RSA Conference 2024 | Doug Merritt & Chris McHenry | Aviatrix

Clips
News
More from RSA Conference 2024

Doug Merritt

CEO

Aviatrix

Chris McHenry

SVP, Product Marketing

Aviatrix

The future of cloud infrastructure: Advancements in networking and security integration

The evolution of networking, the complexities of cloud environments and the strategic alliances shaping the future of infrastructure were all the buzz at the RSA Conference in San Francisco.Aviatrix Systems Inc., in particular, has emerged as a leader helping companies to navigate the evolving landscape of cloud-centric IT infrastructure, including the convergence of cloud networking and security operations.“The core that we serve is the networking team,” said Doug Merritt (pictured, left), chief executive officer of Aviatrix. “The base value comes with the fact that we are a legitimate data plane that is able to live in a multitude of different clouds

play_circle_outline Unveiling the Evolution and Limitations of Networking and Security: A Deep Dive into Cloud's Impact and Integration

play_circle_outline Advantages of Aviatrix's cloud-native router in providing deeper insights and data than cloud vendors.

play_circle_outline Partner strategy with cloud service providers, ISV framework, and VAR and systems integrators

play_circle_outline Convergence of networking and network security

Info

Doug Merritt & Chris McHenry | Aviatrix

Doug Merritt

CEO Aviatrix

Chris McHenry

SVP, Product Marketing Aviatrix

search

>> Welcome back to the RSA Conference. We're here at Broadcast Alley in Moscone West. Doug Merritt's here, CEO of Aviatrix, and he's joined by Chris McHenry, who's the Vice President of Product Management. Guys, welcome. We're going to talk about the cloud networking joining with SecOps.

Doug Merritt

>> Love it.

>> Welcome.

Doug Merritt

>> That's a topic that we have a little bit of info on.

>> Why now, Doug? Why now?

Doug Merritt

>> When you go back and look at networking over the past 50 years, I think if you'd sat down and really thought as a network architect, how should we design these networks? The core security constructs, things like firewalling and adding, would've been included in that, in everything that networking did. The way that networking evolved, you had to have a bunch of boxes out there that were purpose-built for their use cases. And so you had this security orientation as a separate set of boxes that were conceptually in the network topology, but weren't natively integrated in. That SDN movement was supposed to cure all that, kind of had its boom and faded. And I think now with cloud, and cloud being as pervasive as it is, you've got a fully virtualized L1 H L2 layer, right? All that core infrastructure that's so important is available. A company like Aviatrix can come in with a complete network, a full network capability as one solution out there that natively includes network security and security constructs. It's not a whole separate thought process. Are you routing? Are you trying to load balance and app optimize? Are you trying to encrypt? Are you trying to invoke security? That should all just be part of the same dialogue. And I think as cloud continues to progress and we get more heterogeneous with cloud, now you're seeing purpose-built LLM clouds spring up, so we've always had the three big cloud vendors, but Oracle knows its way into that dialogue, as well as a bunch of regional clouds. And I think we're just going to see more heterogeneity and more preponderance of these clouds. And the question I think keeps coming up of the constructs. We're not that effective and efficient as a bolt-on. What are we going to do to make it native and integrated with networking, as it should be full time.

>> Why do you think SDN petered out? It looked like VMware had an angle there for a while, and then it just sort of fell off the map. Why is that, just it wasn't functional enough?

Doug Merritt

>> I think it was a tough play. The way these boxes evolved, you had 9, 10, 15 boxes as part of every rack from different vendors. And you had a bunch of people at that data center that had bet their careers on their F5 boxes, or Palo boxes, or Checkpoint boxes, or Cisco boxes, or Juniper boxes. And there's a beautiful value prop of wait, wait, wait. hey, we've progressed on the hardware front. Why don't we have a software layer and a more general purpose hardware layer? But human dimension, human psychology is tough. You've got to go back in that data center and try and convince six different buyers, here's a better way of doing it. I think it was right technologically and philosophically, but just hard to execute is my view. Always easy to have the rearview mirror. The interesting thing is to the cloud, why wasn't it done natively that way from the beginning? Because here, you didn't have to rip and replace a bunch of other vendors. And for whatever reason, the cloud vendors emulated that old model, so they've got all these awesome networking services, but you've got your firewalling service, you've got your routing service, you've got load balancing service, you got NAT service. It's like, wait a second, you didn't have to do that. And I'm grateful that Aviatrix took a different approach.

>> So too much entrenched Cisco and others, but Chris, explain why this approach is better, and how you guys attack it.

Chris McHenry

>> Yeah. Well, first off, I think the need is greater to some extent. Even if we go back and look at one of the big drivers for SDN, even day zero, when we look at NYSERA and NSX and a lot of the things that VMware was doing there, firewalling and security was always one of the big needs. The difference being we had a perimeter, we had something at the edge that was a traditional firewall that was protecting us from the real danger zone, which is the internet. And one of the things that changes when you go to the cloud is that the internet is now everywhere. So to some extent, the need is actually greater as well. And I think that when we look at how we approach this slightly differently, actually, we're thinking about different kinds of network security. Still looking at things like the zero trust paradigms, micro segmentation, those kinds of tools and controls that organizations need in order to improve their security posture. But we also want to be very intentional about how do we converge perimeter security into that foundational security layer for the cloud, because the internet is so much more ever present when applications are being deployed in the cloud? It's a slightly different set of tools and capabilities. And then the last thing I'll say is we're not talking about green fields. We're talking about going into application environments that are already pretty messy. And so the ability to integrate and automate and understand that landscape up front, and really make it easy for organizations to insert security retroactively into a brown field environment, a huge, huge, huge differentiator for us. That awareness of the cloud really helps organizations achieve their objectives much more quickly.

>> So Doug, you explained the entrenchment and the problem that customers had to go through to merge security and networking. What does a customer have to go through? What are the prerequisites to adopt your solution?

Doug Merritt

>> There's a blog to be pushed out like a week ago, Embrace the Chaos, just building on Chris's constructs.

>> Let the chaos reign, and then rein it in.

Doug Merritt

>> I don't know how to not. Chaos is, it is, and I think it's just going to continue. Again, the heterogeneity within those cloud environments and the heterogeneity across the workload environment, I think, is going to continue. And with heterogeneity, you've got different constructs, which means you need something that's been purpose built to be easily deployed and integratable across those. So one of the many advantages that's exciting about Aviatrix is we've always taken an infrastructure as code approach, and an integratable and heterogeneous approach. So you can really start in that brown field environment on any of 10, 20, 50 different use cases.

Chris McHenry

>> And it's so much more important in the cloud to make sure that security has a good relationship with the application development team, because that was one of the drivers, that partnership, that I think security tended to have a bigger share of the power balance on premises to the detriment of speed, oftentimes. And cloud, one of the primary value propositions is speed, so you have to rethink how security integrates with the tooling that the app developers are using. We want to be able to provide security that both the InfoSec teams, the SecOp teams, and the app teams love. And so that infrastructure as code approach, the deep integration with the cloud, doing things like identity based zero trust, where the developers don't have to request changes to their firewall policies, that whole mindset of serving both the app developers and the security teams really is a critically important part of it.

Doug Merritt

>> So who are your peeps? Is it the SecOps team? Is it the networking team? Is it the DevOps team? All three?

Doug Merritt

>> All three, but the core that we serve is the networking team. The base value comes with the fact that we are a legitimate data plane that is able to live in a multitude of different clouds. So we touch packets, we filter packets, and the people that control that deployment have networking credentials somewhere in their title. But then the value, once you get that in, massive value to the SecOps team, massive value to the DevOps team, turns out massive value to the FinOps team. There's a whole different cost exposure that we create that can pretty dramatically reduce your cloud bills, because the way that we process packets across the cloud, that avoids a lot of egress and data processing fees. So whether it's AppDev, DevOps, ITOps, SecOps, as soon as you get our technology in, they all get massive value. But the core is really that networking team.

Chris McHenry

>> Which by the way shouldn't be surprising. If I look at the fundamental thing that we did, I would say we took a lot of the concepts that you had on premises, and instead of lifting and shifting them to the cloud, we refactored and we re-architected them for the cloud. And if you go to any of the cloud providers' best practices, you'll see benefits are better performance, lower total cost of ownership, all of the things that come with-

Doug Merritt

>> Agility.

Chris McHenry

>> Agility, all the things that come with refactoring. And pretty much everybody else just lifted and shifted their software.

Chris McHenry

>> Which doesn't get you those benefits.

Chris McHenry

>> Exactly.

>> We were talking earlier about SASSY, and how you guys fit, and some of the drawbacks, actually. SASSY's got a lot of momentum in the marketplace. Let's relive that conversation a little bit. What are you hearing from customers? There's some goodness there, but there's some drawbacks. Explain that.

Doug Merritt

>> I'll start, and I'll let Chris clean up with all the intelligent comments, but I like the embrace the chaos. It's an and, not an or. SASSY is awesome, and the SASSY vendors serve a really important purpose. It's very different than what we do. They provided a framework that creates zero trust and a whole host of security benefits. When you're looking at the, even going back to Chris talking about perimeterless. When you're talking about the individual that could be anywhere, not inside the confines of a gated community, a campus, in anything that's controlled by that organization, the question is what happens as soon as that packet leaves that safe walled community? And that's where we come in.

Chris McHenry

>> And if you think about the architecture of applications, and de-perimeterization in general, that cloud layer, right? Let's say that I have a new application, I want to start using AIML, as an example. Well, one of the big benefits of these cloud providers is they have all of these higher level application services. I can't afford to send traffic out of the cloud and bring it back in, not only from a performance perspective, but literally from a cost perspective, because they're going to charge you egress fees, and data transfer in the cloud costs money. So we have to have a security layer physically in the cloud that allows us to have that level of security, have that level of inspection, yet consume the applications that live in that exact same cloud region, or that exact same cloud provider. And that's really where we live. I like to say that we serve service to service traffic. We do zero trust in security for services talking to other services, and SASSY tends to focus on the users talking to services, and both are incredibly important layers of a security architecture.

>> So you sit next to that?

Chris McHenry

>> Yeah, we sit next to it. Many, many, many of our customers use SASSY as the layer to protect their users and their user traffic, and use something like Aviatrix to protect their applications that live in the cloud.

>> So you really extend the value proposition, is that right?

Chris McHenry

>> Yeah, absolutely. They're very, very complimentary.

Chris McHenry

>> You're not shortening the point to point necessarily, or is there a play there as well?

Chris McHenry

>> I think there's absolutely a play there, right? Again, it's about the efficiency. If I can keep that traffic in the same region of the same cloud and still apply security to it, we get better performance, we get lower cost from a data transfer perspective. So yeah, super-complimentary. One other nuance here too is in the context of zero trust, the identity for applications is fundamentally different. If I think about being able to apply zero trust policy, one of the critical hinges there is identity. Has to be dynamic. And apps in the cloud are super, super dynamic. So we've built our distributed cloud firewall product to be identity aware, but not necessarily users' apps, so that the application teams can destroy and re-spin up applications, yet the policy is going to follow them. That zero trust policy is really optimized for the cloud environment.

Chris McHenry

>> And that's irrespective of where that app lives, it doesn't matter which cloud?

Chris McHenry

>> Irrespective of location. Exactly.

Doug Merritt

>> Going back to so many of our customers will have different components of an application spread across clouds, but then things happen, and you wind up relocating something for whatever reason, and it doesn't matter. None of that matters to us. We are that abstraction layer that gives you a singular set of interfaces and control, ubiquitous control, anywhere within a multi-region footprint, within a cloud, or even a very complex multi-VPC or VNet framework within a cloud. But then certainly between clouds. Now, all the way out to Equinix and the edge, or edge connectivity at your own data center that we can deploy into.

>> What would be an example of that? I can imagine they've got... I think at Walmart, they got stuff on-prem, they got stuff in Azure Cloud, they obviously don't do AWS, but I can imagine a customer in AWS running some applications, but wants to run some analytics, or maybe now with GenAI and Google. Is that a reasonable use case? How would you approach that?

Chris McHenry

>> Super common use case, although I would say, I don't know that Walmart is in AWS, but yes.

Doug Merritt

>> He said that.

>> No, they're not.

Chris McHenry

>> But they're in Google and Azure, and they have their own data center.

>> Triplet model, they're on-prem with OpenStack or something, and then they go to Azure, they go to Google.

Chris McHenry

>> Exactly. And some of those applications are Kubernetes-based. Some of those applications are PaaS services. And that actually is surprisingly common from an architectural perspective. We want to, again, in the context of embrace the chaos, we want to actually empower organizations to leverage the best services from whatever cloud is providing those things, right? And it could be different layers of the application stack, could be different teams in the organizations that have preferences for those different pieces, but the InfoSec team and the networking team needs a consistency layer so that they can actually enable and empower choice. And I think that's really one of the big things that we provide for. And we have a lot of customers who have those kinds of models. We call them anchor applications or gravity workloads, and every cloud provider is looking for gravity workloads so that they can pull through other applications. But if you have that agnostic layer that allows you to provide security independent of where it lives, then you can use the best from each of the independent clouds.

>> And are you trickling into mission-critical workloads?

Chris McHenry

>> Absolutely.

>> Okay.

Chris McHenry

>> Yeah.

>> And are you seeing more Oracle in those spaces?

Chris McHenry

>> Yes, huge, huge driver for Oracle Cloud.

Doug Merritt

>> They're the granddaddy of mission-critical workloads. Nobody beats Oracle when it comes to recovery from database problems or applications.

Doug Merritt

>> It's been really impressive the past three years that they stuck with it. And this latest iteration of Oracle Cloud is really interesting, and they're back in the game. And we're seeing more and more of our customers begin to be thoughtful about, hey, if I've got my Oracle financial applications or manufacturing apps, or I've got my Oracle databases, do I need to lift and shift those somewhere, or should I be transitioning to Oracle native in the cloud? Which just increases that complexity. But I go back to, I think the only customers that don't fit what we were talking about would be a less than five-year-old company that is completely modern in their applications and was smart enough to say, I'm just going to be in one cloud and I'm not going to grow big enough to get, I'm never going to an M&A, so there are some of those, maybe. And then maybe some pretty antiquated companies are like, I never left the mainframe. I've got my walled garden and I never experimented. Everyone else, which I think is millions of customers, fit right in that middle of-

Chris McHenry

>> That's your TAM, is that fat middle.

Doug Merritt

>> Exactly.

>> That's the whole market. What about, let's talk about AI. Well, 20 minutes in, we haven't talked about AI. So what's your AI play?

Doug Merritt

>> We're so counter cultural, right?

Chris McHenry

>> I know we've talked about it before, but how does it play in your world?

Doug Merritt

>> I think there are two major threads that we care about. One is intent-based networking. It's still, to really do this properly, there's a lot of complexity. And how do we help teams, dev teams as well as networking teams, declare what they want. I'm trying to create an app with these characteristics. It's got to hit these different areas, including these databases, what should that network topology look like, is one of the angles that we're trying to drive down. And the second is autonomous AI. That first piece is how do I help the network engineer and the development teams do their work more effectively? I think what we will see in the next 18 to 36 months is things are happening so quickly, especially with the threat landscape, that humans will be in the loop to watch and make sure that things are happening properly. But we've got to have agents talking to agents to react at the speed that I believe we're going to need over the next 18 to 24 months.

Chris McHenry

>> So AI for networking and SecOps, apps talking to apps, not necessarily humans, maybe humans in the loop if need be. So is that roadmap stuff, or where does that fit?

Chris McHenry

>> It's stuff that we're executing against right now. I see stuff over the course of the next six months, really, how do we accelerate? I think there's opportunity in accelerating zero trust as well. So there's a few areas that we're making investments in. But yeah, absolutely, starting to integrate the product with AI in a lot of different places to help improve usability, accelerate better security posture, all of those kinds of things.

Doug Merritt

>> And we are lucky enough because we took the time to build this cloud-native router that operates across these different clouds, which again means we get packet-level information. We're lucky enough to get data that nobody else can get. When you look at the services from the cloud vendors, they're good, but they're trying to keep the end user at the right layer of depth. If you get too deep, and it's a service, then things can go sideways, and they don't want downtime and non-resiliency. We can provide a much deeper layer of insight to traffic across these clouds than you can even get from the CSPs themselves. Chris and team just released our network API. One of our values early on was, hey, we're going to gather all that data and try and drive everyone to our pane of glass. A big shift that Chris and team had the past nine months is, yeah, we'd love you to use our pane of glass called Copilot, but why don't we spread that data out? It's a heterogeneous world, and so let's make sure that app observability vendors, let's say we announced that with the network API, we announced integration with New Relic, but we're working with Datadog and Dynatrace and the rest of the crew, so that they can get those network insights that plague the app teams that just can't see whose fault is it? How do we actually correct this? But whether it's other network observability vendors, happy to pass those packets. Open API, pass those packets. The network layer, anyone that's trying to gather that data, our job is to really help them with that insight. But that is a long story to say we've got some really cool data. When you're thinking about AI and we're trying to do with AI, we're privileged to have some really interesting insights that are almost impossible to come by unless you're Aviatrix.

Chris McHenry

>> And another good example of that is in addition to the network insights API, we announced several months, about a month and a half ago that we are an early partner with Microsoft on security, or Copilot for security. So you'll see their development work of that over the next six months, but yeah, it's not just the observability for network performance monitoring, it's also how do we integrate with observability in the security stack as well. So that, again, when I think about those different stakeholders, I want the security team to operate better when Aviatrix is in place. I want the app teams to be happier when Aviatrix is in place. I want the networking teams to be obviously the happiest when Aviatrix is in place. But it's about taking the unique place that we are in the data plane and serving each of those different contingencies.

Chris McHenry

>> I was going to ask you guys about your ecosystem, ecosystem strategy, where you're getting traction. I'm hearing the observability guys, and then Microsoft. Maybe you could summarize your partner strategy?

Doug Merritt

>> Yeah, there are three really strong contingencies. The cloud service providers themselves, Microsoft, AWS, GCP, et cetera. We only live because they're there. There's been different thoughts across Aviatrix on are they competitive or not? And so there's always going a coop-etition.

Doug Merritt

>> It's a gift that they've given the world, so now let's take advantage of it.

Doug Merritt

>> Absolutely. They're a really, really important partner, and we're really trying to ramp up those partnerships. As Chris was talking about, getting involved in that Copilot initiative was really important to us. But our engineering teams and their engineering teams and product managers are meeting to make sure that we're cooperating. Second is the ISV framework that we talked about. How do we integrate with New Relics and Datadogs and other network providers? And we're obviously very, very deep in Terraform and what Hashi provides, so the technology landscape is really important to us. And then the third is the classic VAR and systems integrator world of there's a shortage of really effective networking skills out there. Everyone's fighting for them. And so making sure that we've got deep partnerships there so that everything from network design and topology all the way through to helping run networks and select the right vendors, we're involved with.

Doug Merritt

>> We covered the Hashi-IBM announcement. We spent some time at theCUBE, our analysts rode it up. IBM really doesn't, they're really not a networking company per se. I don't know if that's a possible partnership, but you guys definitely should be talking to them, of course-

Doug Merritt

>> Yeah, we have.

>> ... with the Hashi relationship, I feel like IBM's got sort of a new momentum and a new focus, new culture. So there's another one. Not really so much of a cloud play like Oracle might be, but boy, they're everywhere.

Chris McHenry

>> Well, it's similar though, in the fact that a lot of those gravity workloads may be running on AIX or mainframes, right?

>> Yeah, that's true.

Chris McHenry

>> I think conceptually we're going to see a lot of specialty clouds. Some of that's going to be AI-driven, some of that's going to be legacy workload-driven, but the end state is going to be more diversity for organizations, which means that standardization layer is so much more important.

Doug Merritt

>> And the whole sovereign cloud thing.

Chris McHenry

>> Exactly.

>> You're seeing a lot of that now. Everybody wants to have their data in their country, and that's a trend that's not going to just turn around overnight, right?

Doug Merritt

>> Embrace the chaos. Embrace the chaos.

Doug Merritt

>> RSA is kind of new for you guys. What's your take on the show? What are you doing here?

Doug Merritt

>> First time at RSA, because our core buyer is that network engineering and network ops team, but there's so much security benefit to what we do. We got some good flow at the booth, but we're really here, I believe, my intent was to learn is what is the right messaging for cyber teams and CSOs? How do we help bridge that gap between the really, really hard job that the security teams have with that equally really hard job that network engineering and network ops teams have, so we can make them better allies and much more well-aligned, and I'm excited to be here. Obviously with my Splunk past, this was one of the most important shows the entire year, and it'd be nice to make... I think we can make that happen over time here with Aviatrix.

Chris McHenry

>> Good deal.

Chris McHenry

>> And fundamentally, we see that networking and network security are converging, and that's a trend that's been happening over the last 13, 14 years. Software-defined networking, we talked at the beginning, was one of the big drivers behind that. We announced our distributed cloud firewall product last year right before RSA, and so we've been starting to make a splash, and we've got a lot of customers who are using it to help improve and accelerate their zero trust programs. And so I see that trend continuing, and the network will become... Security has always been a complexity driver in networking. It gets complex when you need to put a firewall in there, or you need to do encryption, or it's one of those complexity drivers. And so a lot of what we do is oftentimes driven by security and compliance requirements, whether it's a networking-specific use case or whether it's a firewalling use case.

Doug Merritt

>> And there's a lot of talk now about the securing the AI. People are really concerned about that. There are a lot of startups really focused on that, from the silicon confidential computing all the way up through the apps. So that's just more chaos.

Doug Merritt

>> Yes, more chaos.

>> Guys, thanks so much for coming to theCUBE. It's always such a pleasure having you. Thank you.

Doug Merritt

>> Always love being here. Thank you for having us on.

Chris McHenry

>> Likewise.

>> It's chaos here. Just bring on the content, we bring it back to you. We'll be right back, right after this short break. You're watching theCUBE from RSA 2024.

Doug Merritt & Chris McHenry | Aviatrix

search

>> Welcome back to the RSA Conference. We're here at Broadcast Alley in Moscone West. Doug Merritt's here, CEO of Aviatrix, and he's joined by Chris McHenry, who's the Vice President of Product Management. Guys, welcome. We're going to talk about the cloud networking joining with SecOps.

Doug Merritt

>> Love it.

>> Welcome.

Doug Merritt

>> That's a topic that we have a little bit of info on.

>> Why now, Doug? Why now?

Doug Merritt

>> When you go back and look at networking over the past 50 years, I think if you'd sat down and really thought as a network architect, how should we design these networks? The core security constructs, things like firewalling and adding, would've been included in that, in everything that networking did. The way that networking evolved, you had to have a bunch of boxes out there that were purpose-built for their use cases. And so you had this security orientation as a separate set of boxes that were conceptually in the network topology, but weren't natively integrated in. That SDN movement was supposed to cure all that, kind of had its boom and faded. And I think now with cloud, and cloud being as pervasive as it is, you've got a fully virtualized L1 H L2 layer, right? All that core infrastructure that's so important is available. A company like Aviatrix can come in with a complete network, a full network capability as one solution out there that natively includes network security and security constructs. It's not a whole separate thought process. Are you routing? Are you trying to load balance and app optimize? Are you trying to encrypt? Are you trying to invoke security? That should all just be part of the same dialogue. And I think as cloud continues to progress and we get more heterogeneous with cloud, now you're seeing purpose-built LLM clouds spring up, so we've always had the three big cloud vendors, but Oracle knows its way into that dialogue, as well as a bunch of regional clouds. And I think we're just going to see more heterogeneity and more preponderance of these clouds. And the question I think keeps coming up of the constructs. We're not that effective and efficient as a bolt-on. What are we going to do to make it native and integrated with networking, as it should be full time.

>> Why do you think SDN petered out? It looked like VMware had an angle there for a while, and then it just sort of fell off the map. Why is that, just it wasn't functional enough?

Doug Merritt

>> I think it was a tough play. The way these boxes evolved, you had 9, 10, 15 boxes as part of every rack from different vendors. And you had a bunch of people at that data center that had bet their careers on their F5 boxes, or Palo boxes, or Checkpoint boxes, or Cisco boxes, or Juniper boxes. And there's a beautiful value prop of wait, wait, wait. hey, we've progressed on the hardware front. Why don't we have a software layer and a more general purpose hardware layer? But human dimension, human psychology is tough. You've got to go back in that data center and try and convince six different buyers, here's a better way of doing it. I think it was right technologically and philosophically, but just hard to execute is my view. Always easy to have the rearview mirror. The interesting thing is to the cloud, why wasn't it done natively that way from the beginning? Because here, you didn't have to rip and replace a bunch of other vendors. And for whatever reason, the cloud vendors emulated that old model, so they've got all these awesome networking services, but you've got your firewalling service, you've got your routing service, you've got load balancing service, you got NAT service. It's like, wait a second, you didn't have to do that. And I'm grateful that Aviatrix took a different approach.

>> So too much entrenched Cisco and others, but Chris, explain why this approach is better, and how you guys attack it.

Chris McHenry

>> Yeah. Well, first off, I think the need is greater to some extent. Even if we go back and look at one of the big drivers for SDN, even day zero, when we look at NYSERA and NSX and a lot of the things that VMware was doing there, firewalling and security was always one of the big needs. The difference being we had a perimeter, we had something at the edge that was a traditional firewall that was protecting us from the real danger zone, which is the internet. And one of the things that changes when you go to the cloud is that the internet is now everywhere. So to some extent, the need is actually greater as well. And I think that when we look at how we approach this slightly differently, actually, we're thinking about different kinds of network security. Still looking at things like the zero trust paradigms, micro segmentation, those kinds of tools and controls that organizations need in order to improve their security posture. But we also want to be very intentional about how do we converge perimeter security into that foundational security layer for the cloud, because the internet is so much more ever present when applications are being deployed in the cloud? It's a slightly different set of tools and capabilities. And then the last thing I'll say is we're not talking about green fields. We're talking about going into application environments that are already pretty messy. And so the ability to integrate and automate and understand that landscape up front, and really make it easy for organizations to insert security retroactively into a brown field environment, a huge, huge, huge differentiator for us. That awareness of the cloud really helps organizations achieve their objectives much more quickly.

>> So Doug, you explained the entrenchment and the problem that customers had to go through to merge security and networking. What does a customer have to go through? What are the prerequisites to adopt your solution?

Doug Merritt

>> There's a blog to be pushed out like a week ago, Embrace the Chaos, just building on Chris's constructs.

>> Let the chaos reign, and then rein it in.

Doug Merritt

>> I don't know how to not. Chaos is, it is, and I think it's just going to continue. Again, the heterogeneity within those cloud environments and the heterogeneity across the workload environment, I think, is going to continue. And with heterogeneity, you've got different constructs, which means you need something that's been purpose built to be easily deployed and integratable across those. So one of the many advantages that's exciting about Aviatrix is we've always taken an infrastructure as code approach, and an integratable and heterogeneous approach. So you can really start in that brown field environment on any of 10, 20, 50 different use cases.

Chris McHenry

>> And it's so much more important in the cloud to make sure that security has a good relationship with the application development team, because that was one of the drivers, that partnership, that I think security tended to have a bigger share of the power balance on premises to the detriment of speed, oftentimes. And cloud, one of the primary value propositions is speed, so you have to rethink how security integrates with the tooling that the app developers are using. We want to be able to provide security that both the InfoSec teams, the SecOp teams, and the app teams love. And so that infrastructure as code approach, the deep integration with the cloud, doing things like identity based zero trust, where the developers don't have to request changes to their firewall policies, that whole mindset of serving both the app developers and the security teams really is a critically important part of it.

Doug Merritt

>> So who are your peeps? Is it the SecOps team? Is it the networking team? Is it the DevOps team? All three?

Doug Merritt

>> All three, but the core that we serve is the networking team. The base value comes with the fact that we are a legitimate data plane that is able to live in a multitude of different clouds. So we touch packets, we filter packets, and the people that control that deployment have networking credentials somewhere in their title. But then the value, once you get that in, massive value to the SecOps team, massive value to the DevOps team, turns out massive value to the FinOps team. There's a whole different cost exposure that we create that can pretty dramatically reduce your cloud bills, because the way that we process packets across the cloud, that avoids a lot of egress and data processing fees. So whether it's AppDev, DevOps, ITOps, SecOps, as soon as you get our technology in, they all get massive value. But the core is really that networking team.

Chris McHenry

>> Which by the way shouldn't be surprising. If I look at the fundamental thing that we did, I would say we took a lot of the concepts that you had on premises, and instead of lifting and shifting them to the cloud, we refactored and we re-architected them for the cloud. And if you go to any of the cloud providers' best practices, you'll see benefits are better performance, lower total cost of ownership, all of the things that come with-

Doug Merritt

>> Agility.

Chris McHenry

>> Agility, all the things that come with refactoring. And pretty much everybody else just lifted and shifted their software.

Chris McHenry

>> Which doesn't get you those benefits.

Chris McHenry

>> Exactly.

>> We were talking earlier about SASSY, and how you guys fit, and some of the drawbacks, actually. SASSY's got a lot of momentum in the marketplace. Let's relive that conversation a little bit. What are you hearing from customers? There's some goodness there, but there's some drawbacks. Explain that.

Doug Merritt

>> I'll start, and I'll let Chris clean up with all the intelligent comments, but I like the embrace the chaos. It's an and, not an or. SASSY is awesome, and the SASSY vendors serve a really important purpose. It's very different than what we do. They provided a framework that creates zero trust and a whole host of security benefits. When you're looking at the, even going back to Chris talking about perimeterless. When you're talking about the individual that could be anywhere, not inside the confines of a gated community, a campus, in anything that's controlled by that organization, the question is what happens as soon as that packet leaves that safe walled community? And that's where we come in.

Chris McHenry

>> And if you think about the architecture of applications, and de-perimeterization in general, that cloud layer, right? Let's say that I have a new application, I want to start using AIML, as an example. Well, one of the big benefits of these cloud providers is they have all of these higher level application services. I can't afford to send traffic out of the cloud and bring it back in, not only from a performance perspective, but literally from a cost perspective, because they're going to charge you egress fees, and data transfer in the cloud costs money. So we have to have a security layer physically in the cloud that allows us to have that level of security, have that level of inspection, yet consume the applications that live in that exact same cloud region, or that exact same cloud provider. And that's really where we live. I like to say that we serve service to service traffic. We do zero trust in security for services talking to other services, and SASSY tends to focus on the users talking to services, and both are incredibly important layers of a security architecture.

>> So you sit next to that?

Chris McHenry

>> Yeah, we sit next to it. Many, many, many of our customers use SASSY as the layer to protect their users and their user traffic, and use something like Aviatrix to protect their applications that live in the cloud.

>> So you really extend the value proposition, is that right?

Chris McHenry

>> Yeah, absolutely. They're very, very complimentary.

Chris McHenry

>> You're not shortening the point to point necessarily, or is there a play there as well?

Chris McHenry

>> I think there's absolutely a play there, right? Again, it's about the efficiency. If I can keep that traffic in the same region of the same cloud and still apply security to it, we get better performance, we get lower cost from a data transfer perspective. So yeah, super-complimentary. One other nuance here too is in the context of zero trust, the identity for applications is fundamentally different. If I think about being able to apply zero trust policy, one of the critical hinges there is identity. Has to be dynamic. And apps in the cloud are super, super dynamic. So we've built our distributed cloud firewall product to be identity aware, but not necessarily users' apps, so that the application teams can destroy and re-spin up applications, yet the policy is going to follow them. That zero trust policy is really optimized for the cloud environment.

Chris McHenry

>> And that's irrespective of where that app lives, it doesn't matter which cloud?

Chris McHenry

>> Irrespective of location. Exactly.

Doug Merritt

>> Going back to so many of our customers will have different components of an application spread across clouds, but then things happen, and you wind up relocating something for whatever reason, and it doesn't matter. None of that matters to us. We are that abstraction layer that gives you a singular set of interfaces and control, ubiquitous control, anywhere within a multi-region footprint, within a cloud, or even a very complex multi-VPC or VNet framework within a cloud. But then certainly between clouds. Now, all the way out to Equinix and the edge, or edge connectivity at your own data center that we can deploy into.

>> What would be an example of that? I can imagine they've got... I think at Walmart, they got stuff on-prem, they got stuff in Azure Cloud, they obviously don't do AWS, but I can imagine a customer in AWS running some applications, but wants to run some analytics, or maybe now with GenAI and Google. Is that a reasonable use case? How would you approach that?

Chris McHenry

>> Super common use case, although I would say, I don't know that Walmart is in AWS, but yes.

Doug Merritt

>> He said that.

>> No, they're not.

Chris McHenry

>> But they're in Google and Azure, and they have their own data center.

>> Triplet model, they're on-prem with OpenStack or something, and then they go to Azure, they go to Google.

Chris McHenry

>> Exactly. And some of those applications are Kubernetes-based. Some of those applications are PaaS services. And that actually is surprisingly common from an architectural perspective. We want to, again, in the context of embrace the chaos, we want to actually empower organizations to leverage the best services from whatever cloud is providing those things, right? And it could be different layers of the application stack, could be different teams in the organizations that have preferences for those different pieces, but the InfoSec team and the networking team needs a consistency layer so that they can actually enable and empower choice. And I think that's really one of the big things that we provide for. And we have a lot of customers who have those kinds of models. We call them anchor applications or gravity workloads, and every cloud provider is looking for gravity workloads so that they can pull through other applications. But if you have that agnostic layer that allows you to provide security independent of where it lives, then you can use the best from each of the independent clouds.

>> And are you trickling into mission-critical workloads?

Chris McHenry

>> Absolutely.

>> Okay.

Chris McHenry

>> Yeah.

>> And are you seeing more Oracle in those spaces?

Chris McHenry

>> Yes, huge, huge driver for Oracle Cloud.

Doug Merritt

>> They're the granddaddy of mission-critical workloads. Nobody beats Oracle when it comes to recovery from database problems or applications.

Doug Merritt

>> It's been really impressive the past three years that they stuck with it. And this latest iteration of Oracle Cloud is really interesting, and they're back in the game. And we're seeing more and more of our customers begin to be thoughtful about, hey, if I've got my Oracle financial applications or manufacturing apps, or I've got my Oracle databases, do I need to lift and shift those somewhere, or should I be transitioning to Oracle native in the cloud? Which just increases that complexity. But I go back to, I think the only customers that don't fit what we were talking about would be a less than five-year-old company that is completely modern in their applications and was smart enough to say, I'm just going to be in one cloud and I'm not going to grow big enough to get, I'm never going to an M&A, so there are some of those, maybe. And then maybe some pretty antiquated companies are like, I never left the mainframe. I've got my walled garden and I never experimented. Everyone else, which I think is millions of customers, fit right in that middle of-

Chris McHenry

>> That's your TAM, is that fat middle.

Doug Merritt

>> Exactly.

>> That's the whole market. What about, let's talk about AI. Well, 20 minutes in, we haven't talked about AI. So what's your AI play?

Doug Merritt

>> We're so counter cultural, right?

Chris McHenry

>> I know we've talked about it before, but how does it play in your world?

Doug Merritt

>> I think there are two major threads that we care about. One is intent-based networking. It's still, to really do this properly, there's a lot of complexity. And how do we help teams, dev teams as well as networking teams, declare what they want. I'm trying to create an app with these characteristics. It's got to hit these different areas, including these databases, what should that network topology look like, is one of the angles that we're trying to drive down. And the second is autonomous AI. That first piece is how do I help the network engineer and the development teams do their work more effectively? I think what we will see in the next 18 to 36 months is things are happening so quickly, especially with the threat landscape, that humans will be in the loop to watch and make sure that things are happening properly. But we've got to have agents talking to agents to react at the speed that I believe we're going to need over the next 18 to 24 months.

Chris McHenry

>> So AI for networking and SecOps, apps talking to apps, not necessarily humans, maybe humans in the loop if need be. So is that roadmap stuff, or where does that fit?

Chris McHenry

>> It's stuff that we're executing against right now. I see stuff over the course of the next six months, really, how do we accelerate? I think there's opportunity in accelerating zero trust as well. So there's a few areas that we're making investments in. But yeah, absolutely, starting to integrate the product with AI in a lot of different places to help improve usability, accelerate better security posture, all of those kinds of things.

Doug Merritt

>> And we are lucky enough because we took the time to build this cloud-native router that operates across these different clouds, which again means we get packet-level information. We're lucky enough to get data that nobody else can get. When you look at the services from the cloud vendors, they're good, but they're trying to keep the end user at the right layer of depth. If you get too deep, and it's a service, then things can go sideways, and they don't want downtime and non-resiliency. We can provide a much deeper layer of insight to traffic across these clouds than you can even get from the CSPs themselves. Chris and team just released our network API. One of our values early on was, hey, we're going to gather all that data and try and drive everyone to our pane of glass. A big shift that Chris and team had the past nine months is, yeah, we'd love you to use our pane of glass called Copilot, but why don't we spread that data out? It's a heterogeneous world, and so let's make sure that app observability vendors, let's say we announced that with the network API, we announced integration with New Relic, but we're working with Datadog and Dynatrace and the rest of the crew, so that they can get those network insights that plague the app teams that just can't see whose fault is it? How do we actually correct this? But whether it's other network observability vendors, happy to pass those packets. Open API, pass those packets. The network layer, anyone that's trying to gather that data, our job is to really help them with that insight. But that is a long story to say we've got some really cool data. When you're thinking about AI and we're trying to do with AI, we're privileged to have some really interesting insights that are almost impossible to come by unless you're Aviatrix.

Chris McHenry

>> And another good example of that is in addition to the network insights API, we announced several months, about a month and a half ago that we are an early partner with Microsoft on security, or Copilot for security. So you'll see their development work of that over the next six months, but yeah, it's not just the observability for network performance monitoring, it's also how do we integrate with observability in the security stack as well. So that, again, when I think about those different stakeholders, I want the security team to operate better when Aviatrix is in place. I want the app teams to be happier when Aviatrix is in place. I want the networking teams to be obviously the happiest when Aviatrix is in place. But it's about taking the unique place that we are in the data plane and serving each of those different contingencies.

Chris McHenry

>> I was going to ask you guys about your ecosystem, ecosystem strategy, where you're getting traction. I'm hearing the observability guys, and then Microsoft. Maybe you could summarize your partner strategy?

Doug Merritt

>> Yeah, there are three really strong contingencies. The cloud service providers themselves, Microsoft, AWS, GCP, et cetera. We only live because they're there. There's been different thoughts across Aviatrix on are they competitive or not? And so there's always going a coop-etition.

Doug Merritt

>> It's a gift that they've given the world, so now let's take advantage of it.

Doug Merritt

>> Absolutely. They're a really, really important partner, and we're really trying to ramp up those partnerships. As Chris was talking about, getting involved in that Copilot initiative was really important to us. But our engineering teams and their engineering teams and product managers are meeting to make sure that we're cooperating. Second is the ISV framework that we talked about. How do we integrate with New Relics and Datadogs and other network providers? And we're obviously very, very deep in Terraform and what Hashi provides, so the technology landscape is really important to us. And then the third is the classic VAR and systems integrator world of there's a shortage of really effective networking skills out there. Everyone's fighting for them. And so making sure that we've got deep partnerships there so that everything from network design and topology all the way through to helping run networks and select the right vendors, we're involved with.

Doug Merritt

>> We covered the Hashi-IBM announcement. We spent some time at theCUBE, our analysts rode it up. IBM really doesn't, they're really not a networking company per se. I don't know if that's a possible partnership, but you guys definitely should be talking to them, of course-

Doug Merritt

>> Yeah, we have.

>> ... with the Hashi relationship, I feel like IBM's got sort of a new momentum and a new focus, new culture. So there's another one. Not really so much of a cloud play like Oracle might be, but boy, they're everywhere.

Chris McHenry

>> Well, it's similar though, in the fact that a lot of those gravity workloads may be running on AIX or mainframes, right?

>> Yeah, that's true.

Chris McHenry

>> I think conceptually we're going to see a lot of specialty clouds. Some of that's going to be AI-driven, some of that's going to be legacy workload-driven, but the end state is going to be more diversity for organizations, which means that standardization layer is so much more important.

Doug Merritt

>> And the whole sovereign cloud thing.

Chris McHenry

>> Exactly.

>> You're seeing a lot of that now. Everybody wants to have their data in their country, and that's a trend that's not going to just turn around overnight, right?

Doug Merritt

>> Embrace the chaos. Embrace the chaos.

Doug Merritt

>> RSA is kind of new for you guys. What's your take on the show? What are you doing here?

Doug Merritt

>> First time at RSA, because our core buyer is that network engineering and network ops team, but there's so much security benefit to what we do. We got some good flow at the booth, but we're really here, I believe, my intent was to learn is what is the right messaging for cyber teams and CSOs? How do we help bridge that gap between the really, really hard job that the security teams have with that equally really hard job that network engineering and network ops teams have, so we can make them better allies and much more well-aligned, and I'm excited to be here. Obviously with my Splunk past, this was one of the most important shows the entire year, and it'd be nice to make... I think we can make that happen over time here with Aviatrix.

Chris McHenry

>> Good deal.

Chris McHenry

>> And fundamentally, we see that networking and network security are converging, and that's a trend that's been happening over the last 13, 14 years. Software-defined networking, we talked at the beginning, was one of the big drivers behind that. We announced our distributed cloud firewall product last year right before RSA, and so we've been starting to make a splash, and we've got a lot of customers who are using it to help improve and accelerate their zero trust programs. And so I see that trend continuing, and the network will become... Security has always been a complexity driver in networking. It gets complex when you need to put a firewall in there, or you need to do encryption, or it's one of those complexity drivers. And so a lot of what we do is oftentimes driven by security and compliance requirements, whether it's a networking-specific use case or whether it's a firewalling use case.

Doug Merritt

>> And there's a lot of talk now about the securing the AI. People are really concerned about that. There are a lot of startups really focused on that, from the silicon confidential computing all the way up through the apps. So that's just more chaos.

Doug Merritt

>> Yes, more chaos.

>> Guys, thanks so much for coming to theCUBE. It's always such a pleasure having you. Thank you.

Doug Merritt

>> Always love being here. Thank you for having us on.

Chris McHenry

>> Likewise.

>> It's chaos here. Just bring on the content, we bring it back to you. We'll be right back, right after this short break. You're watching theCUBE from RSA 2024.