(upbeat music) >> Hey guys, welcome back to the show floor of KubeCon + CloudNativeCon '22 North America from Detroit, Michigan. Lisa Martin here with John Furrier. This is day one, John at theCUBE's coverage. >> CUBE's coverage. >> theCUBE's coverage of KubeCon. Try saying that five times fast. Day one, we have three wall-to-wall days. We've been talking about Kubernetes, containers, adoption, cloud adoption, app modernization all morning. We can't talk about those things without addressing security. >> Yeah, this segment we're going to hear container and Kubernetes security for modern application 'cause the enterprise are moving there. And this segment with Red Hat's going to be important because they are the leader in the enterprise when it comes to open source in Linux. So this is going to be a very fun segment. >> Very fun segment. Two guests from Red Hat join us. Please welcome Doron Caspin, Senior Principal Product Manager at Red Hat. Michael Foster joins us as well, Principal Product Marketing Manager and StackRox Community Lead at Red Hat. Guys, great to have you on the program. >> Thanks for having us. >> Thank you for having us. >> It's awesome. So Michael StackRox acquisition's been about a year. You got some news? >> Yeah, 18 months. >> Unpack that for us. >> It's been 18 months, yeah. So StackRox in 2017, originally we shifted to be the Kubernetes-native security platform. That was our goal, that was our vision. Red Hat obviously saw a lot of powerful, let's say, mission statement in that, and they bought us in 2021. Pre-acquisition we were looking to create a cloud service. Originally we ran on Kubernetes platforms, we had an operator and things like that. Now we are looking to basically bring customers in into our service preview for ACS as a cloud service. That's very exciting. Security conversation is top notch right now. It's an all time high. You can't go with anywhere without talking about security. And specifically in the code, we were talking before we came on camera, the software supply chain is real. It's not just about verification. Where do you guys see the challenges right now? Containers having, even scanning them is not good enough. First of all, you got to scan them and that may not be good enough. Where's the security challenges and where's the opportunity? >> I think a little bit of it is a new way of thinking. The speed of security is actually does make you secure. We want to keep our images up and fresh and updated and we also want to make sure that we're keeping the open source and the different images that we're bringing in secure. Doron, I know you have some things to say about that too. He's been working tirelessly on the cloud service. >> Yeah, I think that one thing, you need to trust your sources. Even if in the open source world, you don't want to copy paste libraries from the web. And most of our customers using third party vendors and getting images from different location, we need to trust our sources and we have a really good, even if you have really good scanning solution, you not always can trust it. You need to have a good solution for that. >> And you guys are having news, you're announcing the Red Hat Advanced Cluster Security Cloud Service. >> Yes. >> What is that? >> So we took StackRox and we took the opportunity to make it as a cloud services so customer can consume the product as a cloud services as a start offering and customer can buy it through for Amazon Marketplace and in the future Azure Marketplace. So customer can use it for the AKS and EKS and AKS and also of course OpenShift. So we are not specifically for OpenShift. We're not just OpenShift. We also provide support for EKS and AKS. So we provided the capability to secure the whole cloud posture. We know customer are not only OpenShift or not only EKS. We have both. We have free cloud or full cloud. So we have open. >> So it's not just OpenShift, it's Kubernetes, environments, all together. >> Doron: All together, yeah. >> Lisa: Meeting customers where they are. >> Yeah, exactly. And we focus on, we are not trying to boil the ocean or solve the whole cloud security posture. We try to solve the Kubernetes security cluster. It's very unique and very need unique solution for that. It's not just added value in our cloud security solution. We think it's something special for Kubernetes and this is what Red that is aiming to. To solve this issue. >> And the ACS platform really doesn't change at all. It's just how they're consuming it. It's a lot quicker in the cloud. Time to value is right there. As soon as you start up a Kubernetes cluster, you can get started with ACS cloud service and get going really quickly. >> I'm going to ask you guys a very simple question, but I heard it in the bar in the lobby last night. Practitioners talking and they were excited about the Red Hat opportunity. They actually asked a question, where do I go and get some free Red Hat to test some Kubernetes out and run helm or whatever. They want to play around. And do you guys have a program for someone to get start for free? >> Yeah, so the cloud service specifically, we're going to service preview. So if people sign up, they'll be able to test it out and give us feedback. That's what we're looking for. >> John: Is that a Sandbox or is that going to be in the cloud? >> They can run it in their own environment. So they can sign up. >> John: Free. >> Doron: Yeah, free. >> For the service preview. All we're asking for is for customer feedback. And I know it's actually getting busy there. It's starting December. So the quicker people are, the better. >> So my friend at the lobby I was talking to, I told you it was free. I gave you the sandbox, but check out your cloud too. >> And we also have the open source version so you can download it and use it. >> Yeah, people want to know how to get involved. I'm getting a lot more folks coming to Red Hat from the open source side that want to get their feet wet. That's been a lot of people rarely interested. That's a real testament to the product leadership. Congratulations. >> Yeah, thank you. >> So what are the key challenges that you have on your roadmap right now? You got the products out there, what's the current stake? Can you scope the adoption? Can you share where we're at? What people are doing specifically and the real challenges? >> I think one of the biggest challenges is talking with customers with a slightly, I don't want to say outdated, but an older approach to security. You hear things like malware pop up and it's like, well, really what we should be doing is keeping things into low and medium vulnerabilities, looking at the configuration, managing risk accordingly. Having disparate security tools or different teams doing various things, it's really hard to get a security picture of what's going on in the cluster. That's some of the biggest challenges that we talk with customers about. >> And in terms of resolving those challenges, you mentioned malware, we talk about ransomware. It's a household word these days. It's no longer, are we going to get hit? It's when? It's what's the severity? It's how often? How are you guys helping customers to dial down some of the risk that's inherent and only growing these days? >> Yeah, risk, it's a tough word to generalize, but our whole goal is to give you as much security information in a way that's consumable so that you can evaluate your risk, set policies, and then enforce them early on in the cluster or early on in the development pipeline so that your developers get the security information they need, hopefully asynchronously. That's the best way to do it. It's nice and quick, but yeah. I don't know if Doron you want to add to that? >> Yeah, so I think, yeah, we know that ransomware, again, it's a big world for everyone and we understand the area of the boundaries where we want to, what we want to protect. And we think it's about policies and where we enforce it. So, and if you can enforce it on, we know that as we discussed before that you can scan the image, but we never know what is in it until you really run it. So one of the thing that we we provide is runtime scanning. So you can scan and you can have policy in runtime. So enforce things in runtime. But even if one image got in a way and get to your cluster and run on somewhere, we can stop it in runtime. >> Yeah. And even with the runtime enforcement, the biggest thing we have to educate customers on is that's the last-ditch effort. We want to get these security controls as early as possible. That's where the value's going to be. So we don't want to be blocking things from getting to staging six weeks after developers have been working on a project. >> I want to get you guys thoughts on developer productivity. Had Docker CEO on earlier and since then I had a couple people messaging me. Love the vision of Docker, but Docker Hub has some legacy and it might not, has does something kind of adoption that some people think it does. Are people moving 'cause there times they want to have these their own places? No one place or maybe there is, or how do you guys see the movement of say Docker Hub to just using containers? I don't need to be Docker Hub. What's the vis-a-vis competition? >> I mean working with open source with Red Hat, you have to meet the developers where they are. If your tool isn't cutting it for developers, they're going to find a new tool and really they're the engine, the growth engine of a lot of these technologies. So again, if Docker, I don't want to speak about Docker or what they're doing specifically, but I know that they pretty much kicked off the container revolution and got this whole thing started. >> A lot of people are using your environment too. We're hearing a lot of uptake on the Red Hat side too. So, this is open source help, it all sorts stuff out in the end, like you said, but you guys are getting a lot of traction there. Can you share what's happening there? >> I think one of the biggest things from a developer experience that I've seen is the universal base image that people are using. I can speak from a security standpoint, it's awesome that you have a base image where you can make one change or one issue and it can impact a lot of different applications. That's one of the big benefits that I see in adoption. >> What are some of the business, I'm curious what some of the business outcomes are. You talked about faster time to value obviously being able to get security shifted left and from a control perspective. but what are some of the, if I'm a business, if I'm a telco or a healthcare organization or a financial organization, what are some of the top line benefits that this can bubble up to impact? >> I mean for me, with those two providers, compliance is a massive one. And just having an overall look at what's going on in your clusters, in your environments so that when audit time comes, you're prepared. You can get through that extremely quickly. And then as well, when something inevitably does happen, you can get a good image of all of like, let's say a Log4Shell happens, you know exactly what clusters are affected. The triage time is a lot quicker. Developers can get back to developing and then yeah, you can get through it. >> One thing that we see that customers compliance is huge. >> Yes. And we don't want to, the old way was that, okay, I will provision a cluster and I will do scans and find things, but I need to do for PCI DSS for example. Today the customer want to provision in advance a PCI DSS cluster. So you need to do the compliance before you provision the cluster and make all the configuration already baked for PCI DSS or HIPAA compliance or FedRAMP. And this is where we try to use our compliance, we have tools for compliance today on OpenShift and other clusters and other distribution, but you can do this in advance before you even provision the cluster. And we also have tools to enforce it after that, after your provision, but you have to do it again before and after to make it more feasible. >> Advanced cluster management and the compliance operator really help with that. That's why OpenShift Platform Plus as a bundle is so popular. Just being able to know that when a cluster gets provision, it's going to be in compliance with whatever the healthcare provider is using. And then you can automatically have ACS as well pop up so you know exactly what applications are running, you know it's in compliance. I mean that's the speed. >> You mentioned the word operator, I get triggering word now for me because operator role is changing significantly on this next wave coming because of the automation. They're operating, but they're also devs too. They're developing and composing. It's almost like a dashboard, Lego blocks. The operator's not just manually racking and stacking like the old days, I'm oversimplifying it, but the new operators running stuff, they got observability, they got coding, their servicing policy. There's a lot going on. There's a lot of knobs. Is it going to get simpler? How do you guys see the org structures changing to fill the gap on what should be a very simple, turn some knobs, operate at scale? >> Well, when StackRox originally got acquired, one of the first things we did was put ACS into an operator and it actually made the application life cycle so much easier. It was very easy in the console to go and say, Hey yeah, I want ACS my cluster, click it. It would get provisioned. New clusters would get provisioned automatically. So underneath it might get more complicated. But in terms of the application lifecycle, operators make things so much easier. >> And of course I saw, I was lucky enough with Lisa to see Project Wisdom in AnsibleFest. You going to say, Hey, Red Hat, spin up the clusters and just magically will be voice activated. Starting to see AI come in. So again, operations operator is got to dev vibe and an SRE vibe, but it's not that direct. Something's happening there. We're trying to put our finger on. What do you guys think is happening? What's the real? What's the action? What's transforming? >> That's a good question. I think in general, things just move to the developers all the time. I mean, we talk about shift left security, everything's always going that way. Developers how they're handing everything. I'm not sure exactly. Doron, do you have any thoughts on that. >> Doron, what's your reaction? You can just, it's okay, say what you want. >> So I spoke with one of our customers yesterday and they say that in the last years, we developed tons of code just to operate their infrastructure. That if developers, so five or six years ago when a developer wanted VM, it will take him a week to get a VM because they need all their approval and someone need to actually provision this VM on VMware. And today they automate all the way end-to-end and it take two minutes to get a VM for developer. So operators are becoming developers as you said, and they develop code and they make the infrastructure as code and infrastructure as operator to make it more easy for the business to run. >> And then also if you add in DataOps, AIOps, DataOps, Security Ops, that's the new IT. It seems to be the new IT is the stuff that's scaling, a lot of data's coming in, you got security. So all that's got to be brought in. How do you guys view that into the equation? >> Oh, I mean you become big generalists. I think there's a reason why those cloud security or cloud professional certificates are becoming so popular. You have to know a lot about all the different applications, be able to code it, automate it, like you said, hopefully everything as code. And then it also makes it easy for security tools to come in and look and examine where the vulnerabilities are when those things are as code. So because you're going and developing all this automation, you do become, let's say a generalist. >> We've been hearing on theCUBE here and we've been hearing the industry, burnout, associated with security professionals and some DataOps because the tsunami of data, tsunami of breaches, a lot of engineers getting called in the middle of the night. So that's not automated. So this got to get solved quickly, scaled up quickly. >> Yes. There's two part question there. I think in terms of the burnout aspect, you better send some love to your security team because they only get called when things get broken and when they're doing a great job you never hear about them. So I think that's one of the things, it's a thankless profession. From the second part, if you have the right tools in place so that when something does hit the fan and does break, then you can make an automated or a specific decision upstream to change that, then things become easy. It's when the tools aren't in place and you have desperate environments so that when a Log4Shell or something like that comes in, you're scrambling trying to figure out what clusters are where and where you're impacted. >> Point of attack, remediate fast. That seems to be the new move. >> Yeah. And you do need to know exactly what's going on in your clusters and how to remediate it quickly, how to get the most impact with one change. >> And that makes sense. The service area is expanding. More things are being pushed. So things will, whether it's a zero day vulnerability or just attack. >> Just mix, yeah. Customer automate their all of things, but it's good and bad. Some customer told us they, I think Spotify lost the whole a full zone because of one mistake of a customer because they automate everything and you make one mistake. >> It scale the failure really. >> Exactly. Scaled the failure really fast. >> That was actually few contact I think four years ago. They talked about it. It was a great learning experience. >> It worked double edge sword there. >> Yeah. So definitely we need to, again, scale automation, test automation way too, you need to hold the drills around data. >> Yeah, you have to know the impact. There's a lot of talk in the security space about what you can and can't automate. And by default when you install ACS, everything is non-enforced. You have to have an admission control. >> How are you guys seeing your customers? Obviously Red Hat's got a great customer base. How are they adopting to the managed service wave that's coming? People are liking the managed services now because they maybe have skills gap issues. So managed service is becoming a big part of the portfolio. What's your guys' take on the managed services piece? >> It's just time to value. You're developing a new application, you need to get it out there quick. If somebody, your competitor gets out there a month before you do, that's a huge market advantage. >> So you care how you got there. >> Exactly. And so we've had so much Kubernetes expertise over the last 10 or so, 10 plus year or well, Kubernetes for seven plus years at Red Hat, that why wouldn't you leverage that knowledge internally so you can get your application. >> Why change your toolchain and your workflows go faster and take advantage of the managed service because it's just about getting from point A to point B. >> Exactly. >> Well, in time to value is, you mentioned that it's not a trivial term, it's not a marketing term. There's a lot of impact that can be made. Organizations that can move faster, that can iterate faster, develop what their customers are looking for so that they have that competitive advantage. It's definitely not something that's trivial. >> Yeah. And working in marketing, whenever you get that new feature out and I can go and chat about it online, it's always awesome. You always get customers interests. >> Pushing new code, being secure. What's next for you guys? What's on the agenda? What's around the corner? We'll see a lot of Red Hat at re:Invent. Obviously your relationship with AWS as strong as a company. Multi-cloud is here. Supercloud as we've been saying. Supercloud is a thing. What's next for you guys? >> So we launch the cloud services and the idea that we will get feedback from customers. We are not going GA. We're not going to sell it for now. We want to get customers, we want to get feedback to make the product as best what we can sell and best we can give for our customers and get feedback. And when we go GA and we start selling this product, we will get the best product in the market. So this is our goal. We want to get the customer in the loop and get as much as feedback as we can. And also we working very closely with our customers, our existing customers to announce the product to add more and more features what the customer needs. It's all about supply chain. I don't like it, but we have to say, it's all about making things more automated and make things more easy for our customer to use to have security in the Kubernetes environment. >> So where can your customers go? Clearly, you've made a big impact on our viewers with your conversation today. Where are they going to be able to go to get their hands on the release? >> So you can find it on online. We have a website to sign up for this program. It's on my blog. We have a blog out there for ACS cloud services. You can just go there, sign up, and we will contact the customer. >> Yeah. And there's another way, if you ever want to get your hands on it and you can do it for free, Open Source StackRox. The product is open source completely. And I would love feedback in Slack channel. It's one of the, we also get a ton of feedback from people who aren't actually paying customers and they contribute upstream. So that's an awesome way to get started. But like you said, you go to, if you search ACS cloud service and service preview. Don't have to be a Red Hat customer. Just if you're running a CNCF compliant Kubernetes version. we'd love to hear from you. >> All open source, all out in the open. >> Yep. >> Getting it available to the customers, the non-customers, they hopefully pending customers. Guys, thank you so much for joining John and me talking about the new release, the evolution of StackRox in the last season of 18 months. Lot of good stuff here. I think you've done a great job of getting the audience excited about what you're releasing. Thank you for your time. >> Thank you. >> Thank you. >> For our guest and for John Furrier, Lisa Martin here in Detroit, KubeCon + CloudNativeCon North America. Coming to you live, we'll be back with our next guest in just a minute. (gentle music)

(soft upbeat music) >> The past two and a half years have seen a dramatic change in the security posture of virtually all organizations. By accelerating the digital business mandate, the isolation economy catalyzed a move toward cloud computing to support remote workers. This, we know. This had several ripple effects on CISO and CIO strategies that were highly visible at the board of directors level. Now, the first major change was to recognize that the perimeter had suddenly been vaporized. Protection, as a result, moved away from things like perimeter-based firewalls toward more distributed endpoints, cloud security, and modern identity management. The second major change was a heightened awareness of the realities of ransomware. Ransomware as a service, for example, emerged as a major threat where virtually anyone with access to critical data and criminal intentions could monetize corporate security exposures. The third major change was a much more acute understanding of how data protection needed to become a fundamental component of cyber security strategies. And more specifically, CIOs quickly realized that their business resilient strategies were too narrowly DR-focused, that their DR approach was not cost efficient and needed to be modernized, and that new approaches to operational resilience were needed to reflect the architectural and business realities of this new environment. Hello and welcome to Why Ransomware isn't your Only Problem, a service of theCUBE made possible by Druva, and in collaboration with IDC. I'm your host, Dave Vellante, and today we're presenting a three-part program. We'll start with the data. IDC recently conducted a global survey of 500 business technology practitioners across 20 industries to understand the degree to which organizations are aware of and prepared for the threats they face in today's new world. IDC Research Vice President, Phil Goodwin is here to share the highlights of the study and summarize the findings from a recent research report on the topic. After that, we're going to hear from Curtis Preston, who's the Chief Technical Evangelist at Druva. I've known Curtis for decades. He's one of the world's foremost experts on backup and recovery, specifically in data protection generally. Curtis will help us understand how the survey data presented by IDC aligns with the real world findings from the field, from his point of view. And he'll discuss why so many organizations have failed to successfully recover from an attack without major pains and big costs, and how to avoid such operational disruptions and disasters. And then finally, we'll hear from the technical experts at Druva, Stephen Manley and Anjan Srinivas. Stephen is a 10-time (indistinct) and chief technology officer at Druva. And Anjan is vice president and general manager of product management at the company. And these individuals will specifically address how Druva is closing the gaps presented in the IDC survey through their product innovation. Right now I'm going to toss it to Lisa Martin, another one of the hosts, for today's program. Lisa, over to you. (soft upbeat music) >> Phil Goodwin joins me next, the VP of research at IDC. We're going to be breaking down what's going on in the threat landscape. Phil, welcome to the program. It's great to have you back on theCUBE. >> Hey, Lisa, it's great to be here with you. >> So talk to me about the state of the global IT landscape as we see cyber attacks massively increasing, the threat landscape changing so much, what is IDC seeing? >> You really hit the top topic that we find from IT organizations as well as business organizations. And really it's that digital resilience that ransomware that has everybody's attention. And it has the attention not just of the IT people, but of the business people alike, because it really does have profound effects across the organization. The other thing that we're seeing, Lisa, is really a move towards cloud. And I think part of that is driven by the economics of cloud, which fundamentally changed the way that we can approach disaster recovery, but also was accelerated during the pandemic for all the reasons that people have talked about in terms of work from home and so on. And then really the third thing is the economic uncertainty. And this is relatively new for 2022. But within IDC we've been doing a lot of research around what are those impacts going to be. And what we find people doing is they want greater flexibility, they want more cost certainty, and they really want to be able to leverage those cloud economics to be have the scale up or scale down on demand nature of cloud. So those are in a nutshell kind of the three things that people are looking at. >> You mentioned ransomware. It's a topic we've been talking about a lot. It's a household word these days. It's now, Phil, no longer if we're going to get attacked, it's when, it's how often, it's the severity. Talk about ransomware as a priority all the way up the stack to the C-suite. And what are they trying to do to become resilient against it? >> Well, what some of the research that we did is we found that about 77% of organizations have digital resilience as a top priority within their organization. And so what you're seeing is organizations trying to leverage things to become more resilient, more digitally resilient, and to be able to really hone in on those kinds of issues that are keeping them awake at night, quite honestly. If you think about digital resilience, it really is foundational to the organization, whether it's through digital transformation or whether it's simply data availability, whatever it might happen to be. Digital resilience is really a large umbrella term that we use to describe that function that is aimed at avoiding data loss, assuring data availability, and helping the organization to extract value from their data. >> And digital resilience, data resilience, as every company these days has to be a data company to be competitive. Digital resilience, data resilience, are you using those terms interchangeably or is data resilience defined as something a little bit different? >> Well, sometimes yeah, that we do get caught using them when one is the other. But data resilience is really a part of digital resilience, if you think about the data itself in the context of of IT computing. So it really is a subset of that. But it is foundational to IT resilience. You can't have it resilience without data resilience. So that's where we're coming from on it >> Inextricably linked. And it's becoming a corporate initiative, but there's some factors that can complicate digital resilience, data resilience, for organizations. What are some of those complications that organizations need to be aware of? >> Well, one of the biggest is what you mentioned at the top of the segment, and that is the area of ransomware. The research that we found is about 46% of organizations have been hit within the last three years. It's kind of interesting how it's changed over the years. Originally, being hit by ransomware had a real stigma attached to it. Organizations didn't want to admit it, and they really avoided confronting that. Nowadays, so many people have been hit by it, that that stigma has gone. And so really it is becoming more of a community kind of effort as people try to defend against these ransomwares. The other thing about it is, it's really a lot like Whack-A-Mole. They attack us in one area, and we defend against it, so they attack us in another area, and we defend against it. And in fact, I had an individual come up to me at a show not long ago and said, "You know, one of these days we're going to get pretty well defended against ransomware and it's going to go away." And I responded, "I don't think so, because we're constantly introducing new systems, new software, and introducing new vulnerabilities. And the fact is ransomware is so profitable the bad guys aren't going to just fade into the night without giving it a lot of fight." So I really think that ransomware is one of those things that is here for the long term, and something that we have to address and have to get proactive about. >> You mentioned some stats there, and recently IDC and Druva did a white paper together that really revealed some quite shocking results. Talk to me about some of the things. Let's talk a little bit about the demographics of the survey and then talk about what was the biggest finding there, especially where it's concerning ransomware. >> Yeah, this was in a worldwide study, it was sponsored by Druva and conducted by IDC as an independent study. And what we did, we surveyed 500, is a little over 500 different individuals across the globe, in North America, select countries in Western Europe as well as several in Asia-Pacific. And we did it across industries where 20 different industries represented. They're all evenly represented. We had surveys that included IT practitioners, primarily CIOs, CTOs, VP of infrastructure, managers of data centers, things like that. And the biggest finding that we had in this, Lisa, was really finding that there is a huge disconnect, I believe, between how people think they are ready and what the actual results are when they get attacked. Some of the statistics that we learned from this, Lisa, include 83% of organizations believe, or told us that they have a playbook that they have for ransomware. I think 93% said that they have a high degree, or a high or very high degree of confidence in their recovery tools and are fully automated. And yet when you look at the actual results, I told you a moment ago, 46% have been attack successfully. I can also tell you that in separate research, fewer than a third of organizations were able to fully recover their data without paying the ransom. And some two thirds actually had to pay the ransom. And even when they did, they didn't necessarily achieve their full recovery. The bad guys aren't necessarily to be trusted. And so the software that they provide sometimes is fully recovered, sometimes it's not. So you look at that and you go, "Wow." On the one hand, people think they're really prepared, and on the other hand, the results are absolutely horrible. Two thirds of people having to pay the ransom. So you start to ask yourself, "Well, what's going on there?" And I believe that a lot of it comes down to... kind of reminds me of the old quote from Mike Tyson. "Everybody has a plan until they get punched in the mouth." And I think that's kind of what happens with ransomware. You think you know what you're doing, you think you're ready, based on the information you have, and these people are smart people and they're professionals, but oftentimes you don't know what you don't know. And like I say, the bad guys are always dreaming up new ways to attack us. And so I think for that reason a lot of these have been successful. So that was kind of the key finding to me in kind of the "aha" moment, really, in this whole thing, Lisa. >> That's a massive disconnect, with the vast majority saying, "We have a cyber recovery playbook," yet, nearly half being the victims of ransomware in the last three years, and then half of them experiencing data loss. What is it then that organizations in this situation across any industry can do to truly enable cyber resilience, data resilience, as we said, this is a matter of this is going to happen, just a matter of when and how often? >> It is a matter, yeah, as you said, it's not if when or how often, it's really how badly. So I think what organizations are really doing now is starting to turn more to cloud-based services. Finding professionals who know what they're doing, who have that breadth of experience, and who have seen the kinds of necessary steps that it takes to do a recovery. And the fact of the matter is a disaster recovery and a cyber recovery are really not the same thing. And so organizations need to be able to plan the kinds of recovery associated with cyber recovery in terms of forensics, in terms of scanning, in terms of analysis, and so forth. So they're turning to professionals in the cloud much more in order to get that breadth of experience and to take advantage of cloud-based services that are out there. >> Talk to me about some of the key advantages of cloud-based services for data resilience versus traditional legacy on-prem equipment. What are some of the advantages? Why is IDC seeing this big shift to cloud where data resilience is concerned? >> Well, the first and foremost is the economics of it. You can have on-demand resources. And in the old days when we had disaster recoveries where there we had two different data centers and a failover and so forth, you had double the infrastructure if your financial services, it might even be triple the infrastructure. It was very complicated, very difficult. By going to the cloud, organizations can subscribe to disaster recovery as a service. And increasingly what we see is a new market of cyber recovery as a service. So being able to leverage those resources to be able to have the forensic analysis available to them, to be able to have the other resources available that are on-demand, and to have that plan in place to have those resources in place. I think what happens in a number of situations, Lisa, is that organizations think they're ready, but then all of a sudden they get hit, and all of a sudden they have to engage with outside consultants, or they have to bring in other experts. And that extends the time to recover that they have, and it also complicates it. So if they have those resources in place, then they can simply turn them on, engage them, and get that recover going as quickly as possible. >> So what do you think the big issue here is? Is it that these IT practitioners, over 500 that you surveyed across 20 industries, this a global survey, do they not know what they don't know? What's the overlying issue here? >> Yeah, I think that's right. It's you don't know what you don't know and until you get into a specific attack... there are so many different ways that organizations can be attacked. And in fact, from this research that we found, is that in many cases, data exfiltration exceeds data corruption by about 50%. And when you think about that, the issue is, once I have your data, what are you going to do? I mean, there's no amount of recovery that is going to help. So organizations are either faced with paying the ransom to keep the data from perhaps being used on the dark web or whatever, or simply saying no and taking their chances. So best practice things like encryption, immutability, things like that that organizations can put into place. Certainly air gaps, having a solid backup foundation to where data is, you have a high probability of recovery, things like that, those are the kinds of things that organizations have to put into place, really is a baseline to assure that they can recover as fast as possible and not lose data in the event of a ransomware attack. >> Given some of the disconnect that you articulated, the stats that show so many think, "We are prepared, we've got a playbook," yet so many are are being attacked, the vulnerabilities as the landscape, threat landscape, just gets more and more amorphous, what do you recommend organizations? Do you talk to the IT practitioners, but does this go all the way up to the board level in terms of, "Hey guys, across every industry we are vulnerable, this is going to happen, we've got to make sure that we are truly resilient and proactive"? >> Yes, and in fact, what we found from this research is in more than half of cases, the CEO is directly involved in the recovery. So this is very much a C-suite issue. And if you look at the the consequences of ransomware it's not just the ransom, it's the lost productivity, it's the loss of revenue, it's the loss of customer faith and goodwill. And organizations that have been attacked have suffered those consequences, and many of them are permanent. So people at the board level, whether it's the CEO, the CFO, the CIO, the CISO, whoever it is, they're extremely concerned about this. And I can tell you they are fully engaged in addressing these issues within their organization. >> So all the way at the top critically important, business critical for any industry. I imagine some industries may be a little bit more vulnerable than others, financial services, healthcare, education, we've just seen big attack in Los Angeles County. But in terms of establishing data resilience, you mentioned ransomware isn't going anywhere, it's a big business, it's very profitable, but what is IDC's prediction where ransomware is concerned? Do you think that organizations, if they truly adopt cloud and status-based technologies, can they get to a place where the C-suite doesn't have to be involved to the point where they really actually have a functioning playbook? >> I don't know if we'll ever get to the point where the C-suite is not involved. It's probably very important to have that level of executive sponsorship. But what we are seeing is, in fact, we predict predict that by 2025, 55% of organizations will have shifted to a cloud-centric strategy for their data resilience. And the reason we say that is workloads on premises aren't going away, so that's the core. We have an increasing number of workloads in the cloud and at the edge, and that's really where the growth is. So being able to take that cloud-centric model and take advantage of cloud resources, like immutable storage, being able to move data from region to region inexpensively and easily, and to be able to take that cloud-centric perspective and apply it on premises as well as in the cloud and at the edge, is really where we believe that organizations are shifting their focus. >> Got it. We're just cracking the surface here, Phil. I wish we had more time. But I had a chance to read the Druva-sponsored IDC white paper. Fascinating finds. I encourage all of you to download that. Take a read. You're going to learn some very interesting statistics and recommendations for how you can really truly deploy data resilience in your organization. Phil, it's been a pleasure to have you on the program. Thank you for joining me. >> No problem. Thank you, Lisa. (gentle music)

>> The past 2 1/2 years have seen a dramatic change in the security posture of virtually all organizations. By accelerating the digital business mandate, the isolation economy catalyzed a move toward cloud computing to support remote workers. This we know. This had several ripple effects on CSO and CIO strategies that were highly visible at the Board of Directors' level. Now, the first major change was to recognize that the perimeter had suddenly been vaporized. Protection, as a result, moved away from things like perimeter-based firewalls toward more distributed endpoints, cloud security, and modern identity management. The second major change was a heightened awareness of the realities of ransomware. Ransomware as a service, for example, emerged as a major threat where virtually anyone with access to critical data and criminal intentions could monetize corporate security exposures. The third major change was a much more acute understanding of how data protection needed to become a fundamental component of cybersecurity strategies, and more specifically, CIOs quickly realized that their business resilience strategies were too narrowly DR-focused, that their DR approach was not cost efficient and needed to be modernized, and that new approaches to operational resilience were needed to reflect the architectural and business realities of this new environment. Hello, and welcome to "Why Ransomware isn't Your Only Problem," a service of theCUBE made possible by Druva, and in collaboration with IDC. I'm your host, Dave Vellante, and today, we're presenting a three-part program. We'll start with the data. IDC recently conducted a global survey of 500 business technology practitioners across 20 industries to understand the degree to which organizations are aware of and prepared for the threats they face in today's new world. IDC Research Vice President Phil Goodwin is here to share the highlights of the study and to summarize the findings from a recent research report on the topic. After that, we're going to hear from Curtis Preston, who's the Chief Technical Evangelist at Druva. I've known Curtis for decades. He's one of the world's foremost experts on backup and recovery, specifically, and data protection, generally. Curtis will help us understand how the survey data presented by IDC aligns with the real world findings from the field from his point of view. And he'll discuss why so many organizations have failed to successfully recover from an attack without major pains and big costs, and how to avoid such operational disruptions and disasters. And then finally, we'll hear from the technical experts at Druva, Stephen Manley and Anjan Srinivas. Stephen is a 10-time CUBE alum and Chief Technology Officer at Druva, and Anjan is Vice President and General Manager of Product Management at the company. And these individuals will specifically address how Druva is closing the gaps presented in the IDC survey through their product innovation. But right now I'm going to toss it to Lisa Martin, another one of the hosts for today's program. Lisa, over to you. (upbeat music) >> Bill Goodwin joins me next, the VP of Research at IDC. We're going to be breaking down what's going on in the threat landscape. Phil, welcome to the program. It's great to have you back on theCUBE. >> Hey, Lisa, it's great to be here with you. >> So talk to me about the state of the global IT landscape as we see cyberattacks massively increasing, the threat landscape changing so much. What is IDC seeing? >> You know, you really hit the top topic that we find from IT organizations as well as business organizations. And really, it's that digital resilience, that ransomware that has everybody's attention, and it has the attention, not just of the IT people, but of the business people alike, because it really does have profound effects across the organization. The other thing that we're seeing, Lisa, is really a move towards cloud. And I think part of that is driven by the economics of cloud, which fundamentally changed the way that we can approach disaster recovery, but also has accelerated during the pandemic for all the reasons that people have talked about in terms of work from home and so on. And then really the third thing is the economic uncertainty, and this is relatively new for 2022, but within IDC we've been doing a lot of research around what are those impacts going to be? And what we find people doing is they want greater flexibility, they want more cost certainty, and they really want to be able to leverage those cloud economics to have the scale up or scale down on demand nature of cloud. So those are, in a nutshell, kind of the three things that people are looking at. >> You mentioned ransomware. It's a topic we've been talking about a lot. It's a household word these days. It's now, Phil, no longer if we're going to get attacked, it's when, it's how often, it's the severity. Talk about ransomware as a priority all the way up the stack to the C-suite, and what are they trying to do to become resilient against it? >> Well, what some of the research that we did is we found that about 77% of organizations have digital resilience as a top priority within their organization. And so what you're seeing is organizations trying to leverage things to become more resilient, more digitally resilient, and to be able to really hone in on those kinds of issues that are keeping them awake at night, quite honestly. If you think about digital resilience, it really is foundational to the organization, whether it's through digital transformation or whether it's simply data availability, whatever it might happen to be. Digital resilience is really a large umbrella term that we use to describe that function that is aimed at avoiding data loss, assuring data availability, and helping the organization to extract value from their data. >> And digital resilience, data resilience, as every company these days has to be a data company to be competitive. Digital resilience, data resilience, are you using those terms interchangeably or is data resilience defined as something a little bit different? >> Well, sometimes yeah, we do get caught using them when one is the other. But data resilience is really a part of digital resilience, if you think about the data itself in the context of IT computing. So it really is a subset of that, but it is foundational to IT resilience. You can't have IT resilience without data resilience. So that's where we're coming from on it. >> Inextricably linked, and it's becoming a corporate initiative, but there's some factors that can complicate digital resilience, data resilience for organizations. What are some of those complications that organizations need to be aware of? >> Well, one of the biggest is what you mentioned at the top of the segment, and that is the area of ransomware. The research that we found is about 46% of organizations have been hit within the last three years. You know, it's kind of interesting how it's changed over the years. Originally, being hit by ransomware had a real stigma attached to it. Organizations didn't want to admit it, and they really avoided confronting that. Nowadays, so many people have been hit by it that that stigma has gone. And so really it is becoming more of a community kind of effort as people try to defend against these ransomers. The other thing about it is it's really a lot like Whac-A-Mole, you know. They attack us in one area and we defend against it so they attack us in another area, and we defend against it. And in fact, I had an individual come up to me at a show not long ago and said, "You know, one of these days we're going to get pretty well defended against ransomware and it's going to go away." And I responded I don't think so because we're constantly introducing new systems, new software, and introducing new vulnerabilities. And the fact is ransomware is so profitable, the bad guys aren't going to just fade into the night without giving it a a lot of fight. So I really think that ransomware is one of those things that is here for the long term and something that we have to address and have to get proactive about. >> You mentioned some stats there, and recently IDC and Druva did a white paper together that really revealed some quite shocking results. Talk to me about some of the things. Let's talk a little bit about the demographics of the survey and then talk about what was the biggest finding there, especially where it's concerning ransomware? >> Yeah, this was a worldwide study. It was sponsored by Druva and conducted by IDC as an independent study. And what we did, we surveyed 500, it was a little over 500 different individuals across the globe in North America, select countries in Western Europe, as well as several in Asia Pacific. And we did it across industries there were 20 different industries represented, they're all evenly represented. We had surveys that included IT practitioners, primarily CIOs, CTOs, VP of infrastructure, you know, managers of data centers, things like that. And the biggest finding that we had in this, Lisa, was really finding that there is a huge disconnect, I believe, between how people think they are ready and what the actual results are when they get attacked. Some of the statistics that we learned from this, Lisa, include 83% of organizations believe, or told us that they have a playbook that they have for ransomware. I think 93% said that they have a high degree, or a high or very high degree of confidence in their recovery tools and are fully automated. And yet, when you look at the actual results, you know, I told you a moment ago, 46% have been attacked successfully. I can also tell you that in separate research, fewer than 1/3 of organizations were able to fully recover their data without paying the ransom, and some 2/3 actually had to pay the ransom. And even when they did, they didn't necessarily achieve their full recovery. You know, the bad guys aren't necessarily to be trusted, and so the software that they provide sometimes is fully recovered, sometimes it's not. So you look at that and you go, wow. On the one hand, people think they're really, really prepared, and on the other hand, the results are absolutely horrible. You know, 2/3 of people having to pay the ransom. So you start to ask yourself, well, what's going on there? And I believe that a lot of it comes down to, kind of reminds me of the old quote from Mike Tyson. "Everybody has a plan until they get punched in the mouth." And I think that's kind of what happens with ransomware. You think you know what you're doing. You think you're ready, based on the information you have. And these people are smart people, and they're professionals, but oftentimes, you don't know what you don't know. And like I said, the bad guys are always dreaming up new ways to attack us. And so, I think, for that reason, a lot of these have been successful. So that was kind of the key finding to me and kind of the aha moment really in this whole thing, Lisa. >> That's a massive disconnect with the vast majority saying, "We have a cyber recovery playbook," yet nearly 1/2 being the victims of ransomware in the last three years, and then 1/2 of them experiencing data loss. What is it then that organizations in this situation across any industry can do to truly enable cyber resilience, data resilience? As we said, this is a matter of this is going to happen, just a matter of when and how often. >> It is a matter, yeah, as you said, it's not if, when, or how often, it's really how badly. So I think what organizations are really doing now is starting to turn more to cloud-based services, you know, finding professionals who know what they're doing, who have that breadth of experience and who have seen the kinds of necessary steps that it takes to do a recovery. And the fact of the matter is a disaster recovery and a cyber recovery are really not the same thing. And so organizations need to be able to plan the kinds of recovery associated with cyber recovery in terms of forensics, in terms of scanning, in terms of analysis, and so forth. So they're turning to professionals in the cloud much more, in order to get that breadth of experience, and to take advantage of cloud-based services that are out there. >> Talk to me about some of the key advantages of cloud-based services for data resilience versus traditional legacy on-prem equipment. What are some of the advantages? Why is IDC seeing this big shift to cloud where data resilience is concerned? >> Well, the first and foremost is the economics of it. You know, you can have on-demand resources. In the old days, when we had disaster recoveries where we had two different data centers and a failover and so forth, you know, you had double the infrastructure. If you're financial services, it might even be triple the infrastructure. It was very complicated, very difficult. By going to the cloud, organizations can subscribe to disaster recovery as a service. And increasingly what we see is a new market of cyber recovery as a service. So being able to leverage those resources, to be able to have the forensic analysis available to them, to be able to have the other resources available that are on demand, and to have that plan in place to have those resources in place. I think what happens in a number of situations, Lisa, is that organizations think they're ready, but then all of a sudden they get hit, and all of a sudden they have to engage with outside consultants, or they have to bring in other experts, and that extends the time to recover that they have and it also complicates it. So if they have those resources in place, then they can simply turn them on, engage them, and get that recovery going as quickly as possible. >> So what do you think the big issue here is? Is it that these IPT practitioners, over 500 that you surveyed across 20 industries, this a global survey, do they they not know what they don't know? What's the overlying issue here? >> Yeah, I think that's right. You don't know what you don't know, and until you get into a specific attack, you know, there are so many different ways that organizations can be attacked. And, in fact, from this research that we found is that, in many cases, data exfiltration exceeds data corruption by about 50%. But when you think about that, the issue is, once I have your data, what are you going to do? I mean, there's no amount of recovery that is going to help. So organizations are either faced with paying the ransom to keep the data from perhaps being used on the dark web, or whatever, or simply saying no, and taking their chances. So best practice things like encryption, immutability, things like that that organizations can put into place. Certainly air gaps, having a solid backup foundation to where data is, you have a high recovery, high probability of recovery, things like that. Those are the kinds of things that organizations have to put into place, really as a baseline to assure that they can recover as fast as possible and not lose data in the event of a ransomware attack. >> Given some of the disconnect that you articulated, the stats that show so many think we are prepared, we've got a playbook, yet so many are being attacked, the vulnerabilities as the landscape, threat landscape, just gets more and more amorphous. What do you recommend organizations do? You talked to the IT practitioners, but does this go all the way up to the board level in terms of, hey guys, across every industry, we are vulnerable, this is going to happen. We've got to make sure that we are truly resilient and proactive? >> Yes, and in fact, what we found from this research is in more than 1/2 of cases, the CEO is directly involved in the recovery. So this is very much a C-suite issue. And if you look at the consequences of ransomware, it's not just the ransom, it's the lost productivity, it's the loss of revenue. It's the loss of customer faith and goodwill, and organizations that have been attacked have suffered those consequences, and many of them are permanent. So people at the board level, whether it's the CEO, the CFO, the CIO, the CSO, you know, whoever it is, they're extremely concerned about these. And I can tell you, they are fully engaged in addressing those issues within their organization. >> So all the way at the top, and critically important, business critical for any industry. I imagine some industries may be a little bit more vulnerable than others, financial services, healthcare, education. We've just seen a big attack in Los Angeles County. But in terms of establishing data resilience, you mentioned ransomware isn't going anywhere, it's a big business, it's very profitable. But what is IDC's prediction where ransomware is concerned? Do you think that organizations, if they truly adopt cloud and SaaS-based technologies, can they get to a place where the C-suite doesn't have to be involved to the point where they really actually have a functioning playbook? >> I don't know if we'll ever get to the point where the C-suite is not involved. It's probably very important to have that level of executive sponsorship. But what we are seeing is, in fact, we predict that by 2025, 55% of organizations will have shifted to a cloud-centric strategy for their data resilience. And the reason we say that is, you know, workloads on premises aren't going away. So that's the core. We have an increasing number of workloads in the cloud and at the edge, and that's really where the growth is. So being able to take that cloud-centric model and take advantage of cloud resources like immutable storage, being able to move data from region to region inexpensively and easily, and to be able to take that cloud-centric perspective and apply it on premises as well as in the cloud and at the edge is really where we believe that organizations are shifting their focus. >> Got it, we're just cracking the surface here, Phil. I wish we had more time, but I had a chance to read the Druva-sponsored IDC white paper. Fascinating finds. I encourage all of you to download that, take a read. You're going to learn some very interesting statistics and recommendations for how you can really truly deploy data resilience in your organization. Phil, it's been a pleasure to have you on the program. Thank you for joining me. >> No problem. Thank you, Lisa. >> In a moment, John Furrier will be here with his next guest. For right now, I'm Lisa Martin, and you are watching theCUBE, the leader in live tech coverage. >> We live in a world of infinite data. Sprawling, dispersed, valuable, but also vulnerable. So how do organizations achieve data resiliency when faced with ever expanding workloads, increasing security threats, and intensified regulations? Unfortunately, the answer often boils down to what flavor of complexity do you like best? The common patchwork approaches are expensive, convoluted, and difficult to manage. There's multiple software and hardware vendors to worry about, different deployments for workloads running on-premises or in the cloud. And an inconsistent security framework resulting in enterprises maintaining four to five copies of the same data, increasing costs and risk, building to an incoherent mess of complications. Now, imagine a world free from these complexities. Welcome to the the Druva Data Resiliency Cloud, where full data protection and beautiful simplicity converge. No hardware, no upgrades, no management, just total data resilience. With just a few clicks, you can get started integrating all of your data resiliency workflows in minutes. Through a true cloud experience built on Amazon Web Services, the Druva platform automates and manages critical daily tasks, giving you time to focus on your business. In other words, get simplicity, scalability, and security instantly. With the Druva Data Resiliency Cloud, your data isn't just backed up, it's ready to be used 24/7 to meet compliance needs and to extract critical insights. You can archive data for long-term retention, be protected against device failure and natural disasters, and recover from ransomware lightning fast. Druva is trusted with billions of backups annually by thousands of enterprises, including more than 60 of the Fortune 500, costing up to 50% less than the convoluted hardware, software, and appliance solutions. As data grows and becomes more critical to your business advantage, a data resiliency plan is vital, but it shouldn't be complicated. Druva makes it simple. (upbeat music) (mouse clicks) >> Welcome back, everyone, to theCUBE and the Druva special presentation of "Why Ransomware isn't Your Only Problem." I'm John Furrier, host of theCUBE. We're here with W Curtis Preston, Curtis Preston, as he's known in the industry, Chief Technical Evangelist at Druva. Curtis, great to see you. We're here at "Why Ransomware isn't Your Only Problem." Great to see you, thanks for coming on. >> Happy to be here. >> So we always see each other at events now events are back. So it's great to have you here for this special presentation. The white paper from IDC really talks about this in detail. I'd like to get your thoughts, and I'd like you to reflect on the analysis that we've been covering here in this survey data, how it lines up with the real world that you're seeing out there. >> Yeah, I think it's, the survey results really, I'd like to say, I'd like to say that they surprised me, but unfortunately, they didn't. The data protection world has been this way for a while where there's this difference in belief, or difference between the belief and the reality. And what we see is that there are a number of organizations that have been hit, successfully hit by ransomware, paid the ransom and/or lost data, and yet the same people that were surveyed, they had high degrees of confidence in their backup system. And, you know, I could probably go on for an hour as to the various reasons why that would be the case, but I think that this long running problem that as long as I've been associated with backups, which, you know, has been a while, it's that problem of, you know, nobody wants to be the backup person. And people often just, they don't want to have anything to do with the backup system, and so it sort of exists in this vacuum. And so then management is like, "Oh, the backup system's great," because the backup person often, you know, might say that it's great because maybe it's their job to say so. But the reality has always been very, very different. >> It's funny, you know. "We're good, boss, we got this covered." >> Yeah, it's all good, it's all good. >> And the fingers crossed, right? So again, this is the reality, and as it becomes backup and recovery, which we've talked about many times on theCUBE, certainly we have with you before, but now with ransomware, also, the other thing is people get ransomware hit multiple times. So it's not only like they get hit once, so, you know, this is a constant chasing the tail on some ends, but there are some tools out there, You guys have a solution, and so let's get into that. You know, you have had hands-on backup experience. What are the points that surprise you the most about what's going on in this world and the realities of how people should be going forward? What's your take? >> Well, I would say that the one part in the survey that surprised me the most was people that had a huge, you know, there was a huge percentage of people that said that they had, you know, a ransomware response, you know, and readiness program. And you look at that, and how could you be, you know, that high a percentage of people be comfortable with their ransomware readiness program, which includes a number of things, right? There's the cyberattack aspect of responding to a ransomware attack, and then there's the recovery aspect. And so you believe that your company was ready for that, and then you go, and I think it was 67% of the people in the survey paid the ransom, which as a person who, you know, has spent my entire career trying to help people successfully recover their data, that number, I think, just hurt me the most is that because, you talked about re-infections. The surest way to guarantee that you get re-attacked and reinfected is to pay the ransom. This goes back all the way to ransom since the beginning of time, right? Everyone knows if you pay the blackmail, all you're telling people is that you pay blackmail. >> You're in business, you're a good customer >> Yeah, yeah, exactly. >> for ransomware. >> Yeah, so the fact that, you know, 60, what, 2/3 of the people that were attacked by ransomware paid the ransom. That one statistic just hurt my heart. >> Yeah, and I think this is the reality. I mean, we go back, and even the psychology of the practitioners was, you know, it's super important to get backup and recovery, and that's been around for a long time, but now that's an attack vector, okay? And there's dollars involved, like I said, I'm joking, but there's recurring revenue for the bad guys if they know you're paying up and if you're stupid enough not to change your tooling. So again, it works both ways. So I got to ask you, why do you think so many owners are unable to successfully respond after an attack? Is it because, they know it's coming, I mean, they're not that dumb. I mean, they have to know it's coming. Why aren't they responding successfully to this? >> I think it's a litany of things, starting with that aspect that I mentioned before, that nobody wants to have anything to do with the backup system, right? So nobody wants to be the one to raise their hand because if you're the one that raises their hand, "You know, that's a good idea, Curtis, why don't you look into that?" Nobody wants to be- >> Where's that guy now? He doesn't work here anymore. Yeah, I hear where you coming from. >> Exactly. >> It's psychology (indistinct) >> Yeah, so there's that. But then the second is that because of that, no one's looking at the fact that backups are the attack vector. They become the attack vector. And so because they're the attack vector, they have to be protected as much, if not more than the rest of the environment. The rest of the environment can live off of Active Directory and, you know, and things like Okta, so that you can have SSO and things like that. The backup environment has to be segregated in a very special way. Backups have to be stored completely separate from your environment. The login and authentication and authorization system needs to be completely separate from your typical environment. Why? Because if that production environment is compromised, now knowing that the attacks or that the backup systems are a significant portion of the attack vector, then if the production system is compromised, then the backup system is compromised. So you've got to segregate all of that. And I just don't think that people are thinking about that. You know, and they're using the same backup techniques that they've used for many, many years. >> So what you're saying is that the attack vectors and the attackers are getting smarter. They're saying, "Hey, we'll just take out the backup first so they can't backup. So we got the ransomware." It makes sense. >> Yeah, exactly. The largest ransomware group out there, the Conti ransomware group, they are specifically targeting specific backup vendors. They know how to recognize the backup servers. They know how to recognize where the backups are stored, and they are exfiltrating the backups first, and then deleting them, and then letting you know you have ransom. >> Okay, so you guys have a lot of customers. They all kind of have the same problem. What's the patterns that you're seeing? How are they evolving? What are some of the things that they're implementing? What is the best practice? >> Well, again, you've got to fully segregate that data, and everything about how that data is stored and everything about how that data's created and accessed, there are ways to do that with other, you know, with other commercial products. You can take a standard product and put a number of layers of defense on top of it, or you can switch to the way Druva does things, which is a SaaS offering that stores your data completely in the cloud in our account, right? So your account could be completely compromised. That has nothing to do with our account. It's a completely different authentication and authorization system. You've got multiple layers of defense between your computing environment and where we store your backups. So basically, what you get by default with the way Druva stores your backups is the best you can get after doing many, many layers of defense on the other side and having to do all that work. With us, you just log in and you get all of that. >> I guess, how do you break the laws of physics? I guess that's the question here. >> Well, because that's the other thing is that by storing the data in the cloud, and I've said this a few times, you get to break the laws of physics, and the only way to do that is time travel. (both laughing) So yes, so Druva has time travel. And this is a Curtisism, by the way, I don't think this is our official position, but the idea is that the only way to restore data as fast as possible is to restore it before you actually need it, and that's kind of what I mean by time travel, in that you, basically, you configure your DR, your disaster recovery environment in Druva one time, and then we are pre-restoring your data as often as you tell us to do, to bring your DR environment up to the, you know, the current environment as quickly as we can so that in a disaster recovery scenario, which is part of your ransomware response, right? Again, there are many different parts, but when you get to actually restoring the data, you should be able to just push a button and go. The data should already be restored. And that's the way that you break the laws of physics is you break the laws of time. >> (laughs) Well, all right, everyone wants to know the next question, and this is a real big question is, are you from the future? >> (laughs) Yeah. Very much the future. >> What's it like in the future, backup, recovery? How does it restore? Is it air gapping everything? >> Yeah, well, it's a world where people don't have to worry about their backups. I like to use the phrase get out of the backup business, just get into the restore business. You know, I'm a grandfather now, and I love having a granddaughter, and I often make the joke that if I'd have known how great grandkids were, I would've skipped straight to them, right? Not possible. Just like this. Recoveries are great. Backups are really hard. So in the future, if you use a SaaS data protection system and data resiliency system, you can just do recoveries and not have to worry about backups. >> Yeah, and what's great about your background is you've got a lot of historical perspective. You've seen that, the waves of innovation. Now it really is about the recovery and real time. So a lot of good stuff going on. And got to think automated, things got to be rocking and rolling. >> Absolutely. Yeah. I do remember, again, having worked so hard with many clients over the years, back then, we worked so hard just to get the backup done. There was very little time to work on the recovery. And I really, I kid you not, that our customers don't have to do all of those things that all of our competitors have to do to, you know, to break, to try to break the laws of physics, I've been fighting the laws of physics my entire career, to get the backup done in the first place, then to secure all the data, and to air gap it and make sure that a ransomware attack isn't going to attack it. Our customers get to get straight to a fully automated disaster recovery environment that they get to test as often as possible and they get to do a full test by simply pressing a single button. And you know, I wish everybody had that ability. >> Yeah, I mean, security's a big part of it. Data's in the middle of it all. This is now mainstream, front lines, great stuff. Curtis, great to have you on, bring that perspective, and thanks for the insight. Really appreciate it. >> Always happy to talk about my favorite subject. >> All right, we'll be back in a moment. We'll have Stephen Manley, the CTO, and Anjan Srinivas, the GM and VP of Product Management will join me. You're watching theCUBE, the leader in high tech enterprise coverage. >> Ransomware is top of mind for everyone. Attacks are becoming more frequent and more sophisticated. It's a problem you can't solve alone anymore. Ransomware is built to exploit weaknesses in your backup solution, destroying data, and your last line of defense. With many vendors, it can take a lot of effort and configuration to ensure your backup environment is secure. Criminals also know that it's easy to fall behind on best practices like vulnerability scans, patches, and updates. In fact, 42% of vulnerabilities are exploited after a patch has been released. After an attack, recovery can be a long and manual process that still may not restore clean or complete data. The good news is that you can keep your data safe and recover faster with the Druva Data Resiliency Cloud on your side. The Druva platform functions completely in the cloud with no hardware, software, operating system, or complex configurations, which means there are none of the weaknesses that ransomware commonly uses to attack backups. Our software as a service model delivers 24/7/365 fully managed security operations for your backup environment. We handle all the vulnerability scans, patches, and upgrades for you. Druva also makes zero trust security easy with built-in multifactor authentication, single sign-on, and role-based access controls. In the event of an attack, Druva helps you stop the spread of ransomware and quickly understand what went wrong with built-in access insights and anomaly detection. Then you can use industry first tools and services to automate the recovery of clean, unencrypted data from the entire timeframe of the attack. Cyberattacks are a major threat, but you can make protection and recovery easy with Druva. (electronic music) (upbeat music) (mouse clicks) >> Welcome back, everyone, to theCUBE's special presentation with Druva on "Why Ransomware isn't Your Only Problem." I'm John Furrier, host of theCUBE. Our next guests are Stephen Manley, Chief Technology Officer of Druva, and Anjan Srinivas, who is the General Manager and Vice President of Product Management at Druva. Gentlemen, you got the keys to the kingdom, the technology, ransomware, data resilience. This is the topic. The IDC white paper that you guys put together with IDC really kind of nails it out. I want to get into it right away. Welcome to this segment. I really appreciate it. Thanks for coming on. >> Great to be here, John. >> So what's your thoughts on the survey's conclusion? Obviously, the resilience is huge. Ransomware continues to thunder away at businesses and causes a lot of problems, disruption. I mean, it's endless ransomware problems. What's your thoughts on the conclusion? >> So I'll say the thing that pops out to me is, on the one hand, everybody who sees the survey and reads it is going to say, "Well, that's obvious." Of course, ransomware continues to be a problem. Cyber resilience is an issue that's plaguing everybody. But I think when you dig deeper and there's a lot of subtleties to look into, but one of the things that I hear on a daily basis from the customers is, it's because the problem keeps evolving. It's not as if the threat was a static thing to just be solved and you're done. Because the threat keeps evolving, it remains top of mind for everybody because it's so hard to keep up with what's happening in terms of the attacks. >> And I think the other important thing to note, John, is that people are grappling with this ransomware attack all of a sudden where they were still grappling with a lot of legacy in their own environment. So they were not prepared for the advanced techniques that these ransomware attackers were bringing to market. It's almost like these ransomware attackers had a huge leg up in terms of technology that they had in their favor while keeping the lights on was keeping IT away from all the tooling that they needed to do. A lot of people are even still wondering, when that happens next time, what do I even do? So clearly not very surprising. Clearly, I think it's here to stay, and I think as long as people don't retool for a modern era of data management, this is going to to stay this way. >> Yeah, I hear this all the time in our CUBE conversations with practitioners. It's kind of like the security pro, give me more tools, I'll buy anything that comes in the market, I'm desperate. There's definitely attention, but it doesn't seem like people are satisfied with the tooling that they have. Can you guys share kind of your insights into what's going on in the product side? Because, you know, people claim that they have tools at crime points of recovery opportunities, but they can't get there. So it seems to be that there's a confidence problem here in the market. How do you guys see that? 'cause I think this is where the rubber meets the road with ransomware 'cause it is a moving train, it's always changing, but it doesn't seem there's confidence. Can you guys talk about that? What's your reaction? >> Yeah, let me jump in first, and Stephen can add to it. What happens is, I think this is a panic buying and they have accumulated this tooling now just because somebody said they could solve your problem, but they haven't had a chance to take a real look from a ground up perspective to see where are the bottlenecks? Where are the vulnerabilities? And which tooling set needs to lie where? Where does the logic need to reside? And what, in Druva, we are watching people do and people do it successfully, is that as they have adopted Druva technology, which is ground up built for the cloud, and really built in a way which is, you know, driven at a data insight level where we have people even monitoring our service for anomalies and activities that are suspicious. We know where we need to play a role in really kind of mitigating this ransomware, and then there's a whole plethora of ecosystem players that kind of combine to really finish the story, so to say, right? So I think this has been a panic buying situation. This is like, "Get me any help you can give me." And I think as this settles down and people really understand that longer term as they really build out a true defense mechanism, they need to think really ground up. They will start to really see the value of technologies like Druva, and try to identify the right set of ecosystem to really bring together to solve it meaningfully. >> Yes, Stephen? >> I was going to say, I mean, one of the the really interesting things in the survey for me, and for a moment, a little more than a moment, it made me think was that the large number of respondents who said, "I've got a really efficient, well-run back environment," who, then, on basically the next question said, "And I have no confidence that I can recover from a ransomware attack." And you scratch your head and you think, "Well, if your backup environment is so good, why do you have such low confidence?" And I think that's the moment when we dug deeper and we realized, if you've got a traditional architecture, and let's face it, the disk-based architecture's been around for almost two decades now, in terms of disk-based backup, you can have that tuned to the hilt. That can be running as efficiently as you want it, but it was built before the ransomware attacks, before all these cyber issues, you know, really start hitting companies. And so I have this really well-run traditional backup environment that is not at all built for these modern threat vectors. And so that's really why customers are saying, "I'm doing the best I can," but as Anjan pointed out, the architecture, the tooling isn't there to support what problems I need to solve today. >> Yeah, great point. >> And so, yeah. >> Well, that's a great point. Before we get into the customer side I want to get to in second, you know, I interviewed Jaspreet, the founder and CEO many years ago, even before the pandemic, and you mentioned modern. You guys have always had the cloud with Druva. This is huge. Now that you're past the pandemic, what is that modern cloud edge that you guys have? 'Cause that's a great point. A lot of stuff was built kind of backup and recovery bolted on, not really kind of designed into the current state of the infrastructure and the cloud native application modern environment we're seeing right now. It's a huge issue. >> I think, to me there's three things that come up over and over and over again as we talk to people in terms of, you know, being built in cloud, being cloud native, why is it an advantage? The first one is security and ransomware. And we can go deeper, but the most obvious one that always comes up is every single backup you do with Druva is air gapped, offsite, managed under a separate administrative domain so that you're not retrofitting any sort of air gap network and buying another appliance or setting up your own cloud environment to manage this. Every backup is ransomware protected, guaranteed. The second advantage is the scalability. And you know, this certainly plays into account as your business grows, or, in some cases, as you shrink or repurpose workloads, you're only paying for what you use. But it also plays a big role, again, when you start thinking of ransomware recoveries because we can scale your recovery in cloud, on premises as much or as little as you want. And then I think the third one is we're seeing, basically, things evolving, new workloads, data sprawl, new threat vectors. And one of the nice parts of being a SaaS service in the cloud is we're able to roll out new functionality every two weeks and there's no upgrade cycle, there's no waiting. The customer doesn't have to say, "Wow, I needed six months in the lab before I upgrade it and it's an 18-month, 24-month cycle before the functionality releases. You're getting it every two weeks, and it's backed by Druva to make sure it works. >> Anjan, you know, you got the product side, you know, it's a challenging job 'cause you have so many customers asking for things, probably on the roadmap, you probably can go an hour for that one, but I want to get your thoughts on what you're hearing and seeing from customers. We just reviewed the IDC with Phil. How are you guys responding to your customer's needs? Because it seems that it's highly accelerated, probably on the feature requests, but also structurally as ransomware continues to evolve. What are you hearing? What's the key customer need? How are you guys responding? >> Yeah, actually, I have two things that I hear very clearly when I talk to customers. One, I think, after listening to their security problems and their vulnerability challenges, because we see customers and help customers who are getting challenged by ransomware on a weekly basis. And what I find that this problem is not just a technology problem, it's an operating model problem. So in order to really secure themselves, they need a security operating model and a lot of them haven't figured out that security operating model in totality. Now where we come in, as Druva, is that we are providing them the cloud operating model and a data protection operating model, combined with a data insights operating model which all fit into their overall security operating model that they are really owning and they need to manage and operate, because this is not just about a piece of technology. On top of that, I think our customers are getting challenged by all the same challenges of not just spending time on keeping the lights on, but innovating faster with less. And that has been this age old problem, do more with less. But in this whole, they're like trying to innovate in the middle of the war, so to say. The war is happening, they're getting attacked, but there's also net new shadow IT challenges that's forcing them to make sure that they can manage all the new applications that are getting developed in the cloud. There is thousands of SaaS applications that they're consuming, not knowing which data is critical to their success and which ones to protect and govern and secure. So all of these things are coming at them at 100 miles per hour, while they're just trying to live one day at a time. And unless they really develop this overall security operating model, helped by cloud native technologies like Druva that really providing them a true cloud native model of really giving like a touchless and an invisible protection infrastructure. Not just beyond backups, beyond just the data protection that we all know of into this mindset of kind of being able to look at where each of those functionalities need to lie. That's where I think they're grappling with. Now Druva is clearly helping them with keep up to pace with the public cloud innovations that they need to do and how to protect data. We just launched our EC2 offering to protect EC2 virtual machines back in AWS, and we are going to be continuing to evolve that to further the many services that public cloud software 'cause our customers are really kind of consuming them at breakneck speed. >> So new workloads, new security capabilities. Love that. Good call out there. Stephen, there's still the issue of the disruption side of it. You guys have a guarantee. There's a cost of ownership as you get more tools. Can you talk about that angle of it? You got new workloads, you got the new security needs, what's the disruption impact? 'Cause you want to avoid that. How much is it going to cost you? And you guys have this guarantee, can you explain that? >> Yeah, absolutely. So Druva launched our $10 million data resiliency guarantee. And for us, there were really two key parts to this. The first obviously is $10 million means that, you know, again, we're willing to put our money where our mouth is, and that's a big deal, right? That we're willing to back this with the guarantee. But then the second part, and this is the part that I think reflects that sort of model that Anjan was talking about. We sort of look at this and we say the goal of Druva is to do the job of protecting and securing your data for you so that you, as a customer, don't have to do it anymore. And so the guarantee actually protects you against multiple types of risks, all with SLAs. So everything from your data's going to be recoverable in the case of a ransomware attack. Okay, that's good. Of course, for it to be recoverable, we're also guaranteeing your backup success rate. We're also guaranteeing the availability of the service. We're guaranteeing that the data that we're storing for you can't be compromised or leaked externally, and we're guaranteeing the long-term durability of the data so that if you backup with us today and you need to recover 30 years from now, that data's going to be recovered. So we wanted to really attack the end-to-end risks that affect our customers. Cybersecurity is a big deal, but it is not the only problem out there, and the only way for this to work is to have a service that can provide you SLAs across all of the risks, because that means, as a SaaS vendor, we're doing the job for you so you're buying results as opposed to technology. >> That's great. Great point. Ransomware isn't the only problem. That's the title of this presentation, but it's a big one. (laughs) People are concerned about it, so great stuff. In the last five minutes, guys, if you don't mind, I'd love to have you share what's on the horizon for Druva? You mentioned the new workloads, Anjan. You mentioned this new security. You're going to shift left. DevOps is now the developer model. They're running IT. Get data and security teams now stepping in and trying to be as high velocity as possible for the developers and enterprises. What's on the horizon for Druva? What trends is the company watching, and how are you guys putting that together to stay ahead in the marketplace and the competition? >> Yeah, I think, listening to our customers, what we realize is they need help with the public cloud, number one. I think that's a big wave of consumption. People are consolidating their data centers, moving to the public cloud. They need help in expanding data protection, which becomes the basis of a lot of the security operating model that I talked about. They need that first, from Druva, before they can start to get into much more advanced level of insights and analytics around that data to protect themselves and secure themselves and do interesting things with that data. So we are expanding our coverage on multiple fronts there. The second key thing is to really bring together a very insightful presentation layer, which, I think, is very unique to Druva because only we can look at multiple tenants, multiple customers because we are a SaaS vendor, and look at insights and give them best practices and guidances and analytics that nobody else can give. There's no silo anymore because we are able to take a good big vision view and now help our customers with insights that otherwise that information map is completely missing. So we are able to guide them down a path where they can optimize which workloads need what kind of protection, and then how to secure them. So that is the second level of insights and analytics that we are building. And there's a whole plethora of security offerings that we are going to build, all the way from a feature level where we have things like (audio distorts) that's already available to our customers today to prevent any anomalous behavior and attacks that would delete their backups and then they still have a way to recover from it, but also things to curate and get back to that point in time where it is safe to recover and help them with a sandbox which they can recover confidently knowing it's not going to jeopardize them again and reinfect the whole environment again. So there's a whole bunch of things coming, but the key themes are public cloud, data insights, and security, and that's where my focus is, to go and get those features delivered, and Stephen can add a few more things around services that Stephen is looking to build and launch. >> Sure, so, yeah, so John, I think one of the other areas that we see just an enormous groundswell of interest. So public cloud is important, but there are more and more organizations that are running hundreds, if not thousands of SaaS applications, and a lot of those SaaS applications have data. So there's the obvious things, like Microsoft 365, Google Workspace, but we're also seeing a lot of interest in protecting Salesforce because, if you think about it, if someone you know deletes some really important records in Salesforce, that's actually kind of the record of your business. And so, we're looking at more and more SaaS application protection, and really getting deep in that application awareness. It's not just about backup and recovery when you look at something like a Salesforce, or something like Microsoft 365. You do want to look into sandboxing, you want to look into long-term archival, because this is the new record of the business. What used to be in your on-premises databases, that all lives in cloud and SaaS applications now. So that's a really big area of investment for us. The second one, just to echo what Anjan said is, one of the great things of being a SaaS provider is I have metadata that spans across thousands of customers and tens of billions of backups a year. I'm tracking all sorts of interesting information that is going to enable us to do things like make backups more autonomous so that customers, again, I want to do the job for them. We'll do all the tuning, we'll do all the management for them to be able to better detect ransomware attacks, better respond to ransomware attacks, because we're seeing across the globe. And then, of course, being able to give them more insight into what's happening in their data environment so they can get a better security posture before any attack happens. Because, let's face it, if you can set your data up more cleanly, you're going to be a lot less worried and a lot less exposed when that attack happens. So we want to be able to, again, cover those SaaS applications in addition to the public cloud, and then we want to be able to use our metadata and use our analytics and use this massive pipeline we've got to deliver value to our customers. Not just charts and graphs, but actual services that enable them to focus their attention on other parts of the business. >> That's great stuff. >> And remember, John, I think all this while keeping things really easy to consume, consumer grade UI, APIs, and then really the power of SaaS as a service, simplicity to kind of continue on, amongst kind of keeping these complex technologies together. >> Anjan, that's a great callout. I was going to mention ease of use and self-service. Big part of the developer and IT experience. Expected. It's the table stakes. Love the analytic angle, I think that brings the scale to the table, and faster time to value to get to learn best practices. But at the end of the day, automation, cross-cloud protection and security to protect and recover. This is huge, and this is a big part of not only just protecting against ransomware and other things, but really being fast and being agile. So really appreciate the insights. Thanks for sharing on this segment, really under the hood and really kind of the value of the product. Thanks for coming on, appreciate it. >> Thank you very much. >> Okay, there it is. You have the experts talk about under the hood, the product, the value, the future of what's going on with Druva, and the future of cloud native protecting and recovering. This is what it's all about. It's not just ransomware they have to worry about. In a moment, Dave Vellante will give you some closing thoughts on the subject here. You're watching theCUBE, the leader in high tech enterprise coverage. >> As organizations migrate their business processes to multi-cloud environments, they still face numerous threats and risks of data loss. With a growing number of cloud platforms and fragmented applications, it leads to an increase in data silos, sprawl, and management complexity. As workloads become more diverse, it's challenging to effectively manage data growth, infrastructure, and resource costs across multiple cloud deployments. Using numerous backup vendor solutions for multiple cloud platforms can lead to management complexity. More importantly, the lack of centralized visibility and control can leave you exposed to security vulnerabilities, including ransomware that can cripple your business. The Druva Data Resiliency Cloud is the only 100% SaaS data resiliency platform that provides centralized, secure, air gapped, and immutable backup and recovery. With Druva, your data is safe with multiple layers of protection and is ready for fast recovery from cyberattacks, data corruption, or accidental data loss. Through a simple, easy to manage platform, you can seamlessly protect fragmented, diverse data at scale, across public clouds, and your business critical SaaS applications. Druva is the only 100% SaaS vendor that can manage, govern, and protect data across multiple clouds and business critical SaaS applications. It supports not just backup and recovery, but also data resiliency across high value use cases, such as e-discovery, sensitive data governance, ransomware, and security. No other vendor can match Druva for customer experience, infinite scale, storage optimization, data immutability, and ransomware protection. The Druva Data Resiliency Cloud, your data, always safe, always ready. Visit druva.com today to schedule a free demo. (upbeat music) >> One of the big takeaways from today's program is that in the scramble to keep business flowing over the past 2+ years, a lot of good technology practices have been put into place, but there's much more work to be done, specifically, because the frequency of attacks is on the rise and the severity of lost, stolen, or inaccessible data is so much higher today, business resilience must be designed into architectures and solutions from the start. It cannot be an afterthought. Well, actually it can be, but you won't be happy with the results. Now, part of the answer is finding the right partners, of course, but it also means taking a system's view of your business, understanding the vulnerabilities and deploying solutions that can balance cost efficiency with appropriately high levels of protection, flexibility, and speed slash accuracy of recovery. Here we hope you found today's program useful and informative. Remember, this session is available on demand in both its full format and the individual guest segments. All you got to do is go to thecube.net, and you'll see all the content, or you can go to druva.com. There are tons of resources available, including analyst reports, customer stories. There's this cool TCO calculator. You can find out what pricing looks like and lots more. Thanks for watching "Why Ransomware isn't Your Only Problem," made possible by Druva, in collaboration with IDC and presented by theCUBE, your leader in enterprise and emerging tech coverage. (upbeat music)

>>Hey everyone. Welcome back to Miami, Miami Beach. Specifically, not a bad location to have a conference. Lisa Martin here with the Cube live at IFS Unleashed. We're gonna be having a great conversation next about Ization moments of Service Rules. Royces here, as is the C of IFS for aerospace and defense. Scott Camani. Nick Ward joins us as well, the VP of Digital Systems at Roll Royce. Guys, excited to have you on the program and welcome back. >>Thank you very much. Nice to be back. It's >>Been three years since the last IFS show. I love How's Scott? I was talking with Darren Roots earlier today and I said, Well, didn't it used to be IFS world? And he said, Yes. And I said, I love the name. I would love to, to unpack that with your cheek marketing officer because it, there's a lot of, of, of power behind Unleash. A lot of companies do such and such world or accelerate, but we're talking about unleashing the power of the technology to help customers deliver those moments of service. Yes. Love it. So Scott, start us off here. Talk about ization. That's a relatively new term to me. Sure. Help me understand what it means, because IFS is a pioneer in this sense. >>We are. So one of the things that IFS is always trying to do is to try to find a way to help our customers to realize a moment of service. And that moment of service is really when they found the ability to delight their customers. And when we look at the way in which we're trying to drive those business outcomes for our customers, ization seems to be at the core of it. So whether it's the ability for a company to use a product, a service, or an outcome, they're driving ization in a way where they're shaping their business. They're orchestrating their customers and their people and their assets behind a val value chain that helps them to provide a delightful experience for their customers. And with IFS being focused on Lifecycle asset management, we no longer have customers that have to choose from best of suite or best of breed. They can actually have both with ifs. And that's something we're really excited to provide to our customers and more excited for our customers to realize that value with their customers, their partners. Along the way. >>You, you mentioned customer delight and it's a term that we, we all use it, right? But there's so much power and, and capabilities and metrics behind that phrase, customer delight, which will unpack Nick bringing you into the conversation. Talk to us a little bit about what your role is at Rolls Royce. My first thought when I saw you was, oh, the fancy cars, but we're talking about aerospace and the fence, so give us a little bit of a history. >>Okay. So yes, we don't make cars is the first point. So we are, we are power, we do power as a service. So we are most well known, I guess for large aircraft airliners. You know, if you've, if you've flown here to Miami, there's probably a 50 50 chance you've flown on a Rod Roy powered aircraft. Our market segment is what we call wide bodied aircraft where you go on, there's two aisles. So the larger section of the market, and we, we provide power, so we provide the engines, but more importantly, we've been a ization company, a service company for at least two decades. We, we have a, a service relationship we call total care. And the whole idea of total care is, yes, I have my engine, it's on my aircraft, but I take care of it. I make sure it's available to fly when you need to fly it. And all of the things that have to come together to make that happen, it's a service company. >>Service company. Talk to me a little bit about, and I wanna get got your perspective as well, but the relationship that Roll Royce and IFS have this is a little bit unique. >>Well, I can start, but I I think Nick's gonna be better served to tell us about that as our customer. Nick and I actually started this journey about four years ago, and what we did was, is we were working closely with our perspective customer Rolls-Royce identified what they were looking for as a desired business outcome. And then we found a way through the technology and the software that we provide to all of our enterprise customers globally to find a solution that actually helped to provide a, an outcome not only to Rolls-Royce, but also to our collective downstream customers, commercial operators around the globe. So that's where we started the journey and we're continuing our discussions around other solutions, but that's how we started and it's been an incredible partnership. We're so happy and proud to have Nick as a customer and a advocate of all things ifs and I'll let him kind of continue from his point of view how he sees the partnership in the relationship. >>No, thank you Scott. I think we've, we've always, we've valued the kind of relationship that we have because I think IFS has always got Rolls Royce in terms of strategic direction. What do we try to do? I said, we're a service company. You know, we, we are, we have to have a service relationship with our, our customers, our airlines. To have a service relationship, you have to be able to connect to your service customer. And ifs is a big part of how we connect for data. That's how do we understand what the airline is doing with the engines, but it's also how we return data back into the airline. So we are, we're get a very close integrated relation between us, our airlines, through a bridge that, that ifs create through the maintenance product. Got it. So it works really well. >>I I think I'd make one other point. One of the things that we've always focused on is quantifiable business value. The only way a partnership like this could possibly work is if we have a desired business outcome, but if we're providing value, So the value work that we did in conjunction with Rolls Royce and really identifying that helped to support the business case that allowed this partnership to really begin and flourish. So I I, I'd be remiss if I didn't mention that business value element that's really core to everything we do and all the, the conversations that Nick and I have. >>Well, it's all about outcomes. Absolutely. It's all about outcomes. It >>Is, it has to be about, it's about moments of service, right? That's why we're here, right? So perhaps a moment of service for Robs Royce is every time you're a passenger, you're going through the terminal. You expect your aircraft to be there, ready, waiting for you to get on and depart on time. And our moment of service is every aircraft takes off on time, every time we live. When we die by the quality of that statement, how well we live up to that statement, I think I checked this morning, there's something alike, 600 aircraft in the sky right now with Rolls Royce power carrying passengers. All of those passengers have relied on that moment. Service happening regularly like clockwork. Every single time you don't get any forgiveness for a delay, you get very little forgiveness for a cancellation that has to happen. And then so many things have to come together for that to happen. >>Those 600 aircraft, that's maybe 200,000 people right now in the sky, Wow. Those 200,000 people are trying to connect, They're trying to connect with friends, they're trying to connect with loved ones, family, colleagues, whatever the purpose is of that trip. It's really important to them. And we just have to make sure that that happens for us. We've had something like a million flights so far this year, 300 million people relying on that moment of so is happening. So I really resonate with, with the language that Scott users about the importance of sort of that focal point on when does it all come together? It comes together when as a passenger, I get on the plane and it goes and I get no issues. >>Right. Well people don't tolerate fragmented experiences anymore. No, no. I think one of the things that was in short supply during the pandemic was patience and tolerance. Sure. Not sure how much of that's gonna come back, right? But those integrated connected experiences, as you described so eloquently, Nick, those are table stakes for the customers, but also the brands behind them because of customers are unhappy, the churn rates go way up. And you see that reflected in obviously the success of the business and what you guys are doing together is seems to be quite powerful. Now then when you were on the cube with us three years ago in Boston at IFS back then you first introduced the intelligent engine and the Blue Data thread. Let's talk about the intelligent engine. Just give our audience a refresher of what that actually entails. >>So perhaps if we just step one one step back for that, just to understand how this fits in. So Roro is a service organization. We talked about that. What that means is we take a lot of the, the risk and the uncertainty away from our airline customers on the availability, the costs and maintenance effort associated with having a, having a chat engine. These are incredibly complicated and complex and sophisticated pieces of equipment. The most expensive, most sophisticated pieces of an aircraft. Managing that is, is difficult. And every airline does not want to have to focus on that. They wanna focus on being able to get the passenger on the air after, fly it, look after the airframe. So our role in that is to take that risk away, is to manage those engines, look after their health, look after their life, make sure they're available to fly whenever they need to fly. >>So for us to understand that, we then have to have data, we have to understand the state of every engine, where it is, the health of the engine, the life of that engine, what do we need to do next to that engine? And we can't do that unless we have data and that data flows into a digital platform. The intelligent engine, which is our cloud based ai, big data, all of the iot, all of the big buzzwords are there, right? So the data flows into that, that lets us run the models. It lets us understand, I can see something maybe it's a, it's a small issue, but if I leave it alone, it become a bigger issue. And maybe that will cause disruption further down the line. So we need to understand that we need to preempt it. So preemptive predictive maintenance is a, is a big part of the intelligent engine, but it's more than just that. >>It's also, we can understand how that engine is being flown. We can understand is it having a really intense flight? Is it having a more benign, gentle flight? Wow. That change time after the flight, typically after the flight. But what that means is we can then understand, actually we can keep that engine on the wing longer then you might otherwise have to do, If you have no data, you have to be conservative, safety rules, everything. Sure. So data allows you to say, actually I'm being overly conservative in this space. I can get more flying bios, flying hours from my product by extending the interval between maintenance and the intelligent engine has a large part to play in us justifying that we're able to do that. And then the final part that it does is eventually the engine is gonna have to come off from maintenance. >>These things fly 5 million miles between overhauls. You imagine you try to do that in your family car. It's, it doesn't happen. It's incredibly sophisticated thing can fly 5 million miles and then we take it off for a major overhaul. But there are thousands of these engines in the fleet. We have to understand which engine is going to come off when for what reason, and prepare our maintenance network to then receive the engine and deal with it and get it back to the customer. So the intelligent engine has a massive part to play in understanding the maintenance demand that the flying fleet is then creating. >>Wow, that's fascinating. And so you talked about that three years ago. What's next for that? I imagine there's only more evolution that's gonna happen. >>It keeps growing. It keeps growing. It's driven by the data. The more data we have, the more that we can do with that. I think as well that, you know, one of the big places that we've we've gone is you can do as much predictive analytics as you, like, there's a lot of people we'll talk about doing predictive analytics, but if you don't do the hard yards of turning predictive analytics into outcome Yeah. Then what did you get? You, you got a bit of smart advice. So we, we take that maintenance demand, we then have to understand how that drives the orchestration and the management of all the parts, the people, the work scope definition, the allocating an engine into a maintenance slot, exactly when it's gonna go. And what are we gonna do to, how do we control and manage our inventory to make sure that engine is gonna go through. >>How do we then actually execute the work inside our, our our overall shops? How do we get that engine back and and integrate our logistics process. So the intelligent engine is, if you like, the shiny front end of a process, it's all the buzzwords, but actually the hard yards behind the scene is just as if not more important to get right. And again, this is why I really like the moment of service concept. Because without that, the moment of service doesn't happen. The engine's not there, the part wasn't there. The field service maintenance guy wasn't there to go fix it. >>And brands are affected >>An, an aircraft on the ground earns no revenue for anybody. No. It's, it's a cost. It's it's a big sink of cost. It >>Is, it is. Absolutely. >>And you're helping aircraft only earn engines only earn when they fly. Yeah, >>Yeah. Absolutely. And what a fascinating, the intelligent engine. Scott, talk a little bit about, we talking about power, we can't not talk about sustainability. Yes, I understand that IFS has a new inaugural awards program that Rolls Roys was a recipient of the Change for Good sustainability awards. Congratulations. Thank you very much. And to Scott, talk to me a little bit about the Change for Good program sustainability program. What types of organizations across the industries of expertise are you looking for and why does Rules ROY really highlight what a winner embodies? >>So since Darren has joined IFS as the ceo, he's had a lot of intentional areas that we focused on. And sustainability has been one that's at the top of the list. IFS has a US ambassador Lewis Pew, who's our Chief Sustainability officer, and he helps us to provide worldwide coverage of the efforts around sustainability. So it's not just about ifss ability to become a more sustainable organization, but it's the solutions that IFS is putting together in the five verticals that we focus on that can help those organizations achieve a level of sustainability for their, for their downstream customers, their partners, and for their enterprises themselves. So when we look at, you know, the social ability for us to be more conscientious about leaving the world a better place or trying to do our best to leave the world not as bad as we came into it, sustainability is a real focus for us. And, you know, the way in which we can support an organization like Rolls Royce and Nickel obviously share those areas of focus from Rolls Royce. It's a perfect fit. And congratulations again for the award. Thank you. We're, we're, we're so excited to, to have shared that with you. We have some other customers that have achieved it across different categories, but it's an area of current and continuous focus for ifs. >>Nick, talk to us, take us out here as our last question is the, the focus on sustainability at Rolls Royce. Talk to us a little bit about that and what some of the major efforts are that you've got underway. >>I think, you know, very similar as, as, as Scott taught there, the focus within Rolls Royce as a strategic group level is really high aviation particularly, I mean we're a, we're an engineering company. We're a power company. Power inherently consumes natural resources. It tends to generate climate affecting outcomes. But at the same time, we are an innovative organization and if anybody's gonna help solve climate challenges, it's gonna be organizations like Rolls Royce who are able to bring different technologies into the market. So we have a responsibility to manage and, and optimize the behavior of our, our existing product suite. But we also have a, a vested interest in trying to move aviation on into the next, the next phase. We talk about sustainable aviation. Aviation has to earn the right to exist. People have choices. We've come out of covid, people are used to doing zoom and not flying. >>People are used to doing things when they don't necessarily get on an aircraft and do something. The aviation business always has to earn the right from the public to exist. And increasingly people will make choices about how they fly when they fly, how far they fly based on the sustainability footprint. So it's really important to us to help both our customers operate the aircraft in as sustainable and climate friendly way as we can. It's really important to find those, those balance points between the cost of an operation and it's the impact of an operation. If you go all over and say, I am going to be net, well, not even net to, but zero carbon by almost inference, that means I'm not gonna operate. You have to operate to get to an outcome. But how do I do that? Why I manage my cost, I manage the, the profitability, the organization doing it, right? >>So it has to be financially sustainable, it has to be sustainable for the people operating within it. It has to be sustainable for the planet, right? So we do that in lots of different ways in small places and, and in big places. So small things we do is we help the operator understand if you change your flight profile, you'll generate fewer emissions. You may avoid controls if you flying a different way, maybe you create trails, you'll lose, you'll lose less fuel while you're doing that. So it's cost effective for you. There was always a balance point there between the wear and tear on the engine versus the, the, the environmental impact. And you find that optimum place. One of the first things we started doing with, with Scott is we have a, a way that we life our engine components. And one of the very simple outcomes of that is using that data, the blue data for connection to the customer. >>If we can see, effectively see inside the engine about how well it's wearing and we can extend those maintenance intervals as we talked about, what that eventually does is it reduces the need to take the engine off, ship it around the world. Probably on a great big 7, 4 7 or maybe year or two ago on an Anson off four big engines flying a long distance trek, shipping our engine to an overhaul facility. We're avoiding something like 200 of those shop visit overhauls a year. So every year that's 200 flights there and back again, which don't happen, right? Collectively that's around about 15,000 automobile equivalent emissions just don't happen. So simple things we can do just starts to have accumulative effect, >>Right? Simple things that you're doing that, that have a huge impact. We could talk for so much longer on stability, I'm sure we're out of time, but I can see why Roll Royce was, was the winner of the Inocular award. Congratulations. Well deserved. Well >>Deserved. I well >>Deserved. So interesting to hear about the intelligent engine. So you're gonna have to come back. Hopefully we'll be here next year and we can hear more of the evolution. Cuz I have a feeling there's never a dual moment in what you're doing. >>It's never a dull moment. There's never an end point. >>No. >>Okay, >>Going Scott, Nick, thank you so much for joining me on the program today. Thank you, Lisa. It's great to have you talk through what's going on at ifx and the partnership with Rolls Royce. We >>Appreciate, and again, Nick, Nick, thank you for your continued support in the partnership. >>I thank you, Scott. We appreciate it. Likewise, thank >>You. Kudos all around. All right, for my guests, I'm Lisa Martin, you're watching a Cube live from Miami. We're at IFS unleashed. We'll be back shortly after a break with our next guests. So stick around.

>>The past two and a half years have seen a dramatic change in the security posture of virtually all organizations. By accelerating the digital business mandate, the isolation economy catalyzed a move toward cloud computing to support remote workers. This, we know this had several ripple effects on CISO and CIO strategies that were highly visible at the board of directors level. Now, the first major change was to recognize that the perimeter had suddenly been vaporized protection. As a result moved away from things like perimeter based firewalls toward more distributed endpoints, cloud security, and modern identity management. The second major change was a heightened awareness of the realities of ransomware. Ransomware as a service, for example, emerges a major threat where virtually anyone with access to critical data and criminal intentions could monetize corporate security exposures. The third major change was a much more acute understanding of how data protection needed to become a fundamental component of cybersecurity strategies. >>And more specifically, CIOs quickly realized that their business resilient strategies were too narrowly DR focused that their DR approach was not cost efficient and needed to be modernized. And that new approaches to operational resilience were needed to reflect the architectural and business realities of this new environment. Hello, and welcome to Why Ransomware isn't your Only Problem, a service of the Cube made possible by dva. And in collaboration with idc. I'm your host, Dave Ante, and today we're present a three part program. We'll start with the data. IDC recently conducted a global survey of 500 business technology practitioners across 20 industries to understand the degree to which organizations are aware of and prepared for the threats they face. In today's new world, IDC Research Vice President Phil Goodwin is here to share the highlights of the study and summarize the findings from a recent research report on the topic. >>After that, we're gonna hear from Curtis Preston, who's the Chief Technical Evangelist at Druva. I've known Curtis for decades. He's one of the world's foremost experts on backup and recovery, specifically in data protection. Generally. Curtis will help us understand how the survey data presented by IDC aligns with the real world findings from the field, from his point of view. And he'll discuss why so many organizations have failed to successfully recover from an attack without major pains and big costs, and how to avoid such operational disruptions and disasters. And then finally, we'll hear from the technical experts at dva, Steven Manly and Anja Serenas. Steven is a 10 time cubo and Chief technology officer at dva. And Anjan is vice president and general manager of product management at the company. And these individuals will specifically address how DVA is closing the gaps presented in the IDC survey through their product innovation. Or right now I'm gonna toss it to Lisa Martin, another one of the hosts for today's program. Lisa, over to you. >>Bill Goodwin joins me next, the VP of research at idc. We're gonna be breaking down what's going on in the threat landscape. Phil, welcome to the program. It's great to have you back on the cube. >>Hey, Lisa, it's great to be here with you. >>So talk to me about the state of the global IT landscape as we see cyber attacks massively increasing, the threat landscape changing so much, what is IDC seeing? >>You know, you, you really hit the, the top topic that we find from IT organizations as well as business organizations. And really it's that digital resilience that that ransomware that has everybody's attention, and it has the attention not just of the IT people, but of the business people alike, because it really does have profound effects across the organization. The other thing that we're seeing, Lisa, is really a move towards cloud. And I think part of that is driven by the economics of cloud, which fundamentally changed the way that we can approach disaster recovery, but also is accelerated during the pandemic for all the reasons that people have talked about in terms of work from home and so on. And then really the third thing is the economic uncertainty. And this is relatively new for 2022, but within idc we've been doing a lot of research around what are those impacts going to be. And what we find people doing is they want greater flexibility, they want more cost certainty, and they really want to be able to leverage those cloud economics to be, have the scale, upper scale, down on demand nature of cloud. So those are in a nutshell, kind of the three things that people are looking at. >>You mentioned ransomware, it's a topic we've been talking about a lot. It's a household word these days. It's now Phil, no longer if we're gonna get attacked. It's when it's how often it's the severity. Talk about ransomware as a priority all the way up the stack to the C-suite. And what are they trying to do to become resilient against it? >>Well, what, what some of the research that we did is we found that about 77% of organizations have digital resilience as a, as a top priority within their organization. And so what you're seeing is organizations trying to leverage things to become more, more resilient, more digitally resilient, and to be able to really hone in on those kinds of issues that are keeping keeping them awake at night. Quite honestly, if you think about digital resilience, it really is foundational to the organization, whether it's through digital transformation or whether it's simply data availability, whatever it might happen to be. Digital resilience is really a, a large umbrella term that we use to describe that function that is aimed at avoiding data loss, assuring data availability, and helping the organization to extract value from their data >>And digital resilience, data resilience as every company these days has to be a data company to be competitive, digital resilience, data resilience. Are you using those terms interchangeably or data resilience to find as something a little bit different? >>Well, sometimes yeah, that we do get caught using them when, when one is the other. But data resilience is really a part of digital resilience, if you think about the data itself and the context of of IT computing. So it really is a subset of that, but it is foundational to IT resilience. You, you really, you can't have it resilience about data resilience. So that, that's where we're coming from on it >>Inextricably linked and it's becoming a corporate initiative, but there's some factors that can complicate digital resilience, data resilience for organizations. What are some of those complications that organizations need to be aware of? >>Well, one of the biggest is what, what you mentioned at the, at the top of the segment. And, and that is the, the area of ransomware, the research that we found is about 46% of organizations have been hit within the last three years. You know, it's kind of interesting how it's changed over the years. Originally being hit by ransomware had a real stigma attached to it. Organizations didn't want to admit it, and they really avoided confronting that. Nowadays, so many people have been hit by it, that that stigma has gone. And so really it is becoming more of a community kind of effort as people try to, to defend against these ransoms. The other thing about it is it's really a lot like whackamole. You know, they attack us in one area and and, and we defend against it. They, so they attack us in another area and we defend against it. >>And in fact, I had a, an individual come up to me at a show not long ago and said, You know, one of these days we're gonna get pretty well defended against ransomware and it's gonna go away. And I responded, I don't think so because we're constantly introducing new systems, new software, and introducing new vulnerabilities. And the fact is ransomware is so profitable, the bad guys aren't gonna just fade into the night without giving it a a lot of fight. So I really think that ransomware is one of those things that here is here for the long term and something that we, we have to address and have to get proactive about. >>You mentioned some stats there and, and recently IDC and DVA did a white paper together that really revealed some quite shocking results. Talk to me about some of the things. Let, let's talk a little bit about the demographics of the survey and then talk about what was the biggest finding there, especially where it's concern concerning ransomware. >>Yeah, this, this was a worldwide study. It was sponsored by DVA and conducted by IDC as an independent study. And what we did, we surveyed 500 is a little over 500 different individuals across the globe in North America select countries in in western Europe, as well as several in, in Asia Pacific. And we did it across industries with our 20 different industries represented. They're all evenly represented. We had surveys that included IT practitioners, primarily CIOs, CTOs, VP of of infrastructure, you know, managers of data centers, things like that. And the, and the biggest finding that we had in this, Lisa, was really finding that there is a huge disconnect, I believe, between how people think they are ready and what the actual results are when they, when they get attacked. Some of the, some of the statistics that we learned from this, Lisa, include 83% of organizations believe or tell, told us that they have a, a playbook that, that they have for ransomware. >>I think 93% said that they have a high degree or a high or very high degree of confidence in their recovery tools and, and are fully automated. And yet when you look at the actual results, you know, I told you a moment ago, 46% have been attacked successfully. I can also tell you that in separate research, fewer than a third of organizations were able to fully recover their data without paying the ransom. And some two thirds actually had to pay the ransom. And even when they did, they didn't necessarily achieve their full recovery. You know, the bad guys aren't, aren't necessarily to be trusted. And, and so the software that they provide sometimes is, is fully recovered. Sometimes it's not. So you look at that and you go, Wow. On, on the one hand, people think they're really, really prepared, and on the other hand, the results are, are absolutely horrible. >>You know, two thirds of people having, having to pay their ransom. So you start to ask yourself, well, well, what is, what's going on there? And I believe that a lot of it comes down to, kind of reminds me of the old quote from Mike Tyson. Everybody has a plan until they get punched in the mouth. And I think that's kind of what happens with ransomware. You, you think you know what you're, you're doing, you think you're ready based on the information you have. And these people are smart people and, and they're professionals, but oftentimes you don't know what you don't know. And like I say, the bad guys are always dreaming up new ways to attack us. And so I think for that reason, a lot of these have been successful. So that was kind of the key finding to me in kind of the aha moment really in this whole thing. Lisa, >>That's a massive disconnect with the vast majority saying we have a cyber recovery playbook, yet nearly half being the victims of ransomware in the last three years, and then half of them experiencing data loss. What is it then that organizations in this situation across any industry can do to truly enable cyber resilience data resilience as it's, as we said, this is a matter of this is gonna happen just a matter of when and how often >>It it is a matter, Yeah, as you said, it's not if when or, or how often. It's really how badly. So I think what organizations are really do doing now is starting to turn more to cloud-based services. You know, finding professionals who know what they're doing, who have that breadth of experience and who have seen the kinds of, of necessary steps that it takes to do a recovery. And the fact of the matter is a disaster recovery and a cyber recovery are really not the same thing. And so organizations need to be able to, to plan the kinds of recovery associated with cyber recovery in terms of forensics, in terms of, of scanning, in terms of analysis and so forth. So they're, they're turning to professionals in the cloud much more in order to get that breadth of experience and, and to take advantage of cloud based services that are out there. >>Talk to me about some of the key advantages of cloud-based services for data resilience versus traditional legacy on-prem equipment. What are some of the advantages? Why are is IDC seeing this big shift to cloud where, where data resilience is concerned? >>Well, the first and foremost is the economics of it. You know, you can, you can have on demand resources. And in the old days when we had disaster recoveries where there we had two different data centers and a failover and so forth, you know, you had double the infrastructure. If your financial services, it might even be triple, the infrastructure is very complicated, very difficult by going to the cloud. Organizations can subscribe to disaster recovery as a service. It increasingly what we see is a new market of cyber recovery as a service. So being able to leverage those resources to be able to have the forensic analysis available to them, to be able to have the other resources available that are on demand, and to have that plan in place to have those resources in place. I think what happens in a number of situations, Lisa, is that that organizations think they're ready, but then all of a sudden they get hit and all of a sudden they have to engage with outside consultants or they have to bring in other experts and that, and that extends the time to recover that they have and it also complicates it. >>So if they have those resources in place, then they can simply turn them on, engage them, and get that recover going as quickly as possible. >>So what do you think the big issue here is, is it that these, these I p T practitioners over 500 that you surveyed across 20 industries is a global survey? Do they not know what they don't know? What's the the overlying issue here? >>Yeah, I think that's right. It's, you don't know what you don't know and until you get into a specific attack, you know, there, there are so many different ways that, that organizations can be attacked. And in fact, from this research that we found is that in many cases, data exfiltration exceeds data corruption by about 50%. And when you think about that, the, the issue is, once I have your data, what are you gonna do? I mean, there's no amount of recovery that is gonna help. So organizations are either faced with paying the ransom to keep the data from perhaps being used on the dark web or whatever, or simply saying no and, and taking their chances. So best practice things like encryption, immutability, you know, things like that that organizations can put into place. Certainly air gaps. Having a, a solid backup foundation to, to where data is you have a high recovery, high probability of recovery, things like that. Those are the kinds of things that organizations have to put into place really is a baseline to assure that they can recover as fast as possible and not lose data in the event of a ransomware attack. >>Given some of the, the, the disconnect that you articulated, the, the stats that show so many think we are prepared, we've got a playbook, yet so many are being, are being attacked. The vulnerabilities and the, and the, as the, the landscape threat landscape just gets more and more amorphous. Why, what do you recommend organizations? Do you talk to the IT practitioners, but does this go all the way up to the board level in terms of, hey guys, across every industry, we are vulnerable, this is gonna happen, we've gotta make sure that we are truly resilient and proactive? >>Yes, and in fact, what we found from this research is in more than half of cases, the CEO is directly involved in the recovery. So this is very much a C-suite issue. And if you look at the, the, the consequences of ransom where it's not just the ransom, it's the loss productivity, it's, it's the loss of, of revenue. It's, it's the loss of, of customer faith and, and, and goodwill and organizations that have been attacked have, have suffered those consequences. And, and many of them are permanent. So people at the board level where it's, whether it's the ceo, the cfo, the cio, the c cso, you know, whoever it is, they're extremely concerned about these. And I can tell you they are fully engaged in addressing these issues within their organization. >>So all the way at the top critically important, business critical for any industry. I imagine some industries may be a little bit more vulnerable than others, financial services, healthcare, education, we've just seen big attack in Los Angeles County. But in terms of establishing data resilience, you mentioned ransomware isn't going anywhere, It's a big business business, it's very profitable. But what is IDCs prediction where ransomware is concerned? Do you think that organizations, if they truly adopt cloud and status based technologies, can they get to a place where the C-suite doesn't have to be involved to the point where they're, they really actually have i i functioning playbook? >>I i, I don't know if we'll ever get to the point where the CCC C suite is not involved. It's probably very important to have that, that level of executive sponsorship. But, but what we are seeing is, in fact, we predicted by 20 25, 50 5% of organizations we'll have shifted to a cloud centric strategy for their data resilience. And the reason we say that is, you know, workloads on premises aren't going away. So that's the core. We have an increasing number of workloads in the cloud and, and at the edge, and that's really where the growth is. So being able to take that cloud centric model and take advantage of, of cloud resources like immutable storage, being able to move data from region to region inexpensively and easily and, and to be able to take that cloud centric perspective and apply it on premises as well as in the cloud and at the edge is really where we believe that organizations are shifting their focus. >>Got it. We're just cracking the surface here. Phil, I wish we had more time, but I had a chance to read the Juba sponsored IDC White paper. Fascinating finds. I encourage all of you to download that, Take a read, you're gonna learn some very interesting statistics and recommendations for how you can really truly deploy data resilience in your organization. Phil, it's been a pleasure to have you on the program. Thank you for joining >>Me. No problem. Thank you, Lisa. >>In a moment, John Furrier will be here with his next guest. For right now, I'm Lisa Martin and you are watching the Cube, the leader in live tech coverage. >>We live in a world of infinite data, sprawling, dispersed valuable, but also vulnerable. So how do organizations achieve data resiliency when faced with ever expanding workloads, increasing security threats and intensified regulations? Unfortunately, the answer often boils down to what flavor of complexity do you like best? The common patchwork approaches are expensive, convoluted, and difficult to manage. There's multiple software and hardware vendors to worry about different deployments for workloads running on premises or in the cloud. And an inconsistent security framework resulting in enterprises maintaining four of five copies of the same data, increasing costs and risk building to an incoherent mess of complications. Now imagine a world free from these complexities. Welcome to the dr. A data resiliency cloud where full data protection and beautiful simplicity converge. No hardware, no upgrades, no management, just total data resili. With just a few clicks, you can get started integrating all of your data resiliency workflows in minutes. >>Through a true cloud experience built on Amazon web services, the DR A platform automates and manages critical daily tasks giving you time to focus on your business. In other words, get simplicity, scalability, and security instantly with the dr A data resiliency cloud, your data isn't just backed up, it's ready to be used 24 7 to meet compliance needs and to extract critical insights. You can archive data for long term retention, be protected against device failure and natural disasters, and recover from ransomware lightning fast. DVA is trusted with billions of backups annually by thousands of enterprises, including more than 60 of the Fortune 500 costing up to 50% less in the convoluted hardware, software, and appliance solutions. As data grows and becomes more critical to your business advantage, a data resiliency plan is vital, but it shouldn't be complicated. Dr. A makes it simple. >>Welcome back everyone to the cube and the drew of a special presentation of why ransomware isn't your only problem. I'm John Furrier, host of the Cube. We're here with w Curtis Preston. Curtis Preston, he known in the industry Chief Technical Evangelist at Druva. Curtis, great to see you. We're here at why ransomware isn't your only problem. Great to see you. Thanks for coming on. >>Happy to be here. >>So we always see each other events now events are back. So it's great to have you here for this special presentation. The white paper from IDC really talks about this in detail. I to get your thoughts and I'd like you to reflect on the analysis that we've been covering here and the survey data, how it lines up with the real world that you're seeing out there. >>Yeah, I think it's the, the survey results really, I'd like to say, I'd like to say that they surprised me, but unfortunately they didn't. The, the, the, the data protection world has been this way for a while where there's this, this difference in belief or difference between the belief and the reality. And what we see is that there are a number of organizations that have been hit successfully, hit by ransomware, paid the ransom and, and, and or lost data. And yet the same people that were surveyed, they had to high degrees of confidence in their backup system. And I, you know, I, I could, I could probably go on for an hour as to the various reasons why that would be the case, but I, I think that this long running problem that as long as I've been associated with backups, which you know, has been a while, it's that problem of, you know, nobody wants to be the backup person. And, and people often just, they, they, they don't wanna have anything to do with the backup system. And so it sort of exists in this vacuum. And so then management is like, oh, the backup system's great, because the backup person often, you know, might say that it's great because maybe it's their job to say so. But the reality has always been very, very different. >>It's funny, you know, we're good boss, we got this covered. Good, >>It's all good, it's all good, >>You know, and the fingers crossed, right? So again, this is the reality and, and, and as it becomes backup and recovery, which we've talked about many times on the cube, certainly we have with you before, but now with ransomware also, the other thing is people get ransomware hit multiple times. So it's not, not only like they get hit once, so, you know, this is a constant chasing the tail on some ends, but there are some tools out there, You guys have a solution. And so let's get into that. You know, you have had hands on backup experience. What are the points that surprised you the most about what's going on in this world and the realities of how people should be going forward? What's your take? >>Well, I would say that the, the, the one part in the survey that surprised me the most was people that had a huge, you know, that there, there was a huge percentage of people that said that they had a, a, a, you know, a a a ransomware response, you know, in readiness program. And you look at that and you, how could you be, you know, that high percentage of people be comfortable with their ransomware readiness program and a, you know, which includes a number of things, right? There's the cyber attack aspect of responding to a ransomware attack, and then there's the recovery aspect. And so your, you believe that your company was ready for that, and then you go, and I, I think it was 67% of the people in the survey paid the ransom, which as, as a person who, you know, has spent my entire career trying to help people successfully recover their data, that number I think just hurt me the most is that because you, you talked about re infections, the surest way to guarantee that you get rein attacked and reinfected is to pay the ransom. This goes back all the way ransom since the beginning of time, right? Everyone knows if you pay the blackmail, all you're telling people is that you pay blackmail and >>You're in business, you're a good customer arr for ransomware. >>Yeah. So the, the fact that, you know, 60 what two thirds of the people that were attacked by ransomware paid the ransom. That one statistic just, just hurt my heart. >>Yeah. And I think this is the reality. I mean, we go back and even the psychology of the practitioners was, you know, it's super important to get back in recovery and that's been around for a long time, but now that's an attack vector, okay? And there's dollars involved, like I said, the arr joking, but there's recurring revenue for the, for the bad guys if they know you're paying up and if you're stupid enough not to change, you're tooling, right? So, so again, it works both ways. So I gotta ask you, why do you think so many are unable to successfully respond after an attack? Is it because they know it's coming? I mean, I mean, they're not that dumb. I mean, they have to know it's coming. Why aren't they responding and successfully to this? >>I I think it's a, it's a litany of thing starting with the, that aspect that I mentioned before, that nobody wants to have anything to do with the backup system, right? So nobody wants to be the one to raise their hand because if, if you're the one that raises their hand, you know what, that's a good idea, Curtis, why don't you look into that? Right. Nobody, nobody wants to be, Where's >>That guy now? He doesn't work here anymore. Yeah, but I I I hear where you come from exactly. Psychology. >>Yeah. So there, there's that. But then the second is that because of that, no one's looking at the fact that backups are the attack vector. They, they, they become the attack vector. And so because they're the attack vector, they have to be protected as much, if not more than the rest of the environment. The rest of the environment can live off of active directory and, you know, and things like Okta, so that you can have SSO and things like that. The backup environment has to be segregated in a very special way. Backups have to be stored completely separate for from your environment. The login and authentication and authorization system needs to be completely separate from your typical environment. Why? Because if you, if that production environment is compromised now knowing that the attacks or that the backup systems are a significant portion of the attack vector, then you've, if, if the production system is compromised, then the backup system is compromised. So you've got to segregate all of that. And I, and I just don't think that people are thinking about that. Yeah. You know, and they're using the same backup techniques that they've used for many, many years. >>So what you're saying is that the attack vectors and the attackers are getting smarter. They're saying, Hey, we'll just take out the backup first so they can backup. So we got the ransomware it >>Makes Yeah, exactly. The the largest ransomware group out there, the KTI ransomware group, they are specifically targeting specific backup vendors. They know how to recognize the backup servers. They know how to recognize where the backups are stored, and they are exfiltrating the backups first and then deleting them and then letting you know you have ransom. >>Okay, so you guys have a lot of customers, they all kind of have the same this problem. What's the patterns that you're seeing? How are they evolving? What are some of the things that they're implementing? What is the best practice? >>Well, again, you, you've got to fully segregate that data. There are, and, and everything about how that data is stored and everything about how that data's created and accessed. There are ways to do that with other, you know, with other commercial products, you can take a, a, a standard product and put a number of layers of defense on top of it, or you can switch to the, the way Druva does things, which is a SAS offering that stores your data completely in the cloud in our account, right? So your account could be completely compromised. That has nothing to do with our account. And the, the, it's a completely different authentication and authorization system. You've got multiple layers of defense between your computing environment and where we store your backups. So basically what you get by default with the, the way juva stores your backups is the best you can get after doing many, many layers of defense on the other side and having to do all that work with us. You just log in and you get all of that. >>I guess how do, how do you break the laws of physics? I guess that's the question here. >>Well, when, because that's the other thing is that by storing the data in the cloud, we, we do, and I've said this a few times, that you get to break the laws of physics and the, the only way to do that is to, is time travel and what, that's what it, so yeah, so Druva has time travel. What, and this is a criticism by the way. I don't think this is our official position, but Yeah. But the, the idea is that the only way to restore data as fast as possible is to restore it before you actually need it. And that's what kind of what I mean by time travel in that you basically, you configure your dr your disaster recovery environment in, in DVA one time. And then we are pre restoring your data as often as you tell us to do, to bring your DR environment up to the, you know, the, the current environment as quickly as we can so that in a disaster recovery scenario, which is part of your ransomware response, right? Again, there are many different parts, but when you get to actually restoring the data, you should be able to just push a button and go the, the data should already be restored. And that's the, i that's the way that you break the laws of physics is you break the laws of time. >>Well, I, everyone wants to know the next question, and this is the real big question, is, are you from the future? >>Yeah. Very much the future. >>What's it like in the future? Backup recovery as a restore, Is it air gaping? Everything? >>Yeah. It, it, it, Well it's a world where people don't have to worry about their backups. I I like to use the phrase, get outta the backup business. Just get into the ReSTOR business. I I, you know, I'm, I'm a grandfather now and I, and I love having a granddaughter and I often make the joke that if I don't, if I'd have known how great grandkids were, I would've skipped straight to them, right? Not possible. Just like this. Recoveries are great. Backups are really hard. So in the future, if you use a SAS data protection system and data resiliency system, you can just do recoveries and not have to worry about >>Backups. Yeah. And what's great about your background is you've got a lot of historical perspective. You've seen that been in the ways of innovation now it's really is about the recovery and real time. So a lot of good stuff going on. And God think automated thingss gotta be rocking and rolling. >>Absolutely. Yeah. I do remember, again, having worked so hard with many clients over the years, back then, we worked so hard just to get the backup done. There was very little time to work on the recovery. And I really, I kid you not that our customers don't have to do all of those things that all of our competitors have to do to, you know, to, to break, to try to break the laws of physics. I've been fighting the laws of physics my entire career to get the backup done in the first place. Then to secure all the data, right to air gap it and make sure that a ransomware attack isn't going to attack it. Our customers get to get straight to a fully automated disaster recovery environment that they get to test as often as possible and they get to do a full test by simply pressing a single button. And you know, I, I wish that, I wish everybody had that ability. >>Yeah, I mean, security's a big part of it. Data's in the middle of it all. This is now mainstream front lines. Great stuff Chris, great to have you on, bring that perspective and thanks for the insight. Really >>Appreciate it. Always happy to talk about my favorite subject. >>All right, we'll be back in a moment. We'll have Steven Manley, the cto and on John Shva, the GM and VP of Product Manage will join me. You're watching the cube, the leader in high tech enterprise coverage. >>Ransomware is top of mind for everyone. Attacks are becoming more frequent and more sophisticated. It's a problem you can't solve alone anymore. Ransomware is built to exploit weaknesses in your backup solution, destroying data and your last line of defense. With many vendors, it can take a lot of effort and configuration to ensure your backup environment is secure. Criminals also know that it's easy to fall behind on best practices like vulnerability, scans, patches and updates. In fact, 42% of vulnerabilities are exploited after a patch has been released after an attack. Recovery can be a long and manual process that still may not restore clean or complete data. The good news is that you can keep your data safe and recover faster with the DR A data resiliency cloud on your side. The DR A platform functions completely in the cloud with no hardware, software, operating system, or complex configurations, which means there are none of the weaknesses that ransomware commonly uses to attack backups. >>Our software as a service model delivers 24 7 365 fully managed security operations for your backup environment. We handle all the vulnerability scans, patches and upgrades for you. DVA also makes zero trust security easy with builtin multifactor authentication, single sign-on and role-based access controls in the event of an attack. Druva helps you stop the spread of ransomware and quickly understand what went wrong. With builtin access insights and anomaly detection, then you can use industry first tools and services to automate the recovery of clean unencrypted data from the entire timeframe of the attack. Cyber attacks are a major threat, but you can make protection and recovery easy with dva. >>Welcome back everyone to the Cubes special presentation with DVA on why ransomware isn't your only problem. I'm John er, host of the Cube. Our next guest are Steven Manley, Chief Technology Officer of dva and I, John Trini VAs, who is the general manager and vice president of product management and Druva. Gentleman, you got the keys to the kingdom, the technology, ransomware, data resilience. This is the topic, the IDC white paper that you guys put together with IDC really kind of nails it out. I want to get into it right away. Welcome to this segment. I really appreciate it. Thanks for coming on. >>Great to be here John. >>So what's your thoughts on the survey's conclusion? I've obviously the resilience is huge. Ransomware is continues to thunder away at businesses and causes a lot of problems. Disruption, I mean just it's endless ransomware problems. What's your thoughts on the con conclusion? >>So I'll say the, the thing that pops out to me is, is on the one hand, everybody who sees the survey, who reads, it's gonna say, well that's obvious. Of course ransomware continues to be a problem. Cyber resilience is an issue that's plaguing everybody. But, but I think when you dig deeper and there and there's a lot of subtleties to look into, but, but one of the things that, that I hear on a daily basis from the customers is it's because the problem keeps evolving. It, it's not as if the threat was a static thing to just be solved and you're done because the threat keeps evolving. It remains top of mind for everybody because it's so hard to keep up with with what's happening in terms of the attacks. >>And I think the other important thing to note, John, is that people are grappling with this ransomware attack all of a sudden where they were still grappling with a lot of legacy in their own environment. So they were not prepared for the advanced techniques that these ransomware attackers were bringing to market. It's almost like these ransomware attackers had a huge leg up in terms of technology that they had in their favor while keeping the lights on was keeping it away from all the tooling that needed to do. A lot of people are even still wondering when that happens next time, what do I even do? So clearly not very surprising. Clearly I think it's here to stay and I think as long as people don't retool for a modern era of data management, this is going to stay this >>Way. Yeah, I mean I hear this whole time and our cube conversations with practitioners, you know there, it's kind of like the security pro give me more tools, I'll buy anything that comes in the market. I'm desperate. There's definitely attention but it doesn't seem like people are satisfied with the tooling that they have. Can you guys share kind of your insights into what's going on in the product side? Because you know, people claim that they have tools at fine points of, of recovery opportunities but they can't get there. So it seems to be that there's a confidence problem here in the market. What, how do you guys see that? Cuz I think this is where the rubber meets the road with ransomware cuz it's, it is a moving train, it's always changing but it doesn't seem as confidence. Can you guys talk about that? What's your reaction? >>Yeah, let me jump in first and Steven can add to it. What happens is I think this is a panic buying and they have accumulated this tooling now just because somebody said could solve your problem, but they haven't had a chance to take a re-look from a ground up perspective to see where are the bottlenecks, where are the vulnerabilities and which tooling set needs to lie? Where, where does the logic need to recite and what in Drew we are watching people do and people do it successfully, is that as they have adopted through our technology, which is ground up built for the cloud and really built in a way which is, you know, driven at a data insight level where we have people even monitoring our service for anomalies and activities that are suspicious. We know where we need to play a role in really kind of mitigating this ransomware. >>And then there's a whole plethora of ecosystem players that kind of combine to really really finish the story so to say, right? So I think this has been a panic buying situation. This is like, get me any help you can give me. And I think as this settles down and people really understand that longer term as they really build out a true defense mechanism, they need to think really ground up. They will start to really see the value of technologies like Druva and tried to identify the right set of ecosystem to really bring together to solve it meaningfully. >>Steven, >>I was gonna say, I mean one, one of the, one of the really interesting things in the survey for me and, and, and for a moment, little more than a moment, it made me think was that the large number of respondents who said I've got a really efficient well run backup environment, who then on basically the next question said, and I have no confidence that I can recover from a ransomware attack. And you scratch your head and you think, well if your backup environment is so good, why do you have such low confidence? And, and, and I think that's the moment when we, we dug deeper and we realized, you know, if you've got a traditional architecture and let's face the dis base architecture's been around for almost two decades now in terms of dis based backup, you can have that tune to the help that can be running as efficiently, efficiently as you want it, but it was built before the ransomware attacks before, before all these cyber issues, you know, really start hitting companies. And so I have this really well run traditional backup environment that is not at all built for these modern threat vectors. And so that's really why customers are saying I'm doing the best I can, but as Angen pointed out, the architecture, the tooling isn't there to support what, what problems I need to solve today. Yeah, >>Great point. And so yeah, well that's a great point. Before we get into the customer side, I wanna get to in second, you know, I interviewed Jare, the the founder CEO many years ago, even before the pandemic. You mentioned modern, you guys have always had the cloud, which r this is huge. Now that you're past the pandemic, what is that modern cloud edge you guys have? Cuz that's a great point. A lot of stuff was built kind of Beckham recovery bolted on, not really kind of designed into the, the current state of the infrastructure and the cloud native application modern environment we're seeing. Right? Now's a huge issue >>I think. I think it's, it's to me there's, there's three things that come up over and over and over again as, as we talk to people in terms of, you know, being built in cloud, being cloud native, why is an advantage? The first one is, is security and ransomware. And, and, and we can go deeper, but the most obvious one that always comes up is every single backup you do with DVA is air gap offsite managed under a separate administrative domain so that you're not retrofitting any sort of air gap network and buying another appliance or setting up your own cloud environment to manage this. Every backup is ransomware protected, guaranteed. I think the second advantage is the scalability. And you know this, this certainly plays into account as your, your business grows or in some cases as you shrink or repurpose workloads, you're only paying for what you use. >>But it also plays a a big role again when you start thinking of ransomware recoveries because we can scale your recovery in cloud on premises as much or as little as you want. And then I think the third one is we're seeing a basically things evolving new workloads, data sprawl, new threat vectors. And one of the nice parts of being a SA service in the cloud is you're able to roll out new functionality every two weeks and there's no upgrade cycle, there's no waiting, you know, the customer doesn't have to say, Wow, I need it six months in the lab before I upgrade it and it's an 18 month, 24 month cycle before the functionality releases. You're getting it every two weeks and it's backed by Druva to make sure it works. >>That says on John, you know, you got the, the product side, you know, it's challenging job cuz you have so many customers asking for things probably on the roadmap you probably go hour for that one. But I wanna get your thoughts on what you're hearing and seeing from customers. You know, we just reviewed the IDC with Phil. How are you guys responding to your customer's needs? Because it seems that it's highly accelerated on the, probably on the feature request, but also structurally as as ransomware continues to evolve. What are you hearing, what's the key customer need? How are you guys responding? >>Yeah, actually I have two things that I hear very clearly when I talk to customers. One, I think after listening to their security problems and their vulnerability challenges because we see customers and help customers who are getting challenge by ransomware on a weekly basis. And what I find that this problem is not just a technology problem, it's an operating model problem. So in order to really secure themselves, they need a security operating model and a lot of them haven't figured out that security operating model in totality. Now where we come in as rua is that we are providing them the cloud operating model and a data protection operating model combined with a data insights operating model which all fit into their overall security operating model that they are really owning and they need to manage and operate because this is just not about a piece of technology. >>On top of that, I think our customers are getting challenged by all the same challenges of not just spending time on keeping the lights on but innovating faster with faster, with less. And that has been this age old problem, do more with less. But in this, in this whole, they're like trying to innovate in the middle of the war so to say, right, the war is happening, they're getting attacked, but there's also net new shadow IT challenges that's forcing them to make sure that they can manage all the new applications that are getting developed in the cloud. There is thousands of SaaS applications that they're consuming not knowing which data is critical to their success and which ones to protect and govern and secure. So all of these things are coming at them at a hundred miles per hour while they're just, you know, trying to live one day at a time. >>And unless they really develop this overall security operating model helped by cloud native technologies like Druva that really providing them a true cloud native model of really giving like a touchless and an invisible protection infrastructure. Not just beyond backups, beyond just the data protection that we all know of into this kind of this mindset of kind of being able to look at where each of those functionalities need to lie. That's where I think they're grappling with now. Drew is clearly helping them with keep up to pace with the public cloud innovations that they need to do and how to protect data. We just launched our EC two offering to protect EC two virtual machines back in aws and we are gonna be continuing to evolve that to further many services that public cloud software cuz our customers are really kind of consuming them at breakneck speed. >>So the new workloads, the new security capabilities. Love that. Good, good call out there. Steven, this still the issue of the disruption side of it, you guys have a guarantee there's a cost of ownership as you get more tools. Can you talk about that angle of it? Because this is, you got new workloads, you got the new security needs, what's the disruption impact? Cause you know, you won't avoid that. How much is it gonna cost you? And you guys have this guarantee, can you explain that? >>Yeah, absolutely. So, so Dr launched our 10 million data resiliency guarantee. And, and for us, you know, there were, there were really two key parts to this. The first obviously is 10 million means that, you know, again we're, we're we're willing to put our money where our mouth is and, and that's a big deal, right? That that, that we're willing to back this with the guarantee. But then the second part, and, and, and this is the part that I think reflects that, that sort of model that Angen was talking about, we, we sort of look at this and we say the goal of DVA is to do the job of protecting and securing your data for you so that you as a customer don't have to do it anymore. And so the guarantee actually protects you against multiple types of risks all with SLAs. So everything from, you know, your data's gonna be recoverable in the case of a ransomware attack. >>Okay, that's good. Of course for it to be recoverable, we're also guaranteeing, you know, your backup, your backup success rate. We're also guaranteeing the availability of the service. You know, we're, we're guaranteeing that the data that we're storing for you can't be compromised or leaked externally and you know, we're guaranteeing the long term durability of the data so that if you back up with us today and you need to recover 30 years from now, that data's gonna be recovered. So we wanted to really attack the end to end, you know, risks that, that, that affect our customers. Cybersecurity is a big deal, but it is not the only problem out there and the only way for this to work is to have a service that can provide you SLAs across all of the risks because that means, again, as a SAS vendor, we're doing the job for you so you're buying results as opposed to technology. >>That's great. Great point. Ransomware isn't the only problem that's the title of this presentation, but is a big one. People concerned about it. So great stuff. In the last five minutes guys, if you don't mind, I'd love to have you share what's on the horizon for dva. You mentioned the new workloads on John, you mentioned this new security hearing shift left DevOps is now the developer model, they're running it get data and security teams now stepping in and trying to be as vo high velocity as possible for the developers and enterprises. What's on the horizon, Ava? What trends is the company watching and how are you guys putting that together to stay ahead in the marketplace and the competition? >>Yeah, I think listening to our customers, what we realize is they need help with the public cloud. Number one. I think that's a big wave of consumption. People are consolidating their data centers, moving to the public cloud. They need help in expanding data protection, which becomes the basis of a lot of the security operating model that I talked about. They need that first from before they can start to get into much more advanced level of insights and analytics on that data to protect themselves and secure themselves and do interesting things with that data. So we are expanding our coverage on multiple fronts there. The second key thing is to really bring together a very insightful presentation layer, which I think is very unique to thwa because only we can look at multiple tenants, multiple customers because we are a SAS vendor and look at insights and give them best practices and guidances and analytics that nobody else can give. >>There's no silo anymore because we are able to take a good big vision view and now help our customers with insights that otherwise that information map is completely missing. So we are able to guide them down a path where they can optimize which workloads need, what kind of protection, and then how to secure them. So that is the second level of insights and analytics that we are building. And there's a whole plethora of security offerings that we are gonna build all the way from a feature level where we have things like recycle bin that's already available to our customers today to prevent any anomalous behavior and attacks that would delete their backups and then they still have a way to recover from it, but also things to curate and get back to that point in time where it is safe to recover and help them with a sandbox which they can recover confidently knowing it's not going to jeopardize them again and reinfect the whole environment again. So there's a whole bunch of things coming, but the key themes are public cloud, data insights and security and that's where my focus is to go and get those features delivered and Steven can add a few more things around services that Steven is looking to build in launch. >>Sure. So, so yeah, so, so John, I think one of the other areas that we see just an enormous groundswell of interest. So, so public cloud is important, but there are more and more organizations that are running hundreds if not thousands of SaaS applications and a lot of those SaaS applications have data. So there's the obvious things like Microsoft 365 Google workspace, but we're also seeing a lot of interest in protecting Salesforce because if you think about it, you know, if you, if if someone you know deletes some really important records in Salesforce, that's, that's actually actually kind of the record of your business. And so, you know, we're looking at more and more SaaS application protection and, and really getting deep in that application awareness. It's not just about backup and recovery. When you look at something like, like a sales force or something like Microsoft 365, you do wanna look into sandboxing, you wanna, you wanna look into long term archival because again, this is the new record of the business, what used to be in your on premises databases that all lives in cloud and SaaS applications now. >>So that's a really big area of investment for us. The second one, just to echo what, what engine said is, you know, one of the great things of being a SaaS provider is I have metadata that spans across thousands of customers and tens of billions of backups a year. And I'm tracking all sorts of interesting information that is going to enable us to do things like make backups more autonomous so that customers, again, I want to do the job for them, will do all the tuning, we'll do all the management for them to be able to better detect ransomware attacks, better respond to ransomware attacks because we're seeing across the globe. And then of course being able to give them more insight into what's happening in their data environment so they can get a better security posture before any attack happens. Because let's face it, if you can set your, your data up more cleanly, you're gonna be a lot less worried and a lot less exposed from that attack happens. So we want to be able to again, cover those SaaS applications in addition to the public cloud. And then we want to be able to use our metadata and use our analytics and use this massive pipeline. We've got to deliver value to our customers, not just charts and graphs, but actual services that enable them to focus their attention on other parts of the business. >>That's great stuff. Run John. >>And remember John, I think all this while keeping things really easy to consume consumer grade UI APIs and the, the really, the power of SaaS as a service simplicity to kind of continue on amongst kind of keeping these complex technologies together. >>Aj, that's a great call out. I was gonna mention ease of use is and self-service, big part of the developer and IT experience expected, it's the table stakes, love the analytic angle. I think that brings the scale to the table and faster time to value to get to learn best practices. But the end of the day automation, cross cloud protection and security to protect and recover. This is huge and this is big part of not only just protecting against ransomware and other things, but really being fast and being agile. So really appreciate the insights. Thanks for sharing on this segment, really under the hood and really kind of the value of of the product. Thanks for coming on. Appreciate it. >>Thank you very much. >>Okay, there it is. You got the experts talking about under the hood, the product, the value, the future of what's going on with Druva and the future of cloud native protecting and recovering. This is what it's all about. It's not just ransomware they have to worry about. In a moment, Dave Ante will give you some closing thoughts on the subject here you're watching the cube, the leader in high tech enterprise coverage. >>As organizations migrate their business processes to multi-cloud environments, they still face numerous threats and risks of data loss. With a growing number of cloud platforms and fragmented applications, it leads to an increase in data silos, sprawl, and management complexity. As workloads become more diverse, it's challenging to effectively manage data growth infrastructure, and resource costs across multiple cloud deployments. Using numerous backup vendor solutions for multiple cloud platforms can lead to management complexity. More importantly, the lack of centralized visibility and control can leave you exposed to security vulnerabilities, including ransomware that can cripple your business. The dr. A Data Resiliency Cloud is the only 100% SAS data resiliency platform that provides centralized, secure air gapped and immutable backup and recovery. With dva, your data is safe with multiple layers of protection and is ready for fast recovery from cyber attack, data corruption, or accidental data loss. Through a simple, easy to manage platform, you can seamlessly protect fragmented, diverse data at scale, across public clouds and your business critical SaaS applications. Druva is the only 100% SAS fender that can manage, govern, and protect data across multiple clouds and business critical SAS applications. It supports not just backup and recovery, but also data resiliency across high value use cases such as e-discovery, sensitive data governance, ransomware, and security. No other vendor can match Druva for customer experience, infinite scale storage optimization, data immutability and ransomware protection. The DVA data resiliency cloud your data always safe, always ready. Visit druva.com today to schedule a free demo. >>One of the big takeaways from today's program is that in the scramble to keep business flowing over the past two plus years, a lot of good technology practices have been put into place, but there's much more work to be done specifically because the frequency of attacks is on the rise and the severity of lost, stolen, or inaccessible data is so much higher. Today, business resilience must be designed into architectures and solutions from the start. It cannot be an afterthought. Well, actually it can be, but you won't be happy with the results. Now, part of the answer is finding the right partners, of course, but it also means taking a systems' view of your business, understanding the vulnerabilities and deploying solutions that can balance cost efficiency with appropriately high levels of protection, flexibility, and speed slash accuracy of recovery. You know, we hope you found today's program useful and informative. Remember, this session is available on demand in both its full format and the individual guest segments. All you gotta do is go to the cube.net and you'll see all the content, or you can go to druva.com. There are tons of resources available, including analyst reports, customer stories. There's this cool TCO calculator. You can find out what pricing looks like and lots more. Thanks for watching why Ransomware isn't your only problem Made possible by dva, a collaboration with IDC and presented by the Cube, your leader in enterprise and emerging tech coverage.

>>The past two and a half years have seen a dramatic change in the security posture of virtually all organizations. By accelerating the digital business mandate, the isolation economy catalyzed a move toward cloud computing to support remote workers. This, we know this had several ripple effects on CISO and CIO strategies that were highly visible at the board of directors level. Now, the first major change was to recognize that the perimeter had suddenly been vaporized protection. As a result moved away from things like perimeter based firewalls toward more distributed endpoints, cloud security, and modern identity management. The second major change was a heightened awareness of the realities of ransomware. Ransomware as a service, for example, emerges a major threat where virtually anyone with access to critical data and criminal intentions could monetize corporate security exposures. The third major change was a much more acute understanding of how data protection needed to become a fundamental component of cybersecurity strategies. >>And more specifically, CIOs quickly realized that their business resilient strategies were too narrowly DR focused that their DR approach was not cost efficient and needed to be modernized. And that new approaches to operational resilience were needed to reflect the architectural and business realities of this new environment. Hello and welcome to Why Ransomware isn't your Only Problem, a service of the Cube made possible by dva. And in collaboration with idc. I'm your host, Dave Ante, and today we're present a three part program. We'll start with the data. IDC recently conducted a global survey of 500 business technology practitioners across 20 industries to understand the degree to which organizations are aware of and prepared for the threats they face. In today's new world, IDC Research Vice President Phil Goodwin is here to share the highlights of the study and summarize the findings from a recent research report on the topic. >>After that, we're gonna hear from Curtis Preston, who's the Chief Technical Evangelist at Druva. I've known Curtis for decades. He's one of the world's foremost experts on backup and recovery, specifically in data protection. Generally. Curtis will help us understand how the survey data presented by IDC aligns with the real world findings from the field, from his point of view. And he'll discuss why so many organizations have failed to successfully recover from an attack without major pains and big costs, and how to avoid such operational disruptions and disasters. And then finally, we'll hear from the technical experts at dva, Steven Manly and Anja Serenas. Steven is a 10 time cubo and Chief technology officer at dva, and Anjan is vice president and general manager of product management at the company. And these individuals will specifically address how DVA is closing the gaps presented in the IDC survey through their product innovation. Or right now I'm gonna toss it to Lisa Martin, another one of the hosts for today's program. Lisa, over to you. >>Bill Goodwin joins me next, the VP of research at idc. We're gonna be breaking down what's going on in the threat landscape. Phil, welcome to the program. It's great to have you back on the cube. >>Hey, Lisa, it's great to be here with you. >>So talk to me about the state of the global IT landscape as we see cyber attacks massively increasing, the threat landscape changing so much, what is IDC seeing? >>You know, you, you really hit the, the top topic that we find from IT organizations as well as business organizations. And really it's that digital resilience that that ransomware that has everybody's attention and it has the attention not just of the IT people, but of the business people alike, because it really does have profound effects across the organization. The other thing that we're seeing, Lisa, is really a move towards cloud. And I think part of that is driven by the economics of cloud, which fundamentally changed the way that we can approach disaster recovery, but also is accelerated during the pandemic for all the reasons that people have talked about in terms of work from home and so on. And then really the third thing is the economic uncertainty. And this is relatively new for 2022, but within idc we've been doing a lot of research around what are those impacts going to be. And what we find people doing is they want greater flexibility, they want more cost certainty, and they really want to be able to leverage those cloud economics to be, have the scale, upper scale, down on demand nature of cloud. So those are in a nutshell, kind of the three things that people are looking at. >>You mentioned ransomware, it's a topic we've been talking about a lot. It's a household word these days. It's now Phil, no longer if we're gonna get attacked. It's when it's how often it's the severity. Talk about ransomware as a priority all the way up the stack to the C-suite. And what are they trying to do to become resilient against it? >>Well, what, what some of the research that we did is we found that about 77% of organizations have digital resilience as a, as a top priority within their organization. And so what you're seeing is organizations trying to leverage things to become more, more resilient, more digitally resilient, and to be able to really hone in on those kinds of issues that are keeping keeping them awake at night. Quite honestly, if you think about digital resilience, it really is foundational to the organization, whether it's through digital transformation or whether it's simply data availability, whatever it might happen to be. Digital resilience is really a, a large umbrella term that we use to describe that function that is aimed at avoiding data loss, assuring data availability, and helping the organization to extract value from their data >>And digital resilience, data resilience as every company these days has to be a data company to be competitive, digital resilience, data resilience. Are you using those terms interchangeably or data resilience to find as something a little bit different? >>Well, sometimes yeah, that we do get caught using them when, when one is the other. But data resilience is really a part of digital resilience, if you think about the data itself and the context of of IT computing. So it really is a subset of that, but it is foundational to IT resilience. You, you really, you can't have it resilience about data resilience. So that, that's where we're coming from on it >>Inextricably linked and it's becoming a corporate initiative, but there's some factors that can complicate digital resilience, data resilience for organizations. What are some of those complications that organizations need to be aware of? >>Well, one of the biggest is what, what you mentioned at the, at the top of the segment and, and that is the, the area of ransomware, the research that we found is about 46% of organizations have been hit within the last three years. You know, it's kind of interesting how it's changed over the years. Originally being hit by ransomware had a real stigma attached to it. Organizations didn't want to admit it, and they really avoided confronting that. Nowadays, so many people have been hit by it, that that stigma has gone. And so really it is becoming more of a community kind of effort as people try to, to defend against these ransoms. The other thing about it is it's really a lot like whackamole. You know, they attack us in one area and and, and we defend against it. They, so they attack us in another area and we defend against it. >>And in fact, I had a, an individual come up to me at a show not long ago and said, You know, one of these days we're gonna get pretty well defended against ransomware and it's gonna go away. And I responded, I don't think so because we're constantly introducing new systems, new software, and introducing new vulnerabilities. And the fact is ransomware is so profitable, the bad guys aren't gonna just fade into the night without giving it a a lot of fight. So I really think that ransomware is one of those things that here is here for the long term and something that we, we have to address and have to get proactive about. >>You mentioned some stats there and, and recently IDC and DVA did a white paper together that really revealed some quite shocking results. Talk to me about some of the things. Let, let's talk a little bit about the demographics of the survey and then talk about what was the biggest finding there, especially where it's concern concerning ransomware. >>Yeah, this, this was a worldwide study. It was sponsored by DVA and conducted by IDC as an independent study. And what we did, we surveyed 500 is a little over 500 different individuals across the globe in North America select countries in in western Europe, as well as several in, in Asia Pacific. And we did it across industries with our 20 different industries represented. They're all evenly represented. We had surveys that included IT practitioners, primarily CIOs, CTOs, VP of of infrastructure, you know, managers of data centers, things like that. And the, and the biggest finding that we had in this, Lisa, was really finding that there is a huge disconnect, I believe, between how people think they are ready and what the actual results are when they, when they get attacked. Some of the, some of the statistics that we learned from this, Lisa, include 83% of organizations believe or tell, told us that they have a, a playbook that, that they have for ransomware. >>I think 93% said that they have a high degree or a high or very high degree of confidence in their recovery tools and, and are fully automated. And yet when you look at the actual results, you know, I told you a moment ago, 46% have been attacked successfully. I can also tell you that in separate research, fewer than a third of organizations were able to fully recover their data without paying the ransom. And some two thirds actually had to pay the ransom. And even when they did, they didn't necessarily achieve their full recovery. You know, the bad guys aren't, aren't necessarily to be trusted. And, and so the software that they provide sometimes is, is fully recovered, sometimes it's not. So you look at that and you go, Wow. On, on the one hand people think they're really, really prepared and on the other hand the results are, are absolutely horrible. >>You know, two thirds of people having, having to pay their ransom. So you start to ask yourself, well, well, what is, what's going on there? And I believe that a lot of it comes down to, kind of reminds me of the old quote from Mike Tyson. Everybody has a plan until they get punched in the mouth. And I think that's kind of what happens with ransomware. You, you think you know what you're, you're doing, you think you're ready based on the information you have. And these people are smart people and, and they're professionals, but oftentimes you don't know what you don't know. And like I say, the bad guys are always dreaming up new ways to attack us. And so I think for that reason, a lot of these have been successful. So that was kind of the key finding to me in kind of the aha moment really in this whole thing. Lisa, >>That's a massive disconnect with the vast majority saying we have a cyber recovery playbook, yet nearly half being the victims of ransomware in the last three years and then half of them experiencing data loss. What is it then that organizations in this situation across any industry can do to truly enable cyber resilience data resilience as it's, as we said, this is a matter of this is gonna happen just a matter of when and how often >>It it is a matter, Yeah, as you said, it's not if when or, or how often. It's really how badly. So I think what organizations are really do doing now is starting to turn more to cloud-based services. You know, finding professionals who know what they're doing, who have that breadth of experience and who have seen the kinds of, of necessary steps that it takes to do a recovery. And the fact of the matter is a disaster recovery and a cyber recovery are really not the same thing. And so organizations need to be able to, to plan the kinds of recovery associated with cyber recovery in terms of forensics, in terms of, of scanning, in terms of analysis and so forth. So they're, they're turning to professionals in the cloud much more in order to get that breadth of experience and, and to take advantage of cloud based services that are out there. >>Talk to me about some of the key advantages of cloud-based services for data resilience versus traditional legacy on-prem equipment. What are some of the advantages? Why are is IDC seeing this big shift to cloud where, where data resilience is concerned? >>Well, the first and foremost is the economics of it. You know, you can, you can have on demand resources. And in the old days when we had disaster recoveries where there we had two different data centers and a failover and so forth, you know, you had double the infrastructure. If your financial services, it might even be triple, the infrastructure is very complicated, very difficult by going to the cloud. Organizations can subscribe to disaster recovery as a service. It increasingly what we see is a new market of cyber recovery as a service. So being able to leverage those resources to be able to have the forensic analysis available to them, to be able to have the other resources available that are on demand, and to have that plan in place to have those resources in place. I think what happens in a number of situations, Lisa, is that that organizations think they're ready, but then all of a sudden they get hit and all of a sudden they have to engage with outside consultants or they have to bring in other experts and that, and that extends the time to recover that they have and it also complicates it. >>So if they have those resources in place, then they can simply turn them on, engage them, and get that recover going as quickly as possible. >>So what do you think the big issue here is, is it that these, these I p T practitioners over 500 that you surveyed across 20 industries is a global survey? Do they not know what they don't know? What's the the overlying issue here? >>Yeah, I think that's right. It's, you don't know what you don't know and until you get into a specific attack, you know, there, there are so many different ways that, that organizations can be attacked. And in fact, from this research that we found is that in many cases, data exfiltration exceeds data corruption by about 50%. And when you think about that, the, the issue is, once I have your data, what are you gonna do? I mean, there's no amount of recovery that is gonna help. So organizations are either faced with paying the ransom to keep the data from perhaps being used on the dark web or whatever, or simply saying no and, and taking their chances. So best practice things like encryption, immutability, you know, things like that that organizations can put into place. Certainly air gaps. Having a, a solid backup foundation to, to where data is you have a high recovery, high probability of recovery, things like that. Those are the kinds of things that organizations have to put into place really is a baseline to assure that they can recover as fast as possible and not lose data in the event of a ransomware attack. >>Given some of the, the, the disconnect that you articulated, the, the stats that show so many think we are prepared, we've got a playbook, yet so many are being, are being attacked. The vulnerabilities and the, and the, as the, the landscape threat landscape just gets more and more amorphous. Why, what do you recommend organizations? Do you talk to the IT practitioners, but does this go all the way up to the board level in terms of, hey guys, across every industry we are vulnerable, this is gonna happen, we've gotta make sure that we are truly resilient and proactive? >>Yes, and in fact, what we found from this research is in more than half of cases, the CEO is directly involved in the recovery. So this is very much a C-suite issue. And if you look at the, the, the consequences of ransom where it's not just the ransom, it's the loss productivity, it's, it's the loss of, of revenue, it's, it's the loss of, of customer faith and, and, and goodwill and organizations that have been attacked have, have suffered those consequences. And, and many of them are permanent. So people at the board level where it's, whether it's the ceo, the cfo, the cio, the c cso, you know, whoever it is, they're extremely concerned about these. And I can tell you they are fully engaged in addressing these issues within their organization. >>So all the way at the top critically important, business critical for any industry. I imagine some industries may be a little bit more vulnerable than others, financial services, healthcare, education, we've just seen big attack in Los Angeles County. But in terms of establishing data resilience, you mentioned ransomware isn't going anywhere, it's a big business business, it's very profitable. But what is IDCs prediction where ransomware is concerned? Do you think that organizations, if they truly adopt cloud and status based technologies, can they get to a place where the C-suite doesn't have to be involved to the point where they're, they really actually have i i functioning playbook? >>I i, I don't know if we'll ever get to the point where the CCC C suite is not involved. It's probably very important to have that, that level of executive sponsorship. But, but what we are seeing is, in fact we predicted by 20 25, 50 5% of organizations we'll have shifted to a cloud centric strategy for their data resilience. And the reason we say that is, you know, workloads on premises aren't going away. So that's the core. We have an increasing number of workloads in the cloud and, and at the edge, and that's really where the growth is. So being able to take that cloud centric model and take advantage of, of cloud resources like immutable storage, being able to move data from region to region inexpensively and easily and, and to be able to take that cloud centric perspective and apply it on premises as well as in the cloud and at the edge is really where we believe that organizations are shifting their focus. >>Got it. We're just cracking the surface here. Phil, I wish we had more time, but I had a chance to read the Juba sponsored IDC White paper. Fascinating finds. I encourage all of you to download that. Take a read, you're gonna learn some very interesting statistics and recommendations for how you can really truly deploy data resilience in your organization. Phil, it's been a pleasure to have you on the program. Thank you for joining >>Me. No problem. Thank you, Lisa. >>In a moment, John Furrier will be here with his next guest. For right now, I'm Lisa Martin and you are watching The Cube, the leader in live tech coverage.

(upbeat music) >> Welcome everyone to this CUBE coverage of AWS re:Invent 2021. We have a lot going on at this year's re:Invent with over 100 guests on the program, and I'm excited to welcome two of those guests here with me right now. We are joined by Ralph Munsen, the Chief Information Officer at Warner Music Group and Atif Khan, the CTO of Alkira and founder of Alkira as well. Gentlemen, welcome to the program. >> Thank you so much, Lisa. So glad to be here with you. >> Good to be here. >> Yeah. Good old fashioned Zoom is become our best friend in the last 22 months or so I'm losing count. Atif, I'd like to start with you. I know Alkira has been on the key before, but it's been a while and you guys are a relatively young company. Give the audience an overview of Alkira and what it is that you deliver. >> Absolutely, Lisa. So we started back in may of 2018, and the Cloud networking space, multicloud networking. And we came out of stealth mode back in April of 2020, and launched the company. In fact, one of our first events coming out of stealth mode was a Cuban interview back in April of 2020. So here at Telecare, what we are doing is we are building a Cloud platform, which allows customers to build a common network across multiple Clouds with built-in network and security services, with the policy and management layer on top full end to end visibility and governance capabilities. And all of this is delivered as a service and consumed as a service as well. And I'm very glad to be here with Ralph, who is from Warner Music Group and is one of our marquee customers. So I'll let Ralph introduce himself, and tell us a bit more about Alkira and WMTS Cloud journey. >> That sounds great. Ralph, why don't you start by giving the audience? I'm sure everyone knows Warner Music Group, but in case there's anyone out there that might not. Give us a little bit of a background. >> Yeah, so the Warner Music Group has been around since 1950 and 1940 even it had its roots at Hollywood and out of Warner Brothers Pictures, Today, say global company in 79 countries we operated. If the 100 employees and we have two major divisions, we have our era recorded music division, which has the labels people commonly turn to Atlantic records, Warner brothers records, and so forth. And then we have our publishing division, which is more a chapel, which is where our songwriters live. And of course we have some singer songwriters that are on both sides of our business. But now currently people may know our artists. We have ed Sheeran, Bruno Mars, Coldplay, Cardi B, Blake Shelton and I could go on and on. But exciting, great year, we're having one of our best years ever. And I'm so glad to be here and partnering with an Alkira. >> Excellent. I love all of those artists that you mentioned. Fantastic. So let's talk a little bit now Ralph about the backstory. Talk to me about the IT infrastructure at Warner Music Group, what you had there and some of the challenges that you had that you came to Alkira to solve. >> Yeah, well initially when I took over about five years ago now, we were very much a data center based business with traditional networking and IT functions. Additionally with our foreign affiliates, IT was sort of decentralized in the sense that a lot of the networking and data center components were left to regions. And so while we operated globally, we didn't really operate globally, at Warner among our affiliates. So one of the challenges was how do we get out of the data center? Cloud was new. One of the big things that were coming with big data, which is absolutely right for moving, going straight to the Cloud, especially if you don't have anything on-prem and how do we rationalize all of these different locations and conduct all the M&A work we've been doing? So it was quite a challenge, really. At the end, we wanted to have one view of the network, and Alkira. I looked at many a company and Alkira seemed the best to provide that to us. So. >> Well, talk to me a little bit more about why Alkira, because as Atif was saying, they're very young. What came out of stealth mode during the pandemic Warner Music Group, being around since the 40s and 50s, the legacy institution, a great brand. What made you take a risk on such an early stage startup? >> Quite frankly, there was nothing in the space (chuckles) at the time you loved, there were companies that had components of it, of what Alkira does, which is basically network orchestration allowing us to use existing components. And nobody has the whole package, especially incorporating security. So, we figured why not take, take a chance? There's no, it won't hurt you no harm. And if anything is successful, it will give us a great ability to manage our network, much more efficiently taking things that took days down to hours and being able to do it much more efficiently with much fewer staff, as opposed to hiring a lot more because when you orchestrate all the components that are underneath, obviously it requires more bodies, more resources. >> Right. That efficiency and cost optimization is key there. Atif I have to ask you, talk to me about, this is only a few years ago, the gap in the market that you and your brothers saw a few years ago, when you founded the company, because as Rob was saying, there was nobody else in the market at the time that could do what you're doing. >> Yeah, absolutely. So Lisa, as you know, myself and Amir, we were also a part of the founding team of Viptela, which was the SD-WAN Company. So back in the day when we did SD-WAN, the requirement was to connect sites together. So if you go back like 5, 10, 5, 7, 10 years ago, networking was done to connect sites together, which could be remote sites, data centers, sites to data centers, all of that together. But fast forward, a few more years with the adoption of Cloud, requirements changed from the networking perspective. So now your network is not just connecting sites together, but most of the traffic now is from sites or users, which could be sitting anywhere. If you look at, what's going on? in the pandemic people are working from all across the globe. They are not just sitting in campuses or sites. So traffic patterns are from sites or users mostly to the Cloud or SaaS applications. So now networks also need to evolve and they need to be built inside the Cloud rather than from outside or connecting into the Cloud. So Cloud access is one capability, but building a network inside the Cloud becomes a requirement. And secondly, now it's not just only about connectivity because security becomes even more important because your security perimeter is changing as well. So securing all these Cloud networks becomes very, very complicated. And now as Ralph can tell you, majority of the enterprises have a multicloud strategy and each Cloud is done differently. So the moment you bring in multiple Clouds, multiple regions across the globe, it becomes so complicated for enterprises to build and manage. They need something, or a platform which makes it easy, gives them one way of doing networking, building a common network across whether you're connecting multiple Clouds or Clouds to your on-prem locations or Clouds to internet or sites to internet. So that's where we saw this gap and we decided to build Alkira to tackle this problem. >> Got it. So Rob, let's talk now about what you've implemented as a team was saying we live in this, in this work from anywhere hybrid multicloud world. Talk to us about Warner, what you implemented and maybe a little bit about your multicloud strategy, if you've got one. >> Ralph: Yeah. So over the last five years, Warner has migrated entirely into Cloud. And to this point before it's multicloud, we're mainly in AWS, but we do have some pleasure and some Google Cloud. And with that, I was telling Atif and Amir. It was interesting and they built a Cloud on site. They totally forgot about the networking aspect. So (laughs), you have ease of use for services and servers inside (indistinct) cloud, but networking is not really present, not to mention when it was built out, it wasn't made to go to competing Clouds. So most companies are facing this problem. How do you treat these environments as a single holistic environment? How do you turn things up, turn things down? How do you secure it, When every single one is different habits, selling unique ways of doing things? So that really was, how we ended up looking for an out Alkira, because I just kept looking at the costs and the profit print grow and grow and grow. And the complexity to a (indistinct) before is growing exponential. One change in one thing would lead to two changes to another. If you add another Cloud or you add another point on the network, you've got exponential growth and complexity, complexity, you have to deal with. So one stop shop. (chuckles) >> One stop shop and reducing that complexity. Talk to me about reducing complexity, and what you're accomplishing there. Especially, in the last year and a half as things have been so dynamic, shall we say? (chuckles) >> Yeah, well, I will say this. It was turnkey for the most part. It took a matter of months as opposed to years, because out of the box, there was a lot of integrations with the major network of players. So as of right now, you can buy firewalls, routing, VPC, things like this, they all exist, but they're not orchestrated together. Right? And then you have policies and security, again not orchestrating a different set of tools. So it really only took us two to three months to get it up and running, I acts, I just had a conversation (chuckles) with them when we were going to finish. So I think we'll be finishing this up completely in January and sometime. So, I was pretty sure. >> LISA: That's fantastic. So really, >> Yeah. >> Sorry Relaph fast time to market there with getting things implemented. Talk to me about from a business outcome perspective, you are CIO, what are some of the outcomes? That this technology is enabling you to deliver back to the business? >> Yeah, it really, the number 1, 2 big ones come to mind. One being able to provide them a secure enterprise. I know when there is the change it's made uniforms for our network without, some of older something's being forgotten about. So that's number one, security is big. You can imagine a company like more ever marquee brands, all brands, any company of marquee brands are targets today. That's number one. Number two is our time to market for eminent. So when we buy a company the time it takes us to get them to be completely part of Warner and therefore start realizing the business case and benefits sort of reasonably bought. Bought the company to begin with. So, we're buying a lot more and we're turning them up and turning those business cases up faster. But usually those cases would say things like six months to a year to integrate with us, and then we can unlock the set of benefits. Now it's more like, two to three months and you start to be able to lock the benefits sooner. And of course, those are different than a case by case basis, but that's. >> Sure, but significantly faster there, you're looking at a two to three X multiplier there, as you talked about. >> Ralph: right. >> Now, you mentioned multicloud Ralph. So here we are at re:Invent. I imagine part of your AWS as part of your Cloud infrastructure and they're a technology partner of ALkira's. >> Ralph: Correct. Yeah. So AWS is actually our biggest Cloud provider of the three, and yeah (laugh) they're their partner without cure. So Good. >> And Atif then you, Alkira's technology partner of AWS, correct? >> Yeas. Alkira is a technology partner of AWS, we are also available on AWS marketplace. So customers can consume, AlKira's platform from AWS marketplace as well. >> But given the fact that so many businesses in every industry are multicloud, I assume that you work with all the Cloud vendors. Atif Yeah? >> Absolutely. So our platform runs inside of the Cloud and runs in AWS is a Cloud as well. And from there it connects to multiple Clouds. So if customers need to connect to Azure or AWS from there or Oracle Cloud or any other Cloud, for that matter, they can connect from our platform and our platform is it scales horizontally. So as customers needs scale, it scales as well. And one of the key advantages is, it's consumed as a service. So there's no software to download or hardware to run for or to acquire for any of the customers. It's a software solution and it's consumed as a service. >> Got it. Ralph one on one more question for you before we wrap things up here, want to get your recommendations for IT Executives, CEOs, who might be in a similar situation to you, whether or not they are with a legacy organization, what are some of your recommendations that you say you need to be looking at a, B and C? >> Yeah, I would primarily say really need to be looking at some of these newer technologies that can help speed up, people, especially in this case to transition to the Cloud and that planning ahead of time, especially goal-setting, I find to be it's any of these places, providers is absolutely Paramount, because you can, if you don't make your own (indistinct) take that step forward and you can end up with shelter. So I make sure that it's very important that when you commit to that, you commit fully, you plan it out and you make sure you actually use it to get the benefits. One of my tech key is software. So. (chuckles) (Lisa Laughing) I'm a bit of it so. >> Well, you've been there and It costs a lot of money and it doesn't do any good. It doesn't move the business forward. And in this day and age, there is a competitor right behind the rear view mirror who might be smaller, more nimble, and more agile, who can take your place easily. >> Absolutely. >> If the organization isn't willing to take the risks and commit, as you said, Atif last question over for you, where are the customers go to learn more? I know you are at re:Invent your booth 1628, but what do you recommend folks go attendees of the event, as well as just other prospects to go to learn more about what you guys are delivering for companies like Warner Music Group. >> So if you're at re:Invent, please stop by our booth. And one of our Cloud specialists will give you a demo as well. So it's a very quick demo and you'll see, how we are reinventing networking for the Cloud narrow. You can also go to our website and you'll find a lot of information on our website. You can request a demo there as well. So look forward to seeing most of you at our booth and those who are not attending in person, please go visit our website. >> Lisa: Reinventing Networking. I like your play on words. They are Atif very appropriate. Gentlemen, thank you for joining me today talking about Alkira, Warner Music Group, what you guys are doing together and how this new early stage technology is really quite transformative. We appreciate your insights. >> Thank you. >> Thank you so much. >> For Ralph Munsen and Atif Khan, I'm Lisa Martin, and you're watching theCUBE's continuous coverage of AWS re:Invent 2021. Thanks for watching. (soft techno music)

(upbeat music) >> Welcome everyone to this CUBE coverage of AWS re:Invent 2021. We have a lot going on at this year's re:Invent with over 100 guests on the program, and I'm excited to welcome two of those guests here with me right now. We are joined by Ralph Munsen, the Chief Information Officer at Warner Music Group and Atif Khan, the CTO of Alkira and founder of Alkira as well. Gentlemen, welcome to the program. >> Thank you so much, Lisa. So glad to be here with you. >> Good to be here. >> Yeah. Good old fashioned Zoom is become our best friend in the last 22 months or so I'm losing count. Atif, I'd like to start with you. I know Alkira has been on the key before, but it's been a while and you guys are a relatively young company. Give the audience an overview of Alkira and what it is that you deliver. >> Absolutely, Lisa. So we started back in may of 2018, and the Cloud networking space, multicloud networking. And we came out of stealth mode back in April of 2020, and launched the company. In fact, one of our first events coming out of stealth mode was a Cuban interview back in April of 2020. So here at Telecare, what we are doing is we are building a Cloud platform, which allows customers to build a common network across multiple Clouds with built-in network and security services, with the policy and management layer on top full end to end visibility and governance capabilities. And all of this is delivered as a service and consumed as a service as well. And I'm very glad to be here with Ralph, who is from Warner Music Group and is one of our marquee customers. So I'll let Ralph introduce himself, and tell us a bit more about Alkira and WMTS Cloud journey. >> That sounds great. Ralph, why don't you start by giving the audience? I'm sure everyone knows Warner Music Group, but in case there's anyone out there that might not. Give us a little bit of a background. >> Yeah, so the Warner Music Group has been around since 1950 and 1940 even it had its roots at Hollywood and out of Warner Brothers Pictures, Today, say global company in 79 countries we operated. If the 100 employees and we have two major divisions, we have our era recorded music division, which has the labels people commonly turn to Atlantic records, Warner brothers records, and so forth. And then we have our publishing division, which is more a chapel, which is where our songwriters live. And of course we have some singer songwriters that are on both sides of our business. But now currently people may know our artists. We have ed Sheeran, Bruno Mars, Coldplay, Cardi B, Blake Shelton and I could go on and on. But exciting, great year, we're having one of our best years ever. And I'm so glad to be here and partnering with an Alkira. >> Excellent. I love all of those artists that you mentioned. Fantastic. So let's talk a little bit now Ralph about the backstory. Talk to me about the IT infrastructure at Warner Music Group, what you had there and some of the challenges that you had that you came to Alkira to solve. >> Yeah, well initially when I took over about five years ago now, we were very much a data center based business with traditional networking and IT functions. Additionally with our foreign affiliates, IT was sort of decentralized in the sense that a lot of the networking and data center components were left to regions. And so while we operated globally, we didn't really operate globally, at Warner among our affiliates. So one of the challenges was how do we get out of the data center? Cloud was new. One of the big things that were coming with big data, which is absolutely right for moving, going straight to the Cloud, especially if you don't have anything on-prem and how do we rationalize all of these different locations and conduct all the M&A work we've been doing? So it was quite a challenge, really. At the end, we wanted to have one view of the network, and now Alkira. I looked at many of companies and I'm curious in the best to provide that to us. So. >> Well, talk to me a little bit more about why Alkira, because as Atif was saying, they're very young. What came out of stealth mode during the pandemic Warner Music Group, being around since the 40s and 50s, the legacy institution, a great brand. What made you take a risk on such an early stage startup? >> Quite frankly, there was nothing in the space (chuckles) at the time you loved, there were companies that had components of it, of what Alkira does, which is basically network orchestration allowing us to use existing components. And nobody has the whole package, especially incorporating security. So, we figured why not take, take a chance? There's no, it won't hurt you no harm. And if anything is successful, it will give us a great ability to manage our network, much more efficiently taking things that took days down to hours and being able to do it much more efficiently with much fewer staff, as opposed to hiring a lot more because when you orchestrate all the components that are underneath, obviously it requires more bodies, more resources. >> Right. That efficiency and cost optimization is key there. Atif I have to ask you, talk to me about, this is only a few years ago, the gap in the market that you and your brothers saw a few years ago, when you founded the company, because as Rob was saying, there was nobody else in the market at the time that could do what you're doing. >> Yeah, absolutely. So Lisa, as you know, myself and Amir, we were also a part of the founding team of Viptela, which was the SD-WAN Company. So back in the day when we did SD-WAN, the requirement was to connect sites together. So if you go back like 5, 10, 5, 7, 10 years ago, networking was done to connect sites together, which could be remote sites, data centers, sites to data centers, all of that together. But fast forward, a few more years with the adoption of Cloud, requirements changed from the networking perspective. So now your network is not just connecting sites together, but most of the traffic now is from sites or users, which could be sitting anywhere. If you look at, what's going on? in the pandemic people are working from all across the globe. They are not just sitting in campuses or sites. So traffic patterns are from sites or users mostly to the Cloud or SaaS applications. So now networks also need to evolve and they need to be built inside the Cloud rather than from outside or connecting into the Cloud. So Cloud access is one capability, but building a network inside the Cloud becomes a requirement. And secondly, now it's not just only about connectivity because security becomes even more important because your security perimeter is changing as well. So securing all these Cloud networks becomes very, very complicated. And now as Ralph can tell you, majority of the enterprises have a multicloud strategy and each Cloud is done differently. So the moment you bring in multiple Clouds, multiple regions across the globe, it becomes so complicated for enterprises to build and manage. They need something, or a platform which makes it easy, gives them one way of doing networking, building a common network across whether you're connecting multiple Clouds or Clouds to your on-prem locations or Clouds to internet or sites to internet. So that's where we saw this gap and we decided to build Alkira to tackle this problem. >> Got it. So Rob, let's talk now about what you've implemented as a team was saying we live in this, in this work from anywhere hybrid multicloud world. Talk to us about Warner, what you implemented and maybe a little bit about your multicloud strategy, if you've got one. >> Ralph: Yeah. So over the last five years, Warner has migrated entirely into Cloud. And to this point before it's multicloud, we're mainly in AWS, but we do have some pleasure and some Google Cloud. And with that, I was telling Atif and Amir. It was interesting and they built a Cloud on site. They totally forgot about the networking aspect. So (laughs), you have ease of use for services and servers inside (indistinct) cloud, but networking is not really present, not to mention when it was built out, it wasn't made to go to competing Clouds. So most companies are facing this problem. How do you treat these environments as a single holistic environment? How do you turn things up, turn things down? How do you secure it, When every single one is different habits, selling unique ways of doing things? So that really was, how we ended up looking for an out Alkira, because I just kept looking at the costs and the profit print grow and grow and grow. And the complexity to a (indistinct) before is growing exponential. One change in one thing would lead to two changes to another. If you add another Cloud or you add another point on the network, you've got exponential growth and complexity, complexity, you have to deal with. So one stop shop. (chuckles) >> One stop shop and reducing that complexity. Talk to me about reducing complexity, and what you're accomplishing there. Especially, in the last year and a half as things have been so dynamic, shall we say? (chuckles) >> Yeah, well, I will say this. It was turnkey for the most part. It took a matter of months as opposed to years, because out of the box, there was a lot of integrations with the major network of players. So as of right now, you can buy firewalls, routing, VPC, things like this, they all exist, but they're not orchestrated together. Right? And then you have policies and security, again not orchestrating a different set of tools. So it really only took us two to three months to get it up and running, I acts, I just had a conversation (chuckles) with them when we were going to finish. So I think we'll be finishing this up completely in January and sometime. So, I was pretty sure. >> LISA: That's fantastic. So really, >> Yeah. >> Sorry Relaph fast time to market there with getting things implemented. Talk to me about from a business outcome perspective, you are CIO, what are some of the outcomes? That this technology is enabling you to deliver back to the business? >> Yeah, it really, the number 1, 2 big ones come to mind. One being able to provide them a secure enterprise. I know when there is the change it's made uniforms for our network without, some of older something's being forgotten about. So that's number one, security is big. You can imagine a company like more ever marquee brands, all brands, any company of marquee brands are targets today. That's number one. Number two is our time to market for eminent. So when we buy a company the time it takes us to get them to be completely part of Warner and therefore start realizing the business case and benefits sort of reasonably bought. Bought the company to begin with. So, we're buying a lot more and we're turning them up and turning those business cases up faster. But usually those cases would say things like six months to a year to integrate with us, and then we can unlock the set of benefits. Now it's more like, two to three months and you start to be able to lock the benefits sooner. And of course, those are different than a case by case basis, but that's. >> Sure, but significantly faster there, you're looking at a two to three X multiplier there, as you talked about. >> Ralph: right. >> Now, you mentioned multicloud Ralph. So here we are at re:Invent. I imagine part of your AWS as part of your Cloud infrastructure and they're a technology partner of ALkira's. >> Ralph: Correct. Yeah. So AWS is actually our biggest Cloud provider of the three, and yeah (laugh) they're their partner without cure. So Good. >> And Atif then you, Alkira's technology partner of AWS, correct? >> Yeas. Alkira is a technology partner of AWS, we are also available on AWS marketplace. So customers can consume, AlKira's platform from AWS marketplace as well. >> But given the fact that so many businesses in every industry are multicloud, I assume that you work with all the Cloud vendors. Atif Yeah? >> Absolutely. So our platform runs inside of the Cloud and runs in AWS is a Cloud as well. And from there it connects to multiple Clouds. So if customers need to connect to Azure or AWS from there or Oracle Cloud or any other Cloud, for that matter, they can connect from our platform and our platform is it scales horizontally. So as customers needs scale, it scales as well. And one of the key advantages is, it's consumed as a service. So there's no software to download or hardware to run for or to acquire for any of the customers. It's a software solution and it's consumed as a service. >> Got it. Ralph one on one more question for you before we wrap things up here, want to get your recommendations for IT Executives, CEOs, who might be in a similar situation to you, whether or not they are with a legacy organization, what are some of your recommendations that you say you need to be looking at a, B and C? >> Yeah, I would primarily say really need to be looking at some of these newer technologies that can help speed up, people, especially in this case to transition to the Cloud and that planning ahead of time, especially goal-setting, I find to be it's any of these places, providers is absolutely Paramount, because you can, if you don't make your own (indistinct) take that step forward and you can end up with shelter. So I make sure that it's very important that when you commit to that, you commit fully, you plan it out and you make sure you actually use it to get the benefits. One of my tech key is software. So. (chuckles) (Lisa Laughing) I'm a bit of it so. >> Well, you've been there and It costs a lot of money and it doesn't do any good. It doesn't move the business forward. And in this day and age, there is a competitor right behind the rear view mirror who might be smaller, more nimble, and more agile, who can take your place easily. >> Absolutely. >> If the organization isn't willing to take the risks and commit, as you said, Atif last question over for you, where are the customers go to learn more? I know you are at re:Invent your booth 1628, but what do you recommend folks go attendees of the event, as well as just other prospects to go to learn more about what you guys are delivering for companies like Warner Music Group. >> So if you're at re:Invent, please stop by our booth. And one of our Cloud specialists will give you a demo as well. So it's a very quick demo and you'll see, how we are reinventing networking for the Cloud narrow. You can also go to our website and you'll find a lot of information on our website. You can request a demo there as well. So look forward to seeing most of you at our booth and those who are not attending in person, please go visit our website. >> Lisa: Reinventing Networking. I like your play on words. They are Atif very appropriate. Gentlemen, thank you for joining me today talking about Alkira, Warner Music Group, what you guys are doing together and how this new early stage technology is really quite transformative. We appreciate your insights. >> Thank you. >> Thank you so much. >> For Ralph Munsen and Atif Khan, I'm Lisa Martin, and you're watching theCUBE's continuous coverage of AWS re:Invent 2021. Thanks for watching. (soft techno music)

>>Yes. >>Welcome to this cube conversation. I'm Lisa Martin, and I'm joined by two Cube alumni. Please welcome Tarazi, senior vice president and CEO, networking at Dell Technologies. Welcome back. And welcome to the Virtual >>Cube. Thank you. I'm excited about this. Thank you. >>We're gonna have a good conversation, because VJ Ramachandran is also here. VP of product management at VM Ware VJ Welcome back. >>Thank you, Lisa. And happy to be here again. >>So have a lot to unpack. We're on the cusp of the emerald 2021. You guys are making an announcement We want to talk about in the Emmy. Why? It's important will break down the announcement. Go ahead and start. Uh, we'll start with you. Envy me. Why is it important? What is it? All that good stuff? >>Yeah, this is excellent topic, and this is really an important component of infrastructure these days. Um, modern applications are changing how they consume infrastructure. That's because the workloads are evolving. Some of them are ai type machine learning workloads that need very high performance. There's also a continued to end by our customers to put work clothes in public cloud and on um and create a hybrid multi cloud model. Um, and also the new exciting stuff is all have to do with the edge applications and distributing applications everywhere with automation and connectivity to where they need to be operating with, you know, on premise. Uh, so long Storey short, These trends, these new applications, how the deployment models work is really diving the need for envy me becoming the key technology for getting your data and storage and with envy me of a fabric and connectivity is starting to become a very important topic. >>How do you have those discussions with customers in terms of their next steps, especially in the last year and a half will stay with you that we've seen such acceleration of digital transformation. What have those customer conversations? How have they changed? >>Uh, they the conversations have changed in two big ways. One, they really want to discuss outcomes. They know that we can bring, you know, industry leading infrastructure and tools and automation and software. But they really want to discuss outcomes, you know? How do you How do I automate my you know, operations? How do I get to unpack the value of my data? no matter what the data is eyes and where it's coming. So so that's the first big changes. People have shifted completely to outcomes. And the second change is that now there is a really good discussion about performance and sustainability. How do I make sure that I'm meeting my sustainability goals? I'm meeting my performance goals instead of just discussing one piece of the solution. >>Got a BJ wanna bring you into the conversation? Now talk to me about BME Front and its evolution from VM Ware's perspective and some of the changes that you've seen in the last dynamic 18 months in the market. >>Yeah, thanks. Thanks for being, You know, I think that we are living in interesting times now. What we're seeing from the standpoint is that applications are evolving rapidly, demanding more performance, local agencies, higher throughput. And these are modern applications and NBA me. What we're seeing is that NBN me as a protocol is becoming the de facto sort of connected with protocol police applications at the same time. What we're also seeing is that the infrastructure team at scale and then deploy these applications at scale They are moving towards a disaggregated architecture in the data centre, and all the employees are going towards this because they want to emulate, you know, the public club. And so you know what's exciting about this announcement and sort of the, you know, the you know, what we are delivering together the bell is that the combination of Indian P plus T c p I P provides in sort of brings both these worlds together. It provides performance and legacies that these new applications these these new modern applications need at the same time provides a way that is disaggregated. And so the combination of these two is You know, it's, uh, industries changing, in my opinion, and and we'll see that this will become sort of the the fact that we can deploy infrastructure in our data centres. And that's what we're seeing in December. >>Got it? Thank you. Let's go ahead and unpack that announcement. That VJ alluded to telling them or have announced an end to end envy. Any TCP ecosystem solution back over to you. You have talked to me about this. What is it? What are some of the core components and we'll get into >>benefits. Perfect. So So we both see envy any of D c P I p as this new future storage connectivity. And it is a pivotal moment for the industry. There's always been debate about what protocols you use for connecting storage for performance speed. But the time has come for envy any of the TCP IP to become the defect of future protocol. Uh, what we're announcing is, first of all, we're announcing a new, uh, software product called S S s from Dell. And that software product will automate the discovery provisioning and automate the setup of all the storage networking How you connect all the hosts to the storage targets in a fully automated way. This is something that has been very complex, very hard to do manually in a one by one. So that's a whole new software product. Number two announcing the availability of envy me over TCP I pee on our key Dell products, which is power store power edge, which is our server product, and also power switch, which is our networking product. So the combination of the new software tool S. S s and all the availability of envy. Emile, that TCP ip on our compute storage and networking that gives customers the ecosystem to be able to use it along with the capabilities that are essential for it. >>Yeah, And DJ head was going to add to what you have just said. You know, of course, being there is fully committed to bringing this, uh, option of NBA me, You know, along with the partnership, Del, um you know, to the market and has been our partnership has been instrumental in bringing this to the market. Now, you know, the cool thing about this particular announcement and, you know, and what to bring to the market is that the smart fabric, uh, services manager is actually built into the centre. So, you know, from the understand point of this fear administrator being the administrator can so stay with them. They're the centre, um, you know, console and be able to manage provision, manage and monitor, Um, you know, in the in your fabric, uh, me or the PCP, uh, connexions. And so it's sort of bridges the gap between storage and, uh, world with you will >>and also the V sphere. The launch of, uh, envy any of the TCP I p and V. Sphere seven you see is the last component of this announcement between putting S S s inside the Centre V sphere enhancements and the Dell products. The end result is the customers get this bump and new capability. However, they can continue to use all the management tools that they have today. So this is an easy automated lift and they get this new capability >>an easy automated lift. Though that sounds like magic to I'm sure a lot of folks ears sticking with you talk to me about this is a new direction for Dell and talk to me a little bit about that and the impact. >>I think the new direction is that we have supported multiple protocols for connectivity fibre channel R d m A. But I think now, as we go to this next evolution and the fact that the world is going to multi cloud and edge and distribution, the new direction here is we're putting a lot of investment and energy, both of us into making envy me over TCP IP automated and high performance. As VJ said, we've been collaborating for over two years on this project jointly that included new standards, new innovation, new software capabilities, new divers on all our products. So although we make it sounds simple. This is a company wide on both sides. Innovation effort to make this possible. >>Absolutely a big innovation effort. DJ, Go >>ahead. And I was gonna say, you know, just to second what we have said, we work as one team you know, begin to companies. But we work as one team and really brought some innovative features and functionality out of the market and, you know, too excited to see this come to fruition. We're working on it for two years now. >>So two years before the pandemic started, I'm curious to get both of your perspectives on how the tunnels of the economy and the market of the last 18 months have influenced. We've seen so much acceleration in digital. How has this interesting time affected or accelerated what you're announcing? Or has it? >>I will start on V say, you know, whatever you'd like to add is that I think what we have seen during the pandemic is acceleration of adopting of a cloud operating model by using more of public cloud but also using automation that we have built into our products, both vm ware and L. And so this kind of automated type software tools falls completely in line with that. You know, customers more and more want the infrastructure automated and they wanted cloud light with as a service, usage based type models. And we're both invested into that area. >>Yeah, And you know, Lisa, if anything at all in the last, uh, two years since the Pandemic, what we're what we're refining is that it's no longer a decision between on Prem or Public Club, But it's actually and and decision, you know, it's on from and public clothes is truly becoming a multicultural world. And so to make this multi cloud, and then customers deploy the right applications and write workload in the right place, depending on the needs. And so, in this multiple world, having this automation and having a consistent way too, uh, to manage infrastructure, uh, in an automated fashion across these multi coloured deployments is becoming key. And so this is a key component of that. What we did, what pronouncing is a key component of that kind of a model, that customers are moving to >>it. Let's talk about the customer benefits you both mentioned performance sustainability, low latency, high throughput. Give me examples of each of those of how this technology will deliver that for customers across industries. >>This is where we've really enjoyed working together and with VJ and his team did fantastic work to test the value of having this partnership is the end to end. Customer sees the performance and benefit from the eyes of using both the software stack from Dell and VM Ware as well as the infrastructure below it. And we've been able to jointly test what the customer will see and what we have seen, which I have to say was a surprise to us. We expected benefits, but even it was one of those Aha moment. Oh my God, this is We thought it was good, but it turned out to be even better. So on the performance side, it's about 2.5 to 3 times the performance of ice crazy, which is the other technology we would compare this to on the Latin Seaside is 70% less latency and uses even less capacity in terms of CPU. We have not seen that kind of performance improvement from a protocol for a very long time. Changing networking protocols usually gives you some little benefit, but not this kind of a step functional performance. So I think the customers will be very excited about this. >>These are some numbers, PJ go ahead and extend onto that. >>No, I You know, I have nothing more to add because, you know, we having extremely encouraged by the performance numbers that you know, that we saw and, you know, and and and here, this red we actually exceeded expected our expectations, right? And if you, the enemy, was the was the right way to sort of, you know, delivered performance. But, uh, you know, to see this kind of results in real world as, uh is very encouraging. >>You guys said there are several sessions at BM world that are covering this topic. I'd like to get both of your perspectives on some of the sessions that you're presenting in and some of the key takeaways that the audience can learn. I have. We'll start with you. >>Yeah. I mean, we're starting with a session to explain the overall strategy, and we're gonna show demos. Exactly how would you use VM Ware software and L s F s s to configure Implement. How does that compare to the customer experience today? That's going to be an exciting session between myself and Paul Turner, who is the VP of product. Also at the end, where I think that that kind of with these visual demos, people will see how fast automated that is, which is really the message here. Then we have multiple sessions from our key technical experts. We're gonna go through a deep technology review of the stack and how to do it. And the functionality. >>Yeah, and Lisa on on the other side of obviously you have a number of sessions on various topics. Uh, on storage. The one that I want to call out is there's a session that I'm doing with Mark flashing who's a city or for storage and for club platform. Really. And we are discussing VMS vision and strategy for storage and availability, and NBA me is certainly a key part of that. But as we just talked earlier, the whole automation and the multiplayer aspect of, uh of the parameters it's critical. So you know. So we're sharing what? How we are approaching this whole multiple world. Um, in this, you know, with storeys and availability innovation. So I'm really excited about that. >>So a lot of news coming out on the nbn me over TCP ip front talked about the collaboration acceleration of that, the directional shift in terms of go to market and availability. When where can existing customers go to learn more information? What's the joint gtm that Del. And then we have, >>uh I think you wanna start on V sphere and I'll add or >>Okay, >>so all the products we talked about today from V sphere seven dot you the power store power edge All of them will be available starting immediately after VM World And between October and November, everything we talked about will be available And during the, um, world, we will announce how customers can use it downloaded by it. As we said before, because they are a s s s is implemented into the centre. This will be a familiar way for customers to use it downloaded and implemented, and a new lease of these fears something customers are used to. We have many customers on power store, so they will be getting a new software at least an update with the new functionality. We we do plan to care developer experience, modules, sandboxes for people to play with will make more announcements on that in the future. >>Yeah, And this, You know, as you have said, this functionality is built into, you know, the spear and recenter as well. And so the next really next release of the sphere will have this functionality. And you'll see a lot of noise about this at the world. That sort of our coming out party. Mm. >>Excellent. Well, it sounds like it's going to be a good coming out party with a lot of information to come around. The emerald timeframe, some great education and deep technical dive is that you guys and your teams will be providing to customers in all industries, which I'm sure they will be very much appreciative of. I appreciate both of you coming on sharing with me the news. What's exciting about this? The impact that's going to make and we look forward to hearing some of the news as it gets rolled out. >>Thank you. >>Thank you so much. >>Lisa. Thank >>you. Great to have you guys for Ihab Tarazi and VJ Ramachandran. I'm Lisa Martin. You're watching a cube >>conversation? Mm.

>> Welcome to the AWS Startup Showcase: New Breakthroughs in DevOps, Data Analytics, and Cloud Management Tools. I'm Lisa Martin. I'm pleased to welcome JT Giri, the CEO and founder of nOps, to the program. JT, welcome. It's great to have you. >> Thank you, Lisa. Glad to be here. >> Talk to me about nOps. This was founded in 2017, you're the founder. What do you guys do? >> Yeah. So just a little bit background on myself. You know, I've been migrating companies to AWS ever since EC2 was in beta. And you know, in the beginning I had to convince people like, "Hey, you should move to cloud." And the question people used to ask me, like, "Is cloud secure?" I'm glad no one is asking that question anymore. So, as I was building and migrating customers to the cloud, one of the things I realized very early on, is just cloud, there are so many resources, so many teams provisioning resources, then how do you align with your business goals? So we created nOps so that, for a mission, how do you are you build a platform where you make sure every single change and every single resource in the cloud is aligned with the business needs, right? Like we really helped people to make the right trade-offs. >> So you mentioned you've been doing this since EC2 was in beta, and we just celebrated, with AWS, EC2's 15th birthday. So you've been doing this awhile. You don't look old enough, but you've been doing this for awhile. So one of the things that I read on the website, I always love to understand messaging, that nOps says about itself, "The first cloud ops platform "designed to sync revenue growth across your teams." Talk to me about how you do that. >> Yeah. So one of the problems we see in the market right now, there are a lot of tools, there are a lot of dashboards that shows like, "Hey, you have this many issues, "here's the opportunity to fix issues. "And here are the security issues." We're more focused on how do we take those issues from a backlog and fixing those issues. Right? So our focus is more on operationalizing, so your teams could actually own that, prioritize, and actually remediate those issues. So that's where we focus our energy. >> Got it. Let's talk about cloud ops now, and how it varies or differs from traditional cloud management. >> Yeah, I think, like I mentioned, cloud management seems to be more like visibility. And everyone knows that there are challenges in their cloud environment. But when you focus more on the operation side, what we really try to do, from an issue, how do you actually fix that issue? How do you prioritize? How do you make the right trade-offs. Right? Trade offs is important because we make a lot of decisions in the cloud when you're building your infrastructure. Sometime you might have to prioritize for costs, sometime you might have to prioritize based on the SLA. You might have to add more resources to hit your SLAs. So we really help you to prioritize. And we build sort of accountability. You know, you can create roles. Most of the time, what we noticed, I truly believe that if it's everyone's responsibility, it's no one's responsibility. You know? So what we do is we help, within the tool, to establish clear roles and responsibilities. And we show audit log of people reviewing and fixing security issues. And we show audit log of people fixing and reviewing cost issues. That's one way we're trying to bring accountability. >> I like what you said, if everyone's responsible, then really no one is. And that seems to be a persistent problem that we see in businesses across industries, is just still that challenge with aligning IT and business. And especially with the dynamics of the market, JT, that we've seen in the last 18 months, things are moving so quickly. Talk to me about how you guys have been helping companies, especially in the last 18 months, with such change to get that alignment. So that that visibility and those clear roles are established and functional. >> Yeah. You know, what we really do is obviously listen to the customers. Right? And one of the challenges we hear over and over is like, you know, I know I have issues in the cloud environment that I really need help prioritizing. And they're really looking for a framework where they can come in and say, "Okay these are the people who are responsible for security. "These are the people who are responsible for the cost." So as part of onboarding with nOps, that's one of the things you do, you define your workloads. By the way, we automatically create your workload across all your accounts. And then we allow you to move resources around if you like. But then one of the first thing we do is assign roles and responsibilities for each one of these workloads. Oh, it's been incredible to see, when you have that kind of accountability, people actually do make sure that the resources are aligned with the business needs. >> So are you seeing, I mean, that's kind of a cultural shift. That changed management is a challenging process. How are you seeing that evolve in organizations who've been used to doing things maybe in a little bit of a blinders on kind of mode? >> Yeah. Well, changed management is an area where we spent a lot of time, because in cloud, changed management is almost like a fire hose. Right? There's so many changes and you could have 20 people or 20 different teams making changes. I think what people really want is sort of root cause analysis. Like, "Hey, this is what changed here. "Here's why it changed. "And here's how actions we could take, or you could take." So this is where we focus on this, where nOps focuses on. We really help people to show the root cause analysis, these three, four things, these three, four changes are related to this cost increase or these security issues. And we show like a clear path on taking action on those issues. >> That's critical. The ability to show the paths, to take the action to remediate or make any changes, course corrections. As we've learned in the last 18 months, real time is no longer for so many industries, a nice-to-have. The ability to be able to pivot on the fly is a survival and thriving mechanism. So that is really key. I do want to talk about the relationship with nOps and AWS. Here we are at the AWS startup showcase. Give me a little overview on the partnership. >> It's been an incredible. Like I said, I have a long history of working with AWS, and I started a consulting company, a very, very successful one. And so I have years of working with AWS partner teams. I think it's incredible. We were the first company in this, maybe not first, maybe very early. We were part of this Well-Architected framework. And when I came out of that training, the Well-Architected training, I was so excited. I was like, "Wow, this is amazing." You know? Because, to me, whenever you're building infrastructure, you really are making trade-offs. You know, sometime you optimize for cost, sometime you optimize for reliability. So it has been incredible to work with the Well-Architected team. Or Amazon also has this, another program, called FTR: Foundational Technical Review. We've been working closely with that team. So yeah, it's been amazing to collaborate with AWS. >> It sounds pretty synergistic. Have you had a chance influence infrastructure, and some of the technical direction? >> Oh, absolutely. Yeah. We work very closely. One of the cool thing about AWS is that they do take customers' feedback very, very seriously. And, Lisa, also other way around. Right? If AWS is going to build something, having that insight into the roadmap is very beneficial. Because if they're doing it, there's no point of us trying to reinvent the wheel. So that kind of synergy is very helpful. >> That's excellent. Let's talk about customers, now. I always loved talking about customer use cases and outcomes. You guys have a great story with Uber. Walk us through what the challenges were, how nOps came in, what you deployed, and how the business is being impacted positively. >> Yeah, I think Uber and all the enterprises, they sort of have the same challenge, right? There are many teams provisioning infrastructure. How do you make sure all those resources are aligned with your business needs? And in addition to that, not only you have different teams provisioning resources, there are different workloads. And these workloads have different requirements. Right? Some are production workloads, some are just maybe task workloads. So one of the things Uber did, they really embraced sort of nOps' way of managing infrastructure, building accountability, sharing these dashboards with all the different teams. And it was incredible, because within first 30 days they were able to save up to 15%. This was in their autonomous vehicle unit. And they spent a lot of money. And having to see that kind of cost saving, it was just amazing. And we see this over and over. And so like when customers are using platform, it's just incredible how much cost savings are there. >> So Uber, you said, in their autonomous vehicle department saved 15% in just the first 30 days alone. And you said that's a common positive business outcome that you're seeing from customers across industries, is that immediate cost savings. Tell me a little bit more about that as a differentiator of nOps' business. >> Yeah. Because as I mentioned earlier, one of the things we do, we bring accountability. Right? Most of the time when people, before nOps, maybe there are resources that are not accounted for. There is not clear owners, there's no budgets, there's no chargebacks. So I do think that's a huge differentiator of nOps, because, as part of onboarding, as you establish these roles and these responsibilities, you find so much unaccounted resources. And sometimes you don't even need those resources, and you shut them down. And those are the easiest next steps. Right? Like, you don't need to architect, you just shut it down. Like no one needs these resources. So that, I do believe, that's our strength. And we were able to demonstrate this over and over, this, on average, 15-30% cost saving in the first month or so. >> That's excellent. That's a lot of what customers, especially these days, are looking for, is cost optimization across the organization. What are some of the things that you've seen, that nOps has experienced in the last 18 months, with so much acceleration? Anything that surprised you, any industries that you see as really leading edge here, or prime candidates for your technology? >> Yeah. A couple of things. We see a lot of partners, a lot of other consulting company, leveraging nOps as a part of their offering. That's been amazing, we have a lot of partners who really leverage nOps as a go to market and ongoing management of their customers. And I do see that shift from the customer side as well. I think the complexity of cloud continues to kind of increase, like you just mentioned, it sounds like from last 18 months, it accelerated even more. How do you stay up to date, you know? And how do you always make sure that you're following best practices? So companies bring in partners to help them implement solutions. And then these partners are leveraging tools like nOps. And we've seen a lot of momentum around that. >> Tell me a little bit about how partners are leveraging nOps. What are some of the synergistic benefits on both sides? >> Yeah, so normally partners leverage nOps, you know, they will use it for Well-Architected assessments. And, you know, I've personally done a lot of these Well-Architected assessments. And, you know, early on, I kind of learned that, assessments are only good if you're able to move forward with fixing issues in the customer's environment. So what we really do, we really help customers, or sorry, we really help partners to actually do these Well-Architected assessments automatically. We auto discover issues, and then we help them to create proposals so they can present it to the customers like, "Hey, here are the five things we can help you with, "and here's how much it will cost." And, you know, we really streamline that whole process. And it's amazing that some partners used to take like days to do these assessments. Now they can do it an hour. And we also increase the close rate on SoW's because they are a lot more clear. You know, like here are the issues and here's how we can help you to fix those issues. >> You got some great business metrics there, in terms of speed and reduction in cost, reduction in speed. But it sounds like what you're doing is helping those partners build a business case for their customers far more efficiently and more clearly than they've ever been able to do before. >> Absolutely. Yeah, yeah. And... >> Go ahead. >> Yeah, so absolutely. Before nOps, everyone is using spreadsheets most of the time. Right? It's spreadsheets to collect information, and emails back and forth. And after the partner's start using nOps, they use nOps to facilitate these assessments. And once they have these customers as ongoing customers, they use nOps for checks and balances to make sure they're constantly aligned. Right? And we have a lot of success of having real revenue impact on partners' business, by leveraging nOps. >> Excellent. That's true value and true trust there. Last question. Where can you point folks, a CTA or URL that you want people to go to to learn more about nOps? >> Yeah. Basically just go to nops.io and just put on signup. Yeah. I love doing this stuff. I love talking to the customers. Feel free to reach out to me, as well: jt@nops. I would love to have a conversation. But yeah, just nops.io is the best place to get started. >> Awesome, nops.io. And I can hear enthusiasm for this, and your genuineness comes through the zoom screen here, JT. I totally thought that the whole time. Thank you for talking to me about nOps, how you guys are helping organizations really embrace cloud ops and evolve from traditional cloud management tools. We appreciate your time. >> Thanks, Lisa. >> For JT Giri, I'm Lisa Martin. You're watching the AWS Startup Showcase.

(soft electronic music) >> Well, it's good to have you here as we continue our series of CUBE Conversations in the AWS Startup Showcase. Today, our focus is on HackerOne and the CEO of HackerOne, Mårten Mickos joins us. Mårten, thanks for being with us, we appreciate the time. Good to see you here, on theCUBE, today. >> Thanks for inviting me, John. >> Let's talk about HackerOne, the global, digital security leader. You are taking care of everybody's worst digital nightmares these days and so congratulations on that front, but I know you've got your hands full. Let's go back for those who are watching that don't know a lot about your history and just tell us about the origination, about how you gathered this stable of hackers, if you will, for good, ethical hacking, we might call that, and how that began and where that path has led you. >> Yes, thank you, John. You mentioned it already, you said the worst nightmare. The worst nightmare we all now have is that we get hacked. We all have to worry as consumers, companies, governments that criminals will break into our system. And then when you start thinking rational think, okay, if the worst nightmare is a cyber crime and getting breached, what is then a medication potent enough to rise to that same level? What can stop your software vulnerabilities from being exploited by criminals? And the world has built a lot of testing software, procedures, scanners, all kinds of things to get there, but none have risen to the level of true criminal activity. But then this movement of ethical hacking has people with the same skill and same passion, and same ability to come from the outside and break in except one difference, they have good intent. So we have a collection, a community of all the ethical hackers in the world, over a million of them, who are all ready to go in and in a way, think the bad and do the good. So they approach your system as if they were attacking you and when they find a hole, they tell you and you can fix it. And it turns out that there's no other way of finding all the ways in which a bad guy could break in. You could do all the other things and you should do all the testing and scanning and whatnot, but it won't rise to that same level, it won't find all the vulnerabilities, it won't think as expansively as a criminal will think. But the ethical hackers do and they are unstoppable. And there are many more ethical hackers than are bad hackers in the world. We have 1.2 million in our community, that's more than there are black hats or criminal hackers in the whole world. >> Yeah, that's an incredible number. I mean, 1.2 million-- >> And growing. >> Ethical hackers. >> And growing. >> How did you go about building that community and vetting that community, right? Because there has to be some kind of credential that you bring to the table, some kind of expertise. So how do you know that everybody in that 1.2 million, which again, just a phenomenal number is of the same cloth, if you will, of good intent and willing to help? >> They would never sign up if they didn't have good intent because we know about them, we can see where they came from. So if you're a criminal, you would never voluntarily give away such information about yourself. So we know their intent. They're, of course, varying in terms of skill and drive and passion and abilities, so we have a ranking system where we can learn about their skills and we test them, so we can, out of that giant community, find the ones who are truly outstanding. Because like in any endeavor in life, some are just natural talent, some work hard to become the top talent, and most of us are just regular, mediocre players in whatever sports we are in, like, like I am. But we have, we managed to find the most talented hackers in the whole world and through sort of a social competition we cause them to learn more, get better, and just better and better. And, and here's the other dimension. So the first dimension is that we have to have a cure that is as strong, as potent as the risk so we have to find vulnerabilities at the same level as criminals will find. Well our hackers will do that. The second thing is it's a moving target. Whatever you learned in cybersecurity yesterday may already be outdated. Whatever technology you are, you are catching up with may already be different than it was yesterday. But thanks to our giant community, we have this sort of evolution inside of the community where new talent is always coming in with new skill and replacing the old ones. So as a hacker, of course, you compete with all your other friendly hackers to be the best, but one day you'll get beaten by a new guy, a new person, a new hacker who has figured out the new technology. And that's how we stay current. Like we, there's no risk of the knowledge being outdated or stagnated because the people revolve in this community and it's always the freshest, most accurate, current talent that's being deployed in our programs. >> Yeah, we've had a lot of conversations with cybersecurity experts over the years here, on theCUBE and generally there's been a theme of, I wouldn't say resignation, that's too strong. I'd say almost acceptance that there are going to be challenges and sometimes bad guys win. Sometimes vulnerabilities are, do yield results, you know, will ill intent. So how do you match the skill level on your side with the skill level and the motivation of the criminal actors on the other side and keep up with that? Because there's great financial motivation on that, on the bad side, you know, in order to, ransomware, you know, a great example of that. But how do you continue to fortify the hackers on your side to match that motivation that is so deeply embedded on the ill side? >> You brought up many good points, so let me start from the backend of them. So first of all, when we say that it's very lucrative to do cyber crime, I don't think it is lucrative for the actual doers. Like in ransomware, a lot of monies is changing hands, but I think it ends up in, ends up in very few hands. So a lot of the technical cyber criminals who are conducting it are probably not making much money. In opposition of this, in our ethical hacking community, we already have 14 hackers who have earned more than a million dollars by working on our programs. That is a lot of money. It's a lot of money even for criminals. If you are enlisted by a nefarious government or other nefarious organization to work for them, they don't necessarily pay you well, but working as a white hat, you can earn much, much more. So I do think the economics is rigged the right way, especially as human beings inherently want to do good. And they are ready to do good even if their pay is much lower. Now, the pay isn't lower, but even if it were, the propensity to do good, it overpowers the likelihood of somebody becoming a criminal. So, so as we, as long as we work together and pool our defenses, we'll be much stronger than any criminals. >> So, so let, if you would, let's turn the page then to you've established the talent pool, very deep, great bench. You've got a lot of people doing really good work. So let's talk about the work they are doing in terms of vulnerabilities that they're sighting, whether it's app security, cloud security, whatever the case may be. What, generally, what are you finding? What are you seeing, like where are the mistakes being made generally in your client base? What kinds of things are you pinpointing to them that you're finding through your work that they can shore up and build those defenses a little stronger? >> Broadly speaking, when you look at the industry today, every organization is undergoing digital transformation, and some do it from a primitive standpoint, some are already running on software. But there's a digital transformation going on, most organizations are moving workloads to the cloud, to a public cloud. When that happens, the nature of your application workload changes, the nature of the threat changes, and the possibilities for mistakes will be different. When you deploy workloads on a public cloud, you may have configuration issues, you may leave secrets in public repositories, there are new threats that come to you. But at the same time, it's a more uniform space because everybody's running on the same cloud and the cloud, itself, is secure. So we have devised specific services for those who run on cloud, where we go in and say, we know AWS, we know Google Cloud, we know Microsoft Azure. We will find the specific, typical vulnerabilities that you have there and we'll tell you about them so you can fix them. And then you get a much stronger cyber defense because the, the world of vulnerabilities is known to us, we've trained our hackers in identifying them. When we find them with one company, we learn, and we can look for the same in some other company. So the pace of learning is much faster in our system and that's how we can bring companies to a higher level of security when they're on the public cloud than they were before. So actually, like when you said many are resigned in front of the situation, the ship is already turning. It's important to look the threats in the eye and be unafraid of it, and just meet it, but we don't have to be resigned anymore. We have the powers in the cloud vendors, in the ethical hacking community, in software automation to now build proper systems that are broadly speaking, very secure. >> So, so how do you? >> Yes. >> How, how do we, when you look at the ransomware incidents that continue to occur, and yet I, and, and that, you know, it frightens a lot of people in the corporate world, municipal, public sector and private citizens even, right? But, but you sound, if I hearing you right, a little more optimistic, that we're getting to be a little more adept at security, if you will, and of sighting vulnerabilities and finding these loopholes and whatever. So you're not as pessimistic as, as some might be. You're thinking that perhaps we are starting to turn the corner a little bit and maybe some of these things that have been big threats are being somewhat more mitigated now? >> Well, I believe that whether you think you can fight cyber crime or not, you are correct, meaning you must have a belief of the power that you have with your other defenders. And today, we can create a defense that's strong enough. Nobody's 100% safe, ever. You can take any vaccinations you like, you may still get the, the virus. So like, as a metaphor, it's the same with software. You can never get 100% safety, but you can get much better than you were before. And you do it step by step with boring, small steps. It's not, there's no silver bullet. There's nothing that in one change will make you secure. But if you, every day fix one little thing, soon, you are more secure than your competitors and soon you are among the most secure in the industry. >> So, you know, Mårten, it is almost, I think about the old saying, "If you can't beat 'em, join 'em." This is like, if you can't beat them, have them join you. Right? >> No, it is if you can't beat them, keep beating them, keep beating at them. Like, criminal activity is very bad. The nefarious actors that are out there, there's nothing good with them. And whether they are operating voluntarily or mandated by somebody who has power over them, it's really, really bad. But, but in terms of numbers of people, they are already in a minority. They have vast resources, they have as technical resources and skills, but we have more people lined up on the defense and pooled defense will always overpower an asymmetric threat. >> Well, it's a great story what HackerOne has done in just a very short period of time over the past seven, eight years. It's important work, it's vital work and you're doing it very well. And so thanks for being with us here, on theCUBE and we wish you all the best down the road, too. >> We want the companies to do well, that's when we do well and they are very secure. So thank you very much, John. This was a wonderful conversation. >> I appreciate the time. Mårten Mickos joining us, the CEO of HackerOne. You've been watching a CUBE Conversation part of the AWS Startup Showcase. (soft electronic music)

>> Welcome to The Cube Startup Showcase made possible by AWS. In this session, we're going to dig into how organizations can improve governance and use AI to increase confidence and trust in their software delivery process. My name is Dave Vellante and joining me is Nick Durkin, who's the field CTO of Harness IO. Nick, thanks for joining. >> Thank you so much for having having me on here. I appreciate it. >> Give us the overview of the company, let's, let's start with what you guys are all about. >> Yeah, I think when you look at Harness specifically, it started as continuous delivery as a service. And we really have grown from that and become a true modern software delivery platform. And with everything that we deliver, we do this with artificial intelligence and machine learning in mind, to remove all of the tasks that we hate. No one wants to babysit deployments. No one wants to sit there and watch tests run that we don't need to run. And so really taking an artificial intelligence approach to software delivery. >> Great. Let's talk about software delivery and maybe we can dig in to some of the trends that you're seeing, maybe the drivers that are leading people to new approaches, you know, some of the challenges that customers face which are also opportunities. >> Absolutely. You know, it's interesting. We look at everyone on their journey for software delivery and traditionally velocity is actually what brings people into to either deploying faster or we need to get and modernize our platforms quicker. And so velocity is the driver traditionally to bringing new tools and new technology. And what's interesting is that governance while equally, if not more important, that's often second fiddle. And so what we find is that customers go on a journey where they use their CI tool and they expand it. They use their open source offerings that they have from modern technologies to create velocity and go fast. But then what they quickly find out is they have to govern this. And whether that's for regulatory purposes or whether that's for just internal processes, right? This becomes the hard part. And a lot of people have to script it. And if someone's actually able to achieve say velocity and governance, this is where now we're reaching, you know, speeds now that we actually wanted. So we're now deploying end times end faster, our monoliths are turning into microservices and we're actually deploying infinitely quicker. And now this becomes a problem because we don't know what broke what. And so if you can achieve velocity in governance, the next problem that people have is traditionally quality. >> Yeah, so you know, that lack of governance, that's a real challenge because you're now seeing even more stress as data becomes prone to those same processes, DevOps for data, if you will. So now you got the whole privacy and governance slamming together, and people want to automate it as fast as they possibly can. So this puts even more stress on developers. And I think your point is they've got to go faster, but that's antithetical to quality. So therein lies the conundrum, but the answer is automation, machine intelligence. Maybe you could double click on that. >> Yeah, sure. No, that's exactly it. If you think about it, there's not enough people at these companies to sit there and look at the knock and understand what normal looks like. There's not enough people to look at every line of log to understand what's going on and what broke. And this is where you can start leveraging artificial intelligence to understand what does normal look like. And when you think about it, they are traditionally opposing forces, velocity and governance. But the reality is when we talk about software delivery, oftentimes people will say and bring in tools, people, processes, and tools are people process and technology. And the reality is it's all entirely about confidence in your people. And whether it's a tool or whether it's a process that provides that confidence, if that's what they're looking for is confidence that their developers can deploy when they want to as needed. And if something goes wrong, it will be taken care of. And so back to your point, Dave, specifically, when we think about software delivery, we think about continuous delivery we really mean automate everything. Right? From start to finish. And that means with all of the guard rails and all the rules that you need for governance, so that you can meet those security requirements, you meet those regulatory requirements while still empowering developers. >> You know one of the other things that obviously has changed in the last 10 years is cloud and cloud adoption, and cloud costs, everybody looks at their bill at the end of the month. They go, okay, I love it because of driving new business models, but hey, can we figure out how to control these costs a little bit? What is the role of developers in terms of controlling cloud costs? How can they impact that? >> Sure. No. If you think about this whole shift left paradigm, and we're now empowering developers to do more and more, what we're not giving them is the inputs that they need to effectively do their job. If you want engineers to care about costs, it's something they need visibility to. If you want, if you want the administrators to function out of, you know, a cost mindset, it needs to be something that's part of their daily information that they have. And today that's not how it works. Today a CFO will call down and say, hey, we're spending way too much money. You know, I just got one. We spent over $35,000 on some test clusters and I got a phone call from our CFO. Just like everyone else does. And then we had to go fix it. Instead of giving people who honestly would do no wrong if they had the information in front of them, giving them that information. So if you solve velocity with governance and now even solve for quality, the next thing that you have coming is cost. You're now going to be deploying infinitely faster to the cloud with so many changes that you can't keep, can't keep track of it. And you need that same auditability that you'd have with a governance platform to show you what you're changing in cost. So now what you want to do is empower the same engineers to know what changed they made, what it modified, how it affected it, but also how it affected costs. And if you give that to the engineers and the people that can affect change, it's amazing what happens. >> I want to come back to this notion of data challenges, because applications are increasingly more data centric. You put your data in the cloud, great, but then people realize, oh, the clouds expanding is going out to the edge. And so data by its very nature is, is distributed. People want more control of the data, the lines of business, the domain experts that it's self service that creates a new problem around governance. And when I talk to practitioners, what I'm hearing is as they embark on this journey, because everything used to be, you know, shoved in one place, a big monolith, and that's a limiter to scale. What they'll do is they'll phase it. They'll say, okay, phase zero, we're kind of process builders. We've got to figure out, okay, how is governance is going to work? And then as fast as they possibly can, they'll codify that so that they can automate it. Do you see that evolution in, in governance? How is it playing out in your world? >> Absolutely, I think, you know, you made mention of data and really data has gravity. But to your point, what we find is that people want choice. Right? What drives where they place their data, where they place their applications. It's on choice, it's on a lot of different things. And one of the things that we found is that to that point, if you can't define those processes, those policies, those procedures, to meet your governance in any of the clouds, this becomes now a burden on your employees. If they only have it for one specific location, whether it be on premise or whether it be in the cloud. Now you have to move to another cloud, or to another place. Now it's just all that much more rework. And the reality is the tooling that you have should allow you, or allow your engineers to deploy wherever is needed, whether it's on Amazon or Azure or, or, you know, primarily when we think about it all over the different Amazon and pieces, when we want to go and I want to deploy to say Amazon EKS or EKS anywhere, and I want to have them physically on the data center, or if I want to have them, you know, up in the cloud, this shouldn't be something that our engineers have to care about. Whether I'm putting on an ECS or on, on EC2 instances. Those are things that our engineers shouldn't have to care about, and the governance should allow you to do it to the appropriate locations when required. So what should happen, ultimately, if you, if you craft this accordingly, this should be designed so that at any point in time, your engineers can't make that mistake. They can't put data in the wrong place. They can't put applications in the wrong place because the governance will hold them to it. And you'll know why, so that you can fix it. And if you create that type of behavior, then there are no mistakes, right? Allow people the freedom to deploy. And as long as they do it within the rules, it'll work. >> I wonder if we could bring up that previous slide again and talk about the velocity of the governance, the quality and efficiency, which, which is most important when you talk to customers? >> Yeah, absolutely. I think depending on where they're at in the journey, velocity might be the thing that's hurting them right now. We have to solve for it. In which case let's go grab a whole bunch of open source tools and let's go grab all the things that we have and start scripting things. And what we find is that oftentimes customers come to us when they realize I've got all this, but now I need to make sure it's governed. And this is where it's hard. And that's where people will actually, you know, if you will, phone a friend, and look for some help, because this is complex and it's not something you want to do on your own, especially if you've been doing it for the last nine years, you don't want to do it again for a new technology or a new space. And then when we think about it, if you've actually achieved governance, which a lot of say, like regulatory, you know, based customers have, quality becomes their part, where they need help. And so really it depends on where the customer's at in their journey, but I can guarantee you, everyone's looking for one of these four pieces and that's, what's their bottleneck right now. And it's really being able to provide the resolution to any of those bottlenecks out of the gate. Right? You want to make sure that if you have that coming, you're, you're prepared for it. And you have a tool that can help you as you're going to progress in those phases. >> If I understand it, your strategies, that will help customers optimize wherever they are in that journey. You know, they might be in a cloud migration. It's like, hey, we got to go fast, let's go. And then their attention is going to shift to governance. And then eventually as they get more mature, it's going to be okay, hey, we've got this down. Now we're going to lower our cost and be more efficient. So let's talk about how you do this, here's a graphic that really speaks to your platform. Nick, why don't you walk us through this? >> Yeah, sure. I think when you think about software delivery, we traditionally will think about CI and CD. And so I think that's where we can start, but there's a lot more to software delivery. And so that's what we'll offer different pieces. One of the benefits of the Harness Platform, it is not, you're not locked into every single part and piece. You already have different technologies that you want to use by all means, use them, but we do offer you those technologies if they can help. And every one of these is designed around that idea and understanding of AI and machine learning at its core. So if you think about it, we started life as continuous delivery as a service. So taking what we would consider artifact to customer. And that's really what we think about when you think about continuous delivery. And in there, we want to think about all of the things that happen after delivery, the same way your best engineers would. So we're going to look at your performance metrics and the business metrics that you have. And we're going to think about them the same way, your best engineers would, but we're also going to look at those logs and understand exactly the same way that yep, that's fine, that's fine. Hey, what's, what's that over there? And this is where we use AI and ML not to do what people love doing, but to do what people hate doing, which is babysitting deployments. When you think about CI, we traditionally think about code two artifacts. So that's the first part and there, Harness, we acquired Drone, the most loved open source CI tool on the planet. And I can't make that up because, you know, you can go to GitHub and actually look it up. So people comment on this and we decided to invest in it, quadruple the team, and then add all of those security governance quality pieces to it. And then even one step further, add some more of that artificial intelligence. Dave, I'll ask you a direct question. If you were to change to the gas cap on your car, would you, after you change that, would you go check every single electrical device and electrical switch on your car to make sure it works? >> I hope not. (laughter) >> You hope not, right? But the funny thing, and the interesting thing is that when we do tests today in our CI tools today, if you make one change, our customers, or actually every customer, is testing everything every single time, instead of being more intelligent about it and only testing those things that matter. And so again, bringing those costs down, bringing that effort down and bringing that toil down across the board, this stands true for feature flags. If you want to get into more granular things and say complex deployments, you want to do this with feature flagging, to allow different customers, to be able to turn on and off different features for different regions or different reasons. Now, this is built into the same tooling where you can apply it to a pipeline and then have that verification after. So you really get that opportunity and that ability to use AI, to do what people are manually calling customers and determining whether it looks okay or are waiting and looking at, you know, output on a screen, now you can have machine learning, handle it for you. And really this is where it's designed to, as you move through that and any type of change that you wanted to do, whether it be in databases or in different network topology and using that same machine learning and verification. And then last thing that cost piece, a lot of people will say that a cloud cost tool does not belong in software delivery. And if you believe in shift left and you believe in giving people all the inputs, and I think you'd probably disagree, you'd actually fight yourself on that and say, it does probably live here. And that's what we want to bring that data, and not only visibility, we want to bring recommendations on how to fix it and bring actionability. So actually start taking action right away to bring costs down. >> Yeah but see you're not just making software delivery better. You're rethinking the approach. You're not just paving the cow path, sometimes I say, you're not doing that. You're reinventing, you know, to use an AWS term. >> Well, we actually did that specifically. When we said we wanted to build continuous delivery. We wanted to do it in a way and in a shape that wasn't copying the way that other CI tools had done it with expanding CI. We said, you shouldn't have to know what, how to write complex deployments. You shouldn't have to care whether you're on an EKS cluster, that's on premise or, or up in the cloud, your engineers shouldn't have to care and we should extract that from them. Right? And that's what we did there. And so to your point with all of these pieces, yes, we're rethinking them. We're not going ahead and just taking and paving that same path, like you said, we're truly trying to make it usable and viable for those that can use it. >> What do people buy from you? Is this a subscription? Is it a consumption-based model? How does that all work? >> Yeah, great question. So it is, it's a subscription and ultimately we're a software delivery company, but we're continuous delivery company. So unlike other people that will talk to you about, you know, updates and new versions and new pieces, we deploy a new version of our software at least once a day, we practice what we preach. And if you're going to continue to deliver software with somebody who doesn't do it themselves, you should probably ask yourself how, if they can't trust themselves to do it, are you going to? But the reality is depending on what you need, you only have to pay for what you need. So it's not like other platforms where you have pay for everything and only only use a part and piece of it. So for every aspect that you want and, or need, you're more than welcome to use it. And, I'll say something that my sales people probably don't like, but you know, we've never lost a deal on cost, right? We're here to show you value and ultimately make sure that it can help you and your customers, and that's what we do. >> Well this is clearly the trend in software pricing. We're seeing it's true cloud pricing, it's consumption pricing, it's you, you seem to have got it right in a, in a hot area that's why the investors are getting behind you. Nick Durkin of Harness IO. Excellent, thanks so much for your time, thanks for your insights. Really appreciate it. >> I appreciate it. Thank you so much, Dave. Thank you for having me on. >> You're welcome. Okay you're watching The Cube's Startup Showcase made possible by AWS, new breakthroughs in dev ops data analytics and cloud management tools. Keep it right there. (soft music)

>>From around the globe. It's the cube covering Fortinet security summit brought to you by Fortinet. >>Okay. Welcome back everyone. To the cubes, coverage of Fortinets championship golf tournament, we're here for the cybersecurity summit. David got a great guest, Ruby cutoff CEO, and co-founder of Tufin great to have you on. Thank you for coming on the cube. We were chatting before. Came on. Camera, big talk. You just gave it. Thanks mom. Thanks >>For having me >>Not a bad place here. Golf tournament, golf and cybersecurity, kind of go together. You know, keep the ball in the middle of the fairway. You know, don't let it get out of bounds, you know, >>And it's a beautiful place. So, uh, very happy to be here and be a premier sponsor of the event. >>Congratulations and a good, good to have you on let's get into the cybersecurity. We were talking before we came on camera around how transformation is really hard. We went to the cloud is really hard refactoring. You're just really hard, but security is really, really hard. That's true. So how do you look at how security is perceived in companies? Is there dynamics that are being amplified by the rapid moved movement to the cloud? You seeing apps being developed really fast changes fast. What's the, what's the barometer of the industry right now? Sure, >>Sure. It's interesting. And this hasn't really changed in the past, but we've seen like exacerbated getting worse and worse. I think a lot of companies security is actually seen as a blocker and frankly security is probably the most hated department in the organization because a lot of times, first of all, the security says no, but also they just take their time. So if you think about organizations, enterprises, they run on top of their enterprise applications. They have applications that their own in-house developers are writing, and those developers are changing their apps all the time. They're driving change in it as well. So you end up having dozens of change requests from developers want to open connectivity. You want to go from point a to point B on the network. They open a ticket. It reaches the network security team that ticket might take several days until it's implemented in production. So the level of service that security provides the application teams today is really not very high. So you can really understand why security is not, um, looked upon favorably by the rest of the organization. >>And some organizations. My perception is, is that, you know, the hardcore security teams that have been around for awhile, they've got standards and they're hardcore, a new app comes in, it's gotta be approved. Something's gotta get done. And it's slower, right? It slows people down the perception. It could be slow. How is it changing? Yes, >>So it changing because when you're moving to the cloud and a lot of organizations are adopting the cloud in many ways, private cloud, public cloud hybrid cloud, you know, they're working in cloud native environments and those environments, you know, the developers are, they own the keys to the kingdom, right? They're managing AWS Azure, Google cloud to managing get hub. You know, they got the place to themselves. So they're pushing changes in their apps without asking it for permission. So they're suddenly exposed to this is how fast it can really be. And while anything that they do in the on-prem or sort of traditional applications is still moving very slowly unless they're using an automated approach to policy. So one of the things that I spoke about today is the need for organizations to adopt a policy centric approach. So they need to define a policy of who can talk to whom and what conduct to what across the entire organizational network, whether it's firewalls routers, which is cloud platforms. >>And then once you have that policy, you can start automated based on the policy. So the concept is somebody opens a ticket, a developer wants to make a change. They want a ticket in service. Now remedy that ticket reaches, uh, some system that's going to check for compliance against the policy. If you're able to immediately tell if that change is compliant or not, then you're able to make that split-second decision, which might take an analyst a couple of days, and then you can design the perfect minimal change to implement on the network. That is really agile, right? That's what developers want to see. And a lot of security departments are really struggling with that today. >>Why, why are they? That seems like a no brainer because policy-based innovation has been around in the network layer for many, many years decades. Right? We'll see, makes things go better, faster. Why would they be against it? Where were they? >>Yeah. So they're not really against it. I think it's just the sheer complexity and size of today's networks is nothing compared to where it was 10 years ago. So you have tens to hundreds of firewalls in large enterprises, thousands of routers and switches, load balancers, private cloud SDN, like NSX and ACI public cloud Kubernetes. It's just a plethora of networking. So we're thinking of it as proliferation of networking is getting worse and worse, especially with IOT and now moving to the cloud. So it is just so complex that if you don't have specialized tools, there's absolutely no way they'll, you'll be able to. >>So your talk must so gone over well, because I do a lot of interviews and I hear developers talking about shift left, right? Which is, you know, basically vernacular for do security in the dev CIC D pipelining. So while you're there rather than having to go fix the bugs later, this seems to be a hot trend. People like it, they want it, they want to check it off, get it done, move on this policy-based automation, help them here. >>It does in some ways, I mean, so you need a policy for the cloud as well, but there's a different challenge that I see altogether in the cloud. And one of the challenges that we're saying is that there's actually a political divide. You have network security folks who are managing, you know, firewalls routers, switches, and maybe the hub to the cloud. And then inside the spokes inside the cloud itself, you have a different team, cloud operators, cloud security folks. And those two teams don't really talk to each other. Some companies have set up centers of excellence, where they're trying to bring all the experts together. But most companies, network security, folks who want to understand what's happening inside the cloud are sort of given the Heisman. They're not invited to meetings. Um, and there's lack of which I think is tragic because it's not going to go over well. So there's huge challenges in security in the cloud. And unless these two departments are going to talk to each other and work together, we're not going to get anywhere near the level of security that we need. >>The cloud team, the cloud guys, if you will, you know, quote guys or gals and the security guys and gals, they're not getting along. What's the, what's the, is it historical? Just legacy structures? Is it more of my department? I own the keys to the kingdom. So go through me kind of the vibe, or is it more of just evolution of the, developer's going to say, I'm going to go around you like shadow it, um, created the cloud. Is there like a shadow security, but trend around this? >>Yeah, there is. And I think it stems from what we covered in the beginning, which is, you know, app developers are now used to and trained to fear security. Every change they want on the on-prem network takes a week, right? They're moving to the cloud. Suddenly they're able to roam freely, do things quickly. If network security folks come by and say, oh, we want to take a look at those changes. What they're hearing, the music is all we're going to slow you down. And the last thing cloud guys want to hear is that we're going to slow you down. So they have they're fearfully. You know, they're, they're rightly afraid of what's going to happen. If they enable a very cumbersome and slow process, we got to work differently. Right? So there's new paradigms with dev DevSecOps where security is built into the CIC pipeline, where it doesn't slow down app developers, but enables compliance and visibility into the cloud environments at the same time. Great stuff. >>Great insight. I want to ask you your, one of your things in your top that I found interesting. And I like to have you explain it in more detail is you think security can be an enabler for digital transformation. Digital transformation can kick the wrong yeah. With transforming. Okay. Everyone knows that, but security, how does security become that enabler? >>So, I mean, today security is a, um, as a blocker to digital transformation. I think anybody that claims, Hey, we're on a path to digital transformation. We're automated, we're digitally transformed. And yet you asked the right people and you find out every change takes a week on the network. You're not digitally transformed, right? So if you adopt a, a framework where you're able to make changes in a compliant secure matter and make changes in minutes, instead of days, suddenly you'll be able to provide a level of service to app developers like they're getting in the cloud, that's digital transformation. So I see the network change process as pretty much the last piece of it that has not been digitally transformed yet. >>And this is where a lot of opportunity is. Exactly. All right. So talk about what you guys are doing to solve that problem, because you know, this is a big discussion. Obviously security is on everyone's mind. They're reactive to proactive that buying every tool they can platforms are coming out. You're starting to see a control plane. You're starting to see things like collective intelligence networks forming, uh, what's the solution to all this, >>Right? So what we've developed is a security policy layer that sits on top of all the infrastructure. So we've got, uh, four products in the two for an orchestration suite where we can connect to all the major firewalls, router, switches, cloud platforms, private cloud SDN. So we see the configuration in all those different platforms. We know what's happening on the ground. We build a typology model. That is one of the industry's best apology models that enables us to query and say, okay, from point a to point B, which firewalls, router switches and cloud platforms will you traverse. And then we integrate it with ticketing system, like a remedy or service now, so that the user experiences a developer opens a ticket for a change that ticket gets into Tufin. We check it against the policy that was defined by the security managers, the security manager defined a policy of who can talk to whom and what conducted what across the physical network and the cloud. >>So we can tell within a split second, is this compliant or not? If it's not compliant, we don't waste an engineer's time. We kick it back to the original user. But if it is compliant, we use that typology model to perform network change design. So we design the perfect minimal change to implement an every firewall router switch cloud platform. And then the last mile is we provision that change automatically. So we're able to make a change in minutes, instead of days would dramatically better security and accuracy. So the ROI on Tufin is not just security, but agility balanced with security at the same time. So you like the rules of the road, >>But the roads are changing all the time. That's how do you keep track of what's going on? You must have to have some sort of visualization technology when you lay out the topology and things start to be compliant, and then you might see opportunity to do innovative buckets. Hey, you know, I love this policy, but I'm, I'm going to work on my policy because sure. Got to up your game on policy and continue to iterate. Is that how do they, how do your customers Daniel? >>So listen, we we're, uh, we're not a tiny company anymore. We've grown. We went public in April of 2019 race and capital. We have over 500 employees, we sold over 2000 customers worldwide. So, um, you know, when customers ask us for advice, we come in and help them with consulting or professional services in terms of deployment. And the other piece is we gotta keep up all the time with what's happening with Fortnite. For example, as, as one of our strategic partners, every time fortnight makes the change we're on the beta program. So we know about a code change. We're able to test them the lab we know about their latest features. We got to keep up with all that. So that takes a lot of engineering efforts. We've hired a lot of engineers and we're hiring more. Uh, so it takes a lot of investment to do this at scale. And we're able to deliver that for our customers. >>I want the relationship with 400. I see you're here at the golf tournament. You're part of the pavilion. You're part of the tournament by the way. Congratulations. Great, great, great event. Thank you. What's the relationship with food and air from a product and a customer technology standpoint, >>We're working closely with Fortnite, where they're a strategic partner of ours. We're integrated into their Fordham manager, APIs. We're a fabric ready solution for them. So obviously working closely. Some of our biggest customers are fortnight's biggest customers will get the opportunity to sponsor this event, which is great tons of customers here and very interesting conversations. So we're very happy with that relationship. >>This is good. Yeah. So that ask you, what have you learned? I think you got great business success. Looking back now to where we are today, the speed of the market, what's your big takeaway in terms of how security changed and it continues to be challenging and these opportunities, what was the big takeaway for you? >>Well, I guess if you were like spanning my career, uh, the big takeaway is, uh, first of all, and just in startup world, patients think things come to those away, but also, um, you know, just, you got to have the basics, right? What we do is foundational. And there were times when people didn't believe in what we do or thought, you know, this is minor. This is not important as people move to the cloud, this won't matter. Oh, it matters. It matters not just in on-prem and it matters in the cloud as well. You gotta have a baseline of a policy and you gotta base everything around that. Um, and so w we've sort of had that mantra from day one and we were right. And we're, we're very happy to be where we are today. Yeah. >>And, you know, as a founder, a co-founder of the company, you know, most of the most successful companies I observed is usually misunderstood for a long time. That's true. Jesse's favorite quote on the cube. He's now the CEO of Amazon said we were misunderstood for a long time. I'm surprised it took people this long to figure out what we were doing. And, and that was good. A good thing. So, you know, just having that north star vision, staying true to the problem when there were probably opportunities that you are like, oh, we, you know, pressure or sure. Yeah. I mean, you stayed the course. What was the, what was the key thing? Grit focused. Yes. >>Looking to startup life. It's sorta like being in sales. We, we got told no, a thousand times before we got told yes. Or maybe a hundred times. So, uh, you gotta, you gotta be, um, you got to persevere. You gotta be really confident in what you're doing and, uh, just stay the course. And we felt pretty strongly about what we're building, that the technology was right. That the need of the market was right. And we just stuck to our guns. >>So focus on the future. What's the next five, five years look like, what's your focus? What's the strategic imperative for you guys. What's your, what's your, what do you mean working on? >>So there's several things that on the business side, we're transitioning to a subscription-based model and we're moving into SAS. One of our products is now a SAS based product. So that's very important to us. We also are now undergoing a shift. So we have a new version called Tufin Aurora Tufin Aurora is a transformation. It's our next generation product. Uh, we're rearchitected the entire, uh, underlying infrastructure to be based on microservices so we could be cloud ready. So that's a major focus in terms of engineering, uh, and in terms of customers, you know, we're, we're selling to larger and larger enterprises. And, uh, we think that this policy topic is critical, not just in the on-prem, but in the cloud. So in the next three years, as people move more and more to the cloud, we believe that what we do will be, become even more relevant as organization will straddle on-premise networks and the cloud. So >>Safe to say that you believe that policy based architecture is the key to automation. >>Absolutely. You can't automate what you don't know, and you can't people, like I mentioned this in my talk, people say, oh, I can do this. I can cook up an Ansible script and automate, all right, you'll push a change, but what is the logic? Why did you make that decision? Is it based on something you've got to have a core foundation? And that foundation is the policy >>Really great insight. Great to have you on the cube. You've got great success and working knowledge and you're in the right place. And you're skating to where the puck is and will be, as they say, congratulations on your success. Thank >>You very much. Thanks for having >>Me. Okay. Keep coming here. The Fortinet championship summit day, cybersecurity summit, 40 minutes golf tournament here in Napa valley. I'm John Firmicute. Thanks for watching.

(gentle music) >> Welcome to theCUBE's coverage of PagerDuty Summit. I'm your host for "theCUBE", Natalie Erlich. And now we're joined by the CEO and Chairperson for PagerDuty. We're joined by Jennifer Tejada. Thanks very much for joining the program. >> Hi, Natalie. It's great to have you, and "theCUBE", with us again. >> Fantastic, well, let's do an overview of what PagerDuty does and how it's helping its customers. >> Well, PagerDuty is a digital operations management platform. And what that means is that we use software to detect real-time issues and events from the complex ecosystem of technology that's really hard for humans to manage. We then intelligently orchestrate that work to the right teams, the right people with the right expertise, in the moments that matter the most to your business. And that's become especially important as the whole world has moved to a digital-first world. I mean, pretty much everything we do we can experience on demand today but that's only made possible through the complex technology and infrastructure that's managed and operated by responders all over the world. And PagerDuty's digital operation solution communicates issues in real time to ensure a perfect customer experience every time. >> Terrific, and if you could go through some of the key features like on-call management, incident response, event intelligence and analytics, it would be really great. >> Sure, so, our heritage started with automation of the on-call situation for engineers. So, back in the day, many organizations had software engineers building apps, platforms, infrastructure, but then they would throw that over the wall to an ops team who would manage it in production. That led to poor code quality, it led to lots of challenges when people would release software in the middle of the night on a Saturday, et cetera. And it meant that it took a very long time for companies to manually get a problem into the hands of the right person to solve it. We automated all of that using an API-based ecosystem that connects to over 460 of the most popular applications, observability stacks, monitoring systems, security applications, ticketing environments, cloud environments, et cetera. And so, all of that is now seamless. What that data enabled us to do was build an event management solution, which we call Event Intelligence, which now uses AI and machine learning to help responders understand the nature of all the different events coming at them. So, for instance, instead of seeing 100 events coming at you from 16 different monitoring environments in your infrastructure, PagerDuty will use AI to know that of those 175 are part of the same incident. They're events conspiring to becoming a business-impacting incident. And that allows our teams to get ahead of things, to become proactive versus reactive. We've also built analytics into our solution which helps our customers benchmark themselves and their operational efficiency versus their peer group. It helps them measure the health of their teams and understand which services are causing them the biggest challenges and the most expense whether that's labor expense or customer impact. And most recently, we've been really thrilled with our acquisition of Rundeck which helps us automate the remediation of events which now means that PagerDuty can automate incident management and incident response, both upstream, in terms of identifying events as they flow in, and also downstream, safe self-healing of infrastructure, application and platform environments to get things back to the way they need to work in order to serve end customers and serve employees across an enterprise. We're really excited as our vision has expanded to become the ubiquitous platform, the de facto platform, for real-time work. And what we've seen over the years is our customers coming up with very imaginative ways to use our software to solve real-time unstructured, unpredictable work across the company. That can be legal teams managing across different geographies and business units to close contracts at the end of the quarter, it could be financial services companies that are managing their physical security as well as their digital security through PagerDuty where time really, really matters if you have a data breach or a potential physical security incident. It could be customer service where customer service and support teams are working very closely with engineering teams to identify issues that are causing customers problems and to manage those issues collaboratively so that the customer experience is protected. So, just some examples of how PagerDuty is getting leveraged. And we're really excited to talk about some new innovations at Summit. >> Terrific, well, you really have your thumb on the pulse of corporate America, and as you know, last year, we talked about the pandemic and now we're looking at going back to the workforce, we're looking at the future of work. What does that look like for you? >> Well, the future of work is here and one thing is for sure, it has changed permanently. I think we all learned from the past year that remote work can provide a lot of flexibility and can level the playing field for people all around the world. It means you can access talent from different geographies. It means you can have a different level of work-life balance, but it also comes with its own set of complications. And one of the reasons we pulled Summit earlier from September into June was we really wanted to be a part of this kind of grand moment of reopening that we're seeing around the world. And that means that every organization that we're working with is redesigning their future. But that didn't start today, that started several months ago, as companies learned from their remote work experience, learned from their on-demand experience in dealing with their own customers. And it took some of those innovations and brought them forward into kind of the new design for the way teams will work, the way brands interact with their customers. And at Summit, you're going to hear us discuss why now is the moment, now is the moment to harness your digital acceleration because that's really the way that business is getting done. I mean, frankly, every business is now a software business and all business is now digital business. And PagerDuty has proven itself as the essential infrastructure on which all companies, all brands, can build their success. And as we widen our aperture we think about building the platform for not just today's challenges, but tomorrow's challenges. So, at Summit, you'll hear us talking a lot about resilience and how your entire organization and your brand will be judged on your ability to stand up a resilient business, a resilient brand experience for your customers. Today, uptime is money and resilience and reliability are the currency of tomorrow. We're entering into this era where autonomy is everything when it comes to work. I mean, employees, and generally humans, do not want to be stuck managing mundane tasks. And the hybrid work arrangements that we're anticipating mean that PagerDuty's platform will become even more essential for customers because hybrid work drives more complexity. It means your teams are distributed, they maybe distributed across regions, co-located, remote at home, in different time zones. And when something's going down that's really causing a problem in your business, you need to orchestrate work across the right people that can make a difference in that moment. Autonomy and flexibility, frankly, is what people expect from work. And they also expect to engage with apps and platforms that are easy to use, that are intuitive, that deliver really fast time to value. And that has long been at the core of PagerDuty's offering and value proposition. And none of these autonomous or automation investments replace human expertise. They allow our platform to channel that expertise and the expertise of your users to give them context and visibility to make the best possible decisions in the moment that matters. And I think that is so empowering as we think about this flexible new hybrid way of working. And then lastly- >> And I love the points. >> Oh yeah, go ahead. >> Yeah, I love the points that you make about resilience and autonomy. I'd love it if you could just drive a little further how we can build more connection now that we're going into the office and also integrating this kind of hybrid system. >> Well, I think it's really interesting because in some ways I feel super connected to my employees 'cause I'm engaging with them one-to-one, my box and their box. I have had the opportunity to stay connected to customers and executives across the industry over course of the pandemic. And yet, I'm an extrovert, I miss the in-person opportunity that kinetic energy that comes with being together in a room. And I'm looking forward to being back in studio, doing interviews with you, Natalie. But at the same time, I appreciate the convenience that I've gained. Like, I'm not looking forward to commuting again. I mean, I plan to only get on the road during off hours in the future. And I realize that I don't have to travel six hours for a two-hour meeting on the other side of the U.S., or 15 hours to have a meeting in Europe, I can get a lot of business done online. Having said that, that connection is so important. The social contract that you create with your customers and your businesses is so important. And making sure that we can connect the complex technology that runs the world today is also really important. And that's where PagerDuty plays a role. PagerDuty really helps you know who you need, what you can leverage them for, and gets them in touch when you need them, like I said, on the work that is somewhat unpredictable but can be very high priority, the highest priority in the case of a security breach or a major customer-impacting incident. And so, using AI apps, or sorry, using AI and automation to make sure that we can intelligently route work to the right people is a big part of how our platform has come together and really become the central nervous system of the digital economy. >> Yeah, I mean, these are really great points and it's a bit of a silver lining actually with the pandemic, learning that we can really stay connected despite not being in the office and now have more hybrid systems of work. But let's switch now gears to talk about leadership in our communities and how we can truly activate change and a far more just and equitable world. >> Well, I am a huge believer in social responsibility and social impact, and I really appreciate how all of our employees have come together to leverage PagerDuty's platform for good. When we went public, we launched pagerduty.org which was led by Olivia Khalili. And I know you'll hear from her and some of our impact customers this week at Summit, but I think what's really important is how engaging it is for our employee base. Last year, 93% of PagerDuty employees have volunteered their time for social causes and philanthropy. And that's in a time when we were all enduring a hardship of our own, we were all facing an unprecedented pandemic. We've donated over a million dollars in financial grants to over 400 organizations through strategic giving and employee-match programs. And we've opened civic engagement. We've opened source civic engagement with our Day for Change for our employees and our toolkits which we've shared broadly throughout the industry. We signed on to the Board Challenge which I was thrilled to do because I'm a big believer that more diversity in the boardroom is going to lead more equity in corporate America. And thrilled to add Bonita Stewart and Dr. Alec Gallimore to our board last year. And I think representation is so important at the board level, not just because it's the right thing to do, not just because it's the right thing for business, but it's the right thing for career growth for your employees, showing them the path to what's possible for them with your company. And finally, we published PagerDuty's first ever "Inclusion Diversity and Equity Report", which is part of our effort to provide transparency around not just what we're doing, but how we're measuring it, how we're progressing, so that we can get better every year. And we've highlighted our work to support time-critical health, our work to support equity in the response to COVID including vaccine distribution. And I really enjoy some of the impact stories that we hear from our non-for-profit partners that are working with us at pagerduty.org. So, leadership is what you make of it and you can lead from every chair in an organization. And I'm so proud of the leadership, our employees, and many of our customers have demonstrated in this time of particular challenge around the globe. And we're not through it entirely yet, and so, I'm just really hopeful that we can all come out of this better together. >> Right, and speaking about leadership, why do you think that diversity is so critical for effective leadership? >> Well, first of all, I think it's our responsibility to reflect the communities that we serve. My users do not all look the same, they don't come from the same background, they're from over 150 countries around the world. They're solving a diverse set of problems. And in fact, the problems they're solving with our platform is growing every day as they imagine how to apply our technology, our digital operations platform, to different types of real-time work around their companies. But diversity is also important in problem solving, in looking at challenges through different lenses, in thinking about the different stakeholders that you serve in that process, and in creating an equitable community around you, creating opportunity for people around you. I mean, one of the things that we did that was a business decision a couple of years ago was to open an office in Atlanta. And part of that was to create a path, create opportunities for Georgians and people in the Metro Atlanta area to participate in the tech industry. This was before everybody was working from home, before those geographical barriers were broken down. And I'm thrilled to say, we have a thriving community now in Atlanta that's growing and we're hiring. But that's just one example. That was the smart thing to do for our business, but it was also a great thing to do, I think, for the community. And we've brought new minds and all kinds of new people into our business. And this month we're celebrating Pride Month at PagerDuty, which I'm thrilled to do. We have very active LGBTQ community who contribute hugely to our efforts and to our customers' success. And we think that everybody deserves an equal shot at opportunity at the lifestyle they want and the opportunity to build their own bright future. >> Great, and just lastly, what's the main focus for PagerDuty in the next year? >> The main focus for PagerDuty next year is really executing on our strategy to become the defacto platform for real-time work, ensuring that we can leverage the largest domain-agnostic ecosystem of connected apps and services, that we can leverage the largest dataset based on responder data, workflows, events and incidents to help our customers deliver the resiliency, the autonomy, and the connectedness that they're looking for to serve their customers and accelerate their digital prospects and frankly, to prosper in the future. So, it really is about becoming that de facto platform for action for all your real-time, unstructured and important work. >> Well, Jennifer Tejada, the CEO and Chairperson of PagerDuty, loved having you on this program. Really appreciate your insights on diversity and leadership, and, of course, the next phase for PagerDuty itself. I'm your host for "theCUBE" now covering the PagerDuty Summit. Thanks for watching. (bright music)

>> Announcer: From around the globe. It's theCUBE with digital coverage of AWS re:Invent 2020, sponsored by Intel, AWS and our community partners. (upbeat music) >> Hey, welcome back everybody. Jeff Frick here with theCUBE. We're coming to you from our Palo Alto studios today with our ongoing coverage of AWS re:Invent 2020. It's a virtual event, like all the events in 2020, but we've been going there since 2013. We're happy to be back this year and we're excited to have for the first time on theCUBE, our next guest, she's Kelly Herod the US SAP Offering Leader for Deloitte Consulting. Kelly, great to see you. >> Great to see you as well, Jeff, thanks so much for having me. >> Absolutely, so first time on, on theCUBE, you guys have a really interesting concept at Deloitte, you call it the Kinetic Enterprise. What is the Kinetic Enterprise all about? >> Yes. So if you think about the past, organizations built their technology infrastructures to be what we would call built to last, the future though is all about built to evolve. And that's exactly what the Kinetic Enterprise is. It's really how we're helping our clients create the right technology infrastructures that evolve with their business. And Kinetic Enterprise is focused on four key pillars. The first, that we're building a technology solution that's clean. That means we want to have reduced amount of custom code or things that we may have built that really rack up your technical debt. The second pillar is that it's intelligent. So we're leveraging all of the technologies, artificial intelligence, machine learning, to really automate and change the way in which an organization runs their business. The third pillar is that it's responsive, and that means it's on the cloud and this is where AWS comes in. And then the last pillar is that it's inclusive. So it uses all of the technologies and microservices available to really optimize and achieve a company's business value objectives. >> So that is a great summary, and I've got the list of the four pillars. It's just interesting you lead with clean. You know, there's a lot of conversation about digital transformation and move fast and be dynamic, you know, would be kind of an opposite to static. But clean, interesting choice of words. It runs with core... Core clean ERP with minimum technical debt. Why clean is such an important thing? I get kind of intelligent and responsive, but clean is an interesting attribute to pick. >> Absolutely, so if you take a step back and think... (Kelly hangs) when comes to ERPs, when ERPs came out, there was... (Kelly hangs) how you're going to run your entire organization on this one solution. What we've found is that as companies have put ERPs, they've gone through and created so much customization, that it's that which makes it very difficult to be able to keep up with technology changes or actually migrate to the next versions. So the concept here is if you're going to go in and put in brand new ERP, such as an SAP S/4HANA, this time around in order to achieve the promise of ERPs, let's make it clean. Let's stick to as much standard functionality as possible within the core, and then we innovate on the edges. And so that will allow us in the future to maintain that flexibility or dynamicism of a Kinetic Enterprise. >> Right. So I have to tease you Kelly 'cause SAP R/3 and ERP is not necessarily synonymous with digital transformation, speed, agility, and embracing change. So you've been involved in Deloitte's SAP practice for a long time. Why should people start to rethink about SAP in terms of being responsive, in terms of being able to change quickly and to your vocabulary, more kinetic? >> And you're right. You know, I've been doing SAP for 20 years. So I actually did start back in the R/3 days. And, you know, I would just say that things are changing, is evolving. You know, SAP themselves has been going through a transformation, a revolution. You look at the ERP landscape as a whole, all of the ERP players are moving to the cloud. The technology is the backbones are changing. Now the reality is, you know, going in and actually changing out your ERP, no matter what solution you're using, it's a big endeavor or undertaking. The goal here, and why we're partnering with SAP, partnering with AWS is really focused on how can we make this more efficient for our clients? More importantly, I like to think about it as how can we make this less of a one and done, and more of a let's keep transforming the technologies and the business as things are changing in the market, along the way. And using technologies to even change how we implement, allows us to do that. >> So, Kelly, another thing a lot of people probably don't think of is SAP and AWS, together in the same sentence. So I'm sure there's a lot of people that are much more intelligent about this, but for those that aren't as familiar, tell us a little bit about the relationship with SAP and AWS and then how you guys are leveraging that at Deloitte. >> Absolutely. So when you... There's a couple of things that I would bring up. One is SAP S/4HANA solutions, in particular, but any SAP environment that you're running on, one of the objectives most of our clients are focused on is how to move to the cloud, and that's where AWS comes in. You can absolutely run any of your SAP solutions on AWS. And what that brings you with is more flexibility, so that you can actually scale or contract your infrastructure that you're running SAP on based on your business needs. The second thing that we've been partnering with AWS to do is a little bit of what I just mentioned, which was a teaser around, how do you change the way you even go about implementing an SAP solution or start to migrate your business? So one of the things we asked ourselves was, could we radically change how you jumpstart an S/4 implementation? And what we decided to do is team up with AWS and leveraging machine learning, artificial intelligence, most importantly, standing up an environment on AWS. We actually created what we call Kinetic Finance Startup. Many of our clients are choosing to start with finance and specifically SAP central finance to begin their journey to the new S/4HANA environment. And what we've been able to do is create a touchless build solution, so over a weekend, we can actually connect to your existing ERP solution. Majority of those is starting with an ECC environment. We can extract the data, we can use harmonization rules to actually change and modify your data and optimize it for the future. And then we actually through completely touchless built-in automation, stand up a brand new AWS environment with S/4HANA on it and actually automate the configuration and testing of the basic financial transactions. So when you come in the next week and we start the conversation with the client, we're actually looking at a real life S/4HANA system on AWS with their mas... >> Oh, that's... >> So the whole concept is to change how we engage. >> Right. So again, I don't know that I were to think of finance as kind of a lead application, to start this journey. I mean, I can see on one hand, it is the system of record and it, you know, it has a lot of very important information that's got to eventually get into finance. On the other hand, it seems like there's less critical, maybe lower hanging fruit that's less risky. Is it because you can run it kind of in a parallel path for some period of time, but it strikes me that finance might not be the first place you go to look for some early wins. >> It's actually what you just said about the parallelism. So the reason we've seen that finance actually was one of the starting points is even if you look at the history of SAP's S/4HANA solution, way back before we got to that, it started with a concept called smart accounting or simple finance. And the theory here is, you could actually... If a company has, let's say multiple ERPs, as most do, you can actually grab the financial information, bring it into a new S/4 or central finance environment, and actually combine or merge the accounting information to get improved reporting, optimize a shared service organization. So it's actually a lower risk way to start the journey before going and touching the heart of the business or core operations, or manufacturing, for example, >> That's pretty interesting. So you run it in parallel for a while and then eventually does, is the plan that it takes over, from the old. So it is effectively kind of, I guess, a slightly delayed lift and shift, or maybe it's a reassemble and then a flip. I don't know how you would describe it because it's not really lift and shift. >> It's not really lift and shift actually, you have two options. You can either over time pull all of your business processes out of the underlying ERP solutions and bring them into the S/4HANA environment or multiple S/4HANA environments. Or some companies may choose to continue to... (Kelly hangs) Especially if you're in an industry where you do a lot of acquisitions or divestitures, you may not have an intention of ever combining all of your ERPs, but you may want to change each of them to S/4HANA underneath, and then have one environment in which you're pulling your data together to really consolidate your financial reporting. >> That's great. I want to follow up on something that you mentioned, which is the use of machine learning and artificial intelligence. And we talk a lot about, right? Those are hot buzzwords all over the place, but, you know, I'm pretty vehement in that, you know, general purpose AI and ML is kind of interesting, but where the real interesting stuff ends is where the rubber hits the road, is in applied. And it sounds like you've got a pretty interesting application where you're applying this technology to help make this move to cloud go a little bit smoother. >> Yes. One of the areas, you know, since we've been talking a bit about finance then I'll use it as an example. Is if you think about it, whenever we go in and we're typically working with... (Kelly hangs) especially in finance, you know, one of the topics is, how to optimize a chart of accounts? So over time we've done this hundreds of times, if we can look at different sectors, different industries, we can use benchmark chart of accounts. So instead of making this a paper-based exercise that individuals are doing, why not take that and actually use artificial intelligence machine learning to create data harmonization rules, so that technologies can actually do that same work. And so that's been one of the things we've been working on that I personally find very interesting just in my finance background. >> Right. And is this a relatively new thing, or have you guys been doing this for a while? >> Actually, it's something that over the last 12 months, we've been focused on building out in partnership with AWS. So it's fairly new. >> That's great. I want... I'd love to shift gears a little bit, and talk about COVID, and the impact of COVID on your business. Clearly in March, right? It was the light switch moment and everybody had to work from home and it was a quick rush to make sure that everybody was safe and we could support our remote workers, that said, can't help with the ba... All the bad stuff that's happening in hospitality and travel, and a whole lot of other industries. So that aside and that's bad stuff. In the tech industry, we were able to make the move, but now we know we're six, seven, eight months into this thing, and it's clear that, you know, we're going to have many elements of this going forward for a while. So I'm curious just from your business and your customer point of view, if you can share, you know, kind of the contrast of what happened in March and April to what you're seeing now and how this new reality, whatever this new reality is going to be, as we, you know, continue to evolve is impacting this digital transformation conversations? >> It is interesting. So if I pivot back to March, when this all occurred, you know, it truly did feel an instant going from in-person. And as consultants we travel and typically have a Monday through Thursday, or Monday through Friday type of travel schedule to an instant working from home overnight. And, you know, I'm really proud of our teams and how they seamlessly made that transition. Many, including myself, were actually leading clients through final cut overs in parallel to this happening. And we were able to really pivot and make those shifts, and I was reflecting with one of the executives I worked with, you know, she and I, you know, six months later, we're looking back at how we did that and how impressed we were with what the team pulled off. And since then, they've been able to do several other go lives, which is great. But I think that it was something we had to do quickly. I think many would have said it couldn't have been done that you would see the whole world move to a working from home environment, but we did. What it tells me is it gives me a lot of hope for a lot of the things that businesses can do in the future. In the past we used to constrain ourselves of, Oh, there's no way we could ever get XYZ done, or we can't make this type of change in the world, but we can. If I flash forward to now, I think we're very settled in kind of this new way of working, but I'm also hopeful for what the future is going to look like. I don't believe it will be a pivot all the way back to... Especially for consultants traveling on a regular basis of Monday through Friday. Instead, I think we're going to create models that give people and organizations the flexibility they need to really balance some of their personal responsibilities along with their work responsibilities. My hope and expectations is that also opens up options so that all organizations have access to more talent that they may not have had before. And I think that also means global talent. I think we're showing we can work as global teams, which means, you know, I could now have members from Japan joining, you know, my permanent leadership team in ways that I maybe never have thought of before. Those are just some examples of what I expect and hope for all of us that we'll see coming out of this. >> Hopefully and I know... Like you said, you've been a consultant for years and years and years, and you guys spend lots of time on airplanes, and hopefully you don't have to spend quite so much time on airplanes because you don't necessarily have to be there all the time. But you talked about an interesting thing and that's talent and opening up the opportunity to get more talent that maybe you wouldn't have ever considered. And along those same lines, right? Is the move in diversity and inclusion. And I just watched a show that you did a few months ago, called the... "A Chance for Change: Accelerating Business Recovery, Through Gender Diversity," on a Facebook interview, very cool panel, really enjoyed it. And I want to follow up on some of those things, 'cause you've made some really simple and poignant points. And one of the things that you said definitively, go back to the wide diverse talent and perspective equals winning in business, period. I love that. You know, we hear this all the time that, you know, not only is it the right thing to do, but it's also good for business. And isn't it nice when those two things can actually line up. And you just talked about, you know, in more of a generic sense, the ability to open up your talent window when there's a worldwide talent shortage, both for geography, but also the work in diversity and inclusion and to continue to hold the momentum that continues to build in this area. I wonder if you could, you know, kind of share your thoughts on that, and your position and what's going on with Deloitte. >> Absolutely. You know, I do think this is one of those key pivotal moments for all of us, and I believe we have, coming out of this an option to really move the needle on our diversity and inclusion, and equality efforts. You know, one example I think about women, women in leadership positions. You know, being in consulting, you know, one of the challenges has always been that we do travel a lot, and it can be difficult to balance all the responsibilities, professional and personally. I think with a move to more flexible work arrangements, less travel, or travel for purpose is what I would highlight for the future. I think it opens the door to many more women being able to have careers in consulting, if that's what they, you know, had desired. I also think it allows them to have... You know, spend their entire careers in consulting and in ways we never saw before. And that means you'll see as significant movement and women in leadership positions. I also think this applies to underrepresented minorities. I hope that from all of this, instead of there may be companies that focus on recruiting from, you know, schools that are local to them or within their surrounding areas. I think this gives us an opportunity to really open that aperture up and look at talent from any school or university, or geography, and being able to get the right skill sets in the door and the right talent. Therefore you can actually see movement and diversity within teams, as well as at the leadership levels for URMs. >> Right. Right. And really managing to the right things too. I think that's the other thing that's coming out of this, and we've had a lot of conversations on work from home or work from anywhere. You guys are a little bit different than the consultant 'cause your team is there, usually local at the client site for some period of time. But for a lot of people, it's the first time they are not sitting across from a desk or, you know, within close proximity. Now you too, in your teams. And so, the shift changes that now you have to judge output, (Jeff chuckles) and not activity. And you would think that that would be a great and easy thing to execute, but we're hearing more and more that it's not necessarily. And you really highlighted, I think, three leadership traits that are always important, but more important now than ever before in that other interview. And I just want to call them out 'cause I thought it was worth calling out. You know, empathy has never been more important. Resilience, and my favorite one you said at the end, calm in the storm. I just wonder again, if you could share, you know, kind of, as you've gone through it, both, you know, as somebody at Deloitte within the greater Deloitte group, but then also in managing your own teams, to maintain that calm in the storm and to maintain, you know, empathetic leadership, because I think you've said it before, right? This is a personal challenge that we're all going through. We all have different things going on at home, whether it's the spouses working, the kids are doing homeschool. People are taking care of older parents, this and that. It's a real personal thing, and so these leadership characteristics, these softer leadership characteristics have never been more important >> That's so true. And, you know, when I think about the empathy part, right now what we're going through is also about how is each of us as leaders also sharing a bit more about how we're experiencing this? I think the sharing of stories is what also helps many on the teams adapt, adjust. The reality is when you're working on camera all day and, you know, in the past, imagine that you maybe were having a tough day or you weren't feeling that great, you weren't on camera all day with every one of your coworkers. You we're actually, you know, sitting in an office, you may have to go to the conference room to do some meetings, but you didn't look... (Kelly hangs) like someone was kind of staring at you all day long. Now, when we're working from home virtually and we're on Zoom or Skype or WebEx, et cetera, all day, it does feel like you're under the lights when you're on camera. And there's a lot of pressure and people are trying to figure out how to manage their own emotions while doing that. And, you know, my message would say as an empathetic leader, it's okay for you to also share when you might be having a tough go that day. Maybe one of your children has been kind of acting out and they didn't really want to do the virtual school. It's okay to share in that because everyone's going through it, and it makes us all more human. >> Right. >> And it makes us all more connected. >> Right. Well, I will share with you a pro tip, we've done a few of these interviews and it is okay to let people turn off the camera. And I think as a manager, I think it's actually an okay thing to say, okay, everyone, let's just turn off our cameras and get a break from that camera that's got that eye on you all the time, because it is just another, you know, kind of a factor that we have to deal with. Well, go ahead. >> And I was going to ask, what do you actually, you know, I don't know what one of your techniques is, but I know mine is some of the meetings, it's actually just go back to traditional telephone calls (Jeff chuckles) and actually even just being on your cell, put on your air, you know, your earbuds, or your headphones and even walk. >> Right. >> So I think the other thing we're all missing is actually that movement, the steps to go to the coffee maker and back, or to lunch and back, we don't have them anymore. So you've got to work extra hard, actually getting those extra steps in calories and just mental breaks at times. >> Yeah, well then there's a whole another tranche on walking during meetings. And I used have a boss that I would only do one-on-ones while we took a walk. He always says, I get in there... 'Cause then there's, you know, you're not necessarily looking at each other. And if there's some sensitive things or tough conversations, sometimes it's easier if you're not just looking across the table at one another with all the silence. So there's a lot to be said for that as well. Well, Kelly, I really enjoyed this conversation and getting to meet you for the first time. It sounds like you're doing a lot of cool and exciting things and, you know, exciting speed and innovation with SAP, that's noble work and I'm sure a lot of people are really happy to have you help them out there. So thank you very much for your time and to have a great AWS re:Invent. >> Thanks, Jeff. It was great to discuss this with you. >> Absolutely. All right. She's Kelly, I'm Jeff. You're watching theCUBE's ongoing coverage of AWS re:Invent 2020. Thanks for watching. We'll see you next time. (upbeat music)

>> From theCUBE Studios in Palo Alto in Boston, bringing you data-driven insights from theCUBE in ETR. This is Breaking Analysis with Dave Vellante. >> Snowflake is not going to grow into its valuation by stealing the croissant from the breakfast table of the on-prem data warehouse vendors. Look, even if snowflake got 100% of the data warehouse business, it wouldn't come close to justifying its market cap. Rather Snowflake has to create an entirely new market based on completely changing the way organizations think about monetizing data. Every organization I talk to says it wants to be, or many say they already are data-driven. why wouldn't you aspire to that goal? There's probably nothing more strategic than leveraging data to power your digital business and creating competitive advantage. But many businesses are failing, or I predict, will fail to create a true data-driven culture because they're relying on a flawed architectural model formed by decades of building centralized data platforms. Welcome everyone to this week's Wikibon Cube Insights powered by ETR. In this Breaking Analysis, I want to share some new thoughts and fresh ETR data on how organizations can transform their businesses through data by reinventing their data architectures. And I want to share our thoughts on why we think Snowflake is currently in a very strong position to lead this effort. Now, on November 17th, theCUBE is hosting the Snowflake Data Cloud Summit. Snowflake's ascendancy and its blockbuster IPO has been widely covered by us and many others. Now, since Snowflake went public, we've been inundated with outreach from investors, customers, and competitors that wanted to either better understand the opportunities or explain why their approach is better or different. And in this segment, ahead of Snowflake's big event, we want to share some of what we learned and how we see it. Now, theCUBE is getting paid to host this event, so I need you to know that, and you draw your own conclusions from my remarks. But neither Snowflake nor any other sponsor of theCUBE or client of SiliconANGLE Media has editorial influence over Breaking Analysis. The opinions here are mine, and I would encourage you to read my ethics statement in this regard. I want to talk about the failed data model. The problem is complex, I'm not debating that. Organizations have to integrate data and platforms with existing operational systems, many of which were developed decades ago. And as a culture and a set of processes that have been built around these systems, and they've been hardened over the years. This chart here tries to depict the progression of the monolithic data source, which, for me, began in the 1980s when Decision Support Systems or DSS promised to solve our data problems. The data warehouse became very popular and data marts sprung up all over the place. This created more proprietary stovepipes with data locked inside. The Enron collapse led to Sarbanes-Oxley. Now, this tightened up reporting. The requirements associated with that, it breathed new life into the data warehouse model. But it remained expensive and cumbersome, I've talked about that a lot, like a snake swallowing a basketball. The 2010s ushered in the big data movement, and Data Lakes emerged. With a dupe, we saw the idea of no schema online, where you put structured and unstructured data into a repository, and figure it all out on the read. What emerged was a fairly complex data pipeline that involved ingesting, cleaning, processing, analyzing, preparing, and ultimately serving data to the lines of business. And this is where we are today with very hyper specialized roles around data engineering, data quality, data science. There's lots of batch of processing going on, and Spark has emerged to improve the complexity associated with MapReduce, and it definitely helped improve the situation. We're also seeing attempts to blend in real time stream processing with the emergence of tools like Kafka and others. But I'll argue that in a strange way, these innovations actually compound the problem. And I want to discuss that because what they do is they heighten the need for more specialization, more fragmentation, and more stovepipes within the data life cycle. Now, in reality, and it pains me to say this, it's the outcome of the big data movement, as we sit here in 2020, that we've created thousands of complicated science projects that have once again failed to live up to the promise of rapid cost-effective time to insights. So, what will the 2020s bring? What's the next silver bullet? You hear terms like the lakehouse, which Databricks is trying to popularize. And I'm going to talk today about data mesh. These are other efforts they look to modernize datalakes and sometimes merge the best of data warehouse and second-generation systems into a new paradigm, that might unify batch and stream frameworks. And this definitely addresses some of the gaps, but in our view, still suffers from some of the underlying problems of previous generation data architectures. In other words, if the next gen data architecture is incremental, centralized, rigid, and primarily focuses on making the technology to get data in and out of the pipeline work, we predict it's going to fail to live up to expectations again. Rather, what we're envisioning is an architecture based on the principles of distributed data, where domain knowledge is the primary target citizen, and data is not seen as a by-product, i.e, the exhaust of an operational system, but rather as a service that can be delivered in multiple forms and use cases across an ecosystem. This is why we often say the data is not the new oil. We don't like that phrase. A specific gallon of oil can either fuel my home or can lubricate my car engine, but it can't do both. Data does not follow the same laws of scarcity like natural resources. Again, what we're envisioning is a rethinking of the data pipeline and the associated cultures to put data needs of the domain owner at the core and provide automated, governed, and secure access to data as a service at scale. Now, how is this different? Let's take a look and unpack the data pipeline today and look deeper into the situation. You all know this picture that I'm showing. There's nothing really new here. The data comes from inside and outside the enterprise. It gets processed, cleanse or augmented so that it can be trusted and made useful. Nobody wants to use data that they can't trust. And then we can add machine intelligence and do more analysis, and finally deliver the data so that domain specific consumers can essentially build data products and services or reports and dashboards or content services, for instance, an insurance policy, a financial product, a loan, that these are packaged and made available for someone to make decisions on or to make a purchase. And all the metadata associated with this data is packaged along with the dataset. Now, we've broken down these steps into atomic components over time so we can optimize on each and make them as efficient as possible. And down below, you have these happy stick figures. Sometimes they're happy. But they're highly specialized individuals and they each do their job and they do it well to make sure that the data gets in, it gets processed and delivered in a timely manner. Now, while these individual pieces seemingly are autonomous and can be optimized and scaled, they're all encompassed within the centralized big data platform. And it's generally accepted that this platform is domain agnostic. Meaning the platform is the data owner, not the domain specific experts. Now there are a number of problems with this model. The first, while it's fine for organizations with smaller number of domains, organizations with a large number of data sources and complex domain structures, they struggle to create a common data parlance, for example, in a data culture. Another problem is that, as the number of data sources grows, organizing and harmonizing them in a centralized platform becomes increasingly difficult, because the context of the domain and the line of business gets lost. Moreover, as ecosystems grow and you add more data, the processes associated with the centralized platform tend to get further genericized. They again lose that domain specific context. Wait (chuckling), there are more problems. Now, while in theory organizations are optimizing on the piece parts of the pipeline, the reality is, as the domain requires a change, for example, a new data source or an ecosystem partnership requires a change in access or processes that can benefit a domain consumer, the reality is the change is subservient to the dependencies and the need to synchronize across these discrete parts of the pipeline or actually, orthogonal to each of those parts. In other words, in actuality, the monolithic data platform itself remains the most granular part of the system. Now, when I complain about this faulty structure, some folks tell me this problem has been solved. That there are services that allow new data sources to really easily be added. A good example of this is Databricks Ingest, which is, it's an auto loader. And what it does is it simplifies the ingestion into the company's Delta Lake offering. And rather than centralizing in a data warehouse, which struggles to efficiently allow things like Machine Learning frameworks to be incorporated, this feature allows you to put all the data into a centralized datalake. More so the argument goes, that the problem that I see with this, is while the approach does definitely minimizes the complexities of adding new data sources, it still relies on this linear end-to-end process that slows down the introduction of data sources from the domain consumer beside of the pipeline. In other words, the domain experts still has to elbow her way into the front of the line or the pipeline, in this case, to get stuff done. And finally, the way we are organizing teams is a point of contention, and I believe is going to continue to cause problems down the road. Specifically, we've again, we've optimized on technology expertise, where for example, data engineers, well, really good at what they do, they're often removed from the operations of the business. Essentially, we created more silos and organized around technical expertise versus domain knowledge. As an example, a data team has to work with data that is delivered with very little domain specificity, and serves a variety of highly specialized consumption use cases. All right. I want to step back for a minute and talk about some of the problems that people bring up with Snowflake and then I'll relate it back to the basic premise here. As I said earlier, we've been hammered by dozens and dozens of data points, opinions, criticisms of Snowflake. And I'll share a few here. But I'll post a deeper technical analysis from a software engineer that I found to be fairly balanced. There's five Snowflake criticisms that I'll highlight. And there are many more, but here are some that I want to call out. Price transparency. I've had more than a few customers telling me they chose an alternative database because of the unpredictable nature of Snowflake's pricing model. Snowflake, as you probably know, prices based on consumption, just like AWS and other cloud providers. So just like AWS, for example, the bill at the end of the month is sometimes unpredictable. Is this a problem? Yes. But like AWS, I would say, "Kill me with that problem." Look, if users are creating value by using Snowflake, then that's good for the business. But clearly this is a sore point for some users, especially for procurement and finance, which don't like unpredictability. And Snowflake needs to do a better job communicating and managing this issue with tooling that can predict and help better manage costs. Next, workload manage or lack thereof. Look, if you want to isolate higher performance workloads with Snowflake, you just spin up a separate virtual warehouse. It's kind of a brute force approach. It works generally, but it will add expense. I'm kind of reminded of Pure Storage and its approach to storage management. The engineers at Pure, they always design for simplicity, and this is the approach that Snowflake is taking. Usually, Pure and Snowflake, as I have discussed in a moment, is Pure's ascendancy was really based largely on stealing share from Legacy EMC systems. Snowflake, in my view, has a much, much larger incremental market opportunity. Next is caching architecture. You hear this a lot. At the end of the day, Snowflake is based on a caching architecture. And a caching architecture has to be working for some time to optimize performance. Caches work well when the size of the working set is small. Caches generally don't work well when the working set is very, very large. In general, transactional databases have pretty small datasets. And in general, analytics datasets are potentially much larger. Is it Snowflake in the analytics business? Yes. But the good thing that Snowflake has done is they've enabled data sharing, and it's caching architecture serves its customers well because it allows domain experts, you're going to hear this a lot from me today, to isolate and analyze problems or go after opportunities based on tactical needs. That said, very big queries across whole datasets or badly written queries that scan the entire database are not the sweet spot for Snowflake. Another good example would be if you're doing a large audit and you need to analyze a huge, huge dataset. Snowflake's probably not the best solution. Complex joins, you hear this a lot. The working set of complex joins, by definition, are larger. So, see my previous explanation. Read only. Snowflake is pretty much optimized for read only data. Maybe stateless data is a better way of thinking about this. Heavily right intensive workloads are not the wheelhouse of Snowflake. So where this is maybe an issue is real-time decision-making and AI influencing. A number of times, Snowflake, I've talked about this, they might be able to develop products or acquire technology to address this opportunity. Now, I want to explain. These issues would be problematic if Snowflake were just a data warehouse vendor. If that were the case, this company, in my opinion, would hit a wall just like the NPP vendors that proceeded them by building a better mouse trap for certain use cases hit a wall. Rather, my promise in this episode is that the future of data architectures will be really to move away from large centralized warehouses or datalake models to a highly distributed data sharing system that puts power in the hands of domain experts at the line of business. Snowflake is less computationally efficient and less optimized for classic data warehouse work. But it's designed to serve the domain user much more effectively in our view. We believe that Snowflake is optimizing for business effectiveness, essentially. And as I said before, the company can probably do a better job at keeping passionate end users from breaking the bank. But as long as these end users are making money for their companies, I don't think this is going to be a problem. Let's look at the attributes of what we're proposing around this new architecture. We believe we'll see the emergence of a total flip of the centralized and monolithic big data systems that we've known for decades. In this architecture, data is owned by domain-specific business leaders, not technologists. Today, it's not much different in most organizations than it was 20 years ago. If I want to create something of value that requires data, I need to cajole, beg or bribe the technology and the data team to accommodate. The data consumers are subservient to the data pipeline. Whereas in the future, we see the pipeline as a second class citizen, with a domain expert is elevated. In other words, getting the technology and the components of the pipeline to be more efficient is not the key outcome. Rather, the time it takes to envision, create, and monetize a data service is the primary measure. The data teams are cross-functional and live inside the domain versus today's structure where the data team is largely disconnected from the domain consumer. Data in this model, as I said, is not the exhaust coming out of an operational system or an external source that is treated as generic and stuffed into a big data platform. Rather, it's a key ingredient of a service that is domain-driven and monetizable. And the target system is not a warehouse or a lake. It's a collection of connected domain-specific datasets that live in a global mesh. What is a distributed global data mesh? A data mesh is a decentralized architecture that is domain aware. The datasets in the system are purposely designed to support a data service or data product, if you prefer. The ownership of the data resides with the domain experts because they have the most detailed knowledge of the data requirement and its end use. Data in this global mesh is governed and secured, and every user in the mesh can have access to any dataset as long as it's governed according to the edicts of the organization. Now, in this model, the domain expert has access to a self-service and obstructed infrastructure layer that is supported by a cross-functional technology team. Again, the primary measure of success is the time it takes to conceive and deliver a data service that could be monetized. Now, by monetize, we mean a data product or data service that it either cuts cost, it drives revenue, it saves lives, whatever the mission is of the organization. The power of this model is it accelerates the creation of value by putting authority in the hands of those individuals who are closest to the customer and have the most intimate knowledge of how to monetize data. It reduces the diseconomies at scale of having a centralized or a monolithic data architecture. And it scales much better than legacy approaches because the atomic unit is a data domain, not a monolithic warehouse or a lake. Zhamak Dehghani is a software engineer who is attempting to popularize the concept of a global mesh. Her work is outstanding, and it's strengthened our belief that practitioners see this the same way that we do. And to paraphrase her view, "A domain centric system must be secure and governed with standard policies across domains." It has to be trusted. As I said, nobody's going to use data they don't trust. It's got to be discoverable via a data catalog with rich metadata. The data sets have to be self-describing and designed for self-service. Accessibility for all users is crucial as is interoperability, without which distributed systems, as we know, fail. So what does this all have to do with Snowflake? As I said, Snowflake is not just a data warehouse. In our view, it's always had the potential to be more. Our assessment is that attacking the data warehouse use cases, it gave Snowflake a straightforward easy-to-understand narrative that allowed it to get a foothold in the market. Data warehouses are notoriously expensive, cumbersome, and resource intensive, but they're a critical aspect to reporting and analytics. So it was logical for Snowflake to target on-premise legacy data warehouses and their smaller cousins, the datalakes, as early use cases. By putting forth and demonstrating a simple data warehouse alternative that can be spun up quickly, Snowflake was able to gain traction, demonstrate repeatability, and attract the capital necessary to scale to its vision. This chart shows the three layers of Snowflake's architecture that have been well-documented. The separation of compute and storage, and the outer layer of cloud services. But I want to call your attention to the bottom part of the chart, the so-called Cloud Agnostic Layer that Snowflake introduced in 2018. This layer is somewhat misunderstood. Not only did Snowflake make its Cloud-native database compatible to run on AWS than Azure in the 2020 GCP, what Snowflake has done is to obstruct cloud infrastructure complexity and create what it calls the data cloud. What's the data cloud? We don't believe the data cloud is just a marketing term that doesn't have any substance. Just as SAS is Simplified Application Software and iOS made it possible to eliminate the value drain associated with provisioning infrastructure, a data cloud, in concept, can simplify data access, and break down fragmentation and enable shared data across the globe. Snowflake, they have a first mover advantage in this space, and we see a number of fundamental aspects that comprise a data cloud. First, massive scale with virtually unlimited compute and storage resource that are enabled by the public cloud. We talk about this a lot. Second is a data or database architecture that's built to take advantage of native public cloud services. This is why Frank Slootman says, "We've burned the boats. We're not ever doing on-prem. We're all in on cloud and cloud native." Third is an obstruction layer that hides the complexity of infrastructure. and fourth is a governed and secured shared access system where any user in the system, if allowed, can get access to any data in the cloud. So a key enabler of the data cloud is this thing called the global data mesh. Now, earlier this year, Snowflake introduced its global data mesh. Over the course of its recent history, Snowflake has been building out its data cloud by creating data regions, strategically tapping key locations of AWS regions and then adding Azure and GCP. The complexity of the underlying cloud infrastructure has been stripped away to enable self-service, and any Snowflake user becomes part of this global mesh, independent of the cloud that they're on. Okay. So now, let's go back to what we were talking about earlier. Users in this mesh will be our domain owners. They're building monetizable services and products around data. They're most likely dealing with relatively small read only datasets. They can adjust data from any source very easily and quickly set up security and governance to enable data sharing across different parts of an organization, or, very importantly, an ecosystem. Access control and governance is automated. The data sets are addressable. The data owners have clearly defined missions and they own the data through the life cycle. Data that is specific and purposely shaped for their missions. Now, you're probably asking, "What happens to the technical team and the underlying infrastructure and the cluster it's in? How do I get the compute close to the data? And what about data sovereignty and the physical storage later, and the costs?" All these are good questions, and I'm not saying these are trivial. But the answer is these are implementation details that are pushed to a self-service layer managed by a group of engineers that serves the data owners. And as long as the domain expert/data owner is driving monetization, this piece of the puzzle becomes self-funding. As I said before, Snowflake has to help these users to optimize their spend with predictive tooling that aligns spend with value and shows ROI. While there may not be a strong motivation for Snowflake to do this, my belief is that they'd better get good at it or someone else will do it for them and steal their ideas. All right. Let me end with some ETR data to show you just how Snowflake is getting a foothold on the market. Followers of this program know that ETR uses a consistent methodology to go to its practitioner base, its buyer base each quarter and ask them a series of questions. They focus on the areas that the technology buyer is most familiar with, and they ask a series of questions to determine the spending momentum around a company within a specific domain. This chart shows one of my favorite examples. It shows data from the October ETR survey of 1,438 respondents. And it isolates on the data warehouse and database sector. I know I just got through telling you that the world is going to change and Snowflake's not a data warehouse vendor, but there's no construct today in the ETR dataset to cut a data cloud or globally distributed data mesh. So you're going to have to deal with this. What this chart shows is net score in the y-axis. That's a measure of spending velocity, and it's calculated by asking customers, "Are you spending more or less on a particular platform?" And then subtracting the lesses from the mores. It's more granular than that, but that's the basic concept. Now, on the x-axis is market share, which is ETR's measure of pervasiveness in the survey. You can see superimposed in the upper right-hand corner, a table that shows the net score and the shared N for each company. Now, shared N is the number of mentions in the dataset within, in this case, the data warehousing sector. Snowflake, once again, leads all players with a 75% net score. This is a very elevated number and is higher than that of all other players, including the big cloud companies. Now, we've been tracking this for a while, and Snowflake is holding firm on both dimensions. When Snowflake first hit the dataset, it was in the single digits along the horizontal axis and continues to creep to the right as it adds more customers. Now, here's another chart. I call it the wheel chart that breaks down the components of Snowflake's net score or spending momentum. The lime green is new adoption, the forest green is customers spending more than 5%, the gray is flat spend, the pink is declining by more than 5%, and the bright red is retiring the platform. So you can see the trend. It's all momentum for this company. Now, what Snowflake has done is they grabbed a hold of the market by simplifying data warehouse. But the strategic aspect of that is that it enables the data cloud leveraging the global mesh concept. And the company has introduced a data marketplace to facilitate data sharing across ecosystems. This is all about network effects. In the mid to late 1990s, as the internet was being built out, I worked at IDG with Bob Metcalfe, who was the publisher of InfoWorld. During that time, we'd go on speaking tours all over the world, and I would listen very carefully as he applied Metcalfe's law to the internet. Metcalfe's law states that the value of the network is proportional to the square of the number of connected nodes or users on that system. Said another way, while the cost of adding new nodes to a network scales linearly, the consequent value scores scales exponentially. Now, apply that to the data cloud. The marginal cost of adding a user is negligible, practically zero, but the value of being able to access any dataset in the cloud... Well, let me just say this. There's no limitation to the magnitude of the market. My prediction is that this idea of a global mesh will completely change the way leading companies structure their businesses and, particularly, their data architectures. It will be the technologists that serve domain specialists as it should be. Okay. Well, what do you think? DM me @dvellante or email me at david.vellante@siliconangle.com or comment on my LinkedIn? Remember, these episodes are all available as podcasts, so please subscribe wherever you listen. I publish weekly on wikibon.com and siliconangle.com, and don't forget to check out etr.plus for all the survey analysis. This is Dave Vellante for theCUBE Insights powered by ETR. Thanks for watching. Be well, and we'll see you next time. (upbeat music)