Enhancing DevSecOps and Developer Security with Snyk’s Cyndi Doyle

This is Techstrong tv. Hey everyone, welcome back to another sec, uh, session here on Techstrong tv. I'm really happy to have on our show today.

I think it's the first time she's been on, but certainly the company is no stranger. To our tech strong audience, Cindy Doyle. Cindy's the global director of GSIs, which are global system integrators and consultancy partnerships at Snyk.

Cindy, welcome to Textron tv. How are you? I'm good, Alan.

Thank you so much for, for having me. Very excited to be here today. We are excited to have you.

I love that background, Cindy. Thank you. It looks almost like a, a, uh, a, a Rockwell or broad kind of background, you know, new England snow.

That's right. It's a winter wonderland out there today. It's Pretty.

Yeah, I don't miss it though. I, you know, I'm living here in Florida 22 years. I, I like to see snow on people's backgrounds.

I don't like to see it in, in my background. Um, but, but anyway, it looks great. And, uh, thanks for being on.

Cindy. As I mentioned, you're the global director for GSIs and consultancy part partnerships at snyk. But why don't you, if you don't mind, share a little bit of your own story with our audience.

You know, how long have you been doing this? Kind of, what's your background Sure. And that kind of thing.

Thank you. So I started at SNY in June of 2021 with the goal of building a global system integrator and consultancy program for sny. So I've spent about 10 to 15 years in channel and partner development, and then about ten-ish years ago, really started to focus on large scale organizations and really building partnerships and programs that will help solve some of the bigger organizational challenges that we see our customers have.

Often technology companies are really good at building strong technology, but the areas that we need help with and really look for partners are, are large scale, um, people and process and solutions that solve bigger customer challenges. And so when I came to sneak about two and a half years ago, that was really my goal was to identify a strong group of GSI and consultancy partners that are trusted by our customers that are innovators in the space, and to work with them to build solutions that make sense for our customers. Absolutely.

You know, as, as an old biz dev channel Mm-Hmm. Lead myself in companies. I helped start, you know, these are kind of the bread and butter.

You know, you're a venture-backed startup, even a well-funded venture backed startup, right? You, you're, you're still a startup. You're a new kid on the block, you're going, if you're selling into enterprise accounts, for instance, there are entrenched, uh, players in that market.

I, I saw that the last security company I helped start where a big part of our market was the federal government. Right? And you just don't go sell as some startup into the fed space.

You need to be working with the, the large integrators that really make the federal government, you know, the, the wheels turn in the machinery there. And, and it's the same way with large enterprises, right? I mean, it's not like, you know, IBM has 500 of the Fortune 500.

There's an account manager for every one of them, but it's not just the IBM's it, it, it's the Deloitte's and it's the, uh, you know, there used to be a, not Cooper's, uh, I think A PWC and, and you know, these large integrators, Accenture obviously another huge one. And, and you know, as a startup, you want to partner with these brands because they already have the beachhead. They already have the accounts that the accounts you're talking to.

And if you could work with them and through them, it's gotta be a win-win, especially for the end user customer who are dealing with the people they're used to dealing with. Yeah. I think it's a really interesting point, Alan, because if you think about the maturity of an organization like ny, one of the biggest challenges I had when I came to NY in, in June of 21 was developer security services wasn't what a lot of the GSI partners, that's not really what they were talking to their customers about.

And so what I've seen over the past two and a half years is, as the market has evolved, as snyk has matured as an organization and has, and how DevSecOps has become a forefront initiative for a lot of enterprise customers, I've seen a lot of GSIs start to turn a bit and adopt these into their core services. I'll give you an example. Um, a lot of cloud transformation projects security used to be an optional service or an optional component to that large pro, uh, project.

But now it's become an essential pillar on how do we ensure that if we're going to move an application to the cloud, for example, how do we ensure that developers are able to, um, do their work in the cloud securely? And so snyk has become a really important component of that overall solution. And so even though it can be hard sometimes I talk about changing a gss, I is like asking them to, you know, switch directions on a cruise ship.

I've seen a lot of GSIs come around to building really incredible solutions that are not just focused on the traditional security teams for extending out to include developers and bridging that gap between the CTO's office and the CISO's office. And that's really an area where snyk will benefit, but our customers will benefit even more because they're gonna be able to offer solutions and services at scale faster around the globe, and then take our, our technology and integrate it directly into a solution they're bringing into market, similar to what Deloitte is doing with Secure By Design. And we're incredibly excited about it for a whole bunch of reasons, but our customers will have access to better resources faster through these partnerships.

And I think that's the thing, um, I'm personally most excited about and the biggest change I've seen over the past couple of years. Agreed. I, I agree with you.

You know, the, the silver lining or, you know, a silver lining in, in what you described also, is that the very fact that these large global SS sis are looking to partner with companies that can provide developer security, SecOps, you know, these kinds of things is in and of itself a validation that the market is there, that the market's maturing, that the market's growing, that the market's important enough where, you know, because with your average global s si, you know, you're bringing in a even tens of thousands of dollars is a big, so what you, you gotta bring in, you know, millions to kind of move the needle. And, and so the fact that they're involved and interested is, is, is in, is indicative of that. So, so that's a good thing.

Um, so we're here today to talk about latest, uh, announcement from SNY in this regard. And, you know, I don't want to steal the thunder. Why don't you, uh, tell us about it?

Sure, I would love to. So last week we announced that SNY has become a formal alliance of Deloitte, which means, um, a couple different things. First, uh, we'll have the ability to start building solutions, and we actually have already built a solution as that we're gonna be bringing to market, and we're gonna have a bigger presence in front of customers so we can start talking about services solutions and do that together, which is a really big step for snyk, but also for our customers.

Deloitte, as one of the, the most trusted security companies in the world in conjunction with Snyk, it's a really great opportunity for us to come together and build really some innovative solutions for customers. And that's what we are incredibly excited to be announcing. Very cool.

Let, let's talk about this one solution that's kind of already been built. What, what exactly is it? So, um, Deloitte has a product on the market that's called Secure By Design.

It's a centralized workflow management system, and it basically helps organizations orchestrate the security activities throughout the SDLC. So this product has been on the market for some time, but what's new is that Snyk is now integrated into, uh, secure by Design. And so what that means for our customers that I'm really excited about is that it's an automated, uh, feed of information that goes back and forth between SNY and Secure by Design.

Um, the policies, the security policies are checked, um, and then analyzed. And then as a next step, the data that comes from snyk is actually, uh, analyzed against the threat modeling intel that Deloitte has built. And so, in an automated fashion, this information is going in and the output is customers are able to focus on the most critical and high severe vulnerabilities that exist, and then basically get them remediated faster.

And so when you look at, from an organization standpoint, like a multinational or global organization that has thousands, and hopefully not, but sometimes millions of vulnerabilities, a tool like this leveraging the information it's getting, um, in the current Deloitte, secure by Design, um, offering, but then adding in the sneak intel and that data that's coming from the developer population is a game changer for customers because we're really gonna be able to focus on what needs to be focused on first. And so when I look at our big, big companies, I think an opportunity to work together on this is gonna be really, really powerful. I, I agree.

I agree. You know, having done these kinds of real relationships and alliances in the past, the devil's sort of in the details in terms of how does it get sold to a customer, how does it get delivered? Mm-Hmm.

Right. Is it, it, how do the sales teams and delivery teams overlay, right? I mean, SNYs not a small company, but compared to Deloitte It is.

Yeah. And, um, yeah. You know, so, so you can't possibly one to one match up with that Deloitte team.

They're just too big. So, you know, how, how, how are Sneak and Deloitte sort of matching up to bring this to market and to deliver a successful program with it? Yeah, it's a, it's a great question.

It's a question I think about every day, if you can imagine. Um, oh, I Can't. Um, so, uh, part of our job is, is enabling the Deloitte team at scale.

But then the great thing is we're working at the really talented group within Deloitte Advisory, and they've basically built out an enablement plan. And so our goal is for their team to know and understand on when to identify, when SNY makes sense for customers. We're not gonna be a perfect fit for everyone, but their consultants and their analysts and their teams are well enough to be able to do that.

And so that process has been happening for quite some time and will continue to happen. Um, Deloitte offers this service both as a managed service, but then they can also, if a customer is already a secure by design customer, for example, and they wanna also, um, include Snyk or they wanna buy Snyk, then they can off also purchase snyk separately and then integrate it into Secure by Design. So there's quite a bit of flexibility in the way that they wanna go to market with us.

And for our customers. Above and beyond just secure by design, Deloitte has built, um, an entire menu or catalog of, of services around snyk that help customers with various other issues. So let's say there's a, a big backlog and they need help with remediation.

Deloitte can do that. Deloitte can identify where they are in their DevSecOps journeys and make recommendations, uh, based on different technology people and process. But then also where sny fits in, um, there's a whole series of services.

And so really my job and my team's job is to build and enable them to identify what makes sense and then just try to support it and scale as much as we can. Because as you said, they have teams of people and some of these clients that are larger than our entire company. So, um, our job can be challenging, uh, with the enablement, but they have a really strong team of expertise built into Deloitte Advisory that they're continuing now to scale out, and so they have a full understanding and will be experts on sny themselves.

Got it. Um, that, that, that's an interesting piece of it. Is this, so the announcement was last week, is it, and, and the first I product, if you will, or service is, is already done.

Is that available right now or that'll be rolling out soon? Um, it is available right now. So, uh, the part of this launch has been quite a bit of work over the past 18 months in doing the integration.

Um, so we have four products and our SaaS and SEA products are completely integrated into Secure By Design right now. They're working on our container and IAC product currently that should be available any day. And then the next generation is when we release our A SPM solution, application Security, posture management solution, uh, which we're calling App Risk.

The goal is to also next get that integrated in, but that will probably be, um, towards, you know, the middle of 2024 when that's fully available and ready for customers. Um, and then we're also working on some gen AI initiatives too. So one of the things I love about this partnership is they bring, um, a level of knowledge and expertise that is, it's really just the highest tier of, um, of innovation that I've seen.

And so we're looking at ways of what else can we partner on together to make sure that we're bringing customers, um, not what's just needed now, but what's coming next that we're ready for, that we can work with them on. And I'm, I'm most excited about that. Absolutely.

Very cool stuff. Cindy, for people who want to get more information on this, is there a sneak site or do they, they go to Deloitte? How, how did they get on the, on-ramp here?

Yeah, so there is a, um, there is a sneak, uh, uh, uh, there's a sneak press release that's available. io and partners, and really anyone at SNY can talk about this, or at least that direct them back to me, and, and I'm certainly always happy to help. So, Very cool.

All right. Hey, Cindy, I want to thank you for coming on today and, and telling us all about this exciting new partnership with Sneak and Deloitte. Um, best of luck and success with it.

And I, I'm sure we'll maybe be hearing about some other GSI and consultancy part partnerships coming forward. I hope so. Thank you so much for having me, Alan.

It's really been a pleasure. Not a problem. Cindy Doyle, it's been our pleasure.

Cindy Doyle, global director, GSIs and consultancy partnerships at Snyk Tell talking to us about a new, uh, relationship and offering go to market between SNY and Deloitte as part of their strategic alliance. We're gonna take a break here on Textron tv. We'll be back in just a minute.

I.