RSAC Interviews, DevSecOps and GenAI, Is Security Delivering The Goods – Security Boulevard Chats – EP18

Hi, everybody, this is Mitch Ashley. And I'm Alan Shiel, and you're listening to another episode of Security Boulevard Chats Out on the Boulevard. Mitch, out on the BI Love You're out on the Boulevard.

I can always hear that song on my head, in my head, you know. Well, it's either that or Hollywood Boulevard. I kinda always liked Hollywood, but this is Security Boulevard.

There's no celluloid heroes. We're not into that flashy business. We're into, you know, except for Lola doing the good work.

Except what? Except for Lola Ola. Yes.

Oh my God. Anyway. Hey, Mitch, this is, it's a good time to be talking security.

We just come back from RSA. It is, I was just gonna say, we need to dedicate this as a special recovery, RSA recovery edition to Security Boulevard. Actually, speaking of recovery, I went to the recovery breakfast at RSA Thursday.

I did too. Yeah. Yeah.

And that was good to see Mogul and Rich Mogul and a, I saw Adrian Lane there and a bunch of other folks. But really for me, the highlight of RSA this year, Mitchell, was, you know, we've been doing the security bloggers meetup. You and I have been doing it for how long?

20 years. 20 plus. Yeah.

And, uh, of course this year we changed it to the security creators, network, security content creators. We opened it up, and I'm glad we did. We had 125 people show up, which was more than we've had in many years.

And a lot of new people, a lot of fresh face faces, a lot of younger people, a lot of women. More diversity. But our core was there too.

Right. The people, people who, you know, we came up with Mitch, who have like senior positions, but not only, see, they're just leaders in this community. People like Andy Ellis and Rich Mogul and Chris Blas.

And I'm just trying to think off the top of my head of the Trey Ford, um, snake, Robert Hanson. Yeah. Storms.

Andrew Storms is there, uh, just, what's his name? Ron Weer. Yes.

Werner. Thank you. The Forester was, you know, just so many old friends that you realize, you realize just how special it is to really be part of that community, Mitch, and man, I already, I already wrote to Tonga room, uh, taking it for next year.

I'm pumped Oh, yeah. To do it. It was an energizing re-energizing experience.

Right. Yeah. It kinda, I I remember you said something about it.

It reminds me of why I do this. This is why I love working in security. I love lots of parts of it, but this is the biggest reason the, the people aspect.

And that whole week was seeing, you know, I mean, Mitch, you and I, we spoke about it at our DevOps chat. There's no lack of conferences. You and I are going to around the world, some exotic locales and some mundane Mm-Hmm.

But there is nothing for me, like going to RSA and seeing my people. Yeah. Uh, it, it, it energizes me and seeing that by broadcast alley.

Right. Or coming to DevOps Connect. Yeah.

I just said there like, I have a window on the world and people are walking by and, you know, crazy. Including the FU guy standing outside shouting into his megaphone that he does if he's here. Yeah.

But, you know. Yeah. He's part of it.

It's all part of the You gonna do, it's all part of the experience. Exactly. You don't know what we're talking about.

Come by Moscone West. Yeah. During RSAC you might get to hear, I'm sure you will actually.

But we should mention all of the interviews we did. Do it, uh, broadcast Alley at RSA are now up on, uh, tech Strong tv. They are.

So if anybody would like to, didn't catch 'em live, they want to see some of the, I don't know how many dozens of people we spoke to. Um, feel free to check it out on Techstrong tv. Mitch, I wanted to talk about something else though.

Yeah. Okay. Great.

Um, I, I started hearing bits and pieces of this at RSA, you know, you gotta, there's a signal to noise ratio, you gotta kind of work your way through. But, you know, you and I have been going to RSA when there were a thousand security companies in the world, and everyone said, there's no way we could afford a thousand security companies. We can't support more than 600.

And then there was 2,500 security companies. There's no way we could support 2,500 security companies. We can't support more than a thousand.

You know, I think there's like seven, over 7,000 venture backed security companies at RS, uh, not at RSA in the world today. Yeah. Many of 'em exhibited RSA, and then there, there are some who don't, like Palo Alto didn't have an official exhibit Mm-Hmm.

But they were all over around RSA with activities and stuff. So there are 7,000 some odd public and venture backed cybersecurity companies in the world, and more come out every single day it seems. But I think what we're starting to hear is that, and security champions at the board level, the exec level, the budget level are starting to get pushback saying, Hey, man, we already bought dozens, if not hundreds of security products.

We have so many security products, half of them aren't even installed. And you know what? We got zero less breaches than we had five years ago.

We have more. Yeah. We we're even more concerned about attack.

We're more concerned about the impact of what happens in a compromise. Stealing data is commonplace, but there's still consequences, you know, when it's PII and things like that. But, you know, also just business continuity.

I mean, just the threat of being hacked now can cause you to pay a ransom without even being hacked. Yeah. I mean, the, the real bottom line is they're asking, am I getting my money's worth?

Mm-Hmm. And you know, Mitchell, I think back to you and I, it's still secure over 20 years ago now, working on those damn ROI calculators remember them. Yeah.

Yeah. Thanks. I didn't believe them then.

I don't believe them now. Well, there's lies, damn. Lies in spreadsheets.

So. Exactly. But, but, you know, inquiring minds wanna know, am I, I'm spending millions of dollars.

This isn't a cottage industry anymore. This is major stuff. And am I getting my money's worth?

Am I getting protection now? Look, we're on the inside. We're security folk.

You and I both know, we we're much more sophisticated about security now than we were in 2005 or 2001. Yeah. Or the 1990s.

Right. But the attack surface, the threats, the level of, of the adversary, you know, they're through the roof, man. Everything, everything has grown more complex.

Mm-Hmm. Everything has grown harder. There's more at stake.

There's a bigger pot of gold for those bad guys to go after. New big questions. How is AI gonna change attackers and our, our capability?

Right. It's gonna change it all for sure. But am I gonna have the budget to buy them and use them?

Companies are saying, you know what, let's slow down. I don't need to buy five new things every year. Mm-Hmm.

And so what does that mean? Does that mean we still need 7,000 of these venture back or public security companies? Does AI security consolidate?

Right. A lot of the legacy stuff that's out there, we're seeing that already. Yeah.

That's been happening. But we'll continue. Right.

What does it mean for the valuations of these high flying security companies, whether they're public or pre IPOI mean, we, while we were at RSA, rumors were flying about Lacework a company that at one point had raised a billion dollar round. I remember covering it on strong TV saying a billion dollar round. Imagine that.

Eight and a half billion dollars valuation. And the rumor was that the Wiz, another high flyer, Israeli security company, was gonna buy them for about $200 million. They have a hundred.

That's a haircut. That's beyond a haircut that's going ball. Yeah.

Um, you know, the, the, the story was that Lacework has about a hundred million dollars in a R and they're selling for 200. Wow. Two times revenue, two times annual reoccurring revenue.

Mm-Hmm. Something something's rotten in Denmark. And then the deal didn't close.

Did it close? Not close. Because Lacework didn't want to sell it.

That did whi the whiz pull out of it. I, I don't know. You know, and I, I am not, I can't speculate here, but Oh, you can if you want to.

But, um, or speculate. Speculate, you know, there, there no, there were rumors and I, I'm not even going to give credence to them about, you know, some of the reasons why that deal didn't go through. But nevertheless, it shows a tremendous deflation of, of, uh, valuations there.

Mm-Hmm. We saw with another company, uh, no names, security. Oh, name.

Yeah. No name five or something, if I remember right. 5 What billion you got.

That's not what it sold for. It sold for about 400 million. 400 million.

Oh, that's right. Okay. Wait, when am I thinking of No, no name.

So no name was like the darling of the API security space. Right? Yeah.

At one point, let's say just three years ago, you had no name security. You had salt. Our friend Michelle McClain was at Salt Security.

Uh, our friends at Traceable who also just announced a small, well, relatively small, rounded 30 million or something, uh, traceable, no name salt. It was another big one. And I'm not, I'm missing it right now.

And then some of the big guys were getting into API security. API security was replacing the web application firewall, WAFs and everything else. No name was a high flyer.

It was a unicorn. I think it was a billion and a half. Maybe it was over.

I know it was over a billion in like 22, if I remember right. Yeah. I mean, it was a unicorn.

It had to be over a billion. Yeah. And now it's sold for 400 billion has, has religion come to Silicon Valley and the VC world.

I think it's interest rates and financial reckoning, you know, or was it irrational, you know, to para to not paraphrase, but to quote, uh, who was it? The, the Fed chair irrational exuberance. Oh, I thought you a Greenspan.

Donald Rumsfeld. No, that's go to Army with the Warrior app. No, it's Alan Greenspan.

It's Alan Greenspan. Right. He killed irrational exuberance.

com bubble Uhhuh. That was the first time I was an internet millionaire. Yes.

Yeah. Thought, woo. Now they're doing right now they're, now they're doing it again to me.

Yeah. Uh, you know, irrational exuberance. And these valuations are coming down.

Um, interestingly, the, the mar the, the overall market is still strong. The NASDAQ's doing well. Yeah.

So public tech companies are doing well and, and a round c round kind of tech companies, you know, real new guys coming out. Maybe they're using AI or whatever. They seem to be raising money at decent valuation.

I have a viewpoint. I I have a kind of soapbox opinion about something. Go ahead.

Climb on board. Mitch, climb on. Let me step up by my soapbox.

Okay, there we go. Okay. Um, you know, I've, I've been looking for, you know, I live in the intersection of security and software, right?

That's been my career. Yep. And, and I can't help it, but stay in both, right?

I can't be just a pure security person. I can't think just purely software. And I, and I see the software industry making exactly the same mistake we made.

It's security, which is create these silos of technology, right? I've got my firewalls, I've got my intrusion prevention, I got my neck, I got my, you fill it out, right? Got another, uh, pizza box that does that appliance.

And, you know, I think, I think security starting or started to get religion about, you know, you can't just sell one more appliance, one more piece of software to do one more thing. You've gotta have, uh, more of a comprehensive security strategy. And that's why, uh, Splunk getting acquired by Cisco makes a lot of sense, right?

And way, a way of tying together a lot of things they already have. But software's doing the same thing, right? I I, we are moving to more platforms for DevOps and things like that, but we still think about security DevSecOps is shifting left, or maybe it's shifting, right?

Or maybe it's shifting everywhere. Or what about supply chain security? But when you set back, it's, this is, all these things are, are tied together.

It isn't just software and software security or infrastructure, infrastructure, security, or network and compute storage, data security. It's all of it, right? And so, I I, I think it, the, the companies that are being undervalued now are such good acquisitions.

'cause they fill in spots. There are gaps or holes that companies have. But the question is, is it in service to something greater?

Or is it just checking a checkbox, right? Are we still checking the checkbox for, would you like fries with that? Oh, we have baked potatoes.

Oh, you don't like that? I can give you chili. You know, you, you tell me what you want.

I've got something on the menu that'll satisfy that, that that's not a meal. Right? That's a fast food restaurant.

So, so that, that's my soapbox is I was at a, uh, a, uh, analyst briefing that was, uh, with, uh, one of very large security companies. And I'd rather not say, 'cause what I'm gonna gonna say here, but that customers on the line, which is great, talking to people who were implementing the products that they had both acquired and already had. And I asked the question, how is what this vendor's doing helping you with your application and your software supply chain security?

And I got a blank for a moment, and I got sort of a one guy chimed in and, and I was trying to be helpful and answer it, but it wasn't a great answer. And then we went on to the next question. And in the process of that question, another person came back and said, I'm thinking about your question that you had here.

Here's what we're doing. Right? And it, it just, what it said to me is, you're selling security for security.

You gotta think about the software you're running on it. The whole thing is integrated together. You know, the, uh, cloud native application is just a distributed app across the network.

It just happened to be running on Kubernetes and a bunch of other servers. They're all APIs going across the internet. So anyway, that, that's my soapbox, is that if we're gonna keep selling individual solutions, we're going to keep adding up the tool chest quantity that we've got.

And then we're gonna say, why do I have 50 when I can need 20? Or I'd like to use 20. Why do I have 20 when I drill like seven, you know, make my life easier.

I'm spinning my world trying to manage all this technology. You, you look at the cyclical nature of this though, Mitchell, we, we saw this, but you mentioned at one time we had firewalls and idss and load balances and routers all sitting at the edge there. And we said, oh, whoa, let's create something called a UTM.

Let's, you know, let's just put one border box up there on super duper one at that. But, uh, a big box. And, and you know what, the whole endpoint thing, there were the whole, whole space.

Let's just do hold space security, server based, boom, you know? Oh, and then, hey, let's make sure our server based security works with our endpoint security and it works at the perimeter. And we saw, you know, and I'm not picking on them, but we saw the rise of like a Sophos, you saw semantic before it was split up.

Go down this route. Yep. Yep.

Uh, Cisco, though they never really got into endpoint. Cisco had a soup to nuts security kind of offering. Palo Alto, Palo Alto starts out as a next gen firewall, right?

They're all over now. Mm-Hmm. So we, we, we have seen this move towards unified platform, if you will, for security, the same way we see it in DevOps, for instance.

Um, to me, that's always the pendulum, right? The one throat to choke versus best of breed. Mm-Hmm.

I think what really brings it home for you though, Mitch and I, I think, you know, and if I'm wrong, correct me, what, what complicates it is there are so damn many categories now of silos of different types of security in this case, right? We're talking security. There are so many different kinds of security that the idea of buying a a point solution for each one of those is my boggling.

Yeah. And you could understand, yeah. Gateway and an application firewall and a web firewall and a, and all of 'em, right?

How many firewalls do I need? Well, now, now that I got all those firewalls, I might as well get a firewall policy manager, right? Music to my friend Johnny Brazil at ERs, right?

Um, but, but you can start to see why people at the exec team and board level are saying, Jesus, another, another security product. Do I need another security product? This is 147.

I didn't understand what the last three did. What's this one? And we still got breached and had to pay ran, no.

Or whatever last year. Screw it. Let's just pay insurance.

But now the insurance, even the cyber insurance people have become the, the enforcers. They won't give you insurance if you don't have this, that, and the other thing. Mm-Hmm.

Right. They're gonna check your underwear. Mm-Hmm.

And, and you see like compliance days, right? Yeah. That's what, and so you back to that.

I don't know what the right answer is, but I just feel like this whole thing has spun up to support more and more companies, more and more different kinds of security, more and more point solutions for more and more money. Let me ask you, do you think it's, is it the VC investment economy that causes that escalation of the number of solutions? Because we get 500 startup companies kicked off with vc?

No. I, I think not to make VC the bad guy of everything. I don't No, they're not the bad guy.

I think they're the symptom, but they're not the sickness. The sickness is every year you go to RSA, what do you ask yourself? What's new?

What's new and what's new? It's gotta be, I need my new shiny Trin kit. I need my new, I need what's new?

I need NextGen. The, the mantra, never less is more. No, it's never, I need more, I need what's new.

Because what's new is better. Mm-Hmm. And, and so knowing that the dcs are also looking for what's new, right?

Imagine going to a VC and say, Hey, I'd like to sell you, I think Mr. vc, you should invest in my company. I have a new DLP, right?

I'm gonna stop data from being taken out of. But nevertheless, I've seen a lot of companies recently, they don't call it DLP, right? But they're going to protect data and make sure data doesn't leave our confines.

Well, they're, it's DLP. Yeah. Yeah.

You know, it grows by any other name. Yep. I agree.

And, um, so that, I think that's, I think that's what's at play there, b***h. It's, so are we gonna sit here next year and say there are 9,000 security companies we can't support more than five. Yes.

We're do that 5,000 tops. We know the answer to that. It doesn't end, you know, but sooner related, the Jenga tower falls in, uh, here's a wrinkle in the, in this time space fabric, um, at our DevSecOps Connect event, the DevOps and ai, DevSecOps and AI that we had at RSAC, one of the, we, we ran a poll during, during the session.

And one of the questions, the last questions was basically because of ai, what's, how much are you gonna have to rethink your security strategy? Is it a sort of wait and see? Is it an evolve with it?

Is it like, tie yourself to what the vendors are are doing? Or is it, I think it's gonna cause us to substantially rethink our security strategy. And a surprising, I don't know if I was surprising or not, but I would say not the majority, but as you, if you grouped them together, more people fell into the, um, it's gonna have a significant, or we're gonna have to stand substantially rethink our security strategy.

This is in the next 18 to 24 months. So it's not very, well, I'm not asking you for five years from now, what do you think you're gonna be working on? Maybe, and I'm not being Pollyanna and, you know, starry-eyed, but maybe AI is the thing that will cause us to rethink it, as opposed to just another shiny object.

Right. And that's another shiny object, another co-pilot. It's another, we have a, we have IML AI in our product.

Don't, can't tell you what it does, but we have it. You know, maybe that's gonna be a spark. Who knows?

It could be. Or it could just open up another, a vista, 20,000 companies. Right?

Right. We can't support more than 15. More than 15.

Oh my God. How crazy. Just a crazy thing.

Anyway, Mitch, we've been on a ran here, but we're probably about outta time for a chat. You know, it is been good therapy, this's helping our recovery. You know what?

I don't know if you guys out there liked it, but for Mitchell and I, look, this was wonderful. We're gonna listen to it five times our ourselves just to Yeah. Get the most out of this.

We can. It helps. Well, we do appreciate some tuning in.

It's, uh, it's fun for us to do this. Alan and I used to do this on the road all the time, whether we, whatever city we're in, we record a podcast. And, uh, we usually were a little drunk until you lost the podcast equipment.

But until there was that time, was that I shall never forget. Thanks to you. Well, I won't let you.

Um, it's worthy of not forgetting. So we better wrap it up. Absolutely.

We, let's wrap it. Mitch, we thank everybody, uh, uh, for joining us. Um, we're gonna put a link into one of our surveys that we're doing right now, but AI and DevOps into the description.

We'd love for you to fill that out. If you would help us with your research, please do. That'd be fantastic.

So in the meantime, brother out, this is Ben, Mitch Ashley and Alex Shival, and you've been listening to another episode of a chat on the Boulevard, security Boulevard chat. I messed you up there, Mitch. Take care everyone.

We'll see you next week. All right folks, we'll see you next episode. Byebye.