Why Non-Human Identity Security Is Cybersecurity's New Front Line | Keith Hollender

Russ Fordyce (00:01): Welcome back to the Winner Circle, everybody. Today I am here with Keith from Arkova. They are the latest Fortress Cybersecurity Award winner, and he is on the front lines of keeping us protected from AI. He has been evolving this company for quite a long time. Keith, welcome to the show and congratulations on all the success. Keith Hollender (00:18): Thanks for having me and thank you on the award as well. Russ Fordyce (00:21): Before we get into all this this new cybersecurity and AI threats and everything that you're seeing, give us a little bit of background on Arcova and kind of your journey to Arcova. Keith Hollender (00:32): Yeah, it's an interesting story. We started out as a cybersecurity practice within Morgan Franklin Consultant, build that out as a independent independent business within Morgan Franklin as Morgan Franklin Cyber. and about eighteen months ago, we executed a management buyout that was private equity backed by MC Partners to become an in independent standalone company, which is where we are today. And we've been continuing to grow and build behind that momentum. and really the thesis behind our business is many of us have been practitioners, we've been in the field, we've worked at at companies, we've been buyers and had that experience before. And really taking a lot of those lessons learned and some of those challenging buying experiences that we have and trying to solve those problems for our client and make it easier to engage, right? We want to be a trusted partner, somebody they can rely on to execute and deliver what needs to be done so that, you know, ultimately they have the results that they want and we become a great partner in that process. Russ Fordyce (01:33): Well, it's interesting you say that 'cause you spent a career on the kind of client side of cybersecurity inside, you know, I think you were in a fortune financial institution, kind of big financial institution before you kind of co founded Arcovia. What did you see inside of that large enterprise security that, you know, or that organization that made you want to build a firm that was kinda on the other side of the table? Keith Hollender (01:54): Yeah, so yeah, I I worked at a lot of the large financial institutions throughout most of my career. And as buyers in that space, we saw the opportunity, right? So there was a lot of a lot of buying going on with partners in the space and as as we were working through that, we were learning about the things that that were challenges in that process, right? Whether it be Working with extremely large organizations that have a lot of bureaucracy that trickles its way into the client buying experience, whether it be things like dealing with constant change orders for small changes in projects and things like that. And so, as buyers, those were things we would go out to industry conferences or events and we would talk about them. And coming over to Arcova, right, the whole idea was. How do how do we do this a little bit better? How do we solve these kind of challenges for our clients? We want to be there to execute. We've we've been practitioners. We understand the pressure of being in the seat, but how do we make the buying experience more nimble, flexible, allow our clients to pivot, right? And that really is where we where we built our foundation is around that flexibility and listening to our client problems and not trying to sell them something that they didn't ask for, but focus on. Delivering what they need. Russ Fordyce (03:20): It's interesting you say that because I've seen that a lot in my sales career and in in sellers of kind of actually it's more almost implementers. When they go in to implement a project, it's what is the process? Let me get it done. And it's it's almost like the client is the problem. You know? And and it sounds like you're you're taking the opposite side, which is, you know, expect change orders, expect change. You're there to solve problems, and that's really what it's about. you've been through this massive kind of change yourself over the last year, eighteen months where I think you went through the divestiture, an acquisition, an AI practice launch, and then a full rebrand. which of those changes felt like the biggest gamble at the time? Keith Hollender (04:02): I I'm I tend to be a little bit risk averse. I don't like to I wouldn't say gamble, but certainly every step in that process created a lot of excitement. So executing on the management buyout and partnering up with our private equity partner through that process, I think that was a major milestone and it was a major transition in how we operate, right? We can make independent decisions, we can do what's best for the business and ultimately trickle down to what's best for our clients in that process. And so I think the client experience was elevated through that process. And I think it really set the foundation for us to do everything else to grow, to make the acquisitions, to do the launch of the AI practice, which is now sort of incorporated into what we do day to day, and, you know, continue to build. And then ultimately the brand changed from Morgan Franklin cyber to Arcova, which was a few months ago, and just build on that momentum. So you know, I I think they were all really exciting moments, but I do think the the management b private equity back management buyout was really sort of a catalyst event. Russ Fordyce (05:14): Yeah. When when you go into an enterprise or they call you in, what's the actual problem they think they have and how often do you find a problem that, you know, is a lot different than what they expected? Keith Hollender (05:25): Well it's interesting, I I think that's evolving. We tend to work with l large enterprise clients. and typically those buyers are fairly sophisticated. more often than not, they understand their problems. more often than not, they're either looking for advisory on how to fix that problem. Sometimes they they have a great concept of what needs to be fixed and maybe what the end state looks like, but bridging that gap. and then a lot of times too, they need somebody who understands to how to get their hands dirty and actually execute on that idea. Right. And so I think that that's really, really where we shine and that's really where we try to kind of be a little bit different for our clients. Russ Fordyce (06:12): Well, AI is all over the boardroom. I imagine it's all over your clients' rooms and boardrooms too. The it's changing both sides of the equation. It's how attackers operate and how we have to defend those attacks. Without naming s kind of specific in incidents, how has that shifted your kind of engagements with enterprises? What are they asking for this year versus kind of two years ago? Keith Hollender (06:33): Yeah, absolutely. I I think clients are looking for right now it's a lot of focus on efficiency with AI. Like how do we how do we get more out of AI? I think that will continue to involve. We've seen these, we've seen these things right way with the big transition to cloud. I think there was a lot of like it mainly being focused on efficiency in the beginning and and then it became about how to operate differently and how can we be more nimble and how can we, you know Change the way we operate. And I think AI is going through a similar evolution right now. We're seeing a need for us to work faster, a need for us to have AI integrated into our solutioning. I think the software focus, at least what we've seen, the software focus is starting to shrink a little bit, and people are looking at more what's the holistic end-to-end service that you get from that solution. And so yeah, we feel really well positioned to to help our clients through that and and and build around that. But I think AI is fundamentally shifting the way people look at solutioning problems in in really industry everywhere. And AI is not a technology problem, it is integrated into the operating model of every business, right from sales to back office to you know technology and and everything. So really is a fundamental shift in the way we we execute on business. I mean, in some ways similar to how computers were integrated into the business world, right? It just totally changed how we do business. Russ Fordyce (08:09): Yeah, it w I I talk about that often. I hate that term that that we all went through, the digital transformation. It was it was it was such it was it was such a horrible name for what we went through. It was it was more like an online transformation or a you know a network transformation or something. It wasn't digital. It was that sounds like we were taking, you know, cassette tapes and converting into CDs or something. now you've you've got this AI world you're talking about and you've stood up this practice. Russ Fordyce (08:39): The thing that that I'd love to understand a little bit better is, you know, I've heard recently, you know, Microsoft is pushing, you know, patch Tuesday patches now that seem to patch nine million things on your computer because of AI. They're able to go find these vulnerabilities, patch them so that they're no longer, you know, zero-day exploits or exploits on your computer. I imagine that's going on all over the cybersecurity world and all over the hardware and software world as people are using AI to better secure their environments. I think Microsoft even stated, or somebody maybe, that, you know, in eighteen months these all these vulnerabilities will be gone. What does the cybersecurity world look like when those kind of, you know, those zero day exploits and all those kind of known flaws are wiped out? Keith Hollender (09:28): Yeah, I mean, I I don't know that I I have that opinion that it will go that far. I do believe AI works both ways. And so new exploits I do believe will continue to be found, new paths will continue to be found. and so I do think it's gonna be an evolution. AI is gonna on on one hand, close the doors quickly, but it's also gonna open doors as well. And so I do think there's an evolution. think traditional threat and vulnerability management, maybe the way that it's been done for the past 10 years, is totally shifting and needs to totally shift. but at the end of the day, right, whether it's coding in new applications, and whether that's vibe coding or or coding directly, applications going the the SDLC process and and all that, I there's there's constantly going to be sort of a back and forth between things being introduced in the environment. configurations happening and things like that. And I think the onus is on us as an industry to be much quicker at addressing those issues because they're going to be exposed quicker as well from AI. And I think that's what AI allows us to do. It allows us to be much quicker at identifying those types of vulnerabilities and fixing them. And it also allows the the adversaries to also identify those much much quicker and try to exploit them. So you know, we work with several large clients that are putting a lot of effort into this right now to reduce the vulnerabilities in their organization quickly and drastically. And I think what it's changing is the speed at at which all that is happening on both sides of the table right now. Russ Fordyce (11:16): Are you seeing more kind of are you seeing different types of attacks versus these kind of malware and kind of zero day exploits? Are we coming into new types of exploits or or are old exploits becoming new again? Keith Hollender (11:31): Yeah, I think right now we're seeing more of old becoming new. we're we're similar exploits, different pathways. the AI adversarial attacks I do think are something that are gonna continue to increase. but ultimately AI is built on information and it's it's exposing pathways traditionally that are there. So it's the the old is new again. It is also finding new pathways in, right? And and that is something we we've got to continue to be aware of. but at the same time, right, the the tools and techniques that AI can use are what what right now what the security researchers use and and the pen testers, et cetera. Now that will evolve and I think it'll evolve very quickly. In six months the conversation may be completely different. But right now it's a lot of what's old is new. Russ Fordyce (12:30): How does that change the way you kind of manage detection operationally? Keith Hollender (12:36): Yeah, I I think it's back to what we talked about, right? So it's about speed and about nimbleness. we're doing a lot more in the detection engineering space, trying to refine what we're looking at, making sure that our team is looking at the right things at the right times. We are also building in right autonomous, right? That's been sort of the I I would say buzzword right in the sock space right now is autonomous socks. So we are Actively working with multiple clients down that path as well. And for a lot of things it works really well. But detection engineering and understanding all of that is changing as well. And I think as AI integrates, it again, it goes back to the same thing. Speed is is really accelerating exponentially right now. Russ Fordyce (13:25): Well, yeah, i and it's i it's speed of attacks, right? Of the number of attacks you can get. But they're also the you know, you were talking about getting more efficient. They're getting way more efficient. Breakout times are now under an hour inside of a network. So, like you're saying, your agents have to be either in there or about to be in there to start catching these guys because they're moving quicker once they get in too, aren't they? Keith Hollender (13:48): Right. They're moving quicker and and it's our job to do the same, right? And I think that that's been the big push for the agentics shop SOP has been certainly being able to react to things immediately and using human in the loop for not only validation but understanding sort of sort of some of the complex things that are happening in an in an environment. And so that combination is where we're focused today. and as I mentioned, we're working with several clients on agentix stock, whether it's built in house or or through third party products. Russ Fordyce (14:20): Well, since you are an expert in this field, the the thing that concerns me the most is kind of that authorization layer. We are now providing, at least I am maybe I shouldn't say this out loud, you know, I'm I'm providing my agents and my AI all sorts of credentials that I've I've never provided, you know, anyone before. you know, you you we used to dole these credentials out, you know, API tokens or keys or whatever, very, very judiciously, especially as small business operators. because we didn't we didn't want to get caught in some sort of you know, bad scenario or have something taken down. That that authentication layer now seems to be the attack vector for everybody because it's almost like that one password kind of concept. why is identity now the front line instead of kind of that network perimeter? Is it all that credentialing? Keith Hollender (15:13): Yeah, well, I think identity plays a bigger and bigger role, right? Non-human identities are increasing exponentially. They're you know, far have always for a while now far surpassed human identities. And I think the industry right now has tried to look at identity as a potential solution to to solve that. I don't think that that will that will work in isolation. I think it's gonna have to be a multi-layered approach once this all works out. But it does start with managing non-human identities and understanding the access controls that they have and understanding what they're doing with them and being able to log that and follow that and understand that. And so right the I identity and access management program within a company, the non-human aspect is really becoming mission critical to everything you do. If you think about a house, right, it's who are you giving the keys to the front door to your house and When do they work? When do they not work? How what are they doing with them? And and and all that, right? So you need the monitoring layer on there to know and validate. You need a logging layer on there to understand what they're doing. You need the authentication layer. You need to be able to revoke, right? Access it at any point. And so there's a lot of steps in the process. But identity is is mission critical to sort of everything working. And I think a lot of enterprise companies understand that and are executing against that right now. I would say one of the most common conversations we have in the identity space is is about non human solutioning right now. Russ Fordyce (16:47): Yeah, it's it it scares me to death. It's you know, it's it's it's robots basically with the ki you know, not only the keys to your house, but you know, if you give it control, authority to construct, authority to buy, sell. I mean, you know, you can get pretty crazy with the tools these days. So it it's gonna be very interesting to see how that gets managed. Do you have a lot of clients coming in to kind of move away from that kind of reactive credential program to more one that's, you know, a little bit more active? Keith Hollender (17:17): Yeah, again, you know, I think it's an evolution. I think clients are trying to solve that problem. They're also trying to solve that problem by being more efficient. There are also products in the market now that are using AI to help solve that problem. So I think it it it's coming full circle. I think the industry is still evolving in this space, certainly not mature, and and still figuring out right the the operating model. But yes, clients are trying to solution around this today. And I think like everything else, the speed is is accelerating. I think people are trying to understand how to leverage the tools in the best approach. And then also understand how do we put better guardrails on you know agentic solutions. So there are guardrails, but it's very hard to understand when you're using generative AI, very hard to understand exactly what that generative AI will do. and the more guardrails you have and the better you can understand them, right, the better you can execute against those projects. Right. At the end of the day, AI will put out a sort of a different answer every time you ask it the same question. Now it might have the same content, but we'll put out a different answer. And the more guardrails you can have to make sure that you're controlling what's accessed, how it's accessed, what it does, and and that's why people have traditionally gone back to the non human identities in in an IAM practice because if you control the access, right, that should in theory control the data. Russ Fordyce (18:46): Yeah. Well, now I've seen also that there's been an uptick in kind of the third party and supply chain incidents too. You know, that as companies get more hardened and enterprise get more hardened, I think the attackers are now going after the weaker parts, which are you know, we had a we had another a winner on another Fortress cybersecurity on called Black Cloak that does enter that does kind of enterprise protection for executives at home, because that was becoming a a a threat vector. now you have these kind of third party kind of vendor and supply chain related incidents kind of growing very, very quickly. How exposed are most enterprises to you know risks that they don't cut you know can kind of directly control? Keith Hollender (19:25): Yeah, third party risk management has always been a challenge for them last many years from from a from a risk perspective. many enterprises run robust programs around that. It's a continued challenge, right? Because you can survey third parties and you can ask them for their controls, but at the end of the day, right, a lot of a lot of breaches do happen through third parties. Well, unfortunately, may not have the resources to have the controls in place that a an enterprise company would have. And so I you know, again, if we talk about AI, I think AI will help speed the market both for the adversaries but also for the good guys, right? And allow third-party risk to be better evaluated. I think tools will be put in place to allow companies to have a better foundational control. around that. And I think companies need to continue to take third party risk seriously, run programs that really evaluate third party risk and really, really understand who has access to their data, who has who can get in and what can can they do. and eventually AI will be play a part of that too, right? Where AI may have the ability to site kind of sit alongside the access and make sure they're only doing the things that they should be doing with that access. And I think That's part of the evolution that we're talking about where AI can create a lot of opportunity for us. Russ Fordyce (21:00): Well, you went through a acquisition recently of Lynx Technology Partners. you know, that was really kind of a third party integration. Did you learn anything there with that integration on how to kind of tighten up controls around, you know, third parties or integration partners? Keith Hollender (21:17): Yeah, absolutely. Lynx great acquisition. We've we've been really excited and have great momentum with Lynx. Lynx had a a third party risk program and a risk operations center. we brought it over a lot of the best practices and integrated into our enterprise third party risk programs to allow us to to build on that. And it really was Building an operating model around how to manage risk for third parties, being able to standardize that in a way that speaks to the risk language of organizations, and making it continuous, right? So sending out a survey once a year, you know, while you do get good information for that, it is sent out once a year, it's sort of a point in time snapshot, and it's as good as the data that's entered into that. Whereas operating third party risk management is like continuous. continuous risk monitoring really changes the way programmatically you look at those things. So Lynx has been a great driver for that for us. The team's been fantastic. Was a great business, been around for a long time. and, you know, we love having them here today and love we'll continue working with the team and everything. They're already fully integrated. I don't even consider them a separate team at all anymore. They're just part of us and part of what we're doing today. And it's links was a great business and we were we were happy to do that transaction. Russ Fordyce (22:47): Well, there's a lot of risks in the world too. There, you know, we're t we've been talking a lot about that risk in, you know, making acquisitions, rebranding, all the risks in the cybersecurity world now. There's also all these kind of geopolitical risks going on right now in our world. How does that show up in kind of the advice that you give clients? Keith Hollender (23:06): Yeah, it it's interesting. I I think you know, during that process we also we also expanded into the Middle East, which has been certainly challenging given some of the some of the events happening as well. but we we are a big believer that the global environment needs to work together, the global environment needs to have providers that that operate in the way we operate. And we do believe we can add value across the board. When we talk to clients, right, ultimately those nation state actors, they they tend to be incredibly well resourced and it creates additional risk and instability in in the world, right? That leads to increased motivation for for those nation state actors to continue to exploit and do malicious things in our environment. or at least stage those attacks. And so you always have to be vis vigilant, but you know, when when things are like they are right now, right, it's just an increased awareness. There should be increased focus and an increased understanding, particularly in critical industries, right? So critical infrastructure, financial services, healthcare pharma life sciences, and others, right, as well. But those are really, really critical industries. And environments like today, it's a it's about understanding the motivations of those nation potential nation state actors or nation state funded actors and really trying to understand the threat intelligence behind that and make sure that the program properly aligns to that. Russ Fordyce (24:49): Yeah, it it's it's funny you say it's it's you don't think about that, but these nation state actors do have almost unlimited resources compared to enterprise. It's it it it it really is it's gotta be a challenge. the other challenge I would imagine is all the different regulatory environments that you're going into as you expand into new regions. What changes about how you kind of deliver services operational? Keith Hollender (25:13): Yeah, and and so I think that that's one of the areas that we've had a advantage. Most of our most of our enterprise clients, not all, but many of our enterprise clients do operate globally. so the exposure to all of the different regulatory environments is something common, right? I think companies for the most part try to understand that compliance means compliance across the board. So if you're working with a global company, right, and you're talking about EU regulations, right, in resilience, like around DORA, for example, right? There's going to be a focus on being compliant across the board because of the global operations. and I you know, I think that's where it is. And we talk about things like GDPR and C C P A and NYDFS and and all these different regulations. I think it just raises the bar for everybody because right, sort of the the the highest compliance standard becomes where everybody has to meet, at least in the highly regulated industries. And so it's elevation for everyone. As the world evolves, I do think right, coming into more standardization would be beneficial and for the world to look at this, look at this similarly. but ultimately it's a tough job you know, regulation and trying to understand that people are working really hard to do that. And I think as we as we continue to grow as a world, right, those things will come together closer and closer together, right? The EU regulations, which are are are a little bit stronger in a few areas, will come together with some of the regulations in the United States and that can spread into places like the Middle East and Asia Pacific region. Russ Fordyce (27:02): Well it's funny, we are kind of I I seem I feel like we're leading in one area and that's in kind of that quantum defense and trying to get ready for the quantum computer age. How is how are your clients kind of preparing for quantum? Are they are you following kind of that NIST standard for algorithms and all of that? Keith Hollender (27:20): Yeah, so quantum readiness is interesting. We're certainly starting to engage with clients on that, obviously following NIST standards. I I think ultimately there's still a lot of unknowns. we we we do hear regularly about, you know, quantum readiness and quantum encryption. And then, you know, a year later those algorithms are, you know, potentially being breached and things like that. So The world is learning. I think quantum is is rapidly knocking on our doorstep. and I think we talk about AI being really a groundbreaking technology. Quantum I think is gonna be equally interesting. And so yes, we're working through quantum readiness. I think quantum hardening has already happened in in a lot of enterprises. and and sort of we're there on the quantum hardening. That's based on the data we have today. That's based on what we know about quantum computing today. The reality is access to quantum computing isn't exactly isn't exactly readily available. That's a good thing for a lot of things, but you we have to assume most nation states are are already leveraging that. So quantum hardening I think is something that's been done. I think true quantum readiness as quantum computing becomes more available. will be sort of the next chapter in what we talk about. Russ Fordyce (28:49): Yeah, it's it it definitely is gonna be another kind of seismic shift once it happens. And and that's you know, I I think we're beyond the ifs at this point. Keith Hollender (28:59): Yeah, I and I think it'll also be interesting too because quantum is sort of in this space where we're not exactly sure how it will shift the world. We just know it will. I mean, there are things that quantum computing does a lot worse than standard computing, and there are a lot of predictability things that it does infinitely better, right? And so when we look at that, right, I think a lot of the use cases haven't necessarily been developed yet. And we're going to be building and doing things we didn't even think of as concepts, right, without quantum computing. So I I you know, I think the steps to to go through quantum hardening and upgrade encryption and do the things that need to be done in that space have happened, right? And not saying there's not more work to do. I I know there's plenty of more work to do in that space, but certainly an area that people have focused on. but I do think that's gonna evolve. I think what we prepared for may not be. How it actually practically works once once quantum computing really changes. and again, I mean, if you look at the what Google released in in the quantum computing chips and things like that, we're still it in the infancy, at least from what we can see, we're still in the infancy of of what these things are. I mean, if you think about computer chips, like these are the you know eight kilobyte like chips that had minimal processing power. We're not even We're not even in the Pentium stage yet, or you know, the three eighty six four four eighty six stage. Yeah. Russ Fordyce (30:31): Or or or of Pent Pentium and AI either, right? I mean, we're still in the I mean, we in reality it's moving quickly, but we're three years into kind of GA, you know, gener general availability of AI, maybe. yeah, I mean I I I like your I like your approach of, you know, let's harden for what we know, but we really don't know a lot. Keith Hollender (30:55): Yeah, I think that's a scary concept too. I think everybody wants to say, Well, we we do and they're right on what we know, we know a lot, but we're still learning every day. And what we think today, you know, I I think we've already proven over the last year or eighteen months what we know today is probably gonna be very different than what we know eighteen months from now. And I think that's w that's remarkable when things are moving that quickly, that that really strategies need to shi shift in eighteen months because we learn so much more. Russ Fordyce (31:24): Yeah, and I I I can't imagine the next thirty-six months. So Kate Kate, thank you so much for joining us. Really a eye-opening conversation with you. Thank you for all your expertise and congratulations again on the award. Keith Hollender (31:38): Thank you again. Thank you for your time.