They went to bed on Wednesday. On Thursday morning they woke up — there was no company. This is a watershed event in cybersecurity that should not be underestimated. The attackers are not human beings anymore; they are machines. This is what we are actually facing with Molotov and the frontier models.
Sixty percent of enterprises are going to start moving to SASE in the next three years. SASE is the future of network security. Seven years from now we are not going to see that many appliances. The right SASE platforms that are built on top of a platform are going to benefit greatly from that. But now they are faced with implementing it on 5,000 appliances. Good luck to them.
Welcome to Fishing for Insight, our cybersecurity strategy and business show on Risk Intel Media. I'm very happy to have you with us. You're something of a legend in the cybersecurity industry. You created three unicorns: Check Point Software Technologies in 1993, Imperva in 2022, and Cato Networks in 2015. And each time you successfully anticipated where the market was heading. Well, this is impressive to see.
Yes. I've been fortunate. I've been doing startups since I was 16, even before the PC. So it's now 44 years, and that's what I love doing. That's been my life, and luckily I've been successful a number of times.
Yeah, and it shows. So, we're going to start with something that is a little bit painful for people like you who love cybersecurity and want to go into depth for every question. Because I'm going to ask you a series of questions and you only have three answers: either it's true, probably, or false. It's hard.
Yeah. We'll see. At least you gave me probably. At least we're nice here. So let's start with the first one: Anthropic and OpenAI will replace all cybersecurity companies and wipe out the market.
Oh. Cybersecurity solutions are too many.
Geopolitics leads to cyber risks.
All non-full cloud companies are destined to disappear in the near future.
Cybercrime has never been easier.
Okay. So let's start with the interview. Let's start with — for example, our audience — explain exactly what is SASE and why it emerged in the cybersecurity industry.
SASE is the future of network security. Security has a few big pillars: endpoint security — CrowdStrike — cloud security — say Wiz — and network security. And network security has been traditionally — it started at Check Point with software, with Palo Alto Networks as appliances, and with Cato as a cloud service. And cloud service is the form factor of network security for the future, because organizations are now everywhere, people and agents are everywhere, applications are everywhere. The appliance physical form doesn't cut it anymore. You need a much more fluid form factor, and that's SASE.
And it's something that the market needed, all right?
Absolutely. In 2019, Gartner picked up on what we started in 2015 and said, you know, this is the future of network security. This is what the market needs. And actually, recently said that 60% of enterprises are going to move to — start moving to SASE in the next three years. I believe personally that seven years from now we are not going to see that many appliances. They are disappearing just as software firewalls disappeared 20 years ago — extinct. And SASE is going to replace that.
Okay. So, we said it in the start of this interview — you have a very rich experience in cybersecurity, around 40 years. So what was the worst cyber attack that you had seen in your career? And if you had the chance to go back, what would you change about the way you handled it?
I would say that the most impactful vulnerability that I've experienced in recent years was Log4j, which — with one vulnerability that was published as a CVE pretty quickly — everybody on the planet was impacted. And that really revealed the weakness in security. Even today, four or five years later, many organizations are still vulnerable to that. And that window of opportunity between CVE and protection is something that we can't afford anymore, because the attackers are not human beings anymore — they are machines. And machines — we need to close that window to zero, otherwise you'll get compromised. And we'll talk hopefully more about that in the future.
And is it possible to close it to zero?
Yes. For example, Cato protected all of its customers in less than 17 hours. Today we would have done it in even less time, because we have agentic researchers that are able to take the CVE, automatically create protection, put it in the cloud, silently test it, and then fine-tune it and deploy it to all customers. Now, imagine a customer of an appliance company — they have 5,000 appliances all over the world. They get — a week after — there's one appliance company that just happened — the week after the CVE was published, they get a security solution. But now they are faced with implementing it on 5,000 appliances. Good luck to them. It's going to take months. And those months are not only an operational burden on them, but essentially a huge security issue in this new world that we are facing. And we are in a historical moment in security, where the attack is done by machines.
And to go back to the worst cyber attack you lived, which is Log4j — would you have changed something if you were able to go back, or you think you handled it the best you could at the time?
I think Cato did a great job. I think we hold the world record, actually, in time to implement a protection. Since then, we've prepared ourselves to a world where Log4j doesn't happen — it's the worst attack, but it's the everyday attack. Like every day you're going to get Log4j. What are you going to do as an enterprise? This is what we are actually facing with Molotov and the frontier models.
Now we're going to go into depth on this question. But first — so I understand that Cato Networks operates its own global network infrastructure that is spread across the world. Why is it so important — I might even say critical — to own its own infrastructure?
There are multiple reasons for that. First, we want to delight the customers. Many of our customers have locations in smaller countries — in Peru, in West China, in New Zealand — all over the world. And we want to be responsive, and we can spin up a POP there very, very quickly. While if you rely on the large hyperscalers, they have a few big data center nodes around the world and can't provide that service. Second, we can better engineer the network. For example, we just recently added GPUs — Nvidia GPUs — to all of our network in order to deliver AI at the edge, AI security at the edge. If you rely on third-party networks, you can't do that. And third, it's much less expensive for us, and we can roll that to customer value.
And what are the challenges to handle at both times the software platform and physical infrastructure?
So this is the core capability that Cato brings. It brings both the networking capability and the security capability, but more than that — the combination. The combination has been the holy grail of network security since — I'm dating myself — since the early '90s, when Cisco came out with their networking devices and Check Point came out with their network security, and Cisco said, 'Hey, let's put it together.' And there were attempts throughout these 35 years to do that, all of them failed, until Cato was successful in doing that. A lot of our IP goes into how do you provide a self-healing, AI-driven cloud network that delivers robustness on the network side but the dynamics of a security solution. So it's very difficult, and that's why we are the only company in the world that has done it.
So, you were talking about Molotov — the AI of Anthropic — and obviously we're going to talk about it because it spread a lot of fears into the cybersecurity community. From what we heard, it promises to unveil and uncover a certain number of vulnerabilities. Some experts even say it's a tsunami of vulnerabilities to come. What do you think about it?
I think this is a watershed event in cybersecurity that should not be underestimated. But it shouldn't be tied to Molotov, because it's not just Molotov. It's Molotov, it's Daybreak, it's the open-source Chinese models that, based on people within Anthropic, are only four months behind them. So, Molotov or no Molotov, this is coming. A month or two ago the Mexican government was hit by a huge agentic attack that stole lots of data — a very successful attack, unfortunately. So this is coming, and we need to look at it in a broader way as a complete revolution of the threat landscape, and it requires a refactoring of the security threat defenses. And I can talk a little bit about what is the refactoring that is needed.
