RSA Conference 2024 | Tom McAndrew | Coalfire

Clips
News
More from RSA Conference 2024

Tom McAndrew

CEO

Coalfire

Compliance challenges in the age of cloud and AI: Insights from Coalfire’s CEO Tom McAndrew

In 2023, viewing compliance as a business differentiator has transformed how companies approach growth and security in new markets.Coalfire, a tech-enabled services company, focuses on compliance, regulations and cybersecurity programs for mostly large enterprise customers. Scaling security and compliance efforts is not feasible with just people and manual processes, technology is necessary to keep up with the growing attack surface and regulations, according to Tom McAndrew (pictured), chief executive officer of Coalfire.Coalfire Systems’ CEO, Tom McAndrew, talks to theCUBE about compliance as business differentiator

play_circle_outline Compliance and Cybersecurity: A Closer Look at Coalfire's Programs, Certifications, and Penetration Testing Services

play_circle_outline The challenges faced by boards in cybersecurity and risk management

play_circle_outline The challenges of cybersecurity for large organizations like Microsoft

Info

Tom McAndrew | Coalfire

Tom McAndrew

CEO Coalfire

search

Shelly Kramer

>> Hello and welcome back to day three of theCUBE's live coverage of the RSAC event here in San Francisco. We are over at Moscone West in Broadcast Alley. And today, I'm joined of course by my colleague, Dave Vellante, our other colleague is here, David Linthicum. We are joined this morning for a conversation with Tom McAndrew, who's the CEO of Coalfire. Tom, welcome. It's great to have you.

Tom McAndrew

>> Hey, thank you so much.

>> Hey Tom.

Tom McAndrew

>> Great to be here. Thank you, Dave.

>> Love the shirt, by the way.

Tom McAndrew

>> Oh, thank you. Yeah, let the ponies run today.

>> It's that time of season. We got the Kentucky Derby. We got the coming up, Belmont.

Tom McAndrew

>> Exactly. Yeah. I appreciate it. Yeah, great.

Shelly Kramer

>> The timing of having you on, we were just talking before we went live is perfect because what Coalfire does is kind of a different focus area than some of the conversations that we've been having here at RSAC the last couple of days. We've had lots of conversations about AI and AI security and all that sort of thing. So Coalfire's focus is slightly different. So why don't you tell us a little bit about where you're focusing?

Tom McAndrew

>> Sure, absolutely. So for those that aren't aware, Coalfire, we're the largest independent cybersecurity company, and we really do help out with two problems. One are compliance and regulations, which is probably what we're very known for. So most of the world's largest enterprise customers come to us for cyber certifications, whether it's high trust, FedRAMP, ISO, SOC, all the other 60 plus emerging regulations that people have to figure out and how to certify their products. And the second is actually dealing with some of the cybersecurity programs. So we have one of the largest penetration testing teams in the world, and then we're doing a lot of building for large organizations that they're shifting to cloud. So that's really the area that we focus in on that, and primarily on larger enterprise customers. So like you said, I'm spending a lot of time with boards and executives that are trying to grapple with cloud migration, gen AI, and some of the new SEC disclosure laws and saying, "What should we be doing at the executive level as we think of cybersecurity.

>> So the market is, let's call it roughly 200 billion.

Tom McAndrew

>> Sure.

>> Half of that is services.

Tom McAndrew

>> Yes.

>> So you play in $100 billion TAM today. And is that a fair way to think about your total available market?

Tom McAndrew

>> Yeah, I think so. I think one thing that's happened is all services companies usually start as pure service, get some tech enablement, get some product and platform. So as we looked at it, we are a tech enabled service. We've got a product that is Compliance Essentials, which is our massive platform, which we have over 6,000 different users across both our pen testing platform and compliance platform. So we're not fully managed services on everything, but you're basically seeing that you can't scale out with just people and throwing bodies. I've always told people you can't just be Word documents, Excel sheets, so you've got to have some technology. And particularly as things are scaling out, the number of regulations, the number of security requirements, I think the attack surface grew about 33% last year. And so budgets are not growing 30%, people are not growing 30%. So you've got to get the tech, but one of the big pivots from last year, and you see this year at RSN, we walk the streets and you see all these vendors. There's definitely a pivot to saying CISOs don't need another piece of technology. They need to simplify what they have and the people component is important. So that combination of people and product is super important in really any cybersecurity company.

Shelly Kramer

>> Yeah. I think it's interesting the board focus ... and what I think most people don't realize is that we have a board problem. And I know you're very aware of this, but the Wall Street Journal published late last year, some stats showing that only 2.3% of directors of boards of the S&P 500 companies have any kind of cybersecurity experience. So we're in a situation where boards are making important decisions about risk mitigation and protecting the company, and they don't really have any expertise at all in this area. So it seems to me that you're delivering a service at a pretty timely juncture for us.

Tom McAndrew

>> Absolutely. So I think two parts. Boards are really good at risk management, and that's what they do. So they don't necessarily have to have the deep cyber expertise. But one of the challenges is cyber can be very confusing and can be very relevant. So in many companies, whether it's ransomware attacks are up 23% this year, everybody's worried. So it's gone from a board level topic to what people need to know. In fact, as of this year, over 50% of the enterprise boards are having quarterly or more frequently reporting on cybersecurity. It definitely is becoming a board topic, but so what? Like we say, boards are nose in, hands-out, so they're not in the day-to-day management of things. So what does that mean and what does good governance look like? It's a big question. And two big changes within the last year that have changed it. The emergence of gen AI. We're all hearing about in the news, everyone's doing some gen AI platform. And the second is the new SEC report reporting regulations, which require companies to disclose what they're doing for cybersecurity, who's responsible, and what their expertise is. So those two things have changed right now that are causing a lot of angst and questions at the board and executive.

>> So what specifically are these updated SEC's regulations? What do I have to do to comply? How are you helping people comply?

Tom McAndrew

>> Sure. So if you're a public company, you have to disclose in your 10-K, how are you addressing cybersecurity? And most of them have a generic, "We've got a CISO. They report here. We invest in products," and those sorts of things.

>> Copy-paste.

Tom McAndrew

>> Yeah. So if you look at what happened and starting in January, people started publishing those. So it wasn't really a super big thing. People did it. The challenge though now is when breaches are happening, or you have a ransomware attack, which is happening everywhere, now public folks are saying, "Okay, well why did that happen? And if you had good cybersecurity, what was the root cause?" Now you're kind of stuck in saying, "Well, were you negligent that you didn't really disclose that you didn't invest in the right tools and products, or did you not have the right people?" So that's what causing the problem is if you don't disclose enough, people will think that you may be misleading investors in materiality, but if you do disclose too much, now you're causing some challenges. So those are the two problems that there really are no good answers today, and we're in the first year. So the people that are going through these breaches are really having a struggle and there's a lot of angst at the board. So the lessons learned, I think for folks is being very careful about what's in that 10-K and public statement. And for those of us that are private that don't have to live with the SEC laws, department of Homeland Security has a draft notice too, that would require similar reporting on breaches for all companies. So that is a new trend that once you have to proactively say what you're doing, that's a challenge.

>> Just a follow-up, when you say they have to be careful about what they put in their 10-K, meaning they have to be detailed enough, or are you saying they should not over promise?

Tom McAndrew

>> Yeah, it's trying to find the Goldilocks zone. You don't want to over-promise and under-deliver, but you also don't want to mislead investors. And that's the challenge. Look at some of these, and some of them have reported, "Hey, we have a breach. We haven't determined that it's going to be material." And if then later it's $100 million deal or you wind up with a massive lawsuit or the government starts going after you, people will say, "Why did you not determine that that was a material thing when it was disclosed?"

>> Microsoft is excoriated by the US government for deficient security. If Microsoft can't get it right, how's anybody going to get it right?

Tom McAndrew

>> And that is par for the course. Most organizations are not built to fight nation-state attacks. And even if you are, what's going to happen? A good example with ransomware is as a person, if my family was taken hostage and something would happened, I reached out to the government, they say, "Don't pay." But they would help me with that recovery. In the digital world, that doesn't happen. You have a ransomware attack, you go to the government, you say, "How do we deal with it?" They say, "Don't pay, but we don't help. Push the data to us." And so there's a couple exceptions for some major organizations, but Satya Nadella in their most recent report said cybersecurity is the number one priority for Microsoft. All the news has been gen AI, all that growth. And so I think that's that lesson learned is you've got to have it. And for folks like any of these larger organizations, it is a challenging environment. What should Microsoft do? What should DHS do? And then what do normal folks do that are consumers of this? Our national security policy is to take the work away from smaller organizations and push the burden on the larger providers. So what happens when those larger providers fail? That's the challenge that we're trying to work with today.

>> And it's easy to pick on the $3 trillion market cap company, but the analogy I use is I live in an old house and there's so many coats of paint on my barn. And so that's the problem Microsoft has, they were founded many decades ago. And so it's not an easy problem to solve. How do you handle that in terms of what Coalfire can do with an organization that has such a complex infrastructure with so much legacy, so many potential holes? How do you attack that problem?

Tom McAndrew

>> Yeah, we've been working with so many different larger organizations as they're dealing with these sorts of challenges and how to deal with it. So one of it is there's a lot of solutions that are out there. What people are seeing is how do you hodgepodge or gather all those sorts of areas? So it's usually not a technical solution. It's usually how do you bring everything together? It's not that there's a tool that's missing, but will you find a cascade of failures? So what these larger organizations are saying, "Hey, let's start consolidating our vendors." So that's definitely one thing that we see happening. And so rather than getting best of breed, you're looking really for best of suite or a group of folks. And the second part is the contracting the vendor. A lot of people have put this massive cloud spend. We work a lot with AWS. They have a lot of people that have committed a lot of funding and have it, but they don't know how to pick and navigate through all the different AWS solutions that can handle all these areas. So those are the things that we can really help out with. With Amazon, for example, we've got a private offering where you can get any of our services through Amazon on one. The ISVs, there's over, I think 30,000 ISVs that Amazon has that all have security and compliance. Rather than 30,000 people solve their own solution, how do we work with Amazon on it? And the third one, which is most interesting is everyone that's great, but where do I get the funding? A lot of these larger cloud providers can help offset some of the funding. And so talking to CISOs saying, "We got a solution." Great, I'm one of a bajillion vendors that do that. But when you say, "Hey, by the way, I can save you half a million dollars and implement something and it's already your committed spend." All of a sudden that becomes much more interesting to what they're doing.

Shelly Kramer

>> You get their attention. Yeah, absolutely. The consolidation though, that's such an interesting ... This is not the first time we've heard this here these days. This is actually kind of the opposite of what our research has shown. And we went into this topic, we went into this conversation. When you do some research, you make some assumptions. And one of the assumptions that we made was that people would be moving more to one solution or platform solution or whatever. And I know that you have this research committed to your brain since you've covered it so deep-

>> Yeah. So we had three 21 folks in the survey, half of them were attending RSA, 51% said, "We're actually expanding the number of tools and vendors that we have." And the big chunk stay the same, maybe about 9% were able to consolidate. Now what does that say to me? First of all, it says practitioners are having trouble consolidating. They can never get rid of stuff. The second thing, we talked to Jay Chaudhry last night from Zscaler, he said, "We're not seeing that in our base. Virtually every customer we have, we consolidate." I think George Kurtz from CrowdStrike would probably say the same thing. You're saying the same thing. It's hard though because you're not 100% market share on the order of Zscaler or CrowdStrike. Most customers are having trouble getting rid of stuff. And so interesting that you see that data, but that means there's big opportunities there.

Tom McAndrew

>> Well, I see potential ... I think why both of these could make sense, it probably is the market. So if you are a cloud-enabled, cloud-first technology company, you are massively doing some consolidation. If you're an on-prem historic, and you're doing cloud, you have the worst of both worlds now. You got to maintain your old infrastructure and move to your new. Absolutely, so some people are adding a whole lot more because they're managing on-prem and off, they're managing different sorts of tools, or they're doing that migration and a lift and shift. But those that can scale, can move at pace, that old saying of, "If you want to go fast, go alone. If you want to go further, go with others." Speed matters now. And so sometimes getting maybe not the best product or the top-tier product, but a good enough product that is configured right is way better than, I think 20 or 30% of the products we see are shelfware.

>> This is interesting because I would agree with what you're saying, Tom, but I think most practitioners in the SecOps world believe that they need to go to the new shiny toy and get best of breed. And I think what you said makes a lot more sense, that good enough's maybe not good enough, but having a framework that brings together those good enough pieces and you get the processes and the people right, that actually is ideal.

Tom McAndrew

>> Yeah. As CEO, I see it all the time. My people come to me and say, "Hey, Tom, we need this solution. It'll make our life better." And then how many times we integrate it, a year later, it doesn't happen, or those people leave and it doesn't happen. It's usually you have to change the processes first before you implement the technology, and all this tech without the process change doesn't matter. So the companies that are innovating, and that's where you see innovation, all this stuff. Gen AI is a big area. It's not a tool issue. It's not a, "What are you buying?" It's, "Well, how do you one make the right investment? And then how do you change the process?" And maybe that's one difference is this year the VC markets and the smaller organizations have been absolutely slammed over the last year. Last year we saw all these companies focus on profitability and efficiency. That means less features, less focus in their products, and they're less robust. And so that's an area that the roadmaps have been slipping, and so people are seeing less from their vendors and putting more pressure .

Shelly Kramer

>> This has definitely been the year of do more with less, right?

Tom McAndrew

>> Exactly, yeah. And we're all doing it. So do more with less, but if you're buying more products and services, that's kind of a recipe for disaster in the long run.

Shelly Kramer

>> Yeah, absolutely. Absolutely. I know you all did some research that you published at the end of 2023, it's called your Secure Realities Compliance Report. Any interesting tidbits to come out of that? Anything that surprised you?

Tom McAndrew

>> Yeah, I think a couple. We've done over 11,000 penetration tests, 50,000 different endpoints that we look at. So there's a lot of data, and also on the compliance side of things. So I think two parts. In our world, some folks have said there's security and compliance are different worlds. And I'd see this as a security , compliance is the minimum, security is really what you have to do. But when you start going to the board, it's about negligence and best practice, and it's hard to talk about that. So a good example, how do you know what you're doing in your penetration program is good enough? That when you have an issue and someone looks at what you've spent and how you've done, what those issues are. And so both the compliance practitioners need to be aware of what's going on in security, and security needs to know about compliance. So what's going on in compliance? Every regulation is happening out there on the world. There's one organization I dealt with, they have 15 people full-time that just scour the world on changes in regulations. 15 full-time people that said, "This is a new change in Germany. This is a change in Italy. This is what's going on NIST. This is what's going on here." So the proliferation of regulations in just something like gen AI, for example, there's two major frameworks. There's a NIST risk management framework and ISO. A lot of people aren't even aware of that. And so if they're implementing gen AI and doing it, they're going to be stuck with, a year from now, "We haven't thought about that security. We haven't thought about this." And so the larger organizations are trying to get ahead of that in what they're doing, but the smaller folks are doing it. So it is frustrating because we always try to say, "Bake security in, don't sprinkle it on top." And in all these new emerging areas like gen AI, we're starting to see those same things. So the guidance is if you're a security practitioner, you need to at least have some familiarity of the regulations and what's going on. Some familiarity of what the US is doing, international is doing, SEC, DHS, whether you're public or private or not. Those are the best practices. And if you're public or private, or if you're a public company, you better be really looking at these dynamics and being very careful about how you are disclosing your cybersecurity. Because when you have the incident, we all have incidents. People are going to look at what you said, and that didn't exist before.

>> I know we're over time, but are you pen testing differently for gen AI?

Tom McAndrew

>> Absolutely. So there's a couple of unique things for gen AI which is ... If you look at the EU Act, they have some new regulation into it. So perfect example, let's say part of it says, "Hey ..." There's been more images created by gen AI in the last year than all of photography before. So you're creating that. So something simple of, "Okay, we want to make sure that the pictures you and I are looking at are watermarked or tagged." So if that ends up something you have happening, well, as hackers, we're thinking about, "Okay, well how do you do that so we can generate things that subvert that watermark?" So everyone is trying to think how to build this, but my point is you got to think the hackers of, "Okay, we're going to try to figure out how to subvert what you're doing, how to use that for malicious areas." And that's an area that the gen AI programs are thinking, "Oh, we're building the rules, but you're not thinking about how easy it is to subvert those rules."

>> Absolutely.

Shelly Kramer

>> Wow. Well, Tom McAndrew, CEO of Coalfire, thank you so much for joining us today. And for our viewing audience, keep it right here on theCUBE as we cover all things coming out of RSAC here in San Francisco. And you want to keep it on theCUBE.

Tom McAndrew | Coalfire

search

Shelly Kramer

>> Hello and welcome back to day three of theCUBE's live coverage of the RSAC event here in San Francisco. We are over at Moscone West in Broadcast Alley. And today, I'm joined of course by my colleague, Dave Vellante, our other colleague is here, David Linthicum. We are joined this morning for a conversation with Tom McAndrew, who's the CEO of Coalfire. Tom, welcome. It's great to have you.

Tom McAndrew

>> Hey, thank you so much.

>> Hey Tom.

Tom McAndrew

>> Great to be here. Thank you, Dave.

>> Love the shirt, by the way.

Tom McAndrew

>> Oh, thank you. Yeah, let the ponies run today.

>> It's that time of season. We got the Kentucky Derby. We got the coming up, Belmont.

Tom McAndrew

>> Exactly. Yeah. I appreciate it. Yeah, great.

Shelly Kramer

>> The timing of having you on, we were just talking before we went live is perfect because what Coalfire does is kind of a different focus area than some of the conversations that we've been having here at RSAC the last couple of days. We've had lots of conversations about AI and AI security and all that sort of thing. So Coalfire's focus is slightly different. So why don't you tell us a little bit about where you're focusing?

Tom McAndrew

>> Sure, absolutely. So for those that aren't aware, Coalfire, we're the largest independent cybersecurity company, and we really do help out with two problems. One are compliance and regulations, which is probably what we're very known for. So most of the world's largest enterprise customers come to us for cyber certifications, whether it's high trust, FedRAMP, ISO, SOC, all the other 60 plus emerging regulations that people have to figure out and how to certify their products. And the second is actually dealing with some of the cybersecurity programs. So we have one of the largest penetration testing teams in the world, and then we're doing a lot of building for large organizations that they're shifting to cloud. So that's really the area that we focus in on that, and primarily on larger enterprise customers. So like you said, I'm spending a lot of time with boards and executives that are trying to grapple with cloud migration, gen AI, and some of the new SEC disclosure laws and saying, "What should we be doing at the executive level as we think of cybersecurity.

>> So the market is, let's call it roughly 200 billion.

Tom McAndrew

>> Sure.

>> Half of that is services.

Tom McAndrew

>> Yes.

>> So you play in $100 billion TAM today. And is that a fair way to think about your total available market?

Tom McAndrew

>> Yeah, I think so. I think one thing that's happened is all services companies usually start as pure service, get some tech enablement, get some product and platform. So as we looked at it, we are a tech enabled service. We've got a product that is Compliance Essentials, which is our massive platform, which we have over 6,000 different users across both our pen testing platform and compliance platform. So we're not fully managed services on everything, but you're basically seeing that you can't scale out with just people and throwing bodies. I've always told people you can't just be Word documents, Excel sheets, so you've got to have some technology. And particularly as things are scaling out, the number of regulations, the number of security requirements, I think the attack surface grew about 33% last year. And so budgets are not growing 30%, people are not growing 30%. So you've got to get the tech, but one of the big pivots from last year, and you see this year at RSN, we walk the streets and you see all these vendors. There's definitely a pivot to saying CISOs don't need another piece of technology. They need to simplify what they have and the people component is important. So that combination of people and product is super important in really any cybersecurity company.

Shelly Kramer

>> Yeah. I think it's interesting the board focus ... and what I think most people don't realize is that we have a board problem. And I know you're very aware of this, but the Wall Street Journal published late last year, some stats showing that only 2.3% of directors of boards of the S&P 500 companies have any kind of cybersecurity experience. So we're in a situation where boards are making important decisions about risk mitigation and protecting the company, and they don't really have any expertise at all in this area. So it seems to me that you're delivering a service at a pretty timely juncture for us.

Tom McAndrew

>> Absolutely. So I think two parts. Boards are really good at risk management, and that's what they do. So they don't necessarily have to have the deep cyber expertise. But one of the challenges is cyber can be very confusing and can be very relevant. So in many companies, whether it's ransomware attacks are up 23% this year, everybody's worried. So it's gone from a board level topic to what people need to know. In fact, as of this year, over 50% of the enterprise boards are having quarterly or more frequently reporting on cybersecurity. It definitely is becoming a board topic, but so what? Like we say, boards are nose in, hands-out, so they're not in the day-to-day management of things. So what does that mean and what does good governance look like? It's a big question. And two big changes within the last year that have changed it. The emergence of gen AI. We're all hearing about in the news, everyone's doing some gen AI platform. And the second is the new SEC report reporting regulations, which require companies to disclose what they're doing for cybersecurity, who's responsible, and what their expertise is. So those two things have changed right now that are causing a lot of angst and questions at the board and executive.

>> So what specifically are these updated SEC's regulations? What do I have to do to comply? How are you helping people comply?

Tom McAndrew

>> Sure. So if you're a public company, you have to disclose in your 10-K, how are you addressing cybersecurity? And most of them have a generic, "We've got a CISO. They report here. We invest in products," and those sorts of things.

>> Copy-paste.

Tom McAndrew

>> Yeah. So if you look at what happened and starting in January, people started publishing those. So it wasn't really a super big thing. People did it. The challenge though now is when breaches are happening, or you have a ransomware attack, which is happening everywhere, now public folks are saying, "Okay, well why did that happen? And if you had good cybersecurity, what was the root cause?" Now you're kind of stuck in saying, "Well, were you negligent that you didn't really disclose that you didn't invest in the right tools and products, or did you not have the right people?" So that's what causing the problem is if you don't disclose enough, people will think that you may be misleading investors in materiality, but if you do disclose too much, now you're causing some challenges. So those are the two problems that there really are no good answers today, and we're in the first year. So the people that are going through these breaches are really having a struggle and there's a lot of angst at the board. So the lessons learned, I think for folks is being very careful about what's in that 10-K and public statement. And for those of us that are private that don't have to live with the SEC laws, department of Homeland Security has a draft notice too, that would require similar reporting on breaches for all companies. So that is a new trend that once you have to proactively say what you're doing, that's a challenge.

>> Just a follow-up, when you say they have to be careful about what they put in their 10-K, meaning they have to be detailed enough, or are you saying they should not over promise?

Tom McAndrew

>> Yeah, it's trying to find the Goldilocks zone. You don't want to over-promise and under-deliver, but you also don't want to mislead investors. And that's the challenge. Look at some of these, and some of them have reported, "Hey, we have a breach. We haven't determined that it's going to be material." And if then later it's $100 million deal or you wind up with a massive lawsuit or the government starts going after you, people will say, "Why did you not determine that that was a material thing when it was disclosed?"

>> Microsoft is excoriated by the US government for deficient security. If Microsoft can't get it right, how's anybody going to get it right?

Tom McAndrew

>> And that is par for the course. Most organizations are not built to fight nation-state attacks. And even if you are, what's going to happen? A good example with ransomware is as a person, if my family was taken hostage and something would happened, I reached out to the government, they say, "Don't pay." But they would help me with that recovery. In the digital world, that doesn't happen. You have a ransomware attack, you go to the government, you say, "How do we deal with it?" They say, "Don't pay, but we don't help. Push the data to us." And so there's a couple exceptions for some major organizations, but Satya Nadella in their most recent report said cybersecurity is the number one priority for Microsoft. All the news has been gen AI, all that growth. And so I think that's that lesson learned is you've got to have it. And for folks like any of these larger organizations, it is a challenging environment. What should Microsoft do? What should DHS do? And then what do normal folks do that are consumers of this? Our national security policy is to take the work away from smaller organizations and push the burden on the larger providers. So what happens when those larger providers fail? That's the challenge that we're trying to work with today.

>> And it's easy to pick on the $3 trillion market cap company, but the analogy I use is I live in an old house and there's so many coats of paint on my barn. And so that's the problem Microsoft has, they were founded many decades ago. And so it's not an easy problem to solve. How do you handle that in terms of what Coalfire can do with an organization that has such a complex infrastructure with so much legacy, so many potential holes? How do you attack that problem?

Tom McAndrew

>> Yeah, we've been working with so many different larger organizations as they're dealing with these sorts of challenges and how to deal with it. So one of it is there's a lot of solutions that are out there. What people are seeing is how do you hodgepodge or gather all those sorts of areas? So it's usually not a technical solution. It's usually how do you bring everything together? It's not that there's a tool that's missing, but will you find a cascade of failures? So what these larger organizations are saying, "Hey, let's start consolidating our vendors." So that's definitely one thing that we see happening. And so rather than getting best of breed, you're looking really for best of suite or a group of folks. And the second part is the contracting the vendor. A lot of people have put this massive cloud spend. We work a lot with AWS. They have a lot of people that have committed a lot of funding and have it, but they don't know how to pick and navigate through all the different AWS solutions that can handle all these areas. So those are the things that we can really help out with. With Amazon, for example, we've got a private offering where you can get any of our services through Amazon on one. The ISVs, there's over, I think 30,000 ISVs that Amazon has that all have security and compliance. Rather than 30,000 people solve their own solution, how do we work with Amazon on it? And the third one, which is most interesting is everyone that's great, but where do I get the funding? A lot of these larger cloud providers can help offset some of the funding. And so talking to CISOs saying, "We got a solution." Great, I'm one of a bajillion vendors that do that. But when you say, "Hey, by the way, I can save you half a million dollars and implement something and it's already your committed spend." All of a sudden that becomes much more interesting to what they're doing.

Shelly Kramer

>> You get their attention. Yeah, absolutely. The consolidation though, that's such an interesting ... This is not the first time we've heard this here these days. This is actually kind of the opposite of what our research has shown. And we went into this topic, we went into this conversation. When you do some research, you make some assumptions. And one of the assumptions that we made was that people would be moving more to one solution or platform solution or whatever. And I know that you have this research committed to your brain since you've covered it so deep-

>> Yeah. So we had three 21 folks in the survey, half of them were attending RSA, 51% said, "We're actually expanding the number of tools and vendors that we have." And the big chunk stay the same, maybe about 9% were able to consolidate. Now what does that say to me? First of all, it says practitioners are having trouble consolidating. They can never get rid of stuff. The second thing, we talked to Jay Chaudhry last night from Zscaler, he said, "We're not seeing that in our base. Virtually every customer we have, we consolidate." I think George Kurtz from CrowdStrike would probably say the same thing. You're saying the same thing. It's hard though because you're not 100% market share on the order of Zscaler or CrowdStrike. Most customers are having trouble getting rid of stuff. And so interesting that you see that data, but that means there's big opportunities there.

Tom McAndrew

>> Well, I see potential ... I think why both of these could make sense, it probably is the market. So if you are a cloud-enabled, cloud-first technology company, you are massively doing some consolidation. If you're an on-prem historic, and you're doing cloud, you have the worst of both worlds now. You got to maintain your old infrastructure and move to your new. Absolutely, so some people are adding a whole lot more because they're managing on-prem and off, they're managing different sorts of tools, or they're doing that migration and a lift and shift. But those that can scale, can move at pace, that old saying of, "If you want to go fast, go alone. If you want to go further, go with others." Speed matters now. And so sometimes getting maybe not the best product or the top-tier product, but a good enough product that is configured right is way better than, I think 20 or 30% of the products we see are shelfware.

>> This is interesting because I would agree with what you're saying, Tom, but I think most practitioners in the SecOps world believe that they need to go to the new shiny toy and get best of breed. And I think what you said makes a lot more sense, that good enough's maybe not good enough, but having a framework that brings together those good enough pieces and you get the processes and the people right, that actually is ideal.

Tom McAndrew

>> Yeah. As CEO, I see it all the time. My people come to me and say, "Hey, Tom, we need this solution. It'll make our life better." And then how many times we integrate it, a year later, it doesn't happen, or those people leave and it doesn't happen. It's usually you have to change the processes first before you implement the technology, and all this tech without the process change doesn't matter. So the companies that are innovating, and that's where you see innovation, all this stuff. Gen AI is a big area. It's not a tool issue. It's not a, "What are you buying?" It's, "Well, how do you one make the right investment? And then how do you change the process?" And maybe that's one difference is this year the VC markets and the smaller organizations have been absolutely slammed over the last year. Last year we saw all these companies focus on profitability and efficiency. That means less features, less focus in their products, and they're less robust. And so that's an area that the roadmaps have been slipping, and so people are seeing less from their vendors and putting more pressure .

Shelly Kramer

>> This has definitely been the year of do more with less, right?

Tom McAndrew

>> Exactly, yeah. And we're all doing it. So do more with less, but if you're buying more products and services, that's kind of a recipe for disaster in the long run.

Shelly Kramer

>> Yeah, absolutely. Absolutely. I know you all did some research that you published at the end of 2023, it's called your Secure Realities Compliance Report. Any interesting tidbits to come out of that? Anything that surprised you?

Tom McAndrew

>> Yeah, I think a couple. We've done over 11,000 penetration tests, 50,000 different endpoints that we look at. So there's a lot of data, and also on the compliance side of things. So I think two parts. In our world, some folks have said there's security and compliance are different worlds. And I'd see this as a security , compliance is the minimum, security is really what you have to do. But when you start going to the board, it's about negligence and best practice, and it's hard to talk about that. So a good example, how do you know what you're doing in your penetration program is good enough? That when you have an issue and someone looks at what you've spent and how you've done, what those issues are. And so both the compliance practitioners need to be aware of what's going on in security, and security needs to know about compliance. So what's going on in compliance? Every regulation is happening out there on the world. There's one organization I dealt with, they have 15 people full-time that just scour the world on changes in regulations. 15 full-time people that said, "This is a new change in Germany. This is a change in Italy. This is what's going on NIST. This is what's going on here." So the proliferation of regulations in just something like gen AI, for example, there's two major frameworks. There's a NIST risk management framework and ISO. A lot of people aren't even aware of that. And so if they're implementing gen AI and doing it, they're going to be stuck with, a year from now, "We haven't thought about that security. We haven't thought about this." And so the larger organizations are trying to get ahead of that in what they're doing, but the smaller folks are doing it. So it is frustrating because we always try to say, "Bake security in, don't sprinkle it on top." And in all these new emerging areas like gen AI, we're starting to see those same things. So the guidance is if you're a security practitioner, you need to at least have some familiarity of the regulations and what's going on. Some familiarity of what the US is doing, international is doing, SEC, DHS, whether you're public or private or not. Those are the best practices. And if you're public or private, or if you're a public company, you better be really looking at these dynamics and being very careful about how you are disclosing your cybersecurity. Because when you have the incident, we all have incidents. People are going to look at what you said, and that didn't exist before.

>> I know we're over time, but are you pen testing differently for gen AI?

Tom McAndrew

>> Absolutely. So there's a couple of unique things for gen AI which is ... If you look at the EU Act, they have some new regulation into it. So perfect example, let's say part of it says, "Hey ..." There's been more images created by gen AI in the last year than all of photography before. So you're creating that. So something simple of, "Okay, we want to make sure that the pictures you and I are looking at are watermarked or tagged." So if that ends up something you have happening, well, as hackers, we're thinking about, "Okay, well how do you do that so we can generate things that subvert that watermark?" So everyone is trying to think how to build this, but my point is you got to think the hackers of, "Okay, we're going to try to figure out how to subvert what you're doing, how to use that for malicious areas." And that's an area that the gen AI programs are thinking, "Oh, we're building the rules, but you're not thinking about how easy it is to subvert those rules."

>> Absolutely.

Shelly Kramer

>> Wow. Well, Tom McAndrew, CEO of Coalfire, thank you so much for joining us today. And for our viewing audience, keep it right here on theCUBE as we cover all things coming out of RSAC here in San Francisco. And you want to keep it on theCUBE.