Martin Roesch: Vectra AI Announces Acquisition of Netography

Hey, everyone. Welcome back here to Tech Drunk tv. I'm really happy to have my friend Marty on, uh, having spoken to Marty, I bet at least a year, but it's always good to see him.

Uh, some of you may know Marty or Martin Rush, uh, who is now the head of cloud at Vector ai, ai, formerly CEO at Nat. And before that, I guess CTO, founder of Sourcefire Fire Ventor. Well, Marty was actually the, the original developer of Snort so many other things.

He's been a mainstay in the security space. I don't know, Marty, 25, 30 years, three years Next year. Yeah.

Yeah. And, uh, but also just a, a great guy, a real, really a nice guy to have as part of the industry, and I enjoy talking with Marty. It's great to see you.

Congratulations. First of all, you know, the news came out, I guess it was maybe almost two months ago, a month and a half ago, uh, the Vectra AI had acquired Na Topography. Yeah.

Yep. Thanks, Alan. Uh, yeah, it was actually, I think the, the one month anniversary was, uh, was a couple of days ago.

So, uh, time flies. Um, but, uh, yep, we announced the, uh, the acquisition of Nat by Vectra. And, uh, you know, we're, uh, we're all settling in and getting to work now, uh, on, uh, bringing the, the two, uh, teams and the tech together.

So it's, uh, it's been really interesting, uh, run so far, uh, and off to a good start. So before we get into the acquisition, the integration and the plans going forward, I feel like we owe it to our audience, Marty, to give them a little background on Vectra ai. They may not be familiar.

Mm-hmm. Familiar. They may not be familiar with NFI either, for that matter.

So let's, you know, pre-acquisition. Give us the quick pictures of Vectra and n Topography, and then we'll talk post-acquisition. Uh, so Vectra is a, uh, network detection response, uh, company, most notably, uh, and, um, they operate by essentially, uh, uh, doing PAC analysis and, um, generating metadata from the pack analysis, sending it to a, you know, to an analyzer.

And then they can do, uh, detections. But the interesting, um, twist is that the detections are AI driven. And this is not LLL ai, not the, the buzzy ai.

This is computer science AI of applying AI techniques to be able to drive, uh, behavioral, uh, anomaly detection and other types of, uh, detection, um, that are difficult to get otherwise, uh, with a, um, kind of directional mindset of reducing noise, which is something, you know, I, I worked in intrusion detection, which is, I suppose kind of the, the intellectual precursor of NDR. Um, and we spent a lot of time in the intrusion detection world trying to minimize false positives and give people high value, uh, detections and stuff like that. So, Vectra, uh, has been around for a little over a decade, and that's exactly what they've been doing.

It's really interesting, uh, how the approach, uh, operates and, and, you know, how they can really demonstrate, you know, put the, the money where their mouths are. Um, so it, it's cool technology. They also have, um, uh, cloud capabilities now.

So, uh, cloud identity and, uh, you know, control plane, uh, and, uh, Azure and, um, Microsoft, uh, 3, 6 5. And then, uh, also, um, just recently added in, uh, the ability to, uh, uh, also analyze what's going on, uh, in Zscaler, uh, environments. So, um, if you've got, you know, mobile remote workforce like everybody does these days, and you're using Zscaler to kinda, um, create your virtual private enterprise essentially, um, it's really hard to inspect and understand what's going on on a network level, uh, in that world.

And, um, now Vectra ai, um, that capability exists, which is pretty cool. So that's Vectra. Uh, and then there's cinematography and graphy was essentially, um, the evolution of, uh, or my, a lot of my thinking of the evolution of where, um, network security and network, uh, traffic analysis should go.

Um, and, uh, not to, not to kind of belabor the point of, uh, the genesis of the ideas. Um, the, the basic idea at IES is essentially to operate on metadata as well, but instead of looking at packets, we're looking at, uh, flow data and DNS, and then we're pulling in, uh, contextual information from the tech stack of, um, customers. So, you know, the tech stack can be anything from Tenable to clarity, to Xon, to Wiz and the cloud, and so on and so forth.

So we pull together all these, uh, data sources from infrastructure that the customer already has to give you a real time visibility and, uh, detection and response capability, um, anywhere, anytime at any scale, uh, frictionlessly, which is, uh, pretty powerful, especially in multi-cloud environments where it's very difficult to look at packets, but it's, um, you know, much easier to look at metadata. But essentially, nobody would come up with a real time cloud scale metadata analytics platform to look at the data plane side of, uh, the, the cloud, which is essentially the interaction of the VPCs. Uh, you know, Wiz tells you kind of how you're supposed to be configured, what you think is going on, uh, at the log level, you know, their CDR and stuff like that.

But the actual operational level of how they're interacting with each other, um, on the network is something that, uh, is, uh, a big blank spot for everybody. Cinematography built that layer and has now brought it to Vectra. And together, um, we're essentially taking the Vectra, uh, AI technology approach to detection, playing to the, uh, Nat metadata stack, bringing na photography's frictionless, um, you know, software-defined observability, uh, capability to, uh, to Vectra.

So it's a, it's a really, um, great marriage. I love it. I love it.

You know, Marty, you, you've done now a few acquisitions, been acquired a few times. Each one has its own sort of cadence and circumstances. And without talking out of school and saying anything that's gonna get us both in trouble, how did this one come about?

Uh, this one came about, um, you know, we had, uh, um, you know, in any startup, if you're playing the game properly, you're gonna, uh, keep avenues of communication open with, um, you know, strategic guys who maybe are your competitors, maybe you're your friends, maybe could be friends or competitors down the road. Um, that's just how you, uh, um, keep the, um, the one, one of the balls in the air, uh, of, uh, building a, a good, uh, startup. So, um, yeah, we, we've been talking for a while now, and, uh, over the summer we really, um, put our heads together essentially, and started really, uh, getting down to brass tacks on, you know, they have something that we would be really nice for us, which was scale and market and customers, and, uh, their ai, uh, driven detection, uh, platform with the same kind of, uh, theory of detection that we had, which is, Hey, what if we use metadata instead of direct detection to drive, uh, more interesting detections that were lower noise, uh, and we had something they didn't have, which was this cloud scale software defined observability, frictionless deployment methodology.

Um, so you, you know, uh, the more we talked, the more sense nice fit, and it was like, let's, let's go. Let's do it. Excellent.

Yeah. Let's talk about you. So CEO of Nat now head of cloud, what exactly does that mean?

It's very nebulous title, isn't it? Yeah, It is, Right. Um, so, uh, essentially, uh, I am, uh, grand puba of all things cloud.

So, uh, um, product go to market, you know, um, messaging, marketing, so on and so forth. So, uh, essentially I'm riding herd over the effort to, uh, drive the nat topography, um, hybrid multi-cloud, uh, approach, uh, across the customer base, and also go find new customers. Um, you know, uh, NDR traditionally has been thought of as a, uh, a more on-prem focused, uh, technology.

So being able to take, um, that to the cloud and, you know, CDR R has already been taken cloud detection response, but that's control plane. Like here's the logs coming on patients. Yeah.

Um, so whatever we end up, uh, uh, calling it the, the other CDR, um, you know, all, all of that. So, uh, um, define that market, build that market, uh, and go, um, you know, attack that market essentially, uh, as we, uh, as we bring the, the, the teams together and the tech together. Um, so it's really interesting because, um, I think there's real growth opportunities there.

'cause quite frankly, uh, nobody is really doing this. Yes, you have guard duty, yes, you have Sentinel. Yes, you have, uh, things like, uh, you know, some of the other, um, NDR companies out there that maybe have some level of, uh, um, of capability to look at flow data and look at, uh, cloud DNS and stuff like that.

But nobody can do it. Like we do it across all the clouds. Um, and being able to do it, uh, and deploy frictionlessly, um, in real time, we actually have the ability to, uh, deploy and keep, um, uh, our cloud footprint up to date with a customer that's running live, massive cloud footprints, um, and auto deploy and things like that without the user having to interact with it.

So it's, it's quite powerful. We have customers that we can deploy across, you know, 10,000 VPCs in about 10 minutes. Uh, wow.

You know, it's, it's, it's next level stuff. So it's, it's really exciting. Yeah.

Very cool. That's excellent. And so, like you said, it's been a whole month already.

Mm-hmm. When will, do you think we'll see some sort of combined offering, and if so, when and what does that kind look like? Yeah, well, it's gonna be kinda a, a crawl, walk, run, uh, sort of thing.

So we're already talking to, um, you know, customers. So we had our pipeline on the na topography side that we're continuing to work to close. Uh, we have new pipeline opportunities coming up out of the existing, uh, vector base, which is perfect to, um, you know, get things rolling, uh, and, uh, you know, start friendly conversations and start, you know, essentially, um, design, partnering, the, the, um, combined entity, um, to, to, and previewing that to, uh, already active customers.

So, um, there's that. And then, you know, as time marches on, um, getting the, the fully realized vision of, uh, um, the combined entity, uh, to, uh, to market, I think is, uh, is gonna be the, the real trick here and the timeframe that that's gonna happen on, I mean, you know, as soon as we can, as quickly as possible Absolutely. As we speak, as No and no faster.

Yes. So my, uh, yep. I've got, uh, you know, luckily there's no engineers, uh, standing on the other side of my camera right now, uh, with baseball bats or anything like that, so I'm not gonna Yeah, exactly.

Dates, but everybody's very aligned on, uh, Or, or not that you see anyway. Right. But you know what they say, you don't see it coming.

So, Marty, for practically speaking, people out here listening to this, watching this, what's your advice for how they should engage with it? It's, it, the company will remain now as Vectra ai and the graphy is in essence their cloud mm-hmm. Uh, solution.

But what, how, what's your advice for the best way to engage? Uh, well, I mean, um, realistically, so there's a, there's a, a, a variety of options available for how you engage, uh, and where you have, um, needs. So I, I would look at people to evaluate their need.

For example, uh, NDR as a category is really coming of age now. For example, there was a, a Gartner released a, a full meta quad friend, DR back in, uh, June, and Vectra was the, you know, at the top of the heap, which was cool. Um, so, um, you know, it's a, it's a real category now with its own kind of energy, um, and so forth.

So, uh, there are, uh, companies and customers out there who maybe don't have NDR or maybe thinking about it or going to have regulatory requirements around it. So you should be thinking about, um, what do I need to kind of meet the, uh, compliance goals that I have or meet the, uh, security goals that I have. But at the same time, um, there's a lot of people out there who don't understand that something like the, the graphy frictionless platform is, uh, available.

Um, and, um, you know, if you operate these large hybrid multi-cloud footprints and you're asking yourself, you know, I have no idea what I've got. I have no idea what it's doing. I have no idea how it's changing and what's happening to it on a minute to minute basis.

Um, and that's a lot of companies these days, and that's how we did a lot of our selling at Nat Topography. Um, then you should really be engaging with us. And, uh, you know, we're, we're not hard to find, uh, you know, LinkedIn usual, the usual, uh, uh, routes, Usual suspects.

Yeah, exactly. Um, it, it's not hard to get a, uh, hold of us, uh, or you can just, uh, y you know, if you just want to come in, uh, completely, um, uh, cold, uh, sales at ai, uh, obviously, uh, the email, uh, route always works as well. But, um, yeah, we're, you know, um, we're interested.

There's also, uh, marketing things that we do. So, uh, seminars and things like that, I'm gonna be at, uh, AWS reinventing a few weeks, for example. Are you On Apple?

US two. Oh, Okay. Oh, are you?

Very cool. We're doing video. I have a suite up at the win.

Oh, yeah. Uh, I'll, we'll ask your people to reach out. Maybe you could pop up and we'll do a live video there if you'd like.

That'd Be fun. Uh, for sure. Cool.

Um, anyway, yeah. So, uh, you know, so there's, uh, uh, appearances that, uh, shows when we attend the trade shows. So we go to the big ones, obviously in partner events, and also if you have partners, uh, partnerships with, uh, you know, the usual partners like, uh, Guidepoint and things like that, you can ask them, uh, about Vector ai and, um, they'll get you engaged.

All right. Hey, Marty, thanks for popping in. I know you're, you're head down putting this all together now and racing to get it out.

I appreciate you coming on and sharing here with us on Tech Drunk tv. I hope to see you in Vegas. Yeah.

And, uh, we'll be in touch. Right? Sounds great, Alan.

Thanks for, uh, the time. Congrats again. Know Martin Rush, head of Cloud at Vectra ai, uh, talking about the Nat Vectra, uh, or Vectra acquiring Nat merger and what it, what's in store.

We're gonna take a break. We'll be right back.