Black Hat USA 2025 | Ted Shorter, Keyfactor

Clips
More from Black Hat USA 2025

Ted Shorter

Chief Technology Officer

Keyfactor

play_circle_outline Ted Shorter's background in technology and founding Keyfactor to solve specific security problems.

play_circle_outline Addressing Common PKI Failures: Keyfactor's Solutions for Scalable Certificate Management and Expertise Retention

play_circle_outline Importance of auditability and fine-grained access control for AI identity management.

Info
Transcript

Ted Shorter, Keyfactor

Ted Shorter

Chief Technology Officer Keyfactor

At Black Hat USA 2025, theCUBE’s Jackie McGuire sits down with Ted Shorter, CTO and co-founder of Keyfactor, to discuss the evolving challenges of machine identity management in an era defined by connected devices and the rapid rise of agentic AI. Shorter shares the journey from identifying recurring PKI failures in enterprise environments to building a scalable, managed service that addresses both certificate sprawl and the “key person” risk inherent in in-house security operations. He explains how Keyfactor’s solutions are helping enterprises and manufactur... Read more

explore Keep Exploring

What experiences did the individual have before starting a company? add

What were the reasons for the failure of the certificate management setups that were initially provided for customers? add

What are the key responsibilities and tools related to identity management and security in enterprise environments? add

bolt Powered by CUBE AI

Ted Shorter, Keyfactor

search

Jackie McGuire

>> Hello Cube community and welcome back to Black Hat 2025 at Mandalay Bay in Las Vegas, Nevada. I'm Jackie McGuire, practice lead and principal analyst for security. Also your favorite security media host, and I am joined by Ted Shorter. Ted, welcome. Ted is the-

Ted Shorter

>> Thank you.

Jackie McGuire

>> CTO and co-founder of Keyfactor. Thanks for being here, Ted.

Ted Shorter

>> Great to be here. - So let's start

Jackie McGuire

>> with a little bit of your background. You're a co-founder, so I would love to hear where you started in technology and then how you ended up at a place where you decided you needed to start a company to solve a problem.

Ted Shorter

>> I never really set out to start a company, so I spent 10 years working for a government three-letter agency right out of college.

>> Alphabet Boy, nice. - Alphabet, where I got the vast

Ted Shorter

>> majority of my cryptography and security background.

Jackie McGuire

>> And left there, and in 2003, joined a small boutique consulting company. We were doing a lot of work around identity, identity management at the time, a lot of PKI design and deployments, especially organizations dealing with a newly mobile workforce needed internal PKI. So the corporate ID badge versions as opposed to the driver's license or passport version. But we kept seeing the same unmet needs over and over again. These things that we would set up for our customers would fail after two years or so for the same two reasons. And we kept waiting for a vendor to fill that space and no one did. So started by writing a small tool that snowballed into what Keyfactor does today.

Jackie McGuire

>> Awesome. And what are the two reasons?

Ted Shorter

>> It was, now that I have my own PKI, I can issue many certs as I want and I'm not paying anybody per certificate. I have a certificate management problem at a scale that no one had seen before. So truly scalable certificate management. And then, the other part was just keeping the expertise in house. So we'd train these people in the consulting engagements and then they would get promoted or leave the company or in some cases got laid off and then these things would just crash and burn over time, and we just got tired of seeing it. And so we're like, "Okay, let's just run it for you and we'll manage all the certs. We'll run that whole thing for you. " And that's really where that started. We made some other acquisitions in other technology along the way, but that really led to what we do today.

Jackie McGuire

>> Not to make too much of a play on words, but I do think there's a lot of key person risk in security that we don't necessarily appreciate.

Ted Shorter

>> A lot of bus factor, as they say.

Jackie McGuire

>> Dude, I say... So I say that all the time.

Ted Shorter

>> It's . Yes. - I'm always like, "What if they

Jackie McGuire

>> get hit by a bus? " And everybody's like, "Whoa, that's a little extreme ."

>> Or win the lottery.

Ted Shorter

>> You could say that. That sounds better.

>> Yeah, "What if they win the lottery?

Jackie McGuire

>> What if they move out of the country? " But it's definitely something I think is a huge... There are so many... I've never been in an enterprise for any amount of time where there wasn't a person... I shouldn't say guy, because we say person now. There wasn't a person who was the only person who could do something that was important. And it's a huge risk.

>> I think, honestly, that's a lot of the driver

Ted Shorter

>> behind the whatever it is as-a-service. And certainly PKI as-a-service is as much about not having to have as much expertise in-house than it is about cloud or offloading workloads, whatever. It's about not having to have that expertise. Let your experts focus on stuff that's more core to the business.

Jackie McGuire

>> So explain a little bit more, if I'm a fifth grader, about what key factor does and how you bring that expertise.

Ted Shorter

>> So today that's what's now called machine identity management. And really, it's machines, devices, workloads, it's anything that needs an identity, both in the enterprise and in the IT space. So about 70% of our business is in large enterprise. That's identities for web servers, workloads, Kubernetes clusters, mobile phones, that sort of thing. The 30% actually is more interesting, at least to me. It's the medical devices, planes, trains, automobiles, people making things that need identities so that when they phone home or get a firmware update, they know that it's legitimate.

Jackie McGuire

>> Medical is something that keeps coming up over and over.

Ted Shorter

>> It's important. - And I think

Jackie McGuire

>> that you're probably the third or fourth person that's mentioned security in healthcare today. And I just keep thinking about, we have this massive population of baby boomers who is going to be onboarding into a pretty intense need for medical care and services and things like that. And our ability to scale that is not anywhere close to where it needs to be to be able to both serve all of those people and protect all of the things that are serving all of those people.

Ted Shorter

>> For sure. And of course, all these things are connected now. So like any other industry that's making things, it's all connected. And if you think about, if you're updating firmware on a pacemaker when it's attached to someone, you better make sure you're protecting the private keys to that update.

Jackie McGuire

>> Attach your defibrillator. - It's the kind thing that

Ted Shorter

>> people can make movies about, right?

Jackie McGuire

>> Yeah. - So it's super important.

Ted Shorter

>> Like a lot of things, the first generation of connected devices, almost any connected device, often didn't take security as seriously. They wind up being presented at Black Hat or something else, not of their own accord, and then get much better after that when they realize how important-

>> You mean I shouldn't be able to hack your blood sugar

Jackie McGuire

>> monitor with my flipper?

Ted Shorter

>> That's kind of... Yeah, well at least that's mostly, that's read only. Your insulin pump is probably more important.

Jackie McGuire

>> This is very true. So we have to talk about agentic AI.

>> Fair enough. - Because that is...

Jackie McGuire

>> Well, so I will say, though, that

Ted Shorter

>> Black Hat last year was mostly security people being like, "Keep this stuff out of my organization. We're just going to put policies in place to ban it. " And I've said this multiple times, so our audience is sick of hearing it, but the horse is out of the barn. We're not putting that horse back in the barn. So I think there is some resolve now in the security that's like, "Okay, we can't stop this. " So now a lot of people are, "Okay, but how do we get to a place where... " And one of my working theories is, agentic AI will actually be one of the things that helps repair some of the relationship between security and the rest of the organization.

Ted Shorter

>> Interesting. - Because, from my perspective,

Jackie McGuire

>> that's always been one of the big blockers is that security has always been the department of "No", the department of, "You can't do that. " And we can't really be that anymore. And so security is going to have to change to the department of, "Hey, we saw you did this thing, we've got your back. We just wanted you to know a few things. " And I think everybody's real desire to use agentic AI is going to push that. So when you think about things like keys and thinking about managing identity and the ability of agents to almost instantaneously do a 100 different things, how do you start to even try to get your hands around that or understand the first things you should be thinking about?

Ted Shorter

>> You're absolutely right. So I think, like cloud, and even to me, the best parallel, I'm old enough now to... Many viewers may not be old enough, but I remember when the internet first happened and-

Jackie McGuire

>> I still remember my ICQ number.

>> And it was very much...

Ted Shorter

>> I really do believe that agentic AI and AI in general is going to be as transformative at the end of the day as the internet was. It's going to change the way people live and work in a very profound sense, and we're only at the very, very beginnings of that. We're what the internet was in 1994, and-

>> That's a pretty gnarly place to be.

Ted Shorter

>> And so it was the same sort of thing.

Jackie McGuire

>> The benefits are undeniable. So it's coming. It is going to happen. Much like the early internet, not very secure.

Jackie McGuire

>> It's interesting too thinking about the full cycle we've been through from the, "Never put anything about you on a bulletin board that's real," like we all use usernames, to, "You have to give Facebook your actual real name and your driver's license."

Ted Shorter

>> To verify.

Jackie McGuire

>> Back to, "Don't put anything on the internet."

Ted Shorter

>> But by the same token, I remember the early days of the internet, I remember being deathly afraid of entering a credit card number into a website and probably justifiably so at the time. But I also was perfectly fine reading my credit card number to a stranger over the phone.

>> Over the phone. - Because that's how you bought

Ted Shorter

>> stuff. So-

Jackie McGuire

>> Or letting them do the ch-ch thing with the machine.

Ted Shorter

>> With the card. - Where they get the card .

Jackie McGuire

>> So

Ted Shorter

>> anything new, there's going to be lots of insecurity.

Jackie McGuire

>> But I think, to me, I also very much think I'm a big fan of MCP, model context protocol. It is, to me, game-changing in that it allows applications and software to do what they're good at and not have to worry about building models into everything. Certainly, there are cases where you would still want to do that, but you don't automatically have to AI every application. You can let the application do what it does well and then let AI do what it does well and separate those two things so they can innovate at their own pace. I think the other part, to me, much like zero trust, it does come down to identity. You need to know what this thing is. You need to know what it's supposed to do. So, it starts with identity that's strong and well-established and durable, and then, you need fine-grain access control, so you can actually say in a much more explicit sense than we've gotten away with doing with people exactly what you... And there are lots of software that has good RBAC and so forth where you can say, "You're allowed to do this with this thing and not with that thing, and you can do this for this person, but not for this person," and all that sort of thing. So I think, getting that to the granularity that you can really carve out exactly what you're allowing this AI agent to do and what you don't want it to do. And then-

>> Without impacting its ability to-

Ted Shorter

>> Without... Yeah, exactly.

Jackie McGuire

>> Return value, right? - So fine-grained exactly

Ted Shorter

>> what you want it to do and nothing more.

Jackie McGuire

>> And then I think the other part is audit and auditability and being able to watch what's happening and then alert and remove access if it does somehow go off the rails. But it all starts with identity and-

Jackie McGuire

>> And how can Keyfactor help?

Ted Shorter

>> So we do machine identity, we do workload identity, we do identity for other workloads, Kubernetes clusters and other automatic processes, and so forth. So clearly, that's a piece of it. I think when it comes to agentic AI, MCP is a little early on the standards as far as that goes. Most of the implementations have OAuth support, which is a great start. A lot of them, though, were just using fixed app keys.

Jackie McGuire

>> We just saw a horrific data breach because of an app using fixed keys.

Ted Shorter

>> So we got to get better. It's great for testing and trialing, and most of our customers are very large enterprise. Most of the folks I talk to, they're testing, they're playing around, there's not a ton of it in production. But everyone is telling me that's going to change in three, four months. They're holding it off for a little bit, but it's not going to happen forever. But I'm hoping that the standards come around and we can use some of the same sorts of identity technologies, things like digital certificates and keys and so forth that can be changed out and are more secure and properly vetted and all of that to establish that strong identity because everything else hinges on that, at least in our view.

>> And if you're CTO, CISO, one of the things

Jackie McGuire

>> that I always like to ask people in C-level is, if you're explaining this to your executive committee who really doesn't understand what a PKI is or what an agent is, and they just have heard the buzzwords, how do you explain to them in layman's terms what the real risk is and why they need to write a check because you need to address this risk?

>> Well, I think luckily, I guess part of the explanation,

Ted Shorter

>> I don't know if it's lucky or not, but there are certainly already plenty of stories of well- trained AI going off the rails unexpectedly and deleting databases and-

Jackie McGuire

>> Just dropping SQL tables.

>> Just whatever. And so,

Ted Shorter

>> I think some of that will hopefully resonate. When I think about the identity piece, even going back to the internet, I actually do believe that MCP will likely in some ways become the HTTP of the internet. I think every piece of software will have an MCP server within six to 12 months.

Jackie McGuire

>> I hope so. - We launched one of our own a few months ago

Ted Shorter

>> and are launching the rest of the product line very soon. It's interesting though, it's the HTTP of the internet, not the HTTPS.

>> S, yeah.

Ted Shorter

>> And in some ways, that parallel holds.

Jackie McGuire

>> The early days of the internet, nobody really thought about security. The internet was not encrypted, and we forget that now, because now you just assume everything is. But I think we need that same sort of mindset of, "How are we really going to secure this thing? " It's great to get these great use cases going. Again, I think there's tremendous power. I think there's no question that AI is going to change the world in the same way that the internet did, if not even more so. But we have to get the security right or it's going to be a hot mess.

Jackie McGuire

>> Because things with agents happen virtually instantaneously. So if we don't get this right the first time, we're not going to find out about it until something has gone really wrong because it happens almost instantly.

>> And to me, the idea of having a person watch over it,

Ted Shorter

>> it's happening too fast. It does the right thing for five days on end, you're not going to pay that much attention to it. And so, I think you need automated oversight as well for sure. I think it's interesting too, there's also a lot of cases where you can give your credentials to a model and let it go do things and delegate the credentials through, which is sort of like, if you want to think of an AI as being a person, it would be like having an intern and actually giving them your password and asking them to do something, as opposed to giving them their own password and then giving them access, which is what -

Jackie McGuire

>> And then only giving them access to the thing that they need.

>> Which is what you're... It goes back

Ted Shorter

>> to, to me, that's the right way to do it. It needs its own identity. You'll need to decide what it's allowed to do or not do based on who it is or what it is.

Jackie McGuire

>> Well, Ted, thank you so much. This has been great. I wish we had more time. Unfortunately, we are running short on it, and I'm sure you have a hundred other things to do at Black Hat this week. Really appreciate it. We'd love to have you back to talk more.

Ted Shorter

>> I'd love to as well, so thank you.

Jackie McGuire

>> Stay tuned. We will be back from Las Vegas, Nevada, Black Hat 2025 with more coverage and guests.