Stretching Cyber Further – Sravish Sridhar, TrustCloud.ai

This is texturing TV. That's a great pleasure of being joined by Travis shridhar. Who is CEO and founder of trust Cloud welcome.

Thank you Mitch. Great to be here good to have you back on I know you've talked with Alan it's good. I have pleasure being able to talk with you myself here too.

ai. Trust that has a very simple idea which we are taking an age-old industry called GRC and we're on a mission to elevate it into a profit Center. Because every security professional Cecil and business leader.

I've talked to don't really understand the business reason that they're implementing a GRC program. And so our Innovation is using AI to transform GRC into a profit Center for businesses all over the world. Wow, taking a compliance with viewed as a complaints thing and turning it into a business.

That's a novel idea. That's right for your customers. So and I'm excited to hear more about that too.

Well speaking of kind of what security teams cisos Professionals in our field, you know, it's we've been through tough times before economic uncertainty and things like that when suddenly budgets or even a little tougher to come by and you're still asked to do all the things you're supposed to do but more it's not an unfamiliar territory talk a little bit about that in what you're experiencing with customers and maybe some of the strategies about how you're helping them or what they're doing into the current economic conditions. Sure. When I grew up Mitch, I used to watch the cartoon show Simpsons all the time and I love watching The Simpsons and when The Simpsons movie came out there's a this is an amazing scene in the movie where Homer is caught between a rock and hard.

And he's literally on a rock and he's being banked between a rock and a house the whole time. This is amazing and it's a gif the people use it as a meme. And I think that security teams feel like Homer being caught between a rock and hard place on one end.

There's growth and breeches. People are trying to hack you. They're trying to run fishing experiments against your entire company and they're trying to find multiple ways to get into your business.

And on the other end with the economic downturn that we're going through right now, there is obvious a budgetary cuts and pressure around doing more. And so the question that every security leader that I talk to is asking now is how do I do more with less? How do I justify the business impact of my security and privacy program?

And how do I have a business conversation with my board of directors and my CFO? on the reasons to try to create a better security environment for the business and that's what we're trying to challenge with trust cloud is to challenge that idea that security is a cost center and rather. It should be a revenue enabler and a profit center for the business.

Yeah, and that's kind of a novel idea. I think for most security teams, right? Because we're used to being the an overhead cost and insurance kind of view.

It is how much Insurance do I need how my security do I need, you know, just enough and not too much. Yeah. How does that how does that idea?

When you talk to prospects and customers about that approach is it like yes, I've been looking for a way to do that or is it like let me think about that that's interesting, you know. Yeah, you know I I often start the conversation with what does your CEO want? And that itself is a very good that's totally right.

I want to grow I want to grow the business and so in the order of in the order of importance what I've heard From talking to Security leaders and Business Leaders, is that the business needs to grow Revenue? That's number one. Number two the business needs to manage costs.

And if you do the first two things then to your point you get profitability or improved profitability. And then the third is the business needs to keep our commitments with our customers. And part of that is keeping the data secure.

So can we do those three things in that order? and then the modern generation of scissors add a fourth criteria to that list, which is can I build a culture of security? In my business and not seem like big brother.

Versus rather embracing people to participate in this idea of security. So can I do those four things? And so what we're trying to do using both artificial intelligence as well as API based programmatic testing of your security program and your privacy program.

Is can we prove and enable the CEO to walk into a management meeting or to a board of directors meeting? And showcase those four things number one. Here's how our security and privacy program has helped us drive Revenue number two.

Here's how it is managing contractual liability that we're having. So I'm protecting us in the downside. Number three, here's how I've rationalized my spend and I'm cutting costs.

and number four I'm actually educating the entire company on why security is important. So that everybody can opt in and participate in what should be an enterprise-wide initiative not just 10 people in the security team forcing people to do things, right? So that's the idea and people are really buying into it.

I can definitely see how I see so or, you know Security Professionals or sign up on yes helping with that because I already have challenges talking business to business people proving our value demonstrating our value. And that the money that we're spending on security is being put to good use. Yeah, not just more protection because we're not sure how much to much to have right but so you mentioned a couple times not as in your insurance clouds name and of course that's on you know, everybody's blog post or news story in the world.

Mostly around AI but machine learning's been, you know, a hot topic for a while as well. Sure. There's a little bit about the role of the eye plays and what you're doing.

From our point of view AI can do three things for a business when it comes to secure gain privacy. The first thing is it can detect what's around the corner. Because once you understand a company's business their operations the scope of their business and where there's risk in their business.

You can start to predict what could go wrong or what is likely to go wrong? based on there environment But also based on what we're seeing across hundreds if not thousands of environments. So the predictive nature is what comes to Bear, you know, can you tell people what's around the corner?

So that's number one. number two is can you actually generate for them work that they would otherwise do manually? Using AI so a common example is if I have to answer a security questionnaire.

Can we use AI to pre-fill and complete 60 to 80% of that security questionnaire using generative models because we know what their security and privacy program looks like we know their controls. We know their policies. So can you intelligently and truthfully answer security questionnaires based on their program not based on things.

We've learned across thousands of llms, but rather things that we know about their security program. So that's the number two. Can we do the manual work?

And do it using AI so that's number two. And number three is can we tap into what a customer wants to know about your program? And a love customer to self-serve.

Their understanding and knowledge about your security program. So I'm sure you've seen the chat interface where people can type a question and they get an answer back. How do we enable that same level of transparency to your prospects and your customers so that they can truly have a conversation with your business about your security and privacy program.

So we enable all those three things. We're customer care and say are you talk to compliant to use the nisk framework you whatever might be and it can query that for you instead of here's the long page of all the explanation of what we might stuff into an RFP if we're trying to get business with this company. It seems like the generative AI That's that's actually a great use case that I've thought about immediately when that kind of picked up steam was.

You know, what a great way to generate right most of that report for you've got the data a lot of it is, you know, what is compliance. It's demons proving that you're doing what you said you're gonna do correct whether it's a set of requirements internally or externally defined compliance standards. So and I agree you definitely don't want generative AI creating everybody the same compliance report that will get by the Auditors about third time.

They see that though. That's great that out pretty quick. So it's got to be, you know matched to your Your environment your policies your your expectations.

Well cool talk a little bit more about than the first part of this of of how we demonstrate that security is helping us in building revenue and increasing profitability. Every company I've talked to struggles with that question. How do I prove that?

My security and privacy program is is increasing revenue and and also cutting liability in theory. Everybody wants to do it. No one's figured out how to do it and the Innovation that we've brought to bear is by saying.

Security tools it compliance tools live in silos today. And that's part of the ciso's conundrum is that they have bought 10 20 30 in some cases a hundred tools. For every slice of their security program and privacy program and compliance program.

The Innovation that we did at trust cloud is we said look let's build a graph of the scope of your business as it comes to security and privacy and let's connect that graph. And then map that graph to the controls the procedures and the policies. That you have in your security program and your compliance program.

And once the graph is connected to your program. We know what is failing and what is passing at any given point of time. So we use AI to enable programmatic governance.

As well as programmatic compliance. To ensure that you're doing what you claim to be doing all the time. So that's part one.

Once you're doing that the same AI can be used to generate answers to security questionnaires. And also track what customers are doing with the portal. Where they ask questions about your security program.

Once you do those two things your sales team invites your customers. They get to see your security program and they also answer security questionnaires using the tool. And based on the answers and documents that are being downloaded.

25 million dollars. Got done because you had these 44 controls and 12 policies. That were required to answer the security questionnaire from Coca-Cola.

Hmm, I would similarly too just taking the the chat interface that you've had what are people asking us about right? So maybe we have more forward in our marketing about our security at the security aspects of our company if that's you know, Study, right. And also what are people asking us about that?

We can't answer via chat or via security question here, which enables the ciso to go to the CFO. And say I have data. Where these deals were at risk?

Because we didn't have these five things. And so let's make an investment to enhance our security capabilities with these five things so that we don't have we don't affect Revenue in the future. Hmm.

Wonderful. Well, let's so let's try back to kind of the original But we started with of the whole doing less with more, right? Yeah, we're doing more with less.

I said that backwards we're not being asked to do it that way. I mean I can kind of connect the dots and imagine, you know through this graph through just by knowing what we're all the policies and the the things that we've implemented to accomplish our security and compliance and risk management and knowing what that ties to and what systems are processes are people tools Etc and then help them pull data from that that right there sounds like a class savings, right? That's effort to pull together compliance reports identify where there issues man the right track.

Are there other things like yeah. Yeah value comes from three things number one. Can you take three to 10 products that you're using and you've purchased a silos?

And Consolidated down to one or two products. And therefore you save a bunch of money from a vendor standpoint. So that's number one.

Number two is can you use both Ai and programmatic control verification? To reduce the amount of manual work that people are doing and that creates cost saving server productivity and potentially a resourcing standpoint. And number three can you when you do one and two what you enable is the ability to close deals faster because now the security reviews are a fraction of the time compared to what it was before and so now deals goes faster and revenue accelerates as well.

So it's a simple idea of doing those three things. Of those three, I could see the through the low-hanging fruit possibly is the consolidation budget Saving right? Because I can immediately show a benefit to the bottom line.

Yeah, and of course manual effort means I don't need to hire more people where I can do it. Yeah. Well that I have maybe make that a more efficient and then of course if you can demonstrate bringing how you're bringing in more Revenue customer impact to the bottom line, so it seems like that's a nice sort of hierarchy of what we can do.

Now what you can work on, you know to get to that point where you're showing Revenue Improvement as well. As you know, I can not hire three more people this year when you're Focus. Yeah, I mean the real amazing aha moment that our customers get is that the moment they close two deals or one deal.

Which could have slipped into the next quarter? But instead got closed in the current quarter. Because the security review was no longer the bottleneck.

Then your entire strategy just paid for itself. That's a really good point. You know, if I'm not waiting six weeks to fill out the paperwork to get everything.

Yeah asked for and I can do that and Six hours or yeah minutes or whatever. Yeah, that's that's value right away. Yeah.

Well speaking at time to Value. How about at the very beginning? Great how I go to trust Cloud that I went.

Check out your stuff. Great. I want to do this.

There's the whole time to value for your customer using your technology. What does that curve look like? What is that timing look like where they start to see and receive value from your product.

Yeah, the two things I learned when we talk to customers number one security most security vendors and most GRC vendors make it too hard for people to try products. Mmm. There's a there's a phrase that is used in the technology world called Product like growth plg.

Nobody's really applied plg principles to the world of GRC GRC is still in the early 2000s when it comes to how people can try and onboard software. So to enable time to Value quickly where the world's first company that has enabled a free self-service way. For people to go and set up their compliance program.

Connected to their business and try the product without ever talking to us. so in a matter of between, 30 minutes and an hour They get to see the whole product in all its glory after they set up. The first set of steps and complete the first set of steps.

So that's part one. Pretty rare secular product. Yeah, it's really hard.

We took a lot of effort to do it and it's pretty amazing. And the second is we say okay as part of that free product. You can upload one of your security questionnaires.

And see how the magic works and go back to your boss and say I normally would take you know, six days to complete the security questions. I did it in 20 minutes. And we're ready to move that deal forward and you have that aha moment.

And you say I've immediately shown time to value by accelerating in sales process. Fantastic, how about companies that are maybe less mature in their Security Programs have some gaps. In that and I don't have a policy for that our process or an attestation way of demonstrating that how can you help folks in that situation?

Yeah, Mitch. There's a huge risk in the industry today where there's lots of vendors in the compliance space. That provide templates.

To these kinds of customers. Mmm, and because they don't have the maturity in their business, they literally take the template and adopt it as their policy. Not knowing it's real that's been there don't have of it.

Right that's right and that ramifications and then representing to a customer. This is my policy around some subject and you really not doing it. There's a huge risk to that.

And so the approach we've taken is different what we've what we've said is templatized policies are dangerous. And this is where the AI comes in because we've built a graph of your business. We understand the controls that you have.

We understand your security practices. We generate. policy documentation and procedural documentation based on the practices that we observe in your security landscape and your control landscape.

And so the controls are the policies are tailored to your controls. And if you enhance your controls you enhance your testing you add more security capabilities. We can Auto create net new documentation in your policies, which you are then asked to review and adopt.

And so the policies became a living document that is an accurate representation of how you run your business. Well fantastic, we're just about out of time here and really appreciate you coming by and sharing what you've done sounds like some great advancement and Innovation and applying AI to what might be seen. Well as you said kind of a problem that's still living very much in the early 2000s.

I can appreciate that for sure working folks find out more. What can you mention, you know, they can on board pretty easily what can folks try out. ai they can sign up for free and they should just have one objective, which is GRC needs to be a profit Center from here on out.

Excellent, great. We'll check it out. Definitely trust Cloud dot AI service.

Thank you so much for stopping by CEO and founder with trust Cloud. Hope see you again soon. Thank you Mitch.