RSA Conference 2024 | Scott Leach & Maheswaran Shanmugasundaram | Varonis

Clips
News
More from RSA Conference 2024

Scott Leach

Vice President, APAC

Varonis

Maheswaran Shanmugasundaram

Country Manager - India

Varonis

Strengthening data security in the age of generative AI

As corporate leaders prioritize generative artificial intelligence, the importance of data security in AI applications is increasingly emphasized to protect sensitive information.Cybersecurity is a data problem, and organizations need to understand where their data is, how it’s being used and who is accessing it to protect it properly, according to Scott Leach (pictured, left), vice president of APAC at Varonis Systems Inc.Varonis Systems’ Scott Leach, VP of APAC, and Maheswaran Shanmugasundaram country manager, India, talk to theCUBE about data security in AI.“If you think about what the threat actors are interested in today, it is all about data,” Leach said

play_circle_outline Introduction of speakers from Varonis

play_circle_outline The Significance of Managed Data Detection and Response: Addressing Challenges in Securing Dispersed Data

play_circle_outline Varonis' solutions: data visibility, access control, and information usage tracking

play_circle_outline Addressing Data Flow Challenges in Critical Infrastructure: How Varonis Identifies and Safeguards Sensitive Information

Info

Scott Leach & Maheswaran Shanmugasundaram | Varonis

Scott Leach

Vice President, APAC Varonis

Maheswaran Shanmugasundaram

Country Manager - India Varonis

search

>> Hi, everybody. Welcome to Moscone West. We're here at 2024. This is the Cyber Security Conference. My name is Dave Vellante, Shelly Kramer is also here with David Linthicum. I'm really excited to have Scott Leach in the house. He's the Vice President of APAC for Varonis, and Mahesh Shanmugasundaram, the Country Manager for India, both from Varonis. Gents, hopefully I got it right.

Maheswaran Shanmugasundaram

>> Absolutely right.

>> All

Maheswaran Shanmugasundaram

>> I'm surprised.

>> Welcome. Welcome to theCUBE. to have you guys. Welcome to the United States.

Scott Leach

>> Thanks for having us.We are welcome. You've got Australia and India.

Maheswaran Shanmugasundaram

>> Absolutely.

>> So you guys hanging? You doing okay?

Scott Leach

>> We're doing all right. Actually, we flew in Saturday night, so we're fairly acclimatized now the time zone, so we're doing better than expected.

>> Yeah, so the premise that we're going to talk about today is cyber security data problem. You guys are treating it as such. You can't... If you don't have really a data house in order, you're going to have trouble getting your cyber house in order. Explain that premise in a little bit more detail.

Scott Leach

>> Sure. If you think about what the threat actors are interested in today, it is all about data. Businesses are getting broken into because attackers want their data. And so if you don't understand is, if you don't understand where is exposed, if you don't understand how it's being used, how can you properly protect it? So that's part of the problem we help organizations solve.

>> And data's everywhere.

Maheswaran Shanmugasundaram

>> Absolutely.

>> Right? So it's very dispersed, so that makes the problem harder because the threat surface gets widened.

Maheswaran Shanmugasundaram

>> Absolutely.

>> What's your take on this for the perspective from the market in India?

Maheswaran Shanmugasundaram

>> Yeah, it's the same, almost like how it is globally, right? You named it. The attack surface around data has increased exponentially now. With data being everywhere, and users are accessing it from anywhere in any device, it becomes imperative for organizations to understand how are actors engaging with data? And is it risky or not. And what data are they engaging? And why are they engaging? Is it because that information is overexposed, or are they supposed to access, I think this problem is increasing more than what it was, and most security professionals are aware of it and they're looking to address this challenge.

>> One of the conversations we started having several years ago was cloud became this sort of first line of defense, and then it really put a lot of pressure on developers, that term shift left, meaning developers have to actually secure at the point of code because infrastructure is code. The cloud model is a shared responsibility model. Developers generally don't want to be worried about security. They want to be worried about writing code and now, so they got data to worry about, they got security to worry about, and they've got to deploy the infrastructure, granted it's easier with code, but of course, they also have to deliver it for the business. So it's a really complicated situation. Tell us a little bit more about how Varonis thinks about this problem.

Scott Leach

>> I think you need to think about it in terms of how do you protect the data. There are always lots of ways in whether you're coming in through an endpoint, whether you're coming in through cloud, whether you're coming in through network. But if a target's always data, you really need to focus first on protecting the data. One of the interesting trends we're observing at the moment is generative AI. So technologies like Copilot, there's a lot of talk in the market about how do we deploy technology like Copilot to surface our data. And one of the challenges we're hearing from a lot of our customers is generative AI technology makes it really easy for people to find an access data that they probably shouldn't have access to. We've seen examples in the market where maybe I'm a disgruntled worker and I want to ask how much is my boss being paid, or who else got a bonus last quarter? If I've got access to that information, GenAI technology makes it really easy for that to be returned to me. And so we're seeing a lot of interest in how can we deploy these technologies securely.

>> And so how do you guys help solve that problem?

Maheswaran Shanmugasundaram

>> Primarily through three ways, right? We help organizations know what data is important where all is it residing. Ensure that only right people have access to information with right permissions because we have to do this. Because when we perform assessments, we see close to 50 percentage of information being overexposed and people getting access to information irrespective of whether they need it or not for their job. So we help organizations to get that visibility. And lastly, which I think is very, very critical is to help organizations to track information usage patterns. Like say the way Mahesh would engage with data stores. Awareness is going to be drastically different if my credentials are with a hacker or it's used by a malware. So we help organizations to understand these information usage patterns, detect suspicious activity and contain it. So that's... Yeah.

>> So visibility, who has access, and then basically those usage patterns. And what you do with that data? Where does that go? How do you act on that?

Scott Leach

>> I'd probably simplify the message even further, right? I'd say it comes down to really three things, kind of find, fix, and alert. So how do you find the sensitive information across your business? How do you figure out what information there is exposed? And once you figure out the exposure, how do you fix it? How do you get back to that zero trust model for data so that I've only got the access to the information I need to do my job and not access to a whole lot more. Then once we fix the exposure, how do we alert when we see unusual access patterns occurring to data?

>> So that's a different sort of meaning of alert.

Scott Leach

>> Yeah.

>> It used to be a pager wakes you up in the middle of the night. Hey, turn this thing off because I'm getting so many false positives, but you're using it in a different context. Explain,

Scott Leach

>> Yeah, we're using it right? We're looking at what normal access to data looks like. And then when we see unusual access patterns to data, we're alerting on it. But we're not just alerting on we're not just throwing a whole lot of noise over the fence. We've invested in 247 managed data detection and response offering so that Varonis analysts are actually triaging and helping drive the investigations around those data focused alerts. So we're taking responsibility for helping secure our customer's data, not just inundating them with noise.

>> Go ahead, please.

Maheswaran Shanmugasundaram

>> I just want to add to what Scott mentioned. I think you touched upon it. Alerts, people get a lot of alerts, how much of that is noise? So it's critical to add enough context to an alert so people can act on it, right? And that's where I think we are significantly different. Since we understand data and we monitor data access patterns, we are able to add that missing context on what that particular threat is providing for their organization in terms of data. And that's where I think most of our customers see a lot of value. And like Scott mentioned, when this is compounded with our MDDR managed data detection and response service with cyber security skill shortage issue, we not just alert, but we also engage with them proactively communicate the top risks that we see through our platform and help them to manage and remediate it.

>> Years ago, when I was working at IDC, a global company, and there was always stark differences in adoption patterns and technology usage by region. And there's still some, but when Thomas Friedman wrote that book, the world is flat from a technology perspective, certainly cultural differences and local laws, much different, privacy laws take some time to filter through. They might start in the EU and filter across the globe. But generally speaking, access to technology has been pretty much democratized. So I'm wondering, when you guys talk to CISOs in the region and you talked to CISOs here, do they have the same problems? What kind of conversations are you having with them. And how are they the same? How are they different?

Scott Leach

>> I think from my perspective, they're largely the same across the region. I think as a cyber industry, we've kind of failed historically, right? I think we've spent a lot of time and a lot of money trying to stop the bad guys from breaking in. We've invested a lot in perimeter defenses, in endpoint, in monitoring networks, in putting in place firewalls, and we've lost sight of what is it the attackers are really after? And that is And I think across the world, CIOs, boards, executives now getting to terms with actually, we need to protect our data. We need to understand where it is. We need to understand what's sensitive, we need to understand how it's being used, and we need to make sure it's protected, and we're seeing that trend right across the region.

>> So I would say, and I said earlier today, Frank Slootman, former CEO of Snowflake said to me one time, I think he wrote this in his book, it wasn't just to me, I'm sure he said it to a lot of people, but if you have 10 priorities, you got none. And when you talk to ask him what their priorities are, there's a list, like 20 priorities. So very, very challenging. Where does data fit on that priority list?

Maheswaran Shanmugasundaram

>> I think it should always be the priority. And people, security practitioners are understanding that it has to be the top priority now, again, because of the way the business has evolved. Like I just mentioned earlier, since data is now everywhere, I firmly believe that cyber security was predominantly designed or most organizations approach cyber security to address these risks, the actor who's going to access the critical asset, how are they protecting the set, and the medium with which the actor is engaging with their set. So mostly cyber security controls were revolving around these. But if we focus on that, the key asset for organizations are always users and data. And if organizations make data as their focus, they, I think, would be able to probably establish a lot of controls which are meaningful, and we would be able to predict a lot of breaches and contain it before it creates a significant impact.

>> You guys are founded to secure data, so you're very biased, but I happen to be a data person, so I sort of agree with you. But now we have so now that's yet another data problem. So it's like this gift that keeps on giving to Varonis, but how are you thinking about the whole ascendancy of What kind of new data problems does that bring to light.

Scott Leach

>> So I think if you about data problem, historically, organizations always knew they had a lot of sensitive information buried across different systems, on-prem and in the cloud, but that data was often very difficult to find, right? Unless a user was going to go start browsing file servers and start trolling through SharePoint sites, the chances of them finding and exposing sensitive data were probably buried in the obscurity and challenges of just the mountain of data that organizations were sitting on. Problem with Gen.AI is that problem's gone away now. I can just ask it a really simple question. Show me all the usernames and passwords that I've got access to. Show me the information on that merger and acquisition we're thinking about making. Show me how much my boss is getting paid. Show me who's been complaining to HR. And if that information exists somewhere in the mountain of data and I've got access to it, GenAI will surface that data back to me. So it makes discovery of that sensitive information much, much easier.

Maheswaran Shanmugasundaram

>> And just what Scott mentioned, it's not about the user getting it. It also gets into the right? And what data gets into the LLM, god knows what happens with that, right? So it's critical for organizations to ensure that access permissions are enforced appropriately and they govern how is being used.that leak into the public domain. Last year at this event... The thing I love about theCUBE is you can develop patterns over time and you can see how things shift, but one of the big conversations last year was does AI generally, and specifically GenAI, give the advantage to attackers or defenders? And the consensus was at the time, initially it's going to be of benefit to attackers, but over time, defenders for things like security posture, the SecOps experience are going to... The pendulum will swing to defenders. Where are we in your view in that?

Scott Leach

>> I think it's still to be proven out, right? I think it's still early days. I think at the moment, we're still seeing a lot of benefit for attackers in gen AI technology, being able to get their hands very easily on sensitive information without having to do lots of reconnaissance. We've seen examples of them being able to use it to craft pretty compelling phishing emails to gain access into systems. And so I think we're seeing the attackers drive more of that early stage adoption of AI. I think businesses still tend to be a little bit conservative. One of the things we are seeing is a lot of these AI programs still stuck in pilot because organizations are worried about the security risks of deploying GenAI at scale across their businesses.

Maheswaran Shanmugasundaram

>> I agree with Scott. I think been always, I mean unfortunately, security or security practitioners try to defend against what hackers innovate, right? So that's happening. But I think AI specifically gives a unique opportunity for security practitioners to focus around data. And if they did that, they probably are establishing a proactive cybersecurity framework and understand more about what's happening around data and predict features and contain them.

>> As you guys know, cybersecurity industry is the worst in terms of buzzwords and acronyms that you got to look up all the time. Posture management, data security, posture management, relatively new, even though the concept of posture management's not new. I think it's Gartner's fault actually. They keep coming up with all these terms because they can make a lot of money by slicing the salami, and they do a good job of educating folks. But where do you guys see, with respect to data security, posture management? Again, relatively new concept. You guys are at the heart of that. What can you tell us?

Scott Leach

>> Look, I think it's a new term to describe a problem that's been around for a while, which is the one we've been talking about. It's, how does an organization get a handle on... What sensitive information have they got? Where is the exposure? How is it being used? And how do we mitigate that exposure through automation, and how do we alert on it when we see unusual activity occurring? I think as you say, it's a nice new term in the market to define a problem that's been around for a while. The problem is, how do we focus on protecting data?

Maheswaran Shanmugasundaram

>> And the reason probably why it's getting more popular now is because the problem is much bigger than what it was. Data was always within a fixed perimeter or an a set. Now, it's just everywhere, and it's very critical for organizations understand the posture. And probably that's why this term is there. But yeah, it's problem that existed and will continue to exist. It's important for organizations to understand posture around the critical data and manage it efficiently.

Scott Leach

>> And we're seeing regulators catch up, right? We're seeing increased regulation around data. We're seeing increased fines and penalties around organizations not doing the right thing with

>> Yeah.

Scott Leach

>> We've seen big in the market that have involved lots of people's personally identifiable information. I think there's a lot more awareness around the need to protect data. And as you say, the analysts are jumping on the back of that, and we might see another magic quadrant appear shortly in this space.

>> Yeah. you've heard it here first in Okay. What about the whole operations technology and critical infrastructure? To your point, Scott, a lot of the data used to be buried inside of applications, so it was somewhat hard to find. It was somewhat insulated. The same thing with a lot of critical infrastructure. It used to be air gapped, and now it's not anymore. Connect the grid to the internet. Hey, that's a good idea. Uh-oh. And so you see some of the concerns that brings up. Data's flowing everywhere. That just increases the risks by many orders of magnitude. What are you seeing in terms of the data flow there? Can you help with that problem?

Scott Leach

>> Look, we can definitely help with that problem. As Mahesh talked about earlier, it really is an attack surface problem. Data used to be just in a backend system, properly secured by IT. Now, you've got data everywhere, on-prem, in the cloud, in critical infrastructure systems that are now connected to the network. You've got collaborative applications like Office 365. You've got data in your SaaS applications like Salesforce and Box and and Jira, and it's a whole of data problem. that is part of the problem that Varonis helps to solve, is go out across all of those different data stores, help organizations identify where their sensitive data is, where it's exposed, and help automatically protect it.

>> So we talked about the acronym SUP earlier. You guys, all you have to do is put another D into the acronym, so MDR becomes MDDR.

Scott Leach

>> It does, yeah.

>> You guys had an announcement around managed data detection and response, MDDR. Tell us about that.

Scott Leach

>> Yeah, so if you think what was the, MDR space, the managed detection and response space, that was often focused on perimeter telemetry, right? It was organizations wanting to make sure that they had logs from their network, from their endpoints, from their firewalls, but often what was neglected there was any sort of data-related activity. And so that's really our focus as a business, is on making sure that we understand how users are interacting with data, and whether that access is normal or abnormal. And if it's abnormal, how do we then help organizations understand the risk and take action in response to the risk? So our offering is the first of its kind in the market where we've got a team of analysts working 247 looking at all of these data-focused alerting and helping our customers to triage those alerts, investigate those alerts, and then take action in response to the alerts that we're seeing.

Maheswaran Shanmugasundaram

>> And I think this is very critical because like you just mentioned, there's been so much noise that most SOC analysts are looking at what to prioritize is a big issue. The cybersecurity school shortage, it's even bigger a problem for them. So by just getting to understand what data is at because of the threat, and was there a material breach or not, it's going to help these SOC analysts to prioritize threats and manage them efficiently through our support. And that's the domain that we are operating through.

>> To me, anything you can do to affect the SOC analyst experience and improve it, clearly AI has the potential to do that. Manage services I've been a huge fan of for many, many years because that individual is just maxed out, and that just increases the risk. You guys look great, by the way, considering it's middle of your bedtime here. But what RSA? What's exciting to you? We'll close there.

Scott Leach

>> Look, I think just the scale of the event's exciting, right? I think we're talking before about there being maybe 45,people here this year, hundreds of vendors talking about new technologies. I think AI and data is what I'm most excited about this year. I think starting to see some of these technologies come together to deliver real outcomes for organizations to help them reduce their risk is what I'm most excited about seeing this year. How about you, Mahesh?

Maheswaran Shanmugasundaram

>> For me, it's just all about networking. I think there's a huge contingent from India. Customers, partners, they're here. We had a great opportunity to host most of them and introduce them with our execs. So I think I'm excited about networking and get our customers and partners from India connect with our executives and understand our vision.

>> Great. Well, thanks for the work that you do. I appreciate you guys coming on theCUBE and supporting our mission to serve our audience. Appreciate it.

Maheswaran Shanmugasundaram

>> Thank you

>> You bet. All right. And thank you for watching. We'll be right back. This is Dave Vellante, Shelly Kramer, and David Linthicum. You're watching theCUBE's coverage of RSA live from Moscone West. We'll be right back.

Scott Leach & Maheswaran Shanmugasundaram | Varonis

search

>> Hi, everybody. Welcome to Moscone West. We're here at 2024. This is the Cyber Security Conference. My name is Dave Vellante, Shelly Kramer is also here with David Linthicum. I'm really excited to have Scott Leach in the house. He's the Vice President of APAC for Varonis, and Mahesh Shanmugasundaram, the Country Manager for India, both from Varonis. Gents, hopefully I got it right.

Maheswaran Shanmugasundaram

>> Absolutely right.

>> All

Maheswaran Shanmugasundaram

>> I'm surprised.

>> Welcome. Welcome to theCUBE. to have you guys. Welcome to the United States.

Scott Leach

>> Thanks for having us.We are welcome. You've got Australia and India.

Maheswaran Shanmugasundaram

>> Absolutely.

>> So you guys hanging? You doing okay?

Scott Leach

>> We're doing all right. Actually, we flew in Saturday night, so we're fairly acclimatized now the time zone, so we're doing better than expected.

>> Yeah, so the premise that we're going to talk about today is cyber security data problem. You guys are treating it as such. You can't... If you don't have really a data house in order, you're going to have trouble getting your cyber house in order. Explain that premise in a little bit more detail.

Scott Leach

>> Sure. If you think about what the threat actors are interested in today, it is all about data. Businesses are getting broken into because attackers want their data. And so if you don't understand is, if you don't understand where is exposed, if you don't understand how it's being used, how can you properly protect it? So that's part of the problem we help organizations solve.

>> And data's everywhere.

Maheswaran Shanmugasundaram

>> Absolutely.

>> Right? So it's very dispersed, so that makes the problem harder because the threat surface gets widened.

Maheswaran Shanmugasundaram

>> Absolutely.

>> What's your take on this for the perspective from the market in India?

Maheswaran Shanmugasundaram

>> Yeah, it's the same, almost like how it is globally, right? You named it. The attack surface around data has increased exponentially now. With data being everywhere, and users are accessing it from anywhere in any device, it becomes imperative for organizations to understand how are actors engaging with data? And is it risky or not. And what data are they engaging? And why are they engaging? Is it because that information is overexposed, or are they supposed to access, I think this problem is increasing more than what it was, and most security professionals are aware of it and they're looking to address this challenge.

>> One of the conversations we started having several years ago was cloud became this sort of first line of defense, and then it really put a lot of pressure on developers, that term shift left, meaning developers have to actually secure at the point of code because infrastructure is code. The cloud model is a shared responsibility model. Developers generally don't want to be worried about security. They want to be worried about writing code and now, so they got data to worry about, they got security to worry about, and they've got to deploy the infrastructure, granted it's easier with code, but of course, they also have to deliver it for the business. So it's a really complicated situation. Tell us a little bit more about how Varonis thinks about this problem.

Scott Leach

>> I think you need to think about it in terms of how do you protect the data. There are always lots of ways in whether you're coming in through an endpoint, whether you're coming in through cloud, whether you're coming in through network. But if a target's always data, you really need to focus first on protecting the data. One of the interesting trends we're observing at the moment is generative AI. So technologies like Copilot, there's a lot of talk in the market about how do we deploy technology like Copilot to surface our data. And one of the challenges we're hearing from a lot of our customers is generative AI technology makes it really easy for people to find an access data that they probably shouldn't have access to. We've seen examples in the market where maybe I'm a disgruntled worker and I want to ask how much is my boss being paid, or who else got a bonus last quarter? If I've got access to that information, GenAI technology makes it really easy for that to be returned to me. And so we're seeing a lot of interest in how can we deploy these technologies securely.

>> And so how do you guys help solve that problem?

Maheswaran Shanmugasundaram

>> Primarily through three ways, right? We help organizations know what data is important where all is it residing. Ensure that only right people have access to information with right permissions because we have to do this. Because when we perform assessments, we see close to 50 percentage of information being overexposed and people getting access to information irrespective of whether they need it or not for their job. So we help organizations to get that visibility. And lastly, which I think is very, very critical is to help organizations to track information usage patterns. Like say the way Mahesh would engage with data stores. Awareness is going to be drastically different if my credentials are with a hacker or it's used by a malware. So we help organizations to understand these information usage patterns, detect suspicious activity and contain it. So that's... Yeah.

>> So visibility, who has access, and then basically those usage patterns. And what you do with that data? Where does that go? How do you act on that?

Scott Leach

>> I'd probably simplify the message even further, right? I'd say it comes down to really three things, kind of find, fix, and alert. So how do you find the sensitive information across your business? How do you figure out what information there is exposed? And once you figure out the exposure, how do you fix it? How do you get back to that zero trust model for data so that I've only got the access to the information I need to do my job and not access to a whole lot more. Then once we fix the exposure, how do we alert when we see unusual access patterns occurring to data?

>> So that's a different sort of meaning of alert.

Scott Leach

>> Yeah.

>> It used to be a pager wakes you up in the middle of the night. Hey, turn this thing off because I'm getting so many false positives, but you're using it in a different context. Explain,

Scott Leach

>> Yeah, we're using it right? We're looking at what normal access to data looks like. And then when we see unusual access patterns to data, we're alerting on it. But we're not just alerting on we're not just throwing a whole lot of noise over the fence. We've invested in 247 managed data detection and response offering so that Varonis analysts are actually triaging and helping drive the investigations around those data focused alerts. So we're taking responsibility for helping secure our customer's data, not just inundating them with noise.

>> Go ahead, please.

Maheswaran Shanmugasundaram

>> I just want to add to what Scott mentioned. I think you touched upon it. Alerts, people get a lot of alerts, how much of that is noise? So it's critical to add enough context to an alert so people can act on it, right? And that's where I think we are significantly different. Since we understand data and we monitor data access patterns, we are able to add that missing context on what that particular threat is providing for their organization in terms of data. And that's where I think most of our customers see a lot of value. And like Scott mentioned, when this is compounded with our MDDR managed data detection and response service with cyber security skill shortage issue, we not just alert, but we also engage with them proactively communicate the top risks that we see through our platform and help them to manage and remediate it.

>> Years ago, when I was working at IDC, a global company, and there was always stark differences in adoption patterns and technology usage by region. And there's still some, but when Thomas Friedman wrote that book, the world is flat from a technology perspective, certainly cultural differences and local laws, much different, privacy laws take some time to filter through. They might start in the EU and filter across the globe. But generally speaking, access to technology has been pretty much democratized. So I'm wondering, when you guys talk to CISOs in the region and you talked to CISOs here, do they have the same problems? What kind of conversations are you having with them. And how are they the same? How are they different?

Scott Leach

>> I think from my perspective, they're largely the same across the region. I think as a cyber industry, we've kind of failed historically, right? I think we've spent a lot of time and a lot of money trying to stop the bad guys from breaking in. We've invested a lot in perimeter defenses, in endpoint, in monitoring networks, in putting in place firewalls, and we've lost sight of what is it the attackers are really after? And that is And I think across the world, CIOs, boards, executives now getting to terms with actually, we need to protect our data. We need to understand where it is. We need to understand what's sensitive, we need to understand how it's being used, and we need to make sure it's protected, and we're seeing that trend right across the region.

>> So I would say, and I said earlier today, Frank Slootman, former CEO of Snowflake said to me one time, I think he wrote this in his book, it wasn't just to me, I'm sure he said it to a lot of people, but if you have 10 priorities, you got none. And when you talk to ask him what their priorities are, there's a list, like 20 priorities. So very, very challenging. Where does data fit on that priority list?

Maheswaran Shanmugasundaram

>> I think it should always be the priority. And people, security practitioners are understanding that it has to be the top priority now, again, because of the way the business has evolved. Like I just mentioned earlier, since data is now everywhere, I firmly believe that cyber security was predominantly designed or most organizations approach cyber security to address these risks, the actor who's going to access the critical asset, how are they protecting the set, and the medium with which the actor is engaging with their set. So mostly cyber security controls were revolving around these. But if we focus on that, the key asset for organizations are always users and data. And if organizations make data as their focus, they, I think, would be able to probably establish a lot of controls which are meaningful, and we would be able to predict a lot of breaches and contain it before it creates a significant impact.

>> You guys are founded to secure data, so you're very biased, but I happen to be a data person, so I sort of agree with you. But now we have so now that's yet another data problem. So it's like this gift that keeps on giving to Varonis, but how are you thinking about the whole ascendancy of What kind of new data problems does that bring to light.

Scott Leach

>> So I think if you about data problem, historically, organizations always knew they had a lot of sensitive information buried across different systems, on-prem and in the cloud, but that data was often very difficult to find, right? Unless a user was going to go start browsing file servers and start trolling through SharePoint sites, the chances of them finding and exposing sensitive data were probably buried in the obscurity and challenges of just the mountain of data that organizations were sitting on. Problem with Gen.AI is that problem's gone away now. I can just ask it a really simple question. Show me all the usernames and passwords that I've got access to. Show me the information on that merger and acquisition we're thinking about making. Show me how much my boss is getting paid. Show me who's been complaining to HR. And if that information exists somewhere in the mountain of data and I've got access to it, GenAI will surface that data back to me. So it makes discovery of that sensitive information much, much easier.

Maheswaran Shanmugasundaram

>> And just what Scott mentioned, it's not about the user getting it. It also gets into the right? And what data gets into the LLM, god knows what happens with that, right? So it's critical for organizations to ensure that access permissions are enforced appropriately and they govern how is being used.that leak into the public domain. Last year at this event... The thing I love about theCUBE is you can develop patterns over time and you can see how things shift, but one of the big conversations last year was does AI generally, and specifically GenAI, give the advantage to attackers or defenders? And the consensus was at the time, initially it's going to be of benefit to attackers, but over time, defenders for things like security posture, the SecOps experience are going to... The pendulum will swing to defenders. Where are we in your view in that?

Scott Leach

>> I think it's still to be proven out, right? I think it's still early days. I think at the moment, we're still seeing a lot of benefit for attackers in gen AI technology, being able to get their hands very easily on sensitive information without having to do lots of reconnaissance. We've seen examples of them being able to use it to craft pretty compelling phishing emails to gain access into systems. And so I think we're seeing the attackers drive more of that early stage adoption of AI. I think businesses still tend to be a little bit conservative. One of the things we are seeing is a lot of these AI programs still stuck in pilot because organizations are worried about the security risks of deploying GenAI at scale across their businesses.

Maheswaran Shanmugasundaram

>> I agree with Scott. I think been always, I mean unfortunately, security or security practitioners try to defend against what hackers innovate, right? So that's happening. But I think AI specifically gives a unique opportunity for security practitioners to focus around data. And if they did that, they probably are establishing a proactive cybersecurity framework and understand more about what's happening around data and predict features and contain them.

>> As you guys know, cybersecurity industry is the worst in terms of buzzwords and acronyms that you got to look up all the time. Posture management, data security, posture management, relatively new, even though the concept of posture management's not new. I think it's Gartner's fault actually. They keep coming up with all these terms because they can make a lot of money by slicing the salami, and they do a good job of educating folks. But where do you guys see, with respect to data security, posture management? Again, relatively new concept. You guys are at the heart of that. What can you tell us?

Scott Leach

>> Look, I think it's a new term to describe a problem that's been around for a while, which is the one we've been talking about. It's, how does an organization get a handle on... What sensitive information have they got? Where is the exposure? How is it being used? And how do we mitigate that exposure through automation, and how do we alert on it when we see unusual activity occurring? I think as you say, it's a nice new term in the market to define a problem that's been around for a while. The problem is, how do we focus on protecting data?

Maheswaran Shanmugasundaram

>> And the reason probably why it's getting more popular now is because the problem is much bigger than what it was. Data was always within a fixed perimeter or an a set. Now, it's just everywhere, and it's very critical for organizations understand the posture. And probably that's why this term is there. But yeah, it's problem that existed and will continue to exist. It's important for organizations to understand posture around the critical data and manage it efficiently.

Scott Leach

>> And we're seeing regulators catch up, right? We're seeing increased regulation around data. We're seeing increased fines and penalties around organizations not doing the right thing with

>> Yeah.

Scott Leach

>> We've seen big in the market that have involved lots of people's personally identifiable information. I think there's a lot more awareness around the need to protect data. And as you say, the analysts are jumping on the back of that, and we might see another magic quadrant appear shortly in this space.

>> Yeah. you've heard it here first in Okay. What about the whole operations technology and critical infrastructure? To your point, Scott, a lot of the data used to be buried inside of applications, so it was somewhat hard to find. It was somewhat insulated. The same thing with a lot of critical infrastructure. It used to be air gapped, and now it's not anymore. Connect the grid to the internet. Hey, that's a good idea. Uh-oh. And so you see some of the concerns that brings up. Data's flowing everywhere. That just increases the risks by many orders of magnitude. What are you seeing in terms of the data flow there? Can you help with that problem?

Scott Leach

>> Look, we can definitely help with that problem. As Mahesh talked about earlier, it really is an attack surface problem. Data used to be just in a backend system, properly secured by IT. Now, you've got data everywhere, on-prem, in the cloud, in critical infrastructure systems that are now connected to the network. You've got collaborative applications like Office 365. You've got data in your SaaS applications like Salesforce and Box and and Jira, and it's a whole of data problem. that is part of the problem that Varonis helps to solve, is go out across all of those different data stores, help organizations identify where their sensitive data is, where it's exposed, and help automatically protect it.

>> So we talked about the acronym SUP earlier. You guys, all you have to do is put another D into the acronym, so MDR becomes MDDR.

Scott Leach

>> It does, yeah.

>> You guys had an announcement around managed data detection and response, MDDR. Tell us about that.

Scott Leach

>> Yeah, so if you think what was the, MDR space, the managed detection and response space, that was often focused on perimeter telemetry, right? It was organizations wanting to make sure that they had logs from their network, from their endpoints, from their firewalls, but often what was neglected there was any sort of data-related activity. And so that's really our focus as a business, is on making sure that we understand how users are interacting with data, and whether that access is normal or abnormal. And if it's abnormal, how do we then help organizations understand the risk and take action in response to the risk? So our offering is the first of its kind in the market where we've got a team of analysts working 247 looking at all of these data-focused alerting and helping our customers to triage those alerts, investigate those alerts, and then take action in response to the alerts that we're seeing.

Maheswaran Shanmugasundaram

>> And I think this is very critical because like you just mentioned, there's been so much noise that most SOC analysts are looking at what to prioritize is a big issue. The cybersecurity school shortage, it's even bigger a problem for them. So by just getting to understand what data is at because of the threat, and was there a material breach or not, it's going to help these SOC analysts to prioritize threats and manage them efficiently through our support. And that's the domain that we are operating through.

>> To me, anything you can do to affect the SOC analyst experience and improve it, clearly AI has the potential to do that. Manage services I've been a huge fan of for many, many years because that individual is just maxed out, and that just increases the risk. You guys look great, by the way, considering it's middle of your bedtime here. But what RSA? What's exciting to you? We'll close there.

Scott Leach

>> Look, I think just the scale of the event's exciting, right? I think we're talking before about there being maybe 45,people here this year, hundreds of vendors talking about new technologies. I think AI and data is what I'm most excited about this year. I think starting to see some of these technologies come together to deliver real outcomes for organizations to help them reduce their risk is what I'm most excited about seeing this year. How about you, Mahesh?

Maheswaran Shanmugasundaram

>> For me, it's just all about networking. I think there's a huge contingent from India. Customers, partners, they're here. We had a great opportunity to host most of them and introduce them with our execs. So I think I'm excited about networking and get our customers and partners from India connect with our executives and understand our vision.

>> Great. Well, thanks for the work that you do. I appreciate you guys coming on theCUBE and supporting our mission to serve our audience. Appreciate it.

Maheswaran Shanmugasundaram

>> Thank you

>> You bet. All right. And thank you for watching. We'll be right back. This is Dave Vellante, Shelly Kramer, and David Linthicum. You're watching theCUBE's coverage of RSA live from Moscone West. We'll be right back.