Name: Idan Plotnik | Apiiro
Uploaded: 2023-04-26T21:00:00.000Z
Duration: 14 min 37 s

More from RSA Conference 2023

Idan Plotnik

Co-Founder and CEO

Apiiro

Info

Idan Plotnik | Apiiro

Idan Plotnik

Co-Founder and CEO Apiiro

(techno music)

>> Hello and welcome to theCUBE's live coverage here at RSA Conference. I'm John Furrier, host of theCUBE. Dave Vellante is here with me. We're moving in and out. It's been about four days of wall-to-wall coverage. RSA is really about connecting to the next generation of platforms, tools to make everything secure from the network all the way up to the application. We've got a great guest here, Idan Plotnik who is the co-founder and CEO of Apiiro. Great company, well-funded. Kind of making some moves. Welcome to theCUBE.

>> Thank you. Thank you very much for having me.

>> So you guys are a Series B funded startup so that really means you're not huge and down the stream, but highly successful, highly funded huge success and momentum with developers.

>> Yeah.

>> Application security, we love it. It's got a little bit of open source SBOM, software supply chain.

>> Yes.

>> Cloud native developers right now are setting the agenda for what is going to be adopted in enterprises and everyone below them is working to be enabled. We're seeing that even here in the security conference. Palo Alto Networks talking about a platform. It's the first time I've ever heard a security conference talking about a platform.

>> Yeah.

>> Usually it's just tools. You guys are successful. Why?

>> I think let's talk about the challenge. It's a huge challenge. The complexity of modern cloud applications and software supply chains created a completely new interconnected attack surface. And the siloed tools created significant blind spots. So eventually the poor AppSec engineer needs to deal with hundreds of thousands of alerts without context and then he's shifting these alerts to the developers. Friction, everyone take the tools out and you have cacophony and you deliver risks to the cloud. This is why.

>> I know this is one of the things, so I got to tell you Dave Vellante and I have been talking about this for probably two years, hardcore two years. Before that I've been saying it on theCUBE, going back to 2010, that developers are going to be coding infrastructure's code, that happened, then we were saying data as code programmable data. Because data's now moving into the field of large language model. Prompt engineering's just prompting a call to another language model that's like a procedure call, that's like coding.

>> Absolutely.

>> That's going to become codeable. So the question is, if you could flip the script who decides where the data is stored? The developers have no decision on it? So I think developers will drive every single infrastructure decision in the future. What do you think about that?

>> So first, I think developers are a part of the conversation of the architecture. So you will see where the data flow between components in the application and where it's stored because it affected the performance of the application. The application security engineer will decide what are the security controls to put on this data. So you need to work in harmony. And you need to decide where the data is to be able to control it. And I think this is the hard work of the application security engineer in this.

>> So the core problem that you're solving is what? Take a minute to explain your company's North Star mission. Why you exist, what you brought to the market and why is it working? Why is the product working and who's your target audience?

>> Sure. So our mission is to secure the code you developed and the way you deliver it to the cloud. Okay, this is a huge problem for application security. It's not only the code, it's how you build it, how you ship it to the cloud. This is a huge attack vector and as I said the current tools create a lot of alerts. So then you have one AppSec engineer to 200 developers. This is the ratio and he or she are overwhelmed with all the alerts and eventually they need to fix them and the context is what they're missing. And what we are bringing to the picture is the following. Our application security platform basically builds a real-time inventory of all the code components, the applications and the software supply chains. So you can ask any question across any code component and get a real time answer in a second. Then we are orchestrating and correlating all the security signals from your siloed tools. And then we connect the dots on our risk graph. This is what gives them the context to be able to save time triaging the alerts, fixing them much faster because we are tying every risk to a code owner with the business impact. And lastly, prevent, put guard rails to the developers with the context so they will not deliver the risks to the cloud.

>> So that sounds awesome. Let just dig into that. By the way, congratulations, a great solution. I love it already, but I want to ask you a specific question. So you got an inventory of all the software build and materials of all the components of the software.

>> And the relationship between them.

>> In production.

>> In the code.

>> In the code itself, okay.

>> And you can ask question, this API that talks to this open source dependency and expose this PI data, is it already being deployed in production?

>> So a knowledge graph for developers, in a way?

>> It's a risk graph for developers and AppSec engineers.

>> So the use case is, a bunch of alerts are going off. So what's the use case? What's the problem right there? Okay, where's the code? Someone's hacking us? It's like a hospital. All the alarms are going off. What do I pay attention to?

>> So let's take the Log4j example. Okay, in the code you have 5,000 Log4j's. Now you need to cut it down and say, show me only the Log4js that are in a high business impact application. Show me only the Log4j's that are in the same repo where I have an API that also exposed PI data. Let's fix this first. Is it already deployed to production? Yes, it's much more risky. Okay, now show me in a click of a button where in my Kubernetes cluster, these Log4j's are running. Great. Instead of 5,000, you narrow down to 10. And now we are opening remediation action because we know who is the developer that committed the code and when it was deployed. So now you close the loop from the Kubernetes.

>> So he or she gets the notification.

>> Exactly.

>> They take care of it.

>> It's not only notification, it's the action items. What actually you need to do to fix and what the implications of the fix. Because in some cases if you fix it you can break the application. So you need the end answer.

>> You called this a risk graph.

>> Exactly.

>> Risk like risk management.

>> We augment risk on top of every code component on every API and dependencies because now I don't care about vulnerability with CVSS score eight. Because it can be low risk for the business. So you need to augment.

>> Operationally, it's an operational dream in the SecOps area. Because you can then prioritize. You go and say, okay, critical systems, boom let's lock the dose down first. No one cares about checking their email right now. Let's shut that down. Just shut it down, maybe or whatever, you can take actionable tasks.

>> To fix the risks that matter to the business.

>> That's important.

>> And I want to double click for a second on one of the points here. Everyone has an SaaS, NSCA, and DUST, and CSPM and whatever tools that they put in their tool chain. Eventually you need one place to take all these alerts and say, okay, this alert is related.

>> It's the hive mind for the network. For the code.

>> Yes.

>> It's the brain for all the software.

>> It's the brain for the software. This is exactly what we are doing and I'm going to use it in our collaterals.

>> Okay. You're going to have to give theCUBE a little bit on that. We'll take advisor shares on that, no problem. Now seriously, let's get into the value. This is really cool. So now just play it forward. You almost connect the dots. Let's get into the the ChatGPT euphoria because got to love what has happened. The whole world now sees magic. Inside the industry we all know where machine learning was reused a lot. We love it. But the fact that the whole world now understands there's horizontal use cases of things they've never seen before. So if you're a layperson, you say, oh my god, that's magic. You know, okay, we kind of get it, it's just taking the web and formatting. But it's all cool. Now but you can almost go and say, hey, I can use tuning techniques.

>> Absolutely.

>> In your graph. Why call the engineer?

>> Okay, let's double click on that. We are using LLM models. Okay. the technology behind ChatGPT, for two years plus. One, we are using it to automate the work of the analyst and give them the accurate points where they need to start thinking. So we saved hours and we saved manpower. Two, we use the ChatGPT technology for the auto remediation stuff in the code so we can generate, because we have all the context ChatGPT needs the context from the code, from the build, from the runtime and then say, okay, this is the solution and we are leveraging it to help our customers fix much, much faster.

>> I mean, I've always loved the line from Andy Jassy at Amazon said, you know, they want to take care of the undifferentiated heavy lifting. But when you've taken the AI approach what you guys are doing, you can go in and say, okay, we can run this new thing. We can operationalize it. Now we got the tuning, which is not human related. So humans are involved in step one and two. And then the tuning can be self-correcting and or guard rails around policy. So you say, Hey, if something happens shut down these systems. Let's target everything here.

>> So we are-

>> Notify the engineer, write the code, don't even ask the engineer.

>> In the security operations side I agree this is where it's going to be. But in our side, which is the left side we will put the guard rails to the developers. So they will not commit the code with the risks of the business. There in their own tool chain like GitHub, GitLab and other, you know source control managers where you open the pool request you will get all the remediation actions and where are the people in the organization that can help you fix it.

>> Great story, congratulations. You know, I want to get the last couple minutes we have here to ask you about the origination story. How did it all get started? Did you wake up one day and say, you know, I'm going to build the most complex reducing system that's going to be intelligent all knowing AI future brain of all software code.

>> So I was a GM for software engineering at Microsoft before that. After the acquisition of my previous startup. So I sold my startup to Microsoft in 2015. And I felt this pain firsthand. I managed a lot of developers in a large business unit in the security division at Microsoft. And then they said, okay, you need these risk management processes like these questionnaires before every release, you need a SaaS, and a CA, and a Dust, and a secret scanning, and pen testing. Then I'm getting tons of alerts and my developers are complaining, Idan, we had a deadline for the 10 of the Fortune 50 customers. Why we are late on delivery?

>> All these hassles. (Idan laughs)

>> Blockers, paperwork, boring stuff.

>> And this is where the epiphany came. And we went to customers and we asked them, like huge customers on the financial industry. And they said, this is a huge pain for us because we want to deliver code to the cloud much faster and we need the guard rails and we don't have the context. We bought all these tools, all these AppSec tools but we need the context and we need the knowledge of augmenting the risk on top of that.

>> Yeah, you know, Andy Grove the famous legendary Intel CEO once said let chaos rain and then reign the chaos in. And I think you're starting to see this with your success is just cut to the chase.

>> Cut to the chase.

>> Make it simpler. Why are we doing all these things? What's the purpose? What are we optimizing for? These are just great questions to ask.

>> Yeah, and the thing is to do more with less today. In the AppSec do more with less. And this is why we released yesterday, the risk graph explorer, which allows developers and application security engineer to ask any question that they want on their code and software supply chain.

>> With a great success. Quick 30 seconds left in the program, put a plugin for the company. What are you looking for? Obviously you got plenty of cash, you're doing well with the customers. What are you looking for? How big is the team? Give some stats, sort of a plugin.

>> We are around 130 people at the company across Israel, the R&D is in Israel and the business development and all the go-to-market team is across the US, Canada and London. We're expanding dramatically. And we had 531% growth ARR from year over year. And it's insane. Suddenly see the rocket ships goes up and we are hiring and we are extending our, you know, capabilities with more and more things that will help the developers deliver secure applications to the cloud.

>> And your priority is keep the R&D going, go to market increase the sales and marketing.

>> Now it's go to market. It's like 80% go to market focus.

>> Congratulations on your entrepreneurial venture endeavor. Hold onto that rocket ship. Make sure it doesn't blow up.

>> Thank you. (laughter)

>> What is it unregulated disassembly that Elon said? Unscheduled disassembly.

>> It's will blow up. We just need to contain it.

>> He actually hit the button, they blew it up because it was going- No you guys were on a good track. Congratulations, looking forward to following the progress. And you're the brain of this software. Congratulations.

>> Thank you. All right theCube coverage here. We're bringing all the action here at RSA 2023. I'm John Furrier and Dave Vellante, we'll be right back after this short break. (soft outro music)

Idan Plotnik | Apiiro

(techno music)

>> Thank you. Thank you very much for having me.

>> So you guys are a Series B funded startup so that really means you're not huge and down the stream, but highly successful, highly funded huge success and momentum with developers.

>> Yeah.

>> Application security, we love it. It's got a little bit of open source SBOM, software supply chain.

>> Yes.

>> Yeah.

>> Usually it's just tools. You guys are successful. Why?

>> Absolutely.

>> And the relationship between them.

>> In production.

>> In the code.

>> In the code itself, okay.

>> And you can ask question, this API that talks to this open source dependency and expose this PI data, is it already being deployed in production?

>> So a knowledge graph for developers, in a way?

>> It's a risk graph for developers and AppSec engineers.

>> So he or she gets the notification.

>> Exactly.

>> They take care of it.

>> You called this a risk graph.

>> Exactly.

>> Risk like risk management.

>> To fix the risks that matter to the business.

>> That's important.

>> It's the hive mind for the network. For the code.

>> Yes.

>> It's the brain for all the software.

>> It's the brain for the software. This is exactly what we are doing and I'm going to use it in our collaterals.

>> Absolutely.

>> In your graph. Why call the engineer?

>> So we are-

>> Notify the engineer, write the code, don't even ask the engineer.

>> All these hassles. (Idan laughs)

>> Blockers, paperwork, boring stuff.

>> Yeah, you know, Andy Grove the famous legendary Intel CEO once said let chaos rain and then reign the chaos in. And I think you're starting to see this with your success is just cut to the chase.

>> Cut to the chase.

>> Make it simpler. Why are we doing all these things? What's the purpose? What are we optimizing for? These are just great questions to ask.

>> And your priority is keep the R&D going, go to market increase the sales and marketing.

>> Now it's go to market. It's like 80% go to market focus.

>> Congratulations on your entrepreneurial venture endeavor. Hold onto that rocket ship. Make sure it doesn't blow up.

>> Thank you. (laughter)

>> What is it unregulated disassembly that Elon said? Unscheduled disassembly.

>> It's will blow up. We just need to contain it.

>> Thank you. All right theCube coverage here. We're bringing all the action here at RSA 2023. I'm John Furrier and Dave Vellante, we'll be right back after this short break. (soft outro music)