CrowdStrike Fal.Con 2025 | Michael Nicosia & Michael Callahan, Salt Security

Clips
More from CrowdStrike Fal.Con 2025

Michael Nicosia

Co-Founder & COO

Salt Security

Michael Callahan

CMO

Salt Security

play_circle_outline Safeguarding the Future: Salt Security's Mission to Protect APIs and Sensitive Data in AI-Driven Applications

play_circle_outline Navigating the Surge: Securing API Traffic Amid AI Growth and Evolving Data Protection Challenges

play_circle_outline Vision for creating a digital representation of enterprises through AI.

play_circle_outline Forward-thinking CISOs acknowledging API security as a major blind spot.

Info
Transcript

Michael Nicosia & Michael Callahan, Salt Security

Michael Nicosia

Co-Founder & COO Salt Security

Michael Callahan

CMO Salt Security

Fal.Con 2025 remains very much underway as theCUBE’s Rebecca Knight and Dave Vellante are joined for an exclusive interview with Salt Security’s Michael Nicosia, co-founder and COO, and Michael Callahan, CMO. The conversation zeroes in on how API and AI security intersect as organizations adopt agentic AI at scale. Nicosia explains Salt Security’s mission to discover, govern and protect APIs and AI traffic, noting APIs power roughly 85% of apps and now sit beneath fast-growing AI agent workflows. The team breaks down MCP and A2A protocols in practical terms, ... Read more

explore Keep Exploring

What is the focus and purpose of Salt Security since its inception in 2018? add

What impact has the introduction of AI agents had on the traffic generated by API calls and the associated challenges of managing that traffic? add

What advancements are being made in the creation of digital representations of enterprises, and what challenges are being faced in this process? add

What is the current state of awareness and action regarding API security among CISOs? add

bolt Powered by CUBE AI

Michael Nicosia & Michael Callahan, Salt Security

search

Rebecca Knight

>> Good afternoon everyone, and welcome back to theCUBE's live coverage of Fal.Con 2025 at the MGM Grand. I'm your host, Rebecca Knight, alongside with Dave Vellante, my co-host and analyst. I would like to welcome two Michaels to the show. We have Michael Nicosia, co-founder and COO of Salt Security. Welcome, Michael.

Michael Nicosia

>> Thank you.

Rebecca Knight

>> Welcome back, I should say.

Michael Nicosia

>> Yes, yes. Privileged to be number two here.

Rebecca Knight

>> And Michael Callahan, he's the CMO of Salt Security. Welcome, Michael.

Michael Nicosia

>> Yeah. Thanks for having us. It's great to be here.

Rebecca Knight

>> So I'm going to start with you, Michael, and have you tell us a little bit about Salt Security.

Michael Nicosia

>> Sure. So we started Salt Security at 2018, and really simply just to secure APIs as well as now AI, which includes AI. But if you think about it, we basically help discover, govern, and protect against any potential malicious activity that might be happening with these bad actors that are trying to infiltrate these applications or these APIs. If you think about APIs, think about they come up with about 85% of applications. So think about a mobile app, a web app, microservices. All of these things are bound by APIs, and there's a lot of sensitive data, sensitive information that basically gets housed in these APIs that are beneficial for obviously these bad actors to try to infiltrate.

Dave Vellante

>> So is MCP the new API?

Michael Nicosia

>> Exactly. I mean, if you think about it, we were talking about this. To us, the AI agent is the new employee and the MCP, which is the protocol is the new brain associated because the new employee is trying to get information and the MCP protocol or A2A protocol is basically getting pinged to go and get that data and retrieve it. And if you think about that motion, that's all API driven. And that's why, again, we're able to not only discover, govern and protect against that as well.

Dave Vellante

>> We think a lot the MCP server, it's like an API broker is probably the best way to think about it. So the API goes to it after the agent is asked it to do something, and then it figures out, "Well, what do I do? Do I go to the Salesforce data source? Do I go to the internet? Do I go to this other database?" Whatever it is, and then brings that back and then figures out what to do with that. So it's really this broker that sits in the middle controlling this massive, massive amount of API traffic.

Dave Vellante

>> So this is a really important point. So it's not like ... The way I said it is wrong. It's not like MCP is replacing APIs, no.

>> No, not at all.

Dave Vellante

>> APIs are like now the plumbing that you guys have been involved in hardening.

>> Exactly. Yeah.

Dave Vellante

>> MCP allows agents to collaborate with each other on top of those hardened APIs. And then you've got MCP, which is Anthropic's sort of standard that they put forth, and now it's an open standard, and then HOA is from Google and you're securing both. Is that right?

Michael Nicosia

>> Yeah.

>> Yes.

Dave Vellante

>> And help the audience understand. I've not done the study, but just anecdotally, everybody is talking about MCP, it's stateless currently, correct? A2A is state full. Maybe you could explain from your perspective, even if it is anecdotal, what the uptake looks like. I mean, it's clearly a lot of momentum, what the use cases are for each and where you fit.

Michael Nicosia

>> Yeah, so the use case is the same, and it's the proliferation of APIs. If you think about you've got hundreds of thousands, billions of APIs. Now with AI or agentic AI or MCP and then A2A protocols, now it's like tens of billions in terms of the volumes that are potentially out there now. And if you think about MCP, just think about one-to-one, and when you think about A2A, it's agent to agent. So think about one agent trying to interact with another agent to get that information, and it just continues to grow and grow and grow from there.

Dave Vellante

>> One of the things that we've seen when we look at the amount of traffic, so you had these APIs when you ... Maybe you are using Uber to get a car, there's an API call that says, "Well, where are you? And then where's the driver? And is your credit card ..." So all those are all API calls. And in the past, that's how the applications would work and they would just call some data source or something and bring you back and answer. With the AI agents and the number of them that are going out there, and the number of data sources that the MCP server is going to, the traffic is increasing 100x. So where you had this almost unmanageable situation before because there was so much traffic, now you have a completely unmanageable situation and you don't know who are they talking to, what kind of data did they have? Are they secure? Are they being attacked? And you've got to get a handle on that.

Rebecca Knight

>> So paint a picture for what that actually means, 100x the traffic, what that means for organizations and their readiness to deal with that.

Michael Nicosia

>> We look at it as it's like how are you protecting that? If you can't protect one-to-one, how do you protect one to many? Right? And how do you protect this proliferation of APIs across your organizations? From a business perspective, I mean, we're talking to CISOs. I mean, there's productivity enhancements throughout, which is great, but the security of this is now paramount. And think about securing billions and billions of these transactions that are happening without, in some cases, without your awareness. And that's why for us, the visibility of the AIs and the MCPs, the protocols is so paramount because you can't protect what you don't know. So having that visibility from either a zombie API or a zombie MCP protocol server, we give you that visibility. So at least you're aware of all of this proliferation that's going on with the organization. And then how do you govern it? And then how do you protect against it?

>> I would say every customer that we talk to, we talk about the threat, we talk about the risk, they see how it's increasing. The very first thing they say is, "Just help me understand what I have. Just tell me what, because I have no idea. I have no idea where these servers are being launched. I have no idea where these agents are. Just help me understand it." So what Mike was talking about, that very first piece of discovering it, super, super important.

Dave Vellante

>> So this is so interesting because in 2023, George Gilbert and I wrote a breaking analysis using the metaphor of Uber for all. And the idea was, as you were just describing, Michael, you call a driver, you have a location, you've got a credit card, there's people, places and things. And we predicted that essentially AI is going to bring in the ability to create a digital representation of your enterprise.

>> Oh, yeah. Yeah.

Dave Vellante

>> And we had Uday Kiran Medisetty on, who was the head engineer who built that. Now, of course, there were no standards back then. Uber had to build this from the ground up on their own. And so now, what we're describing is actually what we described back then is coming true. Organizations are building a digital representation of their enterprise. They're speaking to their enterprise, if you will, in human language. It's got APIs that are hardened underneath that work. And now, there's all these agents talking to each other, they have to have access to tool, and we've got this new world. And it's a little scary, a lot of seams, and that's where you guys come to secure all this.

Michael Nicosia

>> Exactly. So it's a great analogy. There's a lot of seams that are unprotected. So what do you do? So if you think about bad actors, I mean, that's the first place they're going to look at. It's easy. So that's what we protect against.

>> I think one of the ways that we've described it, which it's an interesting thing in security, is about what you're going to protect. So you guys have these laptops, so you can see them, right? So you're like, "Well, I should probably protect that, so someone doesn't attack it." Have you ever seen an API? No. No one has, right? Well, some people have.

Dave Vellante

>> I have actually.

>> All right.

Dave Vellante

>> Really ugly.

Michael Nicosia

>> It's a piece of code, right? And so what we try to do, and I think this is right to what you're saying, Dave, is we say, "Think about it as this API fabric." There's this fabric that represents your entire organization and it's all of these points that are connected and moving, and there's an API here, an API there, but it's really this API fabric that you want to get a handle on. What does it look like? What does my fabric look like and where do I have risk and where should I focus or where should I not focus? But that idea of a fabric, people go, "Oh yeah, I get that now."

Michael Nicosia

>> And everybody has it. Sorry. That fabric.

Rebecca Knight

>> Well, in your conversations with customers, I mean, you're as CMO, but also as a leader of this company, and as you said, a lot of them say, "Tell me what I have. I don't even know." And so at least they're aware of their ignorance, which I guess is step one. But what are they worried about and how do you hold their hand through this without overwhelming them and keeping it simple and understandable, and also effective?

Michael Nicosia

>> Yeah, that's a great question, because we look at it in steps. So the first step is the visibility, and they understand that they're blind to this. It's a blind spot. So creating that visibility and that comfort around the visibility is super, super important. So what do you do after that? How do I control it? How do I govern it? What kind of posture gaps do I have that I can remediate really quickly? What are some of the potential severe things that I need to pay attention to? So those are step one, step two is that governance. And then step three is protecting against any potential malicious activity that might be happening. So we do it in steps, and I think the chewable steps, if you will, is a lot easier for organizations to understand how to take advantage of it. And then obviously, we're always there to help them through those steps.

>> I think a lot of what we hear they care about is data security. That's a big one. So how do I know that my data is not being someone's exfiltrating it? Like an API as we just talked about, it's just data. So in that API is this string that says, "Well, the customer ID is this." Well, that's pretty sensitive data that you don't have. Or maybe a Social Security number or a credit card. And they'll come to us and say, "I know I've got to protect this data either just because I think I need to, or maybe there's compliance regulations related to PCI or HIPAA or whatever. Help me do it." And so what Michael said is right on is it's that first piece is let's show you what you got, show you what your fabric looks like, and let's figure out where you've got some real issues or risk in your business and we can help you reduce them.

Dave Vellante

>> So to Rebecca's point about the awareness, and when I think about the history of, let's call it data protection and eventually security, I go back to the mainframe days. It was like, "Oh, that's secure, not to worry about that." And then PCs come along, and I remember nobody ever backed up their PC until they lost all their data and then they said they got snakebit. And that was the whole marketing of whoever did tape back up back then or whatever it was. And then security became this bolt-on and afterthought. I mean, clearly, it has changed, but has it flipped completely where people are so aware, customers are so aware that this is no longer cannot be a bolt-on because it's so risky? Or is it a ticking time bomb? What do you think? What are your thoughts on that?

Michael Nicosia

>> I think it's latter, unfortunately. I think there are some forward-thinking CISOs that already have the vision that we actually had in 2018 to create the API security market. So there are those visionaries that understand that this is a huge blind spot. And for us, it's just a matter of time. And I think with AI coming into fold and just the amazing momentum that it has, I think as the market continues to grow, it will get more of those, I don't want to say followers, but more of those individuals that will come and step up and say, "You know what? I really need to take advantage of this or take cover of this blind spot that I have." So I think it's getting better. We got forward-thinking individuals that have already taken care of it. Now, it's that laggard ... Not laggards, because that's the end, but it's the crowd mentality that are coming to the fold. And I think as the market continues to grow and get educated, it'll continue to prosper close.

Dave Vellante

>> And that data, it does come back to, you said the data, I don't think that's ever going to end. That's how it started. That's still what people are after. That's the currency. The data is a currency that someone can steal and then resell it or whatever. I think they still need to protect it. And they're still looking at it going, "How do I protect this data? How do I make sure that we're not held for ransom or whatever?" But that data's the key of all of it, because otherwise, why would you need security? You're protecting that data, that intellectual property. I think people are seeing it more. And I think with the AI agents now, I think they're going to become even more aware, like Michael's saying is those AI agents are accessing so many data sources that the data is going to be almost overnight at risk. You've got to do something. And I think that the CISOs we talked to, they go, "Yeah, there's a problem. We've got to do something about it." Yeah.

Dave Vellante

>> What's your relationship with CrowdStrike? What are you doing here? Where do you fit into the platform? Help us understand.

Michael Nicosia

>> Yeah. Now, it's a unique relationship. Obviously, they're a huge strategic partner of ours, but we're also a portfolio company through the Falcon Fund. They invested during our Series D, which is in 2021, and we've got a number of integration points from their XDR to their agent, their Falcon agent. So we can spin up our dashboard directly from their agent to integrating to their next generation SIEM where we can feed our telemetry to them so that our joint customers can get that visibility from an API and AI perspective. And then we're also starting to talk about what's next in terms of integration points from an AI perspective, and what would that better together story look like.

Rebecca Knight

>> So what drew you to CrowdStrike? I mean, we had George Kurtz on here the other day and he said, "Entrepreneurs want to sell to me." I mean, you're a portfolio company, but you're not quite there yet. But in the sense of I'm an entrepreneur, I get it, and do you feel that in the sort of the DNA of CrowdStrike?

Michael Nicosia

>> Absolutely. Absolutely. There's so much synergies between both organizations from a culture perspective, from a disruptive technology perspective, and from a vision perspective of where we want to move into. I mean, I'll have to give George a ton of credit, because he actually was super excited about API security and some individuals that we both know that we're talking about API security, and we actually met him in Israel with Michael Sentonas and several other individuals, and we talked about API security. He wanted to understand the vision where we were going, and then we kind of fell in love with each other, I'd say, and it worked out really well.

Dave Vellante

>> They invested, this is 2022, right?

Michael Nicosia

>> 2021. Actually, it was part of the Series D that we closed at the time.

Dave Vellante

>> Have you raised money since then?

Michael Nicosia

>> No, no.

Dave Vellante

>> This was your last round, right?

Michael Nicosia

>> Yeah, it was our Series D.

Dave Vellante

>> Was it 280 million you've raised? Is that about right?

Michael Nicosia

>> We've raised close to 300 million in total, and our Series D was 144 million led by CapitalG. And obviously, we included CrowdStrike in that, but we didn't need anything more, because we have enough money in the bank, so we were lucky enough to raise that much, and we're just riding the momentum now, which is fantastic.

Dave Vellante

>> It's a lot of dough, but it's not a lot of dough. I mean, you're a pretty capital-efficient business, especially in this space. You see some crazy raises. Explain that. How were you able to be so successful? Are you obviously generating revenue? I presume you're not cash flow positive yet, but-

Michael Nicosia

>> Not yet. Hopefully soon. I mean, to be honest, I think if you think about from an investor perspective, they usually invest in three aspects. They, first of all, look at the market. How big is that market? And everybody thinks that API security along now with AI is going to be tremendously big, where there could be multiple players being multi-billion dollar organizations that could play in that. I think the second thing is disruptive technology, and I think everybody that we talked to from an investment perspective understood that we had something unique in terms of what we brought to the table. And then lastly, it's the team. My business partner myself, this is my second startup. So it helps that you've done it before and you've been successful before. So I think if you mix all of those three along with an amazing vision of where you think you're going to go, I think people get pretty excited about that.

Michael Nicosia

>> I think our investors, we just had our quarterly board meeting earlier this week, they're super supportive. Super supportive of us, where we're going, what they see in the market. And as an investor, they get to see probably 100 times what we see just in our room, and they're like, "You guys are right on it. You're right there. Super happy what's going. Keep going. How can you go faster?" That's always the question.

Rebecca Knight

>> You guys are making it look easy. I love it. Michael and Michael, thank you both so much for coming on.

Dave Vellante

>> Thank you guys. See you again.

Michael Nicosia

>> Thank you so much.

Rebecca Knight

>> It was really great conversation.

Michael Nicosia

>> Oh, great to be here again.

Rebecca Knight

>> I'm Rebecca Knight. For Dave Vellante, stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise news and analysis.