Subscribe
Share
Share
Embed
In this episode of the Core Strength Podcast, we sit down with Andrew Rubin, CEO and Co-Founder of Illumio, to explore how AI is reshaping the economics and assumptions behind network security. As AI enables vulnerabilities to be discovered and exploited at machine speed, organizations are being forced to reconsider areas they historically viewed as too expensive or operationally difficult, including patching, segmentation, containment, and east-west visibility.
The conversation explores why lateral movement remained a blind spot for so long, how Illumio approached microsegmentation as a new category, and why segmentation and network observability are increasingly connected.
We also discuss how AI can help defenders generate policy and surface important signals, while humans remain essential for decisions involving operational risk. Andrew explains why organizations may eventually accept more operational risk in exchange for faster containment, why resilience and recovery are becoming more important, and why security teams will need to get comfortable moving much faster.
Creators and Guests
What is The Core Strength?
Welcome to The Core Strength Podcast, a place for network security professionals who care about getting the basics right. Each episode brings together experienced practitioners to share insights, stories, and practical lessons from the field.
Welcome to the Core Strength podcast. Every piece of data you create, every system you rely on, and now every AI agent you deploy, it all runs through one place, the network. The network is the foundation. On Core Strength, we bring together people who actually secure modern networks, security engineers, network architects, leaders, and builders. Together, we break down how it really works, the decisions, the trade offs, and the lessons learned from operating at scale in the real world.
Richie Hartnett:Let's get into it.
Ross Haleliuk:Hey, Andrew. Super happy to have you.
Andrew Rubin:Thank you so much for having me today.
Ross Haleliuk:Awesome. Let's jump in and let's start by talking about the historical context around network security. You have been building in this space for quite a while, so it's probably quite helpful to establish some historical context. I guess, looking back over the past twenty five years, what do you think have been the biggest architectural shifts in network security? Like, fundamentally, when you zoom out across your career, what have been some inflection points that forced security teams to rethink the way network itself operates?
Ross Haleliuk:What are some of the assumptions that no longer hold today, but used to hold like ten, twenty years ago?
Andrew Rubin:Yeah, it's such a great place to start because I think there are some funny stories that come out of the history. So, for one, I think we all remember that there was a time, a long time ago, where somebody said, Well, the firewall in the perimeter is dead forever. It turns out that making bold predictions that are that extreme is not always the safest play, because the firewall didn't die and the perimeter definitely did not go away forever. I do think that what was embedded in that comment, and we've seen it happen a number of times, is that we go through these changes in the definition of what, let's say, a firewall is, what it is supposed to do, or what a perimeter is, and what it is supposed to do and where it lives. I think it's probably fair to say, though, that my knee jerk response to your question is not to talk about bold predictions that didn't come all the way true.
Andrew Rubin:I think my actual answer is, we actually haven't had a dramatic change in the perception of what network security is supposed to do for forty or fifty years. We built perimeters in the form of brick walls using things like firewalls. We relied on those walls to keep bad things out. And essentially, it became a foundational element of everybody's cyber model. It was a huge part of our cyber strategy and cyber posture.
Andrew Rubin:And in a kind of funny way, I think right now, for the very first time, we're going through the first real destruction of that base assumption. And it's not because somebody built a better firewall. It's not even because of things like micro segmentation that have come along. It's actually because of what's happening with the AI, the models, and things like Mythos, where we're actually realizing that those walls are no longer going to hold up. And therefore, we're having to ask the question when those walls don't hold up, what are we going to do differently?
Andrew Rubin:I actually have been running around for a decade screaming and yelling that there's nothing new about segmentation. We've been doing segmentation using firewalls and even subnet zones in VLANs for thirty, forty years. But we're realizing that the use cases, the way we want to use these things, the number of places we need to use them and the diversification of those places, we're realizing that that whole game is changing right now in real time. And I think it's the first time that we're really seeing it happen.
Ross Haleliuk:Yeah, I definitely agree. And I think that one of the most interesting things about cybersecurity is that many of the core problems haven't changed. Right? The problems just become much, much larger, much more complex and much harder to solve. What I see a lot is that the organizations are still struggling with least privilege.
Ross Haleliuk:They're still struggling with visibility. They're still struggling with reducing unnecessary access, except that today's environments are much more complex than they were ten, twenty years ago. Right? After the decades of M and As and transformations and reorgs and international expansion and all the other changes that every single large enterprise has gone through. So my question to you would be, why do you think we as an industry have spent so much time focusing on detection and improving detection instead of trying to really look at the fundamentals of reducing attack path?
Ross Haleliuk:Like, was segmentation simply ahead of its time, or what was it?
Andrew Rubin:It's such a fantastic question because I think it unpacks actually two things. There's a technology conversation, and then there is a risk and cost conversation. So I want to start with the latter. And I'm going give you a very real example, one that over the last few months, since we've all learned the mythos and the models like it to come, this is a conversation that I'm having with CISOs, with even CIOs, and sometimes CEOs and board members now very regularly. People are asking, why have we done such a terrible job of patching for all these years?
Andrew Rubin:It's not the only thing that we haven't done a great job at, but it's one that right now is very easy to talk about, and it's become insanely relevant because of this conversation about what models like Methos are gonna do. So one of the thoughts that I think everybody should spend a minute on is to ask the question, could we have done a better job patching all these years? Is it that we couldn't do it because either the technology prevented it, or intellectually we were incapable of getting there, Or was it that we decided not to do a better job? And I have a very strong opinion on this. I don't think that it was a technology problem.
Andrew Rubin:I certainly don't believe for even a single second that it was an intellectual problem. We're smart enough and capable enough to do a much better job at patching. I think that what happened was many years ago, we looked at patching the same way we do many things, which is we looked at the risk cost analysis. And we made a decision that to patch really, really well is expensive. And not just in terms of dollars or euros or pounds, it's expensive in terms of time and effort and resources.
Andrew Rubin:By the way, there's operational risk in patching. Because as much as we know we should do a better job, when you patch an older system, there's a risk that that system may not take the patch cleanly or smoothly. You may break something inadvertently. And when we looked at the other side of the equation, which is the risk of not doing a great job patching, although we all know that breaches are real and ransomware exists, and we've seen some pretty spectacular cases of when things go wrong, especially in the last few years, the decision that we consciously made was the cost of doing a great job of patching was higher than the risk of not doing a great job. So we elected to put ourselves in this position.
Andrew Rubin:So now when you hear all these conversations the past few months about people panicking about patching, they're panicking because with models like Methos, we have to re rate that risk. We have to look at it through a different lens, which is if we don't do a better job, how vulnerable are we gonna be? And the general consensus is we're gonna be unbelievably vulnerable as a result of these models. And therefore, kicking that can down the road the way we have is no longer permissible, and that risk is too high. It takes a very dramatic rethinking mentally to realize that you have to operationally change something that important.
Andrew Rubin:So I think that that is a huge part of how we got here, going back to your original question. Then there's the other side of it, which is the technology piece. So you asked the question and you talked about micro segmentation, the world that Illumio lives in, and why haven't more people done more of it? And in a lot of ways, it's similar. The cost of doing it, it's not free, literally or figuratively.
Andrew Rubin:And the risk of not doing it hasn't seemed to be high enough that you needed to do it. And again, very much like what we talked about with patching, when we think about a world where vulnerabilities are measured in thousands, they move and exploitation of them moves at machine speed. All of a sudden recovery, resilience, and containment start to get rerated very quickly. So segmentation goes from a thing that I know I should do, but I haven't had to do, to I better do it right now. Otherwise, in this new world, I may have a lot of very big problems.
Andrew Rubin:And I think that's the most interesting thing that's coming out of all of the AI and model motion, is not what is the reality of what they're gonna do, but this whole rethinking and rerating of risk and cost and security controls that everybody's trying to get their hands around right now in real time.
Ross Haleliuk:So I definitely agree on patching. In fact, that is also the thought that I have been sharing a lot in that security is really about focusing on fundamentals and fundamentals are hard. Like, by the very definition, like, if you if you focus on list privilege, if you focus on identity controls, if you focus on knowing what your assets are, if you focus on understanding what can talk to what, and if you control all of that operational reality, suddenly your attack surface shrinks dramatically. And the reason why people don't do it is not because people are damaged, it's because it is incredibly hard to do at scale. And then as you've said, right, you have to rethink the the risks and and trade offs and the cost of doing all of it.
Ross Haleliuk:But I would argue, like, I I think the part that I would challenge is that on the segmentation and the importance of the network, I think we've had enough reasons to do it before. Because before there was mythos, there was ransomware. And if you look at, you know, colonial pipeline, if you look at MGM, if you look at Target, if you look at a lot of those events, it is not that we can make a simple statement at all. If only you did x, you would have had a much better outcome. But it is an like, if you look at the distinction between companies that get breached and end up with having their entire infrastructure taken down and companies that get breached and having a segment of their infrastructure taken down.
Ross Haleliuk:Those are two very different outcomes. So somehow, still, despite that reality, for the longest time, we have kind of ignored and underestimated East West traffic. Like, what is changing now? Is it truly AI and mythos, or is there more to it?
Andrew Rubin:Well, I obviously, having been living this journey every single day for a long time, there's nobody who agrees with everything you said more than I would. In other words, it is amazing to me that we have this giant blind spot in our world, for the most part, called the network. It's amazing to me that east west lateral movement hasn't been viewed as a bigger risk. And I don't think that it took mythos to get people to realize it. As a matter of fact, one of the things that I talk about often is if we forget about the last three months and the narrative of AI, and we go back even years ago, we've been measuring dwell time on the network in months and sometimes in years, and we've been measuring it that long for decades.
Andrew Rubin:So if somebody is able to penetrate your environment, but much more importantly, if they're able to live in it undiscovered, moving around your environment, which means inherently it's the network they're taking advantage of, and they're able to do that for months, quarters, or sometimes years undiscovered, you would think that that would make it very obvious that the network is an enormous exposure point. But I come back to what I said before, and I used patching as an example, but it's one of many. I think that what we have to remember is that the CSOs and the CSOs teams that are charged with protecting all of these enterprises and government agencies and critical infrastructure, they're busy twenty four hours a day, seven days a week already. They have been for many years. And so, I do think that there is a reality, which is you tend to prioritize the risk, not that's just the most obvious or the biggest one, but the one that is closest to you day in and day out.
Andrew Rubin:And the truth is that most people have been able to get away with not prioritizing, understanding, observing, and protecting and controlling lateral movement on their network. And they've been able to get away with it because it hasn't caused them enough pain in the past. I'm not saying that they're making the wrong decision. It's just when you have 100 problems to solve, and only enough cycles and money to solve 20 of them, you have to pick the 20 that you perceive to be at the top of the list. Now for Illumio, and I think more broadly for micro segmentation, there obviously have been a group of us that believe that this should be, if not at the top of the list, certainly not in the top 20, but in the top two or three.
Andrew Rubin:And we've believed it for a long time. And I would argue that when I look at Illumio's customer base, and I think about those that adopted our product when we first really came to market a decade ago, those are the ones that were already prioritizing this as a risk very early on. But yes, to answer your question, things like ransomware have moved it up the list. I have just never seen anything where the linkage between a use case and a problem and a threat And micro segmentation has been as absolute as what happened when Methos and now some of the other models have become more publicly understood. I think it has done more to accelerate the prioritization of understanding the network and segmenting the network than anything I've ever seen.
Ross Haleliuk:Very, very interesting. So let's talk about Illumio for a second. Let's talk about building segmentation into a category. As far as I understand, when Illumio was founded, segmentation wasn't really viewed as an existing quote unquote market category. Like at the time, firewalls were already pretty mature.
Ross Haleliuk:Cloud was just emerging or just getting adoption. And many organizations viewed internal network controls as difficult, expensive, hard to operationalize projects. What convinced you at that time that this was the problem worth building a company around? And what did you see that much of the industry haven't yet recognized?
Andrew Rubin:Well, think just to answer the last part of that question first, I think the industry does recognize it now. First of all, to point to what is probably the most important and certainly one of the most obvious declarations of importance, Gartner has now, on their research calendar, confirmed that the first Magic Quadrant for network security micro segmentation will be published later this year. Obviously, having an MQ is probably the ultimate instantiation of a new category. There are lots of preceding events that lead up to it. Forrester has been ahead of the curve on this for some time with not one, but a number of waves in this category.
Andrew Rubin:But obviously having both the Forrester Wave and the Gartner Magic Quadrant really solidifies the industry's recognition, the analysts' recognition, and I would argue the customer's recognition because they ultimately drive everything, including all that research. You go back to the beginning of your question, though, what convinced me, and I'll say the early team members at Illumio, certainly not just me, what convinced us to go try and do this? And the answer shouldn't be surprising. It really comes down to three things. Number one, the evolution of the customer's environment made it obvious that there was gonna be a need for either a new iteration of the tools they had relied on in the past, or potentially something that was completely brand new.
Andrew Rubin:So the simple way to say that is people had ignored the inside of the network for the most part forever. The firewalls were absolutely perimeter devices. They were focused entirely on north south or ingress egress. They were trying to keep the bad things out. But we were already seeing customers talk more about deploying firewalls internally, using them for the beginnings of what was east west control.
Andrew Rubin:But the firewall wasn't built to solve that problem. It wasn't designed to be an east west control. And so in my mind, and the early team here at Illumio, we looked at that as using the wrong tool for a new job. The new job was focusing on controlling lateral movement, east west traffic. But the reason customers were using firewalls for that was not because they said this is the right tool for it.
Andrew Rubin:It was because it was the only tool that they found available at the time. So there was a curiosity there around, well, if you were to build a tool specifically for this use case, would you build another firewall? Or would you build something completely different? That was number one. Number two, there was a very, very strong belief that the incumbents were going to fail to imagine the problem from a blank piece of paper.
Andrew Rubin:So those same firewall and networking vendors were going to do most likely what incumbents tend to do all the time when a completely new problem arises, which is they try and take what they already have on their price list and convince customers buy more of this and it will solve your problem. I didn't believe that was going to be the case. I didn't think it was the right tool for the job. And I didn't think that the incumbents were willing to have the intellectually honest conversation, which is, we probably need to start from a blank piece of paper and imagine this problem anew, and then decide what is the right thing to build to solve this problem. And for me as an entrepreneur, that's where the opportunity always unfolds.
Andrew Rubin:When there is a new problem that is markedly different than the problems before it, and the incumbents are likely not going to confront that reality, that creates an opportunity. Not because it creates an opportunity for a startup, but because eventually customers are going to recognize I have this problem, I need to solve it. And the vendors that I rely on already are not bringing me the right answer. And that became really, I'll call it the birth story for Illumio. It was a blank piece of paper talking to and listening, not customers, but let's call them prospects and design partners early on, and saying, you're going to solve this lateral movement problem, how would you go about it?
Andrew Rubin:Would you buy more boxes and slam them into the inside of your network? Or would you use software? Would you do it at a choke point? Or would you make it more distributed? Would you build it on a list of firewall rules?
Andrew Rubin:Or would you use a graph of your network and then algorithms to figure out how to distribute those rules more broadly? And all of those things, we unpacked them, gave us the confidence that there was an opportunity to build something completely brand new. And the one benefit that we had was because we were betting, I'll say, our collective lives on getting this one thing right, we didn't have any distractions. We didn't have a legacy product that we had to wrap our new idea around. We had a blank piece of paper, a bunch of design partners, and a problem that we said we wanna go solve, and we wanna be the best in the world at solving it.
Ross Haleliuk:The time has passed since the point when you and the team envisioned Illumio, when you and the team built an early product. A lot of the time has passed, but also we seem to now be faced with the newer reality and and how AI is truly impacting the entirety of of cybersecurity, including network security, network operations. What do you see that impact being? So, obviously obviously, there is the models like Methos and the fact that there is an ever increasing urgency around micro segmentation, around network as a whole, around controlling lateral movement. But then there is also AI like, there is also other impacts of AI on network.
Ross Haleliuk:Like, what are those impacts? What are you seeing?
Andrew Rubin:Well, first of all, keying off of what it says on your T shirt, at least the part of it that's visible to me, think like a hacker. I'm gonna say this, Ross, because I I actually really deeply personally believe this. I believe it in my Illumio context, and I believe it just as a citizen watching all this occur. I think that AI represents, and I think we all know, it represents obviously an incredibly powerful toolkit, and a very new toolkit. I think it is reasonable to assume that that toolkit, like all tools, will end up in the hands of both attackers and defenders.
Andrew Rubin:It's already happened, and it is already happening, and it's going to continue to happen. I think when people ask the question, and a lot of people are asking, is this going to be a more powerful tool for the attacker or the defender in the short to medium term? I think that's the wrong way to ask the question because I don't think it's about is it a more powerful tool for the attacker or the defender? The tool is the tool. It's going to be equally powerful if used by an attacker as it would be by a defender.
Andrew Rubin:The question is, who's going to use it more effectively? I don't have any problem saying this. As defenders, we live within the rule of law. We guide our principles usually based on ethics and morals. We try to do the right thing by definition.
Andrew Rubin:It's reasonable to assume that attackers couldn't care less about any of those things or they wouldn't be attacking things. The attackers have the advantage right now with AI. And they're gonna have it for some time, maybe forever. But at least initially, if we're going to constrain ourselves and put up guardrails, and we're gonna make sure that we try and use these tools the appropriate way, And let's assume reasonably safely that the attackers don't care about any of that. The tool by definition is gonna be more powerful for them than it will be for us.
Andrew Rubin:And so I think that there's an asymmetry that we better get ready for, which is this very powerful tool that we both have, but is likely to be used more effectively by attackers than defenders initially. What that means is not we throw in the towel, not that we give up and don't use it as defenders, but we have to point it at things where we can move the needle very quickly and very effectively. So as a for instance, people ask us, if I go back to my Illumio day job, customers, people ask us all the time, how are you using AI in the product right now? What are the short or immediate term use cases? So for instance, have the AI do a better job suggesting policy faster than we as human beings have been able to suggest it, figure it out, and write it in the past.
Andrew Rubin:Have the AI analyze the network graph to find the proverbial needles in the haystack, so that a SOC analyst does not have to take the time to look through all the noise to find the signal. There are incredibly powerful use cases that are right in front of us that will significantly help with the asymmetry that we're all dealing with as defenders today. We've been dealing with it for some time. It just gets a lot more asymmetric in an AI driven world. I think that what we're gonna have to do as defenders is we're gonna have to think about where to point the AI to get the most value as quickly as possible, as opposed to the sort of starry eyed use cases that, yes, they may be very real and powerful years down the road, but we can't step over the easy wins to get to the hardest wins years down the road because the attackers are not gonna think that way.
Andrew Rubin:They're gonna take the tool, and they're gonna use it to their advantage any way and every way they can, starting right now.
Ross Haleliuk:Yes. And not only that, I think when we are talking about the way attackers use, like, leverage some of the latest models, they also have a bit of a cost advantage. Right? They can rely on some of the, you know, models from other countries known for their adversarial activity, and they can do it in ways that are much cheaper and much more cost effective. While when you are a defender, probably not going to rely on the very same model from, you know, from a questionable source when you don't know what it is doing.
Ross Haleliuk:I think something that I'm I'm I'm quite curious about as well. So you mentioned about like, you you mentioned how you, at Illumio, use AI. I think when it comes to network, there is a bit of that sensitivity with regard to anything autonomous. Right? Anything autonomous, autonomous automation, autonomous remediation.
Ross Haleliuk:I'm sure you've seen this probably more often than I do now. What part of segmentations and what part of network, network security, network operations do you think are going to become fully autonomous? And where do you believe the experienced security engineers or network security engineers will always remain essential?
Andrew Rubin:So, of all, I think that the security and network engineers are going to remain essential, period. That's not a commentary about the volume of them that will be required ten years from now. My crystal ball does not work any better than anybody else's in predicting what that looks like. But the role and the function of the human in the loop, I think remains essential. What I will say is this, and I'm gonna share a real story, an anecdote from a conversation that I had with a CISO at the RSA conference a few months ago.
Andrew Rubin:I think it speaks to your question because it's very real. So let's assume for a moment that one of the use cases for segmentation is what I'm going to refer to as dynamic quarantining. Dynamic quarantining essentially is the act of having a segment built around, it could be a server, it could be an endpoint, it could be a group of assets, but doing it dynamically in real time to effectively cut those assets off from the rest of the environment. So we're going to call that dynamic quarantining. I had a conversation with a CISO who asked me the following question at RSA just a few months ago.
Andrew Rubin:Can I build a fully automated and essentially autonomous pipeline workflow using Illumio, where if it sees a certain behavioral pattern or trigger, it will dynamically write the policy to quarantine an asset or set of assets off, and it will implement the quarantine autonomously? And I said, of course, you can do that. It's in the workflows right now today. He said, have you had anybody fully automate that workflow? I said, absolutely not.
Andrew Rubin:It's an operational question. I have not yet seen a CISO who's so comfortable that they are willing to cut a production system off autonomously. And he said to me, well, do you think that that is gonna happen? And I said, I think that's actually a question for you as the CISO, not for me as the CEO of Illumio. Our job is to make sure that if you wanna do that, the software is capable of doing it.
Andrew Rubin:And it is. The question you're gonna have to ask is, what is your tolerance gonna be for speed and risk? And what I said at the time, and I believe it a lot more now a few months later is, there is going to be a rerating of speed and risk in the CISO and security function over the next twelve months, unlike anything we've ever seen. Because, inevitably, what's going to happen is the models are going to find, obviously, vulnerability at scale. They are going to cause exploitation to happen at machine speed.
Andrew Rubin:We are not equipped as defenders to defend in that model. And people are gonna have to ask the question, what is the risk they are willing to tolerate? Now, I don't have the answer to that. I believe that Illumio's job is to provide the software that can work and defend in that world. But whether the CISO is comfortable fully and autonomously doing that, literally cutting a production system off, I think that's going to be one of the most fascinating conversations we see unfold.
Andrew Rubin:And I think we're going watch it right in front of all of us over the next, let's say, year or so.
Ross Haleliuk:Yeah, it is interesting because in cybersecurity, we often talk about risk and we draw the Well, we essentially draw the equal sign between security risk and risk. Well, the reality is that oftentimes operational risk is much more impactful than the security risk itself. And obviously, oftentimes they come in hand in hand. But being able to cut Yeah, like, I think when it comes to the network, false positives are not treated the very same way as when it comes to even SOC. Because when you get a false positive in a SOC and you act on it, you will probably have a person investigating it and and then decisioning it as to whether or not an action should be taken.
Ross Haleliuk:But when you're looking at the network, if you do get to the autonomous remediation of any kind, you could be cutting off access to production systems, to some systems that may take hours or days to power back on if if they are complex enough.
Andrew Rubin:I couldn't agree more. I do think that you're absolutely accurate that the rating of risk around the network has always been perceived differently. I will say that I do think one of the evolutions in the security model is, your last comment about it takes hours or days to recover, I think if you ask me what is a word or what are a couple of words that I think are about to get a lot more airtime than they ever have in the past. Recovery and resilience are going straight to the top of the list. If you believe we're going to live in a world full of vulnerabilities and with machine speed exploit, we're not going to be able to stop it all.
Andrew Rubin:We're not going to be able to prevent it all. As a matter of fact, we're probably gonna have a lot more problems than we've had in the past. All of a sudden, and resilience measured in minutes or hours becomes a heck of a lot higher priority than it's been in the past. Because you're right, if you cut off a production system for fifteen minutes and you're wrong, it's not good. But if it prevents a potential catastrophe, it probably is acceptable.
Andrew Rubin:If you do the same thing and it takes five days to bring it back online, the rating of that risk is gonna be perceived very differently.
Ross Haleliuk:Andrew, let's move towards talking a bit about the future. And I know you emphasized several times that you do not have a fantastic crystal ball and you are not somebody who is going to be making wild predictions about tomorrow. But let's challenge you. Let's let's put you out of let's take you out of your comfort zone. So let's try.
Ross Haleliuk:If you look at the next let let's just say if you zoom out and we look at the next ten years, do you think network security is going to look like the way it looks like today? Do you think it is going to look differently? And how?
Andrew Rubin:So, of all, let's start by acknowledging ten years in tech in general would be considered a thousand years, and that's before AI came about. So, we're measuring like a ten thousand year horizon, if we say a decade, because of how fast, obviously, everything's moving. So, a couple I wouldn't say they're bold proclamations at all. What I would say is a couple of things that I think are fair to assume, even over a five or ten year horizon. First of all, the data already tells the story.
Andrew Rubin:We're going through the single biggest infrastructure build out by many orders of magnitude that we've ever seen. Many, many orders of magnitude. The build out that we had to build out the infrastructure for the internet is a rounding error compared to what's going on right now. And I'm talking about infrastructure. Data center, network, obviously connectivity, everything, compute.
Andrew Rubin:There is no doubt about it that although it's convenient to talk about GPUs and Nvidia chips, and all the things that we are all very focused on, because those are the things that are perceived to enable all of this AI. It may not be spoken about as much, but every one of those data centers being built has a massive network connecting everything underneath it. So don't forget that the network build out going on is every bit as enormous and powerful and important as the compute and the chips and everything else that we're building to run on top of it. Right? It may not be spoken about as much, but it's happening because you can't have one without the other.
Andrew Rubin:I would argue that by definition, network security as a TAM is becoming more important every single day and becoming much, much bigger because you can't do this infrastructure build out without a lot more network, and therefore, it's a lot more attack surface. That's number one. Number two, obviously, we already know that the models are causing a massive disruption to our go forward model for cybersecurity. So you've got a massive expansion of the attack surface and the most powerful tooling that's ever been built both to hopefully protect us, but certainly to take advantage of us. And, again, this is a stated fact, not my opinion.
Andrew Rubin:The models are already so powerful that the governments have had to step in and prevent the wide scale release of them. It doesn't mean it'll be prevented forever. I don't think any of us believe it will be. But, certainly, when methos first was announced, the first thing that happened was they had to constrain the release of the model because of how dangerous it was. So you've got a massive expansion of the attack surface.
Andrew Rubin:At the exact same time, models that are so powerful that we're constraining the release of them because of the danger that they bring to the world, you can sort of see where this goes. And so I think whether it's a year from now, five years from now, ten years from now, I think network security is exponentially, parabolically bigger and more important than it's ever been. The only thing that invalidates that prediction is if this entire thing were to end tomorrow, And I don't believe it's going to.
Ross Haleliuk:You've learned a lot, I think, over the past decade, while building Illumio, and I'm sure there are some lessons that you would be open to sharing with other founders. So if you were starting Illumio today instead of a decade ago, knowing everything you learned about how enterprise security has evolved, how networks have evolved, what would you do differently? And more broadly, what advice would you give founders building the next generation of infrastructure security companies today?
Andrew Rubin:Sure. So first of all, part of it is just our timing. I couldn't go back and rewrite this part of the script, but you did ask the question if we started today. So it's not as much what would we have done differently back then as it is if we started today but knew now what we didn't know back then. Back then, when we started the company, we focused on the data center.
Andrew Rubin:We did not focus on the cloud. The data center was by far and away the biggest piece of infrastructure to protect at that time. The cloud, as you said, was still fairly nascent. One thing that I will be very open about is I wish we had accelerated our efforts to get to the cloud a lot faster. We were focused on the data center, solving a very big, very difficult problem there, but that kept us heads down focused on that for a long time.
Andrew Rubin:The cloud became very relevant and came about very quickly once it became relevant. We had to play catch up. Now, we obviously dedicated a huge amount of resources to that over a number of years, but certainly if we were starting today, I wouldn't focus on one or the other, I'd focus on both equally. The data center is still incredibly relevant. Some even think that there's maybe a little bit of a data center renaissance happening in some places.
Andrew Rubin:We certainly see that in our customer base. But it would be obviously silly to not start the company today and say, we have to be 100 relevant in data center and cloud and equally from minute one. That's one thing that I would do differently. The second thing is, we just brought our insights product to market in January of this year. We have been a segmentation only company for the life of the company.
Andrew Rubin:Now, given Gartner's announcement of the first ever Magic Quadrant around network security micro segmentation this year, I feel like we're just at the starting line of the adoption of micro segmentation. That also speaks to our early conversation about why is so much of the world not done this yet? I think we're at the starting line of broad mass adoption of micro segmentation. Having said that, if I were starting the company today, I would have built two products from day one. One would have been our micro segmentation product.
Andrew Rubin:The second one would have been the observability that we built on top of that same network graph, and that product is insights. It is very much complementary to segmentation, just as segmentation is very complementary to insights. The two are clearly cousins. But there is no doubt about it, that the observability, understanding the posture of the network, is a standalone value proposition for customers today. We didn't understand that early on.
Andrew Rubin:And so if I was starting today, I would be focused on building both segmentation and observability at the exact same time, and doing it across data center endpoint and public cloud all at once.
Ross Haleliuk:Andrew, this has been an absolutely fantastic conversation. Yeah. Is there is there anything else? Is there any part in words that you would you would add in closing?
Andrew Rubin:You know, there is, Ross. There's one thing, and actually, I have to be honest. I've been saying it literally everywhere. I say it in every meeting at Illumio. I've said it on these podcasts and these panel sessions I've done the last few months.
Andrew Rubin:And I will tell you, I'm saying it to every prospect customer and channel partner we have. My parting words are, get ready to be uncomfortable going a lot faster. We have been conditioned that it is okay to move slowly. Those days are coming to an end very quickly. And it's gonna be uncomfortable.
Andrew Rubin:And at times, it's gonna be painful. We've talked about some of that in this conversation. But my parting words are, get ready to go faster, and you're gonna be uncomfortable doing it, but it is gonna be a requirement, not a feature any longer.
Ross Haleliuk:Fantastic. Thank you so much, Andrew.
Andrew Rubin:Pleasure to be here.