Venafi’s new life under CyberArk is all about end-to-end identity management

Venafi’s Machine Identity Summit 2024 was both a statement of where the company is headed under its new owner and a reminder of its leadership in the machine identity space.

Taking place at the same time as CyberArk’s $1.5 billion acquisition of Venafi was finally made official, the event acted as a stage to justify the move and explain how customers could benefit from the combination of either company’s decades of experience.

The benefits of the acquisition for CyberArk are clear: while the firm has been doing identity security for the last 25 years, it has stated that the addition of Venafi’s portfolio will allow it to deliver “end-to-end machine identity security at enterprise scale”.

Venafi’s public key infrastructure (PKI) and machine identity solutions will complement the wider array of identity security offerings in CyberArk’s portfolio, with the promise of a single dashboard unifying the two alluring customers.

This appears to meet customer demands, with Ricardo Lafosse, CISO at Kraft Heinz, using his time on stage to repeatedly call for “one dashboard, please!” when asked for his thoughts on the acquisition. Lafosse compared the combination of CyberArk and Venafi to Terminator 2. Hyperbole and pop culture aside, what Lafosse likely meant by this was that combined, the two firms can offer a far more comprehensive identity solution.

He added that customers of the combined firm will now get a far more comprehensive picture of their security, allowing them to make data-driven decisions on their identity controls.

This will be the big takeaway for most customers. Gone are the days of compartmentalized identity management and security workflows, if CyberArk’s claims are to be taken at face value.

Hybrid and multi-cloud will cause headaches for identity management

At its event, Venafi unveiled specific updates to its Control Plane for Machine Identities solution aimed at improving the overall experience for customers. This, it says, will be central to any unified solution coming down the line.

Another major theme of the conference was highlighting how increased adoption of hybrid and multi-cloud environments was fuelling an explosion in the number of machine identities firms need to manage.

Jeff Hudson, CEO at Venafi and now CEO emeritus under the new CyberArk umbrella, said the combination of on premise and public cloud distributed across multiple providers has created innumerable new silos. Across all of these, he added, firms will need to track machine identities.

The ongoing embrace of CNCF has also drastically changed the types of identities being generated, as well as their lifecycle, only exacerbating the complexity for security practitioners.

Venafi wants to capture the corresponding demand from enterprises for visibility across these silos, as well as provide automation to help deal with the sheer volume of assets whose identities need to be monitored, rotated, and secured.

At its 2024 Summit, its announcement of new additions to TLS Cloud Protect that will now allow security teams to natively integrate it across AWS, Azure, and GCP, should go some way in doing that.

Actively securing identities is the next challenge Venafi wants face

Hudson made some bold remarks on stage in Boston, claiming we are entering a new era of identity and cyber security in which Venafi will focus on securing identities over simply managing those identities moving forward.

Future-facing aspects of the event included repeated discussion of the post quantum threat, which Venafi thinks should now be taken seriously by businesses. Specifically, consideration of the quantum threat at Machine Identity Summit 2024 centered on the considerable threat quantum poses to the underlying encryption techniques underpinning the majority of identity systems in use today.

Speaking onstage at the Summit, Colin Soutar, MD of risk & financial advisory at Deloitte & Touche LLP, pointed to expert projections that there is a finite probability we see a quantum computer within the next decade.

Firms should not be burying their heads in the sand on this threat, however nebulous it may appear, and Venafi wants to show it is keenly aware of how identity security is threatened by potential quantum-based attacks.

Accordingly, Venafi announced new post-quantum cryptography integrations looking in Control Plane, including support for the new NIST-approved post-quantum algorithms in the latest versions of TLS Protect and COdeSign Protect.

Kevin Bocek, chief innovation officer at Venafi said overall, the new strategy outlined by Hudson was very much driven by the threat landscape, in which identity-based attacks are core to many hugely disruptive malicious campaigns.

Leaders must reorient their approach towards identity security, according to Bocek, to ensure they have an active process to manage the security of identities at all times.

Venafi, in its new role within the CyberArk ecosystem, is in a good place to leverage its new partners’ long history in securing these identities. When it comes to fending off theoff the identity-based attacks of the future.