Pam Murphy, Imperva | RSA Conference 2023

This is texturung TV. Welcome everybody. We are here at rsac San Francisco 2023.

It's been a long but a great week and very energizing because there's a lot of I think there's a lot of energy happening on the show floor conversations what's happening with customers lots of great things which which I'm privileged to be joined by Pam Murphy CEO of imperva and really one here about some of the conversations that you're having around what you're hearing from customers and things like that. But before we do that love to have you introduce yourself tell us folks a little bit about imperva sure and thank you for having me as you said. My name is Pam Murphy.

I'm the CEO of imperva and imperva we protect and we help our customers protect their data and I'll pass to that day and so our customers they depend on us to protect their applications to protect their data protect their api's wherever that is and resides and whatever format that it takes and that's ever increasing and all those applications and all those forms right for sure. Know well, you know tell me your thoughts about this this year. Yes, the Energy's High lots of Engagement but seems like a lot of conversations with customers and partners about what some of the challenges are where each working on and facing.

What are you hearing from people that you're talking? You know, it's amazing because it's almost like it's filled forever that we're talking about digitalization and transformation. But you know, honestly, we're still in the early Innings.

I think still of that Journey, you know, we like to refer to it as being modernization, right? You had a lot of companies who did the big lift and shift to the cloud and now we're seeing customers go back and sort of do more modernization. Of their applications of their data and you know, there's concerns around, you know, as we have allowed our teams or devop teams or application teams to go into the candy stores that are the csps and all the Technologies out there and effectively take the best of what's out there and use that as part of their, you know, digitalization and use that to sort of, you know, put more more things in the hands of the consumer.

You know the concern Still Remains around have we appropriately secured everything that we've moved to the cloud as we've adopted, you know new technology. Are we doing that in a way that's inclusive and as we've allowed devops and everybody to go out and use every day to store and a reposity out there doing over our data is so I think we are still in the Journey of making sure that as we have, you know had this huge uptick during covid of the use of these new technologies and these news great things, which honestly speaking we need right nobody wants to Stop our teams going out there and giving our end customers the best possible experience from a technology perspective, but it has brought up, you know continued concerns around whether we're evolving the security of that as much as possible. So from our perspective and that translates into A lot of discussions with their customers around security for apis.

So apis in particular moving around for long period of time, I mean I've been around for as long as I've been out of college, but what those apis are being used for particularly in the last number of years has grown and grown and grown and what's happening now is the the power of what those apis are doing and how they're interacting directly with data stores is really bringing to Bear a concern about the the sensitivity and of the of the data that they're effectively touching and pulling so API security is a huge issue with our customers because they don't know where all their apis are what those apis are doing and that also is the case with data in general. So, you know a typical customer now could have data repositories that are structured in nature. The Legacy databases that are on premise will not move there for a period of time but they've also taken advantage of data lakes and you know.

You know, unstructured data and they have those in in RDS. They have them in ec2. They have them in Azure.

They have them and they have them everywhere. So it's the thing of how do you secure data that is in any shape or format that is in any place. And and that's what you know with our data security.

Fabric we go about solving for but you know, we still see quite a lot of companies out there who are still getting their arms around where they have allowed sort of the use of all this technology to send their data. So, you know, it's quite incredible to me how we're still in the Journey of working through all of that in securing all of that, but I think what's happened in the last two to three years in particular is that the pace of that has just, you know exploded absolutely and so now we have applications any form data any form everywhere and it's our job to secure it and bring it back together and help help customers understand, you know where that date is who's touching it what they're doing with it when someone starts at the application layer, what are they doing? What's happening down to the data layer, so You know a lot of insights we can produce for what is just a very complicated problem.

Our customers have these days I can imagine in it's it's catching up with what's happened and what we have but also thinking about how do you it's not going to stop happening right? It's a continue and it's going to continue to accelerate. So I imagine that's where if you're trying to go at it alone.

Yes, there are some very sophisticated companies with security teams that they have but even in that case you need the right partner or the right platform the right tools the things to do API Discovery the things to do where is our data, how is it being managed? Yeah as a proliferate. Well, we're seeing quite a lot and it's you know, it consolidation of Security Solutions is definitely a real thing because what's been happening out in the market is that Companies have grown the number of solutions that they have but they just don't have the people to manage them.

I mean people with security skills is really a big a big shortage. And the last number of years is unfortunately not really helped that so the messages we've been getting is that you know, they want your your security vendors. They want those to be more strategic and they want the platforms to be more complete.

You know, we've been very purposeful about building our platform and making sure that it's very easy to turn on additional capabilities from that same platform and that's what customers are demanding. I think the days of being able to feasibly manage and operate a hundred different. Security Solutions within a customer environment is is gone customers want to be able to spend the time focusing on the threat hunting right focusing on the actionable insights right that they get from those Security Solutions and identifying how do they protect their business from?

You know proactively against future attacks. They want to go up the value chain effectively. And I think that's the reality where we are and I don't really see that changing anytime soon, unfortunately.

I heard a CSO say a while back from a social media company. I don't consider any tool that require additional people it either has to help me do the job more effectively and more efficiently with the resources that I have. I can't hire more totally.

I mean, it's very logical right? You've got to be quick time to Value. You need to be kind of a good total cost of ownership meaning low to operate and you need to deliver value.

You have to be able to justify the investment that you're making in insecurity and what you're getting out of the tool and it's no good anymore to just be very effective blocker or very, you know, effective Discovery you have to be able to sort of deliver insights and value to a customer to help them, you know explain the benefit of the solution and then also the impact on your business if you don't have that capable of say so lots of things to consider but you know, I think it's a very different security environment now then then it is before from that perspective. I think I've worked in other areas of Technology before coming here and They're much more mature Industries where they're that consolidations already happened. And when I first came into security I was like, whoa, how can this be?

But, you know, I think we are seeing you know, Big players getting bigger and I think they will become, you know more more dominant and they'll continue to build out their portfolio and that's certainly well. We've been doing over the last number of years as well. Yeah.

It's interesting because I've had a chance to speak with canal and your your ctoc so and talking a little bit about you know, it is it's customers that are going through the modern things process digitization. You also have made your own transitions part of your evolution of your products and Technologies moving some things to the cloud, you know taking on even more products and offerings and API security and application security. Yeah.

So it's it's we all have to kind of keep Pace with that we do some ways you have to kind of keep maybe a little bit ahead of your customer at least going are ahead of our customers. Yes. I love to hear you talk about that.

Yeah, that's a challenge. Well, one of the things I am, you know, I really love about imperva. Is that our core competency security?

That's all we do and many competitors in our space have have Have another part of their business, right and they have security and so one of the benefits of being solely in 100% focused on Securities that you really you really make sure that you are the best to breed in every product or area that you that you that you operate in and that you touch and that's something that's really really important to to us and we have very big very very large customers who are very demanding of us to make sure that you know, we we stay ahead right and we we don't just sort of keep up if you will and we have a lot of very passionate people in the company who just love discovering new things. Trust me new things developing new things is not a problem. That's not a problem.

I have it's about sort of our capacity in bandwidth to continue to productize and bring them all out to to Market. But you know, you look at the area of bots that is one area which on the bad side or on the bad operator or slash the the Bad actors that is evolving at just a phenomenal race that you know. Constantly having to make sure we throw resources and we throw a capacity it always staying ahead of it.

And there's a very broad bot Market. There's some Bots that are focused on account takeover. There are others focused on price graping others that are focused on inventory scalping.

So there's probably about 12 categories within the topic of boss and every one of those categories. There is a Marketplace out there for those Bots to be made available. And so we have to all the time just using one example of the many many solutions that we have where we have to go and make sure that we are staying ahead of it and you know, they're becoming more evasive.

We need to make sure that the efficacy of our solution is such that we are not stopping the Judgment traffic from coming in so it's fun, but it's you know, it's it requires a lot of investment a lot of manpower to make sure that you're you're staying ahead because there is a lot of Bad actors out there, but that's what makes it it is. It's Dynamic and changing. Yeah, one thing that's fascinating to me too is that's that's evolving is it's not just the technology and the techniques that Bots and Bad actors are using it's transformed into its own business.

Totally if you will, it's not just downloaded a kit and here you go. You're on. Yeah, you practically get support for you know for kits and things like that tools to be able to you know, put bad.

Bots on the network and go Sick up the inventory of all the ps5s or whatever. The latest thing is, which by the way is not illegal, you know, it's it's not a legal activity and therefore, you know, it's it's when when you're dealing with that scenario that kind of gray area which is devoid of legislation right now, then you know, there's there's no penalty for people to do it. And so, you know, there's quite a lot of companies and groups making a lot of money every year as a result of doing that and that has big risk for the underlying business who suffers as a result of it in addition to the reputational risk, you know, people get frustrated that they can't get access to what they need and they get overwhelmed on their systems because there's just Lots like kind of jumping in androaching on them trying to steal inventory.

It poses a lot of problems for businesses. I think there's some tickets systems that might have experienced some of those issues recently for concerts. We all know yes indeed.

Yeah, I'm curious so that every He is talking to some degree about Ai, and the role that that's playing and the generative AI technology is really kind of caused AI to go mainstream. Yes. We've been using ML and a And products and technology for years, but it's made it so anybody can get on to a web page and now use that or or it's making its way into products and systems.

What are your thoughts on the role of AI for security in general or security for for improve? I think we're still working through, you know, the benefits and how we can use it effectively within our products to make our products better. We also worry about the flip side, right the risks that can and will come about as a result of proliferic use of that technology.

So we're trying to come at it from from both sides. And I think you know, there's lots of scary stories going around about where this will end and all that type of good stuff, you know, but I do think it is going to transform honestly transform software transform Industries and really be revolutionary. So you've got two choices you can either get with it and start explore it and take benefits of it or you know, I think I think you could be left behind and so but there are clearly risks and so we're taking a very balanced approach of trying to identify how it can benefit but at the same time be very cognizant to the fact that it will be used to and is already being used to try and conduct security breaches.

And so paranoia is a key value and all the time and so we're continuing to watch out for it and keep an eye on Traffic and things that we're seeing as a result of, you know proliferation in that area. It's really good point. I mean customers aren't going to Value you just plugging in some chat GPT feature there really isn't beneficial to them.

Yeah, but they see benefit from it. They'll credit you for that value and your point about you know, bringing generate code using some of those tools probably generate bad code or you know threat bad threat actor code. Let me just throw my source code into the tool and generate a test script and where does that go?

Yeah. Okay software. Oh my goodness exactly.

You know it, you know, it's scary but there's great benefits as well right that we cannot ignore. So it's like everything else. We'll just have to find the right balance between risk and reward and benefit and threat One thing's obstruct by this year at RSA and I'd love to get your impressions of this but also RSA in general.

Application security is now a big topic here and kind of wondered. When is this gonna happen right coming from but from a software and right security perspective and it's whether it's apis security specifically or app second General. It's not just supply chain.

It is part of the secure you discussion now. And I'm really pleased about that. I mean, I'm sure you are too we've been doing it for a long time.

So I'm glad it's finally, you know, hit the radar for you. Yes, but yeah what any other thoughts on kind of what's RSA? What's happening this year that you're seeing going on a lot as a lot of conversations about data again, you know worry about data I think for for everybody it's you know, it's your crown jewels.

It's the one thing you do not want to end up in the front page of the Wall Street Journal for so a lot of conversations around data API Securities we talked about is a big one and but you know, I think for me, I think the energy that everyone has felt around RSA this week and the conversations that have been had and you know, everyone's forthcoming about the challenges today of being responsible for securing companies environment. I mean, it's a tough tough tough gig being a seesaw or part of a security team today given the You know the blast radius of an impact of what could happen and the number of threat vectors that are out there. And so it's it's really hard.

One of the things we're very much focused on is how can we for our area of the world right for applications and and for data security, how can we just make it easier for companies to sort of simplify and and and have a good line of sight to what they need to focus on for our space. So a lot of conversations have been around that because everything we talked about is around being down on people not having enough people. It is a very big and real thing.

So a lot of conversations around productivity and efficiency and and really going up the the value scale in terms of you know, those insights is really being a big part of the conversation, but it's been a great week. It's been rsa's back just it feels like RSA again. Yes last year was sort of let's kind of dip our toe and Standardly and so cold covid but yeah, it's been a really good week.

That's fantastic. Well parents been wonderful talking with you again always great to speak to you as well. It's always a pleasure and getting your insights and you know your knowledge as well as the insights from customers and Companies that you're talking with.

I hope you'll join us again soon, of course. All right. Thank you Pam Murphy CEO of imperva.

com and all the great things that they do and the security space especially around data protecting your data API Security application security and more. There's a lot there. So thank you for joining us.

We'll talk to you soon.