Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / RSAC Innovation Sandbox Finalist: Harmonic Security with CEO, Alastair Paterson

Transcript

RSAC Innovation Sandbox Finalist: Harmonic Security with CEO, Alastair Paterson · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_01: Welcome to the Cybersecurity Go to Market podcast for a special showcase episode where we're talking to leaders of the companies selected for the 2024 RSA Conference Innovation Sandbox.
• 0:54
  SPEAKER_01: These are the very, very few, in fact, 10 companies out of hundreds, if not over a thousand people who entered, who got selected by judges as having as being the most innovative startups in cybersecurity today.
• 1:06
  SPEAKER_01: I am your host, Andrew Monahan, and today we're talking with Alistair Patterson, co-founder and CEO at Harmonic Security.
• 1:13
  SPEAKER_01: Alistair, welcome to the podcast.
• 1:15
  SPEAKER_00: Great to be here, be here, Andrew.
• 1:17
  SPEAKER_00: Thanks for having me.
• 1:18
  SPEAKER_01: I'm looking forward to our conversation, Alistair.
• 1:20
  SPEAKER_01: You are a now a multi-time cybersecurity entrepreneur.
• 1:24
  SPEAKER_01: You built, co-founded, ran with CEO of Digital Shadows, which was sold to Reliot, what, a couple of years ago, now three or four years ago now, is that right?
• 1:33
  SPEAKER_00: Not even that long.
• 1:38
  SPEAKER_00: So relatively recent.
• 1:39
  SPEAKER_01: Less than two years.
• 1:40
  SPEAKER_00: Yeah, great run.
• 1:41
  SPEAKER_00: And uh thank you.
• 1:42
  SPEAKER_00: It's uh great company.
• 1:43
  SPEAKER_01: Congrats on that whole run.
• 1:45
  SPEAKER_01: And you know, that was uh incubated well and run and you know built up over time.
• 1:49
  SPEAKER_01: And you did it with your your co-founder Brian, who's your co-founder at Harmonic as well.
• 1:54
  SPEAKER_01: I just love that you guys have worked together on on two or three entities over the years.
• 1:58
  SPEAKER_00: Yeah, we go back a long way, um, probably around 20 years at this point.
• 2:02
  SPEAKER_00: So uh yeah, he's uh always been an important part of what we've uh we've been able to achieve as a company last time around, and and obviously he's he's the heart of it again this time uh as CTO.
• 2:12
  SPEAKER_01: And the sharper listeners will have picked up that uh you're a fellow Brit uh like me.
• 2:18
  SPEAKER_01: I'm I'm obviously from Scotland.
• 2:19
  SPEAKER_01: You were born and bred in England, is that right?
• 2:22
  SPEAKER_00: Yeah, I grew up just north of London, uh a little little town called Aylesbury in in Buckinghamshire, uh, which is is famous for not very much.
• 2:29
  SPEAKER_00: But uh yeah, it was it was uh a great place to leave and uh and go elsewhere.
• 2:34
  SPEAKER_00: But yeah, no, I I've been in the US now nine years, but you wouldn't know it.
• 2:37
  SPEAKER_00: I think I I spend enough time talking to British people still that the accent has stayed intact.
• 2:41
  SPEAKER_01: Yeah, my I lost my accent very early on in the process.
• 2:44
  SPEAKER_01: Uh I don't know exactly why, but I did.
• 2:46
  SPEAKER_01: But uh you've held on to yours quite nicely.
• 2:48
  SPEAKER_01: So congrats on that as well.
• 2:51
  unknown: Thank you.
• 2:52
  SPEAKER_01: All right.
• 2:53
  SPEAKER_01: So we sort of answered the first one a little bit, but where in the world did you have your first sandbox, Alistair?
• 2:59
  SPEAKER_00: Yeah, no, absolutely.
• 3:00
  SPEAKER_00: I mean, I I started out in in the UK and uh I grew up there and also I started out working there too.
• 3:06
  SPEAKER_00: Originally it's uh there's a British company, Detica, that's uh has has spawned a lot of actually other cybersecurity startups in the industry, including you know Quantexa and Garrison and Panaceer and a few others, but Digital Shadows was was one of the first, if not the first, to to come out of there.
• 3:22
  SPEAKER_00: And and that was was a great run for us, as you mentioned over you know 11 years or so.
• 3:27
  SPEAKER_00: Uh but uh yeah, that's that was really what took me to the US.
• 3:30
  SPEAKER_00: So I've been in in the US since we did the series A at Digital Shadows in 2015, um living in Silicon Valley ever since then.
• 3:37
  SPEAKER_01: And what's the story of the founding of Harmonic?
• 3:40
  SPEAKER_00: Yeah, so you you mentioned my co-founder is uh is the same CTO as as last time, Brian.
• 3:46
  SPEAKER_00: And so Brian and I in building digital shadows, it was it was really interesting to us.
• 3:50
  SPEAKER_00: So for those who don't know it, we digital shadows was one of the leaders in the Thread Intel space.
• 3:55
  SPEAKER_00: And one of the things we did was was look at all of the sensitive data that had leaked out of companies on the open internet, and we were finding billions of records every week that were leaking out all types of sensitive data.
• 4:06
  SPEAKER_00: So we we'd already, you know, we'd been discussing, you know, that there's something not working very well in the data protection side of the house here, and there's probably a company to do one day on that that side of the house.
• 4:15
  SPEAKER_00: Um, but then then I think really the genesis came from Chat GPT coming out in this generative AI wave that shined a light again on data protection.
• 4:23
  SPEAKER_00: And we'll maybe come uh come back to that um a l a little bit later in what sort of problem we've we've decided to solve.
• 4:29
  SPEAKER_00: But that that was really, you know, those sort of seeds coming together was the start of the story.
• 4:33
  SPEAKER_01: And was there a genesis moment where you were sitting there in the Q's Ar pub talking about this and just came to you that this is what to do, or we run a campfire somewhere?
• 4:42
  SPEAKER_01: What happened?
• 4:43
  SPEAKER_00: Yeah, it's it's funny.
• 4:44
  SPEAKER_00: I mean, the um just going back on harmonic itself as a name, uh, so there's there's sort of a couple of aspects to this.
• 4:50
  SPEAKER_00: So uh when we were thinking of doing something new, we were we were thinking of you know fun company names.
• 4:55
  SPEAKER_00: And uh if you go far enough back, Brian and I actually played in a band together, so in our in our twenties.
• 5:01
  SPEAKER_00: And so we started thinking, well, you know, it'd be pretty good to have a musical name of some sort.
• 5:05
  SPEAKER_00: And uh we were actually in in a place in San Francisco, harmonic brewing, when we were discussing the company.
• 5:12
  SPEAKER_00: So it isn't it isn't officially named after the the brewery, but we are actually having our RSA drinks in that brewery on Wednesday night, of RSA.
• 5:20
  SPEAKER_00: So maybe to see some people there.
• 5:21
  SPEAKER_00: Uh and certainly uh, you know, a couple of their IPAs and a good discussion were part of the foundation for harmonic security this time around.
• 5:28
  SPEAKER_01: Oh, I love that.
• 5:29
  SPEAKER_01: I love that.
• 5:29
  SPEAKER_01: Is that near the Muscone or are you taking people elsewhere around the city for a sights and sounds tour?
• 5:35
  SPEAKER_00: It's it's walkable or a uh you know less than five minutes in a in a car, probably from there.
• 5:39
  SPEAKER_00: So yeah, anyone who's interested, go to our website and and drop us a note.
• 5:43
  SPEAKER_00: We'll we'll get you signed up.
• 5:44
  SPEAKER_01: Love it.
• 5:45
  SPEAKER_01: All right, well, let's talk about the problem then.
• 5:47
  SPEAKER_01: What is the exact problem that you're looking to solve and and who in an enterprise or a company that might buy it would care about this?
• 5:53
  SPEAKER_00: Yeah, great, great question.
• 5:54
  SPEAKER_00: I mean, I think as I mentioned, the start of this was really already thinking about huge issues in data protection and secondly seeing this just spotlight being put on it by the advent of this new Gen AI era.
• 6:07
  SPEAKER_00: Because I think the, you know, we've always had these challenges of sensitive data getting out of organizations, and there's been a you know a shadow IT issue.
• 6:14
  SPEAKER_00: I think with the advent of these Gen AI tools, it's hugely positive, of course.
• 6:19
  SPEAKER_00: But the number one issue that we see in companies right now in terms of adopting Gen AI is concern for their data privacy and security.
• 6:26
  SPEAKER_00: Because you you've suddenly got information often really important, IP and customer data and so on, leaving the enterprise and going into these third-party applications, some of which may be training on the data that's put into them according to their own declarations.
• 6:40
  SPEAKER_00: And some of them are obviously um, you know, very early stage startups and companies that may not have much of a security policy that are now handling a lot of sensitive data.
• 6:49
  SPEAKER_00: So in some respects, it's not really a new set of risks, but it's certainly uh putting a spotlight on those existing set of risks.
• 6:55
  SPEAKER_00: And the challenge is that the existing set of tools is just not up to the task.
• 6:58
  SPEAKER_00: I mean, we've we've spent 20 years regex matching on social security numbers and credit cards trying to find sensitive data.
• 7:05
  SPEAKER_00: And it, I mean, it's it's false positives everywhere, and it's it's just looking at a tiny subset of what's actually sensitive about a company's data.
• 7:12
  SPEAKER_00: And it and it isn't able to identify much higher level uh concepts that that companies care about in their IP and you know, whether it's code or it's um, you know, it's customer data and other types of information that you can't just match simply on.
• 7:26
  SPEAKER_00: So that's like solution one.
• 7:27
  SPEAKER_00: And the other approach the industry's been going with and polishing over the last few years is you know, labeling and classifying all of your data.
• 7:34
  SPEAKER_00: And and I think there's very few CISAs I speak to that relish the opportunity to do that.
• 7:38
  SPEAKER_00: It tends to be a you know very challenging exercise to try and identify even where all your data is, let alone label and classify it all.
• 7:45
  SPEAKER_00: And even if you did, it's gonna be pretty tough to, you know, that alone won't spot bits of that information being copied into prompts or emails ultimately and other things like that.
• 7:54
  SPEAKER_00: So we we just felt like there was there was room for something new, like a completely different approach to solving this set of problems.
• 8:01
  SPEAKER_01: You know, the uh as someone who used to sell DLP solutions back in the day, the dirty little secret about them is that very few were were preventing and most people were just monitoring because it wasn't that confidence in the classification, identification, and then the policies to go with it.
• 8:17
  SPEAKER_01: And they sure as heck didn't want to block something which was mission critical or was related to a CFO trying to do his job.
• 8:24
  SPEAKER_00: Yeah, it's it's sadly become a compliance tick box.
• 8:26
  SPEAKER_00: You know, it's sort of running in the corner on this tiny subset of data, it's tuned to not really find anything.
• 8:32
  SPEAKER_00: Great, you know, we can tick the box that we've got it.
• 8:34
  SPEAKER_00: But actually, if you actually care about your data, it's probably not a measure you're looking to deploy.
• 8:38
  SPEAKER_01: So, what is the big innovation then, Alistair, in in this whole world that you're talking about there, that you'd say that's why we were selected for the sandbox?
• 8:46
  SPEAKER_00: Yeah, I mean, the first thing that we do at Harmonic is the straightforward bit, which is really giving you visibility into AI adoption across the enterprise.
• 8:54
  SPEAKER_00: So which applications and models are in use, and you know, and there's a positive in that, right?
• 9:00
  SPEAKER_00: We we want to be enabling the business to solve the problems that it that it needs to with AI.
• 9:05
  SPEAKER_00: But you you also want to obviously identify the ones that are high risk and potentially are going to train on the data that's put into them and and cause otherwise cause data protection concerns.
• 9:13
  SPEAKER_00: So we you know we cover all of that, and not just for the existing set of of sort of new AI apps, but existing um SaaS apps that are deploying AI as part of the stack, which pretty much every enterprise app is is doing right now.
• 9:26
  SPEAKER_00: So we're covering all of those, those apps, and and a number of them are changing their terms and conditions now because of AI rollout.
• 9:33
  SPEAKER_00: So there's a really interesting challenge in vendor risk management around that.
• 9:36
  SPEAKER_00: So that's like the part one.
• 9:37
  SPEAKER_00: But the really sort of innovative thing that we're doing is that we're building our own pre-trained data protection models to identify sensitive data way better than anything's done before.
• 9:51
  SPEAKER_00: Um, we're using a mixture of experts approach, so we have a combination of different models that are fantastic at spotting different types of sensitive data in the same way that a human would.
• 9:59
  SPEAKER_00: And you can imagine it as if, you know, it's like having a human looking at every piece of data going out of the business and be able to make a human-like judgment about what is and isn't sensitive.
• 10:08
  SPEAKER_00: And the really cool thing is you can configure us in the same way you would talk to a human about what matters to the business.
• 10:13
  SPEAKER_00: So you could be an investment firm and you can configure harmonic by saying, Well, look, I care about my investment committee memos.
• 10:20
  SPEAKER_00: And so, and and and I don't want any of those leaking out.
• 10:23
  SPEAKER_00: And our models actually understand what an investment committee is, they know what a memo is, they know you know, they know they don't have to have seen or been trained on your data and your memos to know what one is when they see one, just like you'd be able to, or I would be able to spot those things for any company.
• 10:37
  SPEAKER_00: So the beauty is that we can, you know, without any complicated rules being set up or any, you know, having to train on your data or do anything like that, we can actually identify what matters to you in terms of sensitive data leaving the business in a way that's just not been possible before.
• 10:50
  SPEAKER_00: So that's sort of core innovation.
• 10:52
  SPEAKER_00: And the reason we've been able to do this so well is really knowledge of previously leaked information.
• 10:57
  SPEAKER_00: It's the sort of OS and Threat Intel background that we've got that gives us knowledge about how to build realistic training data sets that we can build and structure these models on top of.
• 11:05
  SPEAKER_00: So we have a bit of an unfair advantage with that threat intel background.
• 11:09
  SPEAKER_00: Um and the final thing that we do is that having identified something sensitive, you're probably familiar having rolled out DLP that there tends to be a whole bunch of incidents that get fired at the security team.
• 11:18
  SPEAKER_00: You know, it goes beep, the security team have to go and look at it and figure out if it's something interesting or not and why it went beep.
• 11:24
  SPEAKER_00: And and it it's usually, oh great, it was turns out Mexican driving licenses look like US social security numbers.
• 11:30
  SPEAKER_00: And you know, if you had any kind of human context, you'd know to ignore it straight away.
• 11:33
  SPEAKER_00: But but of course, the the systems don't, you know, are not smart enough to do that.
• 11:37
  SPEAKER_00: So the beauty of the harmonic approach, I mean, number one, of course, we're we're looking at this in a much more sophisticated way.
• 11:42
  SPEAKER_00: So when we find something, it really is something of interest.
• 11:45
  SPEAKER_00: But beyond that, we also know why we matched it.
• 11:48
  SPEAKER_00: You know, we know that it's to do with an investment committee memo in my example or some other piece of sensitive information.
• 11:53
  SPEAKER_00: And we have that that context, we pull in identity information to help make good judgments about that too.
• 11:59
  SPEAKER_00: But that that allows us to then instead of fire the results of the security team, we actually go to the end users directly and we can coach them uh in the right direction and say, Oh, you know, it looks like you're sending uh some PII out of the country to a you know a non-GDPR location or something like that if you have European customer data.
• 12:16
  SPEAKER_00: And the employee can say, well, actually, this this is uh this is perfectly fine in this case because I'm closing some business out there, I need to send this proposal out.
• 12:24
  SPEAKER_00: It turns out it's it's valid.
• 12:26
  SPEAKER_00: Loop in their boss on Slack or Teams who approves it, and then the whole thing gets audited and logged and goes through without the friction that you typically have of one loading the security team and two blocking the end user.
• 12:37
  SPEAKER_00: So instead of this sort of once-a-year security awareness training, we're actually effectively coaching users in the right direction on the job.
• 12:43
  SPEAKER_00: Because most of them are, you know, they they obviously mean well and they're trying to just trying to get their job done and they don't want to get blocked by security in doing that.
• 12:50
  SPEAKER_00: So we're we're trying to be an enabler for this new AI revolution as a as a result.
• 12:54
  SPEAKER_01: And who are you finding is the main buyer of this?
• 12:57
  SPEAKER_01: Because it touches lots of different groups inside inside an organization, I would imagine.
• 13:01
  SPEAKER_00: Yeah, I mean it it is interesting.
• 13:02
  SPEAKER_00: We we're seeing um, you know, every organization is looking at AI right now, of course, and a lot of them are building steering committees and groups to look at it.
• 13:10
  SPEAKER_00: Uh, security is is usually a stakeholder and sometimes even runs and chairs those those groups, but there's other other people involved, whether it's compliance, legal, uh, you know, CTO's office and so on.
• 13:21
  SPEAKER_00: Um, but typically we are selling to the security team and and the CISO initially because they tend to get given uh you know the task of actually solving the problems that are being thrown up here and deploying the right type of tooling and visibility.
• 13:34
  SPEAKER_00: So we help them get their arms around this problem with the visibility and then implement the right controls with the Gen AI models we're building for data protection.
• 13:42
  SPEAKER_00: So that's usually the the buyer center and it's the CISO's team.
• 13:46
  SPEAKER_00: Um the types of companies that are interested, they tend to be the ones that are a little more forward-leaning into AI.
• 13:50
  SPEAKER_00: So they're looking, you know, they're accelerating their adoption, but they they have sensitive data they're worrying about.
• 13:56
  SPEAKER_00: So they're fairly mature from a security perspective.
• 13:58
  SPEAKER_00: They don't want sensitive data leaking out, but they want to lean into this AI revolution.
• 14:03
  SPEAKER_00: Um right now we're not we're not necessarily trying to displace existing technologies.
• 14:07
  SPEAKER_00: We may we may go ahead and do that over time, but right now we're looking for the types of buyers that are early adopters and and are leaning into this wave and prepared to look at something new and a totally different approach like harmonic.
• 14:19
  SPEAKER_01: And going back to what you're saying about accuracy, have you been able to gather some data about how more accurate your way is versus the old regex kind of base based way?
• 14:28
  SPEAKER_00: Yeah, I I think so I I don't have any sort of stats to hand here, but but I would say it's it's not only the accuracy piece, which is hugely important, but but it's the fact that we can open the aperture on what we can see way wider, right?
• 14:41
  SPEAKER_00: So if you're the average enterprise and you've got DLP rolled out, you're probably tracking a very small number of nicely typed pieces of data that you can spot, but you're not looking at you know your corporate strategy documents and HR and you know and and MA information and deal documents or um you know one of our design partners, for example, is a lithium-ion battery technology company.
• 15:03
  SPEAKER_00: So their IP is critical, and anything to do with that going out is is a major problem.
• 15:08
  SPEAKER_00: And and you think about what the existing types of data protection technology offer you in trying to stop that that information leaving, it's pretty minimal, right?
• 15:15
  SPEAKER_00: You can't nicely key off anything in that data.
• 15:18
  SPEAKER_00: But but of course, in in our case, Harmonic actually understands the concept of lithium-ion battery.
• 15:23
  SPEAKER_00: You can write some very plain English ways of describing what you care about, and then we can spot that on the way out in a way that nothing else could before.
• 15:31
  SPEAKER_00: So it is it is, yes, partly an accuracy leap because we we're looking at it like a human word and we're not gonna start throwing all those false positives over.
• 15:38
  SPEAKER_00: But but the bigger piece is probably that we're we're actually a strategic tool here.
• 15:41
  SPEAKER_00: We can actually spot the things you care about, not just the sort of compliance tick box uh pieces.
• 15:46
  SPEAKER_00: Got it.
• 15:47
  SPEAKER_01: All right.
• 15:47
  SPEAKER_01: What are your big plans for 2024?
• 15:49
  SPEAKER_00: Yeah, we're we're sort of exciting news for us is is we're just getting ready uh with the sort of general availability of harmonic.
• 15:56
  SPEAKER_00: We've been working with design partners uh who've been live since January on the platform and we've been honing the product since then.
• 16:03
  SPEAKER_00: We we've taken a very, you know, uh I guess customer-first approach of just as soon as we had something we could push live, we we went and took it to to the CISOs and and went live.
• 16:13
  SPEAKER_00: We've had over 50 CISO conversations before we even started writing the code and building anything to make sure that we're we're building in the right way.
• 16:20
  SPEAKER_00: So in terms of of this year, the goal is now getting from that design partner stage where we are today uh to the point where we we're at GA, which is weeks away, not months.
• 16:30
  SPEAKER_00: And then from there, we'll be obviously bringing uh more and more customers on board and uh building out the platform more broadly than it is today.
• 16:37
  SPEAKER_01: Got it.
• 16:38
  SPEAKER_01: And uh you mentioned the event you have during RSA.
• 16:41
  SPEAKER_01: What else do you have on during that week?
• 16:43
  SPEAKER_00: Yeah, I'll um I mean, like everyone else, I'll I'll be pretty busy hanging out with uh with everyone being in town here.
• 16:49
  SPEAKER_00: Um yeah, we've got a we've got a meeting room in in the Moscone on uh on the Wednesday.
• 16:54
  SPEAKER_00: On the Tuesday, I've got the lucky to have some fantastic seed investors at 1011 who are hosting us in a a space next to the uh the Moscone as well on the Tuesday.
• 17:04
  SPEAKER_00: So uh beyond that, I'll probably be in the lobby of the four seasons with everyone else for a chunk of the show or uh or at the bar.
• 17:10
  SPEAKER_00: You know, certainly harmonic brewing on the Wednesday night.
• 17:12
  SPEAKER_01: Uh I love that.
• 17:13
  SPEAKER_01: And they can go to your website to sign up for the the brewing night.
• 17:16
  SPEAKER_00: That's right.
• 17:17
  SPEAKER_00: Yeah.
• 17:17
  SPEAKER_00: Anyone feel free to fill in the form on there and we'll uh get back to you imminently.
• 17:21
  SPEAKER_00: And if you'd like to find out more about Harmonic, you can uh request a demo as well.
• 17:25
  SPEAKER_01: That's awesome.
• 17:26
  SPEAKER_01: Well that's a that's a luck for the sandbox competition itself and of course you know for the rest of the year and beyond uh looking forward to seeing your six days.
• 17:34
  SPEAKER_00: Thanks, Andrew.
• 17:35
  SPEAKER_00: Real pleasure catching with you today.