Black Hat USA 2024 | Ric Smith | SentinelOne

theCUBE.net

Clips
More from Black Hat USA 2024

Ric Smith

CTO

SentinelOne

play_circle_outline Risk management and policy changes

play_circle_outline Security challenges post-incident

play_circle_outline SentinelOne's response to customer concerns

play_circle_outline Impact of policies, liability, and compliance on the industry

play_circle_outline Revolutionizing Security: AI, GenAI, Cloud Vulnerabilities, and Data Lake Market in Next 20 Years

play_circle_outline Resetting platforms for distributed computing and generative AI

Info
Transcript

Ric Smith | SentinelOne

Ric Smith

CTO SentinelOne

Discussions in the cybersecurity community focus on organizational threats. The recent incident underscores the importance of good engineering practices and risk management. There is a growing emphasis on product interoperability and multi-vendor approaches for improved security. Rick from SentinelOne discusses the impact on customers and security strategies. Companies are revising their security tactics to include endpoints, identity, and compliance. GenAI and advanced technologies are transforming data protection and risk management talks. SentinelOne's Pur... Read more

explore Keep Exploring

What is the coolest thing John Furrier has learned this week? add

What have the last two weeks been like for you? add

What kind of measures does the company have in place to ensure the safety of its customers in case of a deployment error like the one that took out many endpoints? add

What potential issues might arise in terms of liability caps and insurance premiums for companies utilizing multiple vendors, including SentinelOne? add

What are some of the common challenges and concerns faced by brands when engaging with new technology, particularly in terms of cybersecurity and data management? add

What trends and changes are CISOs currently seeing in the technology landscape, particularly in relation to distributed computing, cloud services, and data management? add

bolt Powered by CUBE AI

Ric Smith | SentinelOne

search

Savannah Peterson

>> Good afternoon cybersecurity community, and welcome back to Las Vegas, Nevada. We're midway through our two days of coverage here on theCUBE. My name is Savannah Peterson, delighted to be joined by John Furrier and a very special guest. John, what's the coolest thing you've learned this week?

>> Well, we learned that security is still top of mind, built in from day one. Products sprawl continues to happen. More threats are out there. It's not stopping and Gen AI is causing the bad actors to get-

Savannah Peterson

>> The velocity is palpable....

>> more action.And so the platform conversation continues leveraging existing tools. And it's a real risk management show in my mind. It's turning into, what's the risk profile and how do we stop the surge?

Savannah Peterson

>> Yeah. And what better guest to have talk to us about it than Rick from SentinelOne. Rick, thanks so much for taking the time.

Ric Smith

>> Thank you for having me. Lovely to be here.

Savannah Peterson

>> We've been talking about your popularity at the show. I just have to ask, big incident two weeks ago. All eyes on cybersecurity right now, even if you knew nothing about cybersecurity before. So many people impacted. What have the last two weeks been like for you?

Ric Smith

>> Very interesting. Very, very intense. I think the fallout for us was more around our customers reaching out to us and saying, "How vulnerable are we to this?" Fortunately we have very good answers to that in terms of how we structure our deployments. We do phased rollouts, so it's very easy for us to detect issues on an update going out. And that's something that I think is obviously a sensitive topic around it and was definitely something that was missed in that deployment that took out so many endpoints. But a lot of it's just been appeasing them, helping them get an understanding, you're safe with SentinelOne. We've got your back. You don't have to worry about this. And I think for the industry, it's a revisiting of what are good engineering practices in terms of how do we keep customers safe when we make changes to their environment and the endpoints in their environment. It's one of the most sensitive apparatuses we can update, particularly if you're operating down at the kernel level.

>> One of the big things that came out of that too and the conversation we're having here is that obviously a lot of products out there, a lot of vendors, a lot of customers, a lot of tools. Product interoperability and integration is a big topic. How has the market dynamics changed between the vendors? Because now you had that incident, which shows the disruption kind of felt like Y2K should have happened. We felt it. Normal people were exposed.

Savannah Peterson

>> Oh, it was a Y2K moment. Straight up. Yeah.

>> It crashed at that kind of scale, and it still was the tip of the iceberg. So the market dynamics from the customer standpoint and the vendors, what do you see? What's the blowback there?

Ric Smith

>> Well, I think it's less of a direct question about interoperability and more of a question around there used to be a defacto in the board level conversation about how you secured your enterprise, and obviously that's come to question. And CISOs, CIOs are being asked, "What's the alternative? What are you going to do about this?" I also think it's the all-in approach is definitely something that's revisited. It's not just going to be endpoints; it's going to be identity, other solutions. Just because the robustness of how you deal with reliability in the enterprise is now in question and everybody's revisiting that. So I think you're going to see a lot of two-vendor approaches in terms of balancing that and not putting all of your eggs in one basket.

Savannah Peterson

>> Yeah. And probably multi-endpoint solutions, because nobody wants to just be siloed.

Ric Smith

>> Yeah. I mean, that's a lot for security teams to operate, but I think we're headed down that path pretty quickly. So you'll probably see segregation of the assets within the enterprise with different endpoints on them.

>> It's interesting, we covered this last year. I think you were on theCUBE at the event where there was a law that just passed, if there's a breach, you have X number of times, days to submit a report. This was not a breach, it was disruption, but it had a similar effect. What is your take on what policies change? Because it used to be, "Hey, CISO, trust me, it's all going to work," to now we have structure around what we do, liability, policy. You're seeing a lot more effort going into here's how we run things and documenting it. How has that changed? How do you see this impacting and ultimately multi-vendors a big part of that?

Ric Smith

>> I mean, it'll get pretty complicated. So I think from a liability perspective, most MSAs will be challenged in terms of liability caps, so that's probably something that's going to get a revisit. Who knows how far that actually swings. General insurers are going to put their own position in terms of what the premiums are as a result of your vendor portfolio, not just the vendor that you use. It used to be very easy for you to work through that. And then obviously we've got the federal government now digging into this and I'm sure that there'll be an outfall of that as well; yet to be seen what that is.

>> As the chief product and technology of SentinelOne, you guys certainly will pick up probably some business from this effort. So you probably see that happen over time. But what has it done for the product? Because with all these regulations and now compliance and policy, it's kind of a moving train, because there's a product led growth market going on, and the products are in transition because the market's shifting with GenAI. So there's a lot of industry pressures going on relative to how the platforms will work. It's the data problem. Security is about data and risk. So as the data starts to change with generative AI, the data structures, and the data platforms, how do you put a box around that and say, "We did it yesterday, now it's changed"? It's kind of a moving train. How do you rationalize that?

Ric Smith

>> Let's unbundle a couple topics there. I think when it comes to the endpoint discussion, which is probably the more pertinent discussion in terms of review of how you transact with vendors, what's your approaches from an insurance perspective and liability perspective, I think that's actually a well solved problem. What we have here is lack of adherence to basic principles of engineering, so phase deployment, tiered deployment in terms of customer risk. It's really managing how you put change into those environments, and that's industry standard. If we're talking about the data aspect of it, I think it lays into the multi-vendor solution because you can imagine that there'll be multiple sensors out there, multiple forms of telemetry. They all need to go into one aggregate space. Obviously they're going to pick their select data lake or SIM to sit there and connect to that. And then the intelligence aspect of it is the thing that you layer over top of that. And you're really not going to get scale unless you can actually co-locate all of that into one mechanism. Now the good news is that's not operationally risky compared to what we've seen with the endpoints, because this is not perforated on your laptops across the enterprise or your servers or your revenue generating environments. This is isolated to a data lake that can go up and down and flex and not impact those environments. What you lose is visibility and detection. And not a great thing, but you're not going to shut down the company as a result of that.

Savannah Peterson

>> Right, right. And your end customers, whoever they might be, have that comfort at least.

Ric Smith

>> Yes. Now going to policy, the real risk in terms of putting those apparatuses in place is how are you hearing the PII, PCI compliance and things of that nature and making sure that those models don't evolve in the wrong direction.

Savannah Peterson

>> How is AI and GenAI playing a role in the conversations you've been having over the week or the last couple of months?

Ric Smith

>> We have a pretty well-vetted solution that came out a few quarters ago, Purple AI. It plays a significant role in terms of how we operate as a business. If you actually venture down to our demo booth, we have a mortal versus machine demo where we actually pit people against the machine in terms of a threat hunting activity.

Savannah Peterson

>> That's fun.

Ric Smith

>> So one group of people, they use the standard language and interfaces that we've got. The other group of people actually operates it through Purple AI. And we've yet to see a mortal actually beat the machine in this case. So it's very conducive to helping security engineers up-level their game, get to the bottom of their backlog, actually manage the workload that they continuously are burdened with. So we think it makes companies more efficient from a security standpoint, and ultimately makes them safer because they're getting further down that alert backlog.

Savannah Peterson

>> You get to work with a lot of different companies across verticals. Are there any trends within those verticals that you're seeing in terms of their approach to security? Is everyone on the same page? Tell us.

Ric Smith

>> I mean, it varies widely.

Savannah Peterson

>> I had a feeling it might.

Ric Smith

>> Different industries have their different point of view. And then if you look at the stratification of the market just based off of what they can do economically in terms of the team that they develop, there's different sizings. Our SMBs generally would try and take on as much of the platform as possible because it's shrinkwrapped for them to be able to use, particularly when we're looking at VMS's B channel. But as you move up, then it's like people are trying to pick best of breeds or use our platform as a hub to actually bring other vendors together.

Savannah Peterson

>> So kind of all over their security journey.

Ric Smith

>> Yes. I think there's a lot of different views in terms of methodology.

Savannah Peterson

>> What are some of the most common vulnerabilities or risks that you see when you start engaging with a new brand?

Ric Smith

>> I mean, honestly, it depends on the environment. I mean, cloud misconfiguration still dominates everything, so that's a matter of human error and then trying to clean that up. And then once you get through that, then you can actually start looking at actual vulnerabilities, CBEs that are out there that need to be reconciled and patched. And then the next level is really looking at lateral movement and detecting actual threat actors within your environment. But that first tranche ultimately stops the second tranche, and it's still where the boatload of work is.

>> You get to talk to a lot of CISOs, a lot of customers. Also you have the internal facing teams engineering products, so you got to kind of have the keys to the kingdom on the product engineering side, as well as looking at the customers. CISOs that we talk to and that we do surveys with, mainly on the qualitative side, it's clear that there's a reset going on. They're looking at the distributed computing paradigm, which is evolving quickly, cloud, public cloud, on-premise, and edge, and the data layer changing radically with generative AI. They all kind of have this mindset of, "Let's reset the platform for the next 20 years." There's a lot of engineering going on. Data science has been around, got analytics; that's not going away. But data's being kind of decoupled from the database and that's changing the data lake market. How is those conversations going with you guys and the customers? What does that look like? What does that whiteboard look like when they say, "Okay, I want to have a true enterprise. Data's got to be highly available, horizontally scalable. Generative AI apps are going to have intelligence in them. Open table formats are coming. Governance catalogs are now the key sweet spot." A lot of stuff is in flux. What's the whiteboard look like? What do you guys talk about with customers, and what are they thinking?

Ric Smith

>> The last stat that I looked at, only about 15% of workloads had been migrated to the public cloud. And so when you look at that, there's still a strong pull in terms of on-premise private data center management. There's definitely a barrier in terms of integrating visibility across those environments, and they're looking for a solution to do that. And I mean, that's really our bread and butter. So we look at it from an on-prem perspective. We look at it from a public cloud perspective. We can look at traditional endpoint. We look at it from a cloud perspective. And we can manage multi-cloud environments for you in terms of you being able to understand your posture and lock them down in terms of runtime protection. I think that as you evolve down the AI track, there's a lot of purchasing of hardware for those private cloud environments. And on top of that, there's a growing concern about data as an asset. People had loosened up on it for a while and were pumping into the cloud. So there seems to be a little bit more consternation about that motion. I don't know how long-lived it'll be because you also have the friction of supply. Getting access to all the GPUs that you need and all the machinery to run in those data centers is becoming growingly difficult. You've got these large scale vendors, the hyper scalers that are providing those amply. So I think there's a strong tension; I don't think there's an answer yet.

Savannah Peterson

>> I think that was well stated. And I do, I think you can agree or not agree with me, but I think we're going to see that tension for a little bit still.

Ric Smith

>> For sure.

Savannah Peterson

>> I think we're looking at another 18 months of people figuring it out.

Ric Smith

>> I think it's probably well past that.

Savannah Peterson

>> Yeah.

Ric Smith

>> I mean, this is definitely a moment of when the web came, mobile came. It's a change in terms of how we interact with devices and whatnot. But in terms of the vetting of the use cases, I mean particularly if you're looking at the earnings reports in the market, there's still a large capital deployment going on and not a lot of return, which really leads you to believe that they're still looking for answers in terms of what are we actually solving.

Savannah Peterson

>> Still R&D essentially in a lot of cases or micro-use cases that are getting built out of it. I think it's really interesting. In doing my homework for you, there's some investment publications who are very hot on y'all right now, both in lieu of the incident, but also in terms of your growth. What's next for the company?

Ric Smith

>> We are on a track to be more competitive in cloud, so obviously we're positioning against some of the more dominant players there, one notable. And then in the AI SIEM space, we've reran in our data lake to be AI SIEM, which is more apt in terms of representation. So we're actually moving quickly this year to start taking on next generation SIEM takeouts, which really repositions us in terms of competing with Splunk and other vendors in that space.

Savannah Peterson

>> So more and more and more market share.

Ric Smith

>> Yeah. Yeah. And I mean, when it comes down to it, we started off in EDR, an endpoint. The dominant data that you actually put into those kind of apparatuses is EDR, so it just makes it easier for the customer. They're not having to move it around. It's their residence, and then they can pair it and correlate with any other data set that they want to enter into the data lake.

Savannah Peterson

>> Yeah, it's pretty sweet. All right, I ask the smartest of our guests this question because it's nice to have your futurism perspective. When we are sitting down at Black Hat next year, what do you hope to be able to say that you can't say today?

Ric Smith

>> How about what I don't want to talk about next year, which is reliability and scalability. I would love to put that conversation behind us all at an industry level, just because it's just not great for the cyber community in general. People are always already reticent about cyber in general if they're worried about threat actors. It's a scary space, particularly when you know too much about it. So add this uncertainty, it's really just not good for us in general.

>> The problems don't go away.

Ric Smith

>> Yeah, I'd love to see that go away. I mean, I would imagine that Black Hat next year is probably going to have a stronger look in terms of how we are locking down from a data perspective, what's trafficking in our environments to these LLMs. But in there, I think you're going to see a little bit of play in terms of the shift of where the models live. You'll probably also see a large component of starting to own that lifecycle. If you look at the whole shift left apparatus around data science and how you manage that, it's pretty anemic, and that's not something that's ever been safeguarded. And it's not only important now from the perspective of cyber, but it's also just important in terms of engineering and making sure that you have reliability around that. Because it's been, I'd say, pretty shoddy in terms of the broad market.

Savannah Peterson

>> It's table stakes at this point, I feel like.

Ric Smith

>> Yes. There's a lot of maturity that has to happen there.

Savannah Peterson

>> Yeah. Great. Well, hopefully we've solved that, and the whole market dynamic has risen above that conversation so we can be focusing on more fun and sophisticated things.

Ric Smith

>> I completely agree. I completely agree.

Savannah Peterson

>> I love it, Rick. Thank you so much for taking the time to hang out with us.

Ric Smith

>> Thank you for having me. Always a pleasure.

Savannah Peterson

>> This was awesome. John, always a joy. And thank all of you fine human beings for tuning into our two days of coverage here at Black Hat in Las Vegas, Nevada. I'm Savannah Peterson. You're watching theCUBE, the leading source for cybersecurity news.