nVisium Acquisition – Charles Horton, NetSPI

This is Textron TV. Well today I have the great pleasure being joined by Charles Horton. Charles is co with netspy.

Welcome Charles. Hey, thanks Mitch for having me on. It's always good to have the security conversation with the colleague.

It's security and we're cloud and software and security is such an interesting world before we jump into that because I know you've got some news tell us a little bit about yourself and tell us a little bit about and that's fine. Yeah. Sure.

My name's Charles Horton. I'm Co at Best Buy like you said I've been in security for a minute or two Mitch. I don't want to date myself.

I've been with nets5 for about five years and a little over five years and just really fortunate to play a part in the Nets by growth story, you know a little bit about that's fine founded. early 2000s founder-led organization and when I joined in I would just really impressed with the people the client base the reputation and the DNA of the organization is really in offensive security testing and we do that you know, and whenever you talk to somebody about netspy a common theme is really the intersection of talent in technology. We'll never be push button and testing firm.

We always have experts behind all of the solutions that that we provide but really, you know leveraging technology as a as a force multiplier for our people leveraging, you know offensive security methodologies in in everything that we do and the success that we've had is really a testament to the team that we have in place. So as we've grown we've introduced, you know penetration testing as a Attack surface management. We're going to get ready to release breach and attack simulation some platforms that we have to help our clients and and the broader Market just solve for their ever, you know evolving security needs.

I think how much things have evolved since early 2000s when I gotten Securities and that's mine was picking off the ground great to have you all you're great great member of the security community. So it's good to be talking with you and that's my team. So you you've got an announcement that just came out tell us about what's happening.

Yeah, so You know, that's why it's always looking to grow most of our growth has been organic and we've been fortunate we've got cake ER in 1011 Ventures have been really supportive in you know, potentially looking at inorganic growth and m&a opportunities. So we're announcing the acquisition of a pen testing company called Envision and you know, really it takes a lot to to put these things together. And you know, you know Mitch if you've been around, you know, all of the all of the different m&a types and and growth opportunities that you have and we're up to see opportunistic about that.

so so it's you know part of our growth strategy and really it's the combination of amazing talent and The Trusted client relationships that Envision brings to the table, you know, we're really bringing together to Innovative and culturally aligned security companies that you know are committed to delivering penetration testing at the highest level and these things all look great and sound great at the start of a deal. They look great on a on a spreadsheet from an investor perspective, but the but the real opportunity there is 401 plus one equals three scenarios. So combining these organizations and busium is deep in cloud and application testing.

It's gonna just really allow us to expand the depth and breadth of our solutions that we take to the market and take to clients as well. As you know, take the whole Nets by portfolio to Envision clients. It's an exciting opportunity for us and something that we've been in You know works for for a little while and and glad to see and excited for this announcement.

Fantastic. Well congratulations on that announcement. You know Acquisitions is your gun pointing out or always interesting right?

Sometimes it's getting the technology getting a custom rate based maybe getting some skills and experience in new areas. What would you say is kind of the most the biggest area you were looking for taking that advancement and was doing more Cloud kind of work. Was it a different kind of customer base a little bit about that?

I think both of those, you know, the great thing about this opportunity is there's very little overlap in the customer base. So it's really an expansion opportunity and and The Trusted relationships that invisium has with their clients I think is going to allow us to to talk to them more about that's why Solutions and other ways that we can help them and obviously Mitch, you know, as well as I do. There's tremendous energy and investment around Cloud.

I mean, I don't know how long we've been talking about it, but it's here organizations continue to make that investment in cloud and it's going to continue to be a Cornerstone of their you know, overall risk as an organization as well. As you know, there are security strategy. So I think you you try angulate a few of those things and couple that with the talent that they bring to the table.

It's a it's a recipe for Success fantastic how is adding their and testing capabilities service offerings combined with netspice products? What's that Synergy you're talking about one plus one is equals three, right that kind of a A synergistic effect. How are you going to achieve that it's the things that make that happen.

Yeah, that's tough. I mean you really have to be thoughtful around how you design, you know, your next-gen solutions that really combine the best that both organizations do because a lot of times, you know, you get into you know these types of scenarios and there's an imbalance between you know, who wins and who loses or who's you know, who's right and who's wrong? This is an opportunity for really us to harness the intelligence that and you know services that both organizations have developed and develop something new going forward.

So for us, you know the process and what that looks like, you know m&a you're always gonna have, you know, your HR integration your systems integration. But you really have to be thoughtful when it comes to you know, your client experience as well as your employee experience and for us, you know, that process is really getting our experts in a room together and everybody, you know, that's where you need that cultural alignment. If you don't have that, you know, your chances of success are going to face some some headwinds, but if you have that and everybody is passionate about what they do, everybody's passionate about, you know, solving these very complex security problems.

They're naturally gonna look for, you know, the best advantages that we can have. So the insights that The Envision team bring to the table along with the insights that that's by has combining them as well as interesting, you know technology technology pieces. How do we deploy those how do we you know, take those to Market?

We're gonna be things that we're gonna have to solve and we're gonna have to solve them together. You were talking about. The cloud and evolution of where we're going to come through where we're going.

It seems that the great thing for security at least is it's not getting less complex is getting more complex. They're new different ways was Cloud native or webassembly on the horizon for folks or whatever. It might be new ways of thinking about how we build an applications or secure networks here Cloud environments.

Um, it's kind of it's like a mirage all that is hitting us at once. Right and so which opportunity you take sometimes can be even the greater challenge of where do you focus? How do you how do you tackle that challenge?

Yeah, it's it's not easy. I'll give you easy questions. Yeah.

Yeah. Could you throw a softball here? Well, I think you know if you look at just things.

They have a tendency to go from Simplicity to complexity then back to simplicity. Well, this is not going back to Simplicity anytime soon. Just the rapid pace of change in architectures you know you think about it Mitch the amount of code and the amount of ones and zeros that's out in the universe today.

Is more than there was yesterday and tomorrow. There's going to be more than there is today. so for us to be able to Tackle that takes, you know expertise it takes collaboration.

It takes tooling it takes telemetry. There's there's so much that goes into understanding the context of these environments that you know, not everybody has the same footprint either. So it's it's a difficult challenge.

But we you know, we've been in Cloud since you know, 2018 one of our VPS and research published a book on on cloud penetration testing, you know, really it's having those experts but also Synthesizing that expertise throughout the organization and throughout the teams and continuing to grow our expertise at scale. That's the real challenge because every organization can have a guy that knows the thing about the thing right? If you want to talk about Cloud, you know talk to me.

She's right over there in that office but to be able to do it as an organization with with how complex and How fast they change really takes a lot of people working together to share information and we we have you know technology that that Fosters that collaboration and really comes down to you know, our culture our core values of striving for excellence that that keep us, you know, continuing to to drive forward there, but it certainly can be intimidating at times. It is exciting is you think about 2023 since so that announcement happened on the 10th of January? Yeah acquisition as you're thinking about.

The next year plus what are some of the challenges customers are on the Forefront for them in this environment that we're in? Well, I think customers are looking for you know, they'll continue to want you know comprehensive. Solutions solutions that can scale but they're really looking for expertise not only in a specific application or in their Cloud environment in their kubernetes, but they're but they're looking for expertise and for people to really understand what is their footprint look like what are their risks and then you know, what do they need to do to help mitigate those risk and you couple that with you know Mitch were coming through a pandemic coming through a couple years of you know, right, you know a lot of social changes as well the uncertainty of you know, the marketplace in 23, I'll you know with investment and where companies you know are they are they can continue to invest in those important things at the same level as they have the last couple of years.

So, you know a lot of a lot of things, you know around 2023 are going to unfold in the upcoming months, but Security testing is foundational and you know, thematically we know that our clients want to continue to test more. And they want to be able to continue to test continuously. But they also don't want just a annual point in time test.

I mean you think about Cicd Frameworks and how development is changing you're going to see penetration testing security testing and protection continue to evolve to complement those themes and and those work patterns and behaviors to make it more precise more incremental always on and those are things that that we're excited to to participate in and and hopefully play a big role in that. You think about the environment where that microservice I'm working on right now might be in production in an hour be good pen test it before it goes out. Yeah, yeah, and you can like it's it's very difficult to to do that today.

If you say hey, I've got this component. And I need some assurance and you know, you can point some tooling at it. But tooling is only going to get.

You know, maybe half of vulnerabilities that that you know are identified. It's the human aspect that that's still, you know, outpaces any sort of tooling which is why you know, we focus on the on the talent and experts that we have every solution that we put forward has, you know experts behind it are attack surface management has penetracy testing experts behind it reaching a text simulation same thing. But you know, really we think about conceptually our penetration testing as a service, you know, this always on concept more incremental more frequent to where eventually yeah, you'll be able to say hey, I've got this component.

I need to test it and you know whoever is doing that would have the right context for what it interfaces with where it's going to sit what data it's gonna have access to what the other environment variables are and be able to provide some Assurance. That's that's ultimately one of the goals, but there are other ways that we can advance, you know, the overall coverage and depth of penetration testing because the cost of it is, you know can be prohibitive and you think about Mitch in today's world. What's not being tested?

At least to at least to a high degree. I think you've brought it up before supply chain. I mean, there's a number of things that just aren't being tested that are big big problems and huge opportunities for adversaries for sure.

That certainly is Supply chains certainly elevated under our radar in the past year two years. That's for sure. Well, congratulations on the announcement on the acquisition, um working folks find out more about that or not spy Services.

I know you're involved in open source a lot of great things you're doing. Yeah, we have a lot of you know, our technical teams contribute a lot to blogs Tooling in the open source Community that's on GitHub. Our next five website has a lot of that content or a directory of where you can find additional content for me.

I'm on LinkedIn happy to connect and collaborate with anybody at any time especially on on security topics which are you know, extremely fun to talk about so those would be the places to start. com any tsp any tea SPI, right? com.

All right, it's Monday. I'm you know on Monday so still getting my ton working here Charles. It's great talking to me.

Thank you and let's come back here some more come back and tell us a little bit about how post acquisition that's going. Maybe some of the new things going on. Again, you say that to everybody?

Yes, I do. No, I'm not that specifically. But yeah, I do want you to come by.

That's right. Thanks Mitch. Okay.

Thanks Charles.