NYSE Media Week CXO Series, theCUBE + NYSE Wired | Karen Walker, Sysdig

Clips
More from NYSE Media Week CXO Series, theCUBE + NYSE Wired

Karen Walker

CFO

Sysdig

play_circle_outline Cybersecurity challenges and trends, including AI adoption and cloud security

play_circle_outline Impact of labor shortages and skill gaps in cybersecurity industry

play_circle_outline Market outlook for cybersecurity spend and AI adoption

play_circle_outline Regulatory environment and its impact on cybersecurity

play_circle_outline Maximizing Net Retention Rate: How CFOs Redefine Metrics to Drive Innovation in Healthy Markets

Info
Transcript

Karen Walker, Sysdig

Karen Walker

CFO Sysdig

Karen Walker, the CFO of Sysdig, discusses the challenges facing the cybersecurity industry, as attacks become more sophisticated and frequent, with costs increasing significantly. The shortage of cybersecurity professionals, coupled with the need to address skills gaps and navigate regulatory pressures, adds to the complexity. The acceleration of cloud adoption and the role of AI in enhancing security measures are key factors to consider. The conversation dives into the impact of generative AI, the importance of profitability in decision-making, and the evol... Read more

explore Keep Exploring

What are some of the key factors contributing to the increasing complexity and costs of cybersecurity in the current era? add

What are some of the challenges faced by cybersecurity leaders and CISOs, particularly in relation to cloud adoption, labor shortages, and skills gaps? add

What are the projections for cybersecurity spend in 2025 compared to 2024 and what factors are contributing to these projections? add

What has been the impact of recent regulations on the importance of cyber security for companies and their disclosure practices? add

What would you like to be able to say 12 months from now that you're not able to say today? add

bolt Powered by CUBE AI

Karen Walker, Sysdig

search

Dave Vellante

>> Welcome back to New York City, everybody. My name is Dave Vellante. We're here at the New York Stock Exchange. This is theCUBE + NYSE Wired Media Week, our CXO series. I'm here with Karen Walker, who's the CFO of Sysdig. Thanks so much for coming to theCUBE. Really great to see you.

Karen Walker

>> Thank you for having me, Dave. Great to be here.

Dave Vellante

>> You're very welcome. So wow, the world has changed for you lately. I mean, CFO is right in the center of it all. How do you see it both affecting your organization internally in your role? And then we're going to get into what's happening in the marketplace.

Karen Walker

>> Yeah, absolutely. So I'm the CFO of Sysdig. We're a cloud security company. And you're absolutely right. It's a very interesting time in cybersecurity. I think that I'd like to say that we are entering a new era of cybersecurity. There are more attacks, they're more sophisticated, they're faster and they're unpredictable, right? And when you look at just some of the statistics, they're up about 154% over the previous year. They can cost on average $5 million. But I would say that mileage varies. So if you look at MGM's breach last year, they disclosed that it cost them about $100 million. So the stakes have never been higher, and the regulatory environment is also adding some fuel to the fire there. AI adoption, which I'm sure we're going to talk about in a few minutes, is another big factor. But one of the things I actually, before unpacking some of that, I'd also say is that cloud adoption is accelerating. It has been since Covid. It is increasing now, I think even more with AI adoption. But what I've seen when I've talked to cybersecurity leaders and CISOs is that they've been facing labor shortages now for several years. I think that number is about 4 million in terms of shortage of personnel. So they've already had this massive pressure with a shortage of labor. I think skills is another area where they highlight is a very big challenge, like gaps particularly for cloud security. And then this last 24 months cycle, we've been in this sort of macro environment where a lot of people like myself are looking for, how do we get to profitability? How do we increase margins? And so the macro has not been too friendly for spend, although I would say cybersecurity has been more insulated. There's all of these challenges I think that are mounting.

Dave Vellante

>> I love this conversation. And your observation space is pretty good. You've got 700 customers. You guys participate in 40 plus countries as a leader in cyber.

Karen Walker

>> Correct.

Dave Vellante

>> And the reason I said I like this conversation is because I pay close attention to the macro. You know what they say?

Karen Walker

>> Absolutely.

Dave Vellante

>> If you don't get the macro, the macro is going to get you. And right now, if you look at IT spending, it's tracking at about three and a half percent growth per year. I know Gartner and IDC have much, much higher numbers, but I don't believe them. The surveys that we have show a lot of caution. And a big factor is that 45 of the customers tell us that they're funding their gen AI initiatives by stealing from other budgets. So it's not like the CFOs, your colleagues, are opening up the checkbook and saying, "Oh yeah, here's an extra bunch of dough to go spend on generative AI."

Karen Walker

>> Yeah, absolutely.

Dave Vellante

>> It's got to show some return, and it's risky. So people are... Again, it's not self-funding yet. It's not throwing off enough cash. And so now you're right, cyber's been somewhat insulated, but the same, right? You can't just say, "Okay, you have unlimited budget to spend."

Karen Walker

>> Correct.

Dave Vellante

>> Plus, your customers, they can't hire enough people. There's a skill shortage. Now, the hope is that AI can fill some of those gaps, but again, you can't just absorb AI overnight. So I'll get you a question.

Karen Walker

>> Those are great observations, Dave.

Dave Vellante

>> Thank you. How long do you think it's going to take and what's that shape of that? It's probably everything's an Ogive curve, an S-curve. What does that pattern look like in terms of AI filling some of those gaps that we've seen for years?

Karen Walker

>> Yeah, great questions. I'd like to maybe unpack them one at a time here. You're absolutely right. I've seen the same estimates about cybersecurity spend. Of course at the beginning of this year, people thought it would be bigger, a bigger increase, right? But I think we continued to see some of the pressure in the macro, a lot of uncertainty out there. And so, 2024 did not turn out to be the same increase that people talked about at the beginning of the year. Now when we look ahead to 2025, I mean you could call it optimism, but there's definitely projections that show an increase headed our way that's bigger than 2024 versus 2025. But what I would say, I'd like to point out a couple of things. I mean, you're absolutely right. It's not a blank check, right? And then you talked a little bit about displacement of budgets in it for AI. I think that is definitely happening. I've talked to a number of CISOs and CIOs, and that is absolutely the case. But what I would say is that by and large, a lot of the things that are getting displaced are kind of legacy infrastructure, so think more network, more firewall, and cloud security doesn't seem to be impacted by this. And in fact, I would say that cloud security should actually be a beneficiary of AI because it's increasing cloud adoption. And of course then it's really the wild west. I mean, you're going to have new vulnerabilities, you're going to have things that are going to be net new in terms of governance and risks, and also the ability for attackers to use AI to their advantage. So it's going to be really important for security professionals to do the same, but I think it's going to be a tailwind net map.

Dave Vellante

>> Now, Aurora is very fond of talking about how the source of cybersecurity market's huge. I don't know, put a number on a hundred billion maybe more. You add in all the services around it, it's much, much bigger. But his point is always the leader in the market has single-digit market share. Maybe Microsoft has more than that, but it's hard to tell. It's so big, Microsoft. But now I think Palo's over a hundred billion in-

Karen Walker

>> They are....

Dave Vellante

>> in market cap.

Karen Walker

>> In market cap.

Dave Vellante

>> So they were the first.

Karen Walker

>> That's right.

Dave Vellante

>> Do you think there will be others to crack a hundred billion in market cap?

Karen Walker

>> Absolutely. And I think cloud security is going to pave the way. It's going to be a very big market. And I think it's one of the reasons why you see legacy vendors like Palo and Crowd basically try to make investments in this space. Some of them are doing it through acquisitions, some of them are building. But definitely legacy vendors want a piece of this action. It's something they're calling out on their earnings calls, they're tracking it, and I think analysts buy into that. That is basically the future.

Dave Vellante

>> So coming back to thinking about AI and specifically AI risk, as a CFO, how do you think about risk management generally? What's your framework and how have you adjusted that framework to accommodate AI risk?

Karen Walker

>> Yeah. So one thing I would say is you cannot have your head under the covers and sort of waiting to see how it will all pan out. I think that businesses need to make investments in AI. There's a lot of experimentation. There'll be fits and starts, but you have to absolutely figure out how to unlock some of the productivity and dive in. I think that CISOs recognize this as well, and I think it's scaring them, right? Because it's like, "Do I have the security tools that will keep pace with this?" This is going to be introducing new vulnerabilities. It's going to be very challenging from a governance perspective. But I think you'll also have to realize that, A, in many places where we look for productivity gains, whether it's in go-to-market or in finance, AI can actually help security professionals as well. They can help up-level the skills and they can help them respond faster. So two of those challenges I mentioned, labor shortage as well as gaps in skill set, I think AI can help with those. When I look at our own product, it's called Sysdig Sage, it's been very exciting to see how much customers who have used it are excited about it. It's a multi-step reasoning, it has context, it has domain expertise. So when you do think about your investment in AI, don't just invest in sort of a chatbot and a prompt. You want to have something that's really truly going to be a digital assistant. And I think that can certainly help security professionals with those gaps you're seeing.

Dave Vellante

>> So as a CFO, Karen, how do you think about that? Because I see a lot of experimentation going on with generative AI. I see a lot of singles being hit. I see a lot of experimentation that's actually not really throwing off ROI. Now the spending is maybe not huge. Most companies, I would say, if you look at the bell curve, are spending less than a million dollars a year on their experiments. But some of the big guys are spending a lot, as yo know. As a CFO, would you rather see some small quick wins that don't necessarily quick payback period, maybe a nice ROI percentage, whatever, nice IRR, but small NPVs? Or would you rather see longer-term paybacks and bigger NPVs? And I know it's probably an "it depends" question.

Karen Walker

>> Right.

Dave Vellante

>> But can you help us frame how to think about that?

Karen Walker

>> Yeah, I think it does depend, but I think that small NPVs and experimentation I think is the way to go. I mean, it's just so early in these offerings. I mean, we're seeing everything from net new tools to some vendors actually embedding it into their offerings. I think the pricing models and all of those things have not kind of settled out. So I think when I work with my team, I do look for the ROI I think for any investment. I mean, we're in that environment where we're trying to make that balance and strive towards profitability and increasing margins. So I think it's absolutely reasonable to say, "Hey, I want to make this investment. Here's the business outcome that I'm driving for." And I think that it's just so early. I don't think it would go all in on any long investment. I like more of the agility of shorter sprints.

Dave Vellante

>> So if a business manager who, let's say she has some really good street cred and her track record is amazing and comes to you and says, "Hey, I got this idea. It's a little bit risky, but I think this is going to be the future and I think it could be raise our market capitalization by a couple hundred million, billion, whatever," how do you look at that? Do you say, "Hey, I'm not going to write you that check, but if you can fund it through other ways." What are those conversations like? Do you have business line managers, whether in your own company or your colleagues or your previous experience, that have done some sort of novel ways to self-fund and sort of participate, if you will, in the risks? So it's not all on you. I mean, I know you're all in this together.

Karen Walker

>> Yeah, absolutely.

Dave Vellante

>> Does that make sense?

Karen Walker

>> Yeah, I mean I think just very much in the culture of tech and our culture and many companies, it's agile, right? I mean, this isn't necessarily like, "Oh, you get this big bucket of money and you can go on years and years without proving anything out."

Dave Vellante

>> Right. Right, right, right. So I think that's just a best practice whether it's talking about something transformative like AI or any other sort of investment. Having some milestones and understanding, "Have you proven it out?" And just having that agility and that discipline to take a look at that.Help us unpack some of these regulations. We all know GDPR and the California Consumer Privacy Act. And so now you've got all these other global cyber security regulations coming in. There's NIST 2.0 coming in. There are other global standards. There have been executive orders, a lot of finger wagging by the government industry, maybe rightly so, I mean the industry probably could be doing a better job. How are you thinking about these regulations? How are you absorbing them, you and your colleagues in particular?

Karen Walker

>> Yeah, absolutely. So I think cyber security is becoming a strategic imperative for both the C-suite and the board. I think that you're right, these regulations have really shown a light on the importance of cyber security, risk management and posture. So I think that we're starting to see a little bit of a shift. I mean, starting with the SEC rules, those launched last fall. When you look at those rules, I think they were largely a little bit more of the SEC pushing a little bit harder by saying, "Hey, you were supposed to be doing this anyway. You needed to be disclosing these risks in your 10-K, in your filings." But I think with the 8-K rule, and basically you've got four days if you determine that an incident is material to file, I think was a way to make it more transparent, discoverable, and really put the pressure on companies to do so. And it's interesting because when you look at the majority of 8-Ks that have been filed, the vast majority of registrants have said in their disclosure, this is not material. So it seems like people are kind of airing on the side of, "I'm going to go ahead and disclose because I don't want to be caught afoul as these things sometimes do unfold with investigations on an incident." They can look to be potentially not material and then eventually you determine they are. And they could also go the other direction. But it seems like people are kind of airing more on the side of, "Let me disclose first" and then be able to use that as a marker, if you will.

Dave Vellante

>> It's not a self-regulate, I call it running water through the pipes. You get a little muscle memory going and some learnings.

Karen Walker

>> A little bit. You mentioned GDPR. And I think it took some time before we started to see enforcement take place before people sort of navigated to one framework. And so I think with any sort of new regulation, it takes time to settle out. And I think it's the first starting point, but no doubt regulatory environment is heating up, making this a really topic that is top of mind for boards for C-suite. NIST 2.0 Is about to launch in about a week I think from now, less than that. And that is really far sweeping because each of the 27 member states in the EU need to basically transpose this directive into national law. So there could be different provisions that companies need to follow if they're in France versus Brussels and so on and so forth. So very complex. And I feel it's like not being talked about a lot by US companies, but if you're a US multinational, if you're providing a service even, you don't even have to have physical operations in the EU, but if you're providing a service, you're going to be subject to these regulations.

Dave Vellante

>> Let's talk about the IPO market for a minute. I mean, we're up here above the New York Stock Exchange, hearing the bell ring in the morning, in the evening. It's such a great experience and it's exciting, it's emotional. How do you think about ideas? I'm curious as to your thoughts on why the IPO market is so soft right now. I mean, during the pandemic, we saw some real blockbuster IPO. Snowflake in particular was the sort of poster child for successful IPOs. But things have calmed down. I get election. M&A I also get, that sort of FTC and the DOJ kind of shut a lot of those down, but IPOs market's still pretty tepid. Why do you think that is? As a CFO, how do you think about IPOs staying private? Like a Databricks has chosen to stay private. They probably could have gone out. Maybe, maybe not. I don't know. I haven't seen an S-1. How do you think about it?

Karen Walker

>> Yeah, absolutely. Well, I mean, I think if you look back to the zero interest rate period, that drove insane valuations. And a lot of, I think, small companies getting out there and doing an IPO, not having to show profitability, really just being valued 100% on revenue growth, those days are over, right? And so I mean, we're not going to go back down to zero interest rates. Even though the Fed has recently cut interest rates and there's some rates expected, we're not going back to those days. And I think the exuberance that sort of generated was something that was just a moment in time, if you will. And so to some extent, it's a little bit back to fundamentals of having to show profitability. And I think that the pause, I mean, well one, I think volatility and just uncertainty in the market has definitely kept people on the sidelines. I understand that the demand is there. But I think with this reset in expectations in terms of being profitable and having a balance of just not all revenue growth, but profitability in addition to just the size and scale, I think, that's required for that, I think really caused a lot of people to play catch-up and sort of rethink what their financials look like and needed time to get there. In the meantime, I think there's been tons of volatility. And I think that next year a lot of people are saying things will sort of open up. I think they'll be definitely larger scale companies and definitely ones that are either close to profitability, near break-even, or already profitable.

Dave Vellante

>> So the decision point there is if the market's not rewarding growth at all costs, you got to hit the pause button. But of course as a CFO, if you go out in that climate, and you saw this with Snowflake, it was kind of growth at all costs, the stock went through the roof, then the market shifts on them and it becomes one that's really price sensitive. Their main competitor is private. They can maybe make some arguments that they're more cost-effective. Who knows? You don't really know their numbers. And then all of a sudden you get caught in this sort of vortex where you're getting whipsawed. So as a CFO, you've got to be concerned about that. Even in the boom times where you had , but you also had growth at all costs, it was being rewarded.

Karen Walker

>> Absolutely.

Dave Vellante

>> So that's got a little nerve wracking as a CFO.

Karen Walker

>> Definitely. There's a number of companies that encountered that, right? Going out over the summer or spring of 2021. And then we wake up in the fall to a totally different world and had to pivot. And it's much harder to make that pivot when you're a public company out there in front of everybody. A lot easier to do when you're private.

Dave Vellante

>> So I saw a stat, maybe 1,200, I don't know if that's the right number of IPOs in waiting, but I guess the point is the quality of those is going to be a main factor as to whether or not they go.

Karen Walker

>> Absolutely.

Dave Vellante

>> So what do you need to look like to go public today? You've got to have at least a path to profitability? Do you have to be profitable? Do you have to have a free cash flow margin?

Karen Walker

>> I mean, ideally you're profitable, right? I think that growth is still rewarded, right? And it is definitely a larger weighting towards growth and profitability. But I think rule of 40 and the components of it matter. So just making sure the audience understands rule of 40, it's your revenue growth plus your profit, at least equaling 40. 50 is even better. But if you are, let's say, growing your revenue at 100%, but you're like minus 60 on your operating margin or operating margin loss, I don't think that works in this environment. So I think the components matter. So high growth is still important, but definitely if you're profitable, that's also important. So I think rule of 40 is still very critical and I think is here to stay.

Dave Vellante

>> So rule of 40 as a sort of baseline condition. Revenue growth plus operating margin, got to be at 40 plus percent. And you've seen some companies actually do better than that, they do service now for a while. Sometimes people measure... It's interesting. Sometimes they measure free cash flow. But I would think non-gap operating, well, I guess maybe not. Maybe non-gap operating margin is the right metric, correct? Non-gap, right? Operating margin.

Karen Walker

>> Yes. I think it depends on whether you're growth company or if you're more value. There's companies like Autodesk that are valued on free cash flow. So I think, again, it depends on-

Dave Vellante

>> More mature.

Karen Walker

>> Exactly.

Dave Vellante

>> So they can change the rule of 40 metrics.

Karen Walker

>> Yeah. I think that net retention is actually another one that's super interesting. I mean, it is kind of a very commonly disclosed metric for SaaS companies. And I would say if you're doing something like 130, that's amazing. But the reality is, in the software universe today, that median is closer to 110%, and I think that's just a reflection of how challenging the macro is today.

Dave Vellante

>> I've seen CFOs also redefine NRR sometimes, whether they take a different timeframe. You really got to read the fine print.

Karen Walker

>> Absolutely.

Dave Vellante

>> Great. Well, Karen, thanks so much for coming on theCUBE.

Karen Walker

>> Yeah, thanks for having me, Dave.

Dave Vellante

>> Great to have you.

Karen Walker

>> It was great.

Dave Vellante

>> Last question, what do you want to be able to say 12 months from now that you're not able to say today?

Karen Walker

>> Oh, let's see. Great question. Well, I'd like to see a return to companies going public in a healthy market and to see that continued growth, I think, as well. For our own company. Super excited about our offerings and basically what we can do to help companies and help security leaders secure their innovation in the cloud. Looking forward to also leveraging our AI product and how that can really help solve those skills gaps and labor shortage that I talked about.

Dave Vellante

>> Wow.

Karen Walker

>> So super excited about what we're doing.

Dave Vellante

>> We'd love to be here at some point, celebrating the ringing of the bell with Sysdig. Thanks so much for coming on theCUBE.

Karen Walker

>> Thanks, Dave.

Dave Vellante

>> Appreciate it.

Karen Walker

>> Thanks for having me.

Dave Vellante

>> You're very welcome. All right, keep it right there. This is Dave Vellante for theCUBE + NYSE Wired, our Media Week CXO series. We'll be right back right after this short break.