Michaël Lakhal, OneSpan | RSA Conference 2023

This is texturung TV. Welcome back to rsac in San Francisco 2023 more great conversations lots of different topics. We've kind of hit on many areas one area that we haven't talked as much about is around identity.

Of course, you know, it's Central fundamental to security and I'm pleased to be joined by Michael who is with one span director of product management and product strategy. Welcome. Thank you.

Thank you very much great to be talking with you. So tell us a little bit about yourself and tell folks about ones bad. So I'm working.

Mostly I start my career on the finances industry mostly working for banks in Europe. I'm French as you can hear with my accent and now I mean I decided to move to the technology because I really think I mean the technology can change and need to change the way we subscribe and the way we interact with our This kind of organization. So I worked previously for company like DocuSign.

I know I joining one span. So just quick word about one span what we are doing one span. We are security company with security DNA and we operate from the identification.

So we manage identity to capture the approvals or what we call commonly is signature and the storage of them formation. This is really a full digital agreement management system with the high security and we operate mostly in higher regulated industry. Fantastic tell you how far we've evolved doing signature identity and in the highly regulated industry.

I remember the day about can we digitally sign a document right certainly involved quickly. I'd love to hear you talk about the state of identity identity management in that transaction flow because we always focus on kind of user identity. And now we're talking not just it's authenticity and authenticity of that identity as well as the document the the chain of custody control of that.

So yeah, what's your perspective on that? So the identity If you think about it, I mean, this is crucial. This is the starting point of everything everything you need to start with a clear identification and we need to differentiate different type of identity because identities the generic term right now.

I mean, you can be like a full unknown person that I need to onboard in my system. So I need to organize your identity there is different methodology to do it or you could be a known customer but you need to prove to me your your identity, which is what we call authentication. And this is where we operate right now.

We can manage like pure Prospect existing clients known and known clients and we can gather this information to create this digital identity. And this digital identity could be recognized during the full process of transaction and some of those those transactions are all happening on one step right often just on a basic contract and maybe multiple signatures approvals review processes all of that kind of thing. What else besides contracts are we talking about that apply to this digital identity you're speaking of?

But different things and what what's is pretty unique with the one span is we operate globally. So this definition of identity. I just told you just give you I mean could be fair from a country to another one like the for instance here in us the identity and the weights managed is mostly matched by based on risk management.

They manage your risk related to your identity and different artifact into the transaction. In Europe, Francis difference is management. I mean highly regulated as you know there in Asia is different as well.

So it's mostly technology regulation compliancy. So there is no unique answer to that there is multiple approach. But what our clients are looking for right now is really to have like a solution can manage all this complexity for them to delegate that.

if every company had to figure out the nuances of Global you know local Regional country related how we manage identity how we recognize the identity. That's a career in and of itself. Right?

What they used to say is transactional group are Global trust is local and this is what we try to do because you need to upload that really local side of things. I'm curious in in organizations your customers this typically the organization that brings you in contacts one span. It's a hey we need some help come talk to us.

So mostly banks finance BFS I finessing services in general. We are walking right now with most of the biggest banks. I mean the 100 Banks globally that's why I'm in the global approach of things is very important for us.

We are operating mostly on weight level our solution our white limited. That's why means one brand is not like very visible from and use our perspective, but I'm pretty sure that you already use our technology without knowing that's a good white label program, you know realize Yeah, the underlying technology. Yeah, you know weight labeling is very important all about trust here.

I mean because the thing is if you want to bring to us, you will never trust a third party solution. You trust your bank. You trust your doctor your test your trust the hospital you're gonna go to I wish you don't have an appointment when they open for you, but you see my point is white labeling is really I mean about trust here and trust in these digital journey is so important.

Well, let's talk about some of the new things that are coming up for identity in that context certainly AI as a very big topic and I think as everybody, you know, we've had AI for a while it's not like it's brand new but the generative Ai and the availability of it to the mass Market is certainly brought that to our attention. Of course, we all think about, you know, the scenarios of deep fakes of people voices signatures Technologies, whatever that may be how do you look at that set a challenge? So we look at the a Differently as a potential thread, it doesn't mean that it could create like very sophisticated attacks new attacks that we don't even know but the fact that AI can automate a certain number of tasks and action that's something the thread because it's way easier right now to create a phishing attack by using charge GPT the best way to detect a phishing email is you look at watching of the email and you detect some success suspicious the AI it's facilitate the work for hackers.

That's I mean the current state but in the future most probably the AI will be more and more sophisticated and can create better or more efficient fishing attack or malicious code for hackers. So it will open the hacking to anyone. You can become a hacker with say I can say rewrite this email in the style of this someone.

I copied your emails. Yeah, you get it kind of into that. It's gonna be more accurate.

I'm gonna he could get together more information more personal information. So it's gonna be let's dictable issues interesting about the world of ransomware. Obviously that's you know, big issue big topic for everyone and thinking about how you know, I've gone through some incidents myself that involved email and thinking over an account and suddenly, you know, that that identity is no longer the one it should be in getting involved in you know, sharing data or transactions or whatever.

I haven't had a ransomware experience for knock on wood. Just like the hospital. So, you know talk about your role in the ransomware kind of risk.

So we operate mostly in what we call b2c business to Consumer. So end user. So we're answering words not really an area where we operate because mostly for companies it could be like and and user but The point is if you are able to protect the identity you can protect from any attacks.

That's the key thing. This is why I said I mean it's the starting point of everything the identity. Fraudulent identity I can fake and take your identity or pretend that I'm you so I can access to any of the services and I can create any fraudulent attack you.

Great. Well, I'm curious. What kind of conversations are you having an RSA this year?

That might be a little different or maybe an evolution of what we've been talking about previous years. The previous years was mostly about passwordless zero to us. This year is 0 to still exist, but I hear a lot about ai ai, I mean, I understand that everyone is concerned about AI I don't think I mean we have a level of maturity, but for me, I mean if you think about all these technology, I mean the trust the identity management is still I mean, it's become crucial become more and more important for organization AI can prevent can help to prevent that but I think I mean we are not at the level right now of where I mean AI really now when it comes to AI I mean there's this chat, GPT everyone is talking about but I think I mean you can also have expected having like private AI who can protect I mean the end user and each organization should keep an eye on it.

Interesting. Yeah, I think about the the pandemic and the digitization in so many more experiences. I would imagine that's a bit had a big effect on your business as more things of digital differently differently.

I mean, it has a huge impact during the pandemic number of transaction. We operate with also specifically in our domain in bank and insurance. I mean people don't go to the branches anymore.

So everyone want to digitalize we also see. Raise of nectarization performed with mobile devices the next year the New Gen the Gen Z right now. They're all want you need to be mobile forests for for any kind of transaction.

So yes, definitely. I mean there we see an acceleration of this digital transformation and we see it globally and some interesting to see him in the difference between origin to another one. Yeah, I can imagine there are differences and now I mean we have The tax of let me steal your iPhone and you know get your finger brand or hold your face to the phone and okay now you've got access to things.

We hope you don't you didn't have access to. So it's new threats even just basic physical threats to because consumer side of it. Yes it exists.

Now as you say they mean with the facial conditions easier. I'm into steal the someone devices and trying to corrupted. The thing is organization need also to leverage this AI we were talking about, you know to have what we call continuous photogication continuous identification during that transaction.

So you we shouldn't, you know just rely on face ID on your mobile. For instance. We should have like detecting any suspicious activity.

Like behavioral the way you behave to interact with an organization the way you are taping your your password or your your feeling some form. That's I mean the kind of data we capture to analyze and detect potential fraud. So it's not only about and this is how we can prevent this kind of attacks physical attacks.

Very good. Do you see actually from Financial transactions banking is where you played a big role? What's the next most upcoming industry to to adapt your technology?

We operate mostly in high regulatin industry. We see Health Care, although I potential because the digital transformation started in that industry, but I mean all the higher religions where the security matter when the highest level of security standard need to be reach out when we have we need to comply with different standard or local regulation. Mostly our banks Healthcare life science is kind of things.

It seems like regulated Industries would be a natural bit because there you have to have correct people signing attestations or compliance or documents correct that they have to follow. So that's clearly our position. We want to have a full digital Journey with a high level of security.

Oh, very good McHale. It's been great talking with you. I'm glad you're having a good RSA.

Well, I think we all are the level intervent interaction energy and just that kind of businesses transacting. It's good to see that return. Thank you very much.

Thank you for having me here. Absolutely Michelle from one span. They appreciate you coming by.

We'll see you and just a moment with another great interview. Just like we have with Michael here today.