Opal Security's Umaimah Khan on Security-First Identity

Hey everyone and welcome to this week's episode of Gray Matter. I'm super excited to have Umaima Khan here. Umaima is the co founder and CEO of Opal Security and I've had the pleasure of working with her at Opal since the company got started and super excited to have her on today to talk more about herself and what Opal is doing to redefine identity security. Umaima, welcome.

Hi Sam, it's good to be here.

So we have a lot to talk about, but let's just start really high level. Like for our listeners who aren't aware what is Opal Security and what does Opal Security do?

Yeah, we are an identity security platform and we are designed to cover all of identity and access management. So what that means is we ingest, normalize and calibrate Identity and Odyssey data across all systems. So not only can you see who has access to what at any point in time, but you also have the necessary context and workflows to calibrate and remediate. So why? The goal is to allow people to attain what we like to call real world least privilege. So flexible, scalable, adaptable, intelligent. I'll probably end up using some analogies over the course of this conversation, but one we really like to use internally is self driving technology. So if you think about driving a car, it's actually very, very environment dependent. The level of urban development, the relative experience of the driver, local rules and regulations, cultural etiquette, and then there's also some commonalities on what consistently good driving looks like that's largely driven by regulation. And so think about identity and authorization as the very primitive stages of this. There's no continuous sensor data, let alone infrastructure or algorithms to help make good automation decisions and update flexibly. But eventually you get to a point where you can operate in that land and you have a human in the loop on the most critical decision systems and situations to learn from. And so interpretability, transparency, resiliency matters a lot of. So you know, from a product standpoint what that means is not only do we build the underlying ETL and data layer, we also do a lot of classic ML and graph analysis so that we can actually start to get people sort of in the habit of thinking about access and identity as sort of scalable, continuously monitored security first system.

Yeah, one thing I want to, you know, mention and ask you about and then we'll jump into Opal and kind of where you were talking about there at the end. You know, I often get asked as a venture Capitalist, like hey, what do you look for in a founder? And actually often I think of you and in the specific way I think of you and there's many things I admire about you, but the specific thing I think about is you're both highly technical, but you also understand the customer and how to get the customer to value. And I find for many founders who have come from technical backgrounds, whether it's math, computer science, engineering and companies, they might have the technical component but then they don't have the other half of the equation. I want our listeners to learn a little bit more about you. So, so tell us a little bit more about yourself and mamah and like how did you, how did you get to starting a company and now being the CEO of opal?

Oh God, yeah, that's a, that's a fun one, right? I think for me this has been sort of both idiosyncratic and organic in a very unique way. I've mentioned this a couple of times. I was homeschooled so that was probably a pretty defining moment in my life. I would describe my childhood as largely unsupervised or feral, depending on how you want to think about it. But you know, it's good training for startups. I used to be self conscious about it, but it actually got me in the habit of like sort of thinking about goals and ambiguous environments. I fell in love with math as a kid. I did a bunch of pure math both in high school and then in college, mit and sort of initially was very, very set on being an academic. I thought, you know, I'm going to go be a math professor somewhere. And you know, it was a lot of fun. I would say I like very big ambiguous problems where you can kind of connect the pieces and think about unification and think creatively. But I also realized I go absolutely insane when I don't see results. I love the dopamine hit of actually seeing things get somewhere. So what I sort of fell into was cryptography. And cryptography is very unique in that number theory used to be considered largely a totally useless and an incredibly beautiful field until World War II where people realized there were security applications. And this is actually, I think one of the fun things about security. It has this, this, this characteristic of taking these very abstract technologies and making them very real world. After that I went to dc, I worked in the federal government, I worked on cryptography research and ended up over the course of my career just getting like a ton of exposure. After that I worked at an early stage startup, I worked at a mid Stage startup. I worked in open source and I think just had this rate of learning and exposure. And there was kind of a couple of unique things in retrospect I noticed. One was I like working in enterprise. I think the constraint of pragmatism helps when you're naturally a very creative or product oriented person. It's a really aggressive combo if you can leverage it. And also you get to observe problems before the market sometimes realizes they're a thing. So in my case in particular, I constantly, I consistently noticed, from breaches of the government to small startups, that identity and access was basically an issue everywhere, like all the way from my time in D.C. to super early stage companies. And it was kind of fascinating because people would almost treat it like a professional services problem. They wouldn't actually give it this gravity of being a technically difficult and ambiguous problem. So they'd either ignore it entirely because they believed there were more hardcore security problems to solve, or that there was one standard of technology that would emerge and solve everything. And I initially kind of thought like this too. And then I sort of realized, wow, this is incredibly naive. Like we have so many great technologies. We've had this like very steep innovation curve in authentication and authorization and identity. We have the latest and greatest in encryption standards and multi factor, etc. And while they're all excellent, there was just sort of this key insight. I realized that they're all strategies. The problem is not building these technologies, it's how you deploy them and in what combination and in what environment. So the short answer is I effectively went crazy and talked to anybody who would listen for like a period of two years about this was the problem. And I met many skeptics and also many believers and ultimately it led to opal.

I like many of the things you just went through there and a lot of it resonates, including the place, or I should say the lack of pace of progress in certain academic contexts, which I also remember from my past. And so are the things you did kind of in your career prior to Opal that helped you build like that understanding of how does one actually interact with the customer? How does one connect what a customer is saying to a product? How does one then go deliver that product? I see that now every day at opal. But like, what gave you the understanding of that?

That's a, that's a great question. I mean, some of it is like, you know, I was just fortunate to work in, in those types of environments. You know, working in the defense industry, working in enterprise software, you, you, you Sort of understand the ways that businesses scale and, and, and how to, and even if you're not the person leading those conversations or your front of house, it's, it's extra exposure. That's kind of what I was saying. The second thing is, I think for me personally, I think it's a type of self awareness. I feel very comfortable that I will always want to solve things technically or think creatively or think from a technical standpoint. And so it's a learning opportunity to try to think about how would I solve this in another way. And I think sort of there's this broader observation that there used to be this dimorphism where people used to think like B2C companies, product companies solve product problems with product or technology and enterprise companies solve things by just getting feedback from customers. And I don't think that it's that clear of a distinction. I think you actually need both. And so it's recognizing that it's not zero sum, it's not either or, and sort of just generally approaching it with curiosity. Right. I think it's a little bit of like the humility over time of realizing like abstractions don't solve everything. Listening does, Right?

Yeah, exactly. And it's, it turns out it's really hard to listen and actually understand like what a customer is asking for.

Yeah. And I think like one other piece I'll add to that specifically about security is that, you know, sometimes people talk about this concept in the security market of there's no silver bullet. Right. And the idea is that you're often operating in a situation where you don't have a ton of very clear or crisp open information or before and after until after a breach happens. And so when you think about buying or selling a security product, it comes down to more than just saying, well, my product is good. It's like self evident. You actually have to sit and understand how people process technology fit together.

Exactly. You talked about kind of the path to thinking about authentication, authorization, identity challenges and all of this is like even more important in today's world. I feel like every week I read the news to, to learn of another cyber attack that started with some sort of identity related issue. I love what you said around real world least privilege and this least privilege first approach to identity and access management. We should talk more about it before we jump into like more about what that means. Tell us about the backdrop, like what is changing in the world and why do we keep seeing all these cyber attacks around identity and what's resulting in this need for Sort of actionable lease privilege as it relates to identity and access management.

Yeah, this is a great question. You know, I tend to sort of break these things down into a couple of variables. One is market timing. I think, you know, sometimes these just like shifts happen all of a sudden where people realize, like, we really need to be solving this better. Oftentimes it's coupled with a couple of other things. So, for example, regulation is a big one. You know, when the SEC requires that public companies disclose reaches, it's a forcing function. People have to actually like, bring things into the sunlight and explain, okay, this is why this happened and this is why it's not going to happen again. It has material effect on the business and its risk. Technological shifts are also a really big one. I believe in security. Every major established player we've seen in security has sort of dovetailed really nicely with a technological shift, whether that's cloud, whether that's network, whether that's moving from data centers. And so right now we are in the middle of a technological shift, both still writing the explosion of cloud and also seeing like the AI shift. So I think there's sort of like an early rumbling of like, something has to get better. And then to your point, just look at the news, there's like a major breach. It feels like almost every day, like AT and T was last week, almost every record they had leaked by a data source that was only secured by username and password. No time controls, probably little to no process putting in the necessary monitoring for what is their crown jewel. And this would have probably continued in perpetuity until it was inevitably popped because people rarely treat access as a security first issue in building a business. And I think that's changing.

Yeah, I totally agree. And one of the interesting things about access is and getting it right, it's like, like there's two sides to the coin. And correct me if I'm wrong, one is like, I need to enhance the security posture of the organization. But then the second is like, I'm the front door to the employees and their productivity and developer productivity. And so it's like, how do I both harden the security posture while also making people more productive?

Exactly. Yeah. There is this natural. Or historically there's been kind of this natural tension. Right. Like at the end of the day when you're building a business, you want to unlock revenue, you want to keep your growth trajectory, and you reach these certain, like, inflection points of maturity where all of a sudden the risk calculation changes. Right. Once you're the size of AT&T. It's a much bigger deal at the bottom line of your revenue to, to have your records breach then to keep going quickly. I think, you know, again, going back to analogies, the best solutions are actually product oriented in this regard. They recognize that, that you have to sort of align incentives through product work. So the example I like to give is GitHub. You know, ultimately we like to joke internally that GitHub is a compliance tool. I like to sometimes ask people, who do you think buys GitHub in an organization and what do you think? Like where it's used to check the box. But like that's not how you think about it in an organization. You actually think about it as accelerating the rate of development and helping people get to context faster.

Yeah, totally, totally. We talked about some of the attack stories. Let's shift to some of the customer stories. Because I think, you know, what's great for customers and enterprises who are using Opal is, you know, they can be rest assured that they're not going to face these types of identity attacks. And so maybe before we jump into the stories, like how do customers articulate the problem that they're solving with opal? How similar is it to what you just said versus different?

Yeah, so, you know, I think of this as an early disruptive market. And what that means is a lot of times people are formulating their own theories of what good looks like and are sort of approaching these conversations from the perspective of sharing their learnings as well. But there are some common themes. So a big one is visibility. Right. When you talk about like sort of just waiting to know when you're, you know, a crown jewel is going to get popped. You're, you're going to think about visibility all of the time. Orchestration is another really common one. How are we going to put workflows or infrastructure in place that will actually scale with how our business changes over time and then resiliency. And I think this one is oftentimes sort of overlooked and is really, really important to your point. Like this is a very, very trust based relationship. You're trusting somebody to like basically show you what's going on in your organization. You need to be able to roll that back, you need to be able to extend it. And so how do you build systems and infra that organizations can ultimately trust and build on top of and scale. So you know, the number one thing I would say folks come to us with is, I call it two archetypes in the market. One is earlier enterprises that are on this growth trajectory, they're looking for revenue unlock, but they also help looking for someone to help them set good hygiene in place so that as they hit the next stage of maturity, whether that's IPO selling to big enterprise or regulated environments, they're starting with good. And for them it's really about driving least privilege from a security first standpoint without slowing the business down. So an example here is like, you know, if we catch like an organization right before an IPO or something like that, they have generally a good idea of like how the business is managing access. They just know something's going to come around the corner that's going to make it chaotic and they want to get infrastructure in place today to sort of solidify some of that and help it evolve. And this is like sort of like the innovators. They're like the forefront of the industry. They've often built systems like this at their old jobs. The second market, I call it established, entrenched, the chaos is in the house and these folks are looking for somebody to come in with a machete and just show them like where they need to clean access up. So specifically for crown jewels. So you know, you have to think about it in a phased rollout. So the story we see the most here with customers is help us get AWS under control, help us get Snowflake under control, help us get Azure under control. Right. So they have like kind of this vague sense of like, oh my God, it's been 30 years. Who knows where the skeletons are, we know roughly where the crown jewels are, show us what's going on and help us remediate it immediately. So it's, it's nice because as a product we can sort of capture both that proactive and that reactive loop.

I love the way you frame like the two cohorts, organizations out there and, and kind of maturity and pain points. How much overlap is there versus difference and how do you build a product that can kind of appeal to both?

Oh, I love this question. So I, you know, from, from a product standpoint, I actually break it out into certain themes. If I put sort of my technical product hat on, I think of that second established market as the one that's going to help you think about your products from an infrastructure level. Like what do you need to do to scale? How do you need to think about the underlying infrastructure? How do you need to think about the storage layer? How do you need to think about all of the edge cases? The first market is incredibly valuable in helping you build this kind of Inside loop feedback for what the industry should look like in five to 10 years. And the biggest theme there I would say is usability UI ux, which is often a neglected point in enterprise products but more and more we see that it's a non negotiable. So these are the folks whether by size of organization or just because they are used to using best in class products will have very strong opinions on what usability should look like and they help drive it for the latter market. And you build for scale in the latter market.

Yeah, totally. Getting that balance right is really hard but when you get it right it's really powerful. And as you said like typically these things, convergence over long time horizons, you know, if you take those two segments of the market, maybe take one of each, you know, specific kind of customer case study and how, how people are using Opal.

Yeah, I think in the first bucket you're going to see folks usually in early enterprise in verticals like enterprise software, infrastructure, AI, machine learning, like anywhere where they're working with a ton of data and they're sort of mindful that they have to operate in a certain way. And so oftentimes these companies already like really good DNA on like engineering, security, IT and they, they have like a sense of what good looks like. So they're coming in saying like this is how we want to break down how we Grant Access Day 1. This is how we want to break down how we do just in time access for like on call critical infrastructure systems. This is the type of data we need to integrate this into our SIM tools and our ecosystem. It's, that's a very like, I would almost describe it as an intuitive sale and really what you're doing there is understanding if you both sort of have that same security background, that security DNA of understanding what the future needs to look like. The second market, you know, think of it as big banks, nation state actors, like media, like you know you're, you're really coming to the table not necessarily with like an opinion on what the product looks like but a very, very clear idea of here are the crown jewels, Here are the 10 systems that no matter what happens I cannot have popped and what are you going to do to clean them up? And there you know, we talked a little bit about like how we built some strategies for remediation and Opal, there's like some very, you know, there's some very like straightforward things that are hard to apply at scale. So an example here is like with, with one of our big like Fortune 500 customers applying two factor across all of their critical systems or applying just in time access across all of your like production AWS accounts and making this play nice with whatever already exists in the stack, but adding that extra layer of protection and giving that measurability because that's the other thing that I think is often forgotten in security. You're not just fixing these things for your teams. You actually have to communicate how you're getting better laterally to your sister teams upwards, sometimes at the board level to your management. So you have to actually show how things are consistently getting better in that second market as well.

Makes sense. Maybe moving to how customers interact with Opal, you actually mentioned something there on playing nice with the stack, like what is the common identity stack? And like you know, if I use something like an Okta or, or on the identity governance side a Sailpoint or on the privilege access side a cyber arc, like where do you interact? Where do you make existing solutions better? Where do you compete? What's the right way to think about that?

Yeah, this is a great question and I think it's, it's, it's also one of the, the banes of our existence because people have effectively treated the identity stack as sort of a let's throw things at the wall and see if they stick. And so it means that there's a lot of resources and capital that are sunk into it without a ton of measurable results. But there are some commonalities to your point. Almost everyone has an identity provider. You need to have some concept of digital identities if you're a scaling workplace. So we connect with an identity provider such as Okta or Microsoft Entra or Groups, et cetera and you want to use that as your baseline to start feeding in identity data. The other major thing is like HR systems which are notoriously hard to keep in sync after a certain size of an organization, but they have a ton of information on who a person is to help make some of those longer term workflows and remediations. Further down the stack you have these very, very sensitive systems like your hyperscalers, internal tools, customer impersonation, sometimes sensitive SaaS applications or business critical systems like NetSuite or SAP and all of these things are, are so sensitive that they've actually ended up building their own custom built authorization. And so what we end up doing is sort of sitting right in the middle of these types of things and actually collating all of that and helping folks actually visualize okay, where is this identity coming from? Where is it going down to what Are they doing in that? What are the policies that are set on this? How are they being used? Are they being used pulling in sort of the usage data on those things? And so what that allows us to do is really like fill in this like missing context. And because, you know, everything is an API first by design, it means we can also start to make changes on those things. If you want to take the step after visibility. You mentioned the sort of governance stack. So one thing we talk about at Opal is good compliance is an output of good security grc, you know, they have a very critical job. They have to kind of show that we're checking the boxes, that things are running, that they were able to provide the evidence that people are actually implementing these processes. But oftentimes they don't actually have a source of truth for those things. So they're sort of like building these manual spreadsheets over the course of several quarters, trying to ascertain what people actually have access to. And so there's like a natural confluence there where we have the source of truth. We're finally collating all of this. We're giving visibility, we're right sizing policies. And what we can actually do is sort of even make the story as simple as saying, hey, actually nobody has long standing access to this database in aws, so therefore you're under this compliance requirement and go forth. And a lot of our customers have actually started doing this as they've started going for things like FedRamp Medium or FedRamp High, like actually make that part of their SSP.

Yeah, that's, that's really interesting. And I think it's from my perspective, like you're taking a historically very fragmented space, which kind of creates two challenges. One is I have to have this fragmented stack, which means I have a lot of tools I have to manage. And then two is, you know, things fall between the gaps. And so then both in terms of risk identification and remediation, I'm constrained by the siloed nature of my tools. And you're creating kind of a converged architecture that can interoperate and play nice with the things you have in the stack, but can kind of converge the space. And it seems like that's why customers love opal.

Yeah, and I think this is a really critical point not to, not to harp on the ATT like hack, but like, I mean, just think about it. The, the fact that there was like 110 million records that wasn't just sort of fell through the cracks in some sense that nobody recognized that this is like being used in this way, that it's only being by a username and a password. Right. And it's a result of having this fragmented access stack, this fragmented identity stack. So you need that, that overall convergence.

As you said, the other element of like, convergence, if you will, is on kind of people and Personas. Right. And I think kind of one of the interesting things again about identity, you touched on kind of security versus compliance, but there's so many dimensions of this.

Yeah.

And so, like, if you look at the enterprises you're serving today, like, who are the people who are involved with Opal?

Yeah, I like to joke. I call it the holy trinity. So just as a baseline, obviously access impacts all users in a workforce at varying levels of depth, but the folks that we primarily interact with are security, it, engineering, and then grc. And it's really our job to align the various incentives of these stakeholders and also help them see that, like a security first approach here is actually going to help them and not slow them down. So, you know, we primarily sell to security because our belief and conviction is that this is a security issue. What we see over and over in the industry is once a breach happens, an identity, the. The responsibility moves over to security, but you have to serve the needs of the business as well. Right. So what does that look like in terms of, like, efficiency, in terms of usability, in terms of helping people, like, establish the right cultural precedents. And then like, on the engineering side, you know, just because we are such a fundamentally, like, flexible product and we are built to be developed on as well, there's just sort of a natural relationship there as well.

Yeah, exactly. I've always been struck by, like, I feel that Opal is one of the only tools in a security stack that like the, the champion and the security personnel loves, but actually maybe developers love it even more because it makes their jobs better, makes them more productive.

Yeah, I mean, I think that's part of, you know, kind of going back into that early customer attraction. A little bit of our own DNA. Right. I didn't mention this, but I built an early version of Opal at my last startup. And, you know, a lot of some of our early customers, figma, databricks, you know, scale, AI, they came from teams where they had gone through that same trajectory that I had, where they got frustrated that there wasn't a good engineering system in place that was meant to serve the entire business and had just sort of rolled up their sleeves and taken it on themselves. And I think that I, you Know, we've talked a lot about like, sort of like the importance of like the customer and like building enterprise SaaS companies. But I think architectural decisions matter a lot too. And that's one of those things that actually really does shine when you have like an ENG buyer in the room. Like people will notice what a considered architecture looks like and they will be able to think through scale and trade offs and things like that. And that's something that like we've always been very good at. Because that's sort of our DNA at Opal as well.

Exactly. Well, we're not talking about Opal topics. I think the other topic we're texting about is, is, is the one topic that's hard to steer clear of in technology right now, which is, which is AI. And there's a lot we could talk about as it relates to AI, but I want to talk about it in the context of Opal and in the context of security. Right. So what, what's the role that AI plays at Opal?

Yeah, I do love this question. And you're right, we have talked about it at some length because I, you know, part of my job is like also just thinking about how the technological shift is going to impact us and how it's changing and evolving. So I think just to take a step back, when I think about the broader AI space, I think at this point non trivial milestones in learning are largely going to come from big frontier shops or big research institutions. But there's a lot of work to be done in the surrounding ecosystem. We're kind of at the point where we're starting to see applications in smaller and more specialized use cases. And while it's not a moat per se, you're starting to see strong traction in infrastructure deployment and regulation. So we believe that enterprises will likely continue to use increasingly customized smaller open source models that are going to adopt these tools into their dev stacks and they're also going to be concerned with privacy and safety and they don't want to flood all of this to providers and risk leaking their data. So what that means for us is we have to account for how that environment in our customers is changing and how they deploy. Deploy. So how is the attack surface different? So for example, how are non human entities operating with respect to access? How are the crown jewels evolving? Like one sort of obvious example is PII just becomes like this massive like you know, sort of training, training set, which, you know, I worked in health tech briefly. You know, PII was like locked down to operations and only data engineering Teams. Now everyone's like no, no, no, we have to train. So like crown jewels are evolving and the business case for access accessing those crown jewels is evolving as well. So you have to kind of take into account these attack surfaces. You have to take into account the ways in which businesses themselves are evolving. From a technical innovation perspective, I would say I think about kind of two lenses here. One is we operate in a very data rich environment, right? Like we not just the policies and the identity primitives that we've talked about ingesting, but also like how folks are using, requesting, making access, holding onto access, right? How they're making those judgment calls. If we provide transparency and explainability for decision making for access changes, we actually have a very unique opportunity to introduce new forms of automation and incorporate different types of reinforcement learning and constitutional models. If you've ever seen there was an anthropic paper a couple of years ago, there's a lot of automation. This is going back to the theme of efficiency. When it's 2 in the morning or 9pm and you've scaled as much as you could, but you're the eng manager and you're like what is this ticket? What am I doing? And now I have to write the justification and this person requesting is writing the justification. There's so much that can be done if you have that baseline of interpretability and transparency that can just be automated there. The other area that we think about is code generation. As cogeneration gets better, we operate in a relatively defined language with tons of human input and review and repair. So things like IAM policy creation and adaptation get markedly more prolific and proficient than they were even two years ago. And this is an interesting area. You know I did some research in this back in the day and I used to be a bit of a skeptic. Like I was like great, now we're just going to make aws, IAM policies on policies. But the technology has on verifying and correcting and generating like decent policies has actually gotten good. So that's another area I think like we're going to see authorization really take off in.

Yeah, I think those are great examples of, of, of how you all are leveraging AI. I'm curious, like somewhat orthogonal question which is, you know, you're a CEO of a fast growing company. A lot of this AI stuff is relatively new and also evolving very quickly as a leader internally. Like are there any best practices for other founders listening on how you encourage your engineering team to kind of on the one hand not distract themselves which One easily could do given how fast the pace of change is. But on the other hand, stay aware of what's happening and in particular in the context of how it can be applied to strengthen Opal's product and bring new features to your customers.

Yeah, I love this question and I think it's very, it's always like every founder sets their culture and it's very company specific. But even as an engineering leader in past jobs, one thing I always loved to do was I'd run paper reading groups. So I've always built very like curious engineering teams that are also pragmatists. But, you know, staying abreast of the literature is actually like important and it's not even like AI specific. Like I think in the last 10 years there was like this like complete, like, like, you know, explosion of database technologies. And I remember like there was like this need to like kind of like be like, what's happening? What's the latest? What's the greatest? How can we incorporate this? And then the second piece is on distractions. I think that really comes from being very, very clear about what the problems you're solving and having a culture of actually debating the pros and cons. So I mentioned earlier that we do a lot of classic ML at Opal and that's not necessarily a contrarian stance. A lot of our engineering team does come from places like DeepMind and Meta and they've worked on actually varying levels of the AI stack. But we think about what do we need to do today and what do we need to stay aware of so that we can kind of continue to innovate in a reasonable manner and you tie that back to the needs of the business. We work in a very critical part of the stack. We need to always establish trust, transparency and accuracy. And when you work on critical decision systems, if you think about anomaly detection, even like in credit cards or like, you know, fraud or things like that, you don't want to get distracted. First you need to establish that you know what you're doing and how you're solving a problem before you start to layer on like different types of innovation. So I think company being aligned on what problems you're solving, but also making space to continue to be curious and stay aware of things.

Yeah, absolutely. This kind of leads to the last question I have for you, which is what's coming next for Opal? And like if you take kind of, let's say a two year view and then a five year view, so ask you two, two forms of the question. Yeah, what Will OPAL look like and what will the way, how will the way enterprises secure their identity change?

Yeah. Another theme you and I talk about at times is positioning. And I, and I think a lot about, and I've mentioned sort of, we're going over the course of this conversation, this idea of security first identity. I think there's a unique opportunity right now and a unique window, let's say in the next two years to really establish what it means to build a security first identity company. And what that means practically is shifting some of the ways in which we measure, which we monitor and the ways we think about architecting identity solutions and the identity stack. To your point, we're already seeing some initial early signs of this. You know, there's been like sort of the whole non human identity space, but there hasn't really been like this cohesive almost like manifesto. Like this is how you have to think about identity security. And I think we have like a unique opportunity to sort of set some of those precedents. So continuous monitoring, immediate remediation, not waiting for regulation to force better authorization decisions, but actually building them in directly from the ground up and really sort of revitalizing the industry from that standpoint. I think what makes OPAL unique in this space is that we're not, we're, we are intentionally not abstract about it. And this was the thing I learned when I built at my last job. You can build the nicest policy language in the world, but at the end of the day if people aren't using it, then you haven't built the right system. So I think if we build the right system for getting people to think about authorization from a secure and access from a security standpoint, it will naturally change some of these like cultural attitudes. Right. And we measure these things like in our customers when they deploy. Like we see how, how many of them are like operating in like a zero trust model, how many of them are actually using multifactor, how many of them are like actually getting benefit from having like use these strategies on a five year. You know, one of the reasons I love this and you and I joked about this once where I was like if, if I, if I wasn't doing this, I'd probably just go do it again. There's like some joke of this form. I, I just think it's like such a great market and in security it's always a game of entry points and then boxing out markets. Right. And I think if you solve the IAM layer in this like sort of practical, oh, we have the context we have the visibility, we have the orchestration, remediation way that gives you the ability to go in several directions. You have the ability to influence what the authorization schema standard could look like. Like. Right. Because you've effectively built the database. You can define what vulnerabilities look like at the OAS Brunis level. Right. You can even help set direction on hardware for identity. So if you control this layer of the stack, you have just this incredible opportunity to really build an iconic company in identity security. But in order to get there, you have to be pragmatic about where you're meeting customers today without being overly rigid and how that solution is architected.

Yeah, and I mean, that's one of the many things, of the many things that impress me about what you're building at Opal. Like that's, that's always the thing that stands out, which is, it feels like, and I don't want to jinx it, but you all have found this balance of a really clear point of view on how this category should converge and work very seamlessly, end to end with great ui, ux, AI, empower developers strength and security. But you've entered the market very pragmatically and, you know, in a way where you can solve concrete problems today, you can live alongside other tools and make those tools better and kind of progressively get the customer to modern identity security. And I think that's a great template for company building in general. And like, the way you're applying that in this space seems to really be resonating in the market.

I appreciate that. I mean, I will say there were hard lessons. One, and you know, we talked a lot about fragments, but I mean, I do think like a mathematician sometimes, and there's only so many systems you can build and you realize that they don't work where you have to realize. You have to be pragmatic and meet people where they are.

Exactly, exactly. Well, Mima, this was a lot of fun. I'm really glad we were able to have you on gray matter and for our listeners to get to hear more about the Opal story. And I'm really excited for what's ahead for Opal. It's amazing how far you guys have come in just a few short years and the best is very much ahead of us.

Awesome. Thank you so much for having me.