>> Narrator: From Las Vegas, it's theCUBE, covering Qualys Security Conference 2019, brought to you by Qualys. >> Hey, welcome back, everybody. Jeff Rick here with theCUBE. We're in Las Vegas at the Bellagio at the Qualys Security Conference. They've been doing this for 19 years. They've been in this business for a long time, seen a lot of changes, so we're happy to be here. Our next guest works for Caterpillar. He is Brian Rossi, the senior security manager vulnerability management. Brian, great to see you. >> Thanks for having me. >> So I was so psyched, they had an interview, a gentleman from Caterpillar a few years ago, and it was fascinating to me how far along the autonomous vehicle route Caterpillar is. And I don't think most people understand, right? They see the Waymo cars driving around, and they read about all this stuff. But Caterpillar's been doing autonomous vehicles for a super long time. >> A really long time, a really long time, 25-plus years, pioneering a lot of the autonomous vehicle stuff that's out there. And we've actually, it's been cool, had an opportunity to do some security testing on some of the stuff that we're doing. So, even making it safer for the mines and the places that are using it today. >> Yeah, you don't want one of those big-giant dump-truck things to go rogue. (laughing) >> Off a cliff. Yeah, no, bad idea. >> Huge. Or into a bunch of people. All right, so let's jump into it. So, vulnerability management. What do you focus on, what does that mean exactly? >> So, for me, more on the traditional vulnerability management side. So I stay out of the application space, but my group is focused on identifying vulnerabilities for servers, workstations, endpoints that are out there, working with those IT operational teams to make sure they get those patched and reduce as many vulnerabilities as we can over the course of a year. >> So we've done some stuff with Forescout, and they're the kings of vulnerability sniffing-out. In fact, I think they have an integration with Qualys as well. So, is it always amazing as to how much stuff that gets attached to the network that you weren't really sure was there in the first place? >> Yes, absolutely. (laughs) And it's fun to be on the side that gets to see it all, and then tell people that it's there. I think with Qualys and with some of the other tools that we use, right? We're seeing these things before anybody else is seeing them and we're seeing the vulnerabilities that are associated with them, before anyone else sees them. So it's an interesting job, to tell people what's out there when they didn't even know. >> Right, so another really important integration is with ServiceNow, and you're giving a talk I believe tomorrow on how you use both Qualys and ServiceNow together. Give us kind of the overview of what you're going to be talking about. >> Absolutely, so the overview is really what our motto has been all year, right? Is put work where people work. So what we found was that with our vulnerability management program, we're doing scanning, we're running reports, we're trying to communicate with these IT operational teams to fix what's out there. But that's difficult when you're just sending spreadsheets around and you're trying to email people. There's organizational changes, people are moving around. They might not be responsible for those platforms anymore. And keeping track of all that is incredibly difficult in a global scale, with hundreds of thousands of assets that people are managing. And so we turned to ServiceNow and Qualys to really find a way to easily communicate, not just easily, but also timely, communicate those vulnerabilities to the teams that are responsible for doing it. >> Right, so you guys already had the ServiceNow implementation obviously, it was something that was heavily used. You're kind of implying that that was the screen that a lot of people had open on their desktop all the time. >> We lucked out that we were early in the implementation with ServiceNow. So, Caterpillar was moving from a previous IT service management solution to ServiceNow so we got in on the ground floor with the teams that were building out the configuration management database. We got in with the ground floor with the teams who were operationalizing, using ServiceNow to drive their work. We had the opportunities to just build relationships with them, take those relationships, ask them how they want that to work, and then go build it for them. >> Right, it's so funny because everyone likes to talk about single pane of glass, and to own that real estate that's on our screens that we sit and look at all day long, and it used to be emails. It's not so much email anymore, and ServiceNow is one of those types of apps that when you're in it, you're working it, that is your thing. And it's one thing to sniff out the vulnerabilities and find vulnerabilities, but you got to close the loop. >> Brian: You got to, absolutely. >> And that's really where the ServiceNow piece fits. >> And it's been great. We've seen a dramatic reduction in the number of vulnerabilities that are getting fixed over the course of a 30-day period. And I think it simply is because the visibility is finally there, and it's real-time visibility for these groups. They're not receiving data 50 days after we found it. We're getting them that data as soon as we find it, and they're able to operationalize it immediately. >> Right, and what are some of the actions that are the higher frequency that you've found, that you're triggering, that this process is helping you mitigate? >> I would say, actually, what it's really finding is some of our oldest vulnerabilities, a lot of stuff that people have just let fall off the plate. And they're isolated, right? They may have run patching for a specific vulnerability six months ago, but there was no view to tell them whether or not they got everything. Or maybe it was an asset that was off the network when they were patching, and now it's back on the network. So we're getting them the real-time visibility. Stuff that they may have missed, that they would have never seen before, without this integration. >> So I'd love to get your take on one of the top topics that came in the keynote this morning, both with Dick Clark as well as Philippe, was IoT-5G and the increasing surface-area, attack surface area, vulnerability surface area. You guys, Caterpillar's obviously well into internet of things. You've got a lot of connected devices. I'm sure you're excited about 5G, and I'm sure in a mining environment, or those types of environments are just prime 5G opportunities. Bad news is, your attack surface just grew exponentially. >> Yeah. >> So you're in charge of keeping track of vulnerabilities. How do you balance the opportunity, and what you see that's coming with 5G and connected devices and even a whole other rash of sensors, compared to the threat that you have to manage? >> Certainly in the IoT space it's unique. We can't do the things to those devices that we would do with normal laptops' assets, right? So I think figuring out unique ways to actually deal with them is going to be the hardest part. Finding vulnerabilities is always the easiest thing to do, but dealing with them is going to be the hard part. 5G is going to bring a whole new ballgame to a lot of the technology that we use. Our engineering groups are looking at those, and we're going to be partnering with them all the way through their journey on how to use 5G, how to use IoT to drive better services for our customers, and hopefully security will be with them the whole way. >> Right, the other piece that didn't get as much talk today, but it's a hot topic everywhere else we go is Edge, right? And this whole concept of, do you move the data, do you move the data to the computer or the computer to the data? I'm sure you guys are going to be leveraging Edge in a big way, when you're getting more of that horsepower closer to the sites. There's a lot of challenges with Edge. It's not a pristine data center. There are some nasty environmental conditions and you're limited in power, connectivity, and some of these other things. So when you think about Edge in your world, and maybe you're not thinking of it, but I bet you are, how are you seeing that, again, as an opportunity to bring more compute power closer to where you need it, closer to these vehicles? >> So I think, I wish I had our other security division here with me to talk about it. We're piloting a lot of those things, but that's been a big piece of our digital transformation at Caterpillar, is really leveraging data from those connected devices that are out in the field. And we actually, our Edge has to be brought closer to home. Our engineers pack so much into the little space they have on the devices that are out there, that they don't have room to actually calculate on that data that's out in the field, right? So we are actually bringing the Edge a little closer to home, in order for us to provide the best service for our customers. >> Right, so another take on digital transformation. You talked about Caterpillar's digital transformation. You've been there for five years now. Before that you were at State Farm. Checking on your LinkedIn, right? State Farm is the business of actuarial numbers, right? Caterpillar has got big heavy metal things, and yet you talk about digital transformation. How did you guys, how are you thinking about digital transformation in this heavy-equipment industry that's in construction? Probably not what most people think of as a digital enterprise, but in fact you guys are super aggressively moving in that direction. >> Yeah, and for us, from a securities perspective, it's been all about shift-left, right? We have to get embedded with these groups when they're designing these things. We have to be doing threat models. We have to be doing pen testing. We have to be doing that secure life cycle the entire way through the product. Because with our product line, unlike State Farm where we could easily just make a change to an application so that it was more secure, once we produce these vehicles, and once we roll them out and start selling them, they're out there. And we build our equipment to last, right? So there's not an expectation that a customer is going to come back and say, "I'm ready to buy a new truck two years from now," because of security vulnerability. >> Jeff: Right, right. >> So, yeah, it's a big thing for us to get as early in the development life cycle as possible and partner with those groups. >> I'm curious in terms of the role of the embedded software systems in these things now, compared to what it was five years ago, 10 years ago 'cause you do need to upgrade it. And we've seen with Teslas, right? You get patches and upgrades and all types of things. So I would imagine you're probably a lot more Tesla-like than the Caterpillar of 20 years ago. >> Moving in that direction, and that is the goal, right? We want to be able to get the best services and the most quality services to our customers as soon as possible. >> Right, very cool. Well, Brian, next time we talk, I want to do it on a big truck. >> Okay. >> A big, yellow truck. >> Let's do it. >> I don't want to do it here at the Bellagio. >> Let's do it, all right. >> Okay, excellent. Well, thanks for-- >> Thank you. >> For taking a few minutes, really appreciate it. >> Absolutely. >> All right, he's Brian, I'm Jeff, you're watching theCUBE. We're at the Bellagio in Las Vegas, not on a big yellow truck, out in the middle of nowhere digging up holes and moving big dirt around. Thanks for watching. We'll see you next time. (upbeat techno music)

>> Hey, welcome back everybody, Jeff Frick here with theCUBE. We're in our Palo Alto studios for a Cube Conversation as part of the Western Digital Data Makes Possible program it's very gracious of Western Digital to sponsor us to go out and talk to a lot of different companies that are doing a lot of cool innovations. At the end of the day it's all powered by data, at the end of the day all software is just an algorithm sitting on data with a nice display for a specific solution. But this one we're diving into sports and there's so much going on with sports and technology and this is a great company that's actually been kind of flying under the radar for 10 years unless you're into the space. But we're happy to have them as GumGum and we're joined here by Brian Kim he's a senior vice president of Product from GumGum. Brian, great to see you. >> Thanks for having me Jeff. Appreciate it. >> Absolutely. So for the folks that aren't familiar with GumGum give 'em kind of the quick overview. >> Sure, so GumGum's a artificial intelligence company with a expertise in computer vision. And what that means in kind of common language is that we focus on building algorithms that allows computers to identify what's happening in imagery. And then we apply that into different businesses that we feel like the usage of computer vision could essentially automate scale or drive significant value to those different businesses themselves. >> Right, but you guys have been at this for awhile you're almost 10 years old, like you said your 10 year anniversary's coming up. >> Yeah we were founded in 2008 and a lot of the core team still together from the original team that worked there. And we were doing computer vision before computer vision was probably sexy. >> Right right. >> So. We've been working on it for a long time we've built a lot of expertise around that and with a lot of the improvements that have happened in machine learning and A.I. these days it's just been kind of the big, hot thing that has continued to accelerate and helped us grow significantly over the last few years. >> Yeah all of our social media feeds are filled with the picture with the chihuahuas and the blueberries right? Trying to figure out which is which. But you guys have a very different approach then kind of what we read about now in the popular press. You built computer vision capabilities but you built them for a very specific application not just as a generic kind of computer vision so I wonder if you can tell us a little bit about your strategy and how you guys got started in the ad space. >> Sure, so you know, to your point Jeff I think a lot of companies have focus on what we like to call A.I. as a service and what that means is that they build the capability of using computer vision but it's really up to the end user to build it use it as a tool in to their actual business and figure out where it'll actually apply. Our path forward has been focusing on building what we like to call full stack vertical solutions meaning that we decide to go into a specific industry or division like ads for example. We build an ad solution that's using computer vision itself and we actually sell that ourselves to agencies and brands direct and then we work with the publishers on the other side of the coin to actually deliver those ad experiences and continue to kind of build our businesses around that model. >> Right, and how is a computer vision, A.I. driven ad experience different than the alternative? >> Well I think there's a few things that we've focused on that make it different. The biggest I would say is the placement of where the ads actually are themselves. So compared to your standard display ads that are around the content on a web page what we've focused on is actually building ad experiences that are within the content itself. What we call in-image ads and that's an ad that overlays on top of that photo editorial content that's on a publisher website. And what we've done there is we've applied our computer vision to understand what's going on in the actual images. And we leverage that tech to be able to then contextually match the ads from our clients to the actual pages themselves so that they're completely relevant to the page. And we make them look very slick and that's kind of the design of it so that it feels very sticky and natural to the way that the page is actually designed. >> Right >> And built. >> So what's different just so I'm clear is that unlike a typical kind of an ad placement in a page which is going into a dedicated spot as soon as the page loads it takes some data. >> Yep. >> And goes to auction. You guys are actually looking at the page as I the consumer of the page am looking at the page, and based on the things that are loaded regardless of where I am on the page: top, middle, bottom, that's the stuff that drives your ad placement. >> Yeah, perfect example would be you might be reading an article about cats and, you know, PetSmart wants to advertise with us so we'll understand that the image itself is about cats and put like a cat food, PetSmart ad that's placed within the actual image itself you might scroll down a little bit farther and find another article that's about a completely different topic. And we would actually match that to the relevant advertiser that fits that example as well. >> So how are advertisers measuring the delta in the value? I mean some of the stuff researching for this I saw a great quote that you guys in your ad "Delivery want to be seen and frequent and respectful" which I think is a really interesting way to take a point of view because clearly ads run a risk of being way too obtrusive, popovers and popunders and popups. I go to a page, I'm a huge customer in two seconds they're asking me if I want to buy something, I'm already your biggest customer! (Brian laughs) So how are the content publishers measuring this different type of an engagement with an ad presentation the way you guys do it? >> Yeah I think what you talked about is the right approach of how we want to go to market which is that we want to provide a premium offering that's high impact but not obtrusive to the end customer, and provides value to both sides of the ecosystem. So to the advertiser it might be a premium CPM that they're paying in order for that ad placement but because of how relevant it is and how viewable it is 'cause if you think about where your eyes are on the webpage, you're not looking at scanning the sides of the page you're focusing on the content that's going down the image is right in the middle of that. So if an ad pops up right in the middle of that image its much more viewable than say all the ads that are typically around the content itself. And on the publishers side to kind of end frequency we don't want to blast an ad on every single image we want to match it to the most contextual and right placement and then therefore to the publisher when they get an ad, that ad is actually paying out a pretty significant price point back to them. And then they're happy with that experience because their users not saying I'm seeing 50 ads on one page which is kind of the traditional problem that they deal with right now. >> So that's a ad tech market and you guys have been doing that for awhile but the reason we reached out to you specifically is your activity in sports which is a relatively new business for you guys. So how did you get into sports, how did you guys identify this opportunity? And then we'll dig into it a little deeper. >> Yeah, so GumGum as a whole has always been looking at different ways that we think computer vision can be applied in a myriad of different industries. And the opportunity that about 18 months ago we identified was that there was a very legacy business that was being built around providing media evaluation around sports sponsorships. So what I mean by that is how do you quantify the value of a sponsor showing up, State Farm for example showing up in a basketball game. Whether that's an LED placement there on the basket stanchion arm, or they're part of the half-time show. And the measurement that was being done traditionally was essentially done by people. So, people were watching those clips, they were timing how long the different brands were showing up, they were measuring how big those actual placements were. And they were then calculating some value off of it. And we really thought that computer vision can one, automate that entire process, so take the humans out of the loop and get it to a point that its completely automated and you don't have to have people involved. We can deliver it faster, so a computer can do something a 1000 times faster than a human being can probably analyze it. And your providing much more accuracy and efficiency of the actual data that you're providing back. You know that exact dimensions pixel by pixel that a computer is telling you versus a human being trying to eyeball where and when certain ads are showing up. So, what we've done there is then built a business that is now called GumGum Sports, where we provide media evaluation to sports sponsorships so both on the team side, which we call rights holders, and on the brand side and we're essentially the middle man who's providing third party reporting to both sides so that they understand the value of what they're getting across their sports sponsorships, both on digital which is essentially broadcast T.V. but also across social media which has been a huge gap that nobody's addressed to date. >> So just before we go into the impact before it was just a person, they're watching the game and every time that State Farm ad pops up on the stanchion they're writing down approximately how big was it could I see it, was it blurry, was it moving? Was it in the center or the side? You guys, obviously that's just right for algorithmic treatment 'cause you know, like you said you know, the pixels. You're doing time, you're doing placement, you're doing quality, you've added a number of things beyond just simple, that is there. >> [Brian] Correct. >> In terms of metrics to measure. >> Yeah so we look at things like where's the action happening? So if we can identify in a basketball game where the actual ball is that's probably where people are focused on 'cause the action's happening near that ball. So the closer you are to the ball the better score that you'll possibly get. To your point, how clear is it if you're panning back and forth through a game of your logo showing up? How big is it, how prominent is it and we've factored that into what we call our MVP factor of media value percentage which helps calculate what that end value looks like to the client. >> And was the demand driven on the suppliers side or the buyers side, were they looking for validation of this money. >> I think both. >> Value or were you saying it was both really? >> Yeah sorry to interrupt you. >> No, it's okay. >> Both sides were looking for somebody who's not favoring one or the other to give you validation so they wanted an arbitrator who would basically say this is what I think the value is in the ecosystem so that both sides know how to negotiate when they want to put together their deals next year. >> [Jeff] Right. >> You know the value to the teams are the more value you can generate obviously the higher that they can increase their price points. And I think to the brands what they're focused on is how do I optimize my ROI? Buy the placements that are generating the most value for me and not waste my money in other placements that don't generate value for them. >> Right, any big surprises in terms of the value of a stanchion versus the value of a half-time show versus a electronic thing on the scoreboard? >> So I think more than the placements themselves I think the biggest surprise that we found was how big social media actually has become in the valuation of all of media in general. You know, there's a lot of talk about subscribers numbers going down on T.V. That broadcast is declining, that nobody's watching. >> Super Bowl was down I think this year? Which doesn't happen very often. >> You know, live sports is just not what it used to be. But the reality is I think consumers have just changed their habits of where they're consuming that content. So instead of having to sit in front of a T.V. for two hours they might go check the highlights on YouTube, they might go look at their Instagram stream and see a bunch of posts that are coming from fan accounts that they're following that give you the highlight clip. So, being able to measure that piece of it that nobody's done before what we found is that that value is actually as big if not bigger than the broadcast side of it. Which nobody has really quantified to this date. >> That's really interesting. So you're what sniffing hashtags or something around a particular event to grab that data how are you grabbing all the social data around say a basketball game or whatever? >> So that's where the computer vision actually gets applied so we don't even need to look at specific hashtags or specific accounts. We can look at the full stream literally all of social media that's available publicly and we're able to sift. >> [Jeff] Just plug into the API. >> Yes sift through all that with computer vision and say oh this is not a sport, oh this one happens to be a sport now I know that it's NFL, now I know it's tied to the Super Bowl. And then you now classify all that data and then figure out the actual post that you want to analyze and the ones you don't want to analyze. >> It's so interesting I can't help but think back to like the Grateful Dead back in the day they were the only band that would allow people to record at the concerts, right. There was this huge, you can't record and no pictures! And then they would trade the tapes in the parking lot before the game and you saw that too with a lot of professional teams, no phones, I was at a concert the other day and they're like no phones! No phones, I mean that is the way that people experience and expand and amplify these live events. And it sounds like what you guys are doing is really validating how important that is to all the people that are participating in that live event. >> I'll give you a perfect example with the NBA all-star week just happened in Los Angeles recently. If you look at the slam dunk contests half of the all-stars that were in the crowd had their phones up (Jeff laughs) and are basically recording something that they're probably going to post on their social media account later. >> With massive, massive, massive followers. >> Each one of them might have two to 10 million people who follow them so you multiply all that and that's probably a bigger audience then actually who'll tune in to TNT or whichever channel that happened to be watching live the actual slam dunk contest itself. >> That's crazy. So, I'm curious to know what the response is as you come back to this data obviously it's great news for the publishers right a bunch of value that they didn't even know they were delivering no one's even capturing. At the same time I would imagine the advertisers are thrilled to actually to see that they are getting this whole nother traunch of activation that they had no clue or at least no way to measure. >> Correct. I think that's been the biggest surprise to everybody is how much value has been unlocked to them and both sides are thrilled about it because now they can start to measure that on a consistent basis and then moving forward they can figure out how that fits into their overall plan for whether they want to charge more for their sponsorships or whether they want to price certain things in like social media that they never did before. >> Right right. So, my mind is going all kind of places, so could you on sniffing that feed find say the State Farm logo stay on the same thing. Where's State Farm logo showing up in a billboard that's on the 101 that happens to be in front of a pretty spot where people take bike paths. Are you seeing or even attempting to look for other kind of secondary social impacts of other forms of advertising outside of your core solution within the sports? >> Yeah, I mean we've started to get feedback of people who are interested in solutions like that whether it's digital out of home different kind of businesses that have built themselves around wanting to track this type of ROI and we've looked at a few use cases and talked to a couple clients that we're starting to dabble in now that might be interesting for us to build new businesses around. Just like the use case that you talked about with the digital out of home example. >> Right, another one of my favorite lines that gets thrown around a lot these days is in God we trust everybody else better bring data. So I'm just curious as to the feedback you're getting from both sides of that equation within the sports application of now we have this data I mean how is that impacting peoples evaluations, how is that impacting their business decision, just kind of generally how does moving from I think this is a good value, we bought it last year we're going to re-up this year, to here's all the impressions you got the quality of the impressions, a score, plus we've uncovered all this additional value I would imagine data driven decision making has got to be so refreshing in these environments. >> It is and I think the challenge that a lot of them had was that they were getting the data six to eight weeks later, so if you think of it from a brand prospective I'm already off to my next sponsorship six to eight weeks later I can't even think about what I previously did so for us to be able to give them a solution where they can get their data back in a week or less really helps them make smarter decisions to your point about taking data driven decision making and figure out real time how they want to adjust to how their audience is adjusting. >> And do they make a lot of real time corrections in those types of packages or are those like annual deals I would imagine in the sports thing. >> Yeah I think a lot of them at this point are still annual deals the way that they sign up for it but I think now that they're having access to this data they're starting to rethink that model and trying to figure out how do we need to change the way that we purchase these things in the future to better fit how they're getting the data around it. >> Has anyone repriced the inventory based on the data that's come out of the research. They increase the price of a stanchion and decrease, I'm just making stuff up, decrease the price of some other ad unit within the stadium based on some of the data that's come out of your system. >> We've had a lot of our clients talk about their plans of how they plan to go do that. I think we're only 18 months into this business so a lot of them are still in the first season or maybe halfway through the second season of working with us so they're still trying to figure out how to message that properly and what the right channel is for them to recoup those gains but I think the ability for them to start those conversations is something they've never had before so exposing that to them now allows them to really rethink how their business model is. >> It's such a cool example of how data actually allows both halves of the equation to do a better job It's really beneficial to everybody right it's not just one sided information that's giving somebody a big advantage over the other one. >> Exactly. >> All right so Brian before I let you go we're in 2018 still hard to believe I can't believe we're almost through the first quarter, we're ripping through it. Some of your priority's for 2018 what is GumGum working on what are you excited about if we sit down a year from now what are we going to be talking about? >> Yeah I mean we've been doing this advertising business since 2011 it's our most mature business so I'm definitely continually scaling that business from a automation standpoint and continually growing that particularly internationally has been one of our main goals for this year. As I said GumGum Sports is a pretty new business to us but we're expecting that to start to bring in significant revenue for us this year and want to see that growth happen. And we're also looking into new emerging areas where we potentially think computer vision can be applied just like we did in GumGum Sports. It could be the medical space it could be television there's a lot of different applications there that we haven't quite tapped into yet but we're starting to noodle around what are the right ways that we want to go after that and potentially where we want to invest in with how successful we've been so far. >> Yeah, the exciting opportunity ahead. >> Yeah. >> All right. All right Brian, he's Brian Kim, he's the senior vice president of Product from GumGum. Thanks for taking a few minutes out of your day and stopping by. >> Thanks Jeff. >> All right, pleasure. I'm Jeff Frick you're watching theCUBE catch ya next time, thanks for watching. (instrumental music)