Latest / Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth / Breaking Out of Stealth: The Story Behind Spektion’s New Approach to Software Vulnerability

Transcript

Breaking Out of Stealth: The Story Behind Spektion’s New Approach to Software Vulnerability · Cyber Go-To-Market Talk: The Cybersecurity Podcast About Cyber Sales, Marketing & Revenue Growth

• 0:41
  SPEAKER_01: All right, welcome to another special edition of the Cybersecurity Go to Market podcast, being recorded live on the second morning, Tuesday morning at RSA 2025.
• 0:53
  SPEAKER_01: We're here again in the the uh spectacular salubrious uh atrium in the Mariette Marquee.
• 1:00
  SPEAKER_01: Uh it's early morning, so we're kind of on our own, except for people you probably hear the dishes in the background as uh breakfast is being made for some some meeting somewhere.
• 1:08
  SPEAKER_01: Um, and today we're talking with Joe Silva, who's the co-founder and CEO at Spection.
• 1:14
  SPEAKER_01: Joe, welcome to the podcast.
• 1:15
  SPEAKER_00: Hey, thanks for having me, Andrew.
• 1:16
  SPEAKER_00: A little early to be breaking out salubrious.
• 1:19
  SPEAKER_00: Uh wasn't ready for that kind of vocabulary this early, but hopefully I pronounced it right.
• 1:23
  SPEAKER_01: I might have just lost my train of thought halfway through that long word.
• 1:26
  SPEAKER_01: No, you got it.
• 1:27
  SPEAKER_01: So you are an interesting position in that you're a longtime practitioner in security.
• 1:33
  SPEAKER_01: CISO at a couple of places, I think, if I read it right, or at least one.
• 1:36
  SPEAKER_00: Yeah, I was just CISO at JLL, and then I ran cybersecurity at TransUnion prior to that.
• 1:41
  SPEAKER_01: Okay.
• 1:41
  SPEAKER_01: And then you crossed over and said, you know what?
• 1:43
  SPEAKER_01: I need to start my own company doing this.
• 1:45
  SPEAKER_01: There's a better way to do this.
• 1:46
  SPEAKER_01: Tell me tell me through the decision to go do that.
• 1:48
  SPEAKER_00: Well, I felt like I was making way too much money as a CISO, and I was like, what's the best way that I can take the maximum pay cut?
• 1:54
  SPEAKER_00: Uh so I went to start a company.
• 1:57
  SPEAKER_00: No.
• 1:57
  SPEAKER_00: So uh well, before that, before I had been on the customer side as a security executive, I was on the product side prior to that at Symantec.
• 2:05
  SPEAKER_02: Okay.
• 2:06
  SPEAKER_00: Uh so with the threat intel product there.
• 2:07
  SPEAKER_00: So I had worked on the vendor side, actually.
• 2:09
  SPEAKER_00: My first job's in cybersecurity, first at iSight Partners, then at Symantec, mostly on the threat intelligence side.
• 2:15
  SPEAKER_00: Then I went to TransUnion, ran cybersecurity there.
• 2:18
  SPEAKER_00: Then I took the CISO job at JLL.
• 2:21
  SPEAKER_00: And so then last year, my co-founders, Josh and Julian and I, we started Spection.
• 2:27
  SPEAKER_00: We we had worked together for better part of 10 years.
• 2:31
  SPEAKER_00: Uh, and we felt like we were all in different roles solving the same problems over and over again, mostly iterating through them.
• 2:39
  SPEAKER_00: You know, as an executive, I'm dealing with more organizational political problems.
• 2:44
  SPEAKER_00: The core competency of an effective CISO is the ability to navigate the organizational politics of that company, right?
• 2:50
  SPEAKER_00: Just in the context of cybersecurity sometimes.
• 2:53
  SPEAKER_00: But my co-founders, their career offensive security pros.
• 2:56
  SPEAKER_00: And I think like a lot of red teamers, they just keep seeing the same things over and over and over again.
• 3:02
  SPEAKER_00: Uh, and we felt like there was an opportunity to fix some things that no tools in the market were fixing for us.
• 3:08
  SPEAKER_00: And we wanted to really solve a problem, right?
• 3:10
  SPEAKER_00: Not so much take a fingers in the dike approach to cybersecurity, which is often what you feel like you're doing when you're working in any big enterprise security organization.
• 3:18
  SPEAKER_00: You're managing security.
• 3:19
  SPEAKER_00: You're not really solving problems, you're managing risk associated with security and because the business has to make a lot of trade-offs.
• 3:24
  SPEAKER_01: Do you think you had a big advantage over other people looking to find companies in the UR in the trenches and new firsthand, as opposed to having to go and do a bunch of interviews to find out what people are trying to struggle with?
• 3:36
  SPEAKER_00: It's a double-edged sword.
• 3:37
  SPEAKER_00: I think part of our unique advantage as a founding team is our ability to understand the actual problems that a lot of practitioners are solving.
• 3:45
  SPEAKER_00: But at the same time, there's a real trap you can fall into where you just mirror image and assume that every other organization has the exact same problems you do.
• 3:54
  SPEAKER_00: Uh and I think there's been a lot of practitioners who've gone on to become founders and maybe really interesting products, but kind of a niche because it didn't work for a broader market.
• 4:04
  SPEAKER_00: So I think being on the product side before I was on the customer side really served me well, was able to understand what's unique to the situations I'm in and what's just kind of the endemic problems across the industry.
• 4:17
  SPEAKER_01: So you had the experience of what it took to actually build a product, spec it out, do the due diligence.
• 4:23
  SPEAKER_01: Then you had the experience of being uh in real world, uh trying to figure out how to use all this stuff and bring your team together and deal with the politics, then you came back again.
• 4:32
  SPEAKER_01: That's an interesting kind of flow of a career.
• 4:34
  SPEAKER_01: Was it all kind of planned like that?
• 4:35
  SPEAKER_00: Or did you just none of this was none of this was organic.
• 4:37
  SPEAKER_00: Yeah.
• 4:38
  SPEAKER_00: Right.
• 4:38
  SPEAKER_00: I mean, none of this was organic.
• 4:39
  SPEAKER_00: You know, I started off, uh started off in the military, uh, you know, combat arms, then the intelligence world.
• 4:45
  SPEAKER_00: I actually didn't get into the cyber world until way later in my career, after I had uh mostly left the government.
• 4:50
  SPEAKER_00: Oh.
• 4:51
  SPEAKER_00: So no, none of this was planned.
• 4:53
  SPEAKER_00: I wouldn't say it's like a happy accident, it just kind of ended up here.
• 4:56
  SPEAKER_00: Um, but going back to the question about, you know, was it beneficial?
• 5:00
  SPEAKER_00: I would say maybe the thing that was most beneficial around being a practitioner beyond just identifying persistent problems that weren't being solved was having dealt with so many other startups.
• 5:10
  SPEAKER_00: Work closely with a lot of startups, a lot of great teams.
• 5:13
  SPEAKER_00: Many of them built really interesting technology and then were working with companies looking for a problem to solve.
• 5:18
  SPEAKER_00: I think you see that a lot in the startup world.
• 5:20
  SPEAKER_00: Right.
• 5:21
  SPEAKER_00: We started with a problem and then built a technology to solve it, but I understood the pain points that a lot of security leaders have working with startups, where they see a technology, they see a really smart, enthusiastic team, but they also think about how much work it's going to take to get that technology to solve a problem for them.
• 5:39
  SPEAKER_00: And they oftentimes feel like they're like the shadow product manager.
• 5:42
  SPEAKER_00: Uh, and you know, I didn't want to put that kind of burden on our customers.
• 5:45
  SPEAKER_01: Did you, except for the except for that aspect, did you learn a lot about how startups dealt with you as a CISO?
• 5:52
  SPEAKER_01: I didn't know what you wanted and didn't want to do.
• 5:54
  SPEAKER_00: I did.
• 5:54
  SPEAKER_00: I learned, you know, I mean, and every every security leader's got a different personality and could be approached a different way.
• 6:01
  SPEAKER_00: But I learned that some were very curious.
• 6:03
  SPEAKER_00: You know, they said, Hey, what are your, you know, what problems are you dealing with that nobody's solving for you?
• 6:09
  SPEAKER_00: And then some were very opinionated to the point where they would say, Hey, this is a problem that you have, right?
• 6:14
  SPEAKER_00: Well, it's a problem, but it's not in my top ten problems.
• 6:17
  SPEAKER_00: And then they would argue with me about why the problem they were trying to solve wasn't more important to me.
• 6:21
  SPEAKER_01: Wow.
• 6:22
  SPEAKER_01: So that wouldn't say it's probably good they've got a point of view, but you got to balance it a little bit to say, well, just because I've got it doesn't mean to say everyone's got the same point of view.
• 6:32
  SPEAKER_00: Well, you know, there's a saying like, you know, no plan really survives beyond first contact.
• 6:37
  SPEAKER_00: And I think there's a lot of founders that when they make first contact with a market that doesn't have the same enthusiasm for the problem they're trying to solve, there's a reflexive nature to just push back and say, no, no, no, you're not appreciating how valuable what we're doing for you really is.
• 6:52
  SPEAKER_01: Yeah.
• 6:52
  SPEAKER_01: There's that uh transactional analysis, right?
• 6:55
  SPEAKER_01: When when when someone steps away, you don't want to try and grab them, going, no, no, no, no, no.
• 7:00
  SPEAKER_01: You gotta listen, you gotta listen.
• 7:01
  SPEAKER_01: You want to actually go, okay, well, let's step away too and just see what's going on here.
• 7:05
  SPEAKER_01: Let me listen and try and understand.
• 7:06
  SPEAKER_01: That's right.
• 7:07
  SPEAKER_01: Rather than double down.
• 7:08
  SPEAKER_01: I'll talk louder at you so you understand it.
• 7:10
  SPEAKER_00: Well, it you you see this.
• 7:12
  SPEAKER_00: This is what I said about mirror imaging and why that's relevant, where, you know, I worked at TransUn.
• 7:17
  SPEAKER_00: It's a credit bureau.
• 7:18
  SPEAKER_00: I was there during and after the Equifax breach.
• 7:21
  SPEAKER_00: So obviously huge emphasis on security, right?
• 7:23
  SPEAKER_00: Cybersecurity was kind of core to trust, institutional and consumer trust, and the credit bureaus in core to the business.
• 7:31
  SPEAKER_00: So that's a different priority for cybersecurity than it may be in other sectors where the balance between profitability, disruption, and security is going to be struck differently.
• 7:42
  SPEAKER_00: So if I had just mirror-imaged my experience of two jobs and said that's broadly applicable to the enterprise security market, I probably would find a very narrow sliver of folks receptive to the problem we were trying to solve.
• 7:54
  SPEAKER_01: Yeah.
• 7:54
  SPEAKER_00: Well, let's talk about that.
• 7:55
  SPEAKER_00: What what does Spection do?
• 7:57
  SPEAKER_00: What are you solving for people?
• 7:58
  SPEAKER_00: So spection is a runtime vulnerability analysis product where we are saying that CVEs as a measure of understanding the vulnerability risk and all the software you're running are useful, but ultimately a lagging subset of indicators around exploitability.
• 8:14
  SPEAKER_00: And we're able to find vulnerability risk based on runtime analysis of software behavior and all the software organizations are using.
• 8:22
  SPEAKER_00: So oftentimes upstream of CVEs, insecure memory utilization that if if you dealt with it would probably resolve 60-70% of vulnerabilities that come up in software.
• 8:32
  SPEAKER_00: Uh, and so we find vulnerabilities in software, and vulnerabilities not synonymous with CVEs, but general exploitable conditions and software.
• 8:40
  SPEAKER_00: And then we provide mitigations uh for those in the form of preventive controls that can be implemented, but then finely tuned detection-based controls for sim, XDR, EDRs.
• 8:50
  SPEAKER_01: And is that a totally new approach, or are you doing it better than perhaps others have been doing at the past?
• 8:55
  SPEAKER_00: It's a totally new approach based on the experience I had.
• 8:58
  SPEAKER_00: What we saw was we just looked at like where was cybersecurity really overperforming?
• 9:04
  SPEAKER_00: And we looked at the anti-malware market.
• 9:06
  SPEAKER_00: And you have solutions like CrowdStrike and others that had taken, they had taken a runtime approach.
• 9:11
  SPEAKER_00: We went from static AV to next gen AV to EDR EPP, you know, a very runtime approach to data and providing teams with real-time visibility.
• 9:20
  SPEAKER_00: And I think threat detection teams are used to near real-time visibility into events.
• 9:24
  SPEAKER_00: But then we saw that vulnerability management, uh, particularly around software, open source, commercial, and the increasing amount of homegrown tools that organizations end up having on their systems was lagging behind.
• 9:35
  SPEAKER_00: I I both of my last two jobs, I thought it was the lowest ROI function within the security program I was dealing with in terms of the amount of resources and political capital invested in achieving an outcome was make was creating friction within the organization because you can never technology teams can never have the capacity to patch even the prioritized vulnerabilities.
• 9:57
  SPEAKER_00: The nature of CDE disclosure when it's truly important is you're very reactive.
• 10:01
  SPEAKER_00: So we saw an opportunity to really go from what I would consider the static A V signature era of vulnerability management and take a comprehensive runtime approach in terms of understanding what is my entire software-based attack surface, how is it changing in near real time?
• 10:16
  SPEAKER_00: What are the risks and how can I manage that without just saying, here's a prioritized list of CDEs, distributing them to other technology teams and saying, hey, patch these.
• 10:26
  SPEAKER_00: And we'll have some controls in general, but not being able to tailor the specific capabilities of those controls to the exploitability.
• 10:33
  SPEAKER_00: So we really just felt like we there was a genuine opportunity to modernize vulnerability management.
• 10:39
  SPEAKER_00: Oh, you know, there's a lot of new technologies that have come out in the last 10, 15 years, created a new attack surface.
• 10:45
  SPEAKER_00: And I think there's been for all these modern technologies, you know, SaaS, cloud, and now AI, I think if you look at like MCP now as a new attack surface, there's been a lot of modern solutions that are coming to market doing really interesting things to address modern problems on this attack surface.
• 11:02
  SPEAKER_00: What we're not seeing is modern solutions to legacy problems around software running on systems.
• 11:08
  SPEAKER_00: We've not moved to an all-SaS world.
• 11:10
  SPEAKER_00: The amount of software per endpoint is actually increasing in the enterprise.
• 11:14
  SPEAKER_00: We actually have a more atomized software ecosystem.
• 11:17
  SPEAKER_00: I think largely because the barrier to building your own tools, particularly now with AI, is so low.
• 11:22
  SPEAKER_00: And but we still have a legacy solution to legacy problems.
• 11:25
  SPEAKER_00: And then the Verizon DBIR said, you know, software, third-party software was the number two cause of breaches last year.
• 11:33
  SPEAKER_00: So we're doing a pretty good job of security solutions keeping up with new attack surfaces we're creating.
• 11:40
  SPEAKER_00: We're doing a horrible job of keeping up with legacy problems around software.
• 11:45
  SPEAKER_00: And in those cases, I would say as an industry, we're over-indexed in terms of our reliance on detection and response.
• 11:52
  SPEAKER_00: So we wanted to build a solution that would provide visibility and solutions for managing the overall exposure to software vulnerabilities.
• 12:00
  SPEAKER_01: Aaron Powell It seems like maybe it's still the case.
• 12:02
  SPEAKER_01: You can tell me that um a lot of bigger companies run mission critical things on systems being run for a long, long time, years, decades sometimes.
• 12:10
  SPEAKER_01: Is that a prime market for you?
• 12:12
  SPEAKER_00: It it is.
• 12:13
  SPEAKER_00: Uh there's a lot of reasons organizations are running software on legacy systems.
• 12:19
  SPEAKER_00: Sometimes it's for resilience.
• 12:21
  SPEAKER_00: Sometimes it's because they don't want to incur the costs of migrating, where they feel like it's going to be too frictionful.
• 12:28
  SPEAKER_00: They feel like their overall technology architecture is almost like a mousetrap uh type setup where if they change one thing, it could have a cascading impact that's just not worth dealing with.
• 12:38
  SPEAKER_00: And particularly right now, where in general, like there's a lot of uncertainty in the economy, nobody's looking to have a big capex outlay.
• 12:45
  SPEAKER_00: So nobody's looking to undertake some of these big transformation projects right now.
• 12:49
  SPEAKER_01: Who is it inside the organization that buys spectrum?
• 12:52
  SPEAKER_01: Vulnerability management.
• 12:53
  SPEAKER_00: Overwhelmingly, it's the vulnerability management leader, sometimes the threat detection leader, because we're providing a lot of capabilities for blue teams to actually detect and respond and hunt for software exploitation even before a CVE is out.
• 13:07
  SPEAKER_00: But vulnerability management teams are buying us because ultimately they say, how do I understand the total vulnerability exposure of my software, not the subset covered in CVEs?
• 13:19
  SPEAKER_00: And then when where I do have CVEs, what is the most reasonable, defensible prioritization rubric?
• 13:25
  SPEAKER_00: And so a runtime view of software risk overlaid with CVEs gives you a much better view of the blast radius uh exploitation of that software.
• 13:35
  SPEAKER_01: And you guys were in stealth for quite a while or a while.
• 13:38
  SPEAKER_01: Um, and recently came out of stealth, and I think you known some funding as well.
• 13:41
  SPEAKER_00: Is that two weeks ago uh we came out of stealth, we announced that we had had our$5 million C round led by Live Oak Venture Partners.
• 13:48
  SPEAKER_01: And that experience of being in stealth, I've I've people seem to have a bipolar view.
• 13:54
  SPEAKER_01: This is the other thing is the best thing in the world, or other people just scorn like why would you even do that?
• 13:58
  SPEAKER_01: What was your experience and why did you keep like that for a while?
• 14:01
  SPEAKER_00: Aaron Powell Well, I think some of it depends on the underlying technology and how complex the technology you're building out is.
• 14:06
  SPEAKER_00: We wanted we built a technology that's hard to build, easy to implement.
• 14:10
  SPEAKER_00: And so that was one of the reasons we stayed in stealth.
• 14:13
  SPEAKER_00: We did not want to have a massive overhead for implementation and management of the technology.
• 14:17
  SPEAKER_00: I think the wrong reason to stay in stealth is because you want to keep something a secret.
• 14:21
  SPEAKER_00: If you're doing something really unique and really powerful, it doesn't matter.
• 14:25
  SPEAKER_00: You should just do it and get it in as many people's hands as possible.
• 14:30
  SPEAKER_00: We stayed in stealth, but we worked with customers, early design partners and customers.
• 14:35
  SPEAKER_00: And we have some criteria for coming out of stealth, most of which was we wanted to have delivered the maximum amount of value with the minimal amount of overhead for a non-friendly prospect, not somebody who was from our network or extended network.
• 14:51
  SPEAKER_00: And they could implement the product and see value very quickly.
• 14:54
  SPEAKER_00: When we were in stealth, our early design partners and customers were folks where we could deliver value early and in the form of visibility, which is necessary, but I don't believe sufficient in this day and age to actually have a full-fledged product.
• 15:08
  SPEAKER_00: And then because they knew us, largely folks we had worked with before or knew of us, they had a lot of trust in our ability to execute on a roadmap that would help them solve the problems we were surfacing visibility.
• 15:19
  SPEAKER_00: So our criteria for coming out of stealth was unfriendly prospects who don't know us would see the product and not just say, Oh, hey, that's great.
• 15:27
  SPEAKER_00: You gave me visibility in the problems, but would immediately realize the ability to solve those problems with very low overhead.
• 15:33
  SPEAKER_00: Uh that there's a lot of dangers in staying in stealth for too long, though, that I can I would.
• 15:37
  SPEAKER_00: Well, again, you're working with design partners who you probably already have you have some degree of comfort with, and they're kind of accepting of delays, things not being perfect.
• 15:49
  SPEAKER_00: Uh, and that can build bad muscle memory with the product engineering team because they expect post-stealth customer prospects to be just as accepting.
• 15:58
  SPEAKER_00: The POC process when you go into an unfriendly is a lot different.
• 16:03
  SPEAKER_00: Yeah.
• 16:03
  SPEAKER_00: Right?
• 16:03
  SPEAKER_00: You have to deliver, there's zero excuses, nothing's going to be perfect, but the expectations around delivering up to what you committed to and very quickly addressing feedback on where you're falling short are a lot different then.
• 16:17
  SPEAKER_01: Does it have the same effect when you think about uh how you present to the market?
• 16:21
  SPEAKER_01: Like when you come out of stealth, the idea is of okay, now we need to actually say something on a website about what we do and then you have to assume they know nothing about you.
• 16:28
  SPEAKER_01: Right.
• 16:29
  SPEAKER_01: And you don't get the luxury, I would imagine, after you come out to keep tweaking everything daily or weekly, depending on what you learn, right?
• 16:36
  SPEAKER_01: Because being stealth, you you don't have that pressure to let's formulate the right phrase to that's right we do differently.
• 16:42
  SPEAKER_00: That's right.
• 16:43
  SPEAKER_00: You you've got the attention span of your potential user or buyer for 30 seconds initially, and you've got to grab them uh and then they're going to move on to the next.
• 16:54
  SPEAKER_00: Like as a CISO, I tell you like how I thought of as a buyer.
• 16:57
  SPEAKER_00: You know, other than a handful of folks, every non-JLL email went to an external box.
• 17:03
  SPEAKER_00: I would look at it a couple times a week.
• 17:05
  SPEAKER_00: And if you're a vendor and I don't know you or you weren't referred to me by somebody I do know, hardly talk to you.
• 17:11
  SPEAKER_00: Any exposure I got to vendors that I didn't already know about was maybe through LinkedIn.
• 17:16
  SPEAKER_00: I think a lot of folks use it as a news aggregator.
• 17:18
  SPEAKER_00: Um, and then you can kind of see maybe you'll see though, somebody I know also follows this company and what they're doing.
• 17:24
  SPEAKER_01: So would you rely on friends in the industry as a CISO?
• 17:28
  SPEAKER_01: Like you get together and someone say, Oh, I just find this great company, or would you rely on investors?
• 17:32
  SPEAKER_01: What would what was your primary channel?
• 17:34
  SPEAKER_00: Friends, but it's that they have to be really good friends.
• 17:37
  SPEAKER_00: And here's why I say that.
• 17:38
  SPEAKER_00: Folks in the industry that you're friendly with, they'll give you some insights, but they're your friends.
• 17:43
  SPEAKER_00: And if they're not your really good friends, they're generally going to affirm the the problem you're solving in the way you think you're going to solve it because they're your friends.
• 17:50
  SPEAKER_00: Right.
• 17:51
  SPEAKER_00: I say really good friends because you need really good friends who can tell you, hey, this is a horrible idea.
• 17:55
  SPEAKER_00: Right.
• 17:55
  SPEAKER_00: That in your head that sounds right, or that may have worked for you, but that is not reproducible at other organizations and they're not going to get it.
• 18:04
  SPEAKER_00: They're either not going to get it, or they're going to think this is way too difficult to do, or this is providing way more work than it is valued.
• 18:13
  SPEAKER_01: And anything surprising to you as you came out of stealth two weeks ago that you weren't expecting.
• 18:20
  SPEAKER_01: That's like, oh, that's interesting.
• 18:21
  SPEAKER_01: I wasn't really saying that happening.
• 18:23
  SPEAKER_00: From a go-to-market perspective, I wouldn't say really, because I was very fortunate we had a sales leader on board early uh who had been in other startups.
• 18:32
  SPEAKER_00: And he had he he knew what to expect, and we had talked about this for a while.
• 18:36
  SPEAKER_00: Honestly, the thing that I was most surprised by was all of the spam from BDR as a service, HR servicers, folks that are just nonstop hitting me up to deliver services to me.
• 18:48
  SPEAKER_00: That's the thing I was not prepared for, was what a cesspool my LinkedIn inbox would be.
• 18:53
  SPEAKER_01: That's that's what happens, right?
• 18:54
  SPEAKER_01: Oh, someone got some money.
• 18:55
  SPEAKER_01: I I sell things for money.
• 18:56
  SPEAKER_01: I must go and hit them up to try and give me some of that money.
• 18:59
  SPEAKER_00: When I left my CISO job and I did the startup, I didn't think that I was going to continue to be assaulted by vendors.
• 19:04
  SPEAKER_00: Little did I know it was just a different type of vendor I would continue to be assaulted by.
• 19:08
  SPEAKER_01: And you have this big title.
• 19:09
  SPEAKER_01: This guy's got the, he's not only got the money, he's got the big title.
• 19:12
  SPEAKER_01: You can he can decide these things.
• 19:13
  SPEAKER_00: That's right.
• 19:14
  SPEAKER_00: Yeah.
• 19:14
  SPEAKER_00: And this I'm the CEO of a 12-person company.
• 19:17
  SPEAKER_01: Um and as you're looking at this year at the at go to market, what where are your investments going to be, do you think?
• 19:23
  SPEAKER_00: Uh well, our investments are going to be continuing to not just provide the maximum visibility into what software is doing across any system it's installed on, but increasingly going into other areas around, hey, how can we deliver even more value?
• 19:39
  SPEAKER_00: For example, we're providing visibility into software running, but there's things like extensions, IDE plugins.
• 19:47
  SPEAKER_00: What are these specific IDE plugins doing at runtime?
• 19:49
  SPEAKER_00: What are browser extensions doing at runtime?
• 19:51
  SPEAKER_00: There's a lot of browser security companies that look at what's happening from the browser to the other end of the web session.
• 19:58
  SPEAKER_00: There's not as much that's looking at what are these extensions actually doing on your system in terms of what credentials are they accessing?
• 20:03
  SPEAKER_00: How are they mismanaging memory in a way that's creating exploitable conditions?
• 20:07
  SPEAKER_00: And the same is true with IDE plugins.
• 20:09
  SPEAKER_00: So we want to provide real-time visibility across anything running in a customer organization.
• 20:15
  SPEAKER_00: So the Mac, the same amount of exposure, same amount of insight into what your exposure is as you do to everything that's exploiting that.
• 20:26
  SPEAKER_00: Right now we've got near, we've got runtime visibility into threats, but the 99.9 stuff that we've already put on our systems, we have pretty static visibility into.
• 20:36
  SPEAKER_00: And I think probably that disparity is something that attackers are taking advantage of.
• 20:40
  SPEAKER_01: And is there a partner opportunity for you this year to say, well, can we just get in with this type of technology partner and we're going to get some acceleration?
• 20:48
  SPEAKER_00: There are.
• 20:48
  SPEAKER_00: There's uh there's a couple of different partners that we're working with.
• 20:51
  SPEAKER_00: Some are very regionally focused in cybersecurity, others have national practices, but they're very focused on vulnerability management, security architecture.
• 21:01
  SPEAKER_00: One of the things that uh our customers are doing is, you know, they're continuing to get requests from users to use new software, which is good because I've seen a lot of cases where people don't request, they just go ahead and find a way to install it.
• 21:13
  SPEAKER_00: Um and so, you know, security architects are and you know, and vulnerability management teams and sometimes even third-party risk teams, they don't have the bandwidth to do a deep technical analysis of every piece of software.
• 21:23
  SPEAKER_00: So like, oh, no CVE, it's good.
• 21:25
  SPEAKER_00: Vendor assessment, check the box.
• 21:27
  SPEAKER_00: Sure, go ahead.
• 21:28
  SPEAKER_00: So we're working with some partners who are helping security architects totally overhaul the software evaluation process.
• 21:35
  SPEAKER_00: So now organizations POC a piece of software while the requesters evaluating it for functionality.
• 21:41
  SPEAKER_00: We're seeing all the behavior of the software and then able to score it and say, hey, why are you doing these things?
• 21:46
  SPEAKER_00: Why is this software accepting revoke certificates and creating these types of network connections and running at this privilege level?
• 21:53
  SPEAKER_00: So that's doing the security review before the security review.
• 21:57
  SPEAKER_00: That's right.
• 21:57
  SPEAKER_00: What we're doing is essentially vulnerability management is typically something where you wait for CVEs to come in, you prioritize, then you send out work for teams to patch, and then you try to portray a picture of your residual risk.
• 22:08
  SPEAKER_00: We're trying to help vulnerability management shift left from the time software gets installed in the organization or is even being considered for installation, give them ability to evaluate it at scale, and then really shift right in terms of empowering their peers on the blue team and security engineering ways to mitigate the risk.
• 22:26
  SPEAKER_00: So, which overall means the CISO and the security organization is way more empowered to manage.
• 22:32
  SPEAKER_00: Software vulnerability risk rather than just portraying it as a problem for like server, desktop, and other teams to solve.
• 22:39
  SPEAKER_01: Well, Joe, thanks for joining us on the podcast.
• 22:43
  SPEAKER_01: Good luck for the rest of the week.
• 22:44
  SPEAKER_01: I know you probably got a whole bunch of different types of meetings set up for the week.
• 22:47
  SPEAKER_01: I too.
• 22:47
  SPEAKER_01: I hope the time was worthwhile before you fly back uh to home.
• 22:50
  SPEAKER_00: Yeah, I think it will be.
• 22:51
  SPEAKER_00: It's great to be here, Andrew, despite uh not being ready for salubrious at 7 a.m.
• 22:59
  SPEAKER_01: Another segment for visionary or smoking crack.
• 23:03
  SPEAKER_01: Introduce yourself.
• 23:04
  SPEAKER_01: Robbie Robbins, VP of BD at NetRise.
• 23:07
  SPEAKER_01: All right, Robbie.
• 23:07
  SPEAKER_01: I'm gonna throw out some bold predictions about the future of sales, cybersecurity, cybersecurity sales.
• 23:14
  SPEAKER_01: And you have to tell me, am I a deep thinking, insightful visionary, or did I inhale a little bit too much walking through the tender line on the way to the conference this morning?
• 23:24
  SPEAKER_01: Are you ready?
• 23:25
  SPEAKER_01: Absolutely.
• 23:26
  SPEAKER_01: All right.
• 23:26
  SPEAKER_01: By 2030, 80% of cybersecurity purchases under 100K will happen without a human seller or a human buyer, just AI agents buying and selling.
• 23:38
  SPEAKER_02: Yeah, smoking crack on that.
• 23:40
  SPEAKER_02: Tell me more.
• 23:41
  SPEAKER_02: Well, considering how long it's taken us to get here, I don't really see AI suddenly uh revolutionizing buying and selling in five years.
• 23:50
  SPEAKER_02: All right, next one.
• 23:51
  SPEAKER_01: In five years, more CISOs will report to CFOs than to CIOs or CEOs, and sales in the enterprise will shift to being finance first and security second.
• 24:04
  SPEAKER_01: Is that visionary or is that smoke and correct?
• 24:06
  SPEAKER_02: I think that is a bit of a revelation.
• 24:08
  SPEAKER_02: I think you're on to something there.
• 24:10
  SPEAKER_02: Um it's an economic uh decision a lot of times instead of a uh um checkbox you know requirement.
• 24:16
  SPEAKER_02: So I do think uh it will be more finance driven in the future.
• 24:20
  SPEAKER_02: Cool.
• 24:20
  SPEAKER_01: Number three, in 10 years' time, both the RSA conference and Black Cat will be gone completely dead.
• 24:28
  SPEAKER_01: Is that visionary or smoking crack?
• 24:30
  SPEAKER_02: Yeah, you're smoking crack.
• 24:31
  SPEAKER_02: I mean, how long has uh RSA been around, right?
• 24:34
  SPEAKER_02: 30 years?
• 24:35
  SPEAKER_01: Probably 30 years.
• 24:36
  SPEAKER_02: So uh you know, another 10 years is it gonna go away completely?
• 24:39
  SPEAKER_02: No, I don't see it happening.
• 24:41
  SPEAKER_02: It may change quite a bit, but I don't see it going away.
• 24:43
  SPEAKER_02: Maybe it should change quite a bit, right?
• 24:45
  SPEAKER_02: Yes, exactly.
• 24:45
  SPEAKER_01: It might be virtual for all we know.
• 24:47
  SPEAKER_01: Next one by 2030, Shador Sanders will have won a Super Bowl.
• 24:53
  SPEAKER_01: Visionary or smoke and crack.
• 24:54
  SPEAKER_02: Smoke and crack.
• 24:55
  SPEAKER_02: Tell me more.
• 24:56
  SPEAKER_02: Will he even make the league?
• 24:59
  SPEAKER_02: Right?
• 24:59
  SPEAKER_02: I think he uh there's a it's a wild card whether or not he's gonna stick on anybody's roster.
• 25:04
  SPEAKER_01: All right, final one.
• 25:05
  SPEAKER_01: Recently, Google announced they were acquiring Wiz, and some people in the industry called the merger and the acquisition G Wiz.
• 25:14
  SPEAKER_01: So, question for you.
• 25:16
  SPEAKER_01: Within 12 months, the OT security company Insane Cyber will buy another OT security company that's called Century, and the combined company will be renamed to Insane Asylum.
• 25:29
  SPEAKER_01: Is that visionary or smoking crack?
• 25:31
  SPEAKER_02: That's smoke and crack, right?
• 25:33
  SPEAKER_02: That's a marketing uh um dream.
• 25:36
  SPEAKER_01: It's meant to be.
• 25:37
  SPEAKER_01: It surely is meant to be.
• 25:39
  SPEAKER_01: We need to find the executives of these companies and propose a merger.
• 25:43
  SPEAKER_01: Well, Roby, thanks for joining us.
• 25:44
  SPEAKER_02: Uh thank you very much, Andrew.