theCUBEd Awards | ExtraHop RevealX by ExtraHop (Most Innovative Cyber-resilience Solution)

Clips
News
More from theCUBEd Awards

Rob Greer

CEO

ExtraHop

ExtraHop wants to make NDR the star of modern cyber resilience

ExtraHop Networks Inc. aims to ensure modern cyber resilience does not neglect network performance management. The company’s RevealX platform, which monitors network performance and is part of its series of network detection and response solutions, is tailored to modern cloud infrastructure.“As we’ve evolved to a hybrid cloud, multicloud world, the [ExtraHop] architecture lended itself to that scale-out,” said Rob Greer (pictured), chief executive officer of ExtraHop. “If you look at our RevealX platform, it can be placed in many different places, physically on physical appliances, on virtual appliances

play_circle_outline ExtraHop's Tech Innovation CUBEd Award win for Most Innovative Cyber-Resilient Solution

play_circle_outline Passive approach for real-time visibility and forensics across enterprise infrastructure

play_circle_outline Unique architecture for wire speed, single pass data extraction and analysis

play_circle_outline Consolidation of legacy point products into ExtraHop platform for efficiency

Info
Transcript

ExtraHop RevealX by ExtraHop (Most Innovative Cyber-resilience Solution)

Rob Greer

CEO ExtraHop

In a conversation following ExtraHop’s win at the 2025 Tech Innovation CUBEd Awards, theCUBE Research’s John Furrier sits down with CEO Rob Greer to explore what sets the company apart in the highly competitive cybersecurity landscape.

Learn more about our other 2025 Tech Innovation CUBEd Awards winners: https://www.thecube.net/awards

ExtraHop secures the Most Innovative Cyber-Resilient Solution award by delivering unparalleled network visibility through its RevealX platform, which passively monitors traffic from layer two to layer seven, provi... Read more

explore Keep Exploring

What company won the Most Innovative Cyber-Resilient Solution award at the CUBE's Tech Innovation CUBEd Awards? add

What approach did they take in order to gather real-time information without interfering with a lot of traffic in their enterprise? add

What was the initial architecture that was put in place for our super power and how does it allow for efficient data extraction and storage for security and forensic investigations? add

What trend did we see last year in terms of customer adoption and consolidation of product capabilities? add

bolt Powered by CUBE AI

ExtraHop RevealX by ExtraHop (Most Innovative Cyber-resilience Solution)

search

>> Hello everyone, welcome to theCUBE studios here in the Palo Alto office. I'm John Furrier, your host of theCUBE here in Silicon Valley. And also we have our new studio in New York and on the show floor of the New York Stock Exchange connecting Silicon Valley and Wall Street. And today we are going to celebrate theCUBE's Tech Innovation CUBEd Awards where we are celebrating the winners of our inaugural program. The competition was fierce and we received a huge number of exceptional high caliber entries that showcased the incredible innovation in the industry and tech landscape. And today we are joined by Rob Greer from ExtraHop to discuss their award-winning entry, he's the CEO. Took top honors in the Most Innovative Cyber-Resilient Solution. Very competitive category. Rob, ExtraHop wins. CUBE alumni as a company, going back to 2017. We've been covering you guys. You're new at the helm. Congratulations on the award. Thanks for coming on.

>> Yeah, thank you. John. No, when I was evaluating whether I would apply to be the CEO of ExtraHop, I actually did watch your video with Kanaiya at the Fal.Con '24 event, and I was very impressed with what ExtraHop was doing, and that actually sparked a lot of my follow-on interest, which ultimately led me to join ExtraHop in the early part of the year.

>> Well, that's super exciting to hear. And again, that makes me personally proud of our team, doing a great job getting that content out there. And of course you guys are the talent, it only as good as the people on the CUBE. So we appreciate, ExtraHop has had many great interviews. But the innovation award that you guys got, like I said at the intro, it's highly competitive. Cyber-resilience is a category that kind of grew out of the classic stores, networking, compute, era of recovery, ransomware comes in, a lot of other cyber-resilience, data-driven specific things. And then it evolves quickly into you starting to see it creep into new things. So clearly the foundation of cyber-resilience, well understood, still competitive, still has a lot of headrooms. Being innovative in this kind of category is a huge accomplishment. What was central to your approach as a company? Could you share your innovation, what impact it has, why you guys are winning?

>> Yeah, that's a very good question, John. I have to really give credit to Jesse and Raja having foresight back in 2007 to create a technology that provides full visibility across the network, everything from layer two to layer seven. And at the time it was more about performance, more about those characteristics. But it was never limited to just the IT operations side or the network operations side. And what they saw the need in the market and decided to also reveal the appropriate context and metrics and package it up in a way that security operation centers can be more resilient and frankly have more foresight to bad actors in the environment. And one of the approaches they took was to be passive. So everything we do is passive. We don't interfere with a lot of traffic, but we get real-time information. And by not only seeing that information in a single pass, we also are able to record it at scale across the entire enterprise. And so what that means is if you do see a compromise or some sort of breach potentially you can now go back in time and be able to see what is the blast radius of that. And so from a resiliency perspective you don't want to have to turn off your entire infrastructure, if you're a publicly traded company that has to notify regulators within four days these days, if you actually understood that the impact of that was confined and maybe not as severe as you thought.

>> Rob, that brings up a great point. Love that commentary because every time I interview a CISO, whether it's at JPMorganChase or across multiple industries, I always ask the question, what's your resilience bar? Because each one has their own answer depending upon what industry. Obviously, JPMorganChase is huge, they're a regulated industry. But everyone has the standards. So you guys have been very successful. And again, going back to 2017, I could tell you I've done those interviews, the founders understood this. I won't say they were misunderstood, they were very understood in that space. But then now as it goes mainstream in cyber that becomes key. Every successful company has its own unique secret sauce. As you dig in there and look at the customers, look at the technology, what would you say is the most distinctive aspect of the approach has enabled you guys to push the boundaries and achieve this recognition?

>> So I mean our super power it all starts with the initial architecture that was put in place, which was wire speed, single pass architecture. Where you're looking at all the packets and you're able to take out the relevant metadata that IT organizations, security organizations can extract real value from based on the use case. And even to the point of recording all of the data in a way that's efficient and can be referred to in the event of a true forensics investigation. So that architecture was built not just to be on premise... And you got to go back in time, John. In 2007, the cloud was kind of maybe not as pervasive as it is today.

>> Yeah. That's an understatement.

>> And the team being based in Seattle had some connections with our friends at AWS and they looked at machine learning in a way that many companies that were on-premise oriented at the time did not. And in fact, we have over 40 patents around AI and machine learning that they always saw a need to do a lot of the correlations, the analytics in a cloud environment and then enrich the sensors that would've been on-premise at the time. And so, as we've evolved to a hybrid cloud, multi-cloud world, the architecture led itself to that scale out. And so today, if you look at our RevealX platform, it can be placed in many different places, physically on physical appliances, on virtual appliances, V-tapping into the big hyperscalers or even in their proprietary Kubernetes apps that they're building themselves. So it is that vision of thinking about seeing the network wherever it is, whether you control the network or don't, is the secret sauce initially architecture. And then secondly, to be able to take that and then wrap it up in a way that people could do something with it. There's so many alerts coming at the security operations and network operations teams today. Whether they actually look at and if they do look at it, can they do anything with that information? And so they had that foresight. And most recently last year we delivered a lot of innovation around multi-featured sensors. So today we call something called modern NDR. It's the combination of network performance management, network detection of response, intrusion detection, as well as packet forensics. To be able to do that in one sensor and be able to do that in many different locations across a hybrid network gives that efficiency and that broad 360 view that no one in the market can touch. And for us, that is great. It makes us very complimentary to what our partners like CrowdStrike are trying to do for large customers where they have a Next-Gen SIEM, they have EDR endpoint detection response, and what they're missing is the network piece, which is about 40% of the traffic they never see, we see. And that completes the next-gen SOC of where our customers need to go.

>> I love that integration story. Love that whole package of that efficiency. It's interesting. I want to get into the innovation around the customers, I want to put that on hold for a second. But I want to double down on what you just said because you mentioned the early days of AWS. If you think about what happened after that, which essentially how you guys built that value proposition, was cloud was horizontally scalable, right? You mentioned as it got more everywhere, now multi-cloud, that horizontal basis is now what we're seeing today. Distributed computing cloud operations is what people are doing. Okay, great. CISOs are using it now for cybersecurity. It's great. But if you look at AI right now, AI needs that same horizontal scale for data, but yet the specialty in the domain expertise in the software. So you have now the confluence of that horizontal scale and the domain specific data in applications kind of threaded together. So as you guys do this down here, it's getting smarter up here at the top. So what's your insight on that piece? Because I think this is where the puck is going. Love to get your thoughts on how you see that.

>> Well, so AI, machine learning, I mean first off, these have been terms that have been around for a long time. We got to thank our friends at OpenAI for created the killer use case a few years ago that has really accelerated things. The way we see it is GenAI as a use case for modern SOCs allows someone who's not as sophisticated and knowing all the bits and bytes, been around as long as I have or you, John, no offense, but we've been around a while, right?

>> True.

>> You can't remember... When I start talking to people that were as working at ARCNET at pre ethernet or various other types of-

>> There was no open source when we got broke into the business, it was proprietary software. Open source, what? Free software.

>> I have kids who say, "Dad, you had to what? You had a phone connected to the wall?" So today our job is to not make the prior generations deal with the pain and complexity of the past. So GenAI allows us to use regular language to ask questions. And now you still have to ask the right questions to get the right results. And so in the case of our incorporation of GenAI, it's how do we make our customers use our platform in a simpler way? And then if you take it up one degree to the integrations with CrowdStrike or our friends at Netskope or others, and it just so happens that the customer's using their infrastructure to drive the question, how do we nicely tie into that in a elegant way and context? And so for us, GenAI is very much a generation changer, but specifically how do you make it relevant to your customer? And for us it's about very short windows. We're talking hours that our customers have a chance to figure out, okay, when there is some sort of a known ransomware or known a bad actor with some interesting activity, indicators of compromise or threats, how quickly can you figure out where that is and how much of a impact that could have more broadly in your organization? That is our job to minimize impact. And to do that, you have to use these new technologies. But at the end of the day, let's be honest, it's not going to solve world hunger. You still have to do the basics. You have to patch. You have to scan for vulnerabilities. I mean, how many CDEs are out there from 2009 still getting exploited? So the basics still apply.

>> Well, I'd love to do a segment with you guys on AI for security and security for AI because that's been a hot area in networking for AI and AI for networking is a lot of use cases there, but we don't have enough time. Definitely will pick that up again, so much innovation going on there. And again. You guys are doing a great job. Let's get into the product side and the customer because one of the things about these award programs, and you guys have been CUBEd, as we say, with the new awards is case studies. So your product has been recognized for the innovative approach on cyber resilience as an innovator. Could you walk us through the specific example of the customers using the solution to solve the problems that weren't possible or practical to address even before? What was the key case studies that jumped out from this award?

>> Yeah, so what you're seeing is a trend. First off, if I back up for a moment, we recently did a press release when I became the CEO. As part of that, we talked about the prior year. And we did over $300 million in bookings. We have over $41 million plus annual recurring revenue customers. So this company has done quite well. And particular around the Fortune 100, we have about a quarter penetration in that Fortune 100. We do focus a lot in highly regulated, globally distributed hybrid infrastructure. So companies that have a legacy infrastructure, but they also have adopted a lot of modern, new applications and tend to be in two or more hyperscalers. So that the complexity, they're dealing with the combination of a network operations team and a security operations team and they all need to be coordinated. So the biggest trend we saw last year was consolidation of what I would call traditional legacy point product capabilities and moving to our platform. And some of them were existing network performance management with us for years that we have moved over into the security realm by creating connections within their own organizations many times. But there's several of them that were not existing ExtraHop customers where we just went in with a security value proposition. And what that is is these customers tend to not be able to get visibility across devices they can't put agents on and they also have been historically using dedicated solutions for intrusion detection, packet forensics, even asset discovery, think IOT, OT. And so if they could bring in a solution that gives real-time visibility of what's actually going on at the moment across their entire network, enrich that to their security operation center while retiring existing investments in IDS, packet forensics network performance management solutions that might have already been in place and maybe even into some of those critical physical system solutions that you might hear about in the world. That is what we're seeing.

>> So you got consolidation and then net new customers coming in straight up.

>> Correct.

>> What's the consolidation pain point? How critical is it? Are they like the house on fire, they're burnt out in terms of work, they've got too many tools to manage?

>> Yep.

>> Is it actual technical performance? What would be the key things that get people to be less indifferent and be more urgent?

>> Yeah. Well, okay, there's two primary reasons. One, the actual technology is getting zero innovation and there's no other option. Right now they're stuck with an old legacy company that's not doing any incremental innovation work, they may even be behind in certain areas and then they're raising the price all the time. So that could be one. And believe it or not, that's common. And then the second is the swiveling. The chair between the consoles requires a certain sophistication of your security operations personnel and the best SOAR products in the world are not going to be able to fix that alone. And so what you need is good data that's already correlated across the domain of network, give that to the security operations personnel so they don't have to go and do their own coordination, but a correlation between those technologies. I mean, look at what's happened in the endpoint side. EDR at first was a feature, but then it ultimately subsumed the endpoint protection platform category. And so there's been a lot of consolidation on the endpoint side that needs to happen on the network. It's just taken too long. And I'm talking about east-west communications. This is not replacing a firewall. This is replacing the communications, the type of detections that are going on inside the organization's networks.

>> So no innovation, a lot of context switching on the personnel, that's overhead, that's taxing on the human side.

>> Correct.

>> Talk about performance. A lot of folks will say, "Hey, sounds great, but is there overhead involved? What's the performance of this? What does it do for me? Does it make things go faster?" Any angle on that?

>> Well, well first off, I mean, you've been working with ExtraHop for a while so you understand our DNA is performance because the two founders came from F5 back in the early 2000s. I mean, that's what we thought about from the beginning. And reality is you can't separate network operations data from security data. Anyone who tells you that is not probably that educated in cyber. They're one and the same. Now you might be specialized in a particular area. The thing that we've always done is we've looked at all the context versus just security-oriented context. And the reality is, is there's certain behaviors where certain devices or hosts are communicating more frequently than maybe normal, or there's so much traffic that's being sent on an egress or ingress that you're not normally expecting, or it's from a different location. Maybe it's the same identity, but it's coming from a completely different location. And to be able to really bring that together and correlate that, you really need to understand performance. The other part is when you use our products, we don't slow it down. The reason for that is, one, we're not in line, we're passive. Two, we have the best performance characteristics of anyone in the market. So we're talking 100 megabits per second throughput or gigabit... Sorry, not 100 megabits. Sorry. We're talking about hundreds of gigabits per second throughput and being able to also take into account many of these customers are going to 400 plus, east-west traffic. So we're always thinking about how do you get that single pass view of those packets, not drop any of that information. And if the customers want to record it based on certain triggers, you need to give them that forensics and be able to store it for the appropriate period of time. And so that's always an innovation area that we're always on top of, and our networking friends and our hyperscaler friends are always trying to push us even further to have to keep up with those performance metrics. But east-west traffic is where many companies that try to compete in our space will fall down because they simply can't keep up with the performance of today's modern networks.

>> Well, you got to be resilient, which you guys are, but you got to be fast. We don't want slow resilience. Rob, thanks so much. Again, congratulations to ExtraHop and the entire team for winning the CUBEd Cyber-Resilience Solution Award on theCUBE our first inaugural ceremony. Thanks for coming on and great to highlight you guys and good luck and congratulations. We'll see you around. We'll see you at RSA. We'll probably see you at Black Hat and all the events, re:Inforce, I'm sure you guys will be there. So again, congratulations and thanks for coming on.

>> Thank you very much, John. I really appreciate being on your show.

>> Okay, I'm John Furrier here in the Palo Alto studios for the Tech Innovation CUBEd Awards. ExtraHop have been cubed with the Cyber-Resilience Award winner for the innovation. Thanks for watching.