Driving Growth and Adoption of Security Solutions – Tracy Ragan and Brian Dawson, DeployHub

This is Text Strong tv. Hey everyone, welcome back here to Techstrong tv. Wow.

You know what I love? I love when people I know kind of come together, you know, the ultimate kind of synthesis, right? Thesis and, and antithesis synthesis.

And when you get to my age, and you've been in the, in, in the industry long enough, you, you see like, you know, combinations that come and go and, and reform. And, and you'd sometimes you just shake your head and say, well, that was obvious. Why, why, why, right?

Why, why didn't I see that coming? Anyway, with that as a preface, let me introduce you to two good friends of mine. First of all, this woman needs no introduction.

If you watch any text on tv, she's the co-host of Text Strong Women. She's a frequent contributor on our panel. She's speaks at our virtual events.

She'll be speaking at Predict in January, our annual look ahead, and I'm excited to have her on there. She's also a, a force to be reckoned with in the open source world. Linux Foundation, various daughter foundations within Linux Foundation.

I'm talking about only one person, Tracy Reagan. Tracy, welcome. It's great to have you here.

Thank you, Alan. Such a, um, distinguished, uh, list of things that I've done. When I hear it, I'm like, really?

I make you so good. I make you so good. Um, I guess I'm busy.

Yeah, we do. We, I think we keep you busy. But you know, Tracy, and when she's not appearing here on Tech Drunk, she's also the co-founder, CEO of Deploy Hub, and we're gonna hear more about Deploy Hub in a second.

Before we do though, I want to introduce you to our second guest. You've seen him here on Tech Drunk TV over the years as well. You've seen them as one of the pivotal people behind CloudBees, right?

Of people with Jenkins and CloudBees and all of that. You've seen them as a leading person, you know, uh, evangelizing for the Linux Foundation and, and so forth. And you've just also seen them.

We bring them in as a resident tech expert when we, when we need a good tech tech expert to explain stuff to people. And it's my friend Brian Dawson. Brian, welcome.

How are you? I am doing great. Thanks for having me, Alan.

It's been a bit, uh, excited to be back as we talked about. Looking great, by the way. Uh, thank you.

I'm doing well. Excited to be here. And I just gotta underscore, when we look at Tracy, we literally are looking at one of the hardest working people in the DevOps business.

Uh, she's had, uh, her hand in a bit of everything, um, over the number of years and, uh, and almost without fail having a positive impact. So I'm glad to be here with the two of two of you A absolutely. Um, you know what, we're gonna do things a little backwards.

Normally, I'd ask you to, hey, remind our audience about Deploy Hub and what they do and everything. But we're gonna come to that afterwards. We're gonna, I think, let's ju jump right to the, uh, kind of news in this one.

And so I guess Chasey, you are the CEO, it's your prerogative. Do you wanna announce it or I will announce it. Yeah, We're okay.

Go. So, um, this is a kind of a dream I've had since I met Brian. Um, I met Brian, um, at CloudBees, uh, obviously prior to Covid, uh, started working with him.

We did some, uh, we did some webinars together, and I started watching Brian work and how influence, how much influence Brian had, uh, in the DevOps world. And at that moment, I decided I need Brian to come to work for Deploy Hub. And that took me on according Odyssey of several years.

Uh, Brian obviously is, uh, in demand, so I didn't know we would ever really get him, but we are so happy to announce that yes, I have finally won his hand, and Brian is now an official co-founder, um, of Deploy Hub, and he will be working in our, uh, to build our channel partners. So there's ways you can grow businesses. Uh, you can go after tons of money, you can try to bring on a big sales, uh, team, but there's nothing more important than partners.

Partners can, um, really make or break a business, in my opinion. Brian, his secret, uh, his, his secret power is partnerships. So Brian will be coming on, um, as our VP of strategy and operations with a focus on building our channel partner program.

And I am so excited to be able to finally announce this. Fantastic. Well, congratulations to both of you.

Congratulations to the whole Deploy Hub team. That is, is amazing news. And like I said in the outset, sometimes you, you know, you see chocolate and peanut butter and you just, you don't realize how good they are together till you see 'em together.

So fantastic. Fantastic. Yeah.

Chocolate peanut Butter. Yep. So, Brian, let's, let's hear from you, man.

What, you know, I assume you're excited. What, what, what makes you excited? Uh, well, I, you know, what makes me excited and, and it's, this starts to get to be a bit corny, but one of the things I say is, uh, as I like to focus, I have, uh, 30 plus years in software and technology development and delivery with a focus on the human element.

And I'd say one of the things that really get, uh, and then, then I tend to talk about the fact that what we cannot lose sight of is that the endpoints for delivery of any technology are humans, right? I don't care if you're doing, uh, embedded systems, you're generating ASBOs at the end of the day somewhere, your endpoint is humans. So what gets me excited is, uh, that I'm joining a journey to solve a real problem, uh, with a fantastic human right.

Uh, Tracy and I actually, what she doesn't know with a wide footprint is that I had pretty deep exposure to her before we actually met. Um, and that, um, I worked with one of her early companies Open Make right to go at a moment in the, uh, software development and, uh, delivery industry. When a, um, pretty prevalent solution shifted and pulled out, we needed to go help, um, organizations move to a more modern solution.

I touched Tracy, and so I am first and foremost excited about the two humans that I joined on this journey, uh, and Tracy Reagan and Steve, uh, Taylor. Uh, and, uh, I am second excited about really this fact that was a dream of mine. If I go all the way back to a organization called CollabNet, um, that was responsible for a couple of pieces of software, one little thing that, that has been forgotten about in Subversion, right?

An impressive, uh, version control system before we moved to DVCS. And back then we found we needed these things that are now called SBUs to understand what we were developing and delivering. You required evidence of the work that would've been done and what was in the package.

And the fact is Orelia and Tracy have been working on solving this problem for a number of years. So I'm excited to join that journey out. Absolutely.

I love it, man. Good stuff right there. Um, you know what, let me, as I said, we were doing this a little bit backwards.

For people who aren't familiar with Deploy Hub, Tracy, how would you describe Deploy Hub to the audience? Employee Hub is an evidence door of DevOps and security, uh, intelligence, um, which is why partnerships are so important. Yeah.

Because we want to, uh, be able to pull all of those logs, all of the, all of that data that's being generated, whether it be an SBO m or you know, software composition analysis data, uh, deployment data, key value pairs. Uh, there's so much data that we generate in the DevOps pipeline that we don't centralize. And without centralizing it, you don't have the evidence to respond quickly to not only just bugs, but security issues, vulnerabilities.

I was at jfr and they put a number up on the screen and I kept thinking, that can't be right. They claim that according to, um, their, uh, surveys, their customers say that it takes 227 days to containment on a vulnerability that is just wrong. Now, one of the reasons why is we got plenty of, we got lots of data, but it's fragmented.

So Deploy Hub is a, uh, evidence store that aggregates that data so that we can create usable security data, usable security, DevOps, and actionable results so that we don't have to take 227 days to respond to an issue. Absolutely. And our, And Artelia orus is a, is the core open core of Deploy Hub.

80% of Deploy Hub was contributed in 2022, the Continuous Delivery Foundation. And we have an amazing growing, um, very interesting, uh, user community who's building it. So we have about three years of, uh, of, of development in, in the product, and we really have a, so a really solid MVP, which was, this was the right time to bring Brian on and start building those partnerships.

Excellent. Yeah. I, I, I, I, uh, you know, a, a key thing about Deploy Hub to add to it is it, it embraces this reality of what modern software architectures look like and what is delivered.

And what you have to tend to the security for is no longer a nicely packaged monolithic app that you can monitor in one place, but rather it's a complex world of microservices delivered by multiple teams. And what's unique about Deploy Hub is Deploy Hub provides acts as an evidence store and provides evidence-based security for your entire modern market, market, microservices architecture. And so that's important to call out.

What we're finding from a lot of partners is, look, we have, um, uh, great security solutions, but the problem is our security solutions don't give you an organization wide view. They don't give you a system wide view. So, uh, that was really compelling for me, um, in engaging to help grow this thing.

And important to note that the data that we're gathering, um, in 2024, our roadmap in, in particular on the open source side, is to start taking that data and looking at, uh, machine learning workflows and how we can start generating threat models. A good example would be Log per j, log per j. If, if we had understood that we had one person supporting log per J, and it was used by thousands and thousands and thousands of programs and companies around the world, maybe it would've had a bit of a risk, it would've, it would've fallen into a risk model that says, maybe this is something you guys should look at.

So there's a, you can't do AI without data, and that's the problem with security and DevOps data is we haven't centralized it. We're doing that. Yeah.

You know, look, I ran, I, the first time I ran into that particular problem was, I think it was the open VPN, right? Open VPN is is probably the, I mean, it's one of the most popular VPNs out there, but it's also under the covers in every, almost every VPN uses open VPN under the covers. And then what we came to find out that there was about three people who maintained that, right?

And then one day there was a, there was a, uh, uh, a bug, a vulnerability, an open VPN, and, and it, and it brought large parts of networks to its knees that were relying on this open VPN thing. It is going back years. But that's when I realized that these op, the fallacy of open source, having this, all of these sets of eyes on the code, and, you know, the, and the unnamed masses, the unwashed masses contributing is a fallacy.

I mean, yeah, you may get a lot of people using it, but a very, you know, on two hands are, are maintaining, contributing it. Yeah. And I, it's, it's, you know, I I, you know, back at the Linux Foundation when we were sort of looking at how do you measure or quantify the majority maturity of open source and evaluate, is it safe to adopt?

Look, there's a lot of fantastic, uh, uh, open source implementations out there that are, uh, developed and maintained by small teams. Uh, but if I start to see that we have 10 pieces of our stack, 10 containers that are deploying this piece of software from a business critical system, I think it's important that I, that I understand what its footprint is, and I am able to measure is if there's a vulnerability, am I able to respond in enough time or get enough support, uh, that I should, uh, risk having this be in, in my sort of my business critical pathway. So, um, I, I think the thing I wanted to say is, look, there's, uh, something supported by three people can be fantastic world changing, and very important It is, would be very vulnerable.

Yes. If you're delivering business critical applications, be aware of its maturity and what vulnerabilities may arrive. And I think that's the key, is the knowledge to be aware of what you're consuming and what that, uh, business risk is to your business continuity.

Um, and that's, you know, the bottom line we want, we don't want, we don't want denial of service situations because we needed to change some configuration. We need to be aware, and the only way you can be aware is through knowledge, and that's what we're providing. Agreed.

So, Brian, I want to turn to your new role a little bit. People out here saying, I don't, maybe, maybe I should be partnering with Deploy Hub. Yeah, right.

Who, who are you looking to partner with here? Who, who's, what's the channel you're looking to grow? Well, uh, yeah.

The, the, the short answer, and then I'll expand on it, is, uh, we are looking for consultants, software vendors, uh, really, uh, anybody that has a concern for security people in the DevOps CICD security spaces. Um, but really, you know, consultants, uh, DevOps software vendors, sis, that are really interested help in helping clients solve the security problem. Um, I'd say in reality, or not in reality, a little more detail as as, as Tracy called out, uh, I think we collectively as an organization and Deploy hub, yes, we are a commercial business, but we have a real emphasis on community and a belief that sort of, it takes a village, uh, to make the software development and delivery space what it needs to be.

So, um, I am really looking with partners to build a consortium of people concerned with security that have solutions or products that we can come together to deliver together. And what I'm finding a lot of Alan in my, uh, early conversations is, um, there's no shortage of security solutions out there, but what no, some people that you might think are competitors are saying is, Hey, we have a great solution. But what we love about Deploy Hub and it's core orus, is that it's orgwide, it's that it's end-to-end.

It's comprehensive. And so we're also looking for people that, uh, that feel like they have a security solution, but in implying it at scale to an entire org, uh, they need some further assistance or help. com, uh, visit, uh, the Deploy Hub site, and, uh, complete the form there as well.

Or if you prefer, uh, and we'll get right back out to you. I would be tempted to give my personal phone number here and have people No, no, we don't, we don't do that, you know, hipper and all that good stuff. Anyway, hey, man, I, I am, I'm just thrilled, thrilled to see you guys joining up here with this, and I'm sure Steve is as well.

So, best, best of luck to all of you and to deploy Hub. And you know what, come back often and keep us posted. We would love to.

Alan, thank you so much. All righty, so much, Alan. Tracy Reagan, CEO Deploy hub, Ryan Dawson, VP strategy and Operations at Deploy Hub.

Lots of good stuff going on with Deploy Hub and Aurelius. Check it out. We're gonna take a break.

We'll be back here in just a moment on Tech Drunk TV with our next segment.