News
More from RSA Conference 2023

Mike Rau

SVP and General Manager

Brian McHenry

VP Web App & API Protection

F5 shares surge on strong earnings and revenue beats

Shares in F5 Inc. surged in late trading today after the application security firm reported beats in both earnings and revenue in its latest quarter.For its fiscal third quarter, F5 reported earnings per share of $3.21 before costs such as stock compensation, up from $2.57 in the same quarter of last year, on revenue of $703 million, up 4% year-over-year. Analysts were expecting adjusted earnings per share of $2.86 on revenue of $698.81 million.F5 saw its global services revenue increase 8% year-over-year, while product revenue inched up 1%. Notably, while the company saw its systems revenue grow 5% year-over-year in the quarter, its software revenue dropped 3% from the same time last year

F5 takes unified approach to app and API security across infrastructures

Not only has cybersecurity become a joint public/private sector undertaking, but it’s also setting the pace for developers as they create digital products.With the share of distributed computing companies at around 85%, emerging signals indicate the need for coherent application security across hybrid environments

Info

Michael Rau & Brian McHenry | F5

Mike Rau

SVP and General Manager F5

Brian McHenry

VP Web App & API Protection F5

>> Welcome back everyone to theCUBE's live coverage here at RSA. It's day 4 of the CUBE's wall to wall coverage. We've been here unpacking stories, talking to the most smartest people, the smartest people in the network, partners, customers, suppliers. We've got a great set of two guests here from F5, Michael Rau, Senior Vice President, General Manager, Distributed Cloud Platform and Security Services. Thanks for joining me today.

>> Thank you. Great to be here

>> John: Great title there. Brian McHenry, Vice President of Product Management at F5. You get the keys to the kingdom. He's the general manager. Networking is a big part of security. I got to say normally it's a front and center, but now we're hearing platforms here. A lot of discussion around politics. The White House was here. Had some briefings. I saw Microsoft friends in with the White House. Security obviously has moved from being a department to like being the thing. And rightfully so with the network. So we've been saying on theCUBE all week, network security, the network folks and security are the core. They're enabling developers, everything. That's all that matters ops wise. You've seen a lot of reconfiguration. You guys are in the middle of it with a great product that's very clouds friendly, very multicloud, super cloud-like. So you guys are the center with some great products. So what's your take on the current state of RSA?

>> Yeah, I mean the current state of RSA and the customer conversations that we've had is is that there are more and more customers trying to solve the security problem for their apps and their APIs as they distribute their applications around a variety of different infrastructures. You know, certainly there are still a lot of private data centers out there, but you know, applications moving into multiple public clouds to the edge. And most of the concerns we're seeing from customers is like how do I consistently secure all of that and protect both my apps and my APIs? And we're excited because we've launched a secure multicloud solution based on our distributed cloud platform that's specifically targeted at being able to provide consistent security policy end-to-end no matter where the app is running. And customers are really resonating with the idea of one policy goes anywhere that I take my app to.

>> Brian I want to dig into, cause you're the product guy. You got the keys to the kingdom on the features, the customers and the engineering side of it. This is like a huge thing because the bad guys have to use the network. There are footprints they're laying on. The network is the ultimate source of truth. But also it's an opportunity on both sides, the bad guys and the good guys. This has been a big theme. We've been covering this. Everyone kind of knows that already. But the word distributed computing comes back more and more when we talk about the current cloud evolution. You know, today we reported that Dropbox is laying some people off like everybody else but that's important because they were the first cloud native, first SaaS kind of crop of companies that were born in the cloud. And they're laying off. So that's points to this next gen cloud, okay? Where networking's going to be a big part of it. What is that piece of the puzzle for distributed cloud? Because if you got public cloud, say AWS, and you got on-premise and now the Edge, whether it's industrial or a windmill. That's distributed computing. So CloudOps has to run seamlessly in all that. That's the current definition of cloud. Why does F5's product work well in that environment when someone says, hey, how do you work in a distributed way?

>> Well, we have you know, our own regional edge infrastructure, but we also offer, you know, what we call a customer edge node as well. So we're able to put our services anywhere the customer is, whether it's in a public cloud, in their private cloud. They can run in conjunction, meshed with our infrastructure or just completely in their own mesh. But they get all the security services brought along with it. And one of the big things with that is that it enables them to tap into the AI and ML analytics complex that we have powering our web app firewall and API security.

>> Talk about that, the AI piece. What's in there?

>> Well, traditionally, you know, we've done well at network security. We've gotten good at 5-tuple ACLs, but application security has been and API security has been far too complex to really effectively secure it at massive scale. So thousands of policies of, you know, web app firewall or API security can be very onerous to operate. But when you get, you know, AI and ML involved, you can do the analysis not only of the application but also of potentially malicious user intent. That makes it a lot easier to secure the application layer, which is is vulnerable because it's complex and gets targeted more and more by the attacker.

>> Yeah and to add to it I mean I think that when we look at AI and ML it's about protecting for things that haven't happened yet or they're happening to you the first time, right? Looking at behavioral type characteristics. So we use all of the AI and ML for discovery of vulnerabilities based upon behavior. Things that aren't in a signature and kind of or a rural set in a traditional way. But the other thing we use it for is doing API discovery, right? And really path discovery for an application. So giving the customer really, really unique visibility but then also understanding what's a normal behavior for that application, right? Are there new APIs that have popped up that were unknown the day before, right? That's a concern, that's a potential security vulnerability that needs to be predicted.

>> This is an operational impact. Expand on that. I think that's a huge point and then there's benefits there too and consequences for not getting it right. Talk about the ops impact of what you just said.

>> Yeah, so the ops impact and it was actually came through a customer conversation Brian and I had yesterday. He says my app developers, right? They changed their application and then they changed the threat surface of the application without me as the security practitioner knowing it's going to happen. And so the operational impact is whether or not you've opened a door to an intruder without any protection. So this particular customer is very interested in the idea that we have constant visibility of what is a new path in the application, being able to discover that, and being able to respond to it to make sure that the right security controls are in place. So operationally it's about not only just having visibility, but it's also being able to understand if it's creating a vulnerability.

>> And that's the safeguard piece that you were just talking about.

>> Yeah. >> Right. Right.

>> Talk about the F5 solution. You brought this up before we came on camera about Kubernetes, 'cause you guys have a standard way to give policy or layer 3 through 7 networking, stability, what's the word? Reliability or performance. Take us through, this is a huge point 'cause this is a big feature.

>> Yeah, so in our distributed cloud, in our distributed cloud platform, we have a multitude of different ways to deliver our services. But fundamentally if you have compute, networking and storage, you can run one of the nodes for our distributed cloud platform, what we call a customer, customer edge node. And you can deploy that on bare metal, you can deploy that on a hypervisor, any flavor of hypervisor. But we can also deploy as a pod inside of a vaulty vendor Kubernetes infrastructure, right? So if you are all end-to-end Kubernetes, you deploy our customer edge node as a pod inside your clusters. At that point in time you have layer 3 through 7 capabilities for that cluster. So you provide all the inner networking capabilities with layer 3/4 controls like fast ACLs. We can do all your load balancing functions inside and out of the cluster. And then we can provide a full application security stack for web and API, web and API protection. So now all of a sudden a Kubernetes node is really part of your infrastructure and has complete visibility and control.

>> And who deploys that the developer doesn't touch it or is there the network ops do it, do they provision themselves?

>> No, so it can be deployed as part of your tool chain for deployment. And by default the policy that's defined for your organization gets automatically applied as part of that provisioning. So even those that are in operation or DevOps don't have to have security expertise to deploy the service securely for your application.

>> John: So you also put a network layer in there for...

>> It is full network layer, yep.

>> Got it. Okay, great. Now talk about the distributed application deployments that you're seeing for multicloud 'cause this comes up a lot. So what is multicloud? We call it super cloud because it's multiple environments, but it's app related, it's heavy duty application support needed. So you got network to app security needs, but it's on a hyperscaler cloud or on an on-premise or edge or another multiple clouds. Essentially it's, I don't want to say multi-vendor, multi environment, but we'll call it multicloud. How do you guys look at that? What's your view of the definition and how does it render itself into a solution?

>> Well, so our view of it, it's fundamental to modern applications. The modern applications are, you know, first of all, we know broken into microservices and sometimes those microservices are running across a variety of different infrastructure. And so the way we've built our solution is is that irregardless of where you deploy, we can provide the same visibility and control end-to-end. Including if you move application workloads between clouds or between cloud or on-premise, on-premise the edge. So it's actually core to the way we've built our distributed cloud platform is the thought that in the name the goal of a distributed cloud platform is to service distributed applications. And our view of everything is everything will be distributed. Much harder to secure. So also fundamental to the way we do it is to include security in everything we do.

>> It seems like very political in the sense of the cloud players because now that cloud moves into this next gen, you're seeing, again, you're seeing examples of it with people building on top of clouds that don't have any CapEx, they have ecosystems, they have people developing on it. So you have like a robust app, modern app development environment. Seeing that everywhere. That's going to make more complexity into the network. This is a really important point and it's almost as if the clouds should just look at themselves and already won. You know, so they've already kind of won. There's only four, three, maybe five. Okay, maybe three. Two. Microsoft and Google's coming up and up fast, which I like what they're doing, but generally they've already won. So what's the issue? Like customers that I talk to all have multiple clouds, either by default from acquisitions or by accident. They didn't even know they had them. So like, it's kind of like an environment. I don't think they woke up and said we're going to build a multicloud strategy. I mean that's doesn't really, I haven't seen any of that going on other than that they've inherited the cloud.

>> Michael: Why don't you take it from a security perspective. And I'll take it from a visibility perspective.

>> I'll wait on this or no.

>> Yeah, so I mean I think, you know, part of this is just the pace of modern app development is so much faster than anything we've ever seen before. New apps, new APIs are just popping up all the time in a variety of different modes of operation and business value, right? So the thing of it is, is that that's happening so fast sometimes the developers are selecting the cloud without consulting their networking or security counterparts. And then in so doing, you know, dragging network making decisions about whether the security tools they're going to use because they're going to select, you know, whatever AWS or Azure offers as security tools and networking tools. So we're really seeking to solve that problem for the network and security operators to say, hey, we're not going to get in your way of choosing whatever cloud you want, might be most suitable for your application or API. But we are going to ask that you, you know, standardize on a certain type of security policy and networking capability. So you're basically saying, your client's saying don't fight the tide, it's coming. Developers are driving everything, okay? That's pretty much, we've been reporting that. You guys would agree with the developers in charge.

>> Yes. >> Yes.

>> From an applications productivity standpoint. Okay, so then that means that ops have to flex to that, enable that, guardrail it, policy things that are automate these are known concepts in networking. Okay, I see that check. Awesome. Why in F5, what do you guys do differently than the competition? What's your approach? Why are you guys winning? Can you take us through that?

>> Yeah, so you know, simply, you know, we have a you know, just a tremendously long positive heritage in delivering, you know, very sophisticated application visibility solutions, control solutions with our big IP load balancing product. And so we've, taken all of those learnings and with our distributed cloud platform, you know, we've applied that to more modern applications that are broken into microservices and distributed across multiple clouds. So first of all, you know, our expertise in layer 7 at the application layer and then not only for delivering reliability and at scale, but also securely is what we're applying to the distributed cloud platform. I think why we're winning is uniquely, we in a lot of customer environments, they're spread across multiple clouds. They can't see their environment. They don't know where their vulnerability is. So the first thing we do in our solution, and I think it blows most customers away is we can give them end-to-end visibility of their entirety of the environment, right?

>> Yeah. And then the second thing is because we have visibility and we can put ourselves within the data path end-to-end, we can also provide all the security controls that they need to protect their applications. And I'll give you an example. You know, we have customers in multiple clouds, they use the native security tools in those clouds and then a security event like Log4j comes up. Now they have to go to each one of those individual native tools to configure a policy to be able to block a Log4j attack. With our distributed cloud solution, right? They have a policy that's in one place, irregardless of the cloud that they've deployed the application on, they just have to change the policy in one place. Or even better yet, they get an automatic policy update or a behavioral protection that protects all applications across multiple clouds.

>> So if I hear you correctly, you've got 3 through 7 stacked, that's key. One key point, not just three or four, just all, all layers and you're end-to-end, you're embedded.

>> Michael: Yep.

>> You're just building an abstraction layer architecturally to see the data path, right?

>> Yeah, so if you think of a customer...

>> That's like, it's an architectural advantage.

>> Yeah. If you think customer...

>> With the layers.

>> You think of a customer proudly showing their knock years ago where they would show their big network map, right? It's very hard to show a network map anymore. Well we actually, out of the box, once you deploy our solution, we'll give you a full network map all the way to layer 7 of your particular application. That's really unique, that visibility that we provide.

>> Yeah, and you you make it more agile for folks while maintaining. So it's an architectural decision and you got the product to back it up. That seems to be the key. And now you got the new AI over the top.

>> Right. And I think the other reason we're winning is when you look at other web app and API protection vendors who are trying to offer, you know, layer 3/4 DDoS protection, bot defense, web app firewall and API security, you look at them and they're mostly rooted in a CDN platform. Whereas we're coming at it from this multicloud networking platform, managed Kubernetes environment that is designed from the ground up to address these new challenges. So we're bringing, you know, not only our pedigree and application security and delivery to this new platform, but we're doing it in a way that, you know, other, you know, other vendors in the same space can't when it comes to security.

>> You got the full suite.

>> Yeah. >> Basically. So this is kind of like, remember the old days moving up the stack, Cisco always got hammered for that. Like they could never move up the stacks. The point solution layered products are probably eating the dust right now in this market because they can't have multiple views and they can't make the claim to be architecturally relevant in the constellation of the deployment. Whether you're putting it into Kubernetes pod or putting it in an app or in Azure, right?

>> Yeah. Or even putting it in a traditional data center. So look, it is becoming a platform play, right? And I know that there's some positives and sometimes customers perceive some negatives about being a part of a platform. But when you're doing what we're doing, we provide a layer 3 through 7 stack, it's obvious that we're going to add more and more services to that stack. More and more controls, whether it be visibility, network layer controls, security controls. But what we're going to do is give you a simple way to deploy all those things with a similar look and feel and capability that's consistent across all those services. So we're going, you know, we're going after somebody that is looking to lower their total cost of ownership by having a simpler way to do things.

>> Yeah and at the end of the day, they got to be secure. So the old perimeter's gone, but now the perimeter's replaced by embedded architecturally relevant stack.

>> Yeah. Virtualizing the perimeter is maybe a way to think about it, right?

>> Yeah.

>> Like we can make the perimeter as long as you're connected, the perimeter exists and you have control of the perimeter.

>> The perimeter is always changing and it's dynamic, it's just the packet flows however you... But you guys ensure that because you got the end-to-end, you got the suite and 3 through 7 gives you guys different approach.

>> Michael: Exactly right.

>> Yeah, I think this is going to be back to the programmable network. Remember the old kind of like self-healing.

>> Sure.

>> Remember the old self-healing network, it's programmable. But now you've got APIs and you got GeNa. It's actually happening right now. And then the data is going to be interesting. And one of the things I'll end on with you guys, get your thoughts 'cause since we're, you know, looking at the current landscape and trying to project to the future is, I put this out there during the CUBECon Developer Conference is that developers are flipping the script. You guys highlighted that earlier. What if they flip the script on how to program the data and then the network. So developers are kind of shifting left and kind of being enabled, but what if they can decide how to program the data? Meaning that means where it's stored, how data's stored and managed. Most of the database folks handle that piece.

>> Ah, yeah.

>> What if the developers could decide where data's stored? And so this brings up kind of a rethinking of what you guys or how you guys are looking at it, which is you're not changing networking, you're just rethinking it a bit. That's kind of what's happening.

>> Yeah. Yeah. And look, I mean I think you're hitting on a key point with some of the privacy laws, data sovereignty, data localization. You know, having a global footprint of an infrastructure and being able to see traffic globally and being able to manage traffic globally, you know, gives us a very unique way to be able to deal with any customer requirements they have about where their data goes as it transits to the global infrastructure.

>> I'm a big believer in defacto standards. You look at all the biggest success stories over the years things become defacto and you enable people to do their jobs right now from here and the security end, network and then app space. People just want to get busy doing their job, right? Here's threat detection, be prevention, remediation. They don't want to spend time configuring machines. You guys enable that by having some reliability.

>> And one of the things that, you know, we're really bringing to bear on the distributed cloud platform when it comes to the security component is that our customers that are onboarding, they're going into blocking mode right away. Which is something that not a lot of our competitors can claim. And we can do it not just for, you know, traditional web applications but for APIs as well. So we're incredibly API fluent, which I think, you know, we all acknowledge that's where things are going. We're going to say apps in the future, but we're really going to mean APIs. And that's really how we're going to keep pace in a sense.

>> Yeah, and speed agility is key 'cause if something say a breach is going on you can look at critical systems and go sequence into, okay, shut down those, let's keep those up and running. Let's block and contain. It's very much network is the key strategy piece of it. Big piece of the puzzle. The piece.

>> Michael: Yeah. >> Brian: Yeah.

>> Guys, thanks for coming on theCUBE. Really appreciate it. F5, great stack, 3 through 7 layers across end-to-end data suite of infrastructure for developers. It's cloud native, multicloud, super cloud. This is theCUBE here at RSA. I'm John Furrier, your host. We'll be right back with more after this short break. (bright music)