Daniel Cohen: past, present, and future of network security

In this episode of the Core Strength Podcast, we sit down with Daniel Cohen, former SVP of Security Architecture at Paramount, to discuss how network security has evolved over the past two decades, and why it’s becoming harder, not easier. From the early days of unencrypted traffic and manual port management to today’s world of encrypted flows, identity-based controls, and cloud-native architectures, Daniel walks through the major shifts that have changed the field. We explore how innovations like App-ID and identity-aware policies improved flexibility, but also introduced new layers of abstraction that make it harder to truly understand what’s happening inside the network.

The conversation dives into the operational reality behind modern network security: overworked teams, constant infrastructure churn, and a reactive approach driven by lack of time and resources. Daniel explains why network security is still treated as an afterthought in many organizations, how the split between cloud and traditional environments creates fragmentation, and why networks remain the invisible foundation everyone depends on but few fully understand. We also discuss the future - how AI can help reduce manual toil, why network engineers must expand beyond silos, and what it takes to turn network security into a proactive, strategic function rather than a constant firefight.

Creators and Guests

Host

Ross Haleliuk

Community Director at The Core Strength Network

Guest

Daniel Cohen

former SVP of Security Architecture at Paramount

What is The Core Strength?

Welcome to The Core Strength Podcast, a place for network security professionals who care about getting the basics right. Each episode brings together experienced practitioners to share insights, stories, and practical lessons from the field.

Richie Hartnett: 00:04

Welcome to the Core Strength podcast. Every piece of data you create, every system you rely on, and now every AI agent you deploy, it all runs through one place, the network. The network is the foundation. On Core Strength, we bring together people who actually secure modern networks, security engineers, network architects, leaders, and builders. Together, we break down how it really works, the decisions, the trade offs, and the lessons learned from operating at scale in the real world.

Richie Hartnett: 00:37

Let's get into it.

Ross Haleliuk: 00:47

Let's kick things off by talking about the evolution of network security. You've been securing infrastructure and network for over two decades or just about two decades at some of the largest companies in The US. You've probably seen a lot. You've seen the evolution that has happened. You've seen how companies have changed the way they approach their security.

Ross Haleliuk: 01:10

How have networks evolved during that time? And how do how have the ways in which networks are being secured changed?

Daniel Cohen: 01:18

It's a a big question. Yeah. I think when I started in the network security space in about 2005, I think we were we were still doing a lot of upgrades from a 100 gig a 100 megs to one gig. So traffic flows were significantly less. Most of the traffic at the time, I think, was unencrypted.

Daniel Cohen: 01:39

So it was a lot easier to see what was happening on the environment. And we, at CBS, we had a lot of TV stations and needs for local networks, but we also kind of had an organic network that grew through time. And I remember in the broadcast center, we had ports, all VLANs extended throughout this entire facility that was over a million square feet. And over time that became became more of an issue, especially as you start having people plug in, create loops in the network and bring down the bring down the entire network and you're trying to figure out where in a million square feet is this happening in a in a large facility. I think those were kind of the early days.

Daniel Cohen: 02:26

I think the the business evolved and began to depend more and more on the network without necessarily doing that initial investment. It was it was nice to have Internet connectivity. Email was important. But when the business started using it for actual delivery of business services like television, streaming, content delivery, there was a little bit of a catch up that we had to do in in the infrastructure and security teams to address that. But of course, they start doing that and then tell us after the fact.

Daniel Cohen: 02:59

So and then they wonder why things break. You know, why can't I push high speed traffic over a 100 meg port? It doesn't why does it keep dropping? Right? It's not supposed to do that.

Daniel Cohen: 03:08

And so I think over time, those things that I think that that created an opportunity. Once we started to explain and really get momentum, to get budget, to correct these things, and that took a number of years to really both get the the required budget and the engineering and and everything kind of in catch up and and sort of indicate to the business that if you're going to use this for business delivery services, we need to actually architect the network based on requirements. And prior to that, it was architected for email and web browsing. And I think that that posed both a challenge for the network team and us in network security because as you start re architecting it, you start saying what are the requirements? How do we do we meet those requirements in a way that we can try to stay in budget?

Daniel Cohen: 03:57

And how do we start to protect against much larger loads of traffic? It's always a bit of a challenge. And what are these traffic types? Like what what are we going to be seeing and what are the threats? So I think those those type of things really really changed how how how we thought about the network.

Daniel Cohen: 04:15

And we had to think about redundancy and resiliency in a different way as well. It's when you start the business starts depending upon the network to deliver revenue generating services. Like, you're not just talking about redundancy, you're talking about resiliency. And especially in media and entertainment, you're talking about parallel resiliency, not failover. Failover causes an outage, even if it's fifteen seconds, but that means you got black on your television screen, and that's unacceptable in media.

Daniel Cohen: 04:47

So really have to think about how you design that in a different way than than than sort of your traditional IT network.

Ross Haleliuk: 04:55

What would you say were some of the problems that were super relevant in network security twenty years ago but are no longer relevant today and vice versa? What are some of the problems that didn't exist but now you're experiencing them?

Daniel Cohen: 05:08

Yeah. Well, I think one is is just the amount of traffic processing, the amount of traffic that we we we do today. Mean, we have more horsepower, but it takes a lot more to process more a lot a lot more sophisticated traffic flows. I think encryption was something, right, when like I said earlier, when we first started in building our network security organization, most of the traffic was unencrypted. So it was fairly easy to intercept.

Daniel Cohen: 05:32

It was fairly fairly easy to look at it. We moved over time. It started to become 70 plus percent encrypted traffic, and then you what what do you do about it? Even today, it's still it's it's almost probably much closer to you know, it's probably even higher than 70. It's probably 90%, right, encrypted at this And that that makes it harder to see what's in the packets.

Daniel Cohen: 05:54

And then, of course, we have a lot more privacy regulations today and things like that that make it more challenging to do that. And honestly, decrypting traffic is a I mean, it it it's fraught with difficulties. It has regulatory issues. It has there's all sorts of things. Right?

Daniel Cohen: 06:12

And every company has a different profile. It's not impossible to do, but it's and a lot of companies do it very successfully. But it really depends on the rigor of your network, the standardization in your network, and the amount of effort and energy and money your company is willing to put into that. And then at the same time balance that with any regulatory type risk. At Paramount or CBS at the time, we never we actually just we chose not to do full decryption.

Daniel Cohen: 06:38

We we focused mostly on just looking at like the the common names and subject alternate names and certificates and made some decisions based on that. It was imperfect, but we weren't comfortable decrypting traffic fully and but it it created other issues on doing that. So that that that to me was one one major issue because it's harder to detect threats when everything's encrypted. And despite what every vendor will tell you, it is very difficult, I think, to do it effectively without breaking a lot of stuff, especially when you have custom custom traffic flows that are very specific to to media and entertainment. I think other things though that are that have changed I mean, I I think early on, we we had to really understand what ports were required.

Daniel Cohen: 07:24

We we really we did kind of follow a default deny policy. I'm looking at those at that time, it was that you'd get you rarely get what's right. It was always often garbage in garbage out. The the customer didn't know what they were asking for, they would send you documentation that the vendor wrote which I would say more often than not was incorrect. But if it wasn't incorrect, it wasn't clear.

Daniel Cohen: 07:45

Right? They give you one table of here's everything you need. It's like, well, which services are we using? I don't know. Right?

Daniel Cohen: 07:52

And then which is the source and which is the destination? I don't know. Right? And I would say more often than not we had to do a lot of inspection work to figure that out. I think that still exists today, but the the nice thing is with Palo Alto and Cisco and other vendors you have this application ID type capabilities which I think improves, makes it a lot easier.

Daniel Cohen: 08:13

It increases the security a bit, it makes it more flexible. For example, you could just say, hello, for example, you could say allow web browsing on any port. Maybe maybe you don't care anymore if it's port 80 or and that's nice because we used to have to open each port if there was a weird port that was being used, a non standard port that required a little bit of additional work and we had to figure out where it was going. So things like that have really helped. I'm not saying application ID are perfect.

Daniel Cohen: 08:37

I've seen plenty of issues where they don't work properly. I've had issues where they change the classification midstream and they break something. So it's something it's something you still have to evaluate how comfortable you are with it and relying on a machine to determine whether the traffic flow is correct or not. I think other areas too that are really helpful, one thing that has changed a lot is obviously being able to use identity for network flows. So that's really huge.

Daniel Cohen: 09:04

That was really a good a big game changer. Being able to pull in data from like active directory for example or other sources and say here's who's logged in from this and we know that Dan is at this IP. And rather than having to create static policies, we could say, let the firewall dynamically update the policies and say, well, it'll figure out the mapping on its own within a few minutes and say, okay, Dan's at this, and now we can allow that. That And was really helpful because we definitely have a lot of groups that had specific needs, and we wanted to make sure that they could obviously do that. And we we had to always find workarounds.

Daniel Cohen: 09:39

It was just incredibly incredibly cumbersome in the past without that. So app using identity kind of as part of network policy, security policies, I think really helped us just make more flexible policies and reduce the friction with our user base. And then I think the other the other big area that's when I started when I first got into this, we we weren't talking about cloud. It wasn't even a thing. Cloud changed everything.

Daniel Cohen: 10:05

More traffic going outbound, more IP space. Right? In some ways, less control. I think it's very common today that cloud engineering teams control their network security stack. So you get sometimes you get some friction between your your kind of quote legacy network security team and your cloud engineering teams.

Daniel Cohen: 10:23

But securing the network security stack in the cloud is very different or even in virtual environments like VMware and whatnot. I think those started to come in and then you got the cloud. So those those changed, so I think the the game a lot because now you're thinking a little bit more about, I think, outbound traffic. You're not hosting as much on your environment, and there is that push and pull of, like, I'm a cloud engineer. I'll build this as part of my templates for the for the cloud and and create the policies.

Daniel Cohen: 10:51

And then the legacy sort of network security team thinks about that a little differently. So I I think those that that's another really big flip. And with that, you start to see cloud services. And a lot of our services that were traditionally network security move into the cloud. So like SASE, like like it's basically cloud hosted VPN.

Daniel Cohen: 11:12

Yeah. It has some neat neat and other features, but essentially, we used to host all that on premise. Right? Now we put that in the cloud and we backhaul only the traffic that needs to be backhauled, which isn't nearly as much as it used to be. So those are big shifts, and I think how how things kind of shifted changed over time, and and just different different models.

Daniel Cohen: 11:30

And and with that too, you start to think about not only just securing at the network edge, but you start thinking about securing the host. And I think that, especially in the cloud where you can do that a little bit more readily, or even in kind of your virtual environments on premise, you can do that a little bit easier. And then there's a lot of great solutions out there now that allow you to control the firewall configuration security policies on the endpoint. And there's a lot of that changes the game too because it gives you a lot more flexibility. When we first early in the or much earlier in in in our early part of my career, it's like you had to set up a physical firewall.

Daniel Cohen: 12:05

It was difficult for us to manage the firewall on the host. That was a whole different team, and most of the teams that were managing endpoints didn't really understand firewalls, regardless of the fact that it was built in the Windows or Mac. It was just it was just that was another set of skills. And then from the network security team, we were like, well, we're not gonna manage that. That's not something we can centrally manage for thirty, forty thousand hosts at the time.

Daniel Cohen: 12:26

So there's so a lot of shifts a lot of shifts over time.

Ross Haleliuk: 12:29

I'm curious. If you were to talk about the state of the network security today, what would you say is the level of maturity that most organizations are at? Like, what have you seen, like, when you're talking to peers, when you're looking at at other companies, not just the companies you've been a part of? What does the day to day of network security engineers look like? What do companies focus on?

Ross Haleliuk: 12:50

What do they prioritize? What do they not prioritize?

Daniel Cohen: 12:54

Yeah. It's a good question. I think I think it, you know, largely depends upon the business. I think different businesses, regulated business may may have a different approach than sort of businesses that have a little bit more of a flexible approach or or less regulation. But I I think one one thing that I think is pretty common is that the the network teams and the network security teams seem to be overworked everywhere you are.

Daniel Cohen: 13:18

They just can't keep up with the load. And a lot of it is because they're constantly having to build or adjust or maintain the network, expand and update the network. And that that is just seems to be something that I I feel like is everywhere. I every any peer I talk to, it's like we're always having to update the network. There's office moves, there's team moves, there's technology changes, and we have to upgrade our equipment.

Daniel Cohen: 13:42

We have to upgrade like, those upgrades and and that that, like, churn, that life cycle, I think creates a lot of a lot of work because every time you do that, all the different teams involved, whether it's network security or or just network operations, and some companies they're merged, some companies are separate. Like, it's it it really makes it difficult to I think kinda hit your target. You're you're never really catching your breath. And I think the consequence of that too is sometimes that network security is almost an afterthought still. I gotta put the firewall on the path.

Daniel Cohen: 14:13

But in terms of managing policies, we just we're just gonna implement as many policies as you know, we're gonna implement most of the policies and and not have the opportunity to really pressure test them. Are they the correct policies? Does the customer know what they're doing? And again, I think that's going to change based on the industry. Some that are more regulated are going to be a lot have much more robust processes.

Daniel Cohen: 14:33

But I don't think think if you don't have that regulation and you're driving that, then you tend to take a little bit of a looser approach I think. And I think that impacts the maturity. I think each company should really identify what is their maturity state and see if they can work towards that. And that was something that I was working towards in my last role. We wanted to really kind of mature the process and become more proactive.

Daniel Cohen: 14:55

And I think that we we tend to see a lot of reactivity in the network security space because there's just never enough people to really assess everything that's going on. And then I think the other challenge too is as I mentioned earlier is like the cloud security space is often managed by a different team. And I think that you end up having a little bit of a disconnection between what's happening with sort of the traditional network security stack and then the cloud security stack. It's not to say that the that's bad. It's just that I feel like they're not always consistent.

Ross Haleliuk: 15:30

When we talk about network security, it's customary these days to talk about cloud and the fact that companies are moving to the cloud and networks are becoming less and less relevant. But at the same time, at least from from where I stand, from what I have been seeing, the vast majority of the enterprises are hybrid, and they will continue to be hybrid probably until the end of times. Would you agree with that?

Daniel Cohen: 15:51

Yeah. A 100%. I think, like, you you gotta build an infrastructure for where people are gonna sit. And especially as more and more companies return to office, like, there there are physical office spaces where people are sitting, and you need some infrastructure to support that. You're gonna need everything from switches and routers and firewalls and access points and control wireless controllers.

Daniel Cohen: 16:14

You're gonna need some infrastructure to manage that, to operate it. Many company can do it different ways, but you'll still need things like DNS, Right? Whether you use cloud based DNS or on premise, but you you there's there's all sorts of things that need to happen. And then inevitably, you know, there's always gonna be some applications that work better on premise. It depends on your organization.

Daniel Cohen: 16:33

In a broadcast company, like, we had tons of things on premise because we we had to literally put feeds on the air. Right? So there are we have some cloud cloud based feeds too, but on premise, we had a lot of equipment that was specific there for for that and wasn't as easy to move that to the cloud, at least not yet. There's always work in progress to to figure that out and make it more resilient and reliable. But but still, there there's always gonna be something.

Daniel Cohen: 16:58

Maybe it's smaller over time, and I think we can definitely say the footprint today is significantly smaller than it was years ago. This footprint on on premise does.

Ross Haleliuk: 17:08

Then when you're talking about network engineers and network teams, I keep wondering who are who are those people? You don't really hear about network security as much as you hear about identity teams or application security teams. Who owns network security at the enterprise these days? Where like, where do the teams come from? Do they report to security?

Ross Haleliuk: 17:30

Do they not? Like, could you talk about that dynamics?

Daniel Cohen: 17:34

Pretty sure they keep them in the basement, hidden away from everybody. No. I I I kid my fellow network engineers. Yeah. I mean, look, I I think there there's a the so at least at my previous in my previous role, I mean, we had a dedicated we had sort of a dedicated network engineering team.

Daniel Cohen: 17:54

There there were sort of two there was the the this team was split into a couple different areas. So there was an operations team because we had operations all reporting into one set of leadership, and that included network network and network security. And the network team more or less managed the the day to day running of the network security appliances. So but there was oversight from network security engineers that were on my team. And then there was an a network engineering and architecture team and they they worked all all these different teams worked together, but they they had a different reporting structure.

Daniel Cohen: 18:27

Right? And they were responsible for architecting the environment, engineering it, building it, and then handing it off to operations teams for day to day management. And of course, my team needed to interface with both the day to day operations and the engineering and architecture teams to make sure that the the the network was built, right, in a way that that aligned with our governance. I think different different organizations structured in in different ways. At one point or early in my career, right, when I started, I I managed, operated, built, architected.

Daniel Cohen: 19:00

I did everything with network security, and I was on the networks I was on the the the security team. As I progressed in my career, we have eventually handed that off and kinda split it out and said, well, the network the the day to day operations and engineering is now going to be part of the network team. Right? They might have a couple of some of my former engineers at that time were going to be focused on the network security stack, but they were gonna be part of the network kind of engineering team. And my my job was more starting to look at governance and kind of the risk based approach to network security rather than actually day to day engineering architecture and operations.

Daniel Cohen: 19:37

So I think, you know, that changes that that that's structurally how it happens. Now, the other part of the question, like, where are they? Like, we we identity people are out there, like, cloud people are out there. Right? Like, they're all out there.

Daniel Cohen: 19:49

I think that's a really good question. And I think maybe it's sort of tied to what we've been kind of talking about. One of the threads here is that, like, the traditional network security piece has sort of shrunk a little bit in the the world. It's it's still there but it's it's sort of like substrate underneath everything else. Like we just assume the road is there and it works.

Daniel Cohen: 20:08

We're not sure who's building the road, we're not sure how it gets plowed when it snows or or repaired. It just kinda happens. Maybe you see the person, maybe it's happening at 02:00 in the morning. You don't really know. I feel like that metaphor is applicable to how our network engineering and security teams operate.

Daniel Cohen: 20:25

It's like unless there's a fire or the road blows up, like, you you don't hear from them that much. And I I part of me wonders, and this is just my own experience working with a lot of folks, is like, I I feel like it's it's almost a different mindset between network security engineers and then those that work in other parts of the stack. It's like it's like someone who's like focused on building the utilities and understands how the plumbing, the electricity, and all that stuff gets to the actual building versus the one who just builds the road. And it's like they're they're related but like my job is to build the road and once the road is delivered, I don't know what happens. How what's used for or anything like that.

Daniel Cohen: 21:03

And I and I I think that there's an opportunity really for network security and network engineers in general to expand their horizons and really understand that, like, look, you might operate at the lower levels of the stack. Right? Maybe between, let's call it layer one to layer four, like but, like, it would be beneficial to understand the higher layer layers of the OSI stack, which means go and actually talk to the identity people and actually understand a little bit about how identity works. Understand why how AD maps your identity your IP. Right?

Daniel Cohen: 21:34

Provides an IP mapping and how that Palo device, that Palo agent you have running on the AD is actually taking that and feeding it into your your firewall. Is it there's more to it than just like, well, that's their problem. They do identity. I just installed the agent or I we installed the agent and and and they do their thing. And I I think it's it could be bidirectional too.

Daniel Cohen: 21:54

Like, I I I sometimes feel like it's it's almost like people on the other the higher the the the the five the layer five through seven part of the stack and those who operate in the, like, layer one through four, like they're basically speaking different languages. Like you put them in the same room and they just they I don't know. Maybe they can't communicate. And those that can, like they can be really successful and I think that's really important. So I I I don't know.

Daniel Cohen: 22:18

I think that there there's there's really gotta be a way to do that. On my team, I encourage the team to really work closely. I said, look, your primary day to day might be network security and that might mean you you live and think about security policies and things like that in a firewall, but the identity is really key or AI is really key. So go understand the business layers that are actually being driven on top of this road you're building and spend time there. And understand that because it makes us it helps us build a better road.

Daniel Cohen: 22:49

So I I think that is an area that I've personally seen and and maybe a lot of others out there have a different experience. But I've seen that in the companies I've operated and and as well as just with the people I've spoken to over over time that there's sometimes that disconnect, that there's just almost two different languages happening.

Ross Haleliuk: 23:07

It does make sense. And frankly, from what I have seen, I think network security and network engineering teams have been some of the most underappreciated teams at the enterprise where people just assume the network works and the only reasons people end up reaching out to to to the network teams is because they they assume that network teams have broke something. So, oh, I can't access x y z. And so it it is interesting. Like, my hope is that we will see that almost like resurrection of of network security and network engineering expertise and and just craft and and and some respect and and more attention to those areas.

Daniel Cohen: 23:48

Yeah. I think so. I I think you're right on that. I I think the the craft has the opportunity, though, to be enriched by these other channels. It it should it shouldn't be siloed.

Daniel Cohen: 23:57

I think it very much there there very much needs to be conscious effort to collaborate with these other parts of the stack so that it can be a better environment and then it can be be part of the discussion proactively and build, like I said, a a more robust environment that better supports the business. And and through that, you can start to become a problem solver, not just reacting to a business need, but actually, let me help understand let me help you understand what's coming down the road, and we should think about how we need to make changes to our environment to accommodate that before it arrives. So like, it's on its way here. Let's let's get ahead of things. I mean, I think the only way to do that is really collaborating closely with with different stakeholders, whether it's those in the identity space or those in the infrastructure space or cloud space, and of course, the business space.

Daniel Cohen: 24:45

Like, go and talk to the business leaders and understand what they're trying to do, what they're thinking about. I'm gonna get a get a good read on what's coming down in the future and that that helps us build a better network, but it also helps us be more integrated. And I think that's really the key is network is one of those things that like, I I agree with you a 100% that it's one of those things that is is underappreciated, but it's everybody uses it all every day. So I I think there's an opportunity to say, look, we we built a good network, a smooth network. It runs well, and it's it's providing it's meeting or exceeding the the requirements that we set out for.

Ross Haleliuk: 25:20

Definitely. And there is there is many changes happening today with AI and with all the other new technologies that makes me very hopeful that, there is an opportunity for network security engineers and network operations engineers to raise their heads about just being bogged down with all the manual tasks that they have to handle on the day to day and start and buy themselves some time to focus on some of the strategic work. Because fundamentally, at least the people I talk to, they want to do a lot of that strategic work. They want to spend time with the business. The problem is they don't have the time.

Daniel Cohen: 25:56

Yeah. A 100%. I think that's that's really where management platforms can really help bring in that context. And like I said, if it can reduce the workload it's not I would say reduce the amount of work for every single task by like 70%. That's a huge win because there's so many tasks.

Daniel Cohen: 26:14

The team is never they're never gonna run out of things to do. It's just that they're always so far behind. And then to your point, like, it's hard to be sort of the strategic thinker when you've got a list of things to do that run that's a mile long and you have to get them all done. They were due yesterday.

Ross Haleliuk: 26:32

Then as as we are moving towards the end of the episode, my last question to you is going to be about the future. You have seen network security from, I would argue, the early days or some time ago, let's just say, and the state it is in today both through your own experiences and also through the experiences of of spending time with your peers and and helping them on on maturing their security programs. What does the future of network security look like in your view? Let's just say the next five, ten years, what are they going to bring? We are probably not going to get rid of networks.

Ross Haleliuk: 27:11

Networks are still going to be there. We will still need to secure them. How do you think we will be able to solve the problems around talent shortage? How do you think we will be able to solve the problems around prioritization, around the ever growing complexity? Because it doesn't look like networks are going to get any simpler in the years to come.

Ross Haleliuk: 27:29

What what's the approach? What can we do?

Daniel Cohen: 27:32

Look. I I think it's we have to use technology smarter and better technologies, I think. And I know, like, this is not a network security specific issue. I think in across the board, like, we need to do more with less. And I know that everyone's tired of hearing that.

Daniel Cohen: 27:47

But the that is the reality is that budgets are tighter, personnel companies are are a lot of companies are reducing personnel, things like that. And the workload isn't actually changing. It's it's still increasing even with fewer people in an organization, tighter budgets, budgets are being shifted to other parts of the organization. So I I think it's it it really comes down to effectively using your technologies and it's up to our our our our trusted partners and whether it's Palo Alto, Cisco, or other companies to help us be more effective and build that. But one of the things I I think too like is is also the the business the the the people in the business, the technology owners, the security owners, like we need to look at what's in the business too because we we usually, right, don't have a homogenous network.

Daniel Cohen: 28:35

And I think when you go to and I'm just gonna pick on Palo for a moment because it's always fun to do that. We we all love Palo. So but it's like if you Palo thinks you're using Palo for every piece of technology in their network your network. But the reality is is we're probably not. Maybe some companies are, right?

Daniel Cohen: 28:52

We certainly were not using we were using Palo in a lot of strategic areas but we weren't using them everywhere. And I think that's where other where where third party companies provide that value where they can provide a consistent abstraction layer across all your different technologies. Because I I don't expect Palo to build a control plane that manages Cisco or Fortinet or whatever but like third parties should can do that. And I think consequently that gives us the also the opportunity in those to real in the with those company to really build more more better ways to work smarter. Right?

Daniel Cohen: 29:32

To work to be more efficient and to do more with less. And I think I know we've said this a number of times throughout this this session today. It's like, I I do think LLMs and and AI in general really can help here. Because a lot of what we do as network security engineers historically is pattern matching. And that is what an LLM is specifically built to do.

Daniel Cohen: 29:52

So I'm not saying it's going to be perfect every time. I'm not going to say it's definitely going to make mistakes. What we need to do is really be training our our people, our engineers how to use LLMs effectively, how to look for things that feel off, and to to not just trust what you're seeing, but also don't ignore it. Leverage it, use it to your benefit, and be more efficient. And I think if you can do that and then that gives you more time to effectively collaborate with other parts of the business and allows you to again shift and and and focus towards the future.

Daniel Cohen: 30:26

And as you said, think the key is is we want to really have the network and network security teams transition to be a more strategic set of business process because they are part of pretty much every business at this stage whether whether it's formally or or or understood or not. Like like I said, they're laying the groundwork. They're they're building the roads and that's critical for any business to operate effectively, you know, today. So I think thinking about what what the roads need to look like, where they need to go, right, in the future is super critical. And I think using technology is is really critical to do that and learning how to use them effectively.

Daniel Cohen: 31:02

And it's it's gonna take time. Right? It takes time to to to shift that to kinda get network engineers, network security engineers sort of out of their mindset and say, look, I know I'm trained. I have every single Cisco certification or other certification and this is my livelihood. It's like but what we're trying to do is not say we're take away your livelihood.

Daniel Cohen: 31:21

We're trying to make your enrich it and say, like, make sure that you stay relevant and that you can do more as a individual contributor to the company, any company, and to the industry by by taking a a broader look at things. Even if that means day to day, you're coming back down to managing that that type of technology, You now have a better understanding of where it lives, what it does in the environment, and where it needs to go. This is this life the lifespan of this equipment might be five years, but it's only gonna be sufficient in our business for three years. Right? And here's here's why.

Daniel Cohen: 31:54

And here's why we chose this today because whatever reason. Right? There's some constraint. So those are the type of things that I think really helps and will help. And I think that will allow the the the environment to shift and allow the network security stack to become more agile.

Daniel Cohen: 32:10

I think agility is the key that that we've been circling here is, like, we need a flexible agile network that's gonna keep up with AI, keep up with cloud, keep up with identities, shift a little bit more easier. And those type of things have happened, but I think they're gonna need to happen more more quickly in the future and more efficiently.

Ross Haleliuk: 32:30

Dan, this is fantastic. Thank you so much.

Daniel Cohen: 32:33

Oh, my pleasure. Thanks for having me.