Excerpts from the interview.
CW: Heartbleed, Poodle, Shellshock in 2014 reaffirmed hackers are one step ahead of technology vendors. How can Sophos ensure peaceful nights to CIOs and CISOs
Hagerman: By continuing to relentlessly execute on our strategy of delivering complete security portfolio covering all the different components of security juggernaut - end point, network, mobile, web, email, and server. One of the key attributes of Sophos' strategy is offering complete 'security made simple' solutions. We not only continue delivering world class solutions in end user security but in network security too. And for the first time we are meaningfully integrating both sides of the architecture.
And importantly a mere mortal IT admin can actually manage and deploy these products. By delivering security as a system and allowing these different components to communicate with each other. Each one of the component works great on its own but when you have more than one operating, it makes the other ones better. It is the only way that we will be able to stay ahead of bad guys.
CW: How can CIOs design a perfect security posture of their organizations
Hagerman: I don't think there is a 'one-size-fits-all' answer because it is so customized and dependent on each individual environment -- Number of users, kind of applications, nature of IT system architecture etcetera. All these varied things make a difference. Security, just like any other discipline in IT, needs to be adapted. Having said that, there are clear best practices for any enterprise of any size.
First get the basics right. Take a compete orientation of identifying the key complements you need and to have them covered. And Sophos delivers lot of those components. Make sure those key components are delivered and consistently upgraded and updated. You can spend good amount of money on a piece of technology but if it is outdated or if it is too hard to get updated or the users do not like it to be put in place, then it is of no use. And finally educating your people on the importance of security as a priority. Technology itself can be very thorough but ultimately human beings are a critical part of the picture. Combining great technology - that is well deployed, well maintained - with a user base conscious of the threat landscape results in effective security posture.
CW: How do you fight next gen firewall companies like Palo Alto Networks, FireEye (claim to be layer-7, APT Blocker) that are making waves in security market
Hagerman: Palo Alto and FireEye are great companies, but it is important to keep the comparison in context. However their specific target market and philosophy is quite diverse than ours. They almost exclusively focus on global 2000 organizations with big budgets and huge staff. In most cases companies need real security experts to deploy their solutions.
Our overall addressable security market is much bigger than those of the mentioned vendors. Our security solutions are usable for mere mortal IT admin in 10, 20, 30 million SMEs globally that often lack huge dedicated IT staff. We are hence virtually unique in the security landscape. How many large vendors (hardware and software) focus solely on security, focus on mid-market / SMB (what we call pragmatic enterprise) and deliver well-oiled and integrated components of end point, network, server, mobile etcetera There is no one else except us. We are delivering world-class solutions and they are delivered in a way that is simple and easy-to-use. That is different than what FireEye and Palo Alto Networks do.
CW: But FireEye and Palo Alto Networks acquired end point companies Madiant and Cyyvera respectively few years ago.
Hagerman: Nobody uses their end point solutions. We probably have hundred million active end points. FireEye bought Mandiant. I don't think they have more than a million end points. Palo Alto Networks paid USD 200Mn for Cyvvera which is a zero revenue company. They too have maybe one million end points. The scale is simply too different and we are on different planets - with regard to end point security.
Sophos is the only vendor in the world that features in the upper right hand quadrant (Gartner) for both UTM and End Point Security. End point vendors Symantec, McAfee, Trend Micro, Kaspersky, none of them are in the leadership quadrant for UTM and UTM leaders like Checkpoint, SonicWALL, Fortinet, Cisco (that includes FireEye and Palo Alto) do not lead in endpoint.
CW: Sophos acquired UTM companies Astaro and Cyberoam in a space of three years. But the market for hardware appliances might dwindle with the advent of cloud.
UTM is the fastest growing market in security space globally - which in turn - is also the fastest growing market segment within the IT industry. Various analysts value UTM market value at 1.5 billion dollars with a 12 to 15 % CAGR. The next gen firewall market viewed separately - which probably should not be the case- makes it a colossal 3 billion dollar market. I don't think hardware security appliance business will slow down soon. We are thrilled with combination of Sophos and Cyberoam, just as we were equally excited about the acquisition of Astaro in 2011. To reign as a truly disruptive leader in network security, Indian company Cyberoam emerged as an incredibly complementary partner for us to pursue the mutli-billion dollar opportunity in network security. We can now deliver scale, speed, reach, innovation which neither company could have delivered its own.
At the same time, we are also viewing the cloud market selling virtual appliances or selling cloud implementations. The numbers are much smaller but they are growing quite fast. The real strength of our offerings enables partners and customers to choose on premise appliance or virtual appliance that's delivered on cloud or they can even choose hybrid cloud.
Yogesh Gupta is executive editor at CIO India. You can contact him at yogesh_gupta@idgindia.com and/or follow him on Twitter at @yogsyogi1