(gentle music)
>> Hi, everybody. Welcome back to the Moscone Center.
We're in Moscone West.
theCUBE's continuous coverage of RSA 2023,
this is day three, Wednesday.
John Furrier here with me,
Dave Vellante.
Zeus Kerravala is here.
He's the man behind ZK Research,
friend of theCUBE.
Great to see you again.
>> Ah, it's always great to be on theCUBE.
>> You're like a cube analyst now.
>> Yeah, I am. Yeah.
>> Coming in between your meetings.
Thanks for coming on.
>> So, you know Palo Alto really well.
We were at Ignite in December. >> Yeah.
>> And you just heard Lee Klarich
coming on talking about best-of-breed,
they built both best-of-breed int platform,
integrated platform.
And I was kind of skeptical.
I'm like, "Wow, that's never happened before
in the industry."
Is it actually happening now?
>> Well, I think they're best-of-breed
next-gen firewall.
I wouldn't say they're best-of-breed
everywhere though.
But I think the point is,
if you build out a platform,
you don't need to be best-of-breed.
In fact, everywhere.
I had a conversation with the CISO a couple weeks ago.
He said to me he finally understands now
that with the right platform strategy,
if you're trying to best-of-breed everywhere,
you actually get less than effective
threat protection, right?
So the platform strategy actually gives you
best-in-class threat protection
without being best-of-breed everywhere.
And that should be Palo Alto's goal.
It's to be able to find those threats
and remediate against them before anybody else
because of the platform,
but not thinking about things
that are product-by-product basis.
'Cause if you do that,
then you get a knife fight
of my product versus this product,
and that defeats the whole point
of the platform. >> John: Yeah.
>> Because, what are you saying?
Because best-of-breed,
like a caravan has to slow down
so everybody can stay together and be coherent.
But you're saying a best-of-breed
might create some discontinuity
between the rest of the platform.
Is that what you said?
Is that right? >> Well, especially in security
'cause you got to keep policies up to date,
you know, some systems,
you know pull,
some use telemetry.
And so you wind up with this inconsistent data, right?
Like...
So we talked about this at Palo Alto's event.
Security today is an analytics game, right?
Can you analyze the data that you have
to be able to find those needles
in the stack of needles, right?
And if you're working off your own dataset
and everything's consistent,
you can do that better
than if you're trying to cobble together datasets
and normalize some things
from multiple vendors.
>> So, this is exactly what we talked about.
Amazon, for example.
They have such an observational space,
the way they have all that data.
You know, "Are we anonymized?"
Okay, whatever.
That's the challenge.
And I think that's the opportunity for the platform.
And, you know,
I love the platform conversation at these events
because I think it's relevant.
But to your point,
platform for platform's sake
is not the answer. >> Yeah.
>> Platform for objective's sake
is why you have a platform. >> Zeus: Yeah, outcomes.
>> Why do you have a platform?
So if they can create more observational space,
like for example, I asked them
about cloud native networking,
I didn't really get an answer.
Maybe they don't have anything on that.
Or maybe they do.
They said, "No, we're building network security in AWS.
So we'll check on that."
So there's a lot going on
in this cloud native networking
'cause network security is an old school.
Here's my NPLS.
Here's my routes on Amazon.
>> Well, and so,
let's call it what it is. >> John: Unpack that.
>> So cloud native security
can be everything from providing firewalls
in AWS, Azure, GCP, right?
And Palo can do that better than anybody.
But you can also,
you then have to think of container security,
which they're new to.
Also API level security, which is something like,
you know, Volterra which F5 bought, right?
'Cause cloud- >> Dave: Yeah, how can I
just bought Neosec-
>> Yeah, and so cloud native security
is unpacking that itself.
>> Yes. >> It's a pretty big category.
I think within the confines of network security,
Palo Alto does a great job
of cloud native security.
But there's a whole other-
>> John: Of that like cloud native networking?
>> Cloud, yes.
>> But that should be the same policies
as network security. >> Dave: Right.
>> But it just doesn't seem that most companies
that we talk to on theCUBE, they're like,
"Well we have a completely different network security team
than the ones on Amazon."
>> Zeus: Yeah, so that's an interesting trend, right?
I was at Fortinet's event.
They talked about the converge
in network and security.
Scott Harrell, you know, who came from Cisco
and came from Infoblox,
he was talking about that as well.
But when I talked to large enterprises,
they're not really integrating networking and security.
I do see that in the mid-market.
And I just think a lot of the,
you know, a big part of G2 and, you know-
>> John: Yeah.
>> Tom's keynote from Cisco
was about bringing together network and security.
And when you get into those large enterprises
that have all these processors
built around these sims and,
you know, these security tools,
they haven't integrated
the two together. >> Yeah.
>> And I think they're susceptible to breaches.
I do think it's something
they need to do. >> John: Well-
>> But I just think we're a long-
>> John: Well, I want to get your thoughts on...
>> Yeah. >> Dave always says this
on every show we go on security,
'cause it's a great observation.
Not any one company
has the large market share. >> Dave: Yeah.
>> Chambers even said, commented here earlier like,
"Yeah, then someone's got to come above 20%."
And you know, he had 60%.
But who's going to break out in your mind?
Who are the dark horses?
Who's the favorite horses
that's going to emerge
to be more the dominant platform company?
Is it CrowdStrike?
Is it Zscaler?
Is it PAN, Palo Alto Networks?
Who merges in your mind?
>> Dave: Microsoft's the biggest,
right? >> Yes.
>> I mean, just because they're Microsoft-
>> Microsoft is the biggest
but they're a bit of a walled garden.
>> Dave: Right. >> Right, and so-
>> Dave: So of the independents,
so let's part Microsoft for a second,
'cause they maybe do have double digit market.
It's hard to tell.
But, anyway- >> Yeah.
>> Of the independents, who do you-
>> Yeah, so I like Palo a lot.
And I think their platform strategy is outstanding.
I think the way they can build products, byproducts,
integrate them in quickly,
I think makes a lot of sense.
I think the stuff Cisco's been talking about,
when I talk to Cisco...
So Cisco's an interesting security company
'cause it's a...
That expression of, "Fool me once, shame on you.
Fool me twice, shame on me."
I'm at like, fool me seven times now.
(John & David laugh) >> Right, like,
'cause I've been expecting them to do something.
But, if network telemetry
is a big part of security threat identification,
who has more network telemetry
than them? >> John: Yeah.
>> And I think the new leadership at Cisco,
with Tom and G2- >> John: AWS is getting it.
>> Actually understand that, right?
And so they're not trying to...
You know, and they understand that their portfolio,
which is Kenna and Tallos, and Duo and Umbrella,
they need to bring those things together.
But I think they...
From my conversation with the leadership,
I think they finally have it right.
>> Dave: Well Gillis is a great
pickup for Cisco. >> Yes. Yeah.
>> You know, and I think...
Actually, I think VMware has an okay story in security.
They just,
they didn't tell it at the last VMware.
And I think G2 probably said,
"Hey, come." >> John: G2's got a-
>> Why don't you come on over to Cisco
'cause we're really serious about security.
>> Well, G2 wants to talk,
so we'll follow up with 'em.
I got to ask about the private companies though.
What non-public companies
do you see out there
rising up in security and/or network security,
or just say cloud security on-prem, edge?
>> Zeus: Yeah. >> Who's rising?
>> I think Netskope actually, yeah.
>> Dave: Yeah, Netskope got some momentum.
>> Yeah, they've got a lot of momentum.
And I think they...
You know, most people thought of them as a CASB vendor
and thought of Zscaler as a SWG.
And both those companies
are leaders in the Gartner MQ.
I wrote a whole piece on that
in SiliconANGLE by the way. >> John: Yeah, I saw that.
>> And, but I do think those two companies
have broken away from the SSE pack,
and I think they both have the opportunity
to try and create a platform strategy around them.
You know, they're a proxy.
They do a lot of...
There's a lot of stuff they don't do.
But for what they do,
if you believe more and more workloads
are moving to the cloud,
more workers are moving to home,
those two companies actually have a lot of upside.
>> Dave: Well, it's interesting.
We had Jay Chaudhry on,
and you know, he didn't mention Palo Alto,
but he was just throwing firewalls under the bus
any chance that he got.
>> Zeus: Yeah. (John and Zeus laugh)
>> But it's interesting- >> John: But we still need
firewalls though.
>> Let's be real, you still need firewalls.
>> John: You need firewalls, yeah.
>> Well, no, you've made this point a number of times.
But you know, they don't sell firewalls.
>> Zeus: Yeah. >> So, yes.
(all laughing)
>> This is the game they play.
But so, it's been interesting
to watch the security market
'cause I think there was,
a lot of investors said,
"Hey, this market's insulated."
And then last summer, we saw,
you know, security sort of reverted to the mean.
And then you've seen Palo Alto
and Fortinet in particular.
>> Zeus: Yes. >> More recently, CrowdStrike,
you know, sort of do really well.
You see Zscaler sort of not doing as good as,
say even the NASDAQ, or even the BUG ETF.
They're not really doing as well.
So it's really mixed right now.
Why do you think that is?
And do you think that these companies
are going to come roaring back?
I mean, what's your outlook?
>> Well, a lot of Fortinet's growth
has been based on their SD-WAN.
So this convergence of network and security
has actually benefited them more than anybody, right?
'Cause with them, you just flick on the network
and then they're FortiGate. >> Dave: Yeah.
>> But I think, you know, security is always...
I do think a lot of what drove
Zscaler and Netskope that type of growth
was people working from home, right?
And now that we're,
companies are starting to bring people
back to the office,
they need to rethink,
"What exactly are we doing?
We brought in a lot of technology.
How do we integrate it together?"
And I think that's causing
a bit of a pause in buying,
which is why you saw
some of the security vendors
hiccup a little bit.
>> You mean the transition back to hybrid work?
>> Yeah, 'cause this is- >> People are trying
to figure that out.
>> Yeah, yeah. Like who am I going to have in the office?
But I can't really figure out what to secure
or even how to enable them to work
if I don't know what that work style is.
And one of the predictions I made
at the beginning of the year
from a UC perspective
and it holds through security
is that hybrid work this year will be a disaster,
because companies don't know how to implement it.
(John laughs) >> Dave: Right, you're right.
>> I think you're right on that one.
>> It's sort of landing on,
"Okay, Monday, Friday, you work from home.
Tuesday, Wednesday, Thursday, you come in."
>> It's very easy.
But it's so easy that it's foul.
It's end-to-end security.
>> Yeah, I- >> It's end to end security.
So if the policies are going to move from the network
to the edge to the handheld
to the virtual desktop
so that I'm a user,
they got to know when I'm in the office.
It should have...
Independent of the infrastructure.
>> Dave: But a lot of office-
>> Infrastructure should be smart enough to know that,
"Hey, John's in the office. >> Dave: Yeah, but it's not.
Right? >> Well, that's my point.
>> That's my point. >> Dave: A lot of office
infrastructure was-
>> Hold on, I just said it's a simple problem to solve.
>> Dave: Yeah, yeah. But a lot of office infrastructure
wasn't invested in for two years.
>> Yeah. >> Right? During the pandemic.
And now they had to catch up.
>> Well, that's why I was asking-
>> And they probably thought about security.
>> Well, no, I mean- >> And they haven't thought-
>> There's some structural changes,
but the answer is simple.
The getting there is hard.
I asked Chambers the same question.
What's that startup
that's going to come out of woodwork
and like slay this
domain legacy dogma of,
"This is the way it was"?
>> Well what do you...
I don't see that as some startup
all of this is going to suddenly coming in
and taking a big share.
>> Well, I mean if you run cloud native networking
and on-premise networking would tie to the cloud,
you can tie your app directly
into the cloud native network.
That's possible. >> Yeah, but I mean,
I would be personally shocked
to see some kind of startup all of a sudden
come in and grab 20% market share in this market.
>> Oh. >> Yeah, but I just-
Well, I mean not from 0% to 20%.
>> Zeus: Oh, the biggest- >> That was the scenario.
One of my companies does that or they get bought.
Guess what scenario is more likely.
You know, they get bought. >> Yeah, they get bought.
Because more and more,
again, security is a game of analytics.
And, you know,
the company that has the biggest dataset
that they can apply machine learning to
I think is the one
that's ultimately going to win this, right?
And so, but that's why acquisitions do become important.
You do need to be able to bring
the API level data in.
>> But be able to see what's going on there
and combine it with login data
from your VPN client
and network data,
you know, from the stuff
that's moving to your network.
And it's the correlation of those things
that lets you find those things
that are impossible to find,
you know, through a SIM.
You know, one of the things
we didn't talk about too
was what security industries are going to fall, right?
And I do think- >> John: Who do we think
what's going to fall?
>> What parts of the security industry are likely
to see a downturn, right? >> Yeah.
>> And I think, you know,
pure endpoint plays,
you just don't have enough visibility
into the rest of the spectrum.
And I think SIMs.
I've long been a SIM skeptic,
because every time we have a breach,
some SIM vendor says we caught it, right?
>> Well, if you caught it,
your customer didn't see it,
I don't think that counts, right?
>> And so I think a whole
rethink of that industry is needed,
because, you know,
log analysis for,
you know, that just provides you
a whole bunch of data.
It doesn't really
do anybody any good. >> John: The platform-
>> Dave: Can they transform though?
Can those guys like take,
you know, sort of a modern data stack
and then add in some, you know,
not just the sort of log data,
but actually some response and remediation
and then sort of move...
Can they do that? >> Zeus: Yeah, I think so.
>> If you were the head of a CEO of a SIM company,
what would you do?
>> Zeus: Yeah, well they have a ton of data, right?
But I don't think they do
a very good job of analyzing it.
Most of it's reactive.
But I think they have to partner
with the threat intel companies
and be able to look outside of their,
you know, their domain of what they hold.
'Cause they got a lot of interesting data
but in itself and isolation
only has limited value.
>> Yeah, I mean, that takes your point.
I mean the data perspective is huge.
Cribl's announcement with the CrowdStrike
I thought was interesting.
You followed the Cribl deal,
they just did- >> Yeah.
>> It's a great tool.
It pulls data in very quickly,
and they're eating Splunk's lunch.
>> Yeah.
>> Just a nice startup.
The very unique product,
and it's about moving data in to these platforms.
>> I would like to see the security industry
actually get together
and develop some real standards too.
Because a lot of what you see is,
you know, Fortinet partners with Palo,
who partners with Cisco,
and they integrate data together.
But a lot of that is manual integration
done through APIs.
And so, there's a large amount of heavy lifting, right?
Where I think one of the things
the security's industries missed historically
is if you make things interoperable, right?
And you know, you think of the way networks work.
I can plug a Juniper AP into a Cisco switch,
I know it's going to work.
Well, that creates this uplift of utilization.
And the security industry
has lived the life of islands,
(chuckles) And almost in opposition
to what the customers need.
And I think I would like to see...
You know AWS is trying this I guess,
but somewhere along the line,
we need some standards here
that companies can build to
to make this stuff more interoperable.
And then let the best platform win.
>> Like the best analytics win and-
>> The fragmentation. >> We stopped thinking
about these knife fights
of this first-
>> Yeah, it's a knife fight industry.
>> Yeah. >> So would that be
your top story coming out of here?
So what people watching RSA 2023,
what would be the big walkaway story
from your perspective
as you've done tons of meetings
and talked to all the vendors?
What's the big...
Go to the balcony, look down the stage, what's...
>> Well, from the way I look at the world,
I think it is the coming together
of networking and security.
Because that's...
And we'll see how far they goes upmarket.
But more and more vendors
are actually coming at it,
you know, think of VMware as a network company.
They're more into security.
Cisco's the same thing.
All the network security vendors
are now trying to do more networking.
I think one of the interesting
things that has flown
under the radar a little bit
is what is the future role of SecOps though?
'Cause everybody I talked to,
you know, I talked to Jfrog.
They said, "Well DevOps and SecOps are coming together."
Right? VMware is going to tell you
that CloudOps and SecOps are coming together.
Palo say NetOps and SecOps...
Well, if everything's coming together with SecOps, right?
What's the role of SecOps?
And perhaps,
the answer is SecOps should determine policy,
but then each individual group
implements them themselves.
Right? Because...
And it winds up becoming diffused
through every organization.
And just like...
You know, I remember when I started my career,
the companies I worked at,
we had an internet group, right?
>> To think about...
Nobody has that now.
>> Because it's just- >> John: It's the internet.
>> An embedded part of what you do.
>> Dave: And what about DataOps?
>> Yeah.
>> Dave: Sec- (laughs)
>> But security Ops can't- >> SecDevs data-
>> Can't come together with every group.
>> Well this, my point is like, >> Yeah.
>> Right, so, you...
'Cause you've said a couple times
that basically security is a data problem.
And you got this data group.
You know, it's kind of off doing their own thing.
Analytics, rock stars, and data scientists.
You know, are you going to lend some of their time
or loan some of their time?
You know? Or are you going to build your own?
What's the right data strategy for companies?
>> Zeus: Yeah, well I think it's a combination
of your own data plus the vendor.
The vendors supply data,
'cause the vendors...
The thing is the threat intel groups
of these vendors have
just a ton of data they're collecting.
>> Dave: You mean like Unit 42?
>> Yeah, a Unit- >> Or Mandiant?
>> Zeus: Yeah, or Callos,
or you know, groups like that, right?
There's...
'Cause they're aggregating data
across their customer base,
but then the data that the company has
is unique to them, right?
People work in certain ways or whatever.
And if you just,
you know, think of your own company if,
you know, you start logging in all of a sudden
at different times,
that's a pretty good indicator that,
you know, maybe there's something where somebody
hacked your account or something, right?
>> But I think it's a combination of the company's data
applied to the aggregate
threat hunting data that's out there.
>> John: Awesome. >> Dave: Cool.
What about, I mean,
a lot of talk about generative AI.
You know, generative models
and large language models. >> Zeus: It's back at SecOps,
I mean- Do you...
What do you think about that?
You think it's mostly hyped?
Do you think it's...
Are you an optimist
in terms of it being applied to the industry
or is it just a bunch of bullshit?
>> Well, I think generative AI is being used
to create better and better phishing attacks.
Spear phishing campaigns and things like that.
Because now, with generative AI,
you should never have a phishing email
that comes to you with a spelling error.
You should be able to write it in, you know,
to one of your employees in your tone
and the way you talk. >> Dave: Perfect grammar,
right? >> Right.
You could be able to replicate people's voices, right?
Perfectly.
And I think we haven't really explored
what the fraudster use of generative AI is.
And I think that's still yet to be seen.
And I think it's going to have a huge impact.
And I think you need generative AI.
This is a little bit of fight fire with fire.
And this is where companies
need to really rethink their security strategies.
You cannot fight AI-based security
with manual processes.
It's too slow and it doesn't work.
And the great thing about AI
is you could have chatGPT
create me 10 variants of this malware,
and only one of them has to work.
>> Dave: Yeah. >> Right?
>> So you're basically saying- >> Developer productivity
meets a blackhat.
>> You're basically saying, which is no surprise,
the adversaries are going to figure it out first.
>> Yeah. >> And they're ahead
of the defenders
>> Zeus: 'Cause there's more money there.
>> Yeah.
>> John: And it's easier now.
>> Yeah, it's easier now.
>> John: Back to your analytics play,
'cause I think it's going to be a data opportunity.
Whoever can get that data to fight fire
in your instance, and then also use it for defense.
>> Yeah. >> It's really
going to be critical.
>> Well that's why the platform strategy is important.
And that's why, to your point, Dave,
I don't know if a small startup
can come out of nowhere now,
and do that.
Maybe as an analytics company.
>> Unless it's completely game-changing,
it's out of left field. >> Yeah.
>> No one sees it.
>> But then somebody will buy 'em.
>> Yeah, well that's quite interesting, you know.
>> But the thing is that they may come out
with the best-of-breed tool,
you know, that has the potential to be a platform.
And there's a number of companies out there
that are trying to do that,
but it's just,
how long does it take
to get a platform adopted in cyber?
I mean it's eight, ten years.
>> Yeah. >> Zeus: Yes.
>> It's generational.
>> And you need critical mass in a couple of areas
in order to call yourself a platform.
>> And a lot of the really interesting innovations
coming out of Israel.
And those companies are, you know,
they're going to get bought.
>> Yeah.
>> The M&A markets could be hot.
>> Yeah.
>> Alright, Zeus, awesome as always to see you.
Thanks for making some time for us.
>> Always happy to be here.
(John chuckles) >> All right, yeah.
>> Dave Vellante with John Furrier.
>> Zeus: Great stuff. >> And our guest,
we'll be back right after this short break.
theCUBE live from RSA 2023.
(soft music)