RSA Conference 2023 | Mohit Tiwari | Symmetry Systems

theCUBE.net

More from RSA Conference 2023

Mohit Tiwari

Co-Founder and CEO

Symmetry Systems

Info

Mohit Tiwari | Symmetry Systems

Mohit Tiwari

Co-Founder and CEO Symmetry Systems

search

(cheerful music)

>> Hi, everybody. This is Dave Vellante, and we're back at RSAC 2023, the RSA Conference. This is really, we're back to 2019 levels. At least, it feels that way. Remember 2020, this was the last conference. It was March of 2020, just right before the lockdown. People were kind of not really sure if they should even be here. Is this a, you know, what's going to happen? And then, of course, the world shut down for the better part of two years. But we're back, and theCUBE is here. We're really excited. Myself, John Furrier, we're here all week. Monday, Tuesday, Wednesday, Thursday, live broadcasting here from Moscone West, so stop by and see us. Mohit Tiwari is here. He's the CEO and co-founder of Symmetry Systems. Mohit, thanks for coming on, theCUBE.

>> Thanks for having me. Really appreciate it.

>> So, Symmetry Systems, but by the way, you're also a professor at UT Austin. Very cool, great school.

>> Thank you, yes.

>> Our mutual colleague, Bob Metcalf. He's there as well. But, so congratulations on the work that you're doing there. But tell us about Symmetry Systems. Let me ask you the question I'd love to ask founders. Why did you start the company?

>> Well, so there are two things. One is we care deeply about privacy. I would like me and other people to have agency over their data. So that was sort of the founding reason. But then, it's also about competence. We love building infrastructure, we love doing security work. So we just wanted data and privacy, control over data visibility into data to be built into infrastructure. And when we came out, we just realized talking to companies, everyone has good intentions, but they just don't have the tooling. So when you say like, oh, Facebook didn't have visibility into where data went, or if you look at Okta, it's like, "Hey, contractors, what data was being-" It's not that they mean harm. It's just that there's no good tooling for them to have visibility into this data. That's why we started

>> When we were prepping for RSA, we had little editorial meetings and you've put forth key issues. And one of the issues that came up was, one of the criticisms of the security industry is they're building essentially a massive surveillance system. And one of our guys said, yeah, maybe, but it's really the social media companies that are perpetrating that. And you just pointed out they don't have the tooling. I mean, despite the fact that they have all these resources. So is that what Symmetry does? You provide infrastructure and tooling to ensure privacy and providence and lineage?

>> Exactly, exactly, exactly. Our percept is very, very simple. Now, if you are an organization, you're deployed things on the cloud, you will want to understand what data do you have? Where is it? How is it protected? How's it being used? How is it flowing through the environment? So that table stakes compliance is easy, but really, you can get a lot of heavy duty security lift done, right? You can protect the data itself rather than, if you just have simple questions, did contractors touch customer data in the clear, right? You can't answer it. You have to look through hundreds of logs of different tools and such. Whereas if you followed the data, you could just answer that question directly.

>> So your solution simplifies, it allows you to follow the data and makes it simple. Because you can't do it otherwise, is what you're saying.

>> Yes.

>> And it's a software platform that does this?

>> Yes, exactly. It's a service that deploys into the customer's cloud. So that's a big decision we made upfront. We don't want to be a regular SaaS where we now become the single point of failure and we host everyone's data. We are providing a service, deploy the service into the customer's cloud environments and wherever the data is, wherever the cloud is, the service just kind of like a flight data recorder, it watches what data do you have. Like a crawler, it figures out how it's moving and now you can build workflows on top. You can ask questions that, hey, data production, customer data flow into a dev or a staging environment, right? So all of these are essentially questions around data flows and you can just ask the question directly, data type, identity type, and let something happen to it.

>> Okay, so it's not a managed service or is it a managed service?

>> Oh, good, good. So managed service is slightly- It's not a SaaS in the classic sense of Symmetry. Symmetries cloud does not need to pull in the customer's data into our cloud. We bundle up everything we do into a virtual machine, into a Kubernetes deployment, and you can ship it into anywhere, any availability zone.

>> I can put it on-prem if I wanted to?

>> Absolutely. In fact, we have customers who have FedRAMP environments and they are deploying Symmetry in a FedRAMP environment as well, where Symmetry, I have no access to anything. So it's almost like the deployment model is very similar to classic infrastructure. You kind of push things into the customer's environment, but the software delivery mechanism is all SaaS, like CNCF cloud native tooling kind of lets you be cloud agnostic, push code, push everything into the customer's environment, and they get latest updates. They can control everything. They have visibility into everything, but, yeah.

>> What's your secret sauce? Is it your ability to surveil? Is it an agent technology?

>> Yeah, so that's really good. So agent is a very loaded word in the sense that like-

>> But a lot of people don't like agents, but, I mean, CrowdStrike's got a powerful agent and they make a big deal out of it as an example. So they turn it into a positive lightweight, but okay. So maybe not in the classic sense of an agent that needs to be managed, but explain.

>> So I think, yeah, exactly. I think to me, there are three layers that are good to consider independently, right? One is the plumbing. Some places agents make sense. If you have a laptop or a device out there, agents don't leave it, that's great. You should have that. For us, what really made sense is, where's the most of your data? It's in these giant data stores. You have S3, you have RDS, you have DynamoDB, you have Snowflake, Databricks, you want visibility and control over this stuff first. Stuff that goes out into an endpoint, that's kind of the nerve endings. You want control over your spinal system first, and then you sort of figure out what happens on the edge. So that's where we are starting from where your hybrid cloud environment could be AWS, GCP, it could even be on-prem Azure. Understand what's going on there. And it's a service that drops into every availability zone. And all it needs is sort of like a crawler read only access to different types of data stores, right? And we want to be very systematic. Our superpower really is, A, the deployment model into the customer's cloud. We call it SaaS in your cloud, right? Where it's kind of like beamed in like a SaaS but it's in the customer's environment. That's the stage zero. It allowed us as a startup to get into incredibly regulated customers, which if we were a regular SaaS, we would never even make it.

>> And is it a send and forget it type of thing or is it am I constantly interacting with it?

>> Yeah, so the way I think about it is that it has to land well and give you wins immediately. That's not negotiable. So once that happens, over time, it's learning from every action that you're doing. So a key part of all this is that your data flow policies like you observed earlier, they become really compact. They become really simple. And we are helping our customers sort of build out, here's a set of data flow policies that for any AWS environment makes sense, what's production, what's not, what are contractors, who are not, what are external, what's internal, right? This sort of stuff and data flows across them. But then as time goes on, you can get really deliberate about, look, you can really customize it for your own, like, I have very specific, I have a project baby Yoda coming up. I'm Mattel, right? And I want to keep this super secret even from our own infra people, how would I do it, right? So you can sort of start building your org-specific custom stove pipes, right? And the system has to be super extensible for this. So these, yeah.

>> And how do you price it? Is it capacity pricing?

>> So the pricing model, we are still kind of iterating over it. Our first goal was we don't want to have our customers get nasty surprises. So we picked a very simple sort of infrastructure centric model where it's a small, medium, large deployment off Symmetry, right? And a small environment can watch a pretty big customer environment and before you run out of capacity, you'll see it coming. So, you know I need to add more small clusters or add a medium cluster and so on. It keeps your blood pressure pretty low. It's just because you have a data lake, you downloaded a bunch of data, all of a sudden, your bills won't spike. So that was really important for us.

>> So almost like T-shirt sizes.

>> Small, medium, large sizes, exactly.

>> You know, software pricing, no matter what you do, it won't be perfect.

>> Exactly. But then we have a pretty rich partner ecosystem. Do we have customers who use it for- We have partners who use it for compliance. We have partners who use it for zero trust assessments. We have partners who use it for incident response. And I think for these deployment scenarios where the use case is very similar and it's kind of like small bins of time, we are trading on different pricing models for us.

>> You've got three use cases, compliance, zero trust and incident response.

>> Right.

>> So take take zero trust, it's a hot topic right now.

>> Yes, absolutely.

>> Where do you fit in a zero trust architecture?

>> Absolutely. So if you just go back to the NIST classic diagram, there's a subject, there's an identity, there's the pipe, the network pipe, and then there's a resource, right? In the NIST document, the resource really that matters is data. So there's zero trust for identity. So you have authentication, you have continuous authentication. There's the pipe that's zero trust network access, SaaS, all this stuff. It's kind of interesting to me that people started with the pipe as opposed to what are we protecting? So we sort of are the zero trust for data where you understand what data do you have. The NIST documents, the CSAR documents now really list this out like, you have to have visibility into what is your crown jewel, what are you protecting, what should the policy be? And then sort of figure out the identity and the pipe is almost, we are doing it first but to me, logically, it sort of fits like it should be the third thing, right? Because there are many ways to construct pipes, some are networks, some are just-

>> What are you learning? When was the company founded?

>> 2019 Q4.

>> 2019, so you're young. Okay, so, well, that's interesting. You started right before COVID.

>> Yes, so I would say 2020 was, we are all in person and then it shut down.

>> So what have you learned in terms of customers cloud, any cloud, including on-prem clouds. What have you learned in terms of deployment? We always hear everybody's multiple clouds. Are they using your product in multiple clouds?

>> Absolutely.

>> Okay, so what's the dynamic like? What are you seeing in terms of cloud adoption? And it continues, people talk about how it's slowing down, but it's still much, much faster than the overall market. What are the trends that you're seeing inside the cloud?

>> So one big theme to me is every, even our small startup customers have multiple cloud deployments. It's because someone got a contract with GCP or with a large customer on GCP. They were primarily on AWS but now they have to go to GCP, right? A lot of big companies are getting deals from Azure. So they'll have something there. Or a lot of times we see like data lakes, BigQuery is a huge gravitational pull for data lakes. And for product workloads, S3, RDS, like the classic AWS environment is very popular. So the same company will have a data lake team here and a product team there. So for us, the big theme that I feel we are able to deliver to customers is what you referred to earlier. I want my policies, my questions are very simple. I want to be able to say like, hey, I do not want external identities accessing my production data in the clear. Now, it doesn't matter if it's in BigQuery or upstream, it's in a product environment like AWS. I want the policies to be monitored and enforced consistently. So the analysis that I like is just like TensorFlow or PyTorch. They do this for you. Machine learning models. I don't care if it's a CPU, GPU or FPGA, right? I just found simple policies, domain experts writing these policies, right? Compliance experts or security experts. They're not necessarily cloud permissioning experts or exact data store S3 corner case experts, right? So we want to separate out sort of the implementation from the policy. And I think that's the biggest problem.

>> And the experience with your solution is identical no matter whether I'm on-prem or Google or Azure or AWS or GCP.

>> By and large, for 80% of your questions, it's identical, that there is a kind of a long tail 20% use cases where these are corner cases that are unique to your organization and how your organization kind of used AWS off vintage 2016. AWS was pushing like, hey, service control policies and cross account like this and now they're like back or attribute-based access control like that. And now there's something else that comes up, CDK-based deployments, right? So every sort of archeology, right? Like, you can sort of see different stacks that were all deployed. And sometimes, those are corner case things that only make sense, those questions only make sense for AWS. So barring those edge cases, by and large, it has to be a consistent kind of view into every cloud, right? Like, where is my genomic data across my environment? Just tell me where it is, right? And who should I call to fix the non-compliant or not secure genomic data? These are the two questions that security teams or governance teams most care about, right? Is there a ton of buildup of dormant data around?

>> So that was the other use case I was going to ask you about was compliance, how bad is it when you go and investigate? How severe and acute are the compliance problems that are out there?

>> So I think the seven graces that auditors, Azure attacker are a much lower bar than attackers, Azure attacker. So even though the problems are pretty severe, right, the auditors sort of work with the customers to be like, look, I understand why you don't have full visibility. Of course, you can't deploy data classification at the scale of billions of objects. We all understand. No one has it. So let's just mark this as accepted risk. But you don't need to if you have more modern machine learning based tooling, right? Similarly, for permissions, they sort of just export cloud permissions to the auditor and the auditor's CPA and says, I guess it looks good. So I think compliance, sort of we have to move, we as security professionals, we have the responsibility, I think, to simplify every big advance in security, we have to simplify it. Teach the community, teach both the auditors who are trying their best, teach the customers who are also trying their best. Like, hey, here's a new tool, here's what this means for you. Now, both of you all come, meet, look, we all did something great because now you can give evidence to why segregation of duties is being followed or why, I mean, simplest question, right? Disaster recovery is a big theme in compliance. How do I show that everything that is business critical data is backed up? Is there a data flow to a backup environment? It's a big question. It's incredibly hard to show, but now we can show it. So we sort of want to move both sides of the game forward. It's pretty, you know, you can imagine it's really hard to get done now, but hopefully in a couple years it'll be.

>> You mentioned partners before. Maybe talk a little bit more about your partner ecosystem and what you go to market strategy.

>> Absolutely. So we think data and protecting data has to be done in concert with partners who understand the business side intimately. Because you can take people's permissions away from their printers or change the container underneath the developers and they don't really, really care unless you break some dependency. But if you take the head of data sciences permissions away a week before Black Friday, that's not good. So you have to be really intimate with what's going on in the business. So we have essentially for each NIST pillar, there are security advisory companies, like zero trust strategy companies that we partner with. Accenture Zero Trust is a great partner for us. We have customers who sort of deploy data lakes and manage data lakes for them. So we have partners there. We also have incident detection response-type companies that are partners or they're trying to provide cloud security services, right? So Trace3 is a kind of innovation forward partner. We partnered with them. TBC, we have kind of really good local partners as well, regional partners, where we believe that teams that understand the business they use our power tool responsibly. Like, that's sort of the GTM strategy that we are following.

>> The last four months or so with all the generative AI hype have been just amazing. What are your thoughts on all that? How are you experimenting using foundation models like GPT? What's the fit?

>> Yeah, so to me, there are two parts to it. One big part is just our customers getting a user interface that is incredibly natural, that is tailored to their organization, and how the cloud is used. ChatGPT is incredibly good with ask. If you ask an arcane AWS permissions question, it's even better than the AWS definitions, right? So customers can really get tailored answers to that. That's the pro. The tricky bit is a lot of these even permissioning models. So what data do you have? All this stuff is super sort of private to each organization. So I think the future where like you could sort of have a foundation model but train it locally to an organization, deploy it locally into the cloud, that's going to be amazing. Just for visibility and understanding proactively, and then later on, even for detection response kind of use cases.

>> It's going to be interesting to see how that plays out, Mohit. I don't know if you remember. So Google search is the best, right? Everybody loves Google search. For a while, you could take Google search and put it on your own website, remember that?

>> Yes, absolutely.

>> And then they killed the product because they realized, well, let's bring it back to Google. We'll get the advertising revenue. It's, we're far, far, decades beyond that now. But it's going to be interesting to see how that model plays out. Last question. I'm going to ask you. I know you have some announcements coming up in the future, but maybe you could tease us a little bit as to what's coming.

>> Absolutely. So one big thing that we are doing is zero trust, we believe should really be anchored around your crown jewel data. So in partnership with Accenture's zero trust team, we are launching this data guard express, Data Guard is the name of our product, Symmetry Data Guard Express, which is you can deploy it in your cloud and it'll come back and tell you evidence for, hey, here are the concrete things that you need to do. And it takes order of days for you to have something really tangible ROI and not just least privilege kind of thing. So it'll be exciting.

>> I didn't ask you about a funding model. Can you talk about your venture capital, how much money you've raised, where are you at?

>> Yeah, so we raised our seed round in 2019. We have finished raising our series B. Our series B announcement should also be in a month or two from now. We wanted to let the RSA hype sort of dive down. So we have finished raising our series B at this point. We are about 50 people and set to sort of get into the next.

>> Is it public how much you've raised or?

>> No, not yet. We have a couple of strategic partners who are still finalizing their rounds, their investments. So we are going to wait for another month or so.

>> Oh, great. Well, congratulations on getting the company off the ground and thanks for coming to theCUBE. Best of luck to you.

>> Thank you so much, Dave.

>> All right, pleasure to have you.

>> I appreciate it.

>> All right, this is a wrap day one here. We're here all week RSA Conference 2023. The keynotes are going on right now. I'm here with John Furrier, so come back tomorrow, theCUBE.net. Siliconangle.com has all the news. Rob Hoof is on the ground with his team. Mark Albertson's here, our newest journalist in the cybersecurity space, David Strom. So check it out. We'll see you tomorrow. Thanks for watching.

>> Thanks, Dave. (cheerful music)

Mohit Tiwari | Symmetry Systems

search

(cheerful music)

>> Hi, everybody. This is Dave Vellante, and we're back at RSAC 2023, the RSA Conference. This is really, we're back to 2019 levels. At least, it feels that way. Remember 2020, this was the last conference. It was March of 2020, just right before the lockdown. People were kind of not really sure if they should even be here. Is this a, you know, what's going to happen? And then, of course, the world shut down for the better part of two years. But we're back, and theCUBE is here. We're really excited. Myself, John Furrier, we're here all week. Monday, Tuesday, Wednesday, Thursday, live broadcasting here from Moscone West, so stop by and see us. Mohit Tiwari is here. He's the CEO and co-founder of Symmetry Systems. Mohit, thanks for coming on, theCUBE.

>> Thanks for having me. Really appreciate it.

>> So, Symmetry Systems, but by the way, you're also a professor at UT Austin. Very cool, great school.

>> Thank you, yes.

>> Our mutual colleague, Bob Metcalf. He's there as well. But, so congratulations on the work that you're doing there. But tell us about Symmetry Systems. Let me ask you the question I'd love to ask founders. Why did you start the company?

>> Well, so there are two things. One is we care deeply about privacy. I would like me and other people to have agency over their data. So that was sort of the founding reason. But then, it's also about competence. We love building infrastructure, we love doing security work. So we just wanted data and privacy, control over data visibility into data to be built into infrastructure. And when we came out, we just realized talking to companies, everyone has good intentions, but they just don't have the tooling. So when you say like, oh, Facebook didn't have visibility into where data went, or if you look at Okta, it's like, "Hey, contractors, what data was being-" It's not that they mean harm. It's just that there's no good tooling for them to have visibility into this data. That's why we started

>> When we were prepping for RSA, we had little editorial meetings and you've put forth key issues. And one of the issues that came up was, one of the criticisms of the security industry is they're building essentially a massive surveillance system. And one of our guys said, yeah, maybe, but it's really the social media companies that are perpetrating that. And you just pointed out they don't have the tooling. I mean, despite the fact that they have all these resources. So is that what Symmetry does? You provide infrastructure and tooling to ensure privacy and providence and lineage?

>> Exactly, exactly, exactly. Our percept is very, very simple. Now, if you are an organization, you're deployed things on the cloud, you will want to understand what data do you have? Where is it? How is it protected? How's it being used? How is it flowing through the environment? So that table stakes compliance is easy, but really, you can get a lot of heavy duty security lift done, right? You can protect the data itself rather than, if you just have simple questions, did contractors touch customer data in the clear, right? You can't answer it. You have to look through hundreds of logs of different tools and such. Whereas if you followed the data, you could just answer that question directly.

>> So your solution simplifies, it allows you to follow the data and makes it simple. Because you can't do it otherwise, is what you're saying.

>> Yes.

>> And it's a software platform that does this?

>> Yes, exactly. It's a service that deploys into the customer's cloud. So that's a big decision we made upfront. We don't want to be a regular SaaS where we now become the single point of failure and we host everyone's data. We are providing a service, deploy the service into the customer's cloud environments and wherever the data is, wherever the cloud is, the service just kind of like a flight data recorder, it watches what data do you have. Like a crawler, it figures out how it's moving and now you can build workflows on top. You can ask questions that, hey, data production, customer data flow into a dev or a staging environment, right? So all of these are essentially questions around data flows and you can just ask the question directly, data type, identity type, and let something happen to it.

>> Okay, so it's not a managed service or is it a managed service?

>> Oh, good, good. So managed service is slightly- It's not a SaaS in the classic sense of Symmetry. Symmetries cloud does not need to pull in the customer's data into our cloud. We bundle up everything we do into a virtual machine, into a Kubernetes deployment, and you can ship it into anywhere, any availability zone.

>> I can put it on-prem if I wanted to?

>> Absolutely. In fact, we have customers who have FedRAMP environments and they are deploying Symmetry in a FedRAMP environment as well, where Symmetry, I have no access to anything. So it's almost like the deployment model is very similar to classic infrastructure. You kind of push things into the customer's environment, but the software delivery mechanism is all SaaS, like CNCF cloud native tooling kind of lets you be cloud agnostic, push code, push everything into the customer's environment, and they get latest updates. They can control everything. They have visibility into everything, but, yeah.

>> What's your secret sauce? Is it your ability to surveil? Is it an agent technology?

>> Yeah, so that's really good. So agent is a very loaded word in the sense that like-

>> But a lot of people don't like agents, but, I mean, CrowdStrike's got a powerful agent and they make a big deal out of it as an example. So they turn it into a positive lightweight, but okay. So maybe not in the classic sense of an agent that needs to be managed, but explain.

>> So I think, yeah, exactly. I think to me, there are three layers that are good to consider independently, right? One is the plumbing. Some places agents make sense. If you have a laptop or a device out there, agents don't leave it, that's great. You should have that. For us, what really made sense is, where's the most of your data? It's in these giant data stores. You have S3, you have RDS, you have DynamoDB, you have Snowflake, Databricks, you want visibility and control over this stuff first. Stuff that goes out into an endpoint, that's kind of the nerve endings. You want control over your spinal system first, and then you sort of figure out what happens on the edge. So that's where we are starting from where your hybrid cloud environment could be AWS, GCP, it could even be on-prem Azure. Understand what's going on there. And it's a service that drops into every availability zone. And all it needs is sort of like a crawler read only access to different types of data stores, right? And we want to be very systematic. Our superpower really is, A, the deployment model into the customer's cloud. We call it SaaS in your cloud, right? Where it's kind of like beamed in like a SaaS but it's in the customer's environment. That's the stage zero. It allowed us as a startup to get into incredibly regulated customers, which if we were a regular SaaS, we would never even make it.

>> And is it a send and forget it type of thing or is it am I constantly interacting with it?

>> Yeah, so the way I think about it is that it has to land well and give you wins immediately. That's not negotiable. So once that happens, over time, it's learning from every action that you're doing. So a key part of all this is that your data flow policies like you observed earlier, they become really compact. They become really simple. And we are helping our customers sort of build out, here's a set of data flow policies that for any AWS environment makes sense, what's production, what's not, what are contractors, who are not, what are external, what's internal, right? This sort of stuff and data flows across them. But then as time goes on, you can get really deliberate about, look, you can really customize it for your own, like, I have very specific, I have a project baby Yoda coming up. I'm Mattel, right? And I want to keep this super secret even from our own infra people, how would I do it, right? So you can sort of start building your org-specific custom stove pipes, right? And the system has to be super extensible for this. So these, yeah.

>> And how do you price it? Is it capacity pricing?

>> So the pricing model, we are still kind of iterating over it. Our first goal was we don't want to have our customers get nasty surprises. So we picked a very simple sort of infrastructure centric model where it's a small, medium, large deployment off Symmetry, right? And a small environment can watch a pretty big customer environment and before you run out of capacity, you'll see it coming. So, you know I need to add more small clusters or add a medium cluster and so on. It keeps your blood pressure pretty low. It's just because you have a data lake, you downloaded a bunch of data, all of a sudden, your bills won't spike. So that was really important for us.

>> So almost like T-shirt sizes.

>> Small, medium, large sizes, exactly.

>> You know, software pricing, no matter what you do, it won't be perfect.

>> Exactly. But then we have a pretty rich partner ecosystem. Do we have customers who use it for- We have partners who use it for compliance. We have partners who use it for zero trust assessments. We have partners who use it for incident response. And I think for these deployment scenarios where the use case is very similar and it's kind of like small bins of time, we are trading on different pricing models for us.

>> You've got three use cases, compliance, zero trust and incident response.

>> Right.

>> So take take zero trust, it's a hot topic right now.

>> Yes, absolutely.

>> Where do you fit in a zero trust architecture?

>> Absolutely. So if you just go back to the NIST classic diagram, there's a subject, there's an identity, there's the pipe, the network pipe, and then there's a resource, right? In the NIST document, the resource really that matters is data. So there's zero trust for identity. So you have authentication, you have continuous authentication. There's the pipe that's zero trust network access, SaaS, all this stuff. It's kind of interesting to me that people started with the pipe as opposed to what are we protecting? So we sort of are the zero trust for data where you understand what data do you have. The NIST documents, the CSAR documents now really list this out like, you have to have visibility into what is your crown jewel, what are you protecting, what should the policy be? And then sort of figure out the identity and the pipe is almost, we are doing it first but to me, logically, it sort of fits like it should be the third thing, right? Because there are many ways to construct pipes, some are networks, some are just-

>> What are you learning? When was the company founded?

>> 2019 Q4.

>> 2019, so you're young. Okay, so, well, that's interesting. You started right before COVID.

>> Yes, so I would say 2020 was, we are all in person and then it shut down.

>> So what have you learned in terms of customers cloud, any cloud, including on-prem clouds. What have you learned in terms of deployment? We always hear everybody's multiple clouds. Are they using your product in multiple clouds?

>> Absolutely.

>> Okay, so what's the dynamic like? What are you seeing in terms of cloud adoption? And it continues, people talk about how it's slowing down, but it's still much, much faster than the overall market. What are the trends that you're seeing inside the cloud?

>> So one big theme to me is every, even our small startup customers have multiple cloud deployments. It's because someone got a contract with GCP or with a large customer on GCP. They were primarily on AWS but now they have to go to GCP, right? A lot of big companies are getting deals from Azure. So they'll have something there. Or a lot of times we see like data lakes, BigQuery is a huge gravitational pull for data lakes. And for product workloads, S3, RDS, like the classic AWS environment is very popular. So the same company will have a data lake team here and a product team there. So for us, the big theme that I feel we are able to deliver to customers is what you referred to earlier. I want my policies, my questions are very simple. I want to be able to say like, hey, I do not want external identities accessing my production data in the clear. Now, it doesn't matter if it's in BigQuery or upstream, it's in a product environment like AWS. I want the policies to be monitored and enforced consistently. So the analysis that I like is just like TensorFlow or PyTorch. They do this for you. Machine learning models. I don't care if it's a CPU, GPU or FPGA, right? I just found simple policies, domain experts writing these policies, right? Compliance experts or security experts. They're not necessarily cloud permissioning experts or exact data store S3 corner case experts, right? So we want to separate out sort of the implementation from the policy. And I think that's the biggest problem.

>> And the experience with your solution is identical no matter whether I'm on-prem or Google or Azure or AWS or GCP.

>> By and large, for 80% of your questions, it's identical, that there is a kind of a long tail 20% use cases where these are corner cases that are unique to your organization and how your organization kind of used AWS off vintage 2016. AWS was pushing like, hey, service control policies and cross account like this and now they're like back or attribute-based access control like that. And now there's something else that comes up, CDK-based deployments, right? So every sort of archeology, right? Like, you can sort of see different stacks that were all deployed. And sometimes, those are corner case things that only make sense, those questions only make sense for AWS. So barring those edge cases, by and large, it has to be a consistent kind of view into every cloud, right? Like, where is my genomic data across my environment? Just tell me where it is, right? And who should I call to fix the non-compliant or not secure genomic data? These are the two questions that security teams or governance teams most care about, right? Is there a ton of buildup of dormant data around?

>> So that was the other use case I was going to ask you about was compliance, how bad is it when you go and investigate? How severe and acute are the compliance problems that are out there?

>> So I think the seven graces that auditors, Azure attacker are a much lower bar than attackers, Azure attacker. So even though the problems are pretty severe, right, the auditors sort of work with the customers to be like, look, I understand why you don't have full visibility. Of course, you can't deploy data classification at the scale of billions of objects. We all understand. No one has it. So let's just mark this as accepted risk. But you don't need to if you have more modern machine learning based tooling, right? Similarly, for permissions, they sort of just export cloud permissions to the auditor and the auditor's CPA and says, I guess it looks good. So I think compliance, sort of we have to move, we as security professionals, we have the responsibility, I think, to simplify every big advance in security, we have to simplify it. Teach the community, teach both the auditors who are trying their best, teach the customers who are also trying their best. Like, hey, here's a new tool, here's what this means for you. Now, both of you all come, meet, look, we all did something great because now you can give evidence to why segregation of duties is being followed or why, I mean, simplest question, right? Disaster recovery is a big theme in compliance. How do I show that everything that is business critical data is backed up? Is there a data flow to a backup environment? It's a big question. It's incredibly hard to show, but now we can show it. So we sort of want to move both sides of the game forward. It's pretty, you know, you can imagine it's really hard to get done now, but hopefully in a couple years it'll be.

>> You mentioned partners before. Maybe talk a little bit more about your partner ecosystem and what you go to market strategy.

>> Absolutely. So we think data and protecting data has to be done in concert with partners who understand the business side intimately. Because you can take people's permissions away from their printers or change the container underneath the developers and they don't really, really care unless you break some dependency. But if you take the head of data sciences permissions away a week before Black Friday, that's not good. So you have to be really intimate with what's going on in the business. So we have essentially for each NIST pillar, there are security advisory companies, like zero trust strategy companies that we partner with. Accenture Zero Trust is a great partner for us. We have customers who sort of deploy data lakes and manage data lakes for them. So we have partners there. We also have incident detection response-type companies that are partners or they're trying to provide cloud security services, right? So Trace3 is a kind of innovation forward partner. We partnered with them. TBC, we have kind of really good local partners as well, regional partners, where we believe that teams that understand the business they use our power tool responsibly. Like, that's sort of the GTM strategy that we are following.

>> The last four months or so with all the generative AI hype have been just amazing. What are your thoughts on all that? How are you experimenting using foundation models like GPT? What's the fit?

>> Yeah, so to me, there are two parts to it. One big part is just our customers getting a user interface that is incredibly natural, that is tailored to their organization, and how the cloud is used. ChatGPT is incredibly good with ask. If you ask an arcane AWS permissions question, it's even better than the AWS definitions, right? So customers can really get tailored answers to that. That's the pro. The tricky bit is a lot of these even permissioning models. So what data do you have? All this stuff is super sort of private to each organization. So I think the future where like you could sort of have a foundation model but train it locally to an organization, deploy it locally into the cloud, that's going to be amazing. Just for visibility and understanding proactively, and then later on, even for detection response kind of use cases.

>> It's going to be interesting to see how that plays out, Mohit. I don't know if you remember. So Google search is the best, right? Everybody loves Google search. For a while, you could take Google search and put it on your own website, remember that?

>> Yes, absolutely.

>> And then they killed the product because they realized, well, let's bring it back to Google. We'll get the advertising revenue. It's, we're far, far, decades beyond that now. But it's going to be interesting to see how that model plays out. Last question. I'm going to ask you. I know you have some announcements coming up in the future, but maybe you could tease us a little bit as to what's coming.

>> Absolutely. So one big thing that we are doing is zero trust, we believe should really be anchored around your crown jewel data. So in partnership with Accenture's zero trust team, we are launching this data guard express, Data Guard is the name of our product, Symmetry Data Guard Express, which is you can deploy it in your cloud and it'll come back and tell you evidence for, hey, here are the concrete things that you need to do. And it takes order of days for you to have something really tangible ROI and not just least privilege kind of thing. So it'll be exciting.

>> I didn't ask you about a funding model. Can you talk about your venture capital, how much money you've raised, where are you at?

>> Yeah, so we raised our seed round in 2019. We have finished raising our series B. Our series B announcement should also be in a month or two from now. We wanted to let the RSA hype sort of dive down. So we have finished raising our series B at this point. We are about 50 people and set to sort of get into the next.

>> Is it public how much you've raised or?

>> No, not yet. We have a couple of strategic partners who are still finalizing their rounds, their investments. So we are going to wait for another month or so.

>> Oh, great. Well, congratulations on getting the company off the ground and thanks for coming to theCUBE. Best of luck to you.

>> Thank you so much, Dave.

>> All right, pleasure to have you.

>> I appreciate it.

>> All right, this is a wrap day one here. We're here all week RSA Conference 2023. The keynotes are going on right now. I'm here with John Furrier, so come back tomorrow, theCUBE.net. Siliconangle.com has all the news. Rob Hoof is on the ground with his team. Mark Albertson's here, our newest journalist in the cybersecurity space, David Strom. So check it out. We'll see you tomorrow. Thanks for watching.

>> Thanks, Dave. (cheerful music)