Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Eve Maler on Identity Standards, Governance & Digital Death

Saviynt
04/25/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


Hey, welcome to Savvy Talk, the best conversation you are going to hear all day today. We've got probably the best episode we will do ever, well, up until this date, because we, I mean, we've got Yves Mailer, right? Man. Like no, no introduction needed. It's Yves Mailer. No intro required. Yves Mailer. I'm a big fan. And you know how I do with those type of celebrity guests. Yeah. You're going to be on the floor, like, curled up in a fetal position, like all day. I know. I get starstruck very easily. That's me. But maybe we can uncover things that the audience doesn't know about her. And even us. I mean, but it's, this one I'm going to give you a little bit of grace because, like, it's Yves Mailer. Everybody's going to fan out over Yves Mailer. She's been in the industry for so long. She's done so many amazing things. And she's just an incredible force in this industry. So I've been looking forward to this as soon as we knew we booked her. And there's so many things that I've been wanting to talk to her about. I've been following her career for a long time. So this is going to be amazing. Yes. And as soon as I saw her name on our list, yeah, I was pretty excited to know her better. And let the world know Yves as well. Yep. Yeah. I'm looking forward to this one. You guys are going to learn a lot. Should be fun. Let's do it. Let's do it. Here we go. All right. Welcome back. Wow. This is going to be exciting. I know. Yves Mailer, the one and only, the rock star herself is here. I did wear my ZZ Auth and the Love Tokens hard token, so, you know, I wear it for luck. So I need luck with you guys. You don't need luck with us. And you look very rock and roll, Yves, I got to tell you. I got to represent. So I got my Green Day shirt, too. Well, next to you guys, you know, fashion plates. Welcome to the podcast, Yves. Thank you so much. Thanks, man. I've been looking forward to this. So much we want to get into. Let's dig in. What do you want to talk about? I want to talk about the book. I've been hearing so much about this book. Oh, my goodness. Well, I'm very excited to hear that. Yeah. I've just been wrapping up a new book and it's called Mastering Digital Identity from Risk to Revenue. So, you know, who doesn't like taking care of all those things? Although what I've been saying is like, okay, shock, it's been a while. It's been a while. It's about identity, but it's for enterprise CEOs who don't care about identity. So I'm here to make them care because we know they've got to do a better job. We know a few of those. Do you? Can you introduce me? We can. We can talk later. But, Yves, this is so cool because if you think about the journey of a person, right? And they say, yeah, what a big milestone writing a book. They say plant a tree. I don't know. In the U.S. they say that? Plant a tree, write a book, that kind of thing. I don't know if that's true. I don't know if we have that saying, but I like it. I like the direction you're going. So, yeah, you're two out of two. So, yeah, plant trees. I got to get to that. So, this book, what was the idea behind it? And how long were you thinking before? Okay, I think I need to put these words out. Yeah. So for about a year and a half, I've been giving some talks out there. Probably the biggest early one was at EIC. And I called it Mastering IAM's Higher Purpose. And it came from years and years of research. about all the ways in which identity is not just about security, not just about even privacy, but it's about all the other things, experience, and I'm going to get to how I characterize it in a second. But the higher purpose thinking was coming from jobs to be done theory, which is product management theory. So, once you start thinking about, well, who all you're serving, not just enterprise stakeholders, but individual people who are kind of like customers of the identity stuff you're putting out. So, that was the hypothesis. And as I refined it and refined it, and started working on that with some of my clients, because now I'm out on my own working with clients at Venn Factory, it started to become a thing. And I started thinking, could I help make it easier for all of us trying to do this right by explaining this for the hardest audience possible? And that's what I did over the last few months. And it's pretty cool because it sounds daunting, right? Just coming with the ideas, but also putting it away. I know you're an amazing writer, but did you have any help in editing or somebody helping you through the process? Yeah, a lot. So, for people that want to write a book, what are the steps that took you in preparation to get to this point? Okay, I'll start writing. And then you open, what was it? Was it Microsoft Word? No, it ended up being in GDoc, which is my usual first choice that I reach for. It's Notion, actually. And thank you for saying nice things about my writing. It comes very hard for me. I'm a much better editor than a writer. Thank you for that. Well, you know, if you work hard at it, we can get better at things. But I did find that I had written a book 30 years ago. Exactly 30 years ago. Guess what it was about? Identity? No. Did we talk about identity 30 years ago? Not really. What was the predecessor to XML? Nobody knows, unless they're old like me. SGML. Standard Generalized Markup Language. I wrote a book with a friend and colleague 30 years ago. And it was at the time when, you know, people did books differently. I mean, it was with a traditional, what we now call a traditional publisher. Prentice Hall PTR. It's out of print now. But it was called Developing SGML DTDs, which were the schemas, from text to model to markup. And so the process then was very much more rigid. Very much more dictated by the needs of the publisher. Now, the operational things about writing a book are easier. And there's a lot of folks out there to help you, writing partners. And I went with a hybrid publisher. And that suited me just fine because we could move really fast. And so writing looked like a series of steps, like you'd write a blog post only just really, really long. No, I find it fascinating. And just the comparison you did with 30 years ago, sounds a lot like music. You can produce music in your home studio. Like you can write a book at home, which is pretty cool. Did you use any controversial AI in that? No, I did not. Like fact-checking things? You know, I would say background things, helping understand the market for what I'm looking at, yes. Research? Writing, no. And that was just a point of pride. And here's how I thought of it. So I'm a big Queen fan. Oh, yes. The Queen era, before they had the, I think it was the Hot Space album, where they proudly were saying, no synthesizers were used on this album. And then they sort of broke, and we saw what happened when they used synthesizers. It was cool. I mean, it was cool, but it wasn't good music, actually. So maybe it's kind of like a mild neurosis, but I just wanted to be able to say, no AI was used in the writing. So it's organic artisanal. Yes. Yes. Two perfect words for it. Awesome. What do you think of Queen with Adam Lambert? I saw it. Me too. And it was good. It's different. It's something else, right? It's not Freddie. Yeah, it's not. But nothing is. I also saw, who was the guy they had before? The guy from Bad Company. Yeah, yeah, yeah. I forgot his name, too. That's terrible. I should really know his name. But if one's old enough to have Queen as your favorite band, this happens. I'm not going to say, name two songs for that album, kind of thing, right? No, it's pretty cool. And, well, it's funny that most people may know you, right? And I think when we have guests on this show, we say, well, what are the cool things I know about the guests that I think the audience would like to know as well? But I think a lot of people know you. But do they really? Exactly. So I knew you. And you know how much we as humans, we value, like, a third-party confirmation of things. It has to do a lot with what you do. I think I remember, and I learned about you later in life. I was already living in Canada. I was a gardener, actually. And Mike Kelly, which was my mentor, a gardener, an amazing analyst there. And I think we were at Forge Rock. And I said, wow. And all the vendors, yeah, Eve Mailer, she wrote something about this, this, and that. And you should look at that. I said, oh, OK, I'll check her out. And I think that, I remember, people, I think that was the first time. And coming from my mentor, coming from somebody of authority, in that sense of respect, it gave me that angle. So tell me about that. What else do you think the audience would not know about you? Especially people that know you for so long, things that are, like, you're a Queen fan. Yeah, OK, that's one thing. I did, so some people may know who followed my old blog, which is currently not online. I feel a little bad about that. But I think it was like 2006, I went to the IIW, the Internet Identity Workshop. And Kalia had told me in secret, and everybody knows Kalia, that they were going to have a kind of a, it's an unconference, of course, IIW. And they were going to have an evening event that they were going to call an untalent show. And they were going to have a DJ there. Oh, this is getting good. Untalent show at an unconference, OK. I mean, I thought that was hilarious. But she said, you know, maybe you could sort of emcee it or help with, you know, this sort of thing and make sure to get some talents on stage. And the day before I got together with a bunch of people at the IIW gathering, the daytime gathering, and we collaboratively wrote a parody song to the tune of Bohemian Rhapsody. So do you play any instruments? I play keyboards and I sing. There you go. I'm not a good keyboardist, I will say. I mean, in ZZ Auth I did both and I called myself sort of the musical director, you know, we had the Love Tokens who were the background singers and so I would arrange their harmonies. I didn't know that about you. OK, there you go, there's something. But we did perform Bohemian Rhapsody and it's on YouTube. It's not good, but it's, I mean, the parody lyrics are good but the performance was, hmm, I give it a two. So, and then, so I met you when you were at Forge Rock, right, and all that, so how did you get into identity as a professional or a career? I know privacy was big in your life, it still is, but how it all started? Yeah, so kind of origin story. I was an XML expert and I had joined Sun Microsystems. They had a new XML technology center at the time and this was the dawn of web services. I joined there in 1999 and a new group was maybe starting to form around how you secure web services and I thought this was really important and I enlisted a colleague to help me make the case that we should be involved in this, kind of, what was going to become a standards effort. That became SAML and I became the first, kind of, elected chair of that group because they needed somebody neutral and I was perceived as neutral between the two, kind of, it was two start-ups who had competing specs and that was NetEgrity and Secureint. So NetEgrity had S2ML and they were a partner of Sun's and I helped name S2ML for whatever that's worth and then Secureint had AuthXML and since it wasn't the big behemoths, it wasn't Microsoft at the table or anything and I was perceived as such a no-nothing. How many acronyms were you involved in creation of? I mean we voted on a whole I'm not a computer or anything but I'm just curious around SAML because I mean SAML we had a number of contenders of what to call it. I think SXML was one of them and it got more votes than it really ought to have but we settled on, I mean it was called the Security Services Technical Committee and I got tagged as the you-have-to-somehow-hurt-all-these-cats so you know I did that for the first part of its life and we thought of it as like directory and security then. Notice SAML doesn't have an I in it. So that was kind of how I just backed into. I was the XML expert to help with the protocol writing. And even Soko and David, you appreciate that too. We had Heather Flanagan on the show as well and how much influence she had in standards and you too which I think for me is a very mysterious and it's a whole different world of a practitioner and identity and all that so what attracted you into that part of standards and... Yeah so standards are funny right because you've got a lot of volunteers at the table they're typically your competitors and you have to figure out the, I will call it the interoperable intersection of things you want to do to strategically commoditize and the interoperable intersection of your interpersonal styles which is sometimes hard to find and you can't like really there's ways now in the modern standards era to even though they're volunteers you know I used to say you can't fire them but there's ways now with like codes of conduct that you can fire them so that's perhaps helpful but you know it's kind of like your average I don't know cross functional council inside your company where you have to persuade them as well it's all persuasion there's no here I'm your boss do this they're not the boss of them so yeah it's got all those tricky bits but the reason it appealed to me there was I had done it before I had been part of DocBook which was a very well known SGML schema D2D and I was part of some other efforts you remember the Open Software Foundation so they had documentation for their Unix that they were licensing to their customers and I was with Sun which was a customer and we were like well we want to get stuff that we can republish with our changes so that's what SGML was good at and we helped that community get a sort of standard D2D for their documentation so I'd done it before I find it fascinating well you're one of the few It's a really interesting process if you're in the weeds and you care about everything. Because I don't know how to do it. It's like cooking for me. For me, it's like black magic or something. My wife cooks and says, wow, I don't know how you do it. I'm just enjoying it. You're satisfied. So for me, it's standard. I don't know how you do it. I mean, whatever comes, wow, let's adopt. We can't be expert in everything, right? Right. No, no. I'm an expert in eating. It's a level of just, to your point, persuasion and discipline. And I told Heather so many times, it definitely takes a certain personality type to be in standards. And Dean, I've talked to him so many times, and I'm just like, I applaud you because I've tried a number of times and I can't do it. He's a really good at it, too. I can't. It's not my jam, no. It's not. But I so see the importance of it. And it's funny having this conversation earlier. I was talking to a colleague of mine, and when you look at the industry, you look at some of these companies, and it's so funny when you look back how influential a lot of these companies were because at certain given points over the history of identity, I would love at some point to just sit and write the book of identity. You'll see certain points where there was a collection of all the talent, right? And there's these inflection points, like Sun is definitely one of them, right? Because when Sun dispersed, that's when you got like Open DS, right? And Open AM and Open SSO, which led to 4Track. And you see where all these people kind of came from, and then that dispersed out. And then you see other companies, and there's a bunch of talent, and then that dispersed out, right? And I'm pretty sure it happens in other industries, too. But when you specifically look at identity, right, you see certain inflection points where there was just a ton of talent altogether. And that's where all of us kind of found each other, and we all kind of got into all of our little expertises. And we didn't know it at the time. We're just doing what we do. And then you look back on it, and you go, oh, yeah, that's when I was kind of doing this and doing this. I was like a family tree of identity. Yes, that's a super interesting observation. And I think it might have had something to do because Sun had a certain and, you know, really meant a lot to me, and it meant a lot to everybody. The network is the computer as a kind of a, you know, anchor, technical anchor, and it kind of values anchor as well to have things be open. And the kind of battle at the time was Sun versus Microsoft. And I was involved in a little bit of that, because as soon as we had the settlement, there was a legal settlement, which I think it was the rapprochement, you know, where we started to work together. And I was put in charge of Sun-Microsoft interoperability around web services and identity. So I was involved in this weird, fateful thing where Steve Ballmer and Greg Papadopoulos, who was our CTO, came together for a single sign-on demo with interop between SAML and WSFED. Can you imagine these major dudes coming to this thing with a demo where you press a button and, like, you can't see anything, but a green light goes on to show that the person got in? There was a press release about this. No, I think Scott McNeely was there, actually. Yeah. Wow. So were you there after the Oracle acquisition of Sun? I kicked myself out just before the Oracle acquisition. I was on the receiving end. I was at Oracle when Sun came in. Oh, there you go. You had to absorb all these folks. A lot of great folks. We had, like, four directory services at one point. Fusion was supposed to solve that. It did not solve that. I just want to tell you. They were supposed to be fused, and I think the Sun version got just kicked out. I don't remember. Yeah. Didn't make it through. Not that I'm bitter. Yeah, I don't know. So I want to come back to the book for a second, because there was this... I've always had this saying when I talk to customers, right? The most successful identity projects that I've seen for customers is when I tell them, like, you have to think of this like you're a product owner, right? And you're delivering a service to your customers, right? So not only as a vendor when, you know, don't think of just your vendors selling you a product. You then take that, and you create a service that then you sell internally to your customers, which is your businesses or, like, even for your customers, right? So you have to think about this. You have to sell. You have to figure out what features you're doing, all these things, right? And so even down to when I would suggest to customers, like, rename, like, your titles, like, you are an IAM product owner, like, things like that. So, and as I've been kind of hearing about, like, the book that you're writing, it's kind of like you're talking about it as that as well. Like, think of identity as a product. I'm advocating what you've been advocating 100%. In fact, I discussed a little bit the whole Cheeto conversation, chief identity officer, and, you know, I believe that it was kind of stunted from the start, because it didn't face the fact that every organization just has this different mix of needs around identity, and so you don't know where it's supposed to live. You don't have a conversation about where it's supposed to live. Just elevating it to a C-suite doesn't work unless you really motivate that. But I call them identity product owner as well. May I call off something? Because I heard that just before this week, before we met, somebody said, well, it's Cheeto. What do you mean? Like the Cheetos? Like the orange fingers? So, no, no, I heard Eve Miller explain that that's how you pronounce the chief identity officer. I didn't start it, but I love pronouncing it that way. See, your name came up again. It's C-I-E-O, C-E-E-T-O, Cheeto. Is that Cheeto? That's just how people were pronouncing it. There was a discussion about a year, year and a half ago, like Andy Hindle was, and Martin Cooper. And I like it because it's funny. And we were talking about me going down to Brazil to give a talk. And I just checked before I mentioned it on stage, because I talked about this whole subject there. I'm like, do they have Cheetos in Brazil? Cheetos everywhere. We call it shitos. In English, it feels weird. But so you were in Brazil. I was. Yeah, I know, with my friend, Andre. And what did you eat? I mean, I ate everything. Well, there's a lot of meat, which I was very excited about. Delicious, huge steaks as the appetizer or like as the happy hour. I loved being there, and I would love to spend more time there. I became a big fan, of the country people. You're always welcome. Oh, thanks. I feel like I can go back now. Sorry, back to the book. Yeah. But the product owner thing, I think it's not just a powerful metaphor. It can drive a whole bunch of different behaviors, right? You've seen it. You're an accomplished practitioner. So the way in which you ask people what their needs are and try and create product market fit becomes a reality. And you get out of that kind of ticket mindset when you do that. And it makes you a lot more humble and empathetic to think that way. So I just love that entire frame for doing better. And this is where I will mention the kind of the needs that all those potential customers have for identity. I call it the four Ps so that I can remember. Protection is always the first because we started with security protection. But there's also privacy protection and reputation protection and all the risk enterprise risk committee things. Personalization, which we talk about user experience, but increasingly upsell, cross sell, all the things that are company customer facing. Payment and people. And what I mean by people is all the things people really want, individuals want that identity has never given them. We've satisfied pretty poorly. So those are kind of the frame for ask yourself all the ways you can improve all of those at once and not compromise. And we know it's possible. But once you see it that way, you're like, this is not just a cross-functional challenge. This is now it's going to affect the metrics that I choose and like how to just not have to slice the baby so many ways. So I just love that. And I want to promote it more along with you having promoted these great practices all this time because we have to do better. It's getting critical now. And so there's no time to lose. Absolutely. And I really like the idea of approaching identity as a product. And I think we consume thing as an employee. Doesn't matter if you are a partner, a supply chain provider. Yeah, we got to think from that angle to either for retention or productivity, you name it. So fast forward, ForgeRock, all this amazing phase you had there too. And I think the latest one was Venn Factory, which is, you know what? I'm a big fan of Venn Diagrams. And I use those a lot at Gartner. I make them and this is ITTR, this is Kim and vendor names all over. I was always a big fan. So what is that about? What is the Venn Factory about? I mean, I chose the name partly because I have this history since as far as I know, like 2005, making Venn Diagrams about originally SAML, original info card, original open ID. And then I just people like them. So I kept on updating them and making more. But even if you don't have that sort of insider view, who doesn't love a Venn Diagram? Everybody loves a Venn Diagram. So and I like the idea of a factory because it's sort of suggested, you know, so you know, I came up with a logo that I enjoyed around sort of hinting at that. So what are your clients? What type of... So I work with a bunch of tech vendors. I'm increasingly working with enterprises. Okay. I do some work with some of the research firms that we, you know, get to enjoy the fruits of in our organization. So I have a relationship with Coupang Air Coal. I've had a relationship now and again with Liminal Strategy. And then, you know, some great tech vendors that I really believe in. So somebody once asked me a long time ago, you know, if you when you retire, what do you want to do? And I don't believe in the R word, actually. I don't think it's necessarily good for a person. But I said, I just want a boutique consultancy where I can just work with folks that are awesome. And Venn Factory allows me to do that. Yeah, awesome. No, more and more as I get older, the people you work with matters more. And having that opportunity to choose who you work with, I think it's fantastic for people there, too. I think it's a good go in life. Yeah. In general. And then Venn Diagram. There was something I also heard you talking a lot about, which is dramatic pause. Death. Yeah. Always a happy subject. Yeah. Right. But I think we all go through that. I think it's a natural circle of life, if you will. Right. Sure is. So tell us about that. I think that there was a very interesting take on identity. Right. And we have all these huge social footprints in social media, bank accounts and all that kind of stuff. So what happens with that after we... After we pass away or after someone we know passes away? And these are very tough subjects to talk about, but better not to ignore, right? It's ever present. And in the world where we're all digital humans, it happens more and more that we run into these challenges. I'm going to take a step back first to talk about, okay, you mentioned social media. It's an instance of the relationships that we have. Now, in the real world, we have lots of relationships, family and friends and companies and associates and all kinds of things. Increasingly in the digital world, we have them as well. Sometimes they mirror the outside world. Sometimes they're different. And it's one of the things I've believed in a long time that we've been doing identity onesie-twosie. Like we've been doing it one at a time for a long time. It's an account. It's an account with these privileges. And it's just, it's laser focused on the singular. Yeah. But in fact, relationships are super powerful for actually addressing the four P's, if I may say so. And when it comes to somebody's passing away, it's the extreme case. It's like the edge case of different changes in relationships. And it was only this week at Gartner IAM where I was talking to somebody and they're like, yeah, sort of like joiner, mover, lever only, you know, in the real world. I'm like, yeah, I mean, and again, you're not the boss of whoever, so you can't make them do things. And that's where you run into challenges. I like that analogy. It's deep. Well, I've always thought that all of the elements of workforce identity and IGA, if you just kind of open the aperture... Think about it as life cycle management. Yes. There you go. Boom. Exactly. We could benefit from understanding how to do all of these better in the real world and, you know, consumer facing to make it sound sort of parochial, but just life facing, digital humanity facing, we could learn a lot. So I think, you know, one of the co-chairs of the DADE group, so that's death and the digital estate. Death and the digital estate. And the digital estate meaning all the digital assets that they might or might not be financial assets. They might be all of the recordings of our voice that we have an opinion about whether a death bot should be created, should we pass away? Like, these are now very live, no pun intended, conversations that are going on just in the last year. So this DADE group has been looking over the last year at what are the problems that arise in that world of the digital estate with humans facing these very tough transitions. And so we've had people come to that table to share their story of a loved one passing away and what they had to do and could they unlock the phone? How do they log in? How do they get access to all the resources simply to do the kind of administration of that person's passing that need to do? Or just, you know, to help get access to all the stuff that the family cares about. Or just, you know, to help get access to all the stuff that the family cares about. So it's very present. It's going to be present for a long time, this challenge. And so we're looking at now starting up a working group soon in the new year to solutionize around the problems that we've discovered. Okay. That's very cool. So what comes to mind, right, and roll with me for a second here. It's going to sound a little... You get a lot of rope. It's going to sound a little kind of out there, but so I'm a Marvel nerd, right? But this is literally very present for where we are right now. So the Ironheart was the most recent Marvel kind of series that came out. It's an evolution of Iron Man, right? Kind of. Like it's the main character, and I'm losing her name right now, but she's, you know, really smart young lady, right? And so basically she ends up creating her own iron suit. But with that, she ended up creating her own AI, like her own mini Jarvis. But what she did was in all of her trauma, like as she was trying to do this, she ended up creating an AI of her friend that had passed, right? And so it was just very real life, like AI, and it was like her own Jarvis, stuff like that or whatever. And in it, like it just, it kind of like caused all these like, you know, traumatic experiences with her or whatever, stuff like that or whatever. But it was part of the story going in there. It's pretty deep, actually, and very rich from the headlines. Here's where I'm going with this and why I'm going here, right? In part of the series, like the mom was like, you know, like, hey, like, could you, she had, her stepdad had passed, right? So then the mom was like, well, hey, could you do the same thing? Like, could you make another one like my husband? And like, the daughter was like, well, I didn't even mean to do this one, right? Like, so like, no. Why am I bringing this up? Because what we're dealing with right now, like, this is a real conversation with a lot of the artists out there, the actors out there, because what we're able to do with like, like, so I have a media company, right? So there's a lot of stuff that I'm looking at. Like, I can create digital clones of my voice. I can create digital clones. There's a ton of stuff out there. That's right. The likeness. That's the key word. Yeah. So as you were talking about, I'm thinking like, not even for like the digital state of the things that people have access to, but like, just think if you've written stuff like that, like, so I'm thinking like, if I, if something happened to me right now, my family goes out like, well, there's tons of things that I've written. There's tons of things in my voice and stuff like that. And what if they wanted to go, well, somebody decides to go make a digital thing of me while I'm gone. And it's like, well, this is trying to like, who has rights to that? Like, you know, your intentions around that matter and your rights around that matter. And there's a legal question about whether if you pass, do you still have rights around them? The same as like privacy rights don't attach to people who pass away. But these are absolutely live conversations just in the day group meeting that we had this week, this week, whatever, but this is the most recent one. We were talking about how there's the possibility of having agents act as operational executors of your wishes of your estate to help execute to the precise things you want to have happen once the right hookups are made between all the systems. This is why standards come into play. And maybe how maybe others who didn't see that standards are important could see, wow, it is really important to have interop of these systems, because otherwise it's a mess to try and get your wishes exceeded to. So that's super interesting. The Marvel connection is really interesting. I do see like I watched Tron Ares and I really actually want the folks who really liked it. I liked it. I don't know. Your mileage may vary, but like I kept on thinking they walked a really neat line with kind of AI and robots and autonomy and some questions that I really think deeply about and really everybody anymore thinks deeply. Yeah, it is fascinating what you just mentioned on not only the authentication of somebody after passing to their data, but what you do with the data, right? I think so many angles that I haven't thought about. And are those part of the data discussions when you're talking about this? It's all of it, right? Yeah. And I think there's a very interesting parallel with our real lives that we tend to postpone all this type of discussions with our loved ones or relatives. And the same would happen in cybersecurity. You might know, let's not talk about that. Let me worry about other stuff. So I really commend the fact that, no, I think we need to talk about that now. Yes. And I will mention, so our fearless leader is Dean Sachs, who started the Dade Group, and Mike Kaiser is the even more active co-chair than I have been. And we have these couple of documents coming out in final form soon, a white paper talking about some of the cultural aspects of this worldwide, and a planning guide so that you'd have some steps, you know, just like you learn, you know, you ought to behave this way around 2FA. And like, there's things that the sysadmin of the family teaches their family about how to be more safe. These are topics to have at a more serious level, like how to protect your digital estate. And you mentioned likeness, and I just want to say, the name, image, voice now, things that celebrities and professional sports figures have kind of nailed. They do that with contracts and with licensing. Well, as we know, bad actors don't care about licensing rights, and they don't seek them. And one of the things I write about in the book is, since it's written for executives, is talking about the spear phishing risk that we have now with deep fakes. And how... Oh, wow. Because they're stealing your name, image, voice, and they're deep faking you. And it's very dangerous, especially... It's my belief that this likeness protection that we need, there's a few neat technological solutions out there that I do address. And I think that destiny is coming for us all to be kind of stolen, to have our soul stolen through a photograph, if you will. And we need technical protections, and we'll certainly need them if we have opinions about what happens after we pass. Yeah. And some people think about that, like the band KISS, they already... Yes, Ace Frehley. Yeah. And they have... No, the whole band. They have now likenesses and holograms, so now we can't tour forever, right? So that's one thing. James Earl Jones, as a state, licensed his voice for future uses. They were very prescient about that. So there's a case of it being used. But not all people think about that. And I think the danger is somebody else appropriating it... That's right. ...without consent. Yes, absolutely. So after the fact, how do you get consent from somebody who's gone, right? So I think it's interesting to think about that, especially... I've played around with that Sora video generator, and you can say, hey, I want Albert Einstein rapping this song, and it will make it. That's horrific. Yeah. I hope you did not do that. No, but it's there. Somebody did. There are no hypothetical uses of Sora. They all exist now. They've been done. Oh, yeah. It's... So how we treat that and how those problems are... They're not futuristic. They are now. No, no. They're there now. They're happening now. We are... Mm-hmm. We are over the precipice at this point, right? Yeah. Yeah. And I remember having a conversation about a month ago, and I was talking to a couple buddies of mine, and I was like, we're now... We are living in the world that we used to watch as kids on TV, right? Yes. Yeah. All the science fiction movies. We're actually debating and having conversations that we used to sit and look at on fantasy and TV. And we're actually saying this stuff in real life, like minority report stuff, like are we... Like minority report, iRobot, like all these things that used to be science fiction. We're actually talking about it, but not like we're just talking about debating a movie. We're actually having real debates of whether or not this is possible. Yeah. And what to do now. Another fear. And we're actually having to look and do real research on whether or not and how do we prevent it. And I was like, and that's the world we live in now. And it is, to an extent, as a technologist, it's exhilarating, right? Yeah. But it's also that there's a very real, you know, scary realism to it that it's like, we need to take a breath and look at this, right? And the Ian Malcolm always comes back to me. And that's the part that scares me, right? Is because we tend to just move so fast and not think about the ramifications of the things we do. Yeah. We didn't stop to think if we should. Now's our chance. But I can do this. And so we just keep going. And now, like, we really do need to stop and think, okay, yeah, we can, but like, should we? And how should this work? Because it's, again, like, I'll say it, I said it all last year, and I'll probably continue to say it until it's my time to go like, this is the, this is the most, this is the fastest movie technology I've ever seen in my life. This timeline is wild. And we need to respect kind of the power and the ability that we have as identity people to try and make things better. And it's why I talk about like, the four P's, by the way, there's a fifth P productivity, but everybody has to do that in a business. It's kind of the boring one, if you will. But like, we have to have a no compromises approach. Because the stakes are so high with everybody, all humanity being digital now. So like, what can we do to make it better? And how can we accelerate the progress and not slip into these kind of, well, that looked fun. So let's do some permissionless innovation and really screw things up. Why don't we put a bowl on it, right? And wrap this with that question. I think you said it very well. What should we do? In looking to the future, right? So any special takeaways or advice that we can give the audience or anybody who's listening or watching us today here? So what would you, if you have like one recommendation to give them, what would that be? I would say for anybody in identity, a technologist, a practitioner, a leader, recognize how much you really can't go it alone. One of the things that I love about the IDPro mission, I think it is, or the vision statement, talking about being vital and vibrant counterparts to security and privacy, really good categories to contribute to. Vital and vibrant. Vibrant counterparts, I think it says. It's great. A lot of times we're not aware of what a small piece of the picture we realize we're doing. You know, identity is little data, marketing is big data, and they make money. So how do you get some of that? How do you get a seat at that table? Well, you do it by being humble and being empathetic and really serving that customer along with all the other customers and having an answer for why nobody has to give up what they want in order to do identity right. So that's my advice is like, it's sort of be humble, but be ambitious. Why not both? I love it. No, be humble, empathetic, ambitious about helping more. No, this... See kids, this is how you do it. There's no kids watching this. I don't know why. There is! Kids at heart. They're all kids at heart. We know that because we are, right? Absolutely. We got to bring the new generation in, man. I'm not here forever. You're not here forever. I met a few kids this week at Gardner. See? We're bringing up these new folks. Yeah. Teach me new stuff, guys. Eve, thanks so much for coming by. This was awesome. Thank you. And I hope people stay tuned. MasteringDigitalIdentity.com. There you go. What's the name of the book? Mastering Digital Identity from Risk to Revenue. Oh, there you go. Awesome. Get your pre-orders in, people. Thank you, Eve. Thank you both. Such a delight. Man. Eve Mailer. Didn't disappoint. Didn't disappoint at all. Look. And how cool of a human being she is. Yeah. Besides all the amazing writing she does, all the work on the mysterious world of standards. I still... Anybody that works in standards, like, I just already put, like, at a pedestal above me. Like I said, for me it's like cooking, man. It's mysterious but delicious. We need that. Right. But also the takeaways from me, right? From what she explained on how important it is to be open and receptive. Kind of wanting to do more, in a sense of being more. Not in a negative way, but to bring people to understand and do more identity things. Even about things we don't want to talk about. I mean, and I'm... Listen, I can't wait for the book to come out. I just love the fact that realizing that we were aligned on, like, the whole product owner aspect of it. Not even realizing that. So the fact that she is, you know, writing a book from that aspect. I can't wait to read it. And so I'm going to promote the heck out of it. So I love the fact that she's putting that, you know, out there. And then everything about the death in digital estate. Like, that is something that, again, not going to say I'm going to join the standards body. But I definitely will be paying more attention to and seeing what I can do from the outsource. Maybe I can, I don't know, help write something or something like that. But, I mean, considering I know Kaiser, I might just poke at him and ask him, like, hey, what's going on? Like, I tried standards. Like, I tried to hop on the Ipsy board this year and I just, I couldn't do it. But it does, again, like we had in the conversation, I just think that this is the time that we're in. That's going to be so important. It's super important and inevitable. Yeah. That's one of the... Some facts in life that we can change. Taxes and death. Yeah. And I think this is one of the things that we postponed to talk about. but it's becoming even more important. But it's... I think about that a lot. Yeah, what? I think we can change taxes, but I don't know. Stop it. But right, well, who is gonna handle my LinkedIn profile after this whole thing is gone? I mean, you know, your son can take care of it. Maybe you do. No, I'm sorry, I'm good. No, that was amazing. Eve Miller, guys, yeah, wow. We told you, rockstar. What a show. Who do we get to follow that? I don't know. Huh? I wanna go figure it out. No. I'm just happy it's not me. Right. We'll see you guys next time. Let's do it.

TL;DR

  • Eve Maler's new book 'Mastering Digital Identity from Risk to Revenue' reframes identity as a product discipline using the Four P's framework: Protection, Personalization, Payment, and People—arguing identity leaders must serve multiple stakeholders without compromise.
  • Standards development is fundamentally a human coordination problem requiring persuasion and consensus-building across organizations with competing interests, not just technical expertise—a process Maler mastered through her work on SAML and other foundational identity protocols.
  • Digital death and digital estates represent an unresolved identity challenge the industry has postponed addressing, but AI-generated likenesses and digital asset proliferation make governance frameworks for posthumous identity management increasingly urgent.
  • AI represents the fastest-moving technology in Maler's career, requiring identity professionals to balance innovation with responsibility—adopting 'humble ambition' by being empathetic collaborators while maintaining ambitious goals for improving identity outcomes across the enterprise.
  • Identity must evolve from a ticket-driven service model to a strategic product capability that serves security, privacy, user experience, and business revenue goals simultaneously, with identity leaders acting as product owners who understand their role in the broader business context.

Identity as a Product and the Four P's Framework

Eve Maler introduces her forthcoming book 'Mastering Digital Identity from Risk to Revenue,' which reframes identity management as a product discipline rather than purely a technical function. She presents the Four P's framework—Protection, Personalization, Payment, and People—as a comprehensive lens for understanding identity's value across the enterprise. Protection encompasses security, privacy, and reputation risk. Personalization addresses user experience and revenue-generating capabilities like upsell and cross-sell. Payment relates to transaction enablement. People represents the often-neglected individual needs that identity systems should serve. Maler argues that identity leaders must adopt a product owner mindset, treating internal stakeholders and end users as customers whose needs must be balanced without compromise. This approach shifts identity from a ticket-driven service model to a strategic capability that drives business outcomes while maintaining security and privacy.

The Human Coordination Challenge of Standards Development

Maler provides rare insight into the standards development process, describing it as fundamentally a people problem rather than a technical one. Drawing from her experience developing SAML and other identity standards, she explains that standards bodies operate through persuasion and consensus-building across organizations with competing interests. Unlike corporate hierarchies where authority can drive decisions, standards work requires convincing peers who have no obligation to agree. She compares it to cross-functional councils within companies where influence matters more than position. This human coordination challenge makes standards work demanding but essential for interoperability. Maler traces identity's evolution through inflection points at companies like Sun Microsystems, where concentrations of talent dispersed to seed the broader industry. Her perspective highlights how standards emerge from sustained collaboration among practitioners who must balance technical excellence with political realities.

Digital Death and the Unresolved Identity Estate Problem

The conversation addresses digital death and digital estates as an emerging identity challenge that the industry has largely ignored. Maler discusses the complexities of what happens to digital identities, accounts, and assets after death—from social media profiles to cryptocurrency wallets. She references ongoing standards work attempting to address digital estate planning and the transfer of digital property rights. The discussion extends to AI-generated likenesses and deepfakes, raising questions about consent, ownership, and posthumous use of someone's digital identity. Maler emphasizes that these aren't theoretical concerns but immediate challenges requiring governance frameworks. The hosts acknowledge this as uncomfortable territory that practitioners have postponed addressing, but the rapid advancement of AI and digital asset proliferation makes it unavoidable. This segment underscores identity's expansion beyond authentication and access control into fundamental questions of digital rights and legacy.

AI's Acceleration and the Need for Humble Ambition

Maler reflects on AI as the fastest-moving technology she's witnessed in her career, creating both exhilaration and concern. She invokes the Jurassic Park principle—just because we can doesn't mean we should—as a caution against permissionless innovation without considering consequences. The discussion emphasizes identity professionals' responsibility to make technology better for all stakeholders, not just implement what's technically possible. Maler's closing advice centers on 'humble ambition'—being empathetic and collaborative while maintaining ambitious goals for improving identity outcomes. She references IDPro's vision of identity as a vital and vibrant counterpart to security and privacy, arguing that identity leaders must recognize they cannot succeed in isolation. Success requires understanding identity's small but critical role in the broader business context, particularly in relation to marketing's big data and revenue generation. The message is clear: identity must serve multiple masters without forcing compromises, and practitioners must build coalitions rather than silos.

Chapters

0:00 - Welcome to SaviTalk
1:27 - Introducing Eve Maler
2:06 - The Book: Identity from Risk to Revenue
5:12 - Writing Without AI
10:50 - How Eve Got Into Identity
11:36 - The Origins of SAML
13:26 - Inside Identity Standards
16:02 - Identity Industry Inflection Points
19:00 - Identity as a Product
22:22 - The Four P's Framework
26:06 - Digital Death & Identity
38:01 - AI Speed & Identity Risk
39:52 - Final Advice for Identity Leaders

Key Quotes

3:13 "Identity's higher purpose thinking was coming from jobs to be done theory, which is product management theory. Once you start thinking about who all you're serving, not just enterprise stakeholders, but individual people who are kind of like customers of the identity stuff you're putting out."
19:51 "I call them identity product owner as well. I discussed a little bit the whole Cheeto conversation, chief identity officer, and I believe that it was kind of stunted from the start, because it didn't face the fact that every organization just has this different mix of needs around identity."
22:25 "The four Ps: Protection is always the first because we started with security protection. But there's also privacy protection and reputation protection. Personalization, which we talk about user experience, but increasingly upsell, cross sell. Payment and people. And what I mean by people is all the things people really want, individuals want that identity has never given them."
23:07 "Ask yourself all the ways you can improve all of those at once and not compromise. And we know it's possible. But once you see it that way, you're like, this is not just a cross-functional challenge. This is now it's going to affect the metrics that I choose and like how to just not have to slice the baby so many ways."
38:42 "This is the fastest movie technology I've ever seen in my life. This timeline is wild. And we need to respect kind of the power and the ability that we have as identity people to try and make things better."
40:04 "For anybody in identity, a technologist, a practitioner, a leader, recognize how much you really can't go it alone. Identity is little data, marketing is big data, and they make money. So how do you get some of that? How do you get a seat at that table? Well, you do it by being humble and being empathetic and really serving that customer."
Categories:
  • » Cybersecurity » Identity & Access Management (IAM)
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Identity & Access
  • Thought Leadership
  • Executive Briefing
  • Governance & Compliance
  • AI & Machine Learning
  • Identity as a Product
  • Identity Standards Development
  • SAML History
  • Digital Death and Digital Estates
  • AI and Deepfakes
  • Identity Governance
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Eve Maler on Identity Standards, Governance & Digital Death

              Upcoming Webinar Calendar

              • 06/17/2026
                12:00 PM
                06/17/2026
                Action1: The Remediation Gap: Vulnerability Management in the Age of AI
                https://www.truthinit.com/index.php/channel/2010/action1-the-remediation-gap-vulnerability-management-in-the-age-of-ai/
              • 06/23/2026
                01:00 PM
                06/23/2026
                The AI-Powered VMware Alternative
                https://www.truthinit.com/index.php/channel/2009/the-ai-powered-vmware-alternative/
              • 06/24/2026
                11:00 AM
                06/24/2026
                LATAM: Accelerating Insights on AI Through an Engaging Webinar Series
                https://www.truthinit.com/index.php/channel/2012/accelerating-insights-on-ai-through-an-engaging-webinar-series/
              • 06/25/2026
                01:00 PM
                06/25/2026
                Generative AI Security: Preventing AI from Becoming a Data Breach Multiplier
                https://www.truthinit.com/index.php/channel/1998/generative-ai-security-preventing-ai-from-becoming-a-data-breach-multiplier/
              • 07/01/2026
                04:00 AM
                07/01/2026
                Schutz von KI in Anwendungen, Agenten und APIs.
                https://www.truthinit.com/index.php/channel/2008/schutz-von-ki-in-anwendungen-agenten-und-apis/
              • 07/02/2026
                10:00 AM
                07/02/2026
                Resilience Insights from Hybrid Threats When the Cloud Faces Challenges
                https://www.truthinit.com/index.php/channel/2011/resilience-insights-from-hybrid-threats-when-the-cloud-faces-challenges/

              Upcoming Events

              • Jun
                17

                Action1: The Remediation Gap: Vulnerability Management in the Age of AI

                06/17/202612:00 PM ET
                • Jun
                  23

                  The AI-Powered VMware Alternative

                  06/23/202601:00 PM ET
                  • Jun
                    24

                    LATAM: Accelerating Insights on AI Through an Engaging Webinar Series

                    06/24/202611:00 AM ET
                    • Jun
                      25

                      Generative AI Security: Preventing AI from Becoming a Data Breach Multiplier

                      06/25/202601:00 PM ET
                      • Jul
                        01

                        Schutz von KI in Anwendungen, Agenten und APIs.

                        07/01/202604:00 AM ET
                        More events
                        Truth in IT
                        • Sponsor
                        • About Us
                        • Terms of Service
                        • Privacy Policy
                        • Contact Us
                        • Preference Management
                        Desktop version
                        Standard version