ProwlerPro SaaS – Casey Rosenthal, Verica

This is Textron TV. Hey everyone, welcome to another text drug TV segment. I'm happy to be joined by a regular on our show.

It's my friend Casey Rosenthal. He's the CEO co-founder of America Lots going on in verica. Casey's going to tell us about it.

Good morning Casey. How are you, man? I'm doing great.

Thanks Alan. Good morning to you and great to be talking to you again. Absolutely.

Are you up home in Maine or on the road? I am I'm yep. It's it's a beautiful fall day.

So yeah, it's it's I'm up here in Maine. The apples are ripe. And so I'm I'm in a good position.

I'm here. Yeah. Yeah.

I don't need to start turning any day now. Yeah, absolutely good for you. Anyway, we haven't had you on For varicor update probably I'm going to guess a couple months now.

Yeah, why don't you bring us up to date if you would. Sure. Yeah, so so we got a lot going on with Prowler and and Prowler Pro if anybody's following our our repo and GitHub for Prowler, you can probably kind of Guess with the changes.

We've made foundationally for for version 3 which is on the horizon that we've we've made a lot of performance improvements and expansion for the functionality. But what I'm really excited to announce is where we've created a free tier Community SAS around Prowler. So, you know, we're taking the open source package which we're still you know, 110% invested in and the adoption there has just been bananas the the GitHub Stars.

Thank you everybody for those over six and a half thousand now, you know millions of downloads. It's just really taken off open. Um, but that's you know, if if you want to download that add your own checks and instrumented in your system.

It's great for that. What we found was there's a lot of people out there who I can relate to I was a contractor consultant for about a decade in a former life and and I built mostly content management applications for for my customers. So, you know, I'd build them the application.

I'd get him set up. Usually I'd use their credit card to sign up for you know, hosting and DNS and and all of the different services that you need to run an online application. And the thing that I didn't really have at the time back then was a similar, you know SAS subscription security service that I could sign them up for and so that's what we're providing.

You know, right now we've got it's just a free tier. So you just put your AWS credentials in it's agent lists and it'll start scanning and present you with a dashboards. So even if you don't know a lot about security to begin with you can get off and running.

And it just kind of makes AWS security real easy. And you know brings all of the the power of of Prowler, you know, the 250 plus Checks Into The Sassy you get all of that exposed to you in a dashboard, of course, you know again for the beginners what you're initially going to be looking at is, you know, checks passing versus, you know checks that don't pass and or that the critical ones in particular so over time what you want to see is the green line go up and the red lines go down. And so, you know, it's just giving people kind of that very intuitive easy way to get started with security.

Yeah. So we're we're really excited that we're able to, you know, bring this back to the community and and expand the reach even further. you know, so that's one of the Promise.

It was the promise of Seth right to be able to have something like this. Unfortunately, we've probably been in this sassy world now for five six seven years, right me and tasty a lot of products. Don't deliver on that promise.

Right, it's more than just hosting an externally. Yeah, he's of use. It's the hey man.

I said it up. It said some really quick. Everything's back on, you know on the back side and And it just works it where it's like Auto Magic, right it works.

And and it's intuitive and it's it's all about the ux right it is and so and developer ux right? So we we You know at RSA and and some of the other big conferences, you know, I think last time I say in person was that RSA, you know, a lot of buzzwords on the in the exhibition Hall there deaf set cops is obviously a huge both word from marketing. But also, you know, a lot of people are taking it seriously and trying to develop their ability further and we think we can contribute to that because this is a tool that was developed by somebody who actually was facing the problem and built the tool to solve that problem.

You know, Tony when he started Prowler seven years ago now was you know, one person a one-man security shop and so he had to build these checks to automate his job to get his job done and we've the project never lost that Focus. So to be true to that, you know, the the our company Mission and our goal with parlors to stay focused on at the practitioner And what's interesting to us is there really aren't a lot of practitioner-led or or product-led growth products in the security space. Most of it is, you know sold top-down and so most of it focuses on you know, see so goals, you know, which is which is great.

There's there's a place for that but you but in other places and infrastructure you really seen software take Leaps and Bounds forward focusing on that practitioner first approach the the developers ux and you know that that really changed the whole infrastructure world with with kubernetes and observability and all this stuff going on over there. So we think the time is right for that to really take hold and security as well. And yeah, we're just super excited to be Part of that and then, you know kind of in helping instantiate devsecops as a real Force for change.

Absolutely, you know, you mentioned our say we're actually in the middle of talking to RSA about devsecops for next year there and maybe we'll do something on this there. But an interesting thing, you know, I Casey I sent a chair here, but I it's like I have the best seat in the house right? I see everything passing.

Some Trends I've seen coming through. one is you know, we got to stop burdening the developers. They have too much on their plate already and you know the old story this is the smallest violin in the world playing arts and flowers.

Yeah. I mean these look developers make up. a lot of money top developers get paid really really good.

I've never met a developer who raises their hand and says she's I'd like to develop low quality security and old code that's full of vulnerabilities, right? You have great pride in what they scrapsmanship. It's yeah, so Anything we could do that will help them.

Make more secure code I think is welcomed. But I've seen I've seen surveys where 40% of developers say we have enough on our plate. Yes, they have enough on their plate, but they don't want to develop insecure code right?

I think there's a disconnect there. I recently saw an article and it was a sponsored article. It's not you know, and there was a little click baby, but it said something like Devops is dead platform engineering.

That's the new cool thing now sure right. You've got it. Sorry now, it's platform engineering because with these developers have too much on their plate.

I think you know for a long time people said defsecops was it real? It was marketing. It was Arthur.

I think we've realized how real it is and that shifting left and giving developers the tools to to develop more secure code. Is is a win-win-win all around? Yeah, it's that last part.

That is that it's not that developers have. Too much on their plate and adding security is adding another thing on their plate Security's are already on their plate. They just don't have the tools to do the same every part.

Well, stay right. You need tools not developer tools. Exactly.

Yes. Exactly. Yes.

So give them the tool give them the information. They're gonna make better decisions. The same is true about availability and and costs by the way.

So the it's not that security is is special. It's just and those are two things where you know, there's there's also a lot of great Innovation and tooling but yeah, I mean the things that are programs do well right now are the things that developers kind of have that first hand experience, you know, when kubernetes started coming, you know, coming up out of the out of the the miss a few years ago. There were a lot of jokes about like, oh, yeah.

Well all these developers are deploying kubernetes clusters, you know. Before they need to well, yeah, but kubernetes made it easy to do that. They had a good Dev ux to do those things.

So then it was easier for them to you know, so they did more of it if we have better security tools. They'll do more of it. I agree.

Yeah, you preaching to the choir here, but remember the less there are these voices that persist. Let's go. Look at the business aspect of a Casey.

So how did this is available? You know if they're watching this now, it was announced it's available. Now.

How do people sign up? How's it priced? What's the deal?

So so right now it's it's free. pro you sign up. It takes five minutes to go from sign up to seeing dashboards running against your system.

So, you know, you just, you know, follow directions on the site. It's super easy you put in your your AWS credentials that it can hit the AWS API and then it starts feeding the dashboards and you know again in a in a few minutes, you'll have a whole list of view of the security of your your Cloud footprint. We've got a lot of great features.

We're going to add in the in the coming months you can imagine our roadmap is is pretty full and exciting for you know, as far out as we can see. but you know one of the other things that's great about putting this in a SAS is you know, we've got we can see millions of people downloading that the open source package and using that and you know, of course we want to continue supporting that and and and we do but it's it's hard to understand how people are using it if they're just downloading it and we never hear from them again. So this is also another great way for us to it's not just you know, we're offering them more convenience and we're expanding the community that way it also creates a better channel for us to hear back from people like, oh they're you know, they're more interested in the pen testing checks.

We see those get run more often. Well, then we can, you know, put more resources and rally the community more around that type of thing and make the product even even better that way. So this is this is just gonna open up a whole new world for for us in terms of you know, what what Prowler can do and and where we can take it.

So it's yeah, it's pretty cool. io as well. pro, you know, really easy to just, you know, put in your email create a password and sign up and point it towards your AWS account and you'll see you'll see the results.

Oh, man, I love it. Sounds like a great a great thing. Beyond Prowler probably want people to be aware of America does more than just Prowler, right?

Yeah, one of the pioneers and Chaos engineering and For people who may not be familiar. We should have probably done this in the front end of the interview, but we're going to do it on the back end instead. Give them a little background.

I sure yes. So like you said my background is in chaos engineering, I wrote the definition and and co-wrote the book and started the conferences on it America, you know basically has three products at this point. We've got to continuous verification platform focused on kubernetes and Kafka are kind of Flagship deal that we're able to talk about theirs with Dish Networks.

So they're the the fourth big cell service provider and in the US they chose varic as they're continues verification platform. So so that's really cool, too. We're doing a lot of cool stuff to verify call Quality and you know all of their new 5G infrastructures running on kubernetes and Kafka.

So that's that's awesome. Our second area is is the void so the void that Community you can see our incident database is kind of a byproduct of our work on on the Contin. Verification platform we did all this research on like how can things go wrong with kubernetes and Kafka and there's obviously a big connection with chaos engineering there and we gathered so much data other people started seeing value in that data.

So we put together a research team that creates a report an annual report the void report and now there's a community service there subscription service for companies where they can participate in incident analysis incident review and kind of hone their skills around incident incident remediation and stuff like that as well. As you know, get access to certain data products in the report. And then the third the third component is is Prowler as Prowler Pro which is where the majority of our focuses right now just because it's so fun.

I love it. Hey, I hope we don't have to wait Tara. I say in April to see you in person.

Maybe are you gonna be a kubecon? I not kubecon because it overlaps with qcond ironically enough. Cool.

Is that okay? Yeah, but yeah, I'm sure I'll see you soon at at one of these. Okay, Casey Rosenthal CEO co-founder verica talking about the new sass hosted version.

Prowler Pro, really simple if you are on cloud you want to Get serious about Cloud Security, even if you're not an expert, but you're developer who wants to go check it out. We're going to take a break. We'll be right back here on texture on TV.