Why the most important conversation in cybersecurity isn't about technology, but about the people and possibilities it protects.
In 1997, Steve Jobs returned to a struggling Apple and delivered a message that had surprisingly little to do with computers.
He wasn't there to explain why Apple's processors were faster, why its operating system was better, or why customers should abandon Windows.
He wanted to talk about something more fundamental.
What did Apple stand for?
Jobs understood that people weren't going to develop an emotional connection with megahertz, processing speeds, or technical specifications. Those things mattered, certainly. But they weren't the reason people would believe in Apple.
He pointed to Nike as an example. Nike sold shoes, but its most memorable advertising wasn't about rubber soles or cushioning technology. It celebrated athletes, determination, and human achievement.
The product was important. But the meaning behind it was what people remembered.
That philosophy helped shape Apple's legendary Think Different campaign.
Nearly three decades later, I believe there's an important lesson here for cybersecurity.
And it's one our industry has been remarkably slow to embrace.
We've Become Very Good at Explaining Technology
Spend enough time at a cybersecurity conference and you'll hear an impressive vocabulary.
Multifactor authentication. Passwordless authentication. Passkeys. Biometrics. Zero Trust. Identity and Access Management. Behavioral analytics. Continuous authentication.
You'll hear about protocols, architectures, integrations, encryption, compliance frameworks, and increasingly sophisticated artificial intelligence.
These technologies are important. Some are indispensable.
But I wonder how often we stop to ask a more fundamental question.
What does any of this mean to the person whose life or work we're trying to protect?
A hospital nurse doesn't begin her shift thinking about authentication protocols.
She wants to access a patient's records quickly, administer the right medication, and get back to caring for people.
A bank customer doesn't open a mobile application hoping to experience an elegant identity-management architecture.
She wants to know her money is safe and that transferring funds won't become an exercise in frustration.
A business owner doesn't wake up excited about implementing another security control.
He wants his employees to work productively, his customers to transact confidently, and his business to operate without unnecessary disruption.
And a patient in a rural community, perhaps without conventional identification documents, isn't concerned with the technical sophistication of the system recognizing her.
She wants access to care.
These are the outcomes that matter.
Yet our industry too often begins the conversation with the technology instead of the human need.
Security Is Not the Destination
I have spent much of my professional life working in cybersecurity, identity, authentication, and technologies designed to establish trust.
And over the years, I've become increasingly convinced of something.
People don't want more security procedures. They want the confidence to live and work without constantly worrying about security.
There's an important difference.
We sometimes talk about cybersecurity as though the ultimate objective were to deploy more controls, add more verification steps, or create increasingly elaborate defenses.
But security is not the destination.
It is what allows people and organizations to move toward their destinations with confidence.
Consider a healthcare professional who must repeatedly interrupt patient care to authenticate into different systems.
If we can establish that professional's identity securely while reducing unnecessary interruptions, the benefit isn't merely a faster login.
It's more time for patients.
Consider a customer who abandons an online transaction because the authentication process is confusing or cumbersome.
If we can preserve strong security while making that experience simpler, the benefit isn't merely a more efficient authentication process.
It's a customer who can complete a legitimate transaction with confidence.
Or consider an organization facing increasingly sophisticated attempts to impersonate employees, executives, and trusted partners.
The objective isn't simply to identify more suspicious activity.
It's to make legitimate interactions trustworthy and fraudulent ones extraordinarily difficult to carry out.
Technology should quietly serve humanity, not continually demand humanity's attention.
That, to me, is the more meaningful promise of digital identity.
The Age of AI Makes This Conversation More Urgent
Artificial intelligence is making this distinction more consequential.
For years, our industry focused heavily on determining whether the person logging into a system was who they claimed to be.
That remains essential.
But AI introduces a more complicated reality.
Increasingly, software agents will interact with business systems, access information, modify records, initiate transactions, and make recommendations on behalf of people and organizations.
Some will operate with considerable autonomy.
Imagine an AI agent working inside a financial institution.
The agent is legitimate. Its identity has been established. It has been properly deployed by the organization.
Now imagine it attempts to change a customer's payment instructions.
Does the fact that the agent is legitimate mean it has the authority to make that change?
Of course not.
And if a human approves the action, how do we establish that the approver is genuine, has the necessary authority, and understands exactly what is being approved?
These are not merely technical questions.
They are questions about accountability, responsibility, and trust.
Identity is not authority. Authentication is not authorization. And authorization is not permanent trust.
As AI agents assume greater responsibility, organizations will need to establish not only who or what is acting, but whether a particular action is permitted, appropriately approved, and consistent with the authority granted.
That requires a broader approach to digital trust.
One that considers identity, intent, authority, verification, and continuous evaluation.
And one that never loses sight of the human beings ultimately affected by those decisions.
The Best Technology Is Often the Technology People Barely Notice
Think about some of the most successful technologies in everyday life.
We don't celebrate electricity because we understand the engineering behind the power grid.
We appreciate what electricity makes possible.
We don't board an airplane because we're fascinated by avionics.
We want to reach someone or somewhere that matters to us.
And most people don't choose a digital service because they admire its authentication architecture.
They choose it because it helps them accomplish something important.
When security works well, people should experience confidence rather than complexity.
That doesn't mean eliminating necessary safeguards. Nor does it mean pretending that every security decision can be made invisible.
Some transactions are consequential enough to require deliberate human verification and approval.
But those moments should be purposeful, understandable, and proportionate to the risk.
The objective should never be frictionless security at any cost.
It should be the least unnecessary friction consistent with the trust the situation requires.
This is particularly important as we introduce AI into increasingly sensitive workflows.
The person approving a transaction should understand what is being approved. The organization should be able to establish who authorized it. And the system should enforce the limits of that authorization.
Good security shouldn't merely ask people to click another button.
It should help them make informed decisions at the moments that matter.
From Product Features to Business Value
There's another lesson in Steve Jobs's message that deserves attention, particularly for technology companies.
Customers don't make investments simply because a vendor has developed an impressive capability.
They invest because they believe that capability will solve a meaningful problem.
For cybersecurity leaders, that means changing the conversation.
Instead of beginning with how many authentication methods a platform supports, begin with how much time employees lose navigating unnecessary login procedures.
Instead of leading with technical architecture, understand the operational burden of password resets, account recovery, and access-related support requests.
Instead of making broad claims about eliminating cyber risk, identify which risks a solution can reasonably reduce and how that reduction might be evaluated.
And instead of presenting an impressive but generic return-on-investment calculation, work with customers to understand their own operating environment, costs, assumptions, and priorities.
There is a profound difference between telling a customer what their return should be and helping them establish what the value could realistically be for their organization.
The first is a sales claim.
The second is the beginning of a business case.
And when customers participate in establishing the facts, they have a much stronger foundation for evaluating the conclusions.
Of course, not every benefit can be converted neatly into dollars.
Some savings are measurable. Some improvements are supported by credible benchmarks. Others depend on customer-specific assumptions that must be validated.
And some of the most meaningful benefits, such as patient confidence or peace of mind, resist simple financial measurement.
That doesn't make them unimportant.
It means we should be thoughtful about how we explain and substantiate value.
A compelling business case isn't the one with the biggest number. It's the one that survives the toughest questions.
What Do We Want People to Remember?
Steve Jobs understood something that applies just as much to cybersecurity today as it did to personal computers in 1997.
Technology evolves.
Products change.
Features that seem revolutionary today may become commonplace tomorrow.
But the underlying human needs remain remarkably consistent.
People want to feel safe.
They want to be recognized.
They want to accomplish their work without unnecessary obstacles.
They want confidence that the people, organizations, and increasingly the AI agents they interact with are legitimate and acting within appropriate boundaries.
And they want technology to make their lives better, not more complicated.
At Identité, our work in passwordless authentication, verifiable identity, and Full Duplex Authentication® is rooted in a belief that digital trust should be both strong and practical.
But the technology itself is not the larger story.
The larger story is what trustworthy digital interactions make possible.
A nurse spending more time with patients.
A customer completing a transaction without unnecessary frustration.
An organization protecting sensitive information without compromising productivity.
A human being retaining meaningful oversight as intelligent machines take on greater responsibility.
Those are the outcomes worth pursuing.
The Human Side of Digital Trust
Perhaps the most important question cybersecurity companies should ask isn't:
How do we explain our technology more effectively?
Perhaps it's:
What do we believe technology should make possible for the people who depend on it?
For me, the answer begins with a simple principle.
Technology should quietly serve humanity.
Digital identity should help establish trust, not create unnecessary barriers.
Security should protect legitimate activity while making deception and abuse more difficult.
And as artificial intelligence becomes increasingly capable, the responsibility to establish identity, authority, and accountability becomes more important, not less.
This is what I mean by The Human Side of Digital Trust™.
It is the recognition that behind every authentication event, every transaction, every access request, and every security decision, there is ultimately a human consequence.
Steve Jobs didn't ask people to fall in love with computer specifications.
He invited them to believe in what people could accomplish.
Perhaps it's time cybersecurity began telling its story the same way.
Because the goal was never simply to eliminate passwords.
The goal was to eliminate unnecessary friction, preserve human confidence, and make trustworthy digital experiences possible.
And that is a story worth telling.