Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / RSAC Innovation Sandbox Finalist: Bedrock Security with CEO, Pranava Adduri

Transcript

RSAC Innovation Sandbox Finalist: Bedrock Security with CEO, Pranava Adduri · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_00: Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we're talking to leaders of the company selected for the 2024 RSA Conference Innovation Sandbox.
• 0:54
  SPEAKER_00: These are the very, very few, in fact, only 10 companies of all the hundreds that's not over a thousand judges looked at that have been selected as the most innovative startups in cybersecurity today.
• 1:06
  SPEAKER_00: I am your host, Andrew Monahan, and today we're talking with Pranova Aduri, CEO and co-founder of Bedrock Security.
• 1:13
  SPEAKER_00: Pranava, welcome to the podcast.
• 1:14
  SPEAKER_01: Andrew, thanks for having me.
• 1:16
  SPEAKER_01: Uh excited to excited to dive in today.
• 1:18
  SPEAKER_00: Yeah, these are I love doing doing these episodes.
• 1:21
  SPEAKER_00: We get to get these innovative companies and understand what you're all about and give you the chance to showcase ahead of next week.
• 1:27
  SPEAKER_00: We're recording uh the week before RSA.
• 1:29
  SPEAKER_00: So ahead of next week, uh showcase what you're up to.
• 1:32
  SPEAKER_00: So it's for me it's it's fascinating to hear uh what's going on in the very cutting edge of cybersecurity these days.
• 1:37
  SPEAKER_00: So, first question for you, Parnava though, is where in the world did you have your first sandbox?
• 1:44
  SPEAKER_01: Let's see.
• 1:45
  SPEAKER_01: Um I was born in India, but I spent my first five years in Libya before immigrating to the States.
• 1:50
  SPEAKER_01: Libya was an interesting uh upbringing.
• 1:52
  SPEAKER_01: We were in a colony where the the company that my dad worked for had bought over a bunch of consultants uh to help uh the Libyan government build their steel process.
• 2:01
  SPEAKER_01: So I grew up there, uh, immigrated to the States when I was five, and then bounced around the Bay Area since.
• 2:06
  SPEAKER_00: I've never, never had Libya as uh as a place that someone grew up.
• 2:10
  SPEAKER_00: Uh happy to share my some of the countries I lived in when we get when we get together at some point, but uh nothing quite as as dramatic as Libya, though.
• 2:18
  SPEAKER_00: So that's that's fantastic.
• 2:19
  SPEAKER_01: It was um uh last thing I'll say on that.
• 2:22
  SPEAKER_01: Um it was a very like charmed like little bubble uh in the right uh that uh that where where I grew up because it was um the company that my dad was working for, uh, they'd created like a colony of folks.
• 2:33
  SPEAKER_01: And so it was it was uh some of my fondest memories were there.
• 2:36
  SPEAKER_00: I don't know if it's still the case, but uh used to be when people went to work in Saudi many years ago as an expat, you lived in like a compound, it was all walled off, and it was all the expats in one place.
• 2:47
  SPEAKER_00: I'm sure it's progressed a lot since those days, but it sounds like a similar sort of thing.
• 2:51
  SPEAKER_00: Um let's move forward then, part of that, to bedrock.
• 2:55
  SPEAKER_00: What is the story of the founding of your company?
• 2:58
  SPEAKER_01: Well, here's a fun fact.
• 3:00
  SPEAKER_01: My co-founder and I actually used to be rivals.
• 3:02
  SPEAKER_01: He worked at a competing company uh to where I was employed.
• 3:06
  SPEAKER_01: Both of us worked in the data protection world, uh, and the both of us worked on the uh on distributed storage systems because we were building durable storage for helping data protection initiatives for companies, right?
• 3:17
  SPEAKER_01: So uh these would be scale-out backup systems.
• 3:21
  SPEAKER_01: And um Ganesh is a gifted engineer, and there whatever we built, he actually would reverse engineer on his side and uh he'd figure out uh where the file system would have faults, and uh he'd engineer scenarios and competitive bake-offs uh such that our uh our system would run into trouble.
• 3:37
  SPEAKER_01: So um imagine trying to compete with someone like that.
• 3:39
  SPEAKER_01: I'm glad I'm not competing with them anymore.
• 3:41
  SPEAKER_01: So rivals turned uh co-founders.
• 3:44
  SPEAKER_01: How did you connect though?
• 3:45
  SPEAKER_00: I I get you're competing, but how did you go?
• 3:47
  SPEAKER_00: You're the one that did that against us.
• 3:50
  SPEAKER_01: We we didn't know each other.
• 3:51
  SPEAKER_01: Uh we didn't know, I didn't know him by name, right?
• 3:54
  SPEAKER_01: I knew we knew that someone was on the other side reverse of figuring things out.
• 3:58
  SPEAKER_01: And we were just like, who is this guy?
• 3:59
  SPEAKER_01: After the fact, uh, we got connected through our investor.
• 4:02
  SPEAKER_01: After the fact, when we were when we were trading like uh stories about going head to head, then we realized that I realized that it was actually him.
• 4:09
  SPEAKER_00: I bet there was mixed emotions when you realized it at the start.
• 4:13
  SPEAKER_01: Honestly, it was relief.
• 4:14
  SPEAKER_00: It was okay.
• 4:15
  SPEAKER_01: It was relief that uh that we weren't competing anymore.
• 4:18
  SPEAKER_00: Oh, that's great.
• 4:19
  SPEAKER_00: I love that.
• 4:20
  SPEAKER_00: That's that's so funny.
• 4:21
  SPEAKER_00: Uh the chances of it happening though, of actually getting connected, realizing that's what you were both doing are pretty slim.
• 4:27
  SPEAKER_00: So that's uh, you know, an interesting little way to get together there.
• 4:30
  SPEAKER_01: Yeah.
• 4:31
  SPEAKER_01: So we got started in 2022, and uh it's been a really fun journey since.
• 4:36
  SPEAKER_00: All right.
• 4:36
  SPEAKER_00: So what is the problem that you're solving and and who cares about it?
• 4:40
  SPEAKER_01: So the problem that we're solving is that um in today's enterprises, there's a lot of data.
• 4:46
  SPEAKER_01: Uh in fact, um, what I like to say is data is growing exponentially.
• 4:50
  SPEAKER_01: It's the amount of data being created, also the change in that data as well.
• 4:54
  SPEAKER_01: There's new types of data coming in all the time.
• 4:57
  SPEAKER_01: So data is growing and changing exponentially.
• 4:59
  SPEAKER_01: And the hardbringers of that first was cloud.
• 5:02
  SPEAKER_01: It made it really easy to create data, move it around, share it.
• 5:05
  SPEAKER_01: And now with Gen AI, we're about to see another uptick in terms of the amount of data being generated and created.
• 5:10
  SPEAKER_01: And so while that curve is exponential, the security teams, the GRC teams, the keepers of trust and ensuring that organizations are using this data responsibly and keeping them out of the news, those teams grow linearly.
• 5:22
  SPEAKER_01: And that gap is fundamentally the risk, right?
• 5:25
  SPEAKER_01: The problem has been to date, the way for teams to keep pace with uh that data, these are really built for an era where uh data was in terabytes.
• 5:35
  SPEAKER_01: We're in the world of petabytes now.
• 5:37
  SPEAKER_01: So none of these technologies are really scaling for today's environments.
• 5:40
  SPEAKER_01: And as that data is rapidly changing, all of these are rule-based architectures.
• 5:44
  SPEAKER_01: I like to use the analogy of stencils, right?
• 5:46
  SPEAKER_01: If you have a circle-shaped stencil, a square-shaped stencil, and you're trying to use those two shapes to go match all the complicated changing shapes that are coming out right now, you're gonna have a lot of issues in terms of missing things, but also having false positives as well.
• 5:59
  SPEAKER_01: So there's a lot of burden on these teams in terms of keeping up with this data.
• 6:02
  SPEAKER_01: And so the opportunity and where we want to help organization, the problem that we want to take ownership of is helping them keep pace with that data, learning that data as it's coming in, understanding what's most important to the business, and at the end of the day, really helping prioritize what are the biggest risks uh that a security team needs to be focused on, and how do they remediate those risks?
• 6:23
  SPEAKER_01: Uh, how not just giving them uh alerts, but how do you actually get them to uh get them to a good state where they're not carrying that risk anymore?
• 6:30
  SPEAKER_01: So that's the problem and solution.
• 6:32
  SPEAKER_01: And a lot of the people that uh that we work with are security teams, GRC teams, and data governance teams.
• 6:38
  SPEAKER_00: And these people, as you say, have had tools for many years to help with understanding what data they have, understanding how to classify it, and therefore apply policies and and rules to them.
• 6:48
  SPEAKER_00: What is the big innovation that you're bringing that the judges would have seen and go, this might just be the way to correct this problem?
• 6:56
  SPEAKER_01: Yeah, I like to use an analogy for um the core bit of bits of technology that that we brought to market.
• 7:03
  SPEAKER_01: We call it bedrock air, AI reasoning.
• 7:05
  SPEAKER_01: Air is actually a set of three technologies.
• 7:07
  SPEAKER_01: The first is you can protect what you can't see.
• 7:10
  SPEAKER_01: And when it comes to the many petabytes of data that organizations have, being able to even see and get a sketch of what a book we're dealing with, that's a foundational problem.
• 7:20
  SPEAKER_01: A lot of the technologies that were built for yesterday's volumes of data, they can't even keep up with these petabyte scale environments.
• 7:27
  SPEAKER_01: So, step one, how do you actually go do the scan without breaking bank?
• 7:31
  SPEAKER_01: That's step one.
• 7:32
  SPEAKER_01: I'll give you a point of comparison.
• 7:34
  SPEAKER_01: We recently onboarded a consumer AI company.
• 7:36
  SPEAKER_01: They had 16 petabytes of data.
• 7:38
  SPEAKER_01: We onboarded them in four days for less than the cost of an RSA ticket, uh, RSAC ticket, right?
• 7:43
  SPEAKER_01: And by contrast, some of the, like if you think about some of the current vendors and even some of the legacy vendors, we had another prospect.
• 7:50
  SPEAKER_01: They had a 500 terabyte environment.
• 7:52
  SPEAKER_01: To do to scan that 500 terabyte environment, they were quoted 75k, right?
• 7:58
  SPEAKER_01: So we scanned a 30 environment that was 32 times larger for 35 uh for 35x less the cost.
• 8:03
  SPEAKER_01: And so the key innovation there is the ability to go across these very large-scale environments with a highly distributed architecture.
• 8:10
  SPEAKER_01: And uh we call that technology adaptive sampling, right?
• 8:13
  SPEAKER_01: Uh the ability to blast across these environments and make sense of what's there.
• 8:16
  SPEAKER_01: Now you've mapped out the environment.
• 8:19
  SPEAKER_01: The second step is making sense of what's actually important to the business.
• 8:22
  SPEAKER_01: If I came to you with 16 petabytes of uh of data inventory, you would uh you would not know what to do with that, and neither would I.
• 8:29
  SPEAKER_01: So the next step is figuring out what's actually important and material to the business.
• 8:32
  SPEAKER_01: The key innovation there, if you're using rules to try and make sense of that, again, you're gonna be in a whole lot of pain.
• 8:38
  SPEAKER_01: You're gonna be dealing with a lot of false positives.
• 8:40
  SPEAKER_01: The key, what you want, what we want to be able to do is use the latest in AI to learn what data is most important to the business.
• 8:46
  SPEAKER_01: And so the example I like to use here, if I told you that W-2s were considered restricted and offer letters were considered restricted, right?
• 8:54
  SPEAKER_01: You have those two sample points.
• 8:56
  SPEAKER_01: Then I show you 1099 forms, right?
• 8:59
  SPEAKER_01: Even though you've never seen a 1099 before, by looking at the content, you can reason about the fact that that's probably also restricted.
• 9:06
  SPEAKER_01: So imagine doing, imagine a system that is operating 24-7 across all of your data stores and learning globally, doesn't have to sleep, and is constantly uh understanding what is important to the business.
• 9:17
  SPEAKER_01: And that way, as data is changing and it's growing, this system can actually keep up.
• 9:22
  SPEAKER_01: So that's the key difference, yeah, from rules to reasoning.
• 9:24
  SPEAKER_01: And then finally, we've sketched out the environment at these massive scales.
• 9:28
  SPEAKER_01: We've turned it into a heat map that tells you where the most important data is at any given point in time.
• 9:33
  SPEAKER_01: The third step is how do you protect the red hot spots on that heat map, right?
• 9:37
  SPEAKER_01: How do you figure out what are all the ways an adversary could get to that data?
• 9:40
  SPEAKER_01: What are the internal usages of that data that might be opening up the company to regulatory risk?
• 9:44
  SPEAKER_01: And then not only do we find them, we'll actually give you uh containments for it, right?
• 9:48
  SPEAKER_01: How do you actually remediate that problem?
• 9:50
  SPEAKER_01: How do you get rid of that risk?
• 9:51
  SPEAKER_01: So not only visibility, but also getting them to remediation.
• 9:54
  SPEAKER_01: So air is actually a combination of all three of those technologies.
• 9:58
  SPEAKER_00: So what I heard, Pranva, to go back just quickly.
• 10:00
  SPEAKER_00: One was the speed to be able to go and assess what people have.
• 10:04
  SPEAKER_00: You know, if it takes someone study five days, you're you're you're painting the bridge, right?
• 10:08
  SPEAKER_00: It's changed so much in that period of time, you might as well just start again.
• 10:11
  SPEAKER_00: I heard about uh using reasoning and AI to make sense of all the petabytes of data that the organization is gonna have uh and do it so you don't have to teach it every last bit of uh data or document is out there, you know, we'll use reasoning to figure that out.
• 10:25
  SPEAKER_00: And the final one is uh look at those hotspots and focus on those to say these are the bits that we actually really have to think about and figure out how we protect if that the attackers are gonna get there to different routes.
• 10:37
  SPEAKER_01: That's right.
• 10:38
  SPEAKER_01: Um and each of those has a name.
• 10:39
  SPEAKER_01: The first one is adaptive sampling, the second is uh is the reasoning instead of using rules.
• 10:44
  SPEAKER_01: So AI reasoning error.
• 10:46
  SPEAKER_01: The third, um, the ability to protect that data.
• 10:49
  SPEAKER_01: You can the visual you can think about is you find the red hot spots on the map.
• 10:52
  SPEAKER_01: Imagine being able to ring fence that data.
• 10:54
  SPEAKER_01: We call those trust boundaries.
• 10:56
  SPEAKER_01: And if that data is ever leaving those ring fences, or if someone gets access to data within those ring fences, that's not supposed to, that's when we notify and also help you contain that problem, remediate that violation.
• 11:08
  SPEAKER_01: So the third one is called trust boundaries.
• 11:10
  SPEAKER_01: I forgot to mention the name.
• 11:11
  SPEAKER_00: So trust boundaries, let's go a little bit deeper on that if you don't mind.
• 11:13
  SPEAKER_00: I mean, when I hear trust boundaries or boundaries or things like that, I go back to good old DLP days of saying, well, something ran out the door yesterday, you gotta figure out what happened to it.
• 11:23
  SPEAKER_00: Um can you enforce them in real time?
• 11:25
  SPEAKER_00: Do you want people to want to enforce them in real time?
• 11:28
  SPEAKER_00: How does that work?
• 11:29
  SPEAKER_01: Yeah, so we actually did a we actually did a lot of surveying with DLP practitioners uh as we as we built our bedrock.
• 11:36
  SPEAKER_01: What we learned was that blocking in in inline can be very disruptive to the business.
• 11:42
  SPEAKER_01: So the philosophy that we take is find if if for example someone did share something sensitive external to the business, right?
• 11:50
  SPEAKER_01: The key is to rapidly detect that, bring that context to the data owner that, hey, this file was shared out, it's violating this particular control.
• 11:58
  SPEAKER_01: Because of the reasoning, we can actually tell you why it actually uh is a violation of that control in a much more understandable way.
• 12:05
  SPEAKER_01: And then we can actually present to them, click here to block uh to unshare right away, or give a justification for why this is this is required.
• 12:13
  SPEAKER_01: So in that sense, uh rapid detection and containment is in line with how a lot of people are thinking about uh how they want to protect that data, right?
• 12:20
  SPEAKER_01: Versus uh direct blocking, it can be seen as a business disruptor.
• 12:24
  SPEAKER_00: Oh yeah, most DLP deployments are in DLP DLM mode, not DLP mode.
• 12:29
  SPEAKER_00: They're monitoring things that go on.
• 12:31
  SPEAKER_00: But what essentially what you're saying though is you're bringing uh the context and also the speed to understand what's happening.
• 12:37
  SPEAKER_00: That perhaps in the old way of doing things, you'd find out you know, a week later, a month later that something happened.
• 12:42
  SPEAKER_01: Right.
• 12:42
  SPEAKER_01: And and another part about this is the other issue that we hear with traditional uh implementations of DLP, the burden always falls on the security team to review.
• 12:51
  SPEAKER_01: Whereas here, we're actually taking it to the data owners, right?
• 12:55
  SPEAKER_01: The people that are actually doing the sharing, they actually have the context.
• 12:58
  SPEAKER_01: Right.
• 12:59
  SPEAKER_01: And so that workflow tends to actually um that workflow actually tends to get better resolutions uh without burdening the security team as much.
• 13:06
  SPEAKER_00: Well, they'll be happy with that.
• 13:08
  SPEAKER_00: They don't need more alerts, that's for sure.
• 13:10
  SPEAKER_01: Amen to that.
• 13:11
  SPEAKER_00: Uh, what are the big goals for bedrock for 2024?
• 13:15
  SPEAKER_01: Yeah, Andrew, we've built uh we built tech that we're super excited about.
• 13:19
  SPEAKER_01: And in the field, it's been customers have been thrilled with the results that they've been getting uh and the time to value that they've been seeing.
• 13:26
  SPEAKER_01: For 2024, uh, we're coming to market in a big way.
• 13:29
  SPEAKER_01: So um you'll be seeing us a lot more.
• 13:31
  SPEAKER_01: We'll be hearing about us a lot more.
• 13:32
  SPEAKER_01: Go to uh 2024 is our go-to market year.
• 13:35
  SPEAKER_00: That's awesome.
• 13:35
  SPEAKER_00: Um and at RSA next week, except for the wild and exuberant uh celebration for winning the sandbox, what else you got planned for for the rest of that week?
• 13:45
  SPEAKER_01: So for us, uh we have there's um outside of the innovation sandbox, there's a couple of um we'll be we'll be doing another, our VC is actually hosting um a little bit of a um of an expo as well.
• 13:58
  SPEAKER_01: We'll be showcasing there.
• 14:00
  SPEAKER_01: And outside of that, lots of coffee meetings with uh with uh with folks.
• 14:04
  SPEAKER_01: So um uh privileged to be meeting these folks and really excited to be uh sharing bedrock with them.
• 14:09
  SPEAKER_00: Well, it's certainly an exciting time for you, your co-founders, the company, you've got the sandbox, you've got looks like you're investing and go to market for the rest of the year.
• 14:18
  SPEAKER_00: I really truly wish you every uh bit of good luck for next week and success for the rest of the year and beyond.
• 14:23
  SPEAKER_01: Thank you, Andrew.
• 14:24
  SPEAKER_01: Um, and um would love to have uh folks uh come out and uh uh and uh uh meet us at the Innovations Handbox kiosk as well.
• 14:31
  SPEAKER_01: So we'd uh we'd love to show people more.
• 14:33
  SPEAKER_00: And I'll put your LinkedIn into the show notes, Carnova.
• 14:36
  SPEAKER_00: Is there another way you want people to get hold of you?
• 14:38
  SPEAKER_01: Dropping a LinkedIn connect would be amazing.
• 14:40
  SPEAKER_01: Uh response is there.
• 14:42
  SPEAKER_01: And uh my email is also Carnaval, uh first name atsecurity.
• 14:47
  SPEAKER_01: So please drop us a like.
• 14:48
  SPEAKER_01: We'd love to see it right.
• 14:49
  SPEAKER_00: That's awesome.
• 14:50
  SPEAKER_01: Thank you, Andrew.
• 14:51
  SPEAKER_00: Thanks, Pernama.