Sumedh Thakar, Qualys | Qualys QSC22

This is texturong TV. Hey everyone. We're back here in Las Vegas for qualisqse 2022 entering kind of the home stretch right afternoon of the second day and I'm really happy to have this gentleman with me.

I've known him now for a few years. He's sumed tarkar if I mispronounce it. I apologize.

So then of course is the CEO of koalas and and he think I putting on this whole event that we've been covering the last few days so mad welcome. How are you? I'm good.

Thank you Alan. I was a pleasure to talk always sure so. Off camera a little bit.

I I've spent the last day and a half talking New Quality customers. executive team practitioners and you know, first of all, I want to congratulate you because there are few on one hand or two hands. Maybe you can count the amount of companies that have truly built hyperscale.

technology, right the koalas platform from everything I seen in the touched and heard is true hyperscale, right? And that is that's a tremendous accomplishment and the way it was built right re-engineering it with micro. services and everything else so Having that platform those are great enabler and and you guys are doing things that the quite frankly we only dreamed of in the security industry for a long time.

Yeah, a lot of Dreams in the security industry a lot of hopes and wishes, right? We've gone a long ways. Yes scanning vulnerabilities.

Yeah, but why don't you if you don't mind share with our audience kind of your your vision your what would you think the message of QSC this year? Yeah. Yeah.

I think the that's a good question here. Look at security we get so, you know deeply involved in the future and my capability and all of that that sometimes we forget to step back like 30,000 feet to say like look at the end of the day. The Cyber issues are really about a risk to the business.

Right? And when you have something that is a risk, you can't have to quantify that in terms of what does it mean to the loss to your company, even if a potential issue happens and this is really where we're not doing a great job today. We're focusing a little too much on my tools and my projects and when you you know in life whether it's it's your car your home whatever it is if there is a risk then you have an insurance and some way to mitigate that risk.

And typically you have a finite amount of money that you look at to say mitigate that is some of that you're gonna try to build some defenses and the rest of it will take it with the Cyber insurance today, right? And so If you really narrow it down what that comes down to is for us to be able to do a good job with with cyber risk. We need to be able to do a good amount of risk reduction by leveraging tools.

But the cost of that tooling needs to come down and that's where I see the opportunity and to your point about qualis having build that hyperscale platform is because by Innovation and when I talk about Innovation, I'm not talking about some crazy feature to find some super hidden malware The Innovation really is about how do we use the investment in the platform? To create a mechanism for customers to consolidate their security capability security tools and with that get much better efficiency much better speed in detecting and and neutralizing security events. And that's why I reduce your risk with being cost-effective.

And that really is the the big message that is we're hearing from customers is they're just you know, deploying too many tools and they're not even able to go to the board and say Here's my risk you gave me this much money now here is my race people go in and talk about. Oh, we implemented multi-factor authentication, but does that mean my risk is lower or not? Right.

And so I think that's really the the message this time that we we heard from customers with our focus on on vmdr true risk Etc has been hard. We give a risk space approach to to managing cyber issues. You know, it's interesting.

It's always been about the risk. Yeah doing this 30 years. It's always been about risk, but like you said we get lost in in the tools that we buy we get lost in compliance issues.

But the CEO and the chairman of the board still has the same question, right? Am I protected am I am I you know kid. Am I gonna get hit here?

Am I safe? And it's been in it's something we've never really been able to answer in their language. Yes.

You know the responses always been are you protected? Well, we have ideas. Yes.

Yes, I do. We daily schedule I got you know that last Magic Bullet that I bought two and I got this big box, right? But that's not the language.

They didn't care early enough. They wanted a number. I can't tell you now that I'm a CEO that's given I want to hear from you right because look you you run a business and you look at like, you know, what am I?

What's my cost? What am I spending? What am I getting in return?

So, you know you spoke to dilip if I was gonna give a million dollars to deliver some platform capability. I'm gonna say like in this amount of time the output is a new product that we have developed, right and that the question that comes in security. How do you measure the investment that we're making?

What is the outcome of that right to be able to do that? We need to be able to quantify risk and this is something that is very hard to do and a lot of people are able to do so, that's why they talk about DLP and other things but you can't really die. Yeah exactly big diving.

Yeah. You mentioned Insurance. Look, I'll give you a little story.

Yeah, 18 years ago. We're trying to figure out how to compete with. Koalas.

Yeah, and we come up with this idea. Why don't we go make a deal with an insurance company? Yeah, and anyone who gets breached after using our product, you know, they'll get money from the insurance a million dollars worth of coverage or whatever.

I think we spoke to we might have been a on insurance and Aon couldn't make it happen. Yeah cyber insurance was kind of it was a risky business. Nobody intended.

It's come a long way. Yeah, you guys are working with with some cyber Insurance. Yes.

Who how why tell us? Yeah, you know, I think the why is what I talked about, you know, when you to get risk, there's only two ways to eliminate that risk from business perspective one is, you know, being able to use cyber tools and the other part of that is the insurance part, right? So whatever residual risk, you take it with the insurance, but today the the Cyber Insurance Market is is you know maturing still and they're trying to figure out how they're gonna do the premiums Etc.

So today when you look at it that they are sort of both. I don't want to say two sides of the same coin because then means that they don't talk to each other but they are like if you can think of it as a slider right? So I think that really in well related with each other, right you're you're tooling and your insurance and when insurance companies are coming in and they were giving you codes they're just asking a high level question or they're not giving you the ability to say if you invest in tools and those tools actually bring down your wrist and I can reduce my premium because their risk is videos, right and that's not necessarily happening at the larger scale.

However, there are some very interesting startups in this in this area. Like how well insurance that we partner with where they are. They have this concept of an Adaptive insurance right where instead of the traditional way of saying pay me the premium that I've fixed once every every year they actually have integrated with qualis.

And basically they're able to say the customers using qualis vmdr with truis that true risk score gets sent to the insurance company and every month you will get a rebate on your premium. If you did a good job with your security score, if it didn't do a good job your security score you go back to the premium that you had agreed to pay. So now you are actually getting a benefit out of the security tool in terms of your insurance payment introduction, which I think is fascinating because that's really how it should be.

It's beyond fascinating. It's mitigation. Right really is mitigation.

You know, I think of it. I don't know like you we travel a lot right? So I build up all these bomb boy points in Hillary points everything and then I you know, someone in the family wants to go say, you know, tell myself but you know my points And then you look and it says pay with points or money.

Yeah, have you ever done that? Right and you slide the slider how many points she uses how much more money it's the same sort of thing. Here's my total premium.

Yeah, but by sliding my slider by mitigating. Yes, I could bring those premiums down. Exactly and that's what that's the language we need to and it's complicated and but that's the language we need to be able to speak not like oh EDR and and zero trust and all of that because DLP and all of that because of the end.

It's like what is that all that mean to the business? Right? And so a lot of the focus that we are have been putting on innovation has been how do we start to give some measure of risk and and continue to learn from our customers and start improving that so they have something that they can actually take to their board to the business to say.

Look. This is how bad we work. Here's a score.

You know, we gave me a certain amount of money last quarter we invested in doing this and now because of that the score has come down to that. Add is Meaningful that's measurable. That's the language of a CEO or of the board like.

Oh, yeah, exactly. Yeah, it's something they could understand and and the whole concept of risk mitigation. Yes.

So another term we've thrown around for years risk mitigation, but that's really about that's right. What risk mitigation is. I love it.

Here's another concept though that I've seen it to show the last day and a half and that is simplifying security for the people out there. Yeah, right security was never easy, but it's gotten harder. We have more tax services.

We have more the data is exploding, you know, the amount of data we have to sift through and analyze the people work anywhere from anything. Qualysis trying to make security simpler. Yeah, let's talk about that.

Look. I think it goes back to the same equation of right the the if we make the security simpler, it's unified. It's easy.

It's on a single platform single age and you reduce your cost of security. And if you can reduce the cost of security and you can get better security that means your risk is reduced and you pay less for reducing that risk at the end of the day, right? And and again, you know talking about sliders at the end of the day that that's the slide that if you make it too complicated the adoption of that technology is going to be harder which means you don't get the benefit of that risk reduction that you would if it was a lot simpler, right?

So we make we really focus on making it simpler for the organizations to deploy security and I was just talking to a customer and you know, they are in the business of detecting transaction fraud and stuff like that. And you know, they basically they they say that around the holiday season. They see a lot more fragile and transactions coming in and so they deploy antifraud technology which is helpful, but that is a bad user experience for many people because they have to to do the 3DS and they have to input and additional code.

So so then they see drop off and transactions also, right? So it's a balance right? How much if you do too?

You're gonna have customers like this to complicated. I'm not gonna buy if you do too little you're doing money, you're losing money on the fraud. And that's always the fine balance that if you can simplify it in a way that it's easy to deploy and that's really what with the single platform customers can very easily check boxes to say I want inventory.

I want to vulnerability management. I also wanted to patch just another checkbox. I wanted to capture Telemetry for EDR and if you make that simple, then customers are able to get value out of that.

Right? We had a really large customer 400,000 assets laptops globally. They had a quality agent for vmdr.

When the pandemic head all of the employees went home with their laptop, they couldn't and they couldn't basically patch this laptops or VPN. So they called us and within we flipped a switch within 24 hours all that 400,000 laptops were actually deploying patches within 24 hours. It's great.

That's the Simplicity. Right? Like if they have if not, they would have to go buy many additional VPN gateways to allow those laptops to come in and that the cost and the time taken to get to a project that I the VPN.

It's the extra band with it's more right and see it's the encoding and uncode it's a back which is simplifying security and deployment is not just about you have a nice UI it is really is the architecture done in a way that it truly simplifies the diploma and the value that you get over it. Excellent one more area something we spoke we've spoken about the last day and a half and it really wasn't part of your keynote as much when I say but total Cloud. Yes, right.

Look it needed to be more especially during covid and with the whole digital transformation. We're seeing more and more digital transformation of the cloud cloud native New stack if you will. Your take CEOs take on total Cloud you look I think cloud is just another infrastructure that people are deploying things into most companies and you were talking to one of our Airline customers yesterday.

And yes I said, yes the shiny new UI that's in the cloud and then the system that runs the the scripts are in their middleware Linux that nobody wants to touch because they don't know who did that stuff and then at the end of the day the whole thing is run on a Mainframe, right? So when they want to say, what's my risk to my check-in application it is not just about what's running in the cloud. It's the entire risk posture of the vertical stack to say where is my risk?

And so today call us. We do a lot with customers on their on-prem environment on their remote endpoints. We have 30 million agents in the cloud already that our customers are running.

So we see this as an opportunity to help customers simplify their Cloud deployment by by adding. Additional methods of detecting in issues and bringing them into a single View and applying the risk score on top of that. So then you don't have to go deploy five different products one for cloud one for this one for that.

You can truly get that single platform experience and that's exactly what it is about is simplifying security. If you're a college customer you have the MDR running in the cloud. Now, you just have to give us your AWS authentication credentials and you don't have to do anything.

Other than that. We are going to go find the assets. We're going to go do a scan deploy the scanner run the scan bring down the scanner.

All you get is a findings at the end of the day, right? And that's a simplification of the security. That's really what it is that we're focusing on actually one more quick question.

Yeah, we're back in person. No, no virtual side show or anything. How does it feel?

I love it. I'm a people person. I like having those interactions.

I think you know we when we have that one. Conversation people are a lot more open than are distracted. And you know, the whole point of the conference is about bringing our customers here so they can have that direct interaction with our engineering team product team.

And for me, I love having the product Advisory Board and our one-on-ones with all the customers to really listen to them and you really have that focused time. And even that focused 20 minutes is way more useful many times than a one hour Zoom conversation. Yeah people and so I think it's great to have that remote technology but a good combination of being able to get a bunch of stuff done in remotely but also mixing that with the right in person interaction.

I think that's a great way for us to continue to to learn and and to innovate I love it. Hey, man, congratulations great show. Thank you graduation more importantly than the show.

What what you guys have built here what qualities doing? Good stuff. Actually, I always thank you the feedback.

Thank you. Alrighty. Hey, we're gonna take a quick break.

We're live in Vegas for Quality QSC. Stay with us.