"The organization can never hire enough people to deal with the scale of vulnerabilities. So the only option we really have is to leverage automation and in terms of orchestration to help guide us through that process to get to the other side."
Maor Goldberg (00:01.218)
Hello, everyone. Thank you for joining us again today. My name is Mor Goldberg, and I’m joined with Ran Le, my co-founder here at Backline. Today, we are super excited and beyond honored to have Paul with us. Paul led product management at Cellpoint when Cellpoint acquired White Book Security back in the days, and we had the privilege to work with him for a few years. I will let him introduce himself.
Paul Trulove (00:35.446)
Absolutely. You got us off to a good start. you know, met you guys when I was at at SalePoint. That was actually 10 years ago this year. So it’s it’s been a while since we we met back in that transaction. But spent really the last 20 years in cybersecurity.
After SalePoint was the CEO of Securoft for a few years and then most recently and currently the Chief Product Officer at AppUX. So I’ve wandered around the identity landscape in a couple of different organizations, but I have quite the passion for it.
Maor Goldberg (00:57.186)
and currently the Chief Product Officer at UX. So I’ve wandered around the identity landscape and a couple of different organizations, but I’m quite passionate for it. Thank you very much for joining us. SailPoint, we joined SailPoint after our first startup company, small engineering team, very small one-person product team. And even though in my role at SailPoint, I didn’t participate in the product and engineering organization actively,
Eran Leib (01:07.384)
Amazing.
Maor Goldberg (01:26.371)
I remember kind of having that observation of it’s really incredible to see how a high velocity, very efficient, very organized product and engineering team needs to look like. And many of these experiences I still take with me today and the people that we still work with Aviad and Shlomi, they kind of all grew up at CellPoint and a lot of it I think stayed with me and stayed.
with us it was truly… don’t know how it looked like. It wasn’t as chaotic as it actually was David. At some point when I joined, I 20 people in it. And so it was much easier to manage. And then I think by the time I left product management alone, I had almost 100 people in it and we were 1500 people. So it was a lot of fun to see that entire journey. I’m that you guys learned something in the process. I learned a lot too.
Paul Trulove (01:57.288)
I’m glad it looked like it, you know, that it wasn’t as chaotic as it actually was day to day. But yeah, know, at SailPoint when I joined, I 20 people in it. And so it was much easier to manage. And then I think by the time I left, product management alone had almost 100 people in it and we were 1500 people. it was a lot of fun to see that entire journey. But glad that you guys learned something in the process. I learned a lot too.
Maor Goldberg (02:25.339)
a lot of what to do and a couple things what not to do. That’s best kind of learning. I think, you know, one of it’s definitely not the topic of the conversation today, but I will say that after, you know, many companies since working in our kind of line of business, you realize that the one thing that we do first and foremost, and it actually relates to our conversation is building software and you need to have your
Paul Trulove (02:26.009)
a lot of what to do and a couple things what not to do.
Eran Leib (02:30.117)
Was a great school.
Maor Goldberg (02:55.095)
Software building factory be highly efficient highly accurate in high velocity and if it doesn’t work like if product and engineering doesn’t work no matter how great your ideas and your you know, of course everything else needs to work, but I’ve seen firsthand how a large company Just breaks down when product and engineering just doesn’t work so
Paul Trulove (03:17.306)
Yeah, I think anytime you’ve got a product-centric company, meaning your product and your strategy are so tightly intertwined that one can’t really move without the other, that relationship in a software company is incredibly important. I was very fortunate at SailPoint to work with Dave Hildebrand for the majority of my time there as my counterpart in engineering. He was the SVP of engineering for many years, and we just found a way to always make things work. We brought in people that kind of…
Maor Goldberg (03:17.658)
Anytime you’ve got a product centered company, meaning your product and your strategy are so tightly intertwined that one can’t really move without the other. That relationship in a software company is incredibly important. I was very fortunate at SailPoint to work with. They build a brand for the majority of my time there is my counterpart in engineering. He was the SCP of engineering for many years and we just found a way to always make things work. We brought in people that kind of
Paul Trulove (03:47.31)
had a similar philosophy both on the engineering side and product management side. And that made a big, difference. And we could navigate our way out of the problems that
Maor Goldberg (03:47.642)
had a similar philosophy, both on the engineering side and product management side. And that made a big, difference. And we could navigate our way out of the problems that we ran into. Truly, yeah. It’s a truly incredible experience for sure. We even to use the tail point term there, navigate. We had to put a nautical theme here. That’s right. We just had navigate last week, so it’s timely.
Paul Trulove (04:02.404)
See, I even managed to use the SailPoint term there, navigate.
Eran Leib (04:06.123)
We had to put a nautical theme here.
Paul Trulove (04:11.183)
That’s right. And they just had Navigate last week, so it’s timely.
Maor Goldberg (04:16.282)
You know, it’s funny. My son is a sailing instructor and he actually, you know, ran his own camps with little kids over the summer and he loves it. I remember like I found myself telling sell point stories to my son about all of that and the different, you know, conference rooms and the names and all of that. He gave me some looks of dad, what what do you want from me really?
I hope, you related just a tiny bit. so I think we can shift gears for kind of, the topic of the hour. and we wanted to talk about, you know, obviously a security and security products and, know, what, what you saw over your long, career. And I will say that, you know, when I was thinking about this conversation and, and, and something that I find myself.
thinking a lot recently as I speak with more and more conversation, made me realize that we, our industry almost started and stayed for many, many years, obsessed with visibility and detection. I even remember, and for good reasons, right? I remember when I was even a teenager installing, know, choosing an anti-virus software.
Paul Trulove (05:31.192)
Thank you.
Paul Trulove (05:38.329)
Thank
Maor Goldberg (05:44.75)
the ads used to be, can detect 5,000, we can detect 7,000. then, know, later on, when we started to look at intrusion prevention systems and you had all of these certification and I think it was ICSA, right? It was out of Verizon, who used to compare software and then compare intrusion prevention systems. And it was all about how much you detect and what can you detect. And even when you think about even MITRE framework, right? It’s a lot about detection and what you can detect because
Maor Goldberg (06:15.705)
You know, originally in the early days, we had a really severe visibility and detection problems. The bad guys were doing what they were doing and we needed tools to figure out what’s going on and where we have weaknesses and vulnerabilities and so forth. But I think recently it’s almost shifted to the other way. We have a lot of signals and a lot of noise and we can, you know, still not everything probably, but we can detect a lot of things and like we feel that we got to a point where we are just, you know, drowning organization with noise and detections and signals that it became almost too much.
Paul Trulove (06:56.172)
Yeah, I think for the longest time, and I think it’s still true today, you can’t manage what you don’t know about. And so the very beginning of all of the problem statements started with having to detect the things that we need to know about to understand the risks that we then need to go manage. And cybersecurity is really, for the most part, risk management on steroids in a lot of ways. And so the first phase of every project doesn’t matter whether you’re trying to
Maor Goldberg (06:56.533)
Yeah, I think, you for the longest time, and I think it’s still true today, you can’t manage what you don’t know about. And so, you know, the very beginning of all of the problem statements started with having to detect the things that we need to know about to understand the risks that we then need to go manage. know, cybersecurity is really, for the most part, risk management on steroids and in a lot of ways. you know, the first phase of every project doesn’t matter whether you’re trying to
Paul Trulove (07:25.88)
in points, networks, identities, you you have to go find all the things that you want to manage. But I think for a lot of organizations, that’s where they’ve stopped. And then as the number of things that they were trying to manage grew, now I’ve got, you know, this big signal to noise problem in terms of understanding again, what is actually risky and what I actually need to manage because I can’t manage everything and I probably don’t need to manage everything.
Maor Goldberg (07:26.296)
In points, networks, identities, you you have to go find all the things that you you want to manage. But I think for a lot of organizations, that’s where they stopped. And then as the number of things that they were trying to manage grew, now I’ve got this big signal to noise problem in terms of understanding again, what is actually risky and what I actually need to manage because I can’t manage everything and I probably don’t need to manage it.
Paul Trulove (07:55.244)
And that seems to be kind of the stasis we’ve been stuck in for the past, you know, at least five or six years, if not, you know, longer than that.
Maor Goldberg (07:55.657)
And that seems to be kind of the stasis we’ve been stuck in for the past, you know, at least five or six years, if not, you longer than that. Yeah, absolutely. What how can we kind of help? I completely agree that kind of a lot of organizations just just stay there. And, you know, like what do we need to do as an industry? Because a lot of, you know, we are at fault.
you know, as an industry, you know, at least to some degree, because a lot of the ways that we’ve measured our own success, the product success, the metrics that we communicated to our customers in dashboard and so forth and so on, were a lot about the signals and the detection and so forth and so on. So it’s a good, I think it’s a good question to ask. What can we do on our end to help this organization evolve?
and take those next steps. I think part of what we have to is we have to stop celebrating when we find the fire and we have to celebrate when we actually put it out. you know, the reality, you know, think of a dashboard today. It’s all about the metrics of what I’ve found. It’s not really about, you know, figuring out not only what I found, but what I need to go prioritize in terms of remediation and then actually getting to the stage of remediation.
Paul Trulove (08:53.378)
Yeah, I think part of what we have to do is we have to stop celebrating when we find the fire and we have to celebrate when we actually put it out. And, you know, the reality, you know, think of a dashboard today. It’s all about the metrics of what I’ve found. It’s not really about, you know, figuring out not only what I found, but what I need to go prioritize in terms of remediation and then actually getting to the stage of remediation.
And you’re starting to see more products, from a vendor perspective, try to attack that full problem. But the reality is there’s still so many manual processes that bog us down that we revert back to the things that I found as the primary metric of kind of celebrating that, whether it’s a product or a program, the outcome is all about the numbers of things that I found and I’ve started to manage. And I think we’ve got to go through that process of
Maor Goldberg (09:21.079)
And you’re starting to see more products, you from a vendor perspective, trying to attack that full problem. But the reality is there’s still so many manual processes that bog us down that we revert back to the things that I found as the primary metric of, you know, kind of celebrating that, you know, whether it’s a product or a program, you know, the outcome is all about the numbers of things that, I found it and I’ve started to manage. And I just, think we’ve got to, we’ve got to go through that process of
Paul Trulove (09:50.358)
transitioning into it’s the fix that matters, not finding the problem. Finding the problem is only the first step.
Maor Goldberg (09:50.744)
transitioning into it’s the fix that matters, not finding the problem. Finding the problem is only the first step. I think it’s partially, know, like, that’s the vendor’s issue that we highlight on the dashboard, you know, like what we found that kind of like fixates everyone. okay. I’m, I’m, better because I found more, more issues or like, maybe I kind of like that. That’s kind of like, feel like around prioritization also, you know, like you’re prioritizing.
Eran Leib (09:57.363)
You think it’s partially, you know, like, ask the vendors issue that we highlight on the dashboard, you know, like what we found that kind of like fixates everyone. okay. I’m, I’m better because I found more, more issues or like, maybe I kind of like that. That’s kind of like, feel around prioritization also, you know, like we’re prioritizing. So now we’re kind of, again, fixated on that, but kind of losing sight of everything else that we found and don’t know what to do with it.
Maor Goldberg (10:17.877)
So now we’re kind of again fixated on that, but kind of losing sight of everything else that we found and don’t know what to do with it. So I’m gonna suggest that the person editing cut the beginning of when you started talking out because my printer just went off. Yeah, I didn’t hear it.
Paul Trulove (10:26.167)
So I’m gonna suggest that the person editing cut the beginning of when you started talking out because my printer just went off.
Eran Leib (10:35.464)
going to
Paul Trulove (10:37.354)
So just ask that question again and I think it’ll…
Maor Goldberg (10:41.238)
Hahaha
Maor Goldberg (10:44.606)
Okay, cool. So ask your question again and then I’ll answer it. So do you think that part of this is our fault and the vendors by the fact that we’re kind of highlighting those specific, I’d say items in our dashboard, in our metrics, and that kind of drives everyone to fixate on those versus fix, you know, like going towards like actually taking care of things? So yes and no.
Paul Trulove (10:46.144)
So ask your question again and then I’ll answer it.
Eran Leib (10:48.329)
So do you think that part of this is our fault and the vendors by the fact that we’re kind of highlighting those specific, I’d say items in our dashboard, in our metrics, and that kind of drives everyone to fixate on those versus fix, you know, like going towards, you know, like actually taking care of things?
Paul Trulove (11:10.486)
So, yes and no.
Eran Leib (11:11.164)
like self-prophesy.
Maor Goldberg (11:13.367)
else, you know, like a prophecy? Yeah, I mean, I’ll say yes and no. At the end of the day, yes, you know, as a vendor building products, you know, I think we’re all guilty of probably over focusing on the things that we feel like we’re good at. And if we feel like we’re good at discovery and all we do is highlight, you know, the discovered artifacts, you know, you can put that a little bit on the vendor. But I’d also probably bring the customer into the conversation.
Paul Trulove (11:16.406)
Yeah, I mean, I’ll say yes and no. At the end of the day, yes, you know, as a vendor building products, you know, I think we’re all guilty of probably over focusing on the things that we feel like we’re good at. And if we feel like we’re good at discovery and all we do is highlight, you know, the discovered artifacts, you know, you can put that a little bit on the vendor. But I’d also probably bring the customer into the conversation because I hope and I know that I’ve generally been able to say,
Maor Goldberg (11:42.132)
because I hope and I know that I’ve generally been able to say, I’ve turned to the outside to ask my customers or prospective customers, what is it that they want to prioritize? And I think in reality, a lot of times the reason the vendors end up highlighting the things that they do is because that’s what they hear from their customers.
Paul Trulove (11:46.318)
I’ve turned to the outside to ask my customers or prospective customers, what is it that they want to prioritize? And I think in reality, a lot of times the reason the vendors end up highlighting the things that they do is because that’s what they hear from their customer. But I also believe that, and I think this was something that was very much ingrained in us at SalePoint from the perspective of Mark.
Maor Goldberg (12:04.874)
But I also believe that, you know, and I think this was something that was very much ingrained in us at SalePoint from the perspective of, you know, Mark McLean, Kevin Cunningham, Jackie Gilbert, you know, who founded the company. It’s not enough to ask your customers what they want. Sometimes they don’t know. And so, you you need to be able to put that, that next layer of creativity and innovation, you know, and bring back solutions and then test those solutions.
Paul Trulove (12:12.95)
McLean, Kevin Cunningham, Jackie Gilbert, who founded the company, it’s not enough to ask your customers what they want. Sometimes they don’t know. And so you need to be able to put that next layer of creativity and innovation and bring back solutions and then test those solutions to pull the market ahead of where customers may think they need to be. can vendors change this? Absolutely. But I think in doing that,
Maor Goldberg (12:33.013)
to pull the market ahead of where customers may think they need to be. can vendors change this? Absolutely. But I think in doing that, they still have to pay attention to what’s important to customers today. Yeah, I absolutely agree. And I think we’re just living through an evolution, right? It’s a lot of…
Paul Trulove (12:43.074)
they still have to pay attention to what’s important to customers today.
Maor Goldberg (13:00.037)
You could claim and rightfully so that it’s still a lot of signals are missing, still a lot of detections are missing, still organizations are getting breached by bad actors and they only know about it years after sometimes in some extreme cases. So it’s not that these issues are completely gone or we completely got them under control. So we’re definitely at the point where there’s
significantly more mature detection and scanning capability relative to 15 years ago, but it’s not like we completely solve the problem. I think we are at a pivotal point in terms of seeing this actually hit the tipping point and then really begin to change direction. Because if you think about the detection products and the way that most solutions have dealt with this, they aggregated a lot of data.
Paul Trulove (13:40.223)
Yeah, I think we are at a pivotal point in terms of seeing this actually hit the tipping point and then really begin to change direction. Because if you think about the detection products and the way that most solutions have dealt with this, they aggregated a lot of data. They would create some level of analytics on the information, but then generally it had to flip out to a of a manual process. I bring the humans in.
Maor Goldberg (13:59.881)
they would create some level of analytics on the information, but then generally it had to flip out to a kind of a manual process. I bring the humans in, they look at it, they make a determination, and then they pass it on to the next stage. And with the Agilent AI and with a lot of the machine learning opportunities that we now have available to us, I can keep the human out of the process for longer because the…
Paul Trulove (14:09.459)
they look at it, they make a determination, and then they pass it on to the next stage. And with the Agentic AI and with a lot of the machine learning opportunities that we now have available to us, I can keep the human out of the process for longer because the product or the system itself can actually do a lot of the things that I’ve been having to stop, go to a manual process, have human intervention, and wait until it can get to the next step.
Maor Goldberg (14:27.166)
product or the system itself can actually do a lot of the things that I’ve been having to stop, go to a manual process, have human intervention and wait until it can get to the next step. And so I get to bring the humans in later in the process because I can have more automation and more intelligence than I’ve ever been able to do in the past. And so I think that’s going to be an important part of getting us out of this aggregate data and then push it out.
Paul Trulove (14:36.873)
And so I get to bring humans in later in the process because I can add more automation and more intelligence than I’ve ever been able to do in the past. And so I think that’s going to be an important part of getting us out of this. Aggregate data and then push it out to somebody to start making decisions on what they think is risky. The system itself can determine what’s risky based on pattern matching and other machine learning technologies. then we can bring humans in.
Maor Goldberg (14:54.472)
to somebody to start making decisions on what they think is risky. The system itself can determine what’s risky based on pattern matching and other machine learning technologies. then we can bring humans in for the piece that the machines can’t do. Yeah, I completely agree. I love the way you framed it. think, and it’s the way we think about it as we think about remediation and an agent, it’s bringing the humans later in the process.
Eran Leib (15:06.474)
.
Paul Trulove (15:06.847)
for the piece that the machines can’t do.
Maor Goldberg (15:23.028)
Bringing them to the right parts of the process And you know, hopefully reducing the number of times you bring them into the process over time and of course, it’s not gonna happen Overnight, but we want to get to a point which is exactly as you friend it when you can only you only need to bring the people into the process when needed and as late as possible
Maor Goldberg (15:53.883)
Iran, do you want to transition us to the next kind of topic?
Eran Leib (15:55.654)
Yeah, yeah, so it kind of sounds like that we’re measuring success today in the
Maor Goldberg (16:00.116)
So it kind of sounds like that we’re measuring success today.
Maor Goldberg (16:09.997)
I’ll be soft. So if detection focused metrics have shaped the previous way that we build products, what happens when we shift from measuring remediation to actually doing it? So let’s try and talk about the difference between orchestrating fixes and actually delivering them.
Paul Trulove (16:12.669)
Thank
Eran Leib (16:13.912)
Sorry about that. How’d they solve? So if detection focus metrics have shaped, you know, like the previous way that we build products, what happens, you know, like when we shift from measuring to actually, from measuring remediation to actually doing it. So let’s try and talk about the difference between orchestrating fixes and actually delivering them. It’s a different type of animal, I would say.
Maor Goldberg (16:39.26)
It’s a different type of animal, I would say. Well, I I think if we think about the three major phases, discovery is phase one, orchestration is phase two, and remediation is phase three. And so, I think most cybersecurity solutions have progressed past discovery, but we’ve been stuck kind of in this, I orchestrate what I discovered, but I haven’t figured out how to actually
Paul Trulove (16:43.027)
Well, I I think if we think about the three major phases, discovery is phase one, orchestration is phase two, and remediation is phase three. And so, I think most cybersecurity solutions have progressed past discovery, but we’ve been stuck kind of in this, I orchestrate what I discovered, but I haven’t figured out how to actually truly reduce the mean time to fix.
Maor Goldberg (17:07.188)
truly reduce the main time to fix and automate a lot of the back end part of the process. And I think that’s where it doesn’t matter what segment of cybersecurity you’re looking at, many tools have kind of stopped at that orchestration. And I think from an orchestration perspective, all I’m really doing is kind of controlling a workflow. And so that workflow can still have some automation in it.
Paul Trulove (17:10.875)
and automate a lot of the backend part of the process. And I think that’s where it doesn’t matter what segment of cybersecurity you’re looking at. Many tools have kind of stopped at that orchestration. And I think from an orchestration perspective, all I’m really doing is kind of controlling a workflow. And so that workflow can still have some automation in it.
But in most cases, I’m probably engaging or integrating with an ITSM product. And then that ITSM product is engaging with humans as part of the process. And then eventually somebody goes and does a remediation activity that then I have to automate the discovery to determine whether the remediation was what I expected it to be. So it’s still kind of a long cycle process. It’s still fraught with
Maor Goldberg (17:36.413)
But in most cases, you know, I’m probably engaging or integrating with an ITSM product. And then I’m, that ITSM product is engaging with, you know, humans as part of the process. And then eventually somebody goes and does a remediation activity that then I have to automate the discovery to determine whether, you know, the remediation was what I expected it to be. So it’s still kind of a long cycle process. It’s still fraught with.
Paul Trulove (18:05.223)
you know, many different touch points, many different systems and people that probably get involved in it. And so, you while I’ve automated discovery and I’ve automated workflow to a certain degree, I haven’t automated a thing that’s actually going to fix the problem that I discovered. And that’s where, you know, we’re just now beginning to see solutions, try to address that in different categories, you know, of the cybersecurity landscape.
Maor Goldberg (18:05.555)
many different touch points, many different systems and people that probably get involved in it. And so, while I’ve automated discovery and I’ve automated workflow to a certain degree, I haven’t automated the thing that’s actually going to fix the problem that I discovered. And that’s where we’re just now beginning to see solutions, try to address that in different categories of the cybersecurity landscape.
Eran Leib (18:34.34)
Yeah. Do you feel that the reason that we’re stalling at orchestration is also because organizations are kind of, you know, like afraid of letting go and just, you know, like move to the next phase?
Maor Goldberg (18:35.143)
Do you that the reason that we’re stalling at office price change is also because organizations are afraid of letting go and just like, next phase? Yeah, I was going to use, I think it’s a safe middle ground where people feel like they’ve made a lot of progress, but they’re not worried about a negative impact of making a change that could cost the business.
Paul Trulove (18:48.111)
Yeah, I was going to use, I think it’s a safe middle ground where people feel like they’ve made a lot of progress, but they’re not worried about a negative impact of making a change that could cost the business productivity or other types of issues. So it’s the safe middle ground that feels good because I’m past discovery. I can show real process automation. can so
Maor Goldberg (19:04.147)
productivity or other types of issues. So it’s the safe middle ground that feels good because I’m past discovery. I can show real process automation. I can show some level of outcome, but I still fundamentally shopped short of the Holy grail, which is getting the fix done in a timely manner.
Paul Trulove (19:17.104)
some level of outcome, but I still fundamentally shopped, stopped short of the holy grail, which is getting the fix done in a timely manner. And I continue to be surprised if you look at a lot of vulnerability management solutions out there. They can find lots of stuff. They can aggregate, they can prioritize, but they can’t really help you speed up the remediation if it’s gonna drop out into, it’s gonna go sit in a queue.
Maor Goldberg (19:30.258)
And I continue to be surprised if you look at a lot of vulnerability management solutions out there. They can find lots of stuff. They can aggregate, can prioritize, but they can’t really help you speed up the remediation if it’s going to drop out into, it’s going to go sit in a queue, somebody has to pick it up, they have to understand what the changes are, and then they have to actually go make the changes before the system can pick it up and close that ticket out.
Paul Trulove (19:46.553)
Somebody has to pick it up, they have to understand what the changes are, and then they have to actually go make the changes before the system can pick it up and close that ticket up.
Maor Goldberg (19:58.214)
Yeah. You know, it’s super interesting. Just two kind of thoughts come to mind. When we started a year ago, we felt that engineers in particular, we will have a lot of concern, real hard time trusting a system that will go and make changes and to the code base and to the repos and whatnot.
You know, fast forward 18 months from where we started to today, my sense is that, you know, engineers are almost looking to kind of embrace AI and, know, I would say significantly more than I thought. Am I right? Or is it just pop culture, social media that I’m inhaling too much? I think people are starting to get past this chasm that is
Paul Trulove (20:49.958)
No, I think people are starting to get past this chasm that has existed. And it’s not blind faith. I think they’re able to start replicating the outcomes and then testing the outcomes. And that’s creating enough trust in the automation to allow for further expansion of automation. We see it today in the world that I live in at AppUX.
Maor Goldberg (20:56.493)
existed. And it’s not blind faith. I think they’re able to start replicating the outcomes and then testing the outcomes. And that’s creating enough trust in the automation to allow for further expansion of automation. We see it today in the world that I live in at AppUX. We help organizations rotate and manage certification or certificate life cycles.
Paul Trulove (21:18.577)
We help organizations rotate and manage certification or certificate life cycles. And there’s a lot of organizations that use us for discovery, they use us for orchestration, but they still allow for the final implementation of the rotated certificate to be done manually by a human. And our value prop is always, you know, go all the way to automation. And I think once people accept the fact that
Maor Goldberg (21:26.181)
There’s a lot of organizations that use us for discovery. They use us for orchestration, but they still allow for the final implementation of the rotated certificate to be done manually by a human. And our value prop is always, you know, go all the way to automation. And I think once people accept the fact that, you know, they have to give up a little bit of control, but there’s ways to test the outcome.
Paul Trulove (21:47.972)
You know, they have to give up a little bit of control, but there’s ways to test the outcome before they get into a production situation where, you know, big issues could arise if the automation failed. But, you know, we’re still seeing people kind of tiptoe into that world. And, you know, my perspective is the same here as it is in many places. You you have to build a system that you can monitor, you can audit, and therefore you can begin to trust over time. You don’t have to take a blind leap.
Maor Goldberg (21:53.52)
before they get into a production situation where, you know, big issues could arise if the automation fail. But, you know, we’re still seeing people kind of tiptoe into that world. And, you know, my perspective is the same here as it is in many places. You you have to build a system that you can monitor, you can audit, and therefore you can begin to trust over time. You don’t have to take a blind leap of faith. And I don’t think anybody in cybersecurity would suggest that you should.
Paul Trulove (22:18.512)
don’t think anybody in cybersecurity would suggest that you should. So I think, you know, as a vendor, you have to demonstrate, you know, a maturity model that gets, you know, to that full level of automation. But you have to have ways to provide verification in a way to build the trust, through the orchestration process.
Maor Goldberg (22:22.416)
So I think as a vendor, you have to demonstrate a maturity model that gets to that full level of automation, but you have to have ways to provide verification in a way to build the trust through the orchestration process. I think some of the reasons that are maybe not getting your customers to move, to fall over all the way through.
Eran Leib (22:38.274)
I think some of the reasons that are, you know, like maybe not getting your customers to move, you know, like to fall over, like all the way through, is it, is a question of numbers. don’t know, you know, like the numbers of issues they face and how many, you know, like tasks they have versus what we see today in the vulnerability management world, which is in some cases in the millions, right? So for them, it would be,
Maor Goldberg (22:51.754)
is a question of numbers. I know the numbers of issues they face and how many tasks they have versus what we see today in the vulnerability management world, which is in some cases in the millions, right? So, but then it would be in the vulnerability management space, would be to cease or just continue going very slowly through the process.
Eran Leib (23:07.746)
in the vulnerability measurement space, would be to cease or, you know, like, just continue, you know, like going very slowly through the process versus actually making a dent and being able to take over the situation.
Maor Goldberg (23:16.987)
versus actually making a dent and being able to take over the situation. Yeah, I think numbers play into it, right? If I have too much to do, it’s hard to decide where to start. But I also think that’s where the modern analytics that we can provide should be prioritizing the work that ultimately gets done. I there’s no reason to go work on the less risky stuff if I have more risky vulnerabilities.
Paul Trulove (23:23.066)
Yeah, I think numbers play into it, right? If I have too much to do, it’s hard to decide where to start. But I also think that’s where, you know, the modern analytics that we can provide should be prioritizing the work that ultimately gets done. I mean, there’s no reason to go work on the less risky stuff if I have more risky vulnerabilities. You know, same thing from a governance perspective or compliance perspective. I should focus on the areas that are going to have the biggest impact of the business.
Maor Goldberg (23:44.366)
you know, same thing from a governance perspective or compliance perspective, I should focus on the areas that are going to have the biggest impact of the business. Every modern cybersecurity tool should be able to create some level of prioritization in terms of, you know, how it is going to put the work that has to be done in an order that makes sense to ultimately mitigate risk in the organization. Could be operational risk, could be security risk, could be financial risk. It doesn’t really matter.
Paul Trulove (23:51.83)
Every modern cybersecurity tool should be able to create some level of prioritization in terms of how it is going to put the work that has to be done in an order that makes sense to ultimately mitigate risk in the organization. Could be operational risk, could be security risk, could be financial risk. It doesn’t really matter. There are very accessible ways to leverage risk prioritization to determine what order I should work on things.
Maor Goldberg (24:13.328)
there are very accessible ways to leverage risk prioritization to determine what order I should work on things. Once I have that, then we’re back to, I trust the automation enough to let it do its job? I have heard from more than one customer, I like kind of job security of the team as a reason not to.
Paul Trulove (24:21.473)
Once I have that, then we’re back to, I trust the automation enough to let it do its job? I have heard from more than one customer, highlight kind of job security of the team as a reason not to take that next step. But I think to your point, we’re not dealing with dozens of issues or hundreds of issues. We’re dealing with thousands, tens of thousands, if not millions of issues.
Maor Goldberg (24:41.497)
we’re not dealing with dozens of issues or hundreds of issues. We’re dealing with thousands, tens of thousands, if not millions of issues. And so, the organization can never hire enough people to deal with the scale of vulnerabilities of other issues in terms of cybersecurity. So the only option we really have is to leverage products or,
Paul Trulove (24:50.989)
And so, you know, the organization can never hire enough people to deal with the scale of vulnerabilities of, you know, other issues in terms of cybersecurity. So the only option we really have, you know, is to leverage products or, you know, automation and in terms of orchestration to help guide us through that process to get to the other side. Otherwise, you know, the list will never end.
Maor Goldberg (25:09.707)
automation and in terms of orchestration to help guide us through that process to get to the other side. Otherwise, you know, the list will never. Yeah, we’re taking care of the issues that no one will ever get to because the list is too long. Yeah, I think again, I love the way you framed about the frame, the process that we need to go through to build that trust. And I also think that it’s not going to happen overnight. And I agree that.
Eran Leib (25:16.788)
Yeah, we’re taking care of the issues that no one will ever get to because the list is too long.
Maor Goldberg (25:38.026)
evidence-based testing and verification to actually demonstrate to, you know, engineering as well as security. This is why the automation decided to do, you know, and these were that’s the reasoning and these were the steps and these were the results. And I think, you know, goes goes back to product. A lot of the product decision needs to run even user experience needs to promote that. How do you
show the right things in the right places. How are you, are you transparent enough? Are you providing all the evidence, not about the detection, but about the work of your automated workflow or AI agents to build that trust over time? think, yeah, it’s not gonna happen overnight for sure, but I agree that only by consistently demonstrating that you’re trusting and verifying and of course.
It actually, know, rely on it. It’s actually consistently reliable. It will happen over time. It will happen over time. You hit on a really important word that I wanted to come back to, which is transparency. I think one of the challenges I’ve seen organizations have is when they don’t understand what’s happening and why the outcome is what it is, they lack trust.
Paul Trulove (26:44.44)
Yeah, you hit on a really important word that I wanted to come back to, which is transparency. I think one of the challenges that I’ve seen organizations have is when they don’t understand what’s happening and why the outcome is what it is, they lack trust in the repeatability or whether it’s going to make the right decision. I think one of the things that has changed over the last several years as Agenic AI,
Maor Goldberg (27:02.99)
in the repeatability or whether it’s going to make the right decision. you know, I think one of the things that has changed over the last several years as, as, you know, genetic AI has gained much more mainstream traction. Um, you know, as, as a lot of the LLMs, you know, have come into, you know, second and third generation implementations is I think a lot of the vendors that built the Gen one stuff as a black box and just said, us.
Paul Trulove (27:13.442)
has gained much more mainstream traction, you know, as a lot of the LLMs, you know, have come into, you know, second and third generation implementations is I think a lot of the vendors that built the Gen 1 stuff as a black box and just said, trust us, it’ll work as we said, that didn’t elicit the trust. And so you’ve had to open that up a little bit more and you’ve had to give customers in some cases the ability
Eran Leib (27:30.143)
you
Maor Goldberg (27:32.821)
It’ll work as we said, that didn’t elicit the trust. And so you’ve had to open that up a little bit more and you’ve had to give customers in some cases the ability to actually import their own algorithms that they have developed and they have tested into your products. And you’ve got to allow them to use, sometimes their data lakes and data models versus having everything just built inside of a black box and you’re supposed to trust the outcome no matter what.
Paul Trulove (27:43.265)
to actually import their own algorithms that they have developed and they have tested into your products. And you’ve got to allow them to use, you know, sometimes their data lakes and data models versus having everything just built inside of a black box and you’re supposed to trust the outcome no matter what the outcome is. That transparency, I think, is a real, really important aspect of an organization gaining enough trust to allow for things to happen in a much more automatic
Maor Goldberg (28:02.574)
the outcome is that that transparency, I think is a is a real, really important aspect of an organization gaining enough trust to allow for things to happen in a much more automated fashion. Yeah, I completely agree. And then again, I think it will happen. It’s not going to happen overnight. But if the data is there and then to be fair, the data needs to be at a high quality and they need to be consistent. And if if if
Eran Leib (28:14.528)
Her
Maor Goldberg (28:30.861)
Your system says that a certain test passed, it needs to actually pass and so forth and so on. But I think that will be the way to build that trust over time for sure. Yeah. It’s almost funny. We came back full circle to a white box solution. You knew it would, You didn’t even think about that. I think it’s.
Eran Leib (28:37.087)
you
Paul Trulove (28:50.221)
You knew you knew we would,
Eran Leib (28:50.739)
Ha ha ha ha ha!
I didn’t even think about that. That’s a good one.
Maor Goldberg (28:58.486)
like the reason behind the company name, of course, it had nothing to do with what we ended up doing, but it was along some something along those lines, choosing white box instead of black box. It’s yeah, it’s kind of funny. There are so many things that you will trust without understanding anything about. It’s and it will be fine. And even even in the more
Paul Trulove (29:09.677)
There you go.
Maor Goldberg (29:28.661)
I would say significantly severe circumstances. Think about people who are going into including myself going into a Waymo car, driving on the highway. I haven’t I trusted with my life literally and it’s fine. But then we want to fix vulnerability.
Eran Leib (29:46.951)
Someone else vetted that. You kind of trust, I want to say, you know, like the DMV and whoever, that they vetted it. You never open the document saying what did they test. You kind of trust them blindly. We all do.
Maor Goldberg (29:49.665)
What you you kind of trust I want to say you know like the DMV and you’re like whoever that they invented it. You never open it like the document saying what did they test? You kind of trust them blindly. We all do. I don’t think the DMV did anything around. I’m sorry to burst it. It’s like you walk into a plane. Did you go and check the FAA records to see how it goes? Yeah, it’s true.
Eran Leib (30:08.735)
Whatever, know, whoever tested these cards is like you walk into a plane Did you go and check the FAA records to see how it goes?
Paul Trulove (30:12.146)
True. Same thing every time you go to the doctor. You just kind of have to trust that they know what they’re doing because most of us don’t have the education or experience to understand how they’re going to make the trade-offs on what the right outcome is. But Waymo is another example. I haven’t been in one yet. They’re rolling around in parts of Austin these days, but not in my area. I still do the Uber, and I still open the app and follow it on the map to make sure that I’ve…
Maor Goldberg (30:19.872)
Same thing every time you go to the doctor, you just kind of have to trust that they know what they’re doing because most of us don’t have the education or experience to understand how they’re going to make the trade-offs and what the outcome is. But Waymo is another example. I haven’t been in one yet. They’re rolling around in parts of Austin these days, but not in my area.
I still open the app and follow it on the map to make sure that I trust. Yeah, same, same. have to say same. I will say Waymo works incredibly well, surprisingly well, not without quirks and all kind of stuff, but it works surprisingly well. The work is right on the bridge.
Paul Trulove (30:48.331)
trust where I’m going to end up.
Eran Leib (31:07.856)
is getting a ride off the bridge.
Paul Trulove (31:12.373)
Well, one of my colleagues took one home from our offsite last week and it didn’t know how to navigate a cove. And so it just stopped on the outer turn of the cove and he had to walk to the back of the cove to get to his house because for whatever reason, it couldn’t figure out how to navigate and come back out. So it just didn’t go in. So not perfect yet.
Maor Goldberg (31:15.584)
we can. It didn’t know how to navigate a Cove. And so it just stopped on the out, you know, the outer turn of the Cove. And he had to walk, you know, to the back of the Cove to get to his house, because it did. For whatever reason, it couldn’t figure out how to navigate, you know, and come back out. Yeah. So it just didn’t go in. Yeah. No, no, for sure. For sure. There is
Maor Goldberg (31:39.264)
You know, it’s really interesting. was I still remember the really horrific Tesla self-driving accident here on the 101 many years ago. And you have this debate if it’s like safer or not, like there’s something that we need to accept. And I think it’s true to to what we’re doing here, that the AI will make mistakes and you know, the
Paul Trulove (31:48.958)
Mm-hmm.
Maor Goldberg (32:07.623)
some bad stuff will happen, but you need to zoom out and look at the know, the big picture. And I think it’s hopefully there will be less mistakes overall. It’s not that it’s going to be perfect. We’re giving to humans making mistakes. We expect machines to do zero. Exactly. Not a real expectation. it’s we need to set expectations and to know that. things will might go south, but it’s fine.
Eran Leib (32:20.797)
We are much forgiven to humans making mistakes. We expect machines to do zero, which is not a real expectation. We need to set expectations and to know that, yeah, things might go south, but it’s fine.
Paul Trulove (32:23.475)
Okay.
Thanks.
Maor Goldberg (32:37.151)
But you know that you’re building product that nobody will ever accept. Maybe someone except one mistake here and there, but no one will accept mistakes. But I think one of the challenges you brought up is if the humans are involved, the likelihood that something gets done incorrectly is very high. And the goal with the automation is to eliminate that to the greatest degree.
Paul Trulove (32:41.195)
Right. But I think one of the challenges, you you brought it up is, you know, if the humans are involved, the likelihood that something gets done incorrectly is very high. You know, and the goal with the automation is to eliminate that to the greatest degree. But it still comes back to that idea of transparency. If I can understand what happened and why it happened, and then I can correct it, you know, then I get to rebuild the trust. And so, you know, even if you are relying on, you know, an automated solution based on AI,
Maor Goldberg (33:05.3)
but it still comes back to that idea of transparency. If I can understand what happened and why it happened and then I can correct it, then I get to rebuild the trust. And so, even if you are relying on an automated solution based on AI or even something that’s not based on AI, you still have to be able to have that, you want predictability, but you also want the transparency so that you can understand when something does happen, how to correct it.
Paul Trulove (33:19.851)
even something that’s not based on AI, you still have to be able to have that. You want predictability, but you also want the transparency so that you can understand when something does happen, how to correct it and reduce the likelihood that that occurs again in the future. It’s a big cultural shift for an organization. And I think anytime you introduce the cultural shift that we’re going through, it just takes time. Eventually,
Maor Goldberg (33:33.322)
and reduce the likelihood that that occurs again in the future. It’s a big cultural shift for an organization. I think anytime you introduce the cultural shift that we’re going through, it just takes time. Eventually, this will feel kind of like what we’ve been doing around discovery and orchestration versus full automation with AI enabled capabilities.
Eran Leib (33:40.157)
100%.
Paul Trulove (33:50.219)
This will feel kind of like what we’ve been doing around discovery and orchestration versus full automation with AI enabled capabilities, will be a little bit like a fax machine. Back in the day, fax machines were really cool, right? Because I could send something across the world in seconds. But now we all look at a fax machine and go, wow, that’s an antiquated piece of technology because there’s so many more efficient ways to move data across the world.
Maor Goldberg (34:01.547)
you know, it’ll be a little bit like a fax machine. Back in the day, fax machines were really cool, right? Because I could send something across the world in seconds. But now we all look at a fax machine and go, wow, that’s an antiquated piece of technology because there’s so many more efficient ways to move data across the world. And I think a lot of what we’re talking about, you know, is not that dissimilar. The solutions that we all relied on for the last 20 years and another five
Paul Trulove (34:20.328)
And I think a lot of what we’re talking about is not that dissimilar. The solutions that we all relied on for the last 20 years and another five will be completely antiquated and everything that we’re worried about today, we will most likely move past and we’ll be using a level of automation that is uncomfortable today and is very typical tomorrow.
Maor Goldberg (34:30.612)
will be completely antiquated and everything that we’re worried about today, we will most likely move past and we’ll be using, you know, a level of automation that is uncomfortable today and is very typical tomorrow.
I agree. I agree. It will be really interesting to see how long this transition will take. But I subscribe to your timeline. I think it makes perfect sense to me. It’s going to take a while. I’m pretty sure there’s still mainframes someplace. I’m pretty sure there are. If I could talk about it, I agree. We were talking about one today. Somebody made a new connector for a mainframe. I was like, wow.
Paul Trulove (35:02.518)
It’s gonna take a while. I’m pretty sure there’s still a mainframe someplace. fact, I talked about it. We were talking about one today. Somebody needed a new connector for a mainframe. was like, wow. I thought the mainframes were gonna die, what, 20 years ago? Maybe 30? So this will take time, but it’ll get easier and easier. I think the pace of innovation is much different.
Maor Goldberg (35:16.842)
I thought the mainframes were going to die 20 years ago, maybe 30. Yeah, yeah. This will take time, but it’ll get easier and easier. I think the pace of innovation is much different in 2025 looking forward than it was back in 2005 to where we are today. Yeah, absolutely. And I’ll say this, we didn’t talk about the bad actor side almost at all, but I’m sure
Paul Trulove (35:29.066)
in 2025 looking forward than it was back in 2005 to where we are today.
Maor Goldberg (35:45.735)
bad actors will push us to move faster and quicker because they’re already using AI and they’re already discovering and exploiting vulnerabilities using AI. I think unfortunately the reality is that bad actors will push us to move our entire industry and organization to move quicker as well. Yeah, agree.
Paul Trulove (36:07.433)
Yeah, agree.
Maor Goldberg (36:11.003)
Awesome. Paul, thank you very, very much. It’s always a pleasure speaking to you. I wish we could have done it once a week, but you’re way busier than we will ever be, probably. Thank you. I really appreciate your time and truly enjoy the conversation. Very good reconnecting with you guys and glad to see you keep chugging along. So like I said, it’s been 10 years.
Paul Trulove (36:11.515)
Thank you. It was was very good reconnecting with you guys and glad to see you keep chugging along. So like I said, it’s been 10 years. So let’s not let it be another 10 years before we do this again.
Maor Goldberg (36:38.985)
Yeah. Let’s let it be another 10 years before we do this again. Agreed. Agreed. Here’s a decision that is now recorded. Thank you so much. Thanks.
Eran Leib (36:43.132)
Thanks.
Paul Trulove (36:49.769)
Thanks.
