Max Clark: [00:00] My spiel is if you have anything that makes noise, turn it off. Um,
Sirena Ong: My cell phone.
Max Clark: Teams People will close it and not realize it’s running in the background, and then it’ll make noise, um, and
Sirena Ong: Got it.
Max Clark: Um,
Sirena Ong: email
Max Clark: so
Sirena Ong: and my calendar.
Max Clark: it a habit of exiting everything out completely. Um, so that’s the first part of my spiel.
Sirena Ong: Okay.
Max Clark: let’s
Sirena Ong: So
Max Clark: off.
Sirena Ong: is the video portion going anywhere, or it’s mainly the audio.
Max Clark: Oh,
Sirena Ong: It’s,
Max Clark: it’s the
Sirena Ong: it’s all
Max Clark: It’s the video is what we do.
Sirena Ong: okay.
Max Clark: goes, look at the audio, like audio only podcast, but, um,
Sirena Ong: it.
Max Clark: video is the game.
Sirena Ong: All right.
Max Clark: Um, lemme see here. So all that off. All of that is off. Okay. Um, platform, um, records locally on your [01:00] computer and then uploads in the background. So if
Sirena Ong: Got it.
Max Clark: like the, the video gets weird or looks fuzzy, don’t worry about it. It’s getting like your, your computer’s recording your side, you’re gonna see a little thing at the top of the window that’s gonna have like a percentage with a little, like a blue box. Mine’s like right here.
It’s probably like right over here for you somewhere. so if you can’t see me, don’t worry about it. If you look pixelated, don’t worry about it. Anything happens with the video, don’t worry about it. Audio, don’t worry about it. The
Sirena Ong: Got it.
Max Clark: happening on your computer. What that means is, is when we’re done, I’m gonna stop recording and I need you to hang out until your box has a hundred percent uploaded.
’cause it’s gonna, it’s gonna
Sirena Ong: Got it.
Max Clark: and that’s, that’s really your only requirement. Your requirement is to talk a lot and, and wait for that thing to say a hundred percent. That is, that is your job For the next, next little bit. Um, if at any time you feel like you’re talking too much talk.
Sirena Ong: Oh,
Max Clark: Okay.
Sirena Ong: I have never been encouraged. I’m always like, Serena, you’re talking too [02:00] much.
Max Clark: if at any time you think you are talking too much, talk more, um,
Sirena Ong: I get myself into trouble here.
Max Clark: Nope, nope, nope. If at any time if I do a good job, it’s not gonna feel like you’re talking too much.
Sirena Ong: Okay.
Max Clark: learning how to do this. So doing a good job is, you know, we’ll, we’ll, we’ll, we’ll see how that works out. But if at any time, like seriously, the, the point of this thing is not for me to talk, the point of this thing is for you to talk.
Sirena Ong: Yeah.
Max Clark: And, so, so don’t, I, don’t, you know, like, I’m, I’m, if, if I’m quiet for a while, it’s not because I’ve tuned you out or not, don’t care. It’s just because I’m letting you go. Um,
Sirena Ong: Got it.
Max Clark: and so don’t, uh, don’t worry about that one for a second. I wanna make you big here. How do I change my, they they keep, you know, the nice thing about when they update, um, these platforms is they.
Sirena Ong: Don’t communicate the changes.
Max Clark: then things change
Sirena Ong: Mm-hmm.
Max Clark: um, well that’s not what I wanted. [03:00] That’s not what I wanted to do. Um,
Sirena Ong: I need to get rid of them. Hold on. I’ll be right back
Max Clark: see, there you go.
Sirena Ong: outside.
Go, go, go, go, go, go. Here you go. Here you go. Treats. Let’s go one side here.
All righty.
Max Clark: Um,
Sirena Ong: is like super fizzy today.[04:00]
Max Clark: so I read a thing years ago that’s like, um, it’s good to do like pushups or jumping jacks or burpees or something. So you’re, uh, you’re welcome to, you do it to get, you know, get the endorphins going. Can you hear me? Can.
Sirena Ong: Okay.
Max Clark: I think you had, did you have headphones
Sirena Ong: wait, sorry.
Max Clark: Yep.
Sirena Ong: I’d help if I put in my headset.
Max Clark: Yep.
Sirena Ong: Okay, now we’re good.
Max Clark: Do I have water? I have a little bit of water. I’ll be okay. Do you have any, um, when we’re done, I’m gonna send [05:00] you an email. I’m gonna have cc my assistant on it. She’s gonna ask you at some point for a, but, you know, headshots and like other stuff.
Sirena Ong: Yep.
Max Clark: people then always ask like, when’s it getting published? I have no idea. We just have a queue that we work through,
Sirena Ong: Okay.
Max Clark: depending on what’s in the queue.
And we try to publish once a week just so that way it’s like a consistent, consistent thing that’s going out.
Sirena Ong: Yep.
Max Clark: Um, trying to think what else I can tell you. Um, if you, um.
Sirena Ong: If I really mess up.
Max Clark: Just let me know. We’ll mark it, you know,
Sirena Ong: Yeah.
Max Clark: it’s, it’s not, uh, I tell, I tell everybody, this isn’t like ambush journalism, you know? I’m not trying to like, get a gotcha moment, you know, like there’s
Sirena Ong: Yeah.
Max Clark: no value in that for me.
Sirena Ong: Okay.
Max Clark: So we’re not, this isn’t, this isn’t, uh, this isn’t TMZ. Um, um, anything else I can, I can
Sirena Ong: No.
Max Clark: or tell you or answer or anything?
Sirena Ong: Um, no. Was it Okay, the, the two stories I sent over to you?
Max Clark: it’s perfect. We’re gonna
Sirena Ong: [06:00] Okay.
Max Clark: Uh, if you’ve, if you’ve watched any of the other ones, I’m, I think I’m gonna do this a little bit different,
Sirena Ong: Okay.
Max Clark: um, you know, I’m still, I’m, I’m still,
Sirena Ong: This will be my first one, so
Max Clark: you know, um, it’s, it’s no big deal. You know, we’re just, we’re just, we’re just gonna chat.
Sirena Ong: Okay. All right.
Max Clark: So, uh, I’m, I’m just like mentally transitioning my brain here.
Sirena Ong: Yeah. All good.
Max Clark: a couch. It’s gonna be delivered. It was supposed to be delivered like 30 minutes ago.
Sirena Ong: Oh,
Max Clark: be delivered like at some point right in the middle of this.
Sirena Ong: okay.
Max Clark: you know, my whole comment about like, noise is gonna start firing off. There’s be doorbells and my dog, our dog is so old, she’s deaf, so she won’t hear the doorbell.
Sirena Ong: Okay.
Max Clark: over here in her dog bed. So, um, you know, maybe, we’ll, maybe we’ll get away with that one.
Sirena Ong: Okay. Usually the noise, noise cancellations are pretty good now, I think
Max Clark: yeah,
Sirena Ong: for the most part.
Max Clark: this mic is really focused
Sirena Ong: Yeah.
Max Clark: it doesn’t get a lot of [07:00] background noise, which is nice.
Sirena Ong: It makes you sound amazing.
Max Clark: No, well, thank you. It was, uh, this was one of those can of worms where you don’t really realize like how deep of a hole you’re, you’re digging. And you change one thing and then you change another. And then like, you know, you’re like, oh, I should get a new microphone. And then you get the microphone and then you’re like, well, then you need a audio interface.
And then you need, um, you know, uh, uh, it’s called phantom power. You need a, um, phantom power, inline power amp. And then you need this, you need that. And you’re
Sirena Ong: Oh, wow.
Max Clark: I should just kept with my headphone. You know, like it would’ve been better.
Sirena Ong: It’s now you, now you have a whole podcast studio in your house
Max Clark: Yeah. It’s,
Sirena Ong: with the setup.
Max Clark: Um, okay, so Serena SI said, okay, by the way, I’ll also just, I, I’m gonna make the observation so you can kind of pay attention to it. ’cause it’s gonna be really funny to you. I didn’t, I did Toastmasters when I was in second or third grade.
Sirena Ong: Oh my gosh.
Max Clark: in Toastmasters, and you know, I remember from second or third grade is [08:00] ums and ands and butts and like these
Sirena Ong: Yes.
Max Clark: So I don’t say, um, ands or buts, you know, like these things I say. So, and I didn’t realize it until, and it was really pissed me off ’cause I was like 20 episodes deep. And I had this, I had this editor and she said to me, I was like asking like, can you gimme feedback? You know, what’s working? What’s not working?
What should I do differently? And she’s like, oh, you say so a lot. And I’m like, what do you mean you say, I say so a lot. She’s like, well, like every sentence starts with, so tell me about this. was like, you could have told me that like tw you know, like 15 hours ago of recording, you know? Anyways, so now that I’ve said that you’ve got my little vocal tick, you’re gonna,
Sirena Ong: Well,
Max Clark: you’re gonna see it.
Sirena Ong: well, my visual tick is my eyes tend to like. Not, it’s like I’m trying to put my words together and my thoughts, so then my eyes start like shooting over.
Max Clark: That’s normal. You, you know, there’s, there’s a whole thing in terms of like trust and like things of like, um, like where you’re looking based on what you’re accessing in your brain.
Sirena Ong: Yeah.
Max Clark: I don’t, I don’t know, I don’t know. I don’t know. I don’t remember all the things about it,
Sirena Ong: Yeah.
Max Clark: it’s, it’s, uh, you [09:00] know,
Sirena Ong: But it’s really annoying to watch myself. That’s why I hate watching my recordings because, um, you know, it’s, it’s annoying to me to see that I can’t keep my eyes on this camera the entire time. Or on your face My entire time.
Max Clark: can, you can pin me, uh, larger I think in your screen
Sirena Ong: Hmm.
Max Clark: that might, that might help you as well. I do the same thing. I, I put myself, if you highlight, if you hover, I think if you hover directly over the middle of the screen, like
Sirena Ong: Yeah.
Max Clark: and you get a mute, you get a pin and you can pin it and make it a little bit larger.
Sirena Ong: Oh, I see. Actual recording.
Max Clark: I can still see myself, but I’m kind of off to the side a little bit.
Sirena Ong: Yeah. Don’t see the pin, but
Max Clark: Okay. It’s all
Sirena Ong: we’ll keep going.
Max Clark: Uh, Serena, one of the things I hate about tech and tech marketing is the acronym soup that happens
Sirena Ong: Yeah.
Max Clark: and it, you know, I’ve been doing this for so long that it, it feels like some of it actually is created to define categories. [10:00] Some of it just gets created to like. out space and categories, like, oh, you know, everybody’s branding around this acronym, but we do this other acronym, and so therefore, you know, we’re better.
And, and, and it’s, it’s just this like unfortunate byproduct of the industry. It will never change. I can just complain about it. So when, um, make sure I’m doing the acronym right. DSPM, data Security, posture Management came out and this concept really started and you’re like, oh, okay. You have, you know, CSPM and CAP and DSPM and
Sirena Ong: Yes.
Max Clark: and ca you know, like, and it was like, know, you, you know, so like my initial reaction is like, oh, great, we’ve got another acronym in tech in security that now we have to deal with and explain and understand and like, what does this actually mean? And I’d love for you to just assume I know nothing, right? Let, like,
Sirena Ong: Okay.
Max Clark: like there’s a great line in a movie I love of like, talk to me like a golden retriever or like a puppy, right? So let’s start from the beginning with this.
Sirena Ong: Got [11:00] it. Okay. I’ll do my best,
Max Clark: Yeah,
Sirena Ong: I think.
Alright. Oh, you’re frozen. Is that me?
Max Clark: it.
Sirena Ong: Oh.
Max Clark: That was a question for you, your turn to talk.
Sirena Ong: Oh, well. We’re gonna cut that, that we’re gonna cut that little block of silence out. Oh my gosh. Okay. Well, I think, um, DSPM was first coined, I mean, in the early 2020s. I think it was probably after the advent of the cloud. Um, you know, I mean, well, well past the cloud, but I think, you know, what we’re start, what we started to see was a lot of the traditional tools, um, OnPrem, um, you know, hybrid environments, whatnot, there were a lot of gaps relative to the visibility around the data.[12:00] I think early DSPN was really focused on discovering where sensitive data lived and identifying potentially where the exposure existed. So really it prioritized like cloud platforms like AWS Azure. So as more and more enterprises were moving more and more of their critical and sensitive data out to the cloud providers or the the big clouds, they started realizing that there was a, a significant visibility gap, um, in terms of where’s my data?
What is the data that’s actually living out there in the cloud, and are we confident that it’s a hundred percent secured? I think there was heavy reliance in the very beginning on the, the big cloud providers to provide security. But as we have seen even as of late, you know, there’s still an obligation on the customer side to make sure that their data’s truly secure.
And as data started proliferating across SaaS, you know, you start thinking about where’s my data moving? [13:00] It’s moving into the cloud. I have it in my, in my data center. I have it in my on-prem file servers. I have it at the end points with my users on their laptops and now on their phones. And so the coverage footprint for data security, posture management really started expanding.
And it started, you know, now you’re moving towards where it was manual discovery. Hey, I think I know what my PII data is. I think I know what documents have that type of data that is highly sensitive. Um, you have data that’s moving and proliferating everywhere. And then you’re also seeing a movement towards more and more regulations relative to privacy, um, different security frameworks that companies were adopting the, um, CMMC for any defense or government contractors.
So a lot of regulations and requirements that we’re forcing companies to, on the one hand, worry about are we protecting our data and securing that information, but also are we [14:00] compliant?
Max Clark: There’s, there’s, um, there’s two things that you, there’s a, there’s a bunch of things that you just said with that, and I wanna circle back to two of ’em
Sirena Ong: Mm-hmm.
Max Clark: The first one you talk about is people have more reliant on reliance in the cloud and this assumption that the cloud is providing security for them, and
Sirena Ong: Mm-hmm.
Max Clark: Um, this isn’t the case, right? Like,
Sirena Ong: Mm-hmm.
Max Clark: you know, I wanna dig into that a little bit and I, and I, I wanna, and I think I wanna talk about this specifically. Let’s, let’s narrow this a little bit because, um, I find these conversations usually starting with an organization when they have this, they have some event or they have some, something happens, right?
Which then triggers a set of questions around. You know, and, and it starts off pretty benign. It’s like, um, you know, um, we’re using Google, we’re using Google Drive or Box or Teams, or not teams, um, uh, Dropbox or, or SharePoint, [15:00] OneDrive. Like we have, we have our productivity tool with file sharing. Like, you know, you get this, you get a question of like, well, how are you know who has access?
Are we sharing it? Are
Sirena Ong: Mm-hmm.
Max Clark: sharing? Have we, have we sent stuff out? Have we sent attachments? And then the other side of it, I, you know, really you, you touched on was this public cloud side of things of, well, is my data secure because it’s in the public cloud? But time, like you can configure a resource to have internet access to it
Sirena Ong: Right.
Max Clark: really easily.
And it’s, and that was the default for many years. So how, how did these, um. You know, this concept of like, this idea of like platform and platform security and data security within these platforms, what is that like awakening and a journey that a co, you know, an enterprise goes through of like, oh, we’ve got one driver, we’ve got Google Drive, or we’ve got AWS or we’ve got Azure, like, you know, of, of, you know, I’m, so my question in two parts is like, what is the trigger and what happens where they kind of wake up to [16:00] this, then what do they have to do about it?
Mm-hmm.
Sirena Ong: I think what we’ve seen is sort of a shift, um, in security, you know, in terms of, you know, back in the day most of security was focused more, more so on the infrastructure, on perimeter security, securing the network. The systems, the, you know, database security and whatnot. And then there were applications that were started to run on these infrastructures.
And then the focus started moving towards application security and, um, and making sure that, you know, our applications are properly configured, you know, identifying where the potential vulnerabilities are, and these are still in place. I mean, don’t get me wrong, these are all critical layers of security that every, um, CISO and, um, security team is, is investing in and thinking about.
And then you start moving into the applications and then you realize, wow, there’s a lot of customer data. There’s a lot of [17:00] P-I-I-P-H-I medical record information, depending on your industry. Um, and this data, like, um. We’re assuming that by protecting the applications and configuring their deployments appropriately, that they’re secure.
But we’re seeing repeatedly, like incidents of breaches. I think one statistic I saw was, um, on average most organizations are experiencing at least four to five incidents of data leakage or data compromise throughout the year. Um, you know, you have tons of investments that are made, but when you think about all the initiatives that companies are investing in, data loss protection, um, you know, the sims, the incident response and, and, uh, orchestration to respond to breaches or in, in, in case of events, um, most of the time when there is a, a breach or compromise, it’s typically, I think the statistics show that a majority of them are due to human error.
Max Clark: Well,
Sirena Ong: Like,
Max Clark: error. Yeah.
Sirena Ong: yeah. [18:00] And what are the, what are the threat actors going after? What are the bad people going after? They’re going after the data? The data is ultimately the crown jewels. And so there’s always been a gap, um, in a lot of these investments, not despite all these investments in the perimeter, the applications and whatnot, um, there’s been a lack of visibility at the data level to really understand what is it that I’m actually trying to protect.
It’s kind of like that old, um, you know, metaphor around breaking into your house and someone, you know, if they break through your windows doors, that’s one thing. But if they actually know where your crown jewels are, where that safe is in the closet and where it’s hidden, that’s gonna be a problem. And so what do you do about your crown jewels?
You’re always putting it behind, you know, extra layers of security and whatnot. But if someone knows where it is or what it is that they’re going after, um, you know, ultimately they’ll find ways through phishing attacks or different ways in which to navigate through your network to get to that data. [19:00] And.
What Data Security Posture Management does through the discovery and classification, it, it performs, it actually puts a spotlight and helps you identify where all the PII data is, where is my intellectual property related data, product design, specs, component information, you know, the variety of information that is critical from a competitive advantage perspective and also from a security perspective for, you know, relative to defense contractors or to, um, companies that work with national or global, um, entities.
Max Clark: So how is, how is DSPM different from DLP? So somebody that’s like,
Sirena Ong: Hmm.
Max Clark: and protect my data. You know, the, the, the, the initial response is DLP policies.
Sirena Ong: Yep. Mm-hmm.
Max Clark: different?
Sirena Ong: DSPM is mostly focused on data at REST versus DLPs focused on data in motion.
Max Clark: Okay.
Sirena Ong: So the DLPs are typically looking at the activity around. The content, you know, what are [20:00] people doing? How is it moving? What are, what are the transactions occurring? And they’re looking for something anomalous or something that potentially looks suspicious.
Um, the challenge, and I’m not, I mean, they’re highly effective and there are, there is some overlap in terms of some of the discovery and classification that they’re starting to perform, but, um, or trying to bring into their platforms. But, you know, there’s a different, you know, the, it’s, it’s really, um, you know, I look at it like being, uh, preventive healthcare for your data.
You know, I’m going to, um, with A DLP, I’m going to react to, suddenly I found out that I have stage four cancer and I’m going to, you know, um, I, now I have to take care of all the symptoms. I, I now have this disease. I have to figure out what is it that I need to do to, you know, survive and, and surpass, um, the condition.
From A-D-S-P-N perspective, I almost look at it like more preventive care. [21:00] Like how similar to how we take blood tests, go see our doctor, take EKG CT scans if something happens. Very similar. We’re doing that with data, our critical and sensitive data. We’re identifying where the potential hotspots and risks that may exist.
What can we do to mitigate against those re uh, risks? What can we do to remediate the issues that potentially open up, um, security vulnerabilities? Um, it’s really being able to almost like taking an x-ray of my data environment and help me understand where I need to pinpoint challenges.
Max Clark: or verticalized is this in term or, and how much, um, how much functionality overlap exists? I mean, so, so like in the case of DLPA basic DLP system, you’re gonna enable a rule that’s gonna say like, um, match on something that looks like a social security number. So if somebody’s
Sirena Ong: Yeah.
Max Clark: a spreadsheet, you know, and, and there’s data in that that has social security numbers as a format, you know, it would, you can flag and then [22:00] take
Sirena Ong: Sure.
Max Clark: So within DSPM and the example, so in, in your example, right, like that’s that’s being accessed then passes through whatever system the DLP has access to, and so
Sirena Ong: Mm-hmm.
Max Clark: something going on here, right? And you can do DLP in lots of different places. You can do dl, you know, there’s different touch points that, that have DLP access or, uh, DLP functionality can be introduced. But the difference that you’re explaining is DSPM is knowing where that underlying data is in the first place.
Sirena Ong: Mm-hmm. Mm-hmm. Well, um, so Kui, we have, um, we have, uh. We’re, we’re sort of a newer platform in this, um, space of DSPM. It’s a pretty crowded space. It’s been around for years. [23:00] Um, and you know, what we have adapted to is just the, the velocity, variety and volume of data continues to grow and expand.
And especially with the advent of ai, you can’t keep up with all those changes if you don’t have, um, you know, if you don’t have the benefit of contextual discovery. And we’re using the benefit of deep learning models, um, to accelerate the discovery and classification of sensitive information. Um, so for it, depending on our customers, it could vary.
Like if you’re dealing with those in life sciences, it’s gonna be around PHI medical records. And whatnot. If you’re dealing with retailers, it’s gonna be around customer data, data. Uh, if you deal with, uh, anybody working with the government or defense, it’s gonna be around kui data, iar, EAR data. So the variety is gonna be there, and, but the complexity is what is unique to every environment, and you need a platform that’s gonna be adaptable to the [24:00] changes in the data sets, um, but also the changes in regulations.
And, um, the, you know, ultimately every company is trying to move toward having, um, or needs to have a single view of what their data is. What’s the actual sensitivity of that information? Um, who’s got access, where is it moving, being copied, shared, and emailed out or exchanged externally.
Max Clark: Well that’s, that’s the question I’m curious about,
Sirena Ong: Mm-hmm.
Max Clark: The example I’m curious about. Right. So, um, I’ll give you a hypothetical, right. Um. Let’s make it reasonably sized. A thousand, a thousand user company,
Sirena Ong: Yep.
Max Clark: So not manufacturing, we’re, you know, a thousand people at computers.
Sirena Ong: Yeah.
Max Clark: And, uh, you know, we’ll duplicate the platform agnostic.
But let’s just say, you know, in that you’re gonna have file sharing.
Sirena Ong: Yep,
Max Clark: got, you know, company shared folders, you have individual, you know, drives for everybody. You’ve got laptops, you’ve got email, you’ve got chat, [25:00] and then we’re gonna have some applications. There’s gonna be a CRM, there’s gonna be some sort of, um, you know, uh, accounting ERP system.
Then there’s gonna be a business application that’s running, right?
Sirena Ong: yep.
Max Clark: this relatively contained. So now if I’m, you know, um, in a role, right? You know, I’m a CISO or CIO or you know, in a GRC function, you know, GC at these, this company, and I say, okay, great, there’s a lot of data here.
Sirena Ong: Yep.
Max Clark: I’ve got a thousand individual file shares.
I’ve got, you know, 30, 40, 50, 60, you know, team shares. I’ve got, you know, all this data. So I know there’s a bunch of stuff out there, but
Sirena Ong: Yeah.
Max Clark: lacking with a lot of platforms is like, oh, we’re gonna give you this tool so you can go out and do the work, and then you can correlate it in our tool and then track it in our tool.
But like, you’re like,
Sirena Ong: Mm.
Max Clark: great, now I need to like, have a bunch of people go through and like read through
Sirena Ong: Yep.
Max Clark: email. Like, that’s not great. Um, or their chat.
Sirena Ong: And impossible. And impossible.
Max Clark: so how do, so how do you connect those two dots of saying
Sirena Ong: Mm-hmm.
Max Clark: you know, first, [26:00] like I, I, I would say, I, I, the first thing is like, what do we actually even start with in that environment?
Sirena Ong: Yep.
Max Clark: And then how are you, like, what is the process and how are you working through that classification of figuring out what
Sirena Ong: Yeah.
Max Clark: is?
Sirena Ong: Yeah, I mean, it is a challenge and many companies I think, have realized you can’t do this manually. And the challenge with, um, some of the traditional vendors in the space is that you have to kind of know what it is that you’re looking for. You know, there are every system, every DSPM has out the box classifiers, you know, we know that, we know what a phone number is, we know what, um, a social security number looks like.
But then you start adding complexity when you start going global because social securities numbers are obviously not the same identifiers as other countries.
Max Clark: Phone numbers are
Sirena Ong: Mm-hmm.
Max Clark: International. Yep.
Sirena Ong: Yep. And then you start, um, you know, for a thousand person company, you have data that might be, is constantly being, um, I think unstructured content, like I think [27:00] unstructured com uh, content, they’re expecting it to grow three times the amount of structured data,
Max Clark: Mm-hmm.
Sirena Ong: out there.
And that adds additional complexity because you need to know content.
Max Clark: Alright.
Sirena Ong: a nine digit number for like we talked about, it could be a social security number, but in the context of a product company, that same nine digit number could be a product ID number, it could be an account number. And how do you know that unless you understand the context around that data.
And so that’s the advancements that you were starting to see in the d in the data security PO DSPM space. And with through kovi, we’re actually, um, we understand those gaps and we understand where the struggle has been for companies trying to tune their classifiers, trying to keep up with the changes and the new data and data drift that’s coming into their environment.
So the deep learning models now are able to recognize, hey, there’s, there’s an identifier here that we need to take a look at. And I’m gonna look at the context, much like a human would read a document and understand that, [28:00] oh, this is actually an invoice that has a nine digit number that’s actually an account ID for this particular company.
Max Clark: Okay.
Sirena Ong: And now we’re going to be able to classify the end, the, the data types that we have found within that document. And then because we’re so contextual in our discovery and how we’re actually building these data signatures, we are actually now also linking the data and associating similar like related data across systems.
So I might see that same account ID number, not only on an invoice, but I’m gonna see it in an email. I’m gonna see it in a contract, I’m gonna see it in, um, support tickets. So there’s a variety of data type, like right there. I’ve named four or five, but they live in disparate siloed systems. But they are all, you know, with through Kui, we’re actually correlating and linking it so that if security or compliance teams or privacy teams are trying to understand.
Where’s the data [29:00] related to this person? Where’s the data related to this product or project? You can actually start seeing the mapping and the, and how the data sprawl is sprawling across different systems. And it’s very eye-opening when you think about it. Like, oh, I, we’re never surprised when a customer says, oh, I thought the data is here.
Why are we starting to see it in our S3 buckets? Or why are people sharing, you know, the, you know, our why are people sharing product specs with externally? Or why are they saving it to their personal Gmail? Uh, you know, Gmail? Why are they sending to their personal Gmail? So there are all sorts of insights that you start seeing when you’re actually trying, starting to do discovery and classification.
And like you were mentioning about DLP, the DLP is looking for that action and those activities that potentially could be anomalous or unusual. You have to build the policy for it to recognize it. And that’s why there’s always the risk of false negatives and false positives. [30:00] Like there’s a lot of alert fatigue and, and false positives.
But there’s also mostly the biggest concern is the risk of false negatives. What is it not seeing
Max Clark: Yeah.
Sirena Ong: what is it possibly missing? And, and this is where the combination of A-D-S-P-M and A DLP can be extremely powerful because you’re now harmonizing the policies between data at rest, data in motion and informing and kind of proactively telling the DLP, Hey, this is kind of what’s important to this company.
Here’s, here are the different sensitivity, um, levels. Here are the policies that govern based on the sensitivity or the type of information that we’re looking at. And now you can appropriately, appropriately apply the right policies and the right actions and do the right enforcement with, you know, deeper intelligence around your information.
Max Clark: What? What are you describing here? Makes me like, like makes me visualize, um, uh, what’s a simple, a three legged stool, right?
Sirena Ong: Mm-hmm.
Max Clark: you know, if the CSPM or [31:00] the CAP is one leg and DLP is another leg, right? And these are, these are tools that are usually in place, put in place for, you know, I don’t wanna say like policy enforcement’s the right word, but it’s like visibility to them for policy import, you know?
So
Sirena Ong: Yes.
Max Clark: CSPM deployment I’ve ever seen, it’s always like, oh, we didn’t, we didn’t know about that.
Sirena Ong: Right.
Max Clark: and so the value of the CSPs come out really quickly in just terms of how much stuff you find that just is not configured the way that you thought it was
Sirena Ong: Mm-hmm.
Max Clark: be able to track that drift.
And so you, and you, and then you take, and you layer on, you know, DLP you’re like, okay, those are kind of really too common, you know? But, um, you know, thinking about DSPM right now in terms of protecting their cloud resources configuration wise, and are we. Are we monitoring access to data,
Sirena Ong: Mm-hmm.
Max Clark: and, and blocking data.
But can we even classify what our data is, what’s critical or not? Or do we
Sirena Ong: Right?
Max Clark: what’s happening? And I, I, you know, you, you triggered something which was like, um, you know, shadow it, right? [32:00] Everybody talks
Sirena Ong: Oh, yeah.
Max Clark: IT in the world, right? And I think about it in terms of like, you know, there’s, there’s, we need, we need a good term for data.
It’s like, what’s the shadow it phrase for like, data, right? Because
Sirena Ong: Yep.
Max Clark: you know, so, so you’ve got, so there’s this initial onboarding process, right? Where it’s
Sirena Ong: Yep.
Max Clark: we’re gonna kind of like take a, a, a stab at what we think is our data you
Sirena Ong: Mm-hmm.
Max Clark: right?
Sirena Ong: Yep.
Max Clark: we know we are running these tools.
We know we have these data lakes. We know we have these things. And, um, you’re gonna have to connect that. So we go through the process, you’re gonna connect to it, you’re gonna then parse through it all and then start like building a, a, a graph and a relationship for me. Okay?
Sirena Ong: Yeah, exactly. And um, and how we’re gonna do it, um, is less, you know, um, you’re not having to train our system. You’re not having to, um, teach it. I mean, what we’re looking for from, from our customers is more guidance. Like we can’t, you know, for some [33:00] companies, certain types of data is gonna be really critical for them to protect, and for others it’s not as important.
And so it’s some of that understanding. Um, it’s like teaching a, um, a brilliant kindergartener like manners and then suddenly it starts taking off from there and grows and matures. That’s very similar to our platform when it comes to data discovery and classification. And on top of that, the linkages that we drive to, to associate data across the systems.
So yeah, initially we’re gonna identify what are the data sources within scope. We’re gonna connect to them. They could be in the cloud, they could be your on-prem NFS, you know, file systems. It could be DFS, you know, um, as you know, we have, um, we can connect to anything with rest, A-P-I-J-D-B-C-O-D-B-C connection, and then anything for on-prem or we do peer-to-peer all, or there are all sorts of methodologies we can embrace to get to the data that you are trying to get visibility around.
And then, um, the, that’s where we start getting a [34:00] baseline. AI starts learning and starts identifying some of the, uh, what it assumes are key identifiers or key, um, classifications or entities within your data. It starts building its context, very similar to how you might, um, go to chat GPT and put in a prompt.
It comes back with a response, not quite what you’re looking for. So then you give it another prompt to improve what it, um, the output. Very similar in our platform. That’s, that’s exactly how it’s going to operate and it’s very much a much easier lift long term at scale than what you might see in, in, um, in more traditional, um, platforms.
Max Clark: How scary is this going to be running the first time? Right. You know, like, you know, I, I mean, I ask that question intentionally, right? It’s like a
Sirena Ong: Yeah.
Max Clark: little, but I mean like how, how scary is this gonna be for somebody when they run this the first time in their organization? Like what kind of like stuff you find? I’m sure there’s lots [35:00] of really like crazy edge cases, but
Sirena Ong: Yeah,
Max Clark: know.
Sirena Ong: I think, I don’t know that it’s necessarily scary. I think most of the customers that we work with, um, either understand that there’s a problem, like there’s a gap that they’re trying to fill,
Max Clark: Mm-hmm.
Sirena Ong: there’s a compliance driver behind it that says, Hey, we, you know, if an auditor or a regulator actually came to us and asked us certain questions, you know, for evidence of things that we’re doing, we, we wouldn’t be able to easily provide that.
Or it’s, everything that they’re doing today is extremely manual. So there’s usually, um, a reason I think, um, that, that brings them, you know, bring, fosters their interest, I guess, in investing in DSPM. Um, and others are just trying to do the right thing. They realize like, Hey, we, we really don’t have visibility over our data, and we wanna better inform our decisions around what to protect and how to protect it.
So it’s a, it’s, it’s usually like never, like we’re coming in to try to like. You know, point [36:00] out everything wrong with how you’re managing your data, but it’s really like a collaboration. And our intention is really just to provide you the insights, the visibility that you need. It’s kind of like you don’t know what you don’t know, and, but you know that my data’s critical.
I’m regulated, or I have, um, a stick that is hovering over me that requires me to, to get a better handle on my data, or I wanna do the right thing. Any of those reasons, it’s usually like eye-opening for them to start realizing like, Hey, I thought we were labeling our, do you know, I thought our users were actually labeling the sensitivity, you know, applying the sensitivity labels to the content.
And now. Kui, you’ve actually shown us that there’s a lot of mislabeling or unlabeled content within your environment, or, Hey, we didn’t know data was going to be showing up in certain places.
Max Clark: Oh
Sirena Ong: need to clean that up. You know, Hey, we need to apply the right retention policy. ’cause we realize like, hey, we’re, there’s still a lot of content out there that hasn’t [37:00] been, um, deleted from our systems.
Max Clark: There’s, there’s a line in Jurassic Park, right? Nature finds a way,
Sirena Ong: Yes.
Max Clark: and I think about, I think about the friction a lot between like, you know, it teams and, and users, right? And it’s like users find a way, like, you know, it’s
Sirena Ong: Yes.
Max Clark: They, it’s like what’s the easiest way for water to flow? And that’s the way it’s going. And then you turn around and you’re like, why is all this data on somebody’s laptop that was just left in a car and, and was,
Sirena Ong: And
Max Clark: stolen? You know?
Sirena Ong: right.
Max Clark: and, and that’s not like a, a hypothetical, it happens all the time, right? And, um, and we get requests from clients all the time.
That’s, that starts with things like, you know, they have a client mandate, you know, supply chain, uh, you know, requirement.
Sirena Ong: Yep.
Max Clark: How do we ensure that, you know, that customer data is not on personal devices? You know, it’s like, it
Sirena Ong: Yeah.
Max Clark: it starts in these really funny places where, you know, all of a sudden you’re like, well, how do we make sure that customer data
Sirena Ong: Yeah.
Max Clark: you know, here?
[38:00] Right. And
Sirena Ong: Yes.
Max Clark: thought about that before. We just use, you know, OneDrive, or we just used Google Drive and that was it.
Sirena Ong: Well, yeah, exactly. And, and you know, I mean, it’s, it’s never like, uh, I, I, you know, most of the time it’s not even malicious in intent.
Max Clark: No,
Sirena Ong: You know, it’s more like I’m trying to make my job easier. Yeah. I just, I want my data accessible. And then suddenly you’re finding like, wow, they had our entire customer base locally available, or they, they’ve exchanged it.
They sent it a, a spreadsheet, they downloaded it outta Salesforce and they dumped it somewhere else, like where it doesn’t belong, you know? And it’s
Max Clark: who has
Sirena Ong: delicious.
Max Clark: to their monitor is a failure of the IT team, not the person, not the failure. You know, like Microsoft by the way, has finally recently like announced that they’re getting rid of the, I mean, you know, this whole like, change your password every three months, garbage
Sirena Ong: Yeah.
Max Clark: gonna be able to like start killing off.
It’s probably gonna take another 10, 15 years before people understand that. Not to do that anymore. [39:00] But, but, but seriously, right? Like it’s, it’s that same thing. It’s like, you know, people have jobs to do
Sirena Ong: Yeah.
Max Clark: accomplish and do their job the easiest way that they can.
Sirena Ong: Yep.
Max Clark: you know, they’re not gonna jump through a lot of extra hoops just because they feel like jumping through a lot of, they have to do their job and, and, you
Sirena Ong: Yep. And they don’t have time to, to wait for approval to do certain things or access certain things, so, you know.
Max Clark: you know, like it’s so, it’s uh, you know, like, I agree, like the majority of this is not malicious. It’s,
Sirena Ong: Mm-hmm.
Max Clark: and people that look at this in like, um, adversarial relationships are, are taking it from the wrong.
Sirena Ong: Yes.
Max Clark: point,
Sirena Ong: Yep.
Max Clark: you know? Um, it’s, um, you know, so that, that relationship gets hard. So now, so as, um, you know, I would also like imagine that peop as people start classifying data out and connecting to what they think are their primary data sources and classifying data on that primary data source, are you actually showing them, [40:00] um, you know, like flows of data does
Sirena Ong: Yeah.
Max Clark: into it because it’s like, oh, I thought all my data was here, but then I noticed it’s going this place over here that we didn’t know about or didn’t think about or weren’t paying attention to, and like, now we have to go and add this into scope.
Sirena Ong: Absolutely. I mean, it’s all based on context. Again, like, you know, we’re, we’re building these, um, contextual data signatures within our platform that help us to stitch together the elements that are pertaining to, you know, different categories. You know, we, we understand the difference between an employee and a vendor and a contractor.
We understand the difference between what a product and a project and, you know, and what are the policies and governs and restrictions around the data related to those categories, et cetera. So it’s sort of a correlation and a combination of, um, you know, data types, context, policies, um, and being able to, that, that linkage and association that we do is what actually [41:00] what enables, um, companies to have the visual map around.
What, based on what, um, our sense, you know, based on the sensitive data that we’re trying to look at or the categories and whatnot, or the systems themselves or the departments and what they’re doing with data, we can visualize a lot of different things to help answer some really tough questions. You know, in terms of driving data insights, being able to understand, you know, simple things like show me all the data that it has.
It could be as simple as show me data that, um, it, you know, exceeds our seven year retention policy, um, that has this type of data. So you can get very granular and you can really start digging into, um, you know, your data, um, and trust that, um, you know. That I’m going to make visible areas that potentially require more protection or require some type of [42:00] action that potentially is going to, you know, something that we can remediate, uh, ourselves.
Or maybe this is an automation flow or orchestration that we can initiate or kickoff through the integrations into existing investments, whether it’s your DLP, whether it’s your SOAR technology to orchestrate, um, it could be your Jira system, you know, to that you create new tickets. You know, there are a lot of the more visible, I think that the, you know, since the more visible data becomes in terms of just basically understanding what is it that’s out there and, you know, it’s helped security kind of prioritize what it is that I need to do.
What are the governing rules that. These data sets fall under what are the policies that require that these, you know, our, that our findings actually required to protect or ensure that it doesn’t end up in the wrong hands? Or that, hey, [43:00] we’re relying on our employees to apply sensitivity labels, but actually we’re running into a lot of errors or a lot of non labeled content.
So let’s take a data-driven approach and let’s automate that and ensure that nobody can downgrade a label because suddenly their permissions are restrictive, you know, around what they can do with it. Um, so it’s really putting boundaries around, um, critical and sensitive information and, um, you know, providing, you know, the boundaries and the rules and the governing policies that ultimately protect the information, but still allows the business to do what they need to do.
Max Clark: Um, thinking about this in like a, a, a, a, like a wheel,
Sirena Ong: Mm-hmm.
Max Clark: you’ve got, um, discovery
Sirena Ong: Mm-hmm.
Max Clark: and then classification,
Sirena Ong: Yep.
Max Clark: you know, so like classification kinda becomes like this reinforcement with training, right? Because you’re gonna, your classifier is gonna go through and say, I think this is this. And then, you know, the, the end user right, is gonna go through and say, oh, this is correct, this is incorrect.
We [44:00] care. We don’t care. This is important. This isn’t important, right? They’re gonna actually provide additional context to the classifiers. The classifiers running through discovery, right? And
Sirena Ong: Mm-hmm.
Max Clark: you kind of get into this, you, you expand, and then you start talking about policy and enforcement, and
Sirena Ong: Mm-hmm.
Max Clark: right?
So
Sirena Ong: Oh, yeah.
Max Clark: classification, validation, policy enforcement, kind of like
Sirena Ong: Mm-hmm.
Max Clark: And,
Sirena Ong: It’s a continuum.
Max Clark: Yeah.
Sirena Ong: continuum. But then the question is always, you know, I ask every customer, well, why is this even important to you? There’s usually some driver behind it. You know, inventorying data is great, it’s important to do, but what matters more is like, now that you have the visibility, what do you need to do?
Like you wanna better enforce, you want to improve. You know, preventing data losses, you want to better comply with privacy com, uh, regulations, or maybe it’s A-G-D-P-R or maybe it’s, um, CMMC. There’s usually, um, a business reason that goes [45:00] well beyond, you know, you’re doing the right thing around securing the data, but there’s so much opportunity with us to be able to action upon the findings and solve some really significant initiatives or enhance what they’re already trying to do and just make it better.
Max Clark: Let’s talk about risk, right?
Sirena Ong: Hmm.
Max Clark: risk.
Sirena Ong: Yep.
Max Clark: Um, and, and this is something that until people have had the experience, don’t really think, understand just what’s at play, right? So at the
Sirena Ong: Yep.
Max Clark: level, what gets talked about a lot is, um, you know, ransomware, it’s always this like, risk of your data is gonna get encrypted
Sirena Ong: Yep.
Max Clark: lose access to it.
Or, um, somebody’s gonna steal your data and expose it. Right Now, depending on what that data is for exposure, I mean, know, my, my credit card and social security number I think gets exposed every week, you know, every month, right? Like, so I have permanent free credit monitoring for the rest of my life, but that. That company that’s just had that [46:00] breach, that has real risk is I, you know, I’m sure that they’re getting a discounted rate when they have to go out and buy 10 million,
Sirena Ong: Mm-hmm.
Max Clark: of credit monitoring, but that still has cost to Hoover’s
Sirena Ong: Absolutely.
Max Clark: But what else is there that people, you know, that really comes up and, and drives this beyond, know, just like the surface level, like, oh, I’m worried about ransomware, or somebody encrypting my data, or, you know,
Sirena Ong: Mm-hmm.
Max Clark: or, you know, showing up on the news.
Right.
Sirena Ong: Yeah, I mean, that’s sort of inherent risk, you know, if we have any type of critical data or sensitive, there’s inherent risk to that. And so you’re always trying to put in, uh, cybersecurity controls, compensating controls, um, to, to ensure that we’re, you know, managing and, and implementing the right controls and policies and procedures, um, to prevent any type of malicious or, uh, you know, uh, bad incident essentially.
And [47:00] then there’s the residual risks. That’s like the remaining risks left over that after all those mitigation strategies and controls have been implemented, you know, what is the, what is the potential impact or likelihood of, and, you know, in the event that something does happen, what does that risk potentially look like?
And so it’s really interesting when you start. I think CISOs in general are always, it’s one of those things where security is always, um, uh, it’s a necessary investment for every organization, but you’ll have different levels of investment across every, every organization.
Max Clark: Mm-hmm.
Sirena Ong: And um, and on the one hand, CSO is always, always trying to defend the investments they’re making.
Hey, if I have to spend X million dollars on certain things, here’s y.
Max Clark: Mm-hmm.
Sirena Ong: And trying to justify that budget and that investment and the resources. And then it’s actually looking at the risk [48:00] and using that quantified risk to determine, you know, we’re actually doing a pretty good job, but we, we are always gonna have some level of risk associated, no matter how many investments we make or whatever tools we have in place.
There’s always that potential that maybe. You know, maybe we missed something or some phishing attack is effective and somehow somebody’s able to get into our environment. And so, you know, from our perspective, we’re always trying to measure that risk based on the findings and the sensitivity of information that we’re finding.
We have a way in which to actually quantify what that risk actually looks like, uh, the residual risk looks like, um, to help, um, security teams defend what they’re doing, but also to demonstrate how well, and how effectively they’re actually doing what they’re doing to, to protect their environment. And with that quantification, you know, there’s a way to score [49:00] your risk level to be able to analyze what the trends are looking like.
Be able to potentially use that to show, hey, we’re actually trending positively. We’re actually based on all of our controls, the mitigating, um, controls, policies, everything that we’re implementing, we’re actually starting to see the, the residual risk trending lower. And then they’re able to take that information and actually, uh, demonstrate to the board that, hey, we’re pretty effective in our strategy.
They’re able to take the quantification and go and defend against higher in cyber insurance premiums, um, that they might otherwise be charged. So there’s a lot of opportunity to be able to connect the dots between what are we finding, where are in our risks, what are we doing about those risks, and what does that mean from a financial impact perspective?
It’s, it’s almost like, you know, with all of those different levers in play, you can really start operationalizing. Things you can continuing like in that continuum that you were describing earlier [50:00] in that circle, this is where now we can start layering in the findings and layering the advantage of A-D-S-P-N platform like kui, and now start layering in the use cases and extend it to compliance, extend to privacy, extend it to AI governance, um, and data loss protection, identity management.
There’s, there’s a DRM, digital rights management. Um, so there are lots of those, um, integrations and those types of initiatives that companies are investing in, that the visibility that kui can provide can actually help enhance and enrich to drive towards that complete, um, view.
Max Clark: So would you say that you advocate for having DSPM in place before you go down these other roads?
Sirena Ong: Um, I mean. Sure. Like you can’t know what you, you can’t protect what you can’t see. Um, in some regards, we know that, um, this is sort of like we said, like this is an [51:00] evolving, um, space. Um, and one that is becoming increasing visible as a need to have, um, for many security organizations because they’re, you know, through their experience of investing in other platforms, they’re realizing there’s still a, a bit of a gap, um, from which they can benefit from.
And that’s where, that’s where we’re coming to play. So definitely a before I would love it if everyone would say, yes, let’s move forward with this first, so then we can determine how we’re gonna protect everything. But we also know that there are opportunities to come in and enhance and complement and augment their current strategies and just enrich it and make it better.
Max Clark: A million years ago when I was still in-house, it.
Sirena Ong: Mm-hmm.
Max Clark: Um, we had to do disaster recovery, business continuity planning. It was a big part of the, like, the annual process and it was really frustrating ’cause you come up with all these really wonderful plans and budgets and equipment and like whiteboards and diagrams and the whole thing, and then you’d be like, oh, we’re not doing it.
You know, and it, and it took [52:00] a few times before I really understood that my job was to, provide information and options
Sirena Ong: Mm
Max Clark: that then went through the executive team to the board. And it was the board’s job to then decide based on, you know, at that point their fiduciary duty was, do you spend money based on a perception of risk or return?
Sirena Ong: mm.
Max Clark: it’s really. And, um, and when you think about it in that line, it’s like they needed the information to then make an educated decision and you
Sirena Ong: Yes.
Max Clark: information to make a good educated decision, or you’re doing them a disservice.
Sirena Ong: Yep.
Max Clark: And it, and it calmed me down a lot actually in my job.
Once I figured, like I really understood that, it was like, you know, like you have no, I’m not building this platform. I have to design it and I have to, I have to budget it, you know, but like, that’s my job, you know? Um, and, uh, and, and there’s like a lot of parallel here with this. You know, one of the things in cybersecurity that’s really interesting is, you know, you know, [53:00] somebody who’s like advising and counseling people through these, through these pro um, through this, like these journeys is, you know, if, if the owner of the company or the, the board of the company decides they don’t wanna spend money on something, right?
Sirena Ong: Yeah.
Max Clark: But like, you’re not, you know, like you’re all, all, what you get to do is you get to make a case to say, we should do this, otherwise this other thing could happen to us, or we should do this because we can go get this. You know, like we can do better. Right.
Sirena Ong: Yeah.
Max Clark: um, and so I am, I’m thinking about a lot of these conversations I’ve had in past years and just how much that turns into, you know, like, okay, we want this, you know, it’s like tools, technology, vendors wanna sell you a tool, right?
But then
Sirena Ong: Yeah.
Max Clark: then you have to create a process around that tool. You have to have people to manage the tool. You have to implement the tool, you have to maintain the tool, you have to monitor the tool. You have to take action on the tool. You have to do
Sirena Ong: Oh yeah,
Max Clark: with the tool and, and like, is that tool actually giving you some sort of valued output at the end of the day?
Or you just [54:00] have another tool and, um, and you know, I, I’m, I’m, I think about a lot of this stuff in that context around, okay, great, we have all this data, but we don’t care, you know, like.
Sirena Ong: exactly. That’s why I said like, if, to have an inventory is great, but it only matters if you, if there’s actually a tangible or intangible or intrinsic value to having that visibility and, and you know, security. I mean, definitely it’s always been there from a privacy perspective, I think as soon as those like GDPR came into play, everyone was scrambling.
Trying to figure out, do we really have an idea of where all of our customer data is, employee data, you know, do we have the right controls in place? So GDPR set everybody off and said, whoa, we need to really go figure this out. And uh, it took a while. I mean, it’s still like a lot of companies are still doing it manually, um, and trying to inventory and map their data.
And then it became a thing where, well, [55:00] privacy and when you think about collaboration in an environment, privacy is trying to, or compliance teams are trying to implement controls and understand and, and be able to respond, you know, with the evidence that shows, hey, we’re doing the right thing to protect information, and then you have security that’s at the same time also trying to proactively defend.
They’re the company’s environment and information against any threats, whether they’re external or internal. And then you have the IT team or the data teams that actually have the data. They’re managing the infrastructure and they’re, they are the ones that control the king, the keys to the kingdom.
Max Clark: Mm-hmm.
Sirena Ong: All of them have to work together, you know, in this.
And the reality is what’s happening right now is privacy kind of buys their own tools. Security’s buying their own tools, it has their own governance tools, but they’re all trying to do the same thing, but with a different dimension.
Max Clark: Yeah.[56:00]
Sirena Ong: You know?
Max Clark: is more than just a cookie banner, right?
Sirena Ong: Yes,
Max Clark: oh.
Sirena Ong: there are, I mean, I remember being in Spain last year and, um, you, you have, you know, notification everywhere around, Hey, you’re being filmed.
Or, you know, in the airport there were all these different privacy notices because they take it really seriously. I remember even walking into a cafe in Myorca and I ha, I was on FaceTime with my sister and I was like, oh, look at this cute little cafe and little shop. They have little things you souvenirs you can buy and everything.
But the shopkeeper looked at me and she was just like, Uhuh, because she was like, you can’t film me. Like, because they’re so serious. I mean, local shopkeeper, you know, of a cafe in my york, in the island of Myorca office, Spain is like concerned about her privacy rights and everything. And I thought it was Fanta.
I’m like, I am so sorry. I’m just FaceTiming. I’m not recording, you know, but I was like, I gotta go everything. Um, but [57:00] it, it is a very real thing. And, um, and something that, you know, we should all embrace in terms of knowing that our data, I mean, you know, I think it’s almost become commonplace for us to receive those letters in the mail that, um.
One of our, whoever we’re working with, our credit card company or our retailer has been compromised, your data has been compromised. And, um, you know, we’re sorry about that. Here’s a free credit. He’s, here’s free credit monitoring for year, but for a business, this is costing them millions and millions of dollars.
Not only on that, but also the penalties and fines that come as a result, um, as well. So it’s, you know, it’s, it’s one of those things where you either pay now or pay later.
Max Clark: Um, you sent me a couple of case studies
Sirena Ong: Hmm
Max Clark: and, and I was, I was reading them and like rereading and rereading and reading and rereading. And um, and what really struck me [58:00] was even though the industries are different and the under and the, and the, let’s call it like the forcing issue is
Sirena Ong: mm-hmm.
Max Clark: it’s the same,
Sirena Ong: It’s the same.
Max Clark: you know, the thing, you know, same thing that I’ve, I’ve, you know, learned like everything is different but the same, right? So, you know, one you sent was, was, was biotechnology, But it’s the same thing. Visibility gaps, data sprawl, you know, what are they actually storing? Clinical trials, PHI, medical notes, right?
So proprietary personal
Sirena Ong: Mm-hmm.
Max Clark: focused information. What do they have? NIH, hipaa, GDPR. Every state has their own version of GDPR. If you’re international, you’ve got data sovereignty. Oh, we haven’t talked about data sovereignty at all. We should probably talk about that at some
Sirena Ong: Mm-hmm.
Max Clark: Um, you know, and the other one which is also is really near and dear to my heart ’cause I have a lot of experience with this, is, you know, manufacturing and, um, iar R. Restrictions. I mean, you
Sirena Ong: Yeah.
Max Clark: like, you know, opening up [59:00] like Pandora’s box of just, of, of, you know, and, and the thing about iar that’s really fascinating, and I mean, hipaa, the same thing for me. It’s like a lot of these regulatory frameworks, nobody can really define what
Sirena Ong: Yeah.
Max Clark: are and what you need to do to implement them properly.
And, and I’ve been in so many rooms and so many meetings where it’s like, it’s like, it’s like, you know, you end up in these like opinion conversations of like, this is what this actually means. And then the other person, they’re like, well, let’s go talk to lawyers and figure out what it means. And then, and then depending on what they decide, it means like everything then comes back and changes.
But, but, but same, you know, so. Uh, you, you know, iar, right? Just like
Sirena Ong: Yeah.
Max Clark: CMMC, iar kind of run hand in hand now for a lot of people, you know, you run through, it’s like the same thing, right? It’s, it’s visibility controls, um, you know, compensating controls, um, complexity of environments. You know, what happens if stuff actually gets out?
You know, what is your, what is your risk? [01:00:00] you know, in terms of reputational damage, customer impact? Does a customer stay with you? Do they leave? Can they stay? Do they leave? Do you have a regulatory agency that like, comes back down and slaps you really
Sirena Ong: Yeah.
Max Clark: Are you paying fines? Are you, your cyber insurance going through the roof?
Like, know, it’s, you know, it’s, it’s, it’s, it’s really, it was really interesting to like, you know, really, you know, like read that and like look at these two industries at the same time, but
Sirena Ong: Yeah. The same themes.
Max Clark: it’s, it’s the same thing over and over
Sirena Ong: Yeah.
Max Clark: but the same.
Sirena Ong: Mm-hmm. Like I said, it’s the stick. That might be different. One might be a bat and one might be something else, but it’s still, um, you know, we, we ultimately, we’re all trying to do the right thing. I think every company, their intention is always to try to do the right thing. Um, but.
The challenge is, you know, uh, what is the risk, what is the severity of risk and what’s the impact? I mean, for a manufacturing organization, it could be loss of [01:01:00] contracts, which means a hit to their revenue. If, if they, if their reputation gets hit by, you know, data, you know, their data leakage, or some public becomes known that they’re not doing, they’re not protecting their customer’s IP related information or ITAR related data, um, it could, you know, on the healthcare side, it’s significant impact relative to, um, patient data like, you know, our own like conditions and our, his patient histories, medical histories, et cetera.
I mean, it’s a huge violation if you’re not, um, doing the right thing. And I had an interesting conversation with, um, a research organization where they’re, they’re trying to teeter or balance between, you know, um. Data protection and compliance, but at the same time, making the data available for research because they have a lot of third party partners.
Everybody in the healthcare, uh, life sciences is sharing information, um, through [01:02:00] different platforms because again, we’re trying to collaborate globally to try to find answers to diseases or to, you know, come up with new, um, diagnoses around some, you know, and, and pro. Um, oh, I’m so sorry. Like right now I’m drawing a blank.
But, you know, the different protocols in response to different conditions. And, um, how do you, how do you still enable the business to have access or the partners to have access to all this data, but at the same time do the right thing to protect it?
Max Clark: I think that, I think that’s, I mean, you, you kind of touched on something that I’ve, I’ve noticed beforehand and, and this is also friction that happens between the business and IT, or the business and security. I’ll
Sirena Ong: yeah.
Max Clark: as, as big things where it’s like, you know, the it or the security, I’ll just, I’ll just use it to kind of encompass everything.
Sirena Ong: Sure.
Max Clark: It’s job is to power the business. Like they’re not there to be like the naysayers,
Sirena Ong: Right?
Max Clark: their responsibility and what they get evaluated on is, [01:03:00] are they, you know, protecting or, you know, powering the business.
Sirena Ong: Mm-hmm.
Max Clark: And, um, and, and I look at a lot of this and just talking about this and especially like reading through these case studies and, and talking about, you know, like what’s. You know, do you have sensitive data in Snowflake? Are you la you know, labeling your, you know, machine learning? You know, like are, you know, how, where is, how is your data flow actually working? And it’s like, and I can promise you that no IT person or security person on the planet actually cares. They just need, like, they just want like, rules of engagement.
Or they can say, this is safe or unsafe for these reasons. And if the business comes back and says like, we want to do this, or this is our, this is our line. You
Sirena Ong: Mm-hmm.
Max Clark: you know, trying to quantify and saying, you know, we’re at a risk score of 7.2 out of a possible 10, and that’s okay for us.
Like, uh, you know, nobody, nobody at the end of the day, like nobody in it cares. You’re just like, okay, great. I know where my line is. Like anything above that I’m gonna take care of, you know?
Sirena Ong: Well, it, well, I think [01:04:00] it’s like, I think, I mean, you’ve been in it for years and as, and I’ve been in security for years. I think there’s, there was a need at some point, and there continues to be a need to, um, like for security for example. Um, it’s not just about, Hey, we’re trying to defend against breaches, but attaching the initiative to either cost savings or
Max Clark: Mm-hmm.
Sirena Ong: the bottom line or revenue, like if we do this. This is what you know
Max Clark: Mm-hmm.
Sirena Ong: be the opportunity. Like Apple’s done a great job of building a marketing.
They’ve done a great marketing job of utilizing privacy compliance and protect data protection as a marketing advantage for them. Right. They turned it into a, a growth opportunity as opposed to something that’s trying to slow the business down.
Max Clark: I, I, that one I [01:05:00] worry about specifically, right? Because it’s so core to their DNA and to their promise to me as their customer.
Sirena Ong: Mm-hmm.
Max Clark: And, and you can kind of feel that, you know, as like, is that slipping a little bit with the pressures around AI and like
Sirena Ong: Yes.
Max Clark: and like, you know, revenue growth slowing and, um, if they ever, if they ever crack that promise, like it is gonna
Sirena Ong: Oh my gosh.
Max Clark: devastating for that business.
Sirena Ong: It will be. They have definitely.
Max Clark: see it right away, but they’ll see it, they’ll, it’ll kick in pretty quickly.
Sirena Ong: Well, and, and if I could just say, I mean, speaking of the ai, I mean that’s, I mean, talk about not just the volume, variety and velocity of data, but now with the advent of ai, it’s added a whole new layer of complexity with the deployments of copilots, tons of shadow activity happening around the training of LLMs and testing, and nobody wanting to slow the developers down and everything.
But [01:06:00] I remember back in the day, the biggest challenge was, uh, you know, developers themselves sharing like their administrative passwords to environments,
Max Clark: the way, that
Sirena Ong: right? Yeah. So that was like the biggest concern.
Max Clark: by, by the way, that has not changed,
Sirena Ong: So you’re seeing it on, you’re, you’re seeing it appear on Slack, you’re seeing it appear on teams, and you’re like, whoa, guys.
Max Clark: files
Sirena Ong: Yes.
Max Clark: source control like GI and or now we call it, you know, it’s get
Sirena Ong: Yeah.
Max Clark: you know, like that has, that has not, that has not changed why own one one iota, you
Sirena Ong: Right,
Max Clark: and, uh, you know, unfortunately for a lot of people that’s just like, you know, going into like proper key, you know, like vault management and key and,
Sirena Ong: right.
Max Clark: is like usually a pain response because they, they had to, like, something happened and they had to go find and change all their passwords
Sirena Ong: Yeah.
Max Clark: infrastructure.
And you’re like, they start realizing like, how many are out there? And it’s like, whoa, that’s a big one.
Sirena Ong: Well, again, that’s a big use case for discovery too. ’cause then we can go and find those secrets and find them, like across the different communication channels. But, but I guess with AI it’s because it’s so new, [01:07:00] like not, you know, it’s, it’s like, um, you know, when you’re dealing with an ERP system, like SAP, it’s very proprietary and you have experts in that environment and all the non experts are scratching their head trying to figure out how do I get the visibility I need.
Similar here in ai, it’s like there’s a lot of, um, you know, development occurring in different parts. There’s a lot of the shadow data, shadow IT, shadow applications that are getting deployed and, um. And because of all the ethical concerns around ai, um, you wanna make sure that the data is properly prepped properly that’s scrubbed and cleansed of anything that could put it at risk.
You know, those are all things.
Max Clark: a
Sirena Ong: Mm-hmm.
Max Clark: this is, this is, this is keen and, and touching off on a couple of themes, right? So in, in ai, right, so the, I, I think the two things that are most exciting right now today in AI becomes either introducing, uh, a new modality, usually like a chat interface to then go
Sirena Ong: Mm-hmm.
Max Clark: ask [01:08:00] questions about your data, right?
So you can have this, unstructured question response or, or question with an assembly, and then formatting and response, which is really nice. Or you have this, uh, agentic push of like, we’re gonna now
Sirena Ong: Yep.
Max Clark: automations that can then be prompted with work and understand what that is, and then go out and do something and come back in return.
So I’m gonna, I’m just gonna use that as like my two big
Sirena Ong: Mm-hmm.
Max Clark: Uh, so companies are trying to figure out how to do those two things and what those two things really mean for them, but then like, lurking off in the shadows, you hear from a lot of people of like, oh, we can’t do AI yet because our data’s not ready for it. Or, you know, the fear and the reality of like, if we upload our entire data set into this tool, that then somebody can ask a question like, what’s our unreleased financial data for this year gonna look like? Or What is my boss making? You know?
Sirena Ong: Yeah.
Max Clark: and somebody had, you know, there was an email that got sucked in that just had this information in it.
Sirena Ong: Yep.
Max Clark: you know, so, so [01:09:00] goes back to your point about like classification and visibility, right? To
Sirena Ong: Yep.
Max Clark: you know, if, if you have, you know, secu, a c QV in place that you could take and then classify and say, this data can go and this data can’t. Right.
Sirena Ong: Or you could scrub it, like if the data’s necessary. Like there’s, there’s all kinds of discussions around, you know, what, what data can we use? Sometimes the business is just grabbing and downloading, you know, whatever data they wanna use,
Max Clark: whole thing. Yep.
Sirena Ong: right? And then that’s where security comes in. Or the compliance teams comes in and say, whoa, whoa, whoa.
You know, there are some boundaries and restrictions. We don’t wanna slow you down, but you have to be mindful. There are legal liabilities, you know, around this. There are potentially regulatory violations that are occurring.
Max Clark: Yep.
Sirena Ong: So let’s still enable you, but let’s, let’s scrub the data.
Max Clark: Yeah.
Sirena Ong: let’s de-link the identity data that might exist within those, um, data sets.
Or let’s create synthetic data off of the real data, you know, off the raw [01:10:00] data so that you can still run your models off of, you know, um, you know, without putting us at risk. Or let’s make sure that we anonymize and hash the data within the data. Just to make sure that we’re not, we’re, we’re train, we’re still training our models as we see fit, but we’re not putting ourselves, um, at risk in other ways.
And then, you know, and then being able to, you know, through that contextual understanding of the data, you know, being able to inform where are the guardrails that need to be put in place. You know, what are the boundaries? What, what should we tell the chat to not respond to?
Max Clark: Yeah. I mean, iar, your fear factor is releasing, you know, national security, defense Secrets, healthcare, hipaa. If you leak patient information,
Sirena Ong: Yep.
Max Clark: bad. But, you know, every company has pro, pro protected information on their employees. I mean, forget, like everything else we talk
Sirena Ong: Yeah.
Max Clark: like unreleased financial data or whatever product or ip, you know, if, if you’ve got, if, if you release, [01:11:00] you know, protected information of an employee, you know, the state labor board, you
Sirena Ong: Oh yeah.
Max Clark: have a field day with you and, you know, that’s like, like that’s not gonna be a gentle experience.
Sirena Ong: No, it’s not. And then you, and then you, well then we can get into all these like realms of discussions around, you know, does the government have a right to ask for that data? You know, all these sorts of things. So now we’re, you know, we’re, we’re getting to all sorts of, you know, blurring, you know, the edges in terms of data privacy and whatnot.
But yeah, absolutely these are all considerations. But, you know, again, I don’t think anyone’s trying to maliciously expose any of that. It’s just sometimes things happen, but we can do better to, uh, make sure that we understand what that, what that data is, how it’s being used, how it’s being shared. You know, what, how is it being copied or whatnot.
And just make sure that we have, [01:12:00] you know, eyeballs and spotlights and prioritization. Around the data that could potentially, um, compromise our company, you know, compromise our financials, our customers, you know, these are all priority things that come, you know, the whole reason why security exists is ultimately it goes back to protecting the data.
I think.
Max Clark: You kind of, you kind of teed this up. Well, so I’m gonna ask this question. Um,
Sirena Ong: I gonna regret it? Just kidding.
Max Clark: the, no, no, no, no.
Sirena Ong: I’m just kidding.
Max Clark: I hope not at least. Um, what’s, what’s the one thing that you wish more companies, um, understood about DSPM? That, you know, they, they don’t.
Sirena Ong: I, I wish, I guess, um, I guess it’s, it’s, there are multiple dimensions to that. One is, again, goes back to the visibility aspect. I mean, I think the challenge, um, that customers face today, [01:13:00] that is, there’s a lot of. Information out there that sounds the same. And
Max Clark: Biting
Sirena Ong: are a lot of, there’s, there’s a lot, there are a lot of vendors that are marketing very similarity. Similarly.
Max Clark: Mm-hmm.
Sirena Ong: So you’re starting to see DSPN players starting to say, oh, we can address privacy or privacy vendors that say, oh, we can, we also have DSPM capabilities or DLPs that say we can do all the discovery for you.
So there, it’s, it’s a very crowded, very confusing, um, time I think for customers because they know they have the need for it, but they have to parse through so much to try to get there. And so, um, and then when you go down and layer deeper, now they figure out, okay, do we want A-D-S-P-M? And then it’s kind of understanding the differences between the different approaches, um, and.
You know, I think [01:14:00] there’s enough room for, for many different vendors. I think we’re gonna continue to continue to see consolidation in the space. But the challenges are real that customers have experienced. And where the frustration has been around DSPM has been, you know, hey, this is hard to manage. It’s a heavy platform.
I, I have to build a whole team to get it. And then we’re still not getting it right. You know, the accuracy, you know, the, we’re having to constantly maintain and we can’t keep up with all the new data and the shadow data and the, um, you know, the custom data types. It’s not seeing everything. So we’re seeing, so the industry is maturing.
I guess the good news is that we’re, we’re evolving and we’re continuing to get better. And, um, I think that the, I just want, you know, Mike, everyone, prospects, customers, or you know, security leaders out there to understand that you are investing in a lot of different tools that. Absolutely have value and they’re, they’re, [01:15:00] they’re doing well at what they do well.
But the missing link and the missing, um, opportunity here is data visibility, accurate contextual data visibility that’s actionable to actually help you fully, like close the gaps and, you know, make it easier for you overall and make it, we can make it an easy lift. I guess my point with kui is we can make it much easier lift than maybe what you’ve experienced before, and we continue to advance and innovate in this space that will continue to make it easier and easier for our customers and drive more and more automation, but also make it part of a complete story for your data protection strategy.
Max Clark: It’s a great, it’s a great 32nd elevator pitch too. We can make your life easier, right?
Sirena Ong: Yeah.
Max Clark: we’re gonna give you data visibility and make your life easier. That’s
Sirena Ong: Right. Yeah.
Max Clark: do.
Sirena Ong: Well, I mean, it’s, it’s the same thing like, you know, like I said in the beginning, preventive healthcare, if I, if I didn’t do the CT scan and I didn’t see that there is [01:16:00] a, you know, something kind of going on, if I didn’t do the MRI or things like that, then I wouldn’t have known, you know, that I’m, I’m headed towards something that I didn’t expect, and that’s what we can do.
Max Clark: and, um, what’s the other right acronym, like PRM, like, like, um, policy rights management, um, access control.
Sirena Ong: mm-hmm.
Max Clark: gonna start merging or do you think these just maintain like complimentary silos that, that talk to each other?
Sirena Ong: No, they are, are, they are already merging. Um, very much so. I mean, it’s one thing to understand the data, but then it’s like, okay, well who actually has data? Who has access to the data and what are what? You know, what are they doing with the data that they’re finding? And, you know, again, we’re not trying to displace an IAM an an identity management platform.
We’re not trying to displace, um, DLPs or Sims or instant response platforms or whatnot. We’re just, um, we’re, we’re married to it. [01:17:00] Like we have a policy engine, but we’re, we’re not saying that you’re not gonna manage your policies in other platforms as well. So let’s harmonize it and let’s bring it together so that we make sure that wherever the data goes, however it’s shared, that the policies in in governing rules follow it.
And so that’s sort of the combination of effort of, of different tools and different strengths coming from different places. But I look at Kui as sort of being that, that core foundation to be able to enable, um, to better, enable more effectively, you know, all of these different programs and efforts to secure data.
Max Clark: Serena, thank you very much. I know we could talk about, I,
Sirena Ong: I
Max Clark: I, my, I it’s a lot. I mean, it’s, it’s, it’s a lot in an hour, but, um,
Sirena Ong: thank you, max.
Max Clark: Thank
Sirena Ong: I I appreciate the opportunity and thanks to you for, for sharing this hour with me. I think we went over it.
