News
More from RSA Conference 2023

Lee Klarich

Chief Product Officer

Palo Alto Networks

From chaos to cohesion: how integrated platforms streamline cybersecurity

The cybersecurity industry has long been plagued by fragmentation, with companies investing in numerous standalone point products in an attempt to enhance their security posture.This approach has led to increased spending without necessarily improving overall security, according to Lee Klarich (pictured), chief product officer of Palo Alto Networks Inc., who believes that a fundamental shift is occurring with the emergence of integrated platforms that offer best-in-class capabilities.“For the first time, we’ve finally reached a point where there are real platforms emerging that are best in class in the capabilities,” he said

Info

Lee Klarich | Palo Alto Networks

Lee Klarich

Chief Product Officer Palo Alto Networks

(soft music)

>> Welcome back to Moscone Center, Dave Vellante with John Furrier here. Day three. It's Hump Day, RSA 2023. Lee Klarich is here. He's the Chief Product officer of Palo Alto Networks. Lee, good to see you.

>> Wonderful to see you.

>> Okay, every year we spend more on cyber, yet we feel less safe. Why are you an optimist? (all laugh)

>> You know, so there's some fun, there's a fundamental difference in the cybersecurity space than in most other industries. It is one of the most fragmented markets out there, and the net result of that is every company keeps buying more and more and more standalone point products and finding them. So, which results in the spending more money part. But the net result of that is not better security. And so for the first time, we've finally reached a point where there are real platforms emerging that are best in class in the capabilities, but the capabilities are delivered natively integrated, and that is changing the game on security outcomes for the cost that goes into them.

>> Can you explain that real quick? I think it's a really nuanced point. Platforms versus tools. It's a concept in the tech engineer. One kind of talks about inside the ropes, but as customers have sprawled their way to a bunch of tools. I mean, they have this like environment where they're just throwing everything at the problems they have, if the problems are coming in. As you get more unification, what does that platform look like? Because you can't have 10 platforms, or maybe you can, but how do you see that evolving from a customer standpoint? Because if I'm a CISO, I got to reign in the chaos, and I have to have an offensive defensive plan. What's the platform look like?

>> So, let's start with some sort of just basics, right? So it is not uncommon for a company to have a hundred, 150, even 200 different technologies, tools, products in their environment. And they're trying to figure out how to operate all this stuff. They're trying to figure out how to deploy it, how to integrate it, how to make sure it's configured correctly, understand the alerts, prioritize that, follow up on it, all of that. Imagine doing this across 200 different technologies that were not designed to work together. Versus it doesn't have to be 200 going to one. I don't think that's the, it's not going to be quite that ratio, but imagine if you could take 50 of those things and deliver all of them in a single platform. Or think of as like single solution where all those different capabilities are natively designed to work together so that out of the box, everything is correlated. It's configured in one place. The prior, everything is being prioritized in one place just for that portion. Game changer. So now you do that a few times. And most likely the outcome is building around a few key platforms, and there will still be some sort of these, I'll call it more corner case niche technologies that fill in the gaps. That versus today's state is a world of difference in terms of outcomes, and it's a world of difference relative to how much money goes into a solution like that.

>> So the scenario is phases, 200 might go down to 150, then 150 maybe goes to a hundred, and it might take 10 years, but you'll start to begin to...

>> Lee: It can't take 10 years though. I won't be an optimist if it takes 10 years.

>> Okay. Great. So, so you, okay, here's my question. You put up a slides, security is solvable.

>> Lee: Yes. >> Okay. And got it. That was, I think shocks some people. Is it solvable without getting rid of stuff? I think, no, it's not. You got to get rid of stuff. Which we never get rid of stuff in IT, but you're helping. So if it's not 10 years, what's the realistic timeframe for customers that's doable?

>> Obviously it depends on where they're starting from. We have customers that are on this journey, very well in this journey already. And so what is left for them is going to be different than someone who's just trying to figure this out now. But, and I'll, sorry, just one point. It's not a question of getting rid of stuff. It's about whether or not we can replace these point solutions with natively integrated capabilities.

>> Well, well said.

>> Yeah. You need the capability. It's just how you consume and use the capability is changing.

>> But you got to retire some of those point tools.

>> Oh, absolutely. Absolutely. The absolute number has to absolutely decline. So what we're doing is we're basically taking our customers on this journey in network security. So NextGen, firewalls, software, NextGen, firewalls, sassy being able to deliver all of that with an integrated set of capability. So that a customer can accomplish zero trust across their entire enterprise. In doing that, and that can be done in a, depending on the size and complexity organization, that journey can be done in the course of, you know anywhere from say, one to three years. Okay? Now, cloud security is going to be a similar journey, but it's going to be a different starting point, typically. A lot of people are starting with just trying to get visibility in the cloud, and then they're going to go on this journey of how they take that, shift left into the dev and DevOps environments, and then also add in the runtime protections. That also is a journey that can be done in one to three years. And then the same thing is happening in the SOC, with SOC transformations driven through data AI automation. And again, we have customers who are going this journey in one to three years. And so we break this into those three sort of spaces, and they can be done in parallel.

>> It has one to three years for a really a reasonably complex environment, right? Is that fair?

>> Lee: I think so.

>> You have the hardest job, I think. Maybe the most fun job. You have the chief product, you have the keys to the kingdom. You got engineering, you got customers, you got to put the roadmaps together. I mean, those are structural things. You talk about cloud is different than say some of the on-premise activity, then you got network security. That's a huge structural underpinnings that are happening. What does native integration mean? And it implies developers. So, you know, as developers are building now apps on top of a platform, that's the new enablement equation. So as a product leader, how do you prioritize, how do you look at that, and you got you know, change the airplane engine out at 30,000 feet, at the same time try to innovate something game-changing on a on enablement side on the platform for the customer. What's the product thinking? How do you operate that? Just take us through your mindset on how you look at that. 'Cause customers want faster, but they don't want to unplug anything. They want to still defend and do their things.

>> So the first thing we did is when we started to execute this sort of broader strategy, about say five, six years ago was we looked at it in these three spaces. Network security is a huge space in and of itself. And so I have an organization in network security, focuses on that. So everything involved in delivering world-class, you know network security as a platform is one organization for me. Same thing with cloud, same thing with security operations. Now, there's connective tissue across these three different platforms. But what this allows us to do is to break the problem up into logical pieces that make sense, where the integration produces significantly better results than it otherwise would be as point products.

So that's the first thing. >> Give an example real quick.

>> So think of network security. Network security needs to be done in hardware because there's large campus environments, data center environments, it needs to be done in software form factors for private cloud, public cloud environments. It needs to be done in sassy. So cloud delivered for remote users and branch offices. So for us, that's hardware, software, sassy, form factors. Now when we come out with a new security service, so a few years ago we came out with DNS security, we came out with this, a cloud-based service that plugged into each of these form factors natively. So if you're a customer of one or all of these things and we just release DNS security, you click a couple buttons all of a sudden you're doing DNS security across your entire enterprise. Versus if you do this as a point product, what you have to do is you have to look at like, "Okay, I need to roll this out everywhere separately. It's new infrastructure, it's new architecture, new everything. It's a, you know, that might be a 12 month project just to add one capability versus..."

>> I really wanted to get that out, 'cause that's a platform, that's the benefit of the platform. I can do it over here, I can do it everywhere. Depending upon how that plugs into on top of.

>> Yes. Now we take telemetry we're learning from providing DNS security, and now we can start to inform how we detect new malware, how we detect new phishing sites, and vice versa. Detecting new malware can inform our DNS security, and make that smarter. So now we start to get integration benefit across the different security service.

>> Are the core principles the same across those sort of three platforms? Or are there sort of significant nuances or differences? Like take cloud for example.

>> A lot of the core principles are the same. How we do it is very different. How you do security and public cloud infrastructure is very, like, there's some fundamental differences between enterprise, but a lot of the principles are actually the same. For example, the reason there's so many point products in cybersecurity is because security's so important. Like people are not buying.

>> It's lucrative if you're a startup, you could come out with a product and make some money and sell it.

>> Lee: Yeah. No, but but think from...

>> There's a problem.

>> From a customer perspective. From a customer perspective, cybersecurity is super important. They want to have the best. So they go out and they look for the best. So the first principle is everything we do has to be best in class on its own. Then we integrate it and deliver it from a platform which makes it way easier. It makes it, to operationalize. It allows us to start to get cross capability benefits like I was mentioning before. And so that starts. So the principle there is we need to be best in class at everything we do, and then deliver incremental or value through the platform approach. So we have to focus on integration layer at the same time.

>> Is that what you mean by native integration?

>> Lee: Yes. >> Okay. Got it.

>> But it's hard to be, I mean, the industry suggests it's really hard to be best in class and sort of integrated as a platform.

>> Hasn't happened before.

>> Has not? >> No.

>> Right. I mean, IBM hasn't done it. I would argue Oracle hasn't done it. None of the other big, you know, I mean take Dell now. Hundred billion dollar company hasn't done it. Yeah. Okay. But security, nobody's done it.

Not even... >> Lee: Well it depends.

>> I don't even think anybody's tried until, you know now people are talking about it. So what gives you confidence that that's doable? That you can be both best of breed, and have that platform across.

>> So five years ago, if you asked me that question, I would've had to just answer, "Wait and see." We're going to find out. We're now five years into the strategy. We've now shown that we can build a world-class sassy solution as an extension of our network security capabilities. We've now shown that we can put together a set of best in class capabilities that are delivered in an integrated platform with Prisma Cloud for cloud security. We've now shown in security operations in Cortex with XIM, that we can put together a best in class set of capabilities delivered as a platform. So we've now shown it. Now we're not at the ninth inning, and use the baseball analogy, but we're no longer in the first inning on proving that this is possible. And we've done it by making sure that we put innovation first. We have to lead with innovation, we have to make sure our customers are successful, as opposed to leading with go-to-market. Which is often how platform companies think about is like we'll do some stuff and then our go-to-market machine will find a way to sell it.

>> So, I mean, the industry's ripe with, rife with over promising. You were pretty confident that you're not, I mean, I don't know you that well, but I've met you a few times and you seem like a pretty credible individual. But you know what I'm saying about the industry's over promising?

>> Lee: I understand.

>> But you're standing by your promise, your brand promise to your customers that this outcome that you're envisioning is something that you're going to achieve for your customers.

>> Lee: I'm not saying it's easy.

>> Dave: No, I'm not saying it's easy either.

>> I'm saying it's doable.

>> Dave: It's bold, that's good, doable.

>> I have a question on the industry because we talk about a lot about IT transformation. Companies have IT departments, security obviously the number one focus on everything we do we used to talk about. But security is now such a big thing, has it gotten to the point where people are now realizing that it's not just IT and security and developers, it's all kind of one thing. 'Cause when you talk about platforms the way you talk about it, that's not like, just a security thing that is like, a bigger thing. Like you're taking a little bit more of a like, hey, because every company is either out of business if they're not hacked, they could be out of business. It's a huge downside with the security vulnerabilities. This is now a company structural thing. In fact it might even be subordinate to this because it's under the table. Well it's been abstracted down in the plumbing.

>> Yeah, I understand what you're saying. Look, the network security has always been a joint partnership between security teams and networking teams. Like cloud security people are finally realizing that it's going to be a joint ownership between a cloud security team and the development of DevOps teams, right? So the, and so that's sort of the, like what I'm describing is sort of the security teams and the IT teams if you will, or development teams. They're now approaching these problems as partners and figuring out how do we solve these together? I'll give you an example in cloud security. If you only, if you wait until an application is, you know in runtime run in production use to try to do security, you will eventually fail. Because you'll have too many alerts, you'll have too many issues. And trying to fix them at that point, and going back to the developers that developed the application, say, "You have to go fix, you know all of these things that are wrong." They're going to say, "I don't have time to do it now, and I don't want to break an application that's running the business." Which is why cloud security teams are now working with dev and DevOps teams and saying, "We actually have to do these security checks in the build process, in the coding process, and provide real time feedback to the developers." So we fix it before it's running in production. This is what we call shift left. This is a big deal when we get it right and when customers get this right, it's amazing. Developers love it. This is not like develop... Everyone's afraid that it's going to be hard for them. Developers love it when you integrate this feedback into their tools at the right time when it's easy for them to make.

>> If you do at the point of coding, they love it. They don't have to come, their job's done.

>> They don't have to do it over.

>> That's right.

>> But this is what I'm saying. I mean look at the, I love how you're bringing the network security into it, it's such a critical piece. Cloud and on-premise and edge now are going to be the distributed computing paradigm. We all know what that is, people in the industry. that operational construct is can't be cloud versus this, it's all network at the same day. You got to have the same network security position as you got in the cloud. But they're different environments, but they still got to work together. Packets move from point A to point B all the time. And applications are going to be built on top of it. So I just think this whole idea of a platform versus tool is a huge important conversation, because that is now the substrate of how things will be run. And if you shift left with the developers, then they're coding all day long.

>> Yes. And then on top of that, we have to be able to understand the experience that is being delivered to the user that ultimately is actually using all of these applications, the networks and things like that, and actually be able to measure that and automatically respond to and heal issues that that user is seeing.

>> Okay, so the customer, take me through the example of a customer, now how are they reacting? So I can see a customer saying, "Finally, can someone do this?" Or are they scratching their heads? Do they need a little training? Or they either pull them through. What's the customer experience?

>> Dave: Are they skeptical at first?

>> Let's see, let's see what's the motion like?

>> Dave: Are they more like, "Please do this"?

>> For many years this was a hard sell. Over the last couple years I've seen a transition where instead of me trying to explain to a customer, "Hey, this is what I think we should be doing." I'm having more and more conversations where the customer's starting the conversation by saying, "What we've been doing in the past is no longer working. We need, we're here to ask you, talk to you about how you think about the ability for us to move on to a more platform-based approach." So the mindset has shifted, and one of the big drivers for this is the accelerated move to the cloud, the accelerated move to hybrid work via you know, COVID remote work has triggered this change. Because it used to be that everything, you could kind of bring everything back to some central points and you could kind of say like, "I'm just going to bring you back to my data center. I'm just going to bring you back to my campus. I'm just going to bring everything back, and I'm going to do all this stuff in this one place." Well all of a sudden you have to do this everywhere. And you can't, and all this people are, "I can't do a hundred things everywhere. I need, I'm going to have to have a solution that's much more integrated in order to be able to expand out."

>> Yeah. I think it's brilliant strategy I think. And also having these, the point solution be natively great on its own with the ability to plug into the platform is going to pull the platform up when you can. I'd love to get your thoughts. Dave, we've been chatting a lot about cloud native security and a lot of our open source conferences we go to, which brings up the conversation of, I got cloud networking and I got other networking, you know, routes and whatnot. These networks guys, you know, it's super important. As those come together and become hardened in the platform, what's your vision on that piece? 'Cause what that will say is, I don't, the packets and security and network security has to be completely locked down in in any environment, and they're not always aligned right now from what we've been reporting and it's getting better. The customers want to have their network teams in line with the cloud networking. So it's in multiple cloud, it's invisible standard. What's your vision on this?

>> So sort of yes to both. You're sort of saying either/or, but I'm going to say yes. So the network teams are still the sort of the experts on how networking works. How networking works in the enterprise space is different than how networking works in the cloud. It doesn't mean that it goes away in the cloud, it's just different. So what we have to do in doing network security is we have to adapt our products to be able to understand these different environments and integrate seamlessly into these different environments. I'll give you an example. We've, over the last about year and a half or so, we've been rolling out what we call cloud NGFWs. So what these are are software based next gen firewalls that are designed as a service in the cloud. So they're designed to basically be part of the cloud network as opposed to sit on top of the cloud network. So this is an example. Now, they have all the same security capabilities, but how it integrates into the environment has been adapted for that environment to be easier for the customer. So this is how we think about adapting what we do.

>> It's a networking layer across environments, basically. Building natively into the platform.

>> Now how that does networking and how we do networking in the data center are different, but the security capabilities that sit on top are the same. That's the important.

>> Versus on different environments, connecting.

>> Versus having different security in different environments. 'Cause now you have the security teams going, "Wait, wait, wait how do I do this?"

>> Well, speaking as different environments. You mentioned sassy before, what's the state of sassy? I mean, is it working as intended?

>> Yes and yes.

>> Oh, that was easy. Yes and no.

>> Look, the concept of sassy is incredible, right? It's leveraging the cloud to deliver security to any user, any branch office, anywhere in the world to create a sort of direct to app type architecture. Because more and more applications are on the cloud too. So instead of back calling traffic to a data center, you create this architecture that's like really amazing. And on top of it, because we're leveraging cloud, we get the benefit of cloud scale, which is one of the key things I mentioned yesterday about why I'm optimistic is the benefit of cloud scale and machine scale to do things that otherwise would've been manual is incredible, right? So that's why, you know how I think of sassy, why its so incredible. Now as we do that, similar to what we're just talking about, we can deliver the same security capabilities, we can deliver the same security policies, we can deliver the same user experience regardless of where they're located. Which, when you think about hybrid cloud, you might be working from anywhere on any day, and you want the same experience. You want to be productive as an employee regardless of where you are. We are able to uniquely do that. And so that network security platform that goes across these different form factors is what enables us to deliver that. And that is what is resonating with our customers. And when they start to then say, "Okay, I have to do all of this, by the way, I need to do zero trust." And zero trust is an enterprise wide concept, not just a use case based concept. Now all of a sudden they go, "How am I going to do that?" Well you do it by having a consistent platform everywhere.

>> It's so funny, Dave, we always talk on theCUBE, we got to re-platform and refactor. This is like just platform.

>> Just platform, right?

>> Just platform your security, 'cause there's no re, you can't, there's no platform to re-platform.

>> That's right.

>> So it's essentially establishing a new platform.

>> Lee, love the positivity, you know, always a great guest. Thanks so much for coming on theCUBE.

>> Thank you.

>> All right, you're welcome. All right. Dave Vellante and John Furrier are in theCUBE. We're here live, RSA 2023. Keynotes are breaking out. Everybody's going to be heading to lunch soon. We'll be back right after this short break. See ya, Scaravella.

Lee Klarich | Palo Alto Networks

(soft music)

>> Wonderful to see you.

>> Okay, every year we spend more on cyber, yet we feel less safe. Why are you an optimist? (all laugh)

>> So the scenario is phases, 200 might go down to 150, then 150 maybe goes to a hundred, and it might take 10 years, but you'll start to begin to...

>> Lee: It can't take 10 years though. I won't be an optimist if it takes 10 years.

>> Okay. Great. So, so you, okay, here's my question. You put up a slides, security is solvable.

>> Well, well said.

>> Yeah. You need the capability. It's just how you consume and use the capability is changing.

>> But you got to retire some of those point tools.

>> It has one to three years for a really a reasonably complex environment, right? Is that fair?

>> Lee: I think so.

So that's the first thing. >> Give an example real quick.

>> I really wanted to get that out, 'cause that's a platform, that's the benefit of the platform. I can do it over here, I can do it everywhere. Depending upon how that plugs into on top of.

>> Are the core principles the same across those sort of three platforms? Or are there sort of significant nuances or differences? Like take cloud for example.

>> It's lucrative if you're a startup, you could come out with a product and make some money and sell it.

>> Lee: Yeah. No, but but think from...

>> There's a problem.

>> Is that what you mean by native integration?

>> Lee: Yes. >> Okay. Got it.

>> But it's hard to be, I mean, the industry suggests it's really hard to be best in class and sort of integrated as a platform.

>> Hasn't happened before.

>> Has not? >> No.

Not even... >> Lee: Well it depends.

>> Lee: I understand.

>> But you're standing by your promise, your brand promise to your customers that this outcome that you're envisioning is something that you're going to achieve for your customers.

>> Lee: I'm not saying it's easy.

>> Dave: No, I'm not saying it's easy either.

>> I'm saying it's doable.

>> Dave: It's bold, that's good, doable.

>> If you do at the point of coding, they love it. They don't have to come, their job's done.

>> They don't have to do it over.

>> That's right.

>> Dave: Are they skeptical at first?

>> Let's see, let's see what's the motion like?

>> Dave: Are they more like, "Please do this"?

>> It's a networking layer across environments, basically. Building natively into the platform.

>> Now how that does networking and how we do networking in the data center are different, but the security capabilities that sit on top are the same. That's the important.

>> Versus on different environments, connecting.

>> Versus having different security in different environments. 'Cause now you have the security teams going, "Wait, wait, wait how do I do this?"

>> Well, speaking as different environments. You mentioned sassy before, what's the state of sassy? I mean, is it working as intended?

>> Yes and yes.

>> Oh, that was easy. Yes and no.

>> It's so funny, Dave, we always talk on theCUBE, we got to re-platform and refactor. This is like just platform.

>> Just platform, right?

>> Just platform your security, 'cause there's no re, you can't, there's no platform to re-platform.

>> That's right.

>> So it's essentially establishing a new platform.

>> Lee, love the positivity, you know, always a great guest. Thanks so much for coming on theCUBE.

>> Thank you.