SentinelOne co-founder and CEO Tomer Weingarten is a revolutionary visionary in the security market, using AI and automation to provide real-time endpoint protection that has forever changed the security landscape. But it's not only his technology prowess that sets him apart; it's his commitment to a 100% channel model. Please welcome to the stage SentinelOne co-founder and CEO Tomer Weingarten.
Good morning everybody. Hello.
Good morning. Have a seat.
Thank you so much for being here.
So, SentinelOne has very strong Israeli roots, and we had you here two years ago, just after the October 7th attack in Israel, and now you're here again just as the last of the hostages have been released and peace seems to be on the horizon. So, I just wanted to ask about how you reacted when you heard the news that the hostages have been freed and also what it's been like running a company with this device of war raging in the background.
Yeah, I mean obviously, such joy, right? I mean, across the country it's really unbelievable and this is such a happy coincidence, you know, that I've been here two years ago and now I'm here with this amazing closure. So, really, I mean, we're all just completely overjoyed. I mean, we were kind of paused for two years as a nation, and obviously the hard work starts now, and, you know, peace is something that you need to make sure is lasting. And I think that that's always the challenge in the Middle East. And it's been challenging, but, you know, Israeli people are incredibly resilient. If you're in Israel, you probably live through at least a couple of wars, sadly enough, and hopefully this will be the last. But, you know, there's no question that when you see evil triumphs, it annoys you, right? I mean, it's not the natural course of things, like at least for us good people. And, you know, just seeing this come to a closure is amazing. It's amazing for our people, specifically in Israel. It's amazing for the threat landscape. It's amazing, I think, for the level of disinformation, global anti-semitism that we're seeing. And hopefully those are going to dissipate as well. There's multiple facets to this war that has been ongoing. So let's just hope that this will usher in more of a global peaceful time. The Middle East is the axis of many different conflicts and it's actually a very interesting tilt point I think in overall geopolitics. So a lot is at play and just a great moment to your question, what we were doing, you know, dancing with the kids.
Oh wonderful. Thank you. Wonderful. So now we can talk about security. The threat landscape, attacks continue to rise. What's your view of the threat landscape today and what do you see as the most troubling threats?
Yeah. I mean there's no question that the threat landscape forever has been something that's been evolving. It's been just getting more sophisticated with time. There's no point in time where we say, 'Oh, the threat landscape now is much better.' Right? And I think it's obviously even more true today with attackers harnessing generative AI, harnessing everything that we're trying to harness as defenders and as generally the industry. But obviously, attackers always have this unfair advantage where they don't need to do quality control. They don't need to worry about scale. They don't need to make sure it's super accurate and it doesn't do anything bad. It actually works great if it does. So, there's always that unfair advantage that attackers have. We're seeing attackers just leverage AI, I would say, in two main approaches. One, get stuff done faster and at more scale. So, basically run, deploy, infiltrate, exfiltrate, do all of it in the course of a minute, right? I mean, we're talking about for years in this industry, we've been talking about dwell times that were maybe days, weeks and all of that. That's kind of going away. And I think what you're seeing right now is from the point of figuring out there's an exploit to the point of entry to the point of exit, you can look at a completely automated attack that takes a minute. That's one thing we're seeing and I think a lot of what you see us doing and the stuff maybe we'll talk about today is geared towards not just bringing another product for cybersecurity, an amazing silver bullet to deal with that, but really understanding that you require a whole new architecture to deal with real-time attacks and ones that in most enterprises today doesn't exist. Most enterprises today, most businesses today don't even have the level of visibility and the latency required to even address an attack that takes one minute to come to life and to go away. So thinking about how we provide a new architecture that starts with collecting the data, starts with obviously processing and then orchestrating response in as close as can be to real time. That is the mission I think for us and probably for many other vendors right now on just how do we deal with what's going to be coming knowing that a minute today will turn into seconds tomorrow and the breadth of it is not going to subside.
So talk a little more about this new architecture and what it should look like, what these channel partners should be telling their customers about it, how they should be planning for it.
Yeah. You know, we made an acquisition, a couple of acquisitions, but let's talk about architecture and data pipelines are to me probably one of the most important ingredients as you think about what's next in my security stack. It's really clear that everybody has hundreds of security controls and hundreds of security products in their environment. I think it's totally unrealistic to think that somebody's going to come in and deploy this magical platform that's going to replace all of that. That's not going to happen. And our role, I think, has shifted from giving you tremendous endpoint protection to now helping you make more of the security investments that you already have. So in essence, if you think about it, if you had a way to connect all these products in a very seamless way, take all the telemetry that stems off of them, even from your SIEM, everywhere that you have data, you want a super easy capability to deploy something that will connect all the dots, unify the data, start streaming it. And if you can do all of that in a real-time streaming fashion, then the question becomes, okay, I have now this visibility. I'm able to cross-correlate all these different data points. Now, can I apply AI in real time as the data is streaming? So, I can find all these issues that might exist in the environment. And now that I found those issues, can I orchestrate autonomous or close to autonomous action to then go back and say, I've seen something with my email provider that correlates to my network firewall. Can I now understand what intelligent action needs to happen and can I now click okay and have that action take place across my entire enterprise stack. So you're thinking about what we do today with taking a data pipeline directly to a real-time data lake and then to real-time hyper-automation, you have the components to close that loop and obviously our job is also to build the logic to help you do that. I think that giving building blocks in cybersecurity is a great thing and then you kind of offload the problem to the channel partner, to the service provider and to the customer but if we as a vendor can come in and say we can give you the logic we can make this more automatic so the role for the service provider, for the channel partner is to come in and deploy and then supervise and I think this is the big shift we're going to see with AI is that it's going to be less about hey let's tweak, let's do these things, let's manage, there's a lot of nitty-gritty work that goes into it and then just focus on we have a system it's running, we're maybe supervising some of the actions but then they turn more and more automatic so maybe in 12 or 24 months from today we're all sitting here and there's almost an autonomous or semi-autonomous decision-making brain that is orchestrating everything you have in your network environment basically everything from the cloud to on premise you just want visibility, you want control then you want to do it at a scale that today is practically impossible if you think about the existing solutions that folks have today to deal with petabytes sometimes exabytes of data, none of these solutions were designed to do that if you look in your existing SIEM which is the thing that was supposed to centralize everything. Not everything is in it. It's supposed to be something that helps us react to attacks. It's sometimes hours late with the alerts that you see in it. Querying for different events takes sometimes batch processing that is again if we're talking about a threat landscape that happens in minutes, 15 minutes, 1 hour to get back the results of a query, that's a non-starter. So when we think about what's required I think it's more architecture than a single silver bullet product and then it's all about can we apply the most autonomous type of algorithm to be able to then have security almost run by itself. But obviously then the role of the human is to come in to employ judgment to make sure that we supervise the actions that are more verbose that are more intrusive but really let AI deal with a whole gamut of things. I'll give you one small example that has been front and center in the past couple of years. You probably have heard about this thing called cloud security. And, cloud security or CSPM, it's this system that you deploy in the cloud and it's supposed to, not entirely sure what it's supposed to do, but it's probably supposed to make you more secure in some way. And it's centered on basically understanding what type of misconfigurations you have and then giving you long lists of remediation steps to go and try and kind of plug all these holes. I think that we're not too far from the day where you can basically point a pretty significantly trained security LLM on your let's say AWS environment or G-Cloud environment or Oracle or whatever it is and basically say show me the misconfigurations. Okay, show me the plan to remediate them. You go step by step and you click okay and it's pretty much done. So I think a lot of the stuff that we've been selling, deploying, implementing in the past decade even, I think a lot of it is going to become either irrelevant or if you're leaning on it, you're probably just not doing stuff fast enough and efficient enough. And I think that's really where we see AI and kind of the inception of agentic capabilities because that's also kind of level-set for everybody. Nobody is deploying like mega production scale agentic stuff that does mission critical things. It's not yet there. But at the same token I think it's really clear to see the potential and I think it's really clear to see that you can start automating narrow tasks, things that are more defined in nature and that's going to take away from all of these manual work, two hours to do something type of a thing it's going to free up cybersecurity professionals to really deal with the most important stuff that they have. Nobody has enough security professionals. Nobody has free time. So, I think these agentic workloads are designed to help us just streamline our work and do it in a better more efficient manner. It's not still AI to generate more revenue. I think it's AI to get more efficient which in turn will bring more revenue to the bottom line.
Yeah. Talk about cloud security. We had Jay Chaudhry here yesterday from Zscaler. He talked about a future where SIEM goes away. How does that ring to you?
I think so. Yeah, it's pretty true. I think that there's the notion of the SIEM is it's designed today with all these dashboards and nice things and normalization and indexing and schemas and all of that stuff. I think that goes away and I think that you kind of don't need that layer. You need to move to kind of a meta layer. I would say almost like a meta platform that will just again help you onboard data in the most seamless way in the easiest way. This is why when we looked at Observo we looked at about 15 different companies that were doing something in the data pipeline space and seeing a company that does it in a complete AI native way where you don't need to maintain all these connectors and you can get up and running within a week. When was the last time that somebody here deployed an enterprise scale production system for security in a week? That stuff rarely happens. But I truly believe we're moving into a world where it's getting more and more democratized and you'll be able to deploy things with ease, see almost immediate customer value. And then obviously turn on or off whatever ingestion, whatever processing you want on those data streams. By the way, when we think about Observo, it's not necessarily about hey, I'm going to give you a data pipeline to route all the data to me. No, we're not about that. Some vendors, they're kind of a closed garden. For us, it's giving customers the freedom to route data anywhere they want and to optimize data and to save money and filter data and make sure that they're not drowning in useless data. So, it's really about creating a world where you get the data you need and then you can take action right now. It's just not the case by any degree.
This I found both interesting and frightening. Some of the researchers in your lab recently discovered LLM-enabled malware, which is malware that has an LLM directly integrated into it and can create threats right on the fly. Can you talk about how big of a leap forward is this for malware and how do you protect against it?
Yeah. You know, it wasn't surprising one bit. We were kind of looking to see when that's going to happen. The good news is that to detect malware to detect anything that runs on the endpoint EDR is still a very very effective tool like that's the thing, call it AI or not we've been doing AI for the past decade so in the EDR front and while again I would not advise that EDR is a bulletproof type of a thing but the level of visibility that EDR solutions or modern EDR solutions bring to the picture today really gives you the tools to deal with anything that really comes on the endpoint at the end of the day. LLM-based attacks are only going to get more prevalent. It does provide for another level of obfuscation and polymorphism for malware-based attacks or payload-based attacks. Right now it's a bit, I would say, it's kind of improve mode. So it's relatively easy to detect the dependencies and see it behave in a different way but it's going to get more and more sophisticated. I think it's going to make our life as an endpoint provider harder. But that's our job, right? I mean that's what we do every single day. EDR is not the thing that you build and then great let's go do something else. I mean EDR is something that is changing on a daily basis. When you read about oh there's a bypass for this or there's a new attack here, largely within minutes we are already evolving our EDR to address anything new that comes up so unlike the antivirus kind of age where you had a bypass it took weeks for that stuff sometimes never to get better EDR is a real-time thing is real-time reaction EDR is something that for modern providers like us and our peers, it's something that is totally live. There's teams of people, teams of reverse engineers. They're constantly feeding the system that's constantly monitoring hundreds of millions of devices and workloads globally. So it's a very, very different system and it's one that I think is primed to at least be in the position to stop more advanced attacks. It's also what's fueling everything we just discussed in terms of the data renaissance. At the end of the day, 70% of the most valuable data that you typically find in a SIEM system today comes from EDR endpoint solutions. So, I don't think there's any surprise when you see the leading EDR players are now going to lead the data lake, the SIEM story because look, we've been dealing with all this data for a long while. We've changed the equation of what you need to see, what good visibility looks like. So, I kind of believe we have the right of passage here to continue and take that vision to full fruition.
