WEBVTT 00:00:00.000 --> 00:00:19.100 Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. 00:00:19.100 --> 00:00:24.800 I'm analyst and advisor for KuppingerCole Analysts. And for today, it's more important 00:00:24.800 --> 00:00:31.300 that I'm analyst. It's that time of the year where analysts pull out their crystal ball 00:00:31.300 --> 00:00:34.415 and look into the future and make predictions 00:00:34.415 --> 00:00:37.600 for the next year, 2026. And exactly for this, 00:00:37.600 --> 00:00:42.203 I have invited Jonathan Care and Martin Kuppinger 00:00:42.203 --> 00:00:46.900 to discuss exactly that, predictions, expectations 00:00:46.900 --> 00:00:53.100 for 2025. And for today, we are looking at IAM. But first of all, I would like to welcome 00:00:53.100 --> 00:00:55.181 both of them. Hi, Jonathan. Good to have you. 00:00:55.181 --> 00:00:57.400 Hi, Matthias. Good to have you. Good to be here. 00:00:58.600 --> 00:01:01.202 And hi, Martin. Good to have you. Hi, 00:01:01.202 --> 00:01:05.000 Matthias. Pleasure to be again in one of our podcasts. 00:01:05.900 --> 00:01:08.533 Right. And we have two experts with hopefully 00:01:08.533 --> 00:01:11.400 two different perspectives on some of the topics. 00:01:11.400 --> 00:01:15.051 But when we start out, so this crystal ball, 00:01:15.051 --> 00:01:19.200 what do you expect as one key development for 2026 00:01:19.200 --> 00:01:24.500 when we look at IAM, identity and access management evolving? Maybe starting with 00:01:24.500 --> 00:01:27.922 you, Jonathan, what is your key expectation? 00:01:27.922 --> 00:01:31.500 Very, very briefly, I think the biggest threat 00:01:31.500 --> 00:01:37.300 isn't going to be ransomware. It's going to be organizations that have deployed AI agents 00:01:37.300 --> 00:01:40.449 with credentials and broad system access, which 00:01:40.449 --> 00:01:43.800 will overstep our traditional security frameworks. 00:01:44.800 --> 00:01:50.400 And they are acting on harvested identities that they get that from somewhere. 00:01:52.000 --> 00:01:54.505 I'm more thinking that the authorization 00:01:54.505 --> 00:01:57.700 systems we have weren't built for autonomous agents 00:01:58.200 --> 00:02:01.500 and most organizations weren't ready. But then that's our job. 00:02:02.400 --> 00:02:05.114 OK, we need to get back to that. Yeah, 00:02:05.114 --> 00:02:09.400 absolutely. Martin, what are your key expectations for 2026? 00:02:09.400 --> 00:02:13.000 Not giving too much away for the EIC keynote, but hey. 00:02:13.800 --> 00:02:17.500 Yeah, honestly, I didn't really think about my EIC keynote, which is good. 00:02:17.500 --> 00:02:21.200 So I can talk about everything. I don't even know whether I will be the one who 00:02:21.200 --> 00:02:23.744 will be asked to do the EIC keynote. So I'm very 00:02:23.744 --> 00:02:26.500 free in what I can talk about from that perspective. 00:02:26.500 --> 00:02:30.300 So I'm absolutely with Jonathan. AI identity in 00:02:30.300 --> 00:02:34.100 every form will be super essential. So identity 00:02:34.100 --> 00:02:37.976 for AI, AI for identity. And yes, AI empowering 00:02:37.976 --> 00:02:42.100 the identity-based attacks that are anyway running 00:02:42.100 --> 00:02:46.213 at scale for quite a while. It will be a huge 00:02:46.213 --> 00:02:50.600 topic. And so I think we are all still in a very 00:02:51.800 --> 00:02:58.300 honestly early learning phase around how do we handle identities in the IA world for AI, 00:02:58.300 --> 00:03:02.900 adding the complexity, the authorization challenges. This is clearly one of the big areas. 00:03:02.900 --> 00:03:05.677 But there are also, I would say, more down-to-earth 00:03:05.677 --> 00:03:08.400 things, because what I currently see is that a lot 00:03:08.400 --> 00:03:11.596 of organizations and identity management teams 00:03:11.596 --> 00:03:15.000 are a bit overwhelmed by all the innovative stuff 00:03:15.000 --> 00:03:18.667 popping up. So new acronyms and maybe market 00:03:18.667 --> 00:03:22.500 segments, maybe not, appearing in a quite high 00:03:22.500 --> 00:03:26.051 frequency, while organizations still are 00:03:26.051 --> 00:03:31.200 struggling with sometimes really fundamental challenges in 00:03:31.200 --> 00:03:36.500 IAM or with modernization. And finding that balance and avoiding ending up in a 00:03:36.500 --> 00:03:39.293 there's a zoo of tools, a lot of really disparate 00:03:39.293 --> 00:03:42.200 non-integrated solutions, I think is another of the 00:03:42.200 --> 00:03:45.107 big challenges amongst many. So there are a lot 00:03:45.107 --> 00:03:48.200 of things going on and it will be a cool year 2026 00:03:48.200 --> 00:03:51.030 at least for the ones who are looking at trends 00:03:51.030 --> 00:03:53.800 innovation. Right. And if I look at it from my 00:03:53.800 --> 00:03:56.578 perspective to add that as well. So I'm looking at 00:03:56.578 --> 00:03:59.300 that more from the advisory perspective. So and I 00:03:59.300 --> 00:04:02.415 can really just confirm what you just said. So 00:04:02.415 --> 00:04:05.800 there are obviously too much tools around. And the 00:04:05.800 --> 00:04:09.103 question is maybe also to both of you. Why do 00:04:09.103 --> 00:04:12.700 organizations fall for them? Why do they actually 00:04:12.700 --> 00:04:16.187 think that just having this additional tool can 00:04:16.187 --> 00:04:19.600 solve a challenge without properly using that? 00:04:19.600 --> 00:04:22.624 I'm always thinking of that cargo cult term 00:04:22.624 --> 00:04:26.000 that Alex, our colleague, tries or likes to use. 00:04:26.000 --> 00:04:31.800 So is it necessary to have everything or why are organizations falling for that, Jonathan? 00:04:32.700 --> 00:04:37.800 Well, I think I like the cargo cult piece because I think that applies very well to 00:04:38.500 --> 00:04:41.304 the ways we're thinking about AI in general. 00:04:41.304 --> 00:04:44.300 But I think as far as a tool suit goes, I think 00:04:44.300 --> 00:04:50.000 there's this pressure to consolidate. And the promise from I think many vendors is 00:04:50.000 --> 00:04:57.400 if you consolidate, then by using this tool, a manager of managers, you'll get your 00:04:57.400 --> 00:05:02.500 consolidation. And I think it's a myth. We're not actually escaping the tool suit. 00:05:03.200 --> 00:05:06.514 I think we're building bigger cages with fewer 00:05:06.514 --> 00:05:09.900 vendors in. And what happens is that complexity 00:05:09.900 --> 00:05:12.689 hasn't actually gone away. It's just buried in 00:05:12.689 --> 00:05:15.600 vendor integration layers that we don't control. 00:05:16.500 --> 00:05:23.700 Yeah, so I think one of the aspects why people go for these new tools is they know 00:05:24.600 --> 00:05:27.050 they haven't solved everything, which is really 00:05:27.050 --> 00:05:29.500 hard to do in a fast-moving field like identity 00:05:29.500 --> 00:05:36.900 management and also cybersecurity. They are afraid of if they don't do something, they 00:05:38.100 --> 00:05:45.000 may become the victim of audit findings, of cyberattacks, whatever. So better do something 00:05:45.800 --> 00:05:49.510 fast, sometimes might be rational behind that. 00:05:49.510 --> 00:05:53.300 And clearly it's also this hype of things which 00:05:53.300 --> 00:05:55.915 is pushed, so you need this and this and that. 00:05:55.915 --> 00:05:58.700 And I think there's a good reason that we came up 00:05:58.700 --> 00:06:03.800 a couple of years ago with this concept of the identity fabric, which if I remember right, 00:06:04.700 --> 00:06:08.000 had this sort of initial ideas in a joint advisory 00:06:08.000 --> 00:06:11.300 project where you, Matthias, and me were involved. 00:06:11.300 --> 00:06:17.000 So it emerged from there, from practice as well as from the research and the analyst side, 00:06:18.300 --> 00:06:22.208 something which is built to help organizations 00:06:22.208 --> 00:06:26.200 to structure what they are doing, to understand 00:06:26.200 --> 00:06:30.200 which are the gaps, which are the biggest gaps, which are the things they don't need yet. 00:06:31.000 --> 00:06:34.900 And moving forward together as a reference architecture in a really structured manner 00:06:34.900 --> 00:06:38.239 towards something which becomes more and more 00:06:38.239 --> 00:06:41.800 integrated. I think that also leads to something 00:06:41.800 --> 00:06:45.100 which I still observe in many organizations. So we see a lot of organizations adopting 00:06:45.700 --> 00:06:48.519 paradigms like the identity fabric and really 00:06:48.519 --> 00:06:51.400 trying to consolidate initiatives. But we also 00:06:51.400 --> 00:06:57.900 see a lot of, and this is something I still hear way too frequent, we don't have the time 00:06:58.500 --> 00:07:02.266 to do proper architecture roadmap, et cetera, 00:07:02.266 --> 00:07:06.200 work. This would be the same, I think, standard 00:07:06.900 --> 00:07:09.719 comparison, standard picture, the same like 00:07:09.719 --> 00:07:12.800 building a house without any architects and any 00:07:13.900 --> 00:07:21.000 engineers for the static stuff, et cetera, doesn't make sense. So don't do it for IAM. 00:07:21.800 --> 00:07:26.045 No, I like identity fabric and I think that the 00:07:26.045 --> 00:07:30.200 architecture looks lovely. I guess my concern, 00:07:30.200 --> 00:07:38.000 if I'm going to play the devil's advocate here, is that we run the risk of going into 00:07:38.000 --> 00:07:41.081 a very brittle environment. So you have many, many 00:07:41.081 --> 00:07:44.100 connectors and everything works until it doesn't. 00:07:44.600 --> 00:07:47.166 And when you're then troubleshooting, you then 00:07:47.166 --> 00:07:49.900 have not one vendor, you have five vendor support 00:07:49.900 --> 00:07:52.819 teams, all of whom are pointing fingers at each 00:07:52.819 --> 00:07:55.800 other. And so that can be even more challenging. 00:07:55.800 --> 00:07:58.573 But I think the concept of the identity 00:07:58.573 --> 00:08:02.200 fabric is lovely and I like the idea that identity, 00:08:02.200 --> 00:08:05.000 when it works, should be something that fades 00:08:05.000 --> 00:08:07.800 into the background. It should become part of 00:08:07.800 --> 00:08:10.879 the infrastructure. But to bring up a counter 00:08:10.879 --> 00:08:14.300 argument, in today's world of identity management, 00:08:15.200 --> 00:08:19.192 you always have multiple connectors. So even if 00:08:19.192 --> 00:08:23.100 you go to the same vendor and say, okay, I buy 00:08:23.100 --> 00:08:26.100 a GA, so identity governance, administration, 00:08:26.100 --> 00:08:29.300 life cycles, et cetera, I buy access management, 00:08:29.300 --> 00:08:32.151 I buy PAM from that vendor, you most likely 00:08:32.151 --> 00:08:35.400 will end up with three tools from the same vendor 00:08:35.400 --> 00:08:38.628 with three different connectors, very likely. 00:08:38.628 --> 00:08:42.000 I think if we move to something which helps us, 00:08:42.000 --> 00:08:44.109 for instance, onboarding, and I think amongst 00:08:44.109 --> 00:08:46.500 the big problems we are facing at IAM is definitely 00:08:46.500 --> 00:08:49.125 application onboarding. That is something, by 00:08:49.125 --> 00:08:52.100 the way, where AI can help us in speeding up things 00:08:52.100 --> 00:08:55.035 and simplifying things and automating things. 00:08:55.035 --> 00:08:58.100 We can handle that quite well. And then I think 00:08:58.100 --> 00:09:03.400 the orchestration clearly is the thing which is a bit sort of a new playing field for most 00:09:03.400 --> 00:09:07.138 organizations. Right now, we mostly see custom 00:09:07.138 --> 00:09:11.200 bidirectional bespoke integrations versus building 00:09:11.200 --> 00:09:13.840 on orchestration layer that allows us a very 00:09:13.840 --> 00:09:16.600 flexible integration. So we see things clearly 00:09:16.600 --> 00:09:19.350 that are new, that are a new playing field, require 00:09:19.350 --> 00:09:22.100 a new experience. But overall, I personally believe 00:09:22.100 --> 00:09:29.300 that, especially with the flexibility of the identity fabric, where you can say I purchase 00:09:29.300 --> 00:09:32.832 most from my preferred supplier and just fill 00:09:32.832 --> 00:09:36.600 the gaps. Or you say I go for the best of breed. 00:09:36.600 --> 00:09:42.500 Both works in the paradigm of the identity fabric. So there's the choice still. And it 00:09:42.500 --> 00:09:48.200 also reflects that virtually no organization starts identity management on a green field. 00:09:49.000 --> 00:09:52.061 Most have a lot of fields which are not used 00:09:52.061 --> 00:09:55.400 at all currently or not covered at all. And then 00:09:55.400 --> 00:09:58.484 they have some brown field and maybe some black 00:09:58.484 --> 00:10:01.700 field even. So all that legacy stuff that doesn't 00:10:01.700 --> 00:10:04.315 work anymore after 15 years. And still you can 00:10:04.315 --> 00:10:07.100 incorporate this into this picture and also think 00:10:07.100 --> 00:10:09.600 about how do you migrate at your own pace. But 00:10:09.600 --> 00:10:12.100 I don't want to dig too deep into the identity 00:10:12.100 --> 00:10:14.571 fabric because there's a ton of research, a ton 00:10:14.571 --> 00:10:17.200 of podcasts that are around it. And I'm absolutely 00:10:17.200 --> 00:10:20.182 sure that Matthias will put a lot of links into 00:10:20.182 --> 00:10:23.100 or around this podcast to give you some hints. 00:10:23.100 --> 00:10:29.300 And by the way, good situation here to hint on their subscriptions. If you want to access 00:10:29.300 --> 00:10:33.900 everything, go for KC membership. But back to you, Matthias and Charles. 00:10:33.900 --> 00:10:37.800 Yeah, okay. But I think maybe Jonathan mentioned that already, playing devil's advocate. 00:10:37.800 --> 00:10:41.058 I think some reason for this IAM tool zoo that 00:10:41.058 --> 00:10:44.600 we are seeing is that many organizations are still 00:10:44.600 --> 00:10:47.717 struggling with lots of not only technical debt 00:10:47.717 --> 00:10:50.900 but process debt. So that they really understand 00:10:50.900 --> 00:10:53.431 that they don't understand maybe that some of 00:10:53.431 --> 00:10:56.300 the issues where they are throwing new technologies 00:10:56.300 --> 00:11:01.700 at are problems that should have been solved earlier. Parts of NHI that we talk about are 00:11:01.700 --> 00:11:04.882 technical accounts. Hey, this is Pam. That should 00:11:04.882 --> 00:11:08.000 have been done 10 years ago. If we look at let's 00:11:08.000 --> 00:11:10.508 throw AI and access intelligence on my IGA. 00:11:10.508 --> 00:11:13.600 Yeah, this is access governance that should have been 00:11:13.600 --> 00:11:22.700 fixed 12 years ago. And on and on and on. So this is really something where new and really 00:11:22.700 --> 00:11:29.600 intelligent vendors come along, create a new great acronym, a new kind of new tooling. 00:11:30.200 --> 00:11:35.000 And that comes with the promise of solving everything. And that extends the platform 00:11:35.000 --> 00:11:39.700 landscape on and on, right? There's an interesting lagmas test you may apply. 00:11:40.600 --> 00:11:48.400 If most vendors in one of these new segments are in fact established old vendors, then 00:11:48.400 --> 00:11:52.050 most likely there's not that much fundamentally 00:11:52.050 --> 00:11:55.700 new in it. For IWIB, this identity, visibility, 00:11:55.700 --> 00:12:02.400 and intelligence platforms, big quotas, I would say the vast majority of vendors that 00:12:02.400 --> 00:12:11.500 jumped on IWIB have been around for quite a while. I think, yeah, IGA is something that 00:12:11.500 --> 00:12:14.586 fascinates me, although I try to observe it from 00:12:14.586 --> 00:12:17.800 a distance. It's been a perennial problem. I mean, 00:12:17.800 --> 00:12:23.600 I was auditing systems 20 years ago, and I was saying, what are you doing about your 00:12:23.600 --> 00:12:28.900 joiners, movers, and levers? And people go, I don't know. And we have improved on that. 00:12:28.900 --> 00:12:37.000 But nevertheless, I think this idea of one governance layer gives us one failure domain. 00:12:37.000 --> 00:12:39.860 And we get efficiency, but we also get 00:12:39.860 --> 00:12:44.000 fragility in equal measure. I think the problem with AI 00:12:44.000 --> 00:12:50.300 is the amount of data obviously an AI needs is quite significant. And the idea, I am an AI 00:12:50.300 --> 00:12:56.600 enthusiast, as indeed I think all of us are, the idea of real-time analytics on policy, 00:12:56.600 --> 00:13:03.200 on a governance, sounds wonderful. I think in practice, what we're trying to do is what we 00:13:03.200 --> 00:13:06.022 used to try and do with SIEMS 15 years ago. 00:13:06.022 --> 00:13:09.500 We're trying to grab everything, every signal we can, 00:13:10.100 --> 00:13:16.200 and stuff it into an AI, into an analytics engine. But the signal-to-noise ratio, I think, 00:13:16.200 --> 00:13:24.400 is going to be terrible, and is what defeats us. Which I think brings up some interesting 00:13:24.400 --> 00:13:30.400 thoughts about where do we see evolution. I think one is thinking about more integrated 00:13:30.400 --> 00:13:32.604 governance layers. So you said there's a 00:13:32.604 --> 00:13:35.800 challenge with that. I think there are two layers. The one 00:13:35.800 --> 00:13:41.500 is early governance from a process perspective. The other is more dealing with the amount 00:13:42.700 --> 00:13:49.400 of signals and making sense out of the signals. I see some tendency towards saying, okay, 00:13:49.400 --> 00:13:53.800 we need, first we need governance for areas where we hadn't governance, like what we call 00:13:53.800 --> 00:13:56.477 non-human identities, or part of that agendic AI, 00:13:56.477 --> 00:13:59.100 where we just have a lack of governance. We need 00:13:59.100 --> 00:14:02.218 it. And we should work, and I see some players in 00:14:02.218 --> 00:14:05.400 the market working on avoiding that we end up with 00:14:05.400 --> 00:14:08.431 a lot of governance silos and moving more towards 00:14:08.431 --> 00:14:11.400 a holistic perspective. And a lot of things like 00:14:11.400 --> 00:14:18.000 ownership, et cetera, and risk exposure, risk information can be handled quite well here. 00:14:18.000 --> 00:14:22.800 The other element you brought up, and I think both are worth to further discuss right now, 00:14:23.400 --> 00:14:26.566 the other element really is how can we make, or 00:14:26.566 --> 00:14:29.800 what do we need to do to make AI results better? 00:14:29.800 --> 00:14:32.889 I think we hear every day, we read every day 00:14:32.889 --> 00:14:36.400 about alert fatigue of SOC analysts, for instance, 00:14:36.400 --> 00:14:44.500 about burnouts even. I think we are learning that AI is pretty good in spotting anomalies, 00:14:45.400 --> 00:14:53.000 but pretty bad in understanding the context, the reason of that. Is this a real anomaly, 00:14:53.600 --> 00:14:56.350 or is this something which a human can easily 00:14:56.350 --> 00:14:59.100 spot and say, oh, yes, it's the first time we 00:14:59.100 --> 00:15:02.047 run this AI, and it hits the end of year 00:15:02.047 --> 00:15:06.100 bookings in our ERP system, and yes, there is something 00:15:06.100 --> 00:15:08.425 different by the end of the fiscal year than it 00:15:08.425 --> 00:15:10.800 is for the rest of the fiscal year. Very obvious 00:15:10.800 --> 00:15:14.399 anomaly for a human, not necessarily for an 00:15:14.399 --> 00:15:18.500 untrained or just supervised, trained and learned 00:15:19.000 --> 00:15:24.400 AI. So I think we will see evolutions, but I personally believe, and this would be another 00:15:24.400 --> 00:15:27.850 theme which I see as a trend, that we will see a 00:15:27.850 --> 00:15:31.300 massive use of shared signals for many use cases 00:15:31.300 --> 00:15:34.008 with quite some learning curve. Right, and I 00:15:34.008 --> 00:15:36.900 think that is exactly providing that additional 00:15:36.900 --> 00:15:41.700 amount of data that we need so that we can better understand what's actually going on. 00:15:41.700 --> 00:15:46.000 What do you think, Jonathan, could that be an area where AI really can add value? 00:15:46.800 --> 00:15:50.314 I think one of the challenges of shared 00:15:50.314 --> 00:15:55.000 signals is we're asking vendors to share the wealth, 00:15:55.000 --> 00:15:57.173 and there's no doubt that this is the right 00:15:57.173 --> 00:15:59.800 thing to do for their customers. It's something that 00:15:59.800 --> 00:16:05.400 Martin, myself and Smallway, we've all been calling for vendors to be more open. 00:16:06.600 --> 00:16:10.442 However, of course, vendors don't want to lose 00:16:10.442 --> 00:16:14.200 what they see as an opportunity to corner the 00:16:14.200 --> 00:16:16.878 market. They don't want to lose the opportunity 00:16:16.878 --> 00:16:19.500 to obviously embrace the customer, and so that 00:16:19.500 --> 00:16:24.098 incentive to share signals I think is broken. 00:16:24.098 --> 00:16:28.900 I think IDTR is a great thing, but it's showing 00:16:28.900 --> 00:16:32.550 that correlation is hard. Correlation is not easy, 00:16:32.550 --> 00:16:36.200 and the same things we saw with SIEM 15 years ago. 00:16:37.200 --> 00:16:44.600 We don't, as far as I see, have very strong and rigorous standards for identity telemetry, 00:16:44.600 --> 00:16:46.975 and I think the reason that these don't exist is 00:16:46.975 --> 00:16:49.300 because vendors, I think, benefit from lock-in. 00:16:49.900 --> 00:16:53.250 So, we need to encourage everybody, our clients, 00:16:53.250 --> 00:16:56.600 and as Martin said, this is one of the things we 00:16:56.600 --> 00:17:02.700 talk about in our memberships. We encourage vendors. We encourage end users towards what 00:17:02.800 --> 00:17:08.300 we believe are beneficial best practices, and we need to encourage all of us to move 00:17:08.300 --> 00:17:13.000 to this shared part of shared signals, not just marketing, but reality. 00:17:13.000 --> 00:17:13.900 Martin, do you agree? 00:17:15.100 --> 00:17:17.450 I think, first, the good thing is we have, right 00:17:17.450 --> 00:17:19.800 now, standards out like shared signals framework 00:17:19.800 --> 00:17:23.035 and other standards around it, which is great. 00:17:23.035 --> 00:17:26.200 So, we are finally moving to a world where we 00:17:26.200 --> 00:17:29.250 have standards to share signals, share telemetry 00:17:29.250 --> 00:17:32.300 information. I think it depends very much on the 00:17:32.300 --> 00:17:38.100 domain, whether there's a willingness also of end-user organizations to share information, 00:17:38.100 --> 00:17:40.856 and there's also, it's in the organizations, 00:17:40.856 --> 00:17:43.800 clearly, the challenge of how do you make sense 00:17:43.800 --> 00:17:47.821 of signals from different domains? So, we are 00:17:47.821 --> 00:17:52.200 not horribly bad when we look at whatever network 00:17:52.200 --> 00:17:56.050 level and system level events in our SOC tools. 00:17:56.050 --> 00:17:59.900 We are not far from perfect reductions already. 00:17:59.900 --> 00:18:05.400 Identity is, in tendency, a bit more complex because there's the business process behind. 00:18:06.000 --> 00:18:10.600 We have continuous controls monitoring. So, when it comes really to the business systems, 00:18:10.600 --> 00:18:13.619 business transactions, and clearly for an attack, 00:18:13.619 --> 00:18:16.700 it would make a ton of sense to look at everything 00:18:17.300 --> 00:18:21.000 from a deep fake detection signal to what is going on in the network. 00:18:21.000 --> 00:18:23.447 Is this user actually somewhere authenticated? 00:18:23.447 --> 00:18:26.000 So, if there's something happening in a session, 00:18:26.000 --> 00:18:32.300 two, or whatever, and the user is nowhere authenticated in your own domain, then probably 00:18:32.300 --> 00:18:34.573 there's something wrong. And then looking at 00:18:34.573 --> 00:18:37.000 what transactions are happening, is there money 00:18:37.000 --> 00:18:40.874 sent somewhere? If you join all that, it makes 00:18:40.874 --> 00:18:45.000 perfect sense. But the challenge is you then need 00:18:45.000 --> 00:18:48.450 to, so to speak, or you need to have, I try to 00:18:48.450 --> 00:18:51.900 avoid the term train, you need to have systems 00:18:51.900 --> 00:19:00.100 that are capable of making sense of way more different types of signals than before. So, 00:19:00.100 --> 00:19:02.620 solving a certain problem domain and optimizing 00:19:02.620 --> 00:19:05.300 is relatively simple. The more problem domains you 00:19:05.300 --> 00:19:10.500 bring together, the more complex it is, even for AI. Right. And just if we strike out the 00:19:10.500 --> 00:19:14.900 shared in the signals, not shared signals, but just signals using them for authentication, 00:19:14.900 --> 00:19:17.650 for continuous authentication, we want to talk 00:19:17.650 --> 00:19:20.400 also about technological trends or trends that 00:19:20.400 --> 00:19:24.150 are finally manifesting within enterprises and 00:19:24.150 --> 00:19:27.900 organizations in general. Will we see in 2026, 00:19:28.500 --> 00:19:31.345 really the advent of continuous authentication 00:19:31.345 --> 00:19:34.500 based on a lot of internal signals, not necessarily 00:19:34.500 --> 00:19:40.000 shared, so that we better understand what our end users are doing because we collect more 00:19:40.000 --> 00:19:46.900 information and can decide more frequently and more accurately what's going on. Jonathan, 00:19:46.900 --> 00:19:51.449 do you agree? I do. And I'm, again, obviously 00:19:51.449 --> 00:19:56.100 very interested in Martin Jew here. I love the 00:19:56.100 --> 00:20:02.000 concept of security. I love the concept of continuous authentication. However, when I 00:20:02.000 --> 00:20:05.134 talked to one of the big web provider security 00:20:05.134 --> 00:20:08.200 managers, they said, you know, our concern is 00:20:09.400 --> 00:20:12.864 tokens have lifetimes of hours or even days. And 00:20:12.864 --> 00:20:16.400 so we get really, really panicky when we hear any 00:20:16.500 --> 00:20:20.146 kind of endpoint event where tokens are at 00:20:20.146 --> 00:20:24.400 risk, where tokens are exposed. Because the UX is 00:20:24.400 --> 00:20:27.681 continuous for continuous authentication, but 00:20:27.681 --> 00:20:31.400 the security is still point in time, point in time. 00:20:32.200 --> 00:20:35.959 And the idea of behavioral baselines, I think, 00:20:35.959 --> 00:20:39.800 is still not there because normal behavior does 00:20:39.800 --> 00:20:42.743 change. We do evolve our behavioral habits. And 00:20:42.743 --> 00:20:46.000 so, again, you end up with what Martin quite rightly 00:20:46.000 --> 00:20:49.675 referred to earlier. We have false positives 00:20:49.675 --> 00:20:53.600 leading to alert fatigue or they just get tuned 00:20:53.600 --> 00:20:59.250 out. But I guess I used to be a huge fan of the 00:20:59.250 --> 00:21:04.900 whole piece around privacy and surveillance and 00:21:04.900 --> 00:21:08.275 employee monitoring and so on, how that can 00:21:08.275 --> 00:21:12.200 combat insider risk. But it is still surveillance. 00:21:13.000 --> 00:21:19.900 Transparent monitoring is still monitoring. And I think that we are starting to see 00:21:20.800 --> 00:21:26.700 resistance in many privacy aware communities, such as many of the countries in the EU, 00:21:28.200 --> 00:21:31.266 to this idea of continuously being monitored, 00:21:31.266 --> 00:21:34.400 whether it's behavior monitoring, whether it's 00:21:34.400 --> 00:21:37.500 activity monitoring. The backlash, I think, is 00:21:37.500 --> 00:21:40.600 starting to grow. The resistance against it is 00:21:40.600 --> 00:21:42.781 starting to grow. I have another question 00:21:42.781 --> 00:21:45.600 that's negative. So, first, I think, yes, we will see 00:21:46.600 --> 00:21:53.400 quite some major evolution around continuous authentication, maybe also leading the path 00:21:54.200 --> 00:21:57.400 this way into passive authentication where we 00:21:57.400 --> 00:22:00.600 don't actively authenticate anymore. That may 00:22:00.600 --> 00:22:03.245 take a bit longer. So, we will see things 00:22:03.245 --> 00:22:06.600 there. Some I know, some I can't talk about yet, but 00:22:06.600 --> 00:22:09.093 there will be some interesting announcements 00:22:09.093 --> 00:22:11.700 from some players in the market, for sure. So, 00:22:11.700 --> 00:22:13.590 that is something which will happen. Will there 00:22:13.590 --> 00:22:15.600 be too much resistance? I think it depends on what 00:22:15.600 --> 00:22:18.865 you're looking at. And, you know, when you look 00:22:18.865 --> 00:22:22.200 at how you handle it, I think this is the point. 00:22:22.200 --> 00:22:24.550 So, if you say, okay, for this transaction, you 00:22:24.550 --> 00:22:27.000 need another sort of approval or just verify that 00:22:27.000 --> 00:22:29.088 it's really a transaction you want to do, and 00:22:29.088 --> 00:22:31.500 it's in the business context, I think this will work 00:22:31.500 --> 00:22:34.065 relatively well. And I think we also must not 00:22:34.065 --> 00:22:36.800 underestimate that people even here or in Europe 00:22:36.800 --> 00:22:43.900 become more and more used to it. So, when I take my car, which I bought earlier this year, 00:22:44.600 --> 00:22:48.570 that car is basically constantly watching me 00:22:48.570 --> 00:22:52.900 as a driver. And when I appear to fall to sleep, 00:22:53.800 --> 00:23:01.400 it will do an emergency stop, which is, at the end of the day, positive, which is 00:23:01.400 --> 00:23:04.900 probably something you need to get used to. But 00:23:04.900 --> 00:23:08.400 I think it's always a matter of what do you do, 00:23:08.400 --> 00:23:11.078 how do you do it, what is the purpose? And this 00:23:11.078 --> 00:23:13.700 is well understood and felt as being something 00:23:13.700 --> 00:23:17.008 which is sort of intrusive and going beyond 00:23:17.008 --> 00:23:20.700 what is acceptable. And I think there are enough 00:23:20.700 --> 00:23:23.391 scenarios where this continuous authentication 00:23:23.391 --> 00:23:26.200 can really make a lot of sense and deliver a lot 00:23:26.200 --> 00:23:28.469 of value. So, I think we will see a 00:23:28.469 --> 00:23:32.100 significant uptake here. And when we go back, I remember 00:23:33.000 --> 00:23:37.397 if we would have done this podcast 10, maybe 15 00:23:37.397 --> 00:23:41.700 years ago, we may have talked about biometrics 00:23:42.500 --> 00:23:51.400 that make a lot of sense but are not accepted until Apple introduced fingerprint sensors 00:23:51.400 --> 00:23:57.300 on the iPhone. And then later on moved to face ID, perfectly accepted nowadays. 00:23:58.100 --> 00:24:03.700 And we had a lot of discussions there. So, I think it's also a bit of getting acquainted 00:24:04.600 --> 00:24:09.900 to that and understanding for what is it used, how is it used. And at the end of the day, 00:24:09.900 --> 00:24:19.000 the benefit must be bigger than the sort of the negative side of the fear and the risks 00:24:19.000 --> 00:24:21.933 and stuff like that. But honestly, every one 00:24:21.933 --> 00:24:25.000 of us, I think nowadays, or a lot of at least, 00:24:25.000 --> 00:24:28.016 a lot, not everyone probably, but a lot of us 00:24:28.016 --> 00:24:31.100 are scared by the cybersecurity risks we have. 00:24:31.800 --> 00:24:37.100 We don't want to be the entry door for the attacker. So, if something happens, 00:24:37.100 --> 00:24:43.200 hopefully it's not our system, our endpoint to come in. So, at the end of the day, 00:24:43.200 --> 00:24:46.600 doing these things well also takes a burden from every user. 00:24:46.600 --> 00:24:52.300 Do you think that this model then of, as you say, consumerization of technology, 00:24:52.300 --> 00:24:57.600 do you think that will happen that we will become so used to, as you say, I mean, my car, 00:24:57.600 --> 00:25:00.579 yeah, I don't drive a nice car like yours, I 00:25:00.579 --> 00:25:04.100 just have a cheap Hyundai. But I love it anyway. But 00:25:04.100 --> 00:25:07.735 yes, it also has this behavioral monitoring. 00:25:07.735 --> 00:25:11.700 So, we get used to that. And I guess my TV says, 00:25:11.700 --> 00:25:15.211 are you still watching this Netflix series or 00:25:15.211 --> 00:25:18.800 whatever? So, yeah, we are getting used to our 00:25:19.700 --> 00:25:27.400 consumer devices are watching our behavior. So, as you say, that does tend to get societal 00:25:27.400 --> 00:25:30.483 acceptance. Do you think then that we'll get to 00:25:30.483 --> 00:25:33.500 the stage where, as you say, this will just be 00:25:33.500 --> 00:25:37.011 part of the workplace that we expect that our 00:25:37.011 --> 00:25:40.600 mouse movements, our application usage will be 00:25:40.600 --> 00:25:44.439 routinely monitored? Isn't it that we always want 00:25:44.439 --> 00:25:48.200 to have a workplace being as smooth as the stuff 00:25:48.200 --> 00:25:54.200 we use in our personal life? There are some capabilities built into M365, for example, 00:25:54.200 --> 00:25:57.024 where I would say, okay, is this really not a 00:25:57.024 --> 00:26:00.100 bit too much to say, okay, there's an interesting 00:26:00.100 --> 00:26:02.929 document that you could be interested that your 00:26:02.929 --> 00:26:06.300 colleague is working on. So, this is this recommendation 00:26:06.300 --> 00:26:11.300 that you usually see really from social media platforms. And now it says, okay, yeah, 00:26:11.300 --> 00:26:13.550 there's somebody working on a similar topic with 00:26:13.550 --> 00:26:15.800 a document that you can open up here. And we are 00:26:15.800 --> 00:26:18.243 used to that. This is already there, this 00:26:18.243 --> 00:26:21.700 recommendation system. So, the question is, is it helpful? 00:26:22.600 --> 00:26:29.000 Is it cheesy? Is it too intrusive? Or does it just help me in my daily work, Martin? 00:26:29.000 --> 00:26:32.334 I would say yes, yes, yes, and yes. It's helpful, 00:26:32.334 --> 00:26:35.600 it's cheesy, it's too intrusive, and it's really 00:26:35.600 --> 00:26:38.156 good for the daily work. So, at the end of the 00:26:38.156 --> 00:26:41.100 day, I think it's yes to everything. But on the other 00:26:41.100 --> 00:26:46.400 hand, everyone working in an organization, probably bigger than one or two people, 00:26:47.400 --> 00:26:50.333 knows that there are scenarios where you, at 00:26:50.333 --> 00:26:53.400 some time, learn that someone already has been 00:26:53.400 --> 00:26:56.900 looking at whatever this and this and this. And 00:26:56.900 --> 00:27:00.400 so, that also can be extremely helpful. I think 00:27:00.400 --> 00:27:03.022 it's even maybe from a management perspective, 00:27:03.022 --> 00:27:05.700 sometimes positive, because it tends to drive a 00:27:05.700 --> 00:27:08.173 culture of more openness and less silos in 00:27:08.173 --> 00:27:11.000 organizations. So, I think you can find a lot of 00:27:11.000 --> 00:27:13.143 positive things. And interestingly, when I 00:27:13.143 --> 00:27:16.000 learned about that feature at the beginning, I felt, oh, 00:27:16.000 --> 00:27:19.620 this is a bit weird. In my daily work so far, 00:27:19.620 --> 00:27:23.400 I never felt it being really problematic to me. 00:27:24.000 --> 00:27:28.400 Sometimes it's helpful, sometimes I just ignore it. But at the end of the day, 00:27:29.800 --> 00:27:35.700 the positive things clearly outweigh, by far, the negative things. 00:27:37.200 --> 00:27:44.700 I think you make a great point that security, identity, all these things 00:27:44.700 --> 00:27:47.710 exist to serve the organization. They don't 00:27:47.710 --> 00:27:51.000 exist to rule the organization. And as you say, 00:27:51.000 --> 00:27:53.901 what's important is that we enable people to 00:27:53.901 --> 00:27:57.000 collaborate and communicate easily and quickly. 00:27:57.000 --> 00:28:03.300 And I think, as I say, without the tools that enable that, you end up, as you say, with 00:28:03.800 --> 00:28:07.120 vastly reduced productivity. If it's an effort 00:28:07.120 --> 00:28:10.800 for me to communicate with Matthias or with Martin, 00:28:10.900 --> 00:28:13.171 then I'll just figure it out myself. If it's 00:28:13.171 --> 00:28:15.700 something I can do easily and quickly, I can just 00:28:15.700 --> 00:28:17.732 say, hey, put a little note in Docky and say, 00:28:17.732 --> 00:28:19.900 hey, Martin, what do you think about this point? 00:28:20.600 --> 00:28:22.950 Martin will see that and go, oh, this is what I 00:28:22.950 --> 00:28:25.400 think. That is transformative. And especially for 00:28:26.100 --> 00:28:29.726 companies like CuppaCocoa is a, as you know, 00:28:29.726 --> 00:28:33.600 is a remote first company. Many of our end user 00:28:33.600 --> 00:28:39.400 organizations are now finding that balance between in-office and remote first to get 00:28:39.400 --> 00:28:44.000 the best out of their talent. And tools that enable that and support that, I think, yes, 00:28:44.000 --> 00:28:49.800 absolutely valuable. Okay. Well, almost apart from the 30 minutes, which we planned for, 00:28:49.800 --> 00:28:52.350 there is a ton of topics we haven't covered yet. 00:28:52.350 --> 00:28:54.900 We have not talked about PAM. We have not really 00:28:54.900 --> 00:29:01.300 talked about NHI. We have not really talked about all this decentralized identity, EUDI, 00:29:01.300 --> 00:29:03.941 ecosystems, et cetera, et cetera. So I assume 00:29:03.941 --> 00:29:06.700 there will be a follow-up episode anyway. And I 00:29:07.400 --> 00:29:11.700 also think we should have an episode on cybersecurity, which we have not yet touched at 00:29:11.700 --> 00:29:19.000 all, unless it's part of IAM, which it is, of course. But maybe as a final question, 00:29:19.000 --> 00:29:23.261 just a quick round for all three of us. When you 00:29:23.261 --> 00:29:27.700 think of IAM in 2026, what do you think is the one 00:29:27.700 --> 00:29:31.213 capability that is new in 2026 in real life, in 00:29:31.213 --> 00:29:34.800 an identity fabric, a new capability that hasn't 00:29:34.800 --> 00:29:41.400 been there last year or two years ago? What is really new in IAM? What do you expect to be 00:29:42.100 --> 00:29:45.868 really there in IAM? Jonathan? I have one that 00:29:45.868 --> 00:29:49.800 I love, and it actually springs from what Martin 00:29:49.800 --> 00:29:55.900 was talking about, the consumerization of technology. Passwordless authentication touches 00:29:55.900 --> 00:29:59.605 everything. And passwordless simplifies and 00:29:59.605 --> 00:30:04.000 indeed improves greatly the security authentication 00:30:04.000 --> 00:30:07.537 process. I am quite the fan of it, and I expect 00:30:07.537 --> 00:30:11.300 to see that being more and more prevalent in 2026. 00:30:11.300 --> 00:30:16.050 Hopefully beyond just the workforce world into 00:30:16.050 --> 00:30:20.800 the consumer world, because you still have way 00:30:20.800 --> 00:30:27.900 too many passwords there. I was setting up a new computer and then a different platform, 00:30:27.900 --> 00:30:31.709 installing a couple of apps, adding some apps. 00:30:31.709 --> 00:30:35.600 I needed so many passwords. And we are in 2025, 00:30:36.300 --> 00:30:38.757 and it's still like in the 1990s. Sorry. I 00:30:38.757 --> 00:30:41.800 think a lot of developers need to really learn about 00:30:41.800 --> 00:30:45.490 that there is passwordless. So the one thing I 00:30:45.490 --> 00:30:49.100 hope we will see gaining quite some traction, 00:30:49.100 --> 00:30:52.243 also another thing we didn't touch today, 00:30:52.243 --> 00:30:56.000 that is, I would say, new forms of authorization, 00:30:56.000 --> 00:31:01.800 externalized authorization, policy-based, attribute-based, whatever, access control, 00:31:02.300 --> 00:31:07.400 all that stuff. I think there's a huge need to make progress on that. And by the way, 00:31:07.400 --> 00:31:15.400 without that, we will never solve the challenge of security and identity for agendic AI. 00:31:15.400 --> 00:31:21.900 No way to do it without. Right. And if I may add something, I think it's not really a 00:31:21.900 --> 00:31:27.300 capability in its own, but it's built into so many, I think, automation and orchestration. 00:31:27.300 --> 00:31:30.168 We've mentioned that at the very beginning to 00:31:30.168 --> 00:31:33.100 really understand what should not or no longer 00:31:33.100 --> 00:31:36.218 be done by a person, but which can be put into a 00:31:36.218 --> 00:31:39.400 policy that can be implemented and then automated 00:31:39.400 --> 00:31:41.875 and more or less forgotten because it does things 00:31:41.875 --> 00:31:44.400 right in the background. I think this is something 00:31:44.400 --> 00:31:47.150 that we need to learn even more than to bring 00:31:47.150 --> 00:31:49.900 this into real life automation authorization. 00:31:50.000 --> 00:31:55.500 And when you say NHI and agentic and all of these new identities that we have around, 00:31:55.500 --> 00:32:00.400 you cannot deal with them without proper automation and orchestration. We need just to 00:32:00.400 --> 00:32:03.500 make sure that it's done right. Otherwise, it's 00:32:03.500 --> 00:32:06.600 garbage in, garbage out. But proper automation, 00:32:06.600 --> 00:32:13.000 I think that will be a good starting point as well to have that finally working in 2026. 00:32:14.300 --> 00:32:16.675 We're at the end of our time. Jonathan, Martin, 00:32:16.675 --> 00:32:19.000 thank you very much for being here. We did not 00:32:19.000 --> 00:32:24.500 make half of what we thought of. We didn't really plan. We just had a list of ideas. 00:32:24.500 --> 00:32:27.400 I think there's room for working on that list again. 00:32:29.600 --> 00:32:31.900 That might well be the theme of 2026. 00:32:34.000 --> 00:32:37.300 That might be true. Final thoughts, Martin, before we close down? 00:32:37.300 --> 00:32:39.979 A lot of stuff going on. I think at the end of 00:32:39.979 --> 00:32:42.600 the day, we should keep in mind most identity 00:32:42.600 --> 00:32:49.700 management is still evolutionary, not revolutionary. At the end, most organizations 00:32:49.700 --> 00:32:53.650 really will need to look at building a solid, 00:32:53.650 --> 00:32:57.600 solid baseline, a solid sort of basic hygiene 00:32:57.600 --> 00:33:00.532 across everything. And as you said, also think 00:33:00.532 --> 00:33:03.400 about not only technology, organization about 00:33:03.400 --> 00:33:09.800 processes, policies, all that stuff, because the best tool won't help you if you don't 00:33:10.400 --> 00:33:11.700 do the other things right. 00:33:11.700 --> 00:33:15.500 Thank you again, Jonathan, Martin. For those who are watching this, 00:33:15.500 --> 00:33:19.500 if you have questions, if you have comments, please leave them on YouTube in the comment 00:33:19.500 --> 00:33:25.000 section. Reach out to us and send a mail to Jonathan, to Martin, to me. We promise we will 00:33:25.000 --> 00:33:32.100 reply. Watch this space for part two of AM predictions for 2026. 00:33:32.800 --> 00:33:35.700 Thanks again, and looking forward to talking to you soon. 00:33:35.700 --> 00:33:37.700 Thank you. 00:33:55.000 --> 00:33:55.700 Bye.