Latest / Partnerships Unraveled / David Willis, Netskope

Transcript

David Willis, Netskope · Partnerships Unraveled

0:05
SPEAKER_01: Welcome back to Partnerships Unraveled, the podcast where we dive deep into the mysteries and the secrets of partnerships, alliances, and the channel.
0:12
SPEAKER_01: My name is Michelle, I'm head of marketing at Chanex, and I'll be your host for today.
0:16
SPEAKER_01: Now, today I've got the pleasure of speaking with David Willis, VP of Technology Alliances at NetScope.
0:22
SPEAKER_01: It's great to see you.
0:22
SPEAKER_00: How are you?
0:24
SPEAKER_00: Thank you very much for asking, Michelle.
0:26
SPEAKER_00: It is great.
0:27
SPEAKER_00: I am back home after a lovely vacation.
0:29
SPEAKER_00: I'm excited to be on the podcast and uh to talk with you today.
0:33
SPEAKER_01: Fantastic.
0:34
SPEAKER_01: Likewise.
0:34
SPEAKER_01: So welcome to Partnerships Unraveled.
0:37
SPEAKER_01: Let's kick off.
0:38
SPEAKER_01: Give us a quick intro who you are, what you're doing at Netscope, and maybe a bit of the path of how you got there.
0:43
SPEAKER_00: Sure, sure.
0:44
SPEAKER_00: So I am lucky enough to be the head of our technology alliance's team.
0:48
SPEAKER_00: My team builds all of the integrations for Netscope with third-party systems.
0:52
SPEAKER_00: And uh I've been in this role for about nine years.
0:55
SPEAKER_00: Prior to coming to NetScope, I kind of worked my way up what I call the OSI stack, right?
1:01
SPEAKER_00: I started in the US Navy doing nothing with computers.
1:04
SPEAKER_00: Actually, I barely knew what a TDM network was.
1:07
SPEAKER_00: Left, um, went to AT ⁇ T, where I designed uh networks for the Fortune 500, learned about all kinds of tech that's dead, frame relay networks, MPLS, QOS, whatnot.
1:17
SPEAKER_00: Went to Riverbed and focused on how applications worked over those networks, which is a really fun transformation and certainly appropriate at that time.
1:24
SPEAKER_00: Most apps were not ready for the wide area.
1:26
SPEAKER_00: Then I went to Palo Alto Networks, which was a wonderful thing.
1:31
SPEAKER_00: I was actually able to go there before they went public and help build their SP and MSSP practices, which was just really exciting.
1:39
SPEAKER_00: I mean, fast moving, emerging technology, really hot company.
1:43
SPEAKER_00: And uh, but I was there when people didn't believe in Palo Alto, right?
1:46
SPEAKER_00: So I got to work my way through that uh that transformation.
1:50
SPEAKER_00: And then it became very apparent to me that cloud was where everyone was going, premise-based solutions couldn't see 90% of the traffic, and so I came here.
1:58
SPEAKER_00: And it's been a wonderful, wonderful journey.
2:01
SPEAKER_00: I I've really enjoyed touching on multiple elements of networking, applications, and security.
2:07
SPEAKER_01: Right.
2:08
SPEAKER_01: Yeah, I definitely want to dive a little bit deeper into that.
2:10
SPEAKER_01: But before we do that, I want to touch on something.
2:12
SPEAKER_01: Before Tech, you served in the U.S.
2:14
SPEAKER_01: Navy.
2:15
SPEAKER_01: And I find that background generally interesting because I can imagine that military service builds a really specific kind of like operational discipline, mission clarity, structured outcomes, checklists for everything.
2:26
SPEAKER_01: And I'm speaking out of pure assumption because I've never been in the military, but I can imagine that some of that structure, that discipline stays with you.
2:34
SPEAKER_01: And I'm curious to hear what parts of that experience actually translate into how you work day-to-day at Netsco.
2:40
SPEAKER_00: Yeah.
2:41
SPEAKER_00: Yeah, I think you know, you nailed it.
2:43
SPEAKER_00: The big thing that the military forces you to do because of its complexity, breadth, rotations, there's all kinds of change constant, is you have to have checklists.
2:52
SPEAKER_00: You have to build systems, and the systems remain while people change.
2:56
SPEAKER_00: And that has actually been so key to our role.
2:59
SPEAKER_00: You know, Netscope is a fast growth company.
3:02
SPEAKER_00: We've gone from having 15 partners when I joined to over 400 now that I can name.
3:07
SPEAKER_00: And so with that kind of speed with a relatively small team of people, we have to build these systems.
3:13
SPEAKER_00: So uh it was very, very useful to have that operational discipline.
3:17
SPEAKER_00: I'm not going to say we always adhere to it.
3:20
SPEAKER_00: You know, the civilians, I've been in the civilian world for a long time, you know, almost 30 years.
3:25
SPEAKER_00: You have to give up true rigor, right?
3:28
SPEAKER_00: People do not stay out of the military for a reason.
3:31
SPEAKER_00: So a lot of times, you know, something that would be black and white and very clear-cut in the military might not be right, but you have to make a rapid decision based on, again, a kind of a flowchart.
3:42
SPEAKER_00: Here, things are much more amorphous.
3:44
SPEAKER_00: And I'll give you an example.
3:46
SPEAKER_00: So because in tech alliances we're working with partners, sometimes partners are no longer partners.
3:52
SPEAKER_00: There's a lot of change, MA activity, spinoffs.
3:56
SPEAKER_00: And so we're constantly having to evaluate is the partner of today going to be the partner of tomorrow?
4:01
SPEAKER_00: Is the competitor of today going to be the competitor of tomorrow?
4:04
SPEAKER_00: I don't think it's quite so clear-cut in the military.
4:08
SPEAKER_00: Uh I'm sorry, uh, it's it's more clear-cut.
4:10
SPEAKER_00: At least you're getting a lot of direction from the top down.
4:13
SPEAKER_00: Here, it's more of a bottoms-up.
4:15
SPEAKER_00: You know, we've got to be opportunistic, we've got to help our customers.
4:18
SPEAKER_00: And so it's really resulted in this cooperation framework where I don't say we all kumbaya, but one of the things I love about tech alliances is, if I may again use a military metaphor, it's like NATO.
4:30
SPEAKER_00: Okay.
4:30
SPEAKER_00: So everybody has some tension, some overlap, but we're all trying to get along because we know that we're all trying to fight against the bad guys.
4:39
SPEAKER_00: And we're all trying to be aware of the fact that the competitor of today is potentially the partner of tomorrow, and vice versa.
4:47
SPEAKER_00: So that level of uncertainty and change, you know, you can't have checklists for that.
4:52
SPEAKER_00: So you just have to kind of uh play it by ear.
4:55
SPEAKER_00: And honestly, the best thing we can do is be really forthright.
4:59
SPEAKER_00: I find the one thing that I really love about this particular job and this environment is we're all trying to do the best we can.
5:07
SPEAKER_00: And as long as we provide our best self and our most honest self, even if that honest self basically says, look, I'm sorry, I can't partner with you right now, we're competitors.
5:16
SPEAKER_00: Saying that quickly as opposed to just lingering uh has really made it a lot easier to navigate this particular world.
5:25
SPEAKER_01: I think that's such a fascinating answer.
5:27
SPEAKER_01: And while you were talking, I was thinking about how I apply some of those more rigid, discipline-led structures to my own day-to-day.
5:36
SPEAKER_01: And I think it's all about nuance, right?
5:38
SPEAKER_01: If you think about it, structure, discipline, super important, but in a fast-changing world where decisions might not be life or death every single day, you need to apply that flexibility at the same time.
5:51
SPEAKER_01: And knowing what to focus on, where to be rigid, and what to let go, I think is such an incredibly valuable skill set to have.
5:57
SPEAKER_01: But another thing you said is really about transparency, right?
6:01
SPEAKER_01: We get to better outcomes faster if we're clear and honest with each other.
6:05
SPEAKER_01: And I you you mentioned the term, I think it was cooperation.
6:09
SPEAKER_01: I've never heard that before.
6:10
SPEAKER_01: In Dutch, we actually have a simple similar word which translates to like con colleague, like competitor colleague.
6:17
SPEAKER_01: It's very funny.
6:18
SPEAKER_01: I'm I'm gonna I'm gonna use that in the future.
6:20
SPEAKER_01: But I I think, yeah, it's it's really all about nuance.
6:23
SPEAKER_01: And I think companies really would benefit from having that more disciplined structure in place combined with the understanding that as things change, we can't grasp onto that structure for dear life and say, no, no, no, but this is how how we did it, right?
6:39
SPEAKER_00: Yeah.
6:40
SPEAKER_00: And I think it's funny.
6:41
SPEAKER_00: I love tech, but what I love more, because tech in many ways is fairly straightforward.
6:46
SPEAKER_00: It works or it doesn't.
6:47
SPEAKER_00: And then you're just establishing a baseline of how to get from point A to point B.
6:51
SPEAKER_00: Frankly, people are much more complicated, right?
6:54
SPEAKER_00: 90% of my challenges are navigating people.
6:57
SPEAKER_00: It's in communication.
6:59
SPEAKER_00: And so having that flexibility is just so incredibly important.
7:03
SPEAKER_00: And luckily, again, the military really gave me a great foundation in working with very diverse personalities in order to get the mission done.
7:12
SPEAKER_00: And, you know, we we I've got a lot of really good guys, good people on my team.
7:19
SPEAKER_00: I got to work with amazing individuals, but we're constantly having to do that check-in of are we doing the right thing?
7:26
SPEAKER_00: We're all trying to do the best.
7:28
SPEAKER_00: There's no doubt about that, but are we doing the right thing?
7:31
SPEAKER_00: And again, there's a mix of qualitative and quantitative assessment that needs to be done on a regular basis.
7:38
SPEAKER_00: And I find that I love those kinds of conversations.
7:41
SPEAKER_00: Even though there's more uncertainty, uncertainty leads to creativity, creativity leads to, you know, fulfillment for me.
7:47
SPEAKER_00: So it's good.
7:49
SPEAKER_01: I I think that's such a cool perspective, right?
7:51
SPEAKER_01: I recently had a conversation with someone who said, you know, if you're in a market that's homogenized, you get kind of lazy, right?
7:57
SPEAKER_01: And I never thought of it that way.
7:59
SPEAKER_01: Like if you have if you're working in Asia, there's like 15 million different cultures, you have to deal with different ways of working, different legal structures, et cetera, compared to like a market that, again, is more or more homogenized, it makes it seem like your go-to-market is easier because you you you know the people.
8:15
SPEAKER_01: But keeping that trigger, you know, competition create, it makes you creative, it makes you innovative.
8:19
SPEAKER_01: I think that's really important to hold on to.
8:22
SPEAKER_01: But there's something interesting about what you're saying here, right?
8:24
SPEAKER_01: And and it's if look, if we drill everything down to first principles, the conversation becomes really, really simple.
8:30
SPEAKER_01: And we can do that with alliances and partnerships.
8:33
SPEAKER_01: Like if we look at tech and tech alliances and channel partnerships, what are they about?
8:37
SPEAKER_01: They're about multiplying reach.
8:39
SPEAKER_01: But if you drill into them, they're completely different logic, right?
8:43
SPEAKER_01: They operate entirely differently.
8:44
SPEAKER_01: And I think sometimes within a partner ecosystem, you see those two getting mixed up, and that can lead to a really messy partner dynamic.
8:51
SPEAKER_01: So how do you think about that difference?
8:53
SPEAKER_01: How do you build and manage and measure those types of relationships?
8:57
SPEAKER_00: Yeah, yeah.
8:57
SPEAKER_00: It's a it's a great question because it really does come up all the time.
9:01
SPEAKER_00: I find that the uninitiated lump, like you said, lump every everything together.
9:06
SPEAKER_00: And it is absolutely important to at least handle them, not somewhat similarly, but let's say resource them somewhat similarly.
9:12
SPEAKER_00: And the reason is that there's so many people influencing deals, influencing customers.
9:18
SPEAKER_00: And so teasing out who those groups are and understanding how much leverage each one has and how important each one is to the customer, identifying the decision makers, right, the processes, the tools, it's critical.
9:30
SPEAKER_00: So we need to have that.
9:32
SPEAKER_00: So I'd rather have a channel manager going, I don't know what to do with this, I'll give it to you, than to just say, well, this doesn't fit really well into my model.
9:39
SPEAKER_00: And the reality is right now, nothing really fits well.
9:43
SPEAKER_00: Resellers are becoming influencers, resellers are delivering services, resellers are increasingly delivering product.
9:52
SPEAKER_00: I mean, you look at what Dell did, they basically built Tages because the margins were better.
9:57
SPEAKER_00: They could get more deeply embedded.
9:58
SPEAKER_00: We see the same thing with Arctic Wolf.
10:00
SPEAKER_00: Arctic Wolf is this weird hybrid of a product and services.
10:05
SPEAKER_00: CrowdStrike's done it too, right?
10:07
SPEAKER_00: So the reality is the nature of our industry, where there are so few resources relative to the attack surface and the complexity of the problem, has resulted in like these really undefinable entities that we're working with.
10:23
SPEAKER_00: And I find that when I'm getting in a conversation, I have to quickly discover look, are you selling services, are you selling product, or are you selling both?
10:30
SPEAKER_00: And the reason I have to do that is my team is not equipped to be a channel organization, but we are equipped to help these companies build products that can work with ours and then train them in how to talk about it.
10:42
SPEAKER_00: And then if there is a go-to-market motion, I pull in either the go-to-market peers and partners on my team, or I pull in the resellers or the telcos or the SP leaders.
10:54
SPEAKER_00: And I think, you know, that's only going to grow.
10:56
SPEAKER_00: Look, everyone's gonna have an agent.
10:58
SPEAKER_00: Everyone's gonna be deploying something and trying to monetize it.
11:01
SPEAKER_00: So the the reality of these well-siloed, I'm only an ISV or I'm only a whatever, I think that's it's going to continue to collapse.
11:10
SPEAKER_00: Now, there will be continue to be pure plays, but I cannot believe how many companies are trying to build product now.
11:16
SPEAKER_00: And I don't know if it's because of vibe coding.
11:18
SPEAKER_00: I don't know if it's because of the newer generations where everybody has had a crack at doing coding and building product, but for whatever reason, I I do not go into a conversation with the assumption that it's going to be either just services or product.
11:34
SPEAKER_00: So it's been a great conversation to have because I also know based on my past how to create products and services around these integrations.
11:43
SPEAKER_00: And so it's it's it's again, it's fun, it's creative.
11:46
SPEAKER_00: It's like, okay, we can build this, but you sell it a certain way, and I don't know if we build something, you're really going to be able to sell this to that particular group.
11:55
SPEAKER_00: And so it adds that other element to the checklist, as it were.
11:58
SPEAKER_00: What are we gonna, what outcomes are we gonna create, not based on tech, but based on sales motion, service offering, and customer base?
12:05
SPEAKER_01: Well, but you raise a good point that those lines are becoming blurry, right?
12:09
SPEAKER_01: I mean, the entire what's the differentiation between channel and tech at some points, right?
12:14
SPEAKER_01: Because everything's working together.
12:15
SPEAKER_01: So then I'm curious, based on that experience you've had, what pulled you into those tech alliances and what's keeping you there now as opposed to going broader or narrower or whatever?
12:25
SPEAKER_00: All right, all right.
12:26
SPEAKER_00: I I I said in the beginning, truthy, truthiness is really important here, right?
12:31
SPEAKER_00: So I worked for over a decade at AT ⁇ T, and then I sold into AT ⁇ T.
12:36
SPEAKER_00: And what I discovered, although I didn't really tease it out until later in my career, is I was actually doing two jobs.
12:43
SPEAKER_00: I was a salesperson, a sales engineer, and eventually a major account manager, channel sales, all these other things.
12:49
SPEAKER_00: But at the end of the day, what I was really doing was helping these companies to find services that were ultimately taking the form of an integration or a sell motion because these tools had to be tied into all kinds of orchestration systems in service providers and SIs.
13:04
SPEAKER_00: And after a while, I said, why am I doing two jobs and getting paid for one?
13:07
SPEAKER_00: Which one do I like more?
13:08
SPEAKER_00: And uh the reality is I enjoy the creativity of the service enablement piece, which ultimately morphed into the integration piece.
13:17
SPEAKER_00: So it just um, you know, it's just what what flips your lid, right?
13:20
SPEAKER_00: I think the MSSP business, GSI SP business is it is very, it requires a lot of rigor and it requires a lot of patience.
13:29
SPEAKER_00: So the other thing uh I did when I came to this company, because I had just come out of uh Palo Alto, was I said, where are you at from a company perspective in thinking about working with these big companies?
13:41
SPEAKER_00: And they're like, well, we've got this one guy and he's working on this one.
13:44
SPEAKER_00: And I'm like, whoa, whoa, okay, hold on.
13:45
SPEAKER_00: Is that how you think of this?
13:46
SPEAKER_00: Okay, I don't want to do this.
13:48
SPEAKER_00: Because working with these kinds of companies requires a phenomenal amount of investment.
13:53
SPEAKER_00: Tons of resourcing, tons of documentation, you know, embedding in individuals into an Accenture or into a BT or an orange, right?
14:03
SPEAKER_00: And so I'm like, well, at this stage of the company, I think I can do a lot more as Tech Alliances.
14:09
SPEAKER_00: So lots of things.
14:10
SPEAKER_00: No one ever says, I'm gonna go there.
14:12
SPEAKER_00: You know, I listened to this great podcast by uh Shankar Vidankan of the Hidden Brain, and he said, when people look back on their lives, of course we can rationalize how we got there, but it was more like a series of happy circumstances, as opposed to a no, I I want to be in 20 years, I'm gonna be a podcaster, you know, uh talking to a million people about crazy concepts, whereas right now I'm an engineer.
14:36
SPEAKER_00: It's not a straight path.
14:38
SPEAKER_00: But that's how I got to where I'm at with uh no, I love that point.
14:42
SPEAKER_01: I think it's called the sharpshooter fallacy, right?
14:44
SPEAKER_01: That you uh you shoot an arrow and then you paint a target around it.
14:48
SPEAKER_00: Exactly.
14:49
SPEAKER_00: Exactly.
14:50
SPEAKER_01: While you said that, I was looking at my own career and I'm like, yeah, look in hindsight, it it seems incredibly logical, but while you're in it, you're like, oh, what's my next step gonna be?
14:59
SPEAKER_01: Oh, this sounds cool, this seems cool.
15:01
SPEAKER_01: Uh it's not as linear as you as you look at it from to the future looking back.
15:06
unknown: Yeah.
15:07
SPEAKER_01: No, I I I think that's fascinating, and and I I agree.
15:10
SPEAKER_01: I think the creativity of doing tech alliances, like I've I've been in product marketing for a long time in very tech heavy companies, and it was such a joy to see how products develop their existence, right?
15:25
SPEAKER_01: How these uh products are created, but then also how do you fit those into evolving ecosystems within new customer bases?
15:33
SPEAKER_01: And I think especially look at this was all pre-AI, like pre-the AI era that we have now, and I can't even imagine what it's like now because it almost seems like you mentioned these product companies are set selling services, and services companies are selling products, and that might be because of vibe coding.
15:49
SPEAKER_01: And just from my personal opinion, I'm very curious to see where that goes because we're at this point with vibe coding and Claude and all these tools that we can spin up stuff that actually looks pretty comprehensive and impressive in reality.
16:03
SPEAKER_01: But I'm curious to see where that model breaks down and where you'll then indeed need specialists to understand the complex inner workings of these integrations.
16:11
SPEAKER_00: Yeah, yeah, yeah.
16:13
SPEAKER_00: Great point.
16:13
SPEAKER_00: What our uh the CEO at my company actually put out a post somewhat similar to the post of the CEO, George Kurtz, at CrowdStrike, talking about the implications of generative AI tools for, in our case, cybersecurity industry, but it can really apply to any industry.
16:27
SPEAKER_00: And I think we're at this weird, not weird, it's actually been predefined by Forrester.
16:32
SPEAKER_00: We're in the hype cycle, right?
16:33
SPEAKER_00: Yeah.
16:33
SPEAKER_00: And right now we're at the peak of the the, it's not the peak of expectations or whatever it is.
16:39
SPEAKER_00: Any anyway, we're all like really, really excited.
16:42
SPEAKER_00: And my team actually, we just did another four-hour training session yesterday focusing on all the different tools that our company's bringing to bear to take advantage of, building agents, for example.
16:52
SPEAKER_00: So look, it's happening.
16:54
SPEAKER_00: But every peak is followed by a trough, the trough of disillusionment.
16:59
SPEAKER_00: And I think the trough in our case is we've been so hungry for so much automation for so long that we're thinking that this is going to change things.
17:09
SPEAKER_00: Now, I've been in this industry long enough to realize I've been talking about automation back when it was just RESTful APIs or even XML and soap.
17:18
SPEAKER_00: Very few people automate anything.
17:20
SPEAKER_00: Like AI does not change human nature.
17:23
SPEAKER_00: So what is interesting is we're seeing more and more of I want a human in the loop, which is getting right back to the idea of we're gonna take these technologies that need frankly their value is operating at speed, especially when the bad guys are operating at speed.
17:38
SPEAKER_00: And we're adding a human to the loop to like do a decision check.
17:40
SPEAKER_00: Are we gonna do this?
17:41
SPEAKER_00: Are we gonna do that?
17:42
SPEAKER_00: That totally makes sense for making changes to an entire system.
17:46
SPEAKER_00: But when it is coming down to, again, in our industry, an attack, that attack is there and gone in the blink of an eye.
17:54
SPEAKER_00: Right?
17:54
SPEAKER_00: So I I just find it the trough for me is going to be everyone's gonna expect this to do something when in fact the one thing it can't do is change human nature and human fear.
18:05
SPEAKER_00: So until all of us have basically moved on and are golfing or retiring, and all the people that were raised with AI and trusting AI and trusting automation come along, I think the trough is actually gonna be pretty steep.
18:19
SPEAKER_00: Now, there are a ton of things that we're that we're doing that I find really exciting, but also terrifying.
18:25
SPEAKER_00: And I find it terrifying because my team can do more with these tools than if I had doubled the size of my team.
18:33
SPEAKER_00: And so there's definitely that's again, that's a good thing for cybersecurity, don't get me wrong.
18:39
SPEAKER_00: I don't know if it's a great thing for society, but it's a great thing for cybersecurity.
18:42
SPEAKER_00: So we were looking at how to do to do this.
18:46
SPEAKER_00: But then you also asked, how does this change tools?
18:49
SPEAKER_00: Or how does this change the way we think?
18:51
SPEAKER_00: I think it makes integrations a lot easier to do.
18:54
SPEAKER_00: Frankly, I instead of having to give the customer uh or a partner rather an SDK or a CLI, right?
19:00
SPEAKER_00: I give them a markdown file.
19:02
SPEAKER_00: And it tells their system exactly how to work with our system.
19:06
SPEAKER_00: They don't have to manually convert it.
19:08
SPEAKER_00: That is so that is taking away days and weeks of wasted time because they don't care about how our system works.
19:14
SPEAKER_00: They only care about what they need to know to make it work with ours.
19:17
SPEAKER_00: That's great.
19:18
SPEAKER_00: What isn't it?
19:19
SPEAKER_00: It's not a product.
19:21
SPEAKER_00: So I've had this experience for several years now.
19:24
SPEAKER_00: My team actually built a tool to enable integrations at scale.
19:28
SPEAKER_00: We call it Cloud Exchange.
19:29
SPEAKER_00: And while it won a lot of awards, it was never intended to be a product.
19:33
SPEAKER_00: It was intended to be a set of tools that we gave customers to enable things.
19:37
SPEAKER_00: Well, the reality was in a very short period of time, customers made it very obvious that to them this was a product.
19:44
SPEAKER_00: They didn't care what our intended wrapper was.
19:47
SPEAKER_00: Didn't I it wouldn't have mattered if it was a container or an agent or an agent running in a container, right?
19:52
SPEAKER_00: They're like, it's a product.
19:54
SPEAKER_00: The implications for that go far beyond creating something cool with vibe coding.
20:00
SPEAKER_00: It was how do you monitor it for success?
20:03
SPEAKER_00: How do you monitor it for failure?
20:05
SPEAKER_00: Who's going to support it?
20:06
SPEAKER_00: What's the release cycle?
20:08
SPEAKER_00: These are all parts that may be automated over time, but there's an entire ecosystem that has to be built around a tool if that tool is going to become critical to a company's protection or building, you know, protecting their revenue, growing their revenue.
20:24
SPEAKER_00: So I think what's happening right now is everybody's going, oh, it's really easy to build code.
20:30
SPEAKER_00: Okay, that's not the problem.
20:32
SPEAKER_00: The problem isn't putting out a piece of code.
20:34
SPEAKER_00: The problem is what happens when the 15 service providers that want to use it all have incredibly different needs, want to know how it's going to work, and want to know whose throat they're going to choke.
20:44
SPEAKER_00: I'm sorry, with whom they're going to work when it doesn't work.
20:47
SPEAKER_00: And so again, I think this is another one of those troughs of disillusionment.
20:52
SPEAKER_00: Now, the trough of disillusionment with AI might be shorter than previous troughs because everything seems to be faster.
20:58
SPEAKER_00: But again, I think we're in this pixie dust and fairy tale, pointy hair Dilbert phase where everybody thinks throwing AI is going to solve all these problems.
21:06
SPEAKER_00: And these are not simple problems, right?
21:08
SPEAKER_00: This is uh these are problems that my team wrestle with on a daily basis.
21:12
SPEAKER_00: Anytime a customer comes and says, Oh, I just want, and I'm like, if we do that, understand the implications are we're gonna have to maintain that forever.
21:21
SPEAKER_00: We're gonna have to publish it, we're gonna have to scan it for a S-bomb, secure bomb, right?
21:26
SPEAKER_00: Make sure no security, bad security attacks or cybersecurity attacks get involved, blah, blah, blah.
21:31
SPEAKER_00: There's this whole set of expectations.
21:34
SPEAKER_00: So I just, again, it's easy to create code.
21:37
SPEAKER_00: It is.
21:38
SPEAKER_00: It's just, but it's hard to create a problem.
21:40
SPEAKER_01: Well, I mean, at the beginning of vibe coding, there were the all these memes around okay, cool, I launched an app in 10 minutes and it takes me 30 hours to do a code uh code review, right?
21:50
SPEAKER_01: Uh I I and I think that still in some way exists here, especially in cybersecurity, when you're thinking about oh, I'm launching something new, and of course you have all these checks and balances.
22:00
SPEAKER_01: But on the other hand, because you're using AI, you're not entirely sure about what this code actually is and how it indeed interconnects.
22:07
SPEAKER_01: So it adds another layer of, I don't know, perhaps confusion.
22:13
SPEAKER_00: It where you have to absolutely.
22:15
SPEAKER_00: Yeah.
22:15
SPEAKER_00: Yeah.
22:15
SPEAKER_00: Yeah.
22:16
SPEAKER_00: I mean, there's there's all these pieces that never were really well established that are now coming to the forefront.
22:22
SPEAKER_00: And I'll give you one example, which is non-human identity.
22:26
SPEAKER_00: Okay, so we're just seeing a group of vendors, like a good friend of mine who is a CEO and co-founder of a company called AMBit.
22:36
SPEAKER_00: They started about six, seven years ago with the premise that non-human identity had never really been properly tackled.
22:43
SPEAKER_00: And it's not just we need to know who the workload is, it's why is that workload entitled to communicate to these other systems?
22:50
SPEAKER_00: And how do you manage for over pre over-credentialing, over-permissioning, over-access, right?
22:55
SPEAKER_00: That was happening before agents.
22:57
SPEAKER_00: Now we don't have static workloads.
22:59
SPEAKER_00: We've got dynamic workloads being instantiated.
23:01
SPEAKER_00: We've got people throwing all kinds of permissions.
23:04
SPEAKER_00: I mean, I'll be I'll be very forthright.
23:07
SPEAKER_00: As part of our lab, I gave my Claude instance five different tokens to work with these systems, right?
23:14
SPEAKER_00: And that's because you have to do that to unleash the power of large language models to have multiple data sets.
23:20
SPEAKER_00: But at the same time, it's freaking terrifying because what happens if I get compromised?
23:24
SPEAKER_00: Now there's going to be all these non-human identities to which I delegated permissions and they're communicating with all kinds of other stuff.
23:31
SPEAKER_00: We didn't even solve the workload non-human identity problem before this.
23:35
SPEAKER_00: So all of a sudden we're hitting the wall, and it sounds like it's great.
23:40
SPEAKER_00: It sounds like nirvana, but the reason CISOs are like not sleeping right now is they didn't even know what their humans were doing, and now they got all this other stuff going on.
23:50
SPEAKER_00: And you know, in the name of productivity, they don't want to say no, but at the same time, they're saying, whoa, like let's let's let's build some compensating controls.
23:58
SPEAKER_00: And so we're gonna start seeing whole new attack vectors.
24:02
SPEAKER_00: And what the way, the way my company talks about it is look, you use AI and you protect against AI, or you securely enable AI.
24:09
SPEAKER_00: There's two different use cases, right?
24:11
SPEAKER_00: One is you're trying to stand on top of it and make sure it doesn't kill you.
24:14
SPEAKER_00: And the other is, you know, properly using it.
24:16
SPEAKER_00: And we're still, everyone's still working out how to properly use it.
24:21
SPEAKER_00: So I'm really excited that my company is also participating and leading some of these tech, these talks about how do you secure it, but it's on everyone's mind, right?
24:30
SPEAKER_00: And and so again, all these tools are great, but the reality is it's just accelerating all these other problems.
24:37
SPEAKER_00: Uh I'll give you another example.
24:39
SPEAKER_00: Secure bombs, right?
24:40
SPEAKER_00: I mentioned it earlier.
24:41
SPEAKER_00: What is going into the code?
24:44
SPEAKER_00: And what we're finding is there are attacks being launched by virtue of a repository getting updated in Git that everyone then connects to and downloads and uses for their agent, which has led to a large breach, right?
24:57
SPEAKER_00: A global breach essentially by everybody that was connecting to that particular repository.
25:02
SPEAKER_00: So, you know, it was bad enough before, but now we're just like 10xing, 20xing, 100xing the problem.
25:08
SPEAKER_00: So we've got to get control over those fundamentals, which you know there are companies that that have control over those fundamentals, and we just need to figure out how to speed it up.
25:17
SPEAKER_00: We got to get over that human risk element.
25:19
SPEAKER_00: Yeah.
25:20
SPEAKER_01: Yeah, it's such a good point.
25:21
SPEAKER_01: And I think it's almost paradoxical where every company now needs to obviously uh push AI from a value proposition perspective, and then internally they're all struggling to figure out like, hey, how do we effectively and securely and and sustainably implement these innovations in a way that like you said it yourself.
25:40
SPEAKER_01: Like I I had a conversation with our CTO recently, because I I had built basically a messaging hub for the entire company where they can get all our storytelling and playbooks and whatever.
25:51
SPEAKER_01: And I said, Hey, I made this with Claude.
25:53
SPEAKER_01: It it works really well.
25:54
SPEAKER_01: Launch it, please.
25:55
SPEAKER_01: And he said, Are you gonna be responsible for it?
26:00
SPEAKER_01: And in this case, I I simply looked at him and I said, I don't know what that means.
26:04
SPEAKER_01: Tell me more.
26:05
SPEAKER_01: And he said, Look, in this case, we're talking about the updates are infrequent and it's all static content, but think about the risks of if a malicious actor gets access.
26:14
SPEAKER_01: Think about what it means if you leave.
26:16
SPEAKER_01: Think about and I was like, whoa.
26:18
SPEAKER_01: So making this, that's the easy part, and then doing stuff with it, that's the hard part.
26:24
SPEAKER_00: That's right.
26:25
SPEAKER_00: That's right.
26:26
SPEAKER_00: That's right.
26:27
SPEAKER_00: You've got it.
26:28
SPEAKER_00: I'm glad you had that experience.
26:29
SPEAKER_00: And I think what's happening right now is everyone again is so excited about its productivity, but people get more training on how to use the tools than how to secure the tools.
26:41
SPEAKER_00: And uh, and so what's happening is there's all these industries popping up, like with our SI partners, right?
26:47
SPEAKER_00: And our Vower partners and their services, like what my company is delivering, which you know, AI detection and remediation, guardrails.
26:56
SPEAKER_00: But I don't think those, I don't think the services are getting adopted fast enough, and I don't think the products are getting adopted fast enough.
27:03
SPEAKER_00: Because we know, we know that a typical company has 40 to 50 people like you going out and building their own projects and doing their own thing.
27:11
SPEAKER_00: And all that's happening is customers are alerting on it, saying, oh yeah, you know, Michelle's like doing something like with Claude.
27:18
SPEAKER_00: Is that okay?
27:19
SPEAKER_00: I mean, and so, you know, there's the cybersecurity piece and then the support piece.
27:24
SPEAKER_00: And so again, I love being where I'm at because I'm seeing more implications.
27:29
SPEAKER_00: Now, I'm sure if I were in finance, I would have other implications like token burndown is terrifying.
27:35
SPEAKER_00: And actually, I love these concepts of like denial of service by running or figuring out how to trigger a claw query that or claw code that runs again and again and again, and actually not stealing, but basically demolishing a company by having their spend go through the roof.
27:50
SPEAKER_01: Wow.
27:51
SPEAKER_00: It's terrifying.
27:53
SPEAKER_00: Yeah, yeah, yeah, yeah.
27:55
SPEAKER_00: It's so smart.
27:57
SPEAKER_00: So, you know, there's lots of views on it, but I do I do find it very exciting.
28:04
SPEAKER_00: Maybe it's like the excitement of being in a battle, I don't know.
28:06
SPEAKER_00: But uh but it it's a great place to be in Tech Alliances because I'm not just focused on what my company is doing.
28:13
SPEAKER_00: I'm talking to every other partner about what they're doing.
28:17
SPEAKER_00: And then there's this like uh standoff, right?
28:19
SPEAKER_00: We're playing chicken.
28:20
SPEAKER_00: Like, am I gonna deploy an agent in your environment?
28:22
SPEAKER_00: Are you gonna deploy an agent in my environment?
28:24
SPEAKER_00: Are you gonna build an agent in your environment that talks to my environment?
28:27
SPEAKER_00: And those conversations kind of happened before, but it was a lot slower cycle, right?
28:32
SPEAKER_00: It was like, okay, are your PM teams gonna work with engineering to do this multi-month or multi-year integration?
28:38
SPEAKER_00: Now it's like, no, Bob sitting next to me is about to write this thing and we're gonna deploy it.
28:44
SPEAKER_00: And the question is, you know, there's all these other implications for our joint customers about who's hosting it, who's securing it, where does the data go?
28:52
SPEAKER_00: Uh, is the data protected, right?
28:54
SPEAKER_00: And uh so I'm having this conversation every day, multiple times a day, internally, externally.
28:59
SPEAKER_00: And I get to see kind of the I'm calling this the Devonian age of AI, right?
29:04
SPEAKER_00: For those of you who aren't science geeks, the Devonian age was the first breakout of life.
29:08
SPEAKER_00: And what's really cool about it is when you look at it, there's like all these things that have nothing to do with any life form that exists today.
29:15
SPEAKER_00: We all came from like one nematode, right?
29:17
SPEAKER_00: But there were like five, there were AC or symmetrical creatures like starfish and all those other weird creatures that are like bubbles and things.
29:24
SPEAKER_00: That's kind of where we're at with AI, where there's like everyone's trying everything, throwing it against a wall.
29:29
SPEAKER_00: I don't know what's going to come out the other side.
29:30
SPEAKER_00: You know, is it gonna be MCP?
29:32
SPEAKER_00: Is it gonna be CLI?
29:33
SPEAKER_00: Is it gonna be something we haven't thought of in three months?
29:35
SPEAKER_00: But it's a really, it's really exciting to be in the middle.
29:38
SPEAKER_01: Yeah.
29:39
SPEAKER_01: I I think it circles back to something you said at the beginning, right, about that operational discipline where I think the best thing we can do as organizations is have the guardrails in place for the foundations of building, indeed.
29:53
SPEAKER_01: Like how does it connect?
29:54
SPEAKER_01: What data are we using?
29:55
SPEAKER_01: What does it connect to?
29:57
SPEAKER_01: Uh, how do we operationalize it?
29:58
SPEAKER_01: How do we support it?
29:59
SPEAKER_01: And then allow the shell around it to be like, we don't know what's next.
30:05
SPEAKER_01: It's almost like a curiosity and an exploration, right?
30:08
SPEAKER_01: Uh that I think is is fascinating and I definitely support, but I am so curious to see where this goes and and what people will be talking about in six months on this podcast as opposed to now, because the the pace of change is just rapid.
30:24
SPEAKER_01: And maybe, maybe that apex is already there.
30:27
SPEAKER_01: Maybe this is the kind of the coolness and complexity that is manageable from a tech and and and per uh people perspective.
30:36
SPEAKER_01: But uh yeah, what we don't know.
30:38
SPEAKER_00: We we don't.
30:39
SPEAKER_00: All I know is that uh oh gosh, one of one of the guys who designed the AI, or not, not he didn't design, he was a cybersecurity head.
30:49
SPEAKER_00: I want to say at Meta or at oh, he was at X.
30:52
SPEAKER_00: And he basically said, look, the attacks were already bad before.
30:56
SPEAKER_00: Now they're going through the roof.
30:57
SPEAKER_00: Like I we cannot keep up.
30:59
SPEAKER_00: We've got hundreds of millions of things happening all the time.
31:03
SPEAKER_00: We're we're something's got to change.
31:05
SPEAKER_00: And so that's where I'm like, I think this peak of this trough of disillusionment is coming.
31:10
SPEAKER_00: And it might just be the trough of exhaustion, right?
31:13
SPEAKER_00: It might literally be a point where everyone's just like, okay, hold on.
31:16
SPEAKER_00: We can't keep up.
31:18
SPEAKER_00: And I I've never seen that before, except when you know people turn like 65 and they're like, I can't operate the remote.
31:25
SPEAKER_00: Now it's happening to people who are like 35.
31:27
SPEAKER_00: They're like, I can't even keep up with this stuff.
31:29
SPEAKER_00: So I I don't I don't know how it's gonna play out.
31:32
SPEAKER_00: One thing that is definitely impacting me in my day job is how we measure success.
31:38
SPEAKER_00: So in the old world of integration to integration, system to system, we could dictate things like I want a user agent string.
31:46
SPEAKER_00: I want you, when you send me something to get information or to make a change, I want you to tell me who you are.
31:52
SPEAKER_00: So I can measure the success of our integration by how many people have turned on this integration.
31:58
SPEAKER_00: It's a really important metric, right?
31:59
SPEAKER_00: I don't care about building cool, shiny things.
32:02
SPEAKER_00: It's fun, but I want to be successful.
32:05
SPEAKER_00: Yeah, it needs to be used.
32:06
SPEAKER_00: And I tell my guys that all the time.
32:08
SPEAKER_00: It doesn't matter if you build it if no one knows about it, and if no one, if people know about it but don't use it, then we've missed the mark.
32:13
SPEAKER_00: So great, easy in the old world.
32:17
SPEAKER_00: Now I have agents being built by everybody.
32:19
SPEAKER_00: The agents aren't telling me who they're serving the data up to, right?
32:22
SPEAKER_00: And I and I think you know, it doesn't just affect my ability to understand where our data is ultimately going from an activation perspective.
32:31
SPEAKER_00: It's also kind of terrifying because there's no chain of custody over that data.
32:37
SPEAKER_00: I mean, if you think about you you you make a you type in a prompt in ChatGPT or Claude or wherever, it will tell you the source.
32:43
SPEAKER_00: But after it's there, after it's in your system, and you send information based on that to someone else, right, to another system or whatever the case may be, it doesn't know where the data came from.
32:53
SPEAKER_00: It doesn't know who sourced it, it doesn't know how accurate it was.
32:57
SPEAKER_00: And so, I mean, again, this problem existed before, but now it's taken you know even further.
33:03
SPEAKER_00: So I I hope, and you know, we've been talking with some of our teams and some of our peers, we're trying to figure out a way, can there be like a blockchain chain of custody about data that is being exchanged using agents?
33:16
SPEAKER_00: So it doesn't just say where it came from, but who owned it, right?
33:20
SPEAKER_00: Who sourced it, and you can follow that chain.
33:23
SPEAKER_00: I think that's going to be really important because in our world, let me give you an example.
33:28
SPEAKER_00: Zero trust is really important.
33:30
SPEAKER_00: It's kind of like a Rorshock term.
33:31
SPEAKER_00: You talk, you throw the word zero trust to someone and you talk to one guy and he's like, least privilege access.
33:36
SPEAKER_00: You give it to someone else and they're like, shut everything down, right?
33:38
SPEAKER_00: Yeah.
33:40
SPEAKER_00: So the specifics of that are very different.
33:42
SPEAKER_00: But in my world, what zero trust means is we have lots of ways to make sure that Bob in accounting can get to his personal Dropbox to download his pictures of his dogs, but he can't upload sensitive information to that.
33:56
SPEAKER_00: He can only upload it to the corporate box instance, yada, yada, yada, right?
33:59
SPEAKER_00: And there's a lot of tech that goes into that.
34:01
SPEAKER_00: I need third-party information from my partners like CrowdStrike or Okta or Minecast or Abnormal to tell me is that user on a safe system?
34:10
SPEAKER_00: Is their email potentially compromised?
34:12
SPEAKER_00: Is their identity been compromised?
34:15
SPEAKER_00: Are that is that the right persona?
34:17
SPEAKER_00: Well, that's really powerful if I can take it and use it.
34:20
SPEAKER_00: But it's incredibly terrifying if the personas, if the data itself has been compromised.
34:25
SPEAKER_00: And so again, all of these tools can speed things up, but we have to have some kind of verification to know that the right systems, the true systems, the source of truth is trustworthy.
34:37
SPEAKER_00: And I think we're moving past the point where an SSL cert is going to do the trick.
34:41
SPEAKER_00: So I we're looking at tools, other tools like Java web token pairs on top of an SSL, right?
34:48
SPEAKER_00: On top to just try and establish this because it's bad enough trying to figure out if it's a deep fake when it's you and me staring at a camera or a TV.
34:57
SPEAKER_00: But these these systems are having even more challenges because we don't have concepts like step-up authentication, right?
35:04
SPEAKER_00: So I'll go back to that non-human identity problem I talked about.
35:07
SPEAKER_00: You know, all of these tools sound great, but at the end of the day, they're not usable if they're not trustworthy.
35:14
SPEAKER_00: And so we're constantly having to verify for that.
35:16
SPEAKER_00: So that's the other issue I'm constantly wrestling with is how do we know, A, our customers are using it, great, but B, we're getting good data from the right systems.
35:26
SPEAKER_01: Yeah.
35:26
SPEAKER_01: No, I think these are these are fascinating points.
35:29
SPEAKER_01: And I think it's really that as we innovate and as things change, we we need to take stock and see where this goes.
35:36
SPEAKER_01: Because I mean, I'm I'm ready to go back to like paper ledgers, you know, just hide them in a safe.
35:41
SPEAKER_01: You know, that that that fixes some part of the problem, but then uh, you know, we'll get drones opening safes at a distance.
35:46
SPEAKER_01: But uh hey, I'd love to have you on again in like a year to take stock of our assumptions and predictions.
35:53
SPEAKER_01: But in the meantime, we always ask our guests to nominate the next guest on the podcast.
35:58
SPEAKER_01: So who do you think we should have on next?
36:00
SPEAKER_00: Well, I have been incredibly lucky to have worked with an individual over four different companies and over 28 years.
36:07
SPEAKER_00: I mean, how many people get to do that?
36:09
SPEAKER_00: So, Steve Pierce, who is one of our leaders and our service provider in MSSP SE space.
36:16
SPEAKER_00: So he's a systems engineering manager for those.
36:19
SPEAKER_00: He is great because he has seen how these technologies actually get implemented, orchestrated, and supported from both a go-to-market perspective as well as a tech perspective in these large companies that are frankly the ones taking the kinds of stuff I build and making sure customers use it.
36:35
SPEAKER_00: So uh Steve Pierce, NetScope, amazing guy.
36:39
SPEAKER_00: He's gonna be a great guest for you.
36:41
SPEAKER_01: I love that.
36:41
SPEAKER_01: And it's it's always interesting to hear like the two sides of the coins, the coin that we were talking about, the MSP space or the the channel space, and then the tech space and how those almost coalesce.
36:50
SPEAKER_01: And I'm I'm really curious to talk to him, so that's awesome.
36:52
SPEAKER_01: Hey, to wrap this up, do you have any final insights, final thoughts, tips, or tricks you'd like to share with the audience or me?
37:00
SPEAKER_00: I'll say this.
37:01
SPEAKER_00: And I think this uh this came up at when someone was trying to interview me for a similar role at a different company.
37:07
SPEAKER_00: They said, How how do you deal with the difficulty of being in this role?
37:11
SPEAKER_00: And I said, It's not it's not like this is rocket science.
37:16
SPEAKER_00: It's hard to do well, but it's not hard to do.
37:20
SPEAKER_00: So my recommendation to people is look, there's so much information out there that you can use tools like AI, right, to gather in order to get some ideas and excitement.
37:30
SPEAKER_00: But at the end of the day, it's far better to have a simpler system that is executed consistently, honestly, and earnestly than it is to have a smart sheets that addresses every possible problem on the on the planet.
37:45
SPEAKER_00: And so I I've actually, if I were to accuse myself of anything, it's I probably don't make things complicated enough.
37:52
SPEAKER_00: But at the same time, I am very much a GSD kind of guy.
37:56
SPEAKER_00: Get stuff done.
37:57
SPEAKER_00: And I don't want perfection to get in the way of progress.
38:01
SPEAKER_00: So Tech Alliances, I think, is a really exciting opportunity for companies that are looking to broaden their reach, understand the influence of how these technologists and the sellers behind them are helping inform customer decisions.
38:15
SPEAKER_00: And what tech do they care about?
38:17
SPEAKER_00: What outcomes do they care about?
38:18
SPEAKER_00: But we don't have to make it this crazily complex entity in order to create some very useful outcomes.
38:26
SPEAKER_00: So I really enjoy building something or demoing something or build vibe coding a concept and getting feedback and then moving briskly forward and building and just moving on, right?
38:37
SPEAKER_00: That iterative process.
38:39
SPEAKER_00: And that's true for everything, but it's got to be founded in consistency.
38:43
SPEAKER_01: Yeah, I love that so much.
38:45
SPEAKER_01: And and you know, it really, really resonates with me coming from a more safety-focused world, a risk-focused world, where someone once told me very simply the safest way to do a job is to not do it at all.
38:56
SPEAKER_01: And that that really stuck with me, and I think it very much aligns with what you're saying now.
39:01
SPEAKER_01: You don't have to overcomplicate, you have to do it, but just keep keep what you're doing in the back of your mind while you're doing it.
39:07
SPEAKER_01: You know, don't overthink it, don't underthink it.
39:09
SPEAKER_00: That's right.
39:10
SPEAKER_01: I love it.
39:11
SPEAKER_01: Hey, David, thanks so much for sharing your thoughts and taking the time to speak with me.
39:14
SPEAKER_01: And for you, dear listeners, thanks for tuning in and see you in the next episode.
39:19
SPEAKER_01: Thanks, David.
39:20
SPEAKER_01: Thank you.
39:21
SPEAKER_00: Take care.