Episode 18: Jon Gelsey: Identity product GTM insight from Auth0’s early days

Full Transcript

Transcript lightly edited for clarity.

Riley Hughes: Welcome to the Future of Identity, a show that surfaces hard-earned insights identity practitioners need to succeed in the fast-growing world of digital identity. On the Future of Identity podcast, we skip the conceptual and theoretical conversations and dive into the tactical lessons learned from people in the trenches taking a product to market. I’m Riley Hughes, co-founder of Trinsic, and we are a reusable identity infrastructure company powering dozens of amazing identity products. In this episode, I sit down with John Gelsey, founding CEO of Auth0 Inc., which sold to Okta for $6.5 billion, as well as the CEO of Xnor.ai, which he sold to Apple for $200 million before they even had a product in market. This was a tremendous conversation. John told the story of the early days of Auth0, including how they got their first customers and $1 million of revenue. Then we spent time diving into how new technologies get adopted generally, John even went as far as saying that technology adoption is always incremental, not revolutionary.

Riley Hughes: Then we talk about the role of big tech and why he doesn’t think that reusable identity will be dominated by massive incumbents. That led us to talk about what he would do if he were running a company whose business model could be cannibalized by reusable identity, which is that he would look to disrupt himself and do it in a safe way. This was a rare look into one of our industry’s best operators, and he really gave some great advice. I hope that you enjoy the conversation that I had with John, and now to the conversation. John, welcome.

Jon Gelsey: Thank you for having me.

Riley Hughes: Yeah, I’m thrilled to have you. You obviously are one of a few people in the world who have been a part of not only one incredibly successful company, but several, as well as being an investor and advisor to several companies, including ours at Trinsic. So maybe we should start by jumping right in on the early days of Auth0. Specifically, I’m interested in how you thought about focus versus breadth in the early days. Identity touches everything, so it’s easy to go after everything. But I’m curious, what was the initial insight that led to you joining Auth0 and wanting to take a bet on that company?

Jon Gelsey: It was a little bit fuzzy. All startups, especially tiny little things like Auth0 in a crowded space, you know, that’s kind of high risk. What you’re really trying to do is figure out if, is there a niche we could develop where we could, you know, survive and be okay. I was working at Microsoft at the time in the strategy and M&A team, corporate development, and had identity actually in my strategy portfolio, so I was, you know, more familiar with the space. The technical co-founders, Matias Woloski is the CTO, and then Eugenio Pace was the eventual co-founder, but eventually was running customer success initially for us, and amazing job. They were coming at identity in a different way from all of the other identity companies I was seeing, in that they weren’t coming in the door and saying, Here’s a better way to do identity, and let me explain with various security engineer acronyms, SAML or IDC, why it’s better. Instead, what Auth0 was doing was an abstraction layer on top of your existing identity infrastructure to make it easier to use.

Jon Gelsey: And the analogy is really to like Stripe or Twilio, especially in their early days. You know, Twilio is like, Hey, here’s an abstraction layer to the Verizon and AT&T APIs. And sort of your initial reaction is, Well, that’s stupid. Why do I need an abstraction layer for it? I’ve already got the APIs. But then of course you go look at the Verizon APIs, and you’re like, Oh my God, these are hard to use. And of course, you also realize that there’s, you know, for SMSs, there’s, you know, whatever, 267 or something like that, you know, mobile providers around the world, and they’re actually trying to send SMS communications to sort of everybody in the world, and it’s kind of hard to manage that yourself. So what Twilio is doing is an abstraction layer to make it easier to use this existing infrastructure. Stripe, the same thing, but with credit card transactions instead of communication, so that you didn’t have to do all the Bank of America APIs. So Auth0 is doing the same thing.

Jon Gelsey: Every enterprise has an existing identity infrastructure that generally was pretty, pretty clunky, because every enterprise, no matter how well run it is technically, they accrete portions of their identity and security architecture over time. I remember a CTO, one of our first big enterprise customers, saying, I’ve got like a dozen people working on identity. And even with this big team of smart people, I keep feeling like I’m sort of a week away from it falling over. You guys are dealing with all of that for me. Now, the hard part, of course, is having the sensibility, I’ll call it an aesthetic sensibility, of sort of what’s the right level of abstraction so that you’re abstract enough the user can be highly productive, but not so abstract as that you sort of conceal or make it hard to use. And so you started this question by saying, ah, you know, focus versus breadth.

Jon Gelsey: And I guess it was breadth in that we wanted to be the abstraction layer for whatever was in your enterprise, but also focus for focus on not selling to security engineers, but selling to developers who had to use what security engineers had created in terms of their identity solutions.

Riley Hughes: So am I thinking about this right, that as an enterprise, I’ve got my Azure Active Directory stuff over here, and I’ve got a ForgeRock thing over here, and by the way, last year I made an acquisition and they rolled their own thing over here, and Auth0 is a layer that sits on top of all of those? Because my understanding is Auth0 was more of a competitor to those players, the Oktas and the ForgeRocks and the whatever.

Jon Gelsey: So it was kind of a competitor to a ForgeRock or Ping or whatever. They were actually more foot forward in that, you know, it’s like, oh, here’s a better identity solution for you. We can replace your existing IdP. So it’s more of a competitor to Active Directory. or Azure AD or whatever they’re calling it now. I can’t remember the crazy new name for Azure AD.

Riley Hughes: That’s it, Entra.

Jon Gelsey: Thank you.

Riley Hughes: Yeah, it’s interesting. Suppose you’re having a conversation with an enterprise about a one-and-a-half million dollar deal, right, in early days of Auth0. I’m sure that the slide doesn’t just say, It’s easier to use, right? Was it just the abstraction layer, or did you have to blend it with some other things? How did you basically go to these big enterprises with this value proposition?

Jon Gelsey: Sure. What you’re really getting at is what the VCs these days call product-led growth marketing. Back then, we just called it common sense. We viewed ourselves as a developer tool and therefore more appropriate to your point for smaller companies. And I was actually surprised by month four or so that we had big enterprises coming to us and saying, I want to use this on this project over here. Here’s your ten thousand a month or whatever the right number was at the time. And we weren’t really marketing to big enterprises at that time. What we figured out is that the sort of the magic of, again, product-led growth is that you appeal to the constituency, this kind of army of friends that are busily inside the enterprise advocating for you to be, in our case, you know, the identity infrastructure for the entire company. And so we didn’t actually have to really market to enterprises. We were marketing to developers, demonstrating all the features, especially with, you know, here’s the free sample.

Jon Gelsey: Use it for free for, I forget the number at the time, ten or twenty users or something like that. And here’s our extensibility, so we can handle corner cases. And, oh look, here’s the easy way to plug into any identity provider. They were advocating for us. And the way I like to describe it with, quote, PLG, is that it’s all about content marketing, meaning what you want is for Google to notice you, so you need lots of authentic, organic content. Part of your content is a super robust free sample, because really, most people are pretty cynical. So you want to show them that you’ve actually got a really robust product. A large sort of financial services and consulting firm came to us. We get a call to the corporate number, which I think was like a cell phone or something like that. And it’s like, Hey, this is so-and-so. We’ve been experimenting with your stuff and, you know, it might be useful in a project we have. But tell me more about Auth0.

Jon Gelsey: The internal IT department of this large, established, sophisticated financial services company had promised a new identity component appropriate for the guy who called us. And a couple of days before he called us, they said, Oh yeah, you know, things are great. We’re going to be a year late. Sorry, bye. And so he was telling us how he was, like, driving home that night and sort of thinking about how he’s going to hire a tiger team of really expensive consultants and share some way to do a recovery so he could still ship in four months. But then after dinner, he Googles for some reasonable terms, authenticate iOS Active Directory or something like that, and we show up at the top half of the page. So he goes and tries us, and we had written our quick starts and such so that in about ten minutes you could do something compelling. And so that’s when he exposed this to his team, and they’re like, Cool, but who the hell are these people? We’ve never heard of them.

Jon Gelsey: And that’s when he called us to figure out if we were going to be a reliable enterprise partner for his big launch with tens of thousands of people using it. I never would have gone after a conservative financial services firm like that. He found us. And he found us because of our content marketing, number one. And then two, when the content marketing led developers to try it out and say, Hey, is this going to be adequate for our needs? they self-qualified. And now the question wasn’t technology; it was, Can I trust the company? Are they going to be good partners? And that pattern was repeated over and over again. So again, we did not market to the large enterprises; they would come to us.

Riley Hughes: Yeah, that’s interesting. Maybe the better way to frame this would have been, like, Okta was pretty public about how they started. It was really like, Oh, people are moving to the cloud. Identity hasn’t done that yet. Maybe it’s a good idea to do identity meets cloud. And it sounds like what you’re saying is Auth0 did something along those lines, but more like identity meets abstraction layer and nice developer experience.

Jon Gelsey: I already had an way for identity to be cloud. And so it was SaaS applications were becoming popular in the enterprise. Okta came in, again, as an abstraction layer saying, Here’s your portal. Give me a little information about who you’re federating from, and we’ll make it all work. It’s just like click on the slider or whatever. And so Auth0 was that as well, except instead of our target being the IT people who were told, Hey, get this corporate credential working with Salesforce, our Trojan, who we would go after was the developer. Say, Oh, we’re just a developer tool. Make it easier for you to integrate identity into your application. I’d say it was fairly, it was reasonably similar to sort of an Okta approach, different people retargeted, different marketing, and that they were doing traditional enterprise marketing to the IT folks, and we were not doing traditional enterprise marketing because we were doing the PLG content marketing at the lower level. Which, again, if you have the right audience, it’s amenable to content marketing.

Jon Gelsey: That’s far more efficient, far more scalable, far less expensive, and gets you the same place in terms of growth.

Riley Hughes: One thing that I tend to see a lot in the identity space is a lot of better mousetraps, we’ll call them, right? A lot of different approaches that are new and better, fundamentally, you know, a new architecture for doing X, Y, or Z. These things are obviously harder to get adopted, but presumably if you can get them adopted and they really are 10x better, that’s a value proposition that’s strong enough. On the other hand, You need something that is, you know, adoptable. But if it’s so adoptable and incremental that it’s not really providing that much of a delta in terms of the value to the organization over the existing solutions, it may be harder to— have that grow fast. So how do you think about the innovation without being too far ahead of your time problem?

Jon Gelsey: So I, over the years, have developed the perspective that all technology that gets adopted is an incremental advance. It’s never revolutionary. I started my career as a supercomputer designer at a company called Convex Computer that HP acquired in the 90s. We were called the mini supercomputer, a really fast scientific computing machines for under a million bucks initially, and then under five million near the end. We ended up owning the market, but we had lots of competitors that all had super innovative ways that required changes in the source code. And we invested a lot in compilers that would automatically vectorize and parallelize to take advantage of our special-purpose processor that was much, much faster and not require any changes to your source code. And that turned out to be the winning approach, because all engineers are cynical. So the way that all new technology, all new innovations get adopted is always through an incremental approach, which is very accessible. And then because now that you’re invested in it, you start doing other things. Think about the iPhone, okay?

Jon Gelsey: First iPhone comes out. What was the innovation there? The innovation is that I put a dial pad and a cellular modem in an iPod, the music player. So there wasn’t, like, anything new to sell to people. It was like, well, it’s the same music player you’ve always had, but now you can make a phone call.

Riley Hughes: Yeah, that makes sense.

Jon Gelsey: Okay. Jobs didn’t even allow for an App Store, like, at day one, because he wanted a super controlled experience. In fact, the really big innovation was being able to have that really cool single-screen experience with a full-day battery life. And Apple engineers were super innovative, and they did this.

Riley Hughes: Okay. Yeah.

Jon Gelsey: Once I had that platform, now I can do things like an app store and GPS and, you know, all the other things that makes this so incredibly innovative compared to what we had 15 years ago.

Riley Hughes: Yeah. When you look at the reusable identity world and the next generation of where identity is going, obviously you can probably draw parallels to, you know, the kind of zero story here. But in the next iteration of where you see identity going, why do you think that the big guys like the Microsofts of the world won’t just do this, right? If it’s really a compelling value proposition, if it’s really the future, why won’t the big guys or the incumbents just go ahead and build this themselves and crush all the ants? And I think a lot of the, especially in reusable identity, a lot of people look at Apple and Google with the operating system monopolies that they have, or the oligopoly or duopoly, whatever, and think they’re just going to add verified identity into the Apple wallet and everybody’s going to be in trouble, right? How do you think about startups versus the incumbents there?

Jon Gelsey: This caused me some agony 20 years ago when I first became a venture capitalist. I didn’t tell Capital, and where regularly from our—they weren’t really VCs, they were Intel executives who were our committee. They were learning to be VCs at the same time as us. We’d say, Oh, look at this, like, cool new thing that’s like a complement to Windows, and they’d be like, Microsoft’s just going to add that to Windows and they’re going to crush them.

Riley Hughes: Yeah.

Jon Gelsey: And you’re like, I don’t think so. I mean, Microsoft hasn’t said anything about it. But then I went to Microsoft and I figured out what the response was, which was, so number one, yes, Microsoft, Google, Apple, more money than God, incredibly brilliant engineers, they can do whatever the hell they want. But they got so big and powerful by sticking to their knitting. They have products and a business model that works really well for them. Even for a frigging word processor, it’s a 45, 50 billion dollar annual revenue stream. They’re not going to do anything to jeopardize that revenue stream. So first off, to compete with you, they’ve got to free up the engineers, and that’s not going to happen for a while. And then secondly, they’re actually doing pretty good with like tens of billions of dollars of revenue from their existing product line. Why would they change anything in that product? What’s the compelling reason? And in fact, they kind of like to sit back and wait and see how the market evolves and then decide how they want to get this capability.

Jon Gelsey: Then finally, they prefer to buy a working capability that’s been battle-hardened and tested in the market as opposed to coming up with something themselves. It’s really hard to innovate inside of a large corporation because innovation usually isn’t rewarded. And so if you were to say, well, reusable identities, or self-sovereign identities, or any of these other really cool new features, they’re going to, Microsoft or Google, they’re going to wait to see that there’s really a demand for it, and then they’re going to decide who they’re going to buy to be able to get it. Oh, and by the way, the reason they would buy instead of developing themselves, from an absolute dollar perspective, it’s probably cheaper to develop it themselves. But if they develop it themselves, I mean, as software, I don’t care how smart your people are, it’s still at a minimum 18 months to do a production product of anything. Okay? You know, more likely a couple of years, three years to sort of get it right.

Jon Gelsey: With the Microsoft or Google or Apple distribution channels, where they can touch everybody, that’s billions of dollars a year that they’re losing because they don’t have the product. And that’s why big companies tend to acquire new technologies, new products, instead of develop them. Not always, and there’s always subtleties and such, because that way I get it now. I get your product that you’re making a hundred million dollars a year on because you’re the successful reusable identity broker, okay? And from your perspective as the startup entrepreneur, I mean, oh, a hundred million dollars. This is awesome. We’re doing great. And actually you are, because it’s really hard to do that. Microsoft or Google or Apple or Facebook buys you, puts you through their distribution channels, and they’re doing a billion dollars plus just in the first year. And so they spend, you know, half a billion dollars to buy you or something like that.

Jon Gelsey: And that’s still an awesome deal compared with building it themselves, because even though they could have built it themselves for, I’m going to make up a number, 20 million dollars, 15 million dollars, they lost so much revenue, it’s not worthwhile to do. So this is why, in general, not just for identity, but no startup should ever be worried about what Google or Microsoft or Apple is going to do. There’s always corner cases where they will come in and crush you, but it’s fairly rare. It just doesn’t align with the valuation optimization strategies that these big companies have.

Riley Hughes: I don’t know where I heard this, but somebody said in new markets or new technology, it’s always a race to see whether the startups can get distribution first or whether the incumbents can get to innovation first.

Jon Gelsey: So here’s an anecdote from Auth0 days. I wasn’t too worried about Ping or ForgeRock or even Okta. So then Amazon, or excuse me, AWS comes out with Cognito, and this is whatever, 2016, 2017. We’re like, shit, if it’s as easy as clicking a box in your AWS portal and, you know, it’s AWS priced, so it’s like really cheap and such, it’s like, oh shit. The feedback was, it’s like 80% of what you guys have. That AWS did something that was good enough but not great. And so it covered, from an AWS perspective, it covered the majority of the market, except that it really didn’t. It covered many of the use cases, but it wasn’t able to handle all the corner cases that made it truly appropriate for a real enterprise. We would repeatedly go up against them at enterprises that would then say, We like their price, but it’s not usable for our needs. We are a complex worldwide enterprise, and this thing just can’t handle it. So that’s another thing is your big companies will often do sort of a good but not great solution because they’re not really focused on it.

Riley Hughes: You kind of mentioned the notion of cannibalization, right? Without Microsoft isn’t going to cannibalize their Office revenue stream or whatever. I think reusable identity represents a potential for disruption or cannibalization for a handful of companies. These are the identity verification companies, the data aggregators, the bureaus, you know, and really any of these sort of single-use transactional verifications for companies. I’m curious, how would you advise a company that maybe sees reusable identity as a potential disruptor to their existing line of business and doesn’t want to cannibalize that line of business, but also really doesn’t want somebody else to cannibalize their existing business, right? And how would you advise them to think about that? Have you seen companies grapple with this question before?

Jon Gelsey: That’s kind of difficult because you’re dealing with a bunch of politics and conflicts of interest within that company. I’ve got a great business and I want to keep it going versus I see the innovation. I know I need to jump on the innovation bandwagon, but what’s the right timing for jumping? And companies generally screw it up because it’s pretty easy to convince yourself that you’ve got another year or three years or something like that before you have to move. And I think one of the reasons is that, say you’re the CEO, you’re the VP of engineering with the existing successful product, and you see the innovation. The thing is, you’ve got a bonus if you can do X, Y, Z before the end of the year. The company’s doing well. You don’t have to explain to Wall Street why you’re changing your product direction. And so there’s all sorts of pressures to say, it’s going to be fine for another year or two. We’ll be fine. And so you don’t change. And then suddenly it’s too late, and then you die. I don’t know.

Jon Gelsey: The large companies generally, they’re sophisticated enough so that they see the train coming. They see the light in the tunnel coming right at them. It’s really easy for them to convince themselves that they’ve got a little bit longer to wait.

Riley Hughes: It seems like a hard problem to solve because it’s true that you can probably put it off for a year up until you can’t, and it’s not going to disrupt you up until it does, right? And so how do you know when that moment is where you really can’t wait any longer?

Jon Gelsey: It’s really hard. This is how companies die. I think you have the visionary dictator who’s a little bit crazy, but hopefully crazy in the right way, who says, We’re going to do this. This is the way to go. You know, it’s Steve Jobs when he came back to Apple for the second time. He came in and he’s like, We’re simplifying. We’re doing this. We’re doing that. We’ve got a customer obsession. Screw the cost obsession that my previous CEOs had. And he very well could have been wrong. The only reason the board was willing to take a risk is because the company was probably, I don’t know, a year away from bankruptcy anyway. But I’m IBM and I see this threat, and I’m making my, whatever my IBM revenue, ten billion dollars a year. I really don’t want to screw with that ten billion dollars a year. I don’t want to replace whoever my CEO is who’s resistant to change with the rebel who might, like, totally destroy the company for innovation that might not pay off or the innovative new feature products that might not pay off for a decade.

Jon Gelsey: It’s just really hard, and there’s a lot of strong human psychology to not make that change, and then suddenly the train’s upon you.

Riley Hughes: So if you’re sitting on the board, or better yet sitting in the CEO seat of, I don’t know, a background check company, that every time a person goes to apply for a job or volunteer at the Boys and Girls Club or whatever, that, you know, they get this background check done and the background doesn’t change, but as a background check company, you just make money over and over, the same thing, the same check that you already did. And you see the writing on the wall. You see competitors coming in with reusable background checks. You see alternatives kind of floating in. You know, you’re sitting in this leadership position tactically, right? What do you do?

Jon Gelsey: Well, you panic, and then once you’ve got that out of your system, you focus. Let’s frame that as I am, I’m selling what’s maybe becoming a commodity, but it’s not really a commodity. How do you get defensibility for a, quote, commodity? Or let’s not call it a commodity. How do I get defensibility when I’ve got an advantage for a couple of years? The best way to get defensibility is to have perception by your customers of a high switching cost to abandon you and go to somebody else. If I have a word processor, all my employees know how to use, you know, Word. You know, maybe WordPerfect is better, you know, different or— it’s going to be ten dollars cheaper or whatever. But I’ll take a productivity hit and, okay, let me just stick with Word for one more year, and then I’ll change. Okay, but then I never do. My switching costs are too high. Another great moat, of course, is brand, where you have the safe brand. That’s the best kind of defensibility, because then the switching costs are almost sort of infinite for somebody to try and leave.

Jon Gelsey: And so, for what you’re offering, I would actually maybe use Twilio. Twilio is my analogy. You know, commodity. It’s an SMS. How much more commodity is there than something that there’s a billion of in a day, or whatever it was back when they started? They were more dependable, more reliable in actually getting the messages delivered. They were priced fairly, so it wasn’t really worth it to switch. The scale, as you are going to a million messages and then a billion and then ten billion as you grow your product line or whatever, I can keep up with you. You’re not going to have to, like, move to somebody else when we get big. So all of these things add to the switching cost calculation inside that company. And now maybe it’s a pricing thing where you make it really inexpensive to use you. I mean, when eBay started up, it was pretty inexpensive. It was pretty reasonable. You know, now they take 20% or something of your transaction, but they built to that over time. Initially there was, like, very little barrier to that.

Riley Hughes: Yeah. So I guess if I’m hearing you, if you’re in the seat of that background check company, you’re looking at ways to improve your defensibility, essentially. Is that—

Jon Gelsey: Correct.

Riley Hughes: How would you think about the calculus of potentially disrupting yourself, releasing your own reusable background check, even though it’s going to hit your revenue in the near term, it may be a bigger opportunity in the long run. You mentioned it may take the fearless borderline crazy founder archetype to pull something like that off. But if you’re sitting on the board of a company like this, you’re probably going to be banging the table saying, Hey, wake up, this is a big threat. What are you doing about it? What do you think companies should do about it if they’re in that position?

Jon Gelsey: If there’s a general consensus, especially with the sort of the board level, that, hey, your current business is great, but it’s obviously going to be declining over time. Your choice is either we manage the existing product line as best we can, sort of harvest the cash, and five years from now, basically wind down the company because, you know, we’ve made our $50 million or whatever, and that’s fine. Or you roll the dice and cannibalize yourself, obsolete yourself with a new offering, and hope that people pick that up. If you have the board behind you saying, Look, you know, great, that’s what you do. Why bother to have a $50 million company? All startups are hard, but it’s like, you know, starting a company and, you know, getting to five or ten million in revenue, there’s a lot of people who could do that. Is that as much fun as, I’m going to go for the gusto with a very plausible business plan that I’ve got lots of market data that shows me this is reasonable to be the billion-dollar company.

Jon Gelsey: If you are running a $10 million-a-year company or a billion-dollar-a-year company, you’re doing fine, better than 99%. It’s really, do you want to test yourself? Do you want to see if you can do it? It’s running the marathon instead of the half marathon or the 5K, especially if you sort of have some risk mitigations in there, so when you get to mile 10, you find you’ve run out of steam, you can still have a decent business.

Riley Hughes: I remember at some point, I think it was like Ben Horowitz or something. Somebody asked him, Why are you building Andreessen to be such a big, massive institution? And he was basically like, It’s equally as hard to build a 500-person VC firm as it is to build a five-person VC firm, right? The hard part is, like, doing it and getting out there. So as long as it’s going to be equivalently hard, why not swing for the fences?

Jon Gelsey: Yeah, exactly. I completely agree with. And you do it in a thoughtful way. I mean, you want to be careful not to be the insane, crazy CEO. You want to be the cunning, crazy CEO. When Andreessen and Horowitz were building the firm, they started with a five-person firm, and they did a couple of deals, and those deals worked out okay. And they’re like, Here’s some proof points that this works. This is going to allow us to go to LPs and raise the second fund. It’ll be larger. That’ll allow us to now be 50 people instead of five. Of course, we don’t really know it’s going to pay off at scale. We’ll see, but it feels good. With Auth0, we, by doing the PLG content marketing, have lots of free users and such. We were doing a lot of market testing about how popular and useful our features were, so we could get a fairly good view of the market sentiment as to whether we had something that was compelling or just, you know, that’s cool, but there’s a bunch of others like that. And that was really inexpensive because people could sign up, and we could automate watching their behavior and such.

Jon Gelsey: And so we knew all this was working well in an inexpensive way, a low-risk way.

Riley Hughes: Yeah. So I guess to close the loop on this, what I’m hearing is that if you’re in an executive role at one of these companies that fears this disruption, you would probably go out with a value prop to try to cannibalize yourself to the extent that is there, but you’d set up these milestones to where you can still exit at mile 10, so to speak, if it’s not working out as well, and that you would measure along the way, and you’d start small and incremental. And I think this is all really good tactical advice. I appreciate that. I’ve just got two more questions here that I would like to get to. I think, you know, our space, the space that I operate in and the listeners of this podcast, you know, I think fall into this category of the sort of career politicians of the identity world, right? They’re identity practitioners, and they’ve spent, you know, their lives working on digital identity and have a broad view of the history and where it’s going and a deep technical knowledge of how it all works.

Riley Hughes: And yet, when I look at a lot of the big successes in identity, you with Auth0, Todd with Okta, a lot of the big identity verification companies, Jumio, Onfido, whatever, right, these come from Essentially, not the people maybe who invented the specifications or the acronyms, right, the OIDCs and the SAMLs and the whatevers, but they come from almost outsiders that come in and commercialize really well. And I wonder if that’s just happens. happenstance or if you think that’s causal or how do you feel like you being an outsider, so to speak, to the identity industry. I know you had some knowledge from your previous role, but how did that impact Auth0? Do you think it had a relationship to your success?

Jon Gelsey: Yeah, I think it did. Let’s go back to Jobs as an analogy. Jobs, I think he was like a philosophy major. He didn’t understand how computers worked and such. And so he came at it with, I’m not trying to sell to a computer engineer, and therefore I’m not going to talk about megahertz and megabytes and all this other crap that compact or Dell or whatever was pitching. I’m going to sell to ordinary people with the value propositions that the ordinary people care about and therefore are willing to pay me more money than the computer engineer who might be more sophisticated and compare my megahertz to somebody else’s. In fact, I’m going to take the comparison points away from that quantitative to really emotional, okay? And if you think about, I won’t speak as much to Okta because I was watching them less in the early years, but if you look at Auth0, you know, one of the things I would say on a regular basis to the team is, our job is to make every touchpoint a prospector customer has with Auth0 a joyful experience. It is an aesthetic experience.

Jon Gelsey: Matias and Eugenio were fully sympathetic to that. It’s like, you’ve got to make this great. In fact, Matias, to his credit, the number five employee we had, and Matias found him, was Ricky Rausch, this awesome designer out of Buenos Aires. Actually, it was Guillermo Rausch who runs for his sales younger brother, because we wanted the UX of the portal, you know, and for that matter our website, everything to be pixel perfect, because that aesthetic experience of everything, like, looking and feeling great is something you can monetize. It’s indirect, but people look at that and it gives them more confidence and it makes them happier to use it because it’s a more logical and gratifying experience to use it. And again, this is sort of what Jobs did with PCs. He made it an aesthetically joyful experience, as opposed to, here’s a bucket of computer guts, figure it out. An outsider can see those value propositions that are maybe to the broader market better than the long-established practitioner.

Jon Gelsey: One of the problems with being a practitioner, you’re so deep into it that you convince yourself that other people should care about minor little feature over here. And it’s easy to fall into that trap. You know, that’s great having the outsider who actually doesn’t understand any of the details of the security implementation because they’re like, okay, I’m going to ignore that. What’s the benefit as opposed to the implementation details? You know, and is this benefit something that really makes sense to the person who’s ultimately going to be writing the check?

Riley Hughes: Cool. John, this has been an awesome conversation. I wanted to get into Xnor a little bit as well, but unfortunately, you know, we filled up a lot of time with great stuff. Maybe we’ll have to do this again someday. But I always like to ask people at the end of the podcast, what does the future of identity look like to you?

Jon Gelsey: It looks a lot like the history of identity. This is why the here’s a new way to do identity, those companies have typically not worked out very well because people don’t want that. They just sort of want what they have, and that seems to be working to work a little bit better. And we’re seeing great progress in terms of making life easier for secure authentication and authorization. We’ve seen the authenticator apps get better and easier to use and sort of more robust in terms of, you know, I lose my phone, I haven’t lost twoFA codes, et cetera. You know, YubiKeys have evolved over the years, and they’re easier to use. I think that, you know, Google and Apple are behind, and I guess everybody else is behind. Passkeys is awesome because that gives me the multi-factor authentication benefit with less friction. We’re making good progress in terms of More robust security being accessible in a low-friction way, because if you make security high friction, people will work around it.

Jon Gelsey: I think we’re going to see an incremental evolution of how identity is used to be either incrementally easier or transparently incrementally more secure. The path that Trinsic is on is making my verifiable identity reusable. That fits squarely into that path because it’s reducing my friction for using verifiable identity across multiple sites that are serviced by multiple verifiable identity vendors. I think it’s an awesome offering, and it fits squarely into the success pattern for new identity component providers that have been successful in the past.

Riley Hughes: Awesome. Well, I appreciate the plug there. I know you’ve got to run, but do you have anything to plug? Is there anything that you’re working on you’d like people to know about, or if anybody wants to get in touch, how should they do that?

Jon Gelsey: No, nothing really to plug, to tell you the truth. I’m enjoying my downtime after we sold Xnor to Apple, I guess getting close to four years now, doing a bunch of hacking and hobby projects, you know, helping out companies with advising and such. And so I have nothing to sell right now. We’ll see if that changes over time, in which case I’ll heartily plug something. But right now, it’s really just I’m enjoying being a technical explorer.

Riley Hughes: Yeah, well, I do appreciate the plug for Trinsic and appreciate you coming on and sharing your thoughts with us.

Jon Gelsey: Well, it’s always fun to talk about really awesome new technologies can make a big difference, and that’s what I think Trinsic is doing now. And if we were on other areas, I talk about other companies I’m working with that have the potential to change the world.

Riley Hughes: Yeah, yeah, exactly. Thanks so much for listening. If you enjoyed this content, please share it with others who will benefit from it. I’ve been getting a lot of great feedback on the podcast, and since we don’t do a lot of self-promotion or ads or whatever, spreading the word really is the best way to signal to us that the content is valuable and that we should keep doing it. You can find us on YouTube, Apple, Spotify, and wherever else you listen to podcasts. Feel free to reach out to me directly on LinkedIn or X, at Riley P. Hughes, and visit Trinsic if you’re interested in building the future of identity. And you can visit trinsic.id slash podcast to subscribe to the Future of Identity newsletter, where we’ll share the essential reusable identity news that we’re enjoying straight to your inbox. Thanks a lot.