Digital Identity and Fraud Prevention with Gautam Hazari

Welcome back to Mastering Tech Growth, where we interview industry leaders to bring you actionable insights and inspiring stories. I'm your host, Mike, and today we're talking digital identity and fraud prevention. Imagine if an intelligent scam or clever fraud could take down your business. As AI gets better, so do the scams and frauds. How can you stay one step ahead and keep your customers' trust? Joining us today is Gautam Hazari, an influential TED Talk speaker and a visionary CTO at Secura.id. Gautam has been at the forefront of developing innovative security solutions that tackle complex challenges in identity management and fraud prevention. With his extensive experience in deploying cryptographic techniques and machine learning tools, He helps companies navigate the murky waters of digital threats, ensuring they stay secure and thrive in the competitive tech landscape. Before we dive in, a quick reminder to our listeners. If you can subscribe, leave us a review on Apple Podcasts, Spotify, CastBox, or wherever you're tuning in from. Thank you for inspiring us to make a better content for you. Gautam, it's great to have you on the show. Thank you for joining us today.

Thanks a lot, Mike. Thanks for having me here.

Of course. I think it's going to be an excellent conversation. Such a timely topic as well with AI becoming so much more sophisticated. You know, you can fake a video, you can fake a voice. It's so— you can only imagine what that's going to mean, you know, to, to fraud and scam. So when I, when I say mastering tech growth, how do you see fraud prevention and digital identity playing role in enabling growth for tech ventures or protecting growth for tech ventures?

Thanks, Mike. And as you said, it's very, very timely, right? So before fraud prevention, let's see how fraud impacts the businesses, right? And, um, it's not fair on businesses as well, but that's the reality that exists. So the fraudsters are doing business as well, unfortunately, right? That's why they actually strike the high growth businesses, right? So for example, if you just see UK, right, every 12 seconds, one customer or user of a business is getting impacted, or basically they're hit by some sort of fraud. That's just amazing. And but not, I mean, that's not surprising due to the fact of AI, as you mentioned, right? So just for the first 6 months, The impact on the businesses on fraud financially is just over half a billion. So £580 million has been lost due to that. And if you see from the global perspective, 6% of global GDP is impacted due to frauds for the businesses, right? That £3.89 trillion, right? So that basically is the impact. And we can go on and on, right? That's not the point, right? The thing is, the business's growth are impacted heavily. And it's not just financial things, right? Because when a fraud happens, it's shaking up the trust relationship of the business with all the stakeholders, with the users, of course, even within the company, it demoralizes the, you know, the associates, the employees. It creates a strained relationship with the investors and with the overall ecosystem in general, right? And also on the reputation, customer conversion as well. So when, you know, a new customer is joining and they're aware of some fraud that has happened, unfortunately for the business, in that case, they will think twice. Oh, do I have any other option? Do we really need to— I mean, is this the only option? Do I have some competitors, right? That way, that's an impact on the growth in an obvious sense, right? Beyond the direct financial costs involved. And that's an unfortunate reality. But, you know, maybe— and these are the what, right? What are the impact of fraud, of improper fraud management? I think personally that we need to probably zoom into the why as well. Why do we see this thing? Why are we seeing, as you rightly stated, all these deepfakes? Right now it's very difficult to ascertain truth from something which is not truth. And that's not just a metaphor or that's not just a saying. I mean, right now as well, how do we know that this is me, Gautam Hazari, speaking here? It's a digital channel, right? So there are plugins available in all sorts of platforms where the deepfake can be done in real time. It's that scary, right? I mean, there are so many news that we see that, oh, this, you know, some CFO received a video call from the CEO asking about some financial transaction. But then it was not the CEO, it was someone else, right? That was there in some news recently. And how do we actually stop that? And the impact of that, we can't even, you know, ascertain at the moment, we are just at the tip of the iceberg where these fraudsters are, you know, they are probably one step ahead right now, unfortunately, because the AI tools that is creating all the hypes, all the new use cases, fueling in lots of investment, uh, in the businesses, the exact same tools are available for the fraudsters as well. They're doing a business, of course a negative business, they shouldn't be doing it, but they're doing it, right? So in that case That's basically something that as an industry, as a tech industry, we need to look into. And yes, there are ways to mitigate those. There are things that we need to do jointly, and there are things that we need to look into as well. And as I said, more importantly, we need to look into the why. And the why has nothing to do with AI. The why is much more fundamental. So again, I'll be very happy to talk about that why as well at some point.

So before we go tactical around these ways, I really love the fact that you put the fraud is a business as well. So I really wanna unpack this. So if we're saying fraud is a business, which we know it is 'cause it's making a lot of money, are we saying as well that whoever runs the fraud, they actually hire employees? To run the fraud for them?

Interestingly and unfortunately enough, yes. Right. So there is a very interesting Netflix series. What's that called? I forgot the name. Right. There's a two-part series in there. This is about a small town in India. Right. And then they're showing how some of these frauds are done. Where, you know, as you said, these are companies, organizations hiring employees. They have a proper corporate structure, right? And they're doing these frauds.

So do the employees—

sorry, sorry to interrupt. It's called Jamtara. I just remembered it. Okay, so if the listeners want to— I'm sure many have— I have, I have heard that, yeah, we have seen this and it's scary. You will see that, you know, this is, this is an organized Unfortunately, business, right? They're doing things and they're making money, of course, illegally. But that's what it is.

So I would presume employees know they're working for a fraud operation, right? But they don't probably care because they're getting paid.

Yeah, I'm not very sure all of them know it because they have been asked to do something, right? They've been asked to follow a script. They may not know what they're doing. Okay, I'm sure some of them know about it as well. And that's another unfortunate thing. But the more problematic thing that, you know, this is what I have been thinking and talking about is all these employees at some point will be replaced by AI chatbots. And that's even more scary, right? Right now, there's a scaling problem for this, let's say, unfortunate businesses, right? They can only employ certain, right? When they will be replaced by these AI chatbots, there is no scaling problem. They can scale it to whatever they want, right? And that's scary.

So we're saying we're going to have a trained, a properly trained AI bot, which the whole outcome is to actually scam people.

Absolutely.

Yeah. I mean, I can easily see that happening already. So you mentioned every 12 seconds we're getting hit by a fraud as a general population or some type of scam, which is causing about, you know, half a billion of real money loss, which means someone is making that money. Is there any statistics of who is getting targeted at the business level? So if we're not taking at a personal level, such as, you know, you're getting random talk or message saying, you know, I'm in jail, it's your mom, send me money or something like that. But if we're saying B2B type of, you know, frauds or scam, Like, is there any use cases which you could share where how businesses actually potentially could get impacted by these frauds?

Yeah, at the end of the day, the impact is on the businesses and the users, right? And then in between, the regulation comes up in some places, right? Um, so the biggest fraud right now are happening for the obvious reason, that's not surprising, is in the financial industry. Right. Because there needs to be, as we are discussing, that the fraudsters are doing business. Right. So what is their motivation? It's money.

Right.

To start with, unless they're targeting a celebrity, then the motivation is something different. Right. That's a targeted fraud attack. Right. But in majority of the cases, the driver is money. So the financial industry is targeted mostly, but it's going beyond that as well. Right. So, for example, wherever there is a store value, account, like the gaming industry, right? The gaming industry, it's not real money, but there is a store value that's happening, right? Points, whatever, which can be converted into real money at some point. So the fraudsters, because the financial industry is clamping down on all these frauds, right, from the front gate, back gate, side gates, and also through other mechanisms, right? So these fraudsters are doing business, and again, they want less resistance, as with any other business, right? So they're moving their eyes. Hey, do we have any other place where we can actually get some quick money? And then the gaming industry is getting targeted as well. In the financial industry, one of the biggest fraud is what is known as the APP fraud, the authorized push payment fraud, right? And that got accelerated during COVID And the use case is basically, it's not me, mom calling, but it's similar, right? It will be, hey, this is your bank calling you, right? And then they follow a script. Basically, they will target mostly the vulnerable people, you know, where either they have some sort of financial issues or the senior citizens. And then the script basically follows in two ways. Initially, the fraudster will try to either scare that person or make them greedy. So they will ascertain, and they're trained, or they follow the script, right? They will just say, okay, which part do we go? Do we scare them or make them greedy? And either path leads to the exact same position where this unfortunate individual, or victim as we can say, is doing a transaction under the influence of this fraudster. And that's extremely tricky for the business, right? Because in that case, I mean, for obvious reasons, let's say if it's a bank, right? The bank will say, hey, you user have done the transaction, you have authorized this transaction, so you are liable to this thing. That's not a solution, right? And that happens, that's happening around the globe. Then the regulator comes up and say, no, you cannot just say it, right? You need to take the responsibility. You need to put measures to stop that happening, whatever that measure is, work with the industry and do that. When the regulator comes in between the victim and whoever is the business, then it becomes a bit more complicated, I would say, right? Because in that case, yes, it's protecting the user. At the same time, it's costing the businesses as well, right? So the businesses, they need to, of course, do something to stop it. At the same time, if this happens, they need to take some sort of liability. And yeah, that's what is going on. There are a lot many other things are going on and it's at a scary level. Whatever I said, the APP fraud, it is— maybe we can talk about it at some point in the later. It is getting fueled by all these revolution that's going on in the GenAI world. Right.

Okay.

It's much scarier than we can think of. It's not just at the digital level. That's what it is. But we can talk about that a bit later.

So you mentioned targeted fraud, Gautam. So how do they know? And you mentioned as well targeted fraud, you know, maybe they'll choose a target which is, you know, has financial issues or something like that. Where, how do they would even get a list? And in my head, it's almost like a lead list, right? So for any business, like if you're building a lead list, you know, in B2B relationships, you know, you effectively have your best customers or, you know, the best customer persona. You will build the lead list to actually start engaging with them because that has, you know, the biggest chance of success, right? So the moment you said targeted fraud, I'm like, okay, well, they're building a lead list where it's most likely they will be successful with their scams, but how do they even get that information? Because that feels like a privacy level. Right. It's like, how did they get hands of that information?

Yeah, it's, it's, we are providing that information, right? Finding that information and profiling has never been difficult because we put lots of information on our, you know, social media post, on our, let's say, searches, which actually stores some sort of cookies and then they get, you know, leaked out. In our broadcasts, etc. So earlier there were some manual efforts that were needed to profile based on whatever we are actually posting in our social media. And now it's much, much more automated, right? Because these fraudsters are training the machine learning model to create that hit list, as you mentioned, right? Through all these, I mean, even, and again, this is not difficult to create a, let's say, script, a technical script. I'm not— so basically that, let's say that small piece of code will scan the internet for all the, let's say, public and social media posts, extract out the information, feed it into the trained machine learning model, and then it will create that list, right? Where it will say, okay, based on the trained model, looks like these are the vulnerable people, whatever that means, right? Whatever that means. And that's easy, that's straightforward. Okay.

So someone is trying to scam me and let's say I get, you know, potential scam attempt, like I get a message, maybe I get a call, maybe I get like WhatsApp message. Should I presume that, you know, my persona, whatever I have online, actually somehow, you know, went into their lead list, which means maybe I'm sharing too much online? Or is it like still random, you know, when it comes to the scams?

So, you know, if— and it could be both, right? It could be hybrid as well, right? It could be part of that hit list, which is not difficult, or you could be part of some sort of random attempt, right? In most of the cases, it's probably not the random because earlier it was a bit difficult to create it manually. Now with the trained machine learning models, and the open source models, it's probably much, much easier to create that list. But the important thing, and I'll mention it right now, right? I thought I'll mention it later, but because you raised it, you know, you received that message, etc., I'll mention it. How or what is happening right now, right? Earlier, you know, I'm sure you have been receiving, or I have received as well, and I'm sure the listeners have received those messages, right? But just looking into those messages, you will have some sort of intuition how this is fraudulent, right? Because there will be spelling errors, the language will be not professional, right? If they say they are from a bank, the language is not professional. I say, this is not my bank, or this is not my accounts, or this is not my business, right? Now what's happening is these large language models, right? And they're available through open source and easily accessible to these fraudsters as well. They are generating those texts using those language models, right? Even if they don't understand the language that we speak, for example, right? And they can actually— and then the text or whatever is the channel becomes much, much more accurate. That's the first thing. But it doesn't stop there. What they're doing is, as we were talking about, how do they create this hit list? They are scanning our own social graph, our own public posts, So in that case, they're fine-tuning those models using that text, those collected information as well. So the output message to defraud me is not just accurate, it is much, much more personal. It will look like, yeah, this is the language used by my bank, or yeah, this is the language used by my friend, or this is the language used by the company that I'm working with. But it doesn't just stop there. What's happening right now is, you know, there are a lot many content in any form, right? Any multimodal form, not just text, text, image, video, etc. Even books, right? Or articles, blogs. Some of those content become viral, right? And there is a science behind it. Apparently, again, I'm not a neuroscientist, but I was in a conference speaking to a neuroscientist and I was asking, hey, how do they get viral? Is this a random phenomena? And they say, no, it's not random. So something becomes viral for a reason, right? Apparently, again, what happens is when we read those or when we see those, right, the cat videos or some text or some books, right, it apparently increases the amount of some neurochemicals like dopamine or oxytocin in our blood, right? Which means that we start to become emotional. And I wrote an article that Forbes publishes. I call it amygdala hijack, right? So, you know, we have two parts of brain. One is not logical. It just reacts. It's the fight and Flight 1. So that they try to invoke that part of the brain. So basically, using those content, if you read those content, see those content, we become emotional. Then we are not rational, we are emotional. We just act right now. These fraudsters are training the same or fine-tuning the same easily accessible model that they have in their own position. They're training those using these content as well, which gets viral. And which are easily accessible and which can increase the amount of dopamine, oxytocin, and other things, right, which makes us emotional. So now these texts are not just accurate and not just personal, they will make us emotional and do the amygdala hijack. So in that case, even if you know that this could be, you know, from the fraudster, you still act. So, and this is not theory, right? I'm just sharing a story, right? One of my colleagues, and he is a fraud fighter, right? Because that's what we do as part of SecuraID. Our mission is to protect every single individual on earth, right? Right now we are protecting 2.5 billion. Our aim is to do that across all the 8 billion people on earth. And he knows how fraudsters think, how fraudsters work. He knows all the products that we are doing. He knows all the technology, et cetera, right? This colleague basically received some message through some channel, right? And he acted on it. He paid. It was not a huge amount, but still it was huge, right? It was below £100, but still it's an amount, right? And he clicked on it. And after he acted on it, he said, what did I do? And he was embarrassed to talk about that. So we then spoke and said, it's not your fault because show me the message. He showed me. I saw the message. I said, you see what they have done. They have understanding of that you like certain type of things, and that's been used there, right? But the thing is, he then did that again after a few months, even if you knew that, right? So that's the scary bit. None of us are probably protected because when the amygdala takes the decision, not the prefrontal cortex, which is logical, In that case, it's short-circuiting the decision-making process, you know, on action. So these fraudsters can then influence us to take some action where it will lead to, you know, fraud which impacts us and the businesses. Sorry, it was a bit longer kind of explanation, but that's happening and that's scary, and we need to protect the businesses and the users from that.

I love that, that, that was a very good, um explanation, Gautam, and very good use case. So you did mention they try us, they try to get us scared, or they try to get us greedy. And I think on a greedy side, I get that all the time, especially, you know, being content creator as well. YouTube is full of these, you know, and they're very often about crypto or investment where they just, you know, quick get-rich-quick schemas type of situation, right? So this, this is like very much seen. And I don't think that people actually seen in this and go like, this is a fraud. Actually, you know, they, they coexist with everything as a, you know, as a thing because they, you know, they effectively don't really, you know, take money by crime from you. They just have overselling situation where you buy yourself into and then at the end you go like, oh, okay, that, that just doesn't work. But, you know, you gave your money freely because you were effectively emotionally jeopardized and you just got very, very greedy. Well, with the scaring bit, I actually got a couple of messages, you know, back in my home country, which was, hey, I'm in jail, you know, call this number. And then you call this number, it's sort of like police answering and saying you need to transfer some money. So, so that was a scary, you know, scary element. So, so we have those two emotions. And then it leads to this realization for me why when businesses get attacked or scammed or fraud is actually not the business itself, it's actually the individual who works for the business who gets scammed. So at the end of the day, it's always at the person level. So it could be maybe CEO, you could be maybe, you know, CFO or, you know, whatever. You might work through the business email or through the business phone, but you might get scammed at the you know, personal level, and then, you know, the business gets impacted. So, so with that being said, how we as individuals and we as well as individuals working for businesses could prevent ourselves from getting scammed. And the question I have is almost like, how do we go back into that logical mindset when we, when we get that maybe greedy feeling or that scared feeling and we're really not sure what's going on. How do we just sort of like, you know, push that away and go like, okay, let's think logically about this. This is like some steps we can take to make sure that, you know, we validating the situation in a proper light.

Thanks, Mike. And that's an important thing. And as you rightly stated, right, it impacts or it starts with the customer or user of the business, but then it impacts the business as well, right? Not just financially, it's all sorts of other things that we talked about, from reputation to losing the customer, not just that customer, customers, right? Conversion rate, etc. And again, specifically for this, let's say, amygdala hijacking, I think there are certain things that as, let's say, humans, or as, let's say, the customers of the businesses, we can do, right? And it's not really difficult. It's the— so, you know, there is a hot plate there, right? If you touch it, it will immediately react, right? That's amygdala. You're not thinking, oh, should I keep it there or should I remove it, right? That's what amygdala is deciding. But before touching it, if you think, should I touch it or not, that's the logical thinking. You will not touch it, right? For sure you will not touch it. You will have a flowchart going through. Is it hot? 'What if it's hot? What if it's not? But if it's not, do I need to touch it? If it's hot, I should definitely not touch it.' Then you will not touch it, right? That's the logical brain of the prefrontal cortex. But that takes a bit of time, right? The amygdala is there for a reason. That's there for a reason from, you know, our kind of ancestral past or our evolution. It's there to protect us, and it's going to be there, right? And that's the reality. That's our physiological and biological reality. So if something happens quickly, we react quickly, that's amygdala. If we give some time, then it's our rational brain, basically the, you know, the prefrontal cortex. So that gives us a hint, right? Whenever such things happen, you know, give it some time. Even if you're tempted to, just give it some time. I generally give an advice, count from 30 to 1 backwards. If you have reached 1, you still want to do it, okay, then your logical brain is already thinking, right? You may have said, oh yeah, this is the message because I asked them to do something, or I was purchasing something, or I was about to purchase something, or my mortgage was about to— so then it will happen. Again, it's not difficult, but I have to say that Sometimes it may still trigger the amygdala, right? But that's something that we can do as individuals, and it's not really difficult, right? And again, 30 is just an example. You can start with 20 or 30. But the idea is give it some time.

So it just takes as short as 30 seconds when you're in a situation to go like, okay, let me zoom out, let me like count to 30 and see how I feel then. Like that's enough, just a simple 30-second count.

Yeah. And it's not just the time. The reason I said count from back, because when you're counting from back, right, amygdala cannot do that. You are involving your logical brain, your prefrontal cortex.

Right.

So it's not just the short time, it's like involving your logical brain. So while you're counting back, you're actually thinking a lot many things as well. You're thinking, did I actually really request that? Right. You know, and then when the logical brain is involved, you are, you're not completely protected, but you are somewhat protected. That's a simple thing that we can do. Yeah.

So on, so that's on personal level and, you know, let it be on our personal life or as, as employees working for, you know, for the businesses. If something is fishy, we're reacting emotionally. It's a good exercise to do. Let's say I did that. I still feel like I want to execute whatever, you know, I'm being asked for, which is, you know, say, transfer fund. And I think a very good example which I want to use in this, you know, business environment is that there was a story about this scammer which scammed Google for like hundreds of millions. And it wasn't like in AI age, which is recently. That was, I think, like 7 or 8 years ago, if not more, where he simply just was sending emails to, you know, to, to, to Google department responsible to covering invoices. And he would just explain what the invoice is about, you know, would have like a company email and stuff like that. And, and he was continuously getting paid for, for almost a year. And he basically embezzled like a million— uh, sorry, about $100 million until he get caught. So for me, that's like, like, you know, there's probably no emotions. I'm just opening an email, someone's asking to cover an invoice, I'm checking the invoice, seems right. "Maybe I should go and ask someone, you know, around that invoice, but you know, Google was just paying." How do you protect yourself in that situation as a business?

Yeah, that's a very important point you raise, right? And that's, I mean, AI will facilitate that, but it has, it's not purely related to AI. If you think what these fraudsters are doing here is, it's not breaching the security. Right. This is where the fraudster is identifying himself or herself as someone else. Right. So this is actually what we call is a front door fraud. It's an identity fraud. Right. And I just like to go back and this is, this is actually, you know, it's a fundamental to the, to the all the businesses around the world. Right. Whoever is doing anything on the digital space, which is almost all businesses, right? They're not aware of any business who doesn't have any digital presence, right, as part of the business. And no one is kind of protected from there. And this is no one's fault. Uh, this is basically is an accident that happened. So let's go back, right? The internet was never designed to identify the human users. It was invented or designed, you can say, to identify computers, right? And that's why there are IP addresses. So fortunately or unfortunately, we humans do not have IP addresses, right? And the initial days of the internet were all fine because all we used to do was— at least I'm old enough to remember— we used to surf or we used to browse, right? So whether it's me who is surfing AOL or it's you surfing Yahoo, it didn't matter. All that was needed was to identify the returning user, and that's why cookies were invented. Right. But then we started to do some very interesting thing on the internet. We started to do commerce. We started to transfer money. We started to do banking. We started to buy and sell things. And we started to do social media as well. Right. And then it did matter whether it's me doing that banking transaction, it's you, or it's the fraudster, or these days, if it is that AI chatbot, good or bad. Right. Both from both sides are doing the transaction. But the internet was not designed to identify that human user who is actually doing it, right? We started to use internet as an enabler, but that's not what it was. That was an accident, right? Then we started to involve, or we started to add technical solutions which were patches. They were not solutions. So the problem is the internet never had an identity layer, a human identity layer. right? That is missing, and that's no one's fault, right? That still is the case. So the internet was invented in 1989. Still there is no identity layer there. And majority of the problem, including the one that you mentioned, is at the fundamental level. That's where the problem is. Because how do you know, for example, that email when it arrives, right? It may say that it's coming from a legitimate, I don't know, YouTube channel or whoever. And there, of course, they are pretending to be, you know, from someone else, but it's the fraudster, right? In the internet, how do you establish that identity? How do you— as we were saying, right, how do you know that this is not Business X but Business Y, and Business Y is a fraudster, right? We don't have that solution. So we add a lot many kind of complicated solutions or simple solutions. So initially we were using passwords, right? What if the email is protected using passwords? That anyone knows, and we know all the problems associated with passwords. We started to do all sorts of other things. Oh, you send an OTP separately, right? Only the legitimate. So we use that, and again we thought all sorts of problems. Then we started to use even biometrics, right? You put a biometric signature in there. Then we started to use cryptography. You encrypt it, add a digital signature, etc., in there, right? Which establish or tries to establish that. But the important thing is, has this solved the problem? You talked about this thing. This is pre-AI, right? It's happening right now as well, at a much more accelerated way. The unfortunate answer is no, it has not stopped, right? It has not solved that problem because again, the problem remains same. The internet doesn't have an identity layer. Internet doesn't know how to identify we human users. So that way, you know, we need to acknowledge that, accept that, and act upon that. The simple 3 E's, right? And that's what we need to do, uh, right now. Is it really— do we have any solution there? Yes, of course. We just need to work together and, you know, just act on it.

You did mention somewhere about it, like, um, I think it was either your talk on TED or maybe one of your articles that You think that a lot of security issues actually stem from the fact that, you know, we don't have, or have the identity issues, or we don't have a real way of managing identities online. So let's say, you know, let's just postulate, let's just say, you know, some utopian way internet has that, you know, identity layer and we actually can identify people being online. Online, but wouldn't that mean there's no privacy then?

That's a very interesting point you raised, right? So there are three, let's say, aspects related but different, right? We try to mix up on those, right? Privacy, security, identity. We don't talk about identity, unfortunately, a lot, right? We need to, and that's what we are doing from Sakura. I am doing personally as well, and that's what I try to do with my TikTok. And we are mixing up things with security, right? And this is why I said, as you rightly stated, I have been talking about this thing for quite a long— that, you know, first you need to acknowledge the problem. Otherwise, you know, you will think the problem is there, you will try to go there, but the problem is somewhere there, you will never reach to the solution, right? But that will come later. As you said, the privacy, privacy thing, right? Privacy is slightly separate to security identity. I don't think there is confusion between privacy and security and identity. There is confusion between security and identity, including the deepfake things. Deepfake is not a security problem. It's an identity problem, as we can all understand. So the solution is there as well. We'll come to that later. So let me share something here, right, which will probably start to give some hints towards a solution as well. And then we will see that, is this really a privacy nightmare or not? Right. So the internet, rather the web, right, I'm using them as synonymous. They are not, as we all know, right. But when we say internet, we actually talk about the World Wide Web, which was 1989 when Sir Tim Berners-Lee created it. 4 years later, in 1991, there was a parallel internet that was created. Right. I didn't know that. I'm sure you know it. The problem is we don't call it the internet. Right. That's the mobile network.

Right. Okay.

Right. But if you see from what the internet does and what a mobile network does, it's very similar. It connects, you know, components or let's say connects mobiles or a similar network or similar device. you know, to another one or to a business or to, you know, some other, who knows, IoT server, etc. That's what the internet does as well. We don't call it the internet, but I call it the alternative internet, right? The way that alternative internet behaves is very different to how the traditional internet behaves purely from identity perspective, right? So for example, I want to pay you for any— let's say I bought something on, you know, some— let's say eBay, right? And I want to pay you, right? How in the traditional internet behavior, the first thing it will say, stop, you cannot pay. That, that's wrong business, right? If I want to pay any business, you will just facilitate it. But the internet will behave in a way— the traditional internet, hey, stop, you cannot pay. Why? Because it doesn't know how to identify me and you, right? It will say, first you prove You are Gotham. I'm going to challenge you. eBay will challenge me as a service. How? Password, OTP, biometrics, who knows what. After I successfully respond to the challenge and say, yeah, you have proved that you are Gotham. Now you can pay. That's how the traditional internet works. Challenge first, then do the business. Let's come back to this alternative internet. If I need to receive a phone call from you, my mobile operator is EE, right? EE will never say, hey, you cannot that phone call from Mike until you prove you got him. That will not just be funny, that will be unacceptable. I'll never use that operator if it does that. But it doesn't work that way, right? So it just knows who I am. It just— and that doesn't mean that it's not secure, because let's say the mobile operator, they are extremely protected from licensing perspective, regulatory perspective. So for them, security is extremely important. They will never ever kind of confuse that identity. And instead of me receiving the call, someone else will receive the call. Those certain things happen, but that's it, right? But generally they will not do it. So it just knows that it's me, right? But without challenging me, the behavior is very different. So this alternative parallel internet knows how to identify the human users, and they have been doing this thing since 1991. How do they do it? They do it through this SIM, right? And I in SIM stands for identity. I have been saying this thing for very long, right? But that is just kind of left at the corner for more than last 30 years, right? Now coming back to your question on privacy, is this a privacy nightmare? Mobile operator knowing that it's me Have we ever raised that as a private indictment? So do we actually expect that the mobile operator should behave in a way that when I receive a phone call from you, first it should stop and say, do you want to take that call? Prove you're Gautam. Go through that challenge and then only take. That will not work, right? That will not be acceptable. So that's acceptable from regulatory, from personal experience, from businesses, from all perspectives, right? And we have accepted that and we have been working on that from all privacy domains for more than last 30 years. Right. So in that case, if the internet, the traditional internet somehow gets that identity layer as well, I don't think there will be a privacy complication. Again, it depends on the details and the implementation as well. But getting that analogy from how the mobile network works. Where there is an acceptance, we don't raise those privacy issues, I think we can solve it.

So you can't really be then fully private if you're using a mobile network to browse internet? Is that what we're saying?

It is private, right? Because we are talking about how does it identify me as the user. Right? That is me without involving me. And that's what is more in sync with our organic world, right? And I talked about it in my TED Talk as well, because the theme there was synergy, right? So basically the theme was our organic life and our digital life. How do we create that synergy? In the organic life, we don't work in a challenge way, right? So for example, when we meet, we don't challenge each other, even if it's a stranger, right? We try to establish that identity ourselves. So if I need to establish the identity, I will establish myself with my past personal narrative, other things, right? I will not involve you. I will not challenge you, right? But the traditional internet does the other way around. So the business, let's say in the eBay example, eBay wanted to identify me as a human user. right? eBay didn't do it themselves. They involved me, who they wanted to identify me. In the organic world is different. If I want to identify you, I will establish it. If I am not happy, then I'll walk out, right? In the mobile network world, the mobile network needed to identify me, so they didn't involve me. They did it themselves. That's more in synergy with the organic world, right? So that basically is what I was saying. And then That's privacy sensitive, not just privacy sensitive, it's privacy protected as well because my privacy is not compromised in there.

Okay. You still have like burner phones, right? Where you have like a SIM, but at the same time that SIM is not tied to anyone.

There will always be exception as we all know, right? In the security industry, if someone says, oh, this is 100% secure, that's not appropriate. That doesn't exist. Exist. That will never ever exist. I mean, not just in the digital world, right? In the organic world as well. 100% security is, yeah, it's more of a utopia, right? We need to make it, we need to reduce. It's more of a risk management than solving it either zero or 100%, right? That's how it works.

I love that positioning of risk management rather than, you know, having 100%. Nothing is 100%, especially around security. Can I put in that question, Gautam? So when businesses think about that risk management and they think about that protection, uh, operationally speaking, that like a lot of this is, um, just feels big. Like, you know, there's a lot of, uh, almost like processes, you know, don't pay before you get confirmation, you know, maybe, you know, get identity confirmed, you know, here's the steps and stuff like that. So sort of like adds a burden and, um, and slows things down. Like, what's the most optimal way to sort of, you know, reach that Goldilocks zone where you, you know, you're investing enough so you're managing that risk as a business to not get scammed, but at the same time, you know, you're not, you're not really over-leveraging that so it becomes a burden of employees and, and the business operations?

Um, that's a very good, um, you know, point you raised here as well, is It's necessary, but at the same time it shouldn't be a burden because otherwise, you know, the business will not be sustainable, right? The way I see that is the businesses has— they have a specific objective, right? Whatever business, if it's an e-commerce, they want to create a platform for connecting the buyers and sellers, right? That's what their business is. That's where their focus is. That's where their specialization is, right? If it's a bank, their specialization is in managing payments, managing money, right? If it is gaming, creating the most, you know, kind of intuitive user experience is what their focus is on, right? And connecting gamers in there if it's a multiplayer game. What we are talking about here is again separating out security and identity. Majority of the cases, it's identity problem. We will talk about that a bit later. And that's a specialized thing, right? That doesn't have to be and can be, but doesn't have to be part of that business because that's something that they have to do, but that's not something they need to do themselves. There are specialized entities, right? Can call them companies. They specialize on that. So work together, let them solve that problem. Of course, there needs to be some commercial, even if, you know, those businesses do it themselves, still there's a cost to it, right? So in that case, you can focus on what your core you know, value prop is, rather than focus on something that's not your value prop, but you have to do it, right? There is no way that if you ignore it, then your business will be impacted, your growth will be impacted, as we discussed. So that's what I generally suggest, that work together, right? There are entities who are special. They're not doing anything else. They can't do e-commerce, they can't do gaming, they can't do banking. The only thing they can do is solve this problem. So work with them.

Okay, let's I love that, by the way. Um, startups come to my mind where they probably just will try to do that themselves. Like, you know, um, it depends on the size of an operation, you know. If you're a business like, I don't know, 10, 20, 40 people, something like that, potentially they will have some, you know, issues, let's say, like this, like partnering up with an actual security firm, which leads to a question. Is what you just said, Gautam, a cybersecurity type of service, or is it more like of identity management type of service which helps you to prevent from frauds? Is it the same picture, or is it like two separate pictures?

I would suggest they're two separate pictures, right? Because I have been in the security industry for very long. Right. My view is majority of the security problems are either solved or we have a solution to it. There is a cost to it, but there is a solution to it. Right. Because security is not really for humans, it's for machines. Right. And the digital industry, the technology industry has advanced so far that we know how to do that. We can use advanced cryptography. We can use, you know, we can, we are even talking about post-quantum cryptography and QKD, the quantum key distribution, etc. We are talking about 10, 20 years. Ahead, right, from security perspective. I think the more important thing, and again, I think this is a theme we are talking about again and again, this is where I'm focusing most of my time as well, is in the identity, right? This is where the protection is needed. Majority of the problem, and this is not just I am saying it, there is something called the Verizon Business, they publish something which is very popular in the security industry. It's called the DBIR, Data Breach Investigation Report. I think it comes around November or December. It will be interesting to see what you know, what they actually show. They do research around the world and then they publish what they have seen in there, right? One statistic that has remained consistent for the last, I believe, 5 years, right, is that 80 to 86%— that's the range, right? It changes from one year, it's 80, another 81— but 80 to 86% of all, um, you call it security issues, data breach issues are related to what they call credential. And credential is— you translate it to identity, right? Credential is a general term used in identity. So that's what that report is saying as well, right? And that's what we need to focus on. So, you know, what is the intention of that fraudster trying to, you know, scare me or, you know, doing whatever, right? It's to use my identity to do a transaction. So it's an identity problem. Right. If someone is, you know, kind of hacking into some not so protected, let's say, service, right. They steal the entire, let's say, user base, right. What is their intention? They don't want to harm probably that small business. Let's say it's a florist and the end of the street, right. Let's say they have a digital service. Their system will not be that protected, right. They will steal it for what? Because they have done a, let's say, security attack into that business, right? Stole, let's say they have 1,000 or 2,000 user base or maybe 10,000, right? Stole those. They don't want to harm that business because then what they will do is, because this is not that protected, their user base, probably it's kind of, you know, hashed passwords in there, right? What they will do is use their rainbow table, extract out that actual password, and then because we users are humans, right? We will reuse those passwords by changing probably the last digit as 1 or 123, etc., right? Yeah, these fraudsters know it, right? What they do is then they will do a front door attack, an identity attack to more premium service, could be to the e-commerce service. Maybe the banks are more protected and things like that, right? So in that case, all these, let's say, problems that we need to solve, and that we are facing are identity problems, right? So that's why, and again, it's not just about these big businesses because they may want to protect these big businesses, let's say established corporates, etc. Of course, they need to protect their backdoor, which is the security problem, side door. The front door problem is an identity problem, right? And that can, that needs to be solved for the startups as well. And then of course, the commercials come in, oh, is it very expensive? Doesn't have to be. And it is not right. And that's something that we need to talk about more and more and more in the business because these startups are getting targeted more now because they are easy targets if they want to do everything themselves.

Yeah, that's 100%. It's just so much easier to attack, you know, hack or social engineer or, you know, whatever is your— yeah. Attack vector, let's go like this. It's so much easier to go after, you know, startups. Maybe it's not such a big payout, you know, not sure. I don't run a fraud business. But yeah, I absolutely see that. I'm using 1Password and, you know, not affiliated, so not promoting. But before that, I used LastPass. Again, not affiliated, not promoting. And one of the things which happened with LastPass, they got hacked like multiple times, right? And I was keeping all my good passwords, you know, in their tool, right? It was credential management tool. And as you mentioned rightfully, if we try to keep our passwords in our head, it's going to be like some type of pattern, which is probably good. You know, I personally have a pattern where I use, you know, domain to come up with the password. So it's sort of, you know, dynamic in that sense. But a lot of people just have like one generic password which they use all the time, and they again like mention numbers at the end. So that's not the best, right? So, so using a password credential management is great, you know, works on the phone, works on a, on a machine. But then if they get hacked, like, that's it, right? Like, they know everything. And you could be even storing your credit cards in there, in, in that service. Which means if you're running that service, you just have a huge target on your back, like, all the time, because, you know, you, you become a database of, of just gold mine, right?

Yeah, absolutely, Mike. And, um, again, we need to acknowledge that. I think I talked about it, I just briefly talked about it in my TEDx talk as well, right? So we need to identify a solution and hiding the problem because they're not the same thing, right? So let's talk about password and again, nothing against any specific one, as you mentioned, right? But actually talking about the problem and what is not a solution in the industry, right? We know password is a problem, right? From human perspective, because that's not— and by the way, you know, this is what I always say, Passwords are one of the oldest technology, if you can call it a technology, is we are still using, right? It was invented in 1961, even before the internet was born. But anyways, that's strange. So passwords are a problem. It's easy to manipulate because we humans cannot remember all those. If you just use one digital service, fine, right? You can create a very complex one and you remember it, but it's good. For the industry, for us as well, that we use lot many services, then we can't remember, we can't put it in the head and you don't want to reuse it. So then what do you do? Use a password credential manager where you put all your passwords and protect it using some sort of credential. Initially there were passwords, now there are other things coming up as well. That's hiding the problem. That's not really a solution. Right. And that becomes a honeypot for these fraudsters. The fraudsters, the first thing they will do is keep trying manipulating that, because in that case, their kind of scale of the attack and the business becomes much bigger, like what you said, right? What happened with one of those, right? And again, this is why I say we need to differentiate between a solution and hiding the problem. So Password Credential Manager is hiding the problem. You're not getting rid of passwords because the problem is we need to move ahead from passwords. Right. You're not solving that. What you're doing is you're hiding it with something else on the top, either using another master password or some biometrics, which is even more dangerous than password, and, or, or something else, right? So I think we need to acknowledge that this is not a solution and look for a solution. And again, I would say solutions are there, right? They have been there for quite a long time. We just need to talk about it and use it.

Okay, so what would be the solution then?

I think we— I started to hint from the earlier. The first acknowledgement is we talked about right now, right? Let's differentiate between solution and hiding the problem, right? We all— and this is no-brainer— we all want solution, not hiding the problem. Secondly, um, the problems are majority in of the cases are humanized and identity problem, not really security problem. Security, we know how to solve it, right? It's just a matter of cost to solve that security, right? The third thing is we talked about it, we can actually learn from what's happening in that parallel internet, right? So let's talk about it a bit more. And then now the security and identity industry have acknowledged it as well, right? The hyperscalers, I'll name them Apple, Google, right? They have, because they are influencers, right? They will, everyone will listen to that and they will create the technology which will then proliferate, right? And that's important. They're talking about cryptographic, they're calling authentication, cryptographic authentication. Of course, it's cryptic. We technologists can understand, but for common people, they use terms like passkeys, which is great, I would say, right? So that's the solution you can, and then Interestingly, that solution has been there for very long. We have not created any new cryptographic algorithm for very long because that's mathematics, right? And the interesting thing is all this cryptography are based on prime numbers. And when did prime numbers got introduced to the world? 300 BC, when Euclid, you know, showed what prime numbers are. So the solution has been there for very long, but we were not acknowledging the first two, that we were trying to hide the problem, and we were thinking that there's security problem. So actually, interestingly, we solve majority of the security problems using cryptography, majority of those, right? Some form of cryptography. So the identity problem, if we acknowledge them as identity problem, can use the exact same solution. Right now I'm coming back to what I was saying about this alternative internet, right? Where the identity layer of that alternative internet is there since day one. The first SIM-based GSM call was made in 1991. And it knew how to identify that. How did he do that? Using cryptography. Then let's go to the next level. How did they apply cryptography? Where did they apply cryptography? They did it through the SIM. The SIM is nothing more than a cryptographic engine. That's what it is. It's a hardware-based cryptographic engine from 1991. You can talk about eSIM, etc., but still it's the exact same thing. It's applying some— so there is a cryptographic key. That's why to get a SIM anywhere in the world, you have to go through some sort of KYC process, right? It's painful, but we have to go through that. Why? Because after that, that SIM will contain a unique cryptographic key which is allocated to me, right? That will identify me, right? That's why again, I in the SIM stands for identity, right? That's how they're doing it. So that cryptographic solution which the broader industry is saying, that's the way to go, that's there. But now I'll put in some additional things there as well. So that basically is the solution. Cryptography-based protection or identification is the solution. And again, things might change after quantum computers become, you know, proliferated. But I think we have a decade at least, right?

If I get internet, which I have at home, I'm going to have like a SIM in my router or something like that. To go online, and that, that effectively will, will identify the information which flows through my router, goes into wide internet, as me.

You don't have to, you know, in majority of the cases. And again, this probably changes between geography as well. How do you access majority of your digital services through the internet? I mean, through what channel?

Well, I use, um, internet provider which did KYC on me. So they probably know any traffic which goes from, you know, my router is my traffic.

Yeah. What I mean is personally, majority of the digital services, how do you access your bank? Right. It's probably from the banking application on your phone, right? Yep. How do you access social media? Right. Through your phone. Right. So there is already— you are actually using this. So that basically is an irony, I feel, right? That same phone, this phone has that cryptographic engine sitting here which can do the cryptographic authentication, identification, whatever you call it, right? But the digital services should use it, can use it, must use it, I can say, right? It's not been used. We are actually going back to the traditional internet and use the solutions from there, including all those password credential managers, as you mentioned. right? That's something we can change, right? It's already there. Let's just use it, right? And another thing I will just say that there is, it's brilliant as I mentioned, right? So now for example, in iPhones, there is Passkeys there as well. And many of those businesses are using Passkeys, which is cryptographic authentication. The problem is inclusion, right? The problem is that where are you? This is why I mentioned earlier, right? Important to not just say that cryptographic authentication is one of the solutions for now until quantum computers come in. It's also how do you do cryptographic process, right? So many of these processes, let's say passkeys as well, they are using the mobile device to do the cryptographic operations, right? All passkeys are using PKI-based cryptographic processes. Now, if I use this high-end iPhone device, perfect. There is a keychain there. You know, there is a dedicated chip there where the cryptographic process will be extremely secure as a business. If I am providing— so if I'm the bank, I'm very happy because my users are protected, right? So I can then use my— let's say if I'm that bank, the banking application to use the cryptographic process from the device, right? And then I identify the user, let's say me, right, using that. Brilliant. It's secure. And at the same time, it's identifying without impacting the user experience. Now, the problem is if I as a user cannot afford that high-end phone, right? So there are— so for example, in Sub-Saharan Africa, in Southeast Asia, we are working in India heavily. In India, you know, the devices may cost from, I don't know, $10, $15 to $1,000, right? What if I cannot afford it? So in that case, I will miss out. I'll not be included in that secure, seamless identification, right? If we use the same cryptographic process, but from the device, and that's not fair on me, that's not inclusive, that's not fair on the business as well. Just think of that bank, right? Or the e-commerce provider or the gaming provider. They cannot protect their user because even if they're using cryptographic thing, right? Because their users cannot afford it. That's unfair. Now, if you use the same cryptographic process— not same technically, a different, let's say, cryptographic algorithm— but use the SIM conceptually same, right? Is the cryptographic identification seamlessly, but use the SIM as a hardware, right? In that case, it doesn't matter if that SIM is in a high-end iPhone 16 or it's in that $10, $15, you know, kind of other OEMs, uh, phone. It will provide the exact same protection, exact same identification using the same concept which these high-end things are using. So that becomes, I would say, a solution. And it's not just, you know, kind of, it's not just business, right? It's for the society as well. Because, you know, we know that phones in many of the, let's say, not so developed economies as well. Let's say Sub-Saharan Africa, the phone, they may not have much, you know, other digital goods or digital gadgets, but they will always have a phone. Not because as a luxury, because that becomes your survival toolkit, right? That's the reality right now. And every single phone on Earth will have a SIM providing or doing that cryptographic protection right now. Why don't we use that? That's it.

Okay, I know we talked about privacy I still feel like it's like if I have a SIM, if I'm KYC'd to get a SIM, anything I do online can come back to me, which ultimately means there's no real privacy if I'm using that device.

Not really. There are two parts to it, right? Because there are multiple, let's say, entities involved, right? The SIM is an asset or a property of the mobile operator, right? So anything that's going through the mobile network, right? If you see that the mobile operator is sniffing in or knows a lot, that's not true. Same applies to, you know, the ISP, your router, right? Everything is going through that. That doesn't mean they are actually sniffing in everything. On the contrary, mobile operators are heavily regulated. Extremely, it's part of their survival. The licensing costs, the regulatory, there is no geography on Earth where this is not regulated. I mean, the type of regulation will be different, but they are all regulated. So there is, the operators cannot actually sift into that, cannot, just cannot, because getting a license of a mobile operator and getting the, let's say, the radio spectrum is a is a very, very complex process. It costs a lot. And then there are strong licensing. That's one thing, right? On the contrary, the ISP, that's not like that, right? There is not strong regulation other than net neutrality and other things, right? It's a bit softer. That's one thing. Second, so that way the privacy angle can be seen, right? Mobile operators, no way. I mean, if some rogue mobile operator tries to do that, they will be caught, right? And then the penalty is so much they lose the business straight away. Not just lose the business, they will lose a lot of deposit on their, let's say, spectrum allocation and licensing. Right. So that actually deters them from that. Right. So now come back to the other aspect. What about the businesses? Right. So let's say there is a business who their digital, let's say, service is done through an app. Right. That's sitting there. Right. And then that app is then utilizing cryptography in the SIM, right? They don't know anything what's going on through the mobile operators. All they do is they use the SIM cryptography through, you know, some mechanism. We actually provide a service in many countries. We call it SIM-based auth or SaferAuth. So where all they are doing is, hey, please identify or authenticate this user, okay? And then tell us that this is the user who they are claiming to be. That's all. That's all they know. Right. This is no different to any other mechanism, whether they're using themselves using user ID password or themselves using some form of, let's say, OTP. That's very popular. Or themselves using biometrics provided by the OEMs, Face ID or whatever. Right. Or themselves using some cryptographic process provided by the OEMs. It's no different to that because all they're doing is they're asking whoever is providing that solution, they're saying, hey, can you please confirm that this user is same who are claiming to be? That's all right. Is this privacy nightmare? Probably not, right?

I get what you're saying from that perspective of being, you know, within that— what's the word I'm looking like— network as a business. You don't ultimately care. You just want to identify to be able to run your business operations.

Yeah.

So, well, when we're talking about this, you know, the same device and you're doing actions online, what, what I remembered seeing, couple of articles online where in UK, you know, government just came to people's homes to arrest because they said something online. And that, that was, was playing in my head, and I was like, well, how did they know that that was the person?

Yeah, and you're right, right? So let's accept few things are— and then this is independent of what sort of network is being used, right? Whether it's the traditional internet or this alternative internet, as I call it, the mobile network, or some sort of, you know, in the future, some sort of satellite network they're using, right? That's slightly different. I don't think, and again, I'm not a lawyer, but whatever I know, at least in this identity space, the states generally cannot do that unless there is a regulatory or sorry, the legal, not regulatory, legal need for. So that's called legal interception, right? And there's a very complex process. I mean, I have worked with mobile operators for very long, right? I know that process, right? So the way it works is there needs to be some sort of very specific case against an individual or a group, right? That needs to be signed off by whoever is the legal authority, magistrate or whoever.

Okay.

They will challenge, right? Then it will come to that. Then whoever is the network, whether it is the ISP, whether it's the satellite network, whether it's the mobile network, they will get some sort of official legal notice for legal interception, right? Then only it is possible, right? Is it right, wrong? Don't know. That's a separate discussion.

Yeah, I get you.

It's not, it's not that straightforward process that anyone can think.

Okay, so let's say I'm a business, I'm listening to this and I'm like, okay, well, you know, clearly situation is getting more serious, you know, AI advancing, all the fakes and whatnot, you know, and Maybe we got scammed or maybe we got attacked. So I'm very cautious about the fact, but at the same time, like, I don't really know where to go and how to just get my employees into the next level or into level up to be more protected as a business. I can of course use a partner, cybersecurity partners, identity fraud management partners, but let's say I want to keep this in-house. So what plays in my mind is like, is there, you know, compliance certification or frameworks which, you know, by doing them and passing these compliances and getting certification, I know that my employees are exposed to, you know, workshops and knowledge sharing and things like that. So if I get that certificate, I know that, you know, we at least now know stuff.

Very good point. Maybe that's what we need to do as an industry more and more. Not just from compliance certification, maybe to, you know, reach out, evangelize, share the knowledge, which we have started right now. As I said, there is not enough talk about identity. That's the major problem right now, not really security. We need to do it more and more, right? Coming back to compliance certificate, which is, let's say, generic, global, works across all, there is not many, right? So the ISO 27001 from 2000 and 22, they have added a lot many of which are looking into the IAM, right? So the businesses, when they need to go for that compliance, they need to show a lot many of what they call controls, right? In the identity space or other IAM space, right? So that's one thing. But is that enough? Personally, I think no, we need to do a lot more, right? Because compliance gives you a confidence, but it doesn't solve the problem because otherwise, you know, we will— ideally what I want to see is that Verizon DBIR that I said, this is why I said I'm eagerly waiting for November, December when it comes, that 80 to 86% starts to go down and at some point it will never become zero, but in 10 to 20, right? But that's not the reality, right? So all these compliances are there. Is it really solving it? No. So we need to talk a lot more. We need to evangelize as an industry. We need to talk about the problem, where to look into, and what the solutions are.

Okay, so let's engage. Well, engage my amygdala and make me scared, Gautam. Like, give me the worst possible future with AI at hand, you know, fraud and scams. What could be like the worst picture when it comes to this topic? Future-wise.

Future-wise, it is much, much more scarier than— and again, I'm really sorry, I don't want to scare the listeners.

No, no, do it. Let's scare them.

Let's— it's much, much more scary. And then let's think of how the digital industry is moving in. The digital industry had a bit of an inertia. Some things never change. We never even thought that they need to be changing. And the most important thing which is interesting is the user interface, the way we interact with the digital service in the digital world. That has not changed. It's either through an app through a website. That's how it works, right? And we never challenged it. We tried to beautify it. We tried to create the most intuitive user experience, but still the channel never changed. There was a keyboard, right? There was some sort of screen. Doesn't matter whether it's in a laptop, in a PC, or in a phone. That's how we were interacting, right? That is changing. It's— that's just started, right? The way I see that is the world is revolving between 3 A's. The digital world. There are more, but these three is apps, APIs, and AI. So APIs are big as well, right? And then that is part of that future equation. So if you see, I think Akamai published that, you know, I think more than 80% of all, let's say, internet traffic is through APIs. It's not what we are doing, through the APIs because, you know, businesses talk between each other using APIs, right? And apps as well, right? Apps are that part of that, our gateway into the digital service, right? And every single digital service has some form of app, either a native app or a web app, because that has been an initiative. But this AI, it is actually creating a disruption right now, and this is the future, right? And that disruption is converging all these Right, what does that mean is the best user interface that anyone can think of. So how are we interacting right now? Right, through language. Language is the most intuitive user interface, right, that we have been using for I don't know how many thousand years, right? But in the digital space, that's not what we were doing. In the digital space, it was through those apps and the user experiences. And with this large language model in the AI revolution, that is— so the machines used a different language. We were using a different language. Machines didn't understand English, let's say, or any other language that we speak. And we didn't understand as humans the language that the machines speak, right? That's why we had that kind of bridge in the form of apps and APIs between the machines, right? Now that's breaking. What does that mean is now we will interact, we will probably not need apps. There will be a major shift happening on even with, let's say, laptops, phones, etc. Then we will start to use language. For example, I may not need a navigation app where I open and I type in the postcode, etc., in UK. I'll just say it and I don't care what app it is. I'll just open up a device, say, hey, I want to go to Oxford Circus. And then for that, the AI will have that intelligence to see that, okay, my preference is, you know, you'll be using, for example, one rideshare service, right? They will order it and it will come to that. So that's happening. And now you can think where this fraud will go into because we are using language, we are thinking, we are giving a lot of kind of Yeah, all our tasks to these agents, and then the agents will interact with each other, right? So there's an agent that will be sitting in that, let's say, device that I'm holding, whatever that is called, right? That will interact with the agent from the rideshare service that will negotiate. So that's where the attacks will happening. And why is it scary? Because we will not see that these two agents are interacting with each other, which is going to impact me financially or I mean, what if that ridesharing, let's say, agent is being compromised by the fraudster, right? And then it is actually navigating me towards, you know, unknown country and towards someplace where it impacts my personal security. I'm getting kidnapped, for example. I'm going more extreme, but that's possible, right? And then the important thing is it's not distant future. So Yeah, I don't know. I'm sure you've seen this, right?

Yeah. So I mean, the man-in-the-middle attack will get just a different meaning. Like, you know, right now it's— it has a meaning, but when it comes to the outcomes of such attack, it's just going to be on another level.

Completely agree. And, you know, we need to probably rename it. First, acknowledge it and rename it. It's not going to be a man-in-the-middle attack. It will be AI in the middle.

Yeah.

So it will be the AI talking to another AI, one agent talking to another agent, AI agent on behalf of me. But I have no clue. I don't have even visibility. Right. Which agent they're talking to. And then the fraudster will be another AI agent sitting in between.

Yeah.

Either manipulating the discussion, confusing the discussion. We may be, you know, our amygdala hijack problem might get a bit better. Because I am not involved, right? I am not taking that decision. I am not taking that action. It's that AI agent on behalf of me is taking that action. So I can start to feel safe. Yeah, I'm not deciding. Don't try to fool me. But the most scary thing is something is happening that I have no clue, and I have no— don't have any visibility, and I will never have that visibility. So that's the scary bit, and it's not distant future. This will start to happen very soon because those devices are happening where they are converging these and these 3 years.

Okay, and that wraps up our conversation for today. A huge thanks for Gautam for sharing all those insights and experience around identity management for protection. If you enjoyed the episode, please subscribe, leave us a comment on Apple Podcast, Spotify, CastBox, or whatever you're tuning in from. So Gautam, if people want to learn more of what you're doing or what Secura.id is doing, how do they find you?

Uh, thanks a lot, Mike. And it's very important, as I mentioned again, that we need to continue this discussion and the dialogue, right? And we need to work together on that. So please reach out to me if you want to talk more. We have— we do LinkedIn post at least once a day, right? Where we want to talk about the problem, the solution, what we have seen, right? For Secura, please see all the, let's say, posts that we are doing in the Secura.id website. I personally write whenever I can about my thought piece, and then some of those pieces get published in Forbes as well, in Forbes Technology Council. And the most important thing is let's discuss, right? Please reach out to me through LinkedIn or any other mechanism. And I'll be very, very happy to talk, share, and listen as well, right? If there are some personal stories, which I hear all the time, and they are important because they give more oxygen to us to, you know, protect every single citizen on Earth. Thank you, Mike. Thanks a lot.

Excellent. So if you listening to this, just scroll down. If you're watching again, just scroll down, check the show notes, All the links will be there, how to access Gautam and how to learn more about what Secura.id is doing. Thanks again for tuning in today to listen to another Mastering Tech Growth episode. Until the next time, stay safe and see you online.