Martin Kuppinger: Interview with Simon Moffatt

I'd like to start with something, which you already touched answering that question just a few seconds ago, which was about this onboarding process. And so, so what I also see, I would say in daily life is that a lot of what is happening in, in consumer identity still is not really user friendly. And so what's this question about shouldn't we be able to use, EITs probably just far more to use when we look at trends around decentralized identities and, and other things.

But once think thinking I have is I think that still a lot of people don't understand well enough that the authenticator such as you procure my phone or whatever, and the, the ID and the identity provider and the customer record, etcetera, etcetera, these are all different things. So you don't need to own the entire range from, from the authenticator to, to your customer record. So what is your perspective on that?

That's, that's a really good question. I think there were definitely two parts to this. I think one is the delivery mechanism. And by that, I mean to expand on your point around the authenticated device versus where the information's coming from versus how that information is being used, they don't all need to be the same.

First of all, I think things like government identities and, and, and the situations where there is a requirement to provide identity information in the UK, for example, we can leverage different identity providers to, to sign up for your tax management and things like this. I think there's definitely, there's a subtle difference between having to do something and signing up to an identity provider through choice in, in the C space. And I think in the science space currently, the vast majority of interactions are through choice.

So by that, I mean, making purchases, doing something that benefits me instead of necessarily being a requirement where you, you have to go and do something, But by time, the choice seems to end at, oh, your choice is that you purchase something at whatever a, B or C, but once you decide to purchase something there, the choice ends the choice it end ends because you have to register yourself always in the same really outdated manner. And I think that is, that is one of the challenges.

So, so can, can modern modern implementations help in, in getting better on that? I, I think so. I think we we've seen some trends the last couple of years leveraging these concepts called smart profiling or progressive profiling where the registration process is very staggered.

You know, the service provider is only collecting information as, and when they need it, you know, we've all seen this situation where you have a huge registration form and you're having to provide information by hand. Even if you leverage a third party to do that, there's this huge initial onboarding of collection. Whereas I think today it may well be more staggered and incremental. Perhaps the initial interaction is an email address. Maybe if you then look, insurance is a good example to get the quote for the car insurance.

You may have to provide a whole host of information about yourself, your location, your car, et cetera, but you may not need to provide that on the first initial interaction. You may be able to provide that information over a period of time, over a period of, of looking at different resources or with the different pages within that web website, for example. So service providers do get a bit savvy if, if altering, when they collect things, I think, But, but I believe what's still a lot is, is the openness regarding different types of IDs.

So I I'd like to reuse stuff and, and so registering again and again, E even if it's maybe done better, it, it's more dealing with the symptom than dealing with the cause the causes I'd dare to say that, that you don't support external IDs. Yeah, I think so. I think again, though, the, the end user wants choice. I certainly agree if you have an identity provider. I have one of the UK, my post office, for example, I'd love to use that everywhere, but I think it becomes to a critical mass where the, the end user has to decide essentially which identity provider they want to, to leverage.

And it may not be, you may not settle on just one. You may have a multitude of different identity providers based on the information that you want to share to whom. So I certainly think choice is important. I think from a service provider, they need to be able to pick a selection of identity providers that they want to integrate with, which in turn will give different levels of assurance. They'll provide different pieces of information at different times, but it's a very difficult topic.

Cause I think soon as you start to control the end user too much, I think that's when you, you will instantly see a, a huge disparity in which identity providers get, get chosen, but by association you want what? You won't get the critical mass. Yeah.

But when we then go back to the consumer identity management and identity fabric theme theme, that I, I would dare to say that if we do it right, if we build it identity fabric and constructed architect it the right way, then we should have the readiness in serving all these use cases because we have this modular infrastructure because we can use different types of federating, someone in authenticating, even if something totally new pops up, we should be ready to integrate us. Or what is your perspective on that? I absolutely, I could not agree more. Yeah.

I think the modularity is actually more important because not only does it allow you to swap and, and rotate components without huge costs do as a business, as usual activity, but even as Analyst and vendors, we don't really know what the future looks like in the next 2, 3, 5 years. We can make educated guests of cost, but to have modularity is fantastic. Cause it allows you whether it's based on standards or whether it's based on plugin points for extensions, it provides the ability to respond.

And 12, 14 months ago, nobody had any idea, the pandemic would have the impact it has. And I think the businesses that have been the most successful have been the ones who can respond to change the fastest. And I think that comes to When consumer identity.

So, so the identity fabric concept I, I talk about is goes well beyond the consumer. And, and I, I could argue consumer identity management doesn't really exist anymore.

And, and I give you two points on that. The one is that in many implementations, I see it's not only about the consumer and the customers, which are different things, but also for instance, partners. So you frequently have also complex partner relationships with relationships, with other types of identities and last or least there, there do things and the devices.

So in, in some way, what you do here is from my perspective, far bigger and for, for a ton of different identities, I think you're right. I think there's, there's two things which I, I like to, to investigate a little bit more and that that's the, you verify the input. So that's the, the generic input from an identity perspective and absolutely right.

You know, an employment, an employee these days looks very, very similar to a consumer. They work from home. They want shopping cart experiences for application access and access governance and certifications, device integrations are all over the place, whether it's mobile, whether it's IOT, I was doing some research a couple weeks ago about drawn based security. You applying identities to drones and you have a fleet of drones that you to manage. That's still an identity lifecycle. So you need to be generic on the inputs.

And then clearly what you integrate with the downstream systems ends up being highly generic as well. So it's back to that sort of modularity concept where you have integrations that modular at the front, the identity types and the use cases, and the integrations downstream is very modular as well. I think move ahead three or four years, I think the identity fabric concept, you could even be applying this to data as well.

You know, identity of data is a, is a, is a first principle. So I think the being generic, having a set of principles for the fabric I think is, is very important. Yeah.

And, and I also think that is really the point that you need to build something which, which helps you in dealing with all these business use cases goes back to, to my keynote where I said, you know, when, when I look at the old days of identity management, we talked about administrative stuff, but today it's really about business enablement. And as you said, I think the past 12 months has have proven that agility and, and flexibility and, and, and being fast and rapid in, in creating and adapting new digital services essential to succeed in the business.

And I think this is really where, where we need that foundation, because at the end, it's, I would dare to say it's important having a foundation, which allows us to construct all these things for the, the rapid evolution of our business. I that's true. Yeah. I like to think of it as, as being the electrical wiring in, in the house, really in the property.

It's, it's so fundamental. It's so embed into everything you do in the property, and you're plugging in different devices and, and KES and all the rest, but the fabric is really it's that electrical wiring, and it's allowing you to integrate and develop and respond to change.

And, and I think the pandemic's a huge example of that, you know, to be successful in business, it's your employees, it's your consumers, they're the two things really, which are gonna be ever present in, regardless of what you offer, what your service offering is or what you are trying to develop consumers and employees, and you, if you can empower your employees and you can engage your customers, I think that is a huge way to, to responding to change and, and being successful. Yeah.

And it's interesting, I, a while ago, had an interesting question, for example, who said, so, so which meaning of fabric are you using? Is it the fabric in the sense of fabrication or is it a fabric in the sense of something which is involved in the sense of a mesh and, and I thought about it and I, I think it's, it's both.

So, so it provides, it delivers it produces the services, but it also provides this, this mesh, this connectivity, the wiring, so to speak, you need to, to, to deliver to the business. Yeah.

I, I think that's right. I think that's right. I think I'm more inclined to, to focus on, on that mesh aspect so that the tentacles of identity really reaching all parts of the business. I think my only concern with fabric, I mean, the sense of fabrication or a factory is it's, it's a lack of integration. It's like something goes in and then you just get something produced at the output. I think thinking maybe today identity is much more dynamic. It has much more relevance, I think, than, than just releasing services. Yeah.

But, but you also could argue that a modern fabric is, is able to, to produce a lot of different things and changed it very rapidly. So I think both, both interpretations work quite well in that, but, but I think we, we fully agree on the essential thing is that you're able to serve new requirements in a very flexible manner, that you can deal with different types of identities with different types of authentics connect to a huge range of systems, etcetera. Otherwise you will not be able to succeed with your consumer identity management approach.

So, so my, my as essence or my Quin sense would be without the identity fabric will not be flexible enough in what you do in consumer identity management. But do you agree?

I, I do agree and I think it just apply to employees as well. I think you need to be modular. I think it's, it's very difficult to predict the future.

We all, we all try to do this. I think it's, it's very important to attempt to, to try and roadmap, you know, which applications in the employee life space do you want to migrate and integrate for next two or three years from a consumer perspective, as you say, which authenticators, which authentication modalities do you want to encourage, which applications do you want to integrate? You need to have a roadmap and you need to be able to adapt.

You know, we talk about authentication quite a lot. You know, what's the most cool authenticator this week. And it is literally this week because I know next week there'll be a brand new authenticator for ear prints or something, and you need to be able to respond to that stuff. Yeah.

And, and I think that that's where we don't know what is the, the high device it's two or three years from now. We, we, we don't have a clue about that.

And I, I think the other point, and I think this is what you already bring up also again, back to the last 12 months, it has shown that the way we, we work as, as employees is fundamentally changing and the more flexible we are, I think it's very a hundred percent right. The better is. So I think we, we are already close at the end of the time of our conversation. And maybe let's ask any whether there are questions from the audience.