S1: In this standalone episode, I speak with Jason Miller. Jason
S1: is the founder of collide. A company recently acquired by
S1: One Password. And in this conversation we discuss collides acquisition
S1: by one password. The synergy between collide and One Password.
S1: The challenge of password management. The concept of device trust
S1: and zero trust. The limitations of current MDM solutions. Engaging
S1: end users and security remediation. The philosophy behind collides approach.
S1: The importance of human friendly security solutions. Future plans for
S1: collide and the potential for broader application of collides technology.
S1: And with that, here's our conversation with Jason Miller. All right, Jason,
S1: welcome to unsupervised Learning.
S2: Thanks for having me.
S1: Yeah. So I understand you've had some big news in
S1: recent weeks.
S2: Yeah. Yeah, it's been a whirlwind. Uh, as I think
S2: some some folks have found out, we've been acquired by
S2: one password. We announced that a few weeks ago at
S2: the time of this recording, and, um, it was a
S2: really big deal. Uh, it's something that we've been working
S2: on with them for a while and discussions, and it
S2: was awesome to finally be able to talk about it publicly.
S2: But I've always loved the one password product. I got
S2: to meet a lot of the folks who lead the
S2: company there, including the original founders. And, uh, they're incredible.
S2: They're just as good as the product that they sell.
S2: And that was really important to me, because some of
S2: the foundational elements of collide was around treating end users
S2: with respect, honesty, getting in front of end users and
S2: giving them. Under an understanding of what's wrong with their device.
S2: Will they do the same thing? But they focused on
S2: probably even the harder problem than we solve is what
S2: do you do about passwords? How do you keep yourself
S2: safe with all these different logins to all these different apps?
S2: They've solved that so well that it's been ubiquitous like
S2: everybody uses it. And that was always a goal for
S2: me at Callide is to achieve the same thing. But
S2: on the in the device trust space and for end
S2: user driven remediation. And so for us, like culturally the
S2: fit was perfect. And it's great for me because we
S2: get a lot of opportunity to still grow and what
S2: we're doing at Callide. But now we have a lot
S2: more resources, and that would have had to have come
S2: through the form of venture capital and a number of
S2: other things, and the incentives can sometimes get misaligned. Really
S2: confident that with one password, we're going to be able
S2: to continue our mission, achieve it at a much faster
S2: pace and keep what was core about us, our DNA,
S2: the same because they're that way too.
S1: Yeah. That's great. So so talk about some of that synergy.
S1: Like how did this, uh what do you think they
S1: saw in you? Obviously we think it's a great product,
S1: but like the different spaces, a lot of people might
S1: be like, wait a minute, which space is one password?
S1: Which space is Callide? How do you how do you
S1: see that merging both when you first heard about it
S1: and then also now like as you actually implement it?
S2: Yeah. I think to understand why one password likes collide.
S2: It's not about necessarily product or feature synergy. We're in
S2: different areas. And the thing that makes sense to them
S2: is like the way that one password sees themselves after
S2: talking with them, they really see themselves as a company
S2: that is distilling down a really hard topic to, you know,
S2: a hard problem to solve. And in their case, that's
S2: password management and making it something that is easily solved
S2: through software and technology, and distilling it down to a
S2: level of simplicity that even my mom could figure out, right?
S2: I mean, before there were password managers, there really weren't.
S2: There was a lot of recommendations on what you're supposed
S2: to do to do a good job, to keep yourself safe.
S2: From a password perspective, you're not supposed to reuse passwords.
S2: You need to have a certain level of complexity. So
S2: we're doing a lot of talking as security practitioners and
S2: telling people what they need to be doing. But we
S2: weren't giving them any tools to really effectively put those
S2: things into practice. And that's what one password was able
S2: to do. On the Callide side, we have a very
S2: similar challenge in front of us. We have a lot
S2: of IT and security practitioners to tell end users all
S2: the time, hey, you got to keep your OS up
S2: to date. You need to have disk encryption enabled. You
S2: need to have system integrity protection on the browsers need
S2: to be up to date. You need to do this.
S2: You need to do that. And today the tools that
S2: we have to help users solve those problems don't work
S2: very well. We have MDM. Most of Clyde's customers use MDM,
S2: but it has a flaw. And that flaw is it
S2: only can work on the devices that it's installed on.
S2: And there's nothing that really stops people from signing into
S2: your most important apps with their personal devices. Right? You
S2: need to have something in place that says, hey, these
S2: are the rules of the road. You're going to either
S2: have a device that's managed under MDM or in addition
S2: to that, or alternatively, you're going to meet these basic
S2: security requirements before you can get on AWS, before you
S2: can get on GitHub, before you can get on Salesforce, like,
S2: these are the core apps that we have that sensitive
S2: data in them. You need to be on a computer
S2: that's safe. Well, there's no real good answer to that.
S2: And Callide has found the beginnings of that solution for
S2: folks who have Okta. And our plan is to make
S2: that as ubiquitous as the one password password manager is
S2: for passwords. We want to be that solution for solving
S2: that problem for devices.
S1: Yeah, that makes a lot of sense. I heard someone
S1: describe business strategy in an interesting way before they said,
S1: look for a really acute problem that's just so annoying
S1: for people, and just solve it more elegantly and better
S1: than anyone else. And both of the two problems that
S1: that you described, they very much fit that.
S2: That's exactly right. And that's why I think one pastor
S2: has enjoyed so much success is sound like they have some.
S2: They have a really great people there. But let's be clear,
S2: the reason why they're so successful is they've built an
S2: incredible product that solves a real problem that people have.
S2: That's hard to do in the security space because first,
S2: it's really hard to get people to even recognize there
S2: is a problem. So like in colliders case, the thing
S2: that we battle all the time, and one of the
S2: reasons I even come on podcast to talk about it
S2: is people don't necessarily recognize that it's bad that any
S2: device can sign in to most of your apps, including
S2: the devices that are not under management. And that's universally
S2: true in a lot of organizations today. Device trust and
S2: zero trust is concepts are new. Yeah, only a few
S2: years old and the concepts are older. But the products
S2: that actually create the outcomes people are looking for a
S2: really new. And so most organizations are in a state
S2: right now where yes, they have MDM, they have all
S2: these things, but they're not actually. They haven't created a
S2: protective layer that actually ensures that devices are in a
S2: basic state. So a basic state of security. So fundamentally
S2: we collide. Uh, we're solving that problem, and we're trying
S2: to solve it in the most elegant way possible. That
S2: still preserves the cultures of these companies, like a lot
S2: of companies allow a pretty broad BYoD program, or they
S2: have contractors that don't use company provision devices, and they
S2: want to preserve that cultural element of their company, but
S2: they want to have some semblance of security. Well, what
S2: is the state of the what can you purchase today
S2: to ensure that happens? There really isn't a lot out there.
S2: A lot of the zero trust device trust solutions that
S2: exist on the market today. Implicitly assume that the way
S2: that you're going to decide whether a device should be
S2: signing in or not is whether it's enrolled on the MDM.
S2: But if you have a big BYoD program, end users
S2: aren't going to want to enroll their devices in the MDM,
S2: or nor is it really appropriate for them to be
S2: doing that in some cases. Or contractors, they may be
S2: on their own MDM and they're not on yours. And
S2: a lot of the solutions out there just don't work
S2: in that world. We've sort of distilled it down beyond that.
S2: The thing, the key insight that Callide has had is
S2: you can't assume that a device is in a good
S2: state just because it's on the MDM anyway. So let's
S2: just start at first principles. Yeah. What is the disk
S2: encryption story? What is the OS version? How long has
S2: it been since the the device has been rebooted. So
S2: on and so forth. And you can run hundreds of
S2: different checks. Let's just look at those at a baseline level.
S2: Not even thinking about the MDM. And and if they're
S2: not in that state then they don't get on. But
S2: more importantly, we can engage with the end user to
S2: get them to fix those problems while they are being
S2: informed that they're blocked from being signing in. And that's
S2: the key. And that's why this type of solution is
S2: so important, because it will work on anything. Like we
S2: support Linux, you have mobile devices. The reason why we
S2: can do that is we don't need a special API
S2: to fix the problems. The interface to fix the problems
S2: is the person sitting behind the computer. Yeah. And if
S2: you embrace that and you make it so that they
S2: understand and they have the motivation and the tools to
S2: do it, they can solve any problem. Even the most
S2: nuanced security issues your organization is trying to solve today
S2: and users can fix for you and with perfect efficacy
S2: if you do this the right way.
S3: Yeah.
S1: Yeah, that makes sense. It's actually interesting. I mean, that
S1: zero trust story really, really does resonate because it's like
S1: you're falling back and saying, look, this MDM thing, it
S1: hasn't worked out that perfectly. And you're dealing with the
S1: reality that is, which is the business hands out laptops
S1: to people and says go to work like that just happens.
S1: And then when security is like, well, you don't have
S1: the MDM, we can't let you on. Like we're literally
S1: stopping business.
S2: Right? Yeah. And it's a concern. Well, what's interesting is that.
S2: The companies don't really have good tools today to measure
S2: how effective. Their device program. So let's say you don't
S2: have a zero trust or device trust solution today. And
S2: you're trying to understand is that even important? Well, the
S2: first thing that you need to do is you need
S2: to at least cast a net and understand who, what
S2: devices are even signing into apps. Yeah. And that is
S2: that there really isn't an answer to how to solve
S2: that today. You know, that's one of the things I'm
S2: working with on the one password side is can we
S2: actually help capture that? But let's say that report did exist.
S2: Let's say I could give you a report today for
S2: your business. That said, here's all the devices that we saw.
S2: Log in to this app and here's their state. Without
S2: deploying an agent or anything like that, let's just say
S2: that report exists. I think the challenge is that you're
S2: going to see a lot of things. You're going to see, hey,
S2: a lot of these some of these devices aren't on
S2: any MDM. Some of these devices don't have any disk encryption.
S2: Like they just file Vault is off if it's Mac
S2: or BitLocker is off if it's windows. Here's a bunch
S2: that have like an OS version that's three years old.
S2: Four years old. Yeah. Probably exploitable remotely easily by any
S2: drive by malware that could go to the wrong website
S2: and you're popped. You would see a report that says that.
S2: And then the key insight is, after seeing this report,
S2: what do you want to reach for to solve that problem?
S2: And I think what a lot of folks naturally reach
S2: for is, oh, we need more MDM. Well, no, not
S2: really either. You already have MDM and that's not clearly
S2: not working. We've captured a bunch of devices here that
S2: are being used to do real work that aren't on
S2: the MDM. So now that's not working that program. And
S2: the other thing is. You don't have any way of
S2: even effectively measuring the security of these devices outside of
S2: the MDM. So the right thing to reach for isn't
S2: an MDM. In that case, it's to reach for device trust.
S2: It's to say, hey, let's say I have Okta. Let's
S2: figure out a way during the Okta authentication flow to
S2: vet a device. Let's figure out what's going on with
S2: it and then let's. Not let it in if it's
S2: not in the right state, but not block work. As
S2: you said, let's actually give that person who is being
S2: blocked a path to redemption. How do they get their
S2: device in the right state? And they'll be highly motivated
S2: to do that because they want to go and get
S2: to work. And then how do you get the nuances
S2: of that interaction? Right? Like maybe it doesn't start off
S2: with a block. It starts off with a warning and
S2: you have 14 days. Or maybe it's not even a
S2: warning with a consequences. It's just an FYI like, hey,
S2: we're gonna, in the future, be rolling out this program.
S2: If it were to have been implemented today, you probably
S2: wouldn't have met the bar. You may want to start
S2: thinking about that and then graduate to an explicit warning
S2: with a time deadline to then eventually to a block.
S2: And maybe even when they're blocked, you don't. You give
S2: them one more snooze, right? And then they can still
S2: get it if it's an emergency. So those are like
S2: the types of human elements that we've built into the
S2: collide platform, because now we've been running this app, we've
S2: been selling this product for about a year. We're going
S2: to continue to sell it at one password. And we've
S2: learned a lot about how end users react to these
S2: types of screens. And it's been incredibly effective, like all
S2: of our customers today have essentially been able to achieve
S2: perfect compliance and anything that they want by utilizing this mechanism,
S2: which has been fantastic to see.
S1: Yeah, I love the fact that it's enabling business to happen.
S1: I also love the fact that you're using the best
S1: possible resource for remediation, which everyone has been hesitant to do,
S1: which is the person actually using the computer, and you're
S1: sort of guiding them. And it's like, you know what
S1: this reminds me of? And hopefully this isn't offensive in
S1: any way. But, um, I've been like kind of marveling
S1: at calendly. Yes. So it's like, okay, wait a minute.
S1: What are you doing exactly? Like, how bad was this
S1: problem before? Billions of people probably suffering from a problem that,
S1: like the big tech scene has not solved, and someone
S1: comes in and cleanly and, like, elegantly solves this one thing.
S1: It's like what? In their case, it's like, how do
S1: you share calendars? Okay, they make this one thing. It
S1: doesn't do that much and it's amazing. And now everyone
S1: uses it. And guess what? When the bigger people try
S1: to compete, they cram all this extra stuff. They actually
S1: miss the point of the app and end up making
S1: something inferior. Even though they have a much larger team,
S1: it's because they miss the philosophy of it, and I
S1: feel like the collide product basically really understood the problem
S1: and really understood not to over engineer the solution and
S1: to kind of just make it as as clean as
S1: it needed to be.
S2: Yeah. And I think ultimately the reason why we were
S2: able to see that problem isn't because, like, we're clairvoyant
S2: or we understand it. I think we started off looking
S2: to solve like fundamentally, I don't think that the existing
S2: security solutions on the market are very human being friendly. Yeah.
S2: And I wanted to build a security company that had
S2: that as a core principle. So we were sort of
S2: we knew that was an immutable part of collide. How
S2: do we build something on top of that? The second
S2: thing that is part of my DNA that sort of
S2: informed this was I worked in manufacturing as a couple
S2: of first jobs that I had and like, you know,
S2: actually on the machine shop floor. And a big part
S2: of that experience was safety training. And I remember, like
S2: sitting down, you're getting the orientation. It's like making sure
S2: that you're being aware of your surroundings and like, but
S2: you learn about some of these systems that were put
S2: in place and every single. Safety law and process is
S2: written in blood, right? Like people died. And then they
S2: figured out a way to stop that from happening. And
S2: the one that really stuck out to me was this
S2: concept of lock out tag out. So for the folks
S2: who are not familiar with this, let's say you have
S2: a really dangerous piece of equipment on the shop floor.
S2: And someone needs to repair it. Well, previously before lock
S2: out tag out, what would happen is that person would
S2: climb and they would turn off the machine. They would
S2: climb into it, and they'd probably tell everybody, hey, don't
S2: use this machine because I'm going to be fixing it.
S2: And then they'd repair it. And then what would happen
S2: every once in a while is someone wouldn't realize someone
S2: was in the machine. They would turn it on, and
S2: then that person inside the machine would die. So that
S2: was really bad outcome, obviously. And the problem was, is like,
S2: no matter how much training you gave to be like,
S2: always check inside the machine.
S3: Yeah.
S2: People were still dying. So the right solution wasn't more training.
S2: And to give them more PowerPoints or more manuals or
S2: scary videos, it was to actually engineer a system that
S2: would hack around the fallibility of human beings and actually
S2: solve it for good. Yeah. So the way lockout tag
S2: works is when that same person is going to decide
S2: to repair the machine, they actually go up to the
S2: control panel and they lock out the controls, and they
S2: take the key that is used to lock out the
S2: controls with them, so that if anyone even tries to
S2: turn on the machine, they can't do it because they
S2: don't have the key to unlock the controls. It's with
S2: the person. Yeah, who's physically repairing the machine. And that
S2: one simple trick. Effectively eliminated that whole class of deaths
S2: in on a machine shop floor. Well, I feel that
S2: the problems that we face in the security space about
S2: getting human beings to do things we're still stuck in,
S2: like the old. 1920s and 1930s Industrial Revolution phase of
S2: it where we're trying to we know that we need
S2: to get end users to know how to do things.
S2: But the the instruments that we're wielding today are all
S2: training videos, you know, yelling at people when they're not
S2: doing things right, adding MDM. But we really need human
S2: based systems that understand human psychology. They understand how people operate.
S2: They understand that. People need systems that will prevent the
S2: thing from happening entirely. And that's what Callide is. I
S2: think it's the first product on the market that takes
S2: lessons learned from those safety industries, and then brings them
S2: in to the world of cyber security and gets end
S2: users at scale with almost perfect efficacy to solve problems.
S2: And that's what we've built. And that's why one password
S2: was really excited about what we're doing, because they see
S2: their systems. And the way that they arrived with their
S2: answers is very similar methodology.
S1: Yeah, absolutely. That's, uh, that's really interesting. And I like
S1: that story a lot. I've done a bunch of work
S1: in the safety space as well, and they take it
S1: very seriously. And like you said, when you care, you
S1: engineer a solution that solves that problem. And, uh, yeah,
S1: I really like that analogy. Well, where can everyone, uh,
S1: find find out about the product.
S2: Yeah. So you could still find us at Callide. Com.
S2: And today we still sell to folks who have Okta
S2: so that none of that's changing. We're still open for business,
S2: we're still selling our product. And in fact, we're starting
S2: to reach out now to folks who don't have Okta.
S2: So if you have Google Workspace or use Microsoft Entra,
S2: we have something in the works that we're going to
S2: be launching later this year. And we want to start
S2: talking to folks to get their insights on what we're
S2: building and to get them in a place where they
S2: get even beta test it. So if you have Okta
S2: today and you want to use something like collide, go
S2: to collide comm, collide comm. And if you have something
S2: different that you use for single sign on, hit us
S2: up as well and we'll have a chat.
S1: Awesome. Great talking to you.
S2: Thank you so much for having me.