How Anvilogic is Automating Security Operations

Hey everyone. Welcome back here. We're continuing our afternoon coverage of this Wednesday afternoon here at RSAC Conference.

My next guest, and I hope I get this right, is Karthik Kannan. Karthik is with a company called Anvil Logic, and if you don't know about them, don't worry, you're going to after this. But first, let's hear a little bit about Karthik before we get to Anvil Logic.

Karthik, welcome to Techstrong TV. Thank you, Alan. Pleasure to be here.

So let's start with you. Give people a sense of how you came to be here, what your career has been like, what your passions are. Sure.

Again, thank you for inviting me. This may be around the 10th or 12th RSA Conference I've been at, maybe 10th. Been doing companies in this space for quite some time now.

This company, Anvil Logic, we co-founded about six and a half years ago in 2019, pre-COVID. Prior to that, my career has been mostly in the cybersecurity GRC, big data analytics space. Uh-huh.

My previous company, Caspida, was the industry's first machine learning-led user behavior analytics product company, which got acquired by Splunk. Okay. I ended up working at Splunk for three years- Mm ...

running a portion of the security analytics business, which I'm now working with or displacing now at Anvil Logic. Prior to both of these companies, I did another company called Cetus, which was a big data analytics platform company, way before the cloud data warehouse time that we are in now. It was in the days of Hadoop- Mm.

if you remember that. Yeah. Yes, I do.

Okay. Not fondly, I bet. No, but you want to know the truth?

I remember when Hadoop was spun out of Yahoo. Yeah. That's right.

Right? Exactly. And the yellow thing sort of- Yeah.

Exactly right ... that's got... Yeah.

Well, we've come full circle with data warehouses now on the cloud, like Snowflake and Databricks and- Mm-hmm. Yep ... I'm glad to be full circle back, but working at a better time of both gen AI and cloud data warehouses.

So I think in all of my companies, we were ahead of the times, and now we are squarely in the times, so I feel pretty good. Anyway, that said, Anvil Logic is a six-and-a-half-year-old company. We are venture capital funded.

What we are is a SOC automation platform company. Naturally, rendering things with AI and whatnot, but really the core function of what we do is provide automation to various persona workflows in the SOC, whether it's data wrangling and data engineering, or detection engineering, hunting, tuning, et cetera, or triage and investigation. All of that is baked into our platform.

We've been spending six years building it, and now we are surfacing all of that up through AI agents. We'll talk more about that, but that's really in a nutshell what we do, is sell the platform to automate various functions of a SOC in a large enterprise. That's who we are.

I love it. Got it. So, you mentioned Hadoop and AI.

Back then, Hadoop claimed to solve the big data problem. Yeah. That's right.

I think we needed AI to help solve the big data problem, right? That's right. Without AI, we weren't really solving it.

Yeah. But, in prior lives, I did three or four venture-backed startups myself, and one of them was we had an MSSP play, and we had the SOC, and had a lot of experience doing that. And again, we didn't have AI in those days either.

Running a SOC was, you could figure out how many people you needed to man the SOC on a 24/7, 365, and that was an easy formula. The formula for what tools we had, the data we had, how to get actionable intelligence out of that data, right? This is before there was a Snowflake and before there was Hadoop.

And as you said, you probably hated it. Yeah, I had first-hand experience. But the world seems so much different now.

Yeah. Right? The technology is so much better now.

Now, as you said, you started six and a half years ago, 2019, the year before COVID hit here. In 2019, though, you didn't see gen AI or agentic AI coming in here. Let's talk a little bit about what that means for you, though.

It had to be change your whole mission... Not mission, because the mission probably stays the same. No, the mission's the same.

The way we do it, how we accomplish it. Right, your whole way of approaching it. Exactly right.

This reminds me, in "Iron Man", Stark Senior says in a video that he was limited by the technology of his times. Yeah. That's exactly how we felt back in 2019.

We knew what we wanted to accomplish, but no one knew gen AI was coming. Right. But it was such an easy thing for us to adapt to it because we were building the architecture, waiting for something like that to happen.

So we were even pre-gen AI, machine learning, and predictive analytic oriented. So our job was always reconsidered to provide recommendations to the practitioners to help them do things. Not just be a technology platform.

To be something that automated workflows. So you could come in and guide on what you wanted to do, and we would do it for you, right? Because even to use gen AI today, two things have to come into place.

One is you have to know what you are looking for or seeking to build. " That doesn't work. So that's number one.

You have to know what you want. The second thing is you have to be able to have domain knowledge to verify the results and make it better and close the last mile gap. Those are the two foundational principles we've incorporated into the platform, so gen AI can work for us and not against us.

So we spent, like I said, we are six and a half, nearly seven years old. We've been spending all of this time building that system of record platform. The platform, even without gen AI, can still do the mission.

It just is helped and moves faster with gen AI. So we take a look at everything we do in three pillars. One is, like I said, the data management, the data wrangling, bringing data on board, ensuring the health of the pipelines, all of that is so integral to your detection strategy.

Yes. That's pillar number one. We've invested a lot into that, native pipelines and whatnot.

Number two is all things detection engineering, which is the one thing that was really sorely missing in all of the legacy SIEMs, and I come from that world. Most of my team comes from that world. And that's why we built this company to make sure the art and science of detection engineering was in the platform.

That includes building detections, scaling detections, tuning and verifying, closing the loop, coming back. Hunting too is part of it. And the third pillar is what do you do when all of this surfaces up with alerts, is triage and investigate them.

And that's where we've gone into in the last year. And this is where the announcement we have announced this week comes up. I'll talk about it in a minute, but those three pillars really constitute the platform.

Now, if you think about it, there are various personas and workflows embedded in those, and that's what now we are surfacing up with AI agents saying it's in the platform. The agents are going to help you get there faster, better through natural language, through conversations, rather than have to know programming and whatnot. They can either be a human in the loop approach or completely autonomous.

It's up to you. And then the triage investigation piece takes us into a net new market called SOAR. Until now, everything we did was SIEM.

Mm-hmm. And we shook that up. And we took another legacy construct of SIEMs, which is an attached proprietary database in a SIEM stack.

" Sure. And that's something we did by creating that layer of abstraction. So Anvilogic is that layer where your hands on keyboard are and eyes on glass.

But really what's beneath is not one proprietary data layer or structure. It can be- It can be anything. It can be your Splunk with a Snowflake, or a Splunk Snowflake Databricks combination.

What- To plug it in. It's agnostic. Exactly.

Agnostic, that's the right one. And then we'll get to the announcement we made this week. But that's really the construct.

Okay. So back to your question. The technology of our times are helping us achieve that vision much faster now and give you, the end user, a much better experience than having- Absolutely ...

to navigate 45 screens or write code or whatever. No. Someone once told me, "It's always better to be lucky than smart.

" Both is good. Right? We'll take it.

And I don't know if it was lucky or smart in this case, but- Smart people around me, for sure. Sure. Yes.

Yes. That's my management philosophy, too. Exactly.

I don't want to be the smartest one at my table. Never been. Nope, me either.

This really is a technology that really, AI has just been able to turbocharge it. Yep. Right?

Yeah. And I think that's what it is. So you mentioned the announcement here- Yep ...

at RSA twice. You can't keep teasing us. What's the announcement?

Yeah. There we go. I'm glad you asked.

Mm-hmm. So what we announced is something called Blueprints. Mm-hmm.

Blueprints is our automation layer for the whole workflow that I just described. The first use case of Blueprints is investigations. So today in the investigative world, what happens is a playbook is created, and it's mostly created by the smartest tier four, five analyst who's had institutional knowledge, lots of training, years of experience, and has been there and done that.

Taking that and converting that into an automated playbook is really the purpose of Blueprints. Obviously, gen AI and LLMs help make it smarter, provide more recommendations. But that's not all.

All of the contextualization we bring to the table through our small language models that are built into our platform, and the transformations that come with it and the enrichment that comes with it, helps makes this a highly intelligent, autonomous, automated playbook, and that's what Blueprints is all about. Now, while I describe this with the example of investigations, which is the last stage of this whole workflow, you can extend this concept of Blueprints into any major workflow. " The whole cycle can be automated through Blueprints.

But we want to crawl, walk, run, so we're going to take investigations to be that first use case, automate that, take all of the institutional best practices that are there in large enterprises, convert them to our Blueprints, and automate and make autonomous as much as possible. While you construct a playbook, you can have a decision box in the middle that says, "Is this the right thing you want to see? " And put a human in the loop and say that human must approve before the next process takes over.

And automate the whole thing. So in a nutshell, Blueprints is our way of implementing automated workflows across the product, but it also takes us into this new market called SOAR, so now we can be a SIEM and SOAR in one AI SOC platform. Huge differentiation because we've kind of been building this over years, and now finally gotten to that last step of the vision.

I love it. It's available now or now it's coming? Available now.

It is pre-GA. Okay. We have design partners that are working with us.

We will announce GA sometime in the April-May timeframe. Month or two. But it is available for all practical purposes.

You know what? We did the website so people can go check this out. Yeah.

We made some announcements this week. com/blueprints, takes you straight there. You can go to our homepage and see a demo video of it in action.

Excellent. So you've mentioned you've been coming to RSA 10 years. I mean, Shay, I've been coming 25 years, right?

What do you think about this year's event so far? This year, of the last two to three years, I'd say, I think has been much more active. Yeah.

And I don't know if it's because of us or generally the conference has been more active because of AI, but I've almost not been able to go to the show floor. I went- Oh, I haven't ... once for half an hour on day one.

We've been booked up in meetings at the central- I think that's the story here, is everyone is busy in meetings. Yes. But that's always...

Truthfully, look, the RSA Con, even back when I co-founded a security company and we, 2001 exhibiting here through 2009 or '10, this was always a conference for the security industry by the security industry, and I used to try to convince my board that it was okay back then. We were spending $75,000, $100,000, which was a lot of money back then. It's a lot of money.

Yeah. Even now it is. And we weren't really getting a lot of sales leads.

But, A, if you weren't here, people questioned why weren't you here? And B, again, it was for the industry by the industry. This is where you form partnerships, relationships, deals are made.

Ideas are exchanged. Yeah. And so I think that stays true, right?

It is true. There's a lot of things that happen off on the side, in side rooms, in hotel areas, all over the place. That hasn't changed.

No. Has not changed. No.

I think it's partly also because of our execution this year that I feel good about RSA this year, is the conversations are great. AI's obviously changed a lot of the conversation, but the fact that we've been active in meetings means our team is working hard making those conversations possible in one-on-one settings, private settings. We are moving the ball forward.

We're meeting with a bunch of prospects between yesterday, today, and tomorrow. That's great. I mean, we've been back to back with meetings, and these are great forward-moving conversations.

So I feel particularly good about this year than I have in the last couple. Good for you. So I'm happy to be here.

Absolutely. Well, Karthik, I want to wish you well. Congratulations.

It'll be interesting to see how this plays out, right? Yeah. Because we're just, I mean, this agentic kind of revolution, and I think it is, is going to wind up being bigger than generative.

And I think when people have the ability to just access their data and take actionable intelligence out of it, and I mean, because I see it in our own company. You can't imagine all of the different permutations, all the different ways they take this. Maybe ways you're not even thinking of.

Mm-hmm. But it'll be interesting if that comes out. That is true.

I think customers are going to push us into use cases- That you didn't think ... that we did not imagine. Exactly right.

And that is our job, is to have a platform that is extensible. That, right, that people can run with. It's not a single purpose.

Right. Yeah. Because I think in today's world, that's what people want, right?

I think that's part of the reason why open source is so popular, right? Yeah. I take the base, I could build, I go anywhere I want with it.

" And so that's, I think, the kinds of platforms that people want to work on. Yep. You're right.

Thank you for having me. Pleasure. Al.

Karthik, one more time. com? com.

Yeah. Check it out. Hey, we're going to take a break here.

We're live at RSAC. We'll be back.