Navigating the intricate landscape of identity security has evolved dramatically over the past two decades. Once characterized by a mere username and password, the contemporary environment demands that employees manage an astonishing array of digital identities—approximately one hundred per individual, not accounting for the emerging complexities introduced by agentic AI.

Joe Carson engages Erik Siebler, a seasoned professional with fifteen years of experience in Identity Governance Administration (IGA), Privileged Access Management (PAM), and authentication, to unravel the concept of 'legacy' within identity security. They delve into the defining attributes of legacy PAM systems, which are inherently infrastructure-bound, protocol-heavy, and tailored for a bygone era dominated by servers and routers. Erik elucidates the common pitfalls organizations encounter, particularly the tendency to misinterpret modern PAM solutions as mere expensive password managers, thus neglecting the essential integration of security into existing workflows to achieve frictionless access.

As the dialogue progresses, the focus shifts to the forefront of the identity security discussion: agentic AI. Erik articulates a nascent failure pattern in which one AI agent, denied access, may exploit another to circumvent restrictions, thereby complicating the landscape of privileged escalation. This new paradigm necessitates a reassessment of traditional security measures, as privilege escalation becomes increasingly relevant not only to attackers but also to the automated processes within organizations. The episode culminates in a practical migration playbook, emphasizing the importance of product selection, side-by-side rollouts, and key-user engagement, ultimately aiming to equip listeners with actionable insights for effectively transitioning from legacy PAM solutions to modern frameworks.

Takeaways:

• The evolution of identity management has transitioned from simple usernames and passwords to managing nearly 100 digital identities per employee in modern organizations.
• Legacy PAM systems are predominantly infrastructure-bound and protocol-heavy, failing to accommodate the needs of contemporary workflows and user experiences.
• The advent of agentic AI introduces new challenges in privilege escalation, necessitating a reevaluation of traditional security measures and access controls.
• Successful migration from legacy PAM systems requires a meticulous strategy, including product selection, user engagement, and the establishment of critical metrics to measure success.
• Zero friction in user experience is as crucial as implementing zero trust principles, emphasizing seamless integration into existing workflows.
• Organizations must acknowledge the technical debt associated with legacy systems and prioritize modernization to enable effective security in a hybrid and cloud-driven environment.

Hello, everyone.

Welcome back to another episode of the Security By Default podcast.

I'm the host of the show, Joe Carson.

It's a pleasure to be here and it's always my favorite time of my week, which is getting to have fun conversations with amazing people on really exciting topics.

And the whole goal is to really allow us to kind of share our lessons and experience with you, to educate you, to help you on your path, on your future career, or to help you solve challenges that you might be having around the workplace and looking for solutions and ideas to really help make your world a similar, a safer place.

So I'm really excited to welcome with an awesome person.

So, Eric, welcome to the show.

Hopefully, you know, I mean, if you can give the audience, because it's your first time on the episode, if you can give the audience a little bit of background, your origin story, how you got into the industry and a little bit about yourself.

Yeah, perfect.

Hi.

Thank you for inviting me, Joe, and happy to talk with you about the topic today.

And also to all the listeners out there, my name is Eric Siegpler, I'm based in Germany as well.

Some of you might hear.

Yeah.

And I'm in for around 15 years in the industry now.

I have an IT background, IT business systems.

I did an MBA somewhere in the middle in cyber as well.

But I was always focusing on digital identity after my major.

So all of this in there, I started to do IGA projects, pen projects, authentication projects, and all the things which were coming over the last 15 years in this field.

So, yeah, so I'm.

That is my main thing.

Yeah.

And I also love to look into other security aspects.

But yeah, my core knowledge is all.

Around identity, which is today is probably one of the most important areas in security.

In digitalization, it's always been sometimes a bit of how to get people productive and get them enabled and get them accessing the systems.

That's been kind of the problem, that joiner lever mover kind of traditional scenario.

But it has accelerated into so many different things, especially around APIs, cloud, mobile computing, you know, Internet services now all require some type of form of digital identity.

So it has become one of the major pillars, I call it the connective tissue of our digital society.

It's what brings everything together.

Yeah.

And with AI agents, that's just accelerating even more.

Yeah, absolutely.

I mean, I always remember, I always remember back when I started my career back in the early 90s.

It shows how long I've been in the industry.

Security then was, you know, identity was the key to the room and your username to log on to, whether it being a VMS system or basically a desktop or a unique system back in the day.

And then of course accelerated.

If I fast forward to today, I'm looking at my system.

I've probably got hundreds, if not thousand plus different identities.

And that's all for APIs for different systems.

I don't like to merge identities into having one identity that goes across so many systems.

I prefer to keep every time I create a new account, I create a new identity, but I manage all of that.

And it's challenging.

But I think to your point, the acceleration, I think if we look at some of the analyst reports, the average identity now is in, you know, probably close to 100 per employee.

You know, for every employee an organization has, it's upwards of close to a hundred identities.

So I remember, you know, 10 years ago it was probably five to one, but with APIs, with agentic AI, with machine identities and service accounts that just exploded.

So what do you think?

One of the things that I'd like to, you know, because identity's evolved over the years and we've seen many evolutions and you know, one of the things is that organizations, you know, have a lot of legacy, they have a lot of old technology.

What is for you when you see legacy, what is legacy in digital identity?

What some of the ways that organization is it very much on premise, you know, traditional methods of managing the environments.

Is that what you see as legacy?

Yeah.

So I'm.

Yeah.

I mean the identity world is broad.

Yeah.

But if you look into it, legacy is really all this, let's say fairly standard APIs use cases, you design it once and then.

Yeah, it stays the same more or less for quite a while.

Yeah.

And then you might tweak it a bit on the way.

Yeah, you have a typical joiner mover lever that works, maybe an internal and an external.

That's it.

That and around this you shaped all your processes, but that's not there anymore.

Yeah, that's exactly as you said, it's evolving.

You have far more machine to machine authentication which you want to secure, where you don't want to use just a client ID and secret or you want to have it also not just a hurdle.

Yeah.

I think legacy is you have a username, you have a password, you have A maybe mfa, but often a complicated one on the way.

Nobody knows when to use it.

You need to enter it at every step.

Everyone is complaining.

So at a certain time they will disable MFA.

I mean that is what we did 10 years ago because people said it's not working.

And I think that is a big shift also to legacy is how to make this modern and how to make it easy for the user so that they might not even see it in the background.

And then they are more than happy to use it so that we got rid of just making more, more stuff somewhere in the middle, which they complain about, but rather making it smoother for them and at the same time more secure.

Yeah, so I think in the authentication bits and pieces, that is for example passkeys or all these things around it, Federation passkeys when you're working on Windows, Windows, hello for business, they smile into the camera once and then all.

I mean there's also outside of Windows you have this with Mac.

You can use this also with Linux to a certain extent.

Yeah.

But just that they don't feel the authentication and authorization hurdle anymore.

I think that is in the authentication context the move which we didn't do 10, 15 years ago, that was just about how do I get a plain MFA token somewhere and the process that they are compliant or that they, they are more secure.

But everybody thought about is that also helping the end users?

Yeah, I think that is an identity.

Generally one of the big changes from legacy and towards where we moved as an industry.

Yeah, absolutely.

I always think, you know, when we look at those concepts is it's really getting to where it's frictionless.

We talk about zero trust, but I always think about zero friction as one of the most important things is where security shouldn't be an additional check that a user has to do.

It should be something the more we move it into the background, the more it is seamless, the more users want to use it because it takes away additional steps that we would otherwise have to do or have to remember.

It makes their lives much easier.

And that's.

I think that's one of the very unique things about digital identity is that while, you know, it's.

It's something that when you help users, you know, it's good for enabling them to be productive.

But it's also something you can heavily use for security when you see, you know, I think one of the great things is that when users be able to use pass keys or biometrics types of authentication.

What's some of the things, what's the challenges that prevents organizations from moving forward for those.

And also legacy was very much focused on the human.

It was human users.

Exactly.

It was for us types of people.

And the big change has been where it was integrations, APIs, then application service accounts and of course agentic AI agents.

What's some of the things that prevents organizations from moving forward that it really gives them challenges?

Yeah.

Often it's again, we cannot do it.

Our technical debt, often a word which is often used now cannot support it.

It's too complicated.

I don't have budget for it and all these things.

So we see it often especially in huge organizations.

So I mainly work with huge organizations around the world, not smaller companies.

So I always say a small client for me is a thousand plus identities.

Yeah.

And others might argue that's already huge.

Yeah.

So.

But if you look at this kind of organizations, they had so many things growing over the years.

And I think that's not just an identity problem.

It's generally a problem for them, for modernization that all this legacy is still around.

And then if you change something and it destroys a business critical process on the way, they will just turn it on again in the old way.

The business must continue.

And that backwards, backwards compatibility is always one of the.

It's always one of the challenges because you know, you put so much effort into making it more secure and more modern.

But to support the legacy, you had to support the old methods.

And that's sometimes, you know, it kind of negates the purpose of actually installing in modern stuff.

So.

Yeah.

And then, I mean, if we then look into the main topic of our talk today, privilege access management.

So these identities which you should secure even more because I mean, we all know attackers try to get in there with the less effort.

Yeah.

And if they get a privileged account perfect.

Then they don't need to hack anymore because they have everything after it.

Yeah.

And when we look into this.

Yeah.

It is there the same.

Yeah.

So it is.

We saw it that some organizations, what I found is that, you know, when they're doing a digital identity project, I think sometimes it's more important to even sometimes start with the privileged accounts and the privileged identities because of, you know, the danger and the risk that they have have and making sure you've got the right security controls in place.

Sometimes I also like to think that look at as what, you know, break it down into services.

So let's do it end to end services.

And then it becomes very repeatable.

It makes it much easier to deploy because you're doing it end to end.

What's some of the things, you know what, what, what's some of the controls that you would put in place for privileged accounts?

What's, what's some of the protection that you recommend?

And I mean privilege account when you started in the past, we all know it, we have seen it.

You have somewhere a username and a password stored in a script somewhere and that was their privileged account management.

Yeah, I think everyone who is long enough in the industry has been somewhere at a client in an organization where you saw such a kind of script, which is terrible at the end.

No control, you cannot do anything.

And then you might have maybe usernames or passwords which are even the same and stuff like this.

Or you keep the default username password on routers and stuff like this.

Yeah, I remember I have colleagues which are pen testers.

They came into a network and on the main routers they just kept admin admin or whatever they.

And what was there as a default?

Yeah, and I mean if you see all of it, that was how it all started and then you realized you need to manage this properly.

So.

And I think one of the first things was discovery in the pen this world and then also password rotation traditional thing.

That is how it all more or less started.

Yeah.

And this in a fairly on prem.

Infrastructure heavy way.

So I mean if, and that is if you look to legacy PEM or older pem, however you wanted to say it, it was very, very much infrastructure focused because that was still the core.

You had servers, network switches, databases, all these things.

And I think that is also a key when you're seeing putting controls in there and why it stopped.

Then you come to a certain point where they cannot go forward anymore because they still tied around us.

But the world has changed a lot over the last 15 years.

We don't talk that often anymore about VMs or we talk about microservices.

We said it APIs and we are not talking about agentic yet.

So I mean this is really the thing.

We started with discovery password rotation.

Then at a certain time we started session recording to do audit controls.

And then maybe if you wanted to do it more advanced, you started to do session stopping.

If they didn't delete all or whatsoever.

Yeah, what controls?

And I think that is a little bit how it evolved.

And the controls then started to come more and more and more, but always still focused on infrastructure at the beginning.

Yeah, yeah, that's, I think that's, I think that's a big key thing.

The Difference between modern and legacy is that legacy was very much that infra it was your, your, your on premise traditional legacy infrastructure.

It was your routers, your switches, your servers that was around.

It was firewall access.

It was things that you could touch and physically control.

And as you mentioned, as well as organizations, I think it was probably what kind of evolved was to move to bring your own device in cloud computing and especially I also found that a lot of those legacy infrastructures, they failed to be able to break down the end user or the business side of it as well.

It was very much focused at IT infrastructure.

They've already struggled to get beyond the IT infrastructure into the end user to get them.

Sometimes they may have put a password manager there and just okay, let's stop and let's leave it at that.

And rather than bringing it into vaulting and including it as part of the entire, you know, identity security kind of service.

What's.

So you know, if you're looking at that traditional side of things, what's some of the more modern, you know, what do you see as modern?

What's you know, have you moved forward?

Let's say an organization that's starting, let's say they have nothing today.

Where would they start and what would modern look like?

What would be some of the capabilities?

Yeah, I mean if you look at the end PEM we put in place to secure their privileged accounts.

But if you are completely starting from scratch, I think nobody has its own data center anymore, nobody has its own VMS anymore.

They just take microservices from wherever or SaaS services, all of this.

So we don't have this traditional layout more or less disappears with the big cloud computing or also if you use local providers.

Yeah, I mean it starts to disappear more and more.

And that is the key I think also for pem that also the identities, the privileged identities are changing.

Yeah, you don't have necessarily an root user anymore since if you don't control the infrastructure layer anymore, a Linux system, then you don't have an root user anymore.

Do you still have for your db, do you still have your DB Admin?

Yeah, whichever DB you're using, maybe not even this anymore.

And this is I think the big change so modern is probably the infrastructure disappeared or it got abstracted into a layer which you can now consume.

Yeah, I just get a website, I just get a blob storage somewhere.

I just get a network layer in the middle and the rest I don't care about it anymore, so to say.

Yeah, so and I think that is a big difference from a legacy environment towards a modern.

But, but I mean the reality is and that is all big organizations, especially it's hybrid, they have everything they still have on prem, they still have cloud and then it starts to get even more complex.

So I think if you start greenfield with a new corporation which starts really with nothing, I think they have a far easier life than all the bigger organizations still having.

All coming back to the initial thing technical debt which is often used now with all the things which are still flying around.

Absolutely.

So they have to have something that's a hybrid that works for still works for the old legacy IT infrastructure traditional.

So there has to be some way to plug in a modern PAM solution into that old infrastructure.

But at the same time meet the use cases for DevOps environments, for cloud SaaS applications and so forth.

So it has to be able to handle all of those use cases.

Is this where do you see PAM platforms as the kind of the way forward?

Is that something or.

Or PAM services?

PAM is a service that would be consumed from the cloud.

Would that be something that you would consider modern way that it can still plug it back into the legacy infrastructure?

I mean there the answer is probably it depends if you just put in PEM solution in the cloud, is it in modern?

Probably not.

I mean it comes with the integrations and all the functionality which that solution brings.

And then at the end for me it doesn't matter if you hosted SSS solution on prem or wheresoever.

It's about the integrations with such a PEM solution which are important.

Can you natively integrate?

And that is I think a nice example which I had with a client once is when you look to the traditional way like a legacy PEM solution works, you natively integrated it in RTP or SSH and all those things and it didn't need to an administrator didn't necessarily see that the PEM solution was in the middle because it all worked with the native protocols.

But if you look to the modern world and then you have now the new admin which for example, just on an AWS portal, an Azure portal or on a cloud portal, they just use the browser and they're an old fashioned legacy tool which goes via RDP or whatsoever that feels like a friction for them.

So these administrators don't want to see a friction, they might want to use it as much as possible, as easy as possible.

And if you then put something in the middle again like a legacy PEM solution and that's something I've seen often is you use a legacy PEM solution which is just using, let's say, infrastructure protocols to make it more easy or simplified towards a cloud portal, then these users might not feel that well, because they say, I cannot use my native browser experience.

What are you doing now?

And I want to log in, but I don't know the password of my administrative user on the cloud.

So what they are then asking at a certain time is, can I just retrieve my password from a pen solution?

Then they retrieve the password from the pen solution and enter it manually on their cloud provider and then they, they can use it natively.

So then you use your PEM solution only as a really expensive password manager, so to say.

Yeah.

And you lose all the other controls.

And so I think for me, legacy and modern PEM solution is not about a deployment method.

It is for me about the integration such a solution can provide to make it for everyone easy to consume and again, as frictionless as possible.

That's not just for the end users, but also for all the administrator.

Yeah.

So it sounds like one of the big key steps is one is discovery across all of the environments that you operate in.

And then the second part is then interoperability integration between the existing infrastructure that you're using for the business, that it should fit seamlessly into that, into the native experience.

So being able to find everything and be able to bring it in.

I was using metaphor all in the past.

Is that so it's like you're buying a car, but you don't want to have to build the roads just for that car.

You want to be able to get a car that works in the existing roads that you drive on, rather than having to recreate everything again.

And it should be also natively used to the cars that you're used to driving.

It should fit into that same experience.

What's the next steps?

Integration.

Interoperability is key, discovery is key.

What would be the next phase after that?

Is there things that, you know, there's a lot of regulations and compliance that does require.

So, you know, auditability.

Is that something that would also be important here?

Yeah, and I think that is highly dependent on the industry.

There are certain industries.

I mean, if you look to finance and banking, that is one of the core features.

Yeah.

If someone does something on a payment terminal or where they can control certain transactions, I mean, their auditability is the key.

I see certain industries where this might not be the.

I mean, everyone wants it, but maybe to an extent where it's not so important.

Yeah.

Because they don't have this high pressure.

So I think auditability is yes a key thing.

It's also detection of course but to which extent that highly depends on the.

On the industry.

The clients is working.

The clients are working on and yeah, there I see.

I think finance is one of the more extreme parts.

Yeah.

Whereas maybe in certain trading it is not so important.

I once had a client that was interesting.

It was a retailer and we did their general retailing an improvement to secure all their processes in a retailer.

And they said at the end our shops around the world or that was just around Germany, they are independent for up to two weeks.

So even if my central service is down and all of it they can continue where is the need that I do so much more things to make it more secure and so on.

Because they are independent.

Yeah.

They can continue working.

So so kind of very unique use case, you know that it's almost like they can.

They can operate offline for a period of time before it needs to be kind of resynced internally.

So that.

So you know I do see a lot of.

Kind of some of the regulatory sides, you know the PCI is you know is definitely one on the.

In the payments and financial side.

And then there's you know the SOC1 and SOC2 which tend to also does have a lot of kind of push for commerce.

So as we kind of you know trans.

And let's talk about one big disruption we're seeing in the industry which is around AI and agentic AI.

How is that changing how privileged access management works and how do you see it need to evolve?

What's the changes that Pam needs to make to be able to operate in an agentic world.

Yeah.

And if I would have the perfect answer to this, I think I wouldn't sit here anymore and would be now a billionaire somewhere and sitting on an island because I like feel think that is everyone asking themselves right now.

Yeah.

And I think there again the as we see it generally in identity and in Pam with agentic.

The speed of it.

Yeah.

The also the way how they operate is just extreme.

Yeah.

And I think the difference there especially in pen is when you see how agents are working and trying to abuse access from other agents which we never saw like this before.

Yeah.

Maybe from an attacker.

Yes.

They tried to go through the attack lane but when you now you had a service account and the service account had the.

The proper access control in place and it called a service there and they got it denied and it was a.

Denied done.

Yeah.

An agent doesn't stop there Anymore an agent then starts.

Okay, but I know this other agent which might have the access.

So I just try to force that this agent does what I wanted to do right now.

Yeah.

So when we now look into this, the privileged escalation.

Yeah.

As we said it from attackers is now not an attacker anymore.

It might be your business process internally.

Your machines which.

Or doing this.

Yeah.

And this is I think a really big change in the, in the.

For the PEM world.

Besides all the other things with agentic.

Yeah.

How do you control this now?

Yeah.

If you have maybe your agent and you have it properly controlled, but it can reach out to others and they are just willingly say, oh yes my friend, I do this for you, then you need to see again, okay, where's now the control where stops.

And I think that is for privilege.

One of the main changes.

Yeah.

Besides all the other open points, what is the answer there?

I don't know it yet.

Yeah, it's like AI agents are now becoming, you know, really, really smart social engineer, social engineering, other agents.

And I agree and one of you know is it's really important that kind of.

We understand one is the discovery which becomes key in agenda GI as well because it's really hard to understand what's the context, what's the outcomes or what skill is that agent specifically, you know, know been asked to do and you know, does it have the ability to.

To break out off the guardrails that's been put in place by going and you know, getting other agents that has the access to.

To.

To give it over just like you know, and attackers doing social engineering today.

So it's going to be interesting to see.

I think one of, one of the most important parts here is that when you're designing agentic AI in the context, you know, one is.

Is getting what's, you know, how do we keep the human in the loop some way to make sure that we have the oversight.

I think we're moving to.

We are moving to an autonomous agent.

But oversight becomes really important from a human aspect.

The ability to stop it in its tracks, you know, like a halt button or a pause button so that the agent itself, you know, will not try to continue.

And also making sure that it doesn't abuse.

Because I think that's one of the big differences that humans, we do have ethical, you know, and questions.

We have context where we can go and say is this the right thing to do?

How can I do it in a more legal, proper business process way.

But agents don't have those kind of Guidelines or ethics.

They're task driven, they're outcome driven.

I need to meet this goal, this is what I've been asked to do.

And I'm going to try everything in my power that isn't on the exception list or exclusion list in order to achieve that.

And that does create a lot of very disruptive challenges for the identity specifically PAM industry.

Yeah.

And that is then internally as a business.

Yeah.

There might be not external attackers involved yet because they just do it on their own and do then whatever they think they need to do.

But if you then see that an external attacker might get the chance to leverage such an agency for his target to compromise you, to get data from you, whatever they wanted to do, it's getting even more complicated.

Yeah.

I mean there are so many texts which is not pen related necessarily.

How we can still abuse agents or AI right now with white written commands and then PDF as a simple way which you might open or which you enter there or stuff that you put in an email.

So it is a completely new way of, of I think that attackers are using it for offensive security to be faster, but also to leverage maybe existing agents inside an ecosystem to get to their target.

Yeah, absolutely.

And so if of an organization, let's say, you know, and you've, you've done many of these in the past, let's say they, they, they are stuck at that, you know, legacy PAM environment today and they do want to be able to manage more than just human users and they want to, you know, they have this hybrid environment already and they're trying to managing it with, you know, kind of in a legacy way.

What's the path if they do want to migrate to something more modern, what's the first step?

You know, what do you recommend?

You know, let's say they're, they're looking at their business today.

They're having less of their own internal IT infrastructure, but they're still stuck in a legacy PAM infrastructure and they want to leverage it more for, you know, SaaS, model for cloud, for workloads that's running in the cloud.

They've got maybe hybrid workforce as well, working with a lot of third parties.

What's the steps to migrate?

What's some of the things that they need to start with?

Yeah, so I think at first you need to see what is the product you wanted to use because you probably don't develop it on your own.

I mean, with white coding many things are possible nowadays, but I wouldn't recommend this necessarily for such things.

So I still see even with all of the changes happening there that you still use a product out there on the market.

So I think the first, first thing is check what product you wanted to use, what product fulfills your requirements.

Is it the same window?

Is it another window that.

It depends.

So I think the product selection is one of the first steps you need to do based on your use cases you're seeing right now.

And then if you found this out, it is a key to find either your own good people or a good partner supporting you on this journey to really make it as frictionless as possible.

Because if you're touching a pencil system when you're then migrating it, it's often key processes, administrators everywhere in your business best case.

So if you migrate something into a new solution, you also migrate a legacy into it because you want to have one new pillar which can do also all the old stuff, but also the new stuff.

So you need to make sure that the migration happens as smoothly as possible.

And for this you need to have a good team, either of your own people if, if inclined, or if a company has their own people or a good partner.

I mean that's the business where I am in.

But to find a way forward, plan it properly and then execute it.

And I think the steps are there.

Find your new product, get the new product in place, and then work on the migration plan, which is identifying your users, identifying your targets you're using and identifying the use cases and then plan how can I migrate them one to one or not do.

I might maybe not need to migrate certain use cases because you're used in the legacy world.

You worked on workarounds which you don't want to migrate necessarily.

I think that's the most critical part in such a migration.

Users are for short systems are for sure.

That doesn't change much with a migration.

But the use cases, because certain use cases might work far easier than in the past.

Some other use cases you don't want to migrate anymore.

And what I've also seen often in such migrations is that there were use cases you were not even aware as a central pen provider for your organization, because they were just used for something which then was never documented.

And then they will come at a certain point when they are on the new solution saying oh, I cannot use it this way anymore.

Do something.

And then it starts to get interesting.

So I think to sum it up, find a good product, get it up and then do the migration plan.

Plan properly with all the parties involved.

And at the end it's a.

It can only Work well, if you have the product, they are the good product.

You have the client fully dedicated to it and then either their own people or a partner.

And this as a triangular force, so to say to get it forward and then push it forward.

Yeah, because there will be obstacles on the venue.

I mean we had.

We did many migrations and, and we successfully finished all of them.

But some were bumpy and others not so bumpy.

So it's I think just a normal way.

Yeah, absolutely.

A lot of lessons along the way when you're doing the evaluation.

What's some of the criteria they recommend from a product?

Selection criteria.

What's some of your due diligence that you can do beforehand choosing it for the client?

What some of the criteria is.

It's, you know, is it going to the analyst reports and just choosing the one to the most right or most top or is it looking at what's the kind of capabilities of the client as well?

Do they have in.

In house people that's understandable.

Do they have something in place already?

What's some of the kind of criteria that you look at when.

During the selection phase.

Yeah, and.

And most.

When we are, when we are supporting this.

I mean often I personally still think it is analysts because they are supposed to be no neutral and have their framework.

It's always easier to follow those.

I mean if you have a good relationship.

There's also my personal opinion which I share in sometimes.

But I mean this is not something you can write in any report why you chose this and this product.

Because Eric said it.

Yeah.

So I think the core is still that you have as qualitative as possible and things which are not just feelings.

Yeah.

So.

And that I think analyst reports is always good to say.

Look, they are mentioned there.

These have already this and this reputation.

Some analysts check them and yeah, please go forward with it.

So in most cases I see it that we are choosing some top players or niche players out of an analyst report and then going forward with them having a long list, then starting to check them further and then going down to a short list and then you come to a project that is certain time.

And then of course which is still a main thing often is then the price at the end.

Yeah.

So you can have the best product but if it is the most expensive and nobody can pay it, then often also clients will think at a certain time that's not working.

Yeah.

It has to support the business, not be the business.

Yeah, exactly.

Yeah.

That's ultimately, ultimately gets to.

Is.

Is that, you know, in the end I also look at it as well as the, you know, complexity also becomes a massive factor and.

And sometimes usability as well is that, you know.

So I think it gets to your point is what's important as well is that it should be able to fit into the business's existing processes rather than change the business as well.

You want people to be able to meet and become frictionless and move it into the background as much as possible.

How important is it to involve the users, those who's going to be using the solution during that phase?

When do you start engaging with them?

So we recommend usually to start fairly early with key users so that you get at least during.

Often depending on the size, you cannot do it in a big bang.

Often you need to do it waived approach for such a migration from towards new.

And we then see that we often start with maybe the IT department or the security department, the identity department.

Depending how big the organization is.

They can be the first testers, they understand it better.

And then you go further.

But then I think, think you cannot involve everyone.

That's just not possible for most organizations.

So you start with some key users and I think this is the key.

Then coming to key users again to find the proper one which are covering most or the majority of your workforce which are using it or the user group and then getting their feedback and using it.

But what you will also see, and I think that is normal with change, you will meet at a certain time users of your solution which just say I don't like it because it looks different.

Different.

Because with every change, even if you stay inside the same vendor and modernizing it to the latest stick.

Yeah.

The button might change from top right to bottom left or whatsoever.

It might be only minor.

And they will say there's the button not there anymore.

I don't like it.

Yeah, so you need to.

I think then when you take their feedback, you also need to put a lot of work into the qualification.

And is it an opinion?

Is it really a breaking stuff which is there?

And that is.

I think the human factor in such a migration is still huge, but you cannot manage it one by one.

So you need to start to formally find some proofs.

And then at a certain time also start now we migrate it and let's see what comes afterwards.

During this migration kind of phase, is both solutions operating side by side or is it like just that switch over, like you end the day you turned one off and you moved to the other.

How long do you recommend keeping both side by side during that migration phase.

Yeah.

Often we have them side by side for a while because that comes back to the.

We don't want to disrupt any services.

That is for most of our clients.

When you're changing something of a running system which is integrated in their day to day task think about they have whatever business they are in and they have a critical incident to whichever reason and they need to access their infrastructure, their database.

They are.

When we are looking more to the legacy things.

Yeah.

And they cannot access it because the PEM solution is not working in the new way.

And then they might lose millions of dollars because they.

Yeah.

There's something happening in their business.

Yeah.

This cannot happen.

So you need to make it as as easy as possible to.

To that they don't.

How shall I say it now the best way so that they are not interrupted in their daily processes.

Yeah.

Because for them it's just a change.

They might not even understand why we are doing it.

This in the.

In the background.

Yeah.

So there we put it side by side and then we.

We start to make it enable them with some.

A lot of details around it.

Yeah.

That they can use both solutions at the same time.

Then you can say please use the new solution.

Start using it for your day to day task.

If you come to a point where you cannot use it anymore because there is a bug or something works differently.

You can always switch back to the old solution so that you can continue the way as you did before.

That we don't break your business on that is the key.

So have them side by side.

Encourage them to use the new solution.

If they found a bug, write it down, go immediately back to the old solution, continue your time and we will fix it with the next iteration.

And I think this is the key to have both system at the same time.

Let the users know they can still use the old way if it's not working.

But also encourage them to use the new way because that is a downfall of this approach.

Some might say.

Say I don't care.

I use just the old way.

Further they will never finish this project.

I keep on my old version and continue.

So that is then the key make sure that they also move to it and that.

Yeah.

So.

So what's.

What's some of the key metrics that you.

You.

You know.

Of course you know in that migration phase you're probably looking at you know activity from users login.

You know that they're logging into the new solution and using it.

If you find you know handful of users that have never logged in you probably that's a flag to, you know, that they either didn't get the communication or they're just stuck in a method of the old way.

What's some of the key metrics that you look at?

What would be some during a migration itself?

Yeah, it's a usage of the platform.

Yeah.

So I mean generally I think as you said, I mean you can see how many connections, concurrent sessions are running, how many users are logging in.

And I think that's the key and that should go upwards during a migration.

You turn more waves on and then you should see more and more there and on the same time it should reduce all the other.

The usage.

Yeah.

They might be less traffic going through the system, less session recordings and so on.

And I think that is the key that you see that the usage goes up and the other side down.

The thing is how granular you can do it depends how much time you have for it and how much people you have.

But usually in such projects they are already fairly busy with actually migrating all of it.

So they don't have the time to look into so many statistics and so many data into.

So I think it's more a trend you're looking into and the feeling and then often also something's not changing who, who, who shouts out the loudest in the business of the, of a company.

But there again that doesn't necessarily mean that's the most breaking buck on the way.

Yeah.

So that is then again the between metrics reality and normal politics in such organization find a way there and is there easy answer this metric again, unfortunately no.

I think it's in a good feeling of, of the enterprise itself, of their client base together with the project team to find a good balance there.

Yeah.

To.

To get it done.

Yeah.

And what's, how important is it, you know, for organizations today?

Let's say, you know, they're looking at cloud and they're looking at gentic AI.

How important is it for them to try to, you know, to move faster?

Is it something that they can keep delaying and stay on legacy, you know, for the foreseeable future?

Will they end up having to end up with two solutions to manage both?

How important is it for them to make a decision, you know, to, to already start thinking about migrating?

What would be the trigger?

I think that is again twofold.

I think the experts inside organizations see it and they want to move it forward and they want to push it so they see the demand and they want to push it even further.

I think right now, even in the let's say more worldwide economic situation which is not just growing everywhere where you see that they save more budgets and all this.

The issue is often do they get the budget for such a project because you might get maybe savings on the way, but you always, always have an initial invest at the beginning.

Yeah.

Where you have maybe for short term two products running at the same time or you have a project costs at least for someone doing it.

So you need to have an initial investment which you need to do.

And getting the budget, that is still something I see often as a constraint.

Even though maybe the people know that they need to do it.

The pressure knows that the business knows it.

But getting this into the proper business case inside the often IT department, I mean it's still the reality that security sits most of the time still in the IT department and not somewhere else.

That is the biggest issue.

They are stopping them from migrating it and then they might stuck with maybe some different solution.

Or in the cloud they use security control.

It's natively built into each cloud vendor, but it's not unified anymore.

It's not a central dashboard anymore.

So then you start to separate it again and then lose also certain capability to detect and properly manage it.

Yeah, you end up with many silo solutions and no central visibility, which increases risk and it makes challenges.

I think also some of the things as well is that I think in the world we live in today is that Pam has become somewhat democratized as well, is that if you go back five or 10 years ago, there may be only a few options that organizations could choose from.

But today there's much more choices.

So there's a lot more.

And those more modern solutions have evolved a lot from what it was five, 10 years ago.

Yeah, but also the old solution has.

So I think it's an interesting mix right now.

Yeah.

Also old vendors have evolved, new came in.

So it's interesting.

And as you said, it's definitely far more options for people or for organizations to adapt whatever is the best for them.

Yeah, and that's not the easy answer as usual.

So you need to see where I'm loading.

And I mean we see organizations when they are really just everything on one big vendor from a cloud platform, nothing else going back to this then maybe all the stuff inside this platform is enough.

Yeah, but this is fairly little companies coming back to the initial question, greenfield companies versus all the hybrid environments where it's not like this.

But if you start again just fresh, then you might not need need to think about dedicated tools.

You just use what is in there but it is not.

Yeah, that might be for a new startup case, but not for from enterprises.

Yeah.

So question.

I mean this world moves so fast.

Even I'm always looking for information, trying to stay up to date, looking at different talks and industry experts.

How do you stay up to date?

What's some of the resources that you use is there?

You know, what's your method for learning and staying up to date with the latest?

Yeah, that's as you said, the challenge right now in the information flood, you can get everywhere.

I still use a couple of websites which you can use to get general input.

And I still love to talk with other experts I know in the industry to see what they are doing, what the day recently go to conferences to listen to talks, podcasts, to see what it is.

But I still also personally love to touch it on my own.

Yeah, and nice slides is good, but I still love to have something running on my side, playing around with it, see how it's really working and then also feeling oh that's cool, this and now this and this or they look, what is this?

So I think it is a keep of still reading but also keeping keep open and do something on your own.

That's how I do it in the end.

Yeah.

So a mix out of everything, but still you will miss things.

So the best is exchange with other experts, other folks listening to them, see what earned here, what they did.

So podcasts like yours for example.

Yeah.

And I think that is really the key where you can do it the fastest.

Yeah, absolutely.

It's similar to my methods as well as you know, I try to stay connected with the community as much as possible, you know, with some of my peers like yourself and like Ian Glaser and Hutch and Alan.

And there's so many amazing industry experts out there that have such a wealth of kind of industry experience and also kind of really can also visionaries as well.

So going to conferences like the Kapucha Cool EIC or going to a denti verse really allows me to get a kind of really good overview into where the industry's going and what's the challenges and how some of the ideas and methods that they're solving those moving forward.

So it was always great to stay connected.

But I also, I love taking things for a test drive as well.

I love getting my hands on things and you know, understanding and clicking around and trying to figure out, okay, this is how I did it before and what's changed and trying to uncover it, look in the background, you know, Tick the hood up and seeing.

Okay, where has things changed and what protocols are being used.

So where the magic happens?

Is it real magic or is it the same?

Is it, is it the same engine?

Nothing's changed.

You've got the latest car and you open up then you just got like a two, a two cylinder old diesel engine.

Yeah, it's nothing with electrical whatsoever.

Yeah.

So yeah, you plug it in but you know, there's nothing, nothing happening at all of the.

They're still using the old method.

If the audience does have follow up questions, what's the best way for them to reach out, connect with you they do want to follow up with later?

I think the easiest is go to LinkedIn.

There you can find me and that is where you can reach out and then we can find proper channels afterwards.

Fantastic.

To have communications or go through you.

Most of them might know you maybe or at least have contacts to you and go through.

Jodi has also my contact details.

Absolutely.

We'll definitely make sure in the show notes I'll put a link to your LinkedIn as well so the audience can find you very easily.

So Eric, it's been for fantastic having you on and it's always really great to hear some of the best practices and your lessons and experiences and really kind of where Pam is becoming from a legacy perspective, where it's going to in the future.

Also some of the best practices and plans for migration.

So definitely if you are planning a privilege access management or digital identity migration, definitely reach out to Eric.

He can definitely take you on that journey to being successful and take you on the path to, to getting into modern solutions.

So absolutely.

So Eric, great having you on the show.

So for everyone, this is the Security by Default podcast.

I'm the host of the show, Joe Carson.

Tune in every two weeks for latest episodes, new guests, new topics and the whole goal here is to really get clarity through the chaos in the world we live in and to help you on your career and journey in cybersecurity.

So stay safe, take care and thank you and goodbye.