The Real Cost of Manually Governing Applications

Alright. Looks like we've got a good group here that's, that's joined. Let's go ahead and get started. Well, thank you all of you, for for joining us here on a, Tuesday, almost at the end of September. As you see here, we're going to be reviewing today The Real Cost of Manually Governing Applications. And so Neil and I will be going through, well, everything that you should be keeping in mind, at least at a high level, when this is the reality within your environment. We will have a section at the end for Q&A. So if you have a question, feel free to pop that into, the question section. We'll, just let them accrue there, and then we'll address them at the end of, the webinar. So, let's go ahead and jump in. Yeah. Hey, guys. So my name is Neil McGlennon. I'm a Global Field CTO here at SailPoint. And, you know, I really I've spent, you know, eighteen years really advising our customers, our partners, you know, really around a lot of the various, you know, identity security related things in the field. Right? And that's, you know, we've obviously started the early days of SailPoint with the human side of things. These days, a lot more agentic side of things. I think regardless of whatever side of that equation, there's some common themes and common threads and and challenges that we see from customers, and I think that's some of what we're here to talk about today. Absolutely. Absolutely. And, my name is Bel. I'm one of the co-founders here at Cerby, also the CEO. We'll talk a little bit about what Cerby does on the next page alongside a quick overview of SailPoint. But just to echo what Neil mentioned, you know, there's what we were seeing when it was just humans that made up the equation, and and now you have agents, you know, basically multiplying what was going on and moving at machine speed. So it's it's a it's a very good time to be talking about governance of human and nonhuman identities alike. And so to that point, in terms of the agenda today, we're going to go through a little bit of an overview of SailPoint, and Cerby. We're gonna talk about how we work together. We're gonna talk about the cost of manual governance, and then we're gonna jump into an anonymized customer story that illustrates what this can look like in environments. And, you know, really, the point there is you're not alone. The you know, it's a it's a large customer that we're gonna be sharing. And so if these are patterns that you see, we'll walk through how the combination of SailPoint and Cerby helped get them to a better place, and then we'll close with what's next. So that's what we've got on the docket for today. So with that, let's go through a little bit of a, I think, refresher, for many of you in the audience on, SailPoint, and then, of course, on Cerby. But, Neil, if, if you'd to jump in. Yeah. Absolutely. So SailPoint, it it really it's it's whole mission that we started SailPoint with was, you know, creating identity security in a way that, you know, really allows you to kind of secure things with your eyes open. Right? And that starts with, you know, visibility. And, you know, we founded that vision for enterprise-class identity. That was back in, you know, 2005, so quite a while ago. So over twenty years. I've been along SailPoint for eighteen of those years. We have over 3,000 customers globally. Right? We operate in pretty much all corners of the globe. And, you know, around 53% of those are Fortune, you know, 500 customers. And these days, as we kind of, you know, started with, right, we we started on the human side of the the equation. Now we've moved into the the nonhuman side of the equation because, you know, security, like anything, you know, especially identity security, is comprehensive. Right? You can't just, you know, isolate out a specific area. You have to be cohesive. You have to be comprehensive. Right? And so we we cover kind of both the human side of things. We call that human fabric. We call and we agentic side of things, which is the agentic fabric. That's all nonhuman. And to that end, we also built on a common platform. If you hear Atlas platform, platform, that's the platform, the kind of operating system our cloud runs on. We are very cloud-first. We do have an excellent on-premise solution as well, IdentityIQ. And we and and on that platform, a lot of our our partners, just like Cerby here, integrate with. Right? We have an extensive partner ecosystem that expands our global reach. You know, really, you know, security is a team sport, we like to say. Right? We can't op we can't do it by ourselves. No one can do this by themselves. We wanna make sure that we operate and work with our partners to the best of our ability and bring you you and all of our customers all the the best solutions for it. Right? You know, whatever that may be. Absolutely. Well well said. And especially with regard to it is a team sport, because the identity landscape is getting larger. And to your point on the just a moment ago, agents are magnifying the size of it. And so where you can think about where Cerby fits into, the the SailPoint ecosystem is we specifically focus on disconnected applications and disconnected identities. So Cerby is an identity automation platform that focuses on those applications that maybe don't expose standards, like SCIM or on the single sign-on, side of things, SAML or OpenID. And so what we do is we effectively put a wrapper around those applications so that on the outside of that wrapper, it does speak standards. But then inside of that wrapper between serving the application, we use a combination of agentic automation, in some cases, internal API, automation to, be able to automate those actions that otherwise would fall to human folks on the the IT side of things. And so, we ensure that those applications are part of a unified console with SailPoint, as the identity source of truth. We are a fast-growing business. We were founded in 2020, and we're happy to say that we are an inaugural partner in SailPoint's unified platform access program, which was actually launched, I wanna say, about four or five months ago. And so very very excited to be part of the partner ecosystem that Neil mentioned and, you know, bringing value to many, many customers across the very large SailPoint ecosystem. And so, you know, SailPoint is the central control plane, and we help make sure that that we're filling out that access graph. Well said. Yeah. And so as a double click into that, let's talk more about how exactly that could look in your environment. Yeah. So, you know, one of the things that we we like to characterize our approach to, you know, any sort of human or nonhuman type of identity security is kinda looking at it through a three pillar model. Right? And that three pillar model is discover, govern, protect. You know? And if you kinda think about governance solutions, you know, it's kind of the term of identity security of the past, they they kinda focus really on those first two pillars. Right? The discover side of things is all about gaining complete, you know, visibility to everything. And that encompasses a lot of different ideas, you know, application onboarding, listening to various activities that are out in the world. You know, very commonly these days, that's very event-driven, and we play the standards such as the shared signals framework or SSF. You know, when we take all that information in, though, we we wanted you know, we have to do something with it. Right? We centralize that in our identity graph. And identity graph is highly relational. Right? It allows us to see, you know, what person or nonhuman in some cases, right, has what accounts or credentials or access. What access has access and even down to the data level. What data does that mean? And that that graph model is very important because we can distill some very interesting insights, things like privilege. Right? And we could classify things. So, you know, we understand what something means from a, you know, a a data perspective. Hey. This has PII or this has, you know, credit card information or or whatever your your own classifications may be. But also, you know, hey. This is privileged, and this helps shine a light on places that privilege may hide. Right? And so it kind of is that intelligence layer. Right? And once you have that, you're in a really good spot to govern. And that govern area is what really what do wanna what are some of the interesting things you wanna do around this? You know, you wanna review it? That's kinda where certifications come in to to play. Do you wanna put in certain guardrails around things? Like, if you have this, you can't have that. You know? That's separation of duties. Obviously, in that process, as part of this, we manage the lifecycle of these things, the provisioning, the setup of that access. So if you want new access or somebody joins the organization, they go and get that access set up and coordinated. Now those are the first two pillars, discover and govern, but there's this protect pillar as well. And that's definitely more of the security side of things. And, you know, part of SailPoint's mission is to is we're going deeper into that protect pillar. And that means operating in a broader ecosystem ecosystem than we did earlier. It's not just about provisioning anymore, but it's also about being proactive and enforcing policy at runtime. It's also about being reactive, you know, listening to some of those shared signals that we hear and being able to do something about it. Maybe that's a kill switch on an agent. You know, maybe that is coordination to of an activity downstream in a in a SecOps type flow. So there's a lot of different ways you can take that and even into the just-in-time based provisioning area. And that broad ecosystem opens up a lot of doors and sometimes a lot of challenges with customers. Right? They can't reach some of those things. And I think this is where, you know, kind of Cerby comes in. Right? Exactly. Exactly. And and so, you know, to and everyone sees the color coding here, so it's very helpful. But within that context, SailPoint offers very powerful discover capabilities. And so where to think about where Cerby starts within this framework is, it's often the case that you might discover some of these applications where there is some manual amount of work. And they are contributing to the identity graph, but what we often find in concert with SailPoint is there's too much effort involved in contributing that data back into the identity graph. And so anytime you have that manual governance step, that's where Cerby can come in and automate, that process. And, you know, the the mental picture potentially to have is something that's maybe built around flat files. Right? Where there are some number of applications where you're having to go in, generate those flat files and then feed them back into SailPoint. And SailPoint can obviously work with that, but there's the human cost on the team of, well, they have to go and, you know, pull that process. And maybe they're doing every you know, once every three months. And so where Cerby can come in is go and basically increase the cadence or increase the frequency, of that. And so that's again where this theme of manual governance comes into play. And so there are a couple of different ways that we facilitate that. We can do UI-based automation as well as API-based automation. So if, again, there's a process where a human user is stepping through an interface to download the flat files, We can go in and help there. Sometimes these applications exist behind a firewall. We can also, help you with those thick client applications. And as we're generating all this information, we're creating this audit trail where, again, now the sample rate goes from maybe every 90 days to a couple times a day. And so that means that you're getting real fresh data back into SailPoint. And so everything that SailPoint is doing with its powerful policy engine and privilege discovery and classification capabilities, there's now more data to make it more actionable and just be able to do carry out far more workflows there. Now in addition to that, and this is more on the protect side of things, we also have the ability to be able to help with once an account is permissioned and provisioned. We can also help you manage that identity itself from a single sign-on or authentication perspective. And something that we find is a lot of the times those applications that don't support joiner, mover, or leaver, capabilities in an automated context, they might also not support the single sign-on standards. And so that's where we can play within the protect, pillar, and we can help automate that login process so it looks like single sign-on. But even more interestingly, we can also feed certain data points like, hey, this user was permissioned, but they're not actually logging in. And so that gives SailPoint a signal on, hey. Maybe this user should be off boarded, or, maybe there should be a workflow that checks with the user to make sure that they should actually still have that seat. And so, again, we work within the identity graph in these three pillars to make sure that you're getting a even more well rounded view of your enterprise ecosystem and giving more data back to SailPoint to be able to drive more comprehensive decision making. Yeah. And, Bel, this reminds me of a really good quote that I heard. It's not my quote, but I think this was from one of our analysts that I heard secondhand from one of our our marketing folks. But, yeah, the quote was, the organizations that close the loop will prevent breaches. The ones that do not will just continue documenting them. Right? And I think that's pretty profound here. And, you know, I think everybody may be chasing sometimes the regulation or what the the the thing that they need to do, you know, by the time line they need to do it. And, you know, then they don't think of, well, how do I actually execute to this? Right? And, you know, and and how do I close that that that gap? And sometimes that can be fraught with challenges. Right? But, you know, those those are all areas that I I think we can solve jointly. I love that. Our doom to just keep documenting it. That that is so spot on. I'd I'd love to figure out, which analyst said that we can get them on the the record and and push that across the socials. But but so right. And so Yep. You know, to that point about what is the reality if if you're not closing that loop? Let let's talk some numbers. Right? Let let's let's look at what does this actually potentially mean if there are certain loops that you're either closing manually or to to the quotation Neil just shared. You're just documenting them. Right? And and so this is data that was generated in concert with the Ponemon Institute. So it's a report that was released earlier this year. And there are four stats that we believe tell the story pretty well. So let's step through them left to right. Those of you that have seen my presentations before know that I love me some build slides. So let's let's go through this. So based on this survey report that was done by Ponemon, it was discovered across the cohort of of hundreds that on average, at least 30% of enterprise applications are disconnected from identity systems. And then, just under half of those are considered business critical. And, you know, that can include usually, what we find is they tend to be very line-of-business centric applications. Right? These aren't necessarily birthright apps, but it could be, for example, the advertising systems that your marketing team uses. It could be all of the banking systems or a good number of the banking systems that your finance team uses, or it could be CICD tools that your engineering team uses. And so, again, these tend to be often more than not line-of-business tools that are managed by the businesses. And they are critical because they are used by that line-of-business to run their functions, but you're not necessarily seeing them used across multiple functions is what we find. Now the next statistic here is that oftentimes, and this is, you know, also from the Ponemon Institute, that about two thirds of organizations failed an audit, whether it was a quarterly or an annual audit because of gaps and disconnected application controls. And so the audit came through, and, you know, this is actually sourced from businesses that are primarily in highly regulated or compliance-driven, spaces where it was found that there was a manual compensating control in place to manage a key aspect of one of these applications, whether, again, it was joiner, mover, leaver, or just an an annual audit of of who had access. And so that's a pretty high number. Right? The idea that almost two thirds of those companies that participated in this, in this report found that they had failed an audit because of disconnected applications. Now when a failed audit happens, oftentimes, what a company will endeavor to do is to go build a custom connector. And those of you that have been there, I think, Neil, I think when we met quite a bit ago, we we we reminisced on being script kitties and and building these connectors. And one of the issues with with connectors is they break and you need to maintain them. And one of the statistics also from this report was that thirty one hours was being spent per week maintaining those scripts. And so, you know, there's that hidden ongoing cost when you go the route of a custom connector of going and eventually spending most of your time on maintaining what you've already built. Yeah. We definitely see that, you know, across our our our customers too where, you know, you end up with best intentions at the start. Right? But then you kinda forget about the long term maintenance of some of those things. And this is really where complexity hits you. Right? And, you know, we we have one always should try to strive away from that complexity, whether that's, you know, trying to get things more in the box, trying to use established connector to removing some of the complexities or, you know, switching to other means that alleviate some of the workarounds you're having to do, whether that's, you know, coming through as technical debt and maintenance or that's manual herculean efforts that you shouldn't have to do in the first place. Right? Exactly. Exactly. And and to that point about technical debt, what we find is you you never really realize that that technical debt is going to be a big percentage of the total cost of ownership. And so when you take that on initially, you don't realize that, you know, if we're talking about one person, thirty one hours, let's say it's a forty hour work week, that's 70% of that person's time. And so it's that hidden total cost of ownership. And then, you know, also to that point, if you've not developed that custom connector, and you are still running a manual, compensating control, in some cases, it can take fifteen hours to onboard or offboard a single employee, and those are business hours. And let's talk about the cost of that. Right? Imagine, someone comes into the office on Monday, and it's a disconnected application, and they request access. That basically means they're waiting two full business days, to get access to that application. And that that's a real cost. That's a real headwind of someone sitting waiting for access for for two days. And so it's not just the impact to the IT person who's responsible for this. It's also the person waiting for access and the lost productivity, that comes from not being able to get access immediately. I know this says onboarding here, but if you kind of look at it also from the offboarding lens, I would assume it's probably something similar. Right? And think about that long tail on the offboard. You wanna shut somebody down immediately. You know? If it's their last day, you wanna close that gap as soon as you can. And fifteen hours, as you put it, it's more than one day. So you don't wanna you want them if it's their last day, it it should be their last day. Exactly. Right? It's it's and, you know, to that point, I was reading a report from CrowdStrike that was talking about the fastest time to breach now is twenty seven seconds, but on average, it's about thirty minutes. And so exactly to your point, Neil, any orphaned access that the IT team is not looking at, it's now an exploit window when you have agents that can move from a vulnerability to an exploit literally in half an hour. Right? So it every second counts. Yeah. If you look at any of those those AI-based incidents, you know, they're moving in seconds. Right? And then if you put a manual process in there even, you know, top people talk about human in the loop and things like that, and I think that's it's that's kind of the a shortcoming. But, you know, you you have to figure out ways to automate this stuff, and there has to be solutions that thwart some of the manual side of things. And I think, you know, the the solution here is fairly compelling if you get the right solution like Cerby in place. Right? Absolutely. And, you know, obviously, Cerby in combination with SailPoint, and that's what allows you to close all of these loops. So with that in mind, and I I I think we've kind of already hit on this this topic, that a tickets or spreadsheet-driven workflow. There's a lot of cost hidden in a process that is is driven by such a workflow. And so with this in mind, let's put a real customer shape to it, an anonymized customer shape to it. And so here is a joint customer of SailPoint and Cerby that we helped move to a much, much better place. And and so let's talk about the shape of the customer. Global ecommerce business with about 20,000 plus employees. They already have SailPoint ISC in place and a separate solution for single sign-on, but they had actually gone through an audit process. And the audit process had found that there were 50 applications that were being provisioned by hand, and 20 of those applications, were considered within scope of SOX. And so that was a that was a the problem. And two of those applications were also thick clients. And so this was, you know, to the previous slide, an example of a customer that had gone through an audit. They had failed it. The exception was not going to be accepted or extended by their GRC team, and so they needed to find a way to automate this manual compensating workflow. And what did that workflow look like? It's what you see over here on the right hand side where there was a ticket, right, that was raised in their internal ITSM team. That would then be transferred to the IT person if they had access to the application. But for some of these applications, they're actually owned by the business owner. So the ticket would spawn sub tickets and then get reassigned to some of the app owners. And then the app owner, once they received the the ticket, they'd, you know, go in into the application with their admin logins and create the users. And then once the user was created in the console, either the IT admin or the IT the I should say, the app owner in the business would go ahead and set up the account for these users. And then on the flip side, when someone was being off boarded, there was actually one application where off boarding required going to three places. And sometimes they wouldn't go to all three places, and so the user would still be permissioned. And then everything that's happened here, they have to collect the audit information to prove that it happened. And so you're basically paying for the manual process three times. You pay for it on the ticket process of creating the user. The end user pays for it when they're setting up the account, and then, obviously, there's the operating process. But then you have to have the evidence or the collection that it's occurred. And so this is a sample shape of what a manual process can look like. And we do see this, you know, across a multitude of customers. Right? Especially large customers that, you know, tend to be very siloed sometimes. Right? Or they have their own process or sometimes internal politics or even business lines that don't talk to other business lines. Right? And so they have trouble spanning those business lines. And and so it makes things like automation, while there may be capabilities there, it's kind of more of a political question than it is a technical question. Right? And so I think this is where we go, oh, we'll just create a ticket. That'll that'll work, but then they forget that the actual hidden costs that come with that. Right? Absolutely. Absolutely. It's the ticket is the manifestation of a manual process without without question. And so let's generalize a little bit from this customer example. And on the next slide, we're we're gonna talk about how SailPoint and Cerby helped move them to a fully automated closing of the loop. But just so that we can distill how to think about some of the the the key manual friction points. One is deep provisioning. As we mentioned for that one of those specific apps where you had to remove the user in three places, the the access would linger. Right? And that was actually the highest risk, because some of these applications were exposed to the public Internet, and so they that that's a problem. Another issue that was identified in the audit is that when you had a human doing the permissioning, sometimes they would be mispermissioned. And so, we won't show the share the exact percentage of the time, but it was double digits where the user actually received the incorrect permissions in the downstream application. And, you know, when you're doing dozen, dozen things at a time, this happens. Right? To error, to humanist to be humanist to error, think, is the expression, and and that's what you're seeing here. Then a good number of these app oh, sorry. Did you wanna jump in? No. No. No. I was just agreeing. Yeah. And and, again, you know, this happens. Right? Like, there's no pointing of the finger. This is just what happens when you have a manual process. Humans are human. Exactly. Exactly. Now a good number of these applications not only were not connectable from a joiner or leaver perspective, but they also had credentials. So not single sign-on enabled. And so there was this whole other process of for these applications. The IT folks were also at a regular basis having to reset passwords, and so there's this whole other overhead associated with that. And as we already mentioned on the previous slide, as you're going through every single one of these tickets, as you're going through every single one of these motions, you have to be able to provide evidence that you're properly managing these applications, which is critical in a SOX environment where you're you are, have to be compliant with SOX. And so that's how to think about the four buckets of of issues or the four main friction points. And each of these in turn then becomes more complex if you're dealing with one of what we what we call the hard mode app hard mode apps on the right hand side. Maybe it's a thick client because they still exist. And especially if you're in a highly regulated environment, whether it's health care, financial services, or pharmaceuticals, they make up at least a double digit percentage of your application ecosystem. Sometimes the applications are behind a firewall. Sometimes their financial systems where the form of authentication is tied to an individual's passkey or phone number. Or, you know, sometimes it's in a controlled environment that is kind of like being behind a firewall, but it has its own peculiarities in terms of how it's accessed. And so this is how to think about a generalized version of what some of the manual friction points are. But the the the key kinda takeaway here is the apps that are governed manually are most likely to be the ones that the auditors are gonna care about the most. And and so that's exactly what you saw here with this anonymized customer example. So let's talk about how Cerby and SailPoint helped move this user from a place where there was a lot of manual, governance and manual closing of the loop to, being able to run these workflows automatically. So on day zero, we started with an understanding of what was the manual workflow. Right? What what were they doing? And roughly two weeks later, we had we had the end to end going for the first application where from within SailPoint, they were able to now permission a user against one of their hardest on-premise thick client applications. And it was magic. Right? The fact that they were able to, again, from within SailPoint, follow the standard workflow that they'd already created. And on the back end, SailPoint would send that SCIM call to Cerby, and then Cerby would go and do the work and then report back the successful event. In the next two weeks, an additional four applications, were added. One of them having a single sign-on service account, and that's just to say that one of these applications didn't support a single sign-on. In an additional two weeks, five more applications were added. And then by the end of month four, we were able to get the 20 SOX applications live. And so some of the things to flag here are the speed. Right? How quickly this many applications are being added, but also the ease of use. Right? The power of having everything in the central control plane of SailPoint. But let me pause there, Neil, in case there's anything you wanted to mention on the left hand side. No. I I think that, you know, this is, you know, pretty typical what we see from customers where they start, you know, and, you know, you and this this can continue to scale as they mature. Right? And, you know, obviously, you know, you kinda build out what that identity graph is for that Discover lens, but then you're also coordinating all those actions. And, you know, Cerby just becomes an extension of that platform. You know, we have lifecycle states and workflows that can trigger on those joiner, mover, leaver processes that are all intertwined. And, you know, those can get more complicated with the more applications you onboard. And one of the things that we've seen is that the term application onboarding, it's very loaded term. Everybody uses the term, but everybody doesn't use it equitably. Right? They're not it's not equitable across all of our customers. And so some people, you know, use that term to not only talk about connecting to the system, but also automating the provisioning of it, maybe even injecting other process such as joiner, mover, or leaver, sometimes other processes as well, sometimes policy and roles and other governance processes and security processes. So, you know, everybody's definition of what that means, some of sometimes it's very compact, but it's very large scope. And no one's right or wrong in that. It's all just what is the scope of what you wanna achieve. And I think what you have to do is look at all the various tools that you have in front of you and figure out the best path for those things regardless of what your goal is. Right? And some of those that long tails can be very, very challenging. And I think this is really where, you know, Cerby and SailPoint's partnership is really good because, you know, you see that architecture. Right? You have things behind firewalls. You have certain maybe domains where, hey. That's a business partner. I can reach their systems and I can aggregate from it, but I can't act on it because they don't want me to actually write to their systems. It's really read only. And so, you know, there can be business reasons, political reasons, you know you know, even technical reasons there, all sorts of different reasons, and they shouldn't get in the way of your maturity. Right? And, you know, this is really fast time to value. Right? Thirty days, you're already running with this process, and that's a foundation to help you grow and to manage any other things that you that may be stuck. Right? Absolutely. And absolutely love that. And one of the things that you mentioned that I I definitely want to kind of press down on the scale on or or emphasize is the idea that app onboarding can mean different things in different contexts, but it doesn't have to be. And I think the best version of this is where you come up with a consistent definition of what it means to have an application onboarded, and then it's applied across all of your apps. And that is the power of SailPoint and Cerby here, is to your point, Neil, everything that's long tail, some of those really difficult applications, maybe that they're on-premise that you have, a consistency of the data that's being contributed to the identity graph in SailPoint. So, again, you have a consistent view and a consistent ability to be able to govern each application equally and similarly. So with that in mind, let's talk about where we're taking this customer next. And some of these things, I think, are are exciting previews for SailPoint Navigate next week. So Yeah. Just a shameless plug. If you're in town, you can learn more. But, please, if you wanna jump in. Yeah. Yeah. Very timely here. And, you know, we were just kinda talking about maturity. Right? There's a lot of different paths to maturity, and a lot of it kinda depends on what is what is your priority. Right? And, you know, obviously, are are very top of mind. You know, when we talk to other cybersecurity executives, that's definitely one of the first and foremost things that they talk about. Right? How to secure them? Because speed is of the essence there. We see incidents happen as we mentioned earlier. They happen in seconds. You know, if you look at, like, put the Pocket OS breach and things like that, you know, nine seconds it took for that to happen. Right? And so, you know, you you what if you rely on manual process or or human in the loop, those things will fall down. And so, you know, expanding into that by leveraging fabric is always very good. That's a lot of times we're we're seeing a lot of customers go into now. And then, obviously, if you want to, you know, action that, we have certain capabilities, obviously, in that agent fabric capability there too. But if there's things that are more difficult or things you can't touch because of business reasons or, you know, there's other you know, the hard mode, like like Bel talked about a second ago, that's where we could hand off to a Cerby, right, and and let it go from there. And, you know, we also have, you know, a Harbor Pilot on that that type of platform. And what Harbor Pilot is is kind of our agent. And so this stuff doesn't have to be, you know, hard to invoke either. Right? As we have all this information, it's at your fingertips. You can ask the agent. You can ask the harbor pilot, you know, hey. Give me this access. And that access, you know, could be fulfilled by SailPoint connectors if you have a direct connection already established. But if you don't, if it's, like, one of those hard mode apps or, you know, all the various reasons we've mentioned, that could actually go to a Cerby to to to go in and handle as well. You know, on on a as a basis for the both the agentic fabric and the human fabric, we've been revamping our policy engine. And that policy engine allows for that real-time protection and enforcement. It also we've we've done an a revamp of our existing separation of duties engine using that same policy engine. And so that you know, we we leverage that and our next-generation access certifications here really to to to help, you know, modernize the the next iteration of governance. And, you know, all this is built with MCP front ends. Right? So you can plug it into other agents. You can have agents orchestrate agents, things like that, and, you know, streamline the the user's administrative tasks. And, you know, as a sneak peek, you know, one of the things we'll be talking about at Navigate, and I highly encourage you to come if you can, is we talk about things like the autonomous identity security posture management. That's one of things we talk a little bit about. I'll I'll put a pin in that. But, you know, essentially, you know, you you when you bring all this information in, you have to you have to reconcile those priorities. Right? And then once you reconcile those priorities, you understand where those are, you can execute towards those, you know, autonomously. You can execute toward those, you know, manually, but you still have to execute towards those. And, again, that can be part of the execution engine that is either SailPoint or Cerby. And, you know, we we don't particularly care where that control plane, as Bel mentioned earlier, but all that can go out and and make sure it goes where it needs to go, but at least you're you're you're saving on the right return on investment, the right total cost of ownership, all of those variables that really matter to make your business streamline the way it should be. Absolutely. Absolutely. And so, you know, within that framework of of what Neil mentioned, here are some of the areas where Cerby complements or provides further unification. Some of these applications, not only were outside of the identity perimeter from a manual governance, you know, joiner, mover, or leaver perspective, but we were also asking the users to manage credentials. And so one of the other items that we're enabling for this customer is when they get permissioned, the Cerby system, the automation system can receive the invite, go into the application, set up the account, and then publish a single sign-on tile to their single sign-on dashboard. So for those non-SSO, non-JML applications, the user actually never sees the credentials. And this is magical because, you know what, the IT team is also not getting password reset tickets, for this. So that's one of the new areas in that protect, pillar, where where Cerby can can augment the the overall value proposition for the customer. We're also doing, continuing to invest in areas around the maintenance of the connectors. Right? We've talked about total cost of ownership as being one of those hidden anchors tied around, the the ankle of when you do a custom connector, you realize that three quarters of your time, just a little bit over, is spent on maintaining those connectors. And so Cerby's self-healing engine that goes ahead and heals these integrations without a human ever having to be in the loop from the customer side. And then also make it possible for customers and partners to build some of these integrations themselves, so that you've got, again, more of those applications synchronizing more rich data back into the identity graph on the SailPoint side of things. And then maybe one additional item we'll mention within the agent fabric components that that Neil mentioned. Depending upon which ratio you wanna cite, whether it's the one to 50 or the one to a 120, there are a lot of agents out there and they are moving at machine speed. And so Cerby is also investing quite a bit in making sure that those agents that are interacting with disconnected systems that Cerby can expose a control point to SailPoint to make sure that they are governed in the same way that human identities are. And that's everything from putting an MCP server in front of systems that don't have MCP systems to making sure that there's a kill switch that can be activated on the SailPoint side, propagates through Cerby, and then, you know, Cerby does its part for all of those disconnected systems that agents are are working on, and that's our agent broker capability. And, again, another stuff. Yeah. No. Absolutely. If you wanna learn more, we're at SailPoint Navigate next week, and we'd we'd love to share more about what we're doing in concert. So with that, let's get a little bit tactical. What can you take back from what we reviewed today to your team? And so first is the inventory. You can use SailPoint's discover capabilities to build that inventory of everything, all the applications in your environment. And once you understand what those applications are, which ones are manual? Once you've done that, you can rank by blast radius. You know, you're you're probably going to want to prioritize the ones that are most likely to be picked up in an audit process. And, Neil, I know that's something yeah. Go ahead. Yeah. It's it's funny too because, like, you know, there's actually a question in the Q&A, so I'll hit this head on because it's very topical here. It is you know, when you get all this information in, there is that question of where do I start, which is the the the genesis, I think, of Jessica's question in the in the chat here is where do you know, when you have all these things, where do you where do you go? And, you know, I like to look at it very different ways as you you have different lenses you can apply. And and, again, it kinda depends on your organization where which which one you focus on first. Certainly, blast radius is a is one you can focus on. There's kind of what is the most material thing I I can focus on. There's also what is the most opportune thing I can do. Right? Like, what is easy? You know, I can go do this in ten minutes. Let's go do it. Right? And then there there's stuff that is, you know, necessary. Right? What are the things that I really have to do because it's sort of maybe a board edict? You know, your CISO said so. Whatever that may be, those are things that you you must do. And sometimes that's where you know, any and all those places are are places where you have things that can be difficult. Right? And, you know, often oftentimes, when, know, you have you look at it through those lenses, you go, here's what I need to do for the business. How easy or hard is that to do from a technical perspective or, you know, from a connectivity perspective? And sometimes that's where you start to figure out where where some of these harder things live. Right? Absolutely. Absolutely. And we see the questions coming in. This is great. Let us just maybe finish this final bullet, but that that question came in at just the right time around. How do you know what to prioritize? But once you've prioritized it, once you've connected it, you then have the ability to complete the graph. And and that's again where it gets very exciting when you have a complete identity graph or at least a more complete identity graph. That's where you start to be able to drive consistency of process and automated closing of the loop. And so that's that's tremendously exciting. And so we've got a number of questions here. Let's go with the first one here. I'm just gonna read aloud, and then we'll answer. How does Cerby handle applications with no web interface at all? When 32 thick clients and terminal-based apps, like 3270 or 5250 mainframe sessions, specifically can provision, deprovision, and pull entitlements for access reviews and are those, or is coverage limited to browser-based applications only? So great great question there. So Cerby can work with browser-based, thick-client-based, mainframe-based, mobile applications, and really manage to n t any interface, whether that's a UI, you know, set of internal APIs where Cerby's looking at network traffic or, in some cases, even interacting directly with the database. And so for the most part, we we are able to integrate with every application. That's our wrapper. And then on the other side of that wrapper, we expose a SCIM interface or an API interface to SailPoint, and so that's how we close the loop automatically. And so we can handle applications with no web interface at all because we have the ability to look at network traffic and replay the network traffic or interact at the the database level. Anything else you'd add? That's right. Yeah. No. It's it's No. No. It's very interesting. And then, you know, the the the cool thing there is, again, that all the entitlements we gather, they're collected and and sent right back to SailPoint. And so all of a sudden, that application where maybe you're going through a painstaking process of collecting the flat files, Now that's just automatically flowing into Cerby without any human anywhere in the loop or any dependency on the human to close that loop. Excellent. Alright. Let's go through the questions here. One more question. And and, Neil, this is a a question for you. Any interesting previews that you can provide around product updates next week on the agent front that SailPoint's going to be announcing? Yeah. So one one thing I can say is that our SailPoint Agentic Fabric, we well, I think back in June, we we kind of talk we announced that to the world at the at Nasdaq. Right? Couple weeks later, we also announced the the acquisition of Entro tech technology, and that's some fantastic technology there. Tremendous team. There was a a really good match for SailPoint. We were hoping that those two would coincide, but they unfortunately didn't. But we closed that that acquisition kinda mid July. Now, you know, Entro is key technology that flows into that SailPoint Agentic Fabric solution. SailPoint Agentic Fabric has actually gone live already. That was the fastest incorporation of an acquisition and its assets into our cloud, and all that's been done vis a vis our Atlas platform. We can really move pretty quickly. And so, you know, part of that, you know, is that we've gone limited availability as of the twenty second. So a little over a week ago or or early this week. So it's, you know, it's already here. You'll be seeing and you can, you know, look at it and and demo it, and you'll be seeing sessions at that at our Navigate in Austin next week and also the regional navigates thereafter. The the the actual go live for that general availability will be November 2. So right around the corner, we're we're in a kind of that that middle area right now, making sure that we have everything all set for Navigate. We can get everybody's hands on it. And there's a lot of other exciting updates as well that that, you know, stuff around IdentityIQ. You'll hear roadmap updates. You'll also hear some of the new advancements we we have coming to our SailPoint Human Fabric as well. So there there'll be a lot there. I don't wanna spoil all the fun. I'll let you guys attend those. I think some of the Navigate stuff will also be, you know, livestreamed and available on-demand thereafter too. So if you can't make the event, you still get the goodies. Right? Fantastic. Hopefully, we'll see everybody there. Yeah. Yeah. I know. I'll see you, though. Absolutely. Absolutely. Well, that is a great point on which to close. Please join us virtually or in person for SailPoint Navigate next week. A lot of exciting announcements coming your way. We do have a couple of other questions that did come into the Q&A, but we'll follow up with those async. But so I'd like to say thank you all so much for spending some time with us here on a Tuesday, and we look forward to seeing you all next week if you're able to make it out to Austin. Yeah. Thank you, guys. Good talking to Bel. Likewise. Thanks so much.