RSA Conference 2024 | AnalystANGLE, Day 2

Clips
News
More from RSA Conference 2024

David Linthicum

Principal Analyst

theCUBE Research

Shelly Kramer

Tech Analyst

theCUBE Research

Three insights you might have missed from theCUBE’s coverage of the RSA Conference

In the 12 months since security practitioners gathered in San Francisco for the 2023 annual RSA Conference, the view of artificial intelligence has expanded. Where AI was once either bad for business or good for improving protection, it has now become a whole new challenge that will require a novel approach.This was one of the key themes to emerge from four days of coverage as theCUBE, SiliconANGLE Media’s livestreaming studio, interviewed industry executives, government officials and analysts to hear the most recent insights into the future direction of cybersecurity

AI meets security: Strategic insights from theCUBE at RSAC Day 2

This week’s RSA Conference has featured a flurry of discussions that underscore a central theme: the intersection of artificial intelligence and security.TheCUBE is on site to analyze day 2 events, as attendees seek to grasp the implications of AI for their security strategies.“We have to deal with the prompt security and all these sorts of things which people don’t normally have a clue about,” said David Linthicum (pictured, right), principal analyst at theCUBE Research. “We’re normally encrypting, we’re protecting, we’re building firewalls around things when something can be attacked from within. It has to have internal security that’s a different way of thinking

play_circle_outline Embracing a Transformative Learning Year: Navigating AI Advancements, Security and Potential Breaches

play_circle_outline Maximizing the Potential: Achieving Successful AI Implementation through Coordination, Planning, and Informed Decision-Making

play_circle_outline The Conundrum of AI Security: Balancing Innovation Pace with Strategic Announcements and Preemptive Solutions

play_circle_outline Focus on viability, sustainability, and use cases of AI technology

play_circle_outline Concerns about cloud security providers and core technology partners prioritizing AI over current security needs

Info

AnalystANGLE, Day 2

David Linthicum

Principal Analyst theCUBE Research

Shelly Kramer

Tech Analyst theCUBE Research

HOST

search

Shelly Kramer

>> Hello and welcome back to theCUBE's coverage here at the RSA Conference located in beautiful downtown San Francisco. The security conference of the year. I am here today joined by my fellow analyst, David Linthicum and David. Day two, here we go, kicking it off.

David Linthicum

>> Here we go again. So we've got a bunch of keynotes just looking at some real heavy hitters and people are listening to the messaging and trying to figure out what it means to them. And so the vibe here seems to be, "We want to learn." And in other words, there's a bunch of new stuff that's out there and we don't know what to do it yet. And we're trying to get everybody else's opinions on what they're doing to hopefully help us make the right decisions. And also they're linking up with vendors and they're trying to figure out how to read their technology stack and how to do things better. And it seems to be like a learning year almost. In other words, if you went back a year, they go, "No one saw generative AI. Didn't know what it was coming." Now we have the hype ways after year. Now people are in here trying to figure out how to make it work. And then probably next year we're going to hear more case studies in terms of how people implemented generative AI and other AI technologies to create a better security posture and also to secure systems that are now AI enabled because they have to be secured differently. We have to deal with the prompt security, and all these sorts of things which people don't normally have a clue about. We're normally encrypting, we're protecting, we're building firewalls around things when something can be attacked from within and it has to have internal security. That's a different way of thinking, and I think people are looking to transform their thinking.

Shelly Kramer

>> Yeah, I feel like I echo your statements. It feels like we're all here together working on a puzzle.

David Linthicum

>> Yes.

Shelly Kramer

>> You know what I'm saying?

David Linthicum

>> Yeah.

Shelly Kramer

>> And there's an atmosphere of excitement. There's an atmosphere of we're all in this together and we have to figure this out because it's so important. But I think a lot of what I'm seeing too are conversations. And this is I think why it's so nice to... I mean, you and I work virtually all the time. We're experts at it. We did that before a global pandemic forced people to do that. But there's such a benefit of being here and being able to be face-to-face with people and kind of dig into, "What are you working on?" Or, "What are you thinking about?" Or, "What challenges are you having?" And I think people are also very honest about where they are in their journeys, even if it's, "I don't really have a clue, but I know I have to figure it out." And I think there are a lot of those people that...

David Linthicum

>> Yeah. And I think what's changed this year... And I was trying to figure out why such a sense of urgency, and when I talked to the CISOs that are here trying to learn, the fact of the matter is that they built systems at their pace and the ability to secure them. So in other words, they weren't rolling out data centers and applications and application workloads and new applications without a good security plan. And so the security kind of came in first before the applications were built. And we kind of got to that after 20 years of making mistakes. Now the feeling is, and it's probably true that they don't have control of those deadlines anymore. So the generative AI systems are coming up and are going to be up and running within these enterprises, whether you like it or not. Basically, the board has made these decisions. The investors are making these decisions. It's not tactical decisions that are made by the CIO and that being the case, it's taken out of his or her hands and now they're in a panic because it has to be up and running by the end of this year. How are you going to secure it? And whether you get the security running or not, we're going to go ahead and move forward with it. And by the way, if something happens, we're still going to blame you. So it's kind of rock and a hard place.

Shelly Kramer

>> But this is a great job.

David Linthicum

>> Yeah, this is a great job. We talked yesterday, 10 years, 18 months.

Shelly Kramer

>> 18 months, yeah for a CISO.

David Linthicum

>> So my heart goes out to these very well-paid technology executives, having been one a bunch of times in my career, having so much responsibility but not necessarily empowered to make the core decision. So what they're doing here is trying to get to the fast solutions, which is a little concerning to me because normally when we get to fast solutions, we start making mistakes. And so if we think tactically, not strategically, we're not doing something around a plan that's normally when we make mistakes. And I think we're going to see some of that. Maybe not next year, but the year after, we're going to have large breaches that occurred because we missed something that was obvious. But when you get into the triage and, "Why these stuff was breached?" They're going to say, "We were rushed. We had to get it out the door. We were told this is going to be our... Get it out the door, it's going to be our jobs. And so we use whatever tactical security mechanisms that we had in place. Currently, they were the wrong ones for the time. We knew that when we implemented it. And now we have an issue." And I'm not sure if that's the right way to do it. So maybe the message here is that this is really important to the business and this is really going to be a game changer. I call it an innovative differentiator. Many businesses are going to be built around their use of AI, the ability to have supply chain automation, your ability to optimize manufacturing processes, your ability to automate information technology in different ways and how you do it. That being the case, you're reinventing your business. And I understand why you want that technology in place quickly, but this may be a time where we go slower to go faster. And I think that should be kind of the message out there. But the message, and certainly came from the keynote yesterday was "Go, go, go, go, go. Everybody's going AI. Make it happen," which is perfectly fine, but there needs to be some stepwise way and a methodical way in how you do it, different evolutions of technology. I don't think that the technology may not exist from the security space is going to provide ample protection from building these systems. So that's the risk. And I don't know if you feel the same way, but it's a little panic.

Shelly Kramer

>> Well, from somebody who's spent a career as a strategist and who also spent very early part of my career as a paralegal, I think a lot about risk. And I think a lot about responsibility and your story reminds me of... I had a situation where I was working with a team and as we've all experienced senior leaders want this and, "We want it now." And sometimes it's not well-thought-out or anything else. And that was kind of this particular company's approach to AI and, "We're going to do it." And I and a couple of other senior folks that were consulting were saying, "There needs to be a strategy and a policy and guardrails and we need to understand compliance and governance. And we're not saying, 'No. We're just saying we have to do this and build a foundation for doing it right. We can't just go off without any oversight or anything else.'" And that CEO ultimately quit working with a group of people who were urging caution and said, "I'm going to find people who are going to support my initiatives." So you've experienced this.

David Linthicum

>> True.

Shelly Kramer

>> I've experienced this. And so I think that what we're saying is not, "Hurry, hurry, hurry, but make a plan and do it right." And the risk here is so great, and it's not that other transformative things that we've done. Parts of a digital transformation journey, migrating to the cloud, those sorts of things come with a certain amount of risk. But what we're risking right now is access to things like our critical infrastructure and our data, our customer data, our employee data, all that sort of thing. And these are life-changing risks. So I think that it's okay to be the sort of stodgy people that we are to a certain extent and say, "We are huge fans of quick forward progress. Let's make that happen, but let's do it strategically." And I think that's what I'm... Those are the kind of conversations with vendors that I like the most, people who really get that.

David Linthicum

>> Yeah. And not many people do get that. And the thing is, people are incentivized to move fast and sometimes move in a reckless way. And I think we're getting to a point where that's kind of coming back. So it feels like very much like cloud 2010, 2011, where everybody was just making this fast movement into cloud. It wasn't really thinking about the planning around it and now we're paying for it. Now there's repatriation is kind of a huge topic. Anything I write about repatriation, it just hit like crazy. And that's because we're fixing problems that we introduced 10 years ago that probably cost us many billions, probably perhaps trillions. And if you add it up with all the businesses of dollars around the mistakes that are made and we don't have to make them. So these comes into the planning cycle and really kind of thinking this stuff as strategically. And speaking of risk, I mean, we had Antony Blinken speak yesterday and everybody... I sat through that live next door. And one of the things that I think people feel is a risk is that they're not necessarily getting policy telegraph from the government. So they're concerned about policy changing after they've implemented it and invested in certain technology directions. And so this may be a time, and Mayorkas is speaking today, maybe he's going to have something to say about this, but the ability to tell us whether things are going to change or not and what's going to change and what the government's approach to doing a lot of this stuff is. And I understand this international issue and our government, the United States government doesn't apply everywhere, but whatever, Canada, Mexico, all the South American nations, things like that need to think about assuring people that the steady state and policies and how these things are going to be managed is going to be one way or the other. It doesn't mean you have to make a final policy. It can evolve over time. But right now, I think the governments out there really kind of scared to put some lines in the sand and businesses afraid they're going to do that after the implementation occurred. I would've loved to hear yesterday... It's like, "Listen, look, this is what we're going to do. This is what we're not going to do. We're not interested in regulating this. We may have to look at this because of constitutional issues." And he's looking at diplomacy and things like that as ways in which we can do better security, which is negotiating with countries not to attack us.

Shelly Kramer

>> Always works so well.

David Linthicum

>> Yeah, they just, "Oh, thank. Oh, I'm sorry. It was our bad. We didn't mean to," but I think we need to have a closer relationship. All the companies that are here today, and all the business leaders that are here today, and all the CISOs that are here today probably represent many trillions of dollars in business and many millions of people who work for them. So everybody has a stake in this. And I think more coordination between the government and some of the technology leaders. I understand we're having conversations on the hill and things like that, but I'm talking about a deep understanding and a deep coordination where things are generated. In other words, "Here's our policy. Here's what we're going to do. Here's what we're not going to do. And we understand everybody needs to be moved forward as quickly as they can with this technology. And so understanding that you can mitigate some of your risk based on this." Now, obviously it's going to change over time. Laws and regulations change because it's a political thing, but that seems to be a risk that I didn't hear a lot about 10 years ago. That seems to be a larger risk today. And the common question I get, maybe because I live in Washington, D.C., is: what's the government going to do here? What regulations are going to start to emerge? What risk are we going to have that we're going to build a system, make huge game-changing investments and the government's going to make us hit the reset button? Or whatever, state and local governments that are there, whatever country you're working out of. It's all the same risks. They're consistently concerned about that. So do you think we're overly concerned about the risk? Do you think we're not putting enough effort into figuring out... sorry, we're not proactively thinking through this or maybe being a little bit more paranoid than we need to be?

Shelly Kramer

>> I think there's so much there, and I think that we do need to be paranoid. And I find myself thinking about the United States has traditionally lagged behind regulations in the EU, and the whole China thing is a completely different conversation. But I think this is an area where we have to get it together. I mean, we can't sit around and wait to come to the table with solutions that make sense and things that have teeth to a certain extent. And I get so tired of the conversation of, "Regulation squashes innovation and..." Shut up. I mean, you have to have some regulation with something as powerful as artificial intelligence. I mean, that is not going to squash innovation in any way. And so I do think that we look to the government to kind of step up here, and it's hard to be encouraged about that because I feel like so many of the people that are involved in making these decisions... And prove me wrong, please, if you're here, if you're listening, come prove me wrong. But I feel like in so many instances, just based on congressional hearings that I've heard and that sort of thing, I mean, some of the people making these decisions have no knowledge, no experience whatsoever in technology or understanding of how transformative this is. And it's like, and you're making policy decisions. That's frustrating.

David Linthicum

>> It is frustrating. I remember when back when the internet first coming out, when they would give URLs, that was always crass. It's ht... www. So anyway you have some crass but the other thing I'm seeing is the pace of innovation in terms of the security area. I'm seeing a pattern where it's... Of course, lots of great announcements are going to be made this week around very cool companies that are announcing technology that's going to aid in us becoming better at AI stuff. But a lot of the companies seem to be holding back the announcements and holding back some innovation. If you talk to them about that, and I say, "I thought you were going to announce something, this." "Well, we are pushing it off for another six months." And the reason why is because this is so important to them, the ability to get the AI security right that they don't necessarily want to show their cards this early and they may have to invest much more in the innovation of the technology moving forward. So this may be a building RSA, so to speak. We'll look back at this. So everything has a theme that everybody was figuring out, trying to get introduced to what AI was last year. Now this is building the solutions. They're going to take the security solutions to the next level and then next year will be the huge rollouts of technology. Everybody's going to have a different perspective of this, really figure out the pragmatic use, figure out the use cases, which is a big problem right now. We're just using this stuff for too much stuff. Also figuring out the viability and sustainability of it. So that seems to be something that is repeating this time. And I think by the way, the cloud providers, if you look at the sister conferences for this where they're not focused on security, they're just focused on cloud technology, things like that, are doing similar things. In other words, they are announcing certain technologies, but as far as game-changing things, things that are really going to get us to where we need to be around AI, those things I think are still being built. What are your feelings on that?

Shelly Kramer

>> I absolutely agree, and I think that this seems to be a year of thinking about and talking about what AI can do, what the dangers are. And I think that you're absolutely right. I think next year we're going to hopefully see these are solutions that came out of all of the deep dives and all the discussions and all the challenges that we've worked, and also building upon the beta tests that we have and the use cases, and we have some real traction. And this didn't work and this did work. And so I feel like we're too early to have that be the theme of this conference.

David Linthicum

>> Yeah, I think so. And the repeating themes probably need to be crawled down as well. I know everybody's going to leverage AIs within their security solution. That's table stakes now. And so I have three meetings today. I guarantee they want to tell me how AI is part of their security solution now, and we get that. And so we need to think beyond this stuff. So what are we going to be able to do with this stuff as a holistic integration? And we talked a bit about heterogeneity and the complexity of the security solutions out there. Now, what technologies are going to be put in place? They're going to normalize and mitigate the complexity within these solutions. Those are the ones I think need to be made. I haven't heard a lot about those because we're just kind of focused on the AI stuff. In fact, we may see a bit of a larger mistake being made at this show as with the cloud conferences in that there's so much focus and distraction on AI that we're not continuing the innovation and work on the traditional security stuff: next generation encryption, identity access management, those sorts of things. Coming from a CTO space, I was given a limited amount of money to pay my R&D guys to go build things based on me writing stuff on the whiteboard. And if that money is going into just protection and the AI security stuff and integrating AI within the security tool, you're certainly going to get a benefit from that. But the core concern, I'm hearing this from a few CISOs, they don't think they're getting the releases and they're not getting the love from their cloud security providers, on-premise security providers from their core technology partners because they feel they're distracted and working on AI technology. In some instances they may not have AI in their company for the next three years. And so we're getting the-

Shelly Kramer

>> I think that's a valid concern.

David Linthicum

>> Yeah, it is a valid concern.

Shelly Kramer

>> Yeah.

David Linthicum

>> Do you think we should protect against that or do you think it's... I guess, we can't do anything about it, but the thing is if... Do you think that the customers should start making that more apparent? Because right now we're in one of these things about hypes being made. You don't push back against hype. When cloud was coming up, no one could say anything bad about cloud computing because it was the next generation where the technology was going. Now AI's moving the same thing, security along the line with that. And so people feel hindered in making those assertions, but I think those assertions should be made.

Shelly Kramer

>> I do too.

David Linthicum

>> And I would ask... If I was a hard-hitting tech journalist, I would go out to the security providers and talk to them about allocating their resources. They're never going to tell you. But the core question would be: are you taking core innovation that needs to occur with your base-level product, which is protecting your customers now and investing it into the next generation AI stuff, which is going to protect your customers sometimes in a couple of years and sometimes never if they're not using AI? And what are the impacts of doing that? And I think that may be a tougher question for them to answer. And I think that it's funny, I'm going to walk around the show for today and ask them that just to see the reactions that I get. But I think that's a bit concerning from the people who are consuming technology. And it's concerning from the CTOs as well because they're directed by their boards of directors and their CIOs and their executives to move in this particular way. And they're happy to do that because that's where all the cool kids are playing right now. But again, removing resources for something that may be foundational to what their business is. And I think we may see some odd breaches that occur from that when you do a triage on that, that they weren't getting the updates, they weren't getting the improvements to the systems that they needed. And therefore that was a breach that was caused by AI when AI wasn't around it just because we're moving resources from one thing to another.

Shelly Kramer

>> That seems like a big risk. I mean, you still have to look out for your existing customer base as excited as you are chasing AI innovation.

David Linthicum

>> I would think so.

Shelly Kramer

>> I mean, that's what you're saying.

David Linthicum

>> Yeah, I would think so. And I think that we have a tendency to operate in the technology world. I've been in this business a long time, very much like how kids play soccer and there's no strategy to it. The ball's kicked over there and they all run over there, ball's kick over there and they all run over there. And technology's in the same way. And we have a tendency to kind of leave all reason behind if we're moving after a particular hype cycle. And we saw this in... First time we moved to AI in the '80s, which I was involved with, but also client-server and moving to service-oriented architecture and then moving to integration and moving to cloud computing and moving to other kind of innovative differentiators where people are moving in different directions. There's value in doing that. But in doing that, we have to figure out the pragmatic applications of our technology and where this market is specifically going to go and make sure we're not missing the bigger picture. I think a lot of people when they first got in the cloud missed the bigger picture and it ended up hurting them. And as that market normalized, they had to exit the market. I think the same thing's going to occur in the security space. I think the smarter technology players out there, hopefully it's everybody, but it's not, are looking at a holistic market and making sure they're not investing in something that's not going to have a direct benefit to the value and what they're looking to do. And I think customers are going to react. They haven't said anything yet where they're making announcements or talking to reporters, things like that. But I think by the end of the year, there's going to be some pushback on the fact that so much has been invested on the AI side of things and not on the traditional security stuff that they rely on now and will for some time that there's going to be some risk and damage that could occur, will occur. And when it does occur, someone's going to yell about it.

Shelly Kramer

>> You know I very much look forward to having this conversation again later on in the day after you've had a chance to go out and ask those questions to vendors.

David Linthicum

>> I'll grill them for us.

Shelly Kramer

>> Please do that. All right. Well, that does it for our morning kickoff. Coming to you live from the Moscone Center at RSA conference, the technology conference in the security space. I'm here. I'm Shelly Kramer. I'm here with fellow analyst, David Linthicum. Keep it right here on theCUBE.

AnalystANGLE, Day 2

search

Shelly Kramer

>> Hello and welcome back to theCUBE's coverage here at the RSA Conference located in beautiful downtown San Francisco. The security conference of the year. I am here today joined by my fellow analyst, David Linthicum and David. Day two, here we go, kicking it off.

David Linthicum

>> Here we go again. So we've got a bunch of keynotes just looking at some real heavy hitters and people are listening to the messaging and trying to figure out what it means to them. And so the vibe here seems to be, "We want to learn." And in other words, there's a bunch of new stuff that's out there and we don't know what to do it yet. And we're trying to get everybody else's opinions on what they're doing to hopefully help us make the right decisions. And also they're linking up with vendors and they're trying to figure out how to read their technology stack and how to do things better. And it seems to be like a learning year almost. In other words, if you went back a year, they go, "No one saw generative AI. Didn't know what it was coming." Now we have the hype ways after year. Now people are in here trying to figure out how to make it work. And then probably next year we're going to hear more case studies in terms of how people implemented generative AI and other AI technologies to create a better security posture and also to secure systems that are now AI enabled because they have to be secured differently. We have to deal with the prompt security, and all these sorts of things which people don't normally have a clue about. We're normally encrypting, we're protecting, we're building firewalls around things when something can be attacked from within and it has to have internal security. That's a different way of thinking, and I think people are looking to transform their thinking.

Shelly Kramer

>> Yeah, I feel like I echo your statements. It feels like we're all here together working on a puzzle.

David Linthicum

>> Yes.

Shelly Kramer

>> You know what I'm saying?

David Linthicum

>> Yeah.

Shelly Kramer

>> And there's an atmosphere of excitement. There's an atmosphere of we're all in this together and we have to figure this out because it's so important. But I think a lot of what I'm seeing too are conversations. And this is I think why it's so nice to... I mean, you and I work virtually all the time. We're experts at it. We did that before a global pandemic forced people to do that. But there's such a benefit of being here and being able to be face-to-face with people and kind of dig into, "What are you working on?" Or, "What are you thinking about?" Or, "What challenges are you having?" And I think people are also very honest about where they are in their journeys, even if it's, "I don't really have a clue, but I know I have to figure it out." And I think there are a lot of those people that...

David Linthicum

>> Yeah. And I think what's changed this year... And I was trying to figure out why such a sense of urgency, and when I talked to the CISOs that are here trying to learn, the fact of the matter is that they built systems at their pace and the ability to secure them. So in other words, they weren't rolling out data centers and applications and application workloads and new applications without a good security plan. And so the security kind of came in first before the applications were built. And we kind of got to that after 20 years of making mistakes. Now the feeling is, and it's probably true that they don't have control of those deadlines anymore. So the generative AI systems are coming up and are going to be up and running within these enterprises, whether you like it or not. Basically, the board has made these decisions. The investors are making these decisions. It's not tactical decisions that are made by the CIO and that being the case, it's taken out of his or her hands and now they're in a panic because it has to be up and running by the end of this year. How are you going to secure it? And whether you get the security running or not, we're going to go ahead and move forward with it. And by the way, if something happens, we're still going to blame you. So it's kind of rock and a hard place.

Shelly Kramer

>> But this is a great job.

David Linthicum

>> Yeah, this is a great job. We talked yesterday, 10 years, 18 months.

Shelly Kramer

>> 18 months, yeah for a CISO.

David Linthicum

>> So my heart goes out to these very well-paid technology executives, having been one a bunch of times in my career, having so much responsibility but not necessarily empowered to make the core decision. So what they're doing here is trying to get to the fast solutions, which is a little concerning to me because normally when we get to fast solutions, we start making mistakes. And so if we think tactically, not strategically, we're not doing something around a plan that's normally when we make mistakes. And I think we're going to see some of that. Maybe not next year, but the year after, we're going to have large breaches that occurred because we missed something that was obvious. But when you get into the triage and, "Why these stuff was breached?" They're going to say, "We were rushed. We had to get it out the door. We were told this is going to be our... Get it out the door, it's going to be our jobs. And so we use whatever tactical security mechanisms that we had in place. Currently, they were the wrong ones for the time. We knew that when we implemented it. And now we have an issue." And I'm not sure if that's the right way to do it. So maybe the message here is that this is really important to the business and this is really going to be a game changer. I call it an innovative differentiator. Many businesses are going to be built around their use of AI, the ability to have supply chain automation, your ability to optimize manufacturing processes, your ability to automate information technology in different ways and how you do it. That being the case, you're reinventing your business. And I understand why you want that technology in place quickly, but this may be a time where we go slower to go faster. And I think that should be kind of the message out there. But the message, and certainly came from the keynote yesterday was "Go, go, go, go, go. Everybody's going AI. Make it happen," which is perfectly fine, but there needs to be some stepwise way and a methodical way in how you do it, different evolutions of technology. I don't think that the technology may not exist from the security space is going to provide ample protection from building these systems. So that's the risk. And I don't know if you feel the same way, but it's a little panic.

Shelly Kramer

>> Well, from somebody who's spent a career as a strategist and who also spent very early part of my career as a paralegal, I think a lot about risk. And I think a lot about responsibility and your story reminds me of... I had a situation where I was working with a team and as we've all experienced senior leaders want this and, "We want it now." And sometimes it's not well-thought-out or anything else. And that was kind of this particular company's approach to AI and, "We're going to do it." And I and a couple of other senior folks that were consulting were saying, "There needs to be a strategy and a policy and guardrails and we need to understand compliance and governance. And we're not saying, 'No. We're just saying we have to do this and build a foundation for doing it right. We can't just go off without any oversight or anything else.'" And that CEO ultimately quit working with a group of people who were urging caution and said, "I'm going to find people who are going to support my initiatives." So you've experienced this.

David Linthicum

>> True.

Shelly Kramer

>> I've experienced this. And so I think that what we're saying is not, "Hurry, hurry, hurry, but make a plan and do it right." And the risk here is so great, and it's not that other transformative things that we've done. Parts of a digital transformation journey, migrating to the cloud, those sorts of things come with a certain amount of risk. But what we're risking right now is access to things like our critical infrastructure and our data, our customer data, our employee data, all that sort of thing. And these are life-changing risks. So I think that it's okay to be the sort of stodgy people that we are to a certain extent and say, "We are huge fans of quick forward progress. Let's make that happen, but let's do it strategically." And I think that's what I'm... Those are the kind of conversations with vendors that I like the most, people who really get that.

David Linthicum

>> Yeah. And not many people do get that. And the thing is, people are incentivized to move fast and sometimes move in a reckless way. And I think we're getting to a point where that's kind of coming back. So it feels like very much like cloud 2010, 2011, where everybody was just making this fast movement into cloud. It wasn't really thinking about the planning around it and now we're paying for it. Now there's repatriation is kind of a huge topic. Anything I write about repatriation, it just hit like crazy. And that's because we're fixing problems that we introduced 10 years ago that probably cost us many billions, probably perhaps trillions. And if you add it up with all the businesses of dollars around the mistakes that are made and we don't have to make them. So these comes into the planning cycle and really kind of thinking this stuff as strategically. And speaking of risk, I mean, we had Antony Blinken speak yesterday and everybody... I sat through that live next door. And one of the things that I think people feel is a risk is that they're not necessarily getting policy telegraph from the government. So they're concerned about policy changing after they've implemented it and invested in certain technology directions. And so this may be a time, and Mayorkas is speaking today, maybe he's going to have something to say about this, but the ability to tell us whether things are going to change or not and what's going to change and what the government's approach to doing a lot of this stuff is. And I understand this international issue and our government, the United States government doesn't apply everywhere, but whatever, Canada, Mexico, all the South American nations, things like that need to think about assuring people that the steady state and policies and how these things are going to be managed is going to be one way or the other. It doesn't mean you have to make a final policy. It can evolve over time. But right now, I think the governments out there really kind of scared to put some lines in the sand and businesses afraid they're going to do that after the implementation occurred. I would've loved to hear yesterday... It's like, "Listen, look, this is what we're going to do. This is what we're not going to do. We're not interested in regulating this. We may have to look at this because of constitutional issues." And he's looking at diplomacy and things like that as ways in which we can do better security, which is negotiating with countries not to attack us.

Shelly Kramer

>> Always works so well.

David Linthicum

>> Yeah, they just, "Oh, thank. Oh, I'm sorry. It was our bad. We didn't mean to," but I think we need to have a closer relationship. All the companies that are here today, and all the business leaders that are here today, and all the CISOs that are here today probably represent many trillions of dollars in business and many millions of people who work for them. So everybody has a stake in this. And I think more coordination between the government and some of the technology leaders. I understand we're having conversations on the hill and things like that, but I'm talking about a deep understanding and a deep coordination where things are generated. In other words, "Here's our policy. Here's what we're going to do. Here's what we're not going to do. And we understand everybody needs to be moved forward as quickly as they can with this technology. And so understanding that you can mitigate some of your risk based on this." Now, obviously it's going to change over time. Laws and regulations change because it's a political thing, but that seems to be a risk that I didn't hear a lot about 10 years ago. That seems to be a larger risk today. And the common question I get, maybe because I live in Washington, D.C., is: what's the government going to do here? What regulations are going to start to emerge? What risk are we going to have that we're going to build a system, make huge game-changing investments and the government's going to make us hit the reset button? Or whatever, state and local governments that are there, whatever country you're working out of. It's all the same risks. They're consistently concerned about that. So do you think we're overly concerned about the risk? Do you think we're not putting enough effort into figuring out... sorry, we're not proactively thinking through this or maybe being a little bit more paranoid than we need to be?

Shelly Kramer

>> I think there's so much there, and I think that we do need to be paranoid. And I find myself thinking about the United States has traditionally lagged behind regulations in the EU, and the whole China thing is a completely different conversation. But I think this is an area where we have to get it together. I mean, we can't sit around and wait to come to the table with solutions that make sense and things that have teeth to a certain extent. And I get so tired of the conversation of, "Regulation squashes innovation and..." Shut up. I mean, you have to have some regulation with something as powerful as artificial intelligence. I mean, that is not going to squash innovation in any way. And so I do think that we look to the government to kind of step up here, and it's hard to be encouraged about that because I feel like so many of the people that are involved in making these decisions... And prove me wrong, please, if you're here, if you're listening, come prove me wrong. But I feel like in so many instances, just based on congressional hearings that I've heard and that sort of thing, I mean, some of the people making these decisions have no knowledge, no experience whatsoever in technology or understanding of how transformative this is. And it's like, and you're making policy decisions. That's frustrating.

David Linthicum

>> It is frustrating. I remember when back when the internet first coming out, when they would give URLs, that was always crass. It's ht... www. So anyway you have some crass but the other thing I'm seeing is the pace of innovation in terms of the security area. I'm seeing a pattern where it's... Of course, lots of great announcements are going to be made this week around very cool companies that are announcing technology that's going to aid in us becoming better at AI stuff. But a lot of the companies seem to be holding back the announcements and holding back some innovation. If you talk to them about that, and I say, "I thought you were going to announce something, this." "Well, we are pushing it off for another six months." And the reason why is because this is so important to them, the ability to get the AI security right that they don't necessarily want to show their cards this early and they may have to invest much more in the innovation of the technology moving forward. So this may be a building RSA, so to speak. We'll look back at this. So everything has a theme that everybody was figuring out, trying to get introduced to what AI was last year. Now this is building the solutions. They're going to take the security solutions to the next level and then next year will be the huge rollouts of technology. Everybody's going to have a different perspective of this, really figure out the pragmatic use, figure out the use cases, which is a big problem right now. We're just using this stuff for too much stuff. Also figuring out the viability and sustainability of it. So that seems to be something that is repeating this time. And I think by the way, the cloud providers, if you look at the sister conferences for this where they're not focused on security, they're just focused on cloud technology, things like that, are doing similar things. In other words, they are announcing certain technologies, but as far as game-changing things, things that are really going to get us to where we need to be around AI, those things I think are still being built. What are your feelings on that?

Shelly Kramer

>> I absolutely agree, and I think that this seems to be a year of thinking about and talking about what AI can do, what the dangers are. And I think that you're absolutely right. I think next year we're going to hopefully see these are solutions that came out of all of the deep dives and all the discussions and all the challenges that we've worked, and also building upon the beta tests that we have and the use cases, and we have some real traction. And this didn't work and this did work. And so I feel like we're too early to have that be the theme of this conference.

David Linthicum

>> Yeah, I think so. And the repeating themes probably need to be crawled down as well. I know everybody's going to leverage AIs within their security solution. That's table stakes now. And so I have three meetings today. I guarantee they want to tell me how AI is part of their security solution now, and we get that. And so we need to think beyond this stuff. So what are we going to be able to do with this stuff as a holistic integration? And we talked a bit about heterogeneity and the complexity of the security solutions out there. Now, what technologies are going to be put in place? They're going to normalize and mitigate the complexity within these solutions. Those are the ones I think need to be made. I haven't heard a lot about those because we're just kind of focused on the AI stuff. In fact, we may see a bit of a larger mistake being made at this show as with the cloud conferences in that there's so much focus and distraction on AI that we're not continuing the innovation and work on the traditional security stuff: next generation encryption, identity access management, those sorts of things. Coming from a CTO space, I was given a limited amount of money to pay my R&D guys to go build things based on me writing stuff on the whiteboard. And if that money is going into just protection and the AI security stuff and integrating AI within the security tool, you're certainly going to get a benefit from that. But the core concern, I'm hearing this from a few CISOs, they don't think they're getting the releases and they're not getting the love from their cloud security providers, on-premise security providers from their core technology partners because they feel they're distracted and working on AI technology. In some instances they may not have AI in their company for the next three years. And so we're getting the-

Shelly Kramer

>> I think that's a valid concern.

David Linthicum

>> Yeah, it is a valid concern.

Shelly Kramer

>> Yeah.

David Linthicum

>> Do you think we should protect against that or do you think it's... I guess, we can't do anything about it, but the thing is if... Do you think that the customers should start making that more apparent? Because right now we're in one of these things about hypes being made. You don't push back against hype. When cloud was coming up, no one could say anything bad about cloud computing because it was the next generation where the technology was going. Now AI's moving the same thing, security along the line with that. And so people feel hindered in making those assertions, but I think those assertions should be made.

Shelly Kramer

>> I do too.

David Linthicum

>> And I would ask... If I was a hard-hitting tech journalist, I would go out to the security providers and talk to them about allocating their resources. They're never going to tell you. But the core question would be: are you taking core innovation that needs to occur with your base-level product, which is protecting your customers now and investing it into the next generation AI stuff, which is going to protect your customers sometimes in a couple of years and sometimes never if they're not using AI? And what are the impacts of doing that? And I think that may be a tougher question for them to answer. And I think that it's funny, I'm going to walk around the show for today and ask them that just to see the reactions that I get. But I think that's a bit concerning from the people who are consuming technology. And it's concerning from the CTOs as well because they're directed by their boards of directors and their CIOs and their executives to move in this particular way. And they're happy to do that because that's where all the cool kids are playing right now. But again, removing resources for something that may be foundational to what their business is. And I think we may see some odd breaches that occur from that when you do a triage on that, that they weren't getting the updates, they weren't getting the improvements to the systems that they needed. And therefore that was a breach that was caused by AI when AI wasn't around it just because we're moving resources from one thing to another.

Shelly Kramer

>> That seems like a big risk. I mean, you still have to look out for your existing customer base as excited as you are chasing AI innovation.

David Linthicum

>> I would think so.

Shelly Kramer

>> I mean, that's what you're saying.

David Linthicum

>> Yeah, I would think so. And I think that we have a tendency to operate in the technology world. I've been in this business a long time, very much like how kids play soccer and there's no strategy to it. The ball's kicked over there and they all run over there, ball's kick over there and they all run over there. And technology's in the same way. And we have a tendency to kind of leave all reason behind if we're moving after a particular hype cycle. And we saw this in... First time we moved to AI in the '80s, which I was involved with, but also client-server and moving to service-oriented architecture and then moving to integration and moving to cloud computing and moving to other kind of innovative differentiators where people are moving in different directions. There's value in doing that. But in doing that, we have to figure out the pragmatic applications of our technology and where this market is specifically going to go and make sure we're not missing the bigger picture. I think a lot of people when they first got in the cloud missed the bigger picture and it ended up hurting them. And as that market normalized, they had to exit the market. I think the same thing's going to occur in the security space. I think the smarter technology players out there, hopefully it's everybody, but it's not, are looking at a holistic market and making sure they're not investing in something that's not going to have a direct benefit to the value and what they're looking to do. And I think customers are going to react. They haven't said anything yet where they're making announcements or talking to reporters, things like that. But I think by the end of the year, there's going to be some pushback on the fact that so much has been invested on the AI side of things and not on the traditional security stuff that they rely on now and will for some time that there's going to be some risk and damage that could occur, will occur. And when it does occur, someone's going to yell about it.

Shelly Kramer

>> You know I very much look forward to having this conversation again later on in the day after you've had a chance to go out and ask those questions to vendors.

David Linthicum

>> I'll grill them for us.

Shelly Kramer

>> Please do that. All right. Well, that does it for our morning kickoff. Coming to you live from the Moscone Center at RSA conference, the technology conference in the security space. I'm here. I'm Shelly Kramer. I'm here with fellow analyst, David Linthicum. Keep it right here on theCUBE.