At Sekurokon 2024, Sekuro Director of TPE and Client Solutions, Sam Sutcliffe led an insightful panel featuring:
Fabio Fratucello
International Field CTO, CrowdStrike
Mario Puras
SVP Head of Global Solutions Engineering, Netskope
David Cottingham
CEO, Airlock Digital
The discussion revolves around leadership, innovation, and collaboration in the cyber security industry. Watch the full discussion below or read on for the insights shared by these industry leaders.
TABLE OF CONTENTS
- Airlock Digital’s approach to market positioning and innovation
- CrowdStrike’s methods for tracking emerging threats
- Trends and technologies in the Secure Access Service Edge (SASE) space
- Collaboration between technology providers
- Balancing innovation with established practices
- Qualities sought in team members
Airlock Digital's approach to market positioning and innovation
David: Airlock’s approach is a bit of an anti-play on the market. The whole company was born out of a lack of any solution in the space, so I feel as though if there was one, we wouldn’t exist today. I’m quite surprised that, especially in the application control area, not much has changed over the last 10 or 11 years. While everyone knows it’s an effective control, we saw a need to build something from the ground up to make it truly work.
We don’t aim to follow security trends; instead, we forge our own path. Drawing on my practitioner background, the focus is on foundational security, specifically on preventing code execution, which is often overlooked. Trends can be distracting, though we still monitor industry developments and acknowledge the fantastic innovation that’s out there.
Generally, where we look is guided by attention to compliance and regulation – understanding what organisations are required to do ensures that what we are developing is effective.
Most importantly, we carve out space and time within the company to explore what’s next, focusing on areas others may have overlooked and carving out a unique niche in the market. We leave other market leaders to their expertise, focusing instead on excelling in our own lane.
CrowdStrike's methods for tracking emerging threats
Fabio: At CrowdStrike, we’re uniquely positioned as a global threat intelligence provider to monitor the threat landscape through several key avenues:
- Power of the crowd: When a defender is attacked, we harness the telemetry from sensors and runtime, process the data, and share with the rest of the crowd.
- Threat intelligence practice: Our 24/7 threat intelligence operations constantly monitor adversary activity, process the data, and ensure actionable insights are disseminated to clients.
- Incident response practice: When customers are most vulnerable, we respond quickly with incident response services. The data and telemetry collected during these high-stress situations provide invaluable insights for future prevention and defence.
Similarly, we help partners and customers by sharing threat intelligence through various channels. Beyond our products, we offer webinars, discussions, and events like this one, where we can have informal conversations about the threat intelligence and landscape.
Trends and technologies in the Secure Access Service Edge (SASE) space
Mario: Security Service Edge (SSE), which represents half of the broader SASE framework, is transformational technology that Netskope is deeply involved in. If you look at any recent Gartner Hype Cycle report over the last two, three years, they all emphasise SSE’s role as the security backbone within SASE.
The three foundational technologies that make up SSE are:
These three have to be delivered from a cloud native platform as converged services.
When we start talking about emerging technologies, it’s really about the combination of SSE, and Software-Defined Wide Area Network (SD-WAN), which many refer to as the “WAN Edge.” Together, the security side and access side respectively form what the industry calls SASE. Right now, we’re in the early stages of this technology, but over the next three to five years, it’s expected to make a significant impact as it matures.
Looking ahead, five major trends stand out:
- Digital transformation: Hybrid work and cloud migration are becoming the norm, meaning organisations must migrate their architecture, apps and data to cloud. Securing these elements is vital for long-term success.
- Generative AI: While still developing, its long-term potential hinges on protecting both the data that feeds the engines and inputs, and the outputs they generate.
- Consolidation and platforms: The enterprise has an average 76 tools to maintain their applications, taking up 50% or more of their security teams time. Customers are looking for simplified operational models for their security and networking operations. For industry leaders, we are looking out for the ecosystem of partners and how we integrate into each other.
- Resilience and performance: At the board level, these are the two words that are constantly coming up. For CIOs, these concepts encompass stability, business continuity, and the ability to safeguard revenue.
- Data: Data is the new oil, as we say. But without robust protection and a clear understanding of where it resides, who has access, and what types of data are being stored, organisations face serious disadvantages. Netskope’s recent acquisition to expand the leadership and data protection into data security posture management highlights this need.
At Sekuro, we're constantly telling our customers that the future of security has to involve not just integrations, but true collaboration.
Sam highlighted the need for deep collaboration among technology providers, particularly through Sekuro’s approach.
Collaboration between technology providers
Fabio: Collaboration between partners like us thrives on two major themes: platform consolidation and seamless integration.
Integration is a key customer demand in turn requiring our platforms to have a level of integration and openness for us to coexist and work together. As such, there is a need for systems like SASE to communicate with endpoints and application stacks to ensure data flows freely between them. By adopting a common data taxonomy, we can leverage technologies like machine learning and generative AI effectively.
At the same time, this integration needs to be done in a way that delivers outcomes while minimising the burden of customers to be “data plumbers.”
Mario: In one instance, a global manufacturer worked with five key vendors – CrowdStrike, Netskope, Okta, Mimecast, and ServiceNow. Each vendor had its own approach to defining and addressing risk, whether focused on user behaviour, cloud applications, or data activity. However, the lack of a unified definition of risk across platforms created significant challenges for the customer.
Apart from the issue of normalising information from the various platforms, customers also need the platforms to highlight problems and provide clear steps for resolution. This is where AI can come in.
As vendors, we came together and created a unified approach by consolidating risk indicators into a single, normalised variable. This attribute signalled significant issues, clearly indicating what it meant and how to respond. This collaborative approach provided customers with a clearer, more practical view of identifying and understanding risk.
David: In recent years, there has been a shift in how willing vendors are to collaborate with each other. A decade ago, vendors were often guarded, interacting minimally, whereas today, the landscape has evolved significantly, driven by a mutual recognition of shared customers and the need to provide value collectively. Vendors now work together, prioritising seamless integrations to avoid disrupting customer experiences in increasingly complex ecosystems.
It would be remiss of us as vendors not to also look at what's happened in the ecosystem and the space over the past five years. This shift underscores the need for collaboration, ensuring our solutions align seamlessly with customer stacks to deliver a seamless approach.
Balancing innovation with established practices
Fabio: CrowdStrike is established in threat intelligence and Endpoint Detection & Response (EDR), but staying ahead of evolving adversaries requires constant innovation. Adversaries continuously refine their tradecraft, becoming faster and more sophisticated, necessitating proactive advancements in defense strategies.
Recently, CrowdStrike has focused on enhancing the analyst experience by improving how data is integrated into their platform – making it faster, more efficient, and cost-effective. This includes refining detection capabilities using statistical and mathematical models and leveraging cutting-edge technologies for orchestration and response facilitation. These innovations aim to optimise overall security posture.
The emphasis lies on acquiring the right intelligence, embracing change, and matching adversaries' rapid adoption of emerging technologies. Unlike defenders who must navigate security architectures and change management processes, adversaries operate with agility, adapting technologies swiftly. CrowdStrike’s approach underscores the need to adopt similar agility and innovation from a defensive standpoint.
David: Our innovation roadmap currently looks about three years ahead, but flexibility and agility are essential. It’s nearly impossible to define exactly what will be delivered in three years and stick to it.
We frequently shuffle our product roadmap, even within six months, due to shifting requirements or unexpected ecosystem changes that demand a pivot.
In the case of software it is more unique. On an organisational level, planning is deeply tied to the foundational technology roadmap. For example, if an organisation transitions to Chromebooks, its security stack will look entirely different from today’s setup.
Ultimately, it’s about aligning security strategies with the broader business trajectory to ensure they support organisational goals effectively.
Qualities sought in team members
David: I have different teams with varying skill levels and tenure, and this influences their focus.
For instance, the office of the CTO and architects, being more technologists, tend to concentrate on long-term goals and help shape the roadmap for the future. On the other hand, architects and solutions engineers are more agile, focusing on addressing immediate customer needs and market demands. They work closely with the product and engineering teams to quickly deliver new features and capabilities.
While we still aim for long-term value, customers expect short-term returns on their investment and solutions to pressing challenges. In this fast-evolving environment, adaptability is crucial. The ability to pivot quickly is one of the most important leadership qualities, as innovation happens rapidly, and those who don’t adapt risk being disrupted or left behind. So, I balance short-term and long-term focus within my team.
Mario: I look for different qualities depending on whether I’m hiring for an engineer or a leader. For engineers, a strong foundational technical skillset is paramount, but it’s not enough on its own. Beyond technical expertise, I look for grit, passion, and perseverance. We won’t see overnight success, and setbacks are inevitable, so I need people who can push through challenges. Curiosity is also key for engineers – being curious beyond the immediate task is what distinguishes truly strong engineers.
Additionally, empathy is crucial in both roles. Understanding and relating to customers’ challenges is key to solving their problems effectively. Finally, cultural fit is non-negotiable. The team’s magic comes to life when you have alignment and you have a common goal and a mission that a team shares.
When it comes to leadership, adaptability is critical. I call it AQ. It’s as important as IQ and EQ, because disruption is constant in our industry. You have to be adaptable, seeking out opportunities to disrupt rather than be disrupted.
David: I would say do not create a team that has exactly the same type of people in it and that’s it because you will end up in tunnel vision to a particular point. The concept of “healthy tension” across departments is especially important because it encourages productive conflict and ensures that all angles of an issue are considered. For example, in business functions, a strong sales team should be complemented by a finance team to maintain a balanced approach to growth – too much focus on one without the other can lead to oversights.
It’s been interesting watching the evolution of Airlock as a company. When technical teams lose sight of the broader direction, bringing in someone with a non-technical background can help steer the ship without getting bogged down in details. This shows that leadership isn’t always about technical expertise; sometimes, it’s about having the vision and strategic thinking to guide the team.
Stay tuned for more excerpts from Sekurokon 2024.
