RSA Conference 2024 | Mark McClain | SailPoint

Clips
News
More from RSA Conference 2024

Mark McClain

Founder & CEO

SailPoint

The evolution of IAM: Enhancing digital security with AI and biometrics

The identity and access management (IAM) evolution from simple access controls to a sophisticated framework integrating multifactor authentication, biometrics and AI has significantly enhanced digital security and privacy.The identity management ecosystem needs to evolve, Enron’s compliance game led to core aspects of identity, privileged users posing a danger, and perimeter security being insufficient in the cloud era,The identity management ecosystem needs to evolve, as shown by lessons from Enron’s compliance issues

play_circle_outline Expansion of identity market space to include supply chain, business partners, and non-humans

play_circle_outline The Evolving Identity Management Ecosystem: Understanding and Managing Complex Identities and Data for Sustainable Growth

play_circle_outline The Urgency of a Unified Single Platform for Identity in the Era of Microsoft's Dominance

play_circle_outline SailPoint: Emphasizing Identity and Access Management Over Authentication for Enhanced Value Proposition

play_circle_outline Investment in the security space

play_circle_outline Exploring AI in Security: Weighing Risks and Benefits, and Navigating Unintended Consequences of Technology

Info

Mark McClain | SailPoint

Mark McClain

Founder & CEO SailPoint

search

>> Hello, and welcome back to theCUBE, broadcasting live from RSAC here in San Francisco. I'm here with my colleague, Dave Vellante, David Linthicum, and the team here at theCUBE. And today, we are joined by Mark McClain, the founder and CEO of SailPoint. Mark, welcome. It's great to have you.

Mark McClain

>> It's a great pleasure to be here. Thanks so much.

>> We are so glad that you made time for us. And identity management, it is a thorny thing. And we have had lots of conversations over the course of the last three days about identity management. And really, I know that at SailPoint, you're on the record of saying, "The identity management ecosystem, the way that we do it needs to evolve. It needs to grow up." So share with us a little bit your thinking on that. Would you?

Mark McClain

>> Absolutely. Yeah. I guess I have the pleasure of being an OG in the space, as they say. So I was here before we even coined the term, identity management, for the space. So been around this for a bit. What we typically mean by that is when we started into this market space 20 plus years ago, it was very much constrained in most people's minds to the employees of the organization. Those were the identities people were mostly talking about, and it was mostly about, I'd like to ensure those people actually have access to the right stuff ideally. And there was an operational side of that, which today goes by Lifecycle, used to be called Provisioning, but mostly Lifecycle management now. And then post Enron and SOX, we sort of got into this whole compliance and certification game. We should audit and validate. Right? So first, we should try to... Like finances, we should try to operate well, and then somebody should look over and make sure we did it the right way. That was the core. Other aspects of identity market space certainly include single sign on and multifactor, which is a very well-known discipline now and becoming pretty universal, frankly. I think if you're signing in to 50 apps at your shop, you should yell at your CIO. That should not be happening today. SSO and multifactor are pretty common. And then the other historically interesting space has been privilege. Right? Understanding the power and therefore, somewhat the danger of those privileged users and making sure that they are who we think they are. They're doing what we expect them to be doing. Because if they're not, really bad things can happen really fast. Right?

Mark McClain

>> Well, if they have the access that they need, not the access to everything, I think that's really a lot of-

Mark McClain

>> That's right. And importantly in that space, even if they have the access they're supposed to, they're actually doing what you expect them to be doing. It's when the proverbial disgruntled DBA says, "You fire me, I'm going to wipe out the corporate database." Those are bad days. So that's the history. Why we talk about it being different, so much has changed relatively recently. I'd say some of the key dynamics here are the move to cloud and sort of perimeter list environments. Right? I don't know that perimeters are dead. That's not a fair statement. It's just clear they're insufficient. I don't think we're going to quit having firewalls, but everybody has figured out, I can't count on the firewall to protect my enterprise. So we've got this open zero trust mindset of everybody's connecting and I want to make sure you're who I think you are and you're doing what I expect. Right? But the other big dynamics that are happening is what we defined as an identity has rapidly evolved from your employees, to the other humans that are connected to your stuff. Call that supply chain, distribution chain, business partners to very interestingly now, non-humans. Right? What does it mean to have all these robotic software bots and processes, and AI-generated, and IOT? I could go alphabet soup on us, but I won't. But I mean, there's a sense of all these new kinds of identities are dramatically increasing the complexity and scale on the identity side. But the other side is going through a similar thing, which is historically, what we really meant was, I want to know what David does and which applications can he access and what can he do inside SAP, or Workday or Oracle, right? Now, we all hear the stats. Right? That data that lives in those structured business apps, whether you purchased them or they're homegrown, all that data is getting exported and downloaded all day every day, shared, put into multiple spreadsheets, shipped around the internet. And the idea now that you've protected your enterprise by locking down who can access your financial application and you don't know where all that data lives in SharePoint, you're kidding yourself. So the explosion of identities, the explosion of data, and SailPoint sits at that critical intersection of, do you know who all your identities are, what they are? And do you know all the data you want to protect and have access to? And understanding that complexity and managing to risk on that is very challenging.

>> So a couple of years ago, it was probably a few years ago now, because I think it was pretty much in the middle of the pandemic, there was this big conversation about converging privilege and identity. And we heard a lot of noise about that.

Mark McClain

>> Right.

>> And I'm fascinated by your point of view on convergence versus what you say, unification. Help us understand what do you mean by that?

Mark McClain

>> Is it a distinction without a difference? We think it is a difference. Let's talk about that a second. And these terms are not necessarily self-explanatory, but I think the way people are using the term today. Convergence means you've got a vendor doing one of these, you've got a vendor doing this, you've got a vendor doing that. And I can kind of juggling to tell you that every investment banker in the planet visited some combination of me, and the Ping guys and the CyberArk guys, or Delinia or BeyondTrust. Today, I got this great idea. Why don't we put you guys together? What a fantastic idea. No one said that.

>> Why didn't we think of that?

Mark McClain

>> Why didn't we think of that? And so there was this... Especially by the way, in response to Microsoft talking about going broadly. And not so far back, but a little ways back now, Okta, who was sort of viewed as the default winner of the identity game, which some of us did not appreciate that positioning in the market. But anyways, they were dominating that next generation of access, single sign on MFA, and everybody's just assumed, well, they're just going to ripple into these other spaces and own them. And what folks like me and Udi over at CyberArk and the guys at Delinia, Ark and others, we went, "Ah, I don't think people understand how hard this is and how different it is from that." Because to an investor or a fairly simple observer, it's all identity. It must all be related, probably be better with consolidation, convergence. Right? But we said was, no. The issue is, what you really need is a unified single platform, single data model, single set of workflows, single set of policies, and you apply that in all those different areas. The most counterintuitive thing we've said is, "We're not going to get into that SSO, MFA game." Why? To be a little harsh, because we think Microsoft's going to dominate it ultimately. I think it's just going to be clear to the world that in the enterprise segment, which we serve, if you go down market, I think Google's making a lot more inroads there. But in the enterprise segment, Microsoft owns that office environment, that office suite, the productivity suite, whatever you want to call it. It's just quite logical that you would think as a user, I'm going to sign into that environment and it'll get me to everything else I cared about. It turns out that's not so much a security issue as a convenience issue. Right? It's more secure than yellow sticky on your computer with all your passwords. It's definitely better than that, but does it really help Microsoft understand that environment and all the security and risk profile of all those apps that they don't own, all the other business apps, all the other homegrown apps? They don't know those apps. They don't understand that. That's what we have developed over many years, a couple of decades now, the very difficult task of going into all these enterprises. We have 20,000 different connectors to bespoke applications now in our library because everybody's got something different. And you got to connect to all of it, pull that data in, map it, and explain it to people. So long-winded answer to convergence says, "Let me grab these three business apps, identity apps, put them together and I'll sell them to you as one thing." Right? Procurement people love that.

>> Yeah, of course.

Mark McClain

>> Technical people don't always love that. And I loved the stat, Dave, we were just looking at before we went on air, that folks here at the conference are saying they expect to expand the number of security vendors next year. Why? Because all this stuff is very specialized in many cases. And it turns out, what we do is quite specialized in difference than what Okta has historically done or paying, or than what Cyber and others have done. We do think, and we made a little noise about this, that the next generation of privilege might be a little closer. What I mean by next generation is far more dynamic, where the idea that privilege historically, was you're a database administrator or a system admin, I got to lock you down and track what you do. Right? Now, it's like, "Hey, you're just a normal help desk person, but you need to reset a password." It turns out, that takes extremely high rights to do that. You don't really want that 22-year-old on your help desk to have extremely high rights to the whole AD system. Why don't you just say, reset a password. He knows what's supposed to happen there, he or she, but off it goes, temporarily creates privilege, makes the change, comes back, that person never had permanent privilege.

>> And then that goes away.

Mark McClain

>> That goes away. That's a whole new way to think about privilege, which we think is far more relevant to the way we think of this identity integrated control plane. So kind of a long-winded answer, I apologize, but that's why we say unification around the core of securing your enterprise through the lens of identity is different than rolling up three categories.

>> It's pressing what you said about Microsoft, the data we were showing you before. If you look at Microsoft and they're just ubiquitous in that those charts we were showing you before, out of the 1,800 accounts, they're in 1,700.

Mark McClain

>> Of course, they're everywhere.

>> They just completely dominate the graph. You can't even look at anybody else. They're up into the right. And so to the point there, why would you want to compete against that? It's the convenience factor. And procurement says, "Okay, it looked great, cheap, easy, good enough, great."

Mark McClain

>> Totally out of our space. That's why I think our friends at Zoom are going to have a struggle against Teams. Right? They're like, "It's just built into the Microsoft environment. Why don't I just do that?" Right?

>> You remember what happened to the cyber stocks when Microsoft had their big announcement?

Mark McClain

>> Yes.

>> They all dropped. I don't know if you were a public company at the time. You might've been.

Mark McClain

>> Yep.

>> I'm sure you got hit on sympathy, and then the market was just wrong about that. They didn't understand the nuance that you just described.

Mark McClain

>> You can't not respect this incredible resurgence Microsoft has done under Nadella. It's an amazing, one of the greatest business stories of my lifetime. No doubt. Right? But there's also this other edge of the spectrum. Just because Microsoft says they're going to do something, you shouldn't necessarily roll up your tent and go home. Right? They're an amazing company. We're pretty confident we have more people working on this problem than Microsoft does. They're a very big company. They're not all working on this. Right?

>> No, they don't.

Mark McClain

>> They got that whole Xbox thing and a few other things going on. So at the end of the day, sometimes people can get caught up in the, how can you compete with the giant? Well, 20 years ago when we started, we were competing with Oracle and IBM. They were the giants of 20 years ago. We're good. than compete with those guys.

>> You build Joy's Law, right? No matter how good your people are, there's a lot of people out there that collectively are better.

Mark McClain

>> Exactly. Exactly.

Mark McClain

>> And I think Microsoft isn't exactly going to... Nothing against Microsoft. They've done an amazing job, but they're not really known for their amazing security chops. And a lot of the feedback that I'm hearing in the market is, "So sure, you're going to charge us per seat for the co-pilot access, and then you're going to charge us..." "Oh, sure, we can fulfill your security needs and we'll charge you $30 a seat for that." And so people are saying, "Wait a minute. I'm feeling sort of a price creep there a little bit."

Mark McClain

>> That, and I'll tell you the other thing I think we are hearing regularly, I assume it's come up in some of your dialogue, what's the newest term that you probably didn't hear three years ago? Multi-Cloud. Every company who said, "I'm an Amazon shop. I'm an Azure shop." Now, what they're all saying is, "I'm multi-cloud." Why? Because old guys in tech like me will tell you, customers hate when one vendor has apparent dominance of a market space. They know that's going to cause innovation to slow and prices to go up. And so now, all these big enterprise customers are like, "We got all these things." And then I pause there and I look at people and go, "So you think that CIO's going to want Microsoft to manage Google and Amazon for them?" Really, I don't think so. I don't think that's going to happen.

>> So can you create an abstraction layer that I'll say, floats above those clouds and creates a common experience across them? I presume that's IP that you have. And where are you at in the majority of that capability?

Mark McClain

>> I mean, no offense, that's what we've been doing for 20 years. It just wasn't against cloud. It was against every ERP system, every directory, every business application.

>> It was probably harder actually, with all the diversity.

Mark McClain

>> Actually, to your point, it's getting a little simpler the more we see the consolidation at the hyperscalers. Right? But yeah, I mean, that's what we've done for years, is say, "We are the independent layer that focuses on the identity, and you tell us by policy what all that identity should have access to." And not just access as in sign in, back to where we were a minute ago. What privileges and permissions can that person do in that system? It's one thing to say, "I can let you have Salesforce access." It's another to say, "You can see the accounts in your territory or you can see the entire pipeline." Right? You don't want the rep in Atlanta having access to the entire pipeline. So there's two levels or three levels of permissions in many cases here that we're really dealing with. And that's the nuance that is very difficult to manage at scale. That's what SailPoint excels at.

>> Are passwords ever going to go away?

Mark McClain

>> We're going to try. I mean, we're not fans of passwords. That's not really the part of the business we're in.

>> You're not hanging on to that.

Mark McClain

>> We'd like to say that's the other thing people say, "Aren't you going to get into when Duo is for sale, and Cisco?" Great company, by the way. But we're like, "Look, we're ambivalent to that." That's the authentication. How do you validate you're really Dave? And multifactor is an extra way to do that. Password's the basic. At the end of the day, we're like, "Yeah, somebody's going to authenticate you. We care about once we think you know who you are, what can you access?" And to your point, if this changes to a passwordless sync or a passkey, I guess it's the new hottest thing going, whatever it is, somebody's going to get you authenticated. That's actually not the part of the game we're in. Once I know who you are, what can you have access to?

>> So passwordless really doesn't change the game for you.

Mark McClain

>> Doesn't change us at all. It doesn't affect us.

>> Your value prop remains 100% intact.

Mark McClain

>> Independent of that. Exactly.

>> Behind that, yeah.

Mark McClain

>> This is where people get confused in the nuances of identity. Like, "Oh, if that happens, aren't you guys in trouble?" Nope. That actually doesn't affect us at all.

Mark McClain

>> Thankfully, we built this thing the right way.

Mark McClain

>> We thought about the problem from a different vantage point, and I think it's turning out to have been a very healthy way to think. So we're very happy with that.

>> Love to get your perspective because you've been on both sides.

Mark McClain

>> Yeah.

>> Private, public, private.

Mark McClain

>> I don't know which two sides we were talking about there for a second. I don't know where you're going.

>> I talk to Michael Dell about this all the time. We were private. I don't want to be in the 90-day shot clock.

Mark McClain

>> He did an amazing job.

>> Now he's saying, "I love the 90-day shot clock. It's great."

Mark McClain

>> Yeah. Now that I got a team on the floor and... Yeah, exactly.

>> And I have all this liquidity. And I can do share buybacks and dividends and it's beautiful-

Mark McClain

>> Unbelievably well....

>> which I noticed. So what are your thoughts on public? There's a lot of discussion today about staying private for longer. I guess that's part of the theme. The market's really maybe not right for IPOs, but we've seen this before. It goes in segments. We saw this with Cloudera. They stayed private. I felt like they stayed private too long. Maybe, maybe not. They had other business challenges, but do you have a point of view on that?

Mark McClain

>> I think for the most part, obviously, we're a private company. So at this point, I can't comment on what our timeline or future might look like. Right? That said, I can comment generally on that question. Okay. What I would say is, if people in my chair are doing their job right, 99.9% of the company is not affected by that. Right? There's a very tiny group of people whose lives are dramatically different when you're private versus public. You got SCC reporting, you got accounting guidelines, all that stuff. But at the end of the day, we've got to market well, create demand, sell well, fulfill that demand, service well, deliver value to customers, lather, rinse, repeat. And the people that do that across the business, if we were to go public again someday and they have a liquid stock, that will be good. They now have privately held stock that they believe someday would have some value. And having come from the startup world where everybody had private stock that they counted on having value someday, that's very comfortable for me in our leadership team. So I think it can be overblown as to which side of that line you're on. To Michael Dell's example there, there are certainly things about raising liquidity and having extra assets to go after acquisitions and things like that. But on my mind, having lived through, we're an odd company, right? We're venture-backed, then piggybacked, then public, widely held, now private again, with the same PE firm, highly unusual, and we'll see what happens next. But that said, having been the fortunate guy to sit in this chair the whole time, now I've seen all those playbooks, the bulk of the company really isn't affected by that.

>> So Michael, by the way, didn't say to me now he loves that liquidity. That's my observation. But what he did share with me was it would've been very hard for him to affect that transformation as a public company, number one. Number two, it was zero interest rates. And his timing was unbelievable.

Mark McClain

>> Yeah. Free money is great.

>> But you're not going through that kind of painful transformation that Dell had to go through. I mean, they were getting hammered at the time. And so, a different dynamic for you.

Mark McClain

>> It is. And look, I am not a financial market professional. I like to refer to Mr. Buffett, who's pretty famous for doing well in that world. And he's a very harsh critic of earnings guidance, quarterly earnings reports. He's like, "We're putting companies in the 90-day shot clock." And when you're building a strategic business, the fact that you're judged every 90 days on a certain incremental, it is constraining and frustrating at times having lived through that. But it also has the effect of good discipline to drive focus and execution. So I see both the good and the bad of being public from that standpoint. But back to his example and this is not our story, if you're doing a significant rejiggering of your business, massive transformation, very difficult to do that in the public markets.

>> What about M&A? Because obviously, you can use stock as a vehicle to acquire companies, although most deals today are all cash, but you can do M&A with PE as well. You just did a recent acquisition, a small one. You should give a plug for Atlas, but what are your thoughts on this? It's kind of like new PE, new mindset.

Mark McClain

>> Yeah. But you sort of answered your own question, I would argue a little bit. Whichever state you're in, there are assets and resources to go do M&A. If you're a public company with liquid public stock, you're probably going to use that. If you're a private company, but you're healthy and high-performing, you're going to have plenty of access to funds to go do M&A. So I think at the end of the day, it's really more about, can you do M&A as a function of how healthy is your company and who are the people that are funding that business and do they believe in that strategy? If they do, I think no matter which side of that line you're on, public or private, you're going to be able to do what you want to do.

>> If you were a capital allocator, where would you be investing-

Mark McClain

>> All in on security.

>> That's what I'm saying, within the security space. Right? So within security.

Mark McClain

>> The question got so much harder now. Let's see.

Mark McClain

>> Intentionally.

Mark McClain

>> Well, look, this will sound self-serving, but I'm serious. We do think identity is a particularly attractive subset of the space undoubtedly. Now, I don't think that means others are totally unattractive. I think you got to give credit to the CrowdStrikes and some of the others that have rethought some of these market spaces and pretty dramatically rebuilt them. Sure, I'll give you the buzzword compliant answer, invest in AI. Now, which part of AI and which companies? Good luck. I don't know.

>> Okay. Let's double click on that. Would you invest in AI to make security better or would you invest in securing AI?

Mark McClain

>> Ah, that's a great way of phrasing the question. I think today, since I'm a security vendor, I'm also not totally unbiased here, am I? I think using AI to do security better is a double-edged sword that we're going to have to be careful of. Why do I say that? One of the funniest terms that's come out in technology in the last few years is, AI tools hallucinate. I heard that the first time, I went, "What? What do you mean technology hallucinate? Are we talking LSD 60 stuff? What are we talking about?" Right? Yes, is the answer. But there's a sense of these tools are very early stage. While there's a crazy amount of energy and excitement about AI, we're in the early days here. And if you're a security vendor, you don't want to take a lot of risks on how you in fact, perform security. So putting it all in the hands of an AI tool and just trusting it, it's going to give you exactly the right answer, is kind of risky I would argue, at this stage. Will that continue to get better? Absolutely. Are we using AI in aspects? You bet we are. Are we using it for what I'd call the core of how we secure things? Not yet, because I think it's more like, how do we learn from these technologies and let them accelerate? I love the term, augmented intelligence versus artificial intelligence. I think it's going to accelerate and enhance a lot of what we're doing. I know we're going to pull people all the way out of a lot of these things very soon, but we'll use less people who will be better informed to do what they're doing, I think will be very common.

>> I have a paradox in my brain that I would love to-

Mark McClain

>> Only one?

Mark McClain

>> No.

>> One that I just thought of that I'd love for you to help me resolve.

Mark McClain

>> All right.

>> Here's the paradox.

Mark McClain

>> I'm playing counselor now. Okay.

>> Here's the paradox. I'm a full self-driving skeptic. Okay? On the other hand, I'm thinking AGI is actually going to happen and I'm having trouble to rationalize those two things. Where do you stand on AGI and FSD, if you want to comment?

Mark McClain

>> Oh, Lord. I'm almost tempted to take the fifth and say, "Look, I don't know that I would consider myself well-educated enough to have a very strong opinion." I think at the end of the day, I come back to the early innings thing. We're so early innings on how these things are unfolding that... I gave a talk on this recently. Sorry, I'll veer off, but I'll try to tie it in.

>> Yeah, go. Go where you want to.

Mark McClain

>> We had this conference in town in Austin that's about culture and we got onto culture. And this case, I was asked to think about how do you see AI affecting culture? It's an interesting question, company culture. Right? And I said, "Well, look, the advantage of being gray-haired is you've seen some stuff." Right? And I'm like, "What I've seen multiple times in my career is the promise of new tech gets everybody super excited. They rush to it. And almost inevitably, they miss significant unintended consequences." Let me give you a simple example most of us have lived through, which is ATMs. Right? Banks went, "ATM is great. I don't need to pay all those tellers, simplified. I don't need to see you to get your money out." But what accidentally happened, nobody had any relationship with their bank anymore. So all of a sudden, your banking choice was super commodity, financial driven. Unless you had-

>> You've lost your first-party data connection.

Mark McClain

>> First-party data connect. That's what I meant to say. I was going to say that. But the point where I was, at the end of the day, that was amazing cost-saving technology. The unintended consequence was it broke for the retail banks. Right? I'm not talking commercial banks and investment banks, but for the retail banks, all of a sudden, that's when they over-corrected and turned the bank lobby into a Starbucks. I'm like, "I'm not going there to have a coffee. What are you guys doing? Doesn't makes sense to me." But there was this sense of rush to technology, understanding a benefit, a clear benefit of it without thinking through the secondary effects. And I think you can point to ATMs for that. You can point to email. I remember I was super upped, really dating myself. I was excited about email because that wasn't a thing when I was-

>> CC mail, yes. Oh, this is amazing.

Mark McClain

>> This is amazing. Until I had 8,000 emails a day, and now I'm not sure it's a good thing. Right? So there's a sense of, we don't understand the second or even tertiary effects of technology. I think for people that are again, all in on AI, it's like, "Yeah, this is an amazing breakthrough technology." We're all going to have to figure out how to leverage, but how fast to adopt it and in what areas to adopt it? We jokingly came up with this really helpful phrase, "Proceed aggressively with caution." What? Well, that's what we mean, proceed aggressively, but with caution. Don't just go all in and rush to do things that you don't understand the full consequences of. But go dig in, find out what we can leverage, figure out how we can get better with what we're doing with technology like AI, but don't just like, "We're going to get rid of half our people and give it all to the technology." Nope.

>> You know that famous Andy Grove quote, "You're not recommending that here. Let the chaos reign, and then reign it in. Not here."

Mark McClain

>> To use another great phrase, that's fraught with peril, fraught with peril.

>> This is where my favorite dadism and one that I've taught Dave.

Mark McClain

>> Oh, I love dadisms.

>> You don't know what you don't know until you know. And that's kind of what we're talking about.

Mark McClain

>> You had a very wise father.

>> I do.

Mark McClain

>> You still have a wise father.

Mark McClain

>> But no, I'm lucky. Yes, I do still have him. But that's really where we are. We don't know what we don't know. And we will know, we're just not there yet. And so your advice makes perfect sense.

Mark McClain

>> Yeah. By the way, especially in this area, I joke with... Yeah. We, like a lot of folks, we're going to use AI to maybe accelerate the development of content for the website, but we're not publishing right out of the AI tool to our website. We're going to accelerate the drafting of a content page or something, and then say, "Okay, somebody that really knows what they're doing, somebody make sure that sounds right," or whatever. Same with the early translation tools. If you took your website, ran it through a translation tool and sent it to Japan, you got some very unintended consequences.

>> You got immediate feedback.

Mark McClain

>> Immediate feedback.

>> Unacceptable.

Mark McClain

>> Not what you meant, I think. I don't think that's what you meant. So yeah, I think there's a sense of, this is way too important a technological shift to not be deeply ingrained and understanding it and figuring out what it means for your space. I loved your question. That was really good. I'm going to take that back and chew on that a minute. Is it securing AI or AI helping us secure things? Both are important, but I think there really is a sense of dig in, understand it. Every security vendor is clearly doing that at this point, as are all vendors. But I think in our case, we're not going to just hand things over to the AI tools very rapidly, and I don't think that's going to hurt us competitively. Because I think if a young startup were to come after us and say, "We've done it all in AI," oh, they're going to get some of those unintended consequences and maybe find real issues real quick. Right?

Mark McClain

>> Absolutely. Matt McClain, founder and CEO of SailPoint, thank you so much for coming on theCUBE today and spending time with us. I knew it was going to be a great conversation. You did not disappoint.

>> Great guest, Mark. Thank you.

Mark McClain

>> Thanks so much. A pleasure. Well, you guys have great questions. Great conversation. Really enjoyed it so much.

>> Absolutely. And to our viewing audience, keep it right here on theCUBE, continued coverage of RSA out of San Francisco. This is the place you want to be.

Mark McClain | SailPoint

search

>> Hello, and welcome back to theCUBE, broadcasting live from RSAC here in San Francisco. I'm here with my colleague, Dave Vellante, David Linthicum, and the team here at theCUBE. And today, we are joined by Mark McClain, the founder and CEO of SailPoint. Mark, welcome. It's great to have you.

Mark McClain

>> It's a great pleasure to be here. Thanks so much.

>> We are so glad that you made time for us. And identity management, it is a thorny thing. And we have had lots of conversations over the course of the last three days about identity management. And really, I know that at SailPoint, you're on the record of saying, "The identity management ecosystem, the way that we do it needs to evolve. It needs to grow up." So share with us a little bit your thinking on that. Would you?

Mark McClain

>> Absolutely. Yeah. I guess I have the pleasure of being an OG in the space, as they say. So I was here before we even coined the term, identity management, for the space. So been around this for a bit. What we typically mean by that is when we started into this market space 20 plus years ago, it was very much constrained in most people's minds to the employees of the organization. Those were the identities people were mostly talking about, and it was mostly about, I'd like to ensure those people actually have access to the right stuff ideally. And there was an operational side of that, which today goes by Lifecycle, used to be called Provisioning, but mostly Lifecycle management now. And then post Enron and SOX, we sort of got into this whole compliance and certification game. We should audit and validate. Right? So first, we should try to... Like finances, we should try to operate well, and then somebody should look over and make sure we did it the right way. That was the core. Other aspects of identity market space certainly include single sign on and multifactor, which is a very well-known discipline now and becoming pretty universal, frankly. I think if you're signing in to 50 apps at your shop, you should yell at your CIO. That should not be happening today. SSO and multifactor are pretty common. And then the other historically interesting space has been privilege. Right? Understanding the power and therefore, somewhat the danger of those privileged users and making sure that they are who we think they are. They're doing what we expect them to be doing. Because if they're not, really bad things can happen really fast. Right?

Mark McClain

>> Well, if they have the access that they need, not the access to everything, I think that's really a lot of-

Mark McClain

>> That's right. And importantly in that space, even if they have the access they're supposed to, they're actually doing what you expect them to be doing. It's when the proverbial disgruntled DBA says, "You fire me, I'm going to wipe out the corporate database." Those are bad days. So that's the history. Why we talk about it being different, so much has changed relatively recently. I'd say some of the key dynamics here are the move to cloud and sort of perimeter list environments. Right? I don't know that perimeters are dead. That's not a fair statement. It's just clear they're insufficient. I don't think we're going to quit having firewalls, but everybody has figured out, I can't count on the firewall to protect my enterprise. So we've got this open zero trust mindset of everybody's connecting and I want to make sure you're who I think you are and you're doing what I expect. Right? But the other big dynamics that are happening is what we defined as an identity has rapidly evolved from your employees, to the other humans that are connected to your stuff. Call that supply chain, distribution chain, business partners to very interestingly now, non-humans. Right? What does it mean to have all these robotic software bots and processes, and AI-generated, and IOT? I could go alphabet soup on us, but I won't. But I mean, there's a sense of all these new kinds of identities are dramatically increasing the complexity and scale on the identity side. But the other side is going through a similar thing, which is historically, what we really meant was, I want to know what David does and which applications can he access and what can he do inside SAP, or Workday or Oracle, right? Now, we all hear the stats. Right? That data that lives in those structured business apps, whether you purchased them or they're homegrown, all that data is getting exported and downloaded all day every day, shared, put into multiple spreadsheets, shipped around the internet. And the idea now that you've protected your enterprise by locking down who can access your financial application and you don't know where all that data lives in SharePoint, you're kidding yourself. So the explosion of identities, the explosion of data, and SailPoint sits at that critical intersection of, do you know who all your identities are, what they are? And do you know all the data you want to protect and have access to? And understanding that complexity and managing to risk on that is very challenging.

>> So a couple of years ago, it was probably a few years ago now, because I think it was pretty much in the middle of the pandemic, there was this big conversation about converging privilege and identity. And we heard a lot of noise about that.

Mark McClain

>> Right.

>> And I'm fascinated by your point of view on convergence versus what you say, unification. Help us understand what do you mean by that?

Mark McClain

>> Is it a distinction without a difference? We think it is a difference. Let's talk about that a second. And these terms are not necessarily self-explanatory, but I think the way people are using the term today. Convergence means you've got a vendor doing one of these, you've got a vendor doing this, you've got a vendor doing that. And I can kind of juggling to tell you that every investment banker in the planet visited some combination of me, and the Ping guys and the CyberArk guys, or Delinia or BeyondTrust. Today, I got this great idea. Why don't we put you guys together? What a fantastic idea. No one said that.

>> Why didn't we think of that?

Mark McClain

>> Why didn't we think of that? And so there was this... Especially by the way, in response to Microsoft talking about going broadly. And not so far back, but a little ways back now, Okta, who was sort of viewed as the default winner of the identity game, which some of us did not appreciate that positioning in the market. But anyways, they were dominating that next generation of access, single sign on MFA, and everybody's just assumed, well, they're just going to ripple into these other spaces and own them. And what folks like me and Udi over at CyberArk and the guys at Delinia, Ark and others, we went, "Ah, I don't think people understand how hard this is and how different it is from that." Because to an investor or a fairly simple observer, it's all identity. It must all be related, probably be better with consolidation, convergence. Right? But we said was, no. The issue is, what you really need is a unified single platform, single data model, single set of workflows, single set of policies, and you apply that in all those different areas. The most counterintuitive thing we've said is, "We're not going to get into that SSO, MFA game." Why? To be a little harsh, because we think Microsoft's going to dominate it ultimately. I think it's just going to be clear to the world that in the enterprise segment, which we serve, if you go down market, I think Google's making a lot more inroads there. But in the enterprise segment, Microsoft owns that office environment, that office suite, the productivity suite, whatever you want to call it. It's just quite logical that you would think as a user, I'm going to sign into that environment and it'll get me to everything else I cared about. It turns out that's not so much a security issue as a convenience issue. Right? It's more secure than yellow sticky on your computer with all your passwords. It's definitely better than that, but does it really help Microsoft understand that environment and all the security and risk profile of all those apps that they don't own, all the other business apps, all the other homegrown apps? They don't know those apps. They don't understand that. That's what we have developed over many years, a couple of decades now, the very difficult task of going into all these enterprises. We have 20,000 different connectors to bespoke applications now in our library because everybody's got something different. And you got to connect to all of it, pull that data in, map it, and explain it to people. So long-winded answer to convergence says, "Let me grab these three business apps, identity apps, put them together and I'll sell them to you as one thing." Right? Procurement people love that.

>> Yeah, of course.

Mark McClain

>> Technical people don't always love that. And I loved the stat, Dave, we were just looking at before we went on air, that folks here at the conference are saying they expect to expand the number of security vendors next year. Why? Because all this stuff is very specialized in many cases. And it turns out, what we do is quite specialized in difference than what Okta has historically done or paying, or than what Cyber and others have done. We do think, and we made a little noise about this, that the next generation of privilege might be a little closer. What I mean by next generation is far more dynamic, where the idea that privilege historically, was you're a database administrator or a system admin, I got to lock you down and track what you do. Right? Now, it's like, "Hey, you're just a normal help desk person, but you need to reset a password." It turns out, that takes extremely high rights to do that. You don't really want that 22-year-old on your help desk to have extremely high rights to the whole AD system. Why don't you just say, reset a password. He knows what's supposed to happen there, he or she, but off it goes, temporarily creates privilege, makes the change, comes back, that person never had permanent privilege.

>> And then that goes away.

Mark McClain

>> That goes away. That's a whole new way to think about privilege, which we think is far more relevant to the way we think of this identity integrated control plane. So kind of a long-winded answer, I apologize, but that's why we say unification around the core of securing your enterprise through the lens of identity is different than rolling up three categories.

>> It's pressing what you said about Microsoft, the data we were showing you before. If you look at Microsoft and they're just ubiquitous in that those charts we were showing you before, out of the 1,800 accounts, they're in 1,700.

Mark McClain

>> Of course, they're everywhere.

>> They just completely dominate the graph. You can't even look at anybody else. They're up into the right. And so to the point there, why would you want to compete against that? It's the convenience factor. And procurement says, "Okay, it looked great, cheap, easy, good enough, great."

Mark McClain

>> Totally out of our space. That's why I think our friends at Zoom are going to have a struggle against Teams. Right? They're like, "It's just built into the Microsoft environment. Why don't I just do that?" Right?

>> You remember what happened to the cyber stocks when Microsoft had their big announcement?

Mark McClain

>> Yes.

>> They all dropped. I don't know if you were a public company at the time. You might've been.

Mark McClain

>> Yep.

>> I'm sure you got hit on sympathy, and then the market was just wrong about that. They didn't understand the nuance that you just described.

Mark McClain

>> You can't not respect this incredible resurgence Microsoft has done under Nadella. It's an amazing, one of the greatest business stories of my lifetime. No doubt. Right? But there's also this other edge of the spectrum. Just because Microsoft says they're going to do something, you shouldn't necessarily roll up your tent and go home. Right? They're an amazing company. We're pretty confident we have more people working on this problem than Microsoft does. They're a very big company. They're not all working on this. Right?

>> No, they don't.

Mark McClain

>> They got that whole Xbox thing and a few other things going on. So at the end of the day, sometimes people can get caught up in the, how can you compete with the giant? Well, 20 years ago when we started, we were competing with Oracle and IBM. They were the giants of 20 years ago. We're good. than compete with those guys.

>> You build Joy's Law, right? No matter how good your people are, there's a lot of people out there that collectively are better.

Mark McClain

>> Exactly. Exactly.

Mark McClain

>> And I think Microsoft isn't exactly going to... Nothing against Microsoft. They've done an amazing job, but they're not really known for their amazing security chops. And a lot of the feedback that I'm hearing in the market is, "So sure, you're going to charge us per seat for the co-pilot access, and then you're going to charge us..." "Oh, sure, we can fulfill your security needs and we'll charge you $30 a seat for that." And so people are saying, "Wait a minute. I'm feeling sort of a price creep there a little bit."

Mark McClain

>> That, and I'll tell you the other thing I think we are hearing regularly, I assume it's come up in some of your dialogue, what's the newest term that you probably didn't hear three years ago? Multi-Cloud. Every company who said, "I'm an Amazon shop. I'm an Azure shop." Now, what they're all saying is, "I'm multi-cloud." Why? Because old guys in tech like me will tell you, customers hate when one vendor has apparent dominance of a market space. They know that's going to cause innovation to slow and prices to go up. And so now, all these big enterprise customers are like, "We got all these things." And then I pause there and I look at people and go, "So you think that CIO's going to want Microsoft to manage Google and Amazon for them?" Really, I don't think so. I don't think that's going to happen.

>> So can you create an abstraction layer that I'll say, floats above those clouds and creates a common experience across them? I presume that's IP that you have. And where are you at in the majority of that capability?

Mark McClain

>> I mean, no offense, that's what we've been doing for 20 years. It just wasn't against cloud. It was against every ERP system, every directory, every business application.

>> It was probably harder actually, with all the diversity.

Mark McClain

>> Actually, to your point, it's getting a little simpler the more we see the consolidation at the hyperscalers. Right? But yeah, I mean, that's what we've done for years, is say, "We are the independent layer that focuses on the identity, and you tell us by policy what all that identity should have access to." And not just access as in sign in, back to where we were a minute ago. What privileges and permissions can that person do in that system? It's one thing to say, "I can let you have Salesforce access." It's another to say, "You can see the accounts in your territory or you can see the entire pipeline." Right? You don't want the rep in Atlanta having access to the entire pipeline. So there's two levels or three levels of permissions in many cases here that we're really dealing with. And that's the nuance that is very difficult to manage at scale. That's what SailPoint excels at.

>> Are passwords ever going to go away?

Mark McClain

>> We're going to try. I mean, we're not fans of passwords. That's not really the part of the business we're in.

>> You're not hanging on to that.

Mark McClain

>> We'd like to say that's the other thing people say, "Aren't you going to get into when Duo is for sale, and Cisco?" Great company, by the way. But we're like, "Look, we're ambivalent to that." That's the authentication. How do you validate you're really Dave? And multifactor is an extra way to do that. Password's the basic. At the end of the day, we're like, "Yeah, somebody's going to authenticate you. We care about once we think you know who you are, what can you access?" And to your point, if this changes to a passwordless sync or a passkey, I guess it's the new hottest thing going, whatever it is, somebody's going to get you authenticated. That's actually not the part of the game we're in. Once I know who you are, what can you have access to?

>> So passwordless really doesn't change the game for you.

Mark McClain

>> Doesn't change us at all. It doesn't affect us.

>> Your value prop remains 100% intact.

Mark McClain

>> Independent of that. Exactly.

>> Behind that, yeah.

Mark McClain

>> This is where people get confused in the nuances of identity. Like, "Oh, if that happens, aren't you guys in trouble?" Nope. That actually doesn't affect us at all.

Mark McClain

>> Thankfully, we built this thing the right way.

Mark McClain

>> We thought about the problem from a different vantage point, and I think it's turning out to have been a very healthy way to think. So we're very happy with that.

>> Love to get your perspective because you've been on both sides.

Mark McClain

>> Yeah.

>> Private, public, private.

Mark McClain

>> I don't know which two sides we were talking about there for a second. I don't know where you're going.

>> I talk to Michael Dell about this all the time. We were private. I don't want to be in the 90-day shot clock.

Mark McClain

>> He did an amazing job.

>> Now he's saying, "I love the 90-day shot clock. It's great."

Mark McClain

>> Yeah. Now that I got a team on the floor and... Yeah, exactly.

>> And I have all this liquidity. And I can do share buybacks and dividends and it's beautiful-

Mark McClain

>> Unbelievably well....

>> which I noticed. So what are your thoughts on public? There's a lot of discussion today about staying private for longer. I guess that's part of the theme. The market's really maybe not right for IPOs, but we've seen this before. It goes in segments. We saw this with Cloudera. They stayed private. I felt like they stayed private too long. Maybe, maybe not. They had other business challenges, but do you have a point of view on that?

Mark McClain

>> I think for the most part, obviously, we're a private company. So at this point, I can't comment on what our timeline or future might look like. Right? That said, I can comment generally on that question. Okay. What I would say is, if people in my chair are doing their job right, 99.9% of the company is not affected by that. Right? There's a very tiny group of people whose lives are dramatically different when you're private versus public. You got SCC reporting, you got accounting guidelines, all that stuff. But at the end of the day, we've got to market well, create demand, sell well, fulfill that demand, service well, deliver value to customers, lather, rinse, repeat. And the people that do that across the business, if we were to go public again someday and they have a liquid stock, that will be good. They now have privately held stock that they believe someday would have some value. And having come from the startup world where everybody had private stock that they counted on having value someday, that's very comfortable for me in our leadership team. So I think it can be overblown as to which side of that line you're on. To Michael Dell's example there, there are certainly things about raising liquidity and having extra assets to go after acquisitions and things like that. But on my mind, having lived through, we're an odd company, right? We're venture-backed, then piggybacked, then public, widely held, now private again, with the same PE firm, highly unusual, and we'll see what happens next. But that said, having been the fortunate guy to sit in this chair the whole time, now I've seen all those playbooks, the bulk of the company really isn't affected by that.

>> So Michael, by the way, didn't say to me now he loves that liquidity. That's my observation. But what he did share with me was it would've been very hard for him to affect that transformation as a public company, number one. Number two, it was zero interest rates. And his timing was unbelievable.

Mark McClain

>> Yeah. Free money is great.

>> But you're not going through that kind of painful transformation that Dell had to go through. I mean, they were getting hammered at the time. And so, a different dynamic for you.

Mark McClain

>> It is. And look, I am not a financial market professional. I like to refer to Mr. Buffett, who's pretty famous for doing well in that world. And he's a very harsh critic of earnings guidance, quarterly earnings reports. He's like, "We're putting companies in the 90-day shot clock." And when you're building a strategic business, the fact that you're judged every 90 days on a certain incremental, it is constraining and frustrating at times having lived through that. But it also has the effect of good discipline to drive focus and execution. So I see both the good and the bad of being public from that standpoint. But back to his example and this is not our story, if you're doing a significant rejiggering of your business, massive transformation, very difficult to do that in the public markets.

>> What about M&A? Because obviously, you can use stock as a vehicle to acquire companies, although most deals today are all cash, but you can do M&A with PE as well. You just did a recent acquisition, a small one. You should give a plug for Atlas, but what are your thoughts on this? It's kind of like new PE, new mindset.

Mark McClain

>> Yeah. But you sort of answered your own question, I would argue a little bit. Whichever state you're in, there are assets and resources to go do M&A. If you're a public company with liquid public stock, you're probably going to use that. If you're a private company, but you're healthy and high-performing, you're going to have plenty of access to funds to go do M&A. So I think at the end of the day, it's really more about, can you do M&A as a function of how healthy is your company and who are the people that are funding that business and do they believe in that strategy? If they do, I think no matter which side of that line you're on, public or private, you're going to be able to do what you want to do.

>> If you were a capital allocator, where would you be investing-

Mark McClain

>> All in on security.

>> That's what I'm saying, within the security space. Right? So within security.

Mark McClain

>> The question got so much harder now. Let's see.

Mark McClain

>> Intentionally.

Mark McClain

>> Well, look, this will sound self-serving, but I'm serious. We do think identity is a particularly attractive subset of the space undoubtedly. Now, I don't think that means others are totally unattractive. I think you got to give credit to the CrowdStrikes and some of the others that have rethought some of these market spaces and pretty dramatically rebuilt them. Sure, I'll give you the buzzword compliant answer, invest in AI. Now, which part of AI and which companies? Good luck. I don't know.

>> Okay. Let's double click on that. Would you invest in AI to make security better or would you invest in securing AI?

Mark McClain

>> Ah, that's a great way of phrasing the question. I think today, since I'm a security vendor, I'm also not totally unbiased here, am I? I think using AI to do security better is a double-edged sword that we're going to have to be careful of. Why do I say that? One of the funniest terms that's come out in technology in the last few years is, AI tools hallucinate. I heard that the first time, I went, "What? What do you mean technology hallucinate? Are we talking LSD 60 stuff? What are we talking about?" Right? Yes, is the answer. But there's a sense of these tools are very early stage. While there's a crazy amount of energy and excitement about AI, we're in the early days here. And if you're a security vendor, you don't want to take a lot of risks on how you in fact, perform security. So putting it all in the hands of an AI tool and just trusting it, it's going to give you exactly the right answer, is kind of risky I would argue, at this stage. Will that continue to get better? Absolutely. Are we using AI in aspects? You bet we are. Are we using it for what I'd call the core of how we secure things? Not yet, because I think it's more like, how do we learn from these technologies and let them accelerate? I love the term, augmented intelligence versus artificial intelligence. I think it's going to accelerate and enhance a lot of what we're doing. I know we're going to pull people all the way out of a lot of these things very soon, but we'll use less people who will be better informed to do what they're doing, I think will be very common.

>> I have a paradox in my brain that I would love to-

Mark McClain

>> Only one?

Mark McClain

>> No.

>> One that I just thought of that I'd love for you to help me resolve.

Mark McClain

>> All right.

>> Here's the paradox.

Mark McClain

>> I'm playing counselor now. Okay.

>> Here's the paradox. I'm a full self-driving skeptic. Okay? On the other hand, I'm thinking AGI is actually going to happen and I'm having trouble to rationalize those two things. Where do you stand on AGI and FSD, if you want to comment?

Mark McClain

>> Oh, Lord. I'm almost tempted to take the fifth and say, "Look, I don't know that I would consider myself well-educated enough to have a very strong opinion." I think at the end of the day, I come back to the early innings thing. We're so early innings on how these things are unfolding that... I gave a talk on this recently. Sorry, I'll veer off, but I'll try to tie it in.

>> Yeah, go. Go where you want to.

Mark McClain

>> We had this conference in town in Austin that's about culture and we got onto culture. And this case, I was asked to think about how do you see AI affecting culture? It's an interesting question, company culture. Right? And I said, "Well, look, the advantage of being gray-haired is you've seen some stuff." Right? And I'm like, "What I've seen multiple times in my career is the promise of new tech gets everybody super excited. They rush to it. And almost inevitably, they miss significant unintended consequences." Let me give you a simple example most of us have lived through, which is ATMs. Right? Banks went, "ATM is great. I don't need to pay all those tellers, simplified. I don't need to see you to get your money out." But what accidentally happened, nobody had any relationship with their bank anymore. So all of a sudden, your banking choice was super commodity, financial driven. Unless you had-

>> You've lost your first-party data connection.

Mark McClain

>> First-party data connect. That's what I meant to say. I was going to say that. But the point where I was, at the end of the day, that was amazing cost-saving technology. The unintended consequence was it broke for the retail banks. Right? I'm not talking commercial banks and investment banks, but for the retail banks, all of a sudden, that's when they over-corrected and turned the bank lobby into a Starbucks. I'm like, "I'm not going there to have a coffee. What are you guys doing? Doesn't makes sense to me." But there was this sense of rush to technology, understanding a benefit, a clear benefit of it without thinking through the secondary effects. And I think you can point to ATMs for that. You can point to email. I remember I was super upped, really dating myself. I was excited about email because that wasn't a thing when I was-

>> CC mail, yes. Oh, this is amazing.

Mark McClain

>> This is amazing. Until I had 8,000 emails a day, and now I'm not sure it's a good thing. Right? So there's a sense of, we don't understand the second or even tertiary effects of technology. I think for people that are again, all in on AI, it's like, "Yeah, this is an amazing breakthrough technology." We're all going to have to figure out how to leverage, but how fast to adopt it and in what areas to adopt it? We jokingly came up with this really helpful phrase, "Proceed aggressively with caution." What? Well, that's what we mean, proceed aggressively, but with caution. Don't just go all in and rush to do things that you don't understand the full consequences of. But go dig in, find out what we can leverage, figure out how we can get better with what we're doing with technology like AI, but don't just like, "We're going to get rid of half our people and give it all to the technology." Nope.

>> You know that famous Andy Grove quote, "You're not recommending that here. Let the chaos reign, and then reign it in. Not here."

Mark McClain

>> To use another great phrase, that's fraught with peril, fraught with peril.

>> This is where my favorite dadism and one that I've taught Dave.

Mark McClain

>> Oh, I love dadisms.

>> You don't know what you don't know until you know. And that's kind of what we're talking about.

Mark McClain

>> You had a very wise father.

>> I do.

Mark McClain

>> You still have a wise father.

Mark McClain

>> But no, I'm lucky. Yes, I do still have him. But that's really where we are. We don't know what we don't know. And we will know, we're just not there yet. And so your advice makes perfect sense.

Mark McClain

>> Yeah. By the way, especially in this area, I joke with... Yeah. We, like a lot of folks, we're going to use AI to maybe accelerate the development of content for the website, but we're not publishing right out of the AI tool to our website. We're going to accelerate the drafting of a content page or something, and then say, "Okay, somebody that really knows what they're doing, somebody make sure that sounds right," or whatever. Same with the early translation tools. If you took your website, ran it through a translation tool and sent it to Japan, you got some very unintended consequences.

>> You got immediate feedback.

Mark McClain

>> Immediate feedback.

>> Unacceptable.

Mark McClain

>> Not what you meant, I think. I don't think that's what you meant. So yeah, I think there's a sense of, this is way too important a technological shift to not be deeply ingrained and understanding it and figuring out what it means for your space. I loved your question. That was really good. I'm going to take that back and chew on that a minute. Is it securing AI or AI helping us secure things? Both are important, but I think there really is a sense of dig in, understand it. Every security vendor is clearly doing that at this point, as are all vendors. But I think in our case, we're not going to just hand things over to the AI tools very rapidly, and I don't think that's going to hurt us competitively. Because I think if a young startup were to come after us and say, "We've done it all in AI," oh, they're going to get some of those unintended consequences and maybe find real issues real quick. Right?

Mark McClain

>> Absolutely. Matt McClain, founder and CEO of SailPoint, thank you so much for coming on theCUBE today and spending time with us. I knew it was going to be a great conversation. You did not disappoint.

>> Great guest, Mark. Thank you.

Mark McClain

>> Thanks so much. A pleasure. Well, you guys have great questions. Great conversation. Really enjoyed it so much.

>> Absolutely. And to our viewing audience, keep it right here on theCUBE, continued coverage of RSA out of San Francisco. This is the place you want to be.