(upbeat music) >> Greetings from Los Angeles, Lisa Martin here with Dave Nicholson. We are on day three of the caves wall-to-wall coverage of KubeCon CloudNativeCon North America 21. We're pleased to welcome Mark Hinkle to the program, the co-founder and CEO of TriggerMesh. Mark welcome. >> Thank you, It's nice to be here. >> Lisa: Love the name. Very interesting TriggerMesh. Talk to us about what TriggerMesh does and what, when you were founded and what some of the gaps were that you saw in the market. >> Yeah, so TriggerMesh actually the Genesis of the name is in, cloud event, driven architecture. You trigger workloads. So that's the trigger and trigger mesh, and then mesh, we mesh services together, so cloud, so that's why we're called TriggerMesh. So we're a cloud native open source integration platform. And the idea is that, the number of cloud services are proliferating. You still have stuff in your data center that you can't decommission and just wholesale lift and shift to the cloud. So we wanted to provide a platform to create workflows from the data center, to the cloud, from cloud to cloud and not, and use all the cloud native design principles, but not leave your past behind. So that's, what we do. We're, very, we were cloud, we are cloud operators and developers, and we wanted the experience to be very similar to the way that DevOps folks are doing infrastructure code and deploying that we want to make it easy to do integration as code. So we follow the same design patterns, use the same domain languages, some of those tools like Hashi corpse, Terraform, and that that's what we do and how we go about doing it. >> Lisa: And when were you guys founded? >> September, 2018. >> Oh so your young, your three years young. >> Three years it's feels like 21 >> I bet. >> And startup years it's a lot has happened, but yeah, we my co-founder and I were former early cloud folks. We were at cloud.com worked through the OpenStack years and the CloudStack, and we just saw the pattern of, abstraction coming about. So first you abstract the hardware, then you abstract the operating system. And now at with the Kubernetes container, you know, evolution, you're abstracting it up to the application layer and we want it to be able to provide tooling that lets you take full advantage of that. >> Dave: So being founded in 2018, what's your perception of that? The shift that happened during the pandemic in terms of the drive towards cloud adoption and the demands for services like you provide? >> Mark: Yeah, I think it's a mixed blessing. So we, people became more remote. They needed to enable digital transformation. Biggest thing, I think that that for us is, you know, you don't go to the bank anymore. And the banking industry is doing, you know, exponentially more remote, online transactions than in person. And it's very important. So we decided that financial services is where we were going to start with first because they have a lot of legacy architecture. They have a lot of need to move to the cloud to have better digital experiences. And we wanted to enable them to, you know, keep their mainframes online while they were still doing cutting edge, you know, mobile applications, that kind of thing. >> Lisa: And of course the legacy institutions like the BFA's the Wells Fargo, they're competing with the fintechs who are much more nimble, much more agile and able to sort of disrupt the financial services industry. Was that part of also your decision to start in financial services? >> It was a little bit of luck because we started with our network and it turned out the, you know, we saw, we started talking to our friends early on, cause we're a startup and said, this is what we're going to do. And where it really resonated was PNC bank was our, one of our first customers. You know, another financial regulatory company was another one, a couple of banks in Europe. And we, you know, as we started talking about what we were doing, that we just gravitated there because they had the, the biggest need, even though everybody has the need, their businesses are, you know, critically tied to digital transformation. >> So starting with financial services. >> It's, it's counter intuitive, isn't it? >> It was counterintuitive, but it lends credibility to any other industry vertical that you're going to approach. >> Yeah, yeah it does. It's a, it's a great, they're going to be our hardest customers and they have more at stake than a lot of like transactions are millions and millions of dollars per hour for these folks. So they don't want to play around, they, they have no tolerance for failure. So it's a good start, but it's sort of like taking up jogging and running a marathon in your first week. It's very very grilling in that sense, but it really has made us a lot better and gave us a lot of insight into the kinds of things we need to do from not just functionality, but security and that kind of thing. >> Where are you finding these customers with respect to adoption of Kubernetes? Are they leading? Are they knowing we've got to get there eventually from an infrastructure perspective? >> So the interesting thing is Kubernetes is a platform for us to deliver on, so we, we don't require you to be a Kubernetes expert we offer it as a SaaS, but what happens is that the Kubernetes folks are the ones that we end up really engaging with earlier on. And I think that we find that they're in this phase of they're containerizing their apps, that's the first step. And then they're putting them on Kubernetes and then their next step is a security and integration path. So once she, I think they call it and this is my buzzword of the show day two operations, right? So they, they get to day two and then they have a security and an integration concern before they go live. So they want to be able to make sure that they don't increase their attack face. And then they also want to make sure that this newly deployed containerized infrastructure is as well integrated as the previous, you know, virtualized or even, you know, on the server infrastructure that they had before. >> So TriggerMesh, doesn't solely work in the containerized world, you're, you're sort of you're bridging the divide. >> Mark: Yes. >> What percentage of the workloads that you're seeing are the result of modernization migration, as opposed to standing up net new application environments in Kubernetes? Do you have a sense for that? >> I think we live in a lot in the brown field. So, you know, folks that have an existing project that they're trying to bridge to it versus the Greenfield kind of, you know, the, the huge wins that you saw in the early cloud days of the Netflix and the Twitter's Dwayne scale. Now we're talking to the enterprises who have, you know, they have existing concerns. So I would say that it's, it's mostly people that are, you know, very few net new projects, unless it's a modernization and they're getting ready to decommission an old one, which is. >> Dave: So Brownfield financial services. You just said, you know, let's just, let's just go after that. >> You know, yeah. I mean, we had this dart forward and we put up buzzwords, but no, it was, it was actually just, and you know, we're still finding our way as far as early on where we're open source folks. And we did not open source from day one, which is very weird when everybody's new, your identity is, you know, I worked, I was the VP of marketing for Linux foundation and no JS and all these open source projects. And my co-founder and I are Apache committers. And our project wasn't open yet because we had to get to the point where it could be open and people could be productive in the use and contribution. And we had to staff up engineers. And now I think this week we open-sourced our entire platform. And I think that's going to open up, you know, that's where we started because it was not necessarily the lowest hanging fruit, but the profitable, less profitable, lowest hanging fruit was financial services. Now we are letting our code out into the wild. And I think it'll be interesting to see what comes back. >> So you just announced that this week TriggerMesh integration platform as an open source project here at KubeCon, what's been some of the feedback? >> It's all been positive. I haven't heard anything negative. We did it, so we're very, very, there's a very, the culture around open source is very tough. It's very critical if you don't do it right. So I think we did a good job, we used enough, we used a OSI approved. They've been sourced, licensed the Apache software, a V2 license. We hired someone who was well-respected in the DevREL world from a chef who understands the DevOps sort of culture methodologies. We staffed up our engineers who are going to be helping the free and open source users. So they're successful and we're betting that that will yield business results down the road. >> Lisa: And what are the two I see on your website, two primary use cases that you guys support. Can you dig into details on that? >> So the first one is sort of a workflow automation and a really simple example of that is you have a, something that happens in one cloud. So for example, you take a picture on your phone and you upload it and it goes to Amazon and there is a service that wants to identify what's in that picture. And once you put it on the line and the internship parlance, you could kick off a workflow from TensorFlow, which is artificial intelligence to identify the picture. And there isn't a good way for clouds to communicate from one to the other, without writing custom blue, which is really what, what we're helping to get rid of is there's a lot of blue written to put together cloud native applications. So that's a workflow, you know, triggering a server less function is the workflow. The other thing is actually breaking up data gravity. So I have a warehouse of data, in my data center, and I want to start replicating some portion of that. As it changes to a database as a service, we can based on an event flow, which is passive. We're not, we're not making, having a conversation like you would with an API where there's an event stream. That's like drinking from the fire hose and TriggerMesh is the nozzle. And we can direct that data to a DBaaS. We can direct that data to snowflake. We can direct that data to a cloud-based data lake on Microsoft Azure, or we can split it up, so some events could go to Splunk and all of the events can go to your data lake or some of those, those things can be used to trigger workloads on other systems. And that event driven architecture is really the design pattern of the individual clouds. We're just making it multi-cloud and on-prem. >> Lisa: Do you have a favorite customer example that you think really articulates that the value of that use case? >> Mark: Yeah I think a PNC is probably our, well for the, for the data flow one, I would say we have a regular to Oracle and one of their customers it was their biggest SMB customer of last year. The Oracle cloud is very, very important, but it's not as tool. It doesn't have the same level of tooling as a lot of the other ones. And to, to close that deal, their regulatory customer wanted to use Datadog. So they have hundreds and hundreds of metrics. And what TriggerMesh did was ingest the hundreds and hundreds of metrics and filter them and connect them to Datadog so that, they could, use Datadog to measure, to monitor workloads on Oracle cloud. So that, would be an example of the data flow on the workflow. PNC bank is, is probably our best example and PNC bank. They want to do. I talked about infrastructure code integration is code. They want to do policy as code. So they're very highly regulatory regulated. And what they used to do is they had policies that they applied against all their systems once a month, to determine how much they were in compliance. Well, theoretically if you do that once a month, it could be 30 days before you knew where you were out of compliance. What we did was, we provided them a way to take all of the changes within their systems and for them to a server less cluster. And they codified all of these policies into server less functions and TriggerMesh is triggering their policies as code. So upon change, they're getting almost real-time updates on whether or not they're in compliance or not. And that's a huge thing. And they're going to, they have, within their first division, we worked with, you know, tens of policies throughout PNC. They have thousands of policies. And so that's really going to revolutionize what they're able to do as far as compliance. And that's a huge use case across the whole banking system. >> That's also a huge business outcome. >> Yes. >> So Mark, where can folks go to learn more about TriggerMesh, maybe even read about more specifically about the announcement that you made this week. >> TriggerMesh.com is the best way to get an overview. The open source project is get hub.com/triggermesh/trigger mesh. >> Awesome Mark, thank you for joining Dave and me talking to us about TriggerMesh, what you guys are doing. The use cases that you're enabling customers. We appreciate your time and we wish you best of luck as you continue to forge into financial services and other industries. >> Thanks, it was great to be here. >> All right. For Dave Nicholson, I'm Lisa Martin coming to you live from Los Angeles at KubeCon and CloudNativeCon North America 21, stick around Dave and I, will be right back with our next guest.

(upbeat music) >> Welcome to this CUBE conversation. I am Lisa Martin, excited to welcome back one of our distinguished alumni, Derek Manky joins me next. Chief security Insights and Global Threat Alliances at Fortinet's FortiGuard Labs. Derek, welcome back to the program. >> Yes, it's great to be here and great to see you again, Lisa. Thanks for having me. >> Likewise, yeah, so a lot has happened. I know we've seen you during this virtual world, but so much has happened with ransomware in the last year. It's unbelievable, we had this dramatic shift to a distributed workforce, you had personal devices on in network perimeters and non-trusted devices or trusted devices on home networks and lots of change there. Talk to me about some of the things that you and FortiGuard Labs have seen with respect to the evolution of ransomware. >> Yeah, sure, so it's becoming worse, no doubt. We highlighted this in our Threat Landscape Report. If we just take a step back looking at ransomware itself, it actually started in the late 1980s. And it didn't, that was very, they relied on snail mail. It was obviously there was no market for it at the time. It was just a proof of concept, a failed experiment if you will. But it really started getting hot a decade ago, 10 years ago but the technology back then wasn't the cryptography they're using, the technique wasn't as strong as easily reversed. And so they didn't really get to a lot of revenue or business from the cyber criminal perspective. That is absolutely not the case today. Now they have very smart cryptography they're experts when say they, the cyber criminals at their game. They know there's a lot of the attack surfaces growing. There's a lot of vulnerable people out there. There's a lot of vulnerable devices. And this is what we saw in our threat landscape group. What we saw at seven times increase in ransomware activity in the second half of 2020. And that momentum is continuing in 2021. It's being fueled by what you just talked about. By the work from anywhere, work from home environment a lot of vulnerable devices unpatched. And these are the vehicles that the ransomware is the payload of course, that's the way that they're monetizing this. But the reality is that the attack surface has expanded, there's more vulnerable people and cyber criminals are absolutely capitalizing on that. >> Right, we've even seen cyber criminals capitalizing on the pandemic fears with things that were around the World Health Organization or COVID-19 or going after healthcare. Did you see an uptick in healthcare threats and activities as well in the last year? >> Yeah, definitely, so I would start to say that first of all, the... Nobody is immune when it comes to ransomware. This is such again, a hot target or a technique that the cybercriminals are using. So when we look at the verticals, absolutely healthcare is in the top five that we've seen, but the key difference is there's two houses here, right? You have what we call the broad blanketed ransomware attacks. So these aren't going after any particular vertical. They're really just trying to spray as much as they can through phishing campaigns, not through... there's a lot of web traffic out there. We see a lot of things that are used to open playing on that COVID-19 theme we got, right? Emails from HR or taxes and scams. It's all related to ransomware because these are how they're trying to get the masses to open that up, pay some data sorry, pay some cryptocurrency to get access to their data back. Oftentimes they're being held for extortions. They may have photos or video or audio captures. So it's a lot of fear they're trying to steal these people but probably the more concern is just what you talked about, healthcare, operational technology. These are large business revenue streams. These are take cases of targeted ransoms which is much different because instead of a big volumetric attack, these are premeditated. They're going after with specific targets in mind specific social engineering rules. And they know that they're hitting the corporate assets or in the case of healthcare critical systems where it hurts they know that there's high stakes and so they're demanding high returns in terms of ransoms as well. >> With respect to the broad ransomware attacks versus targeted a couple of questions to kind of dissect that. Are the targeted attacks, are they in like behind the network firewall longer and faster, longer and getting more information? Are they demanding higher ransom versus the broader attacks? What's what are some of the distinctions there besides what you mentioned? >> Yeah, absolutely so the targeted texts are more about execution, right? So if we look at the attack chain and they're doing more in terms of reconnaissance, they're spending more cycles and investment really on their end in terms of weaponization, how they can actually get into the system, how they can remain undetected, collecting and gathering information. What we're seeing with groups like Ragnar Locker as an example, they're going in and they're collecting in some cases, terabytes of information, a lot, they're going after definitely intellectual property, things like source code, also PII for customers as an example, and they're holding them. They have a whole business strategy and plan in mind on their place, right? They hold them for ransom. They're often, it's essentially a denial of service in some cases of taking a revenue stream or applications offline so a business can't function. And then what they're doing is that they're actually setting up crime services on their end. They, a lot of the the newest ransom notes that we're seeing in these targeted attacks are setting up channels to what they call a live chat support channel that the victim would log into and actually talk directly live to the cybercriminal or one of their associates to be able to negotiate the ransom. And they're trying to have in their point of view they're trying frame this as a good thing and say, we're going to show you that our technology works. We can decrypt some of the files on your system as an example just to prove that we are who we say we are but then they go on to say, instead of $10 million, we can negotiate down to 6 million, this is a good deal, you're getting 30% off or whatever it is but the fact is that they know by the time they've gotten to this they've done all their homework before that, right? They've done the targets, they've done all the things that they can to know that they have the organization in their grasp, right? >> One of the things that you mentioned just something I never thought about as ransomware as a business, the sophistication level is just growing and growing and growing and growing. And of course, even other bad actors, they have access to all the emerging technologies that the good guys do. But talk to me about this business of ransomware because that's what it seems like it really has become. >> Absolutely, it is massively sad. If you look at the cybercrime ecosystem like the way that they're actually pulling this off it's not just one individual or one cyber crime ring that, let's say five to 10 people that are trying to orchestrate this. These are big rings, we actually work closely as an example to, we're doing everything from the FortiGuard Labs with following the latest ransomware trends doing the protection and mitigation but also working to find out who these people are, what are their tactics and really attribute it and paint a picture of these organizations. And they're big, we worked on some cases where there's over 50 people just in one ransomware gang. One of the cases we worked on, they were making over $60 million US in three months, as an example. And in some cases, keep in mind one of these targeted attacks like in terms of ransom demands and the targeted cases they can be an excess of $10 million just for one ransom attack. And like I said, we're seeing a seven times increase in the amount of attack activity. And what they're doing in terms of the business is they've set up affiliate marketing. Essentially, they have affiliates in the middle that will actually distribute the ransomware. So they're basically outsourcing this to other individuals. If they hit people with their ransomware and the people pay then the affiliate in the middle will actually get a commission cut of that, very high, typically 40 to 50%. And that's really what's making this lucrative business model too. >> Wow, My jaw is dropping just the sophistication but also the different levels to which they've put a business together. And unfortunately, for every industry it sounds very lucrative, so how then Derek do organizations protect themselves against this, especially knowing that a lot of this work from home stuff is going to persist. Some people want to stay home, what not. The proliferation of devices is only going to continue. So what are organizations start and how can you guys help? >> Start with the people, so we'll talk about three things, people, technology and processes. The people, unfortunately, this is not just about ransomware but definitely applies to ransomware but any attack, humans are still often the weakest link in terms of education, right? A lot of these ransomware campaigns will be going after people using nowadays seems like tax themes purporting to be from the IRS as an example or human resources departments or governments and health authorities, vaccination scams all these things, right? But what they're trying to do is to get people to click on that link, still to open up a malicious attachment that will then infect them with the ransomware. This of course, if an employee is up to date and hones their skills so that they know basically a zero trust mentality is what I like to talk about. You wouldn't just invite a stranger into your house to open a package that you didn't order but people are doing this a lot of the times with email. So really starting with the people first is important. There's a lot of free training information and security. There is awareness training, we offer that at Fortinet. There's even advanced training we do through our NSC program as an example. But then on top of that there's things like phishing tests that you can do regularly, penetration testing as well, exercises like that are very important because that is really the first line of defense. Moving past that you want to get into the technology piece. And of course, there's a whole, this is a security fabric. There's a whole array of solutions. Like I said, everything needs to be integrated. So we have an EDR and XDR as an example sitting on the end point, cause oftentimes they still need to get that ransomware payload to run on the end point. So having a technology like EDR goes a long way to be able to detect the threat, quarantine and block it. There's also of course a multi-factor authentication when it comes to identifying who's connecting to these environments. Patch management, we talk about all the time. That's part of the technology piece. The reality is that we highlight in the threat landscape report the software vulnerabilities that these rats more gangs are going after are two to three years old. They're not breaking within the last month they're two to three years old. So it's still about the patch management cycle, having that holistic integrated security architecture and the fabric is really important. NAC network access control is zero trust, network access is really important as well. One of the biggest culprits we're seeing with these ransom attacks is using IOT devices as launchpads as an example into networks 'cause they're in these work from home environments and there's a lot of unsecured or uninspected devices sitting on those networks. Finally process, right? So it's always good to have it all in your defense plan training and education, technology for mitigation but then also thinking about the what if scenario, right? So incident response planning, what do we do if we get hit? Of course we never recommend to pay the ransom. So it's good to have a plan in place. It's good to identify what your corporate assets are and the likely targets that cyber-criminals are going to go after and make sure that you have rigid security controls and threat intelligence like FortiGuard Labs applied to that. >> Yeah, you talk about the weakest link they are people I know you and I talked about that on numerous segments. It's one of the biggest challenges but I've seen some people that are really experts in security read a phishing email and almost fall for it. Like it looked so legitimately from like their bank for example. So in that case, what are some of the things that businesses can do when it looks so legitimate that it probably is going to have a unfortunately a good conversion rate? >> Yeah, so this is what I was talking about earlier that these targeted attacks especially when it comes to spear, when it comes to the reconnaissance they got so clever, it can be can so realistic. That's the, it becomes a very effective weapon. That's why the sophistication and the risk is rising like I said but that's why you want to have this multilayered approach, right? So if that first line of defense does yield, if they do click on the link, if they do try to open the malicious attachment, first of all again through the next generation firewall Sandboxing solutions like that, this technology is capable of inspecting that, acting like is this, we even have a FortiAI as an example, artificial intelligence, machine learning that can actually scan this events and know is this actually an attack? So that element goes a long way to actually scrub it like content CDR as well, content disarm as an example this is a way to actually scrub that content. So it doesn't actually run it in the first place but if it does run again, this is where EDR comes in like I said, at the end of the day they're also trying to get information out of the network. So having things like a Platinum Protection through the next generation firewall like with FortiGuard security subscription services is really important too. So it's all about that layered approach. You don't want just one single point of failure. You really want it, this is what we call the attack chain and the kill chain. There's no magic bullet when it comes to attackers moving, they have to go through a lot of phases to reach their end game. So having that layer of defense approach and blocking it at any one of those phases. So even if that human does click on it you're still mitigating the attack and protecting the damage. Keep in mind a lot of damages in some cases kind of a million dollars plus. >> Right, is that the average ransom, 10 million US dollars. >> So the average cost of data breaches that we're seeing which are often related to ransom attacks is close to that in the US, I believe it's around just under $9 million about 8.7 million, just for one data breach. And often those data breaches now, again what's happening is that the data it's not just about encrypting the data, getting access because a lot of organizations part of the technology piece and the process that we recommend is backups as well of data. I would say, organizations are getting better at that now but it's one thing to back up your data. But if that data is breached again, cybercriminals are now moving to this model of extorting that saying, unless you pay us this money we're going to go out and make this public. We're going to put it on paste and we're going to sell it to nefarious people on the dark web as well. >> One more thing I want to ask you in terms of proliferation we talked about the distributed workforce but one of the things, and here we are using Zoom to talk to each other, instead of getting to sit together in person we saw this massive proliferation in collaboration tools to keep people connected, families businesses. I talked a bit a lot of businesses who initially will say, oh we're using Microsoft 365 and they're protecting the data while they're not or Salesforce or Slack. And that shared responsibility model is something that I've been hearing a lot more about lately that businesses needing to recognize for those cloud applications that we're using and in which there's a lot of data traversing it could include PII or IP. We're responsible for that as the customer to protect our data, the vendor's responsible for protecting the integrity of the infrastructure. Share it with us a little bit about that in terms of your thoughts on like data protection and backup for those SaaS applications. >> Yeah, great question, great question tough one. It is so, I mean ultimately everybody has to have, I believe it has to have their position in this. It's not, it is a collaborative environment. Everyone has to be a stakeholder in this even down to the end users, the employees being educated and up-to-date as an example, the IT departments and security operation centers of vendors being able to do all the threat intelligence and scrubbing. But then when you extend that to the public cloud what is the cloud security stack look at, right? How integrated is that? Are there scrubbing and protection controls sitting on the cloud environments? What data is being sent to that, should it be cited center as an example? what's the retention period? How long does the data live on there? It's the same thing as when you go out and you buy one of these IOT devices as an example from say, a big box store and you go and just plug it into your network. It's the same questions we should be asking, right? What's the security like on this device model? Who's making it, what data is it going to ask for me? The same thing when you're installing an application on your mobile phone, this is what I mean about that zero trust environment. It should be earned trust. So it's a big thing, right? To be able to ask those questions and then only do it on a sort of need to know and medium basis. The good news is that a lot of CloudStack now and environments are integrating security controls. We integrated quite well with Fortinet as an example but this is an issue of supply chain. It's really important to know what lives upstream and how they're handling the data and how they're protecting it absolutely. >> Such interesting information and it's a topic ransomware that we could continue talking about, Derek, thank you for joining me on the program today updating us on what's going on, how it's evolving and ultimately what organizations in any industry need to do with protecting people and technology and processes to really start reducing their risks. I thank you so much for joining me today. >> All right it's a pleasure, thank you. >> Likewise Derek Manky I'm Lisa Martin. You're watching this CUBE conversation. (upbeat music)

(upbeat music) >> Welcome to this CUBE conversation. I am Lisa Martin, excited to welcome back one of our distinguished alumni, Derek Manky joins me next. Chief security Insights and Global Threat Alliances at Fortinet's FortiGuard Labs. Derek, welcome back to the program. >> Yes, it's great to be here and great to see you again, Lisa. Thanks for having me. >> Likewise, yeah, so a lot has happened. I know we've seen you during this virtual world, but so much has happened with ransomware in the last year. It's unbelievable, we had about 14 months ago, this dramatic shift to a distributed workforce, you had personal devices on in network perimeters and non-trusted devices or trusted devices on home networks and lots of change there. Talk to me about some of the things that you and FortiGuard Labs have seen with respect to the evolution of ransomware. >> Yeah, sure, so it's becoming worse, no doubt. We highlighted this in our Threat Landscape Report. If we just take a step back looking at ransomware itself, it actually started in the late 1980s. And it didn't, that was very, they relied on snail mail. It was obviously there was no market for it at the time. It was just a proof of concept, a failed experiment if you will. But it really started getting hot a decade ago, 10 years ago but the technology back then wasn't the cryptography they're using, the technique wasn't as strong as easily reversed. And so they didn't really get to a lot of revenue or business from the cyber criminal perspective. That is absolutely not the case today. Now they have very smart cryptography they're experts when say they, the cyber criminals at their game. They know there's a lot of the attack surfaces growing. There's a lot of vulnerable people out there. There's a lot of vulnerable devices. And this is what we saw in our threat landscape group. What we saw at seven times increase in ransomware activity in the second half of 2020. And that momentum is continuing in 2021. It's being fueled by what you just talked about. By the work from anywhere, work from home environment a lot of vulnerable devices unpatched. And these are the vehicles that the ransomware is the payload of course, that's the way that they're monetizing this. But the reality is that the attack surface has expanded, there's more vulnerable people and cyber criminals are absolutely capitalizing on that. >> Right, we've even seen cyber criminals capitalizing on the pandemic fears with things that were around the World Health Organization or COVID-19 or going after healthcare. Did you see an uptick in healthcare threats and activities as well in the last year? >> Yeah, definitely, so I would start to say that first of all, the... Nobody is immune when it comes to ransomware. This is such again, a hot target or a technique that the cybercriminals are using. So when we look at the verticals, absolutely healthcare is in the top five that we've seen, but the key difference is there's two houses here, right? You have what we call the broad blanketed ransomware attacks. So these aren't going after any particular vertical. They're really just trying to spray as much as they can through phishing campaigns, not through... there's a lot of web traffic out there. We see a lot of things that are used to open playing on that COVID-19 theme we got, right? Emails from HR or taxes and scams. It's all related to ransomware because these are how they're trying to get the masses to open that up, pay some data sorry, pay some cryptocurrency to get access to their data back. Oftentimes they're being held for extortions. They may have photos or video or audio captures. So it's a lot of fear they're trying to steal these people but probably the more concern is just what you talked about, healthcare, operational technology. These are large business revenue streams. These are take cases of targeted ransoms which is much different because instead of a big volumetric attack, these are premeditated. They're going after with specific targets in mind specific social engineering rules. And they know that they're hitting the corporate assets or in the case of healthcare critical systems where it hurts they know that there's high stakes and so they're demanding high returns in terms of ransoms as well. >> With respect to the broad ransomware attacks versus targeted a couple of questions to kind of dissect that. Are the targeted attacks, are they in like behind the network firewall longer and faster, longer and getting more information? Are they demanding higher ransom versus the broader attacks? What's what are some of the distinctions there besides what you mentioned? >> Yeah, absolutely so the targeted texts are more about execution, right? So if we look at the attack chain and they're doing more in terms of reconnaissance, they're spending more cycles and investment really on their end in terms of weaponization, how they can actually get into the system, how they can remain undetected, collecting and gathering information. What we're seeing with groups like Ragnar Locker as an example, they're going in and they're collecting in some cases, terabytes of information, a lot, they're going after definitely intellectual property, things like source code, also PII for customers as an example, and they're holding them. They have a whole business strategy and plan in mind on their place, right? They hold them for ransom. They're often, it's essentially a denial of service in some cases of taking a revenue stream or applications offline so a business can't function. And then what they're doing is that they're actually setting up crime services on their end. They, a lot of the the newest ransom notes that we're seeing in these targeted attacks are setting up channels to what they call a live chat support channel that the victim would log into and actually talk directly live to the cybercriminal or one of their associates to be able to negotiate the ransom. And they're trying to have in their point of view they're trying frame this as a good thing and say, we're going to show you that our technology works. We can decrypt some of the files on your system as an example just to prove that we are who we say we are but then they go on to say, instead of $10 million, we can negotiate down to 6 million, this is a good deal, you're getting 30% off or whatever it is but the fact is that they know by the time they've gotten to this they've done all their homework before that, right? They've done the targets, they've done all the things that they can to know that they have the organization in their grasp, right? >> One of the things that you mentioned just something I never thought about as ransomware as a business, the sophistication level is just growing and growing and growing and growing. And of course, even other bad actors, they have access to all the emerging technologies that the good guys do. But talk to me about this business of ransomware because that's what it seems like it really has become. >> Absolutely, it is massively sad. If you look at the cybercrime ecosystem like the way that they're actually pulling this off it's not just one individual or one cyber crime ring that, let's say five to 10 people that are trying to orchestrate this. These are big rings, we actually work closely as an example to, we're doing everything from the FortiGuard Labs with following the latest around some of the trends doing the protection and mitigation but also working to find out who these people are, what are their tactics and really attribute it and paint a picture of these organizations. And they're big, we're working some cases where there's over 50 people just in one ransomware gang. One of the cases we worked on, they were making over $60 million US in three months, as an example. And in some cases, keep in mind one of these targeted attacks like in terms of ransom demands and the targeted cases they can be an excess of $10 million just for one ransom attack. And like I said, we're seeing a seven times increase in the amount of attack activity. And what they're doing in terms of the business is they've set up affiliate marketing. Essentially, they have affiliates in the middle that will actually distribute the ransomware. So they're basically outsourcing this to other individuals. If they hit people with their ransomware and the people pay then the affiliate in the middle will actually get a commission cut of that, very high, typically 40 to 50%. And that's really what's making this lucrative business model too. >> Wow, My jaw is dropping just the sophistication but also the different levels to which they've put a business together. And unfortunately, for every industry it sounds very lucrative, so how then Derek do organizations protect themselves against this, especially knowing that a lot of this work from home stuff is going to persist. Some people want to stay home, what not. The proliferation of devices is only going to continue. So what are organizations start and how can you guys help? >> Start with the people, so we'll talk about three things, people, technology and processes. The people, unfortunately, this is not just about ransomware but definitely applies to ransomware but any attack, humans are still often the weakest link in terms of education, right? A lot of these ransomware campaigns will be going after people using nowadays seems like tax themes purporting to be from the IRS as an example or human resources departments or governments and health authorities, vaccination scams all these things, right? But what they're trying to do is to get people to click on that link, still to open up a malicious attachment that will then infect them with the ransomware. This of course, if an employee is up to date and hones their skills so that they know basically a zero trust mentality is what I like to talk about. You wouldn't just invite a stranger into your house to open a package that you didn't order but people are doing this a lot of the times with email. So really starting with the people first is important. There's a lot of free training information and security. There is awareness training, we offer that at Fortinet. There's even advanced training we do through our NSC program as an example. But then on top of that there's things like phishing tests that you can do regularly, penetration testing as well, exercises like that are very important because that is really the first line of defense. Moving past that you want to get into the technology piece. And of course, there's a whole, this is a security fabric. There's a whole array of solutions. Like I said, everything needs to be integrated. So we have an EDR and XDR as an example sitting on the end point, cause oftentimes they still need to get that ransomware payload to run on the end point. So having a technology like EDR goes a long way to be able to detect the threat, quarantine and block it. There's also of course a multi-factor authentication when it comes to identifying who's connecting to these environments. Patch management, we talk about all the time. That's part of the technology piece. The reality is that we highlight in the threat landscape report the software vulnerabilities that these rats more gangs are going after are two to three years old. They're not breaking within the last month they're two to three years old. So it's still about the patch management cycle, having that holistic integrated security architecture and the fabric is really important. NAC network access control is zero trust, network access is really important as well. One of the biggest culprits we're seeing with these ransom attacks is using IOT devices as launchpads as an example into networks 'cause they're in these work from home environments and there's a lot of unsecured or uninspected devices sitting on those networks. Finally process, right? So it's always good to have it all in your defense plan training and education, technology for mitigation but then also thinking about the what if scenario, right? So incident response planning, what do we do if we get hit? Of course we never recommend to pay the ransom. So it's good to have a plan in place. It's good to identify what your corporate assets are and the likely targets that cyber-criminals are going to go after and make sure that you have rigid security controls and threat intelligence like FortiGuard Labs applied to that. >> Yeah, you talk about the weakest link they are people I know you and I talked about that on numerous segments. It's one of the biggest challenges but I've seen some people that are really experts in security read a phishing email and almost fall for it. Like it looked so legitimately from like their bank for example. So in that case, what are some of the things that businesses can do when it looks so legitimate that it probably is going to have a unfortunately a good conversion rate? >> Yeah, so this is what I was talking about earlier that these targeted attacks especially when it comes to spear, when it comes to the reconnaissance they got so clever, it can be can so realistic. That's the, it becomes a very effective weapon. That's why the sophistication and the risk is rising like I said but that's why you want to have this multilayered approach, right? So if that first line of defense does yield, if they do click on the link, if they do try to open the malicious attachment, first of all again through the next generation firewall Sandboxing solutions like that, this technology is capable of inspecting that, acting like is this, we even have a FortiAI as an example, artificial intelligence, machine learning that can actually scan this events and know is this actually an attack? So that element goes a long way to actually scrub it like content CDR as well, content disarm as an example this is a way to actually scrub that content. So it doesn't actually run it in the first place but if it does run again, this is where EDR comes in like I said, at the end of the day they're also trying to get information out of the network. So having things like a Platinum Protection through the next generation firewall like with FortiGuard security subscription services is really important too. So it's all about that layered approach. You don't want just one single point of failure. You really want it, this is what we call the attack chain and the kill chain. There's no magic bullet when it comes to attackers moving, they have to go through a lot of phases to reach their end game. So having that layer of defense approach and blocking it at any one of those phases. So even if that human does click on it you're still mitigating the attack and protecting the damage. Keep in mind a lot of damages in some cases kind of a million dollars plus. >> Right, is that the average ransom, 10 million US dollars. >> So the average cost of data breaches ever seen which are often related to ransom attacks is close to that in the US, I believe it's around just under $9 million about 8.7 million, just for one data breach. And often those data breaches now, again what's happening is that the data it's not just about encrypting the data, getting access because a lot of organizations part of the technology piece and the process that we recommend is backups as well of data. I would say, organizations are getting better at that now but it's one thing to back up your data. But if that data is breached again, cybercriminals are now moving to this model of extorting that saying, unless you pay us this money we're going to go out and make this public. We're going to put it on piece and we're going to sell it to nefarious people on the dark web as well. >> One more thing I want to ask you in terms of proliferation we talked about the distributed workforce but one of the things, and here we are using Zoom to talk to each other, instead of getting to sit together in person we saw this massive proliferation in collaboration tools to keep people connected, families businesses. I talked a bit a lot of businesses who initially will say, oh we're using Microsoft 365 and they're protecting the data while they're not or Salesforce or Slack. And that shared responsibility model is something that I've been hearing a lot more about lately that businesses needing to recognize for those cloud applications that we're using and in which there's a lot of data traversing it could include PII or IP. We're responsible for that as the customer to protect our data, the vendor's responsible for protecting the integrity of the infrastructure. Share it with us a little bit about that in terms of your thoughts on like data protection and backup for those SaaS applications. >> Yeah, great question, great question tough one. It is so, I mean ultimately everybody has to have, I believe it has to have their position in this. It's not, it is a collaborative environment. Everyone has to be a stakeholder in this even down to the end users, the employees being educated and up-to-date as an example, the IT departments and security operation centers of vendors being able to do all the threat intelligence and scrubbing. But then when you extend that to the public cloud what is the cloud security stack look at, right? How integrated is that? Are there scrubbing and protection controls sitting on the cloud environments? What data is being sent to that, should it be cited center as an example? what's the retention period? How long does the data live on there? It's the same thing as when you go out and you buy one of these IOT devices as an example from say, a big box store and you go and just plug it into your network. It's the same questions we should be asking, right? What's the security like on this device model? Who's making it, what data is it going to ask for me? The same thing when you're installing an application on your mobile phone, this is what I mean about that zero trust environment. It should be earned trust. So it's a big thing, right? To be able to ask those questions and then only do it on a sort of need to know and medium basis. The good news is that a lot of CloudStack now and environments are integrating security controls. We integrated quite well with Fortinet as an example but this is an issue of supply chain. It's really important to know what lives upstream and how they're handling the data and how they're protecting it absolutely. >> Such interesting information and it's a topic ransomware that we could continue talking about, Derek, thank you for joining me on the program today updating us on what's going on, how it's evolving and ultimately what organizations in any industry need to do with protecting people and technology and processes to really start reducing their risks. I thank you so much for joining me today. >> All right it's a pleasure, thank you. >> Likewise Derek Manky I'm Lisa Martin. You're watching this CUBE conversation. (upbeat music)

>> Announcer: From theCUBE studios in Palo Alto and Boston, connecting with thought leaders all around the world, this is a CUBE Conversation. >> Hi, I'm Stu Miniman coming to you from our Boston area studio and this is a special CUBE Conversation, we always love talking to startups around the industry, understanding how they're creating innovation, doing new things out there, and oftentimes one of the exits for those companies is they do get acquired, and happy to welcome back to the program one of our CUBE alumni, Sheng Liang, he is the cofounder and CEO of Rancher, today there was an announcement for a definitive acquisition of SUSE, who our audience will know well, we were at SUSECON, so Sheng, first of all, thank you for joining us, and congratulations to you and the team on joining SUSE here in the near future. >> Thank you, Stu, I'm glad to be here. >> All right, so Sheng, why don't you give our audience a little bit of context, so I've known Rancher since the very early days, I knew Rancher before most people had heard the word Kubernetes, it was about containerization, it was about helping customers, there was that cattles versus pets, so that Rancher analogy was, hey, we're going to be your rancher and help you deal with that sprawl and all of those pieces out there, where you don't want to know them by name and the like, so help us understand how what was announced today is meeting along the journey that you set out for with Rancher. >> Absolutely, so SUSE is the largest independent opensource software company in the world, and they're a leader in enterprise Linux. Today they announced they have signed a definitive agreement to acquire Rancher, so we started Rancher about six years ago, as Stu said, to really build the next generation enterprise compute platform. And in the beginning, we thought we're going to just base our technology based on Docker containers, but pretty soon Kubernetes was just clearly becoming an industry standard, so Rancher actually became the most widely used enterprise Kubernetes platform, so really with the combination of Rancher and SUSE going forward, we're going to be able to supply the enterprise container platform of choice for lots and lots of customers out there. >> Yeah, just for our audience that might not be as familiar with Rancher, why don't you give us your position in where we are with the Kubernetes landscape, I've talked about many times on theCUBE, a few years ago it was all about "Hey, are we going to have some distribution war?" Rancher has an option in that space, but today it's multicloud, Rancher works with all of the cloud Kubernetes versions, so what is it that Rancher does uniquely, and of course as you mentioned, opensource is a key piece of what you're doing. >> Exactly, Stu, thanks for the question. So this is really a good lead-up into describing what Rancher does, and some of the industry dynamics, and the great opportunity we see with SUSE. So many of you, I'm sure, have heard about Kubernetes, Kubernetes is this container orchestration platform that basically works everywhere, and you can deploy all kinds of applications, and run these applications through Kubernetes, it doesn't really matter, fundamentally, what infrastructure you use anymore, so the great thing about Kubernetes is whether you deploy your apps on AWS or on Azure, or on on-premise bare metal, or vSphere clusters, or out there in IoT gateways and 5G base stations and surveillance cameras, literally everywhere, Kubernetes will run, so it's, in our world I like to think about Kubernetes as the standard for compute. If you kind of make the analogy, what's the standard of networking, that's TCPIP, so networking used to be very different, decades ago, there used to be different kinds of networking and at best you had a local area network for a small number of computers to talk to each other, but today with TCPIP as a standard, we have internet, we have Cisco, we have Google, we have Amazon, so I really think as successful as cloud computing has been, and how much impact it has had to actually push digital transformation and app modernization forward, a lot of organizations are kind of stuck between their desire to take advantage of a cloud provider, one specific cloud provider, all the bells and whistles, versus any cloud provider, not a single cloud provider can actually supply infrastructure for everything that a large enterprise would need. You may be in a country, you may be in some remote locations, you may be in your own private data center, so the market really really demands a standard form of compute infrastructure, and that turned out to be Kubernetes, that is the true, Kubernetes started as a way Google internally ran their containers, but what it really hit the stride was a couple years ago, people started realizing for once, compute could be standardized, and that's where Rancher came in, Rancher is a Kubernetes management platform. We help organizations tie together all of their Kubernetes clusters, regardless where they are, and you can see this is a very natural evolution of organizations who embark on this Kubernetes journey, and by definition Rancher has to be open, because who, this is such a strategic piece of software, who would want their single point of control for all compute to be actually closed and proprietary? Rancher is 100% opensource, and not only that, Rancher works with everyone, it really doesn't matter who implements Kubernetes for you, I mean Rancher could implement Kubernetes for you, we have a Kubernetes distro as well, we actually have, we're particularly well-known for Kubernetes distro design for resource constrained deployments on the edge, called K3S, some of you might have heard about it, but really, we don't care, I mean we work with upstream Kubernetes distro, any CNCF-compliant Kubernetes distro, or one of many many other popular cloud hosted Kubernetes services like EKS, GKE, AKS, and with Rancher, enterprise can start to treat all of these Kubernetes clusters as fungible resources, as catalysts, so that is basically our vision, and they can focus on modernizing their application, running their application reliably, and that's really what Rancher's about. >> Okay, so Sheng, being acquired by SUSE, I'd love to hear a little bit, what does this mean for the product, what does it mean for your customers, what does it mean for you personally? According to Crunchbase, you'd raised 95 million dollars, as you said, over the six years. It's reported by CNBC, that the acquisition's in the ballpark of 600 to 700 million, so that would be about a 6X increment over what was invested, not sure if you can comment on the finances, and would love to hear what this means going forward for Rancher and its ecosystem. >> Yeah, actually, I know there's tons of rumors going around, but the acquisition price, SUSE's decided not to disclose the acquisition price, so I'm not going to comment on that. Rancher's been a very cash-efficient business, there's been no shortage of funding, but even amounts to 95 million dollars that we raised, we really haven't spent majority of it, we probably spent just about a third of the money we raised, in fact our last run to fundraise was just three, four month ago, it was a 40 million dollar series D, and we didn't even need that, I mean we could've just continued with the series C money that we raised a couple years ago, which we barely started spending either. So the great thing about Rancher's business is because we're such a product-driven company, with opensource software, you develop a unique product that actually solves a real problem, and then there's just no barrier to adoption, so this stuff just spreads organically, people download and install, and then they put it in mission-critical production. Then they seek us out for commercial subscription, and the main value they're getting out of commercial subscription is really the confidence that they can actually rely on the software to power their mission-critical workload, so once they really start using Rancher, they recognize that Rancher as an organization provide, so this business model's worked out really well for us. Vast majority of our deals are based on inbound leads, and that's why we've been so efficient, and that's I think one of the things that really attracted SUSE as well. It's just, these days you don't just want a business that you have to do heavy weight, heavy duty, old fashioned enterprise (indistinct), because that's really expensive, and when so much of that value is building through some kind of a bundling or locking, sooner or later customers know better, right? They want to get away. So we really wanted to provide a opensource, and open, more important than opensource is actually open, lot of people don't realize there are actually lots of opensource software even in the market that are not really quite open, that might seem like a contradiction, but you can have opensource software which you eventually package it in a way, you don't even make the source code available easily, you don't make it easy to rebuild the stuff, so Rancher is truly open and opensource, people just download opensource software, run it in the day they need it, our Enterprise subscription we will support, the day they don't need it, they will actually continue to run the same piece of software, and we'd be happy to continue to provide them with patches and security fixes, so as an organization we really have to provide that continuous value, and it worked out really well, because, this is such a important piece of software. SUSE has this model that I saw on their website, and it really appeals to us, it's called the power of many, so SUSE, turns out they not only completely understand and buy into our commitment to open and opensource, but they're completely open in terms of supporting the whole ecosystem, the software stack, that not only they produce, but their partners produce, in many cases even their competitors produce, so that kind of mentality really resonated with us. >> Yeah, so Sheng, you wrote in the article announcing the acquisition that when the deal closes, you'll be running engineering and innovation inside of SUSE, if I remember right, Thomas Di Giacomo has a similar title to that right now in SUSE, course Melissa Di Donato is the CEO of SUSE. Of course the comparison that everyone will have is you are now the OpenShift to SUSE. You're no stranger to OpenShift, Rancher competes against RedHat OpenShift out on the market. I wonder if you could share a little bit, what do you see in your customer base for people out there that says "Hey, how should I think of Rancher "compared to what RedHat's been doing with OpenShift?" >> Yeah, I mean I think RedHat did a lot of good things for opensource, for Linux, for Kubernetes, and for the community, OpenShift being primarily a Kubernetes distro and on top of that, RedHat built a number of enhanced capabilities, but at the end of the day, we don't believe OpenShift by itself actually solves the kind of problem we're seeing with customers today, and that's why as much investment has gone into OpenShift, we just see no slowdown, in fact an acceleration of demand of Rancher, so we don't, Rancher always thrived by being different, and the nice thing about SUSE being a independent company, as opposed to a part of a much larger organization like RedHat, is where we're going to be as an organization 100% focused on bringing the best experience to customers, and solve customers' business problems, as they transform their legacy application suite into cloud-native infrastructure. So I think the opportunity is so large, and there's going to be enough market there for multiple players, but we measure our success by how many people, how much adoption we're actually getting out of our software, and I said in the beginning, Rancher is the most widely used enterprise Kubernetes platform, and out of that, what real value we're delivering to our customers, and I think we solve those problems, we'll be able to build a fantastic business with SUSE. >> Excellent. Sheng, I'm wondering if we could just look back a little bit, you're no stranger to acquisitions, remember back when Cloud.com was acquired by Citrix, back when we had the stack wars between CloudStack and OpenStack and the like, I'm curious what lessons you learned having gone through that, that you took away, and prepared you for what you're doing here, and how you might do things a little bit differently, with the SUSE acquisition. >> Yeah, my experience with Cloud.com acquired by Citrix was very good, in fact, and a lot of times, you really got to figure out a way to adapt to actually make sure that Rancher as a standalone business, or back then, Cloud.com was a standalone business, how are they actually fitting to the acquirer's business as a whole? So when Cloud.com was acquired, it was pretty clear, as attractive as the CloudStack business was, really the bigger prize for Citrix was to actually modernize and cloudify their desktop business, which absolutely was like a two billion dollar business, growing to three billion dollars back then, I think it's even bigger now, with now everyone working remote. So we at Citrix, we not only continued to grow the CloudStack business, but more importantly, one of the things I'm the most proud of is we really played up a crucial role in modernizing and cloudifying the Citrix mainline business. So this time around, I think the alignment between what Rancher does and what SUSE does is even more apparent, obviously, until the deal actually closes, we're not really allowed to actually plan or execute on some of the integration synergies, but at a higher level, I don't see any difficulty for SUSE to be able to effectively market, and service their global base of customers, using the Rancher technology, so it's just the synergy between Kubernetes and Linux is just so much stronger, and in some sense, I think I've used this term before, Kubernetes is almost like the new Linux, so it just seems like a very natural place for SUSE to evolve into anyway, so I'm very very bullish about the potential synergy with the acquisition, I just can't wait to roll up my hands and get going as soon as the deal closes. >> All right, well Sheng, thank you so much for joining us, absolutely from our standpoint, we look at it, it's a natural fit of what Rancher does into SUSE, as you stated. The opensource vision, the community, and customer-focused absolutely align, so best of luck with the integration, looking forward to seeing you when you have your new role and hearing more about Rancher's journey, now part of SUSE. Thanks for joining us. >> Thank you Stu, it's always great talking to you. >> All right, and be sure, we'll definitely catch up with Rancher's team at the KubeCon + CloudNativeCon European show, which is of course virtual, as well as many other events down the road. I'm Stu Miniman, and thank you for watching theCUBE.

>> Announcer: Live from San Diego, California, it's theCUBE covering KubeCon and CloudNativeCon. Brought to you by RedHat, the CloudNative Computing Foundation, and its ecosystem partners. >> Stu: Welcome back to theCUBE, I'm Stu Miniman. My cohost for three days of coverage is John Troyer. We're here at KubeCon CloudNativeCon in San Diego, over 12,000 in attendance and happy to welcome back a CUBE alumni and veteran of generations of the stacks that we've seen come together and change over the time, Sheng Liang, who is the co-founder and CEO of Rancher Labs. Thanks so much, great to see you. >> Shang: Thank you Stuart, is very glad to be here. >> All right, so you know Kubernetes, flash to the pan nobody's all that excited about it. I mean, we've seen all these things come and go over the years, Sheng. No but seriously, the excitement is palpable. Every year, you know, so many more people, so many more projects, so much more going on. Help set the stage for you, as to what you see and the importance today of kind of CloudNative in general and you know, this ecosystem specifically. >> Yeah you're so right though, Stuart. Community as a whole and Kubernetes has really come a long way. In the early days, Kubernetes was a uh, you know, somewhat of a technical community, lot of Linux people. But not a whole lot of end users. Not a whole lot of Enterprise customers. I walk in today and just the kind of people I've met, I've probably talked to fifty people already who are just really at the beginning of the show and uh there's a very very large number Enterprise customers. And this does feel like Kubernetes has crossed the chasm and headed in to the mainstream Enterprise market. >> Yeah it's interesting you know I've talked to you know plenty of the people here probably if you brought up things like OpenStack and CloudStack they wouldn't even know what we were talking about. The wave of containerization really seemed to spread far and wide. At Rancher you've done some surveys, give us some of the insight. What are you seeing? You've talked to plenty of customers. Give us where we are with the maturity. >> Definitely, definitely. Enterprise Kubernetes adoption is ready for prime time. You know the So what we're really seeing is some of the early challenges a few years ago a lot of people were having problems with just installing Kubernetes. They were literally just making sure to get people educated about container as a concept. Those have been overcome. Now, uh, we're really facing next generation of growth. And people solve these days solve problems like how do I get my new applications onboarding to Kubernetes. How do I really integrate Kubernetes into my multicloud and hybrid-Cloud strategy? And as Enterprise's need to perform computing in places beyond just the data centers and the cloud, we're also seeing tremendous amount of interest in running Kubernetes on the Edge. So those are some of the major findings of our survey. >> John: That's great. So Sheng I'd love for you to kind of elaborate or elaborate for us where Rancher fits into this. Right. Rancher is, you've been around, you've a mature stack of technology and also some new announcements today so I'd kind of love for you to kind of tell us how you fit in to that landscape you just described. >> Absolutely. This is very exciting and very very fast changing industry. So one of the things that Rancher is able to play very well is we're really able to take work with the community, take the latest and greatest open source technology and actually develop open source products on top this and make that technology useful and consumable for Enterprise at large. So the way we see it, to make Kubernetes work we really need to solve problems at three levels. At the lowest level, the industry need at lot of compliant and compatible certified Kubernetes distros and services. So that's table stakes now. Rancher is a leader in providing CNCF certified Kubernetes distro. We actually provide two of them. One of them is called RKE - Rancher Kubernetes Engine. Something we've been doing it for years. It's really one of the easiest to use and most widely deployed Kubernetes distributions. But we don't force our customers to only use our Kubernetes distribution. Rancher customers can use whatever CNCF certified Kubernetes distribution or Kubernetes services they want. So a lot of our customers use RKE(Rancher Kubernetes Engine) but they also use, when they go to the cloud, they use cloud hosted Kubernetes Services like GKE and EKS. There are really a lot of advantages in using those because cloud providers will help you run these Kubernetes clusters for free. And in many cases they even throw in the infrastructure it takes to run the Kubernetes masters and etcd databases for free. If you're in the cloud, there's really no reason not to be using these Kubernetes services. Now there's one area that Rancher ended up innovating at the Kubernetes distros, despite having these data center focus and cloud focus Kubernetes distros and services. And that is one of our, one of the two big announcements today. And that's called K3S. K3S is a great open source project. It's probably one of the most exciting open source projects in the Kubernetes ecosystem today. And what we did with K3S is we took Kubernetes that's been proven in data center and cloud and we brought it everywhere. So with K3S you can run Kubernetes on a Raspberry Pi. You can run Kubernetes in a surveillance camera. You can run Kubernetes in an ATM machine. You know, we have customers trying to run now Kubernetes in a uh, factory floor. So it really helps us realize our vision of Kubernetes as a new Linux and you run it everywhere. >> Well that's great 'cause you talk about that simplicity that we need and if you start talking about Edge deployment, I don't have the people, I don't have the skillset, and a lot times I don't have the gear, uh, to run that. So you know, help connect the dots as to you know, what led Rancher to do the K3S piece of it and you know, what did we take out? Or what's the differences between K8S and the K3S? >> That's a great question, you know. Even the name "K3S" is actually somewhat a wordplay on K8S You know we kind of cut half of 8 away and you're left with 3. It really happened with some of our early traction we sawing some customers. I remember, in retrospect it wasn't really that long ago. It was like middle of last year, we saw a blog coming out of Chick-fil-A and a group of technical enthusiasts were experimenting with actually running uh, Kubernetes in very, in like Intel Nook servers. You know, they were talking about potentially running three of those servers in every one of their stores and at the time they were using RKE and Rancher Kubernetes Engine to do that. And they run into a lot of issues. I mean to be honest if you think about running Kubernetes in the cloud in the database center, uh these servers have a lot of resources and you also have a dedicated operations teams. You have an SRE to manage them, right? But when you really bring it out into branch offices and Edge computing locations, now all of the sudden, number one, these uh, the software now has to take a lot less resource but also you don't really have SREs monitoring them every day anymore. And you, since these, Kubernetes distro really has to be zero touch and it has to run just like a, you know like a embedded window or Linux server. And that's what K3S was able to accomplish, we were able to really take away lot of the baggage that came with having all the drivers that were necessary to run Kubernetes in the cloud and we were also able to dramatically simplify what it takes to actually start Kubernetes and operate it. >> So unsolicited, I was doing an event right before this one and I asked some people what they looking forward to here at KubeCon. And independently, two different people said, "The thing I'm most excited about is K3S." And I think it's because it's the right slice through Kubernetes. I can run it in my lab. I can run it on my laptop. I can on a stack of Raspberry Pis or Nooks, but I could also run it in production if I, you know I can scale it up >> Stu: Yeah. >> John: And in fact they both got a twinkle in their eye and said well what if this is the future of Kubernetes, like you could take this and you could run it, you know? They were very excited about it. >> Absolutely! I mean, you know, I really think, you know, as a company we survive by, and thrive by delivering the kind of innovation that pushes the market forward right? I mean, we, otherwise people are not going to look at Rancher and say you guys are the originators of Kubernetes technology. So we're very happy to be able to come up with technologies like K3S that effectively greatly broadened the addressable market for everyone. Imagine you were a security vendor and before like all you really got to do is solving security problems. Or if you were a monitoring vendor you were able to solve monitoring problems for a data center and in the cloud. Now with K3S you end up getting to solve the same problems on the Edge and in branch offices. So that's why so many people are so excited about it. >> All right so Sheng you said K3S is one of the announcements this week, what's the rest of the news? >> Yeah so K3S, RKE, and all the GKE, AKS, EKS, they're really the fundamental layer of Kubernetes everywhere. Then on top of that one of the biggest piece of innovation that Rancher labs created is the idea of multi-cluster management. A few years ago it was pretty much of a revolutionary concept. Now it's widely understood. Of course an organization is not going to have just one cluster, they're going to have many clusters. So Rancher is the industry leader for doing multi-cluster management. And these clusters could span clouds, could span data centers, now all the way out to branch offices and the Edge. So we're exhibiting Rancher on the show floor. Everyone, most people I've met here, they know Rancher because of that flash of product. Now our second announcement though is yet another level above Rancher, so what we've seen is in order to really Kubernetes to achieve the next level of adoption in the Enterprise we're seeing you know some of the development teams and especially the less skilled dev ops teams, they're kind of struggling with the learning curve of Kubernetes and also some of the associated technologies around service mesh around Knative, around, you know, CICD, so we created a project called Rio, as in Rio de Janeiro the city. And the nice thing about Rio is it packaged together all these Cloud Native technologies and then we created very easy to use, very simple to understand user experience for developers and dev ops teams. So they no longer have to start with the training course on Kubernetes, on Istio, on Knative, on Tekton, just to get productive. They can pretty much get productive on day one. So that Rio project has hit a very important milestone today, we shipped the beta release for it and we're exhibiting it at the booth as well. >> Well that's great. You know, the beta release of Rio, pulling together a lot of these projects. Can you talk about some folks that, early adopters that have been using them or some folks that have been working with the project? >> Sheng: Yeah absolutely. So I talk about some of the early adoption we're seeing for both K3S and Rio. Uh, what we see the, first of all just the market reception of K3S, as you said, has been tremendous. Couple of even mentioned to you guys today in your earlier interviews. And it is primarily coming from customers who want to run Kubernetes in places you probably haven't quite anticipated before, so I kind of give you two examples. One is actually appliance manufacture. So if you think they used to ship appliances, then you can imagine these appliances come with Linux and they would image their appliance with an OS image with their applications. But what's happening is these applications are becoming so sophisticated they're now talking about running the entire data analytics stack and AI software. So it actually takes Kubernetes not necessarily, because it's one server in a situation of appliance. Kubernetes is not really managing a cluster, but it's managing all the application components and microservices. So they ended up bundling up K3S into their appliance. This is one example. Another example is actually an ISV, that's a very interesting use case as well. So uh, they ship a micro service based application software stack and again their software involves a lot of different complicated components. And they decided to replatform their software on Kubernetes. We've all heard a lot of that! But in their case they have to also ship, they don't just run the software themselves, they have to ship the software to the end users. And most of their end users are not familiar with Kubernetes yet, right? And they don't really want to say, to install our software you go provision the Kubernetes cluster and then you operate it from now on. So what they did is they took K3S and bundled into their application as if it were an application server, almost like a modern day WebLogic and WebSphere, then they shipped the whole thing to their customers. So I thought both of these use cases are really interesting. It really elevates the reach of Kubernetes from just being almost like a cloud platform in the old days to now being an application server. And then I'll also quickly talk about Rio. A lot of interest inside Rio is around really dev ops teams who've had, I mean, we did a survey early on and we found out that a lot of our customers they deploy Kubernetes in services. But they end up building a custom experience on top of their Kubernetes deployment, just so that most of their internal users wouldn't have to take a course on Kubernetes to start using it. So they can just tell that this thing that, this is where my source code is and then every thing from that point on will be automated. So now with Rio they wouldn't have to do that anymore. Effectively Rio is the direct source to URL type of, one step process. And they are able to adopt Rio for that purpose. >> So Sheng, I want to go back to when we started this conversation. You said, you know, the ecosystem growing. That not only, you know, so many vendors here, 129 end users, members of the CNCF. The theme we've been talking about is to really, you know, it's ready for production and people are all embracing it. But to get the vast majority of people, simplicity really needs to come front and center, I think. K3S really punctuates that. What else do we need to do as an ecosystem, you know, Rancher is looking to take a leadership position and help drive this, but what else do you want to see from your peers, the community, overall to help drive this to the promise that it could deliver. >> We really see the adoption of Kubernetes is probably going to wing at three, I mean. We see most organizations go through this three step journey. The first step is you got to install and operate Kubernetes. You know, day one, day two. And I think we've got it down. With K3S it becomes so easy. With GKE it becomes one API call or one simple UI interaction. And CNCS has really stepped up and created a great, you know, compliance certification program, right? So we're not seeing the kind of fragmentation that we saw with some of the other technologies. This is fantastic. Then the second step we see is, which a lot of our customers are going through now, is now you have all the Kubernetes clusters coming from different clouds, different infrastructure, potentially on the Edge. You have a management problem. Now you all of the sudden because we made Kubernetes clusters so easy to obtain you can potentially have a sprawl. If you are not careful you might leave them misconfigured. That could expose a security issue. So really it takes Rancher, it takes our ecosystem partners, like Twistlock, like Aqua. CICD partners, like CloudBees, GitLab. Just everyone really needs to come together, make that, solve that management problem. So not only, uh, you build this Kubernetes infrastructure but then you actually going to get a lot of users and they can use the cluster securely and reliably. Then I think the third step, which I think a lot of work still remain is we really want to focus on growing the footprint of workload, of enterprise workload, in the enterprise. So there the work is honestly just getting started. Anywhere from uh, if you walk into any enterprise you know what percentage of their total workload is running on Kubernetes today? I mean outside of Google and Uber, that percentage is probably very small, right? They're probably in the minority, maybe even in single digit percentage. So, we really need to do a lot of work. You know, we need to uh, Rancher created this project called LongHorn and we also work with a lot of our ecosystem partners in persistence storage area like Portworx, StorageOS, OpenEBS. Lot of us really need to come together and solve this problem of running persistent workload. I mean there was also a lot of talk about it at the keynote this morning, I was very encouraged to hear that. That could easily double, triple the amount of workload that could bring, that could be onboarded into Kubernetes and even experiences like Rio, you know? Make it further simpler, more accessible. That is really in the DNA of Rancher. Rancher wouldn't be surviving and thriving without our insight into how to make our technology consumable and widely adopted. So a lot of work we're doing is really to drive the adoption of Kubernetes in the enterprise beyond, you know, the current state and into something I really don't see in the future, Kubernetes wouldn't be as actually widely used as say AWS or vSphere. That would be my bar for success. Hopefully in a few years we can be talking about that. >> All right, that is a high bar Sheng. We look forward to more conversations with you going forward. Congratulations on the announcement. Great buzz on K3S, and yeah, thanks so much for joining us. >> Thank you very much. >> For John Troyer, I'm Stu Miniman, back with lots more coverage here from KubeCon CloudNativeCon 2019 in San Diego, you're watching theCUBE. [Upbeat music]

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering Microsoft Ignite. Brought to you by Cohesity. >> Welcome back to theCUBE everyone. It is Microsoft Ignite, it is happy hour. There are people walking around with beer and wine and snacks and it is a great time. I'm your host, Rebecca Knight, along with my co-host, Stu Miniman. We are joined by Jeramiah Dooley, He is an Azure Advocate at Microsoft. >> Yes, ma'am. Thank you so much. >> Of course. CUBE vetaran, esteemed CUBE veteran coming on theCUBE. >> Yeah, I've been doing this for a while and Stu and I've gotten to talk a few times. >> Yes. >> But it's good to be back. >> Well, welcome. So you joined the Microsoft Advocacy Team a little over a year ago and I read a blog post that you wrote, "This is the most interesting period of my career." >> Agreed. >> I'd love to hear you riff on why it is such a gratifying time, what exactly you're doing as an advocate and why it's so interesting. >> Sure. So, I guess we'll start with the last part. My job as a cloud advocate is literally, simply to engage with and help communities who focus on a specific technology and help them build bridges into whatever part of Azure makes sense for them. My job specifically, is that I run a team who's focused on enterprise platforms and tools communities. And for us, that's VMware, that's OpenStack, that's CloudStack, that's any of the communities where the members of it identify themselves by the platform that they operate, not necessarily by the language that they use to write coding in or the applications that they're running. They're worried about the infrastructure portion of it, but usually, from a software standpoint. Part of the reason that it's interesting, is one, it's fun to have an advocacy role where I work as part of the engineering team. My job is simply to be that conduit between customers who say, "It would be really cool to have this," and an engineering team who is desperate for feedback from customers around what do we build and how do we build it. And especially for me, coming from the infrastructure side of things. Before Microsoft, I worked at NetApp. I was part of the SolidFire acquisition. I've worked at infrastructure companies kind of all the way down back into my service provider days. The larger transition of customers, especially enterprise customers, who are moving from one side of that divide to the other really matches up well with what I did from a career standpoint. I came to a company who looked at everything that I knew how to do technically and said we don't really need any of that but we love the context that it gives you for being able to go out and talk to these communities and show them what Azure could do. So it's very interesting to work somewhere where my involvement with the community, my involvement with the technology helps make me a bridge into something that was all new to me. Right, I'm not a developer. I didn't work inside the Azure cloud before I took the role. What I knew was the technology in the communities and Microsoft gave me the opportunity to build the other side of that which is how do we take all of those things and how do we move them into an Azure context. So it's been fantastic. >> Yeah and Jeramiah, we're at an interesting point in this journey we're going on. I think back to you know the virtualization journey and we've reached a certain point where you could virtualize anything and virtualization was growing. But getting from the 20% to the majority was challenging. I feel we're at a similar point and you know for myself, I look at where 20% of the workloads are in the cloud. This movement of data is not going to be a one-time or a one-way journey. There's my data center, there's the public cloud, there's the Edge, there's SAS. My data, my applications are everywhere and I think that's a lot of that hybrid environment. But how do we simplify this environment and make it more consumable for everyone and, tell us a little bit about what are some of the real challenges that you hear in the field and how is Microsoft in the ecosystem helping to solve that? >> It's an interesting parallel. On the 80% virtualization challenge, we had a couple things. One was workloads that we just couldn't and so we were waiting on the business side of things to give us something that we could virtualize. And then there was the law of diminishing returns on the amount of money that it would cost to virtualize them. When we look at the, I'm trying to move workloads from on-premises into the cloud, the transition challenge is similar. The big difference is it's the operational investment that is holding it back. It's not not the law of diminishing returns, it's the law of the sunken cost, right? So we've got customers who have invested decades, literal a decade into the automation and the orchestration and the run books and the what do you do at three o'clock in the morning when things go wrong all in a VMware context or all in an OpenStack context. And those are the things that are more valuable to them, frankly than the vendor who sits underneath it, right? We can change vendors as long as it doesn't impact operations. And so from an Azure standpoint, that's exactly the angle that we want to take if what you need are workloads that live inside a hyper scalar cloud and what you have to have in order to take that first step is don't touch my operations, don't touch my scripting, don't touch my infrastructure's code, don't touch any of the stuff that I've built up as your operational intellectual property over the last however many years. Don't touch any of that and that transition becomes easy. And then once I have a footprint, now I can be real selective about cherry-picking which of these cloud native services make sense and how can I as a customer choose with when my operations team starts to have to take on some of these additional burdens rather than what I feel like the perception is, which is as soon as I get anything from Azure, my entire operations team now has two jobs and everybody has twice the amount of work to do. And then I have to go hire new experts because these work these skills don't translate. And so if we can make it easy to do that initial move without having to change anything and then give customers a very transparent way to decide what cloud services are they going to adopt and how is it that they're going to manage that impact on their operations teams, I think we've got a path that really starts to overcome some of those initial fears. >> But customers are on a continuum, I mean, wouldn't you say just in terms of where they are, in terms of where they are in the technology and then also their mindset and how much they're willing to adopt and change? >> Yep. I think that the group that I'm in, the larger group that I'm in mirrors that. We have four different teams, three teams in addition to mine that sit on that continuum from are we an infrastructure community, that are we a platform community to are we a workload community particularly on the Microsoft side to identify by the workloads that I run, to am I a modern operations community, the SRE principles, the things that we're doing from a culture standpoint to be able to build operations teams that can manage this type of environment. And then finally, are we developers and do we want to really look at the DevOps side of things and how do we tie the developers and their needs back organically in? And I think that customers are on a continuum all the way across but even before they get into that, we went through the virtualization journey and now we're trying to figure out how can I be efficient, how can I take advantage of things that I really don't want to have to build on premises. I would love to have someone else take care of that for me but how can I do that without swamping the humans that have to take care of all the things in the background? >> Yeah, so Jeramiah, we actually had a guest on earlier that said there's companies that would consider themselves a Microsoft shop just like there were people that would say, you know I'm Cisco certified and that is my job. How's Microsoft helping customers move kind of beyond that vendor view to with the language that we hear from Satya Nadella is about business outcomes and the agility and what we all talk about is how the future should be. But you know, it's very difficult inside the enterprise organization to change those roles and rescale and learn up or hire people into that. You've got those four teams maybe. How does Microsoft help people move along this journey? >> I think rule number one is meet customers where they are. It's not our job to dictate how fast customers move or what direction they move in. It's our job to build bridges, maybe lots of bridges and let customers decide which of them make make the most sense. If we can meet customers where they are today and in the case of VMware, that means building a bare-metal environment that we can deploy VMware on to so that customers can take advantage of it without having to change any of their operational stuff. Then, I get to compete on the merits of the services as your offers and I'm happy to do that. Once we have those workloads in a place where you can take advantage of managed database instances or no sequel geographic distribution models that you didn't have the ability to build on your own or even intelligent Edge connected firewalls or application load bouncers. There's so much stuff in there that when we talk to the operations teams, they're like, "I want that and I would like that now", and we just don't have the ability always to push that down into the on premises side of things. So meeting them where they're at and then doing a good job of translating the value, the business value of the services that we offer into the language of that audience. And I really think that's where the advocacy team comes in. It is almost a business value translator where we look at all these things in the Azure marketplace and say here's why this matters to you. Here are the things that you're doing today that we could make go away. Let's work on figuring out what the return on that investment would be to find out if it's a good business deal. >> And the thing about Microsoft is that it has been around for so long that so many of these companies have had decades-long relationships with Microsoft which is not something you could say about all the other cloud providers because they are relatively newer to the scene. >> And good and bad right? I mean on the good side, there's literally not an enterprise that I walk into that there isn't some Microsoft relationship. In many cases, that allows us to be really aggressive and going to customers and saying the licensing on premises that you're trying to move away from has a Microsoft logo on it and the cloud that you're looking to move into has a Microsoft logo on it. Let's figure it out. Sometimes, I mean every, especially large customers, they've got multiple vendors in there, there have always been things that have happened along the way in that relationship but absolutely it's great to be able to look at a customer and know. Even if you're not an Azure customer, I promise your Microsoft customer that gives us some sort of common ground to be able to start that process. >> Yes, so we know that the customer experience is so very important but one of the other experiences is the employee experience. I've got great respect for Microsoft. I've worked with them most of my career but Jeramiah, there's a number of people I know that 10 years ago would never have joined Microsoft but now find themselves working for Microsoft. Give us a little viewpoint as to how kind of the Microsoft of the Satya Nadella era is different from what we might have seen in previous days. >> It's a great point and I know that when I interviewed with Microsoft and went through my loop with some of the people that you're going to have on the show this week. That was my question was would you have seen yourself working for the Microsoft two/five years ago and especially when we're talking about the SRE and the DevOps folks. It's just a categorical no across the board and I think it's from a personal standpoint, the idea that it is new technology that we're looking at, that everything I've done in the last 18 months has been something that I got to learn from the ground up, new content, new technologies, new ways to translate that into customers. I thought that working for a giant company like this would be challenging from a logistical standpoint. What really has been challenging is from a focus standpoint. There is so much to focus on, to learn. I mean even just looking around this place you can get lost wandering through just the hub and the social spaces. My challenge has been less of is this a good place to work or is the culture something that fits and more, what are the... I'm never going to know everything. What are the small number of things that I can focus on and really provide value for? But overall, culture wise, I love the "empower of everyone on the planet" messaging and when you walk onto the floor and you see the tag line, "You can't empower everyone unless you include everyone". It's just really fun to be at a place where you can feel excited about those things and having worked in IT, particularly on the infrastructure side for a long time, that's not always the case. So if you're excited about the type of company that you're going to work for and I have all of these toys to play with and I have so much stuff that I can learn and get involved in and then translate back in to that core enterprise community. No, this has been, not just the most interesting 18 months but we're talking about this is a hard job not to love with the opportunity that we get and then the technology we get to work with. >> That's a great note to end on. Jeramiah Dooley, thank you so much for coming on theCUBE. >> Of course, thank you. >> I'm Rebecca Knight with Stu Miniman. Stay tuned for more of theCUBE. (upbeat music)

from our studios in the heart of Silicon Valley Palo Alto California this is a cute conversation hello and welcome to this special cube conversation here in Palo Alto California cube headquarters I'm Jennifer echoes the cube our guest here is Megan Eisenberg CMO of a new hot company called trip actions formerly the CMO at MongoDB before that taki sign we've known each other some advisory boards great to see you yes great to see you as well so exciting new opportunity for you at trip actions just transitioned from MongoDB which by the way had great earnings they did what was the big secret to Mongo DB z earnings tell us well it's fresh and I think they're executing and their growth is amazing they're bringing their costs down I mean they're they've got product market fit their developers love them and so I'm proud and not surprised you're there for four years yeah transformed their go-to market so that fruits coming off the tree yes yeah it's exciting to see the you know process people technology all coming together and seeing them scale and do so well in the markets yes you know being here in 20 years living in California Palo Alto you see the rocket ships the ones that flame out the ones that make it and there's a pattern right when you start to see companies that are attracting talent ones that have pedigree VCS involved yeah raising the kind of rounds in a smart way where there's traction product market fit you kind of take special notice and one of the companies that you're now working for trip actions yes seems to have the parameters so it's off the pad it's going up its orbit or taking off you guys have really growing you got a new round of funding one hundred fifty million dollars yes unique application in a market that is waiting to be disrupted yes travel about company you work for transactions trip actions is a fast growing business travel platform we service customers like we work slack zoom box and we're growing we're adding 200 customers a month and it's amazing just to see these fast-growing companies right when they hit product market fit I think the keys are they've gotten a massive addressable market which we have 800 billion online travel they're solving a pain and they're disrupting a legacy the legacy providers that are out there we're three and a half years old and we are you know really focused on the customer experience giving you the choice that you want when you book making it easy down to six minutes not an hour to book something and we've got 24/7 support which not many can compete with you know it's interesting you know I look at these different ways of innovation especially SAS and mobile apps you know chapter one of this wave great economics yeah and once you get that unit economics visibility say great SAS efficacious happened but now we're kind of in a chapter two I think you guys kind of fit into this chapter to where it's not just SAS cuz you know we've seen travel sites get out there you book travel it's chapter two of SAS is about personalization you see machine learning you got cloud economics new ventures are coming out of the woodwork where you could take a unique idea innovate on it and disrupt a category that seems to be what you guys are doing talk about this new dynamic because this is not just another travel app when you guys are doing gets a unique angle on this applying some tech with the Corpse talked about that this chapter to kind of assess business I think when I think about chapter 2 I think about all the data that's out there I think about the machine learning I think about how we understand the user and personalize everything to them to make it frictionless and these apps that I love on my phone are because they they know what I want before I want it and I just took a trip to Dallas this week and the app knew I needed to check in it was one click told me my flight was delayed gave me options checked me in for my hotel I mean it was just amazing experience that I haven't seen before and it's really if you think about that that business travel trip there's 40 steps you have to do along the way there's got to be a way to make it easier because all we want to do is get to the business meeting and get back we don't want to deal with weather we don't want to deal with Hotel issues or flight changes and our app is specific to when you look at it you've got a chat 24/7 and someone's taking care of you that concierge service and we can do that because the amount of data we're looking at we're learning from it and we make it easier for travel manager half the people go rogue and don't even book through their travel solution it's because it's not tailored to them so this is the thing I want to get it so you guys aren't like a consumer app per se you have a specific unique target audience on this opportunity its travel management I'm I'm gonna date myself but back when I broke into the business they would have comes like Thomas Cook would handle all the travel for youlet Packard when I worked there in the 80s and you had these companies I had these contracts and they would do all the travel for the employees yes today it's hard to find that those solutions out there yes I would say it's hard to find one that you love and trip Actions has designed something that our travelers love and it is it's for business travel it's for your business trips it's taking care of your air your hotel your car your rail whatever you need and making sure that you can focus on the trip focus on getting there and not just the horrible experience we've all had it you travel a lot I traveled certainly back and forth to the East Coast and to take those problems away so I can focus on my business is what it's so just just look at this right so you guys are off to unicorn the funding great valuation growing like crazy got employees so people looking for jobs because they're hiring probably yeah but you're targeting not consumers to download the app it's for businesses that want to have company policies and take all that pressure off yes of the low so as a user can't buy myself can't just use the app or get I know you can Nano that's the the the whole thing is that as a user there's three things we're providing to one inventory and choice so you go and you know all the options you get the flight you want it's very clear and art we have a new storefront where it shows you what's in policy what's not so we've got that its ease of use it's booking quickly nobody wants to waste time dealing with this stuff right you want to go in booked quickly and then when you're on the trip you need 24/7 support because things go wrong airline travel gets cancelled weather happens you need to change something in your trip and so yes the user has the app on their phone can book it can you do it fast and can get support if they need it so stand alone usually can just use it as a consumer app but when you combine with business that's the magic that you guys see is that the opportunity yes I should say as a consumer as a business traveler so you're doing it through your company so I'm getting reimbursed for the companies the company is your customer yes the company's our customer is the traveler yes okay got it so if we want to have a travel desk in our company which we don't have yet yes it would we would sign up as a company and then all your employees would have the ease of use to book travel so what happens what's the sum of the numbers in terms of customers you have said 200 month-over-month yes we're over 1500 customers we're adding 200 a month we've got some significant growth it's amazing to see product market and the cost of the solution tell people $25 a booking and there's no add-on costs after that if you need to make as many changes as you need because of the trip calls on it you do it so basically per transaction yes well Little Feat one of our dollars yes okay so how do you guys see this growing for the company what's the some of the initiatives you guys are doing a new app yes mo what's what's the plan it's a massive market 800 billion right and we've only just started we've got a lot of customers but we've got many more to go after we are international so we have offices around the world we have an Amsterdam office we've got customers travelling all over so we're you know continuing to deliver on that experience and bringing on more customers we just on-boarded we were ten thousand travelers and will continue to onboard more and more so as head of marketing what's the current staff you have openings you mentioned yet some some some open recs yes yes hi are you gonna build out I've got 20 open Rex on the website so I'm hiring in all functions we're growing that fast and what's the marketing strategy what's your plan can you give it a little teaser on yes thinking core positioning go to market what are some of the things you're thinking about building out marketing CloudStack kind of thing what's what's going on all of these things my three top focuses are one marketing sales systems making sure we have that mark tech stack and that partnership with the sales tech stack second thing is marketing sales alignment that closed-loop we're building we're building pipeline making sure when people come in there's a perfect partnership to service what they need and then our our brand and messaging and it's the phase I love in these companies it's really building and it's the people process and technology to do that in the core positioning is what customer service being the most user-friendly what's the core position we're definitely focused on the traveler I would say we're we're balancing customer experience in making sure we get that adoption but also for the travel managers making sure that they can administer the solution and they get the adoption and we align the ascent in the incentives between the traveler and the travel manager and customer profile what small munis I business to large enterprise we have SMB and we're going all the way up to enterprise yes has it been much of a challenge out there in the business travel side I'm just don't know that's why I'm asking is like because we don't have one I can see our r-cube team having travel challenge we always do no centralizing that making that available but it'd have to be easier is it hard to get is there a lot of business travel firms out there is what are some of the challenges that you guys are going after there well I I think what matters is one picking the solution and being able to implement it quickly we have customers implementing in a week right it's understanding how we load your policies get you on board get your cut you're you're really your employees traveling and so it's pretty fast onboarding and we're able to tailor solutions to what people need what are some of the policies that are typical that might be out there that people like yeah so maybe for hotels you may have New York and your your policy is $500 a night what the I would say a normal typical behavior would someone would book it at $4.99 they go all the way up to the limit we've actually aligned our incentives with the travel managers and the employees and that if you save your company money you save and get rewards back so let's say you book it for 400 that $100 savings $30 goes back to the employee and rewards they can get an Amazon card donate to Cherry charity whatever they'd like to kind of act like an owner cuz they get a kickback yes that's the dot so that's how you an interest adoption yes what other adoption concerns you guys building around with the software and or programs to make it easy to use and we're constantly thinking about the experience we want to make sure just I mean I think about what I used to drive somewhere I'd pull out a map and map it out and then I got lucky and you could do MapQuest and now you have ways we are that ways experience when you're traveling we're thinking about everything you need to do that customer when they leave their front door all the way to the trip all the things that can hang them up along the way we're trying to remove that friction that's a very example I mean Waze is a great service yes these Google Maps or even Apple Maps ways everyone goes to backed away yes yeah I don't I mean ways did cause a lot of Street congestion the back streets of Palo Alto we're gonna expedite our travelers well it's a great utility new company what what attracted you to the opportunity when was some of the because you had a kid going over there MongoDB what it was the yeah motivation to come over to the hot startup yeah you know I love disruptive companies I love massive addressable markets good investors and a awesome mission that I can get behind you know I'm a mom of three kids and I did a lot of travel I'm your typical road warrior and I wanted to get rid of the pain of travel and the booking systems that existed before trip actions and so I was drawn to the team the market and the product that's awesome well you've been a great CMO your career has been phenomenal of great success as a CPM mother of three you know the challenges of juggling all this life is short you got to be using these apps to make sure you get on the right plane I mean I know I'm always getting back for my son's lacrosse game or yes event at school this is these are like it's like ways it's not necessary in the travel portfolio but it's a dynamic that the users care about this is the kind of thing that you guys are thinking about is that right yeah definitely I mean I always think about my mom when she worked in having three daughters and I work and have three daughters I feel like I can do so much more I've got door - I've got urban sitter I've got ways I've got Google Calendar I've got trip actions right I've got all these technologies that allow me to do more and not focus on things that are not that productive and I have no value add on it just makes me more efficient and productive how about some of the tech before we get in some of the industry questions I want to talk about some of the advantages on the tech side is there any machine learning involved what's some what's not what's some of the secret sauce and the app yeah definitely we're constantly learning our users preferences so when you go in we start to learn what you what hotels you're gonna select what where do you like to be near the office do you like to be near downtown we're looking at your flights do aisle window nobody wants middle yes but we're we're learning about your behaviors and we can predict pretty closely one if you're gonna book and two what you're gonna book and as we continue learning you that's why we make you more efficient that's why we can do it in six minutes instead of an hour that's awesome so Megan a lot of things going on you've been a progressive marker you love Terry's tech savvy you've done a lot of implementations but we're in a sea change now where you know people that think differently they gonna think okay I need to be on an app for your case with with business travel it's real policies there so you want to also make it good for the user experience again people centric this personalization has been kind of a cutting edge concept now in this chapter to a lot of CMOS are either they're they're not are trying to get there what are you finding in the industry these days that's a best practice to help people cross that bridge as they think they cracked the code on one side then realize wow it's a whole another chapter to go you know I think traditionally a lot of times we think we need we're aligning very much with sales and that matters that go to market marketing sales aligned but when it comes to products and a customer experience it's that alignment with marketing and the product and engineering team and really understanding the customer and what they want and listening and hearing and testing and and making sure we're partnering in those functions in terms of distribution getting the earned concept what's your thoughts on her and media yeah I mean I definitely think it's the direction right there's a ton of noise out there so you've got to be on topic you've got to understand what people care about you've got to hit them in the channel that they care about and very quick right is you don't have time nobody's gonna watch something that's 30 minutes long you get seconds and so part of the earned is making sure you're relevant you what they care about and they can find you and content big part of that for you guys huge part of it yes and understanding the influencers in the market who's talking about travel who's who is out there leading ahead you know leading in these areas that travel managers go and look to you know making sure we're in front of them and they get to see what we're delivering I like how you got the incentives of the employees to get kind of a line with the business I mean having that kind of the perks yes if you align with the company policies the reward could be a Starbucks card or vacation one more time oh whatever they the company want this is kind of the idea right yeah they kind of align the incentives and make the user experience both during travel and post travel successful that's right yes making sure that they are incented to go but they have a great experience okay if you explain the culture of the company to someone watching then maybe interested in using the app or buying you guys as a team what's the trip actions culture like if you had to describe it yeah I would say one we love travel too we are fast growing scaling and we're always raising the bar and so it's learning and it's moving fast but learning from it and continually to improve it's certainly about the user all of the users so not just the travel manager but our travelers themselves we love dogs if you ever come to the Palo Alto office we've got a lot of dogs we love our pups and just you know building something amazing and it's hard to be the employees gonna know that's a rocket ship so it's great get a hold on you got a run hard yes that's the right personality to handle the pace because you're hiring a lot of people and I think that's a part of the learning we need continual learning because we are scaling so fast you have to reinvent what we need to do next and not a lot of people have seen that type of scale and in order to do it you have to learn and help others learn and move fast well great to see you thanks for coming in and sharing the opportunity to give you the final plug for the company share what who you what positions you're hiring for what's your key hires what are you guys trying to do give a quick plug to the company yeah so I mean we've grown 5x and employees so we're hiring across the board from a marketing standpoint I'm hiring in content and product marketing I'm hiring designers I'm hiring technical I you know I love my marketing technology so we're building out our tech stack our website pretty much any function all right you heard it here trip actions so when you get the product visibility those unit economics as they say in the VC world they've got a rocket ship so congratulations keep it up yeah now you're in palo alto you can come visit us here anytime yes love to Meagen Eisenberg CMO trip access here inside the cube I'm John Ferrier thanks for watching you [Music]

(inspirational music) >> Hello, I'm Peter Burris of Wikibon. Welcome to another Cube Conversation. We're going to have a great time talking over the next few minutes about the role that performance in the data plain is going to play at making possible both the options provided by the Cloud, but at the same time in a way that actually allows us to actually run the applications at the speed and the scale the business requires. To do that, we've got Marc Fleishman, who's the CEO and founder of Datera, and Marc Churchward who's the Executive Chairman at Datera. Welcome back to theCube, guys. >> Thank you for having us, Peter. >> So, Marc, I want to start with what I started with. That at the end of the day we've got this enormous agility that we're provided with in the CloudStack, but you still have to run on real computers that have real constraints and everybody knows that there is no greater constraint than maintaining the state of data and moving data. So how does Datera address those issues? >> Part of data freedom obviously is not only about automation, the the promise of software-defined storage is seamless automation. But unfortunately in many cases with unimpressive performance. In our case, we've engineered the whole data path down to the physical devices, ourselves. The levels of performance we can deliver is millions of IOPS across the data center at less than two hundred microseconds latency. Most importantly, on standard servers, over standard protocols, so nothing fancy in terms of hardware required. That's the true promise of software-defined storage. >> Now you mentioned automation. That kind of performance has got to open up new classes of automation potential, so that the storage or the data resources are that much easier to envision, that much easier to apply, that much easier to exploit by the development community. Tell us a little bit about how automation plays into this. >> Absolutely, once you've made data delivery frictionless, and you've made data orchestration and data automation frictionless, you do unlock new classes of applications. What we're specifically seeing is folks who traditionally run an array of databases on very dedicated proprietary hardware, and then again they get the data trapped in those silos, and they have a real hard time to extract the value off that data, we see a lot of database farms coming on our unified platform across the data center, basically being able to really extract the value of the data across a range of applications. >> Now we've been in the last few years investing pretty heavily in storage area networks and arrays and those types of resources. Flash is changing that, but it sounds as though you guys are actually making it easier to bring servers into the mix of this. What's the real direction you see? Where's this resource going to be managed by and what's the opportunity? >> Ultimately the resource should be managed by the applications, it should be driven by the applications and managed by machine learning. So as we understand the requirements of the applications, every individual application, it should be managed by machine learning in terms of the physical resources on the servers. The server capabilities you put underneath it, and then obviously start rolling the server hardware, as technology improves as well over time. >> So it's really being driven by the server, that's where the market opportunity's coming from. >> That's right, yes. >> The last question I have here is, when we think about new technology, new classes of automation, new trends in the industry, people always immediately go, "Yeah, but new companies?" Where does Datera fit in its lifecycle as it works with customers and as it delivers value out? >> If you look at the market today, server-based storage is already larger than traditional array-based storage. It's growing at five X, year by year. Since we've been on theCUBE the last time, about two years ago, we are now looking at a 240% kegger every year, so the market has clearly come our way. This is the time for this kind of product. >> So the market's good, company's good, trends are good. As we think ultimately about where this ends up in a few years, what role will Datera play within the evolved computing industry? What do you see for it? >> Given that we have the broad data orchestration, enterprise performance and choice on hardware, we really do see ourselves as the data foundation for the software-defined data center. What I mean by that, again, just in an operational model, we are to data what Cooper Ladies is to compute, across a number of operating environments. So it's a really broad data foundation for everyone who wants to deliver ITS service. >> Guy, I have a very simple question for you, very complex answer. One of the places where this seems to be especially important, where the need is especially great, is in that world of analytics. Especially as we try to close the loop between the analytical systems and the operational systems. How does Datera and analytics come together, not just in the use of analytics to make Datera better, but Datera in making analytics applications run better. >> Yeah, and as you said, an easy question, complicated answer. In reality, what companies are trying to do is to run the analytics at the speed of which they're competing in their market space. Which means that it has to get a lot faster. Today's classic environment is an ETL with a data leak, so parking stale data and analyzing it, post-event and tomorrow, in an environment where people are using AI and ML is now in stream and it's in real time. So part of that is you actually have very very fast applications, both from a performance perspective, but also how long their lifecycle is. Because people are doing AB testing on the web, they're doing analytics on the fly, and it really is a kind of a different world. It's a different pace. When I started this business, or when I was in business early and I had hair, we used to look at organizations that had applications that were lasting 10 or 20 years. Now we're looking at enterprise applications that are up and down within a period of months, if not weeks. So managing that lifecycle and not having to invest in infrastructure to support something, that age-old adage of you don't buy an application if it's in 1.0 is gone. Because by the time you're into 1.1, that opportunity's disappeared as well. So, part of what I saw in the attraction with Datera is because it's absolutely software-defined, and all the resilience handles in the software not the hardware. There's not the infrastructure burden. It has much more agility to get up. It can provide tier zero, tier one. Again, you land and expand, so in test endeavor you have the same environment. By a matter of flipping a few switches, you can have tier-one-ilities and then you can drop down in that lifecycle. It doesn't matter whether it's on premise, whether it's a distributed environment or on Cloud. It's the same infrastructure, same architecture, so, back to what Marc said, you have data freedom. >> So we're trying to tie the physical realities of data, to the virtual realities of machine resources in IT, to the Cloud realities of the new wave of applications. >> That's exactly right. >> Marc Fleishman, CEO and founder of Datera, Guy Churchward, Executive Chairman of Datera, thanks very much for being on theCUBE. >> Thanks for having us Peter. >> Thank you Peter. >> And once again, this is Peter Burris, Wikibon, thanks for watching theCUBE. (inspirational music)

>> Narrator: Live from Las Vegas. It's theCUBE. Covering VMWorld 2017. Brought to you by vmware and it's ecosystem partners. (bright pop music) >> Welcome back to theCUBE on day three of our continuing coverage of VMWorld 2017. I'm Lisa Martin. My co-host for this segment is John Troyer and we're excited to be joined by Rob Young, who is a CUBE alumni and the manager of product and strategy at Red Hat. Welcome back to theCUBE, Rob. >> Thanks, Lisa. It's great to be here. >> So, Red Hat and VMware. You've got a lot of customers in common. I imagine you've been to many many VMworlds. What are you hearing from some of the folks that you're talking to during the show this week? >> So, a lot of the interest that we're seeing is how Red Hat can help customers, VMware or otherwise, continue to maintain mode one applications, legacy applications, while planning for mode two, more cloud-based deployments. We're seeing a large interest in open-source technologies and how that model could work for them to lower cost, to innovate more quickly, deliver things in a more agile way, so there's a mixture of messages that we're getting, but we're receiving them loud and clear. >> Excellent. You guys have a big investment in OpenStack. >> Yes we do and even back in the early days when OpenStack was struggling as a technology, we recognized that it was an enabler for customers, partners, large enterprises that wanted to create and maintain their own private clouds or even to have a hybrid cloud environment to where they maintained and managed, controlled some aspect of it, while having some of the workloads on a public cloud environment as well so Red Hat has invested heavily in OpenStack to this point. We're now in our 11th version of Red Hat OpenStack platform and we continue to lead that market as far as OpenStack development, innovation, and contributions. >> Rob, we were with theCUBE at the last OpenStack summit in Boston. Big Red Hat presence there, obviously. I was very impressed at the maturity of the OpenStack market and community. I mean, we're past the hype cycle now, right? We're down to real people, real uses, real people using it. A lot of very, people with a strong business critical investment in OpenStack and many different use cases. Can you kind of give us a picture of the state of the OpenStack market and userbase now that we are past that hype cycle? >> So, I think what we're witnessing now in the market is that there's a thirst for OpenStack. One, because it's a very efficient architecture. It's very extensible. There's a tremendous ecosystem around the Red Hat distribution of OpenStack and what we're seeing from enterprises, specifically the TelCo industry, is that they see OpenStack as a way to lower their cost, raise their margins in a very competitive environment, so anywhere you see an industry or a vertical where there's very heavy competition for customers and eyeballs, that type of thing. OpenStack is going to play a role and if it's not already doing so, it's going to be there at some point because of the simplification of what was once complex but also in the cost savings, it could be realized by managing your own cloud within a hybrid cloud environment. >> You mention TelCo and specifically OpenStack kind of value for companies that need to compete for customers. Besides TelCo, what other industries are really kind of primed for embracing OpenStack technologies? >> So, we're seeing it across many industries, finance and banking, healthcare, public sector, anywhere where there's an emphasis on the move to open source and to open compute environment, open APIs. We're seeing a tremendous growth in traction and because Red Hat has been the leader in Linux, many of these same customers who trust us for Red Hat Enterprise Linux, are now looking to us for the very same reason on OpenStack platform, because much like we have done with Enterprise Linux, we have adopted an upstream community-driven project. We have made it safe to use within an environment in an enterprise way, in a supported way as well, the subscription. So, many industries, many verticals. We expect to see more, but primary-use cases, NFE and TelCo, healthcare, banking, public sector are among the top dogs out there. >> Is there a customer story that kind of stands out in your mind as really a hallmark that showcases the success of working with Red Hat and OpenStack? >> Well there are many customers, there are many partners that we have out there that we work with, but I would say that if you look at some of the, four of out of five of the large TelCos - Orange, Ericsson, Nokia, others that we've recently done business with would be really good examples of not only customer use cases but how they're using OpenStack to enable their customers to have better experience with their cell networks, with their billing, with their availability, that type of thing. And we had two press announcements that came out in May, one is an educational institution of a consortium, a very high profile Northeast learning institutions, public institutions, that are now standardized on OpenStack and that are contributing, and we've also got Oakridge, forgive me, it escapes me, but there's a case study out there on the Red Hat website that was posted on May the eighth that depicts how they're using our product and how others can do the same. >> Rob, switching over a little bit to talking a little bit more about the tech and how the levers get pulled, right, we're talking about cloud, right, another term, "past the hype cycle," right? It's a reality. And when you're talking about cloud, you're talking about scale. >> Rob: Yes. >> We mentioned Linux, OpenStack, and Red Hat kind of built on a foundation of Linux, it's super solid, super huge community, super rich, super long history, but can you talk about scale up, scale out, data center, public cloud, private, how are you seeing enterprises of various sizes address the scale problem and using technologies like the Red Hat and CloudStack to address that? >> So there's a couple things, there's many aspects to that question but what we have seen from OpenStack is when we first got involved with the project, it was very much bounded by the number of servers that you needed to deploy an OpenStack infrastructure on. What Red Hat has done, or what we've done as a company is we've looked at the components and we have unshackled them from each other, so that you can scale individual storage, individual network, individual high availability, on the number of servers that best fit your needs. So if you want to have a very large footprint with you know, many nodes of storage, you can do that. If you want to scale that just when peak season hits, you can do that as well. But we have led the community efforts to de-shackle the dependencies between components so from that aspect we have scaled the technology, now scaling operational capabilities and skillsets as well. We've also led the effort to create open APIs for management tools. We've created communities around the different components of OpenStack and other outsourced technologies - >> Automation a big part of that as well, right? >> Automation as well, so if you look at Ansible, as an example, Red Hat has a major stake in Ansible, and it is predominantly the management scripting language of choice, or the management platform of choice, so we have baked that into our products, we have made it very simple for customers to not only deploy things like OpenStack but OpenShift, CloudForms, other management capabilities that we have, but we've also added APIs to these products so that even if you choose not to use a Red Hat solution, you can easily plug in a third-party solution or a home-grown solution into our framework or our stack so that you can use our toolset, single pane of glass, to manage it all. >> So with that, can you tell us a little bit about the partner ecosystem that Red Hat has, and what you've done sounds like to expand that to make your customers successful in OpenStack deployments. >> Absolutely, so as you're aware, Red Hat Enterprise Linux, we certified most of the hardware, or all of the hardware, OEMs on Red Hat Enterprise Linux. We have a tremendous ecosystem around Enterprise Linux. For OpenStack, this is probably one of the most exciting aspects of Red Hat right now. If you look at the ecosystem and the partners that are just around OpenStack on its own, we've got an entire catalog of hundreds of partners, some at a deeper level than others, integration-wise, business-wise, whatever, but the ecosystem is growing and it's not because of Red Hat's efforts. We have customers and partners that are coming to us saying, we need a storage solution, we're using, you know, NetAMP as an example. You need to figure out a way to integrate with these guys, and certify it, make sure that it's something that we've already invested in, it's going to work with your product as well as it works with our legacy stuff. So the ecosystem around OpenStack is growing, we're also looking at growing the ecosystem around OpenShift, around Red Hat virtualization as well, so I think you'll see a tremendous amount of overlap in those ecosystem as well, which is a great thing for us. The synergies are there, and I just think it's only going to help us multiply our efforts in the market. >> Go ahead John. >> Oh Rob, talking again, partnerships, I've always been intrigued at the role of open source upstream, the open source community, and the role of the people that take that open source and then package it for customers and do the training, enablement. So can you talk maybe a little bit about some of the open source partners and maybe how the role of Red Hat in translating all that upstream code into a product that is integrated and has training, and is available for consumption from the IT side. >> Sure. So at Red Hat, we partner not only with open source community members and providers but also with proprietaries. So I just want to make sure that everybody understands we're not exclusive to who we partner with. Upstream, we look for partners that have the open source spirit and mind, so everything that they're doing that they're asking us to either consider as a component within our solution or to integrate with, we're going to make sure that they're to the letter of the law, contributing their code back, and there's no hooks or strings attached. Really the value comes in, are they providing value to their customers with the contribution and also to our combined customers, and what we're seeing in our partnerships is that many of our partners, even proprietary partners like Microsoft as an example, are looking at open source in a different way. They're providing open source options for their customers and subscription-based, consumption-based models as well, so we hope that we're having a positive impact in that way, because if you look at our industry it's really headed toward the open source, open API, open model and the proprietary model still has the place and time I believe but I think it's going to diminish over time and open source is going to be just the way people do business together. >> One of the things that you were talking about kind of reminded me of one of the things Michael Dell said yesterday during the keynote with Pat Gelsinger and that was about innovation and that you really got to, companies to be successful need to be innovating with their customers and it sounds like that's definitely one of the core elements of what you're doing with customers. You said customers and partners are bringing us together to really drive that innovation. >> Yeah, I couldn't agree more. It's an honor to be mentioned in the same breath as Michael Dell, by the way. But what we see is because of the open source model, you can release early and often, and you can fail early, and what that does is encourage innovation. So it's not only corporations like Red Hat that are contributing to upstream projects, OpenStack as an example or Linux as an example, or KVM as an example. There's also college students, there's people out there who work for Bank of America. Across the fruited plains all over the world. And the one thing that unites us is this ability to recognize the value of our contributions to an open source community, and we think that that really helps with agile development, agile delivery, and if you look at our project deliveries for OpenStack as an example, OpenStack releases a major version of its product every six months. And because of contributions that we get from our community, we're able to release our - and testing, it's not just, contributions come in many forms. Testing is a huge part of that. Because of the testing we get from a worldwide community, we're able to release shortly after a major version of upstream OpenStack because that innovation. In a pure waterfall model, it's not even possible. In an open source model, it's just the way of life . >> So as we're kind of wrapping up VMworld day three, what are some of the key takeaways for you personally from the event and that Red Hat has observed in the last couple of days here in Las Vegas. >> So there's a couple of observations that have kind of been burned into my brain. One is we believe at Red Hat, our opinion is that virtualization as a model will remain core, not only to legacy applications, mode one, but also to mode two, and the trend that we see in the model, that we see is that for mode two, virtualization is going to be a commodity feature. People are going to expect it to be baked into the operating system or into the infrastructure that they're running the operating system or their applications on. So we see that trend and we've suspected it, but coming to VMworld this week helped confirm that. And I say that because of the folks I've talked to, after sessions, at dinner, in the partner pavilion. I really see that as a trend. The other thing I see is that there's a tremendous thirst within the VMware customer base to learn more about open source and learn more about how they can, you know, leverage some of this not only to lower their total cost of ownership and not to replace VMware, but how they can complement what they've already invested in with faster, more agile-based mode two development. And that's where we see the market from a Red Hat standpoint. >> Excellent. Well there's a great TEI study that you guys did recently, Total Economic Impact, on virtualization that folks can find on the website. And Rob, we thank you for sticking around and sharing some of your insights and innovations that Red Hat is pioneering and we look forward to having you back on the show. >> Great to be here. Thanks. >> Absolutely, and for my co-host John Troyer, I'm Lisa Martin and you're watching theCUBE's continuing coverage, day three, of VMworld 2017. Stick around, we'll be right back. (bright pop music)

>> Announcer: Live, from Boston, Massachusetts, it's The Cube, covering OpenStack Summit 2017. Brought to you by the OpenStack Foundation, Red Hat, and additional ecosystem support. (upbeat techno music) >> Welcome back, I'm Stu Miniman, joined by my co-host for the week, John Troyer. We've been talking this week about how OpenStack, there's real clouds, there's real deployments. I'm happy to welcome to the program two people that have done this with Adobe Advertising Cloud. We have Joseph Sandoval, who is the engineering manager at Adobe Advertising Cloud, and Nicolas Brousse, who is director of operations engineering. Gentlemen, thanks so much for joining us. >> Thank you for letting us join. >> Thank you. >> Nicolas, I'm sorry Joseph, we actually had you on the program at the Silicon Valley OpenStack Days a little while ago. Refresh our audience, though, a little bit, your background, how OpenStack fits in with your role, and what you do. >> Sure. Now, I've been in, a long time, in the OpenStack community, at that time when I was at the Silicon Valley event, I was with Lithium Technologies, so we also were an OpenStack user, but we were also kind of going through some transformation, I think, I would say we kind of really pushed the Kubernetes button for the community at that time. So I think I kind of got a little rep about being kind of like an agitator in this community to try to make the product really, you know, work for people who are actually consuming it. >> Right, so not only have you deployed OpenStack, you've done it at two different jobs now already. >> Joseph: Yes. >> People think we're still so early there, but we're already seeing that progression. Alright, Joseph, a little bit of background, yourself, what brought you to the current role in interaction with OpenStack? >> Yeah, so it's Nicolas. >> I'm sorry, yeah Nicolas, sorry, yeah. >> It's okay. >> I come from this startup company called TubeMogul that got acquired by Adobe last year, and one of our challenges as a startup was to be able to scale our cloud infrastructure and our infrastructure in general. We were a newer user of a public cloud at that time, but over the years we faced multiple challenges, not only as a cost challenge, where it gets like easily out of control with public clouds, but also technical challenge. We were in like an IP goals environment with very lean team operation. So we had to figure out a way where we can scale some of our technology and some of our platforms. And so my first technical prime was to have a reasonable cost control. And so we started to look at different cloud solutions. At the time it was like Eucalyptus, CloudStack, Open Nebula, and we tried many of these to get control, to get some time to figure out what was the solution. And we moved quickly to OpenStack and started to implement and get like some known, couple of here a journey to implement that and scale a little faster too. >> Stu, I want to point out something. In that story, at least what I took away from it, usually when you have a problem state of a lean team and you're trying to hyper growth >> Stu: In scaling. >> In scaling, the answer is public cloud. Oh, we'll just go to the public cloud, that'll solve all that problem. You chose a different way and chose a different architecture. >> Nicholas: Correct. >> Anything that brought you to that decision? >> Yeah, so there was a few factors. First one was like, well cost growth on public clouds was growing faster than the revenue in some ways, so that doesn't line up. You need to have a story that makes more sense. And the second one was really like technical. We had some very specific challenge where we're in the real-time bidding advertising, so we have a huge amount of traffic. We do want to try billions, HTTP request on the platform. All of those need to be answered in a few milliseconds, so the proximity of our partner, you can always see that as a smaller stock exchange for advertising. So we need to be close to our partner so all this auction process is happening very quickly. And we have to store huge amount of data. Any of the solution you will find on the public cloud will end up having like 50 minutes ago that's 50 milliseconds that doesn't necessarily fit our use case. >> Yeah, just maybe you can bring us inside the architecture a little bit. >> Joseph: Sure. >> Talk about, look, public cloud isn't simple, obviously costs people, you know, we understand that and there's the debate as to where those pieces fit. But you know, OpenStack, speak a little bit to how it is to put that together. Simplicity is not usually what we hear when we talk, but what worked, what didn't work, what did you have to kind of customize to kind of get things working? >> You know, I think the one thing is just coming through like, you know, two different implementations is that, yeah there is complexity. And what I really got out of this was that you know, you really just have to consume the things that you need, so we've been very lean about the APIs that we consume, what services that we think are meaningful to our business. Instead of taking really all as a service type parts of this framework, we really narrowed it down to what matched our business requirements. I think as well as kind of like how you're consuming, and I think if you noticed the keynote on Monday, all of a sudden we're seeing this new pivot of like, let us manage your cloud. And it still kind of speaks to some of the challenges that you know, the end users of OpenStack have. And I think the part that's really important for anyone that's really going on this journey is that, you know, it's how you decide to consume it, like can you start really running it within like a CICD model so that you're really getting into that dev-ops aspect of it. Even within Amazon, I think in my journey, that's one thing that I think a lot of people miss is that when they try to lift and shift, like they want to race to the public cloud, you're going to still be challenged because you haven't really fundamentally changed how you're consuming the cloud product. You're not making yourself cloud native. And I think in my journey, I've made those same mistakes. I've learned from it enough. I'm actually really realizing that it's almost bigger than OpenStack. It's almost like how as business you operate and how your teams fundamentally build their tools and how they kind of like make open source a true strategy. >> I'd love to hear about the applications that you're using in this environment. We hear it in some of the keynotes on some of the users, you know, rapid move from where they started to adding applications. You mentioned cloud native. What are the class of applications, what percentage of your business runs on that? >> Sure, yeah so the code name we've given our platform is CloudMogul. And really it comprises bare metal, primarily OpenStack, and yet we still also use Amazon, so we have all different frameworks in there, depending on the type of, you know, workload that's there. As far as like OpenStack specifically, we really just consume the court. It's compute, storage, and network. Storage is probably a little bit secondary for us, the way we have designed our platform. Network is the really key thing. And as Nicholas mentioned earlier, I mean, that's the thing that in Amazon, you'll see great choices for compute, great choices for memory, but if you try to find an affordable network, you know, intensive instance, and that's what you know, we have decided why we're doing the data center. So we really have stuck really with just the core OpenStack services. Currently our developers are looking at now rolling out Kubernetes, and they're kind of doing it in a more, you know, dev POC. And as well as we're trying to balance out like the broader Adobe strategies, like they want to move to multi-cloud, they want to use Azure. So there's quite a bit that we're trying to consume, but with the lean team, we have to really be judicious about what we decide to roll in. >> Nicholas, can you comment maybe on the applications you mentioned some of the costs. The keynote, cost compliance capabilities, does that resonate with you, and how do you choose between the public and >> I think it's more like to get back to this lean operation, it would drive like some of our info on it, like we're a technology company in some way. I mean, we are building software, we are building certain solutions. You know, our goal is to develop like an advertising solution and trend solutions at several customer. So we're on a tier to be like a storage solution for OpenStack or compute solution for OpenStack or public cloud. So we really had to focus on what is selling or best use case or solve one problem, as that's where we had like to really look at cutting the fat in some way on OpenStack and really just looking at what is going to be the best use case for us. So we liberate OpenStack for most of our bidding system and manage all those calculating for the VMs, but we also integrate that very easily with like a flat network designed with open maker, so we are about to really like get the best of both worlds, between like Permital, OpenStack, and virtualization, and know we are also like implementing like reverting on the, be able to offload some of the workload back to Amazon in Ozone, we are starting to look at Ozone like a cloud provider but for trying to revert like what's the best and consider like all the terms we have. >> Can you give us a little insight to that cloud bursting is a term that, you know, gets attention because data's tough to move, you know, where the application lives, is that you know, container, Kubernetes stuff that you're doing, expand that a little for us. >> So it's definitely challenging. It's not something that, and then we got a very quick iteration and we have been able to liberate it easily first because we are like a very simple design on the way we were managing our kernel environment on OpenStack prime mount. So it was to very easily integrate, have a direct connect to a VPC on Amazon and just offload some of the compute of these onto this VPC. So a challenge we had to learn is we are trying to understand we're in the workload and that was in iteration, when we did move back to in house, understanding like the network traffic you are getting and understanding like the back and forth between your backend and your frontend. That's something you don't really see or understand easily on public cloud. When you move back in house, then you start to see the bottlenecks and you start to learn about what is really your workload, and we are to do this again, like with cloud bursting, okay, what kind of back and forth are going between our compute services and all the backend service that it needs to access. And latency being very critical for us, we had to really measure that. >> Yeah, you never know til you try it, right? >> Exactly. >> You crawl, walk, run. Hey Joseph, you talked about CICD and rate of change. I'm kind of curious how you're seeing the rate of change of your infrastructure stack, so OpenStack, versus you said you're now kind of experimenting with Kubernetes containers in the talk. A lot of talk about containers here at the show. For me, it's becoming a little more clear where in the architectural pie, layer cake, that that, pie, layer cake, that that fits in. Can you talk about rate of change? Are you looking at, does your infrastructure need to change at the same rate as the application on top of it, or how are you all looking at it? >> You know, in just beginning this journey, the one thing that I've really took away and that was one guy on my team when I was at Lithium, where he would always talk about like really meeting your developers where they're at. And yes, there's so much change, and you have to really kind of balance it. And you know, some of these companies we've been with, we've had some software stacks that are almost a decade old. They're just not made with cloud nativeness in mind. And that's where, you know, I've always been a really like let's move forward, and that was one of the early individuals saying, you know, I was at OpenStack Prague and we were doing, you know, Kubernetes under the control plane. In hindsight I was like, well, it was a little kind of premature. It was almost a little reckless. But I think that the thing that I'm trying to do now is really just try to leverage like where our product's at. Can I help evolve the platform so that, are we 12-factored, can we get there? You know, we have big data kind of workloads. How do we like start taking frameworks that allow us so that you know, we can be in this multi-cloud world. So I think there is a challenge, you know, you're hearing all these new great things that are happening. You know, you're coming to these summits, and you're getting all this hype. But then you really got to walk away. And I just kind of do that sniff test, testing something out to see like, is it really ready? And especially with where we're at in enterprise, you know, we really have to map to security compliance. And I think those are some of the gates that we're challenged with, as well as like, is the workload that we're bringing in, have we adapted it enough so that we can really kind of push what we're doing. Cause I'd love to see us get to the point where we have the frameworks of containers and Kubernetes. But not everything for us can get there. You know, so like on the edge, we're doing billions of requests per second. Bare metal is the key thing for us. And we're running HA proxy on the edge. So the key thing for us is like, run it as code, let's count how much can we do to get this so that we can fully automate this and make it repeatable. And I think that's kind of the core ethos for the team. >> You talked about coming to different summits over the years, kind of the sniff test. What's the mood of the attendees here at OpenStack summit here in Boston this year in 2017 and is it different from previous years? >> You know, I think we seen kind of some interesting ebb and flows. I think when I was in Barcelona, it was definitely different. I was kind of like surprised, it just felt like it was a little bit less energy. Austin I thought was tremendous, it was a great event. And I kind of feel like, I think there's a little bit more pragmatism that set in, which I think is really healthy and a sign of maturity that you know, people are really kind of understanding instead of getting caught up in that, the cloud hype, you know, public versus private and all these things. I think now we're starting to see a more mature audience. I think OpenStack foundation and the community has also kind of adapted as well. I know they try to be everything for everybody under the cloud in a data center. And I think now we're actually seeing a more healthy approach, so for me I think there's still a lot of energy there. Maybe it's getting a little boring, which to me in my world, that's a good thing. >> Nicholas, I'm curious, do you either at this show or at other events, how are you working with your peers in the industry to understand that kind of hybrid multi-cloud model and sort that out, you know, resources you go to, conversations you have, you know, how do you create that learning? >> So, first it's I come from the culture that's from the startup to Mogul that got a prior where we're ready for costs on the customer and the end goal of what we are trying to build. And we are not necessarily driven by the technology itself, we really try to devise technology to solve a problem. We have a lot of geek on our team, and that's what drives some of our discussion. But we're really more trying to look at how we drive the product for our world. And that's really like most of the discussion, even with our product, like we started a year ago to use the Fastly file pen to sort some specific problem where we can't have like a global footprint as much as the city and provider. And they were able to address like some of a specific use case, where they can do like a synchronous looking for us. And that was something like a specific business case for us, and every time we go like to an event or technology, we are trying to see like what are we trying to solve? And that's what drives most of our discussions. >> Joseph, sounds like you've given feedback and been on some of the leading edge of some of the activities. Is there anything you look at where you're hoping for a little bit more maturity, either OpenStack in general or the vendor community out there, you know, what are you hoping to see, you know, as we mature this even further? >> Sure, I mean I would say one thing about, you know, the OpenStack community. And I know this was always kind of one of my early beefs about it. It felt so vendor-centric, and very vendor-influenced that it just didn't really for me feel like the actual consumers, the individuals who really are using these platforms are really being heard. So I think they need to still kind of really force it, really listen to that feedback from the community, what's working, what's not working. As far as what I'd love to see, is you know, I think there's been a little bit more of like a correction I guess in a sense of like all the kind of like services that were out there, these side projects. I think there was a lot of messaging about like let's all work together, which I think is kind of, I just kind of wince a little bit. But I'm like, it's good, I'm glad that they've kind of come to this recognition. I'd love to see more and more of that. But I also want to make sure that the OpenStack community, like stay distinct. I'm not sure if I 100% think like, leveraging off the Kubernetes community, like yes, work together, let's make these things, you know, coexist and stuff. But I do hear some things where like, hey, we should just make this service be the backend for Kubernetes. I'm like, hmm. I don't think you've really looked at the framework of some of these APIs and how they're going to integrate in that environment. And I actually would like to see them develop, you know, distinctly, but you know, find some really friendly integration points so that me as a consumer, I can like easily use these as we evolve and our platform evolves, I can easily kind of start roadmapping these into our platform. >> Alright, Nicholas and Justin, really appreciate you giving us the update, and we'd love to get that real practitioner viewpoint. John and I will be back with more coverage here from OpenStack 2017 in Boston. You're watching The Cube. (upbeat techno music)

(upbeat techno music) >> Host: Live, from Boston Massachusetts, it's the Cube, covering Red Hat Summit 2017, brought to you by Red Hat. >> Welcome to day two of the Red Hat Summit here in beautiful Boston, Massachusetts. I'm your host, Rebecca Knight, with my co-host, Stu Miniman. We are welcoming Jim Whitehurst, who is the president and CEO of Red Hat. Thanks so much for taking the time to sit down with us. >> Thanks, it's great to be here. >> So, I want to talk about the theme of this year's conference, which is celebrating the impact of the individual. In your keynote you talked about the goal of leadership today is to create a context for the individual to try, to modify, to fail, to just keep going. Sounds great. How do you do that? >> Well that's why I say, leadership is about creating a context for that to happen. So you have to create a safe environment for people to try and fail. And you know, this is a tough one, because somebody fails 20 times, you know, maybe it's time him to find a new career. >> Rebecca: (laughs) >> But, you have to create the opportunity for people to fail in a safe way and actually then learn from that. And one of the things I talk a lot about, especially CEOs and CIOs is, you got to create that context. The world that we used to live in was all about taking variance out, you know, Lean Six Sigma process. Innovation's all about injecting variance in, and there's no way to inject variance in without making errors. So how do you, I want to say reward making errors, but you certainly want to reward risk taking and recognize, by definition, some risks aren't going to play out. And that's all about culture. Yeah, it's about process and reward systems, but it's mainly about culture. >> So reward, risk taking, no blaming, what are some other defining elements of this culture in which individuals can feel free to take risks? >> Well, I think a big part of it is you have to celebrate the people who try things And you celebrate taking the risk. You don't necessarily celebrate the successes, right? It's like, you know, in school, you miss something, that's bad, you get something right, that's good. Well we have a tendency to say, let's celebrate the successes, versus actually celebrating the risk taking. And so, there are some processes and systems you have to put in place. You have to have systems in place to make sure no one can risk 100 million dollars. If every Red Hatter could risk 100 million dollars, we'd be in trouble. But you have to figure out how you give enough latitude, enough free time. And, I was just yesterday talking to some Red Hatters who had moved over from IBM. They said, "It's great, we can try new things." Now, try new things within a context of a certain amount of budget or a certain amount of time. So there are processes and systems you have to put in place, but ultimately it's culture more than anything else. It trumps anything else. >> Jim, in your keynote, you said, planning is dead, and that, you know, we're lousy predictors, things are changing so fast. Your role though, you're CEO of a public company that has 60 quarters of consecutive revenue growth. So, it seems you guys are doing pretty well at getting involved in some of the waves that are happening, understanding how to keep growing at a steady pace. Maybe you can reconcile that a little bit for us, as to how you're doing that. >> Yeah, so, one of the reasons that I think that we've been able to navigate a whole set of fairly significant transitions in technology is that we don't select technology, we select communities. And I think that's a really important subtlety. So, we didn't come in and say, "Oh, we like OpenStack more than we like CloudStack of Eucalyptus or the other opensource IaaS that were out five years ago. We looked and observed that OpenStack had built the biggest user base. You know the reason we're significantly involved in Kubernetes today, versus Diego, or Swarm, or the other orchestrators for containers out there, is we observed it was building the biggest community. And, we don't just glom on, we actually kind of get in and contribute ourselves. But we look more to say what are the best communities and let's get involved in that. I don't know what the Kubernetes roadmap is for the next five years, but I'm confident that it has the best community that will drive the right direction for-- >> It's probably a little over-simplified to say you looked for the VHS ecosystem versus the Betamax best technology. >> Rachael: (laughs) >> No, exactly. Exactly, but that's what we think we're good at is observing when a community is the best community. And I say that, it's not just a matter of observation. Whether it's OpenStack or Kubernetes, we get in a help think about governance, right? So, one of the things I think really helped OpenStack is we saw it had the best user community, but we help put together the governance structure, which truly made it neutral, made it open. And so, we try to actually help in doing that, but it really is about identifying communities rather than technologies. >> Is it ever possible that you could identify the right community that might have certain elements, but it's got elements that wouldn't quite work for the opensource way, can you change that community? Is it possible to go in and push a new culture into that community? >> We think we're actually pretty good at that. Now, I think there's a mix of not every community has to be the same. We often talk about, there is no opensource community. There are are literally two million open source communities. And Linux has a culture, many of our projects in JBoss. So Drools is different than Fuse that's different than others. And so, it's okay that the cultures can be different. The key is they all have to have a common element about being open, and committing to being open, and truly being a meritocracy, cause if they best ideas don't win, that's when communities fall apart. And that's actually one of the biggest places where they fall apart. So, I do think we can influence open, and I think just by our contributions we probably influence the cultures of some of those communities. But we don't try to say is there's a Red Hat way to do community. There are a lot of different ways. >> Jim, we look at the cloud space, open is one of these terms that doesn't necessarily mesh with your definition with what the cloud guys do. You guys, of course, supported Red Hat Linux in every single cloud environment that I can think of. For many years you have a expanded partnership with AWS. But, I was debating with Sam Ramji yesterday, from Google, about like, there is no open cloud. There are clouds that use opensource, opensource can live here, but all the big public clouds are built on their platforms and openness is a challenge there. What's your thought as to how you fit there? And then we'll want to get into some of the discussion of the AWS announcement. >> Yeah, sure. So, in defense of the public clouds, it's impossible to offer a physical offering that has hardware in a software stack without it having some of your technologies that don't make it totally open, right? Or transferable. >> Is this why we never saw a Red Hat Open Cloud? >> Well, it's just that, yeah, it doesn't quite make sense in our context for that reason as well. So the role we try to play is, we do try to play the abstracter role, and we do that at multiple levels. So, Red Hat Enterprise Linux runs across a physical data center, virtual data center, and the major clouds. And that's an abstraction point that we think adds value. Because all the way back to 15 years ago, Red Hat Enterprise Linux meant that you could run the same application on a Dell server or an IBM, or an HP Blade, right? And so, we're working to apply that at the cloud level, certainly at the operating system level, but, because of all the services and the growth containers, we needed to do it at another level, and that's what we're doing with OpenShift. So, OpenShift allows you to run on physical, or on virtual in your own data center, on the major public clouds, and take advantages of the services underneath, but do it in a little bit more of an abstracted way. >> All right. So, we had Optum on yesterday, who was also part of the keynote. He's using OpenShift. He's using AWS. He was very excited about the opportunity of OpenShift being able to extend those Amazon services. You and Andy Jassy doing a video this morning. Give us a little bit of the inside look. You know, how long did it take to put this together? My understanding, it's not shipping today, but coming a little bit later this year. Give us a little bit behind what happened. >> Yeah, so. You know, this really started off with a breakfast Andy and I had in January, where we said, look, our teams are working really well together, and we've been partners since 2008, but kind of from the bottom up, I think we were taking very much an incremental approach of what we could do together, what customers we could work with. And, I think it's a little bit in the context of they've been out some other kind of big deals with some other vendors, and so, why don't we think about, what's a true net new offering. So let's now just talk about, oh, running it on Amazon's lower cost. I mean, clearly there's a cost thing there, but, what can we do that's like, wow, actually changes the life of some of the people who are using our technologies. And so what we decided is, well, wouldn't it be amazing, literally at breakfast we were talking about it, if OpenShift, which is used by enterprises all around the world, could actually leverage the thousands of services that AWS is putting out, right? So, right now, if you want to use all of these services, you have to be on AWS, which is great, but there are a lot of customers for whatever reasons, for regulatory reasons, or just by choice or economics, who decided to run on-premise or elsewhere. And so, by making those thousands of services available, it's a win-win all around. For Amazon, it's a ability to expose some really amazing innovation to many, many thousands, hundreds of thousands of developers, and for us it's a way to expose all this innovation to our developers, without kind of forcing someone necessarily to go all-in on cloud. Now, I'll say that we were literally, you know, Sunday night still getting the final contract done. >> Rebecca: (laughing) >> But I would say, when you have a really clear, differentiated source of value for customers, the deal came together, I think, relatively quickly. >> Yeah, et cetera. One of the things we've been trying to reconcile a little bit is, when you talk to customers about where their applications live, that hybrid or multi-cloud world, versus the offerings that are out there, it was a mismatch, because, you know, they were like, oh, I'm using VMware in one place, and I'm using Amazon somewhere else. I've got my SaaS in a different place. We're starting to see Amazon mature their discussion of hybrid through partnerships of yours. OpenShift looks like something that can really help enable customers to kind of get their arms around those environments in many locations. >> Well, I think so. One of the things, if you really go and talk to developers, developers really don't care that much about infrastructure software, and they shouldn't care. And, it's interesting. I think developers right now are really enamored by containers, because containers somewhat makes their life easy. But, I was talking to some of the folks in Red Hat that deal a lot with developers, and they say, ultimately developers shouldn't want to care and don't want to care about even containers. They just want to write code, and they want code to work, right? And one of the cool things about OpenShift is that's kind of what you're doing, is you're saying write code. Yeah, use any of the services you want from anywhere you want to use it. They're all there. They're all available. You don't have to worry about, I want this service, so I have to run this on Amazon, or, hey, I got my database on-premise, so I got to run here. Let's just make it easy. And I think that's one of the cool things about this announcement that's cool for developers, but it's also unique that it's something that only we could bring together. >> Yeah, serverless is something that's been gaining a lot of buzz to kind of say, right, it's underneath there. There's probably going to be containers, but my people writing applications don't want to worry about that. Speak to, it's the application affinity and that tie to kind of modernization of applications that seems to be one of the biggest challenges we've been facing for the last couple of years. Why are companies coming to Red Hat, working across your solution set to help them with that challenge of their older applications, but also kind of building the new businesses. >> Well I think for a couple reasons. So first off, if we really think about what Red Hat is, we call ourselves a software company, but we give away all our IP, so that's a stretch, right? >> Rebecca: (laughs) >> You know, when we think about our overall mission is, we think, there's enterprise customers here with a set of challenges, and there's all this phenomenal innovation happening in opensource communities. How do we build a bridge between those. So certainly that's product. So we create opensource, well, products out of opensource projects. It's about architecture, and then it's about process. And we talked about open innovation labs. But in part of thinking about that's what we do, we obviously start off say, well, what are enterprise problems, and what are technologies that help solve those problems? So, one of the things that we've driven so hard into our container platform is the ability to run stateful applications, right? So it's great to talk about scale-out and cloud native, and we certainly do that, but go talk to any CIO and 99.9% of their application portfolio is stateful. And so, we think about that and we drive those needs. And the reason we're the second largest contributor of Kubernetes isn't just because we're nice people. It's because we're trying to drive enterprise needs into these projects. And so, I do think that technologies that would ultimately emerge, and the products we're able to put out, help enterprises consume opensource in a way that is actually value adding. >> I wanted to ask you about the examples that you used in the keynote today. The three that you highlighted were governance. >> Jim: Yeah. >> And I think that that was really interesting because you're showing how opensource is bringing new innovations and ideas into government and agencies not necessarily known for innovation. Where do you see the future of technology in government coming together? >> Well, one of the reasons I wanted to use government examples is that I actually wanted to highlight, well, what's the role of government when you start thinking about innovation. So, certainly, we could've brought up a lot of examples. You know, yesterday the Optum folks that are big users of our platform, and they've kind of created a context for innovation among their developers. But the reason I wanted to highlight governments, and really try to do it from regions around the world, was to say there is a role for government when you start thinking about what is the new system underneath the economy. So, in the 1940s and 50s in the US the interstate highway system was an important piece of infrastructure. We've always thought about roads and bridges and airports as important for creating the underpinnings for an economy, and that's really, really important in a world of physical goods. And it's not that we don't have physical goods now, but more and more we still have to start thinking about information assets. And look, I've gone and seen the FCC and advocated for net neutrality and all that stuff. And so, certainly broadband as a fundamental infrastructure's important, but I think that government plays a more important role. Whether that's education, and we could spend two hours on education, but even kind of creating these contexts where you make data available. That's what I loved about the British-Columbia example. But broadly it's like, how do you create a context for more citizen participation. I think it's just as important in the 21st Century as roads and bridges were in the 20th Century. >> Jim, you mentioned net neutrality. I'm curious your take on just kind of the global discussion that's going on. A lot of your customers here are international, you've got open communities. The question about net neutrality, trade. It feels like many people, we interviews the president of ICANN a few years ago, and was worried about, you know, are we going to have seven internets, not one internet, because there are certain Asian, and even like Germany, worried about cutting things off. How does that impact your thinking? Do you guys get involved in some of those governmental discussions? >> Well we do. A matter of fact, we actually do have, I'd say a small government affairs team that advocates around these issues. Because we see it too, even with OpenShift, where you start saying, well, different privacy laws in Europe versus the US, but what if someone's running OpenShift in Europe, but it's actually instantiated in the US, and who can get access to what data. Those are really, really important issues. And it is a little bit like, you know, we ought to pick the same railroad gauge, right? To some extent, we need to have a set of consistent policies, not necessarily in every area, but enough that you can actually have the free flow of information, without worrying about, oh my god, I'm exposing myself to felony privacy issues because I'm hosting this application on a cloud that happens to be in the US. So there's some real issues that we have to work through. And they're so bleeding edge and so complex, I'm not sure that we're quite ready to get those done. But these are going to be critical, critical to the economy of the 21st Century. >> The other thing, I can't let you go without asking you about just the opensource business models themself. I've been listening to podcasts. We had a couple of companies go IPO recently. >> Jim: Yeah. >> They're better involved, and they're like, oh wait, I'm an enterprise company, I'm a software company. VC, you shouldn't invest in opensource because they can't monetize what they're doing. What's your take on the investment and business prospect for the other companies that are not Red Hat? >> Well, look, I'm thrilled to see Cloudera going public. Obviously Hortonworks public. MuleSoft recently. And I know some of those are hybrid models, they have an open core, and they have some other proprietary around it. But look, it's still dollars that are getting invested in opensource software I think we've clearly proven a model that you can have 100% opensource and build a successful business. For a whole set of technologies, it's clearly a better innovation model. The thing that I continue to push people is, don't think about it as selling IP. And this is, I've actually had conversations with several university presidents about this same issue. University education is more about the content. Don't be scared of MOOCs, right? And most people kind of get that, a university education, yeah, content's a part of it. But there are 50 other things that make up an education. So that's when I always come back to opensource companies and say, assume the content's free, because it's going to be better if it's totally free. And now think about, how do you build a model around the fact that content's free. And, I think education's a great one. Your industry in media is certainly one that needs to continue to innovate around business models as well. So, rather than saying, let's take a development model that's superior in a number of regards for a set of technologies, especially around infrastructure, and say, let's hamper it, and make it work in the old school business model. Let's continue to work to innovate business models that allow the innovation to happen, because it's going to happen, right? You do have to recognize that so much of what you're seeing in opensource is really a byproduct of what Google and Facebook and others are doing. And that's going to continue, so the best innovation's going to come there. You got to figure out business models that work for it. >> You got to figure them out Thank you so much, Jim. Jim Whitehurst, we appreciate your time. >> It's great to be here. Thanks so much for having me. >> I'm Rebecca Knight for Stu Miniman. We will return with more from the Red Hat Summit. (upbeat techno music)