Latest / The MonkCast / The Digital Sovereignty Questions Every Enterprise Should Be Asking with Jason Willeford
Transcript
- speaker-0: Hey, it's James Governor. We're here for another month cast, and we're here to talk about sovereignty, digital sovereignty, which is so important to enterprises across the world. With me today I have Jason Williford, global lead for secure global support at Red Hat. And ⁓ yeah, this is something I understand, Jason, you have been working on for quite a long time. speaker-1: ⁓ yes, James. Thanks for that introduction. It it is. So ⁓ just to give a quick ⁓ overview, I know we'll dive deeper into the offerings, but I stood up ⁓ confirmed stateside support about ten years ago ⁓ here in the US, and I've long since known that the you know needs of security, the needs of ⁓ public sector were not just unique to the United States. And ⁓ ⁓ it it took some time to break into the European market, but once once I did it it took off and and we last year we launched confirmed sovereign support for the EU. And I can get into ⁓ kind of what that means ⁓ later in the in the broadcast. But yeah. speaker-0: Awesome, that's great. And so here's the thing, I think that Jason, you know, you're a serious person. ⁓ before the call, ⁓ I noticed this because you dialed in five minutes in advance. And I thought, I'm pretty sure that Jason has a history, possibly in the military with that kind of timekeeping. speaker-1: Yes, actually, so I've been with Red Hat twenty one years and ⁓ did some finance work before that, but I did two tours ⁓ with the US Air Force, ⁓ active duty and then a tour ⁓ with the US Air Force in the reserves. ⁓ and I was sent to two ⁓ global conflicts. ⁓ so yes, so I've got quite a bit of military experience in my background. speaker-0: There you go. So I think, you know, if there is an organization that cares about security, ⁓ cares about locking things down, controlling their information, everything else, ⁓ it is a military. So that's probably a useful background. But yeah, let's get back to the present. ⁓ this this this ⁓ consideration around sovereignty is just getting ever more important. ⁓ I'd love to know what are you hearing ⁓ from customers and how has that conversation changed ⁓ in in in recent times? But also what does sovereignty actually mean to Red Hat and to those customers? speaker-1: So that's a that's a great question. And I'll start with the ⁓ the second half of that question. Sovereignty is different things to to different people, and and I like to describe it in ⁓ the form of like a a spectrum of ⁓ security and operational sovereignty, data sovereignty. At one end of that spectrum, you have simple, you know, biometric security, ⁓ physical security, ⁓ things of that nature. At the complete other end of that spectrum, you have all those things and above, but including ⁓ you know, data security and privacy, even maybe things like ⁓ supply chain security, all the way down to the silicon. So it there's a wide range ⁓ of what sovereignty is to different people. The first part of that question. So ⁓ stateside support's nearly 10 years old. ⁓ there are a lot of things that I've learned along the way. I I I've built it, set it up specifically for U.S. public sector. And primarily that is who ⁓ our addressable market is ⁓ here in the States is ⁓ government entities, government agencies, ⁓ some ⁓ you know vertical leaders that ⁓ yeah. Northrop Grumman, for example, like that ⁓ you know, cater to the government entities. But what we have learned in launching sovereign support for the EU way more than just public sector cares about sovereignty in the EU. commercial entities, ⁓ banks, telcos, y you name it. Everyone cares about ⁓ sovereignty, both Data sovereignty and operational sovereignty. I spent a number of weeks ⁓ touring through Europe and speaking with Red Hat sellers and more importantly, Red Hat customers. And time and time again, the message that I received from ⁓ those customers was not just operational sovereignty, but both data and ⁓ their like entire stack. So supply chain sovereignty. is very important to our European customers and it kind of stands apart from the experience that I've had here in the States. speaker-0: Okay. Yeah, I think that's that's definitely coming through loud and clear and one of the things I I you know, I'm gonna be, you know, just very direct. ⁓ you know, ⁓ sometimes you see things, you think it's good, ⁓ and and it's okay to say that as an industry analyst, you know, or occa occasionally gonna like, ⁓ yeah. And I I must admit, I I think that the ⁓ yeah, the the the framework that Red Hat put forward for these different aspects of sovereignty, I mean it's the most sophisticated that I've seen ⁓ in the industry so far. So you know, the the the the you know, I think sometimes you're just like, ⁓ digital sovereignty, that just means you need to either host it in a local data center, you know, put the data in one place. But of course there are so many other aspects, you know, you go and talk to French, German organizations, they're gonna be like, we actually need French or German employees, certainly European employees to be the one that are doing the service and support. ⁓ you've got as it the the aspects you've said, you know, some almost you know, to physical security as well. You need to be thinking about the devices, the edge. ⁓ and and once we start to layer that the these things, we data sovereignty, operational sovereignty, ⁓ y location based sovereignty, all of these things, it is quite complicated. ⁓ and on that note, so you are or or are you know, Red Hat is is increasingly to your point taking a full stack approach. Can you talk a bit more about that and what that what that stack might might look like? speaker-1: Yeah, so ⁓ you're right. It is getting sovereignty is the spectrum of sovereignty is getting ever more complex. And what Red Hat wants to do is decomplex that for its customers. And we want we want to provide a full spectrum. and it will even with Red Hat at the helm, it will still get more complex the further that you go. ⁓ but red hat will be with its customers along that journey. So at one end of that spectrum, it's operational sovereignty. So we we stood up and launched confirmed sovereign support in March. ⁓ along with that, there's it's EU citizens on EU soil and the data sovereignty that goes along with that. So and I have to double click down on on data sovereignty for a moment. So Love that. Without Always go deep. Always go deep. When we talk about data sovereignty, there are a number of things ⁓ that can fall into that category. ⁓ And When we launched ⁓ sovereign support for the EU, we took a hard look at ⁓ data sovereignty for our customers and we divided it up into a couple of sections. So ⁓ one layer of that data sovereignty is the ⁓ the stuff that resides in the you know ⁓ customer portal, right? So those are things like the ⁓ issue description, comments that customers make back and forth to the engineers. Yep. And and the metadata that's associated with that. Now our our ticketing system, and I'm gonna be honest, it is ⁓ Salesforce, that's no secret. we ⁓ have the ability to ⁓ control that data behind role based access controls, which is what we've done. ⁓ and for our European customers, that role based access controls are controlled by my team. We hold the keys. So it's not some admin in some faraway location that might accidentally click a button and, you know, expose a European customer's metadata to the the rest of Red Hat. For global support, that is the case. So if you are a customer and you have global support, you can receive your support from anywhere around the globe. Red Hat ⁓ like most ⁓ technology companies who provide ⁓ you know intricate ⁓ and and very well rounded support use a follow the sun model which means the support follows the sun so we have support centers s ⁓ around the globe and and they go day by day around the globe. The EU support is a 24 hour in the EU support offering. So if you open up a support ticket at two AM local time ⁓ on any given, you know, weekday or weekend, you're gonna get support from my team if you're a a CSS customer. speaker-0: A bit of an overhead for you, frankly. And I'm not saying that's a bad overhead. I mean, you know, that the you're you're meeting a customer need. But obviously, yes, ⁓ there is a different way of working here when you're not following, when when you can't just say, ⁓ the next time zone takes on support roles. That that's that's a a very different that's very different from a support organization perspective. speaker-1: It is a very different ⁓ from a support organization. ⁓ senior subject matter experts like most everybody don't want to be working swing shift, night shift. ⁓ but that is that is what we've done. So we have senior level experts that are ⁓ working s sovereign support cases at you know two AM on a Saturday night. ⁓ and that is just a reality for where you have to be when you want to provide this level of support to ⁓ your customers. So not only do we have, you know, very s well seasoned, ⁓ trained engineers 24 hours ⁓ a day, but those engineers provide a different level of service to their customers. It's a much higher touch. So you're dealing with a a smaller subset of ⁓ very strong, capable engineers, as well as a smaller subset of a customer base. And that lends itself to those engineers developing very strong relationships with their customers. ⁓ that was something that I learned ⁓ through standing this up ha here in the US and it's not something that I set out to do, ⁓ but it is a byproduct of the level of support that we're providing our customers. ⁓ And before we get too far away from data sovereignty, I I wanted to go back and and talk about that spectrum. So you've got your metadata that you put into speaker-0: Actually, I just want to jump in here myself, Jason, before we let's get back to that because one of the the the the the the foundational needs here and I think arguably why this is more important than ever, we haven't I mean it's 2026 and you know we've been on on this call for about twenty minutes. We're you know, we have not yet mentioned AI, but I have to say, so organizations are you know, AI sovereignty is gonna be increasingly important and certainly where this meets, I think, is speaker-1: Absolutely. speaker-0: This the this this buzzword in AI AI at moment, which is context. So the idea that we need to be able to feed the agents the enterprise or organizational context so that it can do a better job of developing software or building a business process. But there's a lot of governance that's required. What I'm seeing in talking to organizations, ⁓ and and you know, not just from a sovereignty perspective, but the the what you don't want to do is just to to to feed the beast. You don't want to just say, okay, we're gonna give the model ⁓ complete access to all of this data. You know, we need to be absolutely concerned about PII. ⁓ Absolutely. We we we we need to and and it might be, you know, we're doing what you know, I'm seeing organizations ⁓ I was talking to one just just the other week and they're like, ⁓ well, you know, we we've got this problem which we ⁓ where we basically fed fifteen years of SharePoint documentation into ⁓ the model, and needless to say, it came up with kind of hinky answers that were not ⁓ meeting the the the organization's current requirements. That's absolutely kind of thing you don't want to do. And I I feel like there might be a play here where frankly the digital sovereignty work will play into more effective AI work. Cause certainly nobody wants to just and in fact we we saw this we saw this explicitly talking to European organizations saying we will not use ChatGPT because we just don't feel we have that trust factor at you know, well, at this point. So yeah, it you know, to me, I think hearing you talk about context and data sovereignty, AI sovereignty is very closely associated with that, particularly because everyone's like, give more context, give more context. Sometimes you don't want to give more context for them to the model because A, you might be getting worse answers, but B, pretty clearly you don't want PII, you don't want organizational ⁓ secrets to find their way into these models. speaker-1: Absolutely. Absolutely. So you you brought up a really good point and a strong point. And I think this is something that our European customers are still trying to figure out for themselves. this, you know, this whole thing ⁓ sovereignty wise, for some of our customers is is old news, but for many of our customers this is still very new. And as you said, how does AI play into the space? All of this is not only very new, but but developing very rapidly. And so one of the things that makes Red Hat very strong in this is that we give the keys to the customer for their entire stack. So it's it's open source. They can run ⁓ their data where they want, how they want. And that includes the AI models as well. So they can run AI local in their data center. They can give it access to the specific data that they care about. And like you said, keep PII data out of it, keep sensitive data out of it. And and those are extremely important things that I think our customers need to be thinking about when they start to dip a toe or dip a foot into the AI space. Where is that data coming from? What processing is is happening to their data and where is it it being ⁓ you know processed on? Is it Is it being picked up and and going to a US based ⁓ model that's being processed there and then sent back? Is it being processed locally? Where did the model come from in the first place? What what data was it trained on? These are all questions that our customers need to ask, not only of themselves, but of their vendors. And and and I fully include Red Hat in in in this ⁓ list, of course, but that That list goes way deeper than just Red Hat. And customers I I don't wanna sound any alarm bells, right? ⁓ there's gonna be a lot of things that customers do. speaker-0: I don't think you I I I think the I think the market is it I mean the alarm bells are ringing pretty loudly already. I mean I I think this is definitely this is meeting a market requirement. This is not like some, you know, FUD security, who know, the you know, the baddies are out there. And no, I mean I mean to be fair, the baddies are out there as well. But the the yeah, the the the the conversations speaker-1: Exactly. speaker-0: that I'm having w with enterprises. And I'm I'm here, I'm based in London. I deal with a lot of European organizations. ⁓ yeah, this this is not I you almost can't bang bang the drum loud enough. And I think that was one of the reasons I wanted to record this was taking that broader view, helping people understand that we've got like data ⁓ sovereignty, technical sovereignty, operational sovereignty, assurance sovereignty, all these different aspects that they and AI sovereignty, these are all things that organizations need ⁓ to think about. So Yeah, don't I d I don't think you need to worry that you're you're you're putting the fear factor here. You you're quite quite measured. speaker-1: I think it's I think it's important for customers to be asking this of themselves and be asking this of their vendors. ⁓ and and quite frankly, ⁓ they they need to be ⁓ more strongly worded, I think, when they're talking to their vendors. Yep. We all ha we all have the ability to meet the customers where they are. And and Red Hat for one does a really good job of meeting the customer where they are. Yep. ⁓ sending me around a tour of Europe is is one of those ways so that I can learn about what our customers' needs truly are, help educate our customers on the offerings that Red Hat has, and then take some of that back, get to work, ⁓ weak the offerings that we have, maybe come up with new offerings to meet the customers' ⁓ demands. And one of the things that I learned. Surely on on one end of that spectrum is the operational sovereignty. So we lost we launched ⁓ CSS for the EU. ⁓ you know, it's it's ⁓ EU citizen on EU soil, ⁓ the data that the customer uploads to us stays in the EU. More importantly, we talked about this a minute ago. The AI, any data processing that happens to that data stays in the EU. Of course, we have to go through logs. We have tools that we use to analyze those logs. All of that support infrastructure resides in the EU. ⁓ and and so that that's one end of the spectrum. The other end of that spectrum is how does Red Hat address ⁓ its ⁓ software stack? How does a Red Hat help the customers address their software stack? Another s kind of step in that direction is Project Lightwell. So Red Hat is going to be helping its customers kind of fight AI with AI. So one of the things that by the speaker-0: Everybody, we I have another podcast coming up about Lightwell. It's very interesting. ⁓ if you are a an organization using Java, and that's pretty much every enterprise out there, listen to the podcast. ⁓ we got you know more more coming along ⁓ about this. But yeah, Jason, why don't you you know watch out for that everyone? But Jason, go ahead and yeah. speaker-1: Absolutely. Good plug for Lightwell, but it it all comes back to ⁓ providing a level of assurance and sovereignty to our customers, whether that is operational sovereignty or like Lightwell is addressing the the software stack above Red Hat. So of course we can take care of our own stack, but we want to help customers take care of their ⁓ sovereignty and their assurance in the rest of their ⁓ open source stack. speaker-0: Question about that, Jason. Yep. So you've talked about asking tough questions of your vendors. And I think that's great. Is there a role for Red Hat to play? Like, do some of these or you know, if you're talking to a major organization, one of your major customers, I mean, one thing that Red Hat has always done actually is provided assurance. You know, if if we think about look, I'm running SAP on Red Hat, there's a level of assurance about ⁓ the the operation on the operations of the of that environment. Red Hat's always been a sort of a ⁓ supported folks that that are ⁓ up the stack. Are organizations saying, Hey Jason, ⁓ we appreciate what you're talking about. Can you help us ask tough questions? Or do your vendor partners how do we how do we know that a Red Hat partner has the same level of rigor that Red Hat has? speaker-1: James, that is an excellent question. And ⁓ so I'll I'll go back in history a little bit. You mentioned SAP. So, you know, one of those things is SAP or L for SAP. that is a partnership that we went into with SAP. We can give our customers, we can extend the strength and resiliency that Red Hat has with its partners. We can extend that to our customers. And we we've always done that. Whether that is working with our OEMs, ⁓ you know, eight HP, for example, or e even on the other side of the pond, Hitachi and Fujitsu, all of those global leaders, we can extend that partnership and the benefits of that partnership to our customers. And it doesn't stop with, you know, hardware vendors. It extends out to like SAP, for example. It extends to our software vendors. We're doing some amazing things. with these partners and we can we can provide that ⁓ you know level of assurance and level of quality onto our customers who of course don't have the resources, don't have the ⁓ the the the you know the monetary will to ⁓ b bring a partner closer to them. They can leverage the work that we already do with our partners. speaker-0: Okay. Yeah, that makes sense to me. So I I mean Joe and Partners, you've got a ⁓ another partner which is ⁓ even even bigger than Red Hat, ⁓ and that's that's the people that own Red Hat. So IBM. So they've been they introduced ⁓ fairly recently the IBM Sovereign Core. ⁓ you've spoken about the full stack. So is is that something that that you're involved with? What's the Sovereign Core initiative? Is that something that EU customers and other global would be interested in? speaker-1: It is. It is. So it's a it's a complete sovereign ⁓ you know cloud in a box ⁓ provided by IBM. Red Hat is a part of that stack with IBM applications. The operational sovereignty behind that for the Red Hat pieces is my team. So I am very close to Sovereign Core. And as the IBM stack ⁓ gets further developed and further released to other regions around the globe, my support organization will follow. So ⁓ right now we just have the EU support. We're looking at ⁓ rolling out sovereignty across ⁓ other regions as well. speaker-0: Yeah, I mean you mentioned Hitachi and Fujitsu. I think they've probably got a few customers in Asia Pac. ⁓ you know, I think the the the pretty clearly, ⁓ you know, Japan is is a market that is gonna be ⁓ looking ⁓ to these sorts of solutions and one would expect that in you know, across as I say, across Asia Pac. So speaker-1: Absolutely. Absolutely. And and Red Hat is listening and responding. speaker-0: Okay, so that's sovereign core. I I mean I think just to sort of as as I'm pretty sure we'll we'll be continuing the conversation another time. There's just a couple of things that I wanted to sort of to tease out at the moment. Is it like sovereignty, is it is it is it kind of a is it a mindset? Is it is there a sort of an organizational change that needs to happen? You know, i i or or or or is this something that that that the organizations could think, ⁓ I can outsource this to a vendor? Like to what extent is it Is it is it a a different way of thinking and how do you engender and support organizations to become more aware of all of these different aspects? speaker-1: So ⁓ that's a good question. It absolutely is a mindset change. ⁓ and I would want Red Hat customers ⁓ throughout the EU to be able to leverage the work that Red Hat and my team have already done here in the States. Re you know, leverage that learning. Like I said, stateside support's almost a decade old. We know how to provide sovereignty to our customers. We have a tried and tested and trusted. ⁓ workflow and framework for doing that. But our customers and and other customers do need to ask both themselves and their vendors of what sovereignty looks like. But they have they've got to figure out what that looks like for them. How far down that rabbit hole they're willing to go and can go. It's been stated, ⁓ there's there's articles that I've read. We can't You know, the full spectrum of sovereignty is is unobtainable. ⁓ right. We we we don't have fabs, ⁓ in ⁓ the EU, for example. speaker-0: Yeah, yeah, yeah. No, that's a that's a huge you're don't worry, the EU is definitely all too aware of that particular issue, my friend. speaker-1: Right, right. So we're always going to have to mitigate the risk. So we we can't completely eliminate it, but you have to ask yourself, what are the risks that I'm encountering? What are the mitigations that we have? Ask those of yours of yourself and your vendors, right? I have had multiple conversations and I enjoy having these conversations with our customers. And they do ask, you know, tough questions. And I Want everyone ⁓ to understand these questions and these answers. Don't you know, don't hide in some corner somewhere. If you're, you know, some, you know, level three engineer for a customer and discovering issues and bubble those things up. Get people talking about it. ⁓ at the very least, I want people talking about these things, not only of themselves, but their industry peers and their vendors. speaker-0: That's awesome, because I was actually going to ask you that very question. So, you know, Red Monk's ⁓ constituencies tend to be ⁓ you know, engineering staffs and people that are wanting to engage with them. so yeah, what are the yeah, what what would you say to a developer or an engineer, an engineering leader about these issues and what they need to do? And then what would you say perhaps to the more traditional enterprise buyer? Like those those two different voices. What would you What would you recommend that that people should be thinking about? What should they do? Where what are the resources they might be able to learn from and so on? I mean, obviously you could say we'll talk to Red Hat, but ⁓ yeah, like what what what would you s what would you say to these these different constituencies about how they should be thinking about sovereignty? speaker-1: I I would say pick up the phone and reach out to your Red Hat ⁓ account executive. ⁓ but but no, but ⁓ but in in all seriousness, ⁓ I I you're right. The the engineers, the developers, the the coders who are in the backrooms, they have a voice and they need to extend their expertise up up the chain. Take those things that they see in the application stack. in the operation stack and discover those vulnerabilities, those risks, and elevate the conversation. ⁓ I I think that is extraordinarily important because the leadership in many organizations unknowingly rely on those voices ⁓ to be heard. And if if you are an engineer, a developer and working on your little corner, your little cog in an application stack, and you don't say something, then that is risks that just get absorbed ⁓ and and could potentially become, you know, a much bigger problem down the road. But I I would say think about leveraging open source. ⁓ when when any time you go the open source route, ⁓ you're you're given the keys. and you can you know ⁓ make your own destination and and choose your own path. I think that is extraordinarily important. If you are on the other end of that spectrum, you certainly want to leverage expertise ⁓ in that industry. Red Hat has it in space. Of course I'm I'm very biased, but we have you know extraordinarily strong services organization that knows the stack completely up and down, knows the solutions knows what the industry needs and can help those customers, you know complete that journey, even if they are still in the solution development stage, right? Red Hat ⁓ consultants and Red Hat services can certainly help customers move through that that journey. And I I think that's important. ⁓ But again, of course I'm very biased. Open source is ⁓ is is definitely the way to go. If something were to happen, you know, we a a lot of my customers during the European trip kept mentioning this ⁓ this thing called, you know, kill switch. Like, you know, what if ⁓ something happens speaker-0: We had it. I Fable we had it one day, we didn't have it the next day. You know, we we may well find that infrastructure that we rely on is no longer available. speaker-1: Yep, yep. And I think customers have to to to think about that. And if they have a primarily ⁓ open source stack and they are fully leveraging open source, they can continue to run ⁓ after day zero, right? And and let the geopolitical situation, you know, resolve. speaker-0: This also mitigates your risk against the kill sweat. speaker-1: Against the kill switch. Yeah. Yeah. Because you own you own the software, you own the stack, right? You own the keys to your kingdom, so to speak. ⁓ and I and I think that's very important. ⁓ so when customers are developing, you know, their own ⁓ workflows, their own applications, their own tool chains, ⁓ they need to take these things into consideration. And I think it's very important. And it's a it is I I don't want to say wake up call, right? But I for executives out there, I d I feel like what we're going through today and yesterday and the geopolitical things that we have kind of situation we've kind of found ourselves in, I think it is a wake up call to executives to be thinking about these as we go through our ⁓ journey. And and certainly Red Hat can help ⁓ customers along that ⁓ open source adoption. speaker-0: That's awesome. I mean, we all need to get better at this stuff. I mean, there's, you know, current stories in the news in the e in the in the UK and the EU at the moment. I mean, ⁓ Hungary continues to use ⁓ some ⁓ Chinese surveillance cameras. ⁓ and you know, there there might just be a little backdoor in there. ⁓ some of them have been blacklisted, still being used. ⁓ we're seeing the UK government kind of reassessing its relationship with Palantir, ⁓ vis-a-vis ⁓ information from the NHS, these issues are not going to become any less pressing. ⁓ and that's one reason why, although we're usually just, you know, about nerds at Red Monk, I think it's so important to understand issues like digital sovereignty, ⁓ things like the EU Cyber Resiliency Act, ⁓ you know, what's happening in terms of security. ⁓ and I think we'll save those for future conversations. C R A, you are waiting to come. I'll give you a speaker-1: Okay, yeah, because I was talking about I was about to dive down another rabbit hole. I'll I'll I'll just kind of touch touch on the surface a little bit. So what are the things that ⁓ the the customers reiterated to me ⁓ and and they're starting to see this come about? Not only do they have to worry about geopolitical issues, right? Whether it's ⁓ the US or China or Russia, but they also have to worry about speaker-0: G go go for it. Let's do it. speaker-1: a ⁓ str str ⁓ stronger regulation coming from their own ⁓ government entities, coming from their own consortiums. It you know, the Resiliency Act and Andora and things like that that are continually being developed and continually being added to also add restrictions to those customers. And they need to understand that that landscape and how that landscape will evolve. And yeah, we we can save that discussion. speaker-0: Sometimes the kill switch might come from inside. speaker-1: Exactly. Absolutely. Absolutely. ⁓ so ⁓ again, another plug for open source, like they y they get to keep running, you know, after day zero. speaker-0: You go, Red Monk loves a plug for open source. And on that happy note, let's ⁓ let's wrap the cut the conversation up today. That's another ⁓ monk cast. ⁓ Jason Willough, thanks so much for joining us today. speaker-1: Thank you, James, for having me. I appreciate it. And ⁓ I I I look forward to talking to you again. speaker-0: Great, and to all the rest of you, those of you that are interested in this topic, and I hope there are a lot of you that just st stuck with us, you should subscribe, you should keep on listening, ⁓ like this content, share it with people, because as Jason says, sovereignty is everybody's job. This is something we all need to think about. And ⁓ yeah, we've we've got some ⁓ some interesting content coming ⁓ soon.