Welcome to the KuppingerCole Analysts chat. I'm your host, my name is Matthias Reinwarth. I'm analyst and advisor with KuppingerCole Analysts and we have a special event today. We are announcing a new concept that we want to explain and provide more details in this episode and in upcoming episodes as well. And for this, I have invited two colleagues. I have invited Martin Kuppinger, distinguished analyst and one of the founders of KuppingerCole Analysts, Dr. Phillip Messerschmidt. He is lead advisor and the deputy chief of advisory here at KuppingerCole Analysts.
After having said all of this, hi Phillip, hi Martin, good to see you. Good to see you.
Hey, good to see you. And we want to talk about a concept that we have been working on for quite a while in the background. And you Martin, you started with the first foundational document around, and I finally say it, the AI security fabric. And you Phillip, you just released the associated reference architecture for that. And before we go into more detail, of course, this is the central questions that we get asked by many people. And I need a volunteer to answer that.
Why do we need an AI security fabric instead of just extending our already established identity fabric to include agents as first class identities? Why is this necessary, Martin?
So at EIC, during my keynote here at the European Identity Conference this year, I already have been showing the very first draft of the AI security fabric as well. As of the slide update to the identity fabric, as well as a draft of the cybersecurity fabric to come soon. We already looked at more than one fabric, and I think that's something we will touch soon. There are intersections, there are things where these are closely related. But both from an organizational perspective, there are people that are relevant nowadays for AI security.
There are people that are accountable, responsible, that's relevant. There are people that are responsible for AI security. There are people that are responsible for the broader cybersecurity. There are people that are responsible for building the IAM elements and devs. And they have different perspectives. And we have also a thinking about delivering things as a service, identity as a service, at the speed of business, Matthias, you talked about.
And from these perspectives and from the depths we can reach, I believe there's a good reason for taking different angles and looking at different, at the end, domains organizations need to address. Right. So it's the same, but more and more dimensions to look at.
Philipp, what would you add to what Martin just said? I think it's important to highlight what Martin already said. It's a change of perspective, and that makes it more of an extension than a second or third version of the fabric. So we are looking basically at the same concept with the same ideas from a different angle. And therefore, in this case, it's the angle of the AI security fabric. And that makes it much more of an extension. Yeah.
And I think we will touch this probably maybe not even exactly a quarter of the capabilities we look at in the AI security fabric are, so to speak, AI identity capabilities. So there's an overlap, there's an intersection. But there's also a lot more in this AI security fabric, like AI safety protection. That one has, again, quite a lot of intersections or transparency. Okay. So then let's dive into that AI security fabric concept.
You, Martin, and myself, and you, Philipp, and myself, we have done episodes around the identity fabric and the fabric concept in general. Now, finally, we are at the point that we can say, okay, let's look at AI security. Let's later look at cybersecurity. But what is the AI security fabric concept in the first place? Where do we start and what is the outcome? Maybe Philipp, if you want to start. So the idea of the AI security fabric is the necessity that we have seen at the market to secure AI and AI agents.
And when we take a closer look at the classic controls, the classic measures, the classic instruments that we currently have for humans are not good enough, I would say, to secure AI agents to full extent. So the idea of the AI security fabric and reference architecture later is to have an approach to secure the agent action in a consequential approach. So the five pillars basically reflect how we are approaching to secure the agent's action. Yeah.
And behind this, I say that we have a specific way of looking at these things, which is the AI fabric is always starting with business and security requirements. Security requirements in that sense are derived from business requirements nowadays. And it's not starting from a tool perspective. And it's really going down from capabilities into the models. And so we then have this fabric as the sort of the bigger, higher level blueprint. And we have the reference architecture then to detail all of that. And to provide something which makes it very, very actionable. Right.
So when I think back to what we discussed when it comes to the overall fabric approach, and of course, we are working a lot with the identity fabric, it's always the mapping from a set of requirements that need to be identified for the individual organization, the individual use case where you are, and then mapping them to the required capabilities. And we did that quite a while for IAM, for IGA, for access management, for privileged access management, for consumer identity access management. We always started from not saying, okay, we need, I don't know, an entrail.
We need, I don't know, any kind of IDP, but we need authentication. We need strong authentication. And we can describe that and then map that to the capabilities. And I think that is also something that we have to and can apply to AI security. But the list of capabilities and the list of requirements will get much bigger.
So in the end, it's an architectural model that connects requirements as the input to capabilities, to services, and then to products and tools that you can actually, or technologies in general, that you can plug together like Lego bricks to get to the solution that you actually need and not buying something and saying, okay, let's solve all issues. And our ambition, I think that's very important, is to look at AI security across the full scope.
So the ambition is, and I think we see a lot of stuff also coming from vendors nowadays with their blueprints, which usually tend to focus on the area the vendor covers. Our ambition is to go broad. And I even would dare to say there are capabilities in which are required, which will be required, but where you hardly find a good solution at that time. So we're looking also forward into what are all the building blocks, the elements that are needed.
And this is, I think, a very important ambition, which also then goes into the distinction to the identity fabric, where we have the same ambition for the domain of identity. And here the ambition is clearly way beyond AI identity into the full scope of AI security, safety, everything. Right. And when we talked before this episode, how can we actually present this AI security fabric as something new, but something that should feel familiar, but it covers a different, but overlapping area. Both of you came up and said, okay, let's look at the six principles that are in the document.
I don't think that we can walk through all of these principles in a 30-minute podcast. But if we pick a few of those principles that are the foundation behind the AI security fabric, Philipp, what would be one key principle that you would pick to say, okay, this is important for understanding the AI security fabric and fabrics in general? So maybe using a little more words about the ones that are not the ones that I want to The basic principles are still the same. So that the classic ones, who, how, and what, we still need to know what is the identity doing?
What is it trying to access and how is it doing that? As you mentioned, the capability first principle is still the same that we had in the identity fabric. So those are more or less stable. One new principle that we want to highlight here in the group is the one home principle. So the idea of the one home per capability principle is now when we change the perspective between fabrics and capabilities, we need to ensure that we don't have any duplicates in the fabric perspectives.
The idea then with the one home per capability approach is to say that we borrow capabilities from different perspectives from other fabrics and that, however, we still need a homing fabric for these capabilities. So the idea is to not duplicate the capabilities, but ensure that this home fabric is clearly identified, communicated, and then used as the primary home for that capability. And that goes into something which I believe is super important in the context, because it doesn't mean that you won't see the capability in fabric A and fabric B or in identity and AI security.
It means that this is clearly home, which also means there's a logic behind when you put it into the organizational context that this is something which is a service to be as a service, which leads us into a much clearer thinking of IT service organizations, identity as a service, security as a service, and which also then leads to one of the other principles that also services follow the organization. So the bundling is then relevant. We need to understand how do we bundle it. So services really have an organizational anchor, basically.
We say the service you model is reflected on the organizational side and on the service delivery side, which then goes into the home concept. And I think this is something which is super important when you build a proper IT organization. I would even say full IT organization, because it applies to everything.
So if we would do a business application fabric, whatever it would be, there would be also a relationship to the home concept, because certain things like the security, SAP security, would basically be anchored in a cyber security fabric, probably, and others would be anchored in an AI security fabric. And it would be a service model that goes across everything. And that helps improving IT organizations. Right.
So if I get that correctly, so whenever you have already one kind of fabric in place, say the identity fabric, and you are living that, and you're expanding that, and you're evolving that over time, and you want to add the AI security fabric, there will be capabilities that you can use, can inherit, can use as a service. So, for example, to make it more tangible for me in the audience, to say, OK, if I want to understand the lifecycle of an agent over time better, there will always be an owner, which will be a person or a team, somebody who is actually responsible for that.
And the user lifecycle management is something that is not something that is within the AI security fabric, because you have modeled it before, you have maybe implemented it before, but nevertheless, it would have influence on the existence and the classification and the quality of an agent. So if the owner changes from the identity fabric, that will have influence on the information that is processed in the AI security fabric. Would that be a simple picture that you could agree to, Philipp? In general, yes. To be honest, I would have taken another example or another example.
I would have taken the authentication example, because that is, at least for me, much easier to say. If you have an IDP, it is not much of a difference. If you have humans, if you have consumers, if you have service bots to authenticate. And in addition to that, now agents or AI agents are coming up and you need to build on the existing IDP, on the existing authentication methods. And this is something that, based on the identity pillar in the AI security fabrics, belongs to the identity fabric in the end.
Of course, it must be clear that these capabilities are borrowed and need to be specified for the agent or the AI security fabric. But nevertheless, what you already have in your organization, what you have in your identity fabric, will be reused in the AI security fabric.
But, and fully agree, but I think what we must not underestimate – and I see it's positive – it requires a different service delivery thinking in the organization. I think this would be a huge step forward for organizations to deliver really services at the speed of the other parts of the business. And that would also mean that you might need to speed up, when you say authentication, and you are used to humans authenticating once or twice a day.
This is not the case for an agent or for a set of agents or really a large number of That changes the requirements also to the authentication process as a whole. So, there will be also influences from the consuming parties towards the services that you consume from other fabrics.
So, that will be an evolution that is connected. And I know you, Philipp, and Patrick, our colleague, you are working on target operating models on the way how services are delivered within an organization. This all gets much bigger with more stakeholders involved.
So, communication, service orientation, service objectives, and that would be really something that has a new quality. But that is a topic for a different episode, for sure.
So, when we have these principles and we come to the topic of the actual capabilities, how does that influence each other? So, how do you get from these principles to the set of capabilities? We said earlier that we just published also the reference architecture.
So, we need to have all of these capabilities in the right set of columns and structures. How does that reflect the principles that you see right now? For example, the principle of one home for a capability. Does that mean that there are blanks, that there are blind spots, or are they there and they are just linked to somewhere else? How can I think of that? How can the audience think of getting bigger with a new set of fabrics? I would start the other way around and looking at the principle of capabilities to services to tools.
And the capabilities help, and we try to have a comprehensive set of capabilities defined that will evolve over time, that will change a bit over time as usual, because especially with the fast speed in AI, there will be updates for it. But that helps organizations to look at which capabilities do we already have. And some of them might exist in other domains, like in identity.
And also to understand which capabilities are needed, at which time, with which priority, to define their specific incarnation of the fabric, and to define their roadmap, to set their investment priorities, all these things. That is where this comes all together.
Okay, understood. It's clear that we cannot explain the full concepts behind the AI security fabric in just a few minutes. But if I remember correctly, Philipp, you came up with an advisory note that was more or less called operationalizing the identity fabric. We need to operationalize the AI security fabric as well. So we need to translate that into services, into systems, into architectures that actually provide value for an organization.
Otherwise, it would not work. What would be, from your experience, from your assumptions that you put onto the AI security fabric, what would be the steps that are required for putting the fabric to work, so moving a concept into the real life? So what we can see right now is that the fabric provides you with a good overview, a good structure, a good map that you can use in your organization to move forward. Ensuring that this comprehensive vision enables you to find the spots that you have not covered yet, and that is pretty much the recommendation here.
Take the fabric, take the reference architecture, and use the capabilities to ensure that you have thought about everything. Some feedback that we have received from the audience and from our community is that they were surprised that we have five pillars in the fabric and the reference architecture, and that some of those pillars are not always thought through while implementing capabilities for agents, for example.
And that is what we are trying to help with, that this comprehensive view then is the foundation for the planning, for the architecture, for the requirements definition, and then for implementation ultimately. Right, and if we think of all the vendors that come up with great new solutions, and they have great new solutions, I think it is important to decompose these solutions into capabilities to understand what they actually deliver, and how they can contribute to such an AI security fabric, and where blind spots are, and where they actually shine.
And that will be the challenge for many organizations in the upcoming weeks and months and years when it comes to securing AI agents. So, we are at the end of our episode right now, and this is really just a teaser. We will follow up on that, and Philip, I think I might want to invite you for having a look at the reference architecture as well, so to get more into detail here.
This was really just to really spark the first flame when it comes to understanding, yeah, there is something like the AI security, and it is as usable as the identity fabric, and that has proven effective for many organizations. So, that would be my final point here.
So, there is a lot more to come. We will do lots of more publications, because we want to highlight this topic from different angles.
So, please stay tuned. Watch the space. There will be more from Martin, from Philip, from Jonathan, our colleague, from John Torbett, and I hope from myself as well when it comes to understanding the fabric and the necessary governance.
For today, I need to stop here right now. We will talk again about AI security.
Thank you, Martin, for being my guest today, and thank you, Philip, for being here today, and I think, yeah, this is a topic that will stay with us, right? No doubt. Absolutely. Okay.
Thanks, and have a great week, a great rest of the week, and let's continue that conversation, because we need to be fast as well with this topic. People, it's already out there, and either we manage it or we don't, and not managing it is not an option.
So, thanks, Philip. Thanks, Martin. Thank you. Thank you. Thank you.
