Protocols, Payloads, Policies, Oh My! : How can Enterprise Customers Make Better Decisions?

So body clock is running six hours behind, but I'm fully caffeinated, so glad to be here. Thank you.

Protocols, payloads and policies, making these type of decisions at the enterprise level is really, really challenging. And I speak for a large enterprise that that is the same as many of you who are in this room and are on this journey the same as we are. These decisions are really, really important because our choices impact not just us as an enterprise, but also our partners and our customers. And the consequences of making the rowing CHO choices means that we all lose whether, whether that loss is measured in precious time, opportunity or treasure.

So in this world of decentralized identity, new protocols, new standards, the question that we as an enterprise are asking is how do you decide? How do you decide? How do we decide? Because the the, the choices that we make are really important for an enterprise. And just to set a little bit of context, this is my enterprise. The business units of my enterprise have a variety of very important functions that have a national impact as well as a global touchpoint.

And because technology is used by us in order to implement a lot of these capabilities, the choices that we make with those technologies have consequences that if we don't make them correctly, that can lead to very bad outcomes. So that tends to almost be paralyzing when we are going through the decision making process. My home within the organization is a science and technology directorate. It has two primary functions.

One of them is find the technology and the talent in order to solve our problems, but of particular relevance to this discussion, we are also the science advisor to our organization providing unbiased advice on not just what technologies but how best to use them. And that becomes really, really important because unfortunately research has proven that we as humans are not that great at making decisions and choices. We are overconfident, we fall victim to confirmation bias, we are distracted by ego, emotion, fear of missing out.

These are all things that stand in a way of us making a decision, a good decision, but it doesn't really have to be that way. So what I wanted to walk you through today is a simple four step process for how to make decisions, technical decisions that are designed to contract irrational behavior and biases. And I wanted to do that through the lens of how we are applying this to the world of decentralized identity. The first step in any such process is simply to have more options. Sounds simple for us.

We are one of the few organizations within the US government that believes that talent doesn't stop at borders. That you need to go out globally in order to find the talent and the technology in order to solve the problems. And we put our money where our mouth is and we invest in companies not just from the US but across the globe. Unfortunately, that is not enough because tech bros exist not just in Boston but in also in Berlin. So the ability to get perspectives that are diverse is also important.

We are fortunate in that close to 40% of the companies that are working with us tend to be founded by minority and female founders. Going one level deeper, we have 13 companies that are focused directly on the decentralized identity space. More than half of them are from outside the us. Now you get access to great talent globally, but if you don't use them, you're not going to be well served. And one of the things that we do, and one of the things that I hope you will do as well is to ensure that you multi-track, you fund multiple companies simultaneously to solve the same problem.

Because that diversity of opinions and diversity of viewpoints and the diversity of jurisdictions that you are drawing your companies and the technologies from has a very, very important component. It gives you a viewpoint that is not locked to the echo chamber of one jurisdiction, one technology stack, one vendor from one area. And if you are an enterprise, you know that often what ends up happening is that you hear what the vendors think that you want to hear rather than what you need to hear.

By having this diverse pool of entities that are working for you, who actually sometimes do not agree, gives you a perspective that is global, that is diverse, that you, that allows you as an enterprise in order to triangulate on an answer that makes sense for you, test your assumptions. If you are in this position, just like the Trojans, you are going to be getting a lot of gifts. We know what you need.

No, they don't, but they think we know what you need. My favorite one is particularly within this context that the Europeans are doing the digital identity wallet. You should be doing that too. Different context, different regulations, different ecosystem so we can have a conversation about what matters and what translates we meet your compliance requirements. That's great. Not enough, much more is needed. Last but not least, we support standards. Wonderful. Is there any special source that you sort of, you know, add to those standards in order to make it easier for you? Let's talk about that.

So it is really, really important that in this era you need a mechanism that you test verify and then perhaps trust. We go through a four phase process. Phase one is just like people with beautiful resumes who cannot do the job. There are companies with beautiful pitches who cannot ship orthodon. So can the company walk the talk in phase one? Phase two tends to be build out the technology fully. Show us what you can do to solve the problem. Phase three, I throw an independent red team at them, full evaluation of their security privacy interoperably functionality.

No more taking on faith that I support this, I support this down to the earth verification. If need be down to the code level. Then only then do we give them an opportunity to deploy this net capability in an operational setting. In a test setting to show that basically these things can actually work in progress in practice, in real operational employ. In real operational deployment, what is important is that I talked about basically funding multiple companies. We fund them through all four of these phases.

We pay them in order to do them and by the time you get to the end of phase four, all four companies have products that are mature that are solving a need, which means that we now have the ability to make a rational, thoughtful decision on what technology to actually acquire. We do not pay upfront in order to acquire the technology. We verify before we make the actual decision of acquisition and bringing it in. The third step is give yourself some breathing room.

What I mean by that is everybody here who's gone through some manner of tech technical evaluations have some sort of a model of, you know, some phasing. I talked about our four phases, but what I've often seen is people thinking that the, because you have phases, the goal is to get to the end of the phase as quickly as possible. Give yourself breathing room, give yourself time to react and learn. Give yourself time to course correct, give yourself the ability and the willingness to sort of not fall victim to what's going on outside.

In order to, in order to have the time and the, you know, focus in order to see what is going on. This is very, very important. And as you are going through this process, you are going to be hammered from all sides. You're going to be told you need to do it this way. You need to choose that. When are you going to give us this? You're going to get a lot of incoming on this. And what is important for you is to make sure that you have a set of core principles that you are grounded in that only if they're all met will you actually be able to move forward.

For us, these are our core principles that need to be met for our credential issuance and our credential verification. The decentralized identity world, some of them are very familiar to the people in the technical community should not be a surprise. Equity is important.

You know, digital is not a requirement. It is an option. We want to be, we want to be equitable. The right to paper is still there. A lot of people are comfortable with that go to town. We want to basically provide that service. I think I'll touch on the last one because I'm sure that you can read faster than I can talk. I think beyond just the technical aspects of it, there is a centralization of power within companies within ecosystems. Currently for us, we've been walked into a corner in the past and told this is the only option that you have.

One of the things that we are doing differently this time in is ensuring that there is a true vibrant, competitive ecosystem of standards-based services, so that we have choices in the marketplace and we have ability to sort of mix and match technology stacks for how we do the business. I would urge you to come up with your own core principles in how you sort of go down this journey as well.

And last but not least, even with all of that prepared to be wrong, the history of our industry is that every single time there has been a step change, somebody has come up with a new way of moving things from point A to point B, right? New protocols. And I would argue that in our decentralized identity world, the conversation around protocol choices is a very active one. It is a swirling whirlpool, a doom conversation in many contexts. And every single organization or entity that is sort of championing one set of protocols believes that they are the one ring that will bind them all right?

That has never happened in our industry and I don't think it's going to happen this time either. So it is important for you as an enterprise to embrace that rather than disregard that.

For us, the way that we've embraced that is very simple. We've embraced a philosophy of and not, or the picture up there, it's a train called the Golden Pass Express in Switzerland. It's a train that is 150 years in the making. If you are a trained fanatic like I am, this is pretty awesome.

It is a train that at speed can dynamically change the width of its wheels from standard gauge to narrow gauge and raise and lower the platform height because the platforms that are different heights, a physical manifestation of the philosophy of and not or so for you, I would absolutely urge you because you need to serve, especially if you need to serve a diverse set of cost customers, you need to have a mindset that embraces that diversity and embraces the choice and recognizes that your customers and your counterparties may make different choices than you do you do.

And for us particularly as a private public institution that does not have the luxury of pivoting into not serving an unprofitable, you know, segment of the population, we need to serve everybody a philosophy of and not, or is critical decisions here do not need to be complex, but they do need to incorporate these four critical elements. Ensure that you have options and take advantage of them.

Test, verify, then think about trusting and have a process for doing so, including independent validation of the technologies using your own internal red teams or it's equivalent. Give yourself time to breathe course correct change for us. One of the one point that I will mess, you know, note with this last one here is if we had not given ourselves the time to do so, when we started this journey back in 2018, we expected the issuer wallet and the verifier ecosystem to move in tandem, everybody maturing at the same level.

It did not happen because we gave ourselves that time in order to see that some parts were lagging. We were able to put additional resources in order to sort of help the wallet and the verifier ecosystem beyond just the issuance piece. And last but not least, even with all of that, even with all of your preparation, you can make a wrong choice. So prepare to be wrong and have a plan B. What I hope that you will do with what you heard from me today is follow Bruce Lee's advice, absorb what is useful, discard what is not add what is uniquely your own.

Because it is really, really, really important that you have a independent way of assessing and evaluating these technologies before you make the choice to go down one path or the other for your enterprise. Because if you do, you'll end up in a place where you are not paralyzed, you are not second guessing your decisions, and you are capable of delivering services and capabilities that serve the needs of your enterprise, your stakeholders, and your customers. Everybody wins. And with that, ladies and gentlemen, that's a wrap for me. Thank you.

Thank you Al for a a, a really brilliant pre presentation. I really like the philosophy of, and I think we could all deploy that very much in our own lives, in our own professional careers. I also like be prepared to fail and have a plan B, which it's also very good. One question I have for you here is what strategies do you employ to mitigate bias and overconfidence in decision making processes, especially when evaluating different technology vendors?

So it is really, really important for you to ensure that first of all, that you actually get the diverse perspectives from different vendors and you don't just have already made up your mind internally. So the ensuring that you have a mechanism to consume it, having an internal competency in order to evaluate what you're being told such that you can actually triangulate on a good decision is important. So I don't want you to blindly take on faith what is incoming from the vendors.

You actually have to ensure that you have the internal competency in order to evaluate what is coming in through the filter of what your enterprise needs. Fantastic. Thank you very much once again for Anna John.