagements 00:02:31.729 --> 00:02:38.100 where we use the identity fabric as a means, as a lever for creating, improving, 00:02:38.100 --> 00:02:42.500 developing architecture, plans, frameworks and roadmaps. 00:02:43.400 --> 00:02:47.200 Philipp, so you're using the identity fabric in client engagements. 00:02:48.200 --> 00:02:50.200 How can that look like? 00:02:50.300 --> 00:02:52.700 Where do you actually use such a concept? 00:02:53.300 --> 00:02:56.200 Where does it get from a piece of paper and a slide 00:02:56.200 --> 00:02:59.100 to something that is actionable and actually helps? 00:02:59.300 --> 00:03:00.300 Yeah, that's a good question. 00:03:01.000 --> 00:03:05.492 When we are working with clients, they usually approach us with different 00:03:05.492 --> 00:03:10.600 challenges and every IAM challenge, every customer is unique when it comes to that. 00:03:11.700 --> 00:03:16.044 We have the two frameworks, the identity fabric and the reference 00:03:16.044 --> 00:03:20.322 architecture as very strong blueprints, as structured approaches 00:03:20.322 --> 00:03:25.000 that provide a lot of guidance and structure for the customer as well. 00:03:25.000 --> 00:03:31.025 So whatever challenge we face in the IAM space, we start with the 00:03:31.025 --> 00:03:37.606 identity fabric and create a structure, an orientation for the customer 00:03:37.606 --> 00:03:45.300 to move forward, to understand the challenge and to understand how to move forward. 00:03:45.400 --> 00:03:47.500 I think that's the most important part here. 00:03:47.500 --> 00:03:51.650 So usually we then start with identifying what kind of identity 00:03:51.650 --> 00:03:55.800 we are talking about, what target systems are we talking about? 00:03:55.900 --> 00:04:02.118 And then we dive into the challenge itself by identifying which tools, which 00:04:02.118 --> 00:04:07.600 capabilities, which services are touched by these challenges, which 00:04:07.600 --> 00:04:14.800 capabilities are important to improve or to change or to use to overcome this challenge. 00:04:14.800 --> 00:04:20.100 And this is done in a series of steps, I would say. 00:04:21.100 --> 00:04:23.000 Usually we start with a maturity assessment. 00:04:23.300 --> 00:04:29.218 We talk about the target state to improve in the long term and that 00:04:29.218 --> 00:04:35.400 can result in a gap analysis, that can result in a roadmap discussion. 00:04:35.400 --> 00:04:39.026 But from there, when we have the status quo, we have the 00:04:39.026 --> 00:04:43.300 target state and we have the gap analysis, we can go various ways. 00:04:43.900 --> 00:04:47.539 Besides the roadmap, we can also do a tool selection, we can talk 00:04:47.539 --> 00:04:50.954 about the target operating model, we can talk about technical 00:04:50.954 --> 00:04:55.600 architectures that highly depends on the challenge our customer approaches us with. 00:04:56.200 --> 00:05:02.003 And even if it is a more operational challenge, then we are able to dive deeper 00:05:02.003 --> 00:05:08.100 into the capabilities and focus on very specific operational day-to-day challenges. 00:05:09.000 --> 00:05:13.300 So this is what we can see when we are working with our customers. 00:05:14.100 --> 00:05:19.900 But I think it's important that this always goes from capabilities to services to tools. 00:05:19.900 --> 00:05:23.842 And this is, I think, really like we discussed in the initial 00:05:23.842 --> 00:05:27.589 episode, central to the paradigm, the idea of the identity 00:05:27.589 --> 00:05:32.500 fabric, that we don't start with like it's frequently done with tools first. 00:05:32.900 --> 00:05:36.144 Tools are the result and tools also follow the 00:05:36.144 --> 00:05:39.600 service and services follow the capability needs. 00:05:39.900 --> 00:05:45.300 And the capability needs are derived from, you call it a challenge, from the requirements. 00:05:45.300 --> 00:05:48.559 And this is, I think, the really essential aspect that 00:05:48.559 --> 00:05:52.000 it helps making, at the end of the day, better decisions. 00:05:52.800 --> 00:05:57.200 That it helps to take a structured approach and not a tool-driven approach. 00:05:57.500 --> 00:05:59.800 Plus, I think that's the other side of it. 00:06:00.100 --> 00:06:02.500 I see this in some of the conversations I'm involved. 00:06:03.400 --> 00:06:05.300 You surely also see it in your conversations. 00:06:05.300 --> 00:06:10.800 It's also something with this entire fabric approach also has a couple of 00:06:10.800 --> 00:06:16.300 elements in that are providing guidance more for a future-proof approach. 00:06:16.700 --> 00:06:19.753 So take orchestration as something that plays a very 00:06:19.753 --> 00:06:23.100 important role, API-first approaches and stuff like that. 00:06:23.200 --> 00:06:26.637 So I think in that concept, a side of the very concrete 00:06:26.637 --> 00:06:30.200 guys is looking at capabilities and ending up with tools. 00:06:30.200 --> 00:06:33.322 And I think we are very well positioned for tools choice 00:06:33.322 --> 00:06:36.500 with our leadership compass work, with our advisory team. 00:06:37.100 --> 00:06:43.367 I think it also helps in giving guidance for sort of a evolution of an existing assets, 00:06:43.367 --> 00:06:49.345 identity management, which always is brownfield in some way towards something where 00:06:49.345 --> 00:06:55.900 maybe it's a little greener over the next, it becomes a little greener over the next years. 00:06:55.900 --> 00:07:00.368 But that also plays into what we discussed earlier, that we are not only 00:07:00.368 --> 00:07:04.836 using that in client engagements, but we're using that also to structure 00:07:04.836 --> 00:07:09.800 our research in the best of all worlds to say, this is a new tool, a new vendor. 00:07:10.000 --> 00:07:13.900 Let's break down what this tool, this service actually provides. 00:07:13.900 --> 00:07:19.356 So to break it down into capabilities, into services, and then to actually reverse 00:07:19.356 --> 00:07:24.746 engineer what a new tool can do to make it fit into our analysis when it comes to 00:07:24.746 --> 00:07:31.200 understanding what are the right solutions for clients now that we understand their requirements. 00:07:31.500 --> 00:07:36.800 So it's one step back and then back to the tool to say, okay, here we are. 00:07:36.800 --> 00:07:39.600 This is something that we need for the tools choice, right, Philipp? 00:07:39.700 --> 00:07:41.400 It's not just for the tools choice. 00:07:41.400 --> 00:07:47.262 I think that that happens all the time when a customer needs advice and comes 00:07:47.262 --> 00:07:53.200 with the question, hey, I have a challenge with my tool here or around a tool. 00:07:53.500 --> 00:07:56.360 The first step is always decomposing that tool into 00:07:56.360 --> 00:07:59.500 capabilities and take a closer look at the capabilities. 00:08:00.100 --> 00:08:03.852 And sometimes you even figure out that this technical 00:08:03.852 --> 00:08:08.100 solution, that tool is doing stuff it wasn't supposed to do. 00:08:08.100 --> 00:08:11.400 So that this capability belongs somewhere else. 00:08:12.000 --> 00:08:15.303 And this is usually then part of the solution or it 00:08:15.303 --> 00:08:18.800 is the reason for the challenge that the customer has. 00:08:19.600 --> 00:08:23.022 The customer is trying to do things with that 00:08:23.022 --> 00:08:26.900 technical solution that this tool should not solve. 00:08:27.100 --> 00:08:30.700 In the end, this capability belongs elsewhere. 00:08:30.700 --> 00:08:35.100 And that's an important step towards the solution. 00:08:35.400 --> 00:08:38.346 And it's increasing the awareness for a 00:08:38.346 --> 00:08:42.500 capability-based model of organizing your organization. 00:08:43.500 --> 00:08:48.065 And I think that's what you said that helps, I would say, helps 00:08:48.065 --> 00:08:53.500 customers to understand where the risk of bespoke solutions is overly high. 00:08:53.500 --> 00:08:57.900 So when you start using a tool for something it is not 00:08:57.900 --> 00:09:02.300 meant for, then you usually end up with customization. 00:09:02.900 --> 00:09:06.400 And I think we have seen it in many areas at some point. 00:09:07.500 --> 00:09:12.048 Over-customization puts customers very frequently in trouble 00:09:12.048 --> 00:09:16.900 because the maintenance updates, all these things start to fail. 00:09:17.500 --> 00:09:18.900 The cost is excessively high. 00:09:19.500 --> 00:09:24.877 And I think this is also one of the aspects where it really can bring 00:09:24.877 --> 00:09:30.800 clarity more in a reverse analysis of what is already there at the customer. 00:09:31.800 --> 00:09:36.000 In contrast to the, which are the capabilities I lack or which 00:09:36.000 --> 00:09:40.200 I don't serve well enough to understand what do I need to add. 00:09:41.100 --> 00:09:45.300 But at the end, it's always a very helpful tool for a structured discussion. 00:09:45.400 --> 00:09:48.600 I think this is also the reason why it's so widely adapted now. 00:09:48.600 --> 00:09:52.609 This is a perfect example where we can use the 00:09:52.609 --> 00:09:58.100 capability view to organize our teams, our people, our experts. 00:09:58.500 --> 00:10:00.700 I'm talking about the target operating model here. 00:10:01.200 --> 00:10:06.200 Usually what we can see is that teams are organized based on tools. 00:10:07.000 --> 00:10:11.300 In the future, this, we expect that this will break up. 00:10:11.400 --> 00:10:15.300 So we are not organizing ourselves based on tools anymore. 00:10:15.300 --> 00:10:18.700 We are organizing ourselves based on capabilities. 00:10:19.400 --> 00:10:24.502 And that means that the responsibilities of teams that come 00:10:24.502 --> 00:10:30.900 capability based in the future will be or won't be based on tools anymore. 00:10:30.900 --> 00:10:34.598 Meaning we have two teams, different responsibility, handling 00:10:34.598 --> 00:10:38.600 different capabilities, maybe even in the same technical solution. 00:10:39.600 --> 00:10:44.112 Yeah, and I would say maybe it's even more, more service system where we 00:10:44.112 --> 00:10:49.000 organize the teams because services are sort of the bundlings of capabilities. 00:10:49.400 --> 00:10:53.189 My example would be on the cybersecurity fabric, but you also 00:10:53.189 --> 00:10:57.103 could envision, for instance, a central authentication service, 00:10:57.103 --> 00:11:01.700 which is an amalgamation of certain capabilities in cybersecurity fabrics. 00:11:01.700 --> 00:11:05.215 A security operation center is the service, which is 00:11:05.215 --> 00:11:09.000 using certain tools, which combine certain capabilities. 00:11:09.200 --> 00:11:12.900 And this is the organizational structure we use. 00:11:13.100 --> 00:11:20.300 But I think what is definitely wrong is to organize around tools. 00:11:21.100 --> 00:11:23.200 The best example is SAP silos. 00:11:23.800 --> 00:11:26.489 They should be organized around capabilities 00:11:26.489 --> 00:11:29.300 and services, not around a certain technology. 00:11:29.300 --> 00:11:31.400 Same here. 00:11:31.500 --> 00:11:34.850 And I think this is the same thing that we see in reality, you 00:11:34.850 --> 00:11:38.200 know, that plays really well into my question that I prepared. 00:11:38.300 --> 00:11:40.878 And I do want to ask, because we've been looking at target 00:11:40.878 --> 00:11:43.900 operating models and service organization, that becomes a new twist. 00:11:44.200 --> 00:11:49.650 So the question is when you are in a discussion with a client and they say, yeah, 00:11:49.650 --> 00:11:55.100 I am, it's okay-ish, but we are struggling with our joiner mover lever processes. 00:11:56.200 --> 00:11:57.900 So it doesn't really work. 00:11:58.000 --> 00:11:58.900 It takes too long. 00:11:58.900 --> 00:12:00.700 Birthrights are slow. 00:12:01.200 --> 00:12:05.400 Of course, deprovisioning is difficult and end of life, not so well done. 00:12:05.800 --> 00:12:09.815 Philipp, how do you translate that into specific capabilities and 00:12:09.815 --> 00:12:14.200 how does that play well or not so well with the target operating model? 00:12:14.500 --> 00:12:20.100 So operational challenges is something that a customer can also come up with at any time. 00:12:20.700 --> 00:12:26.124 That's clear, especially when we are talking to experts in their fields 00:12:26.124 --> 00:12:31.700 that are working hands down deep into technology or functional processes. 00:12:32.100 --> 00:12:34.100 But that is then a different focus. 00:12:34.300 --> 00:12:38.216 So we are basically focusing on a single capability, then mapping that 00:12:38.216 --> 00:12:42.300 again, top down from the identity fabric into the reference architecture. 00:12:43.200 --> 00:12:47.237 Drilling down into that capability and showing how deep 00:12:47.237 --> 00:12:51.200 we can drill down into the details on that capability. 00:12:51.800 --> 00:12:56.306 Of course, we need to ensure that it is understood what the capabilities 00:12:56.306 --> 00:13:01.000 are right and left and how the dependencies between those capabilities are. 00:13:01.500 --> 00:13:04.300 But that is basically what we do. 00:13:04.600 --> 00:13:08.168 So we identify the challenge, we pin it down to a 00:13:08.168 --> 00:13:12.100 capability, we ensure the dependencies are understood. 00:13:12.300 --> 00:13:18.800 And that already creates some awareness and increases the understanding for the structure. 00:13:19.700 --> 00:13:24.000 This is like 50 to 70 percent of the solution already, most of the time. 00:13:24.100 --> 00:13:29.084 It could also mean that some of the origins, the root causes are outside of 00:13:29.084 --> 00:13:34.400 IAM and that is a service-based approach to say, okay, how good is data quality? 00:13:34.600 --> 00:13:36.409 Yes, we have data quality management as a 00:13:36.409 --> 00:13:39.100 capability in identity fabric and the reference architecture. 00:13:39.100 --> 00:13:44.034 But if the quality that is delivered from somewhere else, defined 00:13:44.034 --> 00:13:49.500 somewhere else, that could also already lead to problems in the process. 00:13:49.800 --> 00:13:51.800 So it's the target operating model. 00:13:52.200 --> 00:13:55.203 Working also together with non-IAM teams might be a 00:13:55.203 --> 00:13:58.500 different aspect to look into to get to a whole picture. 00:13:59.000 --> 00:14:02.429 And I think this is an interesting example because this data 00:14:02.429 --> 00:14:06.200 quality and the relationships thing shifted in the latest release. 00:14:07.000 --> 00:14:10.419 We first time showed at our European Identity Conference 00:14:10.419 --> 00:14:13.900 in May, that shifted to one of these foundational layers. 00:14:14.100 --> 00:14:16.861 So there's right now a data and relationship layer, 00:14:16.861 --> 00:14:20.000 which looks at relationships between different identities. 00:14:20.300 --> 00:14:26.000 And we look at the identity fabric at all types of identities, the autonomous identities 00:14:26.000 --> 00:14:31.700 like humans or agents, and the dependent identities like workload identities and others. 00:14:31.700 --> 00:14:37.139 And so we need to deal with relationships nowadays when you go beyond 00:14:37.139 --> 00:14:42.500 the humans and their simple workforce trying to move a lever things. 00:14:42.800 --> 00:14:45.100 And we have the identity information quality issue. 00:14:45.200 --> 00:14:49.661 So this is really something which we understand as a foundational 00:14:49.661 --> 00:14:54.259 element of the fabric, like some of the other foundational elements 00:14:54.259 --> 00:14:59.200 like orchestration, authorization, and certain types of AI capabilities. 00:14:59.200 --> 00:15:04.685 And I think that plays well into what we discussed in the earlier episode, but also 00:15:04.685 --> 00:15:10.500 which is a current challenge that Philipp, Martin, and I are all just working on to say, 00:15:11.200 --> 00:15:16.000 okay, ideally such a fabric is input agnostic. 00:15:16.200 --> 00:15:20.400 The identity fabric is target system and identity agnostic. 00:15:20.900 --> 00:15:25.500 While we are talking right now, identity and access management is changing quite a bit. 00:15:25.500 --> 00:15:30.447 So the question is, how does the concept of the identity fabric and the 00:15:30.447 --> 00:15:36.300 reference architecture, how does it hold up with the developments that we right see? 00:15:36.500 --> 00:15:38.900 It was created to be adaptable, is it Philipp? 00:15:39.000 --> 00:15:39.700 Yeah, absolutely. 00:15:40.100 --> 00:15:45.935 I mean, we have the sets of capabilities, we have made everything expandable at that 00:15:45.935 --> 00:15:51.700 point that we can add new target systems, new identity types as Martin already did. 00:15:51.700 --> 00:15:56.260 We can add new capabilities and based on these identity 00:15:56.260 --> 00:16:01.400 type, we have new perspectives, new aspects, new integrations. 00:16:01.900 --> 00:16:05.500 So there we have a lot of flexibility when it comes to the frameworks. 00:16:06.400 --> 00:16:10.785 It is basically up on us to extend that and to use that and up 00:16:10.785 --> 00:16:15.100 on the customers and clients to understand these new visions. 00:16:16.100 --> 00:16:21.727 Something that I currently see, and I have mentioned that earlier, we 00:16:21.727 --> 00:16:27.273 go away from this tool-focused perspective into a capability-focused 00:16:27.273 --> 00:16:32.900 perspective simply because we move towards an end-to-end perspective. 00:16:34.000 --> 00:16:38.531 And many organizations are doing that not based on a tool 00:16:38.531 --> 00:16:43.300 which has very clear borders and organizational constraints. 00:16:43.300 --> 00:16:48.947 But when we are talking about end-to-end processes, the capability view is very 00:16:48.947 --> 00:16:54.523 helpful and that also shows how many teams and how many tools are part of this 00:16:54.523 --> 00:17:01.100 end-to-end process or journey, especially when we are talking about the recent developments. 00:17:01.100 --> 00:17:07.478 And I think a proof for the identity fabric, I brought it up a bit in the first episode, 00:17:07.478 --> 00:17:14.000 is that several of the foundational concepts were there basically from the very beginning. 00:17:14.000 --> 00:17:19.895 So the identity API layer and related to this, focusing on API-first 00:17:19.895 --> 00:17:26.224 approaches for the technology used, the orchestration basically was there 00:17:26.224 --> 00:17:32.900 in this thinking of a mesh of combining capabilities from the very beginning. 00:17:32.900 --> 00:17:35.300 Some things clearly have been added over time. 00:17:35.700 --> 00:17:39.749 So the ability for signal sharing in both directions, for 00:17:39.749 --> 00:17:43.869 instance, is more pronounced now because we have standards 00:17:43.869 --> 00:17:48.700 for sharing signals nowadays like CAPE and Shared Signals Framework. 00:17:48.900 --> 00:17:52.300 AI clearly is more relevant, more significant in it. 00:17:52.400 --> 00:17:56.000 But I think the foundational concepts we had at the beginning still are here. 00:17:56.300 --> 00:18:01.100 They have been a bit evolved, but not fundamentally changed over the past seven years. 00:18:01.100 --> 00:18:05.964 And going back to your question, with all the changes we are seeing, 00:18:05.964 --> 00:18:10.971 and also when we look at AI, I would dare to say everything in that we 00:18:10.971 --> 00:18:15.835 basically need from a high-level conceptual perspective to deal with 00:18:15.835 --> 00:18:21.200 sort of a new type of actor, a new type of identity, autonomous identities. 00:18:21.200 --> 00:18:25.062 Because we have the relationship in, for instance, so we have agents 00:18:25.062 --> 00:18:28.981 in as an identity, we have relationships in, which is super important 00:18:28.981 --> 00:18:32.900 in the world of agents because it's not just directed access anymore. 00:18:33.000 --> 00:18:34.400 It's a mesh of agents. 00:18:35.400 --> 00:18:38.500 And the fabric is built to deal with these changes. 00:18:39.500 --> 00:18:44.858 And I think also, I brought it up in the first episode last year 00:18:44.858 --> 00:18:50.300 at EIC in 2025, I talked about the identity fabric for the 2040s. 00:18:50.300 --> 00:18:56.957 And I think this is also something which is very essential to that concept that what we 00:18:56.957 --> 00:19:03.384 are doing here is not just solving today's challenge for today, but helping clients, 00:19:03.384 --> 00:19:10.500 helping organizations to build something that withstands change that lasts for a longer time. 00:19:10.600 --> 00:19:15.900 Because I brought up last year this equation of 2025 plus two plus three plus 10 is 2040. 00:19:16.700 --> 00:19:18.800 And it's a very simple equation. 00:19:18.800 --> 00:19:20.200 It wasn't 2025. 00:19:20.600 --> 00:19:25.468 We need two years of planning frequently for a larger tool and gathering the 00:19:25.468 --> 00:19:30.400 batches, et cetera, three years implementation time, not totally unrealistic. 00:19:31.000 --> 00:19:33.200 And then it lives easily 10 years. 00:19:33.800 --> 00:19:37.482 When you look at most of the larger IAM tools, IGA and 00:19:37.482 --> 00:19:41.300 others, they are around for easily longer than a decade. 00:19:41.600 --> 00:19:44.700 Sometimes we see tools that are here for two decades now. 00:19:45.400 --> 00:19:49.300 And that means the fabric is also something which is built for the future. 00:19:49.500 --> 00:19:53.591 Right. And if we bring that into unison, not to say to balance it, 00:19:53.591 --> 00:19:57.868 because balance always comes with a trade-off, but to bring this into 00:19:57.868 --> 00:20:01.897 unison, to have a long-term strategy, to have a north star for an 00:20:01.897 --> 00:20:07.600 architecture and to use the identity fabric and the reference architecture for exactly that. 00:20:08.300 --> 00:20:14.500 And having an evolving identity fabric as well, that needs to be well done. 00:20:15.400 --> 00:20:19.800 So, Philipp, how often does such a fabric itself need to be updated? 00:20:21.000 --> 00:20:24.149 So to make sure that you have that north star, that 00:20:24.149 --> 00:20:28.100 long-running, stable, reliable, long-term planning and strategy. 00:20:28.600 --> 00:20:33.500 And on the other hand, to be capable of adapting to what is changing under the hood. 00:20:33.500 --> 00:20:40.300 As you can see, we are continuously discussing the content and challenging it every day. 00:20:40.900 --> 00:20:45.865 I think the concept of the identity fabric itself is something that 00:20:45.865 --> 00:20:51.200 forces you to stay flexible in your mind, pointing towards the customer. 00:20:51.300 --> 00:20:56.300 If you think capability-based, you need to adapt to what happens. 00:20:56.300 --> 00:21:00.270 But we, as the founders of the Copenhagen Cold Identity 00:21:00.270 --> 00:21:04.600 Fabric and Reference Architecture, are also forced to adapt. 00:21:04.800 --> 00:21:09.300 We cannot launch it and leave it there for years. 00:21:10.000 --> 00:21:14.378 We feel the pressure from the changing market and the 00:21:14.378 --> 00:21:19.500 changing challenges, the changing requirements to adapt to it. 00:21:19.700 --> 00:21:22.342 So in the background, we are constantly 00:21:22.342 --> 00:21:26.000 challenging our framework, constantly improving on it. 00:21:26.300 --> 00:21:31.873 And then snapshot-like, releasing new versions, like Martin did 00:21:31.873 --> 00:21:37.800 on the EIC, of how we will hopefully at the beginning of next year. 00:21:38.700 --> 00:21:42.496 And even interim. So, for instance, this buzzword, 00:21:42.496 --> 00:21:46.900 IWIP, Identity Visibility Intelligence Platform, appeared. 00:21:47.100 --> 00:21:51.000 We got the ask by someone, how does this fit into the fabric? 00:21:51.900 --> 00:21:57.100 And I think this also proves the concept of the fabric and the reference architecture. 00:21:57.300 --> 00:22:01.170 And I'm grateful to Philipp and the team for doing the 00:22:01.170 --> 00:22:05.470 daunting tasks of also filling it up, doing all the detailed 00:22:05.470 --> 00:22:10.200 work, when I come up with maybe a new idea for the bigger picture. 00:22:10.200 --> 00:22:17.407 But I would say it literally took us less than an hour to adapt 00:22:17.407 --> 00:22:25.300 this in a first version to include IWIP and explain where it fits in. 00:22:25.900 --> 00:22:28.422 And that is basically an amalgamation of 00:22:28.422 --> 00:22:31.700 mostly existing, very few new types of capabilities. 00:22:32.300 --> 00:22:35.683 And so it also helps to understand, I think this is 00:22:35.683 --> 00:22:39.000 super important with all the buzzwords popping up. 00:22:39.400 --> 00:22:42.550 IWIP, ISPM, ITDR, or whatever else. Every second 00:22:42.550 --> 00:22:45.700 day or so, someone comes up with a new buzzword. 00:22:45.800 --> 00:22:48.968 And it helps also to take these buzzwords and say, 00:22:48.968 --> 00:22:52.200 okay, let's look, which capabilities are behind it? 00:22:52.200 --> 00:22:56.200 Are they already in, or is there really something new in it? 00:22:56.400 --> 00:23:00.013 And to shift away from this tool-centric 00:23:00.013 --> 00:23:04.800 buzzword bingo thing to a structured decision making. 00:23:05.700 --> 00:23:08.900 And it proves that it works very, very fast. 00:23:09.300 --> 00:23:11.200 So I revise my words. 00:23:11.400 --> 00:23:14.673 So I don't use the word revision of the identity fabric, but 00:23:14.673 --> 00:23:18.000 it's an evolution that we can see that is going on right now. 00:23:18.100 --> 00:23:20.100 But there will be some kind of revolution. 00:23:20.200 --> 00:23:24.400 And we will talk about that in the upcoming episodes in this mini series of episodes. 00:23:24.400 --> 00:23:28.630 And when we look at having the same approach for 00:23:28.630 --> 00:23:33.300 different aspects of what Kupinger Coal is known for, 00:23:33.300 --> 00:23:37.100 and where we're good at, and where we're acting in, and that will be cybersecurity. 00:23:37.500 --> 00:23:41.115 So there will be an episode with the experts around 00:23:41.115 --> 00:23:44.800 the cybersecurity fabric that is currently evolving. 00:23:45.400 --> 00:23:49.421 And more pressing right now, the AI security fabric 00:23:49.421 --> 00:23:53.600 that is currently under development and almost there. 00:23:53.600 --> 00:23:57.200 So that will also demand for this kind of evolution. 00:23:57.900 --> 00:24:01.300 So there will be a first version 1.0 very soon. 00:24:01.500 --> 00:24:06.800 And we will work with that on structuring the market, on supporting our clients, 00:24:06.900 --> 00:24:09.873 doing everything that Philip just explained from 00:24:09.873 --> 00:24:13.900 operational tasks to maturity assessments to make the next steps. 00:24:14.300 --> 00:24:15.900 So I'm really looking forward to that. 00:24:16.200 --> 00:24:20.100 And that makes the work for us advisors, of course, much more complex. 00:24:20.100 --> 00:24:23.681 So when you have more than one fabric, then you end up in 00:24:23.681 --> 00:24:27.200 getting two combined infrastructures, which is possible. 00:24:27.600 --> 00:24:28.800 And this is the target. 00:24:29.400 --> 00:24:30.200 But it's work. 00:24:30.600 --> 00:24:33.400 And this is the work that everybody has to face. 00:24:34.000 --> 00:24:37.000 Before we close down, Philip, a few final thoughts. 00:24:37.100 --> 00:24:39.521 When we look at the fabric, its evolution, and 00:24:39.521 --> 00:24:42.100 how it's applied and how it's evolving right now. 00:24:42.400 --> 00:24:44.100 Yeah, I have a couple words. 00:24:44.100 --> 00:24:48.437 I think it's important to understand that something like the identity 00:24:48.437 --> 00:24:52.900 fabric and the reference architecture is a joint venture to some point. 00:24:53.400 --> 00:24:58.400 And that's why I want to release a little shout out here to the community. 00:24:58.900 --> 00:25:01.800 Feel free to challenge what we have, what we publish. 00:25:02.200 --> 00:25:06.000 And if you think that there is something missing, let us know. 00:25:06.500 --> 00:25:08.000 Approach us, discuss with us. 00:25:08.000 --> 00:25:14.100 Let's understand collaboratively if that fits into the concept. 00:25:14.800 --> 00:25:15.500 Did we miss something? 00:25:15.900 --> 00:25:18.100 That's the major question here. 00:25:18.400 --> 00:25:20.200 And let's clarify that together. 00:25:21.900 --> 00:25:25.100 I think it's very closely related. 00:25:25.900 --> 00:25:29.700 What we deliver is the full paradigm, so to speak. 00:25:31.100 --> 00:25:33.000 Not everyone needs every capability. 00:25:33.000 --> 00:25:36.159 So the individual identity fabric of an 00:25:36.159 --> 00:25:41.100 organization always will look different than the big picture. 00:25:41.300 --> 00:25:46.072 Because it's driven by the requirements for capabilities 00:25:46.072 --> 00:25:51.100 and the way they structure the services of an organization. 00:25:51.800 --> 00:25:57.488 But the overall concepts help exactly moving from a generic perspective, 00:25:57.488 --> 00:26:02.306 fabric and reference architecture, to very concrete guidance, 00:26:02.306 --> 00:26:09.100 architectures, roadmaps, everything, targeted operating models for every organization. 00:26:09.900 --> 00:26:11.400 And that's why we do it. 00:26:11.800 --> 00:26:13.800 Perfect. No more questions, no more comments from my side. 00:26:14.000 --> 00:26:14.900 Thank you very much, Philipp. 00:26:15.000 --> 00:26:18.050 Thank you very much, Martin, for being my guest today, 00:26:18.050 --> 00:26:21.100 for laying out how identity fabric is one incarnation. 00:26:22.300 --> 00:26:25.900 There will be more to cover in upcoming episodes. 00:26:26.400 --> 00:26:28.400 Until then, thank you very much, Philipp. 00:26:28.700 --> 00:26:31.200 And I'm looking forward to the feedback that you asked for. 00:26:31.300 --> 00:26:33.000 So I'm happy to discuss this. 00:26:33.300 --> 00:26:36.335 And if you have any questions, if you have any comments, if you're 00:26:36.335 --> 00:26:39.600 watching this on YouTube, please leave a comment just below that video. 00:26:39.900 --> 00:26:41.200 We are looking at that. 00:26:41.600 --> 00:26:44.300 And no wonder we are replying to that. 00:26:44.400 --> 00:26:46.100 And we take this for serious. 00:26:46.500 --> 00:26:48.400 So every feedback is highly welcome. 00:26:48.700 --> 00:26:49.700 This is a community. 00:26:49.700 --> 00:26:51.400 This is a joint approach. 00:26:51.700 --> 00:26:52.400 So please let us know. 00:26:53.300 --> 00:26:54.800 Until then, thank you very much, Martin. 00:26:54.900 --> 00:26:55.800 Thank you very much, Philipp. 00:26:55.900 --> 00:27:00.000 And looking forward to having you soon in an upcoming episode. 00:27:01.000 --> 00:27:01.300 See you. 00:27:01.500 --> 00:27:01.800 Thank you. 00:27:02.200 --> 00:27:02.700 Thank you. 00:27:03.900 --> 00:27:04.200 Bye-bye. 00:27:23.100 --> 00:27:23.400 Bye-bye.