Predict Redux – Techstrong Research Review EP 12

here Hi everybody. This is Mike Rothman or a worn out my Grossman I guess is the best way to put it head of text wrong research. Chief strategy officer text wrong group and again kind of still in that predict hangover.

So so we're recording the day after predict. I'm joined as always by my partner in crime Mitch Mitch. Say hello.

Say hello. I said hello. Yes the same boat.

This is like, you know the Finish Line at the marathon where they just kind of collapse and bring them water and put a blanket around him and it's sort of where we're special you you did the biggest lifting on all this or like, you know, principal with dick strong research. That's so welcome Mitch and you know, it's just like I guess yesterday afternoon, right? I kind of had this, you know feeling like Luca Don chick after you had that triple double with 61 points and he's just like I need to celebratory beer.

It was just like yes about that one exactly. So we came back a little last night and enjoyed it, but I think today you know, what we want to do is one. Your ball thank everybody that you know kind of joined in with predict.

It was really fantastic. We had you know, almost 2500 people register for the event. We got some great feedback just on on the agenda on the panelists on the trends.

So we released our 2023 text wrong research Trends yesterday in the four areas of devops cloud native cybersecurity and digital transformation. So we got some great feedback and and a lot of downloads on those so that's great just to get a sense of where we're going. But I think what we wanted to do today is, you know, I'm not just you know, kind of recap it, you know, the live stream is available.

The recorded version is available up on the side. So if you're registered go check it out if you missed one of the sessions if you haven't you still have time right you can register on the side and and check out any of the sessions that made sense to you, but there were a couple of things that you know, kind of really resonated out of the panels that Either I participated in or I saw and and I want to kind of dig into into those a little bit so submit. I don't know if you wanted to go first and talk about the stuff that or first of all your impressions of predict.

You know, let's kind of start there, you know, you you've finished something that you and everyone you you especially working really hard on and feel like it went really well. So I felt very satisfied after about how things went yesterday mostly from the reaction from the attendees and especially the panels the people that were there with us. Which was kind of leads me to my first first thing.

I wanted to highlight is, you know, I was covering Cloud native primarily and one of the big things we talked about is the complexity and how we deal with that center. It's you know, establishing senators of expertise and different things that are trans document go download it you can find out so that's a good ideas. There are two sessions and special the second one that I did which was the Long March.

I love our of our transdoc. He had soccer Engineers from Cisco from Dell. Okay, and I haven't had that before on a panel with the consultant really really seasoned senior software architect Enterprise architect and myself and they just kind of took off it was sort of like someone who lift the rods out of the reactor and it just chain reacted.

You know it was going that kind of keep an eye on the meters here to make sure you know, we aren't gonna fly off the digital stream or something but point being is they were debating this whole complexity issue and they were debating. It not as is kubernetes complex to set up and those kinds of issues. They were debating it as okay.

Well monoliths are complex. But if we go and create thousands tens of thousands more microservices and we don't know what the heck they are, you know, you start out with five or ten or whatever and that suddenly you've got 10,000. How do you manage that?

You've sort of unless least a different beast. And where's that happy medium? And how do we how do we figure out guardrails or best practices?

We kind of land on this idea of software patterns for cloud native for microservices something really that's really needed. Yeah, and also Tracy Reagan brought up in one of the panels some of who's on a lot of our shows the Year of domain driven design teams forming around certain areas of kind of functions or domains part of the applications and working together on it that way try to minimize the sprawl if you know, that sounds great. If I have a couple hundred developers right in a shared services group and I can you know, and I can fund a center of excellence and all that if I'm a small team right?

I want to start to embrace some of these Technologies because they're gonna help me accelerate my ability to get to Market and to build things. I mean how I do that right? I mean, you know, so again, I appreciate that but to me when we were working on the transmit, right it was you know, the Long March but it really was about what can we do to whether it was standardized the distributions.

That was one of the key things that you were focused on I was focused on a lot of the you know, kind of commercial tools that can really start to ease both deployment as well. As a lot of the Enterprise type features you need right, you know back up and reliability and networking and and these things that need to be able to be configured and done, you know, without somebody having a role their sleeves up and you know, go to work right or you know, put the mask on and go into surgery right? I mean you just don't have that option.

If you're a small type of organization to me. Those are really the you know, kind of Arbiters of you know, maturity and the ability for you know, normal companies, right not, you know, very tech-centric companies to be able to embrace this stuff. Well for every problem there are some set of entrepreneurs Start a company to solve it.

Oh, yeah. What's interesting is that is happening in this space? And when one path is like Frameworks software developers are very familiar with Frameworks.

And now now there are products and hosting environments, you know, you can do your whole team kubernetes, but around an application framework for some management capabilities not just a kubernetes, but trying to control or keep repositories for all that stuff. I don't know it's not the answer yet. But you know, we it always happens.

Right? We we adopt a new technology. This is a great idea.

We need to do this people jump on the bandwagon. We do it over and over again and then we say well by the way, are we going to secure that now we're gonna operate that and now how are we going to manage it? Because there's so much of it.

So we're in this cycle again of Okay for it not to become you know crater in on itself. Because all of all of its great benefits, but all of its side effects. Yeah, that's where we are.

Right? No that that's right. And and I think it really it just goes to Where we are in the adoption curve, right and and the early folks.

They can dedicate the resources. They have the technical expertise. They can figure it out.

They can be the general contractors and it works out great for them. But in order to become like the lamp stack, right, I mean that was the analogy we used in the trends document. You need that other stuff, right?

You need the provider whether it was some of the precursors to you know, digital Ocean or you know, or you know, one of these other ones where you can basically just go click right and and it deploys WordPress on your lamp stack, right? And and and I think that's really, you know, kind of what we're looking for in 23 to start to emerge around Cloud native and I think that was a great observation and you keep saying you're you're slacking me in the middle of the session. Oh my God, this thing is great.

And I was actually doing my own session just like damn I can't go so that's one of the ones I'm gonna you. I'll check out when I have some Cycles this afternoon and I can get into the into the recorded version of the session with what happens when four software Engineers from Del Cisco consultant and and in a startup go into a bar. This is what happens.

Yeah, that's right. That's right. So what was interesting on mine, you know, so I did kind of the software supply chain, you know a software security panel and I have a bunch of great folks on it as well.

Right, you know Tanya junka who's you know, kind of a developer Advocate kid, I had, you know, David DeSanto from get lab. He's be a product over there. I had Jeff Williams, right CTO of contrast and John Pescatore who's you know, that doesn't even need to be introduced at this point.

Right? But he's been it's don't have much to say about a lot of things right and a gardener is doing a garden for many years as well. But one of the interesting things that Jeff had pointed out because you know, we all use this concept that applications or mostly composed and we're assembly using you know resources And libraries and components and you know services from other folks and Jeff is like that's a common misnomer right?

Because we do a ton of analysis on applications and we find that if you look at the total amount of code, that's probably right but he said 90% of the stuff that you know kind of pulled into an application upon integration is not used right. He said, you know, if you look at the libraries and and kind of the components that are used it's probably 70% custom development maybe 30% right, you know open source of these other libraries. So everybody's so focused on you know, kind of SCA and and right software component out or softer composition analysis and some of these other, you know Technologies, but we're not spending enough time, you know, really kind of helping to make the application right more robust right make the application more secure and obviously Jeff where he's coming from right is all about, you know, I asked and runtime protection and I mean listen He's a zealot for that because he invented a lot of you know kind of those Technologies.

So I totally get it from from that perspective. But it just that that data point was was interesting because I was listening to the RSA session, you know, right after mine where they talked about, you know kind of Trends, you know, in terms of submissions for the conference and one of one of the conference, you know kind of organizing committee was talking about exactly that we compose applications and it's all about you know, and it was just I I kind of way to a little bit of you know, kind of vertigo. They're like, oh where am I because you got two totally different data points from from different folks.

So I thought that was really interesting. And again, I don't have data, you know, kind of know definitely what you know, what the right answer is and honest I don't know that it matters because you want to secure the stuff that you're ingesting and you want to secure the stuff that you're building all the same right? But it was just it was an interesting point counter point that you know kind.

We got from again just the the differing levels of opinion and differing, you know, kind of folks that we brought all together for predict yesterday. It's a spot on issue because I mean I could give you a real simple example like an iPhone if you want to generate a random number there's a package for that I guess so you use it one way and you're done right? You call it this way here but the range I want whatever and there's you know, who knows dozens other functionality classes Etc in it.

You never know you never use but that is all part of your app and part of your environment there you never respond to you. So is it really vulnerable if it's got a vulnerability in it, maybe but maybe not maybe never get it executor of be able to get touch. So you're right it is there's a lot of weight maybe dead weight becomes with code that we use right and just point it and and you know, David and Tanya, you know, you know focused on this as well was you know, really the context of You're using the code within the application because we went back and forth about you know, how do you secure the pipeline?

How do you get developers to take all this stuff? Seriously, is there stuff that you need to do with security folks in order to make it easier for them the whole, you know shift left versus shift right concept and I think everybody agreed that it should be shift everywhere, you know on that, but it was just it was it was a really interesting and I think useful discussion. Um, just because you know, again you had a number of different counter points in there and I wouldn't say they were heated discussions, but you know, again folks definitely had perspectives and they weren't necessarily the same and when Jeff talks everybody listens, right?

I mean, here's the Creator one the creators of oh, yeah and right. So yeah, that's right. I've been on I've been on panels with them where some of the other panelists not that I don't respect to my totally do but they were kind of been Fanboy mode like God.

Yeah, you know, and there was one other point so we did want to kind of Around to the whole regulation piece of it and there was one point that John Pescatore brought up which I thought was was really great. He said, you know, listen if we really wanted to improve software security. We would make the companies that you know, kind of ship it liable for you know, what happens with their code.

We said that would solve the problem in about a hot minute right? You said, you know, we've done that and all sorts of other things. You know, you got Health Care you got you know Financial Services you got if the company has liability then they take these things a lot more seriously says, I don't think we're gonna get there which really means we're not gonna get there right because of whether it's lobbying or you know, again, it's just too complicated on that front to figure out who is liable given how a lot of these applications are built in one way shape or form but you know, he said, you know again the next best thing is to is to really start thinking about forcing folks to look at the componentry forcing folks to you know, really start to evaluate how these things are built.

So he was pretty supportive of the direction that you know, kind of the The US federal government is going but you know, I also thought it was interesting that you know, he's just like listen if you want to solve the problem just you know, make me folks put some real skin in the game he goes and and they would fix that pretty quickly well and we have a pattern. I mean people would and they don't ask me anymore. But used to ask me like when does all this credit card data theft gonna stop happening because it seems like it happens more frequently every day.

And absolutely it's never gonna stop until the consequences are significant not their customers walk away or they get penalized a lot more money than any fines are paying now. It's just you know, it's like it's like credit card death when you lose a credit card and somebody steals and buy stuff. Yeah you pay for it, but they don't, you know, the class is passed on you.

It's just there's no there's no consequences or enough significant to change Behavior. So yeah, they don't eat that with software, right? That's right.

That's right. So what else do you did any other you know kind of big ones because I've got one more after I'm glad jump in I because there's something that was I want to bring up at the end. Yeah, so, you know, the other thing is is you know, sometimes you just kind of come up with terms because you're like yeah, you know based on what I know and where it's gone, you know, this just seems to make sense.

So so one of the things that we wrote in the trend document is you know for in in the security Trends right about you know, kind of visibility and and trying to you know improve you know, how and what's happening in your environment. I came up with this term xspm, right? Because we've got class security posture management.

We've got security data security soon will be identity. You know security. I have somebody in written application security for you know, kind of a scanner type of things.

I just, you know get it since that's Dr. And next everything. So I just, you know, figured we just call it excess PM.

I was actually a company kickoff this week earlier before we did predict and and they're you know to what some degree of visibility company and they're starting to use the term access PM as well because they've got stuff Networks and and you know kind of cloud and and some application things and it was just funny because we totally had not talked about it at all. They didn't know you know kind of that was one of the things that I would be pitching, you know, I was there. So it was just what it was one of those things where it was just so obvious, you know, kind of in hindsight that you know, we're we're going to see a lot of folks kind of talking about access PM, you know kind of this year because again it is it is a platform play.

It's something that you know, all the vulnerability management guy should be doing so won't be long before, you know, they call their visibility platforms, you know access PM. It's not a new gaming computer from Alienware. It's not it's not nothing that you know, it doesn't run cool games.

It doesn't have Madden so it's just but so what so what I wanted to bring up the end. Yeah, I've waxed on I try to control myself about it. You know, we need to really do do something different in security to take it to the next level about how we're gonna secure these applications and shift left or whatever and during the conversation with the software Architects.

I'm cloud-natives along March. One of one of them we Atchison just said, you know, we really have to rethink how we describe software. This is my paraphrase because yes, we used to make the library calls and classes and all the stuff that we're software constructs and now, you know, all that stuff happens the age yes through microservice what we really have it's not service.

Mesh. It's a network. We're talking all these modules over it work.

And security people understand that right? That's what they deal with all the time. So so that spark to me like mmm.

Okay, so maybe we can make the right kind of analogy between this is just like, you know, this is going over Port 80. This is what they're doing and instead of boxes is the pieces of code talking to each other. Maybe there's a point of entree to help the conversation take a step to further between software and and with software and and security Engineers, so It's a lot of thing said that just kind of stuck with me is like that's an interesting.

Yeah, yeah now I think in general, I mean I again I think that there are a lot of different, you know, interesting thoughts. So one other thing, you know kind I was listening in an Allen's one Allen's talks and one of his Palace Emma Keith was literally in Europe about to go skiing, right? He came off the mountain so he's in the car.

You see the skis behind him. He's got his ski gear on you know, like well, that's a pretty good gig. I don't how do I get that game right now, but not that yeah, not that I get that good.

But you know Alan was talking about just you know, kind of how do macroeconomic things and we're gonna start to see some pushback on, you know, kind of some digital transformation efforts and and it was like, I haven't seen that it's like I haven't seen you know, kind of push back in the economy seem to be pretty bad. But you know, we haven't seen at least and he works for inside Partners, right, you know, just a huge private Equity investor and and a lot of different technology sectors. They're investing in companies that you know continue to grow they're really amazing and almost, you know kind of a, you know, kind of late stage investor on that.

But I thought that was also an interesting, you know, tidbit that you know, we all kind of just assumed like we assume that all applications are composed now, we just assume because a lot of people have said it that you know kind of companies are really gonna pull back on their digital transformation. I think we continue to expect that that is what kind of our research yields but it was interesting to get a little bit of a Counterpoint from you know, somebody who's seeing it from a little bit of a different perspective as well. Right?

It is just start us that they're investing in, you know, their companies sometimes acquired sometimes more mature startups. I heard that too and it was jealous location. You know, it remind me of is is you know, when when things are tough You Know You're Going Through The Crucible of okay.

What are we really gonna do? And what are we really gonna get? It doesn't you ain't May shed cost of may involve people and other things but you don't roll up the tent and fold up the carpet right on everything, right?

Nobody survives by doing nothing, you know, at least I don't know anybody. You've got it. You've got to you know, not just keep trains rolling but you've got to keep now.

That's that's right because you if you shut all down all your research down all your investment. It isn't when you started back up. Then things will be better it is Two and a half three years after you've started up your back to where you were.

So that flywheel takes a long time to get spinning back up to that same place. You can't stop completely. You just have to get better at what you're doing.

That's right. That's right. And and I think you need to be more selective about what you invested.

Right? You can't stop investment, but you can't invest in everything either. So so that involves, you know, some tough choices that companies have to make that involve some work that these teams have to make to really again position the accreditive value to the business for a number of these new initiatives, right?

And because again, you're just not gonna get everything funded. So so you've got to figure out what the you know, right mix is gonna be so it's interesting. Yeah.

I thought just a very, you know, kind of great great day. I thought the great sessions. I don't know if anybody in the audience spend some time with the fortune teller, but you know, I I, you know, she was pretty entertaining for me.

So so that was great, hopefully Her you know next time good news. You're in a good mood. So, yeah, and and I think that we learned a lot right?

We learned a lot. So as we continue to move forward and we've got a cyber-oriented conference that we're going to do, you know kind of in the fall time frame and and we're learning in terms of how to you know, kind of have Research Drive a lot of our you know, kind of shows so we're gonna keep improving through the year and and I can tell you predict 24 will be Better right because we'll be able to improve on a number of the things that we've already done. Well, and and we said this in our wrap up with Alan at the end of the day, but you know, it's it's not just surveys and polls.

Yes. We do all those things together some data that our interactions both with directly with people also understanding what they're reading and what's happening with their watching on our show and others, you know, that that massive audience that we have which is it's a privilege to have it is driving what we're doing. It isn't it likes the smartest guy.

He might be the smartest guy. I'm not the smartest guy. That's for sure.

But we're it's driven by all of those factors. Not just us cooking something up in the back room and let's go come up with a you know, a new wacky quadrant or a weird wave that has some extra unknown cookie formally nobody knows about and spoof suddenly. We're really smart people it isn't it?

It's not driven by that. Hopefully we've got some smarts but it is it's an answering experience and some road rash for sure. Yeah some smarts left.

I guess it's not been knocked out of our heads but point being is I consider the success of yesterday. Driven by all that all those things behind it including the team at text drawing to make it happen, but our audience the half a million people engaging with us. Wait, what a flywheel that is and that's I think that's a big part of that success.

Yep. And and you know, we kind of took the the wraps a little bit off of our new success map offering so keep an eye out for that that'll you know, get we're planning to have that hit in Q2 be a lot of work to get that up up and running, but we're really excited about that and again, you know, It's the day after predict. We're both a little bit cooked.

So we're gonna you know, kind of cut it off here, but hopefully you enjoyed it. If you haven't seen the show go register check out the the recorded versions of it again, I think it's really worth your time. com is where you'll find predict.

It'll be now or in the next day it'll be moved over to the prior events recent events. But we also you and I are gonna be in Singapore for Devon stations are that's right yourself, February 10th is in Singapore live. So Alan Mitch myself number of other Tech strong folks will be there as well.

So that that'll be fun. That'll be fun. We're doing our software security pitch, you know dig in and talk about software security and there's just a whole bunch of other great sessions about really devops and looking at it, you know again with the with a little bit of an Asian tint on it from that part of the world for sure.

And then also if you check on Chuck strong events grab Tech strong con Which is another kind of very outcome focused conference that's on March 16th. So be sure and then we'll be at RSA. So we got a number of events that we're going to be, you know, be being part of and both Tech strong and others that we're happy to join and of course we have our show so watch this tell your friends about about Mike and Mitch and you know, these two characters that I talk about what they're working on and what there's exactly and we appreciate you sharing the love and help this build that audience so like I'm promoting yourself somebody should we forget to do that sometimes or I forget to do that sometimes so yeah good.

All right Mitch. Enjoy. We will chat next week.

You're you're gonna see this a little bit further down the line. So, you know, it'll it'll be next week for for you guys will we'll record it again, and I'm sure we'll have something a little bit more timely to deal with but you get thanks everybody and we will see you next time you