(bright music) >> Hello, welcome to theCUBE's presentation of the Unstoppable Domains Partner Showcase. I'm John Furrier host of theCUBE. We're here talking about the metaverse and what it all means, what it brings to the table. We've got two pioneers here in the metaverse breaking it down, doing great stuff. Both co-founders of companies, Noah Gainer, co-founder and CEO Parcel. And CJ Hetherington Co-Founder of Atlantis World, digging deep and doing all the great stuff in the Midwest. Chill and thanks for coming on theCUBE. >> Thank you so much for having us. >> Thanks for having us. >> So, first of all, I want to say congratulations for the work you guys are doing. This is one of the biggest waves we've seen coming on. It's a changing user expectations, it's a changing architecture, it's real technology involved, there's a lot of action. 30% of people at University of California, Berkeley are dropping out of the Computer Science program to get into Web3. This is the biggest technological change, business model change, user experience change. And we've been seeing going back multiple inflection points. This is a big deal. So the metaverse is real. Some people say, "Well, you know, it's not com..." It's coming it's just a matter of time. So let's get into it. What are you guys doing? Tell us about your company's Parcel and Atlantis World. Noah, start with you. >> Sure, so Parcel is a marketplace for virtual real estate. So you can think of something like OpenSea, which everyone is familiar with, but we solely focus on virtual land and virtual real estate in a number of virtual world, maybe part of decent land or the sandbox. So we feature those on our platform and, you know, we take it the next level with the user experience. So we have fully interactive maps. We have price estimates. You can think of it like a estimate on Zillow and in general, we're building the fully verticalized solution for virtual real estate users. And that will extend into rentals, like Airbnbing out your virtual condo or getting a mortgage on your virtual home, as well as, you know, cultivating the community around it. And especially helping empower creators and architects and builders and getting them work and getting their work on display. >> I'm looking forward to digging into that, that sounds very cool. CJ what's Atlantis world doing? What do you got going on? >> Yeah, exactly. So at Atlantis world, we're building the Web3, social metaverse by connecting Web3 with social, gaming, and education in one light web virtual world, that's accessible to everybody. So by going with actually a light web first and a pixel approach so that you can play on mobile or a really old device, because the problem with existing metaverses is that they set an incredibly high cost barrier to entry and also tech isn't necessarily readily available globally in terms of things like VR headsets and gaming PCs. Like for example, when I was in Africa, I travel a lot. If my book would break, it's not even that I couldn't necessarily afford to buy anyone, it's actually not available there. So we're ruling out a lot of the global kind of population from a metaverse experience. And we're building something which is like 3D pixel and super light weight, to kind of bridge that gap and build something which is ready to be massive up till now and onboard billions of users into Web3. So they'll all basically be using Web3 applications in a gamified way and going really hard on connecting that with social features, like voice chat and talking, getting, and virtual events and vaulting and all of that stuff. >> You know, I love what you guys are doing, you're pioneering a whole another area, but what's great about the whole crypto area, is that, since you know, 2017 onwards you saw Ethereum set the developer market started coming in strong. So you start to see that development. And now we got the metaverse. So I got to ask you guys what's the current definition of the metaverse. I mean everyone's... I mean, since Facebook changed their name to Meta, it's been a hype cycle and everyone's like, "Woh..." First of all, you know why they did that. But they're actually putting a lot of DAO in this. This is a wave, we talked about that. But what is the metaverse? How do you describe it? Why is it relevant? Virtual real estate, that sounds cool. What does this all come together? Explain it for the people out there that might not be getting it right. >> Yeah, I feel like for me, the critical difference between an ordinary gamer, what one might think of as game and a metaverse is actually Web3. For me, Web3 is metaverse. And for me it's really because Web3 enables real world utility, but inside of a virtual environment. So for example, inside of Atlantis, you might run into a DeFi bank and understand by interacting with other game characters, which are programmed to teach you about DeFi and like, what is Avel, how to deposit. And so you're actually getting a real world utility out of doing something in a virtual environment. And for me, that's what really bridges the gap into metaverse. Yeah, I'm really kind of bullish on that. (chuckles) >> Noah, what's your take? Define the current state of the definition of the metaverse? What is the metaverse? >> Yeah, to me, it's the 3D internet. And I do agree with what CJ's saying, how, you know, what makes it the most compelling and will ultimately the most successful is that addition of a blockchain and essentialized, you know, tributed ledger technology. Because you can have the closed metaverse, which nobody wants that future. And I don't believe that will be the future. you know, versus the open metaverse, which is blockchain-based, the users are the owners of the assets and the land and everything around it. And it's really foreign by the people. But I see the metaverse as just an extension of the internet we're already using today but we're going to have hardware that makes it 3D and more immersive like AR and VR. >> Yeah, I think- >> Yeah, definitely- >> Go on CJ. >> Around kind of like eight or nine months ago when we started to build Atlantis, we decided that the metaverse was a virtual world where you could live, work, play, and earn, and that's what we've been building. It started off as like building the metaverse that has DeFi and over the kind of time it's gone on our community has grown, we've started to understand the future of our product and our mission and values. It started to become the Web3 metaverse, right? And then on top of that, the Web3 social metaverse, so it's a combination of what all these things. >> You know, it's interesting. And I'm a little bit older than you guys, I wish I was your age, but when the web came along, people were saying the same thing. That the web's terrible. It's a stupid thing. It's never going to be real. And yeah, there was problems. It was slow to dial up back in the day. But yeah, now with gaming, I got to say, I had to look at the gaming evolution being a gamer myself, old school, I guess, but the gaming culture is proxy to what I see kind of happening in the metaverse. And let me get your reaction to that. I'm not saying directly, but you saw what gaming did, right? In game currency, some, you know, pockets of the same kind of dynamic where a lot of value is happening, the expectations were different for users. So how does the metaverse... How does gaming cross over? What's the ecosystem of metaverse? Obviously it's a cultural shift, one. Infrastructure, two. But I can just see this new generation of thinking. It's a whole nother level. Can you guys share your thoughts on that riff? >> Absolutely. Yeah, absolutely. It's like for us, we really believe that we can enable a social revolution, where workers from impoverished and remote regions can actually be onboarded into these digital player to earn economies and also learn to earn economies. So it's about leveraging Web3 and blockchain gaming, whatever actually you want to call it, to enable this revolution and actually onboard new people into a completely new working and dynamic. One of the other things we envision for Atlantis, imagine like you run around this game world and you complete quests inside of the game. And these quests basically involve talking to the non-player characters, the NPCs, which are basically pre-programmed. I don't know if anyone's ever played an MMORPG before, but it can be super fun. And they'll actually teach you how to use different crypto applications. Whether that's a DeFi bank, NFT marketplace, kind of digital asset exchange. And once you all do that, the kind of end goal in vision is that you'll be rewarded with tokens. So users will earn crypto for learning about crypto. And if anybody wants to do that right now, they can actually go to rabbithole.gg. It's a different project to Atlantis, but they building learn to earn, and you go on you complete quests and interact with different crypto applications. And it's so crucial for onboarding. And yeah, it's going to be really powerful, the kind of revolution that play to earn and learn to earn will enable. >> I'll check out the rabbihole.gg sounds awesome. What's your take on the reaction to that riff on this convergence of culture tech, gaming, vibe that's kind of divine the metaverse what's your take on that, Noah? >> Yeah, I mean... I think gaming will be the on ramp for maybe the first billion people, you know, into blockchain. It's something people already do and are already paying for, and they now have the opportunity to get paid to play. So the incentives are extremely strong and I think that will be a great way to usher people in, teach 'em about blockchain without realizing that they're using blockchain. And then once they're already in it and have already used it, then it becomes much more natural to user than other applications. >> It's funny, people always talk about, "Oh, user experience!" You know, expectations drive experience, right? If you expect something and if they're used to gaming, I see the great, great call out there, good point. Well, let me ask you guys a question, 'cause I think this is comes out a lot in terms of like the market shifts and metaverse, as an old expression, "Great markets pull the products out of companies or out of the industry." What organic growth have you guys seen in the metaverse that's been either a surprise or a natural evolution of just success and just growth, because the market's hungry for this and it is relevant. It's new, what's pulling out? What's coming out of the organic aspect of the metaverse? >> I think a lot of art and architecture and design. And, you know, it's empowering a lot of independent creators and allowing 'em to stretch their skills in a way that they maybe couldn't do before, but now can do and get compensated for. Like, we see really see the rise of the creator coming in the next couple of years in the open metaverse and finally they will be the ruling class. They won't get the short end of the stick, which artists have for... I mean all the time. >> Yeah, some of the wall street bet skies in the same way, feel the same way. CJ, What's your take on... What's getting pulled out on the organic execution growth of the interactions and metaverse evolution? >> Of course, yeah. I would, first of all love to go back to the previous point on gaming and just kind of like, definitely agree with what Noah said. And the thing is that gaming is 3.4 billion user market, and they're typically an experimental by nature people and group of users, right? So it's definitely a huge onboarding opportunity for teaching users about Web3 and using Web3 in a gamified way and making that kind of inherently fun and engaging. And again, in terms of organic growth, Web3 is incredible for that. We place a huge emphasis on, I think, collaborate versus compete and try to enable network effects for everybody who is involved in Atlantis and becoming part of our fast growing ecosystem. Like we have eight blockchain, more than 10 DeFi apps, like Aave, Yearn, Balanced, 1inch, Perpetual. All of the DAOs like The Exile, MetaCartel, lobsterdao, PizzaDAO, all of the NFT communities. Like we're actually building a yacht for bought yacht club on the beach in Atlantis. So that's fun. But yeah, we grew our community. We're very early stage still. We've been building only for eight or nine months, but we grew our community to like 20 to 30,000 community members across social channels. And we recently raised over a million dollars from our community and we're fully bootstrapped and taken no private money. So the ability to actually do that and to coordinate both kind of community efforts and fundraising and resources is really testament to Web3 and what it's becoming in the community aspect of that. And also its future and the kind of dawn and domination of the Metaverse. >> Well, I got to say, I just got to give you props for that. I think that fundraising dynamic is a real entrepreneurial new thing, that's awesome. You've got active community vote with their contribution and whether it's money and or other value, right? You got social value. This is the whole thing about the metaverse, there's a new community culture going next level here. >> We believe in community and we believe in Web3. And we know we don't understand why most leading metaverses are focusing fully on huge IP and actually ignoring Web3. So we're actually trying to build the infrastructure layer for Web3 applications and for Web3 driven utility inside of the metaverse. And what we mean by that imagine that any developer or any project or any team or any company could occupy a plot for free inside of the metaverse, customize it by branding and then effectively set up shop, whether that's a Web3 integration, so it's a DeFi Bank, or it's an exchange. Or whether that's an NFT marketplace or a music venue or a coworking space. We're really excited about that. And we really believe we've designed the value capture mechanism for virtual land in the metaverse and we're approaching it in a different way to land in the real world. >> That's awesome. Well, let's get that infrastructure conversation, unstoppable domains obviously there having the partner showcase here. You guys are partners. This NFT kind of like access method is a huge... I love it by the way. I think it's phenomenal. I love the value there, but it's also digital identity and it's distributed naming. So you kind of got this enablement vibe, you got solve a problem. How is it working with you guys? Take us through what does unstoppable metaverse... Why does unstoppable matter to the metaverse? >> Yeah, unstoppable is very great mostly for identity and having a kind of crush chain identity inside of the metaverse and just kind of in Web3 in general. And unstoppable, we enable log in with unstoppable. So if you have, for example, an unstoppable domain which is like a human readable kind of crypto wallet address, but you can also do some incredible, stuff with it, and there is a lot of fun and exciting utility, effectively, like if you would have, I don't know, like unstoppable.dao you would be able to use that to log in to the Atlantis metaverse and it would represent some of your identity and social graph in game with your peers. >> Awesome, Noah, what's your take on the unstoppable angle on this? >> Yeah, I mean, it makes it social. So, instead of you can have a feed, you know, something we're thinking about at Parcel is like a feed of all the real estate transactions, and you could follow certain people, you can follow your friends and see a feed of everything that your friends are doing in English or human readable terms that are not just like a wallet address. So, that's obviously a big one and they're also giving people more options in terms of, naming and top level domains if you want to be something.wallet or .nft, or hopefully eventually .metaverse- >> John: Yes. >> Will help expand that ecosystem much more. In addition to like on our... Like backend being able to capture email when they login and to provide better marketing for our users. >> What would you guys say to other metaverse partners looking for work with unstoppable domains for their login and digital identity, what would you recommend? >> It doesn't make sense to- >> I believe- >> Connect with the best DAO and integrate that if you want to keep shipping stuff for your community and keeping it exciting and engaging and enabling user choice in how they choose to display their identity in virtual environments. >> Yeah, there's practically no downside and plenty of upside, again, having those users who are already using unstoppable domains quickly, you know, log into your site and plug in. >> All right. That's awesome. Good stuff with unstoppable. I got to ask you guys give an example of on your products, I love the metaverse progression. I love the pioneering work you guys are doing. And again, the funding things are different. The user expectations are different. The technology experience are different. Billions of people going to be in enabled for it. What are the cool things you guys got going on? CJ, we were talking before we came on camera about the tree thing you got going on. Take us through some of the things that are exciting that people may not know about or may know about. What should they pay attention to share, share some insight? >> Yeah, of course. So one of the fun things, actually that we're building on that on these sites together with our full team and also some outside contributors from the community and two kin protocol, which is a regenerative finance protocol. And I'll get into that a little bit in a minute. Effectively what we're actually doing is planting a carbon capturing virtual forest inside of the metaverse that will in future also be bio diverse. So how we're approaching that is imagine that you can plant NFT trees inside of the metaverse, providing that your will deposit X amount of kind of USD stablecoin or Ether or some digital asset. You can actually use that to deposit inside of the tree. And we will use some, probably something like super fluid, which is like a kind of smart projecting infrastructure platform. And we all essentially enable every single second funds being sent from the contract and actually purchasing real world carbon credits. So legitimate, you know, government bags to carbon credits from the voluntary kind of public market that have actually been bridged on chain, transformed into a crypto asset, and they will be locked away inside of these trees inside of game forever. And in future, we also hope to have like user on animals, roaming the great forest of Atlantis, which will have biodiversity and endangered species credit, locked inside. And we hope to support a variety of different kind of sustainable assets and things like that to really populate this ecosystem. >> So it's you're doing climate change good for real, as well as rendering it as an asset for everyone to see and enjoy. >> Absolutely. And for me, that's what makes the metaverse the metaverse, that's what I talked about. It's how Web3 enables the metaverse to cross over into our real world, ordinary life from URL to IRL and actually provide some incredible positive impact for all of humanity on the planet. >> And Noah, you have some action going on there. I mean, I would be like, "oh, virtual real estate, isn't it unlimited real estate?" But when you have users come together, this value, we've seen this in gaming, what are some of the cool things you got going on over there at Parcel? >> Yeah, I think one thing that stands out, which maybe not enough people are thinking about are AR virtual world. So, right now a lot of people are focused on the VR types, central and sandbox and, and Atlantis, but there very well may be a billion people using augmented reality before there are a billion using virtual reality just because of the nature of the hardware development and apple may come out with their AR headset by the end of the year. So there are a few projects there they've taken the real world to map and Parcel it out into hexagons, and you can actually buy that, and you own that, that piece and you can put your own custom content there. And on that social impact point, we have heard about a few projects that are trying to use it for good. And like one project is bought up some land in the Amazon rain forest and some of the proceeds go to conservation of the rain forest. So, you know, we're all about using blockchain for good and right, coming together as a globe. >> I can't wait to see the commercial real estate division of your group with all the work from, a remote coming on. Guys, great stuff you got going on, again, you guys are pioneering an area that is coming big. It's coming strong, its got a lot of... A momentum, vitality, and energy to it. Put a plug in for your companies. Noah, we'll start with you. What's going on with Parcel, share a plug for the company. What you're looking for, do some key highlights, news, take a minute to, to give a plug. >> Sure. Yeah, great. We are the destination for virtual real estate and that extends well beyond just the buyers and sellers. That's everyone across the whole chain with property managers and property developers, but then also the builders and creators and artists, and we are working right now on aggregating the best creator directory in the metaverse. So you can think of it as a place where artists can come showcase their work and get hired. As well as just generally like bridging this knowledge gap that is much wider than we even expected. So we have our Parcel learn product coming soon, which is a fully fledged, knowledge base with education, informational content and lots of rich data. >> Where can people get involved? What's the channels? Are all channels open? Where can we find you? >> Yeah, our websites Parcel.so on Twitter, you can find us at ParcelNFT and you can link to our discord from either one of those. It's the best way to get involved. >> All right, CJ, put a plug in for the last world, I know you got a lot of action to share. >> Yeah, of course. I would love to see everybody there. Thanks so much for having us. And thanks for listening. Like I said, at the start of the call, we're building the Web3 social metaverse and we're connecting Web3 with social gaming and education, in one light web virtual world that's accessible to everybody. We're also doing some crazy stuff like planting their cabin, capturing virtual forest and all of that, and trying to be the infrastructure layer for Web3 driven real world utility inside of the metaverse. And we believe that we have designed the critical value capture mechanism for virtual learn. I we'll be sharing more all of that very soon and continuing to integrate the best apps from across the Web3 ecosystem and showcasing them at the center of Atlantis. You can go to discord.gg/atlantisworld. If you would love to learn more about us, you can go to wiki.atlantis.world. And there is some documentation now, which includes back story and team and some of our milestones and achievements so far from winning hackathons to raising grants and launching our Alpha belt, soft launching it. And we all have the public free to play coming in March. And where most active, I would say on discord and Twitter. On Twitter you can find us atlantisOx, or just search Atlantis world. And it's the first one that come up. >> All right. CJ, thank you. Noah, thanks for coming out. I really appreciate you spending the time here, and unstoppable showcase and being a partner. Again they got the great digital identity, great plug there for them here. Thanks for sharing that and thanks for sharing the time. Appreciate you guys are pioneer of some good stuff. Appreciate it. >> Thanks so much man. >> I so appreciate that. >> All right, theCUBE's unstoppable domains partner showcase. Thanks for watching. (bright music)

(techy music) >> Announcer: Live from Las Vegas, it's theCUBE, covering ServiceNow Knowledge 2018. Brought to you by ServiceNow. >> Welcome back, everyone, to theCUBE's live coverage of ServiceNow Knowledge 18 here in Las Vegas, Nevada. I'm your host, Rebecca Knight, along with my cohost, Dave Vellante. We're joined by CJ Desai. He is the Chief Product Officer for ServiceNow. Thanks so much for coming on theCUBE again, CJ. >> Thank you, it's great to be here. First time I came was last Knowledge, which was my first Knowledge, so I'm a lot more educated and equipped this time as compared to firing round of questions from Dave last time. >> We will pick your brain, exactly. So you were up on the stage this morning, a great keynote, and you said, "Welcome to the era of great experiences." Unpack that a little bit. What do you mean by that? >> First of all, thank you for remembering that. That was supposed to be the idea. But on a serious note, we feel, if you think about even our company name is ServiceNow, so you provide service, and when you provide service, that's not a technology you provide, you provide an experience, whether it's IT service, customer service, employee, whatever the case might be. And, if you are not delivering experiences, then you are not that relevant. So we are trying to truly, and we are in the beginning of this journey, truly internalize that, that if people are using us, they call themselves service desk, insider organization, IT service desk, customer service desk, whatever the terms you want to use, there is about experiences. Rather than focusing on bits and bytes, we want to focus on experiences, deliver those experiences via our platform. It's not software as a service, it's software as an experience. It's software as an experience, that's the idea, correct. Thank you for-- >> You also talked about the eras. You know, we went back to the industrial era and then went through the ages of computing. Yeah, I was not sure if that was going to work or not, but the point I was trying to make, Dave, was just around the quality of work and how work has evolved. That's it, that was the idea. >> But I think my takeaway was even more than that, because we are entering, in my view, anyway, a new era, and I'd love to get your comments. We're moving from what is real tailwind for you, which is the Cloud era, and obviously, Cloud is an important part of the new era where you have a remote set of services to one where you have this ubiquitous set of digital services that do things like sense, hear, read, act, respond. That's a different world, and it's all about the experience, and I don't know how to define that yet. Digital, I guess, is how we define it. But what are your thoughts? >> The one thing, even simple things, and these are not simple things to understand. When I look at things like even genomic sequencing, that's so different. They are using technology to figure out how to sequence the human genome so that it can help you with your health, live longer, even things like knowing that somebody rings a doorbell at my home and I can see on my phone. Everything is connected, humans are connected, when mobile came and computer came and internet came. But things being connected is pretty exciting for me. That just transforms our lives and how we work, and I really like that it is all about us, and other than us being focusing on the technology itself. So that's the point. It's that we're humans, and let's focus on humans and experience, rather than worry about, oh, this runs two times faster than the other thing, or this thing is smaller than other thing. That's interesting, but not that interesting. >> At this conference, this is really the message that you're getting across. It's the new tag line, we are making the world of work work better for people. How does the Now platform really deliver on that promise? How does it make the employees life easier? I would say we have a bunch of use cases, but as you know, we started out early on with IT service management, and the whole idea was can we provide, as long as computers are there, as long as software is there, password reset is going to be there for a very, very long time. So, my point is that that's when it started. Okay, I need to do password reset, I want to upgrade my laptop. Every year there is a new laptop, every year there is a new phone, and that cycle will continue, and as long as we are using technology for our knowledge workers, IT help desk will be there, right? And where we are evolving is enterprise service management, because you don't, as an employee, you may deal with IT, you may deal with HR, you may have a contractual issue with legal, you may need something related to your payroll from finance. People think payroll is HR, but payroll is finance. And as you try to go across in a day in a life of an employee, you need to make it as easy as possible. So that's what we are focused on, deliver better experiences. You know, artificial intelligence that listen today, I believe, is more about optimization, rather than intelligence. Yeah, we want to use your data to be able to predict, like if you see in Gmail, I don't know if you use Gmail, but if you have Gmail, you get an email, it'll suggest auto-responses. Those auto-responses are almost positive. Have you noticed that? They are never negative. >> Yeah. >> Oh, of course. >> They're like, no, I don't want to come to your meeting. (laughing) It's kind of like trying to predict most likely what you would want to say, and I think if we can use intelligence to make people more productive, that's what we want. >> I mean, I use that function. I actually like it. >> CJ: Yeah, exactly. >> You know, it gives you three choices, and one of 'em is pretty close to what I would normally, and if I'm busy, I'm done. >> Yeah, right, exactly. >> I like that. This is the other thing we've talked about. We've talked about this with Farrel this morning. Try to anticipate my needs, right? So that means you've got to infuse AI into the application and identify specific use cases. You guys have done some M&A there, you talked to the financial analysts meeting, obviously, not disclosing anything, but watch for us to do some more M&A. You got to believe that that machine intelligence space is really ripe for innovation. >> And what we believe is if I look at the big Cloud providers, like Google, are investing a lot in deep learning and many, many other technologies, so whenever they expose it, and some of them do a really good job, we will just leverage their libraries. But there are things specific to enterprise, because there are things specific to enterprise, like if you use the word network at a hardware company, that's always in context of compute network and storage. If you use the word network at a healthcare company, that's a network of physicians, networks of hospitals, networks of whatever. And if you use the word network at a Telco company, that is a whole different network. My point is we want to understand those pieces, and if we can make it easier based on your data, so if all your cases, which are, Oh, part of your network is down. Ah, that's what you mean from the context end point, so we want to use wherever folks like Google are investing, we will leverage that, but if we need to leverage, we'll do that too. >> It's interesting, we were talking to a customer today, it might have been Worldpay, and they took the CMDV language and transformed it into the language of the business. What a rare and powerful concept for somebody from IT to do that, because if the lingua franca is business, then the adoption's going to go through the roof. >> So does that make sense? >> Yeah, it makes a lot of sense. Well, I appreciate you talking about the value and the customer experience versus the technology. Certainly, it speeds and feeds you right. Boring. But the platform is important. Many products, one platform, that's unique for an enterprise software company, and you guys aspire to be the next great enterprise software company. Talk about how the platform enables you to get there. >> So I will tell you simple. You know our founder, Fred Luddy, started with the platform in 2004, so that was 14 years ago now, and his idea was you should be able to route work through the enterprise using our platform, and then we started with the IT service management and use case. The biggest advantage we have is that we are a very customer-driven organization. Many companies say that, but you see it here. Dave, you have been coming to Knowledge for a long time, I don't know about you. >> This is my first rodeo, but it's cool. >> It's the first thing you see. >> These are 80-plus person sessions, are customer sessions. They're not our sessions, where they are sharing best practices with them. So we get all these requests, CJ, we have built emergency response system using ServiceNow, CJ, we have built financial close using ServiceNow. Can you productize it? And we say, okay, thank you for the idea, which is great, thank you for the idea. How do I prioritize all of that? And, Dave, where platform comes in, because all the services I talked about today, service intelligence, service experience, user experience, they're all built in the platform, and I'm trying to be cautious, but if I want to create a brand new product on our platform, a brand new product on our platform, 40-use case, a 1.0 product where I feel comfortable the customers can use it, I would say 12 to 18 engineers. That's it. >> Rebecca: Wow. >> If I want to create one product, it's 12 to 18 engineers. So the R&D leverage, and that's the point I was trying to get across, that whether it's my own team creating product or whether our customer building apps on our product, because on platform, because we provide all the common services integration, the incremental cost to create something, now sales marketing, with my close friend, Dave Schneider, is much harder, because he has to scale it, build specialty in it and all that, but to create the product is not an issue for us on the platform. >> But this is where Cloud economics are so important, because at volume, your marginal costs go to practically zero. >> CJ: That's exactly right. >> But people may say, oh, 12 to 18, that sounds like a lot, but we're talking about an enterprise class software product here, and Fred Luddy, in the 2004 time frame, I mean, the state of enterprise software then, frankly, and now, was terrible. The guys at 37signals, I don't know if you know Jason, they made valid attempts, but it wasn't enterprise class software, it wasn't a platform. I've said, a number of times this week, the reference model for enterprise software is painfully mediocre, so you guys have done a great job, and now you've really got to take the next step and stay ahead on innovation. >> Correct on innovation card, that's what I said, innovation should be my top priority. You heard me at the Financial Analysts Day. Customer Service Management, brand new product, we actually launched it at Knowledge 16. Okay, that's when we launched it. It was engineers and teens who created that product, so many teens, the 1.0, now we have evolved quite a bit, 500 customers two weeks ago, 500 enterprise customers. You guys know that we don't go to the small line of the business. 500 in two years, eight quarters. >> And I found out last night, I think it was 75, or it might even be higher, reference customers. >> CJ: Yeah, already, using CSM. >> That's the difference. I do, we do, a lot of these shows. >> That's the platform impact. >> And you're talking about the customer focus. You do a lot of these shows. The customers talk about the impact on their business. They don't talk about how they installed some box, or like you say, runs faster. It's the business impact that really makes a difference, and that's why we're excited to be here. >> You saw today when I talked about Flow Designer and Integration Hub. IT wants to provide software so that business analysts can model business processes in a Cloud way with whoever you need to integrate with, so we are really keeping that as the north star for our customers, and how can we make their life easier, whatever they want to automate, some manual processes, all of manual processes. I remember speaking to Fred when I joined initially, and I said, "Fred, how did you think about TAM?" He said, "What do you mean, TAM?" You know, he's a funny guy, and he was serious. His point was there are so many manual workflows, how do you put a TAM around it? Every business is unique, their processes are complex, so don't box yourself and say, Oh, this is a $4 billion TAM and I'm going to get 20% of it. Every enterprise, as long as they exist, they will have manual workflows, you go and give it our platform so they can automate however they want. >> Well, I'm going to make you laugh about TAM. I'm a former industry analyst, so when you guys did the IPO way back when, well before your time-- >> CJ: 2012. >> when Frank was here, there was a research company saying this is small market, maybe it's a billion dollars and it's shrinking, so I, with some of my colleagues, developed a TAM analysis, and it was more than 30 billion. I published 30 billion, you can go on our old Wiki and see that, and the guy said to me, "Dave, you can't publish more than 30 billion. You'll look like a fool." The TAM is much, much bigger than 30 billion. You can't even quantify it, it's so large when you start looking at it. >> And now, because people are recognizing that we automate all the manual workflows in a enterprise on a Cloud platform, last week somebody published a report and I just saw the headlines, I didn't go through the details, 126 billion. So from in 2012 to that small number, and we don't know what the number is. >> Could it be bigger? >> I would have no idea. I would be completely disingenuous if I told you I know what my TAM is, but I don't think that way. I say what customer problems can I solve? >> Well, that's what I wanted to ask you. So you're here with so many different customers. Just on the show, we've had ones in payments, in insurance, in health care. What are you hearing from customers, and what are sort of your favorite applications of what you're doing? What makes you the proudest? >> Yeah, so I would say the proudest moments for me are when I'm like, wow, you do that with ServiceNow? I would have never thought that. So when I didn't expect, when I expect something, Oh, I had this routine email, text collaboration, and I switched it to ServiceNow, get it, like not a big aha moment. I had this one customer who said he has a big distribution network, all these partners, and those guys have ServiceNow, he has ServiceNow, and when they have problem with the product, their product, my customer's product, they all communicate via ServiceNow to each other. So they have created a whole ServiceNow network, truly a B2B kind of exchange, kind of, using ServiceNow. One of our median and entertainment customers who owns a bunch of parks, they refill the popcorn machine using ServiceNow. When the popcorn levels dip, they have those people who carry around the cart, Oh! The popcorn level dip, it marks the sensor, it routines the workflow, goes to the corporate, Ah, we need to fill up popcorn on by this particular ride. For me-- >> And even at my house, I love it. >> Yeah, so that's exciting to me. >> We talked to Siemens today. >> Yes, great customer. >> Awesome, and I want to run a line by you. We talk about AI a lot, machine intelligence. I wrote down during, you know, data is the fuel for AI. Well, you know we love data here at theCUBE, and he was describing that, he said, you know, even though CJ was not prescribing taking the data out, we could leave it in so it learns, right now, we take some of the data out. Well, you described that. Well, we put it to SAP HANA, we throw a little Watson in there, we do some Azure, machine learning, we use Tableau for visualization, he's probably got some Hadoop and Kafka in there, a very complicated, big data pipeline. And I said to him, Okay, in two years, do you want to do that inside of ServiceNow? He goes, "Absolutely. That would be my dream come true." So, I guess I'm laying down the gauntlet. Do you see that as a reality? >> So, we are talk to Siemens, great customer, they keep us honest, so I love that and I did actually meet the team who was in charge of their BI and reporting and they did share the same story a few months ago when I met them. And we are trying to figure out, Dave, if I knew the answer, I would have told you, but you know my style. I don't know the answer. We are seriously trying to figure out, Do we become an analytics hub? We are really good with ServiceNow data, we can build connectors with other data, but do I want to be in the BI and reporting market? Absolutely not. Do I want to help customers as their processes span across and provide them more visual credit tools than others, text-based searches, whatever they need, the answer is yes. Performance analytics, as you know, we have been moving along really at a good pace, and now we have what every single product, but this is something that Eric Miller, who runs that business, we talk about it all the time, because currently our analytics is building the platform, and now you know that data has a Cloud issue, so if you have data here, you have data there, you have data there, we are in our own Cloud. Can we build a connector, potentially, to OnPrem? Don't know the answer, but this is something, it's a fair gauntlet having to solve. >> Humbly, I'd like to give you my input, if I may. >> Yes. >> We see innovation, as I said before, it's data, applying machine learning to that data, and then leveraging Cloud economics. The project with big data projects, as you well know, is the complexity has killed them. Now you see the Cloud guys, whether it's Amazon or Microsoft, and that's where the data pipelines are being simplified and built. Now, I don't know if it's the right business decision for you guys, but wow, wouldn't that be powerful if you guys could do that, certainly, for your customers. >> And, truly, that is, as you heard me on Financial Analysts Day, I'm a huge fan of Geoffrey Moore's work, and he defines system of record, ERP CRM, system of action where we fall in, and then he has System of Intelligence, which is all the things around data and how do you harness the power of data. And that's something that I really, in our product teams, we talk about all the time, if I can solve Siemens problem with everything in ServiceNow, that'd be awesome, but is that something I want to prioritize right now, or is there something, we should give them the flexibility. I don't know. >> Well, you're one of the top product guys in our industry. It's why they found you. No, seriously, I put you up there with the greats. >> You're kind, thank you. >> It's true. You've got an incredible future ahead of you. But as a lead product person, you have to make those decisions, and you have to be very circumspect about where you put your resources. You can't just run to every customer requirement, right? >> And I tell, coincidentally, my wife asks me What's your job, by the way? I said, that's a good question. >> I'm married to a product officer, too, I feel the same way. What do you do all day? You do a lot of meetings. >> Yeah, exactly. So I said that I do a lot of meetings, and she said why do you do a lot of meetings? And I said I'm making a some decision or help my team make a decision because they already analyze a bunch of things. And I said, my hope is, as long as I can make more good decisions than bad decisions, specifically about product strategy, because you never know unless you make the chess pieces move and think of two or three steps ahead, and some things could be right and some things could be wrong. I have a simple framework on my whiteboard for every meeting. No jokes, right? So, my framework is very simple. Question number one, What customer problems we are trying to solve. If you cannot articulate that, for any new product idea you have, I don't go past that question, What customer problem we are trying to solve? Second is Why now? Why do we need to solve this problem now? Like you said, there are many problems, which one are you prioritize? And then, third, Why us? Why should we solve that problem? So, if you can articulate the problem, which always is a challenge because you kind of know what problems you have, but unless you really, really understand the customer pain point, you cannot articulate it. Then you say, why now? Like why is the time right now for us to invest in this, say, analytics, as a service? Why right now? And, third, why you, as in why us? Why is ServiceNow should solve it? That, at least, gives me a guiding compass to say because I have many products, as you know, I am very protective of our platform, and all these use cases come in, every product line wants to go deeper, rightfully so, because they are trying to solve for customers, and the new products want to be built on this platform. Sometimes I say maybe a partner should build it, so we made a decision, facilities product, Should our ISB partner build it? And that's the right place because we feel they are more suited, they have the skill set, all of that. But that's it, what problem, why now, why you? >> Rebecca: Really, I love it. >> Well, the Why you? it's a great framework. The why you is unclear for the Siemens problem, and I can understand that. You take the DemOps announcement that Pat stole from you today-- >> I know, that's not cool, man. >> But that's a problem that you guys solved internally, clear problem. >> He did a nice job of articulating it, very nice job. >> Yeah, definitely. >> But we feel that there always is a process when you need a workflow across, because in planning there are a bunch of companies, as the patch, or in build there are a bunch of companies in develop there are a bunch of companies. That's fine. They could be the system of records for those chevrons and we are the workflow that cuts across. So we feel loved. We showed our value to our customers by doing that. >> Rebecca: That's great. >> I know we've got to go, but lastly, it's roadmap. Last year, you talked about how you guys do releases by alphabet, twice a year. You were really transparent today, laid out the room and talked a lot about Madrid, you laid out well into the future what you guys are doing so, as an analyst, I love that. I'm sure you're customers love it, so-- >> A lot of people to picture, so that's nice. And Twitter, a lot of people posted on social media as well, so clearly there was a customer pain point, as we call it, that they needed a roadmap. In speaking to customers last one year, number one thing, if you tell us what you're building, then we don't have to build it. If you tell us when you're shipping, then we can plan around it, and then we will set aside resources to do testing. Any Cloud software company, whether it's us, CRM software or HR software, people still test, because you cannot mess up your employee experience or customer experience, and they just said give us a predictable schedule, please, so that we know. We did say two times a year, but we were not prescriptive which quarter. It could be four months and eight months, it could be six and six, it could be seven and five. I'm currently going with the quarterly-level fidelity, and eventually, I want to get to a month-level fidelity, where I say March and September, once our internal processes are organized. >> So the other subtlety there, and I know we got to go, is the ecosystem, because you're giving visibility, they have to make bets. They're making a bet on service, but then where's the white space? They're betting on white space. If you're exposing that to them, they can say, Oh, not going to solve that problem. ServiceNow's going to solve it in two quarters. >> I agree. >> Huge difference for them. >> You guys are wonderful. Thank you so much for inviting me. >> Rebecca: Thank you for coming on the show. We appreciate it. >> No, that's awesome, thank you, thank you. >> Dave: Great to have you. >> Rebecca: Great to have you. I'm Rebecca Knight, for Dave Vellante. We'll have more from ServiceNow Knowledge 18 just after this. (techy music)

>> Announcer: From San Francisco, it's theCUBE! Covering OSIsoft PI World 2018. Brought to you by OSIsoft. >> Hey welcome back everybody Jeff Frick here with theCUBE. We're at OSIsoft's PI World 2018 in downtown San Francisco, they've been at it for decades and decades and decades talking really about OT and efficiency. And we're excited to be here it's our first time, and really want to talk to a customer, excited to have our next customer CJ Smith, She's a Project Manager for the city of Riverside CJ great to see you. >> Thank you, hi! >> So you represent a whole slew of mid-sized US cities, so how big is Riverside for people that aren't familiar? >> We serve 120,000 customers so we're not too small, but we're definitely not as big as some of the other cities. >> Right and then as we said before we turned on the cameras, you guys have a whole department for utilities, you have your own utility as well. >> Yes we do have a public utility division within the city, also an IT and public works, parks and recs like other cities as well. But we do have the utility, which is different than some of the stand along utilities, like LADWP for example. >> Right but it's good you were saying off camera that that gives you guys a nice revenue source, so it's a nice asset for the city to have. >> Yeah the utility is revenue generating department. >> Okay so what are you doing here at PI World, how are you guys using OSI software? >> So we started down PI back in August 2016, as an enterprise agreement customer, and at that time we really lacked visibility into our system so we needed something to help us gather the data and make sense of it, because we had data all over the place, and it was hard to answer simple questions it was hard to find simple data. And so we started down the PI journey at that time, and we basically used it like a data hub to aggregate data, turn that data into information, and then we disseminate it using dashboards. So PI Vision dashboards which used to be PI Coresight, as well as reports. >> So what were some of the early data sources that you leveraged, that you saw the biggest opportunity to get started, or yet even more importantly your earliest successes where'd your early success come from? >> So our very first work group that we worked with was our Water Operations and our Water SCADA team. >> Seems to be a pattern here a lot of water talk here at OSIsoft. >> Yeah I'll talk about electricity too. But we started on water and the first thing we did was implement their data, it was called a Water Operations dashboard, and they were doing it manually in Excel, and it would take a staff person over eight hours to do it. And they would do it the next day for the previous day data. So imagine how opposite of real time that is right? So we integrated that data with PI. >> And how many data elements? How big is the spreadsheet this poor person is working on? >> So the Water SCADA tags that we brought in were near 1500 tags, so you imagine that much data and calculations with over 1500 calculations behind it. So it was a ton of effort. >> Right. >> And a huge quick win for them! So it's saved staff time, they now have actual intelligence, real time data, the managers get alerts to their phones about the status of wells, and so it was really helpful to that work group. So that one was one of our first and earliest wins on PI. >> Was it a hard sell? To those people to use it? It wasn't because we did find a champion in that group, someone that would help us. Actually the manager he was very interested in technology and automation. And they understood that even though it would be a time investment up front, it would save them a ton of time in the long run, for the rest of the year. And so one of the things that helped us get buy-in early on is that we used an Agile approach. So we would tell the manager, I only need you for five weeks. I need you and your staff for five weeks, and then you don't have to talk to us anymore. We will deliver the product in five weeks, we will do all the work, but if you could give us five weeks of your time, then you could have all your time back the rest of the year. And that helped us get buy-in from the managers and a commitment, because they can identify with okay just five weeks. >> Right so those were probably the operational folks, what about on the IT folks how was getting buy-in from the IT folks? >> The funny thing is and the thing we did different is, we have a great relationship with IT, and we really forged a partnership with them early on, even from the very beginning when we were just reviewing the agreement. We got their buy-in early on to say okay, this is what we're thinking about doing, we want you to be part of the team, and we really built a partnership with this project so that it could be successful. So they work hand in hand with our PI implementation team every step of the way. They've been on this journey every step of the way with us. So we don't have some of the challenges that other companies that I hear are talking a lot about here with IT and it kind of being a bottleneck, we didn't have that same experience because we really worked hard up front to have the buy-in with them and really build a partnership with them, so that they're implementing PI with us. And another selling point with that is, we're using PI as a data hub or like a bus, a data bus essentially. So for them it's good because we're saying look we're only going to have this point to point system, instead of having all of these individual points we're only going to connect to one system, which will be easier for them to manage and maintain, and we'll instruct staff to go to PI to get the data. So that's a selling point for IT it's more secure, it's more manageable. >> And did you use an outside integrator, or did you guys do it all in house? >> Our implementation team is a combination of in house staff and a consulting firm as well. >> And then it's curious 'cause then you said once you add all the data it's kind of a data bus, how long did it take for somebody to figure out hmmm this is pretty cool maybe there's data set number two, data set number three, data set number four? >> So right after our first six week implementation, we rolled out a new implementation every four to six weeks. >> Every four to six weeks? >> Yeah so we did a sprint cycle the whole first year, and actually the whole second year we're currently in right now, and so we touched a different work group every single time, delivering a new solution to them. So we picked up a lot of traction so much that now, other departments in the city want it, public works is asking for it, the city manager's office so it's really picking up some good buzz, and we're kind of working our way down discussion of smart city talks, and seeing how PI can support smart city, big data advanced analytic initiatives at the city. >> So what are some of the favorite examples of efficiency gains, or savings that department A got that now department B sees and they want to get a piece of that what are some of your favorite success stories? >> I would say two of mine, I shared one on the big stage yesterday about the superpower I talked about our operations manager, who started receiving actionable intelligence overnight. And he got an alert around midnight, and he called his operator and said hey, what's going on with that well? And the operator said very puzzled, how do you know that there's something going on with this well? And he replied and said because I have superpowers. And so his superpower was PI, and that's one of my favorite stories because it's just simple and it resonates with people, because he is receiving alerts and push notifications that he never had before to his mobile device at home. So that's a huge win. >> Was the operator tied in to that same notification, or did that person know before the operator? >> The manager knew before the operator. So the operator didn't know about PI at the time and we had just rolled it out. And so the manager was just kind of testing it and adopting it, and so it was kind of like he had a leg up a little bit and they were confused like how do you know you're at home? >> Man: Right. >> He's like I have superpowers. (laughing) It's probably my funniest and best story, and one that I always tell because it helps everyone, no matter if it's an executive to a field person, really understand the power behind PI. I think another one if I had to pick another example of a win that I think was powerful is, our work order and field map. So we have our field crews right now that have a map, that's powered from our work order and asset management system pushing data to PI, which then pushes it to Esri through the PI integrator, and they're out using it in the field and it helps them route their work, they can see where their workers are, they can see customer information. And that map is really changing the way the field crews work. So imagine a day before this system where, they would go in and have to print every work order from the system. And not all asset management systems are really user friendly. They're kind of archaic a little clunky, so I won't say the name of our system. >> And doesn't work well if there's a change right? >> Yeah and they're not really mobile friendly. So that's part of the challenge, but because of that now public works wants that map, parks and rec every department that has field forces, they want something similar so that they can get all the data from all the other systems in one app in one location on their device. >> And do you find that's kind of a system pattern, where often department A needs very similar to what department B needed with just a slight twist? So it's pretty easy to make minor modifications to leverage work across a bunch of different departments? >> Absolutely a lot of work groups are similar, maybe a little different like you said, but especially those that have field forces. Sometimes it makes it easy to sell it to the next group, it's like look this is what we've done, is this something that you kind of need? Or what would you need differently? Like we've developed field collection tools. That's easy to replicate. Once you see it it's easy to say you know what that works but I need it to say this and I need it to say this. If you just show them a white paper, it's hard for them to say this is what I need. Most people just don't know, but it's easy once you see a suit to say oh I don't like that tie I don't like that shirt, I don't like those pants. >> But something close. >> Yeah but something like that right? So that's the benefit once you start having a solution to easily modify and reproduce. And then the good thing about Agile, you're running sprints so you're learning every sprint. You're kind of learning as you go, and you're able to refine it and refine it and make the process that much better. >> Right. On the superpower thing employee retention is a challenge, getting good people is a challenge, I'm just curious how that impacts the folks working for you, that now suddenly they do have this new tool that does allow them to do their job better, and it's not just talk it's actually real and gave that person a head up on the actual operation person sitting on the monitor devices. So as it proliferates what is the impact on morale, and are more people rising up to say hey, I want to use it for this I want to use it for that. >> Yeah we are getting a lot of interest, and I think the challenge is, and I talked about this a little bit during my session, is change management and culture. Some people see automation and technology as sometimes a threat because of job security, or the I've always done it this way type of mentality. >> Man: Never a good answer. >> Right but once you kind of get them to see that we're just automating your process to make it better so that you can do cooler and better things, so that you can actually analyze the data instead of inputting data. So you can actually solve problems versus spending all your time trying to identify the data and collect information. So staff are starting to see the value, and after the first year and a half, we've gotten a lot of traction. I don't really have to sell it as much, it's now such a huge part of our culture that the first question when we want to implement a new system is does that integrate with PI? I don't even have to ask them. Everyone else is asking well have you thought about using PI for that? So we always kind of look to PI first to say, can we create this solution in PI? And then if not we look at other solutions and if we're looking at other solutions we say, does that solution integrate with PI? So that's become part of our norm to make sure that it plays nice with what we're calling our foundational technology which is PI. >> Right so you talked a lot about departments. Is there kind of a cross-department city level play that you're rolling data and or dashboards into something that's a higher level than just the department level? >> Yeah so far the only thing that we have done that's kind of cross divisional not just in one division, is our overtime dashboards. So we recently created overtime dashboards throughout the entire city so that executive level department heads have visibility into overtime, which just gives them trends so that they can know what departments are receiving the most overtime? Is that overtime associated with what type of cause? Was it something outside of our control? Was it a planned overtime? And then most importantly where we're trending. Where are we on track to be by the end of the year, given our current rate so that they can be proactive in making changes. Do we need to do something different? Do we need to hire more people in this department? Do we have too many people in this department? Can we make shifts? So it's giving that level of visibility, and that's a new rollout that we just have completed, but it's something that we're already seeing a lot of interest in doing more of. Cross divisional things so that the city manager's office and that level has more view into the whole city. >> Right well CJ it sounds like you're doing a lot of fun stuff down at Riverside. >> Woman: We are we are! >> And you can never save enough water in California, so that's very valuable work. >> Woman: That's true! >> Well thanks for taking a minute and sharing your story, I really enjoyed it. >> Thank you for having me. >> Absolutely she's CJ Smith I'm Jeff Frick, you're watching theCUBE from OSIsoft PI World 2018 in San Francisco, thanks for watching. (upbeat music)

>> SiliconANGLE Media presents... theCUBE! Covering AlibabaCloud's annual conference. Brought to you by Intel. Now, here's John Furrier... >> Hello everyone, welcome to Silicon Angle's theCUBE here on the ground, in Hangzhou, China. We're here at the Intel Booth as part of our coverage, exclusive coverage of Alibaba Cloud Conference here in the cloud city. I'm John Furrier, the co-founder of SiliconANGLE, Wikibon and theCUBE. And I'm here with CJ Bruno, who is the Corporate Vice President and General Manager of Global Accounts of the sales and marketing group at Intel. That's a mouthful but basically you run a lot of the major accounts, you bring a lot of value to Intel Supplier to these big clouds. >> I do, John. We look after our top 20 or so largest partners and customers around the world. Amazing like Alibaba, edge to cloud enterprises, deep rich engagements, just an exciting, exciting time to be in the business with these big customers. >> And there's no borders to the cloud so its not as easy as saying PC, like people might think of Intel in the old days. You guys have these major cloud providers, there's a lot of intel inside so to speak but that value is enabling a new kind of functionality. We're hearing it here at the show. >> You are. We work together with partners like Ali, in the area of such big artificial intelligence development, big data analytics and of course, the cloud. We've been working with them for over 12 years now and you can see the advancements and the services that they're providing to their customers, not only domestically, here in China but on a global stage as well. >> Its interesting, Intel, you've been working with these guys for 12 years, what a journey, from an entrepreneurial 12 guys in a dorm room, or an apartment for Jackie Ma, that he talks about all the time, to now the powerhouse. What's it like, because these guys have an interesting formula going on here. They're bringing culture and art, with science, kind of sounds like Steve Jobs, technology meets liberal arts, bringing a cultural aspect. How far have they come? Give us some insight into where they've come from and where you think they're going. >> Its amazing, Jack Ma, yesterday in his keynote, talked about this event eight years ago. 120 people, John, we're standing amongst 60,000 or so, in this event today, just eight short years later. Its amazing what they've been able to do. They're driving innovation, this is not a copy economy, it's an innovation economy. They invest, very high-degree of technical acumen. Willingness to break barriers, try things people have not. Fail fast and correct. Take risks. They're entrepreneurs at heart, they're technologists in their bloodstream and they really invest to win. >> You guys are supplying. We talked to people who talk about Photonics, Deeraj Malik, who's really going deep on these pathways around. Some of the Intel innovations, some of it's like wow, mind-blowing. The other end is just practical stuff, making it easier, faster, simpler to run things. IoT, their big use case, I mean you can't get any more sexier than looking at a city cloud that's actually running the city with traffic and all those IoT devices, so what is the big thing that you guys do for Alibaba? Talk about that journey because its not one thing, what is it? What is the magical formula? >> Sure, of course, first off we deliver, we think, world-class ingredients to their world-class cloud. And enable them to deliver amazing services to their customer, at the base level. But we really work together to solve societal problems. Look at the precision medical cloud that we announced last April together, John. Genome sequencing, solving people's cancer problems, in a matter of days, instead of months. Just one example of the real use case that we bring these technologies to bear on and have an amazing influence. We work on them with the Tenatchi Medical Imaging Competition. 3,000 entrants competing to see who can identify lung cancer quickest, and we have some winners selected, just this week. So these things are real, taking this technology, solving real life problems, and business problems, around the globe. >> And its not just the big, heaving lifting technology that moves the needle, like you were mentioning but its also the micro technologies, like FPGA, you guys have got lot of things. This is like the new Intel, so I'd love to get your thoughts, if you can just take a moment to share the journey that Intel is on right now because you gave a talk yesterday, a kind of a keynote, onstage. What is the Intel journey right now look like? >> We're transforming ourselves from a PC centric company to a company that runs the cloud and powers countless numbers, billions and billions of smart-connected devices. That's a big journey we're on. We've diversified our business significantly in a five year period, John. Driving our data-center business, our IoT business, our programmable logic business as you said, our friends from former Alterra are now two years inside Intel. Our memory business, our NSG technologies, 3D NAND Optane, driving breakthroughs in SSDs and of course new technologies that we're exploring, like drones and neuromorphic computing, making sure we never miss the next big thing. >> I've been following Intel for 30 years of my career and life, as an initial user-developer and now in the media. It's interesting, Intel has never done it alone, it's always been part of the ecosystem. You have brought a lot of goods to the party, so to speak, in technology, Moore's law and the list is endless. Now is an end to end game but you look at 5G for instance, you kind of connect the dots, put a radio frequency cloud over a city and you got to run the IoT devices like a city brain, they're showing here. You got to tie it together with programmable arrays, it's a hardware thing but now the software guys are doing it. You've got cloud native with the Linux Foundation, that's DevOps. You've got data centers that are 10 to one silicon to the edge, this is a wide opportunity, how do you guys make sense of it to customers? Because its a complex story. >> It is John, look, we're the ultimate ingredient supplier. We're bringing forward technologies in artificial intelligence, in 5G, in VR and AR, areas that are just autonomous everything. Autonomous driving in particular. These are big investment areas we're driving into that require an enormous amount to compute, storage, networking, connectivity and we're making the investments to make sure we're critical partners with our customers, in all those huge growth areas. Making us a big growth company now. >> I had a great conversation with Dr. Wong, who's the founder of Alibaba Cloud, he's on the Technology Steering Committee for Alibaba Group and yesterday they just announced a 15 billion dollar investment over three years for FinTech, across the board IoT, AI, collaborate with scientists as well as artisans. This is a big deal. >> It is John, this is exactly an example of what I mentioned earlier. These guys invest to win and they have a will to win. And they want to pioneer and they want to innovate and they put their money where their mouth is, in that announcement, its pretty exciting. >> So the cloud serves quite a market, doing really well. Your global accounts are doing well, certainly in Asia and People's Republic of China, PRC, as you guys call it, extremely well but now there's a Renaissance in cloud in general, so we're expecting to see a lot more cloud service providers, maybe not as big as Alibaba but Alibaba is going to start getting customers that become SaaS companies, that's technically a cloud service provider if you think about it, if they have an application, how do you look at that mark? >> We see what is known as the super seven in the industry, the large folks, both US based and China based but then we've identified the next 60-70 next wave CSPs that are growing vibrantly around the globe and there's a long tail of another 120 that we're interacting with. You're absolutely on point, an exploding area. Significant double-digit growth for years to come and just solving, big, big life and business problems. >> So at SiliconANGLE also silicon is in the name and Wikibon Research is really big in China, here, interesting dynamic that's happening here with the data and the software and was brought up with Dr. Wong about the IoTs, kind of a nuanced point but I want to get it out for the folks watching that you're going to start to see new compute at the edge because data is now the currency of the future. It needs to flow, it's like water but at the edge it can be expensive, low latency that table stakes that everyone wants to get to. You're going to see a lot more compute or silicon at the edge of network. Internet of things coming, your view on that? >> There's no question John, that's exactly the way we see it. The time to get the data back to the long-haul data center, is very expensive and very challenging and requires an absolute redo of the network. We're moving to compute closer and closer to the data, of course, the cloud remains a vital, vital part of that but we move that compute capability closer to where the data is sensed, you can analyze it quicker, you can make faster decisions and you can implement those decisions at the edge. >> CJ, final question for you, obviously Alibaba, big part of their growth strategy is going outside mainland China, obviously doing very well here, not to knock them there but great opportunity to go into the global marketplace, specifically North America. That's going to put more competition, competition was good but it's also going to require more growth. How are you helping Alibaba and how does your relationship at Intel expand with Alibaba? >> We work with Alibaba, not only on the technical front of course but on their go-to-market plans, on ecosystem development plans and even some business models. We do that across our entire customer and partner base, John. We're seeing this explosive growth in cloud and being able to work with our partners on all four of those fronts; technology development, ecosystem development, business model development, are obviously a benefit to both of us. >> Alibaba is going to need some help because you know its competitive, Amazon had a nice run for a while, Microsoft nibbling at the heels, Google and now Alibaba coming in. Competition is good. >> We're proud to call all those innovators our customers and we work hard everyday to earn their business. >> Final, final question, this one just popped in my head. What should folks in America know about this PRC market or China market that they may not know about? Obviously they read what they read in the paper. They see the security hacks, they see the crypto-currency temporarily on hold but blockchain certainly has a lot of promise, but it's a dynamic market here. A lot of of opportunities. What should that audience know about the China market? >> I think the first thing they should know is that if they haven't come to experience it themselves they should. The scale of the opportunity, the scale of the country is like nothing people have ever seen before. As I said, the investments they're making-to innovate, to drive an innovation economy is breakthrough. You take that scale and that investment and this is a market to be reckoned with. >> Congratulations on the 12 year run with Alibaba, and now Alibaba Cloud. Looking really, really, strong, love the culture, got to unique twist; artistry and scientific cultures coming together, looking good. >> Absolutely John, thanks for letting us tell our story. >> CJ Bruno, Group Vice President, General Manager Global Accounts for Intel. I'm John Furrier with SiliconANGLE, thanks for watching.

>> Announcer: Live from Orlando, Florida, it's theCUBE, covering ServiceNow Knowledge17, brought to you by ServiceNow. >> And we're back in Orlando, everybody, this is Dave Vellante with Jeff Frick, CJ Desai is here, he's the Chief Product Officer of ServiceNow, the newly-minted, 150 days in, CJ, great to see you off the keynote, fantastic job. >> Thank you, thank you, thank you. >> Very crisp, I was struck by your story about last October, when you were contacted by ServiceNow, you fired up the platform and started playing around and built an app. >> Yeah! (chuckling) >> And you found it was a good experience. >> It was a great experience, I'll tell you, Dave, from my standpoint, when you join a company that is built on a platform like ServiceNow, you want to make sure that you feel great about the foundational elements, because as always, you can build floors on top of a foundation, only when the foundation is strong. So ServiceNow always, I don't know if you know, but it started out as a platform company, and then they used the service management use case, and went deep in that use case, and then went to Operations Management and other products, as you know, and I just wanted to make sure that, hey, how easy it is, if I'm a customer, or if I'm in the product development organization, to create an app, and having that strong foundational layer, even simple things like, it's the cloud offering, first of all, you have a integrated development environment, you can start creating workflows, UI, all of that is so easy, and there's no headache of figuring out how to deploy the app, because it's right there, so you just publish it and you're done. >> Yeah, it's interesting, one of the first CUBE interviews we did at Knowledge was with Doug Leone, the famous VC, and he told the story of, he saw this, "What am I going to do with this?" And sent Fred away and said, "Build something on top of it," and that's what happened, but. But help our audience understand, CJ, because you talked about Jakarta today. >> Yeah. >> Now, Jakarta is a platform capability, and if we understand it correctly, we were talking about it earlier, the business units have to figure out, "Okay, how do we apply that capability "to our particular needs, and our customer needs," so explain that. >> Yeah, so ultimately, there are two things that happens in the products organization, right? First is, we do release this every six months, twice a year, so every six months, twice a year, and we go by alphabets, and we pick cities, just a fun factoid, we pick cities that go from North America or South America, to Europe, to Asia. So, H released last year, around this time, was Helsinki, after Helsinki was Istanbul, and then we have Jakarta, so are now in Asia, and then next will be Kingston, and the one after that is London, so you go alphabetically, and the reason we pick this city names in alphabets, we support our customers, because it's a multi-instance paradigm, n minus one and n minus two releases, so when you make, name of the cities, customers will have a conversation with me and say, "CJ, we went on Helsinki, we're upgrading to Istanbul, "or we're going to skip Istanbul, "and go straight to Jakarta," for example, so, first of all, that's our naming system that we use, every six months, you will see us talk about a specific release, and you heard from John yesterday, he was very clear in saying, "Listen, "our customers want to hear our roadmap, "they want to know what we are up to," and so we took that customer feedback to heart, and decided, why don't we just tell them what's coming in Jakarta? So Jakarta will be released this summer, and from a planning standpoint, Dave, to answer your question, we figure out first, what do our customers want, and is it in the applications that we talked about, like ITSM or CSM or security or HR, and for those applications to deliver the functionality, what do we need to do in the platform so that the functionality can be delivered? So the requirement process is a complex requirement process, the applications team will give requirements to the platform, customers also sometimes have requirements for the platform on scale, platform will build a functionality, applications team will build the features on top of it, so in Jakarta, which is coming out this summer, we have six new products, you saw some of them, software asset management and others, 30 major features, and that's close, so after Jakarta, we're already in planning for Kingston. After Kingston, I think I'm going to announce it for the first time, will be London, so it's Jakarta, Kingston, London, are the three-- >> Yeah, so when we go to these events, a lot of times, at the keynotes, somebody will make a product announcement and you get a little golf clap, it always happens at ServiceNow Knowledge that you get somebody hooting in the audience, today, the hoot came for software asset management, they were the three high level things you talked about today, performance with UX, and performance, and then the vendor risk management, which is very interesting, we'll talk about that a little bit, and then the software asset management, the guy must've been an Oracle customer hooting and hollering. But so, give us the high level overview. >> Alright, so, here is the thing, right? Our buyer is IT organization, we started with IT. We love our buyer, and CIO, to all the organizations that support CIO, head of infrastructure, the portfolio management team, the business management within IT. And one of the things that we saw, and this is the requirement that we got is, when we talk to CIOs about how to make the IT organization productive, because IT, it's a tough job, man, it's a tough job, things go down, you're like, "Okay, of course, IT," and technology's such an integral part of our life that people are always looking at IT to make sure they deliver great technologies. So, IT budget, and every, debated this all the time, everybody talks about IT budgets, what's happening to IT budgets, how the IT budget is going up or down, are you asked to do more with less, there are so many examples I can use, but as per Gartner, 25% of the IT budget is on software licensing. Then there is hardware and all the other infrastructure and people-related cost. 25%, so if, and as you know, some of the vendors put you through a pretty complex audit process, so why can't we, our chief buyer is IT, why can't we give them a platform, or a product, that allows them to discover how many products you are using by vendor, Microsoft, Oracle, some of you examples you used, for desktop, it's Adobe and others, you use these products, are you really utilizing all the licenses you have, or are you potentially in overage so that you actually have a sense of where you stand with every vendor that you're using that makes up your 25% budget. We talk to financial customers, manufacturing industrial customers, these are billions of dollars of budget, 25% is still a big number, any improvement in that 25% could go a long way, and what CFOs do not like is when CIOs go and tell the CFO, "Hey, we didn't clear this audit, "or potentially these guys may sue us "for a contract violation," so we decided we are going to create a product that helps you get a good posture on what your licensing is, does that make sense? And that's why, you know, I also saw on Twitter, a lot of people love this idea that, hey, can we automate this software as a management process, discover what's being deployed, allow you to reclaim, and at the end, help you save the cost. >> And the other one was the cloud management platform, which again, similar type of situation, especially with all the freemium services, and test dev, and card swiping, that they can get unruly pretty quickly. >> In my last job, as you are aware, I was in infrastructure space, and one of the things in speaking to customers, always realized that hey, IT was not agile enough, we decided, for some customers, we decided to go and use some of the public cloud services, re-enter infrastructure, because IT could not keep up with our demands, and you go and speak to IT, they say there is so much going on that sometimes it's not easy for devops communities, in particular, that you pointed out, so much going on. So, IT felt like they were losing control, developers, whether they're application developers in IT organization or in business units, just wanted agility, and IT felt like if they cannot deliver that level of service, you had the share-to-IT functions going on in the departments, and with cloud, we acquired a company called iTapp about a year ago in April. The first year was all focused on re-platforming, like I said today, I think many times, I'm sure people got sick of listening to me, is, we are going to re-platform every acquisition that we make, and we usually buy technologies in our business so far. And we re-platform it, and now, IT gets the control back, once for, you know, you help the developers, devops people, sure, go and use public cloud, but IT will still have a single pane of glass that allows you to look at your resource mapping, utilization, understanding the cost and the usage, whether you are on public cloud service, or in private cloud service. >> Well, it's huge, because it's very unpredictable, and people often complain, "Oh, I get the cloud bill at the end of the month," but a lot of times, there's not just one cloud bill, it's many, many cloud bills, and what happens, you know, you remember this, in the downturn, a lot of CFOs said, "Go to the public cloud, "eliminate Capax" and then, when we came out of the downturn, lines of business said, "I got to move fast, "and this cloud thing seems to be working for me." IT seems to have really, you know, in previous big picture trends like this, mega trends, IT oftentimes has been sort of pushing back, you saw that with client server. >> Yeah, their security concerns, compliances-- >> And today, they're announcing, okay, we have to embrace cloud, or we're toast. >> And Dave, I'll tell you, there are customers, I mean, some very large customers in regulated industries who tell me that, "CJ, we are now cloud first, "before we decide to do something," I mean, that's a pretty big statement, cloud first, I mean, if you remember 2008, '09, '10, '11, '12, '13, that journey, and how customers were reluctant, and they're like, "I don't know, my data losing from here," and this and that-- >> Well, I got to bring this up, so, I was reading an article on SiliconANGLE, EMC World is going on, Dell EMC World this week, and Michael Dell basically made this statement in his keynote, "If you're a cloud first, "you could be in trouble because of the expanse," and so forth. I don't buy it. I think the other, I love you, Michael, but the value that customers are getting out of going cloud-first, maybe, yeah, maybe the bill at the end of the month is high, but the other residual effects on your business, the speed, the agility, the processes, you're seeing it, aren't you? >> I mean, I'll tell you straight up, there are customers that are asking us, because, you know, again, IT's our key buyer, and key customer, and we appeal to the IT department, and the CIOs, even at the CIO dinner the night before, people are embracing cloud. Now, they are on a journey, some of them have maybe mode few percent of their workload, some of them may have mode a little higher, but they're on some journey, and they're trying to balance when the cost pros out with the cons, or the cons out with the pros, but, can you give us some kind of control plane to manage our cloud resources, understand the usage, understand the billing, which we do for financial management, and tie-in with IT processes, because that resource life cycle, that VMU provision, right, that VMU provision in the cloud, what happens to the life cycle of VM, can you create an incident, can you close it out, that's equally important besides just saying, "Yeah, I'm going to move this particular workload to cloud." So I feel that customers are on this journey of some kind of combination of public and private cloud, and it doesn't have to be zero-sum game, infrastructure continues to grow, I don't feel like, okay, if you do this, that means you do not do private, or if you do private, that doesn't mean-- >> Certainly both, and containers are going to just exacerbate the problem. >> Right, and the demand for compute, store, and networking is not going down any time soon. >> I'll tell you, my role environment, so my team lends cloud infrastructure, so our platforms runs on cloud infrastructure, and you saw some of the elevated numbers, I mean, our growth, we are trying to invest in compute network storage ahead of our growth, so it's not, and we are a cloud service, so I always look at it as, this doesn't have to be zero-sum game, customers are expanding, they want the agility, like you said, the agility, the business is asking, "Can you develop this app faster, "can you give me what I need," is what's driving-- >> It's a topline game for businesses, Jeff, I just want to inject some of those numbers on your cloud, 50,000 instances, 150 million active users, and 10 billion transactions per month. >> Yeah. >> Yeah, but I want to get, it's funny you're talking about Jakarta and London, I remember when we were doing interviews around Dublin, which I guess was a while ago, but I'm curious, 'cause there's this other trade-off, and get your perspective, is in a devops world, in kind of a continuous integration and development world, people want to push code frequently. On the other hand, in an enterprise world, and we've talked to a couple of customers, they can only take it so much, and so you've kind of got this yin and yang, and you want to get stuff out, and there's patches, and this and that, and you're on a relatively aggressive for current enterprise release schedule, on the other hand, the trend is clearly, just keep pumping it out, pumping it out, pumping it out, how do you see that kind of sorting itself out over time with these big enterprise customers? >> I will tell you, from a technology standpoint, there is nothing that prevents us from doing more frequent releases, yes, we have to mature our product release processes, we have to mature our cloud operations and how fast we can churn the code. There is nothing that prevents us, technically, from instead of two releases a year, maybe do four releases, it doesn't! But our customers, and we talk about customers first, listening to customers, you saw John today, I mean, we want to listen to them, and they will tell us, that I was at a large financial institution in Boston two weeks ago, and, your hometown, and they told me that, "I cannot do every six months, "I cannot do every six months, CJ, "we usually skip a release," right? And so we are just listening for specific use cases around service management, the processes, customer-run, same thing with operations management, right now, six months about feels right, every six months, release, we do quarterly patches, where we do not release features in those quarterly patches, and for emerging products, like you saw customer service, they challenge security, the team did a great job, when I look at those releases, is it potentially can we push things fast? Maybe, but right now, I'm okay, based on customer feedback. If customers come and say, "I want every three months," I hope to see what does that mean-- >> Let me run something by you, I told Jeff I've been sharing cabs with practitioners all week, it's great to just have wonderful conversations, and one said to me, "I've asked ServiceNow "if they can give me more granularity in the releases," I said, that doesn't sound trivial, in other words, if I can selectively choose features, is that even technically feasible? >> I mean, this is the isolating the feature, micro-feature development, making sure your schema is abstracted enough, I mean, there are companies in consumer world who do that, and push code out really fast. I would say, right now, one of the requirements I do get is, we're on IT service management, we have been a customer of ServiceNow for a while, but on this other thing, say, customer service, or HR, I want to take the new features, so my IT service management is at, say, Helsinki, but I want to take the HR, like the onboarding you saw, the onboarding, which is in Jakarta. So does that mean I need to upgrade this thing to leverage the HR feature? The answer is yes, because it's all built on single platform. Now, I do not want to do where customers, we give them two instances, and then we do a back-end pipe integration, a connector, so you can be on Helsinki for ITSM, and Jakarta, that-- >> Architecturally-- >> That breaks our model, and I do not want to do that. There are companies who, say, reside in different tenant, and will give you one for, I do not want to do that. >> I wanted to ask you about this too, CJ, because, you have a dogma, you have your own cloud, you see a lot of SaaS companies now saying, okay, you see Workday, a little bit of Salesforce, certainly Infor, putting their applications on AWS, for example. You guys, very proud of your cloud, you have availability, and I think when you show availability numbers, you downplay it, actually, people don't understand this, you're talking about application availability, you're not talking about the server light-- >> No. >> Okay, so you're very dogmatic about your cloud, and this issue here, you won't do something that maybe is going to help one customer but is going to ruin the experience down the road for all, and that dogma, is that a valid, it's not a criticism, it's an observation, and is that a good thing? >> So I would say there are some design principles, or operational principles that we live with, and we are going to stick to them, like we talk about acquisitions and re-platforming, think about, Dave, you have somebody coming in, you acquire a machine learning company, really smart kids, really smart people, machine learning or data sciences, an art more than a science, and looking at prediction accuracies and things like that. Now you tell them, "Welcome to ServiceNow, "here's your badge, you just got onboarded, "it's great what you've built, "we are not going to sell that standalone, "you need to re-platform," which typically takes one year, "Before we can launch your product." That's a tough message. That's a tough message for an engineering team to hear, that now I have to figure out how does this platform work, I mean, if I had a magic bullet, I would tell you, if I can wave the magic wand, I'll say, acquire this technology in machine learning AI, combine that with our organic development, it's a re-platform and I have a toolkit that does this thing, and it is a re-platform, but that's not easy. So on these kind of principles, whether it's re-platforming, how we do the releases, how we look at the cloud, and I want to answer your public cloud question. Right now, as you know, we're active, active, I've seen your interviews in the past here, we're active, active, we have eight pair of data centers, 16 around the world, and we make sure with our multi-instance architecture, the availability of the uptimes are very high for our customers, and when they upgrade, we know, they can pull the upgrade, "I'm going, CJ, "from Helsinki to Istanbul, or Helsinki to Jakarta," and that's available, but, can we potentially look at moving our footprint, and renting infrastructure in a public cloud? I'll never say never, but right now, there is no need for it. >> No, you see it, and there are advantages to having your own cloud. I want to ask about your role as Chief Product Officer. Fred Luddy had that title, we were sort of joking earlier, Fred was a coder, the company brought Frank in for adult supervision, and so you're inheriting that title, but I sense that you're a different type of manager, what do you bring to ServiceNow? >> I'll tell you, first of all, Fred, Frank, and even Dan McGee, who had this role last year, he was here, I saw his interview, he's here today, phenomenal people, I mean, I have interacted with all three of them, Dan McGee helped me transition into my role, Frank hired me, and just great, great guy, and even with Fred, going through this user experience, how do I think about the user experience based on the persona, he's always there to provide input with lots and lots energy and feedback. So let me just tell you for, in less than 30 seconds, what my role is, right? My role is, I help platform team, and the cloud infrastructure team, that's lead by Pat Casey, who is doing CreativeCon tomorrow, I have individual application general managers that you saw some of them today, and I also have the customer support organization, and the user experience teams. So that's my overall responsibility, so it's the responsibility that Fred Luddy had til last October, and Dan McGee had til last December, combined into one. So, it's a big job, and it comes with a lot of responsibilities on behalf of our customers, you talk about high availability number, we help to make sure that we keep our cloud service up and running secure, but at the same time, bringing this innovation in platform and the applications is my job. So, I'd done, fortunately, when I started out of college, makes me sound old, I know, but when I came out of college, I worked for a company that was doing business applications for a long time, eight years there, and I worked in that applications technology team, I worked in the CRM applications, did things for financial applications, and I went on security software, understanding how you protect the applications you write, all the way from OS up to the application stack, and then I worked for a infrastructure company, as you know. So that gave me a really good feel on the entire stack, how do you scale that stack, and be maniacally focused on, what do customers want? I mean, I am very fortunate to have great customer relationships, many companies around the globe, I reach out to them, ask them, tell me what you think, tell me what we are doing well, so customer focus, having done product development for 20-plus years now, and understanding all the way from application stack to the underlying infrastructure, is where I can help-- >> Yeah, it's like a triple threat that you have, the product innovation, the enterprise class, security, and scaling, as you mentioned, very, very important. Alright, CJ, I love having you on theCUBE, you're a great guest, we could continue, but we got to leave it right there. Great to see you again-- >> Thank you, thank you so much, I really appreciate it. >> Alright, keep it right there, everybody, we'll be back with our next guest, this is theCUBE, we're live from Knowledge17, we'll be right back.

>>Welcome back to the aria in Las Vegas, Dave Valante with Dave Nicholson, Falcon 22, the Cube's continuous coverage. Sean Henry is here. He's the president of the services division and he's the chief security officer at CrowdStrike. And he's joined by Kevin mania, CEO of Mandy. Now part of Google Jens. Welcome to the cube. Thank you. Congrats on closing the Google deal. Thank you. That's great. New chapter, >>New >>Chapter coming fresh off the keynote, you and George. I really en enjoyed that. Let's start there. One of the things you talked about was the changes you've been, you've been in this business for a while. I think you were talking about, you know, doing some of these early stuff in the nineties. Wow. Things have changed a lot the queen, right? Right. You used to put the perimeter around the queen. Yeah. Build the Mo the Queen's left or castle new ballgame. But you were talking about the board level knowledge of security in the organization. Talk about that change. That's occurred in the last >>Decade. You know, boards are all about governance, right? Making sure everybody's doing the right things. And they've kind of had a haul pass on cybersecurity for a long time. Like we expect them to be great at financial diligence, they understand the financials of an organization. You're gonna see a maturity, I think in cybersecurity where I think board members all know, Hey, there's risk out there. And we're on our own to kind of defend ourselves from it, but they don't know how to quantify it. And they don't know how to express it. So bottom line boards are interested in cyber and we just have to mature as an industry to give them the tools they need to measure it appropriately. >>Sean, one of the things I wanted to ask you. So Steven Schmidt, I noticed changed his title from CISOs chief inf information security officer, the chief security officer. Your title is chief security officer. Is that a nuance that has meaning to you or is it just less acronym? >>It depends on the organization that you're in, in our organization, the chief security officer owns all risks. So I have a CISO that comes underneath me. Yep. And I've got a security folks that are handling our facilities, our personnel, those sorts of things, all, all of our offices around the globe. So it's all things security. One of the things that we've found and Kevin and I were actually talking about this earlier is this intersection between the physical world and the virtual world. And if you've got adversaries that want gain access to your organization, they might do it remotely by trying to hack into your network. But they also might try to get one of your employees to take an action on their behalf, or they might try to get somebody hired into your company to take some nefarious acts. So from a security perspective, it's about building an envelope around all things valuable and then working it in a collaborative way. So there's a lot of interface, a lot of interaction and a lot of value in putting those things together. And, >>And you're also president of the services division. Is that a P and L role or >>It is, we have a it's P P O P and L. And we have an entire organization that's doing incident response and it's a lot of the work that we're doing with, with Kevin's folks now. So I've got both of those hats today. >>Okay. So self-funded so in a way, okay. Where are companies most at risk today? >>Huh? You wanna go on that one first? Sean, you talk fast than me. So it's bigger bang for the buck. If >>You >>Talk, you know, when I, when I think about, about companies in terms of, of their risk, it's a lot of it has to do with the expansion of the network. Companies are adding new applications, new devices, they're expanding into new areas. There are new technologies that are being developed every day and that are being embraced every day. And all of those technologies, all of those applications, all of that hardware is susceptible to attack. Adversaries are looking for the vulnerabilities they can exploit. And I think just kind of that sprawl is something that is, is disconcerting to me from a security perspective, we need to know where our assets are, where the vulnerabilities lie, how do we plug the holes? And having that visibility is really critical to ensure that you're you're in, involved in mitigating that, that new architecture, >>Anything you >>Did. Yeah. I would like when I, so I can just tell you what I'm hearing from CISOs out there. They're worried about identity, the lateral movement. That's been kind of part of every impactful breach. So in identity's kind of top three of mind, I would say zero trust, whatever that means. And we all have our own definitions of migration to zero trust and supply chain risk. You know, whether they're the supplier, they wanna make sure they can prove to their customers, they have great security practices. Or if they're a consumer of a supply chain, you need to understand who's in their supply chain. What are their dependencies? How secure are they? Those are just three topics that come up all the time. >>As we extend, you know, talking about XDR the X being extend. Do you see physical security as something that's being extended into? Or is it, or is it already kind of readily accepted that physical security goes hand in hand with information security? >>I, I don't think a lot of people think that way there certainly are some and Dave mentions Amazon and Steve Schmidt as a CSO, right? There's a CSO that works for him as well. CJ's clear integration. There's an intelligence component to that. And I think that there are certain organizations that are starting to recognize and understand that when we say there's no real perimeter, it, it expands the network expands into the physical space. And if you're not protecting that, you know, if you don't protect the, the server room and somebody can actually walk in the doors unlocked, you've got a vulnerability that might be exploited. So I think to, to recognize the value of that integration from a security perspective, to be holistic and for organizations to adopt a security first philosophy that all the employees recognize they're, they're the, the first line of defense. Oftentimes not just from a fish, but by somebody catching up with them and handing 'em a thumb drive, Hey, can you take a look at this document? For me, that's a potential vulnerability as well. So those things need to be integrated. >>I thought the most interesting part of the keynote this morning is when George asked you about election security and you immediately went to the election infrastructure. I was like, yeah. Okay. Yeah. But then I was so happy to hear you. You went to the disinformation, I learned something there about your monitoring, the network effects. Sure. And, and actually there's a career stream around that. Right. The reason I had so years ago I interviewed was like, this was 2016, Robert Gates. Okay. Former defense. And I, I said, yeah, but don't we have the best cyber can't we go on the offense. He said, wait a minute, we have the most to lose. Right. But, but you gave an example where you can identify the bots. Like let's say there's disinformation out there. You could actually use bots in a positive way to disseminate the, the truth in theory. Good. Is, is that something that's actually happening >>Out there? Well, I think we're all still learning. You know, you can have deep fakes, both audible files or visual files, right. And images. And there's no question. The next generation, you do have to professionalize the news that you consume. And we're probably gonna have to professionalize the other side critical thinking because we are a marketplace of ideas in an open society. And it's hard to tell where's the line between someone's opinion and intentional deception, you know, and sometimes it could be the source, a foreign threat, trying to influence the hearts and minds of citizens, but there's gonna be an internal threat or domestic threat as well to people that have certain ideas and concepts that they're zealots about. >>Is it enough to, is it enough to simply expose where the information is coming from? Because, you know, look, I, I could make the case that the red Sox, right. Or a horrible baseball team, and you should never go to Fenway >>And your Yankees Jersey. >>Right. Right. So is that disinformation, is that misinformation? He'd say yes. Someone else would say no, but it would be good to know that a thousand bots from some troll farm, right. Are behind us. >>There's, it's helpful to know if something can be tied to identity or is totally anonymous. Start just there. Yeah. Yeah. You can still protect the identity over time. I think all of us, if you're gonna trust the source, you actually know the source. Right. So I do believe, and, and by the way, much longer conversation about anonymity versus privacy and then trust, right. And all three, you could spend this whole interview on, but we have to have a trustworthy internet as well. And that's not just in the tech and the security of it, but over time it could very well be how we're being manipulated as citizens and people. >>When you guys talk to customers and, and peers, when somebody gets breached, what's the number one thing that you hear that they wished they'd done that they didn't. >>I think we talked about this earlier, and I think identity is something that we're talking about here. How are you, how are you protecting your assets? How do you know who's authorized to have access? How do you contain the, the access that they have? And the, the area we see with, with these malware free attacks, where adversaries are using the existing capabilities, the operating system to move laterally through the network. I mean, Kevin's folks, my folks, when we respond to an incident, it's about looking at that lateral movement to try and get a full understanding of where the adversary's been, where they're going, what they're doing, and to try to, to find a root cause analysis. And it really is a, a critical part. >>So part of the reason I was asking you about, was it a P and L cuz you, you wear two hats, right? You've got revenue generation on one side and then you've got you protect, you know, the company and you've got peer relationships. So the reason I bring this up is I felt like when stucks net occurred, there was a lot of lip service around, Hey, we, as an industry are gonna work together. And then what you saw was a lot of attempts to monetize, you know, private data, sell private reports and things of that nature you were referencing today, Kevin, that you think the industry's doing a much better job of, of collaboration. Is it, can you talk about that and maybe give some examples? >>Absolutely. I mean, you know, I lived through it as a victim of a breach couple years ago. If you see something new and novel, I, I just can't imagine you getting away with keeping it a secret. I mean, I would even go, what are you doing? Harboring that if you have it, that doesn't mean you tell the whole world, you don't come on your show and say, Hey, we got something new novel, everybody panic, you start contacting the people that are most germane to fixing the problem before you tell the world. So if I see something that's new in novel, certainly con Sean and the team at CrowdStrike saying, Hey, there's because they protect so many endpoints and they defend nations and you gotta get to Microsoft. You have to talk to pan. You have to get to the companies that have a large capability to do shields up. And I think you do that immediately. You can't sit on new and novel. You get to the vendor where the vulnerability is, all these things have to happen at a great rate to speak. >>So you guys probably won't comment, but I'm betting dollars to donuts. This Uber lapses hack you guys knew about. >>I turned to you. >>No comment. I'm guessing. I'm guessing that the, that wasn't novel. My point being, let me, let me ask it in a more generic fashion that you can maybe comment you you're. I think you're my, my inference is we're com the industry is compressing the time between a zero day and a fix. Absolutely. Absolutely. Like dramatically. >>Yes. Oh, awareness of it and AIX. Yes. Yeah. >>Okay. Yeah. And a lot of the hacks that we see as lay people in the media you've known about for quite some time, is that fair or no, not necessarily. >>It's, you know, it's harder to handle an intrusion quietly and discreetly these days, especially with what you're up against and, and most CEOs, by the way, their intent isn't, let's handle it quietly and discreetly it's what do we do about it? And what's the right way to handle it. And they wanna inform their customers and they wanna inform people that might be impacted. I wouldn't say we know it all that far ahead of time >>And, and depends. And, and I, I think companies don't know it. Yeah. Companies don't know they've been breached for weeks or months or years in some cases. Right. Which talks about a couple things, first of all, some of the sophistication of the adversaries, but it also talks about the inability of companies to often detect this type of activity when we're brought in. It's typically very quickly after the company finds out because they recognize they've gotta take action. They've got liability, they've got brand protection. There, whole sorts of, of things they need to take care of. And we're brought in it may or may not be, become public, but >>CrowdStrike was founded on the premise that the unstoppable breach is a myth. Now that's a, that's a bold sort of vision. We're not there yet, obviously. And a and a, and a, a CSO can't, you know, accept that. Right. You've gotta always be vigilant, but is that something that is, that we're gonna actually see manifest, you know, in any, any time in the near term? I mean, thinking about the Falcon platform, you guys are users of that. I don't know if that is part of the answer, but part of it's technology, but without the cultural aspects, the people side of things, you're never gonna get there. >>I can tell you, I started Maning in 2004 at the premise security breaches are inevitable, far less marketable. Yeah. You know, stop breaches. >>So >>Yeah. I, I think you have to learn how to manage this, right? It's like healthcare, you're not gonna stop every disease, but there's a lot of things that you can do to mitigate the consequences of those things. The same thing with network security, there's a lot of actions that organizations can take to help protect them in a way that allows them to live and, and operate in a, in a, a strong position. If companies are lackadaisical that irresponsible, they don't care. Those are companies that are gonna suffer. But I think you can manage this if you're using the right technology, the right people, you've got the right philosophy security first >>In, in the culture. >>Well, I can tell you very quickly, three reasons why people think, why is there an intrusion? It should just go away. Well, wherever money goes, crime follows. We still have crime. So you're still gonna have intrusions, whether it has to be someone on the inside or faulty software and people being paid the right faulty software, you're gonna have war. That's gonna create war in the cyber domain. So information warriors are gonna try to have intrusions to get to command and control. So wherever you have command and control, you'll have a war fighter. And then wherever you have information, you have ESP Espino. So you're gonna have people trying to break in at all times. >>And, and to tie that up because everything Kevin said is absolutely right. And what he just said at the very end was people, there are human beings that are on the other side of every single attack. And think about this until you physically get physically get to the people that are doing it and stop them. Yes, this will go on forever because you can block them, but they're gonna move and you can block them again. They're gonna move their objectives. Don't change because the information you have, whether it's financial information, intellectual property, strategic military information, that's still there. They will always come at it, which is where that physical component comes in. If you're able to block well enough and they can't get you remotely, they might send somebody in. Well, >>I, in the keynote, I, I'm not kidding. I'm looking around the room and I'm thinking there's at least one person here that is here primarily to gather intelligence, to help them defeat. What's being talked about here. >>Well, you said it's, >>It's kind >>Of creepy. You said the adversary is, is very well equipped and motivated. Why do you Rob banks? Well, that's where the money is, but it's more than that. Now with state sponsored terrorism and, you know, exfiltration of state secrets, I mean, there's, it's high stake's games. You got, this >>Has become a tool of nation states in terms from a political perspective, from a military perspective, if you look at what happened with Ukraine and Russia, all the work that was done in advanced by the Russians to soften up the Ukrainians, not just collection of intelligence, not just denial of services, but then disruptive attacks to change the entire complexity of the battlefield. This, this is a, an area that's never going away. It's becoming ingrained in our lives. And it's gonna be utilized for nefarious acts for many, many decades to come. >>I mean, you're right, Sean, we're seeing the future of war right before us is, is there's. There is going to be, there is a cyber component now in war, >>I think it signals the cyber component signals the silent intention of nations period, the silent projection of power probably before you see kinetics. >>And this is where gates says we have a lot more to lose as a country. So it's hard for us to go on the offense. We have to be very careful about our offensive capabilities because >>Of one of the things that, that we do need to, to do though, is we need to define what the red lines are to adversaries. Because when you talk about human beings, you've gotta put a deterrent in place so that if the adversaries know that if you cross this line, this is what the response is going to be. It's the way things were done during nuclear proliferation, right? Right. During the cold war, here's what the actions are gonna be. It's gonna be, it's gonna be mutual destruction and you can't do it. And we didn't have a nuclear war. We're at a point now where adversaries are pushing the envelope constantly, where they're turning off the lights in certain countries where they're taking actions that are, are quite detrimental to the host governments and those red lines have to be very clear, very clearly defined and acted upon if they're >>Crossed as security experts. Can you always tie that signature back to say a particular country or a particular group? >>Absolutely. 100% every >>Time I know. Yeah. No, it it's. It's a great question. You, you need to get attribution right. To get to deterrence, right. And without attribution, where do you proportionate respond to whatever act you're responding to? So attribution's critical. Both our companies work hard at doing it and it, and that's why I think you're not gonna see too many false flag operations in cyberspace, but when you do and they're well crafted or one nation masquerades is another, it, it, it's one of the last rules of the playground I haven't seen broken yet. And that that'll be an unfortunate day. >>Yeah. Because that mutually assure destruction, a death spot like Putin can say, well, it wasn't wasn't me. Right. So, and ironically, >>It's human intelligence, right. That ultimately is gonna be the only way to uncover >>That human intelligence is a big component. >>For sure. Right. And, and David, like when you go back to, you were referring to Robert Gates, it's the asymmetry of cyberspace, right? One person in one nation. That's not a control by asset could still do an act. And it, it just adds to the complexity of, we have attribution it's from that nation, but was it in order? Was it done on behalf of that nation? Very complicated. >>So this is an industry of superheroes. Thank you guys for all you do and appreciate you coming on the cube. Wow. >>I love your Cape. >>Thank all right. Keep it right there. Dave Nicholson and Dave ante be right back from Falcon 22 from the area you watching the cue.

>>Hello, everyone. Welcome to the AWS startup showcase. This is season two, episode four, the ongoing series covering exciting startups from the AWS ecosystem to talk about cybersecurity. I'm your host, John furrier. And today I'm excited for this keynote presentation and I'm joined by John Ramsey, vice president of AWS security, John, welcome to the cubes coverage of the startup community within AWS. And thanks for this keynote presentation, >>Happy to be here. >>So, John, what do you guys, what do you do at AWS? Take, take minutes to explain your role, cuz it's very comprehensive. We saw at AWS reinforce event recently in Boston, a broad coverage of topics from Steven Schmid CJ, a variety of the executives. What's your role in particular at AWS? >>If you look at AWS, there are, there is a shared security responsibility model and CJ, the C the CSO for AWS is responsible for securing the AWS portion of the shared security responsibility model. Our customers are responsible for securing their part of the shared security responsible, responsible model. For me, I provide services to those customers to help them secure their part of that model. And those services come in different different categories. The first category is threat detection with guard. We that does real time detection and alerting and detective is then used to investigate those alerts to determine if there is an incident vulnerability management, which is inspector, which looks for third party vulnerabilities and security hub, which looks for configuration vulnerabilities and then Macy, which does sensitive data discovery. So I have those sets of services underneath me to help provide, to help customers secure their part of their shared security responsibility model. >>Okay, well, thanks for the call out there. I want to get that out there because I think it's important to note that, you know, everyone talks inside out, outside in customer focus. 80 of us has always been customer focused. We've been covering you guys for a long time, but you do have to secure the core cloud that you provide and you got great infrastructure tools technology down to the, down to the chip level. So that's cool. You're on the customer side. And right now we're seeing from these startups that are serving them. We had interviewed here at the showcase. There's a huge security transformation going on within the security market. It's the plane at 35,000 feet. That's engines being pulled out and rechange, as they say, this is huge. And, and what, what's it take for your, at customers with the enterprises out there that are trying to be more cyber resilient from threats, but also at the same time, protect what they also got. They can't just do a wholesale change overnight. They gotta be, you know, reactive, but proactive. How does it, what, what do they need to do to be resilient? That's the >>Question? Yeah. So, so I, I think it's important to focus on spending your resources. Everyone has constrained security resources and you have to focus those resources in the areas and the ways that reduce the greatest amount of risk. So risk really can be summed up is assets that I have that are most valuable that have a vulnerability that a threat is going to attack in that world. Then you wanna mitigate the threat or mitigate the vulnerability to protect the asset. If you have an asset that's vulnerable, but a threat isn't going to attack, that's less risky, but that changes over time. The threat and vulnerability windows are continuously evolving as threats, developing trade craft as vulnerabilities are being discovered as new software is being released. So it's a continuous picture and it's an adaptive picture where you have to continuously monitor what's happening. You, if you like use the N framework cybersecurity framework, you identify what you have to protect. >>That's the asset parts. Then you have to protect it. That's putting controls in place so that you don't have an incident. Then you from a threat perspective, then you ha to de detect an incident or, or a breach or a, a compromise. And then you respond and then you remediate and you have to continuously do that cycle to be in a position to, to de to have cyber resiliency. And one of the powers of the cloud is if you're building your applications in a cloud native form, you, your ability to respond can be very surgical, which is very important because then you don't introduce risk when you're responding. And by design, the cloud was, is, is architected to be more resilient. So being able to stay cyber resilient in a cloud native architecture is, is important characteristic. >>Yeah. And I think that's, I mean, it sounds so easy. Just identify what's to be protected. You monitor it. You're protected. You remediate sounds easy, but there's a lot of change going on and you got the cloud scale. And so you got security, you got cloud, you guys's a lot of things going on there. How do you think about security and how does the cloud help customers? Because again, there's two things going on. There's a shared responsibility model. And at the end of the day, the customer's responsible on their side. That's right, right. So that's right. Cloud has some tools. How, how do you think about going about security and, and where cloud helps specifically? >>Yeah, so really it's about there, there's a model called observe, orient, decide an actor, the ULO and it was created by John Boyd. He was a fighter pilot in the Korean war. And he knew that if I could observe what the opponent is doing, orient myself to my goals and their goals, make a decision on what the next best action is, and then act, and then follow that UTI loop, or, or also said a sense sense, making, deciding, and acting. If I can do that faster than the, than the enemy, then I can, I will win every fight. So in the cyber world, being in a position where you are observing and that's where cloud can really help you, because you can interrogate the infrastructure, you can look at what's happening, you can build baselines from it. And then you can look at deviations from, from the norm. It's just one way to observe this orient yourself around. Does this represent something that increases risk? If it does, then what's the next best action that I need to take, make that decision and then act. And that's also where the cloud is really powerful, cuz there's this huge con control plane that lets you lets you enable or disable resources or reconfigure resources. And if you're in, in the, in the situation where you can continuously do that very, very rapidly, you can, you can outpace and out maneuver the adversary. >>Yeah. You know, I remember I interviewed Steven Schmidt in 2014 and at that time everybody was poo pooing. Oh man, the cloud is so unsecure. He made a statement to me and we wrote about this. The cloud is more secure and will be more secure because it can be complicated to the hacker, but also easy for the, for provisioning. So he kind of brought up this, this discussion around how cloud would be more secure turns out he's right. He was right now. People are saying, oh, the cloud's more secure than, than standalone. What's different John now than not even going back to 2014, just go back a few years. Cloud is helpful, is more interrogation. You mentioned, this is important. What's, what's changed in the cloud per se in AWS that enables customers and say third parties who are trying to comply and manage risk as well. So you have this shared back and forth. What's different in the cloud now than just a few years ago that that's helping security. >>Yeah. So if you look at the, the parts of the shared responsibility model, AWS is the further up the stack you go from just infrastructure to platforms, say containers up to serverless the, the, we are taking more of the responsibility of that, of that stack. And in the process, we are investing resources and capabilities. For example, guard duty takes an S audit feed for containers to be able to monitor what's happening from a container perspective. And then in server list, really the majority of what, what needs to be defended is, is part of our responsibility model. So that that's an important shift because in that world, we have a very large team in our world. We have a very large team who knows the infrastructure who knows the threat and who knows how to protect customers all the way up to the, to the, to the boundary. And so that, that's a really important consideration. When you think about how you design your design, your applications is you want the developers to focus on the business logic, the business value and let, but still, also the security of the code that they're writing, but let us take over the rest of it so that you don't have to worry about it. >>Great, good, good insight there. I want to get your thoughts too. On another trend here at the showcase, one of the things that's emerging besides the normal threat landscape and the compliance and whatnot is API protection. I mean APIs, that's what made the cloud great. Right? So, you know, and it's not going away, it's only gonna get better cuz we live in an interconnected digital world. So, you know, APIs are gonna be lingual Franko what they say here. Companies just can't sit back and expect third parties complying with cyber regulations and best practices. So how do security and organizations be proactive? Not just on API, it's just a, a signal in my mind of, of, of more connections. So you got shared responsibility, AWS, your customers and your customers, partners and customers of connection points. So we live in an interconnected world. How do security teams and organizations be proactive on the cyber risk management piece? >>Yeah. So when it comes to APIs, the, the thing you look for is the trust boundaries. Where are the trust boundaries in the system between the user and the, in the machine, the machine and another machine on the network, the API is a trust boundary. And it, it is a place where you need to facilitate some kind of some form of control because what you're, what could happen on the trust boundaries, it could be used to, to attack. Like I trust that someone's gonna give me something that is legitimate, but you don't know that that a actually is true. You should assume that the, the one side of the trust boundary is, is malicious and you have to validate it. And by default, make sure that you know, that what you're getting is actually trustworthy and, and valid. So think of an API is just a trust boundary and that whatever you're gonna receive at that boundary is not gonna be legitimate in that you need to validate, validate the contents of, of whatever you receive. >>You know, I was noticing online, I saw my land who runs S3 a us commenting about 10 years anniversary, 10, 10 year birthday of S3, Amazon simple storage service. A lot of the customers are using all their applications with S3 means it's file repository for their application, workflow ingesting literally thousands and trillions of objects from S3 today. You guys have about, I mean, trillions of objects on S3, this is big part of the application workflow. Data security has come up as a big discussion item. You got S3. I mean, forget about the misconfiguration about S3 buckets. That's kind of been reported on beyond that as application workflows, tap into S3 and data becomes the conversation around securing data. How do you talk to customers about that? Because that's also now part of the scaling of these modern cloud native applications, managing data on Preem cross in flight at rest in motion. What's your view on data security, John? >>Yeah. Data security is also a trust boundary. The thing that's going to access the data there, you have to validate it. The challenge with data security is, is customers don't really know where all their data is or even where their sensitive data is. And that continues to be a large problem. That's why we have services like Macy, which are whose job is to find in S3 the data that you need to protect the most because it's because it's sensitive. Getting the least privilege has always been the, the goal when it comes, when it comes to data security. The problem is, is least privilege is really, really hard to, to achieve because there's so many different common nations of roles and accounts and org orgs. And, and so there, there's also another technology called access analyzer that we have that helps customers figure out like this is this the right, if are my intended authorizations, the authorizations I have, are they the ones that are intended for that user? And you have to continuously review that as a, as a means to make sure that you're getting as close to least privilege as you possibly can. >>Well, one of the, the luxuries of having you here on the cube keynote for this showcase is that you also have the internal view at AWS, but also you have the external view with customers. So I have to ask you, as you talk to customers, obviously there's a lot of trends. We're seeing more managed services in areas where there's skill gaps, but teams are also overloaded too. We're hearing stories about security teams, overwhelmed by the solutions that they have to deploy quickly and scale up quickly cost effectively the need for in instrumentation. Sometimes it's intrusive. Sometimes it agentless sensors, OT. I mean, it's getting crazy at re Mars. We saw a bunch of stuff there. This is a reality, the teams aspect of it. Can you share your experiences and observations on how companies are organizing, how they're thinking about team formation, how they're thinking about all these new things coming at them, new environments, new scale choices. What, what do you seeing on, on the customer side relative to security team? Yeah. And their role and relationship to the cloud and, and the technologies. >>Yeah, yeah. A absolutely it. And we have to remember at the end of the day on one end of the wire is a black hat on the other end of the wire is a white hat. And so you need people and, and people are a critical component of being able to defend in the context of security operations alert. Fatigue is absolutely a problem. The, the alerts, the number of alerts, the volume of alerts is, is overwhelming. And so you have to have a means to effectively triage them and get the ones into investigation that, that you think will be the most, the, the most significant going back to the risk equation, you found, you find those alerts and events that are, are the ones that, that could harm you. The most. You'll also one common theme is threat hunting. And the concept behind threat hunting is, is I don't actually wait for an alert I lean in and I'm proactive instead of reactive. >>So I find the system that I at least want the hacker in. I go to that system and I look for any anomalies. I look for anything that might make me think that there is a, that there is a hacker there or a compromise or some unattended consequence. And the reason you do that is because it reduces your dwell time, time between you get compromised to the time detect something, which is you, which might be, you know, months, because there wasn't an alert trigger. So that that's also a very important aspect for, for AWS and our security services. We have a strategy across all of the security services that we call end to end, or how do we move from APIs? Because they're all API driven and security buyers generally not most do not ha have like a development team, like their security operators and they want a solution. And so we're moving more from APIs to outcomes. So how do we stitch all the services together in a way so that the time, the time that an analyst, the SOC analyst spends or someone doing investigation or someone doing incident response is the, is the most important time, most valuable time. And in the process of stitching this all together and helping our customers with alert, fatigue, we'll be doing things that will use sort of inference and machine learning to help prioritize the greatest risk for our customers. >>That's a great, that's a great call out. And that brings up the point of you get the frontline, so to speak and back office, front office kind of approach here. The threats are out there. There's a lot of leaning in, which is a great point. I think that's a good, good comment and insight there. The question I have for you is that everyone's kind of always talks about that, but there's the, the, I won't say boring, the important compliance aspect of things, you know, this has become huge, right? So there's a lot of blocking and tackling that's needed behind the scenes on the compliance side, as well as prevention, right? So can you take us through in your mind how customers are looking at the best strategies for compliance and security, because there's a lot of work you gotta get done and you gotta lay out everything as you mentioned, but compliance specifically to report is also a big thing for >>This. Yeah. Yeah. Compliance is interesting. I suggest taking a security approach to compliance instead of a compliance approach to security. If you're compliant, you may not be secure, but if you're secure, you'll be compliant. And the, the really interesting thing about compliance also is that as soon as something like a, a, a category of control is required in, in some form of compliance, compliance regime, the effectiveness of that control is reduced because the threats go well, I'm gonna presume that they have this control. I'm gonna presume cuz they're compliant. And so now I'm gonna change my tactic to evade the control. So if you only are ever following compliance, you're gonna miss a whole set of tactics that threats have developed because they presume you're compliant and you have those controls in place. So you wanna make sure you have something that's outside of the outside of the realm of compliance, because that's the thing that will trip them up. That's the thing that they're not expecting that threats not expecting and that that's what we'll be able to detect them. >>Yeah. And it almost becomes one of those things where it's his fault, right? So, you know, finger pointing with compliance, you get complacent. I can see that. Can you give an example? Cause I think that's probably something that people are really gonna want to know more about because it's common sense. But can you give an example of security driving compliance? Is there >>Yeah, sure. So there's there they're used just as an example, like multifactor authentication was used everywhere that for, for banks in high risk transactions, in real high risk transactions. And then that like that was a security approach to compliance. Like we said, that's a, that's a high net worth individual. We're gonna give them a token and that's how they're gonna authenticate. And there was no, no, the F F I C didn't say at the time that there needed to be multifactor authentication. And then after a period of time, when account takeover was, was on the rise, the F F I C the federally financial Institute examiner's council, something like that said, we, you need to do multifactor authentication. Multifactor authentication was now on every account. And then the threat went down to, okay, well, we're gonna do man in the browser attacks after the user authenticates, which now is a new tactic in that tactic for those high net worth individuals that had multifactor didn't exist before became commonplace. Yeah. And so that, that, that's a, that's an example of sort of the full life cycle and the important lesson there is that security controls. They have a diminishing halflife of effectiveness. They, they need to be continuous and adaptive or else the value of them is gonna decrease over time. >>Yeah. And I think that's a great call up because agility and speed is a big factor when he's merging threats. It's not a stable, mature hacker market. They're evolving too. All right. Great stuff. I know your time's very valuable, John. I really appreciate you coming on the queue. A couple more questions for you. We have 10 amazing startups here in the, a AWS ecosystem, all private looking grade performance wise, they're all got the kind of the same vibe of they're kind of on something new. They're doing something new and clever and different than what was, what was kind of done 10 years ago. And this is where the cloud advantage is coming in cloud scale. You mentioned that some of those things, data, so you start to see new things emerge. How, how would you talk to CSOs or CXOs that are watching about how to evaluate startups like these they're, they're, they're somewhat, still small relative to some of the bigger players, but they've got unique solutions and they're doing things a little bit differently. How should some, how should CSOs and Steve evaluate them? How can startups work with the CSOs? What's your advice to both the buyer and the startup to, to bring their product to the market. And what's the best way to do that? >>Yeah. So the first thing is when you talk to a CSO, be respected, be respectful of their time like that. Like, they'll appreciate that. I remember when I was very, when I just just started, I went to talk to one of the CISOs as one of the five major banks and he sat me down and he said, and I tried to tell him what I had. And he was like son. And he went through his book and he had, he had 10 of every, one thing that I had. And I realized that, and I, I was grateful for him giving me an explanation. And I said to him, I said, look, I'm sorry. I wasted your time. I will not do that again. I apologize. I, if I can't bring any value, I won't come back. But if I think I can bring you something of value now that I know what I know, please, will you take the meeting? >>He was like, of course. And so be respectful of their time. They know what the problem is. They know what the threat is. You be, be specific about how you're different right now. There is so much confusion in the market about what you do. Like if you're really have something that's differentiated, be very, very specific about it. And don't be afraid of it, like lean into it and explain the value to that. And that, that, that would, would save a, a lot of time and a lot and make the meeting more valuable for the CSO >>And the CISOs. Are they evaluate these startups? How should they look at them? What are some kind of markers that you would say would be good, kind of things to look for size of the team reviews technology, or is it doesn't matter? It's more of a everyone's environment's different. What >>Would your, yeah. And, you know, for me, I, I always look first to the security value. Cause if there isn't security value, nothing else matters. So there's gotta be some security value. Then I tend to look at the management team, quite frankly, what are, what are the, what are their experiences and what, what do they know that that has led them to do something different that is driving security value. And then after that, for me, I tend to look to, is this someone that I can have a long term relationship with? Is this someone that I can, you know, if I have a problem and I call them, are they gonna, you know, do this? Or are they gonna say, yes, we're in, we're in this together, we'll figure it out. And then finally, if, if for AWS, you know, scale is important. So we like to look at, at scale in terms of, is this a solution that I can, that I can, that I can get to, to the scale that I needed at >>Awesome. Awesome. John Ramsey, vice president of security here on the cubes. Keynote. John, thank you for your time. I really appreciate, I know how busy you are with that for the next minute, or so share a little bit of what you're up to. What's on your plate. What are you thinking about as you go out to the marketplace, talk to customers what's on your agenda. What's your talk track, put a plug in for what you're up to. >>Yeah. So for, for the services I have, we, we are, we are absolutely moving. As I mentioned earlier, from APIs to outcomes, we're moving up the stack to be able to defend both containers, as well as, as serverless we're, we're moving out in terms of we wanna get visibility and signal, not just from what we see in AWS, but from other places to inform how do we defend AWS? And then also across, across the N cybersecurity framework in terms of we're doing a lot of, we, we have amazing detection capability and we have this infrastructure that we could respond, do like micro responses to be able to, to interdict the threat. And so me moving across the N cybersecurity framework from detection to respond. >>All right, thanks for your insight and your time sharing in this keynote. We've got great 10 great, amazing startups. Congratulations for all your success at AWS. You guys doing a great job, shared responsibility that the threats are out there. The landscape is changing. The scale's increasing more data tsunamis coming every day, more integration, more interconnected, it's getting more complex. So you guys are doing a lot of great work there. Thanks for your time. Really appreciate >>It. Thank you, John. >>Okay. This is the AWS startup showcase. Season two, episode four of the ongoing series covering the exciting startups coming out of the, a AWS ecosystem. This episode's about cyber security and I'm your host, John furrier. Thanks for watching.

>>Okay, we're back. My name is Dave Valante and this is the Cube's coverage of AWS storage day. You know, coming off of reinforc I wrote the, the cloud was a new layer of defense. In fact, the first line of defense in a cyber security strategy. And that brings new thinking and models for protecting data, data protection, specifically, traditionally thought of as backup and recovery, it's become a critical adjacency to security and a component of a comprehensive cybersecurity strategy. We're here in our studios outside of Boston with two cube alums, and we're gonna discuss this in other topics. Wayne do so is the vice president for AWS storage edge and data services, and Nancy Wong as general manager of AWS backup and data protection services, guys. Welcome. Great to see you again. Thanks for coming on. Of >>Course, always a pleasure, Dave. Good to >>See you, Dave. All right. So Wayne, let's talk about how organizations should be thinking about this term data protection. It's an expanding definition, isn't >>It? It is an expanding definition. They, last year we talked about data and the importance of data to companies. Every company is becoming a data company, you know, da the amount of data they generate, the amount of data they can use to create models, to do predictive analytics. And frankly, to find ways of innovating is, is grown rapidly. And, you know, there's this tension between access to all that data, right? Getting the value out of that data. And how do you secure that data? And so this is something we think about with customers all the time. So data durability, data protection, data resiliency, and, you know, trust in their data. If you think about running your organization on your data, trust in your data is so important. So, you know, you gotta trust where you're putting your data. You know, people who are putting their data on a platform need to trust that platform will in fact, ensure it's durability, security, resiliency. >>And, you know, we see ourselves AWS as a partner in securing their data, making their data dur durable, making their data resilient, right? So some of that responsibility is on us. Some of that is on so shared responsibility around data protection, data resiliency. And, you know, we think about forever, you know, the notion of, you know, compromise of your infrastructure, but more and more people think about the compromise of their data as data becomes more valuable. And in fact, data is a company's most valuable asset. We've talked about this before. Only second to their people. You know, the people that are most valuable asset, but right next to that is their data. So really important stuff. >>So Nancy, you talked to a lot of customers, but by the way, it always comes back to the data. We've saying this for years, haven't we? So you've got this expanding definition of data protection, you know, governance is in there. You, you think about access cetera. When you talk to customers, what are you hearing from them? How are they thinking about data protection? >>Yeah. So a lot of the customers that Wayne and I have spoken to often come to us seeking thought leadership about, you know, how do I solve this data challenge? How do I solve this data sprawl challenge, but also more importantly, tying it back to data protection and data resiliency is how do I make sure that data is secure, that it's protected against, let's say ransomware events, right. And continuously protected. So there's a lot of mental frameworks that come to mind and a very popular one that comes up in quite a few conversations is this cybersecurity framework, right? And from a data protection perspective is just as important to protect and recover your data as it is to be able to detect different events or be able to respond to those events. Right? So recently I was just having a conversation with a regulatory body of financial institutions in Europe, where we're designing a architecture that could help them make their data immutable, but also continuously protected. So taking a step back, that's really where I see AWS's role in that we provide a wide breadth of primitives to help customers build secure platforms and scaffolding so that they can focus on building the data protection, the data governance controls, and guardrails on top of that platform. >>And, and that's always been AWS's philosophy, you know, make sure that developers have access to those primitives and APIs so that they can move fast and, and essentially build their own if that that's in fact what they wanna do. And as you're saying, when data protection is now this adjacency to cyber security, but there's disaster recoveries in there, business continuance, cyber resilience, et cetera. So, so maybe you could pick up on that and sort of extend how you see AWS, helping customers build out those resilient services. >>Yeah. So, you know, two core pillars to a data protection strategy is around their data durability, which is really an infrastructure element. You know, it's, it's, it's, it's by and large the responsibility of the provider of that infrastructure to make sure that data's durable, cuz if it's not durable, everything else doesn't matter. And then the second pillar is really about data resiliency. So in terms of security, controls and governance, like these are really important, but these are shared responsibility. Like the customers working with us with the services that we provide are there to architect the design, it's really human factors and design factors that get them resiliency, >>Nancy, anything you would add to what Wayne just said. >>Yeah, absolutely. So customers tell us that they want always on data resiliency and data durability, right? So oftentimes in those conversations, three common themes come up, which is they want a centralized solution. They want to be able to transcribe their intent into what they end up doing with their data. And number three, they want something that's policy driven because once you centralize your policies, it's much better and easier to establish control and governance at an organizational level. So keeping that in mind with policy as our interface, there's two managed AWS solutions that I recommend you all check out in terms of data resiliency and data durability. Those are AWS backup, which is our centralized solution for managing protection recovery, and also provides an audit audit capability of how you protect your data across 15 different AWS services, as well as on-premises VMware and for customers whose mission critical data is contained entirely on disk. We also offer AWS elastic disaster recovery services, especially for customers who want to fail over their workloads from on premises to the cloud. >>So you can essentially centralize as a quick follow up, centralize the policy. And like I said, the intent, but you can support a federated data model cuz you're building out this massive, you know, global system, but you can take that policy and essentially bring it anywhere on the AWS cloud. Is that >>Right? Exactly. And actually one powerful integration I want to touch upon is that AWS backup is natively integrated with AWS organizations, which is our defacto multi account federated organization model for how AWS services work with customers, both in the cloud, on the edge, at the edge and on premises. >>So that's really important because as, as we talk about all the time on the cube, this notion of a, a decentralized data architecture data mesh, but the problem is how do you ensure governance and a federated model? So we're clearly moving in that direction. Wayne, I want to ask you about cyber as a board level discussion years ago, I interviewed Dr. Robert Gates, you know, former defense secretary and he sat on a number of boards and I asked him, you know, how important and prominent is security at the board level? Is it really a board level discussion? He said, absolutely. Every time we meet, we talk about cyber security, but not every company at the time, this was kind of early last decade was doing that. That's changed now. Ransomware is front and center. Hear about it all the time. What's AWS. What's your thinking on cyber as a board level discussion and specifically what are you guys doing around ran ransomware? >>Yeah. So, you know, malware in general, ransomware being a particular type of malware. Sure. It's a hot topic and it continues to be a hot topic. And whether at the board level, the C-suite level, I had a chance to listen to Dr. Gates a couple months ago and super motivational, but we think about ransomware and the same way that our customers do. Right? Cause all of us are subject to an incident. Nobody is immune to a ransomware incident. So we think very much the same way. And you, as Nancy said, along the lines of the, this framework, we really think about, you know, how do customers identify their critical access? How do they plan for protecting those assets, right? How do they make sure that they are in fact protected? And if they do detect the ransomware event and ransomware events come from a lot of different places, like there's not one signature, there's not one thumbprint, if you would for ransomware. >>So it's, it's, there's really a lot of vigilance that needs to be put in place, but a lot of planning that needs to be put in place. And once that's detected and a, a, we have to recover, you know, we know that we have to take an action and recover having that plan in place, making sure that your assets are fully protected and can be restored. As you know, ransomware is a insidious type of malware. You know, it sits in your system for a long time. It figures out what's going on, including your backup policies, your protection policies, and figures out how to get around those with some of the things that Nancy talked about in terms of air gaping, your capabilities, being able to, if you would scan your secondary, your backup storage for malware, knowing that it's a good copy. And then being able to restore from that known good copy in the event of an incident is critical. So we think about this for ourselves and the same way that we think about these for our customers. You gotta have a great plan. You gotta have great protection and you gotta be ready to restore in the case of an incident. And we wanna make sure we provide all the capabilities to do >>That. Yeah. So I'll glad you mentioned air gaping. So at the recent re reinforce, I think it was Kurt kufeld was speaking about ransomware and he didn't specifically mention air gaping. I had to leave. So I might have, I might have missed it cause I was doing the cube, but that's a, that's a key aspect. I'm sure there were, were things on the, on the deep dives that addressed air gaping, but Nancy look, AWS has the skills. It has the resources, you know, necessary to apply all these best practices and, you know, share those with customers. But, but what specific investments is AWS making to make the CISO's life easier? Maybe you could talk about that. >>Sure. So following on to your point about the reinforced keynote, Dave, right? CJ Boes talked about how the events of a ransomware, for example, incident or event can take place right on stage where you go from detect to respond and to recover. And specifically on the recovery piece, you mentioned AWS backup, the managed service that protects across 15 different AWS services, as well as on-premises VMware as automated recovery. And that's in part why we've decided to continue that investment and deliver AWS backup audit manager, which helps customers actually prove their posture against how their protection policies are actually mapping back to their organizational controls based on, for example, how they TA tag their data for mission criticality or how sensitive that data is. Right. And so turning to best practices, especially for ransomware events. Since this is very top of mind for a lot of customers these days is I will, will always try to encourage customers to go through game day simulations, for example, identifying which are those most critical applications in their environment that they need up and running for their business to function properly, for example, and actually going through the recovery plan and making sure that their staff is well trained or that they're able to go through, for example, a security orchestration automation, recovery solution, to make sure that all of their mission critical applications are back up and running in case of a ransomware event. >>Yeah. So I love the game day thing. I mean, we know, well just the, in the history of it, you couldn't even test things like disaster recovery, right? Because it was too dangerous with the cloud. You can test these things safely and actually plan out, develop a blueprint, test your blueprint. I love the, the, the game day >>Analogy. Yeah. And actually one thing I'd love to add is, you know, we talked about air gaping. I just wanna kind of tie up that statement is, you know, one thing that's really interesting about the way that the AWS cloud is architected is the identity access and management platform actually allows us to create identity constructs, that air gap, your data perimeter. So that way, when attackers, for example, are able to gain a foothold in your environment, you're still able to air gap your most mission critical and also crown jewels from being infiltrated. >>Mm that's key. Yeah. We've learned, you know, when paying the ransom is not a good strategy, right? Cuz most of the time, many times you don't even get your data back. Okay. So we, we're kind of data geeks here. We love data and we're passionate about it on the cube AWS and you guys specifically are passionate about it. So what excites you, Wayne, you start and then Nancy, you bring us home. What excites you about data and data protection and why? >>You know, we are data nerds. So at the end of the day, you know, there's this expressions we use all the time, but data is such a rich asset for all of us. And some of the greatest innovations that come out of AWS comes out of our analysis of our own data. Like we collect a lot of data on our operations and some of our most critical features for our customers come out of our analysis, that data. So we are data nerds and we understand how businesses view their data cuz we view our data the same way. So, you know, Dave security really started in the data center. It started with the enterprises. And if we think about security, often we talk about securing compute and securing network. And you know, if you, if you secured your compute, you secured your data generally, but we've separated data from compute so that people can get the value from their data no matter how they want to use it. And in doing that, we have to make sure that their data is durable and it's resilient to any sort of incident and event. So this is really, really important to us. And what do I get excited about? You know, again, thinking back to this framework, I know that we as thought leaders alongside our customers who also thought leaders in their space can provide them with the capabilities. They need to protect their data, to secure their data, to make sure it's compliant and always, always, always durable. >>You know, it's funny, you'd say funny it's it's serious actually. Steven Schmidt at reinforc he's the, the, the chief security officer at Amazon used to be the C C ISO of AWS. He said that Amazon sees quadrillions of data points a month. That's 15 zeros. Okay. So that's a lot of data. Nancy bring us home. What's what excites you about data and data protection? >>Yeah, so specifically, and this is actually drawing from conversations that I had with multiple ISV partners at AWS reinforc is the ability to derive value from secondary data, right? Because traditionally organizations have really seen that as a call center, right? You're producing secondary data because most likely you're creating backups of your mission critical workloads. But what if you're able to run analytics and insights and derive insights from that, that secondary data, right? Then you're actually able to let AWS do the undifferentiated heavy lifting of analyzing that secondary data state. So that way us customers or ISV partners can build value on the security layers above. And that is how we see turning cost into value. >>I love it. As you're taking the original premise of the cloud, taking away the under heavy lifting for, you know, D deploying, compute, storage, and networking now bringing up to the data level, the analytics level. So it continues. The cloud continues to expand. Thank you for watching the cubes coverage of AWS storage day 2022.

>> Announcer: From theCUBE studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE and ETR. This is "Breaking Analysis" with Dave Vellante. >> The rapid pace of cloud adoption has changed the way organizations approach cybersecurity. Specifically, the cloud is increasingly becoming the first line of cyber defense. As such, along with communicating to the board and creating a security aware culture, the chief information security officer must ensure that the shared responsibility model is being applied properly. Meanwhile, the DevSecOps team has emerged as the critical link between strategy and execution, while audit becomes the free safety, if you will, in the equation, i.e., the last line of defense. Hello, and welcome to this week's, we keep on CUBE Insights, powered by ETR. In this "Breaking Analysis", we'll share the latest data on hyperscale, IaaS, and PaaS market performance, along with some fresh ETR survey data. And we'll share some highlights and the puts and takes from the recent AWS re:Inforce event in Boston. But first, the macro. It's earning season, and that's what many people want to talk about, including us. As we reported last week, the macro spending picture is very mixed and weird. Think back to a week ago when SNAP reported. A player like SNAP misses and the Nasdaq drops 300 points. Meanwhile, Intel, the great semiconductor hope for America misses by a mile, cuts its revenue outlook by 15% for the year, and the Nasdaq was up nearly 250 points just ahead of the close, go figure. Earnings reports from Meta, Google, Microsoft, ServiceNow, and some others underscored cautious outlooks, especially those exposed to the advertising revenue sector. But at the same time, Apple, Microsoft, and Google, were, let's say less bad than expected. And that brought a sigh of relief. And then there's Amazon, which beat on revenue, it beat on cloud revenue, and it gave positive guidance. The Nasdaq has seen this month best month since the isolation economy, which "Breaking Analysis" contributor, Chip Symington, attributes to what he calls an oversold rally. But there are many unknowns that remain. How bad will inflation be? Will the fed really stop tightening after September? The Senate just approved a big spending bill along with corporate tax hikes, which generally don't favor the economy. And on Monday, August 1st, the market will likely realize that we are in the summer quarter, and there's some work to be done. Which is why it's not surprising that investors sold the Nasdaq at the close today on Friday. Are people ready to call the bottom? Hmm, some maybe, but there's still lots of uncertainty. However, the cloud continues its march, despite some very slight deceleration in growth rates from the two leaders. Here's an update of our big four IaaS quarterly revenue data. The big four hyperscalers will account for $165 billion in revenue this year, slightly lower than what we had last quarter. We expect AWS to surpass 83 billion this year in revenue. Azure will be more than 2/3rds the size of AWS, a milestone from Microsoft. Both AWS and Azure came in slightly below our expectations, but still very solid growth at 33% and 46% respectively. GCP, Google Cloud Platform is the big concern. By our estimates GCP's growth rate decelerated from 47% in Q1, and was 38% this past quarter. The company is struggling to keep up with the two giants. Remember, both GCP and Azure, they play a shell game and hide the ball on their IaaS numbers, so we have to use a survey data and other means of estimating. But this is how we see the market shaping up in 2022. Now, before we leave the overall cloud discussion, here's some ETR data that shows the net score or spending momentum granularity for each of the hyperscalers. These bars show the breakdown for each company, with net score on the right and in parenthesis, net score from last quarter. lime green is new adoptions, forest green is spending up 6% or more, the gray is flat, pink is spending at 6% down or worse, and the bright red is replacement or churn. Subtract the reds from the greens and you get net score. One note is this is for each company's overall portfolio. So it's not just cloud. So it's a bit of a mixed bag, but there are a couple points worth noting. First, anything above 40% or 40, here as shown in the chart, is considered elevated. AWS, as you can see, is well above that 40% mark, as is Microsoft. And if you isolate Microsoft's Azure, only Azure, it jumps above AWS's momentum. Google is just barely hanging on to that 40 line, and Alibaba is well below, with both Google and Alibaba showing much higher replacements, that bright red. But here's the key point. AWS and Azure have virtually no churn, no replacements in that bright red. And all four companies are experiencing single-digit numbers in terms of decreased spending within customer accounts. People may be moving some workloads back on-prem selectively, but repatriation is definitely not a trend to bet the house on, in our view. Okay, let's get to the main subject of this "Breaking Analysis". TheCube was at AWS re:Inforce in Boston this week, and we have some observations to share. First, we had keynotes from Steven Schmidt who used to be the chief information security officer at Amazon on Web Services, now he's the CSO, the chief security officer of Amazon. Overall, he dropped the I in his title. CJ Moses is the CISO for AWS. Kurt Kufeld of AWS also spoke, as did Lena Smart, who's the MongoDB CISO, and she keynoted and also came on theCUBE. We'll go back to her in a moment. The key point Schmidt made, one of them anyway, was that Amazon sees more data points in a day than most organizations see in a lifetime. Actually, it adds up to quadrillions over a fairly short period of time, I think, it was within a month. That's quadrillion, it's 15 zeros, by the way. Now, there was drill down focus on data protection and privacy, governance, risk, and compliance, GRC, identity, big, big topic, both within AWS and the ecosystem, network security, and threat detection. Those are the five really highlighted areas. Re:Inforce is really about bringing a lot of best practice guidance to security practitioners, like how to get the most out of AWS tooling. Schmidt had a very strong statement saying, he said, "I can assure you with a 100% certainty that single controls and binary states will absolutely positively fail." Hence, the importance of course, of layered security. We heard a little bit of chat about getting ready for the future and skating to the security puck where quantum computing threatens to hack all of the existing cryptographic algorithms, and how AWS is trying to get in front of all that, and a new set of algorithms came out, AWS is testing. And, you know, we'll talk about that maybe in the future, but that's a ways off. And by its prominent presence, the ecosystem was there enforced, to talk about their role and filling the gaps and picking up where AWS leaves off. We heard a little bit about ransomware defense, but surprisingly, at least in the keynotes, no discussion about air gaps, which we've talked about in previous "Breaking Analysis", is a key factor. We heard a lot about services to help with threat detection and container security and DevOps, et cetera, but there really wasn't a lot of specific talk about how AWS is simplifying the life of the CISO. Now, maybe it's inherently assumed as AWS did a good job stressing that security is job number one, very credible and believable in that front. But you have to wonder if the world is getting simpler or more complex with cloud. And, you know, you might say, "Well, Dave, come on, of course it's better with cloud." But look, attacks are up, the threat surface is expanding, and new exfiltration records are being set every day. I think the hard truth is, the cloud is driving businesses forward and accelerating digital, and those businesses are now exposed more than ever. And that's why security has become such an important topic to boards and throughout the entire organization. Now, the other epiphany that we had at re:Inforce is that there are new layers and a new trust framework emerging in cyber. Roles are shifting, and as a direct result of the cloud, things are changing within organizations. And this first hit me in a conversation with long-time cyber practitioner and Wikibon colleague from our early Wikibon days, and friend, Mike Versace. And I spent two days testing the premise that Michael and I talked about. And here's an attempt to put that conversation into a graphic. The cloud is now the first line of defense. AWS specifically, but hyperscalers generally provide the services, the talent, the best practices, and automation tools to secure infrastructure and their physical data centers. And they're really good at it. The security inside of hyperscaler clouds is best of breed, it's world class. And that first line of defense does take some of the responsibility off of CISOs, but they have to understand and apply the shared responsibility model, where the cloud provider leaves it to the customer, of course, to make sure that the infrastructure they're deploying is properly configured. So in addition to creating a cyber aware culture and communicating up to the board, the CISO has to ensure compliance with and adherence to the model. That includes attracting and retaining the talent necessary to succeed. Now, on the subject of building a security culture, listen to this clip on one of the techniques that Lena Smart, remember, she's the CISO of MongoDB, one of the techniques she uses to foster awareness and build security cultures in her organization. Play the clip >> Having the Security Champion program, so that's just, it's like one of my babies. That and helping underrepresented groups in MongoDB kind of get on in the tech world are both really important to me. And so the Security Champion program is purely purely voluntary. We have over 100 members. And these are people, there's no bar to join, you don't have to be technical. If you're an executive assistant who wants to learn more about security, like my assistant does, you're more than welcome. Up to, we actually, people grade themselves when they join us. We give them a little tick box, like five is, I walk on security water, one is I can spell security, but I'd like to learn more. Mixing those groups together has been game-changing for us. >> Now, the next layer is really where it gets interesting. DevSecOps, you know, we hear about it all the time, shifting left. It implies designing security into the code at the dev level. Shift left and shield right is the kind of buzz phrase. But it's getting more and more complicated. So there are layers within the development cycle, i.e., securing the container. So the app code can't be threatened by backdoors or weaknesses in the containers. Then, securing the runtime to make sure the code is maintained and compliant. Then, the DevOps platform so that change management doesn't create gaps and exposures, and screw things up. And this is just for the application security side of the equation. What about the network and implementing zero trust principles, and securing endpoints, and machine to machine, and human to app communication? So there's a lot of burden being placed on the DevOps team, and they have to partner with the SecOps team to succeed. Those guys are not security experts. And finally, there's audit, which is the last line of defense or what I called at the open, the free safety, for you football fans. They have to do more than just tick the box for the board. That doesn't cut it anymore. They really have to know their stuff and make sure that what they sign off on is real. And then you throw ESG into the mix is becoming more important, making sure the supply chain is green and also secure. So you can see, while much of this stuff has been around for a long, long time, the cloud is accelerating innovation in the pace of delivery. And so much is changing as a result. Now, next, I want to share a graphic that we shared last week, but a little different twist. It's an XY graphic with net score or spending velocity in the vertical axis and overlap or presence in the dataset on the horizontal. With that magic 40% red line as shown. Okay, I won't dig into the data and draw conclusions 'cause we did that last week, but two points I want to make. First, look at Microsoft in the upper-right hand corner. They are big in security and they're attracting a lot of dollars in the space. We've reported on this for a while. They're a five-star security company. And every time, from a spending standpoint in ETR data, that little methodology we use, every time I've run this chart, I've wondered, where the heck is AWS? Why aren't they showing up there? If security is so important to AWS, which it is, and its customers, why aren't they spending money with Amazon on security? And I asked this very question to Merrit Baer, who resides in the office of the CISO at AWS. Listen to her answer. >> It doesn't mean don't spend on security. There is a lot of goodness that we have to offer in ESS, external security services. But I think one of the unique parts of AWS is that we don't believe that security is something you should buy, it's something that you get from us. It's something that we do for you a lot of the time. I mean, this is the definition of the shared responsibility model, right? >> Now, maybe that's good messaging to the market. Merritt, you know, didn't say it outright, but essentially, Microsoft they charge for security. At AWS, it comes with the package. But it does answer my question. And, of course, the fact is that AWS can subsidize all this with egress charges. Now, on the flip side of that, (chuckles) you got Microsoft, you know, they're both, they're competing now. We can take CrowdStrike for instance. Microsoft and CrowdStrike, they compete with each other head to head. So it's an interesting dynamic within the ecosystem. Okay, but I want to turn to a powerful example of how AWS designs in security. And that is the idea of confidential computing. Of course, AWS is not the only one, but we're coming off of re:Inforce, and I really want to dig into something that David Floyer and I have talked about in previous episodes. And we had an opportunity to sit down with Arvind Raghu and J.D. Bean, two security experts from AWS, to talk about this subject. And let's share what we learned and why we think it matters. First, what is confidential computing? That's what this slide is designed to convey. To AWS, they would describe it this way. It's the use of special hardware and the associated firmware that protects customer code and data from any unauthorized access while the data is in use, i.e., while it's being processed. That's oftentimes a security gap. And there are two dimensions here. One is protecting the data and the code from operators on the cloud provider, i.e, in this case, AWS, and protecting the data and code from the customers themselves. In other words, from admin level users are possible malicious actors on the customer side where the code and data is being processed. And there are three capabilities that enable this. First, the AWS Nitro System, which is the foundation for virtualization. The second is Nitro Enclaves, which isolate environments, and then third, the Nitro Trusted Platform Module, TPM, which enables cryptographic assurances of the integrity of the Nitro instances. Now, we've talked about Nitro in the past, and we think it's a revolutionary innovation, so let's dig into that a bit. This is an AWS slide that was shared about how they protect and isolate data and code. On the left-hand side is a classical view of a virtualized architecture. You have a single host or a single server, and those white boxes represent processes on the main board, X86, or could be Intel, or AMD, or alternative architectures. And you have the hypervisor at the bottom which translates instructions to the CPU, allowing direct execution from a virtual machine into the CPU. But notice, you also have blocks for networking, and storage, and security. And the hypervisor emulates or translates IOS between the physical resources and the virtual machines. And it creates some overhead. Now, companies like VMware have done a great job, and others, of stripping out some of that overhead, but there's still an overhead there. That's why people still like to run on bare metal. Now, and while it's not shown in the graphic, there's an operating system in there somewhere, which is privileged, so it's got access to these resources, and it provides the services to the VMs. Now, on the right-hand side, you have the Nitro system. And you can see immediately the differences between the left and right, because the networking, the storage, and the security, the management, et cetera, they've been separated from the hypervisor and that main board, which has the Intel, AMD, throw in Graviton and Trainium, you know, whatever XPUs are in use in the cloud. And you can see that orange Nitro hypervisor. That is a purpose-built lightweight component for this system. And all the other functions are separated in isolated domains. So very strong isolation between the cloud software and the physical hardware running workloads, i.e., those white boxes on the main board. Now, this will run at practically bare metal speeds, and there are other benefits as well. One of the biggest is security. As we've previously reported, this came out of AWS's acquisition of Annapurna Labs, which we've estimated was picked up for a measly $350 million, which is a drop in the bucket for AWS to get such a strategic asset. And there are three enablers on this side. One is the Nitro cards, which are accelerators to offload that wasted work that's done in traditional architectures by typically the X86. We've estimated 25% to 30% of core capacity and cycles is wasted on those offloads. The second is the Nitro security chip, which is embedded and extends the root of trust to the main board hardware. And finally, the Nitro hypervisor, which allocates memory and CPU resources. So the Nitro cards communicate directly with the VMs without the hypervisors getting in the way, and they're not in the path. And all that data is encrypted while it's in motion, and of course, encryption at rest has been around for a while. We asked AWS, is this an, we presumed it was an Arm-based architecture. We wanted to confirm that. Or is it some other type of maybe hybrid using X86 and Arm? They told us the following, and quote, "The SoC, system on chips, for these hardware components are purpose-built and custom designed in-house by Amazon and Annapurna Labs. The same group responsible for other silicon innovations such as Graviton, Inferentia, Trainium, and AQUA. Now, the Nitro cards are Arm-based and do not use any X86 or X86/64 bit CPUs. Okay, so it confirms what we thought. So you may say, "Why should we even care about all this technical mumbo jumbo, Dave?" Well, a year ago, David Floyer and I published this piece explaining why Nitro and Graviton are secret weapons of Amazon that have been a decade in the making, and why everybody needs some type of Nitro to compete in the future. This is enabled, this Nitro innovations and the custom silicon enabled by the Annapurna acquisition. And AWS has the volume economics to make custom silicon. Not everybody can do it. And it's leveraging the Arm ecosystem, the standard software, and the fabrication volume, the manufacturing volume to revolutionize enterprise computing. Nitro, with the alternative processor, architectures like Graviton and others, enables AWS to be on a performance, cost, and power consumption curve that blows away anything we've ever seen from Intel. And Intel's disastrous earnings results that we saw this past week are a symptom of this mega trend that we've been talking about for years. In the same way that Intel and X86 destroyed the market for RISC chips, thanks to PC volumes, Arm is blowing away X86 with volume economics that cannot be matched by Intel. Thanks to, of course, to mobile and edge. Our prediction is that these innovations and the Arm ecosystem are migrating and will migrate further into enterprise computing, which is Intel's stronghold. Now, that stronghold is getting eaten away by the likes of AMD, Nvidia, and of course, Arm in the form of Graviton and other Arm-based alternatives. Apple, Tesla, Amazon, Google, Microsoft, Alibaba, and others are all designing custom silicon, and doing so much faster than Intel can go from design to tape out, roughly cutting that time in half. And the premise of this piece is that every company needs a Nitro to enable alternatives to the X86 in order to support emergent workloads that are data rich and AI-based, and to compete from an economic standpoint. So while at re:Inforce, we heard that the impetus for Nitro was security. Of course, the Arm ecosystem, and its ascendancy has enabled, in our view, AWS to create a platform that will set the enterprise computing market this decade and beyond. Okay, that's it for today. Thanks to Alex Morrison, who is on production. And he does the podcast. And Ken Schiffman, our newest member of our Boston Studio team is also on production. Kristen Martin and Cheryl Knight help spread the word on social media and in the community. And Rob Hof is our editor in chief over at SiliconANGLE. He does some great, great work for us. Remember, all these episodes are available as podcast. Wherever you listen, just search "Breaking Analysis" podcast. I publish each week on wikibon.com and siliconangle.com. Or you can email me directly at David.Vellante@siliconangle.com or DM me @dvellante, comment on my LinkedIn post. And please do check out etr.ai for the best survey data in the enterprise tech business. This is Dave Vellante for theCUBE Insights, powered by ETR. Thanks for watching. Be well, and we'll see you next time on "Breaking Analysis." (upbeat theme music)

>>Okay. We're back in Boston covering AWS reinvent 2022. This is our second live reinvent. We've done the other ones, uh, in between as digital. Uh, my name is Dave Lanta and you're watching the cube. Peter McKay is here. He's the CEO of sneaking ad Shani is the chief technical officer guys. Great to see you again. Awesome. Being here in Boston >>In July. It is Peter. You can't be weather's good weather. Yeah, red SOS. Aren't good. But everything else >>Is SOS are ruin in our sub, you know, >>Hey, they're still in the playoff, the hunt, you >>Know, all you gotta do is make it in. Yes. >>Right. And there's a new season. Simple >>Kinda like hockey, but you know, I'm worried they're gonna be selling at the trading >>Deadline. Yeah. I think they should be. I think it's you think so it's not looking good. Oh, >>You usually have a good angle on this stuff, but uh, well, Hey, we'll see. We'll go. I got a lot of tickets. We'll go and see the Yankees at least we'll see a winning team. Anyway, we last talked, uh, after your fundraising. Yeah. You know, big, big round at your event last night, a lot of buzz, one of the largest, I think the largest event I saw around here, a lot of good customers there. >>It's great. Great time. >>So what's new. Give us the update. You guys have made some, an acquisition since then. Integration. We're gonna talk >>About that. Yeah. It's been, uh, a lot has happened. So, uh, the business itself has done extremely well. We've been growing at 170% year, over year, a hundred percent growth in our number of customers added. We've done six acquisitions. So now we have, uh, five products that we've added to the mix. We've tripled the size of the company. Now we're 1300 people, uh, in the organization. So quite a bit in a very short period of time. >>Well, and of course my, in my intro, I, I said, reinvent, I'm getting ahead of myself. Right. >>Of course we'll >>Reinforced. We'll be at reinve >>In November. Are that's the next one at >>Reinforced. We've done a lot of reinvents by the way, you know? >>So there's a lot, lot of reinvention >>Here. So of course, well, you're reinventing security, right? Yes. So, you know, I try to, I think about when I go to these events, like, what's the takeaway, what's the epiphany. And we're really seeing the, the developer security momentum, and it's a challenge. They gotta worry about containers. They gotta worry about run time. They gotta worry about platform. Yeah. You guys are attacking that problem. Maybe describe that a >>Little bit for us. Yeah. I mean, for years it was always, um, you know, after the fact production fixing security in run time and billions and billions of dollars spent in fixing after the fact. Right. And so the realization early on with the was, you know, you gotta fix these issues earlier and earlier, we started with open source was the first product at wait. Then six, six years ago, then we added container security and we added infrastructure's code. We added code security. We added, um, most recently cloud security with the F acquisition. So one platform, one view that a developer can look at to fix all the issues through the, be from the beginning, all the way through the software development life cycle. So we call it developer security. So allowing developers to develop fast, but stay secure at the same time. >>So I like the fact that you're using some of your capital to do acquisitions. Yeah. Now a lot of M and a is, okay, we're gonna buy this company. We're gonna leave them alone. You guys chose to integrate them. Maybe describe what that process was like. Yeah. Why you chose that. Yeah. How hard it was, how long it took. Take us through that. >>Yeah. Yeah. I'll give, uh, two examples, maybe one on sneak, which was an acquisition of, of the company that was focused on, uh, code analysis, actually not for security. And we have identified the merit of what we need in terms of the first security solution, not an ability to take a security product and put it in the end of developer, but rather build something that will build into the dev motion, which means very fast, very accurate things that it can rely on source and not just on the build code and so on. And we have built that into the platform and by that our customers can gain all of their code related issues together with all of their ISE related issues together with all of the container issues in one platform that they can prioritize accordingly. >>Yeah. Okay. So, so talk more about the, the, the call, the few, the sneak cloud, right? Yeah. So the few name goes away. I presume, right. Or yes, it does. Okay. So you retire that and bring it in the brand is sneak. Yeah. Right. So talk about the cloud, what it does, what problems >>It's solving. Yeah. Awesome. And, and this goes exactly the same. As we mentioned on, on the code, we have looked at the, the, the cloud security solutions for a while now. And what we loved about the few team is that they were building their product with their first approach. Okay. So the notion is as followed as you are, you know, you're a CSO, you have your pro you have your program, you're looking, you have different types of controls and capabilities. And your team is constantly looking for threats. When we are monitoring your cloud environment, we can detect problems like, you know, your FL bucket is not exposing the right permissions and is exposed to the world or things like that. But from a security perspective, it might be okay to stop there. But if you're looking at an operation perspective, you need to know who needs to fix, how do they need to fix it? >>Where do they need to fix it? What will the be the impact if they would fix it? So what do we actually doing is we are connecting all the dots of the platform. So on one end, you know, the actual resources that are running and what's the implication in the actual deployed environment. On the other end, we get correlation back to the actual code that generates that. And then I can give that context both to the security person, the context of how it affects the application. But more importantly, the context for the developer is required to fix the problem. What's the context of the cloud. Yeah. And a lot of things are being exposed this way. And we can talk about that. Uh, >>So this is really interesting because, and look, I love AWS to do an amazing job. One of the other things I really like about 'em is it seems like they're not trying to go hard and monetize their security products. Mm-hmm, they're leaving that to the ecosystem, which I like. Yeah. Microsoft taken a little different approach, right? Yeah, yeah, yeah. Ton a lot. But this, this, this example you're giving ad about the S3 bucket. So we heard in the keynotes yesterday about, you know, reasoning, AI reasoning, they said, we can say, is this S3 bucket exposed to the public? We can do that with math. Right. Yeah. But you're what I'm inferring is you don't stop there. Yeah. Yeah. There's a lot of other stuff that has to, >>And sometimes have to, not as simple, just as a configuration change, sometimes the correlation between what your application is doing affects what is the resulted experience of, you know, the remote user or in this case, the attacker, right. I mean, >>The application has access, who has access to the application, is this, this the chain. >>So propagates, you have to, you have to have a, a solution that looks both at have very good understanding of the application context. A very good understanding of what we refer to as the application graph, like understanding how it works, being able to analyze that and apply the same policies, both at development time, as well as run time. >>So there's, there's human to app. There's also a machine to machine. Can you guys help with that problem as well? Or is that sort of a futures thing or >>Could you, I'm not sure. I understand what >>Referring, so machines talking to machines, right. I mean, there's data flowing. Yep. You know, between those machines, right. It's not just the humans interacting with the application. Is that a trend that you see and is that something that you guys can solve? >>So at, at the end of the day, there is a lot of automation that happens both for, by humans for good reasons, as well as by humans for bads. Right. <laugh> and, and the notion is that we are really trying to focus on what matters to the developer as they're trying to improve their business around that. So both improves making sure they know, you know, quality problems or things of this kind. But as part of that, more importantly, when we're looking at security as a quality problem, making sure that we have a flow in the development life cycle that streamline what the developer is expecting to do as they're building the solution. And if every single point, whether it's the ID, whether it's the change management, whether it's the actual build, whether it's the deployed instance on the cloud, making sure that we identify with that and connect that back to the code. >>Okay. So if there's machine automation coming in, that shouldn't be there, you can sort of identify that and then notify remediate or whatever action should be >>Taken. Yeah. Identify, identify remediate. Yep. >>Yeah. We, we really focus on making sure that we help developers build better products. So our core focus is identify areas where the product is not built way in a good way, and then suggest the corrective action that is required to make that happen. >>And I think part of this is the, you know, just, uh, the speed of the software development today. I mean, you look at developers are constantly and not just look at sneak you're, you're trying to get so much more productivity outta the developers that you have. Every company is trying to get more productivity out of developers, incredible innovation, incredible pace, get those is a competitive advantage. And so what we're trying to do is we make it easier for developers to go fast innovate, but also do it securely and embed it without slowing them down, develop fast and secure. >>So again, I love, I love AWS love what they're doing. We heard, uh, yesterday from, from CJ, you know, a lot of talk about, you know, threat detection and, you know, some talk about DevOps, et cetera. But yeah, I, I, I didn't hear a lot about how to reduce the complexity for the CSO. And the reason I bring this up is it feels like the cloud is now the first level of defense and the CISO is, is becoming the next level, which is on the developer. So the developer is becoming responsible for security at a whole shift left, maybe shield. Right. But, but shift left is becoming critical. Seems like your role and maybe others in the ecosystem is to address my concern about simplifying the life of the CISO. Is that a reasonable way to think about it? I >>Think it's changing the role of the CISO. How so? You know, really it's, I, I think it's before it, in this, in the security organization and D you should chime in here is, you know, it used to be, I did, I owned all application security, I owned the whole thing and they couldn't keep up. Like, I think it's just every security organization is totally overwhelmed. And so they have to share the responsibility. They have to get that fix the issues earlier and earlier, because it's waiting too long. It's after the fact. And then you gotta throw this over the fence and developers have to fix it. So they've gotta find a new way because they're the bottleneck they're slowing down the company from, in innovating and bringing these applications to market. So we are the kind of this bridge between the security teams that wanna make sure the, that we're staying secure and the development organizations and engineering and CEOs go fast. We need you guys to go faster and faster. So we, we tend to be the bridge between the two of them. >>One of the things I really love happening these days is that we change the culture of the organization from a culture where the CSO is trying to, you know, push and enforce and dictate the policy, which, which they should, but they really wanna see the development team speak up like that. The whole motion of DevOps is that we are empowering them to make the decisions that are right for the business, right? And then there is a gap because on one hand, this is always like, you need to do this, you need to do this. You need to do that. And the dev teams don't understand how that impacts their business. Good enough. And they don't have the tools and, you know, the ability to add a source problem. So with the solution liken, we really empower the developers to bake security as part of their cycle, which is what was done in many other fields, quality, other things, everything, it, everything moves into development already, right? So we're doing that. And the entire discussion now changes into an enablement discussion. >>So interesting. Cause you saw, this is the role of the CSOs changing. How so? I see that in a way like frees, sneak the CSO with the cloud is becoming a compliance officer. Like you do this, you do this, you do this, you do this, you third >>One would take a responsibility >>Trying. Yeah. Right, right. And so you're flipping that equation saying, Hey, we're gonna actually make this an accelerant to your business. >>So, so set the policy, determine compliance, but make sure that the teams, the developers are building applications in compliance with your policy. Right. So make sure and, and don't allow them to do something. If they're doing, if they're developing an application with a number of vulnerabilities, you can stop that from happening so you can oversee it, but you don't have to be the one who owns it all the way through from beginning to, >>Or, or get it before it's deployed. So you don't have to go back after the fact and, and remediate it with, you know, but, >>But think about deploy, they're deploying apps today. I mean, they're updating by the hour, right? Where, you know, six years ago, five years ago, two years ago was every six to nine months. Right? So the pace of this innovation from developers is so fast that the old way of doing security can't keep up. Like they're built for six month release cycles. This is six hour release cycles. And so we had to, it has to change security. Can't stay the way it is. So what we've been doing for se seven years for application security is exactly what we're doing for cloud security is moving all that earlier. All these products that we've been building over the years is really taking these afterthought security components and bringing 'em all earlier, you know, bringing everything like cloud security is done after the fact. Now we can take those issues and bring 'em right to the developers who created that and can fix the issues. So it's code to cloud back to code in a very automated fashion. So doesn't slow developers down. >>Okay. So what's the experience. We all know there's, everybody has more than one cloud. What's the experience across clouds. Can you create a consistent, continuous experience, cloud agnostic, >>Agnostic, cloud agnostic, uh, development environment, agnostic, you know, language agnostic. So that's kind of the beauty oft where you have maybe other certain tools for certain clouds, uh, or certain languages or certain development environments, but you have to learn different tools, you know, and, and they all roll up to security in a different way. And so what we have done is consolidated all that spend for open source security, container security infrastructure, now, cloud security, all that spend and all that fragmentation all under one platform. So it's one company that brings all those pieces >>Together. So it's a single continuous experience. Yeah. The developer experience you're saying is identical. Yes. >>Actually one product >>It's entitlement that we're getting. Yes. So you're hiding the underlying complexities of the respective clouds and those primitives developer doesn't have to worry about them. No, I call that a super cloud super >>Cloud. >>Okay. But no, but essentially that's what you're, you're building, building on the, on this ed Walsh would say on the shoulders of giants. Yeah, exactly. You know, you don't have to worry about the hyperscale infrastructure. Yep. Right. That you're building a layer of value on top of that. Yes. Is, is that essentially a PAs layer or is it, is it, can I think of it that way or is it not? Hmm. Is it platform? I >>Mean, yeah. I, I, I would say that at the end of the day, the, the way developers want to use a security tool is the same. Right. So we expose our functionality to them in those ways, if you're using, you know, uh, uh, one GI repository or another, if you're using one cloud or we, we are agnostic to data, don't, it's not, it doesn't really affect us in that manner. Um, I want to add another thing about the, the experience and associated with the consolidation that Peter referred to, uh, earlier, when you have a motion that automatically assess, you know, uh, problems that the developer is putting as part of the change management, as example, you do creating pool request. Now adding more capabilities into that motion is easy. So from enablement of the team, you can add another functionality, add cloud at ISC, add code and so on like that, because you already, you already made the decisions on how you are looking at that. And now you're integrated at, into your developer workflows, >>Right? So it's, it's already, it's already integrated for open source, adding container and ISD is real easy. It's all, you've already done all the integrations. And so for us going to five products and eventually 6, 7, 8, all, all based on the integrations that you already have in the same workflows that developers have become a use accustomed >>To. And that's what we, a lot of work from the company perspective. Right. >>I can ask you about another sort of trend we're seeing where you see Goldman Sachs last reinvent announced a cloud product, essentially bringing their data, their tools, their software. They're gonna run it on AWS at the snowflake summit, uh, capital one announced the service running on snowflake, Oracle by Cerner, right? Yeah. You know, they're gonna be, do something on OCI. Of course, make 'em do that. But it's, it's a spin on Andreessens every company's a software company. It's like every company's now becoming digital, a software company building their own SAS, essentially building their own clouds, or maybe, maybe something they'll be super clouds. Are you seeing industry come to sneak and say, Hey, help us build products that we can monetize >>There companies. So, first off, I think kind of the first iteration is, you know, all these industries of becoming software driven, like you said, and more software is more software risk. And so that kind of led us down this journey of now financial services, you know, tech, you know, media and entertainment, financial services, healthcare. Now it's this long tail of, of low tech. Yeah. Within those companies, they are offering services to the other parts of the organization. We have >>So far, mostly >>Internal, mostly internal, other than the global SI. And some of the companies who do that for a living, you know, they build the apps for companies and they are offering a sneak service. So before I give you these, I update these applications. I'm gonna make sure I'm running. I'm, I'm, I'm signifying those applications to make sure that they're secure before you get them. And so that now a company like a capital one coming to us saying, I wanna offer this to others. I think that's a, that's a leap because you know, companies are taking on security of someone else's and I think that's a, that's not there yet. It may be, >>Do you think it'll happen? >>We do have the, uh, uh, threat Intel that we, we have a very, a very strong security group that constantly monitors and analyzing the threat. And we create this vulnerability database. So in open sources, an example, we're the fact of standard, uh, in the field. So many of our partners are utilizing the threat Intel feed of snake as part of their offering. Okay. If you go to dock as an example, you can scan with, with snake intelligence immediately out of the gate over there, right? Yeah. >>And tenable, rapid seven trend micro. They all use the vulnerability database as well. Okay. So a lot of financial institutions use it because they had, they'd have seven, 10 people doing re security research on their own. And now they can say, well, I don't have to have those seven. I've got the industry standard for vulnerability database from Steve. >>And they don't have to throw out their existing tool sets where they have skills. >>Yes, exactly. >>Peter bring us homes, give us the bumper sticker, summarize, you know, reinforce and kind what we can expect going forward. >>Yeah, no, I mean, we're gonna continue the pace. We don't see anything slowing, slowing us down in terms of, um, just the number of customers that are, that are shifting left. Everybody's talking about, Hey, I need to embed this earlier and earlier. And I think what they're finding is this, this need to rein reinnovate like get innovation back into their business. And a lot of it had to slow down because, well, you know, you, we can't let developers develop an app without it going through security. And that takes time. It slows you down and allows you not to like slow the pace of innovation. And so for us, it's it help developers go fast, incredibly, you know, quickly, aggressively, creatively, but do it in a secure way. And I think that balance, you know, making sure that they're doing what they're doing, they're increasing developer productivity, increasing the amount of innovation that developers are trying to do, but you gotta do it securely. And that's where we compliment really what every CEO is pushing companies. I need more productivity. I need more aggressive creativity, innovation, but you better be secure at the same time. And that's what we bring together for our customers. >>And you better do that without slowing us down. That's >>Don't trade off, slow >>Us down. Always had to make. Yes, guys. Thanks so much for coming to the cube. Thanks, David. Always great to see you guys see ID. Appreciate it. All right. Keep it right there. This is the Cube's coverage of reinforced 2022 from Boston. We'll be right back right after the short break.

(upbeat music) >> Welcome back to Boston. The CUBE's coverage of AWS Re-inforce 2022. This is our second live Re-inforce. We did two in the middle that were all digital. Aaron Brown is here as US AWS cyber leader for Deloitte and Ryan Orsi the cloud foundation leader for partners for Amazon Web Services. Jen, welcome to The CUBE. >> Thanks for having us. >> Thanks. >> Nice to see you. Tell us about the story of Deloitte in cyber and then we'll get it to Deloitte cyber on AWS, or maybe even start there. >> Yeah, sure. I mean, obviously Deloitte, one of the largest cyber consultancies in the world, we've been working with AWS for a very long time. 2013, I was involved with, you know, the first Alliance agreement with them. And then we've been in cloud managed services about five years delivering workloads for clients. We have over 200 clients on that platform and then about a year and a half ago or so, the MSSP program came and it made a ton of sense to us, right? To really level the playing field and gave us a chance to really come out and demonstrate, you know, our capability around MSSP. >> The MSSP program, I saw a slide yesterday in keynote and in the analyst program was, you know, there's technology partners, there's MSSP partners. Explain the MSSP partner. >> Sure, sure. So at the Database Partner Network, we break it down. The program is called the level one MSSP Competency Program. And it is for both those companies that are sort of more of a software company with a managed service and those that are more of a pure service company, it's for both, but it's the general concept, it hosts the community of partners like Deloitte with a concentrated talent pool around 24 by 7 monitoring and response of AWS security events. >> So what is Deloitte? Deloitte's not a pure software play. It's not a pure services play anymore. It's sort of a mixture. >> Yeah, you know, asset enabled services, right? It's the way that we look at it. So, yeah, we're definitely not trying to compete with software companies out there, but we do have assets, right? So we do everything as infrastructure as code and that allows us to deploy our solutions into client environments really quickly. So where you might spend months on third party tool integrations, we leverage all native AWS tools in our standard offering and we can deploy into a client and get those services up and running in a couple of weeks. >> So you sell your software as an integrated service, is that correct? You don't- >> It's service, it's really is service. We sell a metered service. >> You don't sell your software separately? >> No. >> I should say it differently. You include your software as part of the service, is that right? >> Yeah, it is. But actually there's another element. There are obviously some clients who don't want to be in a managed service in perpetuity. And so those same assets that I talked about that we use for MSSP, you know, for the right clients, we don't just give away everything to anybody but for the right clients, for the right engagement, we will work with clients to help them build the capability that they need to run it themselves. And our solution is built in a way where they can do that. Right? We have a base component and a variable component to the solution and we will impart those assets to a client, you know, if the situation is right. >> Okay. So you'll actually transfer the software, but would you charge for that? >> Yeah, certainly, but there's obviously a big service component that goes into it. Right? >> And that's really where your expertise is. >> Yeah, we don't have like a standard, you know, list price but we'll work with clients to basically help them build out that capability because frankly the the market moves so fast that you need a constant capability and engine to update that solution. It's not something that, you know, you're going to sell and someone's just going to use that out of the box for the next five years. >> But a lot of the value that seems that Deloitte brings is you don't run from customization. You welcome that. You, you know, if a client says, hey, I need this special and that special, or whatever it is you'll go attack. You have the staff, the talent to attack that problem. And you use software in areas where you can have repeatability and it helps you scale and be more productive. Is that a fair way to think about it? >> Yeah, that's right. I mean, I guess one of the phrases that we use is we like big hairy problems, right? That's sort of our sweet spot. The, you know, the very simple, hey, I need a couple of guys to do a couple of things, typically, we're not the right firm for that. So, yes, we use the assets cause we realize like, hey, you know, out of everything that needs to be done, there's a significant portion of this that everybody needs more or less the same way. And then we build that, we build the automation to get it in and then we have that variable component working with clients to say, hey, let's make this work in your environment. We use a combination of AWS Native services, but then, you know, some clients have investments in third party tools and we can work with that. >> So it's a perfect match for AWS cause you guys are all about providing tools for builders and here's some primitives, some APIs and Go, we don't want that highly customized snowflake for every single client. >> Exactly. I mean, that's what I feel like the partnership with Deloitte is really bringing to the table for everybody and our mutual customers and builders out there that we both work with is again, they don't run from complexity or customization that security can be complex. It can be hard, Deloitte's helping making it much easier. The AWS partner network is helping kind of bring the ecosystem together and of software service, architectures that AWS recommend for like a security best practice around what to monitor, how to respond, what kind of enriched data should be added to that security finding and kind of pushing that out through our partnerships with it such as Deloitte. >> One of the things that, I mean, certainly big takeaway from this event, the security tracks that reinvent, previous Re-inforce events is AWS imparting, educating its customers on best practice and how tos and things that they should be thinking about, you know, do this, don't do that. In 2019, it was a lot about, hey guys, there's this shared responsibility model and kind of explaining that, we're way, way beyond that now, should we think about Deloitte sort of as an extension of that best practice AWS expertise that can be applied at your clients? I'll go to Deloitte because I don't have the talent to deal with that. I mean, I got talented people, but I just don't have enough of them. >> Exactly. Yeah. Yeah. And that's really, you know, our offerings tend to be comprehensive across all the domains. And like I said, the full life cycle of security operations all the way from, you know, identify the issue to resolve it and recover from it. And, you know, when we look at the shared responsibility model, you know, we like to say, hey, we will take you really far up that stack, that customer responsibility area, you know, for our service, we cover a significant portion of that landscape on our client's behalf cause, you know, what do they care about? Deploying workloads, getting the application running, right? Security is just another one of those important, necessary things, but it just sort of standing between you and the business value of your workload. >> And your ideal target customer would be a large medium up to a large enterprise or is all exclusively large or? >> Definitely not exclusively large. You know, the fact that we have all the automation that we do, we have a significant portion of our security operations folks are offshore allows us to be really competitive. And so we're able to serve clients that maybe, you know, in years past wouldn't have been what you'd think of as traditional. So like clients leveraging the marketplace, you know, we're able to serve that market segment. >> So billion dollar up kind of revenue? Odes that sound about right? >> Yeah. Even south of that a bit. >> Okay. So maybe half a billion or 500 million up. >> Yeah. >> Okay. So thinking about that ideal sort of profile, if you don't know, you don't know, I'm going to ask you to guess. >> Yeah. >> What percent of those target companies, enterprises, have a SOC? Is it 100%, 50%, you know, or are you- >> 75, 75% most so. >> Okay. So let's say 3/4. >> Yeah. >> So you compliment the SOC, right? You're not the SOC, but you may be in some cases? >> Depending, now we're talking about it's a function of what their IT enterprise landscape looks like. If they're 100% AWS, yeah. If you're born in the cloud startup and, you know, you don't do anything else and we have, you know, we have a few of those. Right. And they want to give us everything. They're like, you know, our security guys just going to kind of understand what you guys are doing and feel good about it. Yeah. We do that. But for the most, there is an existing SOC. Right. And so what we do is we leverage, you know, an ITSM software to e-bond with our clients service management functions so that when we're generating tickets, they have full visibility to what's going on. We're still resolving things on their behalf, we need to communicate with some clients, right? Cause a lot of security issues that need to get resolved require engagement with the asset owner. So we're not just a black box. So we do have to talk to folks on the ground at the client to resolve issues. >> And that's actually one thing that really impressed me to getting to know Aaron and his team more and more throughout this journey together in the partnership is they're not throwing alerts over the fence to the customers SOC team saying, well, here's some recommended remediation steps, they're actually rolling up their sleeves and doing some remediation themselves and informing the customer. This was taken care of for you. I think that's really unique. >> Yeah. In addition to, you know, our solution obviously has a bunch of auto-remediations, you know, that we do as part of the solution. >> So what's the engagement like? What's the conversation like when people come to you? Say I have a problem, it's blank, right? What are the typical blank- >> You know, a lot of it has been organizations where there's either a business unit that has kind of maybe off run and doing their own thing. And, you know, it's only sort of come to light with the compliance and security organization inside the client that like, hey, these guys maybe need some help. And boy, we're really strapped. We don't have the people cause talent's so tight to go help these guys and make them get it right. We're going to go ahead and keep them kind of off to the side. And you know, we'll do this managed service to help get that addressed. And then another typical scenario is when companies are acquired. So, you know, organization buys a company and they've got a preexisting. Again, they look under the covers and they're like, oh, these guys really need some help because of the way that we deploy everything as infrastructure as code really very quickly, it's a great way to just kind of get it sorted. It's a metered service. So it's not some massive investment that they have to make. We could just get it sorted out until maybe they get a chance to process and actually onboard that new entity into their enterprise structure. So as part of the MSSP program within AWS, you got to be really good at understanding how to utilize the AWS portfolio of cyber security services natively. So you do that, does that check the box on everything you need or do clients typically say, no, no, you got to integrate with all this other mess that I have there. Can you sweep that mess aside and say, hey, I can do this all in the cloud or what's that dynamic like? >> The answer is, yes, both. Right? So, you know, typically clients will have significant investments in existing third party tools and then either politically because of the investment or from a practical standpoint it makes sense to integrate those. Now that does slow down, you know, the deployment and the customization a bit, but, you know, and a lot of times that makes sense for the client. >> Well, it gets hairy. Like you said, you love these kind of hairy problems, right? >> Yeah, that's right. >> You run towards that. >> That's right. We run towards fire >> And, Ryan, your focus on partners is all partners or is it really the MSSPs or? >> All partners, all kinds of partners in the security space, right? >> Right, right. Yeah. Of course. >> Software companies, professional services, managed services. And we're focused on trying to make the security easier for both of our mutual customers here. Right? So that what you mentioned about best practices and, you know, how do you tell what best practices are per AWS service or third party software that's operating in an AWS environment? That's part of what our team does is we create these partner programs. There's a very detailed, very prescriptive technical checklist that out internal security experts are going through with Deloitte folks, for example, as a part of their membership and the level one MSSP program to make sure that, right? Those best practices which could be fresh off the AWS documentation truck are built into their services. And the reason those best practices exist is for a for a good reason. They're built, tried and tested, you know, in our own environments before they reach the documentation website. But all of that is incorporated into that whole kind of validated checklist that we do together. So it's a great way to make sure that operations from partners like Deloitte, software delivered, customization delivered, aligns with what we're able to see from just our Amazon culture of being so customer obsessed and really listening to all of those very specific challenges they might have that the customer will have at different points in their cloud journey. Those challenges are baked directly into key technical requirement criteria that Deloitte's teamed up with us to go achieve. >> What are you seeing at the macro, Aaron? When we talked to practitioners where we'll survey, we have a survey partner called ETR and they'll do spending surveys coming into the year of CIOs and IT buyers, we're expecting 8%, eight to 8 1/2% budget growth, post Ukraine, inflation, Fed tightening, you know, the tech lash, all that. It's dialed down a bit, it's still pretty robust it's 6% and security still remains the number one priority. And we've seen a little bit of momentum deceleration even in security spend across the board, but not anything, you know, tragic. Are you seeing the same or are you seeing security budgets kind of where they were expected to be at the beginning of the year? >> Yeah, you know, I haven't seen it decline. I mean, I think the fact of the matter is for all the things that we talked about before, right? Basically the skill shortages and just the coordination with other cloud programs, there's a tremendous backlog of stuff that needs to be done. And, you know, enterprises have more appreciation now for the need for all, you know, all the various, you know, ransomware things that have happened and others that, hey, they need to get a handle on the security and their environment. And so I think a lot of what's been going on in the last year, the reason it hasn't been faster, hasn't been for a lack of appetite. It's just been a lack of skills and process to do it. >> Has the business case changed? And the variables maybe the same, but it used to be, hey, if you don't do this, you're exposed. Okay. Here's the fear of getting, you know, infiltrated and then it's going to became if you want to quantify it, it's like, okay, what's the expected loss with, and without, you know, the kind of think of insurance terms. Is the business case shifting with digital toward this is a fundamental component of monetization in order to be able to monetize, you have to ensure this level security. Are we there yet? >> Yeah, I think so. I don't think anyone's arguing whether it's, you know, needed or not. Right. So now it's a question of, hey, and I think CJ Moses had a good slide in the opening yesterday where he was saying, you know, was it, make the secure path, the path of least resistance. Right? And so that's a big part of, you know, how we deliver our solution. We really want to make it easy for the enterprise to absorb the security services that we have. Right? And that's really critical. I think that's where the focus is, is make it easier to do security because the value comes right along with it. >> All right. I'll give you each the final word, Ryan, you go first then Aaron kind of put a bumper sticker on Re-inforce 2022. >> It's not slowing down. It's only picking up in terms of innovation, software tools, operational processes, and some of the unique ways that all these tools are tied together. Third party, Native AWS, consulting, the way these services come together, it's only accelerating. It's been pretty exciting to see some of the innovation here this time at this Re-inforce. >> Right, Aaron, what do you say? >> Yeah, I would agree. I mean, just the breadth of capabilities, the new announcements by AWS of the capabilities in their solution stack. I mean, for me, you know, I just kind of wonder like when does it narrow or when does it settle down and I know that that's not now. >> Keep waiting. >> Yeah. >> But, yeah, I think, you know, we will continue to see you know, just rapid acceleration and new features and services that... >> I often say the next decade at cloud ain't going to to be like the last. So gentlemen, thanks for coming on The CUBE. It's great to see you. >> Thanks for having us. Thank you everything. >> All right, thank you for watching. Keep it right there. This is Dave Vellante for The CUBE. We'll be back right after this short break from Boston AWS Re-inforce 2022. (soft music)

(electronic music) >> Hello everybody, welcome back to Boston. This is Dave Vellante and you're watching theCUBE's continuous coverage of AWS re:Inforce 2022. We're here at the convention center in Boston where theCUBE got started in May of 2010. I'm really excited. Lena Smart is here, she's the chief information security officer at MongoDB rocket ship company We covered MongoDB World earlier this year, June, down in New York. Lena, thanks for coming to theCUBE. >> Thank you for having me. >> You're very welcome, I enjoyed your keynote yesterday. You had a big audience, I mean, this is a big deal. >> Yeah. >> This is the cloud security conference, AWS, putting its mark in the sand back in 2019. Of course, a couple of years of virtual, now back in Boston. You talked in your keynote about security, how it used to be an afterthought, used to be the responsibility of a small group of people. >> Yeah. >> You know, it used to be a bolt on. >> Yep. >> That's changed dramatically and that change has really accelerated through the pandemic. >> Yep. >> Just describe that change from your perspective. >> So when I started at MongoDB about three and a half years ago, we had a very strong security program, but it wasn't under one person. So I was their first CISO that they employed. And I brought together people who were already doing security and we employed people from outside the company as well. The person that I employed as my deputy is actually a third time returnee, I guess? So he's worked for, MongoDB be twice before, his name is Chris Sandalo, and having someone of that stature in the company is really helpful to build the security culture that I wanted. That's why I really wanted Chris to come back. He's technically brilliant, but he also knew all the people who'd been there for a while and having that person as a trusted second in command really, really helped me grow the team very quickly. I've already got a reputation as a strong female leader. He had a reputation as a strong technical leader. So us combined is like indestructible, we we're a great team. >> Is your scope of responsibility, obviously you're protecting Mongo, >> Yeah. >> How much of your role extends into the product? >> So we have a product security team that report into Sahir Azam, our chief product officer. I think you even spoke to him. >> Yeah, he's amazing. >> He's awesome, isn't he? He's just fabulous. And so his team, they've got security experts on our product side who are really kind of the customer facing. I'm also to a certain extent customer facing, but the product folks are the absolute experts. They will listen to what our customers need, what they want, and together we can then work out and translate that. I'm also responsible for governance risk and compliance. So there's a large portion of our customers that give us input via that program too. So there's a lot of avenues to allow us to facilitate change in the security field. And I think that's really important. We have to listen to what our customers want, but also internally. You know, what our internal groups need as well to help them grow. >> I remember last year, Re:invent 2021, I was watching a talk on security. It was the, I forget his name, but it was the individual who responsible for data center security. And one of the things he said was, you know, look it's not at the end of the day, the technology's important but it's not the technology. It's how you apply the tools and the practices and the culture- >> Right. That you build in the organization that will ultimately determine how successful you are at decreasing the ROI for the bad guys. >> Yes. >> Let's put it that way. So talk about the challenges of building that culture, how you go about that, and how you sustain that cultural aspect. >> So, I think having the security champion program, so that's just, it's like one of my babies, that and helping underrepresented groups in MongoDB kind of get on in the tech world are both really important to me. And so the security champion program is purely voluntary. We have over a hundred members. And these are people, there's no bar to join. You don't have to be technical. If you're an executive assistant who wants to learn more about security, like my assistant does, you're more than welcome. Up to, we actually people grade themselves, when they join us, we give them a little tick box. Like five is, I walk in security water. One is, I can spell security but I'd like to learn more. Mixing those groups together has been game changing for us. We now have over a hundred people who volunteer their time, with their supervisors permission, they help us with their phishing campaigns, testing AWS tool sets, testing things like queryable encryption. I mean, we have people who have such an in-depth knowledge in other areas of the business that I could never learn, no matter how much time I had. And so to have them- And we have people from product as security champions as well, and security, and legal, and HR, and every department is recognized. And I think almost every geographical location is also recognized. So just to have that scope and depth of people with long tenure in the company, technically brilliant, really want to understand how they can apply the cultural values that we live with each day to make our security program stronger. As I say, that's been a game changer for us. We use it as a feeder program. So we've had five people transfer from other departments into the security and GRC teams through this Champions program. >> Makes a lot of sense. You take somebody who walks on water in security, mix them with somebody who really doesn't know a lot about it but wants to learn and then can ask really basic questions, and then the experts can actually understand better how to communicate. >> Absolutely. >> To that you know that 101 level. >> It's absolutely true. Like my mom lives in her iPad. She worships her iPad. Unfortunately she thinks everything on it is true. And so for me to try and dumb it down, and she's not a dumb person, but for me to try and dumb down the message of most of it's rubbish, mom, Facebook is made up. It's just people telling stories. For me to try and get that over to- So she's a one, and I might be a five, that's hard. That's really hard. And so that's what we're doing in the office as well. It's like, if you can explain to my mother how not everything on the internet is true, we're golden. >> My mom, rest her soul, when she first got a- we got her a Macintosh, this was years and years and years ago, and we were trying to train her over the phone, and said, mom, just grab the mouse. And she's like, I don't like mice. (Lena laughs) There you go. I know, I know, Lena, what that's like. Years ago, it was early last decade, we started to think about, wow, security really has to become a board level item. >> Yeah. >> And it really wasn't- 2010, you know, for certain companies. But really, and so I had the pleasure of interviewing Dr. Robert Gates, who was the defense secretary. >> Yes. >> We had this conversation, and he sits on a number, or sat on a number of boards, probably still does, but he was adamant. Oh, absolutely. Here's how you know, here. This is the criticality. Now it's totally changed. >> Right. >> I mean, it's now a board level item. But how do you communicate to the C-Suite, the board? How often do you do that? What do you recommend is the right regime? And I know there's not any perfect- there's got to be situational, but how do you approach it? >> So I am extremely lucky. We have a very technical board. Our chairman of the board is Tom Killalea. You know, Amazon alum, I mean, just genius. And he, and the rest of the board, it's not like a normal board. Like I actually have the meeting on this coming Monday. So this weekend will be me reading as much stuff as I possibly can, trying to work out what questions they're going to ask me. And it's never a gotcha kind of thing. I've been at board meetings before where you almost feel personally attacked and that's not a good thing. Where, at MongoDB, you can see they genuinely want us to grow and mature. And so I actually meet with our board four times a year, just for security. So we set up our own security meeting just with board members who are specifically interested in security, which is all of them. And so this is actually off cadence. So I actually get their attention for at least an hour once a quarter, which is almost unheard of. And we actually use the AWS memo format. People have a chance to comment and read prior to the meeting. So they know what we're going to talk about and we know what their concerns are. And so you're not going in like, oh my gosh, what what's going to happen for this hour? We come prepared. We have statistics. We can show them where we're growing. We can show them where we need more growth and maturity. And I think having that level of just development of programs, but also the ear of the board has has helped me mature my role 10 times. And then also we have the chance to ask them, well what are your other CISOs doing? You know, they're members of other boards. So I can say to Dave, for example, you know, what's so-and-so doing at Datadog? Or Tom Killelea, what's the CISO of Capital One doing? And they help me make a lot of those connections as well. I mean, the CISO world is small and me being a female in the world with a Scottish accent, I'm probably more memorable than most. So it's like, oh yeah, that's the Irish girl. Yeah. She's Scottish, thank you. But they remember me and I can use that. And so just having all those mentors from the board level down, and obviously Dev is a huge, huge fan of security and GRC. It's no longer that box ticking exercise that I used to feel security was, you know, if you heated your SOC2 type two in FinTech, oh, you were good to go. You know, if you did a HERC set for the power industry. All right, right. You know, we can move on now. It's not that anymore. >> Right. It's every single day. >> Yeah. Of course. Dev is Dev at the Chario. Dev spelled D E V. I spell Dave differently. My Dave. But, Lena, it sounds like you present a combination of metrics, so, the board, you feel like that's appropriate to dig into the metrics. But also I'm presuming you're talking strategy, potentially, you know, gaps- >> Road roadmaps, the whole nine yards. Yep. >> What's the, you know, I look at the budget scenario. At the macro level, CIOs have told us, they came into the year saying, hey we're going to grow spending at the macro, around eight percent, eight and a half percent. That's dialed down a little bit post Ukraine and the whole recession and Fed tightening. So now they're down maybe around six percent. So not dramatically lower, but still. And they tell us security is still the number one priority. >> Yes. >> That's been the case for many, many quarters, and actually years, but you don't have an unlimited budget. >> Sure >> Right. It's not like, oh, here is an open checkbook. >> Right. >> Lena, so, how does Mongo balance that with the other priorities in the organization, obviously, you know, you got to spend money on product, you got to spend money and go to market. What's the climate like now, is it, you know continuing on in 2022 despite some of the macro concerns? Is it maybe tapping the brakes? What's the general sentiment? >> We would never tap the breaks. I mean, this is something that's- So my other half works in the finance industry still. So we have, you know, interesting discussions when it comes to geopolitics and financial politics and you know, Dev, the chairman of the board, all very technical people, get that security is going to be taken advantage of if we're seeing to be tapping the brakes. So it does kind of worry me when I hear other people are saying, oh, we're, you know, we're cutting back our budget. We are not. That being said, you also have to be fiscally responsible. I'm Scottish, we're cheap, really frugal with money. And so I always tell my team: treat this money as if it's your own. As if it's my money. And so when we're buying tool sets, I want to make sure that I'm talking to the CISO, or the CISO of the company that's supplying it, and saying are you giving me the really the best value? You know, how can we maybe even partner with you as a database platform? How could we partner with you, X company, to, you know, maybe we'll give you credits on our platform. If you look to moving to us and then we could have a partnership, and I mean, that's how some of this stuff builds, and so I've been pretty good at doing that. I enjoy doing that. But then also just in terms of being fiscally responsible, yeah, I get it. There's CISOs who have every tool that's out there because it's shiny and it's new and they know the board is never going to say no, but at some point, people will get wise to that and be like, I think we need a new CISO. So it's not like we're going to stop spending it. So we're going to get someone who actually knows how to budget and get us what the best value for money. And so that's always been my view is we're always going to be financed. We're always going to be financed well. But I need to keep showing that value for money. And we do that every board meeting, every Monday when I meet with my boss. I mean, I report to the CFO but I've got a dotted line to the CTO. So I'm, you know, I'm one of the few people at this level that's got my feet in both camps. You know budgets are talked at Dev's level. So, you know, it's really important that we get the spend right. >> And that value is essentially, as I was kind of alluding to before, it's decreasing the value equation for the hackers, for the adversary. >> Hopefully, yes. >> Right? Who's the- of course they're increasingly sophisticated. I want to ask you about your relationship with AWS in this context. It feels like, when I look around here, I think back to 2019, there was a lot of talk about the shared responsibility model. >> Yes. >> You know, AWS likes to educate people and back then it was like, okay, hey, by the way, you know you got to, you know, configure the S3 bucket properly. And then, oh, by the way, there's more than just, it's not just binary. >> Right, right. >> There's other factors involved. The application access and identity and things like that, et cetera, et cetera. So that was all kind of cool. But I feel like the cloud is becoming the first line of defense for the CISO but because of the shared responsibility model, CISO is now the second line of defense >> Yes. Does that change your role? Does it make it less complicated in a way? Maybe, you know, more complicated because you now got to get your DevSecOps team? The developers are now much more involved in security? How is that shifting, specifically in the context of your relationship with AWS? >> It's honestly not been that much of a shift. I mean, these guys are very proactive when it comes to where we are from the security standpoint. They listen to their customers as much as we do. So when we sit down with them, when I meet with Steve Schmidt or CJ or you know, our account manager, its not a conversation that's a surprise to me when I tell them this is what we need. They're like, yep, we're on that already. And so I think that relationship has been very proactive rather than reactive. And then in terms of MongoDB, as a tech company, security is always at the forefront. So it's not been a huge lift for me. It's really just been my time that I've taken to understand where DevSecOps is coming from. And you know, how far are we shifting left? Are we actually shifting right now? It's like, you know, get the balance, right? You can't be too much to one side. But I think in terms of where we're teaching the developers, you know, we are a company by developers for developers. So, we get it, we understand where they're coming from, and we try and be as proactive as AWS is. >> When you obviously the SolarWinds hack was a a major mile- I think in security, there's always something in the headlines- >> Yes. But when you think of things like, you know, Stuxnet, you know, Log4J, obviously Solarwinds and the whole supply chain infiltration and the bill of materials. As I said before, the adversary is extremely capable and sophisticated and you know, much more automated. It's always been automated attacks, but you know island hopping and infiltrating and self-forming malware and really sophisticated techniques. >> Yep. >> How are you thinking about that supply chain, bill of materials from inside Mongo and ultimately externally to your customers? >> So you've picked on my third favorite topic to talk about. So I came from the power industry before, so I've got a lot of experience with critical infrastructure. And that was really, I think, where a lot of the supply chain management rules and regulations came from. If you're building a turbine and the steel's coming from China, we would send people to China to make sure that the steel we were buying was the steel we were using. And so that became the H bomb. The hardware bill of materials, bad name. But, you know, we remember what it stood for. And then fast forward: President Biden's executive order. SBOs front and center, cloud first front and center. It's like, this is perfect. And so I was actually- I actually moderated a panel earlier this year at Homeland Security Week in DC, where we had a sneak CISA, So Dr. Allen Friedman from CISA, and also Patrick Weir from OWASP for the framework, CISA for the framework as well, and just the general guidance, and Snake for the front end. That was where my head was going. And MongoDB is the back-end database. And what we've done is we've taken our work with Snake and we now have a proof of concept for SBOs. And so I'm now trying to kind of package that, if you like, as a program and get the word out that SBOs shouldn't be something to be afraid of. If you want to do business with the government you're going to have to create one. We are offering a secure repository to store that data, the government could have access to that repository and see that data. So there's one source of truth. And so I think SBOs is going to be really interesting. I know that, you know, some of my peers are like, oh, it's just another box to tick. And I think it's more than that. I definitely- I've just, there's something percolating in the back of my mind that this is going to be big and we're going to be able to use it to hopefully not stop things like another Log4j, there's always going to be another Log4j, we know that. we don't know everything, the unknown unknown, but at least if we're prepared to go find stuff quicker than we were then before Log4j, I think having SBOs on hand, having that one source of truth, that one repository, I think is going to make it so much easier to find those things. >> Last question, what's the CISO's number one challenge? Either yours or the CISO, generally. >> Keeping up with the fire hose that is security. Like, what do you pick tomorrow? And if you pick the wrong thing, what's the impact? So that's why I'm always networking and talking to my peers. And, you know, we're sometimes like meerkats, you know. there's meerkats, you see like this, it's like, what do we talk about? But there's always something to talk about. And you just have to learn and keep learning. >> Last question, part B. As a hot technology company, that's, you know, rising star, you know not withstanding the tech lash and the stock market- >> Yeah. >> But Mongo's growing, you know, wonderfully. Do you find it easier to attract talent? Like many CISOs will say, you know, lack of talent is my biggest, biggest challenge. Do you find that that's not the challenge for you? >> Not at all. I think on two fronts, one, we have the champions program. So we've got a whole internal ecosystem who love working there. So the minute one of my jobs goes on the board, they get first dibs at it. So they'd already phoning their friends. So we've got, you know, there's ripple effects out from over a hundred people internally. You know, I think just having that, that's been a game changer. >> I was so looking forward to interviewing you, Lena, thanks so much for coming. >> Thank you, this was a pleasure. >> It was really great to have you. >> Thank you so much. Thank you. >> You're really welcome. All right, keep it right there. This is Dave Villante for theCUBE. We'll be right back at AWS Re:inforce22 right after this short break.

hi everybody welcome back to boston you're watching thecube's coverage of reinforce 2022 last time we were here live was 2019. had a couple years of virtual merit bear is here she's with the office of the cso for aws merit welcome back to the cube good to see you thank you for coming on thank you so much it's good to be back um yes cso chief information security officer for folks who are acronym phobia phobic yeah okay so what do you do for the office of the is it ciso or sizzo anyway ah whatever is it sim or theme um i i work in three areas so i sit in aws security and i help us do security we're a shop that runs on aws i empathize with folks who are running shops it is process driven it takes hard work but we believe in certain mechanisms and muscle groups so you know i work on getting those better everything from how we do threat intelligence to how we guard rail employees and think about vending accounts and those kinds of things i also work in customer-facing interactions so when a cso wants to meet awssc so that's often me and then the third is product side so ensuring that everything we deliver not just security services are aligned with security best practices and expectations for our customers so i have to ask you right off the bat so we do a lot of spending surveys we have a partner etr i look at the data all the time and for some reason aws never shows up in the spending metrics why do you think that is maybe that talks to your strategy let's double click on that yeah so first of all um turn on guard duty get shield advanced for the you know accounts you need the 3k is relatively small and a large enterprise event like this doesn't mean don't spend on security there is a lot of goodness that we have to offer in ess external security services but i think one of the unique parts of aws is that we don't believe that security is something you should buy it's something that you get from us it's something that we do for you a lot of the time i mean this is the definition of the shared responsibility model right everything that you interact with on aws has been subject to the same rigorous standards and we aws security have umbrella arms around those but we also ensure that service teams own the security of their service so a lot of times when i'm talking to csos and i say security teams or sorry service teams own the security of their service they're curious like how do they not get frustrated and the answer is we put in a lot of mechanisms to allow those to go through so there's automation there are robots that resolve those trouble tickets you know like and we have emissaries we call them guardian champions that are embedded in service teams at any rate the point is i think it's really beautiful the way that customers who are you know enabling services in general benefit from the inheritances that they get and in some definition this is like the value proposition of cloud when we take care of those lower layers of the stack we're doing everything from the concrete floors guards and gates hvac you know in the case of something like aws bracket which is our quantum computing like we're talking about you know near vacuum uh environments like these are sometimes really intricate and beautiful ways that we take care of stuff that was otherwise manual and ugly and then we get up and we get really intricate there too so i gave a talk this morning about ddos protection um and all the stuff that we're doing where we can see because of our vantage point the volume and that leads us to be a leader in volumetric attack signatures for example manage rule sets like that costs you nothing turn on your dns firewall like there are ways that you just as a as an aws customer you inherit our rigorous standards and you also are able to benefit from the rigor with which we you know exact ourselves to really you're not trying to make it a huge business at least as part of your your portfolio it's just it's embedded it's there take advantage of it i want everyone to be secure and i will go to bad to say like i want you to do it and if money is a blocker let's talk about that because honestly we just want to do the right thing by customers and i want customers to use more of our services i genuinely believe that they are enablers we have pharma companies um that have helped enable you know personalized medicine and some of the copic vaccines we have you know like there are ways that this has mattered to people in really intimate ways um and then fun ways like formula one uh you know like there are things that allow us to do more and our customers to do more and security should be a way of life it's a way of breathing you don't wake up and decide that you're going to bolt it on one day okay so we heard cj moses keynote this morning i presume you were listening in uh we heard a lot about you know cool tools you know threat detection and devops and container security but he did explicitly talked about how aws is simplifying the life of the cso so what are you doing in that regard and what's that that's let's just leave it there for now i talk to c sales every day and i think um most of them have two main concerns one is how to get their organization to grow up like to understand what security looks like in a cloudy way um and that means that you know your login monitoring is going to be the forensics it's not going to be getting into the host that's on our side right and that's a luxury like i think there are elements of the cso job that have changed but that even if you know cj didn't explicitly call them out these are beauties things like um least privilege that you can accomplish using access analyzer and all these ways that inspector for example does network reachability and then all of these get piped to security hub and there's just ways that make it more accessible than ever to be a cso and to enable and embolden your people the second side is how csos are thinking about changing their organization so what are you reporting to the board um how are you thinking about hiring and um in the metrics side i would say you know being and i get a a lot of questions that are like how do we exhibit a culture of security and my answer is you do it you just start doing it like you make it so that your vps have to answer trouble tickets you may and and i don't mean literally like every trouble ticket but i mean they are 100 executives will say that they care about security but so what like you know set up your organization to be responsive to security and to um have to answer to them because it matters and and notice that because a non-decision is a decision and the other side is workforce right and i think um i see a lot of promise some of it unfulfilled in folks being hired to look different than traditional security folks and act different and maybe a first grade teacher or an architect or an artist and who don't consider themselves like particularly technical like the gorgeousness of cloud is that you can one teach yourself this i mean i didn't go to school for computer science like this is the kind of thing we all have to teach ourselves but also you can abstract on top of stuff so you're not writing code every day necessarily although if you are that's awesome and we love debbie folks but you know there's there's a lot of ways in which the machine of the security organization is suggesting i think cj was part to answer your question pointedly i think cj was trying to be really responsive to like all the stuff we're giving you all the goodness all the sprinkles on your cupcake not at all the organizational stuff that is kind of like you know the good stuff that we know we need to get into so i think so you're saying it's it's inherent it's inherently helping the cso uh her life his life become less complex and i feel like the cloud you said the customers are trying to become make their security more cloudy so i feel like the cloud has become the first line of defense now the cso your customer see so is the second line of defense maybe the audit is the third line what does that mean for the role of the the cso how is that they become a compliance officer what does that mean no no i think actually increasingly they are married or marriable so um when you're doing so for example if you are embracing [Music] ephemeral and immutable infrastructure then we're talking about using something like cloud formation or terraform to vend environments and you know being able to um use control tower and aws organizations to dictate um truisms through your environment you know like there are ways that you are basically in golden armies and you can come back to a known good state you can embrace that kind of cloudiness that allows you to get good to refine it to kill it and spin up a new infrastructure and that means though that like your i.t and your security will be woven in in a really um lovely way but in a way that contradicts certain like existing structures and i think one of the beauties is that your compliance can then wake up with it right your audit manager and your you know security hub and other folks that do compliance as code so you know inspector for example has a tooling that can without sending a single packet over the network do network reachability so they can tell whether you have an internet facing endpoint well that's a pci standard you know but that's also a security truism you shouldn't have internet facing endpoints you don't approve up you know like so these are i think these can go in hand in hand there are certainly i i don't know that i totally disregard like a defense in-depth notion but i don't think that it's linear in that way i think it's like circular that we hope that these mechanisms work together that we also know that they should speak to each other and and be augmented and aware of one another so an example of this would be that we don't just do perimeter detection we do identity-based fine-grained controls and that those are listening to and reasoned about using tooling that we can do using security yeah we heard a lot about reasoning as well in the keynote but i want to ask about zero trust like aws i think resisted using that term you know the industry was a buzzword before the pandemic it's probably more buzzy now although in a way it's a mandate um depending on how you look at it so i mean you anything that's not explicitly allowed is denied in your world and you have tools and i mean that's a definition if it's a die that overrides if it's another it's a deny call that will override and allow yeah that's true although anyway finish your question yeah yeah so so my it's like if there's if there's doubt there's no doubt it seems in your world but but but you have a lot of capabilities seems to me that this is how you you apply aws internal security and bring that to your customers do customers talk to you about zero trust are they trying to implement zero trust what's the best way for them to do that when they don't have that they have a lack of talent they don't have the skill sets uh that it and the knowledge that aws has what are you hearing from customers in that regard yeah that's a really um nuanced phrasing which i appreciate because i think so i think you're right zero trust is a term that like means everything and nothing i mean like this this notebook is zero trust like no internet comes in or out of it like congratulations you also can't do business on it right um i do a lot of business online you know what i mean like you can't uh transact something to other folks and if i lose it i'm screwed yeah exactly i usually have a water bottle or something that's even more inanimate than your notebook um but i guess my point is we i don't think that the term zero trust is a truism i think it's a conceptual framework right and the idea is that we want to make it so that someone's position in the network is agnostic to their permissioning so whereas in the olden days like a decade ago um we might have assumed that when you're in the perimeter you just accept everything um that's no longer the right way to think about it and frankly like covid and work from home may have accelerated this but this was ripe to be accelerated anyway um what we are thinking about is both like you said under the network so like the network layer are we talking about machine to machine are we talking about like um you know every api call goes over the open internet with no inherent assurances human to app or it's protected by sig v4 you know like there is an inherent zero trust case that we have always built this goes back to a jeff bezos mandate from 2002 that everything be an api call that is again this kind of like building security into it when we say security is job zero it not only reflects the fact that like when you build a terraform or a cloud formation template you better have permission things appropriately or try to but also that like there is no cloud without security considerations you don't get to just bolt something on after the fact so that being said now that we embrace that and we can reason about it and we can use tools like access analyzer you know we're also talking about zero trust in that like i said augmentation identity centric fine grained controls so an example of this would be a vpc endpoint policy where it is a perm the perimeter is dead long live the perimeter right you'll have your traditional perimeter your vpc or your vpn um augmented by and aware of the fine-grained identity-centric ones which you can also reason about prune down continuously monitor and so on and that'll also help you with your logging and monitoring because you know what your ingress and egress points are how concerned should people be with quantum messing up all the encryption algos oh it's stopping created right okay so but we heard about this in the keynote right so is it just a quantum so far off by the time we get there is it like a y2k you're probably not old enough to remember y2k but y2k moment right i mean i can't take you anywhere what should we um how should we be thinking about quantum in the context of security and sure yeah i mean i think we should be thinking about quantum and a lot of dimensions as operationally interesting and how we can leverage i think we should be thinking about it in the security future for right now aes256 is something that is not broken so we shouldn't try to fix it yeah cool encrypt all the things you can do it natively you know like i love talking about quantum but it's more of an aspirational and also like we can be doing high power compute to solve problems you know but like for it to get to a security uh potentially uh vulnerable state or like something that we should worry about is a bit off yeah and show me an application that can yeah and i mean and i think at that point we're talking about homomorphic improvements about another thing i kind of feel the same way is that you know there's a lot of hype around it a lot of ibm talks about a lot you guys talked about in your keynote today and when i really talk to people who understand this stuff it seems like it's a long long way off i don't think it's a long long way off but everything is dog years in tech world but um but for today you know like for today encrypt yourself we will always keep our encryption up to standard and you know that will be for now like the the industry grade standard that folks i mean like i i have i have never heard of a case where someone had their kms keys broken into i um i always ask like awesome security people this question did you like how did you get into this did you have like did you have a favorite superhero as a kid that was going to save the world i um was always the kid who probably would have picked up a book about the cia and i like find this and i don't remember who i was before i was a security person um but i also think that as a woman um from an american indian family walking through the world i think about the relationship between dynamics with the government and companies and individuals and how we want to construct those and the need for voices that are observant of the ways that those interplay and i always saw this as a field where we can do a lot of good yeah amazing merritt thanks so much for coming on thecube great guest john said you would be really appreciate your time of course all right keep it ready you're very welcome keep it right there this is dave vellante for the cube we'll be right back at aws reinforced 2022 from boston keep right there [Music]

>>Hello, everyone. Welcome to the Cube's live coverage here in Boston, Massachusetts for AWS reinforce 2022. I'm John fur, host of the cube with Dave. Valante my co-host for breaking analysis, famous podcast, Dave, great to see you. Um, Beck in Boston, 2010, we started >>The queue. It all started right here in this building. John, >>12 years ago, we started here, but here, you know, just 12 years, it just seems like a marathon with the queue. Over the years, we've seen many ways. You call yourself a historian, which you are. We are both now, historians security is doing over. And we said in 2013 is security to do where we asked pat GSK. Now the CEO of Intel prior to that, he was the CEO of VMware. This is the security show fors. It's called the reinforce. They have reinvent, which is their big show. Now they have these, what they call reshow, re Mars, machine learning, automation, um, robotics and space. And then they got reinforced, which is security. It's all about security in the cloud. So great show. Lot of talk about the keynotes were, um, pretty, I wouldn't say generic on one hand, but specific in the other clear AWS posture, we were both watching. What's your take? >>Well, John, actually looking back to may of 2010, when we started the cube at EMC world, and that was the beginning of this massive boom run, uh, which, you know, finally, we're starting to see some, some cracks of the armor. Of course, we're threats of recession. We're in a recession, most likely, uh, in inflationary pressures, interest rate hikes. And so, you know, finally the tech market has chilled out a little bit and you have this case before we get into the security piece of is the glass half full or half empty. So budgets coming into this year, it was expected. They would grow at a very robust eight point half percent CIOs have tuned that down, but it's still pretty strong at around 6%. And one of the areas that they really have no choice, but to focus on is security. They moved everything into the cloud or a lot of stuff into the cloud. >>They had to deal with remote work and that created a lot of security vulnerabilities. And they're still trying to figure that out and plug the holes with the lack of talent that they have. So it's interesting re the first reinforc that we did, which was also here in 2019, Steven Schmidt, who at the time was chief information security officer at Amazon web services said the state of cloud security is really strong. All this narrative, like the pat Gelsinger narrative securities, a do over, which you just mentioned, security is broken. It doesn't help the industry. The state of cloud security is very strong. If you follow the prescription. Well, see, now Steven Schmidt, as you know, is now chief security officer at Amazon. So we followed >>Jesse all Amazon, not just AWS. So >>He followed Jesse over and I asked him, well, why no, I, and they said, well, he's responsible now for physical security. Presumably the warehouses I'm like, well, wait a minute. What about the data centers? Who's responsible for that? So it's kind of funny, CJ. Moses is now the CSO at AWS and you know, these events are, are good. They're growing. And it's all about best practices, how to apply the practices. A lot of recommendations from, from AWS, a lot of tooling and really an ecosystem because let's face it. Amazon doesn't have the breadth and depth of tools to do it alone. >>And also the attendance is interesting, cuz we are just in New York city for the, uh, ado summit, 19,000 people, massive numbers, certainly in the pandemic. That's probably one of the top end shows and it was a summit. This is a different audience. It's security. It's really nerdy. You got OT, you got cloud. You've got on-prem. So now you have cloud operations. We're calling super cloud. Of course we're having our inaugural pilot event on August 9th, check it out. We're called super cloud, go to the cube.net to check it out. But this is the super cloud model evolving with security. And what you're hearing today, Dave, I wanna get your reaction to this is things like we've got billions of observational points. We're certainly there's no perimeter, right? So the perimeter's dead. The new perimeter, if you will, is every transaction at scale. So you have to have a new model. So security posture needs to be rethought. They actually said that directly on the keynote. So security, although numbers aren't as big as last week or two weeks ago in New York still relevant. So alright. There's sessions here. There's networking. Very interesting demographic, long hair. Lot of >>T-shirts >>No lot of, not a lot of nerds doing to build out things over there. So, so I gotta ask you, what's your reaction to this scale as the new advantage? Is that a tailwind or a headwind? What's your read? >>Well, it is amazing. I mean he actually, Steven Schmidt talked about quadrillions of events every month, quadrillions 15 zeros. What surprised me, John. So they, they, Amazon talks about five areas, but by the, by the way, at the event, they got five tracks in 125 sessions, data protection and privacy, GRC governance, risk and compliance, identity network security and threat detection. I was really surprised given the focus on developers, they didn't call out container security. I would've thought that would be sort of a separate area of focus, but to your point about scale, it's true. Amazon has a scale where they'll see events every day or every month that you might not see in a generation if you just kind of running your own data center. So I do think that's, that's, that's, that's a, a, a, a valid statement having said that Amazon's got a limited capability in terms of security. That's why they have to rely on the ecosystem. Now it's all about APIs connecting in and APIs are one of the biggest security vulnerability. So that's kind of, I, I I'm having trouble squaring that circle. >>Well, they did just to come up, bring back to the whole open source and software. They did say they did make a measurement was store, but at the beginning, Schmidt did say that, you know, besides scale being an advantage for Amazon with a quadri in 15 zeros, don't bolt on security. So that's a classic old school. We've heard that before, right. But he said specifically, weave in security in the dev cycles. And the C I C D pipeline that is, that basically means shift left. So sneak is here, uh, company we've covered. Um, and they, their whole thing is shift left. That implies Docker containers that implies Kubernetes. Um, but this is not a cloud native show per se. It's much more crypto crypto. You heard about, you know, the, uh, encrypt everything message on the keynote. You heard, um, about reasoning, quantum, quantum >>Skating to the puck. >>Yeah. So yeah, so, you know, although the middleman is logged for J heard that little little mention, I love the quote from Lewis Hamilton that they put up on stage CJ, Moses said, team behind the scenes make it happen. So a big emphasis on teamwork, big emphasis on don't bolt on security, have it in the beginning. We've heard that before a lot of threat modeling discussions, uh, and then really this, you know, the news around the cloud audit academy. So clearly skills gap, more threats, more use cases happening than ever before. >>Yeah. And you know, to your point about, you know, the teamwork, I think the problem that CISOs have is they just don't have the talent to that. AWS has. So they have a real difficulty applying that talent. And so but's saying, well, join us at these shows. We'll kind of show you how to do it, how we do it internally. And again, I think when you look out on this ecosystem, there's still like thousands and thousands of tools that practitioners have to apply every time. There's a tool, there's a separate set of skills to really understand that tool, even within AWS's portfolio. So this notion of a shared responsibility model, Amazon takes care of, you know, securing for instance, the physical nature of S3 you're responsible for secure, make sure you're the, the S3 bucket doesn't have public access. So that shared responsibility model is still very important. And I think practitioners still struggling with all this complexity in this matrix of tools. >>So they had the layered defense. So, so just a review opening keynote with Steve Schmidt, the new CSO, he talked about weaving insecurity in the dev cycles shift left, which is the, I don't bolt it on keep in the beginning. Uh, the lessons learned, he talked a lot about over permissive creates chaos, um, and that you gotta really look at who has access to what and why big learnings there. And he brought up the use cases. The more use cases are coming on than ever before. Um, layered defense strategy was his core theme, Dave. And that was interesting. And he also said specifically, no, don't rely on single security control, use multiple layers, stronger together. Be it it from the beginning, basically that was the whole ethos, the posture, he laid that down >>And he had a great quote on that. He said, I'm sorry to interrupt single controls. And binary states will fail guaranteed. >>Yeah, that's a guarantee that was basically like, that's his, that's not a best practice. That's a mandate. <laugh> um, and then CJ, Moses, who was his deputy in the past now takes over a CSO, um, ownership across teams, ransomware mitigation, air gaping, all that kind of in the weeds kind of security stuff. You want to check the boxes on. And I thought he did a good job. Right. And he did the news. He's the new CISO. Okay. Then you had lean is smart from Mongo DB. Come on. Yeah. Um, she was interesting. I liked her talk, obviously. Mongo is one of the ecosystem partners headlining game. How do you read into that? >>Well, I, I I'm, its really interesting. Right? You didn't see snowflake up there. Right? You see data breaks up there. You had Mongo up there and I'm curious is her and she's coming on the cube tomorrow is her primary role sort of securing Mongo internally? Is it, is it securing the Mongo that's running across clouds. She's obviously here talking about AWS. So what I make of it is, you know, that's, it's a really critical partner. That's driving a lot of business for AWS, but at the same time it's data, they talked about data security being one of the key areas that you have to worry about and that's, you know what Mongo does. So I'm really excited. I talked to her >>Tomorrow. I, I did like her mention a big idea, a cube alumni, yeah. Company. They were part of our, um, season one of our eight of us startup showcase, check out AWS startups.com. If you're watching this, we've been doing now, we're in season two, we're featuring the fastest growing hottest startups in the ecosystem. Not the big players, that's ISVs more of the startups. They were mentioned. They have a great product. So I like to mention a big ID. Um, security hub mentioned a config. They're clearly a big customer and they have user base, a lot of E C, two and storage going on. People are building on Mongo so I can see why they're in there. The question I want to ask you is, is Mongo's new stuff in line with all the upgrades in the Silicon. So you got graviton, which has got great stuff. Um, great performance. Do you see that, that being a key part of things >>Well, specifically graviton. So I I'll tell you this. I'll tell you what I know when you look at like snowflake, for instance, is optimizing for graviton. For certain workloads, they actually talked about it on their earnings call, how it's lowered the cost for customers and actually hurt their revenue. You know, they still had great revenue, but it hurt their revenue. My sources indicate to me that that, that Mongo is not getting as much outta graviton two, but they're waiting for graviton three. Now they don't want to make that widely known because they don't wanna dis AWS. But it's, it's probably because Mongo's more focused on analytics. But so to me, graviton is the future. It's lower cost. >>Yeah. Nobody turns off the database. >>Nobody turns off the database. >><laugh>, it's always cranking C two cycles. You >>Know the other thing I wanted to bring, bring up, I thought we'd hear, hear more about ransomware. We heard a little bit of from Kirk Coel and he, and he talked about all these things you could do to mitigate ransomware. He didn't talk about air gaps and that's all you hear is how air gap. David Flo talks about this all the time. You must have air gaps. If you wanna, you know, cover yourself against ransomware. And they didn't even mention that. Now, maybe we'll hear that from the ecosystem. That was kind of surprising. Then I, I saw you made a note in our shared doc about encryption, cuz I think all the talk here is encryption at rest. What about data in motion? >>Well, this, this is the last guy that came on the keynote. He brought up encryption, Kurt, uh, Goel, which I love by the way he's VP of platform. I like his mojo. He's got the long hair >>And he's >>Geeking out swagger, but I, he hit on some really cool stuff. This idea of the reasoning, right? He automated reasoning is little pet project that is like killer AI. That's next generation. Next level >>Stuff. Explain that. >>So machine learning does all kinds of things, you know, goes to sit pattern, supervise, unsupervised automate stuff, but true reasoning. Like no one connecting the dots with software. That's like true AI, right? That's really hard. Like in word association, knowing how things are connected, looking at pattern and deducing things. So you predictive analytics, we all know comes from great machine learning. But when you start getting into deduction, when you say, Hey, that EC two cluster never should be on the same VPC, is this, this one? Why is this packet trying to go there? You can see patterns beyond normal observation space. So if you have a large observation space like AWS, you can really put some killer computer science technology on this. And that's where this reasoning is. It's next level stuff you don't hear about it because nobody does it. Yes. I mean, Google does it with metadata. There's meta meta reasoning. Um, we've been, I've been watching this for over two decades now. It's it's a part of AI that no one's tapped and if they get it right, this is gonna be a killer part of the automation. So >>He talked about this, basically it being advanced math that gets you to provable security, like you gave an example. Another example I gave is, is this S3 bucket open to the public is a, at that access UN restricted or unrestricted, can anyone access my KMS keys? So, and you can prove, yeah. The answer to that question using advanced math and automated reasoning. Yeah, exactly. That's a huge leap because you used to be use math, but you didn't have the data, the observation space and the compute power to be able to do it in near real time or real time. >>It's like, it's like when someone, if in the physical world real life in real life, you say, Hey, that person doesn't belong here. Or you, you can look at something saying that doesn't fit <laugh> >>Yeah. Yeah. >>So you go, okay, you observe it and you, you take measures on it or you query that person and say, why you here? Oh, okay. You're here. It doesn't fit. Right. Think about the way on the right clothes, the right look, whatever you kind of have that data. That's deducing that and getting that information. That's what reasoning is. It's it's really a killer level. And you know, there's encrypt, everything has to be data. Lin has to be data in at movement at rest is one thing, but you gotta get data in flight. Dave, this is a huge problem. And making that work is a key >>Issue. The other thing that Kirk Coel talked about was, was quantum, uh, quantum proof algorithms, because basically he put up a quote, you're a hockey guy, Wayne Greski. He said the greatest hockey player ever. Do you agree? I do agree. Okay, great. >>Bobby or, and Wayne Greski. >>Yeah, but okay, so we'll give the nada Greski, but I always skate to the where the puck is gonna be not to where it's been. And basically his point was where skating to where quantum is going, because quantum, it brings risks to basically blow away all the existing crypto cryptographic algorithms. I, I, my understanding is N just came up with new algorithms. I wasn't clear if those were supposed to be quantum proof, but I think they are, and AWS is testing them. And AWS is coming out with, you know, some test to see if quantum can break these new algos. So that's huge. The question is interoperability. Yeah. How is it gonna interact with all the existing algorithms and all the tools that are out there today? So I think we're a long way off from solving that problem. >>Well, that was one of Kurt's big point. You talking about quantum resistant cryptography and they introduce hybrid post quantum key agreements. That means KMS cert certification, cert manager and manager all can manage the keys. This was something that's gives more flexibility on, on, on that quantum resistance argument. I gotta dig into it. I really don't know how it works, what he meant by that in terms of what does that hybrid actually mean? I think what it means is multi mode and uh, key management, but we'll see. >>So I come back to the ho the macro for a second. We've got consumer spending under pressure. Walmart just announced, not great earning. Shouldn't be a surprise to anybody. We have Amazon meta and alphabet announcing this weekend. I think Microsoft. Yep. So everybody's on edge, you know, is this gonna ripple through now? The flip side of that is BEC because the economy yeah. Is, is maybe not in, not such great shape. People are saying maybe the fed is not gonna raise after September. Yeah. So that's, so that's why we come back to this half full half empty. How does that relate to cyber security? Well, people are prioritizing cybersecurity, but it's not an unlimited budget. So they may have to steal from other places. >>It's a double whammy. Dave, it's a double whammy on the spend side and also the macroeconomic. So, okay. We're gonna have a, a recession that's predicted the issue >>On, so that's bad on the one hand, but it's good from a standpoint of not raising interest rates, >>It's one of the double whammy. It was one, it's one of the double whammy and we're talking about here, but as we sit on the cube two weeks ago at <inaudible> summit in New York, and we did at re Mars, this is the first recession where the cloud computing hyperscale is, are pumping full cylinder, all cylinders. So there's a new economic engine called cloud computing that's in place. So unlike data center purchase in the past, that was CapEx. When, when spending was hit, they pause was a complete shutdown. Then a reboot cloud computer. You can pause spending for a little bit, make, might make the cycle longer in sales, but it's gonna be quickly fast turned on. So, so turning off spending with cloud is not that hard to do. You can hit pause and like check things out and then turn it back on again. So that's just general cloud economics with security though. I don't see the spending slowing down. Maybe the sales cycles might go longer, but there's no spending slow down in my mind that I see. And if there's any pause, it's more of refactoring, whether it's the crypto stuff or new things that Amazon has. >>So, so that's interesting. So a couple things there. I do think you're seeing a slight slow down in the, the, the ex the velocity of the spend. When you look at the leaders in spending velocity in ETR data, CrowdStrike, Okta, Zscaler, Palo Alto networks, they're all showing a slight deceleration in spending momentum, but still highly elevated. Yeah. Okay. So, so that's a, I think now to your other point, really interesting. What you're saying is cloud spending is discretionary. That's one of the advantages. I can dial it down, but track me if I'm wrong. But most of the cloud spending is with reserved instances. So ultimately you're buying those reserved instances and you have to spend over a period of time. So they're ultimately AWS is gonna see that revenue. They just might not see it for this one quarter. As people pull back a little bit, right. >>It might lag a little bit. So it might, you might not see it for a quarter or two, so it's impact, but it's not as severe. So the dialing up, that's a key indicator get, I think I'm gonna watch that because that's gonna be something that we've never seen before. So what's that reserve now the wild card and all this and the dark horse new services. So there's other services besides the classic AC two, but security and others. There's new things coming out. So to me, this is absolutely why we've been saying super cloud is a thing because what's going on right now in security and cloud native is there's net new functionality that needs to be in place to handle multiple clouds, multiple abstraction layers, and to do all these super cloudlike capabilities like Mike MongoDB, like these vendors, they need to up their gain. And that we're gonna see new cloud native services that haven't exist. Yeah. I'll use some hatchy Corp here. I'll use something over here. I got some VMware, I got this, but there's gaps. Dave, there'll be gaps that are gonna emerge. And I think that's gonna be a huge wild >>Cup. And now I wanna bring something up on the super cloud event. So you think about the layers I, as, uh, PAs and, and SAS, and we see super cloud permeating, all those somebody ask you, well, because we have Intuit coming on. Yep. If somebody asks, why Intuit in super cloud, here's why. So we talked about cloud being discretionary. You can dial it down. We saw that with snowflake sort of Mongo, you know, similarly you can, if you want dial it down, although transaction databases are to do, but SAS, the SAS model is you pay for it every month. Okay? So I've, I've contended that the SAS model is not customer friendly. It's not cloudlike and it's broken for customers. And I think it's in this decade, it's gonna get fixed. And people are gonna say, look, we're gonna move SAS into a consumption model. That's more customer friendly. And that's something that we're >>Gonna explore in the super cloud event. Yeah. And one more thing too, on the spend, the other wild card is okay. If we believe super cloud, which we just explained, um, if you don't come to the August 9th event, watch the debate happen. But as the spending gets paused, the only reason why spending will be paused in security is the replatforming of moving from tools to platforms. So one of the indicators that we're seeing with super cloud is a flight to best of breeds on platforms, meaning hyperscale. So on Amazon web services, there's a best of breed set of services from AWS and the ecosystem on Azure. They have a few goodies there and customers are making a choice to use Azure for certain things. If they, if they have teams or whatever or office, and they run all their dev on AWS. So that's kind of what's happened. So that's, multi-cloud by our definition is customers two clouds. That's not multi-cloud, as in things are moving around. Now, if you start getting data planes in there, these customers want platforms. If I'm a cybersecurity CSO, I'm moving to platforms, not just tools. So, so maybe CrowdStrike might have it dial down, but a little bit, but they're turning into a platform. Splunk trying to be a platform. Okta is platform. Everybody's scale is a platform. It's a platform war right now, Dave cyber, >>A right paying identity. They're all plat platform, beach products. We've talked about that a lot in the queue. >>Yeah. Well, great stuff, Dave, let's get going. We've got two days alive coverage. Here is a cubes at, in Boston for reinforc 22. I'm Shante. We're back with our guests coming on the queue at the short break.