Radio Logic What Hackers Don’t Want You To Know About Identity Security

Anders Askasen:

Today I’m joined by Nick Nikols. He’s our new Chief Product Officer. And welcome onboard to Radiant.

Nick Nikols:

Thank you I’m excited to be here.

Anders Askasen:

You have a long background within digital identity. So you’re no stranger to digital identity.

Nick Nikols:

That’s right.

Nick Nikols:

Yeah, it’s been kind of a focus for most of my career, really, if you think about it. But yeah, I started back in the Novell days really with this idea of how to bring, you know, all of these disparate, you know, senses of identity together and make them operate as a common whole.

It’s sort of, you know, if you think about, you know, I talk about orchestration a lot and having things work in concert. It’s like from the perspective of the business, when you’re dealing with all these different applications, every application has its own copy of the different identities that are interacting with it. And from an organizational standpoint, well, that’s your company. And you need to look at it from a holistic perspective. You need to be able to interact and make decisions across all of the disparate environments, not individual silos. And so bringing this all together and really having an understanding of that context, I think is absolutely critical to all these identity problems.

Anders Askasen:

And we’re talking about a career that spans over like two decades plus.

Nick Nikols:

Thirty five years actually.

What

Anders Askasen:

has changed?

I mean, the problems the same? Are we solving the same problems?

Nick Nikols:

It is interesting in the sense that the more things change, some of things stay the same.

There are certain fundamentals that I think that just always hold true. And if you actually think about this and take it even a step further, identity is such a key piece to security that it actually even flows from our language.

If you talk about, you know, nouns and verbs, it’s an actor taking action, okay? So anytime you have an actor taking action, that’s actually an identity. And in order to decide whether that action is appropriate or not, it requires you to understand both the identity context. Who is this, you know, that’s taking this action?

What is the action itself? What is it? What’s the impact of that action? And what is it acting on?

You know, so it becomes very much an identity problem.

Anders Askasen:

And I assume if you have all this identity data collected and there’s, you know, problems with it, you’ll make the wrong decision.

Nick Nikols:

Absolutely. If the data cleanliness is absolutely key for this orchestration.

For all of these pieces to work in concert, they all have to be singing off the same sheet of music.

So to ensure that that context is the same and that you understand exactly how things are changing over time. What’s going on with the identity lifecycle? What point is the state of the information, the accurate state of the information at this point in time relative to all these other activities that are going on? That’s how you can make effective decisions so that way all your time of access decisions are effective. If you’re making because again, this all informs the actual enforcement at time of access of you know, is this appropriate, you know, and whether or not you’re going to be allowed to perform that action or not.

Anders Askasen:

And we talk a lot about what we call the three identity problems that includes both the human and the non human side of things, but also with the emergence of agentic identities.

Nick Nikols:

Absolutely.

Anders Askasen:

This sort of expanded the scope and made it even more important?

Nick Nikols:

Absolutely. And I would actually say, I mean, so fundamentally, even agents, you know, we’re dealing with identities. I mean, all agents should have their own identity.

Anders Askasen:

As a first class identity?

Nick Nikols:

As a first class identity, yes. I mean, so case in point, I mean, is right now the most common scenario is an individual creating or instantiating an agent and then handing their credentials to that agent. Now in a limited scope, that’s maybe okay if that’s your data or your spreadsheet or whatever that your agent’s operating on. But at an enterprise level, that’s unacceptable because just like we don’t want somebody having excessive permissions or being able to go do a whole bunch of different activities, we want to really follow least privilege principles. We need to make sure that these agents, especially if they’re enterprise agents, because they exist outside of that individual, they might be used by more than one individual and they really should be identified uniquely.

And then especially when we start talking about, you know, agents calling agents and going down this chain of many activities that might be taking place, we need to be able to have that accountability at all levels.

And it’s really difficult to do if all it is is passing the same person’s credentials down the chain. That’s not a good approach and you lose context as to who actually or what entity actually performed that action.

Anders Askasen:

You keep circling back to context of driving and being very important in sort of the agentic AI and enterprise. Is that one of the key requirements to ensure that all these different agentic initiatives have the right context and the data is clean and that you can rely on it?

Nick Nikols:

I believe so. And again, it comes back to there are many, many, many enforcement points and we have to orchestrate them. You know, so whenever an entity is given access to a resource, you know, whether it’s a database, whether it’s an application, having an understanding of what that entity can or cannot do within that context is absolutely critical. And when you’re dealing with this chain of activities, you have to be able to have the effective permissions or effective rights of the end result, which is informed by, you know, who was the one that initiated it, you know, and how many of these other, agents might’ve been involved and what their levels of permissions might be. You could also think about this from a perspective of if a particular agent is being used for more than one thing, it might have more permissions than for this immediate job.

We wanna be able to constrain that to just what the immediate requirements are at that given point in time.

Anders Askasen:

And I know during your thirty five plus years within the industry, you’ve also had the analyst Pat. Yes.

And I’m sure in that role you’ve spoken to hundreds of customers.

What makes this so difficult to put in place?

Nick Nikols:

Well, I mean, identity’s always been kind of a difficult challenge and it’s interesting to see that, you know, we feel, know, in the industry, it’s like we’ve been doing this for a long time, right? But there’s always more and more companies that are just starting out doing this.

There’s a lot of good knowledge and best practices, but it’s not automatic.

I would even say even today, if we looked at the enterprise landscape, many, many, many large enterprises are still doing this with homegrown solutions, or they’re doing it the hard way, or they’re still dealing with siloed administration.

Okay. And, know, it takes an effort to sit down and, you know, take a step back and try to bring all this stuff together.

The more we can demonstrate that you actually get much more more scale and you get much more effectiveness by using this infrastructure properly and not just doing it as piecemeal point solutions, know, actually can deliver greater value. But it’s a journey. Everybody, I mean, if you think about this as a maturity curve, you know, there are some that are very advanced and actually are doing it really, really well, but there’s a lot that are just really starting on that journey.

Anders Askasen:

And if we, you know, try to distill something out of the collective knowledge that you have there, what makes the customers that have matured the most, what are they doing different from the ones that are not as mature?

Nick Nikols:

So as part of this, the ones that are more mature, you know, they tend to make the investment. They’re looking at this as a longer term strategy approach. It’s a combination. Mean, lot of times you’ll have some of the folks that understand the value might be at the lower levels within the organization. They might be part of just the identity team, but usually it becomes a more serious concern at the board level.

Anders Askasen:

So how do you lift and elevate that type of conversation to the board level, to the CEO? Absolutely. If you’re part of the infrastructure team or you’re part of an IAM team, How do you elevate the conversation and make it on their radar, make it important?

Nick Nikols:

And it comes back to, this is how you can help mitigate risk, right? There’s always a conversation about how some of this technology and employing a proper identity program and bringing this stuff together and streamlining a lot of these processes will help save you money. But it’s also, and so that’s where you mitigate the risk aspect, but there’s also a whole aspect about this that if you’re doing this really well, you can actually open up new opportunities that can make the organization money. And so really understanding that cost benefit analysis and understand that by doing this, you’re not only reducing a lot of churn, you’re strengthening your security posture by ensuring that the right access, you’re able to get closer and closer to this least privilege model goal, if you will.

But now, because you have all these contexts and you have this information available, I think this comes back to what we were talking about with AI, is that now I can start to leverage that for more value generation.

Anders Askasen:

And I can see the problem with organizations currently that are experimenting with a lot of agents.

Kind of let it loose to see what chaos brings value.

And out of that, you have all these different environments, all these hyperscalers, frontier models, agents that are using different AWS, Microsoft, what have you.

Aren’t we creating the same problem that we have in the days when you were at Novell and you had e directory and you introduced directories and there was a…

Nick Nikols:

We’re adding more and more identity silos. And if we don’t take a step to try to bring this together, the organization doesn’t have control.

Anders Askasen:

So we didn’t really learn the lesson back then?

Nick Nikols:

Not really.

Anders Askasen:

Doctor. We’re repeating the same mistake.

Nick Nikols:

Often. Actually, history repeats itself a lot. And it is interesting to see how, I mean, I’ve even seen, from an analyst perspective, I’ve seen organizations that even went from a high maturity to a low maturity because they went through a merger and the new team, you know, that was being brought in didn’t understand the problem, right? So all of a sudden, company that might’ve been very, very sophisticated and had it really locked down, that didn’t transfer over into the new organization once the mergers and acquisitions were completed.

And it is interesting to even watch that from a perspective because this identity… Talking about adding value, having the right identity infrastructure can actually help with easing the process of doing a merger and acquisition.

Onboarding, bringing all these other elements into the company and aligning with the right processes is much easier if you’ve got this kind of capability. But if the wrong decision makers are not aware of this or not as mature themselves, a lot of times they can…

The whole organization can backslide down the maturity curve.

Anders Askasen:

But I guess at some point it comes down to having budget to invest in the right tooling and invest in the right people and processes. Absolutely.

What would you guide people who are challenged with this? How do they ask for that type of money? We talked about mitigating risk, but…

Nick Nikols:

Yeah. Well, again, comes back to making the business case.

The business case, well, you can save money. So that’s one thing is by reducing the churn and by automating a lot of these activities and having more accurate and consistent processes, you’re saving money. Because at your saving time, you’re able to apply those resources to other places.

So that’s one half of the business equation, right? The other half of the business equation is that, well, when you have this, how can you use this to generate more value? And that’s where you come into this notion, especially like if we’re going to talk about AI use cases, if your agent infrastructure is able to work with this clean data that you’re working with across these different teams, now all of a sudden you can be that much more productive and you’re reducing the churn there but you’re also creating a lot of value.

Anders Askasen:

And when I spoke with you the first time, you were really excited about Radiant Logic and what we can contribute.

Nick Nikols:

Absolutely, absolutely.

Anders Askasen:

You’ve been here for a couple of weeks now, you still as excited?

Nick Nikols:

Oh, of course, yes, absolutely. And again, it comes back to this notion of really fundamentally understanding the data and being able to provide this clean view of the data that can be used in all these different ways.

And again, in the, you know, identity market, if you will, you know, this capability is actually, you know, not all that common. I mean, there’s a few organizations that have this capability as part of their portfolios, but it’s often overlooked. I think it’s a very understanding, this data at time of change and being able to really manage it and leverage is definitely an opportunity for Radiant Logic.

Anders Askasen:

Nick, it’s been a pure pleasure having this conversation with you.

Nick Nikols:

Thank you.

Anders Askasen:

Looking forward to next time.

Nick Nikols:

Same here. Thank you.

Anders Askasen:

Thank you. And thank you for tuning into this episode of Radiant Logic.