(upbeat music)
>> Welcome back to Boston,
everybody watching theCUBE's coverage of AWS re:Inforce 22
from Boston, Atlanta.
Chowder, lobster, the Sox are ruining my summer.
Andy Smith is here as the CMO of Laminar.
Andy, good to see you.
>> Good to see you. Great to be here.
>> So Laminar came out of stealth last year, 2021,
sort of as we were exiting
the isolation economy. >> Yeah.
>> Why was Laminar started?
>> Really about...
There's two mega trends in the industry
that created a problem that wasn't being addressed, right?
So, the two mega trends was cloud transformation. Obviously.
That's been going on for a while,
but what most people don't realize
is it really accelerated with COVID, right?
Everybody having to be remote, et cetera.
Various stats I've read like, increased five times, right?
So, cloud transformation, a now problem, right?
That's going on.
And then, the other next big mega trend
is data democratization.
So, more data in the cloud than ever before.
And this is just going and going and going.
And the result of those two things, more data in the cloud,
how am I securing that data?
The breach culture we're in,
like every day a new data breach coming up, et cetera.
Just one Twitter one yesterday, et cetera.
Those two things have caused a gap with data security teams
and that's what we're here to address.
>> Yeah so, to your point,
and we track this stuff pretty carefully quarterly,
and you saw, it was a really interesting trend,
you actually saw AWS's growth rate accelerate
during the pandemic. >> Absolutely.
>> So you're talking about a couple a $100 billion
for the big four clouds, if you include Alibaba.
And it's still growing at 35, 40% a year,
which is astounding.
So, okay. So more cloud, more data.
Explain why that's a problem for practitioners.
>> Yeah, exactly.
The reality is in the security, what are we doing?
All the security, it's about protecting your data
in the end, right?
Like we're here at re:Inforce.
All these security vendors here.
Really it's about protecting your data, your sensitive data.
But what had been happening is all the focus was
on the infrastructure, the network, et cetera, et cetera.
And not as much focus, particularly, on the data,
and the move to the cloud gave the developers
and the data scientists way more power.
They don't longer have to ask for permission.
And so, they can just do what they want.
And it's actually wonderful for the business.
The business is moving faster,
you spin up applications sooner, you get new insights.
So, all those things are really great,
but because the developer has so much power,
they can just copy data over here,
make a backup over here, et cetera.
And security has no idea about all these copies
of the data that are out there.
And they're typically not as well protected
as that main production source.
And that's the gap that exists.
>> Okay, so there was this shift
from, sort of, the perimeter hardening the infrastructure
and now your premise is it's moving to the data.
We saw when there was, during the pandemic,
there was definitely a shift to end point security.
There was a shift to cloud security,
rethinking the network,
but it was still a lot of, kind of,
chasing the whack-a-mole.
And people have talked about this is a data problem
for years. >> Yeah.
>> But it's taken a while for companies,
for the technology industry to come at it.
You guys are one of the first,
if not the first. >> Yeah.
>> Why do you think it took so long?
Is this 'cause it's really hard? (chuckles)
>> Yeah. I mean, it's hard.
You need to focus on it.
The traditional security has been around the network
and the box, right.
And those are still necessary.
It's important to use identity to cover the edge
to make sure people can't get into the box,
but you also have to have data.
So, what happens is there's really good solutions
for enterprise data security.
Looking at database technology, et cetera.
There are good solutions for cloud infrastructure security.
So the CSPMs of the world,
and the CWPPs aren't protecting containers, you know?
Protecting the infrastructure.
But there really wasn't much for cloud...
Everything you build and run in the cloud.
So basically, your custom applications
in the IaaS and PaaS environments.
There really wasn't anything solving that.
And that's really where Laminar's focused.
>> Okay. So, you guys use this term shadow...
We're talking about Shadow IT.
What's Shadow Data?
>> Yeah, so what we're finding at 100%
of our customer environments and our POVs
and talking to CISOs out there,
is that they have these Shadow Data assets
and Shadow Data elements
that they had no clue that existed.
So, here's the example.
Everybody knows the main RDS database that is in production.
And this is where our data is taken from.
But what people don't realize is there's a copy of that.
In a Dev environment, somebody went to run a test
and they were supposed to be there for two weeks
but then that developer left, forgot, left it there.
They left the company.
Oh, now it's been there for two years.
There was an original SQL database left over
from a lift and shift project that got moved to RDS,
but nobody deleted that thing.
It's a database connected to an application.
The application left,
but that abandoned database is still sitting.
These are all real life customer examples
of Shadow Data that we've run into.
And what the problem is,
that main production data store is secured pretty well.
It's following all your policies, et cetera.
But, all these Shadow Data resources
are typically less well protected, unmonitored,
and that is what the attackers are after.
>> So you're, you know, the old,
the Watergate follow the money, you're following the data.
>> Following the data. >> How do you follow
that data if there's so much of it,
it's sometimes not really well understood where it is.
How do you know where it is?
>> Yeah, it's the beauty of partnering
with somebody like AWS, right?
So, with each of the cloud providers,
we actually take a role in your cloud account
and use the APIs, from the cloud provider,
to see all the changes in all the instances are going on.
Like, the problem is way more complicated in the cloud
because, I mean, AWS has over 200 services,
dozens of ways to store data, right?
It's wonderful for the developer,
but it's very hard for the security practitioner.
And so, because we have that visibility
through the cloud provider's APIs,
we can see all those changes that are happening.
We can then say, "Ah, that's a data store."
"Let me go analyze, make a copy, have a snapshot of that
and do the analyzing of that data."
Right inside our customer's account
without pulling the data out.
And we have complete visibility to everything.
And then, we can give that data catalog over
to the customer.
>> All right. I got to ask you a couple Columbo questions.
So if, you talk about encryption,
everything's...
Encrypt everything.
If the data is encrypted, why then would I need Laminar?
>> Because, I mean,
we'll make sure that the data's encrypted.
>> Okay. >> Right?
Often, it's supposed to be and not, right?
Two is, we're going to tell you what type
of data is inside there.
"Oh, is this health information?"
"Is it personal identify information?"
"Is it credit cards?"
You know, et cetera, cetera.
So, we'll classify the data for you.
We will also then...
There's things like retention period.
How long should we hold onto that data?
All the things about who has access?
What's the exposure level for that data?
And so, when you think about data security posture,
what's the posture of that data?
You're looking at those data policies.
It's something that has been very well defined
and written down.
But in the past, there was just no way to go verify
that, that policy is actually being followed.
And so, we're doing that verification automatically.
>> So, without the context you can't answer
those other questions.
So, you make sure it's encrypted.
If it's not, or you can at least notify me that it's not.
You don't do the encryption. >> Right.
>> Or do you?
>> We don't do it ourselves,
but we can give you, "Here's the command
and the Amazon to go encrypt it." Right?
>> Then I can automate that.
And then the classification is key
because now you're telling me the context.
So I can say, "okay, apply this policy to that data,
retain it for this long, get rid of it
after X number of years."
Or if it's work in process,
"Get rid of it now." >> Yeah.
>> And then, who should have access to that data?
And so you can help at least inform
how to enforce those policies.
>> Exactly.
And so, we call it guided remediation
because what we're...
You know, talking to a CISO,
they're like, "I need 400 more alerts."
Like a hole in the head.
Like, that doesn't do me any good.
If you can't tell me how to resolve
this security gap that I have
then it doesn't do me any good.
And, first it starts with who do I need to go talk to?
Right? So they have hundreds,
if not thousands of developers.
"Oh, great. You found this issue."
I don't know who to go..
Like, I can't just delete it myself,
but I need to go talk to somebody.
"Really, should this be deleted?"
"Do we really need to hold onto this?"
So, we help guide who the data owner is.
So, we give you who to talk to.
We give you all the context.
Here's the data, here's the data asset that it's in.
Here's our suggestion. Here's the problem.
Here's our suggestion for solution.
>> And you started the company on AWS?
>> Started on AWS. Absolutely.
>> Of course. It's the best cloud and why not start there?
So, what's the relationship like?
I mean, how'd you get started?
You said, "Okay, hey, we're we got an idea for a company."
"We're going to build it on AWS."
"We're going to become a customer."
"We're going to..."
>> We actually...
So, Insight Partners is our main investor.
And, they were very helpful in giving us access
to literally hundreds of CISOs,
who we had conversations with
before we actually launched the company.
And so, we did some shifting
to figure out our exact use case.
But by the time we came to market,
it was in February this year,
we actually GA'd the product.
We're like, "Product market fit nailed."
Because we'd had so many conversations
that we knew the problem in the market
that we needed to solve.
And we knew where we needed to solve it first.
And the relationship with AWS is great.
We just got on the marketplace.
Just became a partner. So, really good start.
>> So I got to ask you, so I always ask this question.
So, how do you actually know
when you have product market fit?
>> It's about those conversations, right?
So like, I've been in lots of startups.
And sometimes you each have a conversation
and then they're saying, "Oh, we kind of want this."
And, "We kind of want that."
And so, the more conversations you have,
the more you know you're solving a real problem, right?
And you react to what that prospect is telling you back.
Or that advisor or that whoever we're talking to.
And, every single one of the CISO conversations we had
was, "I don't have a good inventory
of my data in the cloud."
>> The reason I asked that,
'cause I always ask to startups,
like, when do you scale?
'Cause I think startups sometimes scale too fast.
Or they try to scale too fast.
They'll hire 50 sales people.
And then they churn >> Yeah.
>> You know, they got a 50% churn,
but they're trying to optimize their go to market
when they got...
50% of their customers are going to leave.
So it's got to be this sequential thing.
So, you got product market fit.
So, are you in the scaling phase now?
>> We are. Yeah, yeah, yeah.
So now, it's about how quickly do we deliver?
We're ramping customer base significantly.
And, we've got a whole go to market team
in sales and marketing in the US,
and off to the races.
>> And you just run on AWS or you run another clouds?
>> It's multi-cloud. So AWS, Azure, GCP, et cetera.
>> Okay, so then my next question.
Is it, sort of, you can do this within each
of the individual clouds, today?
Do you see a day, and maybe it's here today,
where you can create a single experience
across those clouds?
>> Today it's a single experience across clouds.
So our SaaS portion runs in AWS.
But, the actual data analysis runs in each cloud provider.
So AWS, Azure, GCP and Snowflake too, actually.
>> Ah, okay. So I come through your whatever portal,
like if I can use that term. >> Yep.
>> And that's running on AWS. >> Yes.
>> You're SaaS, as you say. >> Yeah.
>> And then, you go out to these other environments,
GCP, Azure, AWS itself
and Snowflake. >> Yep.
>> And I see Laminar, is that right, or-
>> There's a piece running inside our customer's environment.
>> Okay. >> So, we have a customer,
we get a role inside of their cloud account.
A read only role inside of their cloud account.
And we spin up serverless functions in that cloud account.
That's where all the analysis happens.
And that's why we don't take any data
out of the environment.
So it all stays there.
And therefore, we don't actually see the data
outside of the environment.
I can tell you there's a...
Metadata comes out.
I can tell you there are credit cards
inside that data store,
but I can't tell you exactly which credit card it is
'cause I don't know.
So, all the important actions happens are there
and just the metadata comes out,
so we can give you a cross cloud dashboard
of all your sensitive data.
>> And, of course.
So, take the example of Snowflake.
They're going across clouds. >> Yes.
>> They're building what we call a super cloud,
sort of a layer that floats on top.
You're just sort of going wherever that data goes.
>> Yeah, exactly.
So, there's a component that lives
in the customer's environment
in those multi-cloud environments
and then a single view of the world dashboard
that is our SaaS component that runs on AWS.
>> So, you guys are...
Am I correct? You're series A funded?
>> Series A funded. Yeah, exactly.
>> And already scaling >> Yeah.
>> to go to market. >> Yeah.
>> Which is early to scale, right?
I mean you've got startup experience, right?
>> Absolutely.
>> How does it compare?
>> Well, what was amazing here was access...
I mean, really it was through the relationship with Insight.
It was access to the CISOs that I had never had
at any of the other startups I was with.
You're trying to get meetings,
you're meeting with a lot of practitioners,
you know, et cetera.
But, getting all those conversations with buyers
was super valuable for us
to say, "Ah, I know I'm solving a real problem
that has value that they will pay for." Right?
And so that was a year and a half, probably,
still of all that work going on.
We just waited to GA
until we understood
the market better. >> Yeah. Insight.
They're amazing. The way you talk about scaling.
I mean, they've just...
The last 10 years that PE firm has just gone wild
in terms of, just, their philosophy,
their approach, their cadence, their consistency.
And now, of course, their portfolio.
>> Yeah, and they started doing
a little bit earlier and earlier stage.
I mean, I always think of them as PE too,
but they did our seed round, right?
They did our A round,
and they're doing earlier stages.
But, particularly, what they saw in Laminar
was exactly what we started this conversation with.
They saw cloud transformation speeding up.
They saw data democratization happening.
They're like, "We need to invest in this now
because this is a now a problem to solve."
>> Yeah, it's interesting 'cause when you go back,
even pre 2010, you look at Insight, they would wait.
They wouldn't invest in companies unless there was,
you know, on the way to five plus million dollar ARR.
They weren't doing seed deals. >> Totally.
>> Like, they saw, "Wow, these actually can be
pretty lucrative and we can play
and we have a point of view."
And, yeah. So, cool.
Well Andy, congratulations.
I'll give you the final word.
What should we be watching for from Laminar,
as sort of, you know,
milestones that you guys want to hit
and indicators of success.
>> Yeah, it's all about growth, partnerships,
integrations with other of the players out here, right?
And so, you know, like scaling our AWS partnership
is one of the key aspects for us.
And so, just look for the name out there,
and you'll start to see it a lot more.
And if you have the need,
come look us up, laminarsecurity.com.
>> Awesome, well thanks very much for coming to theCUBE
and good luck, we appreciate it.
>> All right. Wonderful, thanks.
>> You're welcome. All right, Keep it right there, everybody.
This is Dave Vellante,
we'll be back right after this short break
from AWS re:Invent 2022 in Boston.
You're watching theCUBE.
(upbeat music)