3094: Closing the Access Trust Gap: How 1Password is Redefining Enterprise Security
Tech Talks DailyNovember 20, 2024
3094
27:1621.83 MB

3094: Closing the Access Trust Gap: How 1Password is Redefining Enterprise Security

How do businesses navigate the growing security risks in a world where employees work from anywhere, on any device, with apps IT departments might not even know about? In this special episode of Tech Talks Daily, recorded live at Web Summit in Lisbon, I sit down with Jeff Shiner, CEO of 1Password—a $6.8 billion Canadian-based security company trusted by over 100,000 businesses worldwide.

Jeff shares how 1Password is redefining security through its innovative Extended Access Management platform, tackling challenges that have emerged with the rise of hybrid work, shadow IT, and the widespread adoption of SaaS tools. At a time when the "access trust gap" between employers and employees poses significant risks, Jeff outlines how businesses can close this gap by securing every sign-in, device, and app, without compromising productivity.

Our conversation explores the dual role of AI in cybersecurity: both as a potential threat and as a productivity enhancer. Jeff explains how 1Password leverages generative AI to improve customer support and address evolving enterprise needs. We also discuss the future of security, from integrating seamlessly with tools like Azure AD and Slack to meeting the growing demand for user-friendly solutions that employees willingly adopt—creating a win-win for both individuals and organizations.

With a focus on making security intuitive, reducing friction for users, and empowering businesses to thrive in today's fast-paced digital environment, Jeff provides invaluable insights into how 1Password is shaping the future of enterprise security.

As we delve into these pressing topics, one key question remains: how can companies balance security and productivity in an ever-evolving threat landscape? Let me know your thoughts, and stay tuned for more conversations from Web Summit!

[00:00:04] With hybrid work becoming the new normal, and as regular listeners will know, that's not a phrase I enjoy repeating out loud.

[00:00:13] But managing secure access for employees, whether they're using work issue devices, personal gadgets and smartphones, this has never been more complex.

[00:00:23] So how do companies maintain that strong security posture while allowing their employees the flexibility that they need, and flexibility that they need to be more productive?

[00:00:36] Well today I'm joined by Jeff Shiner, CEO of the Canadian-based 1Password, which is a 6.8 billion security powerhouse used by over 100,000 businesses around the world.

[00:00:51] And as one of the leaders in the identity and access management space, 1Password has introduced a groundbreaking approach to what they call extended access management, aiming to bridge the critical access trust gap faced by modern enterprises.

[00:01:09] So in this episode, Jeff is going to join me on the show floor here at Web Summit in Lisbon.

[00:01:15] We're going to discuss the challenges of securing shadow IT, the rise of personal devices in the workplace, and how 1Password is leveraging AI to enhance both productivity and security.

[00:01:27] And we'll also explore why traditional security tools might not be enough, and how 1Password's user-friendly design is helping businesses protect sensitive data without creating friction for their teams.

[00:01:42] So can a tool that's easy to use also provide top-tier security?

[00:01:47] And how is 1Password preparing for a future where SaaS and AI dominates the workplace?

[00:01:53] Well, let's find out.

[00:01:55] So a massive warm welcome to the show.

[00:01:58] Can you tell everyone listening a little about who you are and what you do?

[00:02:02] Absolutely.

[00:02:03] So I'm Jeff Shiner.

[00:02:04] I'm CEO, as of yesterday, co-CEO of 1Password, and we can talk about that a little bit.

[00:02:09] 1Password, of course, has been around for 18, 19 years.

[00:02:11] We started off as a consumer password manager, moved into being an enterprise password manager, and then over the last year or so, moved more broadly into identity security and management with our latest product, extended access management.

[00:02:27] And I'm glad you mentioned the word co-CEO there, because before you met me here at Web Summit in Lisbon, I saw an announcement yesterday that you now have a co-CEO.

[00:02:37] Can you tell me a bit more about that announcement?

[00:02:38] It seems like a big deal for you guys.

[00:02:40] It is.

[00:02:40] It's a big deal for us as a company, and to be quite honest, it's a pretty big deal for me personally.

[00:02:45] So David Fognou is our new co-CEO.

[00:02:49] David and I met five, six years ago, way back when I was originally looking for the first round of funding and was trying to meet some smart people who could help guide me.

[00:03:01] And so he came on then shortly after that as an official advisor, but one of those four hours a week sort of advisors.

[00:03:08] And over time, I brought him on to a lot more hours per week advisor, and then a year or so ago, brought him on as our president and COO.

[00:03:17] And then as of yesterday, you know, brought him on as our co-CEO.

[00:03:21] And I went to him probably a couple of months ago now.

[00:03:24] It takes a little while for these things to happen.

[00:03:26] And I asked him if that would be something he'd be interested and willing to do.

[00:03:29] And the reason that I look at it is, you know, when I started, we were under 20 people.

[00:03:34] We're like 1,400 now.

[00:03:35] And the company changes and the company grows.

[00:03:39] And, you know, with extended access management now, we've just got all that much more growth to do, both in terms of company size and complexity, you know, obviously on the financial side as well.

[00:03:50] I'm a product person.

[00:03:52] That's what I am.

[00:03:53] I want to, you know, build and innovate.

[00:03:55] I want to make things that our customers want and are going to use themselves or problems.

[00:04:01] And, I mean, I don't think I do a terrible job on the operator side, but Fogna does a fantastic job on the operator side.

[00:04:08] And, you know, that's not the joy of my life.

[00:04:12] And I think as a company, we're going to benefit tremendously by having them there.

[00:04:17] Yeah.

[00:04:17] It's a concept I'm seeing more and more of the COO, especially for driving revenue.

[00:04:23] It can make a real difference when you've got different skills that can complement each other.

[00:04:26] It can really help, can't it?

[00:04:27] It really can.

[00:04:29] I mean, there's, look, it's a challenge.

[00:04:31] We spend a lot of time talking about, you know, what could go wrong and what are some of the challenges.

[00:04:37] But there's a lot of opportunities, you know, and some of the ones that I've seen before, you know, some of the companies I really admire at Atlassian with Mike and Scott.

[00:04:45] You have Slack, you know, as well as companies like Stripe.

[00:04:50] So Stripe with, you know, John and Patrick there.

[00:04:53] I don't know if they're both officially co-CEO, but they're both, you know, the two brothers that lead it there.

[00:04:57] And they have quite different personalities and focus areas.

[00:05:01] And I think that's what helps.

[00:05:03] And one of the reasons I was excited to get you on the podcast today, another concept is that of access trust gap.

[00:05:09] It's quite a pressing issue for enterprises at the moment.

[00:05:12] So can you tell me a little bit more about what that gap entails and why it has become such a critical focus for 1Password,

[00:05:20] especially in the current hybrid working environment that we all find ourselves in?

[00:05:24] Yeah, absolutely.

[00:05:25] So access trust gap is a bit of a fancy term, but what it means in sort of simple human terms is,

[00:05:30] hey, we're people and we now work differently than we did, say, 10 years ago.

[00:05:36] And, you know, how do we work differently?

[00:05:38] And I go back, you know, many, many years ago to my time when I did work at IBM.

[00:05:42] And, you know, back then I would, you know, have a lanyard.

[00:05:45] I would go to the office.

[00:05:47] I would, you know, I would sign in.

[00:05:48] I would sit at my desk and the computer that was sitting there on my desk and work on the software that they put on the computer that was on my desk.

[00:05:55] And IBM knew it was me and they knew what devices I was using and they knew what apps I were using.

[00:06:00] And so that then was pretty simple for them to understand how to keep all of that secure.

[00:06:07] Over time, it's changed more and more and we get up to the cloud and things like that.

[00:06:12] But if we look now in 2024 and just accelerated, you know, with the COVID, with the pandemic, people work from anywhere.

[00:06:20] Yeah.

[00:06:21] And, you know, not only do we work from anywhere, but we also work on almost any device now.

[00:06:28] So, you know, I've got my company issued Mac in my backpack there and that's what I work on a lot of the time.

[00:06:33] But when I'm, you know, later in the evening, I'm going to be on my personal computer and my phone is my phone.

[00:06:38] And, you know, I'm not willing to let the company put just anything on my phone.

[00:06:44] And it's, you know, it's mine.

[00:06:46] I want to have the control and the privacy.

[00:06:47] And then the apps, it's even worse than it was.

[00:06:51] You know, it used to be, I say someone jokingly, software is sold on golf courses, right?

[00:06:55] You get an executive and a salesperson and six months later, the company is using Lotus Notes.

[00:06:59] But now software comes in from the edges, right?

[00:07:01] We go to a conference like Web Summit here and it's like, oh, you know, I heard Figma is a cool tool.

[00:07:07] And next thing you know, the design team is trying Figma.

[00:07:09] And so the access trust gap comes from people trying to be productive, from the fact that, you know,

[00:07:16] it used to be only the managed devices and only the company issued software that was used.

[00:07:22] And now people are saying, hey, to be productive, I got to use any device from any location.

[00:07:28] I have to use the apps that I want to use like ChatGPT.

[00:07:32] And so that's the gap, the gap between what the company's IT department, you know, issues and sees and manages and controls versus what we as human beings need to be productive.

[00:07:44] And the gap is challenging because the gap is, again, outside of the purview currently of IT.

[00:07:52] And yet it's necessary for the business because businesses at the end of the day need to be productive and make money.

[00:07:57] It's such a good point.

[00:07:59] We've seen the rise of shadow IT and employees using personal devices alongside their work devices in recent years.

[00:08:05] But as you mentioned, there are so many tools now, especially younger users.

[00:08:09] They just lean to ChatGPT and all these different AI tools.

[00:08:12] We're here at Web Summit and every solution is sold as you can just have it.

[00:08:16] You don't need to tell your IT department about it.

[00:08:18] And they're putting corporate data in there.

[00:08:20] So from everything you're seeing, what unique challenges does that create for companies?

[00:08:25] And how does 1Password's new extended access management platform, how does that address some of these risks that we're talking about here?

[00:08:32] Yeah, I mean, from a company point of view, the security risks are pretty clear.

[00:08:37] You know, you don't know as a company where your brand is being put at risk.

[00:08:43] You don't know, you know, from a security point of view where customer data may be going or IP may be going because you don't have control over it.

[00:08:51] And that, you know, that can be quite, you know, terrifying.

[00:08:54] But there's also the threat of things like breaches and ransomware.

[00:08:57] So, you know, a recent report from Microsoft showed two things that were pretty startling.

[00:09:02] And one is, you know, in the last year, ransomware has almost tripled in terms of the number of attacks.

[00:09:10] And 92% of that ransomware attacks started with an unmanaged device.

[00:09:16] So, again, a personal phone or a personal computer.

[00:09:18] So that shows the nature of the problem because, look, as a security professional, we, you know, we may know, okay, keep your, you know, phones and your computers up to date with the latest patches and what settings and that to put on.

[00:09:32] But, you know, the average human being doesn't and shouldn't have to know that, right?

[00:09:37] And so when we look at it from an access management point of view, there's two sides of it.

[00:09:41] There's from the, you know, from the employee point of view, it's not an employee, it's a person.

[00:09:47] And it can be their devices that they're using, you know, and things like that.

[00:09:50] We have to respect their privacy and their control on those devices.

[00:09:54] You know, I'm not letting the company put on something that can see everything I do and control that device because it's my device.

[00:09:59] It's a company's computer.

[00:10:01] Sure, go ahead.

[00:10:02] I'm going to expect that.

[00:10:04] It's mine.

[00:10:04] No way.

[00:10:05] But at the same time, I understand that from a company point of view, we've got to be able to sit there and say, that's fine.

[00:10:11] But you can't use company, like company apps, company, you can't do company work on that device unless it's secure.

[00:10:18] So with access, you know, management, what we're doing there with extended access management is we're bridging that gap.

[00:10:23] And we're saying, hey, you know, one password and our access management there is going to only allow the company to see the state of your phone and then make decisions.

[00:10:36] So instead of saying, oh, your phone's not in whatever spec the company determines is the right spec, the company's going to update it.

[00:10:44] No, they can't do that.

[00:10:45] It's your phone.

[00:10:45] They have no ability to do that.

[00:10:46] But they can say, hey, if you want to use this app on this phone, here's the things you will have to do.

[00:10:52] You'll have to update to the latest security patch or you have to turn on disk encryption or whatever those are.

[00:10:59] And that gives you as a human the right to choose and the company the right to sit there and say, and if you decide not to, which is fine, then you can't use this business app.

[00:11:08] So that's the approach we take is, again, respect the privacy and control of the human.

[00:11:14] But again, allow the business to secure the work that's going to be done on that device.

[00:11:20] And of course, one password have built a reputation for building not only secure products here, but also user friendly and reducing the friction for both employees and IT teams.

[00:11:31] And there has been friction between those two sets of people for as long as I can remember.

[00:11:36] So can you share how that focus on usability has actually influenced adoption rates and security outcomes for your enterprise clients?

[00:11:44] Because it's something we don't talk about enough.

[00:11:46] I think that importance of usability.

[00:11:48] Yeah.

[00:11:49] And I think we're very fortunate because the first 10 years we were consumer only.

[00:11:53] And when you're a consumer app, you know, you don't have anybody forcing you to use it, right?

[00:11:57] You might have a friend or family member who suggests you use it, but if you can't figure it out in a couple of minutes, you're going to be off to whatever you're doing next.

[00:12:06] And that's really helped us understand the importance of recognizing that people are people.

[00:12:12] And I'm not, you know, I'm not an employee at work and a human at home.

[00:12:17] I'm a human either doing work or not doing work.

[00:12:20] And so we're not going to fundamentally change.

[00:12:22] Now at work, of course, you're going to have somebody who may suggest a little stronger that you have to use that tool.

[00:12:28] But if you think of it from a human point of view, you can use the tool or you can really adopt the tool.

[00:12:34] And what we want is we want people to adopt the tool.

[00:12:37] So our, you know, mantra or one of my favorite sayings is make it good, make the good way the easy way.

[00:12:44] Um, and we find with, with things like one password that people know for the first couple of days that it's keeping them safe.

[00:12:51] And after that, they're like, I don't care.

[00:12:53] It just makes my life easier.

[00:12:54] And so that's our goal.

[00:12:56] Our goal is make your life easier.

[00:12:58] Sure.

[00:12:58] We want to make securities teams life easier as well.

[00:13:02] Uh, but we have to do that by actually going to the, you know, to the human and, and saying, Hey, like, how do we make your life easier?

[00:13:08] Like, well, I just want to press a button and get, get my stuff done.

[00:13:11] Um, if we can do that, we can really address one of the big beliefs we have, which is security is not an IT problem.

[00:13:19] Security is a human problem.

[00:13:21] And unless we address it to all humans, not just humans who really care about security.

[00:13:27] Um, but we have to address it to all humans.

[00:13:29] And you do that by making the tool, um, give something back to them.

[00:13:33] And that's, that really allows it not only for adoption, but selfishly for us.

[00:13:38] It turns people into advocates.

[00:13:40] So if we go to a, you know, we go to a, let's say a company again, you know, um, B2B is obviously, uh, uh, the biggest part of our business now from a financial point of view is over 70% of our ARR.

[00:13:51] So even though we absolutely want people to use a working at home from a financial point of view, we want people to use it at companies.

[00:13:58] And when we go into a company to sell it, there's already a bunch of people in there going, Oh yeah, one password.

[00:14:02] My life's in there.

[00:14:03] I love it.

[00:14:04] Yeah.

[00:14:04] That, that makes it so much easier for us to go and make that sale.

[00:14:08] And it's funny.

[00:14:09] You look at that friction between those two camps and ultimately they both want the same thing.

[00:14:13] Just make my life easier on both sides of that.

[00:14:15] Of course here at web summit, AI is another big theme and the integration of AI into security solutions is both a major opportunity and possibly a potential threat too.

[00:14:26] So how are you at one password?

[00:14:28] How are you leveraging AI to enhance customer support, streamline workflows while also mitigating some of those risks may be posed by generative AI in the context of cybersecurity.

[00:14:38] It seems like somewhat of a balancing act there.

[00:14:41] Definitely a balancing act.

[00:14:42] I mean, if I look at it from a threat perspective, I think one of the biggest challenges is we're humans.

[00:14:47] And it's, it's difficult for humans to distinguish between things that are real and may look very realistic.

[00:14:59] Right.

[00:15:01] I'm always amusing myself with those different, what do they call them?

[00:15:04] Like illusions and stuff like that.

[00:15:05] You know, you stare at the red dot long enough and then, you know, you can see the colors in the picture that aren't there.

[00:15:12] And, and, you know, machines and tools don't do that.

[00:15:17] And so, you know, whether it's things like phishing attacks that are going to get a lot more realistic with AI and, and so many other attacks, like it's, it's, we need to, to give humans tools that they can use that will help protect them against those.

[00:15:32] Now, some of those tools will be AI tools.

[00:15:36] Some of those tools won't like, again, if we look at a phishing attack that may try and bring you to a website that looks very much like the Netflix website or something where you have to renew it.

[00:15:45] And it's just got a subtle difference.

[00:15:46] A machine's going to look at that in zeros and ones.

[00:15:49] It's just going to be different.

[00:15:49] It doesn't care how close they look.

[00:15:51] And so we can help them there.

[00:15:54] You know, I think with AI within the product, there's a, there's a lot of uses of AI and, you know, within the product that we can use.

[00:16:01] And, and we've been using ML models for years just in terms of helping, for instance, even going to a website, understanding what parts of the website to fill in and what parts aren't.

[00:16:13] Every website's built differently.

[00:16:14] And so that, that uses things like ML models.

[00:16:18] But one of the differences that we're trying to focus on is how to do that in a way that doesn't give your private information to, to those models so that they, they start learning them.

[00:16:28] And so for instance, the, the model that we use for the website, we do all of the training of that model.

[00:16:32] And then what we do is we ship out the model that doesn't gather your data uses from, you know, it just executes from the learn side.

[00:16:40] So it doesn't gather any of the data.

[00:16:41] It just, it just executes.

[00:16:43] It's the same sort of thing we can do with AI where we can, for instance, start to categorize apps from a threat level perspective.

[00:16:49] But instead of doing that live with your data, we will do that against our database.

[00:16:53] And then we can database of, of, of like domains that we have the different apps and then send that information in a way that you can leverage it without your data being exposed.

[00:17:04] And we've done that for years with things like the breach reports and that where we can, where we'll just send like a list of all of the sites that have been breached.

[00:17:13] You know, to, you know, your client version of one password.

[00:17:16] So we don't have to see what apps you're using, but we can still tell you if one of your apps is breached.

[00:17:20] So that, again, when we look at all of these, we look at how do we leverage the technologies for good, but without adding extra privacy concerns or extra security risks on you as a person.

[00:17:32] And I think that's not always done, certainly outside of security tools.

[00:17:38] And I think that's something that people just, like anything else, most people will overlook.

[00:17:45] And I think we need to help them, again, just understand that there's an easy way to do it the good way.

[00:17:52] Right. And here at Web Summit, we also see SaaS tools are increasingly ubiquitous.

[00:17:58] Enterprises are increasingly challenged by the sheer volume of apps and services that employees use.

[00:18:04] And there's probably a lot that they don't know about as well, which we covered a few moments ago.

[00:18:08] But how do you at 1Password help companies gain better visibility and control over these sprawling SaaS environments that are blissfully under the radar for many?

[00:18:18] Yeah, I think the first thing we should realize is these apps, the shadow IT, and I use that term, although I'm liking it less and less because it has such a negative concept.

[00:18:33] They're important.

[00:18:34] If you look at what is business's first goal, it's to survive and to thrive.

[00:18:41] And so they need to be productive.

[00:18:44] And these SaaS apps are very productive apps, and they're very different for almost every role within your company.

[00:18:50] And so the days of waiting for IT to approve provision or anything, they're gone, right?

[00:18:57] They're just gone.

[00:18:59] That's not the world we live in anymore.

[00:19:00] There will certainly be enterprise-level apps and things like that, the sales forces, the NetSuites, your HR tools.

[00:19:07] But the vast majority of tools that you'll live and work with day in and day out are going to be specific to your role.

[00:19:13] And most of those are just going to come from the edges.

[00:19:15] And so I think companies have really adopted that position over the last year, year and a half, which was different than a few years ago, right?

[00:19:25] It was five years ago, seven years ago.

[00:19:29] It was like, hey, we're going to put them all behind the SSO.

[00:19:35] And SSOs still have a role where we use Okta and 1Password for the enterprise apps.

[00:19:39] But the vast majority of apps aren't going to come through that way.

[00:19:42] So 1Password, again, we do what we'll always do, which is, again, make the easy way the good way.

[00:19:48] And so as an employee, with your work apps, you're just going to want to log into that work app.

[00:19:55] You're going to use a passkey or a username and password or any of those other ways.

[00:20:01] And as a result, it's just going to get stored in your 1Password work fault.

[00:20:04] And if it's a work app in your work fault, then your company will be able to see that that's an app that you're using.

[00:20:10] They won't be able to see your credentials or that, but your company will be able to get a list of those apps and then be able to decide.

[00:20:17] And then, again, we can start to help with what we're calling the app trust part of extended access management, which is how do we then allow the company to make some simple rules?

[00:20:27] And those simple rules can be, hey, here's the apps that have the most threat vector, whether it's a financial risk or whether they have customer data on them.

[00:20:34] And then they can make rules like you can use them, but you can only use them.

[00:20:38] And again, this will be a sample rule.

[00:20:40] They can only use them on company-issued devices.

[00:20:43] Or you can only issue them on devices that have the security patches up to date or things like that.

[00:20:48] Or the company can maybe take a stronger stance if they want and say, you know, hey, we don't allow you to use, you know, ChatGPT at work, right?

[00:20:59] Or whatever while we're still evaluating it.

[00:21:01] Things like that.

[00:21:03] ChatGPT is my favorite example because a year ago when it kind of blew up, every company was doing the exact same thing.

[00:21:08] Even we were doing it in our company, which was like, you know, three quarters of the people at the company were trying ChatGPT.

[00:21:13] And our security team's going, I wonder if we should let people try ChatGPT, right?

[00:21:17] That's what happens.

[00:21:18] And so, you know, that's the evolution, I think, that's really happening that we can help with.

[00:21:24] Fantastic.

[00:21:24] And given the ongoing shift towards automation and AI and cybersecurity, from everything you're seeing and some of the conversations here at Web Summit,

[00:21:33] what do you believe are the biggest trends and challenges that enterprise will face in the next year and the year beyond that?

[00:21:40] And how is 1Password maybe preparing to meet some of those demands?

[00:21:44] Because we're just a few months away from 2025 now.

[00:21:48] And you're probably looking at this, right?

[00:21:49] It's horrifying.

[00:21:50] They're fast.

[00:21:51] 2024 has gone by.

[00:21:52] Just, you know, just, I don't know, it's got to slow down or something.

[00:21:57] Yeah, so theory by Jeff could be completely wrong, but I look at AI as having three main phases.

[00:22:07] The first phase of AI, which I think is starting to really be over, was the do you AI, right?

[00:22:12] You know, and, you know, it's really meant do you use ChatGPT, right?

[00:22:17] The second phase is the phase I think that we're really starting to see now where AI is working its way into most tools we use to improve that tool, right?

[00:22:29] And it could be simple things like, you know, Zoom now.

[00:22:32] You can use the AI companion to give you a, you know, quick readout of what happened.

[00:22:39] Figma uses AI quite effectively when you do, like, the fig jams to summarize all of the notes into suggestions and things like that.

[00:22:46] We use, you know, AI within one password to help categorize and things like that.

[00:22:52] The third phase of AI is the one that, man, I wish I had a better crystal ball and could figure out because there's lots of opportunity there, but it's going to be just fundamental changes.

[00:23:03] You know, think of it as when the iPhone came out, right?

[00:23:05] We still call it a phone.

[00:23:07] I don't know many people actually make calls on it, right?

[00:23:09] We do everything else, but make calls on it.

[00:23:11] And there'll be that same shift into, like, the next version where it will be AI-centric tools that we change our lives in ways we probably can't think of right now because the traditional way of working will just fundamentally change.

[00:23:25] But what I do see is businesses are going through almost an unprecedented era of change, starting with the pandemic of everybody went and had to work from home.

[00:23:36] We've been remote for our entire existence.

[00:23:38] The number of companies that I went and talked to to say, how do you effectively work in a remote environment?

[00:23:44] And they were really struggling with it.

[00:23:46] The complete move to cloud and now to SaaS has been, you know, another change which has gone from, you know, software sold on golf courses to now everybody can just try anything that you want.

[00:23:59] Even with free trials half the time, so you don't even need to pay for it.

[00:24:04] You're just trying it as a company and all of a sudden data's going somewhere to now the AI era.

[00:24:08] Companies are in this state of unprecedented change.

[00:24:12] And there's so much that you as a security team have to deal with.

[00:24:16] And one of the biggest roles that one password can play is how do we, you know, security is not only an IT problem.

[00:24:23] It's a human problem.

[00:24:24] We can help with that human side.

[00:24:26] So, talking to our own CISO Jacob, you know, like, let's say, you know, so when we ran the reports at OnePass or we, you know, we find the 500 shadow IT apps.

[00:24:36] How do we tell Jason, like, there's 500 more apps you have to protect?

[00:24:39] He can't.

[00:24:41] You know, his mind's going to, you know, blow up.

[00:24:45] So, how do we instead tell Jacob, you know, let our extended access management help you there.

[00:24:51] Let's just put some very simple rules in place that will help the employees know how to keep their devices in those apps a lot more secure than they are with simple steps and simple things.

[00:25:03] And we'll guide them through that.

[00:25:04] And that way, the business as a whole can be significantly more secure.

[00:25:09] A lot of those holes can be, you know, very much shrunken so that the security teams can focus, you know, can continue to focus on the issues that they, you know, that are difficult, need IT and are the most concerning for them.

[00:25:23] And I think that is a powerful moment to end on so many big takeaways.

[00:25:28] And not only are you talking to me here, you've got to dash onto the main stage for a fireside chat soon.

[00:25:33] So, just thank you so much for sitting down with me today here at Web Summit.

[00:25:37] I'll put links to everything that we talked about so people can find you nice and easily.

[00:25:41] But more than anything, thank you for your time today.

[00:25:43] A pleasure.

[00:25:44] I think today's conversation with Jeff highlights the delicate balance between convenience and security in the modern workplace.

[00:25:53] And as businesses continue to navigate the complexities of hybrid work, I think it's clear that tools like 1Password and their focus on extending access management are playing a vital role in closing that access trust gap that we've talked about today.

[00:26:08] So, by simplifying security without sacrificing the user experience, 1Password is setting a new standard here in the industry.

[00:26:17] But as we've heard, the landscape of work and security is evolving rapidly.

[00:26:22] The big question is what's next?

[00:26:24] Will we continue to see a push towards a more user-centric security tools?

[00:26:30] Or will stricter controls and compliance demands take precedence?

[00:26:36] I'd love to hear your take on everything we talked about today.

[00:26:39] Are you already using tools like 1Password to protect your business?

[00:26:43] Or do you see gaps in your current approach?

[00:26:47] Please, share your thoughts.

[00:26:48] Let's keep this conversation going.

[00:26:50] Email me now.

[00:26:52] Techblogwriteroutlook.com

[00:26:53] LinkedIn, Instagram

[00:26:54] And X, just at Neil C. Hughes

[00:26:57] Let me know.

[00:26:58] But that's it for today.

[00:26:59] So, until next time, stay secure.

[00:27:01] Stay curious.

[00:27:02] And I will speak with you all again tomorrow morning.

[00:27:05] Bye for now.

[00:27:06] Bye for now.

[00:27:06] Bye for now.