Let's talk about JumpCloud and specifically where you sit in that world. Give us the 10,000-foot view. What exactly is your business, what do you do and where do you focus?

Let me satiate that first. We are an open directory platform. Specifically, we focused on identity and access management controls with a heavy dose of IP of integrating identities, consider it the IAM market, with the UEM or device management market. Quite literally, we can't see the separation of those categories. We'll talk more about this in a bit, but if you look broadly at the platform we've developed, it highly focuses on the intersection of those technology worlds. It's, again, identity and device.

To date, the business, we're a decade old. We put the shingle on the door in late 2013, early 2014. I'm the co-founder and CTO. My CEO and other co-founder is Rajat Bhargava. Rewind the clock 10 years ago, or roughly, let's say, mid to late 2013, when I started talking with Raj. The thesis came up, which was: how can we, or a company, whether it's us or someone else, deliver to the world an alternative to Microsoft's stalwart product, Active Directory? That literally was the written thesis of what we wanted to go and solve for.

And basically focusing on this concept of freedom, where Microsoft clearly is a key component to the Microsoft heterogeneic stack. So Windows servers, applications that surround and get fed by the access control of domain controllers. We wanted to show the world that there's probably a better, more efficient, more secure way to do that. And guess what? It can be done credibly and responsibly from the cloud. That literally was the thesis. Before lines of code were written and deployed, we hand wrote that thesis.

Think of that as chapter one of the story of JumpCloud. Chapter two of a two-chapter book was, how do we GTM this thing? We knew in the earliest days of the business, even before we pulled the curtain up on it, that to build a product that could replace Active Directory, giving it credibility, it's a very difficult thing to do. For anyone listening that has any knowledge or hands-on experience with AD, people generally don't want to touch it until they're forced to touch it.

The other point is, could a company with a nascent sales force make a phone call into an organization and literally say the words, "Why don't you think about replacing AD and take a shot on a company you've never heard of? Are you in? Can we do this?" That was never going to work. So prior to companies using the term PLG or product-led growth, Raj and I put a lot of emphasis on what that model is known as now, PLG. We literally made the world see JumpCloud hands-on. We didn't hide the product. There are now 200,000 organizations that use this product every day or have signed up and are using it. We had a freeware distribution approach, getting this concept of a cloud-born and cloud-used directory in as many people's hands as we possibly could.

That's how literally the business was bootstrapped. Now it's nearly a half a billion dollars in capital raised. We're an incredibly efficient business generating substantial revenue, about 800 employees, 100% remote around the world. That's the state of the state.

PLG is not a very easy motion to pull off in identity access and cybersecurity more broadly, because people are very nervous about it. It's not the same thing as swiping your card on a productivity tool and seeing if it works out for you. Walk us through where the product sits and where you spike. How exactly are people trying it? Are you mostly targeting smaller companies, hoping to grow with them, or are larger companies giving this a shot?

Let me cover the last part first, which is an easy one. We focus on the small to medium enterprise, so think of that as companies roughly 5,000 employees and below. It is an unbelievably target-rich environment, which largely has been ignored in many ways due to the prototypical approach of building enterprise-focused products. The mid-market basically had Google Workspace and its nascent capabilities of identity and some lightweight device management and single sign-on services. That's what they get. Maybe occasionally you see an Okta in this market. We do see Microsoft technologies. But largely there's nothing that has been in that market to provide unified access control for all these disparate heterogeneic resources. So mid-market is your answer, and we're thriving there.

Let me talk about the depth of platform and product that we've built. Think of JumpCloud as an integrated set of what you and maybe the market would know as categories. By the way, this is all bespoke, our own proprietary sets of technology distributed around our global cloud infrastructure.

At the center of JumpCloud is a directory. It's our own form of a directory, highly scalable. We built our own graph engine that makes it infinitely scalable in terms of the types of things we would like to store within the directory. Think of that as the centerpiece. Then all the services that surround this directory include all of the authentication protocols that, frankly, satiate the need for most, if not all, resources.

Anything web-based will use a token-based approach or an assertion-based approach. So SAML and OIDC are all baked into the platform. Think of that as your prototypical single sign-on capabilities that you'd find in other point solutions, like an Okta as an example. We have RADIUS services, so authenticating networks, VPNs. That's a big chunk of the service. You have LDAP, which many people still use. By the way, just because we are cloud-born doesn't mean the only things we can authenticate and govern access to are cloud-born. People have printers on-premise. They have NAS, network-attached storage. They literally have servers that exist on-premise. So LDAP is a wonderful protocol for that when done right and secured properly, like we do.

The last component of this is device. Device in our world could be the laptop you're talking on, a handheld like Android or iOS, or servers of various types like Windows servers and Linux servers. So device in our world is a broad set of those things across Mac, Windows, Linux, iOS, Android, et cetera. That has its own very special authentication approach, which is an agent that we've designed, highly robust, super secure, but it satisfies a lot of the governing of the device that is really integral to our platform.

Our philosophy is that identity and access control is really most critically done through the device that you're speaking on. Clearly, that's sort of a no-duh statement. In order to get access to Salesforce or Amazon or Google, you're sitting in front of a computer, probably either a browser or a terminal, but it's that device that is acting as the gateway to those resources. So a lot of our IP and the way we architected the platform is driven by the association of the world of identity and that device, mixing those categories so that we have a highly secure way of adding and controlling the identity on the device and understanding its local environment. Our agent using variants, osquery, which people largely understand now, that's one component. We're streaming data off the device so we can posture it. And then all of the configuration of the device, so we as the provider know it's secure. So think MDM in that way, which we do across Windows, Mac, Linux, et cetera.

When you look broadly at the platform we've created, we by intention added these components, which are normally disparate tools or products that are purchased and then subsequently integrated. We feel that's unnecessary. The SME doesn't want to manage a dump truck load of tools and all the negotiation to buy those tools, all the security reviews for those tools, all the integration of those tools. IT dudes, they just want to provide access. They shouldn't be in the business of tool wrangling. So the platform was designed to satisfy that from purely an access control perspective. That's what the JumpCloud platform is if we lift up its hood.

It feels like the combination of your product surface area, both managing identities and thinking about devices, and your entry point with small to mid-sized companies is the perfect combination. You're able to get in before they've established a lot of these systems and before they have the sprawl of a really complex network. If you can get in early and grow with them, you have that ground zero coverage. Is that how you've thought about it, or are you getting into massive companies that already have AD from Microsoft and a massive network?

If we were having this conversation three or four years ago, let's say pre-COVID, we were surfing the SME. We come in, it's a pristine set of IT in that there's no Active Directory. All these companies get to a point where they need more sophisticated access control. They've pushed Google Workspace to its limits, or M365. They're like, "All right, we've got to actually do it better." And that's where JumpCloud has thrived.

Now, COVID hits. Domain controllers were in that moment put under the spotlight and largely broke the back of IT, just in terms of VPNs breaking when they pushed everybody back to their home offices, largely on fleets of Windows machines. It was an extraordinarily brittle moment for them. So many of these companies, which were larger, decided, "Well, shoot, this is our moment to advance our cause of modernizing our IT stack. What do we want to do here?"

What we heard and where we benefited from was, "We did the AD thing. It got us to a point, because we're all used to AD, but it got us to a point where we've discovered it is unusable for two reasons." One, the remote deployment now. Many of these companies are not coming back to the office. They've decided to stick with the thesis of remote operations. And two, to actually implement a heterogeneic stack of different solutions and non-Microsoft, which many of them are pursuing. That was the moment. That is really what created a huge inflection point for JumpCloud. We were cruising at a good clip, but it was that class of customer. Think of them as the higher end of the SME.

By the way, we saw this everywhere. It wasn't just a US problem. Truthfully, we saw a lot of this out of Southeast Asia, which for decades has been a vestige of strong Microsoft distribution through VAR and channel. A lot of these companies had wake-up calls in how they want to run their stack. So Google is thriving there in many ways, and we ended up benefiting from that as well.

Bring us up to speed on the status quo. In the piece, we talk about the evolution from Novell in the early '90s, effectively having a file-sharing system, to Microsoft's directory being the first database approach. Microsoft Active Directory has a very significant install base, and they've tried to make some changes with things like Azure AD. From your seat, how has Microsoft evolved over time, and how well positioned do you think they are for the future?

Microsoft can speak for Microsoft, so these are my opinions. I think in large part, the hope of having a completely cloud-born directory service, assuming that that eventually will be what Entra will become, has largely disappointed their customer base. There's still too much predication on the domain controller, its leveraging of GPOs, how Windows endpoints largely are managed still through that vehicle versus how CSPs and other things in Intune. There's too much conflict in that.

So I think from an opinion standpoint, they have a lot of work to do. They've extended the Active Directory roadmap out through 2026, where it was sort of hard stopped as of actually this year. So I think they have a number of years in front of them in order to achieve the dream of a fully cloud-born variant where domain controllers are minimized.

Now, this said, here's the opinion part. Why are they motivated to do that? Obviously, there's a phenomenal business in Windows Server. There isn't much incentive for them to evolve away from that depth and need in integrating forests of domain controllers, which are really just aspects of a Windows Server. Now, could security be a major forcing function for them? Well, certainly the world sees it that way, just in terms of the lateral exploits that happen when bad actors can and do threaten the internals of a domain-controlled network. I think those are massive wake-up calls. But I'm going to let them speak to their security posture and their stance on that.

We see the world totally differently. You shouldn't have to laterally build Windows servers to scale and grow an access control approach for your business. It just blows my mind that there are companies that just have to. They cannot get off of that. Go to any of the major banks, any of the major manufacturing companies that have been around 30, 40 years, and their whole IT stack was built on that foundation of Microsoft. And that's cool. Microsoft can have that.

The way we look at the world is, every day, the next generation of enterprises is being born. I just got back from a trip to India, where we have hundreds of our own employees now across a broad spectrum of roles, not just engineering, but sales, finance, legal. I visited with two of the 15 unicorns that we actually support from an access control and directory service standpoint. These people do not speak Microsoft. They have no intention of it, other than the high likelihood of having a Windows endpoint, which we see largely in legal, finance and marketing, whereas engineering are typically using Ubuntu or Mint, like Linux laptops, and macOS across the broad spectrum of other employees. These companies don't look like the way Microsoft introduced domain controllers in 1999, 2000 with Windows Server 2000. It's just different.

So that's a long-winded way of saying it's on Microsoft that they want to figure out how to provide flexibility and freedom across resources and do it all from the cloud. I think they got a lot of work to do in that regard. And again, if you're them, how incentivized are you to do that?

Help me understand the best framework to segment the market. The simplest way to think about it is the age and the size of the company. Some companies haven't been around as long and have scaled really quickly. Some manufacturing operations are not massive, but they've been around for 70 years and they're going to be Microsoft through and through. Is there a better framework? When you think about the folks who don't speak Microsoft and are really interested in your solution, what is the ideal customer profile? What's the DNA of that business?

That's a great question. First of all, the way companies are born now, and let's categorize them. Obviously, there are tons of different types of businesses. There are still people that manufacture hard goods, so they are constrained by having tooling and machinery and all that kind of stuff. But the ICP that really come flooding into JumpCloud are digitally native, highly progressive, tech-focused companies, of which there are millions that are born every day, that are being injected with venture capital, that are scaling and growing. Many of these companies generate billions and millions of dollars in revenue, but they're 1,000 employees, 2,000 employees.

When you look optically at what the enterprise looked like, if you weren't 100,000 employees, then what are you really? The people complement part of that calculus isn't quite what's looked at anymore. It's the progressivity. It's the net proceeds that you can make and how efficiently you make that revenue. That's why SaaS and these types of progressive tech companies are very interested in solutions like JumpCloud.

Second point, these companies are highly volatile in their resource selection. We see this now over a decade of witnessing how modern companies build and grow over time. Typically, we see that many key resources, and by that, typically a collaboration suite, we'll just say the Coke and the Pepsi, Microsoft M365 or Google, that is volatile. Number two, we see CRM. Number three, we see cloud. These are not in stack-rank priority. And number four, HR systems. There's a smattering of other, call it non-critical, tooling that supplements workflow. But if you look at that set of products beyond operating systems and what people tap on keyboards, that section of tooling is highly volatile.

Companies that are a couple of years old may have chosen Google Workspace, as one example. Let's assume they're doing legal tech. Comes to pass that you actually need a more advanced Microsoft-based collaboration suite in the legal world than you do with Google. There are actually even regulations that require .doc and similar Microsoft-born file types. So guess what? A hundred employees in, they got to do a big switch of the collaboration suite. When you go through HR systems, or going from one cloud to the other, or going multi-cloud, you have a mess on your hands.

The mess is typically when you have an identity provider that is beholden to basically their own kind. Microsoft is a good example of that. Even with protocols as part of the platform, it caters to and favors its own stack. It's just built by design. I don't blame them. But in our world, the one thing that these IT and SecOps people don't want to change is the identity. Think of it as the structure of an identity, what they have access to and their entitlements.

So that has become, call it the hood ornament of JumpCloud, the fact that it creates this very stable, neutral way of always having an understanding of the identity and swapping at any given time the types of resources that you'll have to lay on top of it. Today, it's Google. Tomorrow, it's M365. Today, you started on Azure to build your SaaS product. In two years, you've made a wholesale switch to Amazon because you're more incentivized to go in that direction. This stuff really happens in volatile scaling companies that are digitally native.

You touched on a lot of the ingredients of how this problem set is changing. Historically, it was very clear: there was a specific identity with a very specific set of rules. As you get outside of role-based access control, there's an element of relationships, and you talked about entitlements as another piece of it. There's the increasing importance of cloud, so understanding specific services and jobs to be done. And there's an increasing set of agents doing specific jobs in the environment. How do you think about what the first-class citizen is, what the context around it is and how to control things when they're changing very rapidly?

Beautiful question. First and foremost, entitlements are where it's at. There are classes of new software vendors in the security space doing continuous evaluation, all this kind of cool stuff. Hint, hint, that's definitely part of our purview too. But at its inner core, it's the identity. When we say entitlements, it's, generally speaking, when an identity goes through the process of being authenticated into something, what can that identity do once it's in there?

We'll start with that premise. Each of these protocols has a different vehicle for that. RADIUS uses VLAN. LDAP uses memberOf. SAML uses assertions with attributes. OIDC has different decorations on its token. They're all different flavors. So we have abstracted that, and we had to do the hard work to translate to each of those protocols how the entitlements are interpreted.

Second point is the world is moving at a rapid clip, thank God, away from group hierarchy as a way to think about the management of entitlements and propagated roles, into ABAC. Thank God. This is an interesting thing. I don't know how old you are. I'm an old fart now, I'm in my 50s. Even our engineering team, they have no idea what group hierarchy is. We understand the general basics of membership, but the way they are building applications has no relevance to that old-school world. So it is about the manipulation and understanding of how an identity is decorated with its attributes and how that carries across to the different authentication vehicles.

So I'm riffing a bit, but I want you to understand how we really think about that. The hard work is, remember back a few minutes ago when we were talking about the breadth of the platform? We have to have complete coverage across every single one of those authentication protocols and the local environment on the device, which brings me to the other point of agents.

You're right. Everybody's got an agent. We've got an agent. As we see the world, the more that agent technology on devices is critical for access control. The reason for this is, again, our assertion is identity and device are inseparable. The device is the gateway to accessing resources. You, by God, better know everything about that environment, both on device and utilizing data as it's traversing networks. We're a network authentication party, so we have to know all that stuff, so we really know the transaction is sound between that device and wherever the resource is, in space, on premise, whatever.

In terms of the agents that exist, is JumpCloud an EDR? Like CrowdStrike or SentinelOne have agents? No, that market's covered. So we have to now move into this world that I'm certain you're familiar with, the Shared Signals Framework world, in order to take our data and share it with other parties that would find it interesting, so that, guess what, they can share it back with us so we can control and limit access to resources. I just want to make sure you hear from my mouth to your ears the broad spectrum of how we're thinking about it and how we, not thinking, but actually implement our solution.

You're in a unique position, seeing a lot of these companies as they scale up. As they scale, they run into fringe cases that introduce new policies and new ways of thinking about things, as opposed to legacy systems whose businesses haven't changed drastically in sometimes decades. Looking forward, what are you most thinking about? A lot of people are thinking about the implications of AI, both in the way it can circumvent identity and try to break in, and on the agent side, like writing policies or automating in a way that leaves people open to problems. What is on the horizon from your perspective?

Let me couch this in two camps. One is the trajectory of where you and your audience can anticipate JumpCloud's platform growth to move into. The other is the impact to and benefit of how this approach will help our constituency, which is IT and SecOps.

On the first part, now you understand JumpCloud's platform largely has had this big set of services surrounding IAM, the whole world of identity and authentication protocols. The other side was the device management or UEM world, and we're smushing those worlds together. In the spirit of smushing more, what our customers are asking us for at a rapid clip is, "Cool, we get that. We need you because you are the access control party. We need you to tell us more about those assets." I'm going to use the word asset very, very broadly. I'm not talking about the old-school world of ITSM, or asset management that is largely just slightly better than a spreadsheet.

They really want to know utilization. They really want to know, is everybody in a least-privileged posture? They really want to know, is the budget for a specific app that we are gating people to and from over- or underutilized? How can they reclaim licenses for budgetary reasons? And furthermore, "How can you tell us, JumpCloud, what we don't know about in our world?" What application services, things that should be governed, maybe in the realm of shadow IT, not nefarious, but maybe departmentally, that isn't under the purview of IT and SecOps? How do you tell us what's out there?

The technology and the way the platform works are already sitting on those signals. We just haven't productized that in a way to present it back to the IT and security operations teams to say, "Here's what you needed to know. This is what JumpCloud has been involved with doing the authentication. Who's in what? How long have they been in there? What entitlements did they walk in, into the service?" We have that now. Now it's just about exploiting the types of data. So think of JumpCloud as broadly and rapidly expanding in those areas.

The other side is impact to our constituency. How do we do all this in a way where IT actually performs less function in mouse clicks inside of our administrative console and the mouse wheels, meaning the automation and, call it, the interpretation of data. I'm not even going to, watch me, I'm not even going to use the word AI right now, but assume that we are doing a huge amount of machine learning on the type of data, requests coming in, authentication going out. How can we do more with that so that IT admins have less ticket management, and the quote robots inside of JumpCloud are performing those tasks, so that IT guys and gals can go and do more strategic things other than responding to a ticket: give me access or change access or whatever. That's what JumpCloud is good at. We just need to exploit and learn that data so that we create more of an autonomous behavior inside of the platform.

That brings up the types of businesses that maybe don't make as much sense for you to work with, whether that's a specific feature set, a specific scale or willingness to be all-inclusive. A lot of folks are hesitant to manage multiple steps in their process with one vendor. To inform how you think about the market, who is not as good of a fit?

We touched upon this class of customer before. It's hyper-legacy. It's large companies that have been around, that are global in nature and very, very dependent upon the Microsoft stack. A lot of them are not incentivized to move off. By the way, Microsoft makes that extremely lucrative through license maneuvering through E3, E5, creating an environment that is very difficult for a company to leave and very difficult for other vendors to actually have a shot on goal for that share of wallet. So it is a real thing. That class of Microsoft-controlled environment is not a good fit for us.

But guess what? There are millions of other companies outside of that, in generally two camps. One, we've already asserted: small to medium enterprises that are digitally native, cloud-born and look and feel a lot like JumpCloud, which is a highly diverse set of resources. JumpCloud, as an example, uses Google Workspace and M365 at the same time. We have multi-cloud architectures. We've got so much SaaS. Our customers look a lot like that. From a scaling perspective, this ranges from a few hundred employees upwards of 30 to 40,000 employees in some of our larger customers. So scale isn't the issue. How they want to behave is really the gating factor of the adoption of JumpCloud.

The other side is this incredible world of managed service providers. My God, the last two years. MSPs are not a new fad. They've been around for time ad infinitum, largely built upon the implementation of Microsoft technologies. Anyone who is an IT guy with an MCSE, newly minted certification, and they have any entrepreneurial bone in their body: let's go and we're going to put a shingle on a door and we're going to be an IT MSP and serve our local region, and we can implement Windows machines and get them set up on M365 and all that kind of stuff.

Guess what? These MSPs and a new class of MSPs don't look like that. That's not the business they're building. They are looking for highly diverse sets of resources that they can resell and manage. Be it Google, be it Microsoft, be it CrowdStrike because they want to get some security stuff in there, MDM providers like JumpCloud and others. They want to be like us. They want to be like SaaS companies, where they're not break-fix models anymore, like, "Ooh, your computer broke," or on a ticket-by-ticket basis, you will pay me for my service. What they want is predictable revenue streams.

They will sell a dentist's office, a doctor's office, a legal firm, an architecture firm that don't want to hire IT folks an endpoint security package with identity control. It's $29.99 a month per user, and it basically unpacks a bunch of solutions that they are reselling. The client gets what they need. The MSP wins because they can pick and choose the resources. They are building these solutions now that come in packages. So it's a really dynamic market, and we're benefiting from it.

That's one of the reasons I ask, because the companies that aren't as good of a fit also reveal who's asking the right questions about how things are changing. In our report, we touched on what the future looks like and who is most future-proofed. User expectations are changing whether or not you're changing your systems and processes. Recent reports say four out of every five breaches started with some identity issue, and you're sitting at that point of effectively printing the keys. What are the things people aren't appreciating? How is the environment going to change in a way that catches a lot of people off guard, and how do they make themselves more future-proofed?

A lot of what you're describing is not distant future stuff. It's now. These are the set of questions being posed inwardly to IT teams and security teams. The CIO is charging their teams with thinking about how to not get trapped. I use the term future-proofing as well. Said differently, it's less the Henry Ford model of the CIO saying, "You can have any resource you want as long as it's Microsoft." Now it's like, "We have got to be agile. We have cost controls that we need to think about. We've got to think about the way our business is operationally evolving from offices to hybrid," which is a real thing. As much as you read in the trade rags that the big companies are trying to get their people back in the office, guess what? I can show you 10,000 other companies who are our customers that aren't.

So the future-proofing aspect is real. Generally speaking, the most progressive leaders in IT, I'll just use CIO loosely, but that family of people making decisions, they refuse to get beholden to singular stacks that control the gamut. So I think enterprises are attempting to tear pages out of the SME playbook, which is more progressivity baked into their planning and modeling, and it comes down to resource allocation. It's just hard for them to get there.

I think you've heard the term, like everybody has, the world of digital transformation. I don't know who made it up, but it's a fancy way of saying, how do these old-school companies get more cloud-born and cloud-ready? I think in many ways, that period is coming to its close. That doesn't mean a lot of people aren't still on a journey, but the playbook of how to get there is printed.

The new world, and here's where really the inner fire of your question comes in, is this. We're at the dawn, the first inning, of the identity transformation, in large part decoupling old-school technologies like on-premise Active Directories, along with it, the security implications, and transforming the identity approach into a more progressive, typically using modern authentication standards. That is what really now is being poked at.

And one final point that you're making: yeah, we do sit at the intersection of the identity of the device. You're doing millions and millions of authentications a day. Modern authentication is real. Getting people away from bad token management, and by that, I mean the ability for tokens to get exfiltrated off machines and then replayed in session attacks, it's like, that was so 2021. We have to evolve fast into hardware-backed tokens, which we do. Others are still lagging behind. So we are hyper-securing those organizations.

And why? Because if we, as a community of cloud-focused identity providers, are not doing that, we're basically propagating the myth, then what good are you guys? You're just as bad as old-school Active Directory if you can't secure tokens or other methods of authentication. What makes you different? That is what we hear continuously from, just call it our prospect base, people who haven't engaged with us and aren't billing with us, but they're very curious about how to get away from this old-school set of approaches.

Let's wrap up on a two-part question. First, the cautionary tale. What are the biggest risks for you? The obvious one is the centrality of your position, which is very exciting for folks who want to break into these networks, so there's a general target on your back. In general, what are the biggest obstacles you're keeping a very close eye on?

It's real. Anyone in our space is a target, and it just comes with the job. We have to provide the trust to our customers that your authentication is safe with us. That comes with a huge amount of investment in security operations and all the things. But moving us aside, when you're really talking about, is it smart to have one place to manage and govern access control and all the authentication and authorization that goes behind it? That philosophy is one camp. Or do I diversify, and our machine authentication is done one way, our networking is done another way, cloud has its own set of token or other secrets used to access cloud?

So there are two camps, and we definitely aren't a fit for everybody. There are many very paranoid, and rightfully so, I'm not using that as a derogatory term, paranoid folks that are like, "I'm not going to put all my eggs in one basket. I'm going to diversify it." Guess what? There's a lot of risk there too, just in terms of the inability to control or revoke access or deprovision when somebody is off-boarded. There are pros and cons in either of those camps.

The future, though, to put a bow on this, is getting the world familiar and comfortable with the cloud as a safe place to transact authentication and access control. It's a tough road to hoe because of the history of people who are just so patterned in thinking, "I know how to control my domain-controlled environment. As long as I have my hands on these servers, I'm good." Continuing to strip away that myth, I think, is not just the total responsibility of JumpCloud, but of anyone who's playing in a cloud-born authentication space. You know who all the vendors are. Some of them are better than others. Some don't have awesome transparency in some of the security issues that have happened. It's not doing this community many favors.

So we have to get the world comfortable. That comes at, make sure we're credible, and that comes at a lot of hard work businesses need to build their brands. JumpCloud is absolutely still in brand-build mode. We're 10 years old, but you can see how foundational this stuff is, just in terms of the broad exposure and trust that it takes, even with 200,000 organizations that have signed up and used this thing around the globe. It's a hugely responsible place to be inside of a company.

That's a really good framework for playing defense. Even though you have to take an active role in changing minds, that's how you protect your core position in this market. The other component is how you play offense, opportunistically chasing things that grow your business and make your customers even more secure. What are the biggest opportunities? What are the biggest tailwinds for your business right now?

It's absolutely freedom. That's a big abstract word. We touched upon this a little during our conversation, but let me get very pointed and concise here. Businesses refuse to be beholden to some singular vendor. When I say businesses, I mean our ICP: mid-market, SME, again, 5,000 employees and below. Very progressive thinkers in that way.

The tailwinds assisting us absolutely relate to that, and to providing the flexibility for an organization to, number one, have its user base understood from an identity perspective and secured. Number two, making sure that operationally, they can work in any environment, either in a building, on a plane, on a beach, either fully remote or some blend in between. Those tailwinds are real.

The final point is making sure people understand that identity is an interesting space, but this is in large part about the devices and what is the device's role in access control, and providing that level of flexibility in how businesses want to operate. Those are our tailwinds. That's why the business is growing, because of those philosophies that modern companies want, and we're benefiting from that.