BlackBerry CTO Charles Eagan says no security passwords is the dream.

This may sound strange coming from a technologist whose company has invested billions in security and recently opened a new lab and business unit focused solely on research and development in the cybersecurity space.

But he makes a compelling argument.

“Passwords are painful and not that effective, and multi-factor authentication just makes it more complicated to compromise,” Eagan told SDxCentral. “People do things to avoid having to remember passwords, or they take shortcuts. Our real vision is: we want more security with less friction. We would love it if you never had to use a password, and you had more security at the same time.”

And, he adds, BlackBerry has technology to make this a reality. “We have insight into your mobile, your desktop, and, potentially, your automobile. So we can build a multi-point perspective because we will know generally where you are and what you do. We can give you frictionless service and access to your information without any risk to security. More security with less friction is the dream.”

After it stopped making mobile phones in 2016, BlackBerry started moving into the enterprise software market with a focus on security. It also opened an autonomous vehicle innovation center at its headquarters in Ottawa, Ontario.

Two years ago, CEO John Chen created the office of the CTO at BlackBerry and appointed Eagan to the post. “My role as CTO … also involved doing technology due diligence on cybersecurity companies,” Eagan said. “I got to investigate Cylance long before the acquisition.”

He’s talking about BlackBerry’s $1.4 billion acquisition in late 2018 of endpoint security unicorn Cylance. The deal, and Cylance’s artificial-intelligence (AI) based technology, boosted BlackBerry’s endpoint management and QNX software, which is used in autonomous cars.

“We believe adding Cylance’s capabilities to our trusted advantages in privacy, secure mobility, and embedded systems will make BlackBerry Spark indispensable to realizing the enterprise of things,” said John Chen, executive chairman and CEO of BlackBerry in a statement last year. Spark is BlackBerry’s IoT platform with built-in encryption.

BlackBerry already had machine learning (ML) and AI-based products at the time of the Cylance acquisition. But the startup “fit into our continuous authentication and security strategy,” Eagan said. This included “having a leader of the pack in the family,” and being able to add new capabilities to its existing products using Cylance’s technology. “Cylance works in the cloud space, it’s embedded, it has a very small footprint, it works offline or online, and it seemed to be a very good fit with our BlackBerry family.”

And by integrating Cylance’s technology with BlackBerry’s endpoint protection, the company can now provide real-time adaptive security with AI for all endpoints including mobile, IoT, and desktop. BlackBerry announced this when it launched BlackBerry Intelligent Security in the lead-up to the annual Black Hat security conference in August.

“It’s cloud-based, multi-factor, continuous authentication,” Eagan said. “We’re sitting behind the scenes looking at what you are doing on your laptop, your phone, and what’s your behavior on both of them. We’re building this central confidence that you are who you say you are.”

For example, people tend to use certain devices at certain times and to access particular types of data. They also hold their phones at unique angles. And then they work on their laptops, they have a usual typing speed and a particular mouse arc. When BlackBerry detects an anomaly in any of these behaviors it can take action such as locking a user out of the system, or alerting an administrator, or even removing sensitive documents.

“It’s continuous authentication, but also contextual authentication,” Eagan said. “So we’re doing this personalization using machine learning on your laptop, and we could do the same thing on the automobile using this machine learning model and a number of technologies including our BlackBerry QNX technology, and come up with very good confidence that the driver is who he claims to be.”

This ties back into the no-passwords dream. The machine learning model can detect patterns “happening across such a broad data set that a human can’t really find,” and that provides a much higher level of security than a password, Eagan said.

At the same time that the Cylance acquisition was underway, the company was spinning up a 120-person lab “to basically work on whatever cool thing the engineers in BlackBerry thought was needed,” Eagan said. Late last month, the company officially announced the BlackBerry Advanced Technology Development Labs — BlackBerry Labs for short — as a new cybersecurity research and development business unit led by Eagan.

The goal here, the company said in a statement, is “identifying, exploring, and creating new technologies to ensure BlackBerry is on the cutting edge of security innovation.”

BlackBerry Labs’ initial focus centers on applying machine learning approaches to security in partnership with BlackBerry’s existing business units including Cylance. “Right now Labs is working on bringing machine learning to our Mobile Threat Defense portfolio and also our automotive cybersecurity and safety space — those are two big focuses,” Eagan said.

The BlackBerry World Tour is currently making its way across the globe and showcasing the company’s enterprise and IoT security products and services. Meanwhile its Intelligent Security services are in beta trials now with companies. And it recently announced that BlackBerry Cylance will integrate with Chronicle’s Backstory security analytics platform starting this quarter.

But despite the security-heavy news of late, Eagan doesn’t see this as a shift in the company’s business strategy. “BlackBerry has always focused on security,” he said. “Building and deploying hundreds of millions of devices globally means security is part of our DNA.”