SecureAuth CEO Geoff Mattson on the coming fraudpocalypse and the death of the password

Geoff Mattson is the CEO of SecureAuth, an identity security company that has raised over $200M and protects more than 50 million identities for enterprises. Before SecureAuth he was CEO of Xage Security. His work now centers on how you prove an AI agent is who it says it is. In this episode of Summation, Geoff and Auren discuss: Why an AI agent is like an Uber driver who might randomly turn into a psycho killerThe deepfake fraudpocalypse, and the simplest thing that defends against itWhy you...

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  Passwords will be replaced by much better mechanisms, principally pass keys.

• 0:04Auren Hoffman?

  Jeff is the CEO of SecureRoth, a identity security company that's raised over $200 million.

• 0:10Speaker 00

  People say that they think they're look at their phone and they think, oh, it's just, you know, looking at my picture and it's validating who I am. Your iPhone, for instance, is taking, you know, 30,000 invisible infrared dots projected at your face and feeding that back as a code into the phone to verify who you are biometrically.

• 0:31Auren Hoffman?

  Hello, fell Dan. It's my guest today is Jeff Matson. Jeff is the CEO of SecureRoth, a identity security company that's raised over $200 million and protects more than 50 million identities for enterprises. Essentially, it figures out how you prove an AI agent actually is. Before SecureRoth, he was the CEO of X-Age Security and he co-founded MissNet. Jeff, welcome to Summation.

• 0:55Speaker 00

  Thank you, Orin. Longtime listener, first time guest.

• 0:58Auren Hoffman?

  Very excited for you to be here. Thank you for being a listener as well. Listeners get priority to be the guests, for sure. Now, like, okay, what does it actually mean to prove who you are to a computer? Like, walk us through like what that means?

• 1:13Speaker 00

  Yeah, you know, a computer can't just recognize your face like a bank teller, right? So, you know, you basically, authentication has traditionally been based on either something you know, something you have, or something you own. So, something you know being, you know, your password typically. You know, something you own being maybe your phone, or something you have being your face, your fingerprints. The problem is nowadays, either of these three things is easily compromised. Passwords can be stolen, phones can be SIM swapped, and with deep fakes, you know, basic facial recognition is pretty weak at this point, too.

• 1:49Auren Hoffman?

  Yeah.

• 1:49Speaker 00

  And on top of that, your account can be taken over after you're let in. So, you know, authentication, it used to be just sort of checking you at the door, and it needs to be now a full-time escort, right, to actually make it work. And then on top of that, I think we'll get into, you know, how AI agents completely scramble the game and make incredible new challenges.

• 2:09Auren Hoffman?

  I've got all these agents. I want an agent to go book a ticket for me on United Airlines. I want another agent to go buy some shoes for me on Zappos. I want another agent to, go through my subscriptions on Netflix. And of course, I want agents to do things in my financial life as well. How do I, how this one, how is that future gonna look?

• 2:31Speaker 00

  You know, right now, if you're doing any of those things yourself, we're just, those apps are pretty much using your identity.

• 2:38Auren Hoffman?

  Or I've got like an API token or something like that, that I've given it, or maybe?

• 2:43Speaker 00

  Well, you have an API token, but the API token is still owned by Orin, right?

• 2:47Auren Hoffman?

  Correct. Yeah, and it might be stored on my machine somewhere, which might be easy for someone to grab.

• 2:52Speaker 00

  That is, that's a huge problem, or I'm glad you're aware of that. I think, just, I hope we have time to talk about that as well. But with a lot of agentic deployments, we see that a lot. We see agents directly owning API keys that can be easily abused. But, you know, the fundamental problem is this, is you don't want the agent to do everything you can do, or present itself as you. That's not authorization, that's impersonation. And what you want to do is you want to, you know, downscope some of your privileges to very narrow set of things it can do. And for that, you know, there has been theoretical work for a long time about a token exchange, where we take your token that says who you are, what you're allowed to do,

• 3:35Speaker 00

  and we provide a more tightly scoped token for, you know, some agent or some other, you know, sub-entity that is working for you. And that hasn't been really widely, well implemented in the industry, and now is absolutely urgent that we do so. And even beyond having that tightly scoped token, we need to have authorization and enforcement mechanisms that work in line to make sure that, you know, we're not just leaving it to the app to try and understand what those privileges are, but we can centrally control them.

• 4:11Auren Hoffman?

  All these services are gonna need to have a whole new way of interacting with things. Like, today, I have a, I have an executive system, a human executive assistant. And even today, like, if that, if my human executive assistant wants to log on to United Airlines, like, often, like, I'm getting the two-factor, and then I've gotta, like, send it to my executive assistant, and they've gotta come on. It's just like, it's a huge mess. So, they haven't even built it for people who have executive assistants, maybe not that many people have that, let alone, like, building it for agents.

• 4:45Speaker 00

  I sympathize. I'm my wife's executive assistant, I think, and I do the same thing for her. You know, this is a problem we've known about for a long time, which is, as I said, what she has to do to actually do things for you is essentially impersonate you. And what we need is, is not to take your full authority, but to have delegated authority, right? We need delegation. And there has, as I said, there have been some basic technologies, you know, proposed or in place, lightly implemented, that solved that problem. But now for agents, we 100% have to solve that problem. It's not just you passing something off to the agent, but the agent can spawn sub-agents.

• 5:24Auren Hoffman?

  Yes.

• 5:24Speaker 00

  And each of them has to have a reduced scope of authority. So, scoped delegation is extremely important. The good, the good news is, this is what I like about agentic AI and all the security problems it's causing, is forcing us to clean up our technical debt we've had for a long time. So, this assistant problem that you have right now, this will be solved by the agentic workflow. You know, you will be, and soon, able to give delegated authority to your assistant to do particular tasks, and that your assistant will be able to give it to AI agents to do the same thing.

• 6:00Auren Hoffman?

  When I log into AWS or something, which obviously it's like, it has like, tons of different user roles and so on, but it's like, it's super complicated, and it's extremely hard for anyone to understand. And sometimes even, like, the administrator in the company, our company is like, have no idea what the heck's going on. And it's just like so convoluted, I guess because you could have these, like, many to many different types of relationships. So, and like, every time they're just adding these features, like, are we gonna just have this, like, massive spaghetti monster, even like when you log in on United Airlines now, or like, how is it gonna look like?

• 6:38Speaker 00

  So, if you look under the surface of what Amazon has done, they have some very elegant language for describing policy and for enforcing policy, and actually good at enforcing policy. But what's sitting on top of that, as you said, is this gigantic spaghetti monster mess of different role-based accesses. And I think the good news is that one thing that AI is actually very good at is taking your stated intent and turning it into this policy language, be it one that, that Amazon's using, or there's some other proposals. So, I think that will be part of the solution. But the other part of the solution is, you know, one reason for this complexity is,

• 7:21Speaker 00

  the policy is trying to capture every possible bad outcome and block it. And what we see with agentic is you can't do that, because agents have LLMs in them. LLMs are non-deterministic, and they're gonna do things you never expected. So, on top of having that static policy and static enforcement per action, you actually do need behavioral analytics that will make sure that the agent is acting within the normal scope of what that type of agent does, right? And so, that will be your safety net if you don't have a, if you haven't captured everything, everything with a, with an overly complex policy. Hopefully, that will simplify the, you know, this policy workflow.

• 8:03Auren Hoffman?

  Even 20 years ago, people say passwords are dead, but they still seem like they're so alive, and everyone uses them every day. You might have like a password manager now that maybe didn't have that 20 years ago, but they still seem like super alive. Like, where, how are, how is that piece of the leg going to evolve over the next five years?

• 8:22Speaker 00

  Passwords will be replaced by, you know, much better mechanisms, principally pass keys. And I think we in the security industry have done a pretty bad job of sort of educating the public on what pass keys are, and, you know, why they should use them. But basically, the reason that they're replacing passwords is, you know, obviously, they're much more secure. You can't have a pass key stolen. It's cryptographic code that is stored in a secure, you know, hardware area of your phone or whatever device you're using, and it's bound to, you know, very, very fine-tuned biometrics.

• 8:55Auren Hoffman?

  I don't think most people understand, like, how the pass key works. So, there's a, I've got, let's say, multiple devices. I've got a phone, I've got a couple different computers, et cetera. There's a, somehow, the pass key, like, lives on all of these through my password manager, but if like, if there was like a new device, like, maybe it wouldn't live there somehow, or like, walk us through how that would work.

• 9:17Speaker 00

  There are, you know, basically two types of, of pass keys. And the ones most people are used to dealing with are the ones that are provided by, you know, consumer app providers like Google or Microsoft. And they're fully embraced by them at this point. And so, what they are is, they're asymmetric cryptography. They're a signature that...

• 9:38Speaker 00

  It allows you to prove who you are with a code that is stored in a vault on whatever hardware device you're using. So it proves that you're holding the phone, you know, if you're using a phone, for instance, and then combined with some very sophisticated biometrics usually. And people say that they think they're look at their phone and they think, oh, it's just, you know, looking at my picture and it's validating who I am. And I could deep fake it by just putting a picture of myself. But, you know, your iPhone, for instance, is, is taking, you know, 30,000 invisible infrared dots projected at your face and feeding that back as a code into the phone to verify who you are biometrically.

• 10:18Speaker 00

  So it's looking at a very strong biometrical indicator that's very difficult to, to copy. And it's also making sure that you have access to your, your phone or some other device. And then it's automatically logging you in with you, without you having to do anything usually, right? And that's why it will kill the password.

• 10:36Auren Hoffman?

  It's very like tied to the device in some way. So if I, my device gets stolen somehow, I'm, I'm still vulnerable or.

• 10:45Speaker 00

  Yeah. If the device is stolen, they would still need your face to access the device, right?

• 10:50Auren Hoffman?

  I guess if it's stolen while I'm using it or something, someone grabs it, then yeah.

• 10:54Speaker 00

  Yeah. Well, that's a great question because, you know, so that's, that's called continuous risk assessment. What we're doing is while you're logged in with your phone, while you're logged into your website, we're constantly looking at you to see if there's anything funny going on.

• 11:06Auren Hoffman?

  Or someone's doing, if you, someone's forcing you to do something against your will, or, you know, you might be doing something weird, right?

• 11:11Speaker 00

  Yeah. So we're, we're looking at your device fingerprint, but we're also looking at your location, you know, the hours a day that you're accessing, some proprietary signals, looking at a lot of things to make sure that, I think you've hit on a very important point, which is account takeover, right? As I said before, authentication and identity used to be with this one static process you do, you log in at the beginning of the day and then you're in, you can do whatever you want. You know, right now what we're doing is on consumer apps and a lot of enterprise apps constantly monitoring you to make sure your account's not taken over.

• 11:42Auren Hoffman?

  Presumably I have these agents, like today I can't have an agent. I've had my agent try to like book a flight for me, even buy shoes, like it's been like terrible. It buys like the wrong shoes or it like, it has, it has all these issues booking the flight. It doesn't seem like it's that hard to be able to do that. But I, you, we all know that's coming, right? Like we all know that that's gotta be mostly solved hopefully. And, you know, then I don't, I hope in the next six months or something. What happens if it like does something wrong? Like, am I going to have like my agent that I'm using? Are they going to be responsible for? Is it's like my fault because I tuned it wrong? Is, am I going to have like insurance for that? Or how, how is that gonna, how's that gonna work out, you think?

• 12:25Speaker 00

  Yeah, it's a really interesting area. It's like, we know where liability lies. And we've seen the case of there's a Canadian airline where their, their chatbot offered bereavement fares that didn't exist. And, and the, the company was held responsible for that. I think, you know, in the, in the business space, there will definitely be liability associated with that. And you're going to see cyber insurance and it's going to go back to the bad old days of cyber insurance, which where it's really expensive and really complex with lots of exceptions. Cyber insurance, complexity and expense is the forcing function that causes boards to do the right thing and listen to the CISO, right? So there's nothing like, you know, black and white cost analysis to, to move things forward. So it's, you

• 13:08Speaker 00

  know, it's part of, part of the positive progression that happens every time a new technology like this is introduced.

• 13:14Auren Hoffman?

  As we're able to offload more and more things to these agents, like what does the world start to look like, both from like a security standpoint and also just from like a life improvement standpoint?

• 13:27Speaker 00

  Yeah. I think I'm looking forward to the life improvement aspect like you are. I wish I could, you know, delegate more tasks end to end, especially my personal life for the agents. I think we're doing much better job of it at, you know, at work. I've often been sort of the low bandwidth connector to multiple SaaS tools if I'm trying to do something, right? And, you know, I'm, I'm taking data from this one SaaS tool and putting in another. And I think the agents do a fabulous job of that right now.

• 13:54Auren Hoffman?

  That I've already been able mostly automate my life. Like I've been able to, okay, grab this thing and do then, you know, a lot of these SaaS tools will have like, you can point it at if they don't, if they have a decent API, but if they don't already, they've got some sort of way of making it happen.

• 14:08Speaker 00

  In my personal life, you know, you know, what we're doing is with that delegated authority that I talked about, you know, we can put controls around agents. So at least they can't do that much damage. So I can say, you know, book me a, a trip, but here's your maximum budget, $200. And I can make sure deterministically that the agent will not be able to, you know, the worst case downside is they waste the $200, right?

• 14:32Auren Hoffman?

  Yep. Yep.

• 14:33Speaker 00

  That, that's the way I'm training my agents. And like I said, I think, you know, like all technologies, we rush in with deployment and rush in with use cases. And then we think about security after. And as security comes in, then I think you'll see, you know, more experimentation with the scenarios we're talking about booking travel and things like that. And, and finally, much more refined flows.

• 14:53Auren Hoffman?

  Everyone's going to have tons of agents. All those agents are going to have a series of sub-agents and then sub-agents may be shared with other agents and stuff. I had, there seems now to be a lot more attack vectors than there were before. Maybe each one of those has less damage, but there does seem like now we've got, you know, a couple more or more, more attack vectors for bad guys.

• 15:16Speaker 00

  It's not just attack vectors. It's new attack categories, right? So the attack vector is like, you can compromise an LLM and get it to do whatever you want. You definitely, and, and there's been, you know, NIST, a gentleman from NIST researcher said, you know, it's, it's mathematically provable that there's no way to secure an LLM internally. And so you can put guardrails around it, not inside of it, and it could still be hacked. And that's conventional cybersecurity we have to worry about, right? But then we also have this, this other case, and I've seen more of this in the past year than I've seen the actual hacking, which is an agent just doing something you don't want it to do, which, you know, sometimes looks like a hack. Sometimes it's trying to accomplish an objective

• 16:01Speaker 00

  that you want, but it doesn't have common sense about the collateral damage. Sometimes it hallucinates something that it thinks you want to do, and it just doesn't understand that, you know, the damage it will cause. You know, agents can look like hackers working their way through an enterprise, not developing malware, but doing what we call living off the land attacks, which is finding holes in your infrastructure and driving through it, right? So, so that's a new, completely new vector of threat vector that has nothing to do with an external entity. It's just an agent going rogue essentially. And then what you mentioned about the sub-agents and, and chains and chain of sub-agents is, you know, that creates an accountability problem. You know, people just don't understand, I

• 16:42Speaker 00

  mean, where their token budget's going, but also who initiated this action that turned out to be the wrong thing to do? And how can I show that to auditors, for instance? So that is another huge new problem that's introduced by, by agents. So I'm cursed to live in interesting times right now, I guess.

• 16:59Auren Hoffman?

  These things are very fragile. I had a agent that was like basically auto trading for me. It was doing good and it was actually really fun to watch. And all of a sudden it started totally sucking. And I was trying to figure out why. And I just caught like, I just cut diving and diving and diving in and somehow like introduced like a negative one in one of the calculations. And so literally it was doing the opposite of what it was supposed to do every single trade, which like, I don't even know how that happened. Like I just couldn't even figure out, like I, I tried to do the audit trail, but I couldn't figure it out. Like these things are like really complicated when you're, especially if you're just like vibe coding it away.

• 17:35Speaker 00

  Well, then, you know, there you mentioned that vibe coding. I've noticed that's another, you know, threat vector that's sometimes it's, it's amusing, but it's actually real. You know, I had like a, a CISO from a financial customer, a major financial institution called me and said, his new threat vector is the C-suite trying to vibe code on the weekend.

• 17:54Auren Hoffman?

  Yeah, totally. That's me. I'm the, I'm the threat vector. That's exactly what I am.

• 18:00Speaker 00

  Well, they're asked to approve things that they don't understand. And they're just, you know, executive leaders and they just plow through and do it. And so it's, it's kind of amusing, but actually there's, you know, there's a data breach as a result of that. So it's kind of not funny too.

• 18:12Auren Hoffman?

  What's the good version in this like AI agent world? Like walk me through like how it works from a security standpoint? How are we all going to feel? It's important that we are secure and it's important that we feel secure. So how does that work?

• 18:26Speaker 00

  And I don't think it's necessarily that far away, but I think, as I said, agents can do a lot of the mundane work that we do. And they can also be like thought partners for us, you know, they can, you know, I think you probably work with agents, they're not, with LLMs, they're not super expert at anything in particular, but they know a lot about a lot of things that you may not know about. So they're, they're good as a, as sort of a broad thinking thought partner. And they're, they're good at, as I said, taking natural language and then driving an outcome, you know, talking to a lot of different systems. They can run very quickly. So I think they're really going to change the way we work in

• 19:08Speaker 00

  a corporate setting first. You know, I'm, I'm seeing this rolling out right now. And then in my personal life, I agree, I think you and I spend a lot of time doing these mundane tasks, like booking travel. If you want to do that, that's, that's fine. But that's definitely something that will evolve to be outsourced to agents. As I, what really needs to be solved though, is that final delegation, that delegation of authority problem we discussed, right? As soon as we nail that, then we can safely trust these agents to stay within the balance of what we asked them to do and to not have cataclysmic downside if they, they go wrong. We rely on biological friction to keep people from doing the wrong

• 19:49Speaker 00

  thing accidentally, right? You can, you can delete database entries and you may delete the wrong entry and that causes a problem. But your agent can delete the whole database in a couple of minutes.

• 20:00Auren Hoffman?

  You've got this like public registry that kind of scores and verifies AI agents. It's kind of, is it like a credit score for bots or what is it?

• 20:08Speaker 00

  We need to look at two things with, with agents. So one is how much security control is built into it. But then you need to look at the scope of what it touches in your enterprise, right? So if you just have a dictation bot that just, you know, collects your notes and video and creates a, a note for it, you know, that's much less impactful than a general purpose, you know, bot that could access all sorts of systems. So, you know, we, you know, cast and rank a lot of public agents in that way. A lot of, a lot of people are not aware of the risk associated with, you know, some very well-known agents. That may have moderate security controls, but also have a very broad scope.

• 20:52Speaker 00

  And so we always start out with that, with the public assessment of the agent. But when you put an agent in your environment, then it needs to be rerated, right? Based on what you connect it to, based on what it does. So we do that with our customers as well. It's, we call it the genetic footprint of the agent, what it starts out with. And then the epigenetic, that's how the environment affects your genetics. Is what happens when it's actually deployed.

• 21:19Auren Hoffman?

  Have you seen Agent Score, agentscore.com? I use them. It's kind of cool. I don't know if you've seen them at all.

• 21:25Speaker 00

  I think their idea is to associate users with agents.

• 21:28Auren Hoffman?

  We have like a KYC, a KYB. They're trying to do like a KYA, like a know your agent. Imagine if like somebody's interacting with an agent. Okay, who's, is this a North Korean behind this agent? Like, how do we know where this agent's from? What are they doing? What are they, where are they moving things? So, okay, yeah, this is actually Orin's agent. It actually is these things, it has this problem on to, et cetera.

• 21:51Speaker 00

  I think there's a lot of work to show the providence of the output of agents. For agents themselves, though, I think it's kind of more important what they're trying to do at any given time, rather than where they came from. Of course, if they came from North Korea, you'd be suspicious. But even if they come from very trusted source, as I said, in their heart is a stochastic process that could change on you at any time. So you still have to monitor it. And then the other thing is, agents can be used by multiple people at multiple different times. So that's why we really need to move away from this concept of this static identity to delegated authority, to actually saying, Orin wants this to be done. He's given this scope.

• 22:34Speaker 00

  He's given this set of responsibilities, this budget. It gets passed to agents. They can subdivide and pass it to subagents. And we have a chain of custody all the way along the line.

• 22:44Auren Hoffman?

  Yeah, that makes sense. Cause like, again, it's not like an Uber driver has a rating or something like that, or Uber passenger has a rating. It's like, imagine the Uber driver has a rating, but then like you roll a 20 sided die. And if a six shows up, that they become like a psycho killer all of a sudden. I don't want that 5% chance of them of like literally driving off the bridge or something.

• 23:07Speaker 00

  We talk about human identities, but software has that identity for a while too, right? You could have micro processes that you identify. But the analogy for them is they're like trains, right? They're very predictable. You can test them. If you attach to what they are, you know, pretty much what they're going to do. Whereas these agents are like, as you say, Uber, they're like a fleet of Uber drivers that could go insane on you at any time, right? If you roll a die, right? So that's why they have to be monitored. And the principles that we've talked about for a long time about delegating authority, certain things like zero trust, where you don't have a safe in and out perimeter. You have a perimeter between any agent that acts and anything that acts on. And you check every action.

• 23:52Speaker 00

  These principles need to be applied now and not just talked about anymore.

• 23:56Auren Hoffman?

  Walk me through the scenario in, over the next couple of years, where the AI and AI agents make all of us more secure and we feel more secure, not less than before.

• 24:09Speaker 00

  You know, I wish I could make that promise, you know, Orin. But I think it's going to be a brave new world with a lot of more security in some areas and more threats than others. I think that agents give defenders a huge advantage in the fact that defenders have access to the record of ground truth. They have access to all the internal data that in the organizations are trying to protect. And it's always been really hard to work your way through that data and understand what's going on. And agents are very good at that. And I've seen people who don't know that much about cyber, throw some logs or throw some other information in Claude

• 24:51Speaker 00

  and come out with some pretty good insights from a cyber perspective. So it can democratize and strengthen the defense of a lot of companies, a lot of enterprises. But it also, it's creating these new vectors. Like it also democratizes attacks. So we haven't seen any like really brilliant or super elegant attacks that have been developed by the agents. But it's, in the past, people used to worry about teenagers, about what we call script kiddies, just using well-known scripts or slightly modifying well-known scripts to hack into whatever they can, just for fun. And they're pretty easy to recognize, pretty easy to catch.

• 25:33Speaker 00

  But now this same demographic has access to vibe coding tools that make them as good as a reasonable hacker, right? So it democratizes that. And the worst thing that we're seeing though, right now is the fraudpocalypse, right? Is a deep fix, so easy to generate. You don't even have to speak English very well. And you can create a fake image of a particular person or a celebrity. They're talking with one CISO who his mother had just been, received a video from Donald Trump to invest in some sort of crypto. And she did, of course, it wasn't Donald Trump, right?

• 26:13Speaker 00

  But yeah, so right now it's very, very easy to defraud people, especially very vulnerable people.

• 26:20Auren Hoffman?

  I mean, we've seen these things where like, they'll get the CFO on a Zoom call or something with presumably some of the other board members and asking the CFO to make a wire. And they end up wiring $20 million to this thing. And we've heard the stories over the last couple of years of this. But there doesn't seem to be as many stories as I would have thought. At this point, I would have thought there'd be just like way more stories about that. And way more of our friends would have got calls from their spouse, FaceTime calls from their spouse where they obviously look like them. But it's just like, anecdotally, you hear it happening here and there, but not at the level I thought it would be by now. Like, why is it not yet so prevalent?

• 27:03Speaker 00

  That kidnapping scenario you're talking about, that I haven't seen that yet. And people do talk about that. But I do think, I think you don't hear about the CFOs with the wire fraud because it's embarrassing. And that's a terrible crime because I've seen that ruin people's careers. Hack happens. Sometimes people move on to a different job or something like that. But I've seen financial people very severely punished for that. So it has a lot of collateral damage. And I definitely have seen an uptick in that. Although it's, we call it the fraudpocalypse, but it's probably still not happening on an everyday basis to someone in your network.

• 27:42Auren Hoffman?

  What are some like very simple things? Or what are some like ways to defend against some of that? Like, what do you advise people to do?

• 27:49Speaker 00

  First thing you do is just defend your email, first of all. That's a huge vector. And so use pass keys for your email, as we discussed. The other thing is, one super simple thing you can do, it sounds a little bit paranoid, but it's so easy to do is have a safe word with your family, right? So, yeah, so everyone just agree on that. It's very simple.

• 28:11Auren Hoffman?

  And what happens if you forget the safe word all of a sudden? Yeah. Like, you're like, oh, I thought the safe word was Corvette. Now I have no idea. Like, it's like, what the, what the heck is the safe word?

• 28:22Speaker 00

  Orin's C4 is Corvette, people.

• 28:23Auren Hoffman?

  Yeah, exactly, exactly. For all the hackers listening, I try to come up with like the safe word that is the least likely to be my safe word. But people like me and you, like, we're out there. Like, we're doing podcasts. We have videos of us. There's a video here. Like, we're giving, in some ways, we're giving like more vectors for attackers to go do stuff. Like, what can people, executives do to harden themselves more?

• 28:48Speaker 00

  You're talking about for executives. It is also a very good idea to have a safe word with executives.

• 28:53Auren Hoffman?

  Like with your CFO, your board, or something like that?

• 28:55Speaker 00

  Yeah. But the other thing is, people that work together like that, often they have a lot of trivial knowledge that they're all familiar with.

• 29:04Auren Hoffman?

  So maybe they should just be like willing to ask. Like, if your CFO is like, wire this thing. It's like, oh, remember that time when we got drunk in Bahamas? You know, can you, and then you're like, no, no, just wire that right now. You're like, oh, no, you gotta actually go with this anecdote with me for a little bit.

• 29:23Speaker 00

  Yeah. No, I need those gift cards now. I'm in a meeting with customers and I need 700 gift cards.

• 29:28Auren Hoffman?

  I had an assistant once that fell for the gift card thing. So this is 10 years ago. And she was, I think she ended up doing like 800 bucks of gift cards. That was our office manager did that. So, I mean, anyone can fall for these things. In some ways, like, in some ways, you want, really, when you want to say, like, look, we're all going to fall for stuff. We're all going to be scammed in our life. Like, the important thing is when we get scammed, it's a small percentage. It's a small, it's a small loss, right? It's like, it's like when, you know, it's like Walmart gets people stealing from their store every day. Right? As long as it's a small enough loss, it's fine. They don't want to have to like frisk everybody who's coming in and out of Walmart. They have some sort of acceptable loss and in some ways all of us are going to have to deal with that, right? Or, or do you disagree?

• 30:13Auren Hoffman?

  Do you think there's ways to get like, you really can get to zero and still have your cake and eat it too?

• 30:17Speaker 00

  People do make mistakes. That's what they do and they need to be forgiven and you need to forgive yourself. Everybody gets scammed on. You can't do business. You can't go into the market without getting scammed on sometimes. But I, you know, I do think the Agentic will also help us here. I think your personal agent, you know, may actually help safeguard against some of these things, maybe able to keep watch for you. And it's interesting because if you take this to its logical conclusion, it may not just be the human delegating some authority to the agent. At some point, the agent may, may delegate authority to the human and say like, okay, you, we've seen enough proof points here that you can go forward with this transaction. Otherwise I'm going to withhold it for you, right?

• 30:56Auren Hoffman?

  Yeah, you can imagine something like that. Like in some ways, like a smart bank manager would do that today. The smart people are like, sorry, I'm not going to send that wire because I don't feel like I have enough data. I need more information before I'm going to send that data, even if it's like a little frustrating for that human. That bank manager is essentially like a smart agent to, you know, to make sure that the human doesn't get defrauded.

• 31:19Speaker 00

  Yeah. And with these token scope technologies I was referring to before, I think there'd be like easier ways to actually do this, to set up these types of flows.

• 31:27Auren Hoffman?

  So, okay, people are listening. A lot of people are probably like super alarmed, like how alarmed should people be?

• 31:33Speaker 00

  You know, you should be alarmed enough to try and embrace some of the AI technology you can to bolster your, your defenses. You know, as I mentioned, if you're, if you're in a company, you do have a huge data advantage, right? You have a fortress of data. I think it's time for you to start actually implementing some of the things we've been talking about for a couple of decades now. Like I mentioned, we have this principle called zero trust, you know, which is you may hear bandied about and it just means instead of having a firewall and everything past the firewall is good and everything outside the firewall is bad. You respect the fact that you're probably breached right now. And you need to look at every single action that occurs, every transaction and make sure it's, it's safe.

• 32:14Speaker 00

  So I think it's, it's time to step up our game, but I do think we're going to see with our period now where there'll be a lot of vulnerabilities in software that expose very quickly with some of these new AI agents. And I think that we're going to, you know, there's going to be a period where they'll be exploited. And eventually we'll come out the other end where there'll be defenses will have been erected and holes will have been plugged in. And, you know, perhaps some new software will be developed to replace it. But I, I think that's going to be a, you know, a very difficult period for, for some organizations. And then, you know, I also think with the rise of Agentic AI, we're going to see all kinds of new thread vectors. And it's, it's completely worth it because, you know, agents are, they're delightful. They're great to work with.

• 32:58Speaker 00

  They can improve efficiency. You know, they have some, they're sometimes frustrating, have some downside, but the promise is so great that it's worth it to just plow ahead and fix the security issues, you know, that, that we, that we all, we know about. As I say, you know, I think we have a lot of technical debt in, in identity security. There's a lot of things that we've known we've had to do for a long time. And now this is just time for us to do them, right? So it's, you know, you call it a wake up call or call to arms for, for the industry.

• 33:27Auren Hoffman?

  When I'm writing the different applications that I'm involved with, I, I usually want to have like, I'll have something like Fable attack myself and suck it and like look for vulnerabilities, do all these things. But then Fable often will come back to me saying, oh, I can't do that. I'm not allowed to do that. And then I have to almost like spend like 30 minutes tricking Fable to be able to make, to, to attack myself, which I should have the right to do, right? It's my code, it's my stuff. I just want to, I want to just make sure that it's secure. Like any advice to working through that?

• 33:59Speaker 00

  I'm wondering if there's even like a little bit of marketing involved in making it a little bit too vigilant about, you know, not letting people, you know, look at anything having to do with cyber.

• 34:10Auren Hoffman?

  You don't want to ask a medical question. I have to, I have to downgrade to OPIS to ask a medical question. I'm like, what the heck? You know, it's like this myself.

• 34:17Speaker 00

  I haven't seen like bots like produce a lot of biological research. And so I'm, I'm not even sure that's, I'm not sure they're even as much of a vector as some knowledgeable person doing an internet search and looking for these things. I'm not an expert there, but I think they, they may have tightened up those controls too much. I've, and all I can say is I've done the same thing as you, Orin, you know, just to get some basic work out of, out of Fable that has to do with cyber. And I don't want to divulge any, you know, tradecraft on this podcast. I'm entropic come after me or, you know, or be used by people that don't have good intentions. But as you said, the, the fact of the matter is it is still possible to get around the, you know, the guardrails.

• 34:59Auren Hoffman?

  If you're just giving advice to the average person, average smart person, they've got a password manager, they've got their two factor stuff, they're using the pass keys. They've got the safe word with their family. Okay, they've got that done. Okay, let's say check, check, check, check, check. Let's say hopefully already 95% of people listening already have those things done. What's the next thing that like your, your friends should be doing?

• 35:27Speaker 00

  Well, if, you know, if you have those, that pass key in place, you know, protecting your email and you have a safe word, that's, you know, 98% of what you need to do to, you know, block an attack. And I think, and the other thing you might want to do is, you know, talk to the people in your family or people you work with who may not understand how prevalent and how easy it is to be frauded by Dfix at this point. And just admit to them, you know, a lot of people, they, they see something in video, seeing is believing. And they just, they need to understand that you can't believe your own lying eyes anymore.

• 36:05Auren Hoffman?

  Even if it's like, if you think it's real time on a screen or something like that. And then of course, you know, we're going to have these like glasses that are projecting stuff soon. So then you don't even know in like real life, what you're seeing, if they can like, someone can get into the glasses. So it's going to be a very interesting world that we live in.

• 36:21Speaker 00

  You're, and you're, you see something like that, even if you know it's fake, your gut tells you it's real, right?

• 36:26Auren Hoffman?

  How are you personally using AI in your day to day? Like what are you building for your, yourself or your life or, you know, et cetera?

• 36:35Speaker 00

  First of all, it's my interface to all these SaaS systems. As I said, you know, I'll go through, you know, I have natural language interface.

• 36:42Auren Hoffman?

  But it's a great way not to use all these crappy SaaS tools. So

• 36:45Speaker 00

  Oh, my God, yeah.

• 36:46Auren Hoffman?

  These tools are so terrible and they're literally like, they take years off your life. Like, you know, Salesforce and all these other tools out there. So if you can use AI to just never actually get into their UI, that's great.

• 36:59Speaker 00

  Exactly. Yeah. I mean, I mean, you could make a case that maybe their UIs are good for like really uninitiated users to kind of guide them. But if you kind of know what you want and you have to go through those interfaces, it's just all. And the other thing is if you're trying to deal with your, your customer support database and your sales database, you know, and deal with a spreadsheet, you know, you can just go straight through your agent and have it do it for you. So it's nirvana. Encourage your SaaS vendor, you support MCP, you know, to, which is an interface into, into agents. And to use the security standards associated with them, so we can get more of this available. But yeah, I use it as a basic interface into all these SaaS systems.

• 37:43Speaker 00

  I also use it as a thought partner. And I find that it's often very wrong in a very compelling, interesting way. It can get you to think outside the box. And what I like about a provide coding is if there's some critical part of an application, you know, you need to just kind of code it yourself. But there's parts that, you know, you don't care about as much. If you just want a good enough UX, it can be a good enough UX. I don't have to get a, you know, UX artist.

• 38:09Auren Hoffman?

  Well, you also can make a UX that's like personal to you, right? So what I like about it is like, I have UX that are personal or in, you can have UX personal to Jeff. Maybe the only person in the world that would benefit from that is Jeff. But like in 20 minutes, you can build something that is like so personal and like something you use. Like I have all these like Chrome extensions that are personal to me. Nobody else would want these. They're literally like, it's all, it's a, it's an N of one product, but it's actually like really great for me.

• 38:38Speaker 00

  As long as it's not, you know, precision and, you know, there's nothing critical on the line. Then, you know, these tools are great for generating all kinds of artifacts like that, right? So.

• 38:46Auren Hoffman?

  Last question we ask all of our guests, what conventional wisdom or advice do you think is generally bad advice?

• 38:52Speaker 00

  Some people in security say the weakest link is the human, you know? And I think that's like putting the blame in the wrong place. And basically your security procedures rely on someone, you know, getting a phone call at three in the morning, you know, who's not a security professional to, to understand what they should or shouldn't do. Then, you know, I think you don't have the right security controls in place. And I think, you know, what really exposes this to is these AI agents, you know? So it's, it's no longer going to be, you're not going to say the weakest link is the human. You're going to say it's the AI agent. And no, there's no anti-phishing training videos that you can make an agent sit through that will stop it from, you know, doing the wrong thing.

• 39:32Speaker 00

  So you're just going to have to put controls around it, you know, and not expect it to be a junior member of the, of the InfoSec team.

• 39:40Auren Hoffman?

  You joined Secureoff in December as CEO. Nowadays, like it's more typical, like for the founder to stay, you know, see like, walk us through that kind of journey and how that decision was made and how you were able to stay with it. How are you able to grow that company, joining that company since December?

• 39:59Speaker 00

  Well, I've been interested in, you know, the intersection between AI and security long before it was cool. And what happened with Secureoff is, Secureoff is the, the most important identity security company that nobody's ever heard of. It has a lot of very large, for instance, banking customers, healthcare customers that rely on it for very high end parts of security, not just sort of what comes with a major vendor.

• 40:25Auren Hoffman?

  Because the company's been around for 20 years, right?

• 40:27Speaker 00

  It's been around for 20 years and it has some, some big names you see in, you know, publicly, but it also has a lot of big names there. You know, they won't disclose that they're, they're using it. But, you know, some of the largest financial institutions in the world, as I said, healthcare, you know, government. And what they've said is, we may, we had this talk today about things like, you know, pass keys. And we've implemented private pass keys for some of these companies. We talked about, you know, risk management, we're able to, for people that are remotely logging in, we can use, you know, machine learning and real time risk management to, to make sure that we, the person is who they, who they say they are and they're not a bot or fraud. We've done like a really great job actually of stepping up a security profile

• 41:12Speaker 00

  for companies that are focused on identity. But what happened is some of these large banks, they said, you know, now our workforce is pretty much safe. We say we're with these private pass keys, we've made companies phishing resistant, but really, frankly, I can't say it officially, but they're not going to have any phishing problem anymore, right? And employees don't have to type in 16-digit passwords anymore and remember them. There's no passwords, ever, ever. They never have to, even when they create an account, have to. So we reached a sort of nirvana place with workforce, but now we have hundreds of ghost employees for every employee, and these are these AI agents. And we have absolutely

• 41:57Speaker 00

  no way to control them. And this is the big challenge in the industry right now. And I thought SecureOffice is in the best position, given their deep, high-end technology across the identity spectrum, consumer identity, workforce identity, and now agentic identity, to be able to step up and deliver that solution. So we're working with those major customers to roll out an identity security solution. And also, if you forgive me going on about this, but you know, identity has, in the security community, it's what my kid would call NPC. It's non-playing character. It's sort of something you need to do, but the

• 42:38Speaker 00

  interesting part has been detection and response, hunting down the bad guys. But now with agentic, it's a main character, right? The principles of identity of authentication, authorization, and really what we call authority, which is not just saying you're allowed to do this, but letting an agent do it. That is the crux of cybersecurity for agents, we think. And even these interesting areas like detection and response, I think they'll be based on the behavioral information that identity vendors collect from these agents.

• 43:13Auren Hoffman?

  You come in this company, an awesome company. It had a few CEOs before you that had very short tenures. Like, obviously, there's something like, they're bringing you on, like, what does one do in the first 90 days to right the ship, to make everybody excited, to move everybody forward? Like, how does one do that in a company like this?

• 43:33Speaker 00

  You know, I think that that happened before I came on board, that the people I talked to were quite excited about what they were doing. And it's very technically focused, with a product everyone's proud of, with customers that strongly support it. So it was encouraging that, and sort of stepping out of the way of that process, and pouring the gas on that natural inclination. And I wouldn't have come on board if that hadn't been in place.

• 44:02Auren Hoffman?

  Yeah, it's really interesting. I mean, there are all these, like, there's actually these gray companies, and like, sometimes they just need like a little bit of a rebirth, or a little bit of like, hey, like, or almost like, let them cook type of thing, like, okay, let these guys go, like, let's get out of the way, and let's stop, like, let's just let the innovation happen.

• 44:21Speaker 00

  I talked to everyone, all the principals, and they just said, you know, we have this amazing product, this amazing technology, if only we could explain it. And I talked to the customers, too. The customers were like, yeah, it's amazing stuff. If only we could explain it. So I think that's a great problem to have. I wanted to focus on this space. I've had enough success with some other companies that, you know, I mean, I can have a lot of options in terms of whatever I want to do. I really wanted to focus on this space. I think this is a great base. I think you can only develop this technology with a very aggressive team that's not too big, but you also need to be working with some really significant, serious customers, right, to work out the real issues. And SecureOffice has the right combination of that, right?

• 45:02Auren Hoffman?

  Amazing. This has been awesome. Thank you, Jeff Mattson, for joining us on Sumation. Really enjoyed this conversation. This was a lot of fun. I really appreciate you being on board.

• 45:11Speaker 00

  Me too, Orin. Thank you very much.

• 45:12Auren Hoffman?

  One more thing before we go. I read a blog called Sumation. It's the same as this podcast. The blog is about non-obvious idea sharing on business, talent, data, longevity, and random contrarian takes. If you like the conversations on this show, you'll probably like the blog. It's free. New content comes out twice a month. You could subscribe at orin.substack.com. That's orin.substack.com.