Protecting data isn’t optional: What frustrates CIOs and CISOs?

In this podcast recorded at RSA Conference 2017, Chris Drake, CEO at Armor, talks about the frustration that he sees in the cybersecurity industry as he continues to meet CIOs and CISOs in the field.

Here’s a transcript of the podcast for your convenience.

This is Chris Drake. I am the founder and the CEO of Armor. You can find more about us at armor.com. I just wanted to have a conversation with you about just the frustration that I see in the cybersecurity industry as I continue to meet CIOs and CISOs in the field.

As you know, the dwell time ratios is not getting any better – we’re about 150 days. And as a reminder, dwell time is the amount of time a hacker is on a customer environment to the amount of time they get removed from that environment. And I think we can all agree that 150 days is pretty poor. Companies are spending a lot of money trying to solve that. 75 billion dollars were spent last year in cybersecurity trying to solve that, and all we have to show for it is a 150 days dwell time.

And so, the CIOs I’m seeing are growing a sense of frustration. I actually spoke with a CISO for a major healthcare organization that said, ‘Chris, I’m extremely frustrated. I’ve spent so much money on cybersecurity, I have 15 million dollars plus cybersecurity annual budget, I followed all the compliance requirements, and I continue to get hacked. And my organizations has to write big checks because of it. I’m just thinking about throwing my hands up and just buying cyber insurance.’ And that’s how frustrated the CIOs and the CISOs are starting to get, where they’re just, basically, giving up and buying insurance. And I just don’t think that’s right.

If I look at why is that a problem and I look at what the cybersecurity vendors are doing, I think we, as a cybersecurity market have not provided the solutions that CIOs and CISOs needed. As I look at what the CIOs and CISOs kind of go to the market and try solve for, you know, there are thousands and thousands of cybersecurity companies saying very confusing messages, overlapping on capabilities, and they’re all single point solutions.

A CISO has to identify what point solutions do they actually need, which one is the best, and then try to get them to all work together. And that’s pretty damn challenging. If they didn’t decide to do that, they said, ‘That’s too much of a learning curve and it’s too costly’, then they go the managed security service provider route, which is a common route that CISOs do, the MSSPs. And what’s their options there? The MSSPs are generally 80% revenue, focused on selling technology. The MSSPs, because every customer to them is unique, they’re basically a snowflake, MSSPs really have built no software model to integrate and orchestrate all the security tools that they sell them. And it’s not cost effective for them to build that on a one op per customer, because a customer would never pay for it.

Gere you have organizations that are trying to solve these cybersecurity challenges with plethora of security tools that are all point solutions and not integrated, they have to have a learning curve on each to the MSSP market who is trying to sell those tools, but have no orchestration automation either. Because of that, you can see where the obvious gaps are with the CISOs and the CIOs security strategy, and why a 150 days of dwell time exists.

I found that incredibly frustrating, which is why I founded Armor. And so, Armor takes the tool selection away from the customer and says, ‘We will select the best technology, we automate and orchestrate it, because we’ve standardized on the toolsets so we don’t have to automate every single firewall vendor out there, every single antimalware vendor out there, because we’ve selected the best point solutions we got on a scale. And so, we can write software against it.’ And it’s all integrated and orchestrated where a customer can get the value of a really tight security stack. We deliver that as a service in third party clouds or in our own cloud. And we think that’s really the way to solve the problem.

I’m not blaming the security vendors for their point solutions, I’m not blaming the MSSPs because every customer is a snowflake; they’re just hard challenges, and it really takes a solution security provider like Armor to kind of tie all this together and actually provide it to CIOs and CISOs.

So we’re doing our best to get the word out. And I just ask all the CIOs or CISOs who are listening to this message, don’t give up and put your hand up and say, ‘That’s it’, and go out and buy cyber insurance. You may need cyber insurance anyway, but definitely consider a solution like Armor as an alternative.