Welcome to the Reboot Chronicles, connecting you to the world's top leaders and CEOs rebooting their organizations and themselves with revealing stories to help you prosper in unprecedented times. I'm your host, Dean DeBiase, and as a serial CEO who's led dozens of companies that created thousands of jobs and billions in revenue, my passion is uncovering powerful lessons that can inspire you to reboot your organization, your career, and your life. Listen and subscribe wherever you get podcasts or at rebootchronicles.com. I'd like to welcome the godfather of Israeli cybersecurity, Shlomo Kramer, to the Reboot Chronicles. You know, cybercrime damage is estimated to cost the world anywhere from 15 to 20 trillion dollars by the decade's end, and none of us are really safe from its impact. Shlomo is the co-founder and CEO of Cato Networks, who pioneered the next generation of cybersecurity SASE technology, which combines enterprise communications and security into AI-enabled cloud-based platforms. That's a mouthful; maybe we'll unpack that a bit. Shlomo was a seed investor and a board member early on at the industry giant Palo Alto Networks, writing their first investment check, and he co-founded Check Point and Imperva and took both of those companies public. Speaking of going public, Cato has raised about $771 million and was last valued at about $3 billion plus, and lately have been on a growth tear, doubling revenues with a massive ecosystem with thousands of enterprise clients and partners that they protect. Shlomo, good to see you.
Yes, sir. You joining us from Israel today?
So you're looking good. And I've always had this question for you, because you're a serial entrepreneur like me, you've done multiple IPOs, and you could have done anything. Why did you do this? What inspired you to start Cato?
So, first of all, I've been in network security since its beginning. Check Point was the first generation; it was software-based. Then things became complicated. I invested in and mentored Palo Alto, which had the idea of simplifying it into a platform that was an appliance. And in 2015, we understood that the appliance had overstayed its welcome, and there's a need for a new form factor, which is a cloud network that is as fluid as the digital business. And we started Cato based on that. That was the core idea in 2015: be the AWS, the cloud network for network security.
Yeah, you guys made that early prediction and early shift. Why did it take so long for us all to get into cloud? I'll never know. I mean, most everything wasn't a cloud; it was just on our own servers, which was a cloud. That was a good, smart risk to take. Your year-over-year growth has just been really impressive lately. So what's your secret behind that? What's going on with your momentum?
The customers really need the operational efficiency and business agility that Cato and that SASE, the category that was defined based on what Cato invented in 2015 by Gartner, provides. And it's very simple: if you look at the midsize enterprise and you look at IT security spending as part of IT spending in general, just from COVID in the last four years, it grew more than 40%. And you would say, 'Hey, we spend more, but we are more secure.' And the actuality is that actually losses from data breaches in these four years grew almost 50%. So we spend more and we are less secure, and things are getting worse. So something is broken. And if I summarize what's broken, it's that things are getting more and more complex. There are so many threat vectors, there are so many assets, the requirement for velocity from the digital business is ever increasing, and the second-generation appliances cannot address that. So there's real pain, and that pain is really driving a generational shift that Cato enjoys and drives its growth.
Yeah, that's what I call being in the right market at the right time. But you also gave Gartner credit for tagging it, but you guys kind of invented it too, so you get dual credit for that. I've been involved on the periphery of cyber since it started back in the early 2000s, and all I've seen is it gets worse and worse and worse. Everyone says they're going to solve it, like appliance-type guys versus cloud, and then it just gets worse. The numbers I gave at the beginning, trillions of dollars of damages coming up and hundreds of millions of hacks, by the time we finish recording this podcast, all major corporations in the US will probably get some type of an attack. It just doesn't seem to get better. So as business people, that's the right market at the right time. With AI enablement, is it going to get progressively worse?
Yes, so AI obviously is going to complicate things. It's kind of human nature that every new invention is first weaponized, and then people think about other ways to use it. So AI is going to be weaponized in two main ways. One is very relevant to what we do, which is essentially industrializing sophisticated attacks. So an attack that a nation-state attack where a cyber attacker attacked a very high-value target can now be spread across many different targets at a fraction of the cost. So that's a real threat, and that's not yet happening because AI is not quite there yet, but it will happen. And the only way to protect against that is to embed AI in your defense mechanisms, so fight AI with AI. And that's obviously something that we've been doing in Cato way before large language models and the new generation of AI came about. The second way, which is beyond the scope of this conversation but extremely interesting, is that AI continues the journey to blur our ability to distinguish between what is true and what is false. And that creates a huge rift in society, a huge change in the way that humans can organize themselves. This is going to be a major threat, and a way to also make fraud more sophisticated, financial fraud more sophisticated. But that's the small piece of it; the big piece is the political and social aspects of the inability to know what is true and what is not.
Look, when you look at AI offensively and AI defensively, it's like an eye for an eye. So they're just going to go at each other; that'll just escalate. Do we just step back and watch it all happen?
Well, you know, we have how many engineers in Cato that need to build these AI defense mechanisms? And that's what we do: find the AI algorithms and use the data to develop them, and so on and so forth. So people, right now and for the foreseeable future, are stimulated. Of course, I was kidding a little bit, but that pace of always staying ahead just doesn't seem to have an end.
When you look at you guys re-architecting these Fortune 500s, do you see yourself as a solo player or actually part of someone who already has a few security layers, and maybe we can pop yours in on top?
No, so basically, the next decade is going to be a re-architecture of the entire network security stack. And it happened in the past. I'm telling you something perhaps hard to believe: in 10 years, 90% of network flows are going to be SASE. Perhaps there will be some deep in the data center appliances, but they'll all be SASE. 25 years ago, all firewalls were software, and within much less than a decade, the Fortinets and Palos of the world replaced all of those billions and tens of billions of dollars of install base with appliances. So these things happen, and we are in the beginning of a cycle of replacement. So this is a replacement play. In every account that Cato comes into, we replace firewalls, we replace remote access, we replace MPLS or standalone SD-WAN, and we replace old SSEs like the Zscalers of the world that are essentially firewall helpers. So it's a replacement.
What about the CEO of CrowdStrike coming to talk at our events? What about you guys getting hacked or messed up like they did? Not specifically what happened with them, but the idea of concentration: is that another risk, and then you're the biggest target?
Actually, the concentration is positive from a security perspective. I'll give you one example. Every appliance vendor has vulnerabilities that they publish from time to time. Say I have a Fortinet in all of my locations around the world, and there's a new vulnerability. It would take me months, and sometimes it will never happen, that I will patch these vulnerabilities. If you are a cloud service, we do it for you. We essentially test the vulnerability, we quietly see that it works, we install it, and the customer doesn't need to do anything. We were the first ones to have complete protection for our customers for Log4j, for example, in less than 24 hours. So the fact that you are a cloud service servicing all these customers, and you've got the best security talent, all eyes are on this service, versus having an appliance here and there and IT security or not, it's a much more secure way of doing things.
Let's talk about some threats. A lot of threat actors out there. There was one selling Amazon, Apple, Facebook, Microsoft data and even some source code. Amazon's a huge target, obviously, with a lot of spoofing and cybersquatting. How do you stop that stuff?
There are two sides to this coin. First of all, you need to stop the attacks. There's quite a lot of cloud infrastructure, CI/CD protection, and application development protection platforms. This is an area where you've got everybody from Wiz to Aqua to Orca that has this breadth from code to cloud, which would prevent stealing these types of assets. Then there is the detection piece, which is understanding that you have been attacked, so going after the dark web and finding footprints of your compromised assets there. There are other services that do that, and once you do it, you can try to clean it up and remediate the issue. So those are the two main measures.
