Max: 00:00 Max Clark, it’s a Tech Deep Dive. I’m sitting with Roman right now, I’ve asked you, I’m going to do it again. Yeah, it’s in here. Yes, okay. I was thinking about it and then I completely blew it. Um, and Roman is the head of sales for us, for Open Systems. And if you don’t know who Open Systems are, that’s probably not unusual. Open Systems is a, oh, I’ll let Roman get into details, but a Swiss based company, and they do some really interesting things. And we’re here talking specifically about a split that Open Systems recently did, moving and aligning services, and Roman runs and now is responsible for their SASE line. So Roman, thank you for joining and doing this with me.
Roman: 00:58 Thanks a lot, Max, for having us. So hopefully I didn’t besmirch your name the rest of that intro too terribly.
Max: 00:59 No, absolutely not.
Roman: 01:00 So, um, Open Systems is a Swiss company. That’s where we were founded, approximately 30 years ago, but since then we have expanded to the US. So that’s how I ended up, as you can hear by, Max, and I’m originally not from the US, I’m Swiss. But with Open Systems expanding to the US and trying to conquer that market, I moved from Zurich, Switzerland to San Francisco, California in 2019. So that’s when we really started to expand, even though we had customers way before here in the US, that’s when we really started to expand here in the United States.
Max: 01:40 Let’s start by talking about Open Systems as a customer focus, right. So who are your customers, and you know, I mean, I’ll just give you the whole pitch here in one shot, like, you know, geography, size, vertical, you know, what makes up a company that you guys go after?
Roman: 01:57 Absolutely, yeah. So in general, Open Systems offers services that almost every company needs, right, because almost every company has users, and they can be anywhere. They can be in a Starbucks, they can be at home, they can be in a location, in an office, in a factory, or whatsoever. And these users have to use applications, business critical applications, to do their job, to drive their company’s value, and whatever they do. And these applications, some are still in like traditional data centers, they can be in the cloud, many have SaaS applications now, but also many have still like engineering stations, or robots in factories, and so on. Right, and these are the two things that make up a company from an IT perspective. You have users with their devices anywhere, and you have applications, and they’re anywhere. And Open Systems provides a service to basically connect them in a secure manner, right. And the latest term for that is SASE, secure access service edge. And this is really where Open Systems came from a long, long time ago. We used to call it hybrid WAN, and then secure hybrid WAN, and then the term SD-WAN came around, so we called it secure SD-WAN, because it was not just SD-WAN, but also firewall and so on. And then a couple years ago, Gartner came up with the term SASE, and Open Systems, for the first time, felt like, yeah, this is actually very much where we believe we belong. This is the combination of network and security in one technology fabric, one technology platform.
Max: 03:38 Microsoft or Google will say every company is our customer, right. You know, we’re going to service everybody, from a single person solopreneur to, you know, Fortune one, you know, Fortune fives, right. I don’t find very many suppliers actually saying that they’re going to do everything for everybody. So, I mean, are you still focusing on mid-market, large enterprise, small enterprise, SMB, I mean specific verticals? Open Systems started with, you know, financial services, as it’s a real focus. So as you’re looking at, you know, prospecting or marketing, who are you marketing to, and who are you prospecting into?
Roman: 04:04 Yeah, I mean, it’s absolutely correct, we have our origin in the Swiss banking industry, based in Zurich, but since then we have expanded quite a bit, right. Services are interesting to customers typically around, on the smaller side, like 500 users, but more toward a thousand users, that’s kind of like the lower end. We have smaller customers, and sometimes our services make sense for smaller customers as well, but I would say the sweet spot starts around 500 to a thousand on the small side. And then on the upper side we go into the enterprise, we have customers with 30, 40, 50,000 users, and three, four, five hundred locations all around the world. Now, typically, especially with SD-WAN, which is a sub-component of SASE, right, that makes a lot of sense if you have multiple locations which need to be interconnected. This can be regional, we have customers that are in specific regions, a bank, for example, in the Midwest. But we have a lot of customers which are international, especially in the manufacturing space, for example, they are in many different countries, they have factories in China or in other countries, and their connectivity is often a bit more tricky. And that’s where we have a lot of expertise, and where we can help our customers to interconnect locations on a regional or global level. Right, yeah, like I said, roughly a thousand to twenty, thirty, forty thousand users in size. Um, typically more than one location, right, so five, six locations, up to two, three, four hundred locations, that’s where the maturity of our customers sits nowadays.
Max: 06:00 Okay, so more of a private or public enterprise, you know, mid-market to large enterprise as a focus. But not necessarily, I mean, are you active in healthcare as well? I mean, so, okay, so it’s not so much vertically specific, is it more of just, you know, is the customer reach the maturity or size necessary to actually be looking at these things in the first place?
Roman: 06:18 Exactly, yeah, as I said before, it’s, almost every customer has that need to connect users wherever they are to applications wherever they are, so that’s very vertical unspecific, I would say. What we are not doing, to kind of put a frame around it, is, we are not working with the federal government. We have university customers, even though that’s kind of like in the government area, but it’s not federal government. So the reason why, no federal government, we don’t have a FedRAMP certification, and we are not intending to get that. So that’s kind of a reason why this is a vertical that we don’t work in.
Max: 07:03 You know, I would normally ask these questions in terms of, like, really simplistic, like, what problem do you solve, and how does this impact the customer, and, you know, those sorts of things. But I agree with your earlier statement, I 100% believe that, you know, SASE is a definition of this smash up between network and security, and especially with remote users, makes 100% sense, like you absolutely need to think about your network and security in one stack. And then the second thing is, there’s a whole concept around SASE, and the definition of SASE, most people are really not actually even meeting SASE as a definition, they’re still kind of somewhere in this SSE definition. And there’s this massive rush and realignment by, you know, manufacturers and service providers to try to fit and say, okay, we’re now, you know, SASE companies. And then on top of that, there’s also this idea with, you know, MSPs or MSSPs, of this buy versus build, did they go out and just say, hey, we went and partnered with, you know, fill in the blank logo, because we could buy their equipment, now we’re SASE certified, and we’ve got this thing in this overlay. What I want to talk to you about, and what I’m curious with Open Systems, is, you’ve been doing this for a long time, right, you know, your SD-WAN was in the market for a long time. Well, I mean, walk me through the iteration of service from Open Systems. What did you buy? What have you built?
Roman: 08:21 No, absolutely. I mean, a little history lesson, Open Systems, in its very early stages, was basically an integrator. So we used other vendors’ hardware, and we helped to interconnect companies, bring them to the internet, and so on. I would say approximately 20 years ago, Open Systems made a decision to start and build our own stack, because we had, like, 10 years of experience in that space, right. And we said, there is an opportunity to actually bring many of these technologies together. In the beginning, that was firewalls with WAN capabilities. So when Open Systems started to do, we started to build our own platform, our own operating system, on top of that we started to build our own WAN capabilities, firewall capabilities. And then over time, we added more and more, right. Once you go out to a location, you want to have secure web gateway capabilities. And for us, what’s really critical is that, you can have all these point products, but if they are standalone, you will have challenges in regards to complexity, you will have challenges in regards to how do these different technologies work together, right. And Open Systems has always had the aspiration to bring all of these technologies onto one platform.
Roman: 09:57 So, um, I mean, if we go by the Gartner definition, SD-WAN is a core component, right. So back in the days, as I mentioned, we called it hybrid WAN, we had the capability to connect multiple lines and have some sort of failover, we were there for a long time. And then, over the past, I would say five to ten years, this has evolved into SD-WAN, until finally the term SD-WAN arrived, which gives us the capability to do routing on an application level, to send traffic via different links, to make sure if there’s an issue on one link there’s an automatic failover, and so on.
Max: 10:31 Palo Alto, Fortinet, Cisco, big brand names, every company has had some exposure to using these things. Um, have, I mean, Cisco, you look at their portfolio, their entire thing that you would align into SASE has been acquisitions, Meraki, OpenDNS, et cetera, you know, Duo, it’s all been slammed together. Palo Alto did something similar, they purchased CloudGenix to create the SD-WAN side of the thing. You know, Fortinet, I mean, so now Palo has Prisma and Cortex, and Fortinet has their EDR and SIEM and, you know, network stack, and, you know, the large manufacturers are chasing into this as quickly as they possibly can, because, to your point, having a single logo, even if it’s not even really a single platform, creates a lot of, you know, efficiency and ease for a company to consume. So an organization that’s going out and saying, hey, you know, we need to do, and meet this challenge and solve this for our enterprise, why not just go and buy a full Meraki stack, or a Palo plus Meraki stack, or a full Fortinet stack, or fill in the blank, whatever logo, color, icon you want to interact with, stack?
Roman: 11:45 Yeah, I mean, it kind of goes back to our ideal customer profile, I said typically it ends at, like, 30,000 users, right. And the reason for that is that companies which are larger, they have the team to actually operate their own technology stack. They have large enough teams to operate this technology 24/7. They have the knowledge, they have the capability to retain, even though they struggle with that, I mean, we see that more and more, but that’s kind of like, yeah, why they can do it. Customers in the SMB and the mid-market and the low enterprise, they just don’t have the teams to do that, right. So if they go out and buy technology, there’s phenomenal technology out there, but technology only gets you that far, right. You have to operate this technology, because you can have the best box, but if it’s configured the wrong way, or it’s misbehaving, or it has an issue, if you don’t have a team that has the capacity to address this issue, then your employees, your users are not going to access these applications which they need to do whatever the business is doing, and you come to a halt, and you lose money, and yeah, no one is happy about that. So the real big thing is that we provide that technology, which is very comparable to all the big players, but we provide it as a service. Right, so we bring, we call it Mission Control. Mission Control is our 24/7 operation center, which runs around the world, so we have offices, obviously in Zurich, Switzerland, we have one in Honolulu, Hawaii, which is a very nice outpost for us, we have here in the US mainland an operation center, and that allows us to provide a very high quality service, 24/7. And that’s on an operational level, but then we also bring a strategic level layer to the customer, we have a customer success team, which is an extension of the customer, so they work very closely with them, and they help, from the very beginning, right, they help with how should the WAN architecture, the SD-WAN, be architected, how should the firewalls be set up, how can we make sure we have the segmentation on a local level, right. So these are all things where the customer success team helps on a very strategic level. And over time, right, if the customer wants to onboard a new application and so on, these are all things we help them, and the stuff that comes with it, with the service, is the customer doesn’t have to take care of patching, or life cycle management, or monitoring, all these cumbersome tasks that someone in IT has to do, which are not value generating. Like, no one has ever generated value for a business by making sure the boxes are patched, if they don’t do it, they will for sure run into an issue, and they will decrease the value of the business, because they will have a breach or something, but it’s not value generating.
Max: 14:52 So SD-WAN means basically whatever the marketing department wants it to mean at the time, right. Um, I kind of classify SD-WAN as, you know, you’ve got a web interface to configure the box, right, so it’s like your basic SD-WAN, and then maybe it’s, um, availability and circuit failover SD-WAN, and maybe you, you know, or you have a good service, you can actually apply real quality of service and application performance profiles on top of that. There’s, uh, like MPLS replacement, so overlay-underlay, you know, network design, I think circuit availability and redundancy is a relatively consistent feature with everything, it just depends on how sophisticated it does it. But if you say, okay, this environment has a WAN optimization issue, right, constrained bandwidth, remote locations, they’re trying to do, uh, file sharing across massive distances and latency, you know, there’s specific point solutions, or services, that tackle these things. So now, if you’re providing this as a fundamental service, how deep into these different things do you actually go? I mean, obviously a customer doesn’t need, you know, a GUI to go configure their firewall, because they don’t have one anymore, but, you know, if they’re having a WAN optimization issue, or if they want to do, you know, accelerated file transfers, or if they need to do an MPLS replacement, you know, is that something that you’ve now built out this functionality as well into your stack, or are you, you know, as a customer then going and saying, okay, we need this service from Open Systems, but we also still need this other thing over here that we’re going to interlink between the two platforms?
Roman: 16:26 Yeah, that’s a good question. So SD-WAN, as I said, is a core component of our SASE stack, and I think SASE is one way to solve a use case, right. I would say that the use case behind everything is, you have users, they need to access applications to do their business, that’s the use case, and this experience should be good. Now, how can you solve for that, right. If you have a single line, a single ISP line, at a specific location, you’re at the risk of this line going down, and then the user experience is really bad, because no one can do their work. Now you can go and say, okay, we need two lines, right, and then you have redundancy. Now when you have two lines, you want to make sure that we are not only doing a hard failover from one to the other, but we want to do some dynamic failovers, right, if we detect that a Teams session, for example, is not performing very well on one line, because, I mean, it’s the internet, there could be like some packet loss or whatever on the last mile, right, we want to make sure we have technology in place, as kind of like an insurance policy, that then automatically fails over to the other available line, and there could be two, three, or four lines, right, depending again on the use case and the risk adversity of the company. But that’s really what we want to achieve when we talk about SD-WAN, it’s a user experience, that could be, that the application is available in the first place, that if we have limited bandwidth, that the bandwidth is not consumed by 99% YouTube traffic or Spotify, but actually the business critical application, like SAP or Salesforce, that they have priority, and that my video conferencing is top notch, and if there is an issue, there is a failover. So these are all the things that are addressed by SD-WAN, and these are capabilities that we have in our technology stack, and this technology is what we help the customers set up, right. If we migrate the customer over, or we onboard a customer to Open Systems, we have a very in-depth workshop to understand their application landscape, because only then we can help them to design an application strategy in an SD-WAN context that fulfills the requirement, or the use case, of having great user experience and application availability, right.
Max: 18:59 Based on age of company, and like, I mean, so it’s a Swiss company, over 20 years old, started by doing firewalls, it basically tells me, okay, checkpoint legacy, see, you know, more than likely, right. Move forward, what is your customer architecture, and deployment? I mean, are you turning up, you know, equivalent of, like, boxes or VMs in data centers specific to customers? I mean, are you doing partitions on a single instance? Like when we talk about, like, how the SD-WAN interacts with the firewall, which interacts with the remote users, which interact with the application, the data center, you know, like, walk me through an architecture topology, network map, whatever phrasing you want to use for it, of, you know, how do these pieces fit together?
Roman: 19:37 Yeah, yeah, I think the most underlying piece is what we call the service delivery platform, right. The service delivery platform is basically the hardware or the hypervisor, and that runs our operating system, right, so that’s the most fundamental piece. Now, when we talk about the hardware aspect, we have different sizes, right, we have very small boxes for offices with, like, five or ten users, but then we have boxes for up to a hundred, three hundred, whatever, where we can address different needs. And then we have boxes which go into a data center, right, there’s, like, really big, two-unit boxes which have, like, 10 gig of throughput, and so on, and they can handle a data center, right. Now, it’s not just physical anymore, so hardware is one thing, but it’s kind of like fading out, it seems, and there’s definitely a trend towards cloud, right. So we have the capability to deploy the same service delivery platform into Azure, AWS, Google Cloud, into your Equinix, into your hypervisor that you have in the data center, and so on. The cool thing is that it is the same platform, that you have in various sizes of hardware and different hypervisors, and then we are able to provide these services, that’s why it’s called the service delivery platform, you’re able to deliver these services on each of these edges, right, with the SD-WAN, with the firewall, with the secure web gateway, with the DNS filter, with all the components that make up our SASE technology stack. The edges, they connect to each other, right. So Open Systems has built the SD-WAN so that we use the public internet, and make sure we do that in a smart way, so that we, for example, have regions, if we want to interconnect Europe, we have a region over there, we have a region for Asia, or for the US, right, depending again on the customer’s use case behind it. And then we can often use, for example, the Azure backbone to interconnect regions.
Max: 21:59 You know, in the US it’s not too terrible if you’re, you know, you have a chassis in North Texas and you have users in SoCal, you know, it’s not so horrible for those users to have to effectively tunnel to Texas and then get on the internet and do whatever they’re doing and come back. But then all of a sudden you open up an office in Singapore, or in London, or Paris, or whatever happens, because you put sales people, or you’re hiring, you know, engineering talent, or whatever you’re actually doing in these markets, and then you find out, oh, you have to tunnel all your traffic from London back to Los Angeles to then go back to London. What I’m looking for here is, in that case, you know, that company maybe doesn’t have assets already in Europe, right. It’s not like, or they don’t have a lot of assets, or they’re not operating offices, maybe it’s just some users in a WeWork, like, how do you deal with that use case, that doesn’t, where it doesn’t suck, right. You know, because there’s like some things that have to tunnel back, but there’s a lot of things that don’t, like if they’re opening up Google Maps to try to figure out how to get down the street, or find, you know, lunch delivery.
Roman: 22:54 Absolutely, yeah, I know, I’m 100% with you on that, and this is definitely something that we see a lot of companies that move to us struggle with at the moment. Right now, there are some applications which are bound to a location, right, so it could be a legacy application that runs in a data center that has to be used by the entire world, this would then be a WAN application typically, and we have the SD-WAN in place to make sure the users efficiently get to this application which is just at one location. But as you say, there are many other applications, there are business critical applications, SaaS applications, which have to be used, like Outlook or OneDrive or any application, and then there is the plain internet. And we want to make sure, to have good user experience, you want to make sure that you actually access the internet where you are. If you’re in the United States and you go to Google, you want to get Google US, if you go to Germany, you want to get Google Germany. And when you go to Google Maps, you don’t want to have your pin somewhere else, right. So the way we solve this is that, users that are remote, they access the internet through the closest POP. Now, if the customer has a presence all over the world, and they have offices, then they could either be, the remote users can be connected to the closest office and can use that infrastructure. Or what’s more common now is that we spin up POPs, in for example Azure, and then if there is a remote user that goes to Germany, they connect to that POP, and then they have the same security and infrastructure that they enjoy in their office, when they’re somewhere else.
Max: 25:06 Within those environments, if users need an, and a company’s looking for, you know, like, we need to provide this functionality, we need a firewall, we need secure remote access, we want to improve, you know, our security posture, we want to do all these things, but we also need to have, you know, this FTP server that sits in our office, it’s core to our ordering process, for our ETL with this, you know, customer or supplier that we have, is that something that you can help them solve for? And I’ll expand on that a sec, which is, I find a lot of people, their response is, like, oh, go out and get two network connections and run BGP yourself. But, I mean, again going back to that, if you have the expertise to run BGP yourself, then you probably have the expertise to run and manage this other equipment, in these boxes, yourself as well. So telling a company like, just go run BGP yourself, isn’t necessarily the solve for them, because what they’re looking for is something easier, that they don’t have to think about. How do you help the customer with this, and not necessarily for office to office, or office to data center, where that’s controlled, or remote user to office, but, like, external partner, external parties, to asset?
Roman: 26:03 Yeah, so that’s a good question, right. I mean, um, yeah, so this is where the customer success team comes in, right, and supports the customer with whatever challenge they have, given that we have many different customers, we can always go and see how have other customers solved the specific issue, and we can provide recommendations to the customers. So it’s kind of like a crowd intelligence that we can provide. Now, in this specific case, you say, it is an application which has to be accessed from the outside, let me make it simpler for you, let’s say the customer is a data center, and they’re hosting applications in their data center, you know, we can use a carrier neutral facility, right, that’s, it’s not their data center, somewhere else, right, and they need to have redundant internet connections to that data center.
Max: 27:07 Like, how much of that will you take on and manage for the customers? Is it something where they can say, okay, great, we’re just going to turn over the entire access layer and, you know, edge infrastructure to Open Systems, and you’re going to maintain, you know, we want, you know, two or three carriers, you know, circuits terminating into our data center?
Roman: 27:24 Yeah, we have what we call the connectivity as a service. So we have many customers which not only get the SASE platform from us, but they also get connectivity from us. So we basically act as an aggregator, and we can help them procure lines to a data center, but what we also do, and that’s very much especially here in the US, is we often work with partners, right, we work with other companies that focus on procuring lines, and we work very closely with them to help a customer to provide the underlay, the transport layer that they need. And then on top of that, we can provide a service that we call the internet line operation service, where if there is a problem, Open Systems can act on behalf of the customer to make sure this problem gets resolved, right. The most simple could be that a line goes down, and we have to figure out, okay, why did it go down, so we get in contact with the ISP and figure out why this problem occurred. Or we have an issue with the performance of a line, and then again, this is something that will be observed by Open Systems, we have SD-WAN in place to make sure there’s automatically a failover that happens, but then you still want to know, like, okay, is this issue still persisting, do we still have packet loss or an increased latency on a line, and this is then something that Open Systems again can, on behalf of the customer, get in contact with the ISP to solve these problems, right. And that’s a big headache for many of our customers, and they’re super happy that we take on this job.
Max: 29:26 So go from the actual physical transport to the actual operations of the redundancy, what I mean by that is, you know, if you’re in one, you know, that area, right, like, it’s going to be AT&T and Spectrum, right, or, you know, Zayo or Lumen or whatever combination, right, you know, customers decided they have two networks, the two networks have to go somewhere, and in the data center those two networks have to plug into a router that’s announcing IP addresses via BGP, or is proxying, you know, those connections through another gateway in order to have IP address persistence and inbound-outbound traffic in that environment, is Open Systems going to deploy routers and manage BGP for the customer, and take care of it, or is it that the customer has to go out and get their own routers and their own BGP, and then your SD-WAN goes behind the BGP routers? Like, that’s a relatively complex architecture, way more complex than just saying, hey, we have two circuits or three circuits that we need to maintain. It’s probably the most complex architecture you could have, is when you get into a data center and need redundancy and resiliency. But when we look at, okay, where do your boxes actually fit into these things, like, how much of that do you take on and take over?
Roman: 30:25 Yeah, yeah, I would say there’s two fundamental use cases. Use case number one, much simpler, is that you have applications at this data center which are used by your employees, right, and then it’s a perfect use case for SASE, and SD-WAN thereof, because it allows every user, wherever they are, to access these applications, and you can have the redundancy just with multiple lines, right. Now, the second use case, if you have applications that have to be accessed by the public, like via the internet, and so on, because that’s exactly when you need BGP, so that you have one IP towards the outside world, but actually multiple lines behind it. Now, Open Systems can help with that, but it’s definitely not our core focus anymore, I would say. We very much focus on SD-WAN and kind of BGP routing for inbound traffic, if you host, like, a web server or an FTP server that you mentioned before, right, this is a use case we can address, but typically we would want to consult the customer to move these applications to someone that actually specializes in hosting public facing applications, right. Now if that’s not possible, because it’s legacy, then it’s definitely something we can help the customer with, be it with the BGP routing, or the SD-WAN, to make sure we have the redundancy.
Max: 32:04 It’s not just legacy environments, right. You start talking about cost cycles and budgeting, you know, enterprise, a mid-5,000-person enterprise made a significant investment in firewalls already, right, and those firewall vendors are pushing their own SD-WAN, and that firewall vendor is pushing their own remote access, and usually that firewall vendor is also trying to push something else, like, here’s our EDR, here’s our XDR service, or here’s our fill in the blank. How do people migrate from what they currently are running into Open Systems? Actually, before I ask you that question, I’m going to ask you the other question, which is, what is the driving factor that forces somebody to decide to migrate from running their own stuff, or having and then to Open Systems? And then the second part is, how does this actually happen?
Roman: 32:46 Yeah, yeah, if we, let’s just take a time span of the last 10 years, right, if we look at what happened over the past 10 years, there has been a move to cloud applications, to cloud-like infrastructure as a service, software as a service, and so on, and the network that connected the users and these applications had to transform fundamentally, right. Now, some companies maybe had an MPLS, and then their first step was, let’s go from MPLS to ISP lines, or to a hybrid version, and we implement SD-WAN, then they did that, then they realized, oh, our location is now actually connected to the internet, so maybe we need a firewall to secure that, so then they got a firewall, then they realized, ah, our cloud proxy, that’s still in the data center, sorry, our proxy, secure web gateway, that’s still in the data center, means that every traffic has to be hair-pinned and then goes to all the SaaS applications, so really bad user experience. So then they said, let’s get a cloud proxy, and they had that. And then they said, oh, now we have all the users that are remote, let’s get some EDR, and so on. So what happened over the past 10 years is that many companies built the parts of SASE, but with, like, 15 different vendors, and the complexity is out of control, and their capability to operate that technology, it’s super, super difficult, and that’s where many companies are struggling with. And with that comes security issues, right. Many of the breaches we’ve seen in the past have occurred not because they don’t have the technology in place, but because it’s not configured correctly, or it wasn’t patched correctly, and so on. So these are really the fundamental issues that many companies are struggling with, and there’s these two different aspects, some people say, like, oh, I don’t want to have all my eggs in one basket, right, you want to have a single vendor that does everything for you, um, yes, go and put your eggs in different baskets, but how exactly do you make sure all these baskets are configured correctly and work correctly with each other? So I understand the risk that you could argue you add by going with a single vendor, but the risk of not doing it, I believe, is much greater, because of everything I just mentioned before, right.
Roman: 35:03 So that’s kind of the fundamental thing why customers are looking to move, why there is such a huge move in the market towards SASE.
Max: 35:32 As a CTNA, right, because of that complexity, sprawl, management, expertise, ongoing, everything. How do you train, how do you hire, how do you take vacations, um, how do you make sure that when something goes wrong at two o’clock in the morning that somebody’s actually looking at it that knows what the heck they’re doing, you know, those sorts of things. So, you know, which then takes us to the second part, which is, you’ve now got a massive deployment of infrastructure, how does this, I’ll say, I’m a rip-the-band-aid-off-quick kind of guy, like, after doing migrations for over two decades, like, it’s just, I have learned that for myself personally, I would rather just have a whole lot of pain condensed into a really short amount of time, because then at least the pain is done. And that just comes from experience of doing migrations where it was like every weekend for six months there was something that was going on, to try to limit the overall disruption, and I’m not really sure that actually saved anything in the long run. But I mean, what’s typical here, you know, you’ve got to ship equipment out to every location, you’re going to have to install software on every device, you’re going to have to, you know, coordinate with lots of different people in order to make these changes, like, how, you know, what happens, and what’s in staging? Can you, I mean, just, I guess we’ve signed this contract now, we’ve decided to do it, we’re going to talk to a CSM, they’re going to get engaged, we’re going to start talking about architecture and start planning these things out, what is that actually, you know, like, what should be expected, is typical, I guess?
Roman: 37:04 Yeah, this is an absolute critical question, and, we believe a strong differentiator of Open Systems, when you go, like, let’s take that example of a company with 5,000 users, and they probably have, like, 50 or 100 locations worldwide, this is not a small venture, right, but it’s also not as hard as some may think. Now, we understand that there is not a greenfield, so there is lines already in place, there is technology already in place, right. So in the beginning, we have to figure out, what can we do now to start reducing that complexity, and what do we have to do maybe in a phase two or three to really kill that complexity that you have, because the worst thing is, you bring in Open Systems, but you keep, like, half of the other stuff you have, then you haven’t achieved anything, like, you still have, I don’t know how many, but you maybe have different contract end dates. So we’re not going to say, like, oh, if you have your proxy in place, we don’t force anyone to use ours, right. If they still have it, then fair enough, we disregard that portion for now, but then once it comes up, maybe a year later, we have the box in place, the service can just be turned on, and all is good.
Max: 38:26 Isn’t that kind of counter-intuitive to the actual end goal, though? I mean, if you’ve got all these legacy point solutions that are out there running, I mean, is Open Systems then taking it on and saying, okay, you’ve got this existing proxy that’s running out for the next year, and you know, your reaction is basically what I would have expected, of like, nope, but then at the same time, you know, if the customer is trying to get away from complexity, you know, saying, oh, we’re not going to activate this functionality in our infrastructure, which would become your web proxy, and you’re going to still run your own web proxy, which has all these negative things going on with it, because you’ve got this investment in this web proxy, like, I get that too, from a budgeting and financial risk standpoint, but like, at some point, doesn’t that actually kind of work against the goal that the customers probably started this whole thing in the first place for?
Roman: 39:20 Yes, no, I’m 100% agree with you. Um, that the thing is, we have to, if the customer believes in the end goal, right, there is different ways of how to get to this end goal, and unfortunately it comes down to a budgeting issue. If the customer has invested in something already, and it has another year on it, the customers, many customers are reluctant to just say, like, oh, let’s turn that off, or to say, oh, let’s pay Open Systems for this same service as well, and then we have double spending. Now this is where obviously we try to work with customers, because our goal is to get them to a full stack Open Systems service, and not have the complexity that they have before, so that’s our obvious end goal, but yeah, we have to understand that some customers have made these investments, they don’t want to have double spending, and it takes time, right. These can be projects which take longer. Having that said, um, I have had many projects where the customers started, and they were just looking for SD-WAN, for example, they said, oh yeah, we need SD-WAN, and then we have the conversations with them, and they, through that process, through the sales process, they started to realize, maybe it makes sense to actually kill our own firewalls and put that onto Open Systems as well, and the secure web gateway and so on. And it’s a process, right, and we help them along this process, and sometimes we can be quicker with the migration to reduce that complexity and get to the brave new world, and sometimes it takes a little longer for various reasons, and sometimes it’s just budget, right. But it’s definitely not the end goal, and that’s never, like, Open Systems is never, we would never engage with the customer and say, like, oh, let’s just do 10% of what we can do for you, I don’t think we are the right fit for that, and we want to be transparent about that. But if a customer has the vision, and we can actually help the customer to see that vision, then we are absolutely the right fit to take them on that journey and help them transition.
Max: 41:01 You’ve got somewhere between zero and probably three years of staged, you know, contracts and terms and support and renewals and life cycle that have to be worked through, just from a contractual term standpoint, and then you start looking at like depreciation, you know, within budgeting, I mean, so that also then becomes a consideration when you start talking deployments, right. You know, migrations can be, we’re going to do location at a time, which, this is again why I turn into like, maybe rip the band-aid off, you know, kind of personality comes out quickly, because, you know, if you’re going to change, if you’ve got 100 locations and you’re going to change that location out, that location has VPNs and connectivity and things going on with everything else in the infrastructure. Okay, so you’re going to do a hundred, and then you’ve got this matrix, right? You look at it, you say, okay, you know, it may be, in the best case scenario, the location only talks to like a hub, or a central location, or a cloud, right, say even a central office, you’ve got a secondary office typically, and you’ve got some kind of cloud environment, so you’ve got three endpoints for each remote location. And then you probably have, like, two circuits, or redundant pathways or whatever, so that’s six, so then you’ve got, you know, six connections times a hundred locations that you want to update. So you’re going to do 600 reconfigurations over the course of that project, if you do site by site by site down that path. And you take a step back, you’re like, okay, this is nuts, we shouldn’t do this, if a company is saying, we want to go to a single vendor, and, you know, in theory, we want, like, best in breed, and we’re going to use, you know, the best in definition from, you know, fill in the blank anonymous, you know, analyst company that, for, you know, we trust that this is actually going to give us good information, major manufacturer that’s public here A, and major manufacturer’s public here B, and then, like, you know, build out some kind of, like, RFP process or comparison chart, or, like, you know, Chinese menu in Excel, even though it’s probably not all accurate, because, you know, everybody’s telling you the truth always about what their stuff really does, how does Open Systems then get into that process of evaluation? Like, how does somebody make a concerted evaluation of, you know, your underlying functionality and feature set, versus, you know, this public data set that we already have, like, we’re already running this box, or we’re evaluating this other box, and, you know, here’s the whatever report on this box, we don’t want to run boxes anymore?
Roman: 43:44 And, you know, it’s definitely a challenge that you have, as a Swiss based company which hasn’t been in the US for that long, and has not the same name recognition as the big players, right, so that’s definitely something that we struggle with in sales. I believe that when you have a conversation with the customer, there is almost no one that would disagree with the fact that if you have many different players, and they somehow have to work together, like technologies that, that adds complexity, like there’s almost no one out there, and every media article, and even the big, like companies, they say that, right. So the question is, if I, I mean, we see that, that someone says, like, oh, yeah, we want to have firewalls and proxies and SD-WAN and so on from different vendors, or best of breed, but if you have a conversation, an open and honest conversation, and you ask, like, okay, what is the underlying use case that you try to solve here, then you will ultimately arrive at the same conclusion that building it yourself, with many different vendors, is not going to reduce the complexity, it’s going to increase the complexity, it’s going to introduce additional risk, it’s ultimately not going to solve your goal of making sure your users and applications are connected in an efficient and secure manner. And through that process, many customers arrive with us at the conclusion that, oh yeah, it actually makes sense to go to a single vendor SASE platform and get it as a managed service, right.
Max: 45:43 I find that CIO, CTO, like, the executive level, really likes the idea and concept behind going to a managed services provider, and these things, you know, you can take a lot of different things behind it, but just the underlying, I know this company is going to exist for a long period of time, and I don’t have to worry about staffing churn, you know, that’s one of the things that comes with this. That’s a, and, of course, you get on the other side of it, like, where there’s an SLA, and financial penalties, and I have somebody I can sue, you know, like, you know, that has resources, insurance, and assets behind it. IT teams themselves look at MSPs and might say, okay, I’m still responsible for this, but now I’ve got this other layer here in order to get my job done that I don’t like. And some people answer this with, like, co-managed infrastructure, where, you know, the IT team still has access to the admin consoles, they can make changes to it, and can be self-sufficient for them to have this, like, resource that they can go use if necessary. How does Open Systems address this, is this a black box to the IT teams, is this, you know, something where they can go in and log into a portal and tweak knobs, is this, you know, are you restricted to how far that can go, are you there to provide, you know, guardrails and training wheels, or is it just, you know, free-for-all? Like, what’s the philosophy of interactivity between you and the technical teams?
Roman: 47:00 Yeah, I know, that’s a really important part. I myself, I’m an engineer by trade, so if I put myself in the shoes of our customers, into the IT personnel, I would be reluctant to go and work with a managed service provider, because, are they going to take my job, or am I going to be obsolete, or what am I going to do? So these are concerns that we are confronted with many times, but it’s a very simple thing to address, we have a customer portal, so we have a very open box approach, Open Systems, so maybe that’s where it’s coming from, a very open box approach. The customer portal gives our customers full visibility into the status of the box, into the configuration of the box, into the statistics, we offer a wide variety of tools that can be used by the IT team if they want to do their own debugging and so on, right, so that’s very, that’s 100% transparent, and it is offered through a portal. And we just, like, what I do when I’m confronted with IT personnel, then we just show a portal, and everyone’s like, oh, that’s pretty cool, that’s actually nice.
Max: 48:23 What they get to see on the other side, there’s definitely a trend, I mean, you go to a supermarket, there’s not a checkout anymore, there’s now, you have self-checkout, right? Yeah, but there’s one reason why you want to use self-checkout, maybe there’s a huge line on the other side. So when we talk about self-managed, co-managed, fully managed, right, I would also say—
Roman: 48:41 Open Systems fall somewhere in that co-managed space, because there’s many things that the customer wants to change, where we would never be able to add any value. I give you an example, the customer has a new application, or needs to adjust the firewall, right, there, the customer just tells us what to do, and we implement it, there’s not really a lot of value we can add. So we want to make sure that more and more of these straightforward changes can be done by the customer themselves, be it adjusting whitelists, like exclusion lists on the secure web gateway, or on the threat protection, and so on. So these are things we want to offer to the customer in a self-managed manner. But then there is a lot of things which are way more complex, so what I mentioned before, the entire patching process, right, we don’t tell our customers, you have to patch our boxes, that’s a process that we do, we do it ridiculously efficient, because we have, like, 10,000 of these boxes deployed around the world, and we basically need one push of a button, and we can deploy to all our boxes if we need to. So these are things that we can take away, and I strongly believe that anyone in IT in 2023 would have a very hard time justifying their job, if the only thing they’re doing is like patching or monitoring, all of that, right, because that, again, as I mentioned before, doesn’t really add value. As an IT person, I would want to make sure that I add value to the company and to the success of the company, and that comes from moving, or bringing the company forward in their IT strategy, and that’s what we allow them to do, because we take away all that stupid stuff, the ridiculous stuff that no one wants to do, we take it away for them, we make sure the boxes are up to date, we make sure they’re monitored, if something breaks, we replace it, right, that’s part of the service. If there’s an incident, we take care of that incident, we only involve the customer if we have to, so they can really focus on what’s important, what’s business relevant, and the rest is on our side, they have full visibility, they can do changes themselves if they have to, they have all the tools if they need to do debugging. And with that approach, we almost immediately turn everyone that’s against a managed service from Open Systems into a fan, very quickly.
Max: 51:16 You mentioned, you talk about the ability to turn things on or not use them selectively based on existing point solutions that are there, but you are replacing a lot of different stuff, right. So you’re talking about replacing SD-WAN, you’re talking about replacing a firewall, you’re talking about replacing secure web gateway, ZTNA function, you know, it sounds like threat intelligence probably fits into that as well, to some degree, you know, then that would also mean that you guys would have to have, you know, CASB functionality. How granular, how, first off, like, how do you, at a high level, how do you actually price this, and what does that look like, is this, like, oh, you’ve got, like, 12 vested WAN boxes, times this size, equals, you know, like, what are those things? So from a pricing perspective—
Roman: 51:56 Um, I mean, I’ve, I’m with the company for nine years, and I think we have gone through a couple iterations when it comes to how we price our service, but we got to a pricing model that’s very simple, it’s based on how many users you have. The two of us, we’re two users, um, kind of like warm bodies, I personally have multiple devices, that doesn’t really matter, right, I have a laptop, I have an iPad, I have an iPhone, so multiple devices, but it’s Roman is one user, and Max would be another user, and that’s how we price our service. We need to understand, okay, if you have physical locations, how many people are at these locations, what kind of connectivity we have, what kind of throughput we expect, so that we can size the boxes accordingly. But then, again, the price is per user, so very straightforward. And then when it comes to, okay, what is the actual price, it depends on the services you want to consume, right, we have bundles, you can go very small to start, because again, there’s only budget to replace one component, but the idea is, there, to within a year or two, to replace all of it, so it’s kind of like a salami tactic. But then you would have a smaller per-user cost if you just use a few services, and if you use more services, then your per-user price is higher.
Max: 53:24 So compared to Palo Alto or Fortinet, a company is going to look at this, and, you know, I mean, you’re going to take care of it for them, so they’re not out in the market shopping for a VAR to buy it, they’re not looking for an MSP to operate it, right, this, they’ve come to you, you’re doing everything for them, it’s your equipment, you’re managing it, you’re shipping it out, you’re supporting it, you’re patching it, you’re updating it, you’re replacing it, you know, they don’t have to deal with any of that. And then when they look at the bill, is this something where they’re going to look at it and say, oh my goodness, this is, why are you guys so cheap? Like, how, you know, like, how much of, you know, a pricing disparity between, you know, existing state and your state, you know, really comes into this factor, are you trying to, are you trying to, you know, are you guys maximizing this market, in line with Palo Alto and a Cisco and a Fortinet, and, you know, fill in all the rest of the blanks, I’m just going to use those three because they’re the big ones, or is this something where, you know, by the time they’re done and everything is said and done, they look at this, this is a, you know, look, we’re going to reclaim a lot of budget here for you guys to go and do other things with?
Roman: 54:32 Yeah, yeah, I think, I mean, return on investment is key for everyone, right, and this is something we many times have to help a CIO to make the case internally, to the CFO and CEO, for example. A challenge that we sometimes run into is that we compare apples and bananas, right, the classic, if you just get our technology or our service, it’s going to be more expensive if you just buy plain boxes, so that’s not the business case, right. The business case is really to compare, okay, what does it cost if I buy the boxes, and then I need, for example, an MSP to run it, I need to replace the boxes, and so on. So that’s something where we can help the customers, but if you do that calculation correctly, then, in many cases, we are cheaper.
Max: 55:20 Companies need to be really happy with you to keep you around for, you know, that kind of longevity, I mean, just internal executive team turnover is a lot, you’re probably on your second or third CIO in that span of time easily, right?
Roman: 55:31 Yeah, maybe.
Max: 55:32 Okay, so Roman, we’ve been going at this for a little while, let me do this, final words, give me your best kind of commercial, right. So somebody watching this, you know, and they’re only going to get and consume, you know, the next 45, 60 seconds’ worth of content, you know, what, how, what’s your, I don’t say elevator pitch, I hate elevator pitch, but you know what I mean, like, yeah, wrap this up.
Roman: 55:58 I would say if you’re a company that has users that are anywhere, because pandemic, or even before, and you have different types of locations, and then you have applications which are anywhere, and you have to make sure that, you ask the IT leader, or your team, can sleep at night, and every user around the world can work and do their job, if you’re looking for something like that, then I believe Open Systems is a great fit. We can help, really, from the beginning, from the architecture to the operations of the entire stack, to make sure your users are happy using the applications they need for their daily job.
Max: 56:37 I think keeping your users happy is probably exactly the line that you want to end with. Roman, thank you very much for your time, I appreciate it, this was fantastic, and I hope that I get to see you more and more, although I’m probably going to always butcher your last name every single time I do it, it’s just, I can’t, I’m sorry, I’m just, happy that in the US we are on a first name basis, much easier than if you go to Austria or Germany, where it’s the last name, and even titles, sometimes.
Roman: 57:04 So, yeah, very different cultures. Thanks a lot for the opportunity.
Max: 57:10 Thank you, Roman, thank you very much.
