Scott Johnson on Black Duck’s Rebrand and Future of App Security

This is Textron tv. Hey everyone, welcome back here to techron tv. I've got a really good story.

It may not be a big story to you guys, though. It is a big story. You know, in the, in the area they play in open source software and, and licensing and software composition analysis.

This is huge, but it's also, on a personal note, a really feel good story for me. I used to cover this company way before there was a Techstrong or a media ops. I had just left still secure, and I was, I think I was writing for Computer World or Network World, one of the worlds.

And I and Phil Os, who I find out is still a black hat. Phil was doing a blog there too. Still here?

Yeah, he still A black, and Phil and I used to compare notes all the time, and that's how I was really kind of first introduced to Black Duck Software. This, of course, was before Open Source was, as you know, prevalent as it is today, as dominating as it is today. And it was really Black Duck back then was about open source licensing, right?

Enterprises wanted to know what was their exposure vis of being licensed for open source. Anyway, not to steal my next yes, thunder, but Black Duck wound up getting acquired by Synopsis. He'll tell us what years ago, you know, synopsis was it's old version of Big Brother, big Corporation and, and Black Duck, you know, held its own and, and was a valuable component there.

But the good news is the duck is back black Duck is back. Let me introduce you to Scott Johnson. Scott is VP of Product Management at Black Duck.

Hey Scott, welcome to Text Drug tv. Hey, thank you so much and uh, like I showed you earlier, I, you can kind of see I brought, I brought, this is actually, you got the black duck. There we go.

Yeah. Now this is one of the, one of the older versions. I think we have cases of them.

So the new the new Black Duck is a little more svet. Got a little Really? Yeah, I, I kind tell.

Hey, but I'm a little more Svet too. So it all, it's all good. And You're Looking good.

It, it's what's happening. Scott, before we jump into Black Duck though, let's talk a little bit about Scott, as I said, your VP product management, but this isn't your first stop in the security universe. Give us, give us kind your background.

Yeah. The universe is, is, uh, expansive, isn't it? Right.

So I started related It. It's big. If it is, it's six degrees of separation.

Well, we, we talked about just some of the interconnected folks that we know from the industry. So yeah, so I, um, I started, uh, back my cyber journey back in 2002 and I had the opportunity to join Internet security systems. Some of your listeners.

Yeah, black Eyes Internet Scanner, X-Force X-Force team. Yeah, the original, uh, white, white hat, you know, good guys, so to speak. Right.

So, and I really got tell the truth, tell You didn't call it cyber then. No, no, we were sec Yeah. That, that evolved into Yeah, That evolved, Right?

Yeah. We were still talking about, you know, Ninda. I mean, think of all the, the, the really interesting, you know, Trojans and Worms and both Ninda and, and, uh, uh, the Anor Cova virus.

I still remember the, the, uh, uh, The McCarthy Virus took out my, took out and bricked my computer. Jesse Mahar got my IBM machine. Oh God, I remember that one too.

I can't call for that. But anyway, I fell for it. I got caught.

So, but yeah, so I spent a number of years there. Um, got, uh, acquired by IBM and, and the journey ended up in, uh, the AppSec space. So I, I was with, uh, a competitor in the AppSec space as a GM for a number of years, and then joined, uh, uh, the Synopsis group about four years ago almost now, when, uh, our current, uh, our former GM and now CEO Jason Schmidt came over.

And so it's been quite a journey in the, in the security space and a lot of great people along the way and, and just look the continued, uh, challenges to resolve for customers and just how, how critical, you know, cyber is to our day-to-Day businesses, right? Our business operations and the enterprises themselves. I mean, I was, we were just in a user event, um, in London and we were talking about one of our customers that was there was Maersk and, uh, we were just talking about the impact in the supply chain.

Like when, when the barge hit the bridge in Baltimore wasn't a, yeah, wasn't a cyber thing, but the rippling effects of everything along that in terms of, you know, what's in the supply chain, what's in the box, what's in the container. We had companies there like Wreck it, who makes Lysol. So there's literally packages there.

And so the, the impact and the interconnectedness of things just underscores how important cyber and InfoSec is. So that's a little bit about my journey and I sure, I made the decision back then when I was talking to a couple of, uh, uh, the guy named Neil Meta, who was one of the, I think he's a Google now, and he was one of the guys along with our C**n folks that, that, uh, first sort of brought heart bleed to fruition. And I was talking to him and after a conversation, I'm like, you know what, cyber's where I'm gonna be, I don't know what I'll be doing 20 years from now in cyber cybersecurity, but I'm gonna be there.

And, uh, let's just say it hasn't disappointed and we have no, we both have the scars. We both have the scars on our bed. Yeah, I Would say disappointed.

Well, let's say, say this, as Tanna would say, it's always something inside the security, right? It's always something going on. Um, Scott, I, I tried to do justice describing sort of the early black hat when I first kind of, you know, was exposed to them.

It was really about, uh, software licensing, open source license, and back then you had OSI licenses, there were six or seven, and Black Duck was the standard on how you, you know, made sure you were in compliance with your open source software licensing. But of course, over the years it, it's expanded beyond just licensing. I wanna discuss that and I want to discuss sort of the, the history of the Synopsis acquisition, and now the Sure.

The spinoff, but let, let's first talk about the Black Duck product line, right? From open source licensing to what? Well, really centering around, um, I think two, two factors.

One, um, the vulnerabilities, right? Being able to identify vulnerabilities associated with the open source components. When you look at the, you know, the predominance of an application today where 70, 80, 90% of the application is, is open source, and all it takes is one vulnerability that gets embedded right into, uh, the, the base of the app, right?

Your mobile app, if it gets distributed, if you're a large financial institution, and it goes out to a million customers, right? You have to identify that. So that's, that's a big part of the evolution that happened there.

The second thing, um, more recently goes back to, uh, the executive order around the supply chain and what we really are in many, yeah, the supply chain effect and how black duck SCA is really, um, the, it's really all about, um, supply chain security and open source. SCA is a big part of it, but it's evolved, right? Where you have to be looking at the SBOs, uh, looking at, uh, the various fields, right?

Every customer wants to know Dependencies and all of it that The exact, exactly the dependencies and, um, the ability to create an SBO and, and know the ingredients of your software, just like you wanna know the ingredients of your, your peanut butter, you wanna know. And, and that has really changed things we've done, we've done a lot over the last couple of years, and especially the last, uh, six, nine months to incorporate supply chain capabilities. We came out with our black duck supply chain edition, which builds on that licensing, uh, aspect that you mentioned, our binary analysis and adds additional capabilities so that our customers can really address that challenge and, and, and meet those needs.

Because today, every, every application requires an SBO m that goes with it, and the, the impact down the stream. When you look at many of our customers and say the automotive space, you know, they're making the software that goes into the chips, that goes into the car, that then drives us to the store or drive or our, or our family members to the soccer games. And if there's issues with those, those chips and the firmware and the software, um, you know, lives could be at risk, right?

I still remember going back to Joshua Corman saying, I don't want my automated self-driving car, you know, running over my grandmother, you know, and it's like, that was 10 years ago, and today it's like, yes, we can't have that. And, uh, so that's part of the evolution with, uh, with Black Duck, SCA, um, and then as a company more broadly, which you were alluding to, um, when you look at Synopsis, and really it goes back to Chief Oon, uh, one of the, the co-CEOs and longtime synopsis, uh, uh, leader who really had the foresight to look at the evolution of what Synopsis was doing with EDA and, and building out or providing the, the design, the chip design software, and realizing that wow, InfoSec and vulnerabilities that could be associated there, that synergy is really important. And so that really led to some of the acquisitions with Verity, black Duck, Sal C**n, uh, and a number of others that really brought us together to create the nucleus for the software integrity group.

And now, um, the foundation for what's now Black Duck software, which includes all of those, uh, technologies and solutions for our customers that we'll be able to build on. So I, I want to make sure we, we emphasize that people understand it. First of all, SCA software composition analysis, right?

Which is kind of the, the code name for scanning for vulnerabilities and open source software and components. It's more than scanning it's testing for it and everything else, right? But when we talk about this new version of Black Duck, it isn't just that that they spun the old black duck back out.

This is truly a new black duck that really represents the entirety of that software integrity group, right? So Synopsis is, and I, Scott, you, I'm assuming you would know more than I, billions multi-billion dollar market cap company, right? Correct.

Yep. 5 billion in revenue, extreme growth, the, the hockey stick growths, you know, and yeah, I mean, the whole Thing, very successful, right? And about, I guess it was maybe a year or less ago, they, they said they were gonna like bifurcate the company and spin up this software integrity group, which does, as you mentioned, had Black Duck and some of the other Cohesity and some of the other companies they had acquired as well as, you know, organic products that they had developed there into one software integrity group.

But that was handling, you wanna call it cyber software integrity. It was probably bigger than just pure cyber. And now that entire group represents the new Black Duck.

So this is black Dutch plus plus, right? Yeah. So this is, that's exactly correct.

So the, the roll up and, and the, um, software integrity group was sort of created some years back, and each of those acquisitions went into the same business unit. So the great thing is the foundation that we have, not only with the Great technologies, but um, most of a business unit. So in terms of being spun out, right when, when the organization looked at, you know, um, what made the most sense for us as a business unit and the direction that the, the mothership was going, it made a lot of sense to say, Hey, let's enable, uh, the software integrity group to go out on its own and really drive its focus and, uh, enable us to action our vision.

Because as great as being part of the mothership has been, we're still, you know, 10% of a $5 billion revenue company that was more distributed. So when they made investments, they obviously had to look where we, where do we get the, the, the right ROI for our direction, uh, and um, really focusing across the board. And so the new entity with us becoming Black Duck.

Uh, and there was an interesting quote that I, I heard just the other day from the poet William Blake, when's the last time William Blake was quoted, uh, on, on your show? Probably never. Well, Maybe what was it ever is the question.

Yeah, Exactly. But he said, no bird soars too high if he soars with his own wings. And that's sort of indicative when I thought I said, that's us.

We have been a great company, really profitable business unit within Synopsis, and now, right? We're, we're moving outta the nest and we're having the opportunity to really spread our wings to, to tie in with the, the vision, the, the, uh, um, the imagery to, to address the needs of our customers more directly. And, uh, it's, it's an exciting thing that many of us had really, that are here, had been wanting to do for some time, and that really is to drive the, the platform to meet the needs of customers at a, uh, at a, at a more granular way or address the challenges that, that are out there.

Absolutely. Scott, our audience is, they're a technical audience, not many people from the CFO side of the house, but for those who may be wondering, so if Black Duck is now an independent company, independent of Synopsis, is it wholly owned by Synopsis, an employee owned VCPE owned? What's the story?

Yeah, so we are, uh, part of, uh, two private equity groups with, uh, clear Lake and Francisco Partners. And so we just Also very, very heavily invested in cyber, Both heavily invested in cyber, right? They, they, in fact, um, uh, one of the, one of the reasons why we are still using the, where we're going with a name Black Duck is one of the private equity team members, um, has been following Black Duck for a number of years.

And when the discussion came up, uh, that individual had one of the black ducks and said, well, what a, what about this for the name? Um, and, and plus just branding wise, you know, why rename and come out with Aptify and try to start something new when the Golden Egg right is right there in the nest. So why not?

No Doubt about It. I mean, look, I, I was, I was thrilled to hear that it was being named Black Duck, right? That was, that was a good, I mean, I don't know, for me, it just brought back good memories and, and good feelings of, of a quality company, right?

And, and yeah, those are hard to come by. So it's all of good S**t. Hard to come by.

Yeah, it's all official. As of October one, um, we, uh, we opened the Egg if people were watching on LinkedIn, you know, and we, we hatched in terms of, uh, becoming a, a black duck as a, as a business entity. And so we're now in sort of the, that short term transition, right?

Where we're working through all the entities set up and making sure we have the right businesses set up in the different regions, making sure our PO systems are working and all those things. And then really, um, you know, driving that assurance with our customers. Um, and unlike a lot of private equity scenarios, one of our benefits we think is right outta the gate we're profitable.

So, um, 500 million roughly in revenue or, or profitable. So we can, we can focus on growth versus sort of the cost controls that often come with, with pd, uh, that I think a number of folks in the space and our competitor base have gone through. And then the, the third element of sort of our short term efforts is really then from that assurance with customers.

And we just had a user event in London and spent some time with some of the largest enterprises in the world and really just centering around our execution. So the things that we said we were going to do six months ago, nine months ago in our roadmaps, continuing to execute on those, we're working now on rust coverage, for example, with Verity. We talked a little bit about the supply chain and we're continuing to add new capabilities there for SBO m management and doing that at scale.

So it's, it's proving to our customers that, um, yeah, now that we're our own entity, um, we're making that transition. And then longer term, when we really look at what that means to drive more agility and really focus, right, um, in a larger enterprise, right? There are, there are times when the, the mothership might say, Hey, we really need you to do this deal with Customer X.

That may or may not really fit for us, but you go do it 'cause the mothership wants you to. So in our new world, we're really gonna focus in on our base customers with, uh, the, the embedded space, uh, and truly just expanding that. There's a lot more coverage we can add and the, the various hyperscalers out there, so you mentioned the, the large tech companies, um, our bread and butter, and then the regulated enterprises, so transportation, automotive, and really getting closer to those customers, uh, and maybe not quite as much in maybe the commercial side that we will, we'll have some options there, but really doubling into those customers that truly have complex and regulated needs that we feel we're best positioned to, to meet the needs of.

And so that's sort of our longer term approach around agility focus, and then building that trust with our quality results. Because for those customers, um, quality still matters, right? We just, I just saw a win wire come across and, um, the interesting thing is it was against one of our competitors and the primary takeaway for that customer was the quality results were the difference.

And so we want to continue to build on that while we evolve the ease of use with our SaaS platforms so we can play that side of it, but the quality can't waiver and we're gonna continue to build on that. Right? Again, that's part of the Black Duck brand is is the quality.

Absolutely. Hey Scott, I got a silly question. Sure.

com? Black Duck. Black Duck.

Yeah. We be, uh, we maintained the URL um, You Did throughout. Yeah, Very.

So, so we were fortunate enough, somebody was smart enough. com was a bed and breakfast way back in like 2013, so Really? Yeah.

So maybe we'll make some with a, with our, with our duck. Maybe we'll make some, some eggs at some point. But, uh, the irony is that That's like a breakfast at RSA or something to me.

You Know? You're on, I Got, you're on. Yeah.

Hey Scott, thank you so much for coming on. Congratulations to you and Phil. Thank you.

And the whole, the whole Black Duck team there, man. We're, we're expecting big things from you. It's good to have you back and, uh, you know, I, I think we're doing some work here at Techstrong with the Black Duck team already, so we'll have some stuff with that, but man, I'm excited and happy.

It's good, it's good for you guys to have that name back and it's excited to see where you guys go with it. Yeah, we're looking forward to it. And as always, Alan, really appreciate Your, your time and uh, Blake, thank you so much.

All right. All righty. Take care.

Hey, Scott Johnson, VP Product Management at Black Duck here on Text Drug tv. com. We're gonna take a break.

We'll be back in a moment.