Passwordless authentication

So we can start blocking and adding more friction there.

Passwordless capabilities are starting to be something that's bubbling up to the top.

Continuous pen testing is coming up to the top.

We're seeing a lot of those capabilities.

I mean, pa- partially it's apathy.

[chuckles] Um, but I think, um, I, I think, you know, we have to provide people with the carrot approach more than the stick approach, uh, in order to drive passwordless adoption.

So one of the things that HYPR has done, for example, is we have our MFA authenticator app here, right? But one of the things I can do in this app is I can also manage and supervise all my agents, right? So now if I give you, Jim, the option to, um, use passwordless as an employee at your company, you may or may not take me up on it.

But if I also tell you, "Hey, you can see what your agents are doing on your phone, you can supervise them from your phone, and you can like, you know, talk to them on your phone or whatever else." Like that may get you to, to jump in, right? And so how do we make our MFA apps, uh, something that people want to use instead of something that they seem, uh, they see as a hindrance to their productivity? Um, because ultimately, like whether it's passwords or MFA or Fido or whatever else, like these are security controls that exist out of necessity, right? People would much more prefer to just sit down at their computer and just not have to do anything, [chuckles] right? Um, so, so I think, I think what's getting in the way is we, we, we as an industry haven't done a good enough job of making it, of, of, of making passwordless and MFA something that people want to do and something that actually makes their life much, much easier.

Mm.

If, if you invest in PAM, IGA, MFA, passwordless, you want to see that, you know, you want to see that add some value before you then consider change.

Well, I, I have so many questions around that.

Um, so sorry for, like, the, uh, choose one thing that I'm going to ask, right? But-

Well, we should be in that category because there is budget there, and if you talk about-

Yeah

... um, passwordless or you talk about IGA, you know it's a well-known, well-defined area.

Now, I think what we're typically getting towards now is it's quite easy to add capabilities to existing platforms, be they vendor platforms like yourself, or be that stuff you've built internally within an organization.

Seen it happen.

Passwordless is not phishing resistant.

Authenticator phone sign-in is not a passkey.

Check the sign-in logs.