Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners
Moderator: Alan Murray, FORTUNE


Brainstorm Tech 2022: Meet The New Cyber Defenders

Conferences

Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners
Moderator: Alan Murray, FORTUNE
Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners



this is, you know, if you think about what's happened since we last gathered in aspen three years ago, you had incredible acceleration of digitization, you had everything moved to the cloud, you had this incredible moment where everybody went home and they took their computers with, with them and insisted they be able to access all of their data from their kitchen at all times. And then on top of that, a geopolitical crisis. So cybersecurity, the risk has obviously expanded greatly. Uh, and I'm pretty sure if there's one industry that is now, surely recession proof it is this one. So I'm delighted to have this panel, Merav Bahat, uh, is the Ceo of Daz assaf Rappaport is the ceo of whiz, we'll ask them why the preference for double Z's. Well, actually, you only have one Z, z's generally a preference and, and Stephen Ward is an investor in both, Uh, with inside partners. So Steven, let me start with you. What I mean is this, it's like the 4th of July and you sell fireworks, right, this is uh, cyber is a great place to invest right now because of the risk. It is, and I mean, I've spent 20 years as an operator, You know defending networks of Fortune 100. So I've been on that side for a long time, only been an investor for the past year. So it's, it's nice to be in an industry where you can take those experiences and apply them to the investment side, um, talk to sisters all the time and the demand is not going anywhere. Companies need to be protected And unfortunately there's assailants out there who are constantly trying to break in. You mentioned the global economic, you know, the situation that we're in with Russia and Ukraine and unfortunately large corporations get caught in the middle of that. Sometimes their targets, sometimes they get caught in the middle of it. So when you see an increase of attacks and you see, especially when wars are a combination of physical wars and digital wars, um, you know, companies like Wiz and as you are needed in order to protect these enterprises. Well, let's talk about both of them. You worked with Merav in a previous life, correct? So actually, both I met both of them when I was an operator when I was a C so at home depot, that's when we originally met and that carried over into the investment side, interesting. So you had some history with them. So tell us, tell us about your company. Um, so does is about security remediation, um, where you know, moving fast to the cloud and security in general has kind of two steps. Um, first is detect issues, understand, you know, your environment, your risk, your posture. And the second step is to fix those things. But what happened with the fast move to the cloud as you just, uh, you know, shared with us is that, you know, people in organizations has the tons of security depth and it means that when we come into an organization, they have, they could have six millions alerts or five million alert that hasn't been addressed. So to help this organization fix them fast, which means collaboration between security and depth which creating this responsible for this alert. This is what we do. So the problem you're trying to solve is the fact that there are so many alerts going on. Companies can't react fast enough. And how about wiz, so so kind of before of that if you think about the cloud, the security debt that's rushing through the cloud and we definitely saw it like accelerated during Covid, I think basically how do you realize what, what is the risk in front of you think about it that for example, they know they're great practitioners in insecurity but in order to solve cloud problems and we're talking about when we're saying cloud is not one cloud going to be multiple, it's gonna be Azure AWS G C P and multiple others and it's different technology stacks. Super complex problem. So the problem is basically how do you bring the best of the security to the death and the devops and that's kind of how do you mitigate the risk of that? So that's kind of the kind of, we're complimenting each other, we have mutual customers that were fun working together. So you find yourselves working with a lot of the same customers Stephen one of the, one of the things that that raises, I mean you listen to Morocco and I've talked about this. It's a much more complex environment for for security csos companies, those companies than it was before. Um uh but it also is a complex response I mean so I have to hire whiz I have to hire dot how many different solutions Do I have to have to protect myself against cyber attack? I mean how do you deal with the, just the sheer complexity of the problem? Yeah, the last place I was at Fortune 14 Um I had 71 security solutions but we had three data centers. We were in multi cloud like a soft said so I think what people sometimes forget is it's not just additional complexity. The scale is much bigger. You're replicating these data centers in the old days, you would have one data center that was brick and mortar, maybe you had to as a backup. Well now sometimes you have two centers And then you also have 2-3 different cloud environments. The scale is so much bigger now. Um and then on top of it, these cloud environments, once you get in, they're very similar So to hack into a one Fortune 100 or a Fortune 200. Those environments can be very different like those traditional on prem environment you get into cloud environments, they're all sort of built the same in a lot of ways, which means Attackers can spread so much more quickly, which means you have to identify those things faster and then you have to identify response by the way? None of you have used the word prevent. I mean it's prevention gone or is that just not the issue anymore? No, not not at all. Actually actually this is kind of the movie because things are happening so fast in the cloud and the ability of the Attackers to, to, you know, to get to rule the kind of environment is happening sometimes in seconds, you know, kind of prevention and the and is super important and that's kind of where shift left is coming like hey, how can we protect? How can hey, I know now the image of the cloud that I have and I know what changes are gonna happen by the develops or the developers themselves, how can I mitigate it before it happens And this is a crucial part of the process of protection. Yeah, there's another just to add another thing here. So prevention is always important. Everything we do is to prevent eventually. But when you look at incidents like look for share, I don't know, you know, it's like uh probably not, not, not, not all of you aware of that, but that was a big incident. Everybody who has clouds and you know, they have environments were kind of panicked about it. It was a couple of days before christmas and uh, it was nobody's fault. You couldn't prevent it in with any tooling, right? It's, it's an open source kind of some, some kind of library everybody uses. Right? So the thing here is how do you detect it fast and how do you immediately Fast? That's a different mindset in Southeast critical piece. Well, let's talk about the geo politics of this a little bit. I mean, I would have thought in february when when Russia marched in Ukraine that the countries that were supporting Ukraine would be in danger of greatly increased cyber attacks orchestrated by Russia. But we don't seem to have seen that at least if we have, I'm not aware of it. I mean, are you surprised? Why haven't we seen it? Is it still coming? How would you think there's an, there's an uptick right now? Most of it was between Russia and Ukraine. Like there were some major cyberattacks between them. Um, as NATO becomes more and more popular out there, you're seeing some of the other attacks occur on other european countries. But I think one really cool thing to think about is the level of sophistication didn't go up. It actually went down and what we realize is back in the day when Russia would use other sources in other countries to attack. A lot of those resources came from Ukraine, a lot of the really talented hackers were in Ukraine, but when they split and had this war, those Ukrainians basically said, we're not gonna do this, we're going to put all our resources into Russia. So what Russia has really done over the past 3 to 6 months hasn't been that sophisticated, we've been a little surprised the volume is still there. But the sophistication hasn't gone up. So there is an argument that Ukraine had actually had more talent from a cybersecurity standpoint than Russia did. I think just to add to that, maybe the the other side not seeing it doesn't mean it doesn't exist and that's that's important. You know, and we need to remember this cyber weapon and you know, you know, to a decision of Russia or any nation to attack another nation. We didn't see that. We saw it in the in the past, we saw it between actually Ukraine and Russia even not this year even in the past years before, but it's something that we don't know how nations going to react to that. So it's truly a weapon. The capabilities are there. We know that we saw the Russian, the Russian, the Russian the chinese, the Iranian capabilities in the world in action. And they're pretty, you know, sophisticated in a way, I've heard some national security experts say one scenario is that Putin gets frustrated in Ukraine and he wants to escalate his options are nuclear chemical cyber cyber is likely to be the go to option. Yeah. I mean, we've seen him uses this kind of Russia uses this kind of, you know, cyber attacks as the weapon right already. But I think that, you know, I think that is going to create some chaos chaos, I think it's we're gonna see, I think it's too early to say as a staff set against not seeing, it doesn't mean it doesn't exist by the way, you two both have national security backgrounds, right? That's the reason there's so many Israeli companies in cybersecurity. Yeah, I think the 828,200, basically the Israeli N. S. A I would say 80% of the entrepreneurs are coming from there, so we tend to have a bias Towards security, that's what we've done in 80 200. So I guess you'll see more more bias in the Israeli ecosystem for startups, for security and yeah, I think, I just add, I mean there's also the, you know, multinationals that coming to Israel and actually have acquired companies, I think that gives um you know, the founders from the 1st 1st start, you know, the, you know, the the 1st 1st timers actually to build um products to scale in scale and the ability to actually grow faster and bigger. And I think that why we see the next generation of companies out of Israel that are actually growing and not just selling after, you know, a couple of months and a great number by the way to hold on to is In 2021 VCS invested 8.8 billion into Israel that was tripled from the previous year, so a lot of money and how much of that was cyber related, do you think? I don't know how much of it was cyber um I do, I mean us personally as insight, we're the largest investor in Israel um specifically to cyber and then overall software, so we're pretty bullish on 80 280 100. And the talent that they produce in the ecosystem, they have their Is incredible being a government guy and and doing 12 years in the government here in the us. I'm, I'm envious and I'm also irritated over it because I want us to have that every time I go there, I'm meeting with folks saying, well, how do you do it? And how do we replicate it? Very, very difficult to replicate steven. What's the endgame here, the business end game now moving away from national security. But you know, if I were that, uh If I were in your shoes and had to buy 71 different security solutions, I'd say this is crazy. I mean, does that lead, is there going to be a roll up to these companies? The Daz and whiz get bought up by bigger companies where clearly there has to be some consolidation here. Where do you think that goes from here? I think it's all, look, there's just in the past three or four months and this happens every time there's sort of an economic tightening on these large enterprises, the csos will turn around and go, okay, we're gonna slow down a little bit. Our budgets are going to keep going up, but we're gonna slow down and look for efficiency for synergies between technologies. So they may turn and go, hey, I really want whiz and dad to work seamlessly in the environment, Some will turn and say, I'm gonna buy one new one to rip out three and there will be a rip and replace, um, hands down. Cyber needs to roll up. Like, uh, you know, being new to the VC world. I came in and said, I want to combine these three companies and make one and it was extremely naive of me to think that that's easy. Works that easy. Yeah, egos are usually didn't say just do it. You know, we already know they're gonna be too big for each other pretty soon. Um, yes, there needs to be a roll up. Um, and I think the tightening and where we are right now and the slowdown in investing. I think that will organically occur, um, over the next year. Well, it's going to be a fascinating area to watch. Thank you both for making the long trip here. Thank you, Stephen for putting in some perspective. Great to have you on the brainstorm tech stage