I know Jim wants to talk about Hugging Face, but I want to ask you just kind of one question around this idea of AI agents, and maybe for people who haven't gotten, you know, neck deep [chuckles] or deeper into this sort of world, how would you-- If someone says, "Okay, what's the difference between an AI agent and, like, a service account or some other sort of traditional things that have defined permissions versus what an AI might have?" How do you, you know, make that g- I guess, make that case or make that argument or the explanation to people who are struggling to understand what the difference is?

Yeah, I think the, the most simplistic way I sort of think about the difference between humans, applications, agents, and agentic workloads is really, uh, there's two dimensions.

One is, uh, trustworthiness and then determinism.

And so, uh, if you look at determinism, uh, you know, there's two dimensions to that, non-deterministic and deterministic.

And if you look at, let's just pick on humans for a second.

Humans are non-deterministic, but I would argue generally trustworthy, meaning we all have reputations.

We don't want to get fired.

[laughs]

Okay, and do you think, um, agentic AI security equals NHI security?

Um, not necessarily.

I, I mean, look, NHI is kind of one of these terms that, um, means different things to different people, and you probably get five different, uh, definitions of it depending on who you ask.

You know, some people, when you talk to them about NHI, they think service accounts.

Some people, when you talk to them about NHI, they think keys and tokens and API keys.

Um, but I think, uh, agentic identity really is i- its own, um, set of identity problems from kind of, you know, delegated authorization on behalf of a user for personal productivity agents.

Um, you know, SaaS or infrastructure enterprise agents really have their own kind of service account and, um, like standalone identity th- uh, upon which you need to, like, authorize their activity and authenticate them.

Now, do you think AI agents behave more like employees or software, to your earlier point?

Okay, so look, uh, we're now gonna be talking about, you know, the, the main focus in this podcast, right, which is identity is the third generation of security, right? So when we talk about that, like, you know, what were the first two generations? What defined them, and why have they now reached their limits, uh, and now s- being surpassed by identity as the third generation of security? Do you wanna share a center?

Yeah, the first gen- yeah, the first generation I think of is very much was network-centric security.

Um, and that was because of the traditional kind of corporate IT infrastructure was very on-prem focused.

You know, people, uh, came into the office every day.

Everyone was in the office.

There was, um, a network infrastructure that surrounded the digital enterprise and kept the bad guys out and kept the resources in, and we layered a lot of technologies into the network.

Um, DLP, egress firewall, um, uh, you know, um, subnets to be able to restrict access to different applications.

What are you doing at C1? What are some of the capabilities that you're building into your, your platform?

Tell me more about this rise of the agentic enterprise that we're seeing.

Yeah, I mean, I think we've gone through and, w- well, we've done...

We've gone through the agentic transformation ourselves at C1.

We've built a cloud-based software factory.

We have a platform for hosting internal Vibe Coded applications.

Uh, we encourage our team to use AI tools.

We use our own products internally to enable our team to adopt AI MCPs, uh, and tools and automate, um, you know, manual processes.

Yeah

So how do our underlying access architectures have to evolve to verify trust in a world where, frankly, seeing is just no longer believing, isn't it?

Yeah, I remember a year ago, there was multiple examples of I think it was people deep faking CEOs and board members and trying to get financial transactions made and things like that.

So I think there's different, I would say, classes of deep fake type attacks.

There's more of your broad based social engineering type attacks.

And I think one of the impacts of AI on that is it AI is able to do that at scale and in a very targeted way.

I think we're going to see a lot of asymmetry happening in those types of attacks.

And then the second category is much more of your targeted attack where you're trying to deep fake the CEO calling the CFO asking for a immediate wire transfer to pay for something.

I'm just wondering as well, sitting here, do you see a future where AI predicts access needs and then revokes them based on anomalies or when the need for that access is simply gone before the human even notices?

So how do our underlying access architectures have to evolve to verify trust in a world where, frankly, seeing is just no longer believing, isn't it?

Yeah, I remember a year ago, there was multiple examples of I think it was people deep faking CEOs and board members and trying to get financial transactions made and things like that.

So I think there's different, I would say, classes of deep fake type attacks.

There's more of your broad based social engineering type attacks.

And I think one of the impacts of AI on that is it AI is able to do that at scale and in a very targeted way.

I think we're going to see a lot of asymmetry happening in those types of attacks.

And then the second category is much more of your targeted attack where you're trying to deep fake the CEO calling the CFO asking for a immediate wire transfer to pay for something.

I'm just wondering as well, sitting here, do you see a future where AI predicts access needs and then revokes them based on anomalies or when the need for that access is simply gone before the human even notices?