In this live episode of the Connector Podcast recorded at the Digital Finance Summit in Brussels, host Koen Vanderhoydonk interviews Sutton Maxwell, commercial leader at Curity, a provider of enterprise‑grade identity and API security solutions. The conversation covers Curity’s unique approach to securing API traffic, the emergence of AI as a new threat surface for financial institutions, and common mistakes such as treating security as an afterthought. Maxwell explains how Curity helps organisations through education, thought leadership, and showcasing best‑in‑class digital leaders. They discuss market focus—primarily North America and Europe—with the United States driving the fastest AI adoption, while European regulation slows progress. Regulation is described as a double‑edged sword that both enforces necessary security and adds friction. The dialogue explores how to balance security friction with seamless customer experience using adaptive controls and progressive profiling. Future technology trends such as multi‑tenant, multi‑region, hybrid‑cloud deployments and the AI “dot‑com‑bubble” analogy are examined, along with the concept of “cloud exit” strategies. Finally, Maxwell offers practical advice for fintech founders: embed identity management and KYC from day one, avoid monolithic bolt‑on security, and treat identity as a growth enabler. Contact information for Curity is provided at the end.
Chapters
Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Koen Vanderhoydonk as you learn more about the latest available trends and solutions in the markets.
Welcome to a live podcast recording here at DFS in Brussels, Belgium fintech, and I have with me Sutton from Curity. Sutton, who are you and what do you do?
Yeah, thanks. Good to be here. Sutton Maxwell. I've been in the identity and security space for over 15 years.
Wow.
Building propositions, product, go-to-markets, teams, companies. And I'm leading the commercial organizations at Curity.
Nice one. And you say 15 years. So what is it actually that you guys bring on the table which is different than all the others?
Yeah, I think if you take a look at our offering, it's a software offering for large enterprise, and we have kind of a unique quality in how we make the guardrails for APIs and all the traffic that goes through them safe and secure and consumable. So our customers deploy these kind of services so their customers can safely access their data, safely access their products and information. And do business.
Yeah. And I guess over those 15 years it probably went from personal identification to APIs. But how— what's the case with AI?
Yeah, well, I mean, AI is a new threat surface, right, for a lot of businesses. I think if you kind of look at it, there's a rapid acceptance and adoption of AI for low threshold use cases like ask questions, do some simple stuff. But true kind of enterprise use cases, you know, 95% of them stay in POC pilot or fail ultimately because of multiple reasons.
The famous McKinsey report.
Ah, well, okay, there's a McKinsey report on it, fine. I think we probably have our own view on it as well. I mean, we see our customers that adopt AI protocols and look to do agentic use cases. Security is a really important component of how they look to build these services out to the market. Of course, if you do it wrong and AI starts accessing customer data or information that it shouldn't be accessing, this is a problem. You can have a front page of the news. So it's— and that's a big deal. Yeah, exactly.
Absolutely. So maybe you take it on the wrong— what are in your scenario the most frequent mistakes that a financial institution or a fintech is making?
I think, you know, security is always an afterthought, right? We're racing towards delivering these new services, racing towards, you know, reducing cost and reducing complexity by, you know, augmenting that with AI and getting things fast to market. But We're forgetting that security is not a bolt-on conversation. It's not something you can do afterwards. And if you do it wrong, again, you're going to get into problems, right? So if you take this seriously, you need to really invest in a good strategy around this, how to make, again, a secure kind of approach to delivering AI and agentic use cases to the market.
And how would you typically handhold a company in that sort of strategic process?
Right. Well, I mean, I guess there's a lot of different ways to look at that, but I think it's a little bit about education. It's a little bit about thought leadership. And it's also kind of showing some of the kind of true digital leaders in this space and kind of presenting and trying to kind of talk about what it is they do. Because of course, we learn from our customers and partners as well who are on the bleeding edge of delivering these services to the market. And of course, through that kind of iterative process, We understand how this business is evolving and where the rubber meets the road in terms of what's real, what's not real, what's possible, not possible. And so that's, I think, a really interesting conversation for us to be a part of. And then, of course, taking that information back and disseminating it out to our market, to our customers and partners that we work with today.
If I got it right, you guys are active in Europe and also in the US, also in Canada? What are the other markets that you're active in as well?
A little bit of activity outside of Europe and North America. But frankly, I think if you look at the global market for cybersecurity and identity services, you know, 60%, 70% of it is in North America alone. And then, you know, a big proportion outside of that in Europe, and then it's the rest of the, rest of the world. So that kind of resembles our business to a certain extent. We do have some activity in the Middle East, a little bit of activity in Asia Pacific, but our main focus is on Northern Europe, Europe, and North America.
And where do you see the most growth?
Well, the largest kind of push in terms of AI adoption is coming from the US. I think Europe is sort of behind on this wave, sort of struggling with more of a regulatory view on how to drive some of these services, whereas the US is kind of full steam ahead and testing and iterating and trying to learn and develop. So I would say the biggest pull from that side of the market, this new agentic kind of world, is coming from the US.
Well, I think you're right. That's what a lot of people say. Europe is regulated, maybe overregulated. I guess that's another discussion. But do you see regulation as being a burden in what you do, or is it an enabler?
I think it's a double-edged sword.
Tricky question.
Yeah, it's a double-edged sword, right? I think there's certain things our customers just need to deal with from a compliance perspective. And a lot of our customers are banks, financial services companies, and they deal with financial data, they deal with financial information, transactions, payments. And of course, we expect a certain degree of security and safety when we interact with those institutions as consumers, right? So in that sense, a degree of regulation and a degree of friction, right, in a financial process is important. I expect that from my bank. I expect that from my insurance provider.
Can you elaborate? Can you elaborate a little bit more on that?
Well, right. I mean, they're dealing with sensitive information. They're dealing with my bank account or, you know, maybe my address, my personal information. I expect them to keep that safe.
Absolutely.
Right. And if they need to use it for alternative purposes, they should, you know, maybe ask politely. Right. And that could be fine in particular for, you know, purposes of onboarding me as a customer, going through KYC checks or AML, you know, regulatory checks on my profile. And I'll agree to that. Right. If it's an easy process. But, you know, too much friction, it gets in the way of of doing business. So you've got to find a way to strike the balance between kind of the customer journey that you need to enable and the security and friction that the customer expects for the business you're in.
It is indeed, I think, a silver lining between what is needed and what is wanted. And the want is security, but it's also customer experience. So how do you make that balance between security and customer experience? How does that really work in reality?
Well, I think, yeah, there's 2 things. One is orchestrating and designing the services that, and understanding your customers and what they're buying from you, right? So that's the kind of market-driven effect. As a technology provider in the space, we see our technology as one of those kind of balancing acts that enables companies to dial this in, right?
Mm-hmm.
So the kind of services that Curity deliver can help you dial up the friction, dial up the security, Or if you're in a less kind of sensitive, let's say, use case, a less sensitive market, maybe roll that back and dial up customer experience, customer engagement. So the checks and balances, the validation processes, the security processes that we enable our customers to build can be all over the place and very strictly enforced, or they can be a little bit more about progressive profiling and enablement.
It's kind of interesting that you bring up technologies. And I think if you bring up technologies, there's a lot of new kids on the block, multi-tenant, multi-region, hybrid clouds. There's a lot of things happening nowadays in terms of technology. So how do you handle this? And how do you see the future maybe in 5 years in terms of technology versus identity management?
Yeah, it's a good question. I think 2 trends I think that we see as a business and that I see kind of personally as well. I mean, of course, one is the AI trend, and I'd liken that probably to the dot-com race, right? Where you have—
Are we talking about bubbles here?
Little bits, right? Of course. But, you know, I think, you know, we could realize or could see the shapes and mold of a bubble But of course, dot-com, out of that came e-commerce, a multi-trillion-dollar market. I think it's gonna be very similar in the next 2, 3, 5 years based on the position we're at now with Agentic. We're gonna see some interesting kind of things emerge, some real markets emerge that weren't there before, different ways of doing business digitally that weren't there before. And those things are real.
And now my next question would be, what would be that business? And then I'll write it down and you'll never see me again. No, just joking.
Exactly.
Sorry.
If we had a crystal ball, right?
If only we had.
Yeah. And then the other thing, I mean, when it comes specifically to security and identity management, well, this is still a critical foundational pillar for driving digital business is how you bring your customers into your world, how you onboard them, how you do KYC, how you attach that to the regulatory processes you have to go through, how you make that interaction secure and safe. And a lot of businesses are looking at, well, you know, this is very sensitive, it's sensitive data, and we need to control that journey as best as we possibly can. We need to use best-in-breed technology where it makes sense, but the data, it's ours, right? It's our customer data, it's our partner data, it's sensitive information that we need to make sure we have a grip on.
Mm-hmm.
Cloud exit's a real thing in this market. So, you know, having a hybrid strategy around, you know, what services you leave launch as SaaS and buy as SaaS, and what services you might kind of build in-house or put on any cloud or bring your own cloud for. I think you'll see a lot of those kind of motions as well emerge out of this AI era, because you'll see an accelerated pace for adoption of SaaS in certain places and the exact opposite in others.
Well, we're here today at the Digital Finance Summit. What brought you here today? What's on On the agenda today, right?
I think, you know, we're looking to get into conversations, learn, talk to the market, meet potential partners and customers. We have a talk later which will be nice, you know, on stage 4. But, but of course, for us, it's interesting to engage the market and to meet the market and to see where the direction of travel is for the market.
It was obviously great to have a lot of banks here today, but there's also a lot of fintechs. So if I would be a fintech founder and I would like to start with something now, what would be your number one advice in terms of identity management?
I think, you know, you don't have to do, do a kind of monolithic approach to this from day one, but you do have to think about it from day one. It's fundamental for how you do KYC. I mean, if you're a fintech provider, you have to do this process. You're regulated to do it. So you're going to have to to build your technology on top of first principles identity management capabilities that allow you to onboard customers safely and securely. But you can start small. You don't have to kind of have a monolithic approach, but make sure you do it right. Don't bolt on security afterwards. You know, think about it from day one, build it into the service and the design of your solution. And guess what? It's not just a cost center. It can be an enabler for you if you have a good, smooth experience here that's also safe. You're going to adopt customers faster than your competitors.
I think that's a very nice one to sort of come to the end of our podcast here. So in case any financial institution or fintech actually wants to have that conversation with you and Curity, how do they, how do they find you? Yeah.
Okay. I mean, of course, get me on LinkedIn. I'm active there. Curity itself, you know, you can go to our web. We're here at the event. You can— I think we've got some contact details probably somewhere.
Absolutely.
You can email us directly, but we're keen to get into these conversations. So yeah, happy to be here. Thanks.
Well, thank you very much. Thank you also to the audience. And please still stay tuned because more news will come from DFS this year in Brussels. Thank you very much.
Thanks for listening to another episode of the Connector Podcast. To connect and keep up to date with all the latest, head over to www.koenvanderhoydonk.com. JoinTheConnector.com or hit subscribe via your podcast streaming platform.
