Powering Business Resilience Through Identity Security and Service Management

CHRISTINE KLIPPINGER  |  0:07–1:03

Hi everyone, and welcome to our presentation today. We're going to get started in just a minute, but I want to share a couple of housekeeping items with you all. First, this webinar is being recorded and it'll be available to you afterwards as well as for those folks who registered but aren't able to attend. Also, you'll see that there are some attachments available for you to access if you like. And lastly, if you need to adjust your screen resolution, you can do so in the lower right-hand corner of your screen. I'm Christine Klippinger, and I am the Global Webinar Program Manager for SailPoint. I'd like to do a quick introduction to our panel today.

First, Michael Yario, CEO of MajorKey, is going to serve as our moderator. He's joined by Arun Kothanath, MajorKey's Chief Technology Officer. We're also pleased to have Jeff Gore, VP of Industry Product and Solutions Marketing with ServiceNow. And rounding out the panel is SailPoint’s own global field CTO, Neil Mcglennan. Hi everyone.

SPEAKERS  |  1:04–1:05  

Hello. Hey guys. Hey.

CHRISTINE KLIPPINGER  |  1:06–1:44

Very quickly as we get started, we've got our Safe Harbor statement for you to take a glance at. This presentation may contain forward-looking statements which are subject to risks, uncertainties, and assumptions. Actual results may differ materially from those expressed or implied. These statements reflect our current views at the date of this presentation and we undertake no obligation to update them.

Please refer to our filings with the SEC for more information. Now that's out of the way, let's get started. I'm going to hand it over to Michael now and have a good presentation all.

MICHAEL YARIO  |  1:47–2:28

Thank you. Well, welcome everybody. Very excited to be the moderator of this particular webinar. I think it's important to kind of set the stage with the folks that are on the call. Historically, identity security was mainly used to protect us against threats and prevent breaches. It was often seen as an obstacle that really slowed down business operations and outcomes. But as today and things have moved on, identity security technologies and processes have evolved into helpful tools that can accelerate business goals. My first question is, why is identity security becoming such a critical lever for business resilience and operational efficiency in today's enterprise landscape?

I think we can start with Neil.

NEIL MCGLENNAN  |  2:30–3:28

Yeah. Well, identity security has really become that critical foundation for modern enterprises because identity is that control point in that perimeterless world. And we all know that everything is gone more perimeterless these days, right? It's really hard to enforce least privilege and detect threats all while simultaneously supporting regulatory compliance across hybrid environments, cloud and on-premises, right. And as we see workforces grow and have a lot more of these different types of identities and more accesses and also non-human identities as well are machines. They're becoming more dynamic and AI augmented. And identity security really ensures that consistent kind of scalable control that really is a strategic enabler for things like zero trust and digital transformation initiatives, things like that.

MICHAEL YARIO  |  3:29–3:31  

Right, Jeff, I'd be interested in what your thoughts are.

JEFF GORE  |  3:32–5:08

Yeah. So once again, as the head of industry product sources marketing, we're talking with customers quite often around their core business challenges and we're looking at the value chain of the customers in the industry that they represent, what they're actually looking to solve across that value chain. And one thing is very clear, particularly in regulated industries, I think industries like banking, insurance, life sciences, public sector, in any of these industries, operational resilience is a critical corporate initiative, which is quite simply the ability to maintain your critical business operations even when faced with disruption of any variety. And so, what we see is that in general, organizations will say that the fact that they've got disconnected people, disconnected processes, data stored across thousands of applications, it really leaves that company unprepared for the unexpected.

And if the unexpected happens, obviously that's going to lead to loss of customer trust, definitely going to impact top line revenue, definitely going to impact just the overall profitability organization where unexpected downtime could lead to up to billions in losses for a mid-sized bank. And think about how much that could increase as you expand into larger enterprise organizations and even customers across multiple industries. So critical C-level top of mind conversation for operational resilience.

MICHAEL YARIO  |  5:16–5:18

Yeah, it's great data. It's great data. Arun, can you provide a little feedback?

ARUN KOTHANATH  |  5:21–6:55

Sure. I'm going to piggyback on both Neil's and Jeff's answers. I think all four of us have been long enough in this field to know that as evident from either the grey hair or lack of hair, right. So, we know that. But traditionally identity security has always been driven by what Neil said; it was security, threat, and associated things. And then Jeff alluded to the business now going into the value chain proposition for the business. Now what we are seeing more and more is the bottom-line effect. You move from security to compliance to efficiency and then leading that into how do you influence or impact your business lines, right?

So, you're talking about things like zero trust, which is traditionally a security or CISO's issue coinciding with zero friction, which is usually CIO or a business leaders' issue, right? So, coinciding that. And then what we're seeing is that anytime identity security becomes the critical path of any of these things, you are in the resilience path, right? So, we often see those concepts coinciding and then things like an HR team trying to look for employee experience, a better employee experience. So, you are looking into the business aspect where identity is kind of the hinge pin for all of that.

MICHAEL YARIO  |  6:57–7:15

Yeah, it makes sense. To follow up on that question, how does aligning identity security and service management change the way organizations approach digital transformation and compliance, withdrawing the synergy between IT service management and IGA from a business value lens. Jeff, why don't we start with you?

JEFF GORE  |  7:17–8:56

Yeah, so what we find within IT service management more broadly, any workflow that spans across the enterprise. Arun just gave the example of an HR service. Take core processes like onboarding a new physician in healthcare or establishing an enterprise risk program within a bank. These are not processes that exist fully within a single function. They do not sit within a single entity. So, it's always leading to multiple systems and multiple departments. And now that you're dealing with a process flow that involves each of these departments, that probably have their core underpinning system of record. The problem statement is magnified when you add up just the sheer amount of data points, the sheer amount of access control, and the sheer amount of places where something could occur that could actually disrupt that overall intent workflow.

And so, it's just so critical that organizations are rethinking their processes right now. And we're going to get to AI later, I'm sure. But even more so when we get into the promise of AI, where if you haven't really firmly identified all of your data needs, all of these connected processes, and then establish a mechanism for you to manage your entire ecosystem of providers, all of the folks that actually interact with the core process, you're setting yourself up for impacts to your operational resilience. And once again, that's going to lead to loss of revenue and loss of profitability for an organization in the long term.

MICHAEL YARIO  |  9:04–9:06

Yeah, interesting points, all of them. Neil, what are your thoughts?

NEIL MCGLENNAN  |  9:08–10:32

Yeah. One of the things is we're talking a little bit about IT service management. One of the things is it's not just IT, right? You're really talking about those types of things. You're talking about the business. Just like Jeff mentioned it, all that value is interacting with the business. And likewise, identity security is also a business imperative, right? And so that's something that you can't do alone, right? Yeah, security is everybody's job. And I think by weaving the two together you really have additional context, right? You have additional details and you want to make all those things happen as efficient as possible. Every business need wants to operate in the most autonomous, most efficient way for cost savings and make sure everybody's lives are sane, right?

And we want to make sure that they're also extending to access controls. You're getting the right stuff at the right time. And we don't want to over provision people and give people too much access. We also don't want to give them not enough either, right? So, there's that fine balance, but you also have to coordinate this. So, making sure that we have the most up to date information around who has access to what, but also the wide, brighter, wider business can leverage that information as a point of decision, right? If we have information around who has access to what, maybe you can use it or likewise things like managerial chains or something still pending approval or things like that.

These things work tightly close with each other because in the end identity security group needs business and business needs identity security.

JEFF GORE  |  10:42–11:15

I actually love that answer. I just wanted to chime in. We often hear trust is the currency of business and you really just hit that, hit that on the head. If individuals are not having access to the right data at the right time or data is improperly accessed at the wrong time, once again, that is a loss of trust of the organization. You're dealing with sensitive information, sensitive customers' information, and regulated content quite often. And because of that, it is just paramount that folks actually make resilience and this access control and security just a core part of the culture of the organization.

NEIL MCGLENNAN  |  11:28–11:36

I really like that. Access can live kind of almost anywhere too. In different silos in different parts of the org where people aren't paying attention. I think that's a nice thing is that it kind of pulls it all together, and then the business can leverage that to its benefit, right?

ARUN KOTHANATH  |  11:42–12:23

One other thing I would add to it a tiny point is when you talk about resilience, when you talk about converging all of that into one ITSM platform, the ability to increase visibility, right? So, you're talking about defining KPIs and making those KPIs available to those who care for them. Traditionally, how many Excel spreadsheets have you seen in calculating KPIs, right? So this type of integration, especially the identity functions to ITSM can give you the direct correlation between how often, how many times, how quickly all those parameters that are speaking to the business sense. So that's something which we see often nowadays.

MICHAEL YARIO  |  12:30–13:10

Yeah, all great points. Kind of moving on to technological or integration of solutions, as Jeff alluded earlier, AI is increasingly more vital to identity security and being able to streamline how organizations secure and govern and manage identities and ITSM workflows can boost both security and efficiency across the enterprise. And so, our question is where does AI play a role in identity driven service management, and what kinds of decisions or processes are becoming more intelligent as a result? Essentially, what's the value of AI across identity and ITSM? Let's start with Arun.

ARUN KOTHANATH  |  13:12–14:42

Sure. So, I still think that organization is still in the hype stage dealing with AI, right? They hear all good stories, and AI can be the next best thing in the world. While going through all of that, we're still seeing cases where Gen AI is providing more meaningful outcomes to those who are asking for. One of the biggest problems is again, I go back to picking on Excel today, I guess, looking at Excel spreadsheets and then deciphering what the outcome of that. That becomes a challenge for most people versus the Gen AI system giving you that answer in the plain language of your choice that makes it so much easier. AI, the generative language is assisting that.  

Now AI in general is promising to get listening faster, we're all working with humongous amount of data, whether it is access or roads or governance or ticket resolution or whatever that case may be. But coming to decisioning was based on let's say previous trends or previous cases so on and so forth. That becomes much quicker, faster, and probably closer to reality, and error-free as well. So, the impact of AI is actually becoming more and more visible. We have a ways to go to get to a lot more of what is promising, but it is definitely in the right direction.

NEIL MCGLENNAN  |  14:56–15:59

Yeah, one thing I'll probably add on to there a bit is, I think AI is definitely a business enabler, right. And we're talking a little bit in our previous question about how identity security, business operations, and processes work together. I think that the two go kind of hand in hand again here, AI is almost kind of just a way of summarizing and enabling that shortcutting some of those manual efforts by leveraging that context that we talked about earlier, right? If we know that somebody already has something, or there's a trend that we're currently seeing across a peer group or there's a lot of different access requests and maybe we can recommend this thing be approved.

There are different ways that we can leverage this in a deterministic way to help people point out, OK, well, maybe I don't have to go hunt for that information myself. Maybe I don't have to go figure this out or ask somebody else. I can have that information you handed to me in a in a nice way, right?

JEFF GORE  |  16:05–18:20

And it should kneel to piggyback on that a little bit and just to give a very specific example. Take a bank and one of the most common customer interactions of a bank is going to be a customer disputing a transaction, right? So, I got my credit card bill. I see the bill. I don't recognize a charge on it. Well, in the pre-AI days that is a very complicated interaction for a bank because it involves tons of systems both internally within the card issuer, which is the bank, but also the full ecosystem of merchants that actually may be processing that data as well as data that is unique to that particular customer.,

And so, in the days of AI, now you can actually envision these processes and customers are realizing processes where AI is actually helping the customer realize whether or not that is a valid interaction point to the contact center with having the right information at the right time. Hey, maybe my spouse made a purchase and I just didn't recognize it. And this is not even something I should be disputing, right? Having access to that type of data and in real plain language from a customer perspective or if you move to the agent, someone who's actually working that particular conversation. AI can help summarize all of the collateral across all these systems to help that agent understand whether or not this is a valid dispute, how this dispute should be getting processed.

And I will go so far as to say in the realm of an agentic AI, where AI is actually serving autonomously as a fellow employee of the call center agent, you can easily imagine a real that it's making the recommendations, performing the work for someone to validate before it moves on. And so once again, just bringing it all home with an actual customer example and use case where this isn't just IT service management, it isn't just CRM, it's bringing it all together into one coherent conversation for our customer. It's around business transformation.

MICHAEL YARIO  |  18:24–18:50

Yeah, I think it comes down to experience a lot too, right? It's people's experience when they go through like using Jeff's analogy, or I should say use case of a of a customer disputing, right? I think when someone's in that scenario, they're usually not the happiest of people, right? And being able to go ahead and get that solved quickly with real data, with factual data, it makes the experience in an uncomfortable situation a little bit more bearable. So a really good example.

JEFF GORE  |  18:53–19:05

Yeah, I mean it's time, it's accuracy and you building that trusted relationship with your customer or with your employee, whatever that interaction would be.

MICHAEL YARIO  |  19:06–19:35

So, you may have stolen my thunder a little bit, Jeff, but my next question was... you've done a very good job of already showing when maybe Neil or Arun can jump in and maybe give another example. Can you share how automation and AI reduce risk by also freeing up IT and security teams so they can focus on higher value work, right? How does innovation in the workforce help from a cost impact standpoint help? How do we get the folks that work for you working on things that are more valuable to the organization?

NEIL MCGLENNAN  |  19:41–22:38

Yeah, this is something that we see quite a bit when we run identity as a program, not a project. It's something that we continually say because programs have that long term aim, that long term strategic goal. And our projects are very small and contained. So, we want to make sure we have that long-term impact. To do that you have to have efficient use of resources and the other interesting dynamic and variable you have, is that the threat landscape has never really been greater than it is today, right? We're affected by both the volume and velocity of threats, and the volume of IT systems entering.

And so, we kind of see AI as that business enabler, and we can also see it as an identity security enabler as well, right? And that's where I think the two kind of go hand in hand. But they also allow your people to focus. And when you have that large volume of stuff, when you have velocity where you have to be reactive, because some of these things are autonomous, the world is very dynamic. You have a lot of different threats. You're getting hit with everywhere. You need to focus. You don't have time to waste time really, right. You have to get down the brass tacks. You have to find the issues that are most critical to you right then and there.

I was talking to a customer who was considering purchasing Identity Security Cloud. They eventually bought it, and they were saying, 'Look, I don't know what I'm doing. I'm in the dark and I'm just looking for a light switch.’ And the way I kind of describe it is like, well, people think about it. A lot of these AIs provide value to you by allowing you to shine lights in the darkness of where you need to focus. So, if you think about role models. Here's a role that may be a fit for this business because we've identified these people that are all similarly access. You may also find people that are outliers, right?

Here are people who look unlike anyone else. Is that because they're a risk or is that because there's something like a service account or a machine identity or something like that? And so when you do that, you focus on all these things that allow your resources to be freed up and focused on what really matters. We can guide you to what matters. We can also focus you to now say, OK, because I didn't waste time trying to find those things, I can go get down to brass tacks. I can go and accelerate my program. Now, how you choose to use all this extra free time is really up to you.

Some people put that time right back into their investment, their identity security program, right where they can go and mature their program faster. They do more, they onboard more applications and sources; they put more security policies in place. We also see people redirect those efforts. Maybe those efforts from resources were being borrowed from somewhere else that was impacting your core line of business, right? So those are things you can hand right back to the business and say, hey, these guys would be better utilized over here where it's a direct cost center where you can actually make money and where it can help the rest of the business grow and maybe other areas.

MICHAEL YARIO  |  22:51–22:51

That's good.

ARUN KOTHANATH  |  22:53–26:36

That's actually from a technology perspective; you’re spot on. There's so many of these advancements helping. We were trying to find out where innovation leads and what is the real impact when we come down to “How is it helping the workforce?” Is that efficiency? Is that the speed of certain decisions? And then, how does that affect your cost structure? Is that going to save you money? These two always come to mind.  

And so, what we have seen, I started having this conversation probably a few months ago with my peers, the CISO- and CIO-level community. What we see is that there are four distinct areas where the impact of AI, automation, and innovation comes through.  

Number one is visibility. We kind of touched on that a little bit. We are all working with various volumes of data coming from different sources and making it visible to the relevant people. And asking a Gen AI-based system “What is the relevancy of this role?” in plain English versus running a SQL query, that has much more impact on the visibility part of it.  

Number two is the decisioning part of it. You can have speed and accuracy. I mean, you have the signals coming from your state-of-the-art firewalls, identity systems, authentication systems, and MFA. These are all signals that you could put together to make a decision faster. Going back to what Jeff was talking about, you’re coming to that access decision quicker: “Should I or shouldn't I desire access?”

The third one is presentation, which may sound simple, but probably has one of the largest impacts. One of the difficulties we as technologists always face is providing the right artifact for the right audience. CISO presentation material has probably no meaning to a CFO, right?  

So when it comes to AI induced presentation materials and how the artifacts are being created, the level of complexity, the level of detailedness, the level of abstractness, they're all balanced in how you present it. A CFO may be looking for the profitability or ROI statement versus a compliance perspective, which is looking at “Am I going to fail an audit?” Right? So, they're both working from the same data. You should be able to get to the right presentation material.

The fourth one, being probably the easiest to visualize, is automation. If you have visibility, you can make decisions faster, and if you can present it to the right people, you should be able to automate, right? So that fourth one definitely falls into place as well.

So, we try to ask the stakeholders here, “Where do you want to focus?” Do you want to make a decision faster, such as creating a role based on the pattern of access, or do you want to present it to a regulator so that you can speed up your next audit?

So, quantifying that has become much more important. I mean, the innovation has helped and will continue to help. I think it's getting refined every day. Things are getting better every day. You have more creative ideas coming. So, it's one area where we are definitely seeing innovation help quite a bit.

NEIL MCGLENNAN  |  26:42–28:42

And I will say, on some of that, there's a lot of things that people can analyze and go do. I think some of it is also being able to respond to real-world needs that may not be predetermined, right? Somebody may say, “Hey, look, I'm just trying to find this thing that just landed on my desk this morning. I don't know how to do this? Maybe it's beyond my capability,” or things like that.

But being able to have that interaction, oftentimes through agentic interactions. And I think the world's still coming to terms with how we operate with agents.

It feels very command line right now. We'll see how it evolves, right? But being able to ask for those things and get value out of them. We have an agent called Harbor Pilot that we launched earlier this year, and that allows you to even go get reports, dynamic reports based on those insights and things like that, just like you're talking about. And those could be published, but those could be just things that are ad hoc.

You can also ask it to do things like, “Build my workflows.” So, if you say, “Hey look, I need to create a new onboarding process for this type of person that we've never had before. How would I do that?”

And it can automatically do that. And I think extending this even further is that this doesn't operate in a silo, right? Obviously, ServiceNow has a very good platform for AI agents. What we're doing is extending a lot of our Harbor Pilot capabilities as tools inside of MCP servers and things like that. And so, conceivably, those could also be enveloped into things like ServiceNow tools as well.

So, you can imagine, at some point in the future, you'll probably have somebody that goes into ServiceNow. That is their main interface for the business. They're already going there for everything else. But Harbor Pilot is an extension of that, right?

And so it doesn't matter. You don't have to go and pick and choose which agent you talk to. You just talk to the one place and you get what you're looking for, no matter where it may be.

Right now, there's the concept of authorizations and security around that, which is probably a separate conversation altogether. But I think that's another cool area for business enablement in the future.

JEFF GORE  |  28:47–30:27

Yeah, I love this conversation that we're having right now. So, I'm just going to chime in as well. Sorry, Michael, I just want to keep chiming in because we're doing this thing about AI in service of business transformation.

We've outlined some of the key challenges and complexity, whether that's regulatory environments, too many silos, or just the complexity of the overall ecosystem that organizations are working in.

But ultimately, and we can't ignore this, everything we're talking about as it relates to efficiency, speed, and profitability of an organization, this all applies to real-world examples. We're now talking about life sciences organizations delivering drugs to market faster. We're talking about banks, as in the previous example, reducing the number of disputes or fraud taking place within the system and improving profitability. Or we're talking about a healthcare experience.

We're talking about how a better physician experience means nurses and doctors can be credentialed and in front of patients faster, resulting in better quality of care for the patient. But just as importantly, it's profitability for the organization, and there's the undercurrent of the underlying assets and data to support it.

And those assets are important. Clinical devices need to be treated differently. In federal government settings, if your asset is your fleet or your missiles, you can imagine the threat of foreign actors is a very real issue.

And it kind of brings this all to life. And that's exactly what we're talking about here. Super exciting times.

MICHAEL YARIO  |  30:30–31:37

It really is. I feel like we could do a whole webinar just on this particular area of AI. It's obviously changed so much, and it's continuing to change at light speed. Maybe we do another webinar where we talk about AI.

But moving forward, I think it's really important for people to understand, especially people like myself, where real-world use cases and those types of outcomes can be a little more compelling.

So, look, integrating identity security with ITSM enhances organizational operations. I think we all know that, right? It unites security, compliance, and operational efficiency, and results in better risk management, innovation, and cost savings.

But it'd be really good to hear from the folks on the phone here. And I understand that you probably can't talk about these organizations by name, but you can at least talk about the sector. Could you walk us through some real-world examples, and you've done some of that already, where SailPoint and maybe ServiceNow, in collaboration, have been able to deliver measurable improvements in security, efficiency, or compliance?

Who wants to go first?

NEIL MCGLENNAN  |  31:38–35:32

Yeah, well, I can probably jump in here and talk a little bit. I'd say that we've built some very good integrations that our customers love. In fact, I think it's one of the most popular integrations on the ServiceNow marketplace. We see that our customers love working with ServiceNow, they love doing business there, and we love meeting our customers where they are.

When we see our customers using this, a lot of the use cases they drive are, obviously, on the governance side, where we can govern ServiceNow access, provision it, and all that good stuff. I think that's pretty basic.

We've also extended it to be able to launch things like access requests. We call this the service catalog integration. With this integration, people can go into ServiceNow, where they're already getting other things like desks and phones or interacting with the business in a myriad of other ways. We can plug right into that process and say, "Hey, here's the things that you can request," and we're getting live information from our SailPoint systems. That's providing things like recommendations, and the power of AI is woven into that process, right?

And then once that enters SailPoint, we go do the provisioning of it. That's for things that are automated. Right now, not everything is automated, and sometimes that may need to come right back around to ServiceNow. We may be able to coordinate that back to ServiceNow in order to facilitate manual provisioning, setup, or coordination of these things.

Now, those are the out-of-the-box things that we offer, right? Those are all there. Those are all very heavily used. We see customers love them. But we don't actually stop there. The interesting thing is, in our SailPoint platform, we have a very good workflow system, just like ServiceNow, and those can be very complementary.

In fact, we have default steps that will send things to ServiceNow, and ServiceNow can also route things directly to us. So you can see that as kind of stitching identity security and weaving that into the broader business processes. Whether you're starting in ServiceNow or SailPoint doesn't really matter. It's what you're really doing in the grand scheme of things. You can kind of weave this identity-enabled fabric into your business, right? And that's big value. You're working where the customers are.

Some other interesting things that we've heard come up with customers are being able to inject information into ServiceNow workflows where they're actually doing stuff today. Somebody wants to check on the status of something they've submitted, and they're not sure where it is. Wouldn't it be cool to be able to leverage AI in order to summarize where that is? We can call out the SailPoint APIs and summarize, "Hey, by the way, this thing is already in progress. Here's where it is. Here's the current status," and all that stuff.

That way, they're providing, again, a shortcut to a user who may be working a case or checking on something, so they don't have to go find that themselves. That's one less click. It's being delivered to them. That's value directly to them rather than them having to go hunt for it, right?

We've seen other use cases here too, especially as we expand into non-human identities. ServiceNow has great CMDB-type functionality. So we've seen people who will say, "Look, we're already modeling applications in ServiceNow. I want to bring those things into SailPoint because I have this rich catalog, and I want to start organizing my machine accounts, service accounts, and my agents all under that umbrella."

And so, as we continue to evolve, I'm sure agents will be involved there too. Obviously, we get a little bit more forward-looking here, but you can kind of see that the possibilities are really endless.

And the fact that we're both built on very flexible platforms that are, very simply put, standards-based for things like REST APIs and HTTP event triggers, those are fantastic foundations to be able to really weave your own tapestry into your business and deliver value as a result.

MICHAEL YARIO  |  35:54–36:58

That's good. Yeah. I mean, I don't know if anyone else has anything to add to this particular area. But if not, I think we should move into thought leadership because, obviously, in this world of change and all the things that we're doing, you've got a few leaders on this phone alone, right?

I think IT and business leaders have now acknowledged more of the convergence of identity, AI, and service management. It's kind of a key area to securing digital enterprises, right? The integration can enhance resilience, efficiency, and collaboration. But as identity becomes more central to digital transformation, leaders should ensure good governance and create a culture that balances innovation and security and handles new risks.

And so, my question really for the team here is, as you're looking ahead, how should CIOs and CISOs think about the future of identity, AI, and service management working collaboratively? And what's at stake if they don't actually take those concepts and start thinking about them together?

Maybe I'll join.

JEFF GORE  |  37:00–39:48

Yeah, I'll jump in to start. Here at ServiceNow, we have a yearly survey we run. We call it the Enterprise AI Maturity Index, which is really looking at an organization's readiness to adopt AI broadly within their organization.

We were really surprised by this year's study because even though you hear about AI all the time, and it's a critical imperative for organizations to adopt AI in general, our maturity index scores have gone down fairly significantly. And for organizations that are in regulated industries, such as banking and life sciences, they've actually gone down by more than single digits. So, we're talking about a 10 to 11% decrease in the ability for these organizations to respond.

So, you start interrogating that a little bit more, and you start looking at, okay, what are the folks that are leading in this area able to do? We call them pace-setters, but what are these organizations able to do?

One thing that is clear is that if you're in a regulated industry, a challenge to adoption is simply all those regulatory pressures and all of the data certification requirements that you have to perform on things like your LLMs to be able to adopt them. They become the bottleneck. And the fact that data is changing so rapidly and the models are adapting so rapidly, they're going too fast for a data certification process that's internal within that organization and may be subject to regulatory pressures.

They're just not able to keep up. And so we're actually needing to explore things like decreasing the speed of releasing new models, or we have to help customers get more comfortable with their internal data security certification processes, adopting these changes and being quicker at being able to attest to any of the clutter within these models.

I think this speaks nicely to this integration point between identity access, building end-to-end workflows, and what it actually means to manage your entire ecosystem in support of these end-to-end workflows, because that's what a pace-setter is able to do. They're able to build processes and build a culture within their organization that actually allows them to more rapidly adopt these new, cutting-edge technologies.

That's good.

MICHAEL YARIO  |  39:49–39:49

Yeah.

NEIL MCGLENNAN  |  39:50–42:14

One thing that you kind of talked a little bit about there is that data is leaving these applications, right? What we see is that when people want to leverage these new LLMs and these new AIs, those all operate on data. So that data leaves the confines where you had security controls in place and regulatory requirements that you've evolved over the course of time, and you've brought that data out into this new framework.

That new framework is fairly nascent, but it also tends not to be incorporated with those other security controls, right? And so what happens is, by virtue of leveraging some of this new technology, whether you like it or not, you've actually increased your threat landscape, right? You've duplicated it.

The other challenge that we foresee is, because you've duplicated it, how do you keep those things in sync? And more importantly, how do you keep those access controls in sync when you have something over here and something over there?

It also gets more complicated when you start getting into the agent world, right? When we start interacting with this data, you're going to go into a place like ServiceNow and interact and chat with ServiceNow's agents, and those may be leveraging tools on many different systems. This request then gets ping-ponged across the organization, across many different agents.

So how do you ensure that the security and the integrity of your security policies can maintain that whole transaction? It's kind of this wild world where you have this execution flow of all of these agents, right? And they're ping-ponging around. That's a level of security.

But you also know who you're logged into ServiceNow as, right? And what identity you have in identity security. And you kind of know what you should have access to here. If you intersect those two models, that's the path of authorization. It's a very interesting way of looking at, "Hey, here's how we can really help secure this path."

And I think that we have to look at it a little bit that way too. We want to make sure that we're providing the latest and greatest tools and value to the business. We also want to make sure that we're doing so in a way that still aligns with their security policies and doesn't make us less secure, even though we're expanding that threat landscape. We want to do so in a thoughtful way.

ARUN KOTHANATH  |  42:18–43:26

I’ll just quickly add to that. While we talk, every tool is going to bring in some AI-capable refinement technology, whatever that is. But one thing my team, specifically my advisory team, keeps telling CISOs is: are you aligning to your organizational policy, organizational standard, or outcome? Right? You start from there because, ultimately, we tell them that AI should work for you, not the other way around. So that’s one of the things we keep talking to them about.

I agree with both of you. And while exploring the impact and benefits of AI systems, we also try to remind them that these systems are not cheap. They do require a considerable amount of data aggregation, making sure that the data, like Neil mentioned, is reliable. That takes time, energy, and money. So those things can add up.

So, does it really align with the organizational outcome they’re trying to achieve? Just to kind of top off what both of you said. All good thoughts.

MICHAEL YARIO  |  43:34–43:56

So, look, we're coming towards the end of our webinar, and I've just got one last question to ask the group. As identity becomes more central to the digital enterprise, how do you see the roles of CIOs, CISOs, and business leaders evolving to drive cross-functional governance?

If you want to start, Arun.

ARUN KOTHANATH  |  44:06–46:22

Sure. So, I think the biggest value is, I mean, we all know that everybody now is going to work from the same set of data lakes. Data lakes make it happen.

Microsoft wants everything dumped into the Azure lake, or wherever. Snowflake wants everything within Snowflake. So, data lakes are your new place where you're going to look for data.

I come from data warehousing-type scenarios where it's the same concept, but now the volume of data coming in, whether it's ITSM, firewall logs, audit logs, IGA systems, or authentications, everything is going to the database. That volume typically leads to latency, right? So your system has to catch up with those things on demand because these decisioning systems need data on demand.

So this is kind of where the CIO and CISO roles become very critical, because the task is now making that data in the data lake available to the right people. The basic principle of who has access to what becomes really critical. You do not want to have PII data available to a technical engineer just because that data is available in the data lake.

So the CIO and CISO roles are morphing into, how do you secure that and ensure who has access to what, right? That is made possible through identity. You need to know who. That's the first thing, right?

So think about a scenario where, I think I was watching a Microsoft webinar earlier in the month, they talked about the concept of a digital employee. I think IBM put forward that one as well.

So this digital employee, physically non-existing, has an email, has a social media presence, has a chat session going on. Now, what is the privilege that digital employee has? That becomes a security question. That becomes a governance question. That becomes a compliance question, right?

So the CIO and CISO now have to morph into the overlapping of data and how that can be governed.

Yeah. And I do see that, to that end, you end up seeing data officers involved in this equation now too because of that, right?

NEIL MCGLENNAN  |  46:32–49:04

Because that is now leaving, you kind of see these board-level imperatives, right? We have the CFO, who's usually been in charge of governance because it typically comes up through there. You have the CISO, who is in charge of information security, and they set security policy. But more and more, they're using a lot of systems, and sometimes those systems aren't ones they're adept at running. That's more in the CIO's camp, right?

And so, we have been seeing even buying patterns shift a little bit from the CISOs and CFOs to the CIO, who makes more strategic buys, right? And I've been asking, why is this?

Some of it is this fragmentation of the world that we live in, right? Some of that is due to things like, well, not only have we talked a bit about data leaving applications, but we've also talked about a plethora of different solutions. There's shadow IT and things like that, and we're starting to see shadow AI now, where people are running AIs themselves because they have the ability.

And so, you're starting to see these kinds of shadow activities. There can also be smaller point solutions that people buy, but they're not bought with the greater good in mind, right?

The world's gotten very fragmented. And so, when we talk to a lot of cybersecurity execs, one of the things that really resonates with them is, "Dude, I've got way too many tools in the toolbox, but none of those things can talk to each other, right? Everything's siloed, and I want to knock down those silos."

And this has driven innovation. You look at initiatives like the Shared Signals Framework, where everyone talks in different protocols, but they can all work together. That really helps. But I think, at the end of the day, it's all a business imperative, right?

So, we have to make sure that all of our tools integrate with that broader ecosystem. Kind of back to your ServiceNow example, right? Make sure that we're integrating there. But also make sure that, look, it's not just the CISO's job. You may be ultimately responsible for implementing and executing security policy, but it's the business's job to make sure that policy sticks, right?

And we've got to make sure that we're accountable. Make sure the CFO doesn't lose their job and the board gets all their questions answered. Make sure that the data is in the right spot. Your data protection officers are all watching their policies as well.

So, in summary, it kind of takes a village, and that village is the business, right?

Yeah, 100%.

JEFF GORE  |  49:05–49:53

And I’ll just say my closing thoughts, and then our last question. One of the key themes here is trust. We at ServiceNow have this mantra that we repeat quite often in our all-hands team meetings, which is that trust is earned in drops, and trust is lost in buckets.

And for a CIO to be the trusted leader of the business, to bring the promise of AI forward, to actually leverage all of the data within the various systems of record and drive action across the enterprise with end-to-end workflows, to be that trusted leader and drive business transformation, it means having a strong posture of operational resilience, security, and risk.

Those disciplines are really the corporate imperative.

MICHAEL YARIO  |  49:59–50:33

No, well said. Well said.

Well, this concludes the webinar. I want to tell everybody I really appreciate their time on this. It was really good. I’d love to do another one, to be totally candid with you.

I get the best job, right? Because I just get to sit here and point the direction, listen to three really smart people, and I get to walk out of the room and plagiarize everything you said and act like I’m really smart. So, I appreciate it.

I kid, but I’m being a bit honest as well. So, thank you guys very much. This was excellent, and I look forward to seeing you all again. Hopefully, everyone who listens gets a lot of value out of this.

I sure did.

JEFF GORE  |  50:35–50:36

Excellent. Well, thanks for having me. This is great.

PANELIST  |  50:38–50:38

Thanks guys.