RSA Conference 2024 | Art Gilliland & Phil Calvin | Delinea

Clips
News
More from RSA Conference 2024

Art Gilliland

CEO

Delinea

Phil Calvin

Chief Product Officer

Delinea

Privileged access management: Delinea’s strategy for tackling cloud-based identity risks

Delinea Inc. is leading the charge in privileged access management solutions, focusing on identity access management and the challenges of interconnected systems in the evolving digital landscape.As companies increasingly transition to cloud-based infrastructures, managing the surge in identities has become a critical concern. This is an important shift, especially considering the explosion in identities that businesses need to manage with the move to the cloud, according to Art Gilliland (pictured, right), chief executive officer of Delinea.Delinea’s Phil Calvin and Art Gilliland talk to theCUBE about privileged access management

play_circle_outline Discovering Delinea: The Significance of Identity Management in Today's Marketplace Explained

play_circle_outline Ensuring Secure Identity Management: Tackling Growing Threats as Cloud Adoption Soars

play_circle_outline Focus on helping customers simplify their security environment through authorization

play_circle_outline Use of AI in anomaly detection and behavior monitoring

play_circle_outline The excitement and innovation in the security industry

Info

Art Gilliland & Phil Calvin | Delinea

Art Gilliland

CEO Delinea

Phil Calvin

Chief Product Officer Delinea

search

>> Welcome back to theCube's coverage of RSA 2024. We're deep into day two. We're really excited to have Art Gilliland He's the Chief executive officer and Phil Calvin, the Chief product Officer at Delinea. Guys, welcome to theCube.

Art Gilliland

>> Thank you very much.

>> Thanks for coming on.

Art Gilliland

>> Good to be here. Thank you.

>> Let's start off with your business. You guys are identity specialists. Tell us where you fit in the marketplace.

Art Gilliland

>> Yeah, so if you think about identity, there's three big categories. Authentication, "I am Art, I can prove it." Authorization, what should Art be allowed to do, and governance or identity governance, so, "Tell me everything that Art has access to or the things he's touched over the last six months." And the reporting side of that. We are definitely square in the authorization space, and so we help to think about privilege and privilege management, so PAM is a big part of that product. And then we just made a recent acquisition and of a company called Fastpath, which takes us into the identity governance space.

>> So I want to ask you, so there's been efforts to sort of bring PAM and IAM together, but then that hasn't really taken hold. Why is that? What's special about PAM? How do you see the threats evolving in identity? Maybe you could connect those dots for our audience.

Art Gilliland

>> Yeah, I think if you think about authentication, so the IAM, identity access management part of that, there's a big part of that that's just infrastructure. So, "I need access to this thing and I need an account," and, "Here's your account." And that's that infrastructure part of it. PAM really focuses much more on the security problem, like what should you be allowed to do? How do I make sure that it's the right policy? Being able to set those policies for your super users. And you don't want those users to actually have access to those passwords. You want to control them centrally, you want to manage them centrally, you want to report and audit and compliance. And so that's a lot more of a security use case. And I think that's why you hear a lot about convergence, but you don't see that convergence there really.

>> So how do you see the threats in your space evolving? And then I really want to get into the product and the platform.

Art Gilliland

>> Yeah. Look, I think what's happening in the marketplace is you see this massive move from customers to the cloud, like SaaS applications is a big way. If you look at our company, almost the entire infrastructure of our company is run in SaaS, whether it's the quote to cash process or the dev process, all in SaaS. Which means a lot of your accounts are up there, it means all the interconnectedness that's happening in SaaS. And what that's done for customers, a huge explosion in the number of identities they need to manage, not just their human identities, the workforce and consultants that work in there, but also all these machine identities. So all the APIs that connect to each other and all these applications that are talking in the cloud. And so customers are having to deal with that. And they don't actually know where they all are. They don't have ways of controlling or managing them. Being able to find them and manage them is a big risk for them. And so what's happening is the adversary is going after that confusion, after all that interconnectedness and stealing passwords or stealing credentials. And so they don't have to break into your environment anymore, they just log in. And so real focus on that identity and identity security has been probably one of the top three issues for CSOs over the last five years.

>> Yeah, absolutely. The hackers are capitalizing on the chaos. So Phil, from an architectural standpoint, how do you think about building products, or maybe should I think of it as a platform? Platform or product? Let's start there. And then how do you think about architecting that?

Phil Calvin

>> So I'm the techie, so I'm going to say platform. And basically the way we've approached it is we have originally these two companies, Thychotic and Centrify, and we re-architected to build a cloud-native platform, and that's a bunch of technical gobbledygook, but what that gets you is a 99.9% uptime. You get the continuous push code to production. We are able to innovate extremely quickly with our customers and solve their use cases really quickly on the platform.

>> So the platform, control point is cloud-native and then I can run that anywhere, is that correct?

Phil Calvin

>> Well, we run the platform, we run it as a SaaS service and we can geographically run it anywhere. And in addition to the platform itself, what we do is we bring all the use case and capabilities onto the platform in an experience that is extremely easy to use, really quick to adopt. We're very focused on the user experience and the admin total cost. That gives our platform a distinct advantage.

>> So how are customers dealing with all this chaos? What's the current state? What's the ideal state you're trying to get them to?

Art Gilliland

>> Yeah, look, I think the current state is that they're flailing. You can't look at the news and think they've got their hands around this identity thing, they've got their hands around the security standpoint. And to be fair, the security industry is not helping them. We throw 100,000 different acronyms at our customers, and that creates a challenge. And so I think where we want to get them to is we want to move them to platforms that solve a problem, not a bunch of different small products, not a bunch of different industries. We actually want to be able to solve that problem over time. And so what Delinea is very focused on right now is, "How do I help you manage what your users should have access to, whether that user is a human or a machine? And can we set policies that make sense for what Art should be allowed to do or what this API should be allowed to do and who it should connect to?" And I think that is what we want to help customers get to, especially in a world where you don't own your infrastructure anymore. So the user and their interactions with data is going to be key, and being able to set policy and manage that is going to be the future that we want to try to get customers to.

>> And the name Delinea is because you delineate who has access to what, right?

Art Gilliland

>> Exactly right. Exactly right. That's where the name came from and we went through a whole process of renaming, and that made the most sense for our customers, really helping them delineate between what you should be allowed to do and what you shouldn't be.

>> I want to talk customer strategies, CISO strategies. There's a lot of talk, especially from some of the big guys, about consolidating. You certainly hear that a lot from the of Palo Alto, but the reality is customers are actually increasing the number of tools for a variety of reasons we can talk about. But are you able to help customers just simplify their environment, or is it really about just hardening the privileged access?

Art Gilliland

>> So look, I think what we want to try to do is help customers solve a problem across a whole bunch of different areas. And so what Delinea is focused on is that authorization space. And so that authorization could happen on your laptop or a computer, and the user's interaction with the applications there could happen in your interaction with SaaS, could happen with your contractors trying to get access to sensitive systems in your environment. And so it's really about setting policy around authorization. In the past, you would've bought one product for that. Another product for contractors, another product here. And what we're saying is it's actually trying to simplify the problem space around a category of problems around authorization for us. I think you look at other companies like Palo Alto, they were talking about the network connections and those connections or Zscaler with network connections or CrowdStrike at endpoint. We're saying identity is the heart of what security's going to look like in the future, and so that's why we're focused there.

>> So Phil, what do you see in these the big tech trends that are affecting security, enterprise IT? Would love to get your thoughts on AI and gen AI, where that fits in your world.

Phil Calvin

>> So I think the massive shift we're going is this transformation to the cloud. Every organization is doing it. Art mentioned about our infrastructure, but every organization is doing that transformation. And that just brings a ... Your security focus goes away from managing bits and bytes and managing networks and all that kind of stuff. The perimeter is no longer the perimeter of your VPN or your environment. The perimeter is what you're authorized to do. And so we think that's the central point of it. The trends that we're definitely seeing, we've got some very interesting investigations into AI. One in particular talk briefly about is we have the ability inside PAM to record the session that the user's actually done. And so you could imagine thousands of hours of recordings. We can actually apply an AI model to those sessions and get the anomaly detected down to maybe 10 hours. So it's a massive savings for an administrator that is trying to find out something that goes on because we've given them that information with AI. It's very targeted use. It's really, really powerful, and that's the type of innovation that I think we want to continue trying to do.

>> So how does that work? You're observing behavior?

Phil Calvin

>> Yeah, dropping into the technology a little bit. So we record a video session and we use OCR to return that recorded video session into a story, and then we apply an LLM to that story and we look for anomalies. So Phil normally logs into the server, just does his normal behavior. That's okay. He went in there once and he changed a DNS entry. That gets flagged by the AI, and all of a sudden the admin has ... instead of 1000 hours of sessions, they have maybe an hour or two hours that they can look at to find anomalous behavior.

>> And this is the use case for gen AI, LLM specifically?

Phil Calvin

>> Correct.

>> What are you using? It's all over the place, right? Llama 3 comes out and you're like, "Wow, that looks really interesting, and it's open source and it's actually just as good as GPT, and it's 70 billion and the smaller models." And so how do you sort through all that ping ponging?

Phil Calvin

>> I think first of all, we have some very, very smart technology people that are really plugged into what's doing, but I think that when you're building software, you have to be extremely deliberate about how you approach it. You can't react to the latest technology trend, you have to be focused on what are you using This particular thing, in our case, in the LLM that we're using, we're very focused on how we're training that model, which is really where the interesting thing comes out. And then you build good software around it. Building software is not about a technical buzzword, it's about the execution and diligence when you're doing it and really enabled by the cloud native investment that we talked about.

>> And because your dataset is very confined and constrained, I presume that largely eliminates or maybe completely eliminates the sort of problems that everybody has with LLMs, which is hallucinations and pulling stuff off the internet and making stuff up.

Phil Calvin

>> Yeah, correct. Our use of AI is isolated to what our customers are actually using, the sessions recording. It's not a general purpose AI model that is taking data from the public internet. There's two parts. There's the training of the model and the execution of the model. And that stuff happens in isolation with our customer's data. We're not co-mingling our customer's data with the public internet as an example.

>> Are you actually doing heavy duty training, or would you call it more fine-tuning?

Phil Calvin

>> The start was a lot of heavy duty training. Right now, we're into the refinement of the modeling and making sure-

>> So you had to get access to GPUs, presumably in the cloud?

Phil Calvin

>> Yeah.

>> Did you use the public cloud or some alternative cloud?

Phil Calvin

>> This is a little bit of an interesting story about our innovation. So again, I talk about the cloud native. We do hackathons with my engineering team. And so this idea came up and they started working on it using just general open source models. And we went from concept to something in production in about four or five weeks. That's just the rate of innovation that we're able to pull off. And it's evolved since then, and now it's starting to turn into a real product.

>> Open source has been amazing. You think about the impact that Linux had on the internet. It took a long time to emerge in the LAMP stack. It actually kind of neutralized Microsoft's dominance. A lot of people maybe remember that. The impact of open source in AI and LLMs is just amazing. You're talking about a year after GPT-4, Lama 3 comes out. The time is so compressed. So that's the one positive. Having said that, are there concerns that you have as a technology practitioner about open source, some of the fine print? I've talked to some customers say, "Even though we're not the size of ByteDance or Meta, we're a little bit worried that they could pull the rug out from underneath us." How do you think about that and address it?

Phil Calvin

>> I'll give you my perspective and then maybe Art can give you his. From our perspective, we have a very diligent process by which we integrate any open source, whatever it happens to be, into our process, and that has to go through a formal process that myself and our legal team and our security team and all that kind of stuff. So we have a formal process around that in terms of how we think about it. And I don't know if you want to talk about how you think about the business.

Art Gilliland

>> I think from our perspective on the business side, obviously it's about governance and security and who owns the data and where we do that. So before we launch a feature that is supported by some of this open source, we do a lot of diligence to make sure what's happening with our customer data. And we're super diligent about that. Because obviously if you're putting your things in the cloud, we need to protect that and we take that super seriously. It's probably our number one priority if you look at the security priority list is protecting our customer's data. And so making sure we have the legal frameworks for it, making sure we've invested heavily in our own investigation of where the data goes, how it gets trained. Which is why it's okay to practice in the public internet and do pilots and POCs there. But when you are going to build and run the thing yourself, you actually want that control. You want to be able to train the models yourself. One because it's more efficient, more cost-effective for the company, but also because it provides a lot more security and protection for their customer's data.

Phil Calvin

>> What is the fundamental salient ... maybe there's not one, but I'm sure there's many, because you're a platform, that enables your technology to be world-class? We can talk about the differentiators, but what's that secret sauce?

Phil Calvin

>> So I'll say it's not secret sauce. It's diligence and execution. Building software, if you do it right, takes investment. And I always use the terms of doing your exercise and eating your vegetables. The heavy lifting to do all of the automation and the scale and all that testing, that takes work. It's not secret sauce. It can't be done overnight and you can't pretend to do it. So if you have an old architecture and you just lift it and throw it in the cloud, you're going to have things like you need to update your software, it's going to take you half an hour to take it down. You do the investment properly and you do your diligence and you get what we have, which you can push software continuously and your customers can see continuous uptime.

Art Gilliland

>> And just to add to that, I think one of the challenges that you'll see in the space is if you were in a big, well-established company, you've got a lot of customers sitting on legacy infrastructure. And so just snapping your fingers and switching them over is hard. And so a lot of companies when they wanted to get through cloud fast, they basically took their on-premise thing and did some Kubernetes things and put stuff in containers and then put it in the cloud and said, "Oh, that's cloud native." That is not what we did. We literally started over, and for 18 months, we essentially rebuilt the guts of our product after the acquisition. And so you take a sideways step in terms of your innovation on your legacy products, but what it buys you in the future is being able to do four and a half nines of availability for your customers that you can deploy code in 30 minutes from the time the engineer finishes through all the QA and everything because built around automation, and your competitors just cannot do that. So unless you take that energy and really diligently rearchitect, you cannot be cloud-native just because you put some stuff in Kubernetes.

>> You're absolutely right. People took a wrap around their existing stack, shoved it in the cloud, say, "We're cloud too."

Art Gilliland

>> Exactly.

>> And then they paid all the penalty and then eventually they tried to get there, but they lost ground to some of their competitors. So the secret sauce really is, like you say, hard work, understanding how to build platforms. Cloud native is part of that. It's not like, "Oh, we invented something that's radical." We just did the work.

Phil Calvin

>> Well also, I think there's a part of it. You have to be aligned as a company. To go take that 18 months for myself and my team and my engineers to build this, that means that Art needed to be aligned to that as a strategy and recognize that this is building a long-term ... we use the term future-proof solution, but that has to be something ... It can't be just a technology decision. That's a business decision that Art and our board needs to be aligned behind, and that allows us to be successful.

Art Gilliland

>> But how do we get there? I think the big thing is why would you make that decision? It starts with our customers. You ask the customers what is it they need? And when you start talking about SaaS, they want, "Okay, make sure it's up all the time. What kind of security infrastructure do you have?" Features and functions will get developed over time. Like, yes, a deal here or there hinges on a feature, but there's core elements of things you have to deliver. And if customers are going to really take advantage of the cloud and the availability of the cloud and the flexibility and the scalability of the cloud, you have to do some things right, and I think that was the big driver of it. It starts with talking to your customer and really listening to what your customer needs.

>> So let's talk about the customer. What you're seeing there? Maybe we can take some examples. I'm always interested in the business case, how you justify this, what kind of returns people are seeing. What can you tell me?

Art Gilliland

>> Yeah. So in terms of PAM. We'll start with PAM and then we'll talk about SaaS because I think those are the two ROI choices that people try to make. The first one is really around insurance and cost savings. And I think unfortunately that's just true in the security space. You're buying these tools and putting them in place to lower your risk posture. And that risk posture helps you sell more potentially to your customers because they trust you more. It avoids the downside of a breach and all the costs associated with that. In particular in PAM, it's required for cyber insurance. And so you can actually cut your cyber insurance costs in half by having an effectively deployed PAM in your environment. And so a lot of those things, we talk about with customers in helping them build their business case internally. The second business case we help them do is that move from on-premise, running this yourself to SaaS. And the reality is we are investing heavily in our SaaS infrastructure and our cloud operations team and availability because it's our profit center. And so very few, if no customers can invest in the same way to the same level of diligence to keep their product up and running, to keep the system patched and all of that availability that they would get from the cloud. And so that is about uptime, it's about availability, it's about usability, it's about taking advantage of innovation that they just can't do. And so there are some, what I would call soft benefits that they also build into a business case, in particular when they move to cloud, as well as the hard costs of they don't have to own it, they don't have to upgrade it, they don't have to patch all this cost savings that would go into that for them on a human cost basis.

Art Gilliland

>> Okay. But it really is ... You're right, it's about the reduction in expected loss. Are you able to, even if it's anecdotal from your customers, get feedback that that's actually happening in the field?

Art Gilliland

>> Well, there's a real tangible dollar cost right now when you do it, because when you buy and put PAM in, you get a discount on your cyber insurance. And so that's real dollars. Yes, it's still connected to risk, because that's how your terms get built in an insurance world, but that's real money that comes back into the pocket of a company today. And so we see as much as 50%, sometimes more on the cost savings for cyber insurance just from PAM.

Art Gilliland

>> Really?

Art Gilliland

>> And so there's big cost savings-

Art Gilliland

>> So it's not like when I install the alarm -

Art Gilliland

>> No, you get a 5% discount. It's not 5%.

Phil Calvin

>> It's not even worth it.

Art Gilliland

>> We're talking big savings, because if you look at the big challenge for customers with breaches, every single breach that occurs is an identity based breach, almost every single one, like in the high nineties. And so being more secure, really working with two-factor authentication, really working on privilege management allows you to control the blast radius for these breaches. They may still get in, but they can't elevate privileges, they can't move around the organization as easily. And so the cost of breaches radically comes down for customers, which is why insurance gives such a big discount.

>> That's interesting. Last Saturday, the Berkshire Hathaway annual meeting was on, which really interrupted my handicapping for the Kentucky Derby, which is why I lost my anyway. And Ajit Jain, who runs their insurance business, he got a question on cyber insurance, and basically his answer was very negative. "We hate this business. We assume we're going to lose money, but we got to do it. It's obviously a hot area."

Art Gilliland

>> It's very hard to underwrite.

>> Yeah. And then we had a company called At-Bay on earlier this week, and they basically combined cyber insurance and they have a managed service as well, but they were basically saying what you're saying, "We can dramatically lower the risk profile if the customer does these things." And obviously PAM is one of the harder things to do, and by 50% savings, that's substantial.

Art Gilliland

>> Yeah, it's big savings. I know that was true for our renewal, and I know it's true for a lot of our customer's renewals.

>> How's the conference going? There's like ... Crazy. This is back to pre-COVID levels. A lot of noise. Where's the signal? How do you guys differentiate from all this noise?

Art Gilliland

>> Yeah, look, I think the reality is there's a bunch of learning that happens in the conference just by going to see the vendors, but a lot of it is the interaction with the customers and the interactions we can have with our partners. You come to RSA, yes, there's some learning that happens in the floor, but the real value of it is you can do six or eight months worth of meetings in five days. And so yeah, you sort of wear yourself out, but people are excited about it. Identity security is one of the top three priorities for CISOs. And so the number of meetings, the number of interactions you can have with customers and partners at a show like this is just extraordinary, which is why we invest in it.

>> Last word?

Phil Calvin

>> Last word. To me, it's an exciting show. I love to see some of the innovation. As a product guy, I like to look at and see what the small companies are doing just to see where they're thinking. That's always really interesting to me. And I spend a lot of time, obviously with customers and listening to what their challenges are and figuring out ways we can help them get more secure.

>> Anything stand out in particular, any tech that-

Phil Calvin

>> Nothing yet....

>> caught your eye

Phil Calvin

>> Other than the Delinea platform. That really stood out.

>> There you go. All right.

Art Gilliland

>> It's funny to see how much AI is out there. Every RSA has a theme, and so obviously AI is the big theme, and you're not a company if you don't talk about it right now, but we'll see how much money it makes customers over time.

>> Yeah. We did a survey with our partner, ETR prior to RSA. About half the respondents were attending, and of course the number one thing they wanted to see was what's happening with AI and security.

Art Gilliland

>> Yeah. Huge opportunity for really driving automation, real huge opportunity for cost savings, I think for customers, but also a huge opportunity for the adversary to automate their side of the house too, so it increases risk. So I think it's going to be still more of attrition.

>> Well, but last year there was certainly AI talk, but it was more, "Okay, the adversary's better phishing, and we think AI has potential." Now, there's a lot of talk about securing the AI, and AI doing things that aren't intended and needs to approach security differently. So that is new here.

Art Gilliland

>> It's healthy, actually. I think one of the things that I believe is true and has been true over the last flow of all these big platform shifts, AI is the first platform shift that I've seen where security is starting to be thought of before it gets deployed. Whereas cloud was adopted superfast. These technology big trends that change the world, they get adopted and then they're like, "Oh, I forgot about security." That, I think is happening a little differently here. Yes, the models have to get invented, but before people are using it now they're really thinking about security, which is great for us.

>> That's very true. Internet, mobile apps, big data, it was all this code of cloud, there was always shadow activities, and there's definitely shadow AI, but people are watching now saying, "Whoa, hold on." And you hear these stories and-

Art Gilliland

>> Companies are getting really smart about it-...

>> very much aware of it....

Art Gilliland

>> and they should because it's super powerful, but also could be pretty dangerous.

>> Yeah, definitely. Guys, thanks so much for coming to theCUBE. Really appreciate your time.

Art Gilliland

>> It's really been great. Thank you.

>> Appreciate it. Thank you. Okay. Keep it right there. We'll be back, wall to wall coverage. We're deep into day two. theCUBE at RSAC 2024. We'll be right back.

Art Gilliland & Phil Calvin | Delinea

search

>> Welcome back to theCube's coverage of RSA 2024. We're deep into day two. We're really excited to have Art Gilliland He's the Chief executive officer and Phil Calvin, the Chief product Officer at Delinea. Guys, welcome to theCube.

Art Gilliland

>> Thank you very much.

>> Thanks for coming on.

Art Gilliland

>> Good to be here. Thank you.

>> Let's start off with your business. You guys are identity specialists. Tell us where you fit in the marketplace.

Art Gilliland

>> Yeah, so if you think about identity, there's three big categories. Authentication, "I am Art, I can prove it." Authorization, what should Art be allowed to do, and governance or identity governance, so, "Tell me everything that Art has access to or the things he's touched over the last six months." And the reporting side of that. We are definitely square in the authorization space, and so we help to think about privilege and privilege management, so PAM is a big part of that product. And then we just made a recent acquisition and of a company called Fastpath, which takes us into the identity governance space.

>> So I want to ask you, so there's been efforts to sort of bring PAM and IAM together, but then that hasn't really taken hold. Why is that? What's special about PAM? How do you see the threats evolving in identity? Maybe you could connect those dots for our audience.

Art Gilliland

>> Yeah, I think if you think about authentication, so the IAM, identity access management part of that, there's a big part of that that's just infrastructure. So, "I need access to this thing and I need an account," and, "Here's your account." And that's that infrastructure part of it. PAM really focuses much more on the security problem, like what should you be allowed to do? How do I make sure that it's the right policy? Being able to set those policies for your super users. And you don't want those users to actually have access to those passwords. You want to control them centrally, you want to manage them centrally, you want to report and audit and compliance. And so that's a lot more of a security use case. And I think that's why you hear a lot about convergence, but you don't see that convergence there really.

>> So how do you see the threats in your space evolving? And then I really want to get into the product and the platform.

Art Gilliland

>> Yeah. Look, I think what's happening in the marketplace is you see this massive move from customers to the cloud, like SaaS applications is a big way. If you look at our company, almost the entire infrastructure of our company is run in SaaS, whether it's the quote to cash process or the dev process, all in SaaS. Which means a lot of your accounts are up there, it means all the interconnectedness that's happening in SaaS. And what that's done for customers, a huge explosion in the number of identities they need to manage, not just their human identities, the workforce and consultants that work in there, but also all these machine identities. So all the APIs that connect to each other and all these applications that are talking in the cloud. And so customers are having to deal with that. And they don't actually know where they all are. They don't have ways of controlling or managing them. Being able to find them and manage them is a big risk for them. And so what's happening is the adversary is going after that confusion, after all that interconnectedness and stealing passwords or stealing credentials. And so they don't have to break into your environment anymore, they just log in. And so real focus on that identity and identity security has been probably one of the top three issues for CSOs over the last five years.

>> Yeah, absolutely. The hackers are capitalizing on the chaos. So Phil, from an architectural standpoint, how do you think about building products, or maybe should I think of it as a platform? Platform or product? Let's start there. And then how do you think about architecting that?

Phil Calvin

>> So I'm the techie, so I'm going to say platform. And basically the way we've approached it is we have originally these two companies, Thychotic and Centrify, and we re-architected to build a cloud-native platform, and that's a bunch of technical gobbledygook, but what that gets you is a 99.9% uptime. You get the continuous push code to production. We are able to innovate extremely quickly with our customers and solve their use cases really quickly on the platform.

>> So the platform, control point is cloud-native and then I can run that anywhere, is that correct?

Phil Calvin

>> Well, we run the platform, we run it as a SaaS service and we can geographically run it anywhere. And in addition to the platform itself, what we do is we bring all the use case and capabilities onto the platform in an experience that is extremely easy to use, really quick to adopt. We're very focused on the user experience and the admin total cost. That gives our platform a distinct advantage.

>> So how are customers dealing with all this chaos? What's the current state? What's the ideal state you're trying to get them to?

Art Gilliland

>> Yeah, look, I think the current state is that they're flailing. You can't look at the news and think they've got their hands around this identity thing, they've got their hands around the security standpoint. And to be fair, the security industry is not helping them. We throw 100,000 different acronyms at our customers, and that creates a challenge. And so I think where we want to get them to is we want to move them to platforms that solve a problem, not a bunch of different small products, not a bunch of different industries. We actually want to be able to solve that problem over time. And so what Delinea is very focused on right now is, "How do I help you manage what your users should have access to, whether that user is a human or a machine? And can we set policies that make sense for what Art should be allowed to do or what this API should be allowed to do and who it should connect to?" And I think that is what we want to help customers get to, especially in a world where you don't own your infrastructure anymore. So the user and their interactions with data is going to be key, and being able to set policy and manage that is going to be the future that we want to try to get customers to.

>> And the name Delinea is because you delineate who has access to what, right?

Art Gilliland

>> Exactly right. Exactly right. That's where the name came from and we went through a whole process of renaming, and that made the most sense for our customers, really helping them delineate between what you should be allowed to do and what you shouldn't be.

>> I want to talk customer strategies, CISO strategies. There's a lot of talk, especially from some of the big guys, about consolidating. You certainly hear that a lot from the of Palo Alto, but the reality is customers are actually increasing the number of tools for a variety of reasons we can talk about. But are you able to help customers just simplify their environment, or is it really about just hardening the privileged access?

Art Gilliland

>> So look, I think what we want to try to do is help customers solve a problem across a whole bunch of different areas. And so what Delinea is focused on is that authorization space. And so that authorization could happen on your laptop or a computer, and the user's interaction with the applications there could happen in your interaction with SaaS, could happen with your contractors trying to get access to sensitive systems in your environment. And so it's really about setting policy around authorization. In the past, you would've bought one product for that. Another product for contractors, another product here. And what we're saying is it's actually trying to simplify the problem space around a category of problems around authorization for us. I think you look at other companies like Palo Alto, they were talking about the network connections and those connections or Zscaler with network connections or CrowdStrike at endpoint. We're saying identity is the heart of what security's going to look like in the future, and so that's why we're focused there.

>> So Phil, what do you see in these the big tech trends that are affecting security, enterprise IT? Would love to get your thoughts on AI and gen AI, where that fits in your world.

Phil Calvin

>> So I think the massive shift we're going is this transformation to the cloud. Every organization is doing it. Art mentioned about our infrastructure, but every organization is doing that transformation. And that just brings a ... Your security focus goes away from managing bits and bytes and managing networks and all that kind of stuff. The perimeter is no longer the perimeter of your VPN or your environment. The perimeter is what you're authorized to do. And so we think that's the central point of it. The trends that we're definitely seeing, we've got some very interesting investigations into AI. One in particular talk briefly about is we have the ability inside PAM to record the session that the user's actually done. And so you could imagine thousands of hours of recordings. We can actually apply an AI model to those sessions and get the anomaly detected down to maybe 10 hours. So it's a massive savings for an administrator that is trying to find out something that goes on because we've given them that information with AI. It's very targeted use. It's really, really powerful, and that's the type of innovation that I think we want to continue trying to do.

>> So how does that work? You're observing behavior?

Phil Calvin

>> Yeah, dropping into the technology a little bit. So we record a video session and we use OCR to return that recorded video session into a story, and then we apply an LLM to that story and we look for anomalies. So Phil normally logs into the server, just does his normal behavior. That's okay. He went in there once and he changed a DNS entry. That gets flagged by the AI, and all of a sudden the admin has ... instead of 1000 hours of sessions, they have maybe an hour or two hours that they can look at to find anomalous behavior.

>> And this is the use case for gen AI, LLM specifically?

Phil Calvin

>> Correct.

>> What are you using? It's all over the place, right? Llama 3 comes out and you're like, "Wow, that looks really interesting, and it's open source and it's actually just as good as GPT, and it's 70 billion and the smaller models." And so how do you sort through all that ping ponging?

Phil Calvin

>> I think first of all, we have some very, very smart technology people that are really plugged into what's doing, but I think that when you're building software, you have to be extremely deliberate about how you approach it. You can't react to the latest technology trend, you have to be focused on what are you using This particular thing, in our case, in the LLM that we're using, we're very focused on how we're training that model, which is really where the interesting thing comes out. And then you build good software around it. Building software is not about a technical buzzword, it's about the execution and diligence when you're doing it and really enabled by the cloud native investment that we talked about.

>> And because your dataset is very confined and constrained, I presume that largely eliminates or maybe completely eliminates the sort of problems that everybody has with LLMs, which is hallucinations and pulling stuff off the internet and making stuff up.

Phil Calvin

>> Yeah, correct. Our use of AI is isolated to what our customers are actually using, the sessions recording. It's not a general purpose AI model that is taking data from the public internet. There's two parts. There's the training of the model and the execution of the model. And that stuff happens in isolation with our customer's data. We're not co-mingling our customer's data with the public internet as an example.

>> Are you actually doing heavy duty training, or would you call it more fine-tuning?

Phil Calvin

>> The start was a lot of heavy duty training. Right now, we're into the refinement of the modeling and making sure-

>> So you had to get access to GPUs, presumably in the cloud?

Phil Calvin

>> Yeah.

>> Did you use the public cloud or some alternative cloud?

Phil Calvin

>> This is a little bit of an interesting story about our innovation. So again, I talk about the cloud native. We do hackathons with my engineering team. And so this idea came up and they started working on it using just general open source models. And we went from concept to something in production in about four or five weeks. That's just the rate of innovation that we're able to pull off. And it's evolved since then, and now it's starting to turn into a real product.

>> Open source has been amazing. You think about the impact that Linux had on the internet. It took a long time to emerge in the LAMP stack. It actually kind of neutralized Microsoft's dominance. A lot of people maybe remember that. The impact of open source in AI and LLMs is just amazing. You're talking about a year after GPT-4, Lama 3 comes out. The time is so compressed. So that's the one positive. Having said that, are there concerns that you have as a technology practitioner about open source, some of the fine print? I've talked to some customers say, "Even though we're not the size of ByteDance or Meta, we're a little bit worried that they could pull the rug out from underneath us." How do you think about that and address it?

Phil Calvin

>> I'll give you my perspective and then maybe Art can give you his. From our perspective, we have a very diligent process by which we integrate any open source, whatever it happens to be, into our process, and that has to go through a formal process that myself and our legal team and our security team and all that kind of stuff. So we have a formal process around that in terms of how we think about it. And I don't know if you want to talk about how you think about the business.

Art Gilliland

>> I think from our perspective on the business side, obviously it's about governance and security and who owns the data and where we do that. So before we launch a feature that is supported by some of this open source, we do a lot of diligence to make sure what's happening with our customer data. And we're super diligent about that. Because obviously if you're putting your things in the cloud, we need to protect that and we take that super seriously. It's probably our number one priority if you look at the security priority list is protecting our customer's data. And so making sure we have the legal frameworks for it, making sure we've invested heavily in our own investigation of where the data goes, how it gets trained. Which is why it's okay to practice in the public internet and do pilots and POCs there. But when you are going to build and run the thing yourself, you actually want that control. You want to be able to train the models yourself. One because it's more efficient, more cost-effective for the company, but also because it provides a lot more security and protection for their customer's data.

Phil Calvin

>> What is the fundamental salient ... maybe there's not one, but I'm sure there's many, because you're a platform, that enables your technology to be world-class? We can talk about the differentiators, but what's that secret sauce?

Phil Calvin

>> So I'll say it's not secret sauce. It's diligence and execution. Building software, if you do it right, takes investment. And I always use the terms of doing your exercise and eating your vegetables. The heavy lifting to do all of the automation and the scale and all that testing, that takes work. It's not secret sauce. It can't be done overnight and you can't pretend to do it. So if you have an old architecture and you just lift it and throw it in the cloud, you're going to have things like you need to update your software, it's going to take you half an hour to take it down. You do the investment properly and you do your diligence and you get what we have, which you can push software continuously and your customers can see continuous uptime.

Art Gilliland

>> And just to add to that, I think one of the challenges that you'll see in the space is if you were in a big, well-established company, you've got a lot of customers sitting on legacy infrastructure. And so just snapping your fingers and switching them over is hard. And so a lot of companies when they wanted to get through cloud fast, they basically took their on-premise thing and did some Kubernetes things and put stuff in containers and then put it in the cloud and said, "Oh, that's cloud native." That is not what we did. We literally started over, and for 18 months, we essentially rebuilt the guts of our product after the acquisition. And so you take a sideways step in terms of your innovation on your legacy products, but what it buys you in the future is being able to do four and a half nines of availability for your customers that you can deploy code in 30 minutes from the time the engineer finishes through all the QA and everything because built around automation, and your competitors just cannot do that. So unless you take that energy and really diligently rearchitect, you cannot be cloud-native just because you put some stuff in Kubernetes.

>> You're absolutely right. People took a wrap around their existing stack, shoved it in the cloud, say, "We're cloud too."

Art Gilliland

>> Exactly.

>> And then they paid all the penalty and then eventually they tried to get there, but they lost ground to some of their competitors. So the secret sauce really is, like you say, hard work, understanding how to build platforms. Cloud native is part of that. It's not like, "Oh, we invented something that's radical." We just did the work.

Phil Calvin

>> Well also, I think there's a part of it. You have to be aligned as a company. To go take that 18 months for myself and my team and my engineers to build this, that means that Art needed to be aligned to that as a strategy and recognize that this is building a long-term ... we use the term future-proof solution, but that has to be something ... It can't be just a technology decision. That's a business decision that Art and our board needs to be aligned behind, and that allows us to be successful.

Art Gilliland

>> But how do we get there? I think the big thing is why would you make that decision? It starts with our customers. You ask the customers what is it they need? And when you start talking about SaaS, they want, "Okay, make sure it's up all the time. What kind of security infrastructure do you have?" Features and functions will get developed over time. Like, yes, a deal here or there hinges on a feature, but there's core elements of things you have to deliver. And if customers are going to really take advantage of the cloud and the availability of the cloud and the flexibility and the scalability of the cloud, you have to do some things right, and I think that was the big driver of it. It starts with talking to your customer and really listening to what your customer needs.

>> So let's talk about the customer. What you're seeing there? Maybe we can take some examples. I'm always interested in the business case, how you justify this, what kind of returns people are seeing. What can you tell me?

Art Gilliland

>> Yeah. So in terms of PAM. We'll start with PAM and then we'll talk about SaaS because I think those are the two ROI choices that people try to make. The first one is really around insurance and cost savings. And I think unfortunately that's just true in the security space. You're buying these tools and putting them in place to lower your risk posture. And that risk posture helps you sell more potentially to your customers because they trust you more. It avoids the downside of a breach and all the costs associated with that. In particular in PAM, it's required for cyber insurance. And so you can actually cut your cyber insurance costs in half by having an effectively deployed PAM in your environment. And so a lot of those things, we talk about with customers in helping them build their business case internally. The second business case we help them do is that move from on-premise, running this yourself to SaaS. And the reality is we are investing heavily in our SaaS infrastructure and our cloud operations team and availability because it's our profit center. And so very few, if no customers can invest in the same way to the same level of diligence to keep their product up and running, to keep the system patched and all of that availability that they would get from the cloud. And so that is about uptime, it's about availability, it's about usability, it's about taking advantage of innovation that they just can't do. And so there are some, what I would call soft benefits that they also build into a business case, in particular when they move to cloud, as well as the hard costs of they don't have to own it, they don't have to upgrade it, they don't have to patch all this cost savings that would go into that for them on a human cost basis.

Art Gilliland

>> Okay. But it really is ... You're right, it's about the reduction in expected loss. Are you able to, even if it's anecdotal from your customers, get feedback that that's actually happening in the field?

Art Gilliland

>> Well, there's a real tangible dollar cost right now when you do it, because when you buy and put PAM in, you get a discount on your cyber insurance. And so that's real dollars. Yes, it's still connected to risk, because that's how your terms get built in an insurance world, but that's real money that comes back into the pocket of a company today. And so we see as much as 50%, sometimes more on the cost savings for cyber insurance just from PAM.

Art Gilliland

>> Really?

Art Gilliland

>> And so there's big cost savings-

Art Gilliland

>> So it's not like when I install the alarm -

Art Gilliland

>> No, you get a 5% discount. It's not 5%.

Phil Calvin

>> It's not even worth it.

Art Gilliland

>> We're talking big savings, because if you look at the big challenge for customers with breaches, every single breach that occurs is an identity based breach, almost every single one, like in the high nineties. And so being more secure, really working with two-factor authentication, really working on privilege management allows you to control the blast radius for these breaches. They may still get in, but they can't elevate privileges, they can't move around the organization as easily. And so the cost of breaches radically comes down for customers, which is why insurance gives such a big discount.

>> That's interesting. Last Saturday, the Berkshire Hathaway annual meeting was on, which really interrupted my handicapping for the Kentucky Derby, which is why I lost my anyway. And Ajit Jain, who runs their insurance business, he got a question on cyber insurance, and basically his answer was very negative. "We hate this business. We assume we're going to lose money, but we got to do it. It's obviously a hot area."

Art Gilliland

>> It's very hard to underwrite.

>> Yeah. And then we had a company called At-Bay on earlier this week, and they basically combined cyber insurance and they have a managed service as well, but they were basically saying what you're saying, "We can dramatically lower the risk profile if the customer does these things." And obviously PAM is one of the harder things to do, and by 50% savings, that's substantial.

Art Gilliland

>> Yeah, it's big savings. I know that was true for our renewal, and I know it's true for a lot of our customer's renewals.

>> How's the conference going? There's like ... Crazy. This is back to pre-COVID levels. A lot of noise. Where's the signal? How do you guys differentiate from all this noise?

Art Gilliland

>> Yeah, look, I think the reality is there's a bunch of learning that happens in the conference just by going to see the vendors, but a lot of it is the interaction with the customers and the interactions we can have with our partners. You come to RSA, yes, there's some learning that happens in the floor, but the real value of it is you can do six or eight months worth of meetings in five days. And so yeah, you sort of wear yourself out, but people are excited about it. Identity security is one of the top three priorities for CISOs. And so the number of meetings, the number of interactions you can have with customers and partners at a show like this is just extraordinary, which is why we invest in it.

>> Last word?

Phil Calvin

>> Last word. To me, it's an exciting show. I love to see some of the innovation. As a product guy, I like to look at and see what the small companies are doing just to see where they're thinking. That's always really interesting to me. And I spend a lot of time, obviously with customers and listening to what their challenges are and figuring out ways we can help them get more secure.

>> Anything stand out in particular, any tech that-

Phil Calvin

>> Nothing yet....

>> caught your eye

Phil Calvin

>> Other than the Delinea platform. That really stood out.

>> There you go. All right.

Art Gilliland

>> It's funny to see how much AI is out there. Every RSA has a theme, and so obviously AI is the big theme, and you're not a company if you don't talk about it right now, but we'll see how much money it makes customers over time.

>> Yeah. We did a survey with our partner, ETR prior to RSA. About half the respondents were attending, and of course the number one thing they wanted to see was what's happening with AI and security.

Art Gilliland

>> Yeah. Huge opportunity for really driving automation, real huge opportunity for cost savings, I think for customers, but also a huge opportunity for the adversary to automate their side of the house too, so it increases risk. So I think it's going to be still more of attrition.

>> Well, but last year there was certainly AI talk, but it was more, "Okay, the adversary's better phishing, and we think AI has potential." Now, there's a lot of talk about securing the AI, and AI doing things that aren't intended and needs to approach security differently. So that is new here.

Art Gilliland

>> It's healthy, actually. I think one of the things that I believe is true and has been true over the last flow of all these big platform shifts, AI is the first platform shift that I've seen where security is starting to be thought of before it gets deployed. Whereas cloud was adopted superfast. These technology big trends that change the world, they get adopted and then they're like, "Oh, I forgot about security." That, I think is happening a little differently here. Yes, the models have to get invented, but before people are using it now they're really thinking about security, which is great for us.

>> That's very true. Internet, mobile apps, big data, it was all this code of cloud, there was always shadow activities, and there's definitely shadow AI, but people are watching now saying, "Whoa, hold on." And you hear these stories and-

Art Gilliland

>> Companies are getting really smart about it-...

>> very much aware of it....

Art Gilliland

>> and they should because it's super powerful, but also could be pretty dangerous.

>> Yeah, definitely. Guys, thanks so much for coming to theCUBE. Really appreciate your time.

Art Gilliland

>> It's really been great. Thank you.

>> Appreciate it. Thank you. Okay. Keep it right there. We'll be back, wall to wall coverage. We're deep into day two. theCUBE at RSAC 2024. We'll be right back.