Bryan Palma, Trellix | RSA Conference 2023

This is texturing TV. Welcome to our interviews here at RCC 2023 in San Francisco good to be talking with great people fantastic Technologies and topics but just mainly kind of seeing people in person. So I have the great pleasure to be joined by Brian Palmer.

Who is CEO with relics. Welcome Brian man. Thanks.

Yeah. Good to see have you here? You did your keynote.

We're going to talk a little bit about that. Love to hear about that. But first, you know tell us about yourself and of course tell us about trellis, of course.

I'm the CEO of traleks. And for those of you not familiar tralox was formed from the integration of McAfee and FireEye. So pretty excited about the work.

We've been doing over the last 18 months. We brought the two companies together and we're the market leader in xdr. So we're excited to keep keep running that race.

So to speak a Hot Topic from last year still Hot Topic this year. We think so. We've got a big bad around it.

We think it's a defining moment in the cyber security Market the move to xdr, and we're going to continue to Invest there. We made a couple key announcements this week. We made one around our unified endpoint.

So we had great endpoint technology in both of the former companies and we're bringing that technology together and you know to make sure we have a market leading endpoint solution. We also made an announcement around fedramp. We're one of the leaders in fedramp the public sector the intelligence Community the dod or some of our important most important customers.

So excited about the progress we made around that ramp as well talk more about xdr kind of state of adoption state of the technology where we have and I don't think it's reached the it's become such a broad and defined term like some things do when they go on too long. That's right, you know, that's right, but love to hear kind of your take on xcr2. Yeah.

I think we're in the early stages, you know Gardener kind of says xdr adoptions and that five to 10% range. They believe that by 2025 it'll be in the 40% range. I gave some stats yesterday on stage.

We did a survey of 500 CIS and Out 47% of them said they were making investments in xdr. It was one of their top five Investments. So I think we're going to continue to see that Evolution happen and the growth really happened over the next couple years.

Like you said, it was a big topic last year. It's a big topic this year. I think that's showing it's got some staying power.

It's got some traction for sure for sure. So tell us about your your keynote. Yeah.

What did you talk about? What sort of the reaction that you got? Yeah.

So I talked a little bit about security operations and some of the issues in today's Security operation centers, you know, I had the opportunity to go out and meet I visited about half a dozen socks across the globe some internal some with our partners and some with our customers super eye-opening for me. So what I did in the first part of the talk is talked a little bit about what are some of the issues that we're seeing in security operations centers today, and I outlined those you know, Staffing is a is a problem. Obviously that models changed every single sock I visited was Hybrid sock so none of them are fully physically running at 100% They're doing some amount virtually it really range from 80% to 40 percent to zero percent.

Some stocks are fully virtual. So I think that's having an impact on how are the people in the sock learning. How is mentorship happening?

How are they storming problems when you need to actually be physically together. So there's a people component. I talked a bit about the tools as well a lot of our tooling, you know, the statistic that we got is 25 different tools a typical analyst is using which is very difficult.

It's a lot. Yeah monitoring a lot of cognitive. It's a lot of cognitive load for sure and and trying to manage all that we talk to more about the human element a lot of stress comes with these jobs as well.

And that's having an impact people are burning out some issues there and then finally, you know, not enough use of AI machine learning artificial intelligence to make us the humans. A better job and then I I kind of contrasted that with what does the socket tomorrow look like. Let's talk a little bit about that and you mentioned ai's component.

We kind of Time how long into a talk is they come that's right. You gotta get a little bet you got a little if your slander in five minutes unusual. But anyway, you know, it's it's gotten Mass Market because of it in the generative AI sure aspects of this much more to AI of course, what do you see is the role today in evolving role of AI in a sock and yeah.

Yeah. I mean, I think first of all it's critically important right because you know, what I talked about yesterday is I think the soccer the future pretty much gets humans entirely out of the detection business and you know, that might be a bit of a provocative statement but I think we should get to a point where machines artificial intelligent machine learning are handling all the detections versus somebody looking at a screen and looking at a bunch of alerts where the humans Then should be focused is on the response and on the remediation on the resiliency on the ours, right and we're not there yet. Obviously still lots of humans.

I made a joke about having to have noise canceling headphones in the stock because you're hearing so many alerts but I think the role of AI is to bring together the security and from we have enough information and actually one of the other big pieces from our survey was that the ciso's number one problem is too much information. It's not too little now the problem is they're not getting Insight out of that information. So I think the role of AI is to get them inside out of that out of that data that they've been collecting and then turn that into actions.

I think that's where we as a vendor Community have to do a better job of leveraging artificial intelligence and machine learning. There's even I've seen some kind of demos prototypes of things people talking about using generative AI just pull out extract all out of all that information. What happened?

That's right. What were the responses build the timeline for me Canada? The manual effort we would do to prepare some Communications internally or full-blown report.

That's right. Yeah, it takes some of those the toil out of some of those tasks totally right? Well, right.

Yeah, and that's what you know built into the trail xdr is exactly that artificial intelligence and what it does is what you just said, it looks across the data set and says, oh we saw this on email. I saw this over on the network and I saw this on the endpoint that's a correlation that wouldn't be made by a human. But then what they do is they curate that they serve it up to the analyst saying you may want to go double click here, right?

Because these three things seem related and then we call that a guided investigation versus looking for a needle in a haystack. An alarm went off. Is it real is it not looking at?

Hey, this is this has Fidelity something they now doesn't mean something's always there but it's definitely been curated. So the analyst can spend their time on you know, Likely more critical insights why some of the institutional knowledge that's right context that aren't exact systems. Exactly.

Another thing. That's really emerging. I hear a lot more about is in the security world and we've heard in this and kind of the cloud and software world is resilience.

Yeah, not just rigidity of you know, being able to stay up and whether the storm and no matter, you know, how hard our systems get beat on from the security standpoint, but it's the it's being able to handle the unexpected. That's right. That's Trend systems that can bend and flex but not maybe it's through isolation.

Maybe it's other techniques that we can yeah apply what I imagine. You probably talked a little bit about that. I did talk a little bit about it and you know interestingly in our not interestingly probably more more appropriate, unfortunately 86% We interviewed and surveyed over 500 CIS globally 86% said that they had an incident right?

I mean, so that's a huge number right? You know, you will. What you will have exactly and that's something you know, I on the way over here.

I was on the street. I bumped into my good friend Kevin mandia, you know Kevin and I go way back obviously worked together a fire eyes. I was spinning out the business and you know Kevin's been saying for a long time.

It's not if it's when and we're in that world today. Now the good news is that you know, there was a stigma, you know before where people wouldn't talk about a Bree it was a big you know, so the numbers were always on shameful. Yeah.

We're always under reported you there were more breaches right now. I think people are opening up there but it's all about that resiliency. It's about what your I are.

What's your response? Right? What's your remediation?

How do your point are you thinking and architecting your environment right? You have Cloud. How do you think about back up right?

So that's really I think there's a recognition now that it is about resiliency both technology resiliency and people resiliency, but also process resiliency. I think we're seeing more of that and we're seeing companies be able to handle that and to Work through it because it's inevitable right? It's just such an incredibly broad attack surface that things are things are going to come your way.

Very cool. I love that you surveyed and talked with the CSO your customer community. Of course, what kind of things are you learning from them as they're using your technology is they're dealing with uncertainty, you know changes in economically, they're dealing with maybe some reord maybe even layoffs.

Yeah organization. Maybe we kind of directing where they're heading given given what's current times. Yeah.

I think the first thing we learned is it's a hard job, right? I mean that was I gave some stats on it. It's a lot of stress and not only on the CIO but on the folks working in Security operation centers, right, you know one ciso told us like, you know, you you only have to be wrong once right and everybody kind of blame.

So there's a lot of stress on those folks. They're on the front lines and they all you know, we the other thing we we talked about in the survey is, you know, a large percentage of CIS identify with this protect. Notion, so they're doing the job because they believe they want to protect their company and when they don't do that it's hard.

So we're definitely seeing a stress component to it. I mean, I think the other thing we're seeing is just you know that came out of it is that you know, the ciso's feel like the board understands cybersecurity is important, but they're not always giving them the resources that are commensurate with the importance of it and that can be frustrating from a budget perspective and for what they want to do. I also think that what we heard is folks are looking for what I'll call more pillar Tech not technology that can help them more broadly and I've always talked about, you know cybersecurities one of the areas where we don't have a platform right if you go into customer, you know management or you know Salesforce.

Yeah, there's no platform in cyber security forums exactly. We've all different platforms which gets you back to your 25 tools in the stock. I think what customers Are making clear is they want to they want to reduce the number of variables.

They want to have a platform approach because they can't continue to manage this, you know vast array of best of breed tools. This has been a while but I mean everyone see so of a major social media company told me anything that comes in the door that requires more people more work for my existing people. It's probably not something I'm going to be able that's right.

I've got to find ways to do what we're doing exactly or more efficiently more effectively and to tie it back. That's where as I talked about my talk. That's where AI has to come in.

It has to be able to take some of these what I call rope processes and procedures at the bottom end of the value curve and Outsource that to machines so that we can lift up the impact of our human personnel and have them working on the more strategic things that change can be destructive but also can be an opportunity to make changes right that we can rethink. Maybe you don't have that staff anymore. Maybe we've changed the kind of That because of things that happen or what we do.

I mean, what do you see is the opportunity while we're in a time of change maybe a time of Destruction. What's the upside? What are things that we can can gain from that?

Yeah, I mean a couple things and I had a couple suggestions yesterday and the keynote. I mean the one we just spent a lot of time on is how do we move towards an autonomous stock? That's run by robots is what I talked about.

I think that's really critical. We have got to make that advancement and you know, it's both on the operator side and it's on the vendor side getting us to truly be able to adopt Ai and ml take care of the detection load and maybe even some of the response load gets automated as well. So I think that's number one.

I had this other idea about yesterday, you know being at RSA you want to be provocative. So I had this idea about Gamers. There's three billion gamers in the world and you know, there's some sci-fi books that I've read, you know, and and I was thinking about how do we fuse together gaming platforms with sock operations?

Could we crowdsource say could we tap into These three billion Gamers rotation of exactly and yeah and kind of tap into these very highly motivated technical competitive folks and could there be a crowdsource sock out there that works for everybody? You know, that's baby basically a platform. So I you know, we threw out some some fun ideas exactly right with a you know, with you know, economic incentives and you know certifications and and you know, my my statistic was with three billion Gamers if we took the top one percent maybe 30 million new people to do responders to be analysts to be investigators.

So just that just you know, you never know where those you never know marks go throw them out where it turns into for sure So speaking to be I and I know we're not we're not necessarily. Yeah experts but do you think yeah, do we have the AI technology today for what we need to get where we where you want to go or there certain advancements. You think there's just our maturity I think.

Think what we have is is pretty good and we haven't adopted it as well as we could have so I think I definitely think there's an adoption issue. I do think there's an opportunity to do more I think security maybe is lagging a little bit on that but I think giving everything we're seeing going on with chat GPT. And you know Bart, I think you're gonna see a real explosion.

I don't think that's overstated. You hear a lot about it in the media. It's the new darling.

It's the new thing but I do think in the next 24 months, you're gonna see a significant Groundswell of change around AI especially in the security space. Well, it seems like we have the data we have massive amounts of attacks. And yeah factors that have been hit between larger language models for generative or machine learning trying they thrive on it.

That's the fuel that makes it happen. So hopefully as we apply more of that that's right get you know, learn our skills and that's why and that's why I think we're in a good place right because We we have so we are not and again our survey reinforce this we are not short on data. Nobody's saying I don't have enough data.

They're all saying I have too much data and I can't make sense of it. Well, that's what AI ml that's what it's designed for to go into large data sets and help make sense of it. So we should be doing that.

That's not a next gen function. You know, I did a little I had a little bit of fun in my keynote too. We did a deep fake there was a deep fake of me and we did some chat GPT stuff with my speech so it's fun.

But yeah, we have the data now it's about insights. And when I talk to CIS, that's what they always say. I need more insights.

I want to know so I can take action. I need insights. That's where Ai and ml can really help us.

What do you hope we're talking about next year to 2024 when we get back together and say hey, did your keynote this year? You know, this is really cool. I was hoping we were talking that's right.

Yeah. Well, I hope there's a lot of robots in the sock and I hope some gamers are helping us out now, I mean On a serious Gamers around here. My gamers are you know attacking and playing soccer?

Exactly? No. No, I think look I think it's hopefully staying on the conversation that we just talked about was here last year is here again.

We think xdr and that platform is the way forward for cybersecurity. So I think if we're talking about hey, it feels like we've got more of a platform for cybersecurity from an xdr type architecture. We think that's great.

I think the more we're talking about tralex next year. We'll be great. We were on everybody's lanyard this year.

We're excited about that and just making sure people know our deep history and cybersecurity and that we've reinvented ourselves and where we're going the next year. I'd be excited if that was to talk and seriously, thank you for your support of the community and RSA and sponsoring all that you do that doing the talk. So Brian, it's been fantastic.

Talk to you good conversation next year Brian. Mama who's CEO of trellis, so we'll see you again soon. Thanks so much.

Take care.