RSA Conference 2023 | Nayaki Nayyar | Securonix & Omer Singer

More from RSA Conference 2023

Nayaki Nayyar

CEO

Securonix

Omer Singer

Head of Cybersecurity Strategy

Snowflake

Info

Nayaki Nayyar | Securonix & Omer Singer | Snowflake

Nayaki Nayyar

CEO Securonix

Omer Singer

Head of Cybersecurity Strategy Snowflake

(upbeat music) (crowd bustling)

>> Welcome back to San Francisco, everybody, this is Dave Vellante for theCUBE and our coverage of RSA 2023. This is day three, hump day, it's Wednesday. We're going to be here all week, we're going through Thursday, we've been wall to wall coverage, really excited to have Nayaki Nayyar, who's the CEO of Securonix, and Omer Singer, who is the head of Cybersecurity Strategy at Snowflake, both CUBE alum. Great to see you both, again.

>> Great to be back, Dave. >> Dave: Thanks for coming on.

>> Thank you Dave, we are glad to be here, and I'm a CUBE veteran now.

>> Many times you've been on. (Nayaki laughing) You know, so I was going to ask you, so, you know, you've been executive in the industry, obviously hot space, why did you decide to come lead Securonix?

>> Yeah, you know, I will tell you, Securonix is in a very, very phenomenal space right now. We have been a leader in the entire SIEM market for the last four years in a row in the Gartner Magic Quadrant. And when you look at the entire market, SIEM market, Dave, it's a $5 billion market, predicted to be approximately 10+ billion by 2025, going at a nice double digit figure, and we have a massive opportunity to go from where we are to a quarter billion or half a billion over the next two to three years.

>> But we were at your event the other night, and I was talking to some of the folks at your company, and they were saying, Nayaki is coming in and really focusing us, laying out a vision, roadmap. I mean, it's kind of what you do, it's like your superpower. So, that's kind of cool, could you tell us a little bit about that? What can you tell us? Yeah, at this event, we actually rolled out our new vision, the vision and strategy for the next two to three years, which is what we call the Unified Defense SIEM. And a big part of that strategy, Dave, is how we are partnering with Snowflake to be the data lake for us going forward. And with this partnership, our entire SIEM, as an offering, will run on Snowflake's data lake, the security data lake will become the partner going forward offering this for all of our customers.

>> So you guys have a lot going on. I mean, you sort of flipped to have an industry go to market structure, so we're just seeing all kinds of new industries pop up on the Snowflake data cloud, security is obviously a key use case. How's that going? Give us the update on the uptake there.

>> Yeah, so, you remember we met back in June, when we first announced the cybersecurity workload, 'cause we've had so many customers ask us, "How can we use Snowflake to help scale our cybersecurity program? We've got all this security data, it's overwhelming us, it's driving the costs through the roof, the data's very siloed, help us with it." And, so we've been taking that very seriously, and we've been collaborating with the Securonix team very closely. And what Nayaki mentioned us launching is both a product, and it's a go-to-market effort, where now when customers ask us, "Hey, can Snowflake help us with our security challenges at scale?" We do have this way of bringing the work to the data and helping them to solve that on Snowflake.

>> So you have all the data, tons of it, you got the platform. So the idea, obviously to put that data inside the platform, or however you say that, bring the platform to the data, right?

>> Omer: The work to the data. (chuckles)

>> Work to the data, it's kind of an interesting way to think about it, 'cause you're not necessarily, you know, data's everywhere, so you guys got an interesting architecture. But my question, Nayaki, is what does that enable you to do.

>> A customer? Yeah. So, when you look at it from a customer perspective, Dave, right, customers run our entire Securonix SIEM platform for detecting all the threats, for investigating those threats, and responding to the threats. And with this new version, what we call the Unified Defense SIEM, where we're running on Snowflake's data lake, it really helps our customers go from a seven days of hot search, which used to be the offering that we had before, to a full 365 days. None of the customers had 365 days before, so with this new offering, now customers can search full 365 days of hot search. And this capability, Dave, there's no other vendor in the market has it, massive competitive differentiation for us right now.

>> And you know what they were doing with the data before, when it was, let's say seven days in hot, it was then siloed in different places, and Snowflake is all about breaking down those silos. So if we could do that for security teams, and give them the confidence that there is one place that they know they can go to, and they will find the security data that they need to answer their questions, that's a huge shift, and a big relief for cybersecurity teams.

>> Why couldn't they do it before? Was it just too expensive, too complicated?

>> It was very expensive before, I mean, just doing, we had seven days of hot search, 90 days of warm search, and everything was cold, and it was a lot of it was driven by the cost and the expense, but by moving to Snowflake, now we have broken down those tiers, right, there's no hot, warm, cold, there's one tier of all hot search, and they get full 365 days, and we are providing at a price point that is extremely price competitive in the market.

>> So a lot of the conventional wisdom is always, "Well, the data gets old and then it's not useful." That's not the case in security is it?

>> No, data is king, right? Data is the new oil. So while we have all the security data, we also do believe the actual data storage itself is not a competitive sensation. Of course, Snowflake does that beautifully, but where Securonix's competitive strength is is in threat content. So as a part of the Unified Defense SIEM, we've also released what we call Threat Content as a Service, where not only we, at Securonix, are contributing more and more threat content on our platform, but we are also opening up where our customers and partners can contribute to that content. Similar to, let me give you a very simple example, Dave, you know, if you think of from a Netflix perspective, Netflix doesn't differentiate because of the platform, it really differentiates by the content it delivers, right? So think of it that way, it's not just a platform and the data, it really is the threat content that we deliver on top of this platform that truly sets us apart. We have a very, very strong threat research lab at Securonix, the most advanced research lab, that we release that content very, very proactively and timely for our customers to take advantage of.

>> The value of all of that content is multiplied when you can apply it across a year's worth of data, rather than, okay, great research, now you apply it to maybe a week's window. That's limited, right? And it limits the value. And that's where Snowflake can focus on being the best data platform, and Securonix can focus on doing that research, and having the content to apply across that really 365 day window.

>> So the platform's an enabler. So one of the other things, I mean, Snowflake, you know, boiling it down, it's hard to get here, but it's simple, and you can share data, right? And so how is that data sharing, data sharing that's governed and secure, how is that of a benefit to customers in the context of security in that use case?

>> Yeah, so I mean, in addition to what we call the Threat Content as a Service, right, which is a big part of our Unified Defense SIEM, another thing that we have also rolled out is what we call peer-to-peer collaboration, right? Where we are enabling customers to collaborate with each other on this threat content, threat intel. And just to give you an example, let's say there are two airline companies, American Airlines and United Airlines, they will compete with each other on airlines as a business, but when it comes to cybersecurity, they would want to share content, right, or share intel, and the platform enables them to do that peer-to-peer collaboration. That's another big way, in fact, this is what we call, we can help them proactively defend any threats by collaborating with each other and being ahead of the competitors here. What is the state of collaboration in the industry today? I mean, the example Nayaki just gave is, I think that's probably pretty common, but how about even amongst the technology? Well, first of all, how common is that? And then what about amongst the technology industry? I know several years ago there was attempts, we have a private dataset, we're going to try to monetize that private dataset, and that caused a lot of, you know, criticism. And I think that's changed, but as a security pro, I'm interested in your --

>> Yeah, I'll tell you what I'm excited about. I think once all this data's in the data cloud, and it could be shared, data includes the insights on the data, things like what are the KPIs, the metrics with which the security program is being measured. If I can start sharing that, maybe anonymized, maybe governed sufficiently, now I can see, how's my program fairing compared to my cohorts, compared to my industry. And that's super valuable for a security leader to know, how are they doing compared to others. So that kind of data sharing doesn't really exist today, and I think there's a lot of demand for that kind of data sharing, and once everything is happening in the data cloud, it then becomes feasible from a technological perspective.

>> Well, part of the problem is, how do you share that data, as you know, securely? I mean, you could call your friend up and say, "Hey, this is what we're seeing."

>> Nayaki: No, no, no.

>> But this is different. >> The platform enables them to share it in a more secure way, yeah.

>> So in other words, like you could say, all right, I'm going to grant access to my colleague, who maybe --

>> No we use for GitHub for allowing customers to share that kind of data.

>> Dave: Okay, so.

>> But well, I mean, we're going to a lot more technical detail in that, but that's, I would say, in the very initial stages, Dave, where we have seen that request come from a lot of our customers to enable them to do it, and we are slowly but surely releasing more and more of that functionality for our customers to be able to collaborate with each other on that.

>> So the Threat Content as a Service.

>> Yeah.

>> What is that? How do I consume that as a customer?

>> There are a lot of use cases, threat use cases that we deliver on a very periodic basis, in a timely manner, that customers have access. Well, as we release it, we release it into our customer's landscape so the customers can start using it and start leveraging it for hunting.

>> Dave: It's a subscription.

>> Yeah, it's as a subscription.

>> And I was impressed, I saw a demo of this yesterday, and what Securonix is doing now is they're actually checking to see where are your gaps, and where's your security program maybe missing a certain data source or missing a certain detection that it should have, and then being able to deliver that to the customer based on what they've identified as a gap. I mean that, that's really valuable.

>> Is the outcome for customers that they can now, you mentioned proactive defense, I think you called it, so is that the outcome that you're trying to achieve, that they can defend now proactively, as opposed to, "Hey, there's a fire, put it out."

>> That is the whole point, right? Enabling our customers to be proactive in defending against threats is the ultimate goal, and every time we deliver our latest content, I think that really helps them get closer and closer together, and it's a peer collaboration, also helps. But a bigger part of the entire platform, Dave, is also getting them the full visibility into what we call the threat coverage, right? Where are they in their coverage for the micro framework, or in this framework, that's another big part of the entire platform, where it's not just an experience for the analyst that we want to deliver, but also extending that to a CXO or a CSO experience, where they can see, from a full coverage perspective, where they are in their entire maturity framework, yeah.

>> Now you sit on some boards, right? What's the board level comment? I remember having this conversation with Robert Gates, gosh, mid-last decade, the former Defense Secretary, who also, you know, sits on a lot of boards, and he's like, "Absolutely. It's a board level issue." Now, he's sitting on some big companies, right? So has is it become mainstream at the board level?

>> Yeah, you know, cybersecurity is no longer just a CI or a CSO issue anymore for every large enterprise, it has become a board topic. Every public board is now required, especially the audit committees are now required, to disclose if there is any significant breach within four business days. And yes, I do sit on a couple of public boards, I'm on audit committee also, and the CSOs are now required to come present, every quarter, every board meeting, where they are in that entire journey. Especially, and everyone is using different frameworks, but in this framework is one thing that I've seen most of the CSOs use to present that to the board, and come back and share that with the board, right? So.

>> What are those conversations like? Because when I get into, I mean, I've been in this business a long time, and I'm no SecOps pro, but I, you know, I can absorb technology pretty well, and your eyes just bleed when you get the acronyms, and the complexity, I mean, it's so, when somebody goes into the anatomy of a hack, it's like, "Wow, I got to read that again." And then over and over. So, what, is there an education going on at the board level?

>> Nayaki: It is. Like, how are they able to absorb such complexity? Or is it just at a high level? How does that dynamic work?

>> Well, that is why every board is now required, I mean, they're really hunting for industry experts, CSOs to be on their board also to provide that expert guidance. But there's definitely a lot of education happening, NACD is providing a lot of education around that. But also, boards are now following certain frameworks, and this framework is one of the frameworks that most boards are following to understand where the company is in their maturity framework, right? So that makes it a little easier for boards to follow and understand. But again, I agree with you, it's a complex topic, (chuckles) right, for any board to really get into the details. But most boards are, I would say, doing a lot of work around it.

>> But you got to speak wallet here, business, right, you can't be, so I get it, so it's a maturity model, here's where we are, and here's where we want to get, here's how long it's going to take, this is what it's going to cost, here's the risks of, you know, this scenario, things like that, right?

>> Nayaki: Yeah.

>> And I think this is also part of cybersecurity joining the modern data stack, and security leaders being able to use the same kind of tooling that maybe sales leaders or marketing leaders have been using, right? Like BI tools to see how are we doing, not just at a quarterly board review, but day-to-day, right, being able to follow along. Once all the security data is in your data cloud, now you can use BI tooling to see all of that together in one place, and we've really then kind of brought cybersecurity into the fold, the way the rest of the company gets insights from data.

>> Well, I'll say this, you know, when you look at this space, cybersecurity, it's a very fragmented market, right? The number of tools, technologies, products, tech stacks that every customer has, or every large enterprise has, is very, I call it a Frankenstein's mess. So having a security data lake, this partnership that we are doing with Snowflake, it really helps customers bring all that security data into one single, holistic data lake, provide the insights, right, and get the insights that they're looking for, but truly now extend that insight beyond just a SOC analyst to a CXO level. I mean, it really brings a lot of structure to that fragmentation that is in the market right now.

>> Is there a go-to-market relationship as well?

>> Yeah, we are actually, we are going to market together, because now we have embedded our Snowflake data lake into our stack jointly. Customers have a choice to bring their own Snowflake, or they can buy the entire embedded Snowflake offering from us. And yes, both of our go-to-market teams are going together.

>> By the way, okay, so an obvious target is to go to Snowflake customers and say, "Hey, what are you doing for security? We can help."

>> Nayaki: Absolutely.

>> Or if you're not a Snowflake customer --

>> Omer: That's right.

>> Nayaki: We have embedded that stack, right, so.

>> We're seeing a tremendous amount of SIEM migrations, a lot of our customers are trying to figure out their strategy, and so if they can take that opportunity of rethinking their SIEM strategy to align that with how the rest of the company handles data, right, and go with this approach where it's a very seamless integration, that just makes all the sense in the world, and it's very cost effective, which counts now, right? You do need to think about that, the bottom line, how much you're going to be spending on this as the amount of data scales up, and we can deliver on that for our customers.

>> So yeah, thinking about the cost effectiveness, I mean, you've got the marginal economics of adding this use case are not huge. It's basically --

>> Nayaki: It's not.

>> Setting up (chuckles) another virtual warehouse, I already used that term.

>> And it's the architecture, right? The separation of storage from compute here plays a very key role, that the SIEMs that try to be vertically integrated, and trying to solve the data challenge themselves, they just can't deliver that kind of cost effectiveness.

>> Yes.

>> So if I'm a Snowflake customer, what do I have to do to get up and running? And I want to know, if I'm not a Snowflake customer, what's that experience like?

>> Yeah so, in both ways, if a customer is an existing Snowflake customer, they can run our entire SIEM on their snowflake, we call it "Bring Your Own Snowflake," right? So that is already available, but if a customer doesn't have Snowflake, and they can buy the entire stack from us with Snowflake embedded into it, and they can run that too, right? So we have both the offerings, and in both cases, like I said, customers can do a full 365 days of hot search, it's a single tier model, there's no hot, warm, cold, Threat Content as a Service is automated, is available in the platform with the peer-to-peer collaboration. And I can't say enough about the competitive differentiation we bring in with the unified experience. This is something, Dave, we have UBA, we have SIEM, we also have SOAR into the platform so that customers have a full, what we call end-to-end experience for detecting the threats, investigating them, and also providing a full end-to-end response, right? So it's a big one for us.

>> So you're here meeting with customers, you're obviously talking to 'em about this capability, what's their response? What's going to be their experience, and how do they take advantage of this? What's that on-ramp we're going on?

>> We just had a big launch event yesterday, and we had a lot of customers, it was sold out.

>> Omer: We were turning people away at the door, yeah. (Dave and Omer laughing)

>> We had to turn people away from the luncheon, because we couldn't accommodate everyone. So, it was a phenomenal --

>> Dave: You love that problem. (laughs)

>> Yeah, it was a phenomenal --

>> I've been on the other side of that too, it's like, you know. (laughs)

>> Phenomenal success, I would say. And every customer that we have talked, they're truly excited about the partnership, I mean, that's one. They're extremely excited about going from that six to five days of hot search, I think that's something that they had been asking us, and now that we delivered, it's a big, massive benefit for them. And the journey ahead with this whole Unified Defense SIEM that we just launched, a lot of good excitement. Every customer that we talked to now can start benefiting from this new vision that we have just launched.

Yeah. >> Dave: How unique is this?

>> We are the only one right now, to be very honest, in fact, I shared in the launch right, how we stack up against all the other SIEM vendors, with the 365 days of hot search, the single tier storage, with the threat content service, peer-to-peer collaboration, built-in SOAR, right? When you look at all of the key capabilities that any customer would want, we are the primary leading vendor in the entire stack right now.

>> That's fantastic. Congratulations. And best of luck to both of you, we'll see you at the Snowflake Summit, I hope.

>> Yep. See you there. >> Thank you. Yeah, we will definitely be there at the Snowflake Summit.

>> End of June in Vegas at Caesar's Forum, it's going to be fire marshal full, it was full last year, so I know it's growing. (Nayaki laughing) And we had to go into the overflow for the keynotes, it was good, I'm going to have to get there early this year.

>> Absolutely. Look forward to it. And like I said, I'm a veteran of CUBE, so I would love to be on the session.

>> Dave: Great, let's make it happen. We're there, I think at least three days, wall to wall, so it'll be good. All right guys, thanks so much.

>> Appreciate it. Thanks so much.

>> Appreciate it.

>> All right. Thank you for watching. Keep it right there, Dave Vellante, John Furrier's in the house, theCUBE's coverage of RSA 2023 continues right after this short break. (upbeat music)