If you look at Microsoft and Google and Palo Alto Networks which claim that they collect all this data into their data lakes, they only collect the data into data puddles that don't talk to each other and it just doesn't work.
So that's what Silic is about. I started Silic because the cyber security industry needs a new architecture where all the data gets collected into one place, into one data lake. And then all the different cyber security functions...
Welcome to Inside Cyber Security with Silic. My name is Renee Bonvani and I am heading up marketing at the company. Today I'm joined by Nir Zuk, founder and CEO of Silic and previously the founder of Palo Alto Networks. 17 years ago, I had the pleasure of starting to work with him on what would become eventually the largest cyber security company in the world. And when he had the idea for Silic, I didn't hesitate to join him again and come out of retirement. In this episode, we're talking about why Silic exists, what Nir believes the industry is getting wrong right now, and why AI, data scale, and sovereignty are changing what cyber security looks like for a growing number of organizations. So Nir, what made you look at the industry and the current landscape and think, hm, it's time to change?
You know Renee, I've been fighting with the entire cyber security industry throughout my career where the cyber security industry has this tendency of trying to solve every little problem with another product, with another set of products, with another market. And my approach throughout the last 32 years since I started building the Check Point product has been no, it has to be a platform. It has to be one thing.
And when I started with Check Point in '94, there was no cyber security market. Me and Dave and Shlomo Kramer and Gil Shwed and a few others, we created the cyber security market. But then because Check Point was focusing on operating margins and not on investing in R&D, it let the rest of the market create identity and URL filtering and anti-malware and sandboxing and so on as separate things.
And then we started Palo Alto Networks to fix that. To consolidate the entire market around one thing, which worked really, really well. We became the largest cyber security company in the space today. And then we expanded to endpoint and cloud security and SOC and identity and so on.
Well, turns out that the market has been running away with other products. Products that focus around data. So AI security and data security, DSPM, DLP and IoT security and different forms of cloud security and SaaS security, what's called CASB and SOAR products and so on. They all now operate with a lot of data. They collect data. They provide visibility to the data. They look for attacks within the data, hopefully respond. And sometimes they even use the data to suggest policy changes. They each do it in their own domain. And it's running away from us.
A typical organization today believes that most of the data sits in the SIEM, in the SOAR. Most of their cyber security related data, where in reality it's maybe 5%. Much more data sits with their EDR vendor and NDR vendor and UEBA and so on. In those individual puddles and with the different cloud security vendors and SaaS security vendors and API security vendors and IoT security vendors and OT security vendors and AI security vendors and so on. There's so much data sitting out there in puddles and so little sits in the SIEM which is supposed to be where all the data is.
We're in trouble as an industry because those products are operating with a very limited set of data and these are products that base their operations on data, which means that they're very, very, very far from optimal. And I can give you a few examples.
For example, IoT security. So when you talk to IoT security vendors, for example those that focus on medical devices but there are others out there, those that focus more on industrial environments and so on and of course IT environments. Let's talk about those that focus on medical environments. So when you talk to them as a hospital and you say okay how can you secure my CT and MRI and so on, the scanners, they'll tell you well we look at the network traffic and we try to prevent malware from getting there but mostly what we do is we collect network data and then we will look for abnormal communications, we will look for command and control connections, we will look for the CT or the MRI talking to the wrong places. That's how they do their work.
And then when you ask them but wait, what about the operator of the CT that's using a Windows machine? How do you make sure that that operator doesn't have malware on their machine that's now going to give the subject 100 times the radiation? And the answer is well that's what you have endpoint security vendors for. It's somebody else's problem. But that somebody else doesn't know medical devices and doesn't focus on it, it's a general purpose solution. So when you buy an IoT security solution today in medical environments, you get a portion of what you need. You don't get everything.
Another example is AI security vendors. AI security vendors need to see for example the prompts. The only place to really see the prompts is inside the browser. But they don't sit inside the browser. It's the Talons of the world which is part of Palo Alto Networks now and the Islands of the world that sit inside the browser. And they also need to see the endpoint because they need to know what kind of MCP servers you're running on the endpoint and what kind of API calls you're making, but they don't sit there. That's where the endpoint security vendors of the world sit. So how can the AI security vendors claim that they do AI security? It's not clear.
So it turns out that all, and we can go forever, we don't have a lot of time. We can show how each and every solution that you buy today in the cyber security industry is using just a portion of the data that they need. And there's no way for them to get that. It's even true with the large vendors. If you look at Microsoft and Google and Palo Alto Networks which claim that they collect all this data into their data lakes, they only collect the data into data puddles that don't talk to each other and it just doesn't work.
So that's what Silic is about. I started Silic because the cyber security industry needs a new architecture where all the data gets collected into one place, into one data lake. And then all the different cyber security functions, all the different SOC functions and IoT security and OT security and the different data security functions and the different cloud security functions and so on. They all work on the entire set of data that is collected once.
Now that is an incredible assumption, right, where you believe that at the core, the architecture is broken because everything sits across multiple data sources. Now, there's another assumption, right, about the cloud itself, right? And that the cloud could be the place where all of this could be done. So, what do you think about that?
This cannot be done in the cloud.
You want a longer answer?
I want a longer answer. Yes.
The answer is the cloud is too expensive. And the way you build applications in the cloud, if you're a SaaS vendor, a cyber security vendor trying to deliver your cyber security function or functions from the cloud. The way you build them is you look at the pricing model of your cloud provider, whether it's AWS or Azure or GCP, and then you adjust your products based on that. And then 3 months later they change their pricing model and then you have to adjust your products based on that. So it is the pricing model of the cloud provider that is going to determine what you can and cannot do and how much it's going to cost you and what architecture you can actually use. And that just doesn't work.
We need something that is much more consistent. We need something that is cheaper, that is predictable and that engineers can use as they want and not as they are forced by a pricing model. So I strongly believe that this data lake that I'm talking about, the data lake that is necessary in order to rebuild the cyber security industry around a single data lake, that data lake has to run on premise. I also believe it has to be delivered in hardware. I don't think that as an industry we have a good experience in providing software that you install on your own hardware as a customer. It has to come in appliances whether it's one appliance or tens of racks. It has to come in a form of an appliance. Of course, with the value being the software running on the appliance.
Yeah, that in itself is an incredible change in architecture because for the last 20 years we looked at the cloud as the place to do this. Cloud has become a black box. It's become not only a black box from the technology perspective but also from the pricing perspective as you say and it's my belief that AI is the next black box right where again if you rely on AI running somewhere else and on your premises right it becomes very hard to plan and very hard to understand what it does. Do you feel the same about AI as you feel about the cloud?
Yeah, of course. First the pricing of AI in the cloud is extremely expensive and is changing all the time. I've built in the past products that used specifically generative AI. I mean machine learning is something else. Machine learning by the way is much more useful for cyber security. But there are things where GenAI is useful. And every time we've tried to build in previous lives GenAI based solutions, we ended up not shipping them. Because of the cost. And that was before Anthropic changed their pricing model and before everybody's realizing that they're not charging enough and before all the shortages that are happening right now that are increasing the cloud and the AI cost and so on. It just doesn't make any sense. You can't use GenAI in the cloud and still charge customers what you charge today for the non-GenAI version of the product.
Yeah. Now at what, so I couldn't agree more, right? These are things that we have to take care of. Now, why did you want to take care of this, right? So, what made you think, oh, this is a great idea. This is my thinking to I'm going to start a new company doing this. What was that moment where you thought this is my problem to solve?
Because if I'm not going to do it, nobody else is going to do it. I mean, we don't need to work, right? I mean, we need to work for mental sanity. We can do other things. Look, someone has to do it. And then it's also, it's fun. It's fun to rebuild all of cyber security all over again. And it's fun to assemble the team that we reassembled. You mentioned in the beginning that you retired and we have a few others here that retired and I brought them back and we're going to do it and we're going to build the largest cyber security vendor in the world.
Again, now starting fresh, right, has a lot of challenges, right? But besides the issues of, oh, it's the puddles and the lack of a lake and the cloud. I've heard you say things about the industry is also a terrible reputation, right, for quality and for being available to its customers. So, are there other things that you're trying to do right this time around, right, that you saw go wrong in the past?
