Black Hat USA 2024 | Trish Cagliostro | Wiz

theCUBE.net

Clips
More from Black Hat USA 2024

Trish Cagliostro

Vice President Global Channels and Alliances

Wiz

play_circle_outline Impact of Generative AI on security and industry

play_circle_outline Architecting foundation for security with focus on data security

play_circle_outline The Urgency of Security Market Consolidation in Face of Evolving Threats and Future Challenges

Info
Transcript

Trish Cagliostro | Wiz

Trish Cagliostro

Vice President Global Channels and Alliances Wiz

Trish Cagliostro, Founder and CEO of RevWizards, discusses the impact of Generative AI on security and the importance of data security in the age of AI. She highlights the opportunity for cost reduction and addressing the security workforce shortage. Trish emphasizes the need for companies to listen to customers, leverage new technologies, and prioritize security in a rapidly changing tech landscape. She anticipates market consolidation and the emergence of new technologies to combat evolving threats. Trish aims to help companies accelerate their go-to-market... Read more

explore Keep Exploring

What are the challenges and opportunities in implementing GenAI technology in terms of data security and workforce shortage in the industry? add

What is your opinion on the importance of having a clear direction and strategy for organizational transformation in order to take advantage of the latest advancements in technology and data? add

What are some challenges faced by CISOs in the cybersecurity industry and what potential changes or advancements do they anticipate in the future? add

bolt Powered by CUBE AI

Trish Cagliostro | Wiz

search

>> Welcome back, everyone, to theCube's coverage here at Black Hat. I'm John Furrier, host of theCube two days of wall-to-wall coverage. We've got Savannah Peterson and myself digging into all the experts and the companies changing the game in security. A lot going on, a lot of problems being solved. A lot of things have happened in the past couple weeks setting the table. Trish Cagliostro is here, Founder and CEO of RevWizards, formerly with Wiz. Cube alumni. Great to see you.

Trish Cagliostro

>> Great to see you, John. Thanks for having me on.

>> Thanks for coming back. Well, I really wanted to chat with you because a couple years ago when we were at Wiz, we were at an Amazon event and we were riffing and then we had a separate conversation off-camera around how cloud really helped and how COVID really propelled this cloud security story. And now in this market, we're seeing a huge data play. We're seeing infrastructure at the silicon level getting faster. You're seeing kernel developers rise up and being more productive. All the best AI stuff is getting closer to the hardware. And so that's changing there. And then open source ecosystem is booming with Generative AI. So Generative AI has created this flash point where it's clear that this wave is happening. It's an opportunity but also a challenge for the industry. So I want to get your thoughts on that. What's your reaction to that? What's your perspective of the impact of Generative AI to security?

Trish Cagliostro

>> Sure. I feel like it's Cloud 2.0 for us. We have a chance to get it right this time in security. When cloud started, we pushed back a little. It took us a minute to get on board. Similar to COVID, GenAI has happened. The business has decided it's happening. Now we got to figure it out. And, of course, there's always going to be, when you think about how you can be successful with GenAI, at the end of the day, it's a data story, which there's some obvious follow through of naturally that means, well, probably a data security story. I always thought it was interesting when I was at AWS and I was working with customers, we'd talk to them about things that we wanted to do from a security perspective in their environment, and most of the time they'd be like, "I don't know what's in my environment." Ask customers, what's in their data, where it is, and who has access to it, the answer is a little scarier. The other thing I'd say too is I think it also is an opportunity beyond the challenge side. So that's the scary side. The happy side is that, I think I was joking about this earlier, but if we went downstairs and we made it into a drinking game of which vendors have on their marketing material a reference to the security workforce shortage, we probably wouldn't make it very far into the event before neither of us could stand. But what that tells us is that we have this huge opportunity in security to embrace it. Let's lead the conversation on how industry should be using AI. Cost reduction, great story. An even better one is how I've taken all of these tools and been able to take my two million person workforce shortage and ultimately be able to accomplish and have the talent that I need instead of having that big gap.

>> And I think the productivity angle on that is huge. I think the AI opportunity is going to be, where's the data? What can I automate? What's the heavy lifting, undifferentiated heavy lifting, to use the Amazon term? Two, what's going to help me do my job? How do I drive security posture and identification, discovery, mediation faster? That's going to be the key.

Trish Cagliostro

>> I think that's true. I mean, I think about myself and my friends will tell you, I'm always the last person to adopt technology. I was the go-to resume writer for all my friends. Let me tell you, ChatGPT is who I send them to now. I mean, even in your regular daily life, there's all these opportunities to help you do things much, much faster. And those are things that excite me.

>> You got the new gig going on. You were at Wiz. How long were you at Wiz for?

Trish Cagliostro

>> Three years.

>> So that was quite the ride. And obviously big news of the Google acquisition they turned down. Big success story, and what I want to get your thoughts on is, one, compare what Wiz did to what we're seeing in the market now because we're predicting, certainly, Dave and I thought was in our QPod, and certainly the research shows it, a lot of startups are going to come out of the woodwork soon and you're seeing existing startups at the crossover point where they're going to propel. So we haven't yet seen the breakout for that next big startup, but it will come and it'll probably look like Wiz. So the time to market value, even if you add GenAI, talk about resume writing, but marketing literature too. So going to market is different now. What are you going to see there and how do you look at that? Because you were a wizard at GoToMarket, hence the RevWizard name, your company. So Wiz was successful.

Trish Cagliostro

>> Just a little. No, when I think about Wiz, I think the thing that was really so unique about us is that to me it was this convergence, of course, amazing product unlike anything I'd ever seen in my career. Beyond the product though, there's a lot of great products. There was the timing. There was the size and growth of the market due to COVID. There was all these things that were converging to create this opportunity. And to me, if you had to say, what is the second most important thing beyond the product, it was our ability to execute. It was to be able to see those things that were going on and be able to capitalize on them. So what does that actually mean going forward? I think that every company that starts now, if I'm a startup that's been around for a long time, I now have to execute in a way that I never did before because every six months the whole tech stack is changing. I have to think about tech debt in a way that I never did before. Oh, by the way, it's also really expensive to build companies like that and to be able to execute and go as quickly as you need to. It costs a lot of money. So that means valuations rise. And so I think that as we're getting into this emerging market, we're just starting to see some of these secondary impacts and how it's going to change how we think about everything in how we go to market.

>> You do a lot of advising. You're working with startups and big companies. As you look at the show floor at Black Hat, and there's a lot of vendors shaking the tree trying to get cash out into their pockets with a product, what is your biggest advice? Because the market's in transition and people win in transition. This is a huge opportunity for the players in the industry, but the products are also transitioning. So you got market and product transition. What's the advice to companies because people are trying to figure that out?

Trish Cagliostro

>> I think this is one of the craziest things, but it's so weird. You've got to listen to your customers. Your customers are the ones who are ultimately telling you what their priorities are and what they need. If you have a product, if you're meeting your customer's demands and you're meeting their requirements and you're prioritizing them, that's important. That's always the most important thing that I tell startups. The other thing I would say too is take advantage of the new technology that is out there. I think not only are you seeing new startups come out, you're seeing traditional companies or maybe companies that aren't as new take advantage of these technologies, and it's a way for them to bridge that competitive gap. I always thought this was interesting. There's a big difference between being in the cloud and being cloud-native, and it takes a lot of work to really truly be cloud-native. It reminds me of that same example where companies now, if it takes me a really long time to rewrite into a cloud-native application, if I start to introduce things like AI, I can build things faster. It's a really great opportunity not only just for startups, but for big companies to really reinvent themselves in a way that is ultimately really beneficial to their customers.

>> It's interesting, we're seeing a lot of companies certainly trying to deal and rationalize their portfolio with security products as thousands of vendors, thousands of products. And risk management's key. So integration, interoperability, those are big factors, but a lot of the planning, thinking about the CISO and the executive business leaders and technical leaders is that they want to build a solid foundation for 20 years, 10 to 20 year horizon. And they're starting to have conversations that don't sound like they were before. It's complete refresh, complete rewriting. It's a systems architecture. So the whiteboards look a lot like a systems problem with data versus an analytics database problem. So you're starting to see that shift. What's your reaction to that? Because we're seeing the big companies have end-to-end workloads. They just don't have GenAI yet. They will.

Trish Cagliostro

>> They will.

>> Net new applications will emerge, but that has to have a different data model. Data has to be available. So the whole data scene is upside down. Data security, how do you architect that foundation in your mind while deploying the best security?

Trish Cagliostro

>> I think I'm a big believer and you have to know where you want to go. And you asked what my opinion is, it really excites me because I think for a really long time we've tried to band-aid together some newer stuff with some older stuff, and it puts us in the situation that we're in now where when you want to take advantage of the latest things today, it does require a larger organizational transformation. So to me, that's really exciting. And when you think about the data side of that, and if you start with this idea of, okay, I want to build this thing that is going to ultimately solve some problem for a customer, the idea is then, okay, well, let me think about, well, what kind of data do I have that is going to get me there? What do I need to answer those kind of questions? What are the data sets that I need to go get? Because chances are I might not have all the data that I need. I'll give you a funny example of this. So my toothbrush has AI now, apparently. It was used to make it more efficient, so does my husband's golf clubs. Those are data stories where, if you think about the golf example, they're collecting data on how people use clubs, how they hit them from all these wonderful hardware sensors that are out there to tract . And so I think that being able to understand what the types of data you are, and then what's in that data? Because it's one thing to say, 'I need this kind of data," it's a whole other thing to understand what's actually in it. So a good example of this is I think that as we think about architecting what we put in the data, being really thoughtful about not just the obvious use cases of like, Hey, probably don't write a social security number in clear text into a file. Just not a great idea." We're going to have to get a little thoughtful on, well, what happens when we write to a log file from the output of our applications? Not really realizing, oh, we accidentally dumped the entire object and that was the address and things for the people. So all these, I think that as we're thinking about data as a whole and we're thinking about it from a security perspective, if we think more about how people intend to use it, not just what we have, I think ultimately that's going to help us design more secure solutions for it.

>> And we saw a lot of the breaches are a result of either misconfiguration or bad DevOps practices. We just saw the CrowdStrike, Microsoft, and now Delta's involved, they've got the biggest impact. But that was a disruption. That was not a breach. But that was failed because of humans. Maybe AI helps there, maybe it doesn't and they would've flagged it, bad process. I mean, that could be detected.

Trish Cagliostro

>> In my opinion. I think a better way to think about that is that technology integrates with our lives in a whole different way than we ever probably envisioned 20 or 30 years ago. And what that means is that if it's in our lives, we probably have to think differently about how we recover from it and have more robust planning. It's easy to say, "Oh yeah," and play Sunday morning quarterback of how to make sure that doesn't happen. It's going to happen. I think that, as an organization, having strong disaster recovery plans, understanding things like prod and dev environments, there's all these things that go into play that all of us should be doing, whether it's on the customer side, on the vendor side, I think it's a healthy wake-up call for everybody that we can always get a little bit better in how we're approaching managing very high priority systems. And you think about it now and today where you have potentially electronics in your body and stuff like that. Probably want to have some good strategies about how we handle that in the real world first.

>> Trish, what do you see the market changing in the next year? If you see the progression, honestly, we're in a little bit of a global meltdown this week, earlier in the week, but now you see the startups, they're in that point where, okay, are they going to make the money? Are they going to have the right products? There's a lot going on. Where do you see the market evolving to in the security space?

Trish Cagliostro

>> I think I tend to agree that there has to be some amount of consolidation. If I'm a CISO, I have a really tough life. I'm not happy. I keep getting told by every other vendor, "No, no, just deploy this one more thing and then you'll be good." I don't think they feel very good. And so at one point there becomes a need where you have to consolidate, where you can consolidate. That has to happen. I also think you're going to see new types of technology that emerge because we're going to face new types of threats. Whenever we do new things, usually as a species we tend to figure out how to do bad stuff before we help ourselves. So we have to be prepared for those things that are going to come. You throw in things like quantum and cryptography, it gets even more complicated. And so ultimately, I think I have no idea what's happening over the next year. It's probably going to be a lot. There's a lot of things that are going on.

>> That's an honest answer. Yeah, we don't know.

Trish Cagliostro

>> It's hard to answer.

>> The world could spin in any different direction. So what are you working on these days? So Wiz was a great run. Congratulations on that success.

Trish Cagliostro

>> Thank you.

>> Nice feather in the cap there, and they continue to move forward. You get new things now, what are you up to at RevWizards?

Trish Cagliostro

>> So right now we're helping companies go to market with the cloud providers. I think that was one of the most critical things to help us grow at Wiz. Caveat, I'm a little bit biased in that. And ultimately when I look at the market and I think part of what really excited me about my role at Wiz is I felt like I was sitting at this convergence of people changing the way they consume and buy and ultimately leverage technology. That's exciting to me. So as we get into the future, what I really wanted to do is help companies take advantage of the cloud providers and of the different ways that you can go to market and help accelerate it. We were talking about this in our conversation earlier, and I agree, the execution window for startups has become smaller. That's the scary side of the technology. And so my goal is to help my customers and the organizations I partner with to be able to take advantage of those different trends. .

>> Yeah, speed and scale are the new moats. You get the scale and the speed, critical.

Trish Cagliostro

>> It's not even the moat anymore. Now you have to build the excavator that's always digging the moat.

>> It's like table stakes.

Trish Cagliostro

>> Yeah.

>> Trish, great conversation. Thanks for coming by and sharing your insights on theCUBE. Great to see you. Thanks for coming on.

Trish Cagliostro

>> Awesome. Thanks for having me, John. It was great.

>> Thank you for watching. I'm John Furrier with theCUBE. We'll be back from Black Hat after this short break.