>> Male Voiceover: Live from Boston, Massachusetts,
it's theCUBE, covering AWS Reinforce 2019.
Brought to you Amazon Web Services
and its ecosystem partners.
>> Okay, welcome back everyone.
CUBE's live coverage here in Boston, Massachusetts
of AWS Reinforce.
That's Amazon Web Services' first inaugural conference
around cloud security.
I'm John Furrier with Dave Vellante.
One of the top stories being announced here
at Reinforce is the VPC traffic mirroring
and we wanted to bring in CUBE alumni
and friend Mike Banic who's a VP of marketing
at Vectra who specializes in networking.
Welcome to theCUBE.
We go way back.
HP Networking, you got a hot startup here.
So I wanted to really bring you in
to help unpack this VPC traffic mirroring product.
It was probably the meatiest announcement out
of everything onstage.
That other stuff was general availability of Security Hub,
which is great, great product, and Guard Duty as well.
All this other stuff happened.
But the VPC traffic mirroring is a killer feature
for a lot of reasons.
>> Absolutely.
>> But it brings some challenges and some opportunities
that might be downstream.
But I want to get the thoughts on what is your take
on the VPC traffic mirroring.
>> So, at the highest level, it brings a lot of value
because it allows you to get visibility into something
that's really opaque which is the traffic within the cloud.
And in the past, the way people were solving
this was they would have to put an agent
on a workload, and nobody wants that.
One, it's hard to manage.
You don't want dozens to hundreds or thousands of agents.
And also, it's going to slow things down.
And third, it can be subverted.
You get the advanced attacker in there,
he knows how to get below that level
and operate in a way where he can hide his communication
and his behavior isn't seen.
With traffic mirroring, we're getting a copy of the packet
from below the hypervisor.
Cannot be subverted, and so we're seeing everything.
And we're also not slowing down the traffic
in the virtual private cloud, so it allows us
to extract just the right data for a security application,
which is in our case metadata, and enrich it
with information that's necessary for detecting threats
and also in performing an investigation.
>> Yeah, it was definitely the announcement
that everybody has been talking about.
Kind of has the buzz.
So, from a partner perspective,
how do you guys tie into that?
What do you do?
What's the value that you bring to the customer?
>> So the value that we're bringing really stems
from what you can do with our platform.
There's two things everybody's looking to do
at the highest level, which is detect threats
and respond to threats.
On the detection side, we can take the metadata
that we've extracted and we've enriched
and we run it through machine learning algorithms.
And from there, we not only get a detection,
but we can correlate it to the workloads we're seeing it on.
And so we can present much more of an incident report
rather than just a security alert saying,
hey, something bad happened over there.
It's not just something bad happened
but these four bad things happened
and they happened in this time sequence over this period
of time and it involved these other workloads.
So we can give you a sense of
what the attack campaign looks like.
So you get a sense of like with cancer.
It's not just you have bad cells in your liver,
but they've metastasized to these other places.
We also will keep that metadata
in something we call Cognito Recall, which is in AWS,
and it has prebuilt analytics and saved searches
so that once you get that early warning signal
from Cognito Detect, you know exactly where
to start looking for.
You can peel back all the unrelated metadata
and you can look specifically
at what's happened during the time of that incident
in order to perform your threat investigation
and respond rapidly to that threat.
>> So you guys do have a lot
of machine intelligence, AKA AI chops.
How close are we to be able to use that AI
to not only identify, detect,
but begin to automate responses?
Are we there yet?
Is it something that people want, don't want?
>> We're getting close to being there,
to answer your first question,
and people aren't sure that they want it yet.
And here's some of the rationale behind it.
We generally say that our AI's pretty smart,
but security operations people are still the brains
of the operation.
There's so much human intelligence,
so much contextual knowledge,
that a security operations person can apply
to the threats that we detect.
They can look at something and say,
oh yeah, I see the user account,
the service that's being turned on
from this particular workload.
I know exactly what's happening with that.
They add so much value.
So we look at what we're doing
as augmenting the security operations team.
We're reducing their workload by taking all the mundane work
and automating that and putting the right details
at their fingertips so they can take action.
There's some things that are highly repeatable
that they do like to use playbooks for,
so we partner with companies like Phantom,
which got bought by Splunk,
and Demisto, which Palo Alto Networks acquired.
They've built some really good playbooks for some
of those well-defined situations
and there was a couple presentations on the floor
that talked about those use cases.
>> Yeah, Phantom was a pretty good, solid product.
It's built into Security Hub.
Security Hub's a nice product.
Why don't we get back to the VPC traffic mirroring
because it makes so much sense.
I mean, it's about time.
>> Mike: Yes.
>> I mean, finally they got it done.
It just doesn't make any sense it wasn't done before.
But I got to ask.
First of all, the analytics.
You've said on theCUBE before, network doesn't lie.
>> Mike: The network does not lie.
>> Network doesn't lie and the subversion piece
is a key piece.
It better be the lowest level possible.
That's a great spot for the data.
So, totally agree.
Where do you guys create value?
Because now that everyone's got available VPC traffic
mirroring, how do you guys take advantage of that?
What's next for you guys?
Where's the differentiation come from?
Where is the value?
Go next.
>> Yeah.
There's really three things that I tend to focus on.
One is we enrich the metadata
that we're extracting with a lot of important data
that really accelerates the threat investigation.
So things like directionality,
things like building a notion
of what's the identity of the workload
or when you're running us on-prem, the device,
because IP addresses change.
There's dynamic things in there
so having a sense of consistency
over a period of time is extremely valuable
for performing a threat investigation.
So that information gets put into Recall
for the metadata store.
If people have a data link
that they want to have us send it to,
whether it's Elastic or Splunk Kafka,
then that is included in what we send
to them in Zeek format.
And they can use other Zeek tooling
so they're not wasting any money there.
And then the second piece is around the way
that we build analytics.
There's always a pairing of somebody from security research
with a data scientist.
The security researcher explains the tools,
the tactics, the techniques of the attacker,
so that way the data scientist isn't being completely random
about what features do they want to find
in the network traffic.
They're being really specific
to what features are going to actually pair
to that tool, tactic, and technique
so that way the efficacy of the algorithm is better.
We've been doing this for five plus years
and that history speaks for something.
Because some of the learning we've had is,
all right, in the beginning, there were maybe a couple
different supervised techniques to apply.
Well, now we're applying those supervised techniques
with some deep learning techniques
so that way the performance
of the algorithm is actually 90 percent more effective
than it was five years ago when it first rolled out.
>> So you're differentiating the software.
Get the data, extract the data out,
which is the metadata.
Which you were doing anyway, but now it's more efficient.
Low speed, no problems with informance
in the agents you mentioned earlier.
Now it's better data.
Impact to customers.
What's the revelation here for, at the end of the day,
your customer and Amazon's customers through you?
What do they get out of it?
What's the benefit to them?
>> So it's all about reducing the time to detect
and the time to respond.
We had one of our Fortune 250 customers present last week
at the Gartner Security Summit.
He stood onstage, a gentleman from Parker Hannifin,
talked about how they had an incident
that they got an urgent alert from from Cognito.
It told them about an attack campaign.
He was immediately alerted to 45 different machines
that were sending data to the cloud.
He automatically knew about what were the patterns of data,
the volume of data.
They immediately know exactly what the services
that were being used within the cloud.
They were able to respond to this
and get it all under control in less than 24 hours,
but it's because they had the right data
at their fingertips to make rapid decisions
before there was any risk.
And what they ended up finding was,
it was actually a new application,
but somebody had actually not followed the procedures
of the organization that keeps them compliant
with so many of their end users.
In the end it saved tremendous time and money
and if that was a real breach,
it would have actually prevented them
from losing proprietary information.
>> Well, historically it would take 250 days
to even find out that there was a breach.
>> Mike: Right.
>> And then by then, you know,
who knows what's been exfiltrated.
>> Yeah, we had a couple firms
that run red team exercises for a living come by
and I said to them, do you know who we are?
And they said, of course we know who you are.
If there's one tool out there that defines us,
it's Vectra.
And I'm like, okay, well let me tell you about the news.
>> Hey, that's great.
>> That's the kind of historical on-prem.
So what do you do if we're on-prem?
Is this all running on AWS, is it cloud only?
>> It's actually both.
So we know that there's a lot of companies
that come here that have never owned a server
and everything's been in AWS from day one.
>> Dave: No IT.
>> Exactly.
And for them, we can run everything.
We have the sensor attached to VPC traffic mirroring in AWS.
We can have the brain of the Cognito platform in AWS.
So for them, they don't need anything on-prem.
There's a lot of people that are
in the lift and shift mode, can be on-prem and in AWS,
so they can choose where do they want the brain
and they can have sensors in both places.
And we have people that are coming to this event
that they're hybrid cloud.
They've got IT infrastructure in Azure
but they have production in AWS
and they have stuff that's on-prem.
And we can meet that need too
because we work with the vTAP from Azure.
And so we're not religious about this,
it's all about giving the right data at the right place,
reducing the time to detect and respond.
>> Mike, thanks for coming in and sharing the insights,
your perspective, on the VPC traffic mirroring.
Appreciate it.
Give a quick plug for the company.
What are you guys working on?
What's the key focus?
Are you hiring?
You just got some big funding news.
Take a minute to get the plug in for Vectra.
>> Yeah, so we've gone through several years
of consecutive more than doubling
in annual recurring revenue.
Been really fortunate to be earning a lot
of customer business from the largest enterprises
in the world.
Recently had funding, $100,000,000 led by TCV
out of Menlo Park.
Total capitalization is over $222,000,000 right now.
On the path to continue that doubling.
But we've been really focusing
on already being where the puck is going to
by working with Amazon Advance on traffic mirroring.
And we know that today people are using containers
in the VM environment.
We know that where they want to go is more serverless
and you're leveraging containers more.
We're already going in that direction, so.
>> Well, great to see you.
Congratulations.
We've known each other for many many years.
This was our 10th anniversary on theCUBE.
You were on year one.
Great to know you and congratulations
on the success of Vectra
and great announcement with Amazon.
Gives you a tailwind.
>> Thanks a lot.
It's great to see your growth as well.
Congratulations.
>> Thanks Mike.
Mike Banic unpacking the relevance
of the VPC traffic mirroring feature.
This is the kind of conversations we're having here.
Deep conversations around stuff that matters around security
and cloud security.
Of course, theCUBE's bringing you the coverage
from the inaugural event at Reinforce from AWS.
We'll be right back after this short break.
(upbeat music)