AWS Financial Services Symposium 2025 | Peter Sprenger, Splunk

Clips
More from AWS Financial Services Symposium 2025

Peter Sprenger

Field CTO

Splunk, a Cisco company

play_circle_outline Rise of AI and technology in solving problems

play_circle_outline Utilizing Data and AI Programs to Enhance Cybersecurity in Financial Services with Splunk's Analytics

play_circle_outline AI assisting cybersecurity analysts with alerts

play_circle_outline Splunk Cloud's partnership with AWS for federated search

play_circle_outline Edge processing and AI capabilities for data processing efficiency

Info
Transcript

Peter Sprenger, Splunk

Peter Sprenger

Field CTO Splunk, a Cisco company

In a conversation at the AWS Financial Services Symposium, theCUBE Research’s Dave Vellante and Scott Hebner sit down with Peter Sprenger, field CTO of the Americas at Splunk, a Cisco Co., to unpack how financial institutions can get the most out of their investments in people, process and technology. Sprenger introduces the “team of teams” model – an organizational strategy aimed at breaking down silos that naturally form within large security teams. He explains how fusion centers can unify threat intelligence, risk and IT ops without creating more layers of... Read more

explore Keep Exploring

What are some trends you are observing in the industry in terms of AI talk and tools creep? add

What unique characteristics do you see in the financial services industry when it comes to cybersecurity and threat actors? add

What is the importance of machine learning and AI in reducing the number of alerts and allowing analysts to focus on what matters in making risk-based decisions? add

What is one way in which Splunk Cloud utilizes AWS for serving customers and managing data stored in S3 buckets? add

What investments has Splunk made in their ability to process data at the edge and only ingest what is important? add

bolt Powered by CUBE AI

Peter Sprenger, Splunk

search

Dave Vellante

>> Hi, everybody. Welcome back to New York City. This is Dave Vellante with Scott Hebner, and you're watching theCUBE's continuous coverage of the AWS Financial Services Symposium. This is the 10th year of the symposium. It started out with 35 people in a small hotel room, the Roosevelt, and now it's up to several hundred, I'd say five, six, maybe even 700 people here. Peter Sprenger is here. He's a field CTO for Splunk, a Cisco company. They just announced earnings. Just last night, I saw Jeetu Patel over in Saudi shaking hands with MBS and the POTUS. I was like, "There's my brother from another mother. Jeetu hanging with the big dog," so we were super excited to see that. We just had him on at RSAC. Welcome to theCUBE. First time.

Peter Sprenger

>> Thank you. Great to be here.

Dave Vellante

>> Yeah. So what's happening in your world? You're coming off of RSAC. I don't know if you were at the event, but you-

Peter Sprenger

>> It was. San Francisco was a lot of fun, and unprecedented is a word that's probably overused the last few years. We wish it would maybe calm down a little bit, but just the technology we're seeing, especially in AI, and where people are leveraging technology to solve problems, it seems to only be accelerating. And a lot of fun at RSA, and it was great seeing how people are solving the problems at scale and really at machine speed as we think about what we can do now.

Dave Vellante

>> There was obviously a lot of AI talk. There was AI talk last year, gen AI talk the year before, but it felt like it was much more substantive this year, number one. And number two, it seems like the industry is finally, at least to a certain extent, calming down with tools creep. Even though there's a lot of innovation, a lot of, I think CISOs and practitioners are saying, "Okay, we've got a lot of capabilities and we really want to try to leverage it." What are you seeing there, Peter?

Peter Sprenger

>> I think it's absolutely some of the trends we're seeing, and we're seeing executives now saying, "Look, I made these investments. What did I get for it?" And so they're having a higher expectation of their tooling. They're realizing that these things work together and they were designed to work together, so if I go with a best in breed solution, I'm really buying into an ecosystem, and that ecosystem gives me an end-to-end solution where teams are empowered to do their work faster, they can look at data that's more comprehensive, it's more accurate, and it's just easier for teams to work with. So that speed and that velocity of response accelerates, giving leaders insights that matter. I also think on AI, it's something where there's the allure of the promise of AI, and we've gotten to the point where there are now these contours we can see, we can see it in practice in some use cases. And we've also come down from the high a little bit where we've realized that for AI to work, you have to have a good data program and a good AI program, and the people that maybe didn't invest in a good data program at the onset, they now have some catching up to do, but you have to do both. And I think the reality is sometimes a little sad, but that's where we are.

Dave Vellante

>> And you've spent a lifetime in financial services, right?

Peter Sprenger

>> Just about. That and the military.

Dave Vellante

>> That and the military. Thank you for your service. Appreciate it.

Peter Sprenger

>> Oh, no. .

Dave Vellante

>> And what other unique characteristics do you see in this whole space? I know fraud detection with AI, things of that nature are really, really important. But if there's any industry, maybe financial services and life sciences, where trust and explainability and compliance are critical number one objectives, what's unique about this industry?

Peter Sprenger

>> We see the scale and the frequency and sophistication of attacks increasing at accelerating rates. And so when we look at where we have nation state threat actors, we have complex, we have AI being used in attacks, and so we have threat actors that are investing in infrastructure to attack companies. Now, the financial services industry is of coarse handling the lifeblood of the economy with funding and the engines of commerce. It's an attractive target, and with that, we also see significant investments in the financial services industry. With that investment comes complexity. That complexity is challenging to manage without just a lot of effort and thought put into architecture, and how do our teams work together and what is the end goal to make decisions and really realize that value in the cybersecurity tooling that we've invested in? In our case, for Splunk, once we have data in the platform, what else can that data be used for? And you mentioned fraud. There's looking at IT services, business operations, the banks all have online banking portals for customers. And so the insights that are helpful for cybersecurity, we see those helpful for really every other part of the business as well, and so it's just dashboards of getting it out.

Dave Vellante

>> And the lifeline of AI is data, and I think in the world that you're living in, at least from what I understand, is it could be very fragmented. You have different teams, you have different processes, you have different data sets that all, I would imagine, have to come together to really be effective with AI, particularly around fraud detection and remediation. And that's the team of teams concept is-

Peter Sprenger

>> Yeah, and that's where we do see many of the large organizations building out a fusion center to be able to help the teams talk together. Underlying that, you want a shared ecosystem of data, and you need a really good data platform to help make sense of all the data that's coming in. I think data has a half-life and so it's less valuable as time goes on, especially if there's an incident, if it's cyber or a business incident or whatever it may be. And so getting those insights quickly, making sure that a leader has all the information that they can get helps them make the best decision they can. They'll never know everything, but you want to at least know what's out there and eliminate some of the unknown unknowns as people like to say.

Dave Vellante

>> So Willie Sutton, right? Why do you rob the banks? Because that's where the money is, so obviously that's the big risk. Having been in that world, you know, basically these financial institutions, they spin up products that are database products very, very quickly, and they tend to have teams that are focused on the execution, and so those teams tend to be siloed. Is data the unifying force?

Peter Sprenger

>> I think it's the unifying force, and it's also there's the expectation, rightly so from stakeholders, that is my data safe? And we see a very heavy regulatory focus as it should that is customer's data safeguarded? Are we looking at privacy protections where we should? Are we defending against cyber threat actors? And so managing all of the stakeholders and making sure that there's trust and confidence in the financial system, that's a heavy responsibility and it requires a lot of planning to be able to not only do the job well, but also make sure that people still have confidence that that's happening. And you can only do that with a good data program, and you can only reduce risk or mitigate risk by understanding it first to make well-informed data-focused decisions.

Dave Vellante

>> So I hear about all this, and it affected RSAC this year, a lot of talk about agentic, but I feel as though it's a disaster waiting to happen from a security standpoint. Everybody's rushing in. How do you see that in financial services and how are organizations designing security in versus holding it on? Every day I open the Wall Street Journal, there's another attack. It's a gift that keeps on giving in the cybersecurity industry, but at the end of the day, the industry's pulling together. What's your philosophy around agentic and how do we protect against that impending disaster?

Peter Sprenger

>> I'll take the easy part of the question first. In cybersecurity, great people, there has been such investment in people and technology that when you're trying to find a needle in the haystack and AI helps you find it with this really good metal detector, and then you have a really highly trained analyst that's an expert in his or her field say, "Yep, it's a needle," and then you do it, that's just an easy win. And likewise, if someone's using a Splunk-released AI to help write queries for searching mass amounts of data, and AI can help do that. And so those are use cases that unequivocally just make life better for analysts where there aren't enough analysts in the job market to scale like we have been for the last 10 or 15 years, and now there's so much more data. I think over 90% of data that's alive right now was created in the last two years, and so when you look at that type of scale and analyzing it, we need AI. The other more complex question is we have the promise of AI, and with that, we see some organizations stifle creativity and they say, "You cannot use it." And then people find a way to get their jobs done and they go to some other area that you can't see, and that's where we see Cisco leading with AI defense and the ability to analyze models and understand what's going on. So we need cyber security to be a business enabler and not stop the business, but partner and figure out how can we leverage technology responsibly and then be able to answer to our stakeholders what is it doing? And that just requires a lot of planning about where is the data coming from, how is it being trained and used, and how can we make sure that data doesn't go to the wrong place? Those are tough questions.

Dave Vellante

>> Your concept of the teams of teams resonates with me, because if you think about AI assistance, GenAI, it's usually for an individual productivity. Agents go to another level where they're working with each other, they mimic digital workers. You have workflows, you have multiple workflows working together, which essentially you're getting AI to become teams of teams. And if you're delivering teams of teams on all the security threats and the data under the covers, there's a fusion there, it sounds to me, right?

Peter Sprenger

>> Yeah. I think even if we look at machine learning and something as simple as alerting, alerting sounds great. The computer is going to tell me when something is wrong, and then a leader says I should look at this light that went red on this dashboard. And now what we've seen is that there's just too many alerts, and so we released ML and AI to help calm down the alerts, and it's really being respectful of the analyst's time so they can really concentrate on what matters. They can look at more things and be able to triage what matters, get that information to leaders, and leaders can make risk-based decisions. It's much like when I was a military officer on the battlefield, you'd never have all the information, but you want to have as much as you can have quickly so you can focus your time planning and reacting where it matters. I think the other area that we see is with AI itself, you can pull these insights together, but at the end of the day, I guess for carpenters, when power tools, it's not like power tools are putting carpenters out of business. They can just build more houses, right?

Dave Vellante

>> Super power.

Peter Sprenger

>> Yeah, and so that's where we see AI. They are power tools for people to be able to do more than they were before because technology isn't slowing down.

Dave Vellante

>> But on the alert front, you bring up a good point, the prevailing wisdom is that AI has enabled attackers to just overwhelm the humans that used to be able to... Technology would take care of 99% of the attacks, and then that 1%, humans could deal with. But now with AI, the sentiment is it's just too much, to your point, so things have to change. Now, if I'm a shiny new toy cyber security startup, I would say, "Oh, all that old stuff, you got to throw out," which of course as we talked about earlier, you just can't do that. So given Cisco's very large footprint in cybersecurity, now add Splunk to that. Other than Microsoft, you've certainly got the biggest account footprint out there, and so how are you supporting that trend and what processes are changing, and how are they being modernized and how do you support that?

Peter Sprenger

>> Sure. You look at Splunk, it's a data analytics platform for action, and I think that's what really helps us create value is you're taking action with the data and doing something where it's going to make the firm safer, it's going to enable a customer experience. It's going to do something that really realizes that investment and builds. What we see with attacks is that they are automated. Just like you said, they're coming in much faster. AI can move very quickly, but we've also changed the standards on the cybersecurity side. So now the time to contain a breach is minutes, and to remediate is not much longer, and these expectations keep increasing. The only way to meet it is through automation and being able to take a risk-based systematic approach, which requires planning and investment and good program strategy upfront, with at some level, everyone from executives to analysts being technologists and understanding the mission and what we're trying to do.

Dave Vellante

>> When you're looking at the processes, the teams of teams, beyond the traditional SOC KPIs, what do you think are the most important things that businesses should be looking at now that they perhaps couldn't do as much before?

Peter Sprenger

>> I think it's coming back to what is the mission and how do we map that back to metrics that help us understand where we need to course correct, where we need to invest, where we need to flex resources, and where to look at what's been going well and do more of that? And so metrics help leaders lead. There's an old adage, if you measure something, it gets better. And so it's doing that, but using it as something that's a tool where people can learn from that and then create new metrics. And you really look at the data as a microcosm of your business and build from that. And that's where I think the team of teams really helps because people are sharing the same piece of data. Those silos are eliminated and they're able to work together and understand how they can help each other, and people want to be collaborative. They want to work together for a common goal, and I think for leaders, it's socializing that goal and getting buy-in and making sure we have a clear, simple message about what are we doing and how can we use technology to help us get there?

Dave Vellante

>> There's obviously a lot of fear in the media. Journalists always go right for the negative, AI is going to take away jobs. I don't know about you guys, but I'm busier than I've ever been. My backlog of interesting stuff is just piling up as I use AI to deal with all the mundane things, and so I'm swamped. But pertaining to talent, I would think cyber security is the one area we always talk about the talent shortage where people are embracing AI saying, "This helped me as a SOC analyst deal with all these false positives." You pointed out, Peter, bringing automation is really a sure way to handle it. So how do you see the skills being addressed by AI and how would they evolve? What kind of skills should people that aspire to get into cyber security be focused on?

Peter Sprenger

>> I love that question, and when I went to undergraduate, I remember that there were a couple of things. People were penetration testers for red teams, they were SOC analysts or they were incident responders when things really go terribly wrong there. And I think that's what's amazing about cyber security, is because especially the financial services industry is operating at scale, you'll have thousands of people dedicated to cyber defense. So you have project managers, program managers, cyber threat intelligence analysts. You have people looking at vulnerability patching, and you have of course the traditional SOC analysts and security incident management to manage how are we thinking about things? Are we doing everything we're supposed to for stakeholders, for regulators and customers, and what needs to be done? And that's where that team of teams concept really matters, in operating at scale and really looking at the objectives that we set out to do, and AI helps everyone understand that together. And it was interesting, I was looking at some curriculum about just looking at how to integrate AI into an educational program, and my first thought was, "Oh, well, there should be an AI class. That's the easy answer." Then I realized that for every one of the jobs I listed, there are AI use cases and it's just going to become one more tool that we have. And right now, it's new and so it's easy for us to segment that, but eventually, it's going to be one more tool in our arsenal as we're defending financial institutions.

Dave Vellante

>> As you know, Dave, I spent a lot of time on the AI talent marketplace, and it's my view that it's not going to take jobs. As a general rule, it's about giving people superpowers to do more. It's going to make everyone smarter.

Peter Sprenger

>> They may make different jobs.

Dave Vellante

>> . It's going to eliminate jobs, right?

Peter Sprenger

>> Well, I think it's different jobs and they're adjacent too. They're not moving into a completely different sector. They're jobs that are tangential to what people are already doing.

Dave Vellante

>> Yeah, businesses will have to make a decision. They can either save costs, eliminate jobs, or they can do a hell of a lot more by giving people the superpowers, and I think it's still an open question we'll see in time here. But that brings us to a question about let's go three years ahead now and you're a security analyst and you're working with Splunk and Cisco, right?

Peter Sprenger

>> Yeah.

Dave Vellante

>> And with AI being incrementally infused into all this, what do you envision looking out a couple years?

Peter Sprenger

>> Well, if I'm a SOC analyst, hopefully a lot less Excel, and we all love Microsoft, but I find Excel is kind of the duct tape of middle managers. When they don't have a tool to solve it, they make it work with Excel. And so hopefully, they log in for the day, they see the alerts that have happened or the information that's been highlighted, and they also see the information that hasn't been highlighted. There's an alert that they're missing something, maybe something isn't working correctly, so they go take a look at that. And from there, if there is an alert that requires escalation, there's a notification to the rest of the team so multiple people are tracking it, and we have redundancies. And what I also think is for a SOC analyst, they traditionally look inside the network and cyber threat intelligence look outside the network. But now, we'll have automation where we're looking for indicators of compromise that auto match against what's in the estate and brings that up and bubbles it up to that team of teams to get more people to help out that SOC analyst. And the SOC analyst isn't alone anymore. They're on the front line. If they miss something, they have a team that's supporting them, and when leaders receive that SOC analyst, the SOC analyst isn't sending it to another team to put it into a PowerPoint to fix the fonts and get all the formats. That's already done, and the CISO wakes up at 2 AM because there's some geopolitical event, looks at a dashboard without having to wake up that SOC analyst to do it, and that's powerful.

Dave Vellante

>> And that SOC analyst you can envision over time becomes a supervisor of AI agents, some of which are acting autonomously, but the job goes from being the analyst to managing a digital workforce.

Peter Sprenger

>> Exactly.

Dave Vellante

>> It could get really fascinating. What's your relationship with AWS? Give us a bumper sticker on that.

Peter Sprenger

>> Sure. I think of course, Splunk Cloud uses a lot of AWS for serving customers. What we've also seen is AWS was I think the first, one of our first partners where we have federated search. And we do want to meet people where they are with their data strategy, so if people have logs for compliance purposes and they store in S3 bucket, we can search those now from Splunk without having to ingest those, and it makes things a lot easier. And we're seeing customers that have, especially in the financial services, things that they just maybe can't move into the cloud because it's legacy technology, and they're obviously not avoiding the cloud because of how easy it makes to just run the business. And so with these hybrid environments, we can search information in AWS without ingesting it, leaving it right there in AWS's area. We've also seen where the uptime of using AWS products can exceed by a wide margin on-prem legacy technologies. And we look back to the bank's mission statement and what they're really trying to do to serve customers and what their core competency is and they focus their best talent, it's often not racking and stacking stuff in their data center. And so when we just look at the numbers for uptime, using AWS, using cloud services, it's a force multiplier and allowing people to focus on what matters with your best talent.

Dave Vellante

>> What about those workloads that they're not going to move into cloud? Is that we bring the cloud to the data with something like outposts or local zones? How do you see customers dealing with that?

Peter Sprenger

>> We see a lot of edge processing and looking at that, especially when we look at AI and the ability to bundle that. We have quite a few things we're working on to be able to push that out to the edge, to be able to compute that and move data around quickly when it needs to, but process it in place if it doesn't. And Splunk's made quite a few investments lately in our ability now where if you get data that's perhaps not relevant, you can discard that at the edge and only ingest what's important. And that helps significantly with compute because you're really only expending compute on what matters, and leaders get those insights that much faster.

Dave Vellante

>> And it saves on storage costs. Well, that was awesome, and Peter, thanks so much for joining us on theCUBE. We really appreciate your perspectives and insights.

Peter Sprenger

>> Thank you, Dave.

Dave Vellante

>> Okay, this is Dave Vellante for Scott Mullins, and you're watching theCUBEs coverage of AWS Financial Services Symposium from the Big Apple. We'll be right back right after this short break.