.conf23 and RIP Mitnick – Techstrong Research Review EP 28

Hi everybody. Mike Rothman here with another edition of the Textron Research Review. It is that time of the week where we are basically just revisiting what happened.

You know, talking a little bit about what we think is gonna happen, you know, discussing pretty much whatever's in our craw at any given time. I'm joined, as always by Mitch Ashley, principal at Textron Research. Mitch, how are you today?

Good to be here. I think of our time together as inside the minds of the analysts Or Creepy or interesting, or whatever that might be. Yeah, it's, you know, what, what's rattling around here?

And then actually that, that's a great segue cuz I, I do want to kind of get inside the, the mind a little bit. We did get some bad news in the security space this week, um, famous or possibly infamous, depending on where you come down on it. Hacker Kevin Mitnick passed away.

So, uh, he had, uh, pancreatic cancer, which is just a killer. Right. You know, literally a killer.

Uh, so he, I believe, passed away over the weekend and they announced it on, on Tuesday or or Wednesday. Uh, I didn't know Kevin well, I mean, I had a dinner with him one time and, you know, I've met him at conferences a handful of times. I, I can't say I really knew him well.

He seemed to be, uh, the, you know, kind of the engaging enough type of, uh, type of fellow could totally see where he was. Y you know, a world-class social engineer, just a little bit awkward, but then he could turn it on and you're just like, whoa. And then I saw him do a presentation one time and he kinda, uh, just became a different person and it was, uh, very interesting.

Mm-hmm. Um, but we do have to, you know, kind of at least recognize, you know, some of the impact that he's had. Right.

The first very high profile hacker, uh, ended up going to prison, um, for, uh, you know, kind of an extended period of time, uh, due to his, uh, you know, mishaps and, and, uh, you know, again, priming. Right. You know, there's no other way to put it.

Right. You know, he, he was definitely, uh, on the wrong side for a while. Uh, but you, you know, when you talk about second chances and you talk about rehabilitating yourself and really making a difference, you've seen, you know, again, a guy like Kevin Mitnick, uh, really, you know, kind of invested in the community.

He started a company called Nobe four. He was one of the founders there, became very, very successful. So he ended up, uh, passing away an extremely wealthy, uh, person.

Not that that matters cuz you can't really take it with you. But he did have a lot of impact on the next generation in terms of showing them and helping them understand the importance of security awareness, you know, the tactics of social engineering. Uh, and really had a, a, a long lasting impact, uh, on the industry.

Like Dan Kaminsky before him. Uh, just very high profile people who, uh, pass away, you know, again, way too early. Although, uh, Kevin was almost 60.

Uh, so you, you knows, like, he looked so young. I mean, it was like, really? He was that old.

I didn't, I didn't realize, uh, he was that old. Uh, but a sad day in the industry. And again, just, uh, another reminder that we do need to, um, again, pay attention to the people you care about.

Right. Do the stuff that you like to do, uh, and, you know, don't be an a*****e. Right?

I mean, I guess that's just kind of what it's at the end of the day when they're pulling all the ledgers together and you know, you go on to wherever it is you believe, you go on to, um, you know, just try to try to go being a good person. Right. And that's, uh, that's one of the things I think Kevin did, uh, kind of changed what he was doing and really did contribute to the, uh, community and the industry, uh, at the end.

Um, so rest in peace. And, uh, now we move on to the regular. So any comments?

I do wanna say, I do wanna say one thing about Kevin. I didn't know him and hadn't met him, but I'd heard him speak. Um, two things that are notable, well, three things.

One is he is a great example of the America's known is the land of second chances. We do like to give people a chance to redeem themselves. And he clearly did that.

The other is, my, my connections to him was one, I worked with a network engineer named Hank Latham, who was at an early I s P in the Denver area. And he was actually, you know, F B I shows up and we need this information. And he was one of the people, not the person, but helped track down exactly what was happening.

So it's kind of interesting hearing that later of what, what happened in the background. And, but the other thing was social engineering was I'd never heard of such a thing, right. And the idea of showing up at the front desk and, hi, I'm Bob and I forgot my whatever by badge, you know, getting in the door.

And Kevin really brought that to the surface, at least for me. I think it did for a lot of people. So while there was badness that happened, there are a lot of good things that came out of, um, what we learned from him and what he did.

So, you know, rest in peace to Kevin. You bet. Alright, now on to more pertinent topics.

Um, we were both on the road this week. I was actually sitting on my butt and Cape Cod, you know, kind of enjoying, I was really sick, but we were traveling around doing some stuff. So I took a little bit of r and r this week.

Mitchell did not. com, right? So tell me a little bit about, you know, your experiences there, some of the stuff you saw.

I know they made a big deal about AI and that's, you know, them and everybody else, uh, right. But, uh, yeah, just gimme some general impressions of, of what you saw there and, uh, what you thought was interesting. Yeah.

Well first it was the land of 111 degrees. That's My god, getting out the plane. That was, I'll be there in a couple of weeks for blackhead.

I'm really looking forward to cooking in the desert. I mean, literally It was 78 degrees at seven 30 in the morning yesterday getting on my plane. So anyway, that aside, um, you know, Splunk's one of those companies that, you know, I've known since they had a 10 by 12 booth in, you know, 2003 or four at R S A and just amazing what's happened with, I think the, the big impressions that I have was one, um, Gary Steele is the c e o and all of the new leadership that are at Splunk, they've really kind of tightened and accelerated focused what the company's doing.

And they're clearly on outcomes, customer value, and, uh, kind of, kind of getting, I don't know if I wanna say more professional cuz the, obviously the previous management was too, but the, you know, kind of tighten the reins and really get, get moving to the next level. And they seem on that track, um, you know, clearly, uh, you know, used to see Splunk and other things like that you go to as a very centric kind of crowd. And yes, there's obviously that there now as well, but it's, you know, in security of course too, you know, major part of, of their business.

What what I was struck by was, one, they've changed their go-to market. They're no, no longer kind of corporate sales, um, where you talked to this person about buying that, about buying that they've integrated and turned on SSO and doing some things like that to make their products more seamless and work together. And there's more work to do.

They made some, uh, strides there, but even their sales model is changing to, you know, here's the person and they get you all the stuff you need. They'll bring in the SES to help help you get up and going. Uh, AI was a big thing.

Uh, as, as you mentioned, um, one of the reasons was they have a new c cto o uh, min Wang who came in from Google, ibm, hp, Google, and, uh, duke University. And originally China, um, had a, had a fascinating conversation with her. She, we did an interview for about 22 minutes and that'll have up on Textron TV in a few days.

Um, and, and she's, you know, a researcher that's been her job, job after job after job. So she comes outta that world wanting to get into a, I want to get into the product side. And so very much about how do you create value, not just research, right?

Not, not to to understand what the importance of research is, but, you know, they did the generative a AI thing that's in preview, um, you know, as an interface into getting information there already had a, a pretty strong machine learning, uh, s d k interface into the back end. And so there's some hints about where they might be going and what they might be doing. And, you know, they obviously can share only so much, but that was, that was a, a standout I think as well.

Um, probably the third thing is just sort of a touchy feely thing, but there was a real vibrance of that, of that community. I mean, you sense a lot of positive energy and of course you got music and lights and all that kind of Yeah, I that rah rah stuff. Just talking with people and uh, and what they were doing and how much they like their work and yes, they like this product, they don't, there was, um, I talked with some people from Carnival Cruises and they were on main stage as a, as a profile customer and talking about their evolution and some of the, talking about edge case, Mike, uh, a ship on the ocean is a floating city.

There's your edge case, a big edge case. But anyway, a lot of fascinating things from it that I took away. Yeah.

That, that's so, so let's kind of pick apart at each one of these things, right? And, and obviously it's been about a year since, uh, you know, kind of the new regime has, has come in at Splunk. Mm-hmm.

Uh, rejuvenated focused. It's always interesting to me. Y you know, when somebody else comes in and they've got, and I don't even wanna say different ideas, but they're able to, you know, kind of act as a change agent where maybe a little bit of the old regime, which had been there, you know, six, seven years, eight years at that point, uh, kind of just get into the, you know, kind of operations in the day-to-day.

And they really don't, you know, kind of move the needle to that degree. So sometimes you do need to shake it up, uh, a little bit. Uh, interesting again, in terms of the people that they bring in.

Gary Steel's background is obviously security. He was the c e O of Proofpoint for, for many years, probably 15, 17 years, uh, on that front. Again, grew him up, took him public, you know, kinda ultimately through the, the private equity deal, uh, that they did.

Um, so always interesting to, you know, see what I, new ideas folks come in with. Um, you know, but the reality is I think, you know, let's hit on the community side of things, right? You know, they've always had, Splunk has always had a captive audience from that standpoint.

You know, folks that kind of get hooked on it, you, you know, in terms of the freemium version, you know, typically an IT ops, uh, type of of use case, then it, you know, spreads through the rest of, of the IT organization including security, uh, on that front. Very difficult to move out of it, right? Very sticky because you're building a lot of operational processes, uh, around it.

Uh, obviously, you know, kind of the pricing issues have been well documented over the past, you know, couple of years and, and their workload pricing has moved to address some of those things. And again, you talk to folks, you know, with some success, but in a lot of cases, uh, you know, there's still significant dissatisfaction in terms of the amount of money, uh, folks are, are spending on Splunk, which gives it opening to some of these newfangled backends that, uh, are, you know, basically log management products that have, uh, you kind of next generation backends that, that come at it, you know, saving a third or to a half of what you would typically spend, uh mm-hmm. With Splunk.

Um, so, you know, again, I mean I think it's a journey, right? It's a process and, and how do you both reengage your community? How do you address some of the business operational and pricing things and how do you start to position for innovation?

And that's where I think they're like almost everybody else, you know, really kind of leaning in on the AI piece of it. So I know you, you'd spent, you know, some time with their new c o describe a little bit about, you know, kind of the use cases or at least the initial use cases that, that they, that they talk about, uh, with, you know, gen AI and, and how does that compare to, you know, what Microsoft is trying to do with security copilot and mm-hmm. You know, pretty much everybody is, you know, packing some, you know, type of, of generative AI onto, you know, kind of their monitoring platform.

So how, how do you see Splunk's at least, uh, announcements of that capability, you know, stacking up? Uh, I think one of the difference with their generative AI in addition to just being a natural language interface to the database is Splunk is all built on spl, Splunk programming language too. I guess our in version too now.

Um, but it is, and it's not sql, but it is no small task to get good at spl L and that's one of the learning curves. Uh, that takes a while. You build up a lot of chops in over time as you build AppSec.

That was an early sticky point, right? Build AppSec and on top of the data, now you're doing more to kind of keep you in the ecosystem. So seeing, um, generative ai, uh, because it actually shows you the SPL that it creates, so you can kinda learn it as you go.

You don't have to get out the book or, you know, get on the online docs and look that up. So I think making it easier for people to come on board and train people faster. Um, there was a gentleman there from GE Digital who was talking about how he had really brought together security and software development, and I got a chance to talk with him afterwards and he's had some success there.

And one of the things he said was, they have a standard set of training that they send people through of here's the platforms we use, you know, this cloud provider, this log, this, uh, uh, unified kinda log management up to observability, et cetera. So that was pretty fascinating too. I think another area of, of AI that, that we might, you know, they're not saying much yet, cuz I mean, she was 91 days in the job, she's still figuring out what's going on at the company and what probably, probably what projects to keep and not is they, their task is to figure out not just how to do things better, but to make it more efficient.

So if they can cut down cycle time, mean time, uh, for repair, all of those kind of metrics are things that Splunk's already very focused on. I think that will be an initial, some wave of where we may see some AI improvements. Now, where it goes beyond that, you know, good guesses, I can make some guesses, but I think that'll be the near term focus of what we'll see from them.

Now as you add more AI into other parts of our businesses and customers businesses and using their tools and their data and access to that data and the ease and the ability to do that, I think that's going to become either a positive or an issue depending on the barriers to get to that data. Cuz people are gonna want that. Um, and they call it domain specific, right?

I wanna build models on my data, that kind of thing. And there was mention of that, but don't really, I don't know how easy that is yet. I don't know about build, you know, there's build the model and then there's run the model against a certain, you know, kind of base.

Mm-hmm. Right? Mm-hmm.

So I, I, I, you know, I suspect they're gonna be building more generic models that then they'll be able to apply specifically to a customer's, you know, kind of backend, uh, data, uh, on that front. Y you know, the, the, so it's interesting that, you know, kind of they're looking at, at pumping out, you know, s P two, uh, on that because y you know, that's really a precursor to what you would wanna see, which is, you know, kind of code based remediation based upon what you're seeing there. So having, you know, kind of GPT, like I know Orca and I then I know a bunch of companies are doing that.

I just mentioned Orca because I saw it, right? Mm-hmm. 5, they've updated to g PT four, uh, within the last quarter.

So, you know, I think that will help on, on the accuracy, uh, and stuff. And, and again, I mean, I think that it has been, um, astounding in terms of the amount of progress we've made. Just and remember Chichi PT wasn't a thing until December, right?

November, December, December, um, on that. And, and we're in the middle of July and, and we've seen three or four iterations, uh, of folks using, you know, kind of generative and different ways, uh, within their products. So, so that's obviously very exciting in every company is, you know, leaning into it in some, you know, way, shape, uh, or form, uh, on, on that front.

Now, the, the other thing I want to get into is, y you know, you didn't mention the O word, right? You know, and that's observability and that's something that, you know, Splunk has been trying to gain a foothold in depending on who you talk to. Maybe they're starting to make some, you know, kind of inroads, but you know, again, you ask three people, you get 10 opinions, uh, on that.

So where, where did they come down on, on observability as part of their, you know, big strategy given that Gary steals the security guy tend to surround himself. Mm-hmm. You know, with security type folks, are they minimizing that?

Are they leaning into that? Are they investing in it? com?

So it's a bit of a two-sided coin because, uh, you know, they acquired Omni Mission, but three years ago, who was a de uh, ra, uh, distributed tracing, uh, some of those folks are very heavy and, and involved in OpenTelemetry and they still are one of the leaders, one of the top tier folks, and they're on the governance committee for OpenTelemetry. So their kind of, their observability story is really about tel and, and how they're using that and how that's making it easier. Uh, I, I sense that they're in this transition of getting to, you know, they don't store everything in, in that format.

They're providing interfaces through, uh, the hotel specs and APIs. Um, but it was interesting cuz I, one of the things I asked during his session was about open source, which your strategy and what's changed about it, thinking about OpenTelemetry, and they mentioned that as being important, but also, you know, they've done a lot of proprietary things. They started before there was hotel and all those things, right?

So they've got, they're one of those companies that have been around for 15, 20 years, but now they're operating in a world of, it's very open source, um, very, um, very much centric around providing back to the community, which is a very, uh, very different vibe than what I got from when I was at SUSE than the SUSE Con and, and Munich, which it's all about, you know, we're all about open source everything and being transparent and all that. So, you know, it's, they're, they're a huge player in observability and I think they, they do have solutions that satisfy a lot of that, how far it goes and how you might stack them up against other observability players. I think that would be an interesting, really kind of to dissect that and understand who's really got the, the chops there and how far can you take it, You bet it, and to continue to track the overlap between security and observability cuz you know mm-hmm.

A dog has, you know, kind of made it a point to both do some small deals, right? In technology deals on the mm-hmm. Security side, uh, as well as, you know, continue to talk about their security platform and leveraging the same data.

Splunk's trying to go at it from, from the opposite, uh, direction. Um, elastics obviously trying to play in, in both sides, uh, as well. Um, so in again, um, just I, I think how organizations leverage a lot of the telemetry that they are pulling out of these increasingly cloud-based, right?

Increasingly, um, uh, containerized application stacks right, is going to be interesting over time because again, when you think about it, it really is the same data for the most part, uh, especially as you move towards infrastructures code and you start to, uh, again program, uh, everything. Uh, so clearly, you know, the collision will continue. It'll be interesting to see how the, uh, leaders shake out.

But, um, for sure Splunk is, is gonna be a player in there just due to, you know, both their, uh, existing a r r momentum, uh, as well as, you know, kind of the customer base, uh, and the community. So for folks that are Splunk customers, what's kind of the main takeaway that you got out of, uh, the show, Mitch? You know, I think it's, you know, more, more on the path that they're on.

They're, uh, the Splunk cloud offering is seemed to me that that's where more the innovation was being applied first and then going back kind of into, though they didn't say that that explicitly, and I didn't, I didn't get that answer. That was my vibe. They also announced they are moving Splunk into Azure native, making it native.

And I probe several times. I'm like, okay, I get it. There's a massive number of customers there.

Yeah, you want access to that. You want to be, you know, you want to improve your offerings to them. What, what's, why, tell me more about why the low hanging fruit was, well now you can use your Azure credits to buy Splunk stuff and that's available now.

Great. Okay. That's getting access to customers.

One of the, one of the sort of under vibes that I talked, just talking with different people is there's also the egress costs of having massive amounts of data in somebody else's cloud. And so they didn't say it. That's obviously a big savings for customers.

Like, like if I'm an Azure person and I'm paying to ship data over to somebody else, cuz that's only where you operate, that's a, that's a negative. And hopefully as they bring more native solution, Splunk solution into the Azure cloud, now it's all, you know, in the same cloud et cetera, doesn't address multi-cloud, you still have those issues too. But if you're heavily Azure, I think that's one of the main motivations You, you do.

And, and again, that's another tactic that the cloud providers use to kind of keep you there, right? Mm-hmm. If it's punitive to, you know, either keep replicated data in a variety of different cloud platforms or, you know, to move something under dures or, or as a migration or re-platforming or what have you, um, it's a consideration, right?

I mean mm-hmm. You know, have to, it's A cost. So I, I did think, you know, kind of moving to Azure was, um, you know, an, an an interesting thing that typically gets down to economics.

So, uh, part of it, you know, I suspect is yes, our customers have a lot of data there, but in reality I think a lot of that has to do with Microsoft going to 'em and saying, we'll cut you a sweetheart deal relative to what you're paying AW s yeah. You know, for significant, We want you here. And again, when you think about some of these monitoring platforms and, you know, kind of where their cost of, of delivering the services, uh, you know, cloud storage is, is probably, you know, cost number one, right?

You know, cost item number one. Uh, so, you know, their ability to, you know, kind of drive those costs down, uh, I think is interesting. It'd be interesting to see if they do a similar type of deal with Google, uh, at some point cuz Google has been known to buy business here or there, um, on that.

But again, good to, good to hear that, uh, again, things are moving. They've got, uh, some rejuvenation there, they're thinking innovatively, uh, and uh, ultimately, um, it's about really maintaining that community, right? Because once you get on the downside of that, uh, it's not pretty.

And we've seen that, uh, a number of times as well. Oh, sorry. Um, you know, just a lot, uh, the old platforms where you're just like, oh, they still around?

Mm-hmm. At one point it was, you know, kind of the, uh, uh, it, it was the, the, the first, you know, sitting in pole position, right? And now, you know, those platforms are all but dead.

So you constantly have to be focusing and, and innovating and making sure that your community remains, uh, engaged on that front. Mm-hmm. So, good pitch.

Any other parting thoughts before we, uh, let everybody get on with their day? You know, I, I think, I think that nails it. I don't, I don't know if I want to kind of go down that path much more.

I think it, it was, it was great and a lot of great, what I've noticed too is that the, the conferences, the vendors they're doing, they're really doing a good job of, um, engaging with analysts and press and making sure their story gets out in sort of traditional and non-traditional ways. So, you know, I think it's good that, you know, we have access to that and I appreciate all the vendors that have helped us do that, you and I and others. You bet.

You bet. All right. So with that, we will wrap up another addition of the Textron Research Review.

We'll be back next week probably with our next edition about pretty much whatever's in our crop. So everybody have a great week. Be well, and uh, we will see you soon.

Take care, everybody.