RSA Conference 2024 | Curtis Simpson & Nadir Izrael | Armis

Clips
News
More from RSA Conference 2024

Nadir Izrael

Co-founder & CTO

Armis Security

Curtis Simpson

CISO and Chief Advocacy Officer

Armis

Securing critical infrastructure: Armis tackles cyber threats with strategic innovation

As tech innovation reshapes industries, the need for robust cybersecurity for digital transformation becomes critical to protect organizational infrastructure.Organizations need to proactively address security vulnerabilities rather than just reacting to incidents as they occur. Understanding and managing the attack surface, focusing on managing vulnerabilities and risks, and intelligently and effectively remediating are key to protecting an organization’s security, according to Curtis Simpson (pictured, left), chief information security officer and chief advocacy officer of Armis Inc.Armis CISO Curtis Simpson and CTO Nadir Izrael talk with theCUBE about cybersecurity

play_circle_outline Gaining Visibility and Prioritizing Security in Organizations: Armis' Mission to Tackle Critical Infrastructure Challenges

play_circle_outline The increasing sophistication of cyber threat actors and the need for proactive cybersecurity measures.

play_circle_outline The role of AI in accelerating proactive cybersecurity and focusing on remediation.

play_circle_outline The intersection of physical and digital worlds and the need for expertise in bridging the gap.

play_circle_outline The potential of AI to prompt organizations to rethink their cybersecurity approaches.

Info

Curtis Simpson & Nadir Izrael | Armis

Nadir Izrael

Co-founder & CTO Armis Security

Curtis Simpson

CISO and Chief Advocacy Officer Armis

search

>> Welcome back to RSA Conference 2024. You're watching theCUBE. We're here with Curtis Simpson, who's the chief information security officer and chief advocacy Officer at Armis and Nadir Israel, who's the CTO and co-founder of Armis. Great to see you guys. Thanks for coming on.

Curtis Simpson

>> Thanks for having having us.

>> Thanks for having having us.

>> I'm really excited about this conversation securing critical infrastructure. It is of national and global importance. But before we get into it, why'd you start the company?

Curtis Simpson

>> We started the company about eight years ago now, and we started about a singular answer to a question that we posed to CISOs. We asked them, what is missing in your world? What is keeping you up at night? And most CISOs out there, their answer to that, way back then was, we don't know what we have. Plain and simple. To me that was astonishing that a company wouldn't know even the stuff that it itself has procured. But most companies out there don't know what they have. They don't understand the devices and assets in their organization. They don't understand the quantified risk, they don't understand their attack surface. But as we matured the company, I think it turned into what do I have then? How do I prioritize the work on that or understand what I need to work on? And finally, how do I do something about it? And Armis is in the business of doing something about that and helping you actually mitigate those exposures and lowering your overall attack surface.

>> I love this blurb that you guys shared with me. Today's cyber threat landscape continues to worsen, this we know. Organizations globally are struggling to combat the increasingly sophisticated tactics of threat actors. Your adversaries are highly capable, aren't they?

Curtis Simpson

>> Very much so.

>> And Armis' comprehensive AI-powered platform is designed to help security teams protect their entire attack surfaces and manage their organization's cyber risk exposure in real time. Growing demand for Armis' solution has resulted in exponential growth for the company. Wow, that sounds pretty impressive. What's your CISO, put your CISO hat on that, you're a recipient of that message. How do you respond?

Curtis Simpson

>> It's the reality we're facing today. So I was one of the first large customers of Armis, and the challenge I was facing was on the manufacturing side. So I worked for a food service distribution operation. I had no visibility into what was powering manufacturing or supply chain operations in general. And the conversation I had to have with my board was, if something moves from our IT environment over to that supply chain environment, I'm going to have to pick up a red phone and tell you that we now have a seven to eight figure challenge that I can do nothing about because I have none of the visibility. This is paramount today. The reality is there's too many things. Visibility isn't even the problem necessarily anymore. It's about, to Nadir's point, understanding what I have, but then what should I actually do that matters to the business now because the reality is there's too many problems sitting in front of us to actually solve them all. We have to pick the ones we need to solve today and then tomorrow we need to pick the ones we need to solve that day and on and on and on. And Armis is what powers that, and this is the message behind that at the end of the day.

>> Are you enabling, and I'd love to hear some proof points, customers to really be proactive. I mean, we all know you just react. It's a game of whack-a-mole, and it's just the way it is. Is that changing? Will AI change that? Will Armis change that? Give me some proof points.

>> So I think fundamentally the industry at large has fallen in love over the last decade with this idea of detection and response. We just put a lot of different tripwires and detections and respond to it really quick and we'll be okay. But the reality is that that worked maybe at a certain level of maturity or scale, but it doesn't really work anymore. Organizations have millions and millions of different exposures at any given point in time. They have different risks they need to manage. And you know what? Putting up a fence or actually shoring up a hole in your armor is way more cost-effective and frankly effective than waiting for something to happen and then responding to it mid-breach or mid-event. Now, I think that getting closer to that ideal vision of being able to manage like Curtis just said, that entire attack surface and what are the things I need to focus on today and how to action that, that's really Armis's mission. And yes, a heavy dose of AI will absolutely help get us there or accelerate us there. But even before that, in my opinion, it's the boring basics. It's managing vulnerabilities and risks and basically just focusing on remediating and not just on responding to active threats.

>> But how do you put a fence around? There is no perimeter anymore.

Curtis Simpson

>> No.

>> So what do you do? Just multiple fences where they need to be or what's the solution there?

>> Well, I'll start and you can definitely add to that, but I would say that it starts with understanding that attack surface. To your point, it's vast, it's dynamic, it's complex, but that doesn't mean it's unmeasurable. It doesn't mean that you can't have an intelligence understand it and still be able to point today what are the three holes that if I closed in that attack surface, I could be that much more protected than I was before. And it's the same rules as I heard this once in an analogy to your car. Your car doesn't need to be super protected. It just needs to be slightly harder to steal than the three other cars down the block. So ultimately you as an organization need just to keep chipping away at things, but do it intelligently, effectively, not just go down a list, but do it in a way that actually puts together guardrails, closes up different hatches and day over day just maneuvers through that.

>> I like that analogy. It's like running away from the bear. I have to be faster than you are.

Curtis Simpson

>> Yeah.

>> Exactly.

Curtis Simpson

>> And a lot of it too is understanding. So the problem is for the longest time we understood the technology problems within our environment, but we didn't really relate them back to the context of how we do business. The power is at the intersection point there and truly understanding what could, it's not just understanding what do I need to do today, but what could disrupt the business in the most material capacity possible, and how do I direct my resources and attention towards that? And much of what we're doing is bringing that context together in one place such that you can make those smart decisions 'cause there is no silver bullet, there's no single control, there's no single perimeter. It is about understanding where could the most damage be done and what do I do to reduce that damage? And that's the question we fundamentally as CISOs ask ourselves every single day, but it's the telemetry that matters behind it and the ability to rapidly relate to how we do business that enables us to tell the right stories to our partners within the operation that allow us to continue to progress.

>> So you guys are seeing rapid growth, that definitely got my attention. Talk about your platform, what's driving that growth?

>> I think the growth comes from the problem statement first and foremost. The reality is everything we're talking about here is not news to any CISO out there that needs to work. But at the same time, I think the problems are getting worse and worse because over the last few years, if we think about cyber security as a whole, it's gotten a hell of a lot more dangerous and harder than it used to be. It used to be that CISOs would tell themselves, I don't need to worry about nation states. Nation states, if they're out to get me, they're out to get me. But these days you can't afford not to. You're just as much as an organization, a target of cyber criminals as you are of nation states or affiliated groups. The use of both much more clever vulnerability exploits and a time to market of an exploit that's that much faster as well as the use of more and more AI. Even in that, we're seeing the beginning of AI platforms that can basically take advantage of all of these things combined and essentially assault at scale, attack surfaces all at once. All of these things are driving our growth. They're driving the growth of the industry at large. But I think especially for companies that can map out and help you actually remediate things, not just tell you about stuff but actually fix things. That's what's driving, I think, most of our growth from an outside-in perspective.

>> I mean that gets back to the proactivity as opposed to, "Hey, here's yet another alert." I mean, people just alert fatigue. I read a book last summer, a friend of mine wrote it, his first book. He's not a well-known author, but he was a tech guy who spent a lot of time in Israel, worked for EMC for years, buying companies, and spent a lot of time in Silicon Valley. The book was called A Restaurant in Jaffa, and basically it was this fictional story, but because he had a knowledge of tech and programming developers, et cetera, it was a fictional story about how this hacker group basically took over critical infrastructure and he got into it and gave some really plausible examples of how that could happen. And it really scared me and I was like, "Dude, how real is this?" And he said, "No, this is real." And so if you think about a scale of one to 10, how secure our critical infrastructure is, it ain't a 10 or a nine. Okay. So-

>> I'm glad you're not asking that as a question because that would be an awkward answer.

Curtis Simpson

>> I don't want to give you that number.

>> Yeah, it's a scary thing. But so this means we're talking about certainly a critical issue for nations, for the globe, for citizens all over the world. Your thoughts on the state of critical and for you don't have to go into give it a rating, but there's probably some industries that are stronger than others. I hope defense, I hope airlines, but there are many that may not be. How are you guys helping them solve that problem?

Curtis Simpson

>> It does go back to a lot of what we've said. So when you look at these environments today, so one of the terms that we use in this space is operational technology. This is technology that was built by the automobile industry decades ago, really at the beginning of the production line. Well, these are the technologies that critical infrastructure operations are using, and it was fine generally for years because they were isolated from everything else. But the reality is everything within every environment today is fundamentally connected. We have to be able to manage environments remotely. We have to be able to understand data coming out of environments. We have to feed them into different platforms. The problem fundamentally is not just the old technology, but how it's been intersected with everything else. So how we help critical infrastructure is first understand what you have, understand the attack surface, and then help you actually prioritize those efforts in a meaningful way. Because the reality too is in these environments, so we think about terms like patching. Well, in a traditional enterprise environment with traditional technology, apply a patch on 40 or 50-year-old technology, you don't apply a patch. It's about mitigations. So it's about understanding what you have. It's about understanding where you're exposed, but then it's about understanding to your earlier point, how do I proactively apply the right mitigations so I can actually defend this water treatment facility, this, and you name it, energy grid, against these types of attacks so that we're able to safeguard the citizens and all these capabilities that rely on them. That's fundamentally what we're enabling them to be able to deliver. And without technologies like ours, they've got disparate views into all of this that are not connected as such that you can understand how these systems can be disrupted. And that fundamentally is why we've seen some of what we've seen within the market.

>> Because 40, 50 years ago that critical infrastructure wasn't connected. Today somebody had the brilliant idea of connecting the grid to the internet, and it's like, oh, that sounds good.

Curtis Simpson

>> Exactly.

>> Oh, oops. But so it's this hybrid world where you've got that 40 to 50-year-old legacy, but increasingly you will have to apply patches to the new stuff that's going on there, right? Is that how we should be thinking about it?

>> Yes, but also I think just the fact that you understand that environment, that you understand the security controls that you have, that you're able to apply them smartly, that you're able to use them in a way that can really shield your environment, all of those things are riddled with both inefficiencies, areas where you just don't know. There's an entire realm that is just managing the stuff that you even have, even before you patch or do anything else beyond that. Of course, patching of course, the boring basics like I called them in the beginning, but even just understanding what you have and which security controls are at your disposal, it's understanding the battlefield and what you have on the board, that's already a lot. And that's something that I feel is a huge area of investment where we find ourselves in with critical infrastructure, but with organizations in general.

>> How much exposure can you give customers to the supply chain for that critical infrastructure?

>> I think quite a bit. I think both from the perspective of customers that rely on critical infrastructure, but also of the critical infrastructure companies and agencies and anything else themselves. Exposure ultimately, it might be a tough equation to quantify, but it is quantifiable. It's finite, it's discrete, it's quantifiable. So I think ultimately it measures on the level of visibility that you can provide out of the box, which is our core and bread and butter, but then the quantification, the prioritization, and then actually helping them technologically, but also processing people-wise to solve things. Once they start seeing that, okay, we've done this and risk actually got reduced, it reinforces itself. You can start getting people measuring impact instead of just alert fatigue or other things like that.

>> Because I would imagine that the supply chain, the emerging software supply chain for critical infrastructure is different than the software supply chain for an enterprise. Enterprise is open source. There's a lot of commercial off-the-shelf software. But now the entire world, Andreessen, everybody's a software company. Every company's a software company. Scares me a little bit because I oftentimes see non-tech companies building an app, and as a consumer you're like, "Wow, whoever built this just doesn't understand software." And so I'm applying that to the physical world, becoming digital. And they're not, certainly not security, and they're not software experts, they're not security experts. They'll hire some people in, they have a big vision and then they could end up exposing. So how do you think about that and what are you seeing in terms of the state of the digital and physical worlds coming together and those traditional legacy companies actually becoming digital? Are they ready for that?

Curtis Simpson

>> This is fundamentally why we exist. If you look at, so most of these, one of the interesting things when you look at say, critical infrastructure, as a CISO within that type of environment, historically, I've never owned the other side of the business or that corresponding risk. So when you think about it from that perspective, I've never owned it. Now I need to own it yesterday because the risk is sitting there, and as you think about this physical digital intersection, well, I just need to understand what it is. It's really just a new set of assets. It's a new set of technologies that I just need to embrace, understand they're part of the ecosystem, and then we need to do the things we talked about. It is why we exist. And I think what we've seen generally in the market is a lot of these companies recognize the fact that I don't know anything about any of what I just said, and I'm going to have to rely on the experts to help me actually get there. And that's fundamentally where we come in. We're not seeing anyone build what we're doing. We're seeing people acknowledge that they can't do what we're doing, and they need to leapfrog where they are today immediately.

>> Well, it's interesting though because the OT guys, they're engineers and engineers are, they want control of their stuff. They don't want you messing with it. So I mean it and SecOps, hard enough getting those guys together and bring in DevOps and the data team, and now you're saying, okay, all that is coming into OT with that control freak mindset, which I don't blame them by the way. So there's cultural aspects to becoming more safe as a nation, as a world, isn't there?

Curtis Simpson

>> It's actually frankly why it's astonishing how little focus is given to the actual remediation process and how to work between different teams and different cultures to get things done. I think that a lot of the focus these days for us on how to action, how to remediate, how to manage that very delicate process between different people that need to manage things together, give them views of the world that align with their perspective on what they're trying to get out of it, and bring those different functions closer together by not antagonizing each other with the system that this one wants to use and this one wants to use, but really create a workflow that accommodates all of these different needs is crucial. And it's frankly a very underserved area of cyber security as a whole. It's missing that entire point that you just made around bringing along different organizations to that journey because everybody cares about it. They just care about it differently.

>> You think AI will be a forcing function to make organizations completely rethink how they do things?

Curtis Simpson

>> It will be, and I think one of the biggest strengths you'll see in this conversation is actual meaningful guidance that takes your industry, your operating environment and consideration. Because the general challenge, it goes back to that, well, I used to just patch now, I can't patch any of these things. What do I actually do and what should I do? Now one of the powers of Armis is we are a passive technology. So within these types of operating environments, one of our successes has been we can convince the other side, being the OT engineers, to actually consider the technology. A, because it's not going to disrupt your environment, but B, it's actually going to solve some of your problems too. But it goes back to I had to sell this internally in terms of OT engineers adopting these capabilities to their benefit, and that is a big part of it. You have to ultimately get there to solve this problem, but sometimes you need the technology to bring you enough awareness to have a meaningful conversation with those teams. Actually, the reality we're facing is if you've never owned this before, you don't know enough to have a meaningful conversation, and you might be kicked out of the room faster than you really want to be. So a lot of where we help is bringing visibility to these CISOs to empower them to have meaningful conversations with their business partners to actually drive and direct change within these environments.

>> It's hard to get your hands around actually the size of the cybersecurity business. I mean, it ranges from $150 billion a year spent on cyber growing at low double digits. I think that's probably generally accepted number, but I've seen when you include internal spending it go up to a trillion. This whole conversation around critical infrastructure dramatically increases the TAM. I mean, a lot of times entrepreneurs say, "Look, I know it's huge. I don't try to size it. I could go to IDC or DAR or whatever." But on a relative basis, how do you think about that total available market? Is it double like the existing or are there more enterprises? So maybe not, but it's a significant uplift on the market opportunity, isn't it?

>> I think massively so I think that the more... You asked before about AI, I'll give you a slightly more, I don't know, far-reaching, but not that far away in the future future. I think AI, the way it works right now and the different applicability and use case within organizations will get us to a point very quickly where it's not about having data structures and databases and things everywhere. We won't have the tight controls and views that we currently have because there's no point. They're built for humans. But if you have AIs that can consume and contextualize all of that, what you'll start seeing is a complete disarray and dismantling of all the classic infrastructure elements that we already had. You asked about putting up walls and different things. There's not going to be even a territory anyway. It's just going to be all spread around. And in that kind of world, the amount of new challenges and new things that will be introduced into the environment and the mesh of cybersecurity into everyday life and all of these different aspects will be enormous. I think that the potential growth of the market, not only is it far from over, I would even argue that with all of these accelerated paces of other markets, it'll grow. It will grow faster than what we're even thinking.

>> It's interesting because the bromide in this business is cybersecurity can't be an afterthought. It has to be designed in from the beginning. Oftentimes it's not. In fact, I would argue it's almost never.

Curtis Simpson

>> Rarely.

>> And so what happens is the application developer has to worry about all this stuff, and it's so far removed from the core, and what you just described is the opposite, where AI is going to enable it to be designed in from the beginning, much closer to whatever the data, the critical infrastructure this floating perimeter embedded. You're already seeing it. You certainly see it in semiconductors with confidential computing, but that extends to everything, all parts of the stack. That's enormous.

Curtis Simpson

>> Yeah, the whole conversation has changed, quite frankly. I've been in enterprise CISO for a large portion of my life, and again, it's changed. There's a lot less selling having to be done now, and there's more questions being asked of us. What should we be doing? What actions should we be taking? How should we be thinking about this? Those are not questions that I was receiving through most of my career. Most of my career was, why are you here? What do we need to do? Why do we need to do it?

>> How long is this meeting?

Curtis Simpson

>> Exactly. Are we done yet? This was not anything anyone wanted to do. They saw me as a black box. We just do things and hopefully never speak for my early point in my career, but now we're fundamentally looking to subject matter experts like CISOs to actually direct that foundation because digital transformations combined with very destructive newsworthy events have entirely changed this conversation. We now know our business leaders, our technology leaders, know that the tip of the spear is in the cloud. They've seen what that tip of the spear looks like in the news when you don't secure it as the foundation and no one wants their burgeoning capabilities that they're broadcasting to the market to be utterly destroyed. The brand erosion that you're going to experience as part of that is now meaningfully understood whereas historically, it never was.

>> You're right, the cloud is the first line of defense, but there's a lot of lines behind it that are much more vulnerable.

Curtis Simpson

>> I often say, we added the cloud. We didn't move to the cloud. We have the cloud, we have the middleware, we have the mainframes, we have all of it now, and this is a lot of where we come in to help.

>> Guys, such an interesting conversation. You guys got a lot of momentum in the market. What's the future for Armis? You guys thinking public markets? Is that something that's on the radar?

>> I think the aim is to build ultimately a generational company, something that is very big and serves companies and does everything long-term. So going public is a typical step in that, and it's definitely what we're aiming towards. But ultimately, I think that market dynamics being what they are, everybody doesn't know even three months from now what's going to happen, let alone a year or two. But I would say that from a perspective where the company is marching towards generally being able to really take that vision of a future where you can actually remediate all of this stuff and actually fix things and build a platform, build a huge company behind that, that can really serve all of these different CISOs and enterprises out there. And yeah, go public definitely would be a personal and collective achievement that would be amazing to us. And another milestone on the way to building that long-standing generational business.

>> Yeah, I think those IPO markets, they're going to come back. The Fed's still in control, but we'll see. I think there are a lot of advantages to being a public company for your business and also for many of your employees can be game-changing, wealth-changing.

Curtis Simpson

>> For sure.

>> Amazing. Congratulations on all the success.

>> Thank you.

>> Really appreciate the support. Thanks for coming on theCUBE.

Curtis Simpson

>> Thanks for having us.

>> Thanks for having us.

>> All right. Keep it right there. This is Dave Vellante. Shelly Kramer and Dave Linthicum are also here. We're in Moscone West at RSAC 2024. We'll be right back.

Curtis Simpson & Nadir Izrael | Armis

search

>> Welcome back to RSA Conference 2024. You're watching theCUBE. We're here with Curtis Simpson, who's the chief information security officer and chief advocacy Officer at Armis and Nadir Israel, who's the CTO and co-founder of Armis. Great to see you guys. Thanks for coming on.

Curtis Simpson

>> Thanks for having having us.

>> Thanks for having having us.

>> I'm really excited about this conversation securing critical infrastructure. It is of national and global importance. But before we get into it, why'd you start the company?

Curtis Simpson

>> We started the company about eight years ago now, and we started about a singular answer to a question that we posed to CISOs. We asked them, what is missing in your world? What is keeping you up at night? And most CISOs out there, their answer to that, way back then was, we don't know what we have. Plain and simple. To me that was astonishing that a company wouldn't know even the stuff that it itself has procured. But most companies out there don't know what they have. They don't understand the devices and assets in their organization. They don't understand the quantified risk, they don't understand their attack surface. But as we matured the company, I think it turned into what do I have then? How do I prioritize the work on that or understand what I need to work on? And finally, how do I do something about it? And Armis is in the business of doing something about that and helping you actually mitigate those exposures and lowering your overall attack surface.

>> I love this blurb that you guys shared with me. Today's cyber threat landscape continues to worsen, this we know. Organizations globally are struggling to combat the increasingly sophisticated tactics of threat actors. Your adversaries are highly capable, aren't they?

Curtis Simpson

>> Very much so.

>> And Armis' comprehensive AI-powered platform is designed to help security teams protect their entire attack surfaces and manage their organization's cyber risk exposure in real time. Growing demand for Armis' solution has resulted in exponential growth for the company. Wow, that sounds pretty impressive. What's your CISO, put your CISO hat on that, you're a recipient of that message. How do you respond?

Curtis Simpson

>> It's the reality we're facing today. So I was one of the first large customers of Armis, and the challenge I was facing was on the manufacturing side. So I worked for a food service distribution operation. I had no visibility into what was powering manufacturing or supply chain operations in general. And the conversation I had to have with my board was, if something moves from our IT environment over to that supply chain environment, I'm going to have to pick up a red phone and tell you that we now have a seven to eight figure challenge that I can do nothing about because I have none of the visibility. This is paramount today. The reality is there's too many things. Visibility isn't even the problem necessarily anymore. It's about, to Nadir's point, understanding what I have, but then what should I actually do that matters to the business now because the reality is there's too many problems sitting in front of us to actually solve them all. We have to pick the ones we need to solve today and then tomorrow we need to pick the ones we need to solve that day and on and on and on. And Armis is what powers that, and this is the message behind that at the end of the day.

>> Are you enabling, and I'd love to hear some proof points, customers to really be proactive. I mean, we all know you just react. It's a game of whack-a-mole, and it's just the way it is. Is that changing? Will AI change that? Will Armis change that? Give me some proof points.

>> So I think fundamentally the industry at large has fallen in love over the last decade with this idea of detection and response. We just put a lot of different tripwires and detections and respond to it really quick and we'll be okay. But the reality is that that worked maybe at a certain level of maturity or scale, but it doesn't really work anymore. Organizations have millions and millions of different exposures at any given point in time. They have different risks they need to manage. And you know what? Putting up a fence or actually shoring up a hole in your armor is way more cost-effective and frankly effective than waiting for something to happen and then responding to it mid-breach or mid-event. Now, I think that getting closer to that ideal vision of being able to manage like Curtis just said, that entire attack surface and what are the things I need to focus on today and how to action that, that's really Armis's mission. And yes, a heavy dose of AI will absolutely help get us there or accelerate us there. But even before that, in my opinion, it's the boring basics. It's managing vulnerabilities and risks and basically just focusing on remediating and not just on responding to active threats.

>> But how do you put a fence around? There is no perimeter anymore.

Curtis Simpson

>> No.

>> So what do you do? Just multiple fences where they need to be or what's the solution there?

>> Well, I'll start and you can definitely add to that, but I would say that it starts with understanding that attack surface. To your point, it's vast, it's dynamic, it's complex, but that doesn't mean it's unmeasurable. It doesn't mean that you can't have an intelligence understand it and still be able to point today what are the three holes that if I closed in that attack surface, I could be that much more protected than I was before. And it's the same rules as I heard this once in an analogy to your car. Your car doesn't need to be super protected. It just needs to be slightly harder to steal than the three other cars down the block. So ultimately you as an organization need just to keep chipping away at things, but do it intelligently, effectively, not just go down a list, but do it in a way that actually puts together guardrails, closes up different hatches and day over day just maneuvers through that.

>> I like that analogy. It's like running away from the bear. I have to be faster than you are.

Curtis Simpson

>> Yeah.

>> Exactly.

Curtis Simpson

>> And a lot of it too is understanding. So the problem is for the longest time we understood the technology problems within our environment, but we didn't really relate them back to the context of how we do business. The power is at the intersection point there and truly understanding what could, it's not just understanding what do I need to do today, but what could disrupt the business in the most material capacity possible, and how do I direct my resources and attention towards that? And much of what we're doing is bringing that context together in one place such that you can make those smart decisions 'cause there is no silver bullet, there's no single control, there's no single perimeter. It is about understanding where could the most damage be done and what do I do to reduce that damage? And that's the question we fundamentally as CISOs ask ourselves every single day, but it's the telemetry that matters behind it and the ability to rapidly relate to how we do business that enables us to tell the right stories to our partners within the operation that allow us to continue to progress.

>> So you guys are seeing rapid growth, that definitely got my attention. Talk about your platform, what's driving that growth?

>> I think the growth comes from the problem statement first and foremost. The reality is everything we're talking about here is not news to any CISO out there that needs to work. But at the same time, I think the problems are getting worse and worse because over the last few years, if we think about cyber security as a whole, it's gotten a hell of a lot more dangerous and harder than it used to be. It used to be that CISOs would tell themselves, I don't need to worry about nation states. Nation states, if they're out to get me, they're out to get me. But these days you can't afford not to. You're just as much as an organization, a target of cyber criminals as you are of nation states or affiliated groups. The use of both much more clever vulnerability exploits and a time to market of an exploit that's that much faster as well as the use of more and more AI. Even in that, we're seeing the beginning of AI platforms that can basically take advantage of all of these things combined and essentially assault at scale, attack surfaces all at once. All of these things are driving our growth. They're driving the growth of the industry at large. But I think especially for companies that can map out and help you actually remediate things, not just tell you about stuff but actually fix things. That's what's driving, I think, most of our growth from an outside-in perspective.

>> I mean that gets back to the proactivity as opposed to, "Hey, here's yet another alert." I mean, people just alert fatigue. I read a book last summer, a friend of mine wrote it, his first book. He's not a well-known author, but he was a tech guy who spent a lot of time in Israel, worked for EMC for years, buying companies, and spent a lot of time in Silicon Valley. The book was called A Restaurant in Jaffa, and basically it was this fictional story, but because he had a knowledge of tech and programming developers, et cetera, it was a fictional story about how this hacker group basically took over critical infrastructure and he got into it and gave some really plausible examples of how that could happen. And it really scared me and I was like, "Dude, how real is this?" And he said, "No, this is real." And so if you think about a scale of one to 10, how secure our critical infrastructure is, it ain't a 10 or a nine. Okay. So-

>> I'm glad you're not asking that as a question because that would be an awkward answer.

Curtis Simpson

>> I don't want to give you that number.

>> Yeah, it's a scary thing. But so this means we're talking about certainly a critical issue for nations, for the globe, for citizens all over the world. Your thoughts on the state of critical and for you don't have to go into give it a rating, but there's probably some industries that are stronger than others. I hope defense, I hope airlines, but there are many that may not be. How are you guys helping them solve that problem?

Curtis Simpson

>> It does go back to a lot of what we've said. So when you look at these environments today, so one of the terms that we use in this space is operational technology. This is technology that was built by the automobile industry decades ago, really at the beginning of the production line. Well, these are the technologies that critical infrastructure operations are using, and it was fine generally for years because they were isolated from everything else. But the reality is everything within every environment today is fundamentally connected. We have to be able to manage environments remotely. We have to be able to understand data coming out of environments. We have to feed them into different platforms. The problem fundamentally is not just the old technology, but how it's been intersected with everything else. So how we help critical infrastructure is first understand what you have, understand the attack surface, and then help you actually prioritize those efforts in a meaningful way. Because the reality too is in these environments, so we think about terms like patching. Well, in a traditional enterprise environment with traditional technology, apply a patch on 40 or 50-year-old technology, you don't apply a patch. It's about mitigations. So it's about understanding what you have. It's about understanding where you're exposed, but then it's about understanding to your earlier point, how do I proactively apply the right mitigations so I can actually defend this water treatment facility, this, and you name it, energy grid, against these types of attacks so that we're able to safeguard the citizens and all these capabilities that rely on them. That's fundamentally what we're enabling them to be able to deliver. And without technologies like ours, they've got disparate views into all of this that are not connected as such that you can understand how these systems can be disrupted. And that fundamentally is why we've seen some of what we've seen within the market.

>> Because 40, 50 years ago that critical infrastructure wasn't connected. Today somebody had the brilliant idea of connecting the grid to the internet, and it's like, oh, that sounds good.

Curtis Simpson

>> Exactly.

>> Oh, oops. But so it's this hybrid world where you've got that 40 to 50-year-old legacy, but increasingly you will have to apply patches to the new stuff that's going on there, right? Is that how we should be thinking about it?

>> Yes, but also I think just the fact that you understand that environment, that you understand the security controls that you have, that you're able to apply them smartly, that you're able to use them in a way that can really shield your environment, all of those things are riddled with both inefficiencies, areas where you just don't know. There's an entire realm that is just managing the stuff that you even have, even before you patch or do anything else beyond that. Of course, patching of course, the boring basics like I called them in the beginning, but even just understanding what you have and which security controls are at your disposal, it's understanding the battlefield and what you have on the board, that's already a lot. And that's something that I feel is a huge area of investment where we find ourselves in with critical infrastructure, but with organizations in general.

>> How much exposure can you give customers to the supply chain for that critical infrastructure?

>> I think quite a bit. I think both from the perspective of customers that rely on critical infrastructure, but also of the critical infrastructure companies and agencies and anything else themselves. Exposure ultimately, it might be a tough equation to quantify, but it is quantifiable. It's finite, it's discrete, it's quantifiable. So I think ultimately it measures on the level of visibility that you can provide out of the box, which is our core and bread and butter, but then the quantification, the prioritization, and then actually helping them technologically, but also processing people-wise to solve things. Once they start seeing that, okay, we've done this and risk actually got reduced, it reinforces itself. You can start getting people measuring impact instead of just alert fatigue or other things like that.

>> Because I would imagine that the supply chain, the emerging software supply chain for critical infrastructure is different than the software supply chain for an enterprise. Enterprise is open source. There's a lot of commercial off-the-shelf software. But now the entire world, Andreessen, everybody's a software company. Every company's a software company. Scares me a little bit because I oftentimes see non-tech companies building an app, and as a consumer you're like, "Wow, whoever built this just doesn't understand software." And so I'm applying that to the physical world, becoming digital. And they're not, certainly not security, and they're not software experts, they're not security experts. They'll hire some people in, they have a big vision and then they could end up exposing. So how do you think about that and what are you seeing in terms of the state of the digital and physical worlds coming together and those traditional legacy companies actually becoming digital? Are they ready for that?

Curtis Simpson

>> This is fundamentally why we exist. If you look at, so most of these, one of the interesting things when you look at say, critical infrastructure, as a CISO within that type of environment, historically, I've never owned the other side of the business or that corresponding risk. So when you think about it from that perspective, I've never owned it. Now I need to own it yesterday because the risk is sitting there, and as you think about this physical digital intersection, well, I just need to understand what it is. It's really just a new set of assets. It's a new set of technologies that I just need to embrace, understand they're part of the ecosystem, and then we need to do the things we talked about. It is why we exist. And I think what we've seen generally in the market is a lot of these companies recognize the fact that I don't know anything about any of what I just said, and I'm going to have to rely on the experts to help me actually get there. And that's fundamentally where we come in. We're not seeing anyone build what we're doing. We're seeing people acknowledge that they can't do what we're doing, and they need to leapfrog where they are today immediately.

>> Well, it's interesting though because the OT guys, they're engineers and engineers are, they want control of their stuff. They don't want you messing with it. So I mean it and SecOps, hard enough getting those guys together and bring in DevOps and the data team, and now you're saying, okay, all that is coming into OT with that control freak mindset, which I don't blame them by the way. So there's cultural aspects to becoming more safe as a nation, as a world, isn't there?

Curtis Simpson

>> It's actually frankly why it's astonishing how little focus is given to the actual remediation process and how to work between different teams and different cultures to get things done. I think that a lot of the focus these days for us on how to action, how to remediate, how to manage that very delicate process between different people that need to manage things together, give them views of the world that align with their perspective on what they're trying to get out of it, and bring those different functions closer together by not antagonizing each other with the system that this one wants to use and this one wants to use, but really create a workflow that accommodates all of these different needs is crucial. And it's frankly a very underserved area of cyber security as a whole. It's missing that entire point that you just made around bringing along different organizations to that journey because everybody cares about it. They just care about it differently.

>> You think AI will be a forcing function to make organizations completely rethink how they do things?

Curtis Simpson

>> It will be, and I think one of the biggest strengths you'll see in this conversation is actual meaningful guidance that takes your industry, your operating environment and consideration. Because the general challenge, it goes back to that, well, I used to just patch now, I can't patch any of these things. What do I actually do and what should I do? Now one of the powers of Armis is we are a passive technology. So within these types of operating environments, one of our successes has been we can convince the other side, being the OT engineers, to actually consider the technology. A, because it's not going to disrupt your environment, but B, it's actually going to solve some of your problems too. But it goes back to I had to sell this internally in terms of OT engineers adopting these capabilities to their benefit, and that is a big part of it. You have to ultimately get there to solve this problem, but sometimes you need the technology to bring you enough awareness to have a meaningful conversation with those teams. Actually, the reality we're facing is if you've never owned this before, you don't know enough to have a meaningful conversation, and you might be kicked out of the room faster than you really want to be. So a lot of where we help is bringing visibility to these CISOs to empower them to have meaningful conversations with their business partners to actually drive and direct change within these environments.

>> It's hard to get your hands around actually the size of the cybersecurity business. I mean, it ranges from $150 billion a year spent on cyber growing at low double digits. I think that's probably generally accepted number, but I've seen when you include internal spending it go up to a trillion. This whole conversation around critical infrastructure dramatically increases the TAM. I mean, a lot of times entrepreneurs say, "Look, I know it's huge. I don't try to size it. I could go to IDC or DAR or whatever." But on a relative basis, how do you think about that total available market? Is it double like the existing or are there more enterprises? So maybe not, but it's a significant uplift on the market opportunity, isn't it?

>> I think massively so I think that the more... You asked before about AI, I'll give you a slightly more, I don't know, far-reaching, but not that far away in the future future. I think AI, the way it works right now and the different applicability and use case within organizations will get us to a point very quickly where it's not about having data structures and databases and things everywhere. We won't have the tight controls and views that we currently have because there's no point. They're built for humans. But if you have AIs that can consume and contextualize all of that, what you'll start seeing is a complete disarray and dismantling of all the classic infrastructure elements that we already had. You asked about putting up walls and different things. There's not going to be even a territory anyway. It's just going to be all spread around. And in that kind of world, the amount of new challenges and new things that will be introduced into the environment and the mesh of cybersecurity into everyday life and all of these different aspects will be enormous. I think that the potential growth of the market, not only is it far from over, I would even argue that with all of these accelerated paces of other markets, it'll grow. It will grow faster than what we're even thinking.

>> It's interesting because the bromide in this business is cybersecurity can't be an afterthought. It has to be designed in from the beginning. Oftentimes it's not. In fact, I would argue it's almost never.

Curtis Simpson

>> Rarely.

>> And so what happens is the application developer has to worry about all this stuff, and it's so far removed from the core, and what you just described is the opposite, where AI is going to enable it to be designed in from the beginning, much closer to whatever the data, the critical infrastructure this floating perimeter embedded. You're already seeing it. You certainly see it in semiconductors with confidential computing, but that extends to everything, all parts of the stack. That's enormous.

Curtis Simpson

>> Yeah, the whole conversation has changed, quite frankly. I've been in enterprise CISO for a large portion of my life, and again, it's changed. There's a lot less selling having to be done now, and there's more questions being asked of us. What should we be doing? What actions should we be taking? How should we be thinking about this? Those are not questions that I was receiving through most of my career. Most of my career was, why are you here? What do we need to do? Why do we need to do it?

>> How long is this meeting?

Curtis Simpson

>> Exactly. Are we done yet? This was not anything anyone wanted to do. They saw me as a black box. We just do things and hopefully never speak for my early point in my career, but now we're fundamentally looking to subject matter experts like CISOs to actually direct that foundation because digital transformations combined with very destructive newsworthy events have entirely changed this conversation. We now know our business leaders, our technology leaders, know that the tip of the spear is in the cloud. They've seen what that tip of the spear looks like in the news when you don't secure it as the foundation and no one wants their burgeoning capabilities that they're broadcasting to the market to be utterly destroyed. The brand erosion that you're going to experience as part of that is now meaningfully understood whereas historically, it never was.

>> You're right, the cloud is the first line of defense, but there's a lot of lines behind it that are much more vulnerable.

Curtis Simpson

>> I often say, we added the cloud. We didn't move to the cloud. We have the cloud, we have the middleware, we have the mainframes, we have all of it now, and this is a lot of where we come in to help.

>> Guys, such an interesting conversation. You guys got a lot of momentum in the market. What's the future for Armis? You guys thinking public markets? Is that something that's on the radar?

>> I think the aim is to build ultimately a generational company, something that is very big and serves companies and does everything long-term. So going public is a typical step in that, and it's definitely what we're aiming towards. But ultimately, I think that market dynamics being what they are, everybody doesn't know even three months from now what's going to happen, let alone a year or two. But I would say that from a perspective where the company is marching towards generally being able to really take that vision of a future where you can actually remediate all of this stuff and actually fix things and build a platform, build a huge company behind that, that can really serve all of these different CISOs and enterprises out there. And yeah, go public definitely would be a personal and collective achievement that would be amazing to us. And another milestone on the way to building that long-standing generational business.

>> Yeah, I think those IPO markets, they're going to come back. The Fed's still in control, but we'll see. I think there are a lot of advantages to being a public company for your business and also for many of your employees can be game-changing, wealth-changing.

Curtis Simpson

>> For sure.

>> Amazing. Congratulations on all the success.

>> Thank you.

>> Really appreciate the support. Thanks for coming on theCUBE.

Curtis Simpson

>> Thanks for having us.

>> Thanks for having us.

>> All right. Keep it right there. This is Dave Vellante. Shelly Kramer and Dave Linthicum are also here. We're in Moscone West at RSAC 2024. We'll be right back.