Name: Episode #7 | From identity admin to business enabler: reshaping IAM teams
Uploaded: 2025-10-30T18:16:10.374Z
Duration: 1 h 16 s
Description: Episode #7 | From identity admin to business enabler: reshaping IAM teams

Transcript for "Episode #7 | From identity admin to business enabler: reshaping IAM teams": Welcome to the latest episode of signals continuous identity sessions where we connect the brightest minds in identity with the strategies and real world approaches that make I'm work better. I'm your, I guess, somewhat experienced host at this point and still generally generally curious, technology, security, even identity nerd, Dustin Abel. And each time, each session, we're sitting down with people who build and manage identity at enterprise scale. These people who've figured out how to eliminate bottlenecks, reduce manual work, and implement automation where it makes sense to actually improve security without slowing down the business. We call them the best of the best. Today, we have one of the best joining us, and we're focused on something that hits close to home for a lot of identity leaders. How to move your team from being seen as the ticket queue that slows things down to being recognized as a strategic business enabler. If you've ever felt like identity team is capable of so much more than access provisioning, but you can't seem to get executive attention or, you know, dig out of that hole or get resources to operate strategically, this conversation is for you. We are joined by Kevin McGee, global director of cybersecurity startups at Microsoft for startups. Kevin works with Fortune 500 CISOs every week and has a unique perspective on how the best organizations are repositioning their security and identity programs from cost centers to competitive advantages. He's also written extensively about translating technical security work into business outcomes that executives actually care about. For our audience, we'd love to hear your questions and thoughts. Please comment. Please send back, questions and and requests, and we, will personally respond to every sing single one. So let's get to it. Kevin, first of all, thanks for joining me today. Good to see you again. How are you? Where are you? What's new? So thank you for having me. I guess I'll be your your somewhat experienced guest for the day, so we'll be a good pair. So, I live in a small town called Brantford, Ontario, Canada, which is just West of Toronto in the home of Wayne Gretzky if you're a hockey fan. It's, it's a little chilly out, today as we go into fall, but, wonderful way to wrap up the week, having a great conversation with you today. So thank you for having me. And before we get into the industry stuff, I will say I am from Southern California. You are currently living in maybe maybe from the Greater Toronto Area. The World Series is at stake. Are you a Blue Jays fan, and are you paying attention? So I think, the last time we were in the World Series, I was in school in the early nineties. So it's Thirty years ago. Yeah. Yep. It's been quite a big deal up here. That's that's for certain. So, hopefully, by maybe by the time this airs, it'll be resolved one way or the other. I'm not 100% sure. Yeah. Well, before we dive in, maybe you can give folks a quick sense of what you're up to, what your role is at Microsoft, what does that mean, and how your experience and purview have have really built a a view of the industry. Well, I've been with Microsoft about eight years, and I joined, our incubation organization for Azure. So working on sort of the new product releases and whatnot, and I've always sort of worked in in new, new product launches, new product releases. And and one of those new products at the time was security, when I joined Microsoft. So when it graduated to a full product suite, I went along with it and became chief security officer of Microsoft Canada. So I've had a a really unique set of experiences. I'm sure we'll get into some of them over the, time period, but to be a practitioner, to run sales organizations, to see different points of view and perspectives. But as CSO, I got a chance to really work with the CISOs, the the boards of directors, the audit committee chairs, executives on on what their needs are for security and how we can best meet them through Microsoft. And, in my current role, I've gone back to my roots, to my start up's roots, and I work with our our start up ecosystem to say, you know, what what do we need to do to extend our platform? What do we need to enhance our platform? And what are the innovative start ups out there that are solving problems at scale? And I think about the purpose of a platform is to make tools and and things available for entrepreneurs and and and creative people to create things. So, that solve unique problems sometimes that we never even thought of before. So it's fascinating to work now with, startups again to say, you know, how are you approaching these problems? What are you seeing different, and how can we accelerate quickly? Because startups can really, you know, capture the moment of what's happening and iterate quickly to solve problems that enterprise customers need. When we combine that with our platform, sort of that that trust level that that Microsoft provides, it allows enterprise customers that are risk adverse to do things to then adopt innovative solutions for security at scale, to solve some of these new problems. So I think it's the best of both worlds. It's a really fun job, and, it's it's a great chance to have discussions like this as well where maybe we can sort of influence the direction of how organizations think about, you know, including innovation and addressing innovation and securing innovation as well. Yeah. Great. Thanks for sharing. And and starting off, given your that scope of your experience, if we look at identity teams, specifically, being with being business or becoming business enablers, I guess I should say, The reality is that most IAM teams I hear from and I talk to are really stuck with access requests or provisioning tickets. And I'm I'm curious if, number one, if you're experiencing seeing the same thing, and how did we end up here where it's a cost center? It's not it's not really the strategic positioning mechanism. I think from the business perspective, so executive leaders that are on technical board, you know, the folks that are sort of running the day to day business, they really don't sort of think about where it all fits in on on security IT and whatnot. It's kinda just this lump of folks that, that enable what we do kind of approach. And I I bet if you ask most executives maybe, you know, where does identity fit? Is it a is it an IT function? Is it a security function? Is it its own function? Do we even have that function? They may be unaware that it, exists. And and, you know, when we think about, you know, the importance of identity, and it's sort of the cornerstone to everything that we do now in the digital world. The fact that we're not on their radar from an identity perspective, that they don't know where we sit in the organization, they're not thinking through, that that tells me the disconnect in the business, decisions being made because business decisions create vulnerabilities that are exploited, you know, at the layer eight level, and, we can't solve that with the tech stack. So I think, you know, really raising the the discussion to, where identity should sit, you know, how our risk's managed, how do we think about it within the executive levels is one of the the the the key challenges we have right now in in creating technologies and deploying technologies to secure, our enterprises as well too. It's that knowledge gap, that understanding gap that the business has of where identity fits that often, you know, creates these problems. And when you speak to Fortune 500 companies, let's say, I I know you're working day to day with a lot of, startups in the ecosystem and they're getting exposed to Fortune 500 companies. Obviously, the Microsoft customer base has the biggest companies in the world. And when you're talking about these cybersecurity threats, and I've I've read and heard you speak about focusing on the Archer, in in some ways. And, when you talk about their identity programs, what are the most common complaints you hear from them? How are they perceiving the challenges in identity and access management? I think a lot of you know, what what we were discussing earlier just, you know, it's not on the radar. It's not getting funded. It's not it's it's a challenging issue. And often, identity is one of those things that, say, different group business units have built their own identity. You know, little clusters or whatnot. And the skill set needed to go around and federate that identity is is massive for an executive. It's not a technical problem. You know, getting multiple divisions to get on the same identity platform can be a major challenge in some organizations when you make an acquisition of a company and they come and they may have a different approach to identity. So just, you know, what is identity? Do we have a common understanding of what identity means to our organization may not exist? So we see a lot of executives just make assumptions of, you know, we have a security team. They've figured it out. But they're they're probably not giving the direction to, the security teams, to the identity teams to say this is this is how we should be thinking about risk from a identity perspective because it probably doesn't occur to most executives that, you know, it's something that they need to set that tone or set that risk. And often CISOs struggle in pushing back to say, you know, you can't abdicate that discussion to us. We can't understand how you think about risk or how you want to apply risk or or whatnot. And this isn't just with identity. This is all areas of security. But identity, again, because it maybe is a part of IT, maybe part of secure security, makes it even more ambiguous and where it fits into the risk discussion. So, I know this is something that I help CISOs a lot of times is how do we discuss these these challenges, or how do we put them on the radar, or how even just communication strategies, can be implemented, to raise these up to where the decision should be made or just, you know, make it part of the decision as well. It's, it's it's pretty amazing how sometimes just a little communication can can help us along a little further. To what extent are you seeing organizations bringing identity and security together under the same leadership or at least, next to one another? Or are you seeing that, I guess? I think much more so. Like, I think back to when I started my career, on the help desk. Identity was just one of those things, you know, you provision the phone and the PC and and the login. Right? It was just part of that ticket as you mentioned earlier. We're now you know, you really need that identity layer or control plane or or whatever paradigm you wanna apply to it figured out in order to layer on modern security. And I think we're at that, tipping point now where nonhuman identities could, you know, overtake the number of human identities. And I I do remember back, and, again, I'm dating myself, where we we thought identity just meant a a human being. And then we started, you know, in active directory probably 2000, maybe late nineties, thinking about adding the identity of devices. And then, of course, that allowed us to think about things like zero trust and whatnot that we wouldn't able been able to do had we not extended the concept of the identity or the, you know, tracking the devices as well too. But now when we have human beings that have, you know, agentic services that can act on their behalf that aren't human, and maybe maybe we have ten, twenty, 30 times the number of new employees, that are virtual coming on board. How do we think about that those identities, and and how do we delegate access to them? And it it's it's going to be, a whole new rethink of, of what we we think of identity. And I guess the, the, the way I kinda think about it was when I started my career, the the person showed up. You saw them. They were in front of you. You could check their ID. You knew who they were. But now our identities are almost like astro projection. How much of your identity is an employee actually lives in in the cloud and on the Internet? Most of our conversations are like this. They're virtual. They're email. Our our identity and how we express ourselves and our consciousness, as an employee, for the most part, is actually existing in a digital realm, and now we're gonna layer on these agentic services that connect on our behalf. I think identity now becomes even more important than ever. And then I start to think about where the gap is. It's really from the person to the perimeter. We've always thought about, you know, security from within the perimeter, and we've extended that out to the edge. But the person to the perimeter with things like deep fakes, you know, change of status or whatnot, so, you know, continuous access, this is going to be the gap that we have to start to think about how do we manage, and then how do we manage it with AI services as well too. So I think if you're in the identity space, you will not be unemployed, for the near future as these challenges start to mount and organizations have to start dealing with them. Yeah. Let's hope not. You mentioned earlier that a bunch of sort of teams or, business organizational units or groups are really driving a lot of the identity around themselves and, I mean, even more so for AI as you were saying. You're getting these specific bespoke use cases that grow beyond, a lot of this management in in, legacy sort of ways of managing it. So it becomes a a concern across the business. And you mentioned it earlier about extending a lot of these conversations from the technical details towards the business and business outcomes. So let's let's let's talk about that a little bit. What does it actually look like for an identity leader who's preparing to have a conversation with the CFO or a CEO about investments in identity? How do they even get started in order to bridge that gap and tie those investments back to the business and not just to a technical detail or a technical service? I think it needs to be a discussion that's held, you know, risk, general risk, and and identity should be a subsection of that discussion with every major business decision, especially around digital transformation. And I don't know. We're we're gonna call it AI transformation, because we're not with digital transformation, we're just not, you know, sort of paving the goat drills and calling them highways. We're rethinking the business process, and we're into do see new risk as well. With the AI digital transformation or whatever again, whatever we're going to call this, you know, there has to be another rethink of these things. So, for example, a project to, enable the Salesforce to use AI tools to respond to customers. Mhmm. Maybe it's just in their email and whatnot as well too. Well, you know, that's just not a tool you click in or add to email. This is gonna completely change the workflow. It's gonna completely change accountability. You know, if, something goes out within an email to a customer that shouldn't have, it's misworded or, you know, not not a a proper sentiment that represents the company's values or whatnot. How do we look at, who's responsible for that and whatnot? How do we tie that back to the individual? These are questions I think we need to stop and pause and think through as we sort of push these technologies out. And when you talk to boards, they're they're very interested in cybersecurity, but they're much more interested in using artificial intelligence to improve efficiencies, to gain market competitiveness, and whatnot. So I think if we show up as risk professionals and not just identity professionals as they, you know, the old mister no and, you know, when they can't do this, we're we're always gonna be sort of sidelined or we'll be cleaning up the messes afterwards. So how do we get really engaged and involved in solving those problems and and coming forth with solutions early in in those project, forming processes to say, here's how we think we can do it. And, ultimately, employees will want to do their job, and they will find the easiest way to do their job. And then the old days that shadow IT maybe. Mhmm. And if we can make it easy, if we become the easier thing, to do, with an IT, then most people will just conform. So, again, rethinking the approach, very positive, very forward thinking, but also reframing sometimes, you know, things like privacy, consent, and whatnot in terms of business advantage that we can, derive, not just in terms of risk mitigation. Because board's executives are all about the upside, and they don't you know, they'll focus on the downside or the risk, as much as they need to. But the business is driven by the upside. So how do we much more align our thinking to that side is is really sort of the coaching I do quite often with CISOs, in these discussions. Well, sometimes we sort of revert to what's getting measured is is what's getting managed, I guess. And these teams might care a lot about tracking their users provision or or tickets closed, which is tough to really tie to business impact. So how do you respond to those those requests or those questions about what they should be tracking? What are the metrics that you can show that, you know, you're mitigating risk? It's it can be kind of an esoteric thing. So I'm curious how identity teams, can really be tracking these metrics that executives actually care about. So it's interesting. So you go to an audit committee meeting, and you hear the financial folks, and they go through. And there's, you know, two hundred years of generally accepted accounting principles that, you know, talk about controls and whatnot. Generally accepted accounting principles that, you know, talk about controls and whatnot. And and, so you would never allow the person who receives invoices to pay invoices. You'd have a control on him and whatnot in in those. We've got that all figured out, and then I hear things like, well, protect the crown jewels. We're doing that. Yep. Okay. And we go into the the controls discussion for IT. Well, if you haven't classified your data, how do we know what the crown jewels are? If we, if we think talk about things like, identity controls, often, you know, the auditors are coming back and saying they're lacking. And quite often, when I go back to the next quarter's audit committee, they're still lacking. And there's a disconnect in sometimes the importance of these. They're just IT things. Well, they're just as important as the checking account kinda thing. But often, I think what happens is the executives don't understand what they're being asked to do. So reframing sort of the, the approach from the, from our side is key Because they'll ask, well, give me a metric I can track in. And I hear, organizations tracking things like number of of email accounts compromised or, you know, just very operational metrics. Well, we're certainly not, you know, in the the chief financial officer's, report. There's not how many checks we wrote last month because it's immaterial to the amount of fraud. So how do we start to think about, you know, explaining risk? And I like Rick Howard's, approach if you've, anyone's read this book of first principles, chapter six, talks about, what's the material, the probability of a material impact to the organization due to a cyber event over the next three years. So framing a discussion to say, with the project moving forward, you know, I see a 40 to 60% probability of a 8 to $10,000,000 impact if we don't properly provision identity, with this solution. Now business people can understand. Giving ranges, you know, is kind of the key when when it doesn't have to be scientific. You can use inside out Bainesian approach or whatnot. But, really, you're just sort of expressing the level of concern they need to think about. And then that allows the business folks to say, okay. Hey. This is this is material. We should look at this. And if you think it's maybe a a 10% I mean, a 10 to 20% chance of a 100,000, dollar material impact should something go wrong, but the upside of this project is 20,000,000, then they may decide that we're not going to invest in, you know, risk mitigation for this project. But that's their decision from the business perspective to accept that risk. That's not up to us in in technology to accept those risks. So, one, we need a better way to communicate, and probability ranges and dollar amounts are probably the best way to do it. And then we need to make sure that we're not letting the business folks abdicate their responsibility to understand the risk, ask questions. Because at that point, if they don't understand, well, why is it a 60 to 80% probability, you know, that this could happen? Okay. Let me walk you through that. Well, now they've asked the question, so we're actually answering their question. We're educating and informing them rather than just sort of throwing data at them. So some of those communication techniques on how to engage the exec are really the difference between getting your program funded or Mhmm. You know, you really getting maybe fired when their program, that you didn't fund your your, security measures, results in a material impact to the organization. So and it's not a skill that we teach in technology. We often promote, the technological folks up the ladder because of their ability to do the technological things, not necessarily the people things. So I'm a big advocate of investing in leadership training, education, from, for cybersecurity professionals in general, for this main purpose to to have these discussions and to sort of better assert our positions within these discussions, but also position them very positively instead of negatively. That's great. A quick follow-up on some of the metrics. I think compliance is maybe one of those more binary measurements. Right? It's you're either compliant or you're not or may maybe not, but generally. And and I I believe you've stated or you've mentioned in an article that compliance can really be a competitive advantage, not just a burden. And I'm sure that compliance is something that boards are discussing and care about. How does this play into identity programs, risk, all those other metrics that we've been discussing? I think the purpose of compliance and I think back to my earliest days. I kind of saw compliance as you have to cross the road between the lines. That was compliance. It is an arbitrary rule. So if I had to walk two blocks down to to cross the road in the lines to be compliant, you know, that was fine. But if no one's watching and whatnot, I could jaywalk it across. As long as I look both ways, I don't get, you know, hit by a truck. That was security. That's that's what I was really about. But as I've sort of taken on more responsibility, and I work a lot of with boards of directors sitting on a number of, boards of public institutions and whatnot. The purpose of compliance is good. I think, you know, the understanding that, you know, these are the things we need to do because it makes the organization safe and trustworthy. The implementation doesn't always work to match the the importance of the compliance. So we we make it really onerous, the compliance, and it's once every, you know, two years. And it's so out of date. Really, it's that information doesn't help the organization run the business. But with modern technology and tooling, you know, what if we could continuously test, the level of our compliance? And we could start to see if we're drifting off course. That could inform our business decision rather than hearing about it eighteen months from now that two years ago, we we missed compliance in an area. So that allows us to make real time decisions, inform decisions on risk, but then also say, yes. You know, we're confident moving into sort of this new geographical area with our sales team and opening up a new sales office because we have this in place, and we can, you know, run continuous checks. Or if we acquire another company, we can sort of spread our umbrella of compliance over for continuous monitoring. And you may even see this in the sort of a health hacking phase. Like, how many of us are now wearing Apple watches or Whoops or or whatnot where we're continuously monitoring, and we're making better decisions, about our even our own health. Because I know if I go to the doctors in two years and I get my blood taken and my blood sugar's a little high, he's gonna yell at me, and for the next couple months, I'll stop eating ice cream. But if I can, in real time, see, wow. You know, that's what that having an ice cream cone at 08:00 did to my blood sugar. I'm pretty sure I'd probably have an apple instead. Right? So it's the same thing applied to business. What if we could start to think about the health of the business, the way we're using the health monitors within our organization? So and that applies to all areas of security, and and I think especially, to identity. It could be in sort of the the bedrock of security. Yeah. And, I mean, at Signal, we talk a lot about context of of access, right, and and security a part of that and and other, states of being as as parts of that as well that might not always be considered direct identity or security considerations, but, you know, the a ticket status is is context. It could, you know, it could be that sugar the blood sugar reading that really leads you to thinking about the decision you're making and how how to make it in the future and how you made it in the past. That's that's a really interesting the decision too. Right? I think that's the key, like, up to date data at the time of the decision, and I think that's what we're getting to in in that capability we're having now. Yeah. When things change, then, you know, that I I said in an earlier episode, I think there's this idea that you never cross the same river twice because even if you're crossing in that same spot, that the river is different. The, you know, the water is rushed by, all those different pieces. It's to your point that that real time context to make a decision at the appropriate time. And, you know, I may enter, into a task, and I've escalated my privileges. Done the problem thing. I'm not logged in as administrator. I've logged in as myself, and now I've logged in as administrator, escalated my privileges to do a task, but then I get off doing something else, you know, and forget to downgrade my own privileges. Well, if I'm running some AgenTic software or whatnot that has access to my privileges, it's creating new opportunities for attackers to think about, you know, how we can leverage those gaps. So I think even more so now, we can't rely on sort of the human in the loop to to take care of those challenges. So, the approaches, you know, that you're working on and and that I see are most effective are those areas where it can just sort of happen on its own, where it, you know, with continuous monitoring is really looking at what is the the, the privileges needed at the time, what makes sense. And, again, we've been doing this for years. If you're having a plumber over, you know, to work on your house, you don't give them the key to the house and your alarm code and say, you know, come whenever. No. When they show up, they have access. Let it do their job and they leave. You're not gonna give them sort of that continuous access as well too. So we've applied those principles to IT, and I think they work well for now. But, you know, now the plumber doesn't just show up on his own. Millions of robo nanorobots show up as well too in the form of AgenTek Solutions. How do we think about their identity? How do we think about their their access? What do they have access to? And I see this in some of the, the AI deployments we're we're having where we'll say, well, this information was leaked out, you know, because we deployed this AI, to well, no. Actually, it was always available. It was just hard to find. Right? Right. And often, it's an identity issue where, you know, it's been shared to everyone or shared to a group or shared to someone who shouldn't have access to it or whatnot. So it's, these, these tools are are surfacing problems that have existed for quite a quite a while, but they're just more visible now because we're implementing these tools that service them faster. So, we can either take advantage of that to sort of, rethink how we we, deploy security, things like identity, or, you know, we suffer the consequences if we move too quickly with these tools without, you know, balancing the risk of them associated with them. Yeah. I think we're we're skirting around but discussing, zero standing privilege. And I know you've written about zero standing privilege and ZSP being a real shift from perpetual access to this purpose driven security, but we realize that it's not just flipping a switch to zero standing privilege because of all the components that it touches and we've talked about from IT ops to business workflows. When you talk to organizations about these challenges that are across departments, where are the biggest friction points? How do you how do you sequence the work across the teams in order to get to that that model? I think, really, you know, consensus of what identity is, I don't know, what what it means to the organization, and and sometimes starting with the philosophical question is is a great place because it surfaces, misunderstandings or or different interpretations of what we should be what should what should we be looking at. And I even look at this from, say, the privacy perspective if, you know, we're we're collecting, consent to, you know, send me information within the state of California. Does that imply consent, you know, when I'm overseas to send it to or, to me as well too? So, you know, we have so many factors that contribute to, identity. What what does that what does that really mean to the organization? I think post COVID too, you know, when we're having, discussions like this, we often engage with, with our our peers more often via digital means. So, you know, when you're on a, a virtual call, how are you sure that that's the person that that you thought it was? And and I think about sort of the application, so, process. So when, and job hunters would sort of send in, the application, you could sort of read and and get a sense of them, and they and they kinda matched how they sounded on on on the, video conference. But now they're using ChatGDP and other tools to write their cover list of re resumes, and they sound like PhD experts and then sometimes get on and maybe the cover letter resume didn't didn't match, but you can tell. But what happens when the the cover letter and the, the person you're talking to on screen are are both, AI generated, and you have no means of of checking that? This isn't something that HR departments have ever had to deal with before. It's it's it's really happened in a matter of months some of these technologies have become available. So, you know, long held views of how did I know that that was the person that I was talking to? How do how do, you know, how do I engage in those discussions that we've just held these beliefs? Now we're seeing, some of these challenges that are so unique to organizations that have never had to think about it before as well too. So bringing other organizations into, the discussion space, sir, what what challenges are you having? Okay. Did have some little bit of a technical difficulty here, but that's that's life. That's what we're dealing with. And coincidentally, Kevin, I wanted to ask you about, something we've been calling the pyramid of pain. This that wasn't too painful. And there's an interesting pain pain pyramid, we've called it. It's a parallel in, threat detection. You could say that some sort of defensive controls are trivial for for attackers to bypass. When we think about it in a workforce environment, I usually think about it from an application mission criticality. When we're talking about zero standing privileges with regards to it, how concerned are we the standing privilege that a user has to Microsoft Teams or Slack or even email versus a cloud workload in Azure or in AWS or GCP, for instance? Obviously, those are different levels of real time, different levels of of mission criticality should something bad happen for for a attacker to bypass. How do you think about sort of zero standing privilege through that lens, and how can identity leaders move to those approaches of zero standing privilege in that pyramid approach? Where do they start? What resistance do they get in an organization? It's a little bit of a, you know, one size does not fit all. So how can they move to that with least resistance to eliminate standing privileges? I think, when we think about it, again, the question asked, how do we decide, you know, what what is most important? That's the conversation really the business has to decide. Ultimately, the business has to instruct us on what its risk tolerance is. Is it going to accept risk? Is it gonna mitigate risk? Because we might deem one application not to be, you know, too important. But it can turn out to be the, either the entry point to the, a larger attack or maybe it includes some information that is very important. So we often see third party, applications being used. So, say, you're you're having an, an event and you spin up an event application. Well, that's outside of your identity, solution, your current identity solution. Well, that could be the breach that, you know, result in password reuse or or information as well too. So, oh, but that was a third party application. But it's still an employee doing work, so it needs to be brought into the identity fold. The classic one, and I don't see as often was, well, we've constructed this incredible identity, you know, management solution. We've we've locked down, you know, the organization. But then we have external board members that are using their personal Hotmail accounts. We're gonna send the most confidential information, part of the company, to board members or, you know, their, you know, their their Gmail account or something like that as well. So we break those rules. So often, really, having those discussion with the business. Are you comfortable, about, you know, sending, board package material to a Gmail account? You know, is in violation of sort of all of our identity principles. Right? And and I don't think it often occurs to business people that that's a problem until you you sort of walk them through it. Well, if it was in our environment, we would know who has access to it and and whatnot. And then things like, well, would it we'll throw it up on a SharePoint portal. Well, if I'm on this committee of the board, I I have access to the in camera, minutes of, that committee meetings. But if I leave that, committee, then I I I no longer have it. But if it's all on one general SharePoint, then I would have access to those information. So I think, you know, often, we just assume that business people, you know, think through these challenges, and business people just assume that we're taking care of those things. And, and that's where the disconnect happens where some of this this data maybe leaks out. Teams has a sort of a SharePoint back end where files, when you put it in the chat, are are stored. You know? Who has access to that chat? Afterwards, if we just add someone to a standing meeting, that we have, will will they have access to the files? Will they have access to the chat? You know, we that's a daily occurrence where we don't have, you know, those deep discussions. Well, if we're not doing that in sort of the day to day communications and operations, what are we thinking about our back office? How are we thinking about how those communication, you know, things work as well, you know, throughout the organization? So I think there's this assumption on both sides that the other side's figured it out or has it taken care of. And and often, we need to step through these, the actual, you know, sort of use cases with the business to say, have you thought through this? You know, what other areas where should we be thinking about them identity? The one that I find now is interesting with the board meetings is not not only do we have people joining from their own personal accounts to a Zoom to a Teams, but they're sending their own personal AI note takers to Mhmm. A board meeting, to transcribe the meeting. You know, if you walked in to a company meeting with a tape recorder and sat it down on the desk and hit record, ten years ago, I think I think it would get a different response. But I often see some board members just admitting these, you know, five or six note takers. So, you know, I'm I'm worried some of these these these things were normalizing without really thinking through the ramifications of, you know, what is that thing? You know, who how do we know where the actual board member sent that? You know? How is that information gonna be used? Like, we we need to stop and sort of have some of these discussions. A lot of these tools are really making us more efficient, but with that comes some risk as well too. How do you advise to, the CISOs or the security leaders or whoever it is to be able to better communicate those risks in business terms? Is it through, you know, obvious sort of stories like the one you just gave about tape recorder? Or how can these leaders think about framing work to executives who maybe don't care or just don't know about protocols or architecture or or the technical nature of things? I think it's it's basically, you know, using metaphor, using storytelling. So you don't pass out power tools to your your your your kindergarten children aged children today. You know? It it makes them more efficient, though. They can, you know, they can, drill holes faster and whatnot. But that's what really what we're doing sometimes is passing out these really incredible powerful tools without thinking, you know, does that person have the knowledge? Do they, you know, are we giving it to the right person? You know, I I think sometimes just slowing down and stopping to have it in these conversations, but then expressing it in ways they can understand because we often we'll express it as technical people in technical frameworks and terms, which they don't get, and they will just shut off if they start to Mhmm. Understand. The opposite of that is, you know, when the business people get really wound up about something, and they'll say, well, this AI thing, it's you know, I saw the Terminator, and it's a very emotional type question. Yeah. And as we're technical people, we respond with data. Well, if someone's using system one thinking fear and you respond with data, you're at a different disconnect. So you you really need to say, okay. You know, are they emotionally having a discussion, or or are they ready to have that discussion? So So sometimes, you know, just aligning your answer to the state of mind that they're in to say and to stop and say, well, you know, I I don't know how the movie Terminator applies to the situation. You know? Can you walk me through that? Can can just be a way to sort of slow down and and reframe the conversation. But because we're technical folks and often they're the business, we feel compelled to answer. And what do we answer with? We answer with data. We answer with technical answers. We answer with frameworks, which confuses them, and then there's even more of a disconnect in conversation. So stop slowing down, making sure that you understand the question, not abdicating responsibility. These are very difficult things for technical people to do, but but these are the most important discussions we need to have. And it's going to be even more difficult as we struggle to understand the technology. And then I have to admit, you know, most of my security career, I just watch packets on the network. It's a whole new world out there, and there's whole new aspects to security that I could never have imagined even a year ago that we are dealing with today. So it's okay not to know all the answers and to to have these philosophical discussions. But I think getting, you know, to an understanding of what the challenges are, what the opportunities are together is a sort of key, and, you know, things you know, identity is at that root. You know, what what constitutes an identity? What what constitutes a person? What constitutes, privilege? Like, these are are things that are being completely rewritten now, and we need to have these conversations with the business and be on the same page with them. It sounds like, you know, some some serious cultural change, not just, like, better dashboards. And, Skynet notwithstanding, are you it it's some basic communication, and we've started this episode talking a lot about identity teams and identity security getting a real business seat at the table or a seat at the business table maybe better said. It sounds like it may boil down to a little bit of listening and and learning and communicating better and and not just in the ones and zeros always. I think that's what I'm hearing from you mostly. And you think about some of the attacks, like, we're seeing sort of the, executive impersonation, you know, for Mhmm. In a check and whatnot. These are all just confidence scams that have been around forever. Right? But they're accelerated and and more difficult to identify because of the technology that's obscuring the identity further as well too. So as these are sort of surfacing and we see the videos, the fake videos of, you know, someone, doing whatnot, or, it's they're starting to get a sense of what the challenges are. But, one, I think we're struggling to understand how the technology works, how it fits in, how it's gonna be deployed, and and just the speed that it's happening, they must be struggling too. So I think we need to be comfortable and confident to admit, you know, we don't know. We don't have all the answers. Maybe before we launch that thing, we we need to slow down because and I don't know what what you want. And and if I don't know what you want, I don't know how we can protect the organization. I think that's a fair thing to say. So we need to be comfortable and confident in having those discussions because, you know, again, we we can't just check their driver's license when they show up at the door anymore or sign in, you know, and assign the employee in and put the badge around them and what like that. We have had sort of this this idea of how we manage access that really hasn't changed that fundamentally over years. That that is going to change drastically in the future, and we have the opportunity today to set sort of that fundamental, you know, approach or culture. I think that will be key. Those organizations that really invest in it now and get it right will accelerate with these these technologies, those those customers that don't or those organizations that don't think about it, that don't invest, are gonna be hampered as they sort of run into roadblocks with these challenges need to have to retrofit. They're just going to lose ground, to their competitors who are racing for some of these technologies. So often, you know, my my grandfather who was a carpenter says you measure twice and you cut once. I think this is our opportunity, with things like, you know, what is an identity? How are we gonna secure it? How are we gonna approach it? Let's measure, you know, twice before we we cut once, and that's how we become a business accelerant. Great stuff. I mean, slow slow down to speed up. I I have another friend who, is a craftsman as well, and he says slow is smooth and smooth is fast. If you get going too fast, then you end up having to stop and go back and but slow is smooth and smooth is fast. I have heard, obviously, throughout this, you know, you've been talking about AI. How how can we not today, or any day? And Microsoft is clearly in the middle of a lot of the AI agent work and automation and with Copilot. And while I understand you are are not the AI spokesperson for Microsoft, I'm I'm curious about how you see AI automating identity work. What's realistic? What's still gonna require a lot of this human judgment and strategic thinking? Wow. That's a pretty open ended question. I I gotta say, I, I initially struggled to understand what the big deal was about AI, which is probably counterintuitive. But I think, again, because most of my peers were explaining it to me in technological terms, and I really didn't start to understand till I started to use it to my for myself and for my own tasks and purposes. And I think that's when sort of the lights came on. And one part of Microsoft culture is we wanna be using our own tools. So, you know, are we using Copilot to respond to emails? Are we using Copilot to do summarizing, you know, when we come back for vacation and whatnot? And I honestly, I was quite nervous to to have it do some things for me, on my behalf. But as I become more comfortable with the tool, I start to imagine things that it could do for me, and I I just overall get more comfortable with the tools. But I think back to, you know, when we started to be able to share our screen, I was always worried about sharing something I shouldn't. Or when you could share a file in OneDrive, well, what if I get the permissions wrong? I think with some I'm having some of that anxiety now. If, if I'm creating something that's gonna make my life easier, am I inadvertently, you know, opening the door to, allowing someone access to something that they they shouldn't have? So I think tying, tying some of the the AI stuff to what you do personally is key, and and executives need to to do that too. They need to experience the tools, not just sort of abdicate that as well too. And then start to think through, okay, what are the ramifications, you know, of of these actions that I'm doing? Well, will give us a better sense as well too. But it's an interesting, time to sort of engage with the business to say, how do you wanna use the tools? How can we help you? What what what are your top tasks? How can we, you know, make them more secure? How do we think about this? If you're gonna run some of these, these agents, You know, what how risky is this? What data will they have access to? Asking open end questions like that, I think, are really going to be key. And, again, from a communication perspective, you know, why is a is a challenging question to ask. Why are you doing that? Why is it very ax accusational? So I always encourage IT folks, always ask how or what? How or what questions are curiosity? They're engaging. They're sharing. A why can be interpreted from the business of, as adversarial or accusational. So if you ask, why are you doing that? It's very different than, well, what are you going to use that for, and how will that work and improve your day? Same question just framed very differently. So often, we don't in the tech folks, we don't think about the niceties, you know, of of those words, but it's very powerful in how we position ourselves because how what questions position us as as, curious, as an advocate, as someone that's here to help them, but also sort of puts them in the driver's seat to answer why can when can really create that adversational, you know, distance between the organizations that we're trying to avoid too. So be very cautious of not just what you're asking, but how you're asking and how you're engaging. You know, it's it's a lot of the advice I provide to CSOs and executives with the business as well. Because a few words like that can really change, you know, the the level of engagement. Wow. Great great takeaway there, not just for the topic we had today. And speaking of, as we start to wrap up with our guest, Kevin McGee, the global director for cybersecurity startups at Microsoft for startups. Kevin, if, an I'm leader or a director, whatever it may be, listened, watched this today, where would you advise that they really focus on, getting you know, spending their time and energy over the next year to maximize team impact? Or maybe if if we had to boil it down, what's, like, one thing you would tell them to take away from this this talk today? I think, you know, the biggest skill we can have is risk professionals. I'll just lump risk professionals together. It's it's to be able to communicate risk better, and there's two ways to do that. One is how I I said, you know, sort of verbally position it. So thinking about your your, your layer eight skills of executive presentation and communication, but also the ability to quantify things really matters. So if you can express yourself in in sort of a way that, you know, communicates the way they want to listen on the business side, but then you can bring numbers, to, to the discussion. I think that's the key. Because when we don't quantify things, there's no way for them to calibrate the importance of the challenge. So really think about, you know, how do I approach them? So which means, you know, understanding how do I quantify risk, how do I do Bayesian analysis kind of thing. You don't have to become a stats major, but there's wonderful books, you know, out there or wonderful, you know, lessons that you can you can take from, from other, risk, organizations about how to communicate that that will allow, your your message to be landed and landed with the the gravity that you need it to be. So you can't just say it's a big problem. Well, how what's the magnitude of the problem? Because you might think a a $100,000 material risk is, you know, a huge thing, but maybe to the folks you're talking to, you know, who are dealing in billions of dollars. Well, I'm willing to accept a $100,000 risk. So, so calibrating so in quantification is sort of the key. And if just here's the the sort of the the final note on that. If you can't quantify it, how do you expect them to be able to quantify it? So that puts the burden on us to understand. You know, we need to quantify the risk. We need to quantify the challenge in order to communicate. And ranges are great because I've had a a number of times where someone, you know, senior execs come back. Well, where did you get that opinion from? Well, it's my opinion, and this is my informed opinion. And this is the range I think it is. If you want more, I can drill down to that. But I think a 40%, you know, range from my outside, inside analysis, you know, is is effective enough to have this discussion. Generally, I hear them good enough. Right? But, again, if you can't quantify it, we can't expect them to quantify it. And that's really the key to landing, any any message that's gonna influence an executive as well too. So those those soft skills, really, do matter. And engaging in those conversations, those idea, you know, based conversations about how we can improve the business, not just how we can secure the business is is going to engage them and get them, you know, wanting to talk to you instead of sort of rolling their eyes or or, being unavailable when you show up on the calendar as well too. Wow. Yeah. I mean, great advice. And and, a couple more quick hits before Sure. We we'll let you get out of here. Speaking of getting out of here, where are you going next? Where will you be? I know you travel a bit. I know that Microsoft Ignite is coming up. Where can folks run into you or see and hear you speak? Well, I'm I'm traveling. It's conference month, October and November. So I'll be, traveling quite a bit. I'll be, in Washington, attending, the Data Drive conference, so which is, which is always a great one. Ignite is our our conference, so I I I just just tens of thousands of people. I don't know the size of it, but it's a great opportunity to engage, in, in in all sorts of, discussions for about what's going on with Microsoft and our ecosystem. And this year, it's in San Francisco. I think that's in three weeks from now, from the time we're taping. But, it is a very busy time, to, to really, you know, to sort of sort of capture and understand what's going on in the marketplace. So, I'm I'm prioritizing spending face to face time, really sort of deep deeper discussion. So not thirty minute hits, one hour hits, two hour hits with, with some of, the portfolio companies we're working with to really understand the challenges and with customers as well too. A great opportunity to engage and say, you know, what are your challenges? How can we help? And and those are some of the most interesting conversations I have when I talk to customers and say, what are the challenges? I have these discussions, and we have an opportunity to bring back to the business then through my organization and say, here's what we're seeing. You know, are we building a product? Can we partner with a startup that's building innovation? Or should we, you know, talk to some start ups that say, hey. Here's something completely new we hadn't thought of. Can you help us build it? So it's an exciting time from that perspective, from a builder's perspective, because there's so much happening. There's so much opportunity to make a contribution right now. And the tools and platform are just gonna increase and get better and become more complex, which will then require more, you know, more thinking, more more tooling, more or developing as well too. So I think it's important we stay vigilant as defenders, but I think it's important that we stay aligned to the business in in making, making ourselves the enablers of these technologies. So I think you'll see the theme through anything I write or speak about is how do we become an enabler of these solutions rather than and get in their way. Throughout my career, when we've tried to stop things like BYOD or whatnot, it's never ended well for us in IT. So I think this is our opportunity to do it right this time. Great. Well, we we like to ask each guest we have on continuous identity sessions a similar question around the in the spirit of continuously evolving. So I I put it to you, Kevin. What's something that you continuously work on, continuously attempt to do, continuously practice? Definitely doesn't have to be work related. It could be a personal skill, or or, or something you're interested in. Well, as as you might have guessed, I'm a a big reader. So, so that's, that's obviously, I read about a book a week, and I read very broadly, across history, psychology. What now I find bringing in other aspects are really key. I think the one thing that was challenged in a friend of mine who's, an English professor challenged me a couple years ago was that for most of my, grip read nonfiction. And I've been struggling with some of these new technologies, and he's challenged me to go back to science fiction, to sort of understand how AI is gonna affect humanity, what those technologies will be like because there's a whole genre out there that's been studying these challenges, for years. So I think reading broadly, is is the key to help influence my thinking, and, it's also sort of a sort of a way for me to unwind at the end of the day. But I also can't tell you how often I connect with an executive or someone over a book that we both enjoyed. So or, you know, a common, you know, thing we've learned from a book or whatnot. So, people like to connect on ideas, and people like to explore those, you know, ideas. And the number one thing I often get asked for for people who work with me for more years, well, what are you reading now? And, you know, what's what's kind of interesting is one of the things I like to ask as well too. So I think, you know, we can get hyper focused on just learning AI or just learning their security, but I think, you know, the bringing in the broader, parts of the discussion, you know, from quantification, you know, from, from our business colleagues or understanding how, you know, psychology works in terms of asking questions or whatnot. Reading broadly is is probably the, the best thing, I I've done for my career to enhance it. And, also, it's just quite a great way for introverts, like myself to make connections with people, that, you know, have similar interests as well too. So that's that that would be my I am a answer, I think, in a convoluted way to your question. Oh, great. No. It's perfect. Thank you, Kevin. Thanks again for joining us, and and we we're very grateful for for you taking time out of your day. And thanks to everyone who joined us here today and also who's joining us in the future, I guess. Quick reminder, all of these continuous identity sessions are recorded and available at signal.ai and our YouTube channel. We're continuously developing our on demand our on demand library, I should say, over here at signal continuous identity sessions. You can also subscribe at signal.ai to get details on all upcoming episodes. We'll also share links to resources or articles, maybe books that Kevin mentioned in the follow-up email if you subscribe. Next time, same channels, next level insights. Continuous identity session is coming soon. Until then, keep making identity work better and more continuous. We'll see you next time.