Name: Customer Panel Discussion
Uploaded: 2026-05-12T16:48:26.552Z
Duration: 35 min 8 s
Description: Customer Panel Discussion

Transcript for "Customer Panel Discussion": Thank you, Vibhuti. Hello, everyone. We just spent the last hour pulling back the curtains on Sabian's identity security for AI, and the energy in this room is electric. We have talked about the why, and we have demoed the how. But we all know that in enterprise world, vision only matters if it survives the reality of global production environment. As we move from static parameters to a world where AI agents are acting as our identities and L and M's are processing our most sensitive data. The stake for security and governance have never been higher. To help us bridge the gap between innovation and implementation, I'm thrilled to be joined by two leaders that aren't just watching the AI revolution, but are architecting it. Please join me in welcoming our design partners from UKG, Ajita Chaudhry. Ajita, can you please introduce yourself? Sure. Hello, everyone, and thank you for having me. I'm really excited to be here, especially given how quickly agentic AI is evolving. I lead identity at UKG, where we are focusing on securing identity across workforce, nonhuman identities, and increasingly now, AI driven entities. For the last couple of years, we have been focusing on identity program at UKG. Not only have been focusing on human centric model that can support, but also, machine and AI identities at scale. With the rise of agentic AI, the shift becomes even more significant. We are no longer just managing identities. We are securing entities that can act and make decisions and interact independently. This fundamentally changes our paradigm on just identities to identities and entities. Thank you, Ajita. Thank you. And from Hertz, none other than Arun Nana. Nana, can you please introduce yourself? Yeah. Absolutely, Nupur. I'm equally thrilled to be here with you all, wherever you guys are in. Good afternoon, morning. So I'm I'm Jana. I head the entire global identity space at Earth. We manage all identities, including mission identities, customer identities as well. My teams work out of different locations across globe. We manage both customer as well as workforce identities. Thank you so much both for joining us today. You have been in the trenches with us as we developed this AI driven governance tool. You have challenged our assumption and pushed our road map to ensure these solutions solve real world friction and not just theoretical risk. I know our audience would love to learn from your journey and experiences, so let's drive right in. Do you think that you started by treating AI agents as identities? If not, why? What mindset shifts did you have to fight with? So I'll take this question first. Honestly, no. We didn't start out treating AI agents as identities. Early on, we started treating them more like extensions of applications and more like an application or an APIs. The problem with that mindset is that you lose accountability. Quickly, we started realizing who owns the actions, what permissions are in place, how do you audit them effectively. We were not able to answer those questions. And that's when we started re recognizing that AI agents behave much more like identities than tools. They take actions, access data, and make decisions and perform actions based on those decisions. That's what we shifted and held and and then we started treating them more as identities as opposed to, tools. And then we started enforcing, overlaying core identity principle, life cycle management, least provision, governance on top of it. That fundamentally changed in how we approach security. I agree with Ajita. So, to be honest, none of the enterprises, larger enterprises, would have started, treating AI agents as identity. Right? So they they treated AI to enable their business, to fast track their business functions. But this capability is also bring the equal and security threats. So when the threat landscape changes, when things go beyond our control and there are a lot of people coming up with the new AI tools and agents, LLMs and language models on a daily basis, equally the security domain also keep changing. We need to keep in front of it to make sure we we not only enable our business to perform or to function, but we also give them the secured method to to enable that business to our customers. Having said that, EAI has always been a forefront for us in terms of how we run our business. Technology drives our fleets, technology drives our customers' interaction. We even do some of our rental business through through AI agents and chatbots. So there's so much business enhancements and happen. At the same time, this will become more problematic if we don't look at agents as important, openness and the different, different cloud providers, cloud enablement, on prem, data centers, everything is open. We it's a it's a lot of AI agents and large language models coming in and MCB servers deployed all over the world. Very important to have an AI agents and related components treated as identity so you can bring bring this identity centric security around this. Very well said, both. And did you say that we can use agents to book cars? That's exactly what I'm gonna do next. And, Yana, you got to. We we can eventually. Right? So, we it's it's in our it's in our, DNA to enable our customers the best way to operate, the best way to interact with. That is so fair. And, Nana, you brought a very good point. At Cvent, we strongly believe that there are two aspects, when it comes to AI. AI for identity security, which is more focused on enabling our identity security to do more and quickly. And the second part is, of course, identity security for AI. You want to enable you wanna increase your productivity, but securely. But so let's dive into the first format. First of all, huge congratulations on going live with agentic AI onboarding. I know you do drove our team really, really hard to make this a reality. Why were you excited? Tell us your plans about it, what you were able to accomplish so far. I would love like, our audience would love to hear more about it. Yep. Thank you, Nupur. This is a very good question. Where do you start? Right? Where did I started on this journey? So some little backstory, I've been doing this identity for more than two decades. The most important challenge we face every day is how do we onboard applications faster? And how do we reduce frictions and efforts from our business partners and application owners so that we could take most of the work and onboard them? Especially with the legacy products, legacy platforms, mainframe, and Tandem requires a lot of effort from both sides. To when I when I took over this role at Earth, we were doing this this access enablement provisioning five to ten days, impacting our product as, effective to to be to be proactive on a day one was indefinitely a it's a big challenge. So when I started looking at serving and offering an agent based, agenda AI based onboarding, it was a little definitely an eye opener, and I really wanted to jump in and explore it. And then I was also offered a design partner to help to build it along the way. It was as a journey. So we partnered with the part team and worked with the CTO, Vibhudi, And then we've been designing this from the day one and to make things work for an enterprise grade applications, especially the legacy legacy technologies. In my case, I use this in nonstop hosted applications. Obviously, there is no there is no way to do the direct connectivity there. Using any IBM tool, difficult for connectors. You can do make it work, but it needs a custom development. It takes time to build. With this enablement, we could do layering over, different components of Saviynt along with agent AI. Most of the 90% of the work we took care of it. As a Saviynt engineer, we were able to do most of the work, limited our application team's efforts and uptick, it went down a lot and it helped us to fast track the onboarding for our mainframe and non stop. And eventually, we brought the the metrics from five to ten days to to minutes. Not only that, our our evidence collections and audit enablement, all of them become more easier because this this is more all of them become connected applications for us. Disconnected applications, we all know, requires, data extraction from the endpoint, data extraction from the VPN, merge it to to to raise a campaign, merge it to report to audit. There's a lot of work goes in. This all got solved, with this agentic AI based onboarding when when these apps become more connected applications. Most importantly, my business owners and application owners are not going to do a lot of work. My team took care of most of the work. And very simple prompt based onboarding to the the LLM and the MCB server. So it was it was a it was a really good opportunity for us to learn, and then we shared our our industry experience and our our, environment details so Savant can build along with it. It's a win win situation for us. Definitely. We we, at Saviynt, we design with our customers to make sure that we are not solving any theoretical risk as I mentioned earlier. It's all about solving the real world challenges. And thank you so much, Niana, for sharing your story. That is definitely a big pat on the back for us to make sure that we are building the solutions that making an impact in your environment and helping you do more with the resources that you have. Let's move on and talk about, yes, AI is great. It has helped a lot when it comes to identity security processes, but you have to make sure you're doing it all securely. Let me turn over to you, Ajita. As design partner, what stood out to you about Saviynt's willingness to build specifically for AI driven identity challenge challenges rather than retrofit old models? So what what stood out for us is Saviynt, was not trying to retrofit or force fit AI into existing identity models. Those conversations early on could have easily gone the other way. And you could have said, take what we already have, stretch it, and use it for your AI purposes. But that's not what happened. Saved stepped back and said, let's rethink what the basics look like. So we started thinking about how to represent human and AI identities. Do they fit in human noncategories? But then criteria is they don't completely fit in nonhuman categories or purely human categories either. So there was a hybrid for, AI identity. And then how do you manage dynamic access? Because most of the, identity paradigm was static access, not dynamic access. And what governance even looks like when something can act on its own. From a design partner standpoint, those matter to us quite a bit. So having worked with us rather than pushing us into a model that frankly wasn't built for that. Even now, the reality is no one has a complete answer yet. There is still metro playbook for agenda. Yeah. Either still maturing as in as we speak. And but Savant is on the forefront of it. It's working with, the companies they already have and their partners to try to break the traditional IAM model approach and actually build something that's specific for AI identities. And having a partner that recognizes that there is not a old traditional IAM model that will work and willing to figure it out alongside us and as things evolve, and that makes a big difference, folks. Jana? Yeah. I agree, Ajita. It's absolutely, well said. So what stood out for me specifically, what Saviynt offered was the biggest partnership. Willingness to to cooperate with us and an industry develop an industry grade solution. Right? So, I was to be honest, I was not so much, thrill oh, what I'm going to get out of this? Right? Let's try out. So when I started doing more and more work with the saving part part and product teams and engineering work, and then I realized these guys are very serious. Right? So they are seriously solving a problem that had been a long term. Tomorrow, if we ask what should we do in terms of enabling these customers, ideally, I would like to see if somebody joins an organization in a specific department going to manage different specific application, I should not be going to save and then request access or do a both. Within a prompt, I say, okay, x and y joined the team managing these apps. Give them all the relevant access whenever they need them. As as Ajita said, more dynamic fashion. Right? That's where this is gonna evolve and, you Sabian really step on the right direction to enabling the businesses to get to the right way. That's actually pushed me a lot. So that kept pushing me. It's a it's a as I said, it's a win win. Right? For me, it's a, I need to meet my goals. I I wanted to solve my problem for my business owners and application teams to solve make them productive, effective, and, onboard faster. At the same time, Sabian is solving a bigger problem in the world, which is related to IDM IGA onboarding, which is more aligned. That stood out that partner stood out to me really well. Yeah. You you both of, both of you got a very good point that our whole environment shifted drastically from last one year or so. Right? Now you are they are like, you're talking about AI identities. They are no longer in design. They are already in embedded in your workflows. So that brings me to the next question. How does having visibility and governance over AI identities impact risk posture, speed of innovation, or confidence in deploying AI at scale? So I'll take that. What we are seeing is while it's still evolving, is that once visibility and governance around the agent agents, it fundamentally changes how they are perceived and used. For example, if before we were worried about deploying something in production, but once we had visibility and could predict the actions and what it's used for, the conversation shifted rapidly. From a risk perspective, before, we had a lot of blind spots. The moment you have visibility, that changes the conversation around yes. You can see it. While we are still improving on what that looks like, we're getting better visibility on auditability. Even though it's not perfect yet, we are able to mitigate that. So we're at least able to address the risk. And that basically changes the dynamic on the speed and confidence. The the moment you have visibility, you're able to articulate your your impacts to the leadership, and the conversation moved from hesitation to how do we scale it responsibly. What does that scaling look like? Do we yes. We recognize that it's not a fully big solution, but do we understand our risk? Do we understand the impact, and are we do we have mitigating controls around that risk? That's where it it changes the paradigm the moment you have visibility from experimenting to scaling responsibly and being, productive across the organization. That's a very good point, Ajita. It all starts with, can you see them? Can you govern them? Are they doing what they're supposed to do? Are they accessing what they're supposed to do? We can no longer say, oh, AI AI agents are not AI and identities on its own or they are just workloads. No. They have evolved. Nano, what do you think about these? Yeah. Absolutely. So if you don't see them, you're not going to protect them. It's a very simple, basic, common security language. Right? You need to have visibility on what you're protecting it. Especially with AI agents, the the the the the scale it's getting built and adopted to to enable our businesses across enterprises brings a lot of opportunities for us. The business is growing, our customer interactions are improving, it become more seamless, transparent. People are not going to wait for an agent to pick up a call to answer for something. These are such an important improvement that we are bringing to to the to the our customer base. But at the same time, we also bring in our security threat landscape. We as we know, some of these agents, we could manage it because we build it ourselves or we could have bought somewhere from AI tools. We know what it is that. But how do we know something behind the scene is gonna happen? These are autonomous agents. They are we always keep saying responsible usage of AI. But do we know everybody does that? Because there are so much interlinked, there are so many things that go in behind the scene, and this MCB servers, as full kit can build now, such a amazing improvement, the enhancement that we did. But these are solving our major problems, daily life problems, so we have to get to that. Right? So at the same time, if I don't have that visibility, I'm going to lose my security protection. My crown jewel, my important data from my customer data, my workforce data is being shared and leveraged by these agents on a daily basis to do my business. Right? My risk posture completely changes. When when I know some human is going to touch the data or my system is going to touch the data. If an unknown agent is going to be using my data and do a lang language learning, that's a different landscape of security. Right? Where does this data going to land? How is it going to be used? And what are the different autonomous agents are using this data for making this business decision? Speed of innovation at the same time brings the speed of security security issues. So identity is all about visibility and governance, apply the same rigor to the to the AI agents as well. That's a very good that's a very good point, Nana. It all starts with visibility. So now this this is an interesting question. It's like, what surprised you the most about the impact? You've talked about all the guardrails that you guys put in. But what was the most surprising element? Something you didn't expect when you started this journey. So what surprised us the most is how quickly ownership and accountability get complicated when it's an AI agent. With human identities, responsibility is usually clear. With AI agent, That that responsibility, that accountability, that line blurs very, very fast. Is it the developer that's response? Is it the deploying team that's responsible for it? Is it the product owner who's responsible for it? Is the technical owner responsible? Is it the system triggering that action who's responsible for it? That is where I think we were surprised on who actually owns it. And then when we went to answer that question, everybody points at somebody else. There's no clear ownership lines on who is responsible for an AI agent's action. Because at the end of the day, we want to be able to associate an AI agent's action to a response human, identity or to a human heartbeat, right, within the organization. That's where I think we were very surprised. Without that clarity, access decisions, and governance, When we started, establishing that, that became very difficult to articulate and to, get by it. So at the same time, when you think about these agents, these are executing tasks. They are making decisions within within the access you grant them. So who's managing those permissions? And they're able to request access and get permission too in in case of some dynamic agents. So, that's a meaningful shift from our telation of IAM. And I think that's where we were, surprised quite a bit on trying to solve for, ownership and accountability for an AI agent's actions. No. No? Yeah, Ajita. Thanks. That is a great great background on that. See, for me, when we started this, most of the organizations like us, we started slow and small. Right? Let's try out Microsoft Copilot. Let's give some some chat options. Right? That's why we started. Okay. That's that's the better we could manage easily. But the way it evolved and the adoption rate went in and scaled and to the extent where every department is using some sort of AI tools today. My developers are having, cursor, cloud, you name them. Right? So there's so much they are using it. But then developing like we put if the code developed it used to take ten days to develop a code, they're taking it in minutes. Such a fast way of releasing the product. Right? So you are you're giving the getting the benefit. At the same time, we are also getting into a different security landscape. The threat risk is is increasing. So my my journey when we started the surprise element was we started very low. Within a year, it's it's explored. The usage of AI in our environment in terms of from from a corporate to field, from a developer to a customer, it's all changed. So we have been using AI for everywhere. That adoption rate to solve our business problems also brings in security challenges. That surprise and also give us a great opportunity for the way we were thinking about it. Our thinking has got changed. We used to be human centric, identity centric business, and we were giving access on based on who can perform what. Now, we are thinking how do I provide access for unknown entity like an agent, which is performing something in, without your knowledge and how do we bring that visibility and then you govern it. So that security, identity security around that aspect is is really good good opportunity for us to learn and and secure our our process. Thank you, Nana and Ajita. And I love how you talked about, like, AI is growing at scale. You have so many AI identities now. And how are you thinking about the ownership management? If a human user who has paid tens of agent, if that person leaves, where are they that that agent's going to assign to? Who's gonna take care of them? Or they are like sitting ducks, you know, would have all the privileges for just a bad actor to compromise. Thank you. So as AI agents become more autonomous, what identity security capabilities, in your opinion, will become nonnegotiable over the next twelve to twenty four months? So, like, previously, I stated ownership and accountability. Right? Yeah. You want to be able to clearly answer who did what and why, and that's where you get control from. And I think that is one of those key aspects of AI agents going forward. AI agents, as we know, are becoming more and more autonomous. So we clearly want to be able to tie an agent back to an owner, and, otherwise, everything starts to unravel access decisions, governance, audit. All of it depends on the foundation that we are able to tie an AI agent's action to a owner. Second place is the nature of the, access itself. These agents are not static. They are dynamic, and they have, they're acting up based on a context. What they need access to can change depending on the context they're operating under. So understanding the contacts and understanding that these are dynamic and short lived, access, understanding the contacts under which these are operating, ownership, accountability, contacts, I think those are the key paradigms that we have to start, tracking and be able to govern it better in the next twelve to twenty four months to get to get control for AI governance. So my perspective, so we've been talking for some time conversions of different identity domains. Right? Right? IGA, PAM, privileged access management, giving you an identity security holistic identity security on time, dynamic, just in time, and all of that for a primeral road or any workloads. But when it comes to AA agents, that is paramount important. We are dealing with privileged access product problems. We are dealing with governance problem. We are dealing with the compliance problem. Everything is built into one. There were products separately. We're thinking about solving separate problems and addressing them. Now those those days are gone. Now you have a big holistic, big comprehensive issue to sort of resolve for it. That comes with a nonhuman identity being used. Multiple API is stitched together to become your FCP, protocol. So there's so much we're building which are interwoven. That means our identity needs to be conversed and treat everything as privileged and treat them as with the right compliance and and standards. Right? That's the way this industry is should evolve. Look at next twelve to four twenty four months. How do we convert everything into one single, view so that the nonhuman identities are treated like a privileged actors' identities and give them the current status current IDA governance around that? So it's a converged model is what important to get to the dynamic, nature of it. That's very good points. I love, Ajita, how you said ownership, accountability, context. And then, Yana, you talked about you cannot treat AI identities as a, you know, as one of the workloads or anything else. You have to start treating them as a first class citizen. Totally agree. So you both have accomplished a lot when it comes to identity security in this AI world. What advice would you give your organizations that are just beginning to operationalize AI but haven't yet addressed identity security? I would say that agents can easily be classified as a model or a data challenge, not necessarily an ident identity centric, evolution. Right? If from an identity span standpoint, I can see why I I would treat AI agents as an identity problem. But if you're within the organization, it could easily be a model or a data challenge. But recognizing that the entity is primarily identity centric and the governance around this, evolves under identity would help our you understand that while model and data and context are also important, it's, one of the primary aspects of this is going to be identity around agents. And the second is, again, visibility, accountability, ownership, and context. Those are going to be key. So getting visibility into accountability, ownership, and context is going to be one of those key paradigms that's going to help you evolve into be a being able to govern your AI agents. So and the third is, look, there is no perfect solution. There's no perfect process at this point for AI agents. We are all trying to build together. We are all trying to figure this out. So don't wait for it to be perfect. There is no perfection or there is no perfect solution right now in this space. Get you're better off trying to directly evolve and then that rather than waiting for a perfect solution. Yeah. I Very good point. Yeah. Absolutely. I deal with that totally. So operationalizing AI is very, very important topic because everybody wanted to go on an AI journey. Right? So, but one thing that I would do to understand and make this, awareness across the board is securing AI is everyone's responsibility. It's not just an identity problem. Identity is number one priority to to secure these agents as human identities, but at the same time, what we are exposing to our our world is what your important data is. Right? So your data, your, your assets, your your, people, everything is involved in this. So it's everyone's responsibility. Start responsible AI with with where you can control your your AI footprint. Start small and grow your organization. Right? As we did it and if if many of the organizations tried the same way instead of jumping and doing a lot of things at the same time, and we just not try to boil the ocean. Just start small and go from there. Right? And as I said, everyone's responsibility. Treat AI as everyone's responsibility. Build a governance around it. Yeah. It's a team sport. And, you know, and not enough like, even we are saying that we are learning from our customers every day. We are uncovering the things that we didn't even know about until now, and then we are trying to build a solution for it. I am loving this conversation. But before we wrap up, a quick lightning round. How does that sound? Good? Okay. So one word to describe the biggest AI identity to us today, Ajita. Lack of visibility, unaccountable access. Faster redaction. Build fast or secure fast? Secure to build fast. For my business, build fast. For me, secure fast. That's a true identity professional. AI identities, asset or attack surface? Both. And governance makes the difference. For me, attack surface makes more challenging, so I would go with attack surface. You both are a hardcore identity professional. Thank you. Thank you so much. I am sure our audience also enjoyed the conversation as I did. Always love our conversations. Always learn so much from both of you. Thank you for helping us build the solution that is built for today's organization. Thank you so much for joining us today. With that, let me bring Sabian's president, Arun Paul, to take you further in the journey.