With the growth in unbridled attacks from cyber criminals with no particular pattern, cyber security providers need to reengineer and re-innovate solutions to deter the attempts. This is where OEM like Virsec excels in bringing comfort to the CISOs. We spoke to Bobby Gupta, SVP & MD- International Business, Virsec to understand his perspective.
“Broadcom, one of our customers, vouches for Virsec. By leveraging our platform, they could reduce the ongoing manpower by almost two thirds .”
Bobby Gupta, SVP & MD- International Business, Virsec
What is the security trend are you seeing in the market?
When I talk to our clients, whether it’s in the US, Australia, Japan or India, one thing which is paramount to all the board level executives is the plethora of attack patterns that we have never seen before. There has always been a pattern, but now if you look at the attack pattern it has reached a new level altogether. Attacks have no patterns and machine learning(ML) is also not able to detect that pattern. And that’s created a lot of problems.
When the leaders of the quad countries met with each other, the dialogue was security collaboration – how the different countries collaborate in a cohesive manner against the attacks of the rogue nations. One thing is that we’re seeing the attack pattern from the rogue nations growing at a massive level. We saw the attacks happening in the critical infrastructure. So, when you talk to them, everyone is trying to have the right solution in place.
The plethora of attack patterns orchestrated by remote execution and great technologies like 5G are becoming a bane. As 5G is enabling all devices including OT and IT to be connected over a very fast bandwidth, it is offering hackers a golden opportunity to mine. That means people like us (Virsec) have a role to play.
Do you have any specific observation in the regions of APAC and Middle East?
We have seen, especially in India and Asia, that attacks have increased threefold during COVID. We have also noticed unknown attacks happening. Every country is gearing up to adopt the latest technologies to stop the flow of attacks. Also, a lot of ecosystems are working in collaboration with each other. As a strategy, we work with our partners in APAC and the Middle East to provide solutions and support.
How is your presence in these regions?
Outside of USA, the Middle East is a very strong market for us. We have an office in Dubai, UAE. We have clients in Saudi Arabia, Qatar, Bahrain, and Kuwait. We are also very strong in India. We have an R&D center in Bangalore with 120 employees. . We also have an office in Delhi and Mumbai and some clients in every sector including defense, industrial systems, BFSI, etc.
Last year, we opened a new office in Australia – we have a team in Brisbane and Sydney. We are expanding very quickly in the APAC region as we see our clients’ demand is growing. The CISOs are finding us more relevant vis-à-vis the competition. Of course, there are a lot of security companies, but they are looking for one solution which can give them full stack protection.
The biggest question is how can you stop the attacks from happening in the first place? That is where Virsec has a different platform called ‘Deterministic Protection Platform’ or DPP.
What is the ask from the Board to the CISOs?
Yes, they are under tremendous pressure. They have to take the right decisions, but the problem is the talent. There is a paucity of the right talent in DevSecOps and DevOps. If there is the right team, there are so many products to choose from, and they need people to manage it. Currently, the biggest problem for the CISOs is to manage the expectation of the Board. In Europe and the US now, there is a new regulation that you have to inform the board about any hack or cyber attempt immediately. That means everyone is in the limelight. They need to have the right solutions and the right team for deployment.
The talent pool challenge is everywhere, what is your play in that?
The good part about Virsec is that although we are a small company, our churn rate is very low because of our vision. When our founders started the company five years ago, their vision was to create something different altogether and we call it cyber security architecture 3.0. Cyber Security 1.0 was what everyone was doing, such as your network security and EDR, etc. Cyber Security 2.0 came with AI and ML. But now if you look at the attacks happening, there are no patterns. People talk about AI and ML but the hackers are very smart. What are you going to do with it if there is no pattern? Though you use the AI in algorithms, Virsec’s soultion is embedded in the software and that’s what we call Deterministic Protection Platform. Since the whole world is using the software, whether it’s your COTS software or legacy applications of the mill software, if you can protect the software from being hacked then the game is over. That’s why we are saying that we lower the total cost of ownership.
You don’t need multiple engines and multiple dashboards. You can replace several products. You don’t need so many people to manage it. There’s, of course, a paucity of right skillset workforce at the client side but Virsec helps deploy workloads. You don’t need so many agents to manage and monitor it.
In fact, Broadcom, one of our customers, vouches for Virsec. By leveraging our platform, they could reduce the ongoing manpower by almost two thirds. We work with the industry, different departments, different universities in USA and India now – also expanding to Asia. We are working on how we can enhance the skillsets in cyber security. We are working on how to make a curriculum and program as a part of the undergrad programs. You can only bridge the gap by getting cyber security as part of the curriculum from day one.
What exactly is DPP?
We call it Deterministic Protection Platform against the commonly available Probabilistic platform. By putting our solution at the runtime, we do not allow any false positives. Our software behaves as per the application behavior – our coders know the real intention of the application as it behaves in a certain way. By deploying Virsec, we make a golden image of a software, which detects any malicious attack in microseconds. That is why we call it runtime application protection, too. We provide full stack protection, whether it’s for Web, Host and Memory, etc. No one has the complete stack as some solution providers have EDR, NGWAF and Endpoint Security, etc.
Which vertical segments are you focusing more?
The most important vertical for us is critical infrastructure. If anything can happen to your banking system, power grids, industrial systems, defence systems, etc., the whole country can collapse. We have our use cases and customers in the Government Sector, BFSI, Telcos and Large Enterprises. We provide servers including on-prem and cloud, workload protection on VMs, containers, legacy applications, etc.
We work with global partners like Raytheon, Tech Mahindra, Schneider, AVEVA, on the OT and IT side and we also have a lot of local partners in every country. We’re also expanding in Europe through our partner ecosystem.
What’s your competitive advantage? Why is a full stack protection company better over point products vendor?
The first thing is that an IT or security leader in a typical organization needs four or five products to protect their organization. If you look at a CISO or CIO, they have to manage a host of things including invoice, contracts, OEMs, internal workforce, etc. That is not an easy job. If one company can do a job for four or five vendors, that’s easy for everyone to match with internal teams. Second thing is the CPU usage, we don’t use more than 3%, so it’s a very light weight engine. Since we are not doing a deployment over months and years, Virsec’s solution can be deployed easily and quickly. . You do not need a lot of people. We provide Proof of Value. So, CISOs have peace of mind
Our platform is very robust. For example, we did a hackathon event with a major department in the US six months back. They offered a challenge of hacking the Virsec platform by putting the best red team but over a week’s time, they were not successful even once despite making 14,000 hacking attempts. The CIO of the major department remarked: ‘it is for the first time that we are seeing something like this in a Hackathon’.
We have major customers in the Middle East and India. There are case studies and use cases for reference.
How do you want to ramp up your operation in this region?
We have a big team in India. We have a R&D team out of Bangalore and provide tech support from India as well. We have Data Center support from Yotta. We have offices in all the major cities including Mumbai, Bangalore, Delhi and Dubai. We have sales teams, system engineers and a deployment team. In addition to this, we have partners to support the entire project. We are also expanding the team as part of our growth strategy. We are hiring the best of talent despite geographic boundaries.
After US, our focus will be the Asia Pacific and Europe. In Asia Pacific, five countries are important for us including, Australia, Singapore, Japan, India and maybe some countries in the ASEAN region. In the Middle East we focus on five countries. Africa will be covered through our partners. We’re opening new offices in the major cities. We have hired a new team in Australia and Japan. We are expanding our sales and tech team in India and the Middle East. We hired a new team in Europe.
We are expanding with our own presence in major markets where we see good traction. The rest of the markets will operate through our channel partners.
In every country, we are bringing in locals to work with us to support our global citizen program and to help the local economy. Therefore, we have local Japanese team in Japan, local Australians in Australia, Arabs in the Middle East, and so on.
We also work with industries and academies. For example, we are currently working with a university in Australia to help develop curriculum for the undergrads. We are trying to collaborate between two countries so that information flow happens and is leveraged through learning.
What would be your suggestion to the CISO as far as best practices are concerned?
First and foremost: every CISO should correct their security posture. They have to look at two things: what is the current stack they are using and where are the gaps? The CISOs have to raise their voice. If they see some challenges, they need to report it to the CFOs and the Board. The situation for the CISOs is becoming worse due to remote access and 5G deployment.
I have seen a common problem in Asia and India. Cybersecurity is ignored. You have to face it. 90% of companies have been hacked. Ransomware demands are going up. It is a matter of time, where India will come up with a policy that you have to report any hacking incident that has happened in the last 12 months. I really want my CISO friends to be more vocal and fight for budgets.
