CrowdStrike Fal.Con 2025 | Kanaiya Vasani, ExtraHop

Clips
More from CrowdStrike Fal.Con 2025

Kanaiya Vasani

Chief Product Officer

ExtraHop

play_circle_outline ExtraHop focuses on network detection and response solutions beyond traditional definitions.

play_circle_outline Pain points for CISOs include detection gaps and alert fatigue in SOC operations.

play_circle_outline Enhancing SOC Workflows: The Impact of ExtraHop and CrowdStrike's Integration on Customer Security

play_circle_outline Development of identity awareness for investigating compromised credentials and token theft.

Info
Transcript

Kanaiya Vasani, ExtraHop

Kanaiya Vasani

Chief Product Officer ExtraHop

The energy at Fal.Con 2025 is electric, and theCUBE is at the center of it all. In this exclusive conversation, ExtraHop’s chief product officer Kanaiya Vasani joins Rebecca Knight and Dave Vellante to break down why the network is now the frontline of cybersecurity. From stopping attackers hiding in plain sight to redefining how SOC teams operate alongside CrowdStrike, Vasani explains how ExtraHop is changing the game.

He reveals why decryption at scale and protocol-level insight are critical to spotting stealthy moves, how AI-powered agents are trans... Read more

explore Keep Exploring

What is ExtraHop and how does it complement the services provided by CrowdStrike? add

What are the common pain points that CISOs and customers are experiencing regarding cybersecurity? add

What are the current challenges faced in Security Operations Centers (SOCs) and how can network telemetry help address them? add

What role does an NDR platform play in investigating compromised credentials and the associated activities within an infrastructure? add

bolt Powered by CUBE AI

Kanaiya Vasani, ExtraHop

search

Rebecca Knight

>> Hello everyone, and welcome back to theCUBE's live coverage of Fal.Con 2025 here at the MGM Grand. I'm your host, Rebecca Knight, alongside Dave Vellante, my co-host and analyst. I would like to welcome back to the show, Kanaiya Vasani, chief product officer at ExtraHop. Thank you so much for coming, for returning to theCUBE.

Kanaiya Vasani

>> My pleasure being here again. Great to see you both, and looking forward to our conversation.

Rebecca Knight

>> So, to refresh our viewers memory, why don't you tell us a little bit about ExtraHop, and how it complements what CrowdStrike does?

Kanaiya Vasani

>> Yeah, so ExtraHop is a market leader in what we would call network detection and response solutions. Our definition of network detection and response is far more expansive than the traditional view, which was doing behavioral analysis of network traffic. We think of network detection and response as a platform that enables all kinds of use cases that depend on network telemetry, use cases ranging from observability to threat detection, to application performance assurance, to gathering forensic evidence in your infrastructure, doing identity investigations, cloud investigations. So, we have a pretty broad view of what a network detection and response platform does. It's not too unlike what CrowdStrike has done in the endpoint detection and response space. EDR started out as a complement to AV and DLP, and other agents on an endpoint, focused on advanced behavioral analysis of things happening on the endpoint. But over time, that whole EDR category expanded to take over all the other point products in that endpoint security space. So, we are to the network what CrowdStrike is to the endpoint. We have a great partnership. There is six different areas of integration between CrowdStrike and us, and we just continue to do more together, to make the lives of our customers, particularly the practitioners in the SOC, as easy as possible.

Dave Vellante

>> So, how does that manifest itself in the product? I think about CrowdStrike, it's got the sensor, or an agent, a lightweight agent. It's got a lot of data. What are the similarities and differences in terms of the product architecture?

Kanaiya Vasani

>> Yeah, so they have an endpoint agent that collects telemetry from the endpoint, feeds any anomalous behavior they see from an endpoint standpoint into a SIEM, and now they have a next-gen SIEM product as well. We do the same. We have sensors that are deployed across your hybrid multi-cloud footprint, physical sensors, virtual sensors, cloud-hosted sensors. We collect telemetry from the network, so we see everything that goes through your network. We parse all the packets that are going through, L2 through L7. We baseline what is normal behavior in your network at every layer of the stack, so, at the packet flow layer, at the session layer, at the application transaction layer, and then we start to look for potential anomalies, and we feed it into a next-gen SIEM, including CrowdStrike as well. Now, for a person sitting in the SOC, if they see alerts or detections from the endpoint and from the network, and if they are able to correlate that, then they have much more confidence in whether something is truly malicious, or we are just dealing with false positives. So, that's where it all comes together.

Dave Vellante

>> I'm merely not a network guy, but I've been around a long time. So, I think about the north-south traffic. I remember talking to Jayshree Ullal, early on last decade, and she laid out their premise, which was traffic's going to start going east-west. And I was just talking the other day with the head of NVIDIA's networking, and it's now scale up, scale out, scale across. So, the network is constantly evolving, and all of this is a result of AI, building AI factories, as there was kind of marketing term, and then connecting these data centers, so, they're in the racket. So, the network continues to evolve. What does that mean for security, and specifically ExtraHop's approach?

Kanaiya Vasani

>> Yes, I think one of the things we have seen since we last spoke a year ago, the trade craft has evolved significantly. So, what you're seeing is compromised credentials are the number one attack vector. Network breaches are the second-largest attack vector, as bad guys are trying to get in. And the minute they are in, they start to move laterally aggressively, doing reconnaissance, enumeration, and just trying to get to the crown jewels, data staging, exfiltration. So, I feel like the detection battle has shifted from the endpoint as the battlefield to the network as the battlefield, because the bad actors are going in as legit actors and moving around, and the network is the only place you can find them. So, the importance of network detection and response has certainly gone up. The other thing that is happening is just, if you look at the east-west corridor, the scale requirements on the east-west corridor are very, very high. I have customers who have 400-gig interfaces in their Arista switches. You talked about Jayshree. Broadcom just launched in switching fabric, the Tomahawk 102 terabits per second switching, right? So, what are you going to see? You're going to see Arista, Juniper, and Cisco come out with 1.6 terabit ethernet interfaces on their switches. So, that's the scale you need to operate on that east-west corridor, if you want a baseline behavior, and then flag anomalies.

Rebecca Knight

>> When you're talking about this modern NDR and the capabilities, and the improved and really unparalleled visibility, what are security teams able to see now that they couldn't see before? What exactly is it?

Kanaiya Vasani

>> So, let's double-click for a second into the trade cloud. You got a stolen identity. You get in, you start to enumerate what's in the different parts of your network. Then, you start to do these remote shell executions over existing binaries, right? So, all the time, whether it's your identity, or the protocols you're using to move around, you are using existing living-off-the-land techniques, and you are hiding in plain sight. So, I think one of the challenges on that east-west corridor, scale is one challenge. The second is your ability to go deep into the protocol stack, and understand every single protocol, baseline that, and see whether this is a normal sysadmin trying to run a remote shell, or is this a bad actor trying to run a remote shell, and hence do something malicious on that other endpoint they are trying to get to. Now, what makes this even more complicated is all these protocols are encrypted. So, if you can't decrypt this traffic at scale, you can't see anything. You might say, "Hey, there's a phone call from Beijing to Moscow, but who is having that phone call, and what's being talked about?" You can't see any of that. So, our ability to go in and decrypt this traffic at scale, without being a man in the middle, there is an offline way of getting session keys, and then decrypting this traffic. We are able to look inside, and we are able to see what PowerShell script is being executed on the other side. We are able to see what parameters are going with those PowerShells. We are able to see if we see some behavior that might be an attempt at obfuscating defenses, like Base64 encoding. So, we will look at all that, and then, with confidence, we'd flag that, "Look, your existing binaries and protocols are being used in a malicious fashion to move around your infrastructure."

Dave Vellante

>> Let's see, what can't you see when you decrypt the traffic? Or maybe you said it another way. How do you ensure that there's no leakage of that data to, like, the hyperscalers will talk about their enclaves, and even they can't actually see it, but the machine can see it, if that makes sense?

Kanaiya Vasani

>> Yeah. So, what happens is, we get session keys from Active Directory domain controllers, or from F5 load balancers if you are doing TLS encryption. We store the session keys and the encrypted packets together. And only when you are trying to do a detection are you applying the session key to look at the packets, and then that data is discarded. So, data is stored at rest in an encrypted format. The session keys are used only when you are trying to look for potential malicious behavior, or if you're trying to show a PCAP on the screen for customers to do more diagnosis.

Dave Vellante

>> I see. So, they're always encrypted when they're at rest?

Kanaiya Vasani

>> Correct.

Rebecca Knight

>> From your perspective as a chief product officer, I mean, obviously, we're here at Fal.Con 2025, and you're having lots of different conversations with CISOs, with customers, and potential customers. What are the pain points that you are hearing from them over and over again?

Kanaiya Vasani

>> Yeah, so two or three pain points come up. One is this gap they have in detection, right? Because they have deployed all the different security tools out there, and they are still getting hacked. So, clearly, there is a gap, and we are looking to fill that gap, at least by providing them yet another window into what is happening in their infrastructure through network detection and response. The second big pain point is, it's the traditional alert fatigue in the SOC. "Dwell times are shrinking. How do I speed up my workflows in the SOC?" And the conversations we have with them is, take all the network telemetry, and the network context we can bring to the table. And that's what we are doing, by the way, with CrowdStrike. Everything we know about a device is packaged up, available to CrowdStrike, in their Falcon store, or their next-gen SIEM, through an API. If they are investigating an alert associated with an IP address, we can give you the full blast radius of that IP address, so you know what is the scope of your investigation. So, that really helps speed up the SOC automation workflows. So, that's the second big pain point that comes up. The third is, whenever there is a ransomware event in the network, if you talk to the IR teams, the first thing they're going to come in and say is, take the network offline. But you can't, it is the lifeblood of your infrastructure. So, where we can help is, because we know exactly what happened at that particular time during that window where you had the ransomware event, if you know where the guys got through, what is the endpoint they got in through, we can tell you, during that window, this endpoint was communicating with what other endpoints in your infrastructure, so we can narrow down the scope of your IR efforts. We did that in a very large customer. They were managing the entire city infrastructure for one of the largest metros in the country, and the IR team came in and said, "Shut it down." And these guys are like, "Garbage trucks can't move, libraries can't operate. I can't do anything." But they had extra help. They were able to narrow down the scope of the breach to a library network. They brought that down, cleaned it up. They were up and running in no time. So, that is the third element. Because security is important, but it can't come at the cost of operating the business, so you need to strike the right balance.

Dave Vellante

>> So, this vision that CrowdStrike's putting forth of the agentic SOC, can you explain how ExtraHop plugs into that?

Kanaiya Vasani

>> Yeah, no. Look, I think this is a... And George talked at length, right? The bad guys are using AI in a big way. MIT just did a survey. 80% of the ransomware campaigns have used AI in one form or the other, mostly GenAI, for very targeted phishing campaigns and stuff. And we need to get better at using the technology as well. So, I think this whole notion of an agentic workforce is a great idea. We have been having these conversations for the past 12 to 18 months, in terms of AI moving from a driver-assist model in the SOC to an autonomous, Waymo-like model in the SOC. The whole maturity thing George talked about, we have been talking about that as well. So, we have an AI assistant in the product. You can pull whatever data you need from our system through that AI assistant. We have had these smart triage and smart investigation capabilities in the product for a couple of years now. We are evolving them into an agentic workflow. So, now, a CrowdStrike triage agent can query an ExtraHop triage agent, and get the necessary information they need to make a more informed judgment on a particular alert and its priority. So, I think that agentic roadmap that we have lines up very well with CrowdStrike's roadmap. We are taking all the data, we have all this rich telemetry we have, and opening it up through building out an MCP server interface. So, you can have an LLM query for whatever information you need. So, let's say somebody is using Charlotte AI, and Charlotte wants to query network data. They can do a query to our MCP server, and pull the required data out there. So, the idea is to make sure that that network context is available to the next-gen SIEM and SOC as easily as possible, and as well-packaged as possible, to help speed up the SOC workforce. Really, that is the end goal. Can you operate at the speed of AI, and counter the adversaries who are already leveraging AI in a big way?

Rebecca Knight

>> So, looking ahead, in the next three to five years, what's your vision for how network detection and response evolves, and really finds its place in the future of cybersecurity?

Kanaiya Vasani

>> So, as we look forward, there is a lot of work we are doing on the scale axis, because when you have 102 terabits of fabric, you need to keep up with that, and the sensor architecture may look very different. So, that is one place where we are spending a lot of time. Machine learning at scale, a lot of other NDR vendors sort of started out building appliance-based AI. They have these big brains sitting on-prem, and I think that that whole thing about on-prem versus cloud, when it comes to machine learning and AI, that has been litigated and the jury is already out there. You have to leverage the scale of the cloud. So, we will continue to do more in terms of cloud-scale, ML, and AI in the infrastructure. The third place where we are spending a lot of time is in what we call detection efficacy, because the big problem with any detection and response system is they tend to be very noisy. So, the more we can dig into the context, the more we can look deeper inside what's happening in your infrastructure. We can give you alerts with a lot more confidence, low, very high, true positives. So, we are also identity-enabling the entire NDR platform, because folks are coming in through compromised credentials, and we believe that an NDR platform is the best place for you to investigate what happened in your infrastructure after you had a compromised credential. You have a lot of ITDR systems that are going to tell you that there's something wrong, some identity was compromised. But to investigate that, and see how they moved around in your infrastructure, where did they stage the data, how did they accelerate the data? And NDR is the best place to do that. So, we are investing a lot in terms of the identity roadmap for an NDR, investing a lot in cloud-native architectures, and visibility into Kubernetes and containers, and giving you observability and detection and response there as well. Last, but not the least, I think the next frontier is going to be, not just login credentials, but token theft. I mean, you already saw the NPM outage, and we have a token theft detector in our product today. We are doing a private preview with some customers. There is a lot of interest there, because even with AI, when you have these MCP servers opening up your data walls to these LLMs, the authentication is happening through OAuth. You're granting access tokens, and what if somebody steals those tokens? I mean, it's game over. So, we are doing a lot of work in non-human identities, and these service tokens and access tokens, and just providing security for that.

Dave Vellante

>> You scare me. Should we stop using OAuth?

Kanaiya Vasani

>> Look, I think use it, but make sure you're protected.

Rebecca Knight

>> Okay. We're going to end right there, before we all break out into hives. Thank you so much, a great conversation.

Kanaiya Vasani

>> My pleasure, really enjoyed it.

Dave Vellante

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight, for Dave Vellante, stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.