Tanium CEO Orion Hindawi on Cybersecurity and the Shifting IT Landscape | Technovation 562

Thank you for having me.

Sure. So we started the company with the basic thesis that very large companies, Fortune 500, large global big enterprise environments, either in government or on the commercial side, really have a lot of compute. Cloud, IoT, OT, all these fun things that they've got. They don't know how many of them they have. They often don't know where they are, what they're doing, who's using them, what data's on them, what vulnerabilities they have. They really have very sparse data about what they're trying to manage from a compute standpoint. And in addition to that, they've got tons and tons of little tools that are supposed to do that for them. So in many cases, they've got 20 or 30 or sometimes even 50 tools that are designed to give them visibility on their IT assets, and yet the visibility is really pretty fractured and untrustworthy. So what we've built is a platform that lets you see everything you've got with a chip in it, and fix it. It's a really broad set of things that they want to fix, but really kind of finding and fixing within the IT stack and having a system of record that they trust about all the things with chips in them. I think that's becoming incredibly critical, especially in work from anywhere, but frankly, even before that, it was super critical for almost every company we talk to.

Yeah, the friendly federal governments, you look at financial services, healthcare to some extent. They were really kind of on the vanguard of this because even then you could not run financial services in any reasonable way without having IT be the principal element of that. But what we've found in the last 10 years is that everybody has come along. So if you're running retail environments, manufacturing environments, state and local governments, you start thinking about education. They all have become so dependent on their IT environment to do basic functioning that there's just no room anymore for mediocre operations or security. You have to be great at this, or it almost doesn't matter what you do.

So I mean, the first top line learning actually that was super interesting was watching people do things they said were going to take years or sometimes decades in like days. So it's actually fascinating to watch an IT team get called by the CEO and the board and you have to go and send everybody home. And I think a lot of IT teams, you know, things that you could access by cloud that historically had never been cloud enabled in days. And I think that actually gave a lot of IT teams the confidence that they could do things they didn't believe they could do. It was amazing to watch. The second one was the network is just not the right place to do anything anymore. So a lot of people went to work from home. Whether you use a VPN or you don't, it's not the same from an enforcement standpoint as it used to be when you had everybody in the office. And so this investment that people had made in understanding their network, in managing their network and managing problems through their network, basically overnight disappeared. And that forced a lot of rethinking in both security but also in the way that people are thinking about how they want to architect their environment. And the third one I would say is we learned that all of the hygiene issues that we'd kind of let lapse for a while unsurprisingly came home to roost. So we have a lot of our customers who had not ever done great IT asset management. And when everything is locked in a locked building and nobody is picking things up and leaving with them, you kind of believe that there's a container that's keeping everything together. So that's good. When everything goes home, if you're not tracking your assets, they're not coming back sometimes. If you don't really know how to distribute software and you have to distribute it, the tool capabilities and the hygiene capabilities and the core IT table stakes capabilities that at some level some people were kind of just saying we'll deal with that later, it became super emergent to deal with it now because without them, the rate of change that they were trying to drive in the pandemic was not possible. And so I think it forced a lot of people to look at their kind of good enough in their own mind quote-unquote tools and realize they were nowhere near good enough and that they had to really accelerate tool upgrading as well so that they had the toolbox to be able to actually adapt to the new world.

So maybe I'll start from a little bit of a different place on the answer to that question. If I look at the IT environment 10 years ago, the business lines were driving the decision making in almost every case that we used to see. So business would come and IT was an enablement function, a cost center that like facilities or like the people who procure paper, who would be necessary for the functioning of the business. And I think that organizational structures reflected that. They were not actually the decision makers. They were not even the people who were driving the conversation. But I think it's getting to the point where IT can actually help the business understand how the business can mature. So you know, I think there are a lot of people in almost every industry who are not as facile as their IT teams in understanding how they can unlock more TAM because they have data that they didn't really understand the value of. They didn't know how to mine that data, they didn't know how to expose that data, how to productize that data. And IT knows how to do that now. And most IT leaders I know are really spending a lot of time thinking about how they can, instead of being a cost center, be a business enabler. And part of that is actually productizing what IT can do that product line business owners often don't understand how to do.

Yeah, so it's super fascinating. I'm going to say something that I think everybody already probably knows, but I'll say it anyway. There is such a land grab in so many areas of IT and technology today that the drive to partner is high. But also what partners are willing to do to help each other, I've never seen it like this. It's gotten to the point where the cloud providers are leaning over too hard and offering things they shouldn't offer because they want to turn their workloads so hard that they're willing to make their sales teams available, their marketing teams available. They're willing to give you access to almost anything in their company if you're willing to work on their cloud. I look at a lot of the more established companies in our industry, even if they're not cloud-driven, and the desire to partner because it drives growth. And growth is so appealing in today's market for so many people because I think the public market really values growth these days. We're seeing an environment that is very partner-friendly. And I think that there's a customer centricity that pervades some companies. And I would say Salesforce is a great example, which is a company that we work with very closely, where the discussion of customer is constant within that environment. What they want, how to help them. I think that it's a very customer-oriented culture. And for us, that's a requirement because I've seen a lot of companies that are much more predatory in the way that they engage their customers. And I think it's incredibly difficult to align a company like ours, which is very customer focused, with somebody who is a much more predatory kind of, they see customers as food rather than partner. You can't bridge that gap. So that's one. And the second one is I want somebody who is committed for the long term. There are transactional partnerships that work for six months and then don't work, and kind of lily pad your way across with those transactional partnerships. But the best partnerships I've engaged in sometimes go on for decades, either with people or with technology companies. And you need somebody whose culture you trust, but also people you trust. And that really all often comes from good alignment on what you need. But I think it's also some companies really, you know, they're carnivorous by nature. They like eating their partners. And you don't want to partner with somebody like that because if you do, eventually you're going to have a fight on your hands. And even if it's productive in the short term, in the long term, customers end up being really disenfranchised because they get caught in the middle.

Yeah, so I mean, it's interesting. You know, when I was 17, I was going to be going into college and I was gonna go to Cal and become a physics professor. That was my plan. And David was starting his first, well, it's not his first company, but the first company I was part of at the time. And he just said, you know, it would be great if you came along and started this with me. And I think the first thing I learned from him was that it's okay to not know exactly what you're planning on doing. And then the second question is, can somebody start doing something? It's not actually that like ivory tower planned. It's more, you know, we've got an area we want to work on now. How do we kind of get some momentum? And it doesn't actually even matter which direction you're going. If you want to go somewhere, it actually matters less about are we going in the perfect direction and it's more a question can we just get some momentum going somewhere so that we can learn something and then course correct. And I loved that process. I loved working with him. David is an incredibly humble, kind, thoughtful, experienced person. I mean, I'm biased, but I really believe every one of those adjectives. And at BigFix, our first company, this was back in 97. We had Ash Carter, the former Secretary of Defense, on our board. And being able to talk to somebody like that on a regular basis about how we can help the world is a huge luxury we did not have at BigFix. We had a really sub-par board. We had a control structure that was really fractured. We had a lot of employees who, because we'd had to raise money enough times, had gotten confused about our mission. We had some things that were really sub-optimal. And so when we sold that company, David and I spent some time thinking about what do we want to do. And there was a real opportunity to retire. And at the age of 27, I don't think that's a good idea. So we started Tanium. And we had the luxury of not making the same mistakes we'd made the first time. And so, you know, it's funny because me and my father were very, very close. We talk all the time. I mean, implicit trust is like understatement of the year. I know that he wants what's best for the company and best for me and vice versa. And there are huge luxuries there. And I think his humility as a human has allowed us to work well together because I think he's made incredible amounts of space not just for me but for everybody else in the company. And I don't see that characteristic in a lot of people, especially not in tech companies where I think egos can be large. So you know, I think he made it easy for me to work with him and I love working with him. And you know, if we started another company, we would do it together. It's an enormous luxury. And I will say the other thing is, you know, I have a lot of my friends who see their parents because they live in different places five times a year, two times a year. I see my father every day. And I end up seeing my mom almost every day. And she gives me a laundry list of things that I need to work on and do. And he helps me build Tanium. And I'm obviously over trivializing, but it's a luxury. It's a huge gift to be able to work with people you love and have it work.

I love working. I love it to the point where Jackie, my wife, will remind me that sometimes that's not actually good. And you know, it's interesting because vacation for me, and I realize this over time, where I put my phone down is more stressful for me than vacation where I read my phone for an hour a day. I love what I do. And I think one of the things that our industry doesn't do very thoughtfully is encourage what Frank Slootman realized at ServiceNow and what a lot of other thoughtful people realize, which is the constitution of your job changes a lot as you scale. And the skill set necessary to be able to do a great job changes as you scale. And there comes a point, I think, in almost every founder-led company when the founder is not the optimal person to run the company. And it's just a question of do you trust the people around you enough and do they trust you enough for somebody to say the emperor has no clothes. I really hope that doesn't happen soon. I really think that there's a lot of runway left. But I think if I were good at golf, I still probably wouldn't be able to find enough soul nourishment in it. I love the mental stimulation and I love the access to thoughtful people. I love solving a problem that I think is really interesting. I love being able to give back to the world in some useful way. And all these are things that this job allows me to do and that I think working allows you to do. So that's a long-winded way of saying I think it would be hard for me to imagine retiring ever.

Yeah, you said California is my home. Two years ago I would have agreed with you, but it's distinctly not my home. In fact, I haven't been back in almost a year and I think that's probably gonna continue for a while. I think that there's a real danger in the general case of getting overconfident. And I think that if people didn't get overconfident, if companies didn't get overconfident, if industries, locations, you would really have a different world, but they do. And I think that California got overconfident. I lived there for years in the city and then outside of the city my whole life up until a year ago. There's some incredible aspects of that location, that topography, the proximity to a lot of things like Napa and Tahoe. I'm not gonna be the guy running the tourist bureau there, but everyone knows that there are some great things. But bad governance kills cities and it kills states, it can kill countries. And I think that California got complacent. And I think that the breaking point, and look, to be honest, we've been thinking about this for years. My family has been thinking about it for years. And when the pandemic hit, we realized that you can go move anywhere in the country that you live in because I'm not going to be a hostage taker. If you are living in a small apartment paying $4,000 a month in San Francisco and you could just as well, because we can't see each other in person, do that job from a palace in most of the rest of the country for the same amount of money, it's cruel to ask people to stay. And so we very quickly told people in March, you've got the ability to move anywhere you want in the country you live. And we had a ton of people take us up on that. So a lot of people left. I was one of them. And I was really explicit. We are moving to Seattle because we love Seattle. And you know, there are pluses and minuses about everywhere, but the pluses far outweigh the minuses. And I think that the talent is everywhere. And that is probably more acutely true today than it's ever been because a lot of my friends who used to live in San Francisco moved everywhere other than San Francisco in the last year. And many of them are going to stay. And so having a remote first culture, I think, is a huge strength. But I will tell you this, I think that California has the potential to reinvigorate itself. Does every company? I mean, we work with IBM and I think IBM's gone through a tough cycle, but I actually think they have an incredible opportunity to reinvent the company. And I think we want to help them with that. I think California can do that, but I think that you have to have an awareness. And I see this in IBM and I wish I saw this in California. Raising kids around needles and homelessness isn't fun for anybody. And I really want to see California fix that. And if I thought that there were actual appetite to fix the problems at their root, this would have been a different discussion. But until I see that, I think it's really hard to force that on my people. And I'll just say, you know, we used to have our conference in San Francisco. We moved it not because I wanted to. We moved it because we got so many complaints from our customers. That sucks. I don't want to be the person who's asking my people, whether they work for me or they work with me or they pay my salary, to do things they don't want to do. And so I've got a lot of my friends who moved to Austin, Denver, Nashville, Miami, Seattle, Sun Valley. And I think this is going to happen more and more.

When I think about Tanium, I think we've done an incredible job with Fortune 500, Global 2000, very large enterprise companies getting visibility and control over their assets. And the biggest two opportunities I see in front of us are serving the wide swath of customers that aren't in that category. It's just a question can we make our technology easy enough to consume and use that they can use it effectively. And I think we've spent a huge amount of energy on that problem in the last year, very successfully the last couple years actually, between launching Tanium as a Service, which is cloud hosted, a lot of work on the interface, a lot of work on getting value out of the system immediately and not having to have a lot of training. And the second one is if we look at what we do as a system of record for data and control over everything with a chip in it, there are a lot of adjacencies that are really obvious. So I want to be able to create workflows on that so that I can actually drive an ITSM, an ITIL process. And it turns out ServiceNow is a great partner for that. And we have a lot of customers who use both. And whether it's our current customers or smaller customers, I think it's actually the same problem, which is they may have compliance requirements that they don't know how to solve in cloud. And they may end up in a situation where they don't actually know what to migrate and who to migrate it to. And so when we look at working with IBM and some of our cloud providing partners, a lot of it is around solving those problems. We have the data, we have the control plane. Now how do we create an ecosystem where these bigger problems can be solved between us and somebody who's an expert in the other side of the problem? And so, you know, I think you're going to see that Tanium has a lot of opportunities to go into these adjacent markets with partners and build really unique capabilities. And it all starts from the data. Just to kind of put a pin on that, I routinely am talking to customers who will tell you that if their CMDB is 85% accurate, it's great. And my next question is, first of all, what other data source in all of not only IT but business would you feel okay with being 85% accurate on? Revenue, facilities data, you wouldn't accept that anywhere. And the second one is, you want to drive automation and end user self-service and self-healing. You want to drive automated compliance, continuous compliance. You want to do all these things. You want software license management events to be a non-event because you've got really strong data. If I can give you three or four nines accurate data, all those things become feasible. And so I think that the opportunity for us is we have that data. We have that control plane. And now we need to make it more digestible for everybody else because everyone's got those same problems. And to be honest with you, in work from anywhere, it's really, really painful when you've got a user and they can't use their computer because there's nothing else they can do. They can't go to an office and have a meeting and come back and IT fixed it. You can't do that anymore. And so I think the standard of helping users be secure and operating well is going up. And I think we owe our customers a much better answer than what the industry is giving them. And I think every one of those areas is huge opportunities for our company.

And look, there are a ton of recommendations that I would give around enabling multi-factor and the right kind of multi-factor, around password protection and being thoughtful about not reusing them, around being able to actually pick services where you have a prayer that they're going to do a good job with your data. I think that this is a really unfair asymmetric problem because we could record another 10 hours and I would just be getting started about good hygiene in cyber. I guess what I would say is this: look, the number of different people who have your data, the lower that number is, the better it is for you. The less you're exposing data that you really, really don't want to expose. So from a somebody being able to do identity theft perspective, I think people need to be thoughtful about what they're sharing. And I would say use as few vendors as you can. Really enable every security feature they have. And look, companies like Google have exposed incredible security capabilities to their customers to the point where you can tokenize and require a token to be able to use email. I think a lot of people don't want to walk around with a physical token they have to plug into every device to be able to use their email. But I think you need to make a choice on how much inconvenience you're willing to take to be able to be safe. And I think there are a lot of recommendations, but the table stakes ones: use a password manager that you trust, update things when you can. So you know, you've got Windows Update or Mac OS Update that will automatically update for you. Enable that. But I think the really best recommendation I have is try not to do things that if you think about them for a little bit, like sharing super sensitive data on social media, try and just think about those things a couple more times before you do them. Because a lot of the things that I've seen on a personal basis, if you look at them and even the person who did them looks at them and thinks about them for a second, you realize that was bound to have negative consequences. So I think that's a long-winded way of saying be thoughtful about what you share and who you share it with.

Absolute pleasure. Thank you for having me.