RSAC Conference 2025 | Day 1 Cyber Lunch - RSAC Quickbites

Clips
More from RSAC Conference 2025

Dave Vellante

Co-Founder & Co-CEO

SiliconANGLE Media, Inc.

Jackie McGuire

Principal Analyst

theCUBE Research

play_circle_outline Impact of AI on cybersecurity: democratization of hacking, vulnerability to skilled hackers.

play_circle_outline Evolution of security architectures: need to fight automation with automation, rethink security stacks.

play_circle_outline Striking a Balance: The Role of Consumer-Led Platformization in Cybersecurity Flexibility

play_circle_outline Challenges in integration of different data formats and schemas in security products

play_circle_outline Need for visibility and discovery in cybersecurity using AI

play_circle_outline Future of AI-driven security platforms and potential for automation in red teaming

Info
Transcript

Day 1 Cyber Lunch - RSAC Quickbites

Dave Vellante

Co-Founder & Co-CEO SiliconANGLE Media, Inc.

HOST

Jackie McGuire

Principal Analyst theCUBE Research

In this “Quickbite” analyst segment from the RSAC 2025 Conference, theCUBE’s Dave Vellante and Jackie McGuire share strategic perspectives on today’s cybersecurity threats. Their conversation highlights how nation-state tactics and AI are reshaping the cyber risk landscape.

McGuire explains how democratized hacking and AI-powered attacks are forcing teams to rethink legacy defenses. Vellante expands on how cloud migration is adding complexity to security postures, especially as endpoint exposure continues to rise.

The segment emphasizes cybe... Read more

explore Keep Exploring

What are some ways that AI is impacting cybersecurity and making organizations more vulnerable to attacks? add

What concerns do some people have about companies claiming to be AI companies in the cybersecurity industry, and what potential consequences do they fear if AI is deployed in a ineffective manner? add

What is the future of platformization in terms of consumer-led development and the flexibility required from vendors? add

What are some challenges faced when building integrations for security vendors who have grown through acquisition? add

What is a great use of AI in terms of security and discovery? add

What are some potential future trends in cybersecurity for organizations with less than 5,000 employees? add

bolt Powered by CUBE AI

Day 1 Cyber Lunch - RSAC Quickbites

search

Dave Vellante

>> All right, welcome to RSAC Conference. My name is Dave Vellante and I just got here, and so this is our little lunch segment with Jackie McGuire, our newest Cyber Analyst, and she leads our cyber security practice. Jackie, thanks for taking some time, good to see you.

>> You look very well put together

Jackie McGuire

>> for being fresh off a plane, so impressive.

>> Yeah, I was up at 4:00 AM, got my tie on,

Dave Vellante

>> I'm going cash today, but so listen, I'm really excited to have you on. I wanted to start with the basics. I think let's start with the threat because that's where everybody likes to start.

Jackie McGuire

>> Yeah. - I think about the pyramid, so top of the pyramid,

Dave Vellante

>> we've got nation state actors. Not a lot of them, but boy, they know what they're doing.

Jackie McGuire

>> And we might be antagonizing some of them, I don't know.

Dave Vellante

>> Maybe. Actually I say there's not a lot of them, there actually are a lot of them, but in the grand scheme of things, relatively speaking-

>> There's only three or four.

Dave Vellante

>> Right, okay, we'll come back to that.

Jackie McGuire

>> And then in the middle, we got organized crime so there's more of those, maybe not as sophisticated. And then down below you got the hackers, the hacktivists, and they can cause a lot of trouble. They're not as sophisticated at all, but there's a lot of those guys. But what my understanding is that AI has democratized that a little bit and taking a lot of the intelligence from the top of the pyramid and it's floating it around and that's changed everything. Is that an accurate depiction? And then let's dig into what's happening in your world in the practitioner community, how are they handling that?

Jackie McGuire

>> Yeah, so I think there's a really interesting, there's another layer just under nation state actors that often goes overlooked. And so some of these big texting scam and all of that is actually forced labor also coming from nation state actors. China's a big one that has a lot of forced labor. They literally have people sitting in these massive rooms doing the texting scams. That's another whole layer of it's kind of nation state, but sometimes it masquerades as private hackers. And so look, I think if we take a huge step back, to me, this whole thing goes back to cyber resilience. We've had this massive migration to the cloud, almost everybody's using Amazon, Microsoft, or Google's computers now, right? They're not using their own computers, and while that has really accelerated innovation, it's also created these very critical linchpins in our entire compute. If you think about your security stack, probably three quarters, 80% of your security stack's running in the cloud. When I think about nation state, that's where I go is, all right, we have just a couple very huge linchpins within our whole architecture that would be really nice to go after. And then the next layer down from that is depending on what statistics you read, depending on how important endpoint protection is to a vendor, 70 to 90% of attacks still originate at the endpoint with people doing people things that they shouldn't be doing. I think you have on top of the spray and pray has always been what we call what typical crappy hackers do. They just spray as many attacks to as many places as they can and hope one of them works. AI is accelerating that at an exponential pace. You can use this to translate threats into different languages, to automate going through phone numbers. There's a lot of things that AI has automated on the attacker side, but then I also think that it's creating an enhanced focus on critical infrastructure, which is another place we're seeing a lot of investment by nation state actors and compromise in that we're all starting to rely on AI and that's creating, if somebody were able to actually disable Amazon's West Coast servers, think about how many things in your security stack would stop working. So yeah, I think AI has both opened up and democratized hacking, but it's also really left us even more vulnerable to the really good hackers who are hacking really critical stuff.

Dave Vellante

>> That gives some credence, and I'd love your thought on this, to the Nir Zuk premise, which is basically everything that we've had in terms of security architectures, you could pretty much throw it away because we used to be able to handle the 1%, we stopped the 99% and then the 1% humans could handle. Now they can't anymore because being overwhelmed by automation. So you have to fight automation with automation, so you have to rewrite your security stacks. Now of course, that's the vendor saying, you got to buy our stuff, but they claim Palo Alto that they've had to do a couple of rewrites. Actually, I think, and then I'll talk about the first one that didn't go so well. But then I think they did another redo. And their argument is we're an AI company, and of course there are other AI companies as well, but is that premise valid or is that just good vendor marketing?

Jackie McGuire

>> All of the companies who are AI companies now were XDR companies, they were SOAR companies. Look, I may have accidentally told one of the leadership at the company you just referenced that XDR was a marketing term, not a technology. And I believe that, are they AI companies in the sense that they are currently marketing and selling AI? Yes. Are they AI companies in the sense that a predominant amount of their revenue is coming from that? Absolutely not. I worry because in security, up until about two years ago, you heard security budgets are basically unlimited, we just can't buy the right things with them, we can't get our shit together. And now I'm worried that we've already started to see that pull back on, okay, budgets aren't unlimited anymore. And if we start to deploy AI in stupid ways, when we hit this trough of disillusionment, what I really worry about is all of these we're an AI company now what's going to happen to that brand when AI disillusionment hits? The other thing that really bothers me is that if I'm using, you said Palo Alto, so if I'm using Cortex XDR and I'm not using the AI built into it, but a bunch of other people are, I'm paying for that because most of these AI companies, AI tools, the AI is free. We all know AI is not free from an economic perspective, from an environmental perspective, and so one of the other things that I, being very cynical, hate, is I'm paying for people to screw around with AI when it's not necessarily adding value. I've yet to see one of these companies parade a CISO out on stage that says, because they have AI, "AI did this for me, it made this detection, we caught this zero day," I just haven't seen it. So once I start seeing these crazy use cases being presented at DEF CON of, "This is how AI actually helped our SIEM catch a nation state actor, " maybe I'll buy into it. Until then, it's a marketing term.

Dave Vellante

>> So much to cover with you. I was struck by something that Jon Oltsik published before RSA, his piece, and he talked about has anybody else noticed that network and security are coming together? And of course that's Cisco's whole rap. Of course it is, why wouldn't they take that route? And then I listened to someone like George Kurtz say, "Yeah, the network is just a highway. The bad guys go down the highway and then to attack, where do they go? " Something you said before, "They go to the endpoint. " And so having that endpoint visibility and the whole agent discussion, agents, not agents, security posture management. Before we went on, you were talking about Wiz as a company that actually has the marketing chops and the technical chops.

>> Yeah. - Others say, "Oh, that Wiz is posture management.

Dave Vellante

>> Everything's now posture management.

Jackie McGuire

>> " Help us squint through all that mumbo jumbo.

Jackie McGuire

>> Yeah, so what we were talking about with Wiz is I said, one of the things I'm really interested about at RSA is that there are companies, so I might be biased, I met with Island earlier. Island is this enterprise browser, this secure enterprise browser that essentially just stops threats at the browser level and enables you to do things say, "Okay, my employees can access LinkedIn, but they can't use the messaging on LinkedIn," and they get down to that fine grain of detail. And so there are companies like that that I feel like are doing really cool things and don't have the brand awareness they should. I'm like, "I know who you are because I love the tech, but what is it? " But then there's other companies like Wiz, and I think one of the reasons that Google coughed up another 9 billion when they went to Wiz with 24 I think, or 23 the first time-

>> And then they upped it to 32. - ...

Jackie McGuire

>> and then came back with 32.

Dave Vellante

>> They're buying marketing, and I'm the millennial whisperer. They're buying millennial marketing because the thing that Wiz does so well is marketing to millennials through experiences. Millennials love experiences, and walking into a Wiz booth at RSA is an experience, just the whole thing. The Wiz Mart, they're looking like a Meow Wolf exhibit.

Dave Vellante

>> They're parties. Same thing.

>> Exactly. And so it's interesting to me to see

Jackie McGuire

>> that there are companies that have great tech, and for some reason the marketing just isn't, whether it's the, I don't know. And then there are companies that have great marketing, but the tech is not really there. And we can all think of a few of them who've spent seven figures at trade shows and then disappeared, and then there's a Wiz. What I'm really interested is talking to the vendors who are finding that apex of great technology and the right messaging at the right time for the right users and that it's like alchemy. It's such a hard thing to figure out, and so I want to talk to more companies because I view the analyst role changing as data gets democratized. We used to charge for surveys. Now, I think really what my value is looking at those surveys, yes, but really talking to the vendors who are doing it well, talking to the customers who are buying with confidence and figuring out what are those threads that we need to be threading together that create that lightning in a bottle for vendors.

Dave Vellante

>> What does the Wiz acquisition up from whatever it was 23, 24, to 32, what does that tell us about, first of all, M&A? The second part of that question is when I think about Microsoft, Microsoft does a good job of monetizing security, and a lot of people can criticize Microsoft security, but they got a pretty good security business. Practitioners and customers are starting to rely on them because they got, whether it's good enough or easy, and they've got this platform approach that they're pushing. They're there, and they're ubiquitous. But now Google with Mandiant and Wiz, even though that acquisition hasn't gone through, we'll see if it does with the government trying to put a bullet in their head or at least break them up. So how do you see that playing out? Is it a signal that Google is trying to be more like Microsoft? Of course, they've got applications, they're more up to stack. They're really trying to build a business around security, which is not a bad business to build. And then you've got AWS, which really doesn't heavily monetize security. Maybe you pay for a little security lake here or there, but it's not the same way they market EC2, for example, or storage. So how should we think about the hyperscaler landscape and what does the Wiz acquisition tell us about those two things? M&A picking up again, and the hyperscalers posture toward, no pun intended, toward monetization.

Jackie McGuire

>> Yeah, so I think those three companies have very different cloud businesses. AWS's cloud business is driven by multiple things. A lot of it is the cloud compute. Google's cloud business has been driven primarily by workplace, so the vast majority workplace and personal storage. And then you have Microsoft who sits in the middle, but my understanding, and someone at Microsoft, you're welcome to brief with me if this is not true, is that a decent amount of the growth in Microsoft security products has been bundling it with their cloud offering. And Microsoft has been very aggressively pursuing cloud transitions away from AWS. I think they've been bundling a bunch of their different offerings, including cloud security into a cloud offering, because I think their growth was, when we saw it was probably starting 18 months ago, the growth in Sentinel, we were like, "Wait, what? " And also in Azure, so the Wiz acquisition tells me a few things. The Mandiant acquisition was bizarre because I've always looked at Google like a toy store. They're like Spencer's gifts. You go in there and you use Google Workplace because you've used Google since 2006 for your personal stuff, and it just feels natural. And with everybody having Macbooks now and the tech community being somewhat anti-Window, don't at me, it's easier to use Google Workplace. So I think when they bought Mandiant, it was like, how are you a toy store that's trying to sell arm guards? And so I think when they bought Wiz to sit in the middle, it made more sense to me. It was like, okay, here's the toy store, here's the metal detectors at the front of the toy store, and then here are the arm guards in case somebody gets through the metal detectors. I know this is a really shitty analogy, but that's how I look at it. I think a few things. One, Google is going to have to start accepting they can't physically build the infrastructure to compete with Amazon or Microsoft on compute. I don't think that they're offering, even with Gemini, they are never going to compete with an AWS just on a straight compute basis.

>> Even with their two TPUs and all that.

Jackie McGuire

>> Even from the ability to build the data centers

Dave Vellante

>> that it would require to scale up compute to the degree that Amazon has or even lease the space, I just don't see it. But what Wiz does get them is a piece of both of those clouds. So if you're going to get a piece of everything going through AWS through Wiz, you're going to get a piece of everything going through Azure through Wiz. It gets them access to multi- cloud, which is really important. We've seen them make a handful of strategic acquisitions in that direction, and it gives them more compute to charge on than they've had so far.

Dave Vellante

>> I just want to push on something you said because doesn't Google, I mean, I think Google because of search has this massive data center infrastructure and undersea cables and huge network and all that other stuff. And what I learned was interesting at Google Cloud Next is that as every whatever 1% that they save on that side of the house, it frees up data center capacity for Google Cloud, so they don't have to go out and find a location. So you saw Microsoft dialing down some of its leases both for external leases and its internal build out.

Jackie McGuire

>> Well, that's great news for Google because their search business is dying because millennials don't use-

>> Well, they had a pretty good quarter though, Jackie.

Dave Vellante

>> They did. - Maybe it's a dead cat bounce, but.

Dave Vellante

>> Yeah. Well, there's a couple things going.

Jackie McGuire

>> I want to personally complain to Google with my airtime

Jackie McGuire

>> because, one, Gemini has made Google search results trash. Google used to have some of the best search results. You could almost always count that after the couple sponsored results, the first three things that came up in your results were the right things. That has completely gone away with AI.

>> Isn't that fixable? - It is.

Jackie McGuire

>> If they put somebody who really has a product mindset on

Dave Vellante

>> that and said, stop giving me Gemini pop-ups

Dave Vellante

>> and just make it a great experience.

Jackie McGuire

>> But it is. But millennials also, and this is one of the things that Wiz actually said, and the head of growth marketing at Wiz says all the time, hey Mara, that for millennials, social media is this new search engine. Millennials do not Google anything. They go to Instagram, they go to TikTok, they go to Reddit, and they Google best blah, even for work. And so yes, if Google wants to survive, if Google wants to continue to compete, they have to, have to, have to fix search, and they have to find a way to draw millennials back into search with a more experiential search process. The Gemini summary at the top is almost always wrong. The links it links to are almost always old, and so yes, I think that Google has a great opportunity in front of them. I just don't understand the product vision behind search because when they need to be attracting more millennials who are not using search anymore, it seems like the results are, yeah, it's a much different-

Dave Vellante

>> I think they're going to figure it out. Here's why I think that, because they'll make a lot of mistakes. Gemini's good, it can be really good. I mean see the benchmarks, it's top of class.

Jackie McGuire

>> The independent product is great, just the integrations into the rest of Google are trash.

>> I think what they need to do is step back

Dave Vellante

>> and say, okay, where are we making money? Because I think they're afraid. It's the classic innovator's dilemma, but if they can identify the monetization points in that whole Google playground and insert AI Gemini in the right places and Vertex for the developers, I think they will figure, I mean they've got all the peace parts. I mean, shame on them if they blow this.

>> Well, I prefer Gemini. I am a Google simp.

Jackie McGuire

>> So just to be clear, I've had an email address with Google so long that it has the word shit in it. That is how long I've been a Google customer, since before they validated their email addresses. I have owned every Android since it was Motorola Droid. I love Google. I am such a Google simp. But yes, I really would love for them to get their Gemini integration into products down. The same thing. Google, if you have an Android phone and you try to use Google, they still, Google Assistant and Google Gemini are still two different things. Some of the automated actions you would use Gemini for on your phone don't work. I love Google and I really, really hope that, one, the Wiz acquisition goes through so they can build an actual coherent security product at Google, which is something that they've really struggled with. And two, they fix the way they're integrating Gemini so people can see what a good product it is. Because almost every version of GPT, the last several roll- outs I found Gemini preferable to ChatGPT so I think they have a great opportunity.

>> That's good. Okay, let's get back to cyber.

Dave Vellante

>> Where do you land on the argument of Nikesh Arora called the end of best of breed? The best of breed era is over, however you want to say that. It's all about platformization, his term. I think you've got guys like CrowdStrike partnering up with the Oktas of the world and Zscalers to maybe have some plug-in kind of thing. Maybe it's not that simple, but that's their platform approach. Both seem viable, and then you got guys like Wiz who are the shiny new toy, best of breed. It just seems that, well, from the data we have from the recent survey data, certainly nobody's reducing the number of vendors in their security stack or that's not obvious in the data, but we've started to see a slowdown in the rate of increase. Maybe that's a sign that consolidation is beginning to happen or is going to happen, where do you land on this?

Jackie McGuire

>> Yeah, I hate to talk about millennials again, but I do think, I don't know that I would say best of breed is going away, but I do think that buyers under 45 have very little brand loyalty. I think I actually met with a large tech company last week and they're like, "We're this company, we're this company, people obviously trust us. " And I said, "I don't know that for people under 40 that's actually true because the world is changing every 90 days right now. " And so while as a security person 10 years ago, I wanted the brand I know has worked for 20 years, now I'm like, "I want the brand that I know can keep up with the rate of change at all the crap coming at me. " So I do think platformization is where we're going, but I still think vendors are trying to do vendor- led platformization where the vendor builds the platform and then tells you how to use it. What I think we're going to need is consumer- led platformization where the consumer presents you with their tech stack and you help them create the platform. I'm much more bullish on the intelligent abstraction layers because I think platformization is trying to create a multivitamin for everybody in the world. There's a reason there are men's multivitamins and women's multivitamins and kids is everybody needs something different. That's the case in security too. It would be one thing if security had really rigid frameworks like finance where it's like you use this type of endpoint, this type of network, this type of cloud. No two security stacks are the same. There are literally no two enterprises that have the same stacks, and so I think we're going to go to a consumer- led platformization where the abstraction layer is the platform, and I think vendors are going to have to get a lot more flexible with working with third parties.

>> Isn't the promise of agentic

Dave Vellante

>> that it will be that abstraction layer?

Jackie McGuire

>> Yes. Well yeah, but you're still going to need something to collect all of that abstraction. I think if the argument is that Palo Alto thinks they're going to build the coolest UI or the most intuitive UI, and so that'll be what sits on top of all of your agents, then maybe that will work.

Dave Vellante

>> I think they would say that they have the data access to the data so that they can respond at run time. I think CrowdStrike would say the same thing with their agent, capture the data once and then build a million modules, 29, and it's ready to go, all you do is turn it on. It's interesting, in one of the survey results here from ETR, they said, if you can completely rebuild your cyber security stack, I don't know if you saw this, what one product or vendor would you most prioritize? And the number one product was, well, we want features not product and the features were MFA and identity, EDR, XDR. And then the third one was what I called the grail platform. They want that platform, but they don't necessarily see it yet.

Jackie McGuire

>> But Palo Alto, and sorry Nikesh, but Palo Alto's a good example. They say they're a platform, but Palo Alto's XDR uses a different data format and schema than their SIEM product does. So you can't be a platform-

>> Tell me that's not true.

Jackie McGuire

>> So they can talk in common languages.

Dave Vellante

>> Because you gave me that, and I couldn't go deep enough to

Dave Vellante

>> defend that statement so let's poke at that a little bit.

>> The data schema they use, and this is

Jackie McGuire

>> from a year, year and a half ago. So when I worked at Cribl and we were building integrations for Palo Alto, one of the difficult things about building those integrations is that several of their products use different data formats. This is the case for almost all legacy, even CrowdStrike, all of these security vendors who have done growth by acquisition, acquisition does not a platform make. Buying all of the ingredients for a cake does not make a cake. You have to actually put them together in the right ways, in the right proportions and make the cake, and so 40% of SIEM standups fail. That's the current statistic, and it's not because the SIEMs don't work, it's because they don't work out of the box. And as a salesperson for a CrowdStrike or Palo Alto, I'm going to sell you a certain number of professional services hours to make sure that you can deploy this product, but it's probably not really as many as you're actually going to need to get all of your stuff tied in, all of your identity platforms cut over. So yes, I do think that the CrowdStrikes, the Palo Altos, the Splunks, all of these large incumbent providers that have data, they're in a great position to build the platform, but when they acquire a new company, there needs to be, I think more clarity and better communication around what that integration's going to look like to make me believe that this is going to become another part of the platform and not just another thing that I have to deal with as six different pieces under the same login.

Dave Vellante

>> Well, we've seen both sides of the spectrum. More often we've seen a bevy of acquisitions create integration hell. I mean, you certainly saw that at EMC, IBM when it bought all those software assets, it never really brought them together. On the other end of the spectrum, you got Oracle Fusion. They actually did the work to bring those together. I think about ServiceNow who was very picky about which companies it would buy. I don't know if that's changed under McDermott, but it risks if you don't have that platform approach. George Kurtz would say that we have a platform, we actually do the integration. I don't know, I'm not qualified to determine whether or not that's the case. I've certainly heard customers complain about the disparities across some of the Palo Alto platforms like you were alluding that it's an abstraction layer or it's a veneer. So ultimately, the market's going to reject that is really your point.

>> I think the few things are going to happen.

Jackie McGuire

>> I think one really great use of AI is discovery because you can't really protect what you can't see, and that's what we find a lot in security is you buy a SIEM and you roll it out and you start onboarding sources into your SIEM, but there's this random Snowflake database just hanging out that somebody in IT spun up to try a new AI tool. That's the place where I'm like, I don't want an AI assistant in CrowdStrike to tell me what my, I want an AI assistant in CrowdStrike to be like, "Hey, you don't have EDR on these 450 endpoints that should have EDR on them," because that's a lot of times it's like the compromises happen and things we didn't even know were out there. We were talking before we started about shadow AI is the new shadow IT, and I guess we're going to need AI to find AI because, yeah, the best platform in the world, if not all of your data's going into it, it doesn't work.

Dave Vellante

>> That's what's the adversaries are doing, right?

Jackie McGuire

>> Yeah. - Show me all the open internet points

Dave Vellante

>> and which ones aren't protected and I'll put automation on it.

Jackie McGuire

>> And if I've got a 10 person security team, I'm probably not out there actively red teaming myself. I'm probably not out there, and so that's where some of the AI enabled red teaming, if I could say, "Hey, CrowdStrike red team me for me," and that's where I think some of the AI things are going to go. I think within the next five years, almost all organizations with less than 5,000 employees are either going to be in some type of AI driven security platform, or have to move to a service provider because it's just not feasible that now as a security team, literally everything is the attack surface. It's not your network, it's not your firewalls, it's not your SaaS, it's literally your entire organization now, so how do you automate that?

Dave Vellante

>> All right, hey, thank you. We got to go.

Jackie McGuire

>> Yeah. - Really appreciate your

Dave Vellante

>> insights, it was rapid fire. I appreciate the cyber lunch. All right, thank you Jackie.

>> Thanks. - Jackie McGuire. Dave Vellante here at RSAC

Dave Vellante

>> 2025.

Jackie McGuire

>> John Furrier is also in the house. We got Christophe here. We got Jon Oltsik, myself, Rob Strechay is popping in for a day, and the whole CUBE team, so stop by and see us in Moscone West. We're right back right after this short break.