Clips
News
More from Axonius Adapt25

Erik Nost

Sr Analyst, Security and Risk

Forrester

From shadow IT to singular truth: Axonius reshapes cybersecurity visibility

Fragmentation isn’t just a technical issue in cybersecurity — it’s an existential one. Shadow IT, software-as-a-service sprawl and disconnected tools leave teams squinting at their environments through fractured lenses, with no clear cybersecurity visibility into what’s safe or exposed.Axonius’ Dean Sysman talks with theCUBE during Axonius Adapt25.“That’s led to dozens of different tools that organizations need to use, and each one only sees a part of the picture, a part of the one piece of that puzzle of the organization,” said Dean Sysman (pictured), co-founder and chief executive offer of Axonius Inc

play_circle_outline Shift from reactive to proactive security strategies

play_circle_outline Importance of visibility and data management in security

play_circle_outline Focus on platform-based approach in security industry

play_circle_outline Integration and specialization of security platforms for comprehensive coverage

Info
Transcript

Erik Nost, Forrester

Erik Nost

Sr Analyst, Security and Risk Forrester

Erik Nost Explores Shift to Proactive Security at Axonius Adapt 2025

Erik Nost, senior analyst for security and risk at Forrester, joins us at Axonius Adapt 2025 in Dallas, Texas. In this engaging session, we discuss the crucial shift from reactive to proactive security approaches, a significant theme for the event hosted at the dynamic Gilley's venue.

Meet Erik Nost, an authoritative voice on security and risk analysis, as they join theCUBE Research hosts to explore the current security landscape. Joined by another security analyst, Nost di... Read more

explore Keep Exploring

What are some key components of shifting from reactive to proactive security strategies? add

What are some challenges that security analysts face in the current data-rich environment of cybersecurity? add

What is the importance of visibility and being proactive in a security platform in the security industry? add

What are some trends in the industry regarding how security companies are expanding their capabilities? add

bolt Powered by CUBE AI

Erik Nost, Forrester

Rob Strechay

>> Hello, and welcome back to Axonius Adapt 25, the inaugural Axonius event. We're really excited to be here from Dallas, Texas at Gilleys. Really, as we were just talking about with our guest who's going to be on in a second here, a concert hall that is really famous for a lot of really great artists and stuff. A really cool little venue and I'm excited. I got Jackie here, who's our newest analyst in the security vertical. We're going to get to geek out on this because we're joined by Eric Nost, who's the senior analyst for security and risk at Forrester. So, this is just analysts here geeking out on what we've heard and what we're hearing around the water cooler or coffee venue.

Jackie McGuire

>> The white paper cooler.

Rob Strechay

>> The white paper cooler, or the little dummies guides that are on every table here. So, welcome on board, Eric.

Erik Nost

>> Awesome, happy to be here.

Rob Strechay

>> And your first time on theCUBE, hopefully not the last. So, we always enjoy having other perspectives on here. And so, thanks for coming on. I think just to give us a high level view, break down where you see Axonius and the industry as a whole fitting in, and what's going on, and why this is a really important time for security, for asset management and understanding the security over all of that.

Erik Nost

>> What we're seeing is a shift from reactive to proactive security. I think there's the recognition that, hey, we've been reacting to things like zero days and we're reacting to whatever the celebrity vulnerability is the week all the time. It really makes it difficult for us to have good proactive strategies. But, to get there, you have to understand what you're dealing with, what your prioritization should be, what's the context that feeds into that, and then ultimately get towards what Dean talked about earlier, like actionability and remediating these weaknesses that have been prioritized.

Rob Strechay

>> I think to me that is one of it. And, Jackie, you see it also, you're talking to CISOs, there's a lot of them here. This event is like brainpower central from a security perspective. So, what are you seeing as well? Dean talking about actionability and getting to actionability as well.

Jackie McGuire

>> I think one of the first papers I wrote as a security analyst was security as a data problem. And I think we started in a place where we didn't have enough data, we didn't have enough visibility. We went to bring your own device and remote work overnight without a huge amount of planning for most enterprises. And now we're at a place where we have a lot of visibility, we have a lot of data, and now we're losing things because there's so much data and there's so much that we can see that, everything from alert fatigue to just being able to bury attacks in these really noisy logs that attackers know we're all struggling with. So, I think taking that next step to, we couldn't see everything. Now we can see everything. Now, what are the things that we're seeing that are the most important? Because, realistically, you're never going to patch everything. You're never going to remediate everything. So, I think moving to a place where we can make intelligent decisions about where we spend our time and resources fixing things is where we need to be going. So, it's great to hear more focus on that. I'm sure you find the same thing that you hear from more CISOs that they have too much data than not enough.

Erik Nost

>> Absolutely. The problem's shifted. I think two, three years ago there was like, you need visibility to be able to do whatever it is you need to do, but now it's, we've got all these point products. We have all these different things giving us different risk scores, giving us different highlights that might be distracting towards what the actual proactive picture is and what really matters to the business. So, I agree. It's too much visibility at this point.

Rob Strechay

>> So, where do you see, and what's differentiating the different companies that are in this landscape? Because, you've covered it all. So, what are you seeing as differentiation?

Erik Nost

>> So, the way I think about it is platform. So, platform, platform, platform is the name of the game in the security industry. Everything's trying to be a platform. But, when I think about a proactive security platform, I go back to how much visibility is this platform providing you and how far along this lifecycle is it leading you to actually be proactive? Because again, you have the visibility. So, you need to have a good prioritization strategy so that you can actually fix stuff. That's the thing is like, we need to fix the things that we've been talking about fixing for so long if we're actually going to improve our posture. So, that's one thing I see like a proactive platform, but every security company in the industry is also-

Jackie McGuire

>> Everybody's a platform.

Erik Nost

>> Everybody's a platform, but you see reactive platforms out there. So, like your classic SecOps companies that are trying to marry their insights from SecOps and into proactive as well, which has some interesting synergy when you start to look at that.

Rob Strechay

>> I think that to me is the big thing when I came here. And I come from the observability world and from the DevOps world, and I start to look at this and people building signals into everything, plus all of the APIs and the SaaS and all of these different things. I think the one thing I took away from the earlier comments that Dean had from the stage was, the breadth of adapters that they have and also some of the numbers that they put up on there, that 300% growth in SaaS applications. To me, that makes total sense because they want to spend their money on building applications that are actually positive in revenue for that organization. But, when they're doing that, now they're using really just their core assets, their core intellectual property. What are you seeing in this market, and where Axonius is playing that really it's how people can get from being reactive to proactive to being actionable in that way. What are you seeing in that movement and that journey towards actionability?

Erik Nost

>> I think it's a slow movement. I think people are initially catching on to, hey, I have all these insights. I'm starting to build a better prioritization strategy. Whether that's using exploit prediction scoring system or some of the features you see like an attack path mapping that exists now to start to look at how identities and CVEs and externally facing assets can all chain to have an actual objective achieved by an attacker. But, again, to get there, there needs to be an appetite to automate. And that's really what I see folks have a struggle with is letting go of the control and keeping humans in the loop. You need to be able to actually make changes on systems, configuration changes, have some more automation around patch management, which I think that's going to be the big challenge that CISOs and security leaders are going to have as they try and complete this lifecycle of proactive.

Jackie McGuire

>> One of the things I'm really hopeful for, and I want to commend us because we made it halfway through this interview without saying AI, I'm going to bring it up though. So, when we talk about automation, it's kind of like, I go back to automating cars. And so, we've been trying to automate cars for 15 years and it turns out that humans do some really crazy, unpredictable out of the scope things when they drive and walk and bike that make it really hard to automate cars. The SOC is not entirely different. I've never met two companies that have the same tech stack or the same organization in security. So, as we start to look to automate this, do you think we're finally going to start to adhere to one of the 845 standards that exist for logging? Because, there are all of these, OCSF was going to be the schema that was going to unite them all. We really can't automate things that aren't consistent. So, do you think this desire to automate and maybe the economic windfall behind it will bring us closer to adhering to some common set of standards?

Erik Nost

>> It's a great question. I haven't thought of that before, but to get to automation, I would agree that you need to have an expected set of standards that you would need to adhere to. We were talking earlier about just like, first you need to be on UTC across the globe.

Jackie McGuire

>> But, my firewall is in Chicago, in Chicago's central time.

Erik Nost

>> So, start there maybe, but I think that's part of it. So, getting to those standards, absolutely. But, I think there's something deeper outside of that that's just emotional, that deals with human emotions and just fear of letting go and all the things that can potentially go wrong. Maybe the standards will help alleviate that, but it could eventually maybe drive what the standard ultimately is.

Rob Strechay

>> What are you seeing as some of the largest, I guess you could say barriers or challenges that organizations are having to get to that automation, to get to that visibility?

Erik Nost

>> Absolutely. So, it's fear that when you're going to automate something, that it's going to break something. Tons of examples over the past year about what can happen if you automate things and automate changes, automate updates to maybe an agent on a-

Rob Strechay

>> Having to sit in the Delta Sky Club for three hours, I can tell you that-

Jackie McGuire

>> I got stuck in Chicago-

Rob Strechay

>> And that's a DevOps.

Jackie McGuire

>> No, North Carolina.

Rob Strechay

>> But, to your point, the automation, but go ahead.

Erik Nost

>> But, we've had all these processes for so long in patch management and change management and ITIL. So, it's just like the old school ITIL mentality of logging all these changes, testing everything. But, this is where now I'm going to mention AI, where I think maybe there's opportunity to get there. Because, if you start to look at not generative AI, but agentic AI and-

Jackie McGuire

>> Machine learning. Let's just call it machine learning, because there's so much of machine learning-

Rob Strechay

>> Traditional AI....

Jackie McGuire

>> that's not AI that actually works in security, I say is coming from a data scientist in security, we don't need large language models for syslog.

Erik Nost

>> No, we don't. But, what is interesting is if we can leverage those to start to learn, to start to test these things and start to generate expected behaviors and expected outcomes and what the security leaders are so hesitant to automate and have deeper actionability and automated remediation and so on, using AI to test these things to generate text around what they can expect if they were to automate these things and so on. So, I think that's where there is opportunity eventually.

Rob Strechay

>> I see it as being able to do a lot of the documentation portion of it as well like, hey, I want to not only, you see these things, I see these alerts come in, help me put that into a sensible place that I can give to a CEO, a CIO that maybe doesn't know what bucket to S3 hashtag-

Jackie McGuire

>> Or code annotation is....

Rob Strechay

>> simplify is.

Jackie McGuire

>> I am admittedly a terrible developer to work with because I don't annotate my Python code because I'm like, I know what it does, why do you need to know what it does? So, I would love a co-pilot that just sat with me and explained to other people what I was doing.

Erik Nost

>> To explain to people how vulnerable the code is that you wrote.

Jackie McGuire

>> Well, not just how vulnerable. Well, so I learned that the hard way because my CEO was a former Mandiant guy. So, when I handed him my first model he was like, you shouldn't have these 800 things hard-coded in here actually.

Rob Strechay

>> But, I think that to me seems like, we're at Axonius and Dean was just on and we were talking through about their use of AI under the hood. I gave him, actually props, didn't mention AI once in his keynote, which I was like, that takes a lot of restraint, because there's a lot of AI traditional, what I'll call traditional AI or ML under the hood that's happening. How do you see the next three to five years playing out? Because, they've announced their exposures and their identity. They're building out the platform and really covering more of these areas. How do you see the entire landscape? Is it going that direction where you're going to get a lot of these growing up platforms that are really covering a bigger part of the landscape, or is it, hey, we're still going to have a lot of these connectors that we have to build by hand and do these integrations into these multiple platforms or multiple data silos?

Erik Nost

>> I think you'll see both, and you already see it happening in the industry. So, if you're a security company that's really good at cloud, you specialize in cloud, that's what you start to see them make acquisitions or start to build out products that might be better at endpoint or better at identity or some of these other things. So, you can track the acquisitions that have occurred and start to see, well, some companies have their strong suits, and then they're going to either build or buy or integrate. So, I think that it comes down to build, buy, or integrate. And I think the trend that we're going to continue to see is integration, because that's going to be a lot easier.

Jackie McGuire

>> As analysts I know we make our careers on creating new acronyms. So, I just want to trademark POAR right now, which will be platform, orchestration, analysis and response, because that's where we're going to end up. Everybody's going to become a platform. And then, to your point, every platform is going to be specializing in different things and then all of a sudden you're like, wait a second, we need a platform for our platforms. And so it goes.

Rob Strechay

>> I agree, but I thought it was interesting where Dean was like, hey, we came up with CAASM back in the day. He has the Google search saved, which is pretty funny. Now that he's saying that they've crossed the CAASM, that came to me while I was sitting there watching.

Erik Nost

>> Pretty good.

Rob Strechay

>> Thank you. He's crossed the CAASM and moving towards that actionability. How do you see the future of this asset intelligence and cybersecurity coming together over time? How do you see this going into the future where they play and what they've been good at for the last eight years?

Erik Nost

>> So, when you get into visibility, I think about it a couple of different ways. There's breadth and depth. Because it's like, you want to know all the assets and you want to know what types of endpoints, identities one might have access to or what infrastructure is connected to the internet and all these other things. And that takes a wide view around different types of asset types, from network, to data, to devices and so on, but there's also depth. There's also understanding why this asset exists, who owns it, who's responsible for it, who's supposed to be doing patching or configurations on it.

Jackie McGuire

>> How it's configured.

Erik Nost

>> How it's configured. So, what's the state of that device right now? And I think one of the biggest challenges in that is the business value that that asset has. So, it's very difficult still. It's still pretty subjective to say, hey, this device is risky, or this cloud instance is risky because A, B, and C with these vulnerabilities, but what is it actually doing for our business and what is the disruption that we're going to have if it's owned for whatever reason?

Jackie McGuire

>> Tying risk to enterprise value is definitely something I've talked about a lot since I rejoined the analyst ranks. And I think it's something that a lot of security teams struggle with, because a lot of times we're talking about conceptual risk or risk avoided versus sales closed and revenue in. So, I hope that we continue to focus on that and getting better about talking about the dollars and cents behind the risk that we're saving our companies, not just making you check an extra box before you sign into AWS.

Rob Strechay

>> Totally agree. Well, I think that's a great place for us to leave off. Thanks Eric for coming on.

Erik Nost

>> Absolutely.

Rob Strechay

>> First time, not last time. Glad to have you on here and glad Axonius could bring you by. So, thanks for joining us.

Erik Nost

>> Awesome. My pleasure. Thank you.

Rob Strechay

>> And thank you guys for watching this Axonius Adapt 25 live from Dallas. We'll be back with more, and we're going to keep digging in on these themes and getting you the story from here live on theCUBE. We're the leader in tech analysis and news. Stay tuned.