RSA Conference 2023 | Brendan Hannigan | Sonrai Security

theCUBE.net

More from RSA Conference 2023

Brendan Hannigan

CEO & Co-Founder

Sonrai Security

Info

Brendan Hannigan | Sonrai Security

Brendan Hannigan

CEO & Co-Founder Sonrai Security

search

(bright intro music)

>> Welcome back to Moscone West. Everybody watching theCUBE's coverage of RSA 2023. RSA is back, and it's big. I mean, it's back to pre-pandemic levels. Brendan Hannigan is here. He's the CEO and co-founder of Sunrise Security. Good to see you again.

Thanks for coming to theCUBE. >> Nice to meet you, Dave.

We're delighted to be here. >> Yeah, so tell me, I always like to ask, I said, "Good to see you again," you've been on theCUBE before. I've not interviewed you, but I always like to ask founders and co-founders, why did you start the company? Take us back to the beginning.

>> The beginning, thought about it, is, essentially, the way we build technology has totally changed from the way we've done it in the past, and that's been going out for many years, driven by a lot of the cloud providers, and we realize two things. One, we have to transform how we're securing it. It's going to be totally different. It has to be, so that's one reason, and the second reason is, you know, we've worked hard to build security for enterprises through the years. There's many innovations that have happened, and people always ask me, "What's the next big innovation in security to really change the game for customers?" And I keep telling them, "It's the cloud." If you do an amazing job in the cloud, you can deliver a level of security far superior to anything you could do in enterprise network and data center, and our approach to helping customers is to achieve that objective.

>> You know, it's interesting. So the very, very first Reinforced that I went to.

>> Yeah. >> Steven Schmidt at the time

was the CSO of AWS. >> Yeah.

>> He's now, of course,. >> Yeah.

>> The chief security officer, I guess.

He was the CSO of AWS. >> Yeah.

>> Now, he's the CSO of Amazon. Anyway, he said, at the time, "The state of cloud security is actually really good," and this vendor narrative that says, you know, everything is, you know, scary and bad is not helpful for the industry, and I said, "Okay, that's a different perspective." At the end of the day though,

it's still really complex. >> Yes it is.

>> So what is the state of cloud security? What's end of the spectrum is it on?

>> In the end of the spectrum, the great thing is the art of the possible is amazing with the cloud, and so Steve is right, and by the way, we build our platform in AWS. We're an amazing partner, and AWS is an amazing partner to us, and so we work very closely with AWS, but when you're a company, and we actually focus, Dave, on larger enterprises, so there's always a segmentation in the marketplace, and think of my own company, we've got a single team, we're very focused on one app, and so it's very integrated between the development and running cloud. Think, now, you go to a big enterprise, they have hundreds and hundreds of cloud accounts. Some of our customers have thousands and thousands of cloud accounts. They've hundreds of teams using those cloud accounts. The art is, as time goes on, a lot of complexity gets built in as to how companies are using that cloud. The scale of it gets very complicated, and so the scale, the flexibility leads to complexity from a security perspective. So the reality is for many companies, this gets very complex very quickly, and the other thing is, right now, the industry, the whole security industry is orienting towards cloud, and quite honestly, the security industry is confusing the living daylights out of our customers, and that is something we really got to work on to help customers. So I think customers have a scale problem and a complexity problem, and then we, as an industry, are confusing the living daylights out of them.

>> Okay, so cut through that confusion.

>> Brendan: Yeah.

>> Where should people be thinking about? How should people be thinking about cloud security? And help us, you know, take the confusion away. What are those confusion elements and what should we be focused on?

>> So, you know, I think about it this way, which is there's this concept within the industry called CINApp, which is a broad based platform with many different things into it, and, of course, that makes sense for a class of customers. So customers have to know where they are in this journey. Some customers are at the early stages. They can use broad based solutions that do a little bit of everything, but as you grow up in scale, you actually need specialized capabilities in certain areas. So for example, in the cloud, the risks are different than in a traditional environment, and two of the key risks that exist, we say this all the time, vulnerability management and detection and basic configuration settings is important. It's like keeping your house clean. It's just not enough. The risk is underneath the covers of cloud, and it's all about how the compute and the resources in the cloud can interconnect. So we focus on helping our customers with identity, access, permissions, understanding what are the risks in terms of how they've set that up, helping our customers eliminate it, and make sure they never come back again.

>> Okay, then that's helpful. So the complexity is you've got thousands of cloud accounts,

hundreds of teams. >> Yes.

>> None of 'em are using the same exact best practice.

>> Yes. >> We know that. They're doing things... I would say a lot of these problems are self-inflicted.

>> Brendan: They are.

>> But it's 'cause we're moving so fast, but, okay, so how do you specifically solve the problem?

>> The problem, yeah, well, firstly, actually, as we talk about the confusion that customers can have and the complexity of it, the industry is speaking about cloud like it's an amorphous blob. There's a cloud, and we need to solve cloud security with a single product, and it's not right. So we actually segment. We actually focus on large enterprises, and we say large enterprises have unique challenges of scale and complexity, and one of the biggest challenges of scale and complexity they have are the rights permissions and identities and what they can access in the cloud, who can access critical resources, and who can escalate to get privilege and do damage in that cloud. I'll give you an example of scale, Dave. It's not unusual for our customers to have hundreds and hundreds and hundreds of thousands of roles in AWS or service accounts. Human beings can't manage that, we know that. The analytics to understand that is enormous in terms of what we have to do, and what do we do for our customers? We graph every way any entity can get access to a resource in their cloud. We graph every way an entity, a piece of computer serverless function, can get access to a privilege, and then we run analytics to solve a problem for a customer. How can we eliminate a risk that's just extremely concerning? In other words, a developer getting access into production, an obvious way for an attacker to laterally move to true to cloud, helping with an audit. So auditors are getting smarter about cloud. The auditor walks in and says, "Hey, we're having a look at the cloud. Tell me how you're controlling access to resources," and our current, many, many, many companies now because of the scale of what's happened, it's a hard question to answer. We answered a question for every resource. We can tell every single thing that can access anything in all the clouds actually.

>> So for example, an individual might have access to so many more resources than he or she should have access to-

>> It's using to. >> And that's very common

right? >> Exactly.

>> And explain why that's a problem. I mean it's pretty obvious, but somebody gets in, then they have access to a much wider blast radius than they would normally, right?

>> So this is actually the risk that we run if we focus on the edge and vulnerabilities and watching external threats. We all know, at any point in time, there could be a zero day vulnerability or you can't possibly have them all remediated, and so somebody gets in. Now, we think of it being an attacker, but within the cloud, we all know the infrastructure is created automatically. It's created during bill processes. So now, the entity that gets into person has the ability to create a piece of compute. Now, what can it do when it's in there? We have to answer that question, and it's a really hard question to answer, but yet it's fundamentally important 'cause we don't have a data center anymore. We can't just surround it with a firewall. The data is entirely separated from the compute, and you have to be able to answer the question. When that serverless function is active, what can it access for that 60 seconds? That's a critical question to answer 'cause that's exactly what a hacker will do. They go in. They move around. They grow in terms of their privilege, and then they, basically, get access to something that actually is important, and now, they could actually, if they have to right right, they could create a piece of compute and extract it. All of that is possible. All of it happens, and it's hidden in the complexity of these big large environments.

>> Okay, so we love the analogies of superheroes on "theCUBE" when we're talking about security, you know, what is it? "The Incredibles", right?

>> Yes. >> That each of them has a superpower. What would you say is Sunrise's superpower?

>> Our superpower is all around identity, access, and permissions underneath the cover, and, basically, saying with a certainty, we can answer the question, what can this entity do, where can it get privileged, and how can it add access for all of the cloud providers? That's a superpower. On top of that, the value we're delivering is amazing audits, incredible way to understand what attackers can do if they're in your cloud, and then continuously monitor if any changes. Under the covers, Dave, we have this amazing technology. What it's doing is, actually, a lot of people now talk about graphs 'cause graphs are a really important technology. We're actually loading up every possible permission entitlement in AWS. We're graphing every way any entity can get to that entitlement, and we're able to do it at a scale where our customers, we've got customers with 4,000 cloud accounts. We've got customers with hundreds and hundreds and hundreds of thousands of service accounts and roles in their environment. So it's scale. It's an immense understanding of access, identity, and privilege in these environments, and it's the orchestration to do that for large enterprises.

>> So when you talk about graph, you're talking about graph database or is that something that you've built or is it-

>> It's something we built. >> Visualization capability?

>> Underneath the covers, we've built a way to actually aggregate all the ways in which things can interconnect into cloud and answer, it's kind of a complicated way to answer a simple question, what can that thing do, who can access my critical data, and is that creating risk for my business?

>> Should I think of it as a purpose-built database?

>> It is a purpose-built database.

>> And it's a graph database? >> It's a graph database.

>> Okay, so it's expressive. >> It's extremely expressive. It's all actually our entire platform can... We've a beautiful UI on our platform, but can be entirely interrogated through GraphQL.

So it's truly a- >> Explain that because the knock on graph databases in commercial worlds is you have the expressiveness, but you don't have the elegance,

query elegance of relational. >> Absolutely.

>> Right, sounds like you've solved that problem?

>> We have actually, so basically, well, we do, and this is one of the challenges which sort of an off-the-shelf, oh, we're just going to create things and stick them in a graph. We actually have to build custom stores, customs ways of interconnecting, and then we have custom analytics to answer really hard questions. Like if we take AWS, how do all the various different permissions models affect how things are interconnected in this graph? So we build these analytics and now we use GraphQL as an API into it where you can go and execute the analytics against a graph. So what it's doing is it's like you can go in and get an individual node or an individual vector into graph or you can actually go in and execute one of our analytics and get the answer out so it's super flexible, and, of course, in the world of cloud, in the world of automation, we have some customers who initially want to see, and then customers want to automate on. You can't, you got to be able to bring on thousands of cloud accounts and automate that process, and that's when we do a great job.

>> And is there reticence initially to automate, and how do they sort of get... How do you get customers through that reticence if it exists?

>> So it's governance. It's escalation pads. It's certification pads. It's involving humans where they want to be involved. There's some things, actually, which are easy to automate, and there's other things where, absolutely, it requires human intervention, and we basically tell customers, "Here's the flavors of what's possible, and you get to choose based on what you want to do based on your comfortable now." Many customers, as they should be, initially, are reticent. They should only do it on basic things, but after a while, so for example, I'll give you one simple example. We will, actually, if we have a finding, and we execute a policy, and it's extremely concerning, we will escalate it and say, "Okay, we're escalating it to this team. If they don't resolve it in seven days, we'll escalate it to a bot."

>> Okay. >> That's pretty decent.

>> Yeah. >> You got time to fix it. It's a bad situation. After that, we've automated,

and it's going to remove. >> Okay.

>> It's going to be a cloud janitor, basically.

>> Okay. (laughs) >> That's thee process.

>> You know, I don't know where I saw this, your website or I don't know, but it was called cloud security posture management,

and that's inadequate. >> Yes, it is.

>> Your philosophy, what is it and why is that inadequate?

>> So, you know, this is the acronym soup, which, you know, the security industry always does this, and it's basically, you know, for now, in cloud, it's getting challenging. Cloud security posture management really is representative of an important function, which is are the base settings of how I've set up the problem, the cloud platform, correctly. For example, have I get MFA enabled? So that's a simple question. We should answer that question, and there's lots of ways to do that. We have an amazing way to do it, but it's insufficient. Why is it insufficient? Same with just vulnerability scanning, making sure there's no log for JS in my cloud, it's very important, totally insufficient. How do we segment and control access and movement within a cloud? It's using the identity and access management systems of each of the cloud providers. There are 40,000 unique permissions possible across three cloud providers. So no amount of CSPM, no amount of vulnerability, you know, work will guarantee nobody will get into your cloud, and once they get in, if you have not constrained a risk of identity, access, permission, when they get in, you're going to be in big trouble, and that's how you've set it up. So it's totally insufficient. We have to do the hard work to say, "What are the assets that are important to me? What can access it? Is it appropriate? Now, monitor to make sure it stays the way I want it. If something changes, I get an alarm." That's what we talk about. It's security from the inside out. The great thing about it, Dave, is it's something that customers have. It's work, but they've great control over this. They've no control over all the millions of things trying to attack us all the time. One thing they do have control over, that's my critical data. Who can access it? More importantly, in cloud, what can access it? The serverless functions, the containers, the ephemeral compute. Is it appropriate? Am I monitoring for changes? That's our superpower, and we believe that's the magic of cloud. That's what allows us to deliver a level of security in cloud. That's much better in the data center. CSPM vulnerability management, important, but if that's all you do, you're going to be no better than having your existing challenging cybersecurity situation that we have with existing enterprise networks and data centers.

>> Yeah. >> The magic of cloud is we can get granular to team, to workload, to data and put immense control over.

>> So they don't lift and shift your security posture, actually go beyond and leverage the cloud is what you're saying.

>> The pillars of security in the past are things like firewalls and security operations centers. The pillars of security in the future, have I set up the cloud platform correctly, identity, data, and then, of course, the workload. People are underestimating the importance of identity and data. They are the critical pillars for cloud security in this world, and that's what you get. That's what gets you to an amazing place in terms of security.

>> And, Brendan, you can do this across any cloud, is that right?

>> Yes, and this is, you know, this has been a labor of love, and it takes a long time because each of the cloud providers have built these amazingly flexible systems to allow DevOps teams to innovate quickly, leverage, and build microservices applications, and that power is built into the identity and access management system of each cloud. I'll re-emphasize the statistic. 40,000 permissions across three different cloud providers with 20 being added every day. My company, we understand every one of those permissions. We change our analytics every day to reflect in new permissions, and we're running our analytics for our biggest customers all the time to say, "Oh, something's changed. A new path has been opened up that you don't expect into your data." That's our superpower.

>> And the experience of using your solution, irrespective of the cloud that I'm on is identical, is that right? Are you sort of hiding all that underlying complexity of the the cloud?

>> Actually, you ask really good questions because, actually, the reality is we have to do both, and I'll tell you why. So when we're working with our customers, right, there's uniquenesses of each platform, and so, obviously, we have to understand that, but we actually have this orchestration platform where, sometimes, we're sending the findings and remediations to teams who may only know

AWS, for example. >> Okay.

>> So when we're speaking to that team, we got to speak AWS. We've learned this actually. If we boil out, I call it boiling out to vitamins, if we boil out to vitamins too much, they go, "I am not sure what to do with this." So we got to speak that language, and we do for each cloud provider, but then, now, actually as a company, by the way, this is the big difference between a small SaaS company who's going to buy this uber single thing versus a big enterprise. When I get to a big enterprise, I can't have my security program baked in three, four different ways. I have to have some way of saying, "These are the controls that are important to my business," and we let them do that. So we can do things like separation of duties. We can do things like privilege escalation, and it turns into each of the cloud providers' language and rules, and then when we send the notifications to those experts, it actually looks like it's just AWS or it's just some other cloud provider.

>> Okay, so you basically have

an abstraction layer. >> Yes, we do.

>> That speaks your common language.

>> We do. >> And then you allow the sort of drill down to speak AWS or Azure or GCP or-

>> And when we started, at first, we thought we're just going to build this great abstraction layer, and then we learned very quickly, and now, I need to hear specifics about AWS and what's wrong, which, of course, is correct. It was the good feedback from our customers, and so we go both ways.

>> I got to ask you, what are you seeing in cloud demands? It's really interesting. We watch very closely the cloud, you know, consumption, the demand you're seeing, you saw. You saw Azure growth slow down.

>> Yeah. >> Still really good. I mean I had it at 30%. I think it came into one 31% constant currency. Google GCP, a little softer. People saying Amazon might come in. I got 'em at 15%, still significantly higher

than the on-prem world. >> Yeah.

>> I've also heard some people forecast next quarter AWS, maybe as low as 10%, but I've heard they're being really proactive about going out to their customers, locking in longer term deals, playing the long game. What's your outlook for cloud demand? Is it sort of, you know, you hear repatriation all the time. I've written about the repatriation myth. I just don't see it in the numbers, but what are you seeing in the front lines?

>> Of course, so if, again, this is like I haven't seen the... I don't have the intricate data, but I will tell you here's my viewpoint.

>> Yeah, yeah. >> Of course.

>> Just sort of anecdotal, right?

>> Of course, there's going to be an impact. If you look at one of the big impacts that's happened actually is the funding environment for startups has actually changed dramatically in the last two years, right? And so startups themselves are spending less money, and so a lot of SaaS companies are going to be spending less in cloud. That's just normal. I mean, of course, they are, and that has to impact the cloud providers.

>> Dave: Right.

>> It's just a blip on a journey, which is 100%, there's nothing going to stop this, and, actually, Dave, this note did the repatriation notice is just another blip, and I'll tell you why. It's not, and you know this, in the end, we don't go to cloud because I used to have a server here, and I'm putting a server there. We go there for innovation. I have built things in my solution and in my, our platform, I shouldn't say my, our platform, our team built this amazing platform with magical capabilities that are available in cloud. We wouldn't innovate at this rate if I wasn't building it in cloud. It's not about, "Oh, my God, I'm plugging a server in." We all know that. There's nothing can stop that, and if you're a big enterprise in particular and you want innovation in your IT department, it's only happening in cloud. Like nobody's like innovating in let me build a next version of on-prem software for a data center. So you're never going to get new innovation. So anything that happens this year is a blip. This is unstoppable, and it's great for security. We have a lot of work to do to make it great 'cause if it's done poorly, it is extremely concerning, but when done well, it is amazing, and, actually, that's what we have to do for our customers.

>> So speaking of venture capital and the like, I mean, you guys, I think you're a Series C company,

right, is that correct? >> Yeah, yes, we are.

>> Raised a fair amount of money.

>> We have. >> Not quite 100 million,

but is that- >> Yeah, no, we have actually raised $88 million.

>> Crunch basis, yeah, okay 80 something, right?

>> Yeah. >> Okay. Are you sort of in growth mode? You know, there's a whole narrative about growth capital is now hard to get. Where are you guys?

Are you- >> We we are actually super, so we're absolutely in growth mode, but we're actually also in a mode where we grow based on how the business is going. You know what I mean? We're not trying to... The problem we're solving is a problem which is for sophisticated customers at the high end of the marketplace. That's where my company focuses. Our deals are many hundreds of thousands of dollars. So when we close with a customer, it's typically many hundreds of thousands of dollars. It's some of the biggest companies in the world. So we basically are super happy with our growth. We've got enough capital to grow, and we're not trying to be all things to all companies. We're just not. We think it's too hard. We're going to focus on these amazing solutions for amazing brands in the world, typically, ones which have these big complex clouds, many teams using those clouds, and they've both a technology problem and even orchestration problem, and we help them with that problem.

>> That's it. It's chaotic, and I always say chaos is cash (laughs) for, you know, for criminals, you know, and a technology company that can get it right, Brendan. so thanks very much for coming in "theCUBE".

>> Really appreciate it. >> All right, good stuff.

>> Thank you so much for having us.

>> All right, thank you for watching. Keep it right there. John Furrier and I will be back with RSA 2023. You're watching "theCUBE" from Moscone West in San Francisco. (gentle outro music)

Brendan Hannigan | Sonrai Security

search

(bright intro music)

>> Welcome back to Moscone West. Everybody watching theCUBE's coverage of RSA 2023. RSA is back, and it's big. I mean, it's back to pre-pandemic levels. Brendan Hannigan is here. He's the CEO and co-founder of Sunrise Security. Good to see you again.

Thanks for coming to theCUBE. >> Nice to meet you, Dave.

We're delighted to be here. >> Yeah, so tell me, I always like to ask, I said, "Good to see you again," you've been on theCUBE before. I've not interviewed you, but I always like to ask founders and co-founders, why did you start the company? Take us back to the beginning.

>> The beginning, thought about it, is, essentially, the way we build technology has totally changed from the way we've done it in the past, and that's been going out for many years, driven by a lot of the cloud providers, and we realize two things. One, we have to transform how we're securing it. It's going to be totally different. It has to be, so that's one reason, and the second reason is, you know, we've worked hard to build security for enterprises through the years. There's many innovations that have happened, and people always ask me, "What's the next big innovation in security to really change the game for customers?" And I keep telling them, "It's the cloud." If you do an amazing job in the cloud, you can deliver a level of security far superior to anything you could do in enterprise network and data center, and our approach to helping customers is to achieve that objective.

>> You know, it's interesting. So the very, very first Reinforced that I went to.

>> Yeah. >> Steven Schmidt at the time

was the CSO of AWS. >> Yeah.

>> He's now, of course,. >> Yeah.

>> The chief security officer, I guess.

He was the CSO of AWS. >> Yeah.

>> Now, he's the CSO of Amazon. Anyway, he said, at the time, "The state of cloud security is actually really good," and this vendor narrative that says, you know, everything is, you know, scary and bad is not helpful for the industry, and I said, "Okay, that's a different perspective." At the end of the day though,

it's still really complex. >> Yes it is.

>> So what is the state of cloud security? What's end of the spectrum is it on?

>> In the end of the spectrum, the great thing is the art of the possible is amazing with the cloud, and so Steve is right, and by the way, we build our platform in AWS. We're an amazing partner, and AWS is an amazing partner to us, and so we work very closely with AWS, but when you're a company, and we actually focus, Dave, on larger enterprises, so there's always a segmentation in the marketplace, and think of my own company, we've got a single team, we're very focused on one app, and so it's very integrated between the development and running cloud. Think, now, you go to a big enterprise, they have hundreds and hundreds of cloud accounts. Some of our customers have thousands and thousands of cloud accounts. They've hundreds of teams using those cloud accounts. The art is, as time goes on, a lot of complexity gets built in as to how companies are using that cloud. The scale of it gets very complicated, and so the scale, the flexibility leads to complexity from a security perspective. So the reality is for many companies, this gets very complex very quickly, and the other thing is, right now, the industry, the whole security industry is orienting towards cloud, and quite honestly, the security industry is confusing the living daylights out of our customers, and that is something we really got to work on to help customers. So I think customers have a scale problem and a complexity problem, and then we, as an industry, are confusing the living daylights out of them.

>> Okay, so cut through that confusion.

>> Brendan: Yeah.

>> Where should people be thinking about? How should people be thinking about cloud security? And help us, you know, take the confusion away. What are those confusion elements and what should we be focused on?

>> So, you know, I think about it this way, which is there's this concept within the industry called CINApp, which is a broad based platform with many different things into it, and, of course, that makes sense for a class of customers. So customers have to know where they are in this journey. Some customers are at the early stages. They can use broad based solutions that do a little bit of everything, but as you grow up in scale, you actually need specialized capabilities in certain areas. So for example, in the cloud, the risks are different than in a traditional environment, and two of the key risks that exist, we say this all the time, vulnerability management and detection and basic configuration settings is important. It's like keeping your house clean. It's just not enough. The risk is underneath the covers of cloud, and it's all about how the compute and the resources in the cloud can interconnect. So we focus on helping our customers with identity, access, permissions, understanding what are the risks in terms of how they've set that up, helping our customers eliminate it, and make sure they never come back again.

>> Okay, then that's helpful. So the complexity is you've got thousands of cloud accounts,

hundreds of teams. >> Yes.

>> None of 'em are using the same exact best practice.

>> Yes. >> We know that. They're doing things... I would say a lot of these problems are self-inflicted.

>> Brendan: They are.

>> But it's 'cause we're moving so fast, but, okay, so how do you specifically solve the problem?

>> The problem, yeah, well, firstly, actually, as we talk about the confusion that customers can have and the complexity of it, the industry is speaking about cloud like it's an amorphous blob. There's a cloud, and we need to solve cloud security with a single product, and it's not right. So we actually segment. We actually focus on large enterprises, and we say large enterprises have unique challenges of scale and complexity, and one of the biggest challenges of scale and complexity they have are the rights permissions and identities and what they can access in the cloud, who can access critical resources, and who can escalate to get privilege and do damage in that cloud. I'll give you an example of scale, Dave. It's not unusual for our customers to have hundreds and hundreds and hundreds of thousands of roles in AWS or service accounts. Human beings can't manage that, we know that. The analytics to understand that is enormous in terms of what we have to do, and what do we do for our customers? We graph every way any entity can get access to a resource in their cloud. We graph every way an entity, a piece of computer serverless function, can get access to a privilege, and then we run analytics to solve a problem for a customer. How can we eliminate a risk that's just extremely concerning? In other words, a developer getting access into production, an obvious way for an attacker to laterally move to true to cloud, helping with an audit. So auditors are getting smarter about cloud. The auditor walks in and says, "Hey, we're having a look at the cloud. Tell me how you're controlling access to resources," and our current, many, many, many companies now because of the scale of what's happened, it's a hard question to answer. We answered a question for every resource. We can tell every single thing that can access anything in all the clouds actually.

>> So for example, an individual might have access to so many more resources than he or she should have access to-

>> It's using to. >> And that's very common

right? >> Exactly.

>> And explain why that's a problem. I mean it's pretty obvious, but somebody gets in, then they have access to a much wider blast radius than they would normally, right?

>> So this is actually the risk that we run if we focus on the edge and vulnerabilities and watching external threats. We all know, at any point in time, there could be a zero day vulnerability or you can't possibly have them all remediated, and so somebody gets in. Now, we think of it being an attacker, but within the cloud, we all know the infrastructure is created automatically. It's created during bill processes. So now, the entity that gets into person has the ability to create a piece of compute. Now, what can it do when it's in there? We have to answer that question, and it's a really hard question to answer, but yet it's fundamentally important 'cause we don't have a data center anymore. We can't just surround it with a firewall. The data is entirely separated from the compute, and you have to be able to answer the question. When that serverless function is active, what can it access for that 60 seconds? That's a critical question to answer 'cause that's exactly what a hacker will do. They go in. They move around. They grow in terms of their privilege, and then they, basically, get access to something that actually is important, and now, they could actually, if they have to right right, they could create a piece of compute and extract it. All of that is possible. All of it happens, and it's hidden in the complexity of these big large environments.

>> Okay, so we love the analogies of superheroes on "theCUBE" when we're talking about security, you know, what is it? "The Incredibles", right?

>> Yes. >> That each of them has a superpower. What would you say is Sunrise's superpower?

>> Our superpower is all around identity, access, and permissions underneath the cover, and, basically, saying with a certainty, we can answer the question, what can this entity do, where can it get privileged, and how can it add access for all of the cloud providers? That's a superpower. On top of that, the value we're delivering is amazing audits, incredible way to understand what attackers can do if they're in your cloud, and then continuously monitor if any changes. Under the covers, Dave, we have this amazing technology. What it's doing is, actually, a lot of people now talk about graphs 'cause graphs are a really important technology. We're actually loading up every possible permission entitlement in AWS. We're graphing every way any entity can get to that entitlement, and we're able to do it at a scale where our customers, we've got customers with 4,000 cloud accounts. We've got customers with hundreds and hundreds and hundreds of thousands of service accounts and roles in their environment. So it's scale. It's an immense understanding of access, identity, and privilege in these environments, and it's the orchestration to do that for large enterprises.

>> So when you talk about graph, you're talking about graph database or is that something that you've built or is it-

>> It's something we built. >> Visualization capability?

>> Underneath the covers, we've built a way to actually aggregate all the ways in which things can interconnect into cloud and answer, it's kind of a complicated way to answer a simple question, what can that thing do, who can access my critical data, and is that creating risk for my business?

>> Should I think of it as a purpose-built database?

>> It is a purpose-built database.

>> And it's a graph database? >> It's a graph database.

>> Okay, so it's expressive. >> It's extremely expressive. It's all actually our entire platform can... We've a beautiful UI on our platform, but can be entirely interrogated through GraphQL.

So it's truly a- >> Explain that because the knock on graph databases in commercial worlds is you have the expressiveness, but you don't have the elegance,

query elegance of relational. >> Absolutely.

>> Right, sounds like you've solved that problem?

>> We have actually, so basically, well, we do, and this is one of the challenges which sort of an off-the-shelf, oh, we're just going to create things and stick them in a graph. We actually have to build custom stores, customs ways of interconnecting, and then we have custom analytics to answer really hard questions. Like if we take AWS, how do all the various different permissions models affect how things are interconnected in this graph? So we build these analytics and now we use GraphQL as an API into it where you can go and execute the analytics against a graph. So what it's doing is it's like you can go in and get an individual node or an individual vector into graph or you can actually go in and execute one of our analytics and get the answer out so it's super flexible, and, of course, in the world of cloud, in the world of automation, we have some customers who initially want to see, and then customers want to automate on. You can't, you got to be able to bring on thousands of cloud accounts and automate that process, and that's when we do a great job.

>> And is there reticence initially to automate, and how do they sort of get... How do you get customers through that reticence if it exists?

>> So it's governance. It's escalation pads. It's certification pads. It's involving humans where they want to be involved. There's some things, actually, which are easy to automate, and there's other things where, absolutely, it requires human intervention, and we basically tell customers, "Here's the flavors of what's possible, and you get to choose based on what you want to do based on your comfortable now." Many customers, as they should be, initially, are reticent. They should only do it on basic things, but after a while, so for example, I'll give you one simple example. We will, actually, if we have a finding, and we execute a policy, and it's extremely concerning, we will escalate it and say, "Okay, we're escalating it to this team. If they don't resolve it in seven days, we'll escalate it to a bot."

>> Okay. >> That's pretty decent.

>> Yeah. >> You got time to fix it. It's a bad situation. After that, we've automated,

and it's going to remove. >> Okay.

>> It's going to be a cloud janitor, basically.

>> Okay. (laughs) >> That's thee process.

>> You know, I don't know where I saw this, your website or I don't know, but it was called cloud security posture management,

and that's inadequate. >> Yes, it is.

>> Your philosophy, what is it and why is that inadequate?

>> So, you know, this is the acronym soup, which, you know, the security industry always does this, and it's basically, you know, for now, in cloud, it's getting challenging. Cloud security posture management really is representative of an important function, which is are the base settings of how I've set up the problem, the cloud platform, correctly. For example, have I get MFA enabled? So that's a simple question. We should answer that question, and there's lots of ways to do that. We have an amazing way to do it, but it's insufficient. Why is it insufficient? Same with just vulnerability scanning, making sure there's no log for JS in my cloud, it's very important, totally insufficient. How do we segment and control access and movement within a cloud? It's using the identity and access management systems of each of the cloud providers. There are 40,000 unique permissions possible across three cloud providers. So no amount of CSPM, no amount of vulnerability, you know, work will guarantee nobody will get into your cloud, and once they get in, if you have not constrained a risk of identity, access, permission, when they get in, you're going to be in big trouble, and that's how you've set it up. So it's totally insufficient. We have to do the hard work to say, "What are the assets that are important to me? What can access it? Is it appropriate? Now, monitor to make sure it stays the way I want it. If something changes, I get an alarm." That's what we talk about. It's security from the inside out. The great thing about it, Dave, is it's something that customers have. It's work, but they've great control over this. They've no control over all the millions of things trying to attack us all the time. One thing they do have control over, that's my critical data. Who can access it? More importantly, in cloud, what can access it? The serverless functions, the containers, the ephemeral compute. Is it appropriate? Am I monitoring for changes? That's our superpower, and we believe that's the magic of cloud. That's what allows us to deliver a level of security in cloud. That's much better in the data center. CSPM vulnerability management, important, but if that's all you do, you're going to be no better than having your existing challenging cybersecurity situation that we have with existing enterprise networks and data centers.

>> Yeah. >> The magic of cloud is we can get granular to team, to workload, to data and put immense control over.

>> So they don't lift and shift your security posture, actually go beyond and leverage the cloud is what you're saying.

>> The pillars of security in the past are things like firewalls and security operations centers. The pillars of security in the future, have I set up the cloud platform correctly, identity, data, and then, of course, the workload. People are underestimating the importance of identity and data. They are the critical pillars for cloud security in this world, and that's what you get. That's what gets you to an amazing place in terms of security.

>> And, Brendan, you can do this across any cloud, is that right?

>> Yes, and this is, you know, this has been a labor of love, and it takes a long time because each of the cloud providers have built these amazingly flexible systems to allow DevOps teams to innovate quickly, leverage, and build microservices applications, and that power is built into the identity and access management system of each cloud. I'll re-emphasize the statistic. 40,000 permissions across three different cloud providers with 20 being added every day. My company, we understand every one of those permissions. We change our analytics every day to reflect in new permissions, and we're running our analytics for our biggest customers all the time to say, "Oh, something's changed. A new path has been opened up that you don't expect into your data." That's our superpower.

>> And the experience of using your solution, irrespective of the cloud that I'm on is identical, is that right? Are you sort of hiding all that underlying complexity of the the cloud?

>> Actually, you ask really good questions because, actually, the reality is we have to do both, and I'll tell you why. So when we're working with our customers, right, there's uniquenesses of each platform, and so, obviously, we have to understand that, but we actually have this orchestration platform where, sometimes, we're sending the findings and remediations to teams who may only know

AWS, for example. >> Okay.

>> So when we're speaking to that team, we got to speak AWS. We've learned this actually. If we boil out, I call it boiling out to vitamins, if we boil out to vitamins too much, they go, "I am not sure what to do with this." So we got to speak that language, and we do for each cloud provider, but then, now, actually as a company, by the way, this is the big difference between a small SaaS company who's going to buy this uber single thing versus a big enterprise. When I get to a big enterprise, I can't have my security program baked in three, four different ways. I have to have some way of saying, "These are the controls that are important to my business," and we let them do that. So we can do things like separation of duties. We can do things like privilege escalation, and it turns into each of the cloud providers' language and rules, and then when we send the notifications to those experts, it actually looks like it's just AWS or it's just some other cloud provider.

>> Okay, so you basically have

an abstraction layer. >> Yes, we do.

>> That speaks your common language.

>> We do. >> And then you allow the sort of drill down to speak AWS or Azure or GCP or-

>> And when we started, at first, we thought we're just going to build this great abstraction layer, and then we learned very quickly, and now, I need to hear specifics about AWS and what's wrong, which, of course, is correct. It was the good feedback from our customers, and so we go both ways.

>> I got to ask you, what are you seeing in cloud demands? It's really interesting. We watch very closely the cloud, you know, consumption, the demand you're seeing, you saw. You saw Azure growth slow down.

>> Yeah. >> Still really good. I mean I had it at 30%. I think it came into one 31% constant currency. Google GCP, a little softer. People saying Amazon might come in. I got 'em at 15%, still significantly higher

than the on-prem world. >> Yeah.

>> I've also heard some people forecast next quarter AWS, maybe as low as 10%, but I've heard they're being really proactive about going out to their customers, locking in longer term deals, playing the long game. What's your outlook for cloud demand? Is it sort of, you know, you hear repatriation all the time. I've written about the repatriation myth. I just don't see it in the numbers, but what are you seeing in the front lines?

>> Of course, so if, again, this is like I haven't seen the... I don't have the intricate data, but I will tell you here's my viewpoint.

>> Yeah, yeah. >> Of course.

>> Just sort of anecdotal, right?

>> Of course, there's going to be an impact. If you look at one of the big impacts that's happened actually is the funding environment for startups has actually changed dramatically in the last two years, right? And so startups themselves are spending less money, and so a lot of SaaS companies are going to be spending less in cloud. That's just normal. I mean, of course, they are, and that has to impact the cloud providers.

>> Dave: Right.

>> It's just a blip on a journey, which is 100%, there's nothing going to stop this, and, actually, Dave, this note did the repatriation notice is just another blip, and I'll tell you why. It's not, and you know this, in the end, we don't go to cloud because I used to have a server here, and I'm putting a server there. We go there for innovation. I have built things in my solution and in my, our platform, I shouldn't say my, our platform, our team built this amazing platform with magical capabilities that are available in cloud. We wouldn't innovate at this rate if I wasn't building it in cloud. It's not about, "Oh, my God, I'm plugging a server in." We all know that. There's nothing can stop that, and if you're a big enterprise in particular and you want innovation in your IT department, it's only happening in cloud. Like nobody's like innovating in let me build a next version of on-prem software for a data center. So you're never going to get new innovation. So anything that happens this year is a blip. This is unstoppable, and it's great for security. We have a lot of work to do to make it great 'cause if it's done poorly, it is extremely concerning, but when done well, it is amazing, and, actually, that's what we have to do for our customers.

>> So speaking of venture capital and the like, I mean, you guys, I think you're a Series C company,

right, is that correct? >> Yeah, yes, we are.

>> Raised a fair amount of money.

>> We have. >> Not quite 100 million,

but is that- >> Yeah, no, we have actually raised $88 million.

>> Crunch basis, yeah, okay 80 something, right?

>> Yeah. >> Okay. Are you sort of in growth mode? You know, there's a whole narrative about growth capital is now hard to get. Where are you guys?

Are you- >> We we are actually super, so we're absolutely in growth mode, but we're actually also in a mode where we grow based on how the business is going. You know what I mean? We're not trying to... The problem we're solving is a problem which is for sophisticated customers at the high end of the marketplace. That's where my company focuses. Our deals are many hundreds of thousands of dollars. So when we close with a customer, it's typically many hundreds of thousands of dollars. It's some of the biggest companies in the world. So we basically are super happy with our growth. We've got enough capital to grow, and we're not trying to be all things to all companies. We're just not. We think it's too hard. We're going to focus on these amazing solutions for amazing brands in the world, typically, ones which have these big complex clouds, many teams using those clouds, and they've both a technology problem and even orchestration problem, and we help them with that problem.

>> That's it. It's chaotic, and I always say chaos is cash (laughs) for, you know, for criminals, you know, and a technology company that can get it right, Brendan. so thanks very much for coming in "theCUBE".

>> Really appreciate it. >> All right, good stuff.

>> Thank you so much for having us.

>> All right, thank you for watching. Keep it right there. John Furrier and I will be back with RSA 2023. You're watching "theCUBE" from Moscone West in San Francisco. (gentle outro music)