>>Hello, Ron. Welcome to AWS reinforce here. Live in Boston, Massachusetts. I'm John feer, host of the cube. We're here at Carl Matson. CSO at no name security. That's right, no name security, no name securities, also a featured partner at season two, episode four of our upcoming eightish startup showcase security themed event happening in the end of August. Look for that at this URL, AWS startups.com, but we're here at reinforc Carl. Thanks for joining me today. Good to see >>You. Thank you for having us, John. >>So this show security, it's not as packed as the eight of us summit was in New York. That just happened two weeks ago, 19,000 people here, more focused crowd. Lot at stake operations are under pressure. The security teams are under a lot of pressure as apps drive more and more cloud native goodness. As we say, the gen outta the bottle, people want more cloud native apps. Absolutely. That's put a lot of pressure on the ops teams and the security teams. That's the core theme here. How do you see it happening? How do you see this unfolding? Do you agree with that? And how would you describe today's event? >>Well, I think you're, you're spot on. I think the, the future of it is increasingly becoming the story of developers and APIs becoming the hero, the hero of digital transformation, the hero of public cloud adoption. And so this is really becoming much more of a developer-centric discussion about where we're moving our applications and, and where they're hosted, but also how they're designed. And so there's a lot of energy around that right now around focusing security capabilities that really appeal to the sensibilities and the needs of, of modern applications. >>I want to get to know name security a second, and let you explain what you guys do. Then I'll have a few good questions for you to kind of unpack that. But the thing about the structural change that's happened with cloud computing is kind of, and kind of in the past now, DevOps cloud scale, large scale data, the rise of the super cloud companies like snowflake capital, one there's examples of companies that don't even have CapEx investments building on the cloud. And in a way, our, the success of DevOps has created another sea of problems and opportunities that is more complexity as the benefits of DevOps and open source, continue to rise, agile applications that have value can be quantified. There's no doubt with the pandemic that's value there. Yeah. Now you have the collateral damage of success, a new opportunity to abstract away, more complexity to go to the next level. Yep. This is a big industry thing. What are the key opportunities and areas as this new environment, cuz that's the structural change happening now? Yep. What's the key dynamics right now. That's driving this new innovation and what are some of those problem areas that are gonna be abstracted away that you see? >>Well, the, the first thing I I'd suggest is is to, to lean into those structural changes and take advantage of them where they become an advantage for governance, security risk. A perfect example is automation. So what we have in microservices, applications and cloud infrastructures and new workloads like snowflake is we have workloads that want to talk, they want to be interoperated with. And because of that, we can develop new capabilities that take advantage of those of those capabilities. And, and so we want to have on our, on our security teams in particular is we wanna have the talent and the tools that are leaning into and capitalizing on exactly those strengths of, of the underlying capabilities that you're securing rather than to counter that trend, that the, the security professional needs to get ahead of it and, and be a part of that discussion with the developers and the infrastructure teams. >>And, and again, the tructure exchange could kill you too as well. I mean, some benefits, you know, data's the new oil, but end of the day it could be a problematic thing. Sure. All right. So let's get that. No names talk about the company. What you guys do, you have an interesting approach, heavily funded, good success, good buzz. What's going on with the company? Give the quick overview. >>Well, we're a company that's just under three years old and, and what APIs go back, of course, a, a decade or more. We've all been using APIs for a long time, but what's really shifted over the last couple of years is the, is the transition of, of applications and especially business critical processes to now writing on top of public facing APIs where API used to be the behind the scenes interconnection between systems. Now those APIs are exposed to their public facing. And so what we focus on as a company is looking at that API as a, as a software endpoint, just like any other endpoint in our environments that we're historically used to. That's an endpoint that needs full life cycle protection. It needs to be designed well secure coding standards for, for APIs and tested. Well, it also has to be deployed into production configured well and operated well. And when there's a misuse or an attack in progress, we have to be able to protect and identify the, the risks to that API in production. So when you add that up, we're looking at a full life cycle view of the API, and it's really it's about time because the API is not new yet. We're just starting to now to apply like actual discipline and, and practices that help keep that API secure. >>Yeah. It's interesting. It's like what I was saying earlier. They're not going anywhere. They're not going, they're the underpinning, the underlying benefit of cloud yes. Cloud native. So it's just more, more operational stability, scale growth. What are some of the challenges that, that are there and what do you guys do particularly to solve it? You're protecting it. Are you scaling it? What specifically are you guys addressing? >>But sure. So I think API security, even as a, as a discipline is not new, but I think the, the, the traditional look at API security looks only at, at the quality of the source code. Certainly quality of the source code of API is, is sort of step one. But what we see in, in practices is most of the publicly known API compromises, they weren't because of bad source code that they because of network misconfiguration or the misapplication of policy during runtime. So a great example of that would be developer designs, an API designs. It in such a way that Gar that, that enforces authentication to be well designed and strong. And then in production, those authentication policies are not applied at a gateway. So what we add to the, we add to the, to the conversation on API security is helping fill all those little gaps from design and testing through production. So we can see all of the moving parts in the, the context of the API to see how it can be exploited and, and how we can reduce risk in independent of. >>So this is really about hardening the infrastructure yep. Around cuz the developer did their job in that example. Yep. So academic API is well formed working, but something didn't happen on the network or gateway box or app, you know, some sort of network configuration or middleware configuration. >>Absolutely. So in our, in our platform, we, we essentially have sort of three functional areas. There's API code testing, and then we call next is posture management posture. Management's a real thing. If we're talking about a laptop we're talking about, is it up to date with patches? Is it configured? Well, is it secure network connectivity? The same is true with APIs. They have to be managed and cared for by somebody who's looking at their posture on the network. And then of course then there's threat defense and run time protection. So that posture management piece, that's really a new entrant into the discussion on API security. And that's really where we started as a company is focusing on that sort of acute gap of information, >>Posture, protection, >>Posture, and protection. Absolutely >>Define that. What does that, what does posture posture protection mean? How would you define that? >>Sure. I think it's a, it's identifying the inherent risk exposure of an API. Great example of that would be an API that is addressable by internal systems and external systems at the same time. Almost always. That is, that is an error. It's a mistake that's been made so well by, by identifying that misconfiguration of posture, then we can, we can protect that API by restricting the internet connectivity externally. That's just a great example of posture. We see almost every organization has that and it's never intended. >>Great, great, great call out. Thanks for sharing. All right, so I'm a customer. Yep. Okay. Look at, Hey, I already got an app firewall API gateway. Why do I need another tool? >>Well, first of all, web application firewalls are sort of essential parts of a security ecosystem. An API management gateway is usually the brain of an API economy. What we do is we, we augment those platforms with what they don't do well and also when they're not used. So for example, in, in any environment, we, we aspire to have all of our applications or APIs protected by web application firewall. First question is, are they even behind the web? Are they behind the w at all? We're gonna find that the WAFF doesn't know if it's not protecting something. And then secondary, there are attack types of business logic in particular of like authentication policy that a WAFF is not gonna be able to see. So the WAFF and the API management plan, those are the key control points and we can help make those better. >>You know what I think is cool, Carl, as you're bringing up a point that we're seeing here and we've seen before, but now it's kind of coming at the visibility. And it was mentioned in the keynote by one of the presenters, Kurt, I think it was who runs the platform. This idea of reasoning is coming into security. So the idea of knowing the topology know that there's dynamic stuff going on. I mean, topes aren't static anymore. Yep. And now you have more microservices. Yep. More APIs being turned on and off this runtime is interesting. So you starting to see this holistic view of, Hey, the secret sauce is you gotta be smarter. Yep. And that's either machine learning or AI. So, so how does that relate to what you guys do? Does it, cuz it sounds like you've got something of that going on with the product. Is that fair or yeah. >>Yeah, absolutely. So we, yeah, we talked about posture, so that's, that's really the inherent quality or secure posture of a, of an API. And now let's talk about sending traffic through that API, the request and response. When we're talking about organizations that have more APIs than they have people, employees, or, or tens of thousands, we're seeing in some customers, the only way to identify anomalous traffic is through machine learning. So we apply a machine learning model to each and every API in independently for itself because we wanna learn how that API is supposed to be behave. Where is it supposed to be talking? What kind of data is it supposed to be trafficking in, in, in all its facets. So we can model that activity and then identify the anomaly where there's a misuse, there's an attacker event. There's an, an insider employee is doing something with that API that's different. And that's really key with APIs is, is that no, a no two APIs are alike. Yeah. They really do have to be modeled individually rather than I can't share my, my threat signatures for my API, with your organization, cuz your APIs are different. And so we have to have that machine learning approach in order to really identify that >>Anomaly and watch the credentials, permissions. Absolutely all those things. All right. Take me through the life cycle of an API. There's pre-production postproduction what do I need to know about those two, those two areas with respect to what you guys do? >>Sure. So the pre-production activities are really putting in the hands of a developer or an APSEC team. The ability to test that API during its development and, and source code testing is one piece, but also in pre-production are we modeling production variables enough to know what's gonna happen when I move it into production? So it's one thing to have secure source code, of course, but then it's also, do we know how that API's gonna interact with the world once it's sort of set free? So the testing capabilities early life cycle is really how we de-risk in the long term, but we all have API ecosystems that are existing. And so in production we're applying the, all of those same testing of posture and configuration issues in runtime, but really what it, it may sound cliche to say, we wanna shift security left, but in APIs that's, that's a hundred percent true. We want to keep moving our, our issue detection to the earliest possible point in the development of an API. And that gives us the greatest return in the API, which is what we're all looking for is to capitalize on it as an agent of transformation. >>All right, let's take the customer perspective. I'm the customer, Carl, Carl, why do I need you? And how are you different from the competition? And if I like it, how do I get started? >>Sure. So the, the, the first thing that we differentiate selves from the customer is, or from our competitors is really looking at the API as an entire life cycle of activities. So whether it's from the documentation and the design and the secure source code testing that we can provide, you know, pre-development, or pre-deployment through production posture, through runtime, the differentiator really for us is being a one-stop shop for an entire API security program. And that's very important. And as that one stop shop, the, the great thing about that when having a conversation with a customer is not every customer's at the same point in their journey. And so if, if a customer discussion really focuses on their perhaps lack of confidence in their code testing, maybe somebody else has a lack of confidence in their runtime detection. We can say yes to those conversations, deliver value, and then consider other things that we can do with that customer along a whole continuum of life cycle. And so it allows us to have a customer conversation where we don't need to say, no, we don't do that. If it's an API, the answer is, yes, we do do that. And that's really where we, you know, we have an advantage, I think, in, in looking at this space and, and, and being able to talk with pretty much any customer in any vertical and having a, having a solution that, that gives them something value right away. >>And how do I get started? I like it. You sold me on, on operationalizing it. I like the one stop shop. I, my APIs are super important. I know that could be potential exposure, maybe access, and then lateral movement to a workload, all kinds of stuff could happen. Sure. How do I get started? What do I do to solve >>This? Well, no name, security.com. Of course we, we have, you know, most customers do sandboxing POVs as part of a trial period for us, especially with, you know, being here at AWS is wonderful because these are customers who's with whom we can integrate with. In a matter of minutes, we're talking about literally updating an IAM role. Permission is the complexity of implementation because cloud friendly workloads really allow us to, to do proofs of concept and value in a matter of minutes to, to achieve that value. So whether it's a, a dedicated sandbox for one customer, whether it's a full blown POC for a complicated organization, you know, whether it's here at AWS conference or, or, or Nona security.com, we would love to do a, do a, like a free demo test drive and assessment. >>Awesome. And now you guys are part of the elite alumni of our startup showcase yep. Where we feature the hot startups, obviously it's the security focuses episodes about security. You guys have been recognized by the industry and AWS as, you know, making it, making it happen. What specifically is your relationship with AWS? Are you guys doing stuff together? Cuz they're, they're clearly integrating with their partners. Yeah. I mean, they're going to companies and saying, Hey, you know what, the more we're integrated, the better security everyone gets, what are you doing with Amazon? Can you share any tidbits? You don't have to share any confidential information, but can you give us a little taste of the relationship? >>Well, so I think we have the best case scenario with our relationship with AWSs is, is as a, as a very, very small company. Most of our first customers were AWS customers. And so to develop the, the, the initial integrations with AWS, what we were able to do is have our customers, oftentimes, which are large public corporations, go to AWS and say, we need, we need that company to be through your marketplace. We need you to be a partner. And so that partnership with, with AWS has really grown from, you know, gone from zero to 60 to, you know, miles per hour in a very short period of time. And now being part of the startup program, we have a variety of ways that a customer can, can work with us from a direct purchase through the APS marketplace, through channel partners and, and VA, we really have that footprint now in AWS because our customers are there and, and they brought our customers to AWS with us. >>It's it nice. The customers pulls you to AWS. Yes. Its pulls you more customers. Yep. You get kind of intermingled there, provide the value. And certainly they got, they, they hyperscale so >>Well, that creates depth of the relationship. So for example, as AWS itself is evolving and changing new services become available. We are a part of that inner circle. So to speak, to know that we can make sure that our technology is sort of calibrated in advance of that service offering, going out to the rest of the world. And so it's a really great vantage point to be in as a startup. >>Well, Carl, the CISO for no name security, you're here on the ground. You partner with AWS. What do you think of the show this year? What's the theme. What's the top story one or two stories that you think of the most important stories that people should know about happening here in the security world? >>Well, I don't think it's any surprise that almost every booth in the, in the exhibit hall has the words cloud native associated with it. But I also think that's, that's, that's the best thing about it, which is we're seeing companies and, and I think no name is, is a part of that trend who have designed capabilities and technologies to take advantage and lean into what the cloud has to offer rather than compensating. For example, five years ago, when we were all maybe wondering, will the cloud ever be as secure as my own data center, those days are over. And we now have companies that have built highly sophisticated capabilities here in the exhibit hall that are remarkably better improvements in, in securing the cloud applications in, in our environments. So it's a, it's a real win for the cloud. It's something of a victory lap. If, if you hadn't already been there, you should be there at this point. >>Yeah. And the structural change is happening now that's clear and I'd love to get your reaction if you agree with it, is that the ops on security teams are now being pulled up to the level that the developers are succeeding at, meaning that they have to be in the boat together. Yes. >>Oh, lines of, of reporting responsibility are becoming less and less meaningful and that's a good thing. So we're having just in many conversations with developers or API management center of excellence teams to cloud infrastructure teams as we are security teams. And that's a good thing because we're finally starting to have some degree of conversions around where our interests lie in securing cloud assets. >>So developers ops security all in the boat together, sync absolutely together or win together. >>We, we, we win together, but we don't win on day one. We have to practice like we as organizations we have to, we have to rethink our, we have to rethink our tech stack. Yeah. But we also have to, you have to rethink our organizational models, our processes to get there, to get >>That in, keep the straining boat in low waters. Carl, thanks for coming on. No name security. Why the name just curious, no name. I love that name. Cause the restaurant here in Boston that used to be of all the people that know that. No name security, why no name? >>Well, it was sort of accidental at, in the, in the company's first few weeks, the there's an advisory board of CISOs who provides feedback on, on seed to seed companies on their, on their concept of, of where they're gonna build platforms. And, and so in absence of a name, the founders and the original investor filled out a form, putting no name as the name of this company that was about to develop an API security solution. Well, amongst this board of CSOs, basically there was unanimous feedback that the, what they needed to do was keep the name. If nothing else, keep the name, no name, it's a brilliant name. And that was very much accidental, really just a circumstance of not having picked one, but you know, a few weeks passed and all of a sudden they were locked in because sort of by popular vote, no name was, >>Was formed. Yeah. And now the legacy, the origination story is now known here on the cube call. Thanks for coming on. Really appreciate it. Thank you, John. Okay. We're here. Live on the floor show floor of AWS reinforced in Boston, Massachusetts. I'm John with Dave ALO. Who's out and about getting the stories in the trenches in the analyst meeting. He'll be right back with me shortly day tuned for more cube coverage. After this short break.

(theme music) >> Okay, welcome back everyone, theCUBE's live coverage here in Boston, Massachusetts for AWS re:Inforce '22. Big show for ground security, Amazon re:Invent's coming up. That's the big event of all time for AWS. re:MARS was another one, re:Inforce, the re:Shows, they call them, theCUBE's got you covered. I'm John Furrier, host of theCUBE with Dave Vellante, who's in an analyst session right now. He'll be back shortly. We've got 2 great guests from an amazing company, HackerOne, been on theCUBE many times, (mumbles) Marten Mickos, of course, a big time, (mumbles) We got two great guests. Sean Ryan, Sr. Principal Product Marketing Manager Will Kapcio, Senior Sales Engineer. Gents, welcome to theCUBE. >> Thanks for having us John. >> So Marten's been on many times, he's such a character. He's such a legend. >> Yeah. >> Your company has had great traction, great community, just this phenomenal example of community meets technology and problem solver. >> Yeah. >> He's been part of that organization. Here at re:Inforce they're just kind of getting wind of it now, right? You hear an open, teamwork, breaking down the silos, a big theme is this whole idea of open community, but yet be hardcore with the security. It's been a big part of the re:Inforce. What do you guys think of the show so far? >> Loving it. Partly too, we're both local here in the Boston area. So the commute was pretty nice. (everyone laughs) And the heat wave broke the other day so that's wonderful, but yeah, great show. It's good to be back in person doing this kind of stuff and just, it's really lively. You get a lot of good energy. We've had a bunch of people stopping by trying to learn what we're all about and so, it's really fun. Great show so far. >> And you guys have a great company. Take a minute to explain for the folks who may not know HackerOne. Tell them what you guys do real quick in one minute. >> Okay, the quick elevator pitch. (chuckles) So really we're making the internet safer using a community of ethical hackers. And so our platform enables that so we can skill match the best talent that's out there around the world to help find all the vulnerabilities that your company needs to discover. So you can plug those holes and keep yourself safe. >> So in an era of a talent gap, Will, you know the technologies out there, but sometimes the skills are not there. So you guys can feel the void kind of a crowdsourced vibe, right? >> Yeah, exactly. If you're trying to build a security program, and apply defense in depth, we offer a terrific way to engage additional security talent either because you can't hire enough or your team is simply overloaded, too much to do, so. >> Hackers like to be a little bit, white hat hackers like to be independent, might want some flexibility in their schedule, live around the world. >> Yes. No question for hackers that do it full time, that do it part-time and then everything in between. >> Well, you guys are in the middle here with some real products. So talk about what's going on here. How vulnerable are the surface areas in organizations that you're seeing? >> Yeah, probably more so than you would think. So we ran a survey earlier this year, 800 security and IT professionals across North America and Europe. And one of the findings from that survey was that nearly a third, actually over a third, 37% of the attack surfaces, not secured. Some of it's not even known. They don't know what they don't know. They just have this entire area. And you can imagine, I mean there's a lot of reasons you know, real legitimate reasons that this happens. One of those really being that we don't know what we don't know. We haven't scanned our attack surface. >> And also it's about a decade of no perimeter anymore. >> Yes. >> Welcome to the cloud. >> For sure. Absolutely. And people are moving quick, right? You know, the Cloud perfect example. Cloud people are building new applications on top of these new underlying configurations happening on a constant basis. Acquisitions, you know, that's just a fast moving thing. Nobody can keep track of it. There's a lot of different skill sets you need you know. And yeah, skill shortage out there too. As we talked about. >> What's the attacker solution you guys have? You guys have this HackerOne attack resistance component, what's that about? >> That's right. So that is to solve what we call the attack resistance gap. So that area that's not protected, hasn't been secured, on top of just not knowing what those assets are, or how vulnerable they are. The other thing that happens is people are sort of doing status quo testing, or they're not able to keep up with effective testing. So scanners are great. They can catch common vulnerabilities, but they're not going to catch those really hard to find vulnerabilities. The thing that the really sophisticated attackers are going to go after. >> Yeah. >> So we use... This large community that we have of ethical hackers around the world to be able to skill match them and get them doing bug bounties, doing pen tests, really bulletproofing the organization, and helping them risk-rank what they find. >> Yeah. >> Triage these, do the retesting, you know, get it very secure. So that's how we do it on a high level. Will, you might have a-- >> Yeah. I mean there's a tremendous amount of automation out there, right? But you can't quite at least not yet replace critical thinking. >> Yeah. >> From smart security minds. So HackerOne has a number of solutions where we can apply those minds in different ways at different parts of the software life cycle at different cadences, to fit our customers' needs, to fit their security needs, and make sure that there's more complete human coverage throughout their software lifecycle, and not just automation. >> Yeah. I think that's a great point, Will and Sean, because you think about open source is like not only grown significantly, it's like's it is the software industry. If you believe that, which I do. Open source is there it's all software free. The integration is creating a DevOps movement that's going the whole level. So Devs are doing great. They're pumping out codes. In fact, I heard a quote here on theCUBE earlier this morning from the CTO Sequence Security that said: "Shift left but shield right." So shifting left is build your security into the code, but still you got to have a shield. You guys have this shielding capability with your attack module management service. So you now you got the Devs thinking: "I got to get better security native" So but they're pumping out so much code. >> Yep. >> There's more use cases, so there's going to be code reviews needed for stuff that she said, "What is this? We got to code review new stuff. A developer created something." >> Yes. >> I mean, that's what happened. That's what's going on everywhere, right? >> Exactly. We often hear that for every 100 developers, you've got one security professional. (John laughs) You know, talk about skill shortage that's just not sustainable. How are you going to keep up with that? >> Yeah. >> So-- >> Your phone is ringing off the hook. There's no phones anymore, but like technically-- >> Yeah, yeah, exactly. So, you know, yeah, you need to go external find some experts who can help you figure that out, and keep up with that cadence, you know keeps going and going. >> So, HackerOne. I love the ethical thing. I mean, you know, I'm a big fan. Everyone who watches theCUBE knows I'm a big fan of Marten and your company, but it's not just bug bounties that you do. That's just people think of, they see that in the news. "Oh, I made a million dollars from saving Microsoft teams from being exploited" or something like that, or weird things big numbers. But you do more than that. There's code reviews, there's assessments, like a variety of different things, right? >> Yes, exactly. Exactly. >> What are the hottest areas? >> Yeah, I mean, that's exactly why we coined the term, Attack Resistance Management really is to help describe all those areas that we cover, so you're right, bug bounty is our flagship product. It's what we're best known for. And it's a terrific solution. But on top of that, we're able to layer things like vulnerability disclosure, pen testing and code review. >> Pen test is actually really important-- >> Attack surface management, you know, a whole suite of complimentary offerings to help you engage these hackers in new and interesting ways. >> Yeah. >> The bug bounty is very popular because it's fun. >> Yeah. >> I mean if your going to work on something... It's fun for the hackers but the white hat hackers, the companies they can see where's my bugs it's the fear of missing out and the fear of getting screwed over. That's the biggest driver, right, you Know-- >> Yes, definitely and we now have a product called assets. So this is attack surface management. And what we're able to do with that is bring that in leverage the ethical hackers to risk-rank. What's your assets out there? How vulnerable are these? What's critical? Feed that in, and then you know, as Will was saying we've got all kinds of different testing options. Sometimes bug bounty continuous that works. Sometimes you want pen test, you know, you want it bound. >> Well, the thing about the thing about the pen test, well the soccer report, Amazon's got soccer reports but pen test is a moving train. >> Yeah >> Cause if you're pushing new code, you got to pen test it all the time. It's not a one and done. >> Exactly. >> You got to keep it running. Just one and run, right? >> You can't do the old school penetration test once a year, big monolithic thing. You know, this is just a check the box for compliances like, no, you need to be focusing this on the assets that you're releasing, which are constantly changing. And doing ongoing smaller cadences of pen testing. >> I had someone at a conference had a few cocktails in them, confessed to me, that they forged a pen test report. >> Oh man. >> Wow! (everyone laughs) >> Because he's like, "Oh! It was three months ago. Don't Worry about it." Like, but a lot can happen in three months. No, this is reality, they are like, "I can't turn it around fast enough" They had an Apsec review... >> Yeah. >> In their company and... >> And that's it. >> I mean, I'm not saying everyone's doing bad behavior, but like people can look the other way that creates more vulnerabilities. >> It can happen. And even just that time space. Let's say you're only doing a pen test once a year or once every two years. That's a long time. It's a lot of dwell time, you can have an attacker inside mulling around your network. >> All right. So we get a big service here. This one, AWS, we're here at re:Inforce the trend that you see Amazon getting closer to the ecosystem, lot more integration. How are you guys taking HackerOne's attack surface area product management software, closer to Amazon? What's going involved? Because at the end of the day they're enabling a lot of value and their partners are growing and becoming platforms within of themselves. What is the connection with Amazon? Keeping those apps running? How do you guys do that? >> Yeah. So we've got a specific assessment type for AWS. So... On the one hand, we're bringing in the right group of ethical hack hackers who are AWS certified. They have the right skillset, we're matching them. We've got the right assessment type for them to be able to track against and find the right vulnerabilities, report on those. So this is our pen test offering geared particularly towards the AWS platform. And then we also have an AWS security hub integration. So if customers are using the AWS security hub, we can plug into that, feed that information. And that gets more to it, the defense and depth for your AWS. >> And you guys verify all the ethical hackers? Everything's verified? >> Oh yes, absolutely. Fully. >> Yep. So they're verified for their pen testing experience, and skills and of course their AWS skills in particular. And their work experience, making sure that it's long enough that it's good, background check, the whole nine, so. >> How far has Amazon come from your perspective, over the past few years with the security partnerships? I mean their services have grown every year. I mean, every Amazon re:Invent, thousands of new announcements, new services. I mean if they update the DNS server, it's a new thing. Right? So like everything's happening. >> Yeah. >> What's different now? >> It's great to see. I mean, you look around at how many different types of security solutions there are here how many different types of partners, and it just shows you that defense in depth again, it's a really critical thing. Been a wonderful partner for us. I mean that, they're a big fan of us. They tell us that all the time. >> Yeah, 'cause the customers use you. >> Cause they're customers too. Right. Exactly. Exactly. But no, it's, it's been great. So we're looking at, we've got some things on the roadmap, some continued integrations that we look forward to doing with AWS, but you know, again it's a great powerful platform. It gives customers a lot of freedom, but with that freedom comes the responsibility that's needed to actually-- >> Will, what's your take? We hear hybrid security keys, management systems, announced today, encrypt everything, don't have over permissive environments. Obviously they're talking about more platform and that type of stuff >> Absolutely. My take would be, I think our own partnership with the AWS security team is great evidence that they're thinking about the right things. We worked within conjunction with them to develop our pen test methodology. So that combined for proprietary HackerOne platform data and findings across all of our customers that are common issues found in AWS environments with their own knowledge and their own experiences from the AWS security team directly. So it's a pretty powerful checklist that we're able to run through on some of these customers and make sure that all of the most common miss-configurations and such are covered. >> Yeah. They're highly motivated to do that. 'Cause they get blamed for the S3 buckets being kept open. It's not even their fault. >> Right. (crosstalk) >> We got hack over in Amazon. Amazon's terrible! >> Yeah. You know, one of the things we like to talk about is the fact that, you know, cloud is really about automation, right? >> Yeah. >> Yep. >> But you can't automate that human ingenuity the skills that come with an actual human who has the experience and the know how to fix these things. >> It's a lot going on in Amazon. It's always been kind of like, you just described earlier in theCUBE. An erector set, not Lego blocks yet, but still kind of, you still got to build it. It's getting better in the Lego model, but there are challenges in protecting cloud, Will. I mean this is a big part of protecting cloud platforms like AWS. What are some of those challenges? >> I think some of the challenges are the ephemeral nature of the cloud can really result in developers, and you know really business units across an organization spinning up assets that IT or security don't know about. And so that's where things like HackerOne assets in those attack surface management style solutions come into play, trying to identify those assets proactively and make sure that they're receiving some sort of attention from the security team whether it's automated or manual or ideally both. >> You guys got a good solution. So how about the partnership? We got one minute left. Talk about your partnership with AWS. You guys are certified in their security group, with their team and marketplace, right? Talk about some of those things. >> Yeah, we've been in marketplace over a year. We've had that the specific solution that I mentioned the App Pen test for AWS in place and integrated with security hub for some time now. There's some other stats that we could probably share around the ethical hackers that we have working on that. We have a number of certified AWS hackers, who again they have the right skill set for AWS, and they've been a great partner. We are very focused on continuing to work with them, and build out some new offerings going forward. >> Well, you guys have done a great job. Will, tell your team congratulations on the tech side, on the product side, very strong community. You guys had a lot of success. Congratulations! And thanks for sharing on theCUBE, appreciate it. >> Thanks for having us John. >> Thank you for your time-- We're here at re:Inforce where all the access tab is open, it's team oriented, we got cloud scale, data, encryption on everything. Big news coming out of re:Inforce, well, theCUBE's got it covered here. I'm John Furrier, your host. Thanks for watching. We'll be right back with more coverage after this short break. (theme music)