[MUSIC]
JACK ATHERTON: Cybersecurity is in the spotlight, with recent high-profile data breaches and geopolitically motivated cyber-attacks driving increased awareness around the importance of risk mitigation. What’s the overall health of the cybersecurity sector, and will enterprise spend on security continue to grow?
BRIAN ESSEX: At the very highest level, management teams, the C-suite, boards of directors are very aware of the threats that exist, it’s top of mind for CEOs. And the awareness and the concern is at such an elevated level, that there’s a lot of support for incremental spending on security and a lot of concern about developing good cyber resilience within enterprise environments.
JACK ATHERTON: Welcome to Research Recap. I’m Jack Atherton. I cover tech, media, and telecom specialist sales here at J.P. Morgan. Today I’m joined by my colleague Brian Essex, who covers U.S. Security Software in our Equity Research Team, to explore key themes and developments shaping the cybersecurity sector. Brian, thank you so much for being here.
BRIAN ESSEX: Thank you for having me, Jack.
JACK ATHERTON: Before we kick off, Brian, why don’t you introduce yourself?
BRIAN ESSEX: Thanks, Jack. So I cover cybersecurity for J.P. Morgan. And I got started covering the industry actually in 2004, after being a banker for a few years post grad school. I spent some time on the buy side in a few other sell-side firms before joining J.P. Morgan last October, recently launching coverage in January of this year.
JACK ATHERTON: Great. Well, delighted to be doing this. So to kick off, I touched on the fact that we’ve seen some recent high-profile attacks. MGM, Caesar, Clorox. Can you just give us a bit of background on what happened there and who’s exposed?
BRIAN ESSEX: I mean certainly these are definitely very high-profile, and I think they received the awareness that they did because of the cost and the very public nature of each of these threats. So these were essentially ransomware attacks, all three of them, very costly attacks. And one of the interesting things about these is whenever we see these, each of these news events that we see in the industry tends to drive the level of awareness and anxiety around these cyber-attacks like a step function higher. And I certainly think we saw that with each of these. We had Clorox, and then, you know, MGM and Caesars followed in close succession with each other later on. And in addition to having each of these events be very costly, in terms of awareness I think people are very aware that, you know, they see on the news that people can’t check into their hotel rooms, or getting written receipts in a digital era for certain transactions that they’re doing at the casinos. And the timing of these events, particularly for MGM and Caesars, I think was very interesting, because this happened just two months before Formula One, right? Which arguably for each of them is, you know, one of the largest revenue events in recent history for each of those companies. So here we are two months before this substantial industry event in Las Vegas, and, you know, both these hotels get hacked. Maybe another thing just to note too is cost is increasingly becoming a point that many are aware of. You know, I think MGM are saying it cost them over $100 million to remediate the attack. Also interesting, one of them paid the ransomware, and the other one didn’t. But on the cost side, I’ll reference IBM’s recent ‘cost of a breach’ report that noted that the average cost of a breach is now up to a little over $4.4 million. So in addition to very public attacks, they’re also becoming very costly as adversaries understand how best to exploit and monetize some of these vulnerabilities that enterprises have.
JACK ATHERTON: As an F1 fan, there was lots of cause for uncertainty going into last weekend’s race, which ended up being a nail-biter and I think a resounding success, having started off with a few hurdles. And so, those were the recent high-profile attacks that we’ve seen. There’s obviously lots of geopolitical events going on at the moment. Can you talk about how historically you’ve seen geopolitics play into the world of cybersecurity?
BRIAN ESSEX: It’s a good question. And it’s definitely been really interesting how it’s revolved over time. In addition to certain adversaries that have consistently been out there, you’ve got nation state-sponsored adversaries out there. Certain hackers have been relatively innovative in developing new threats and finding new vulnerabilities. But now you have nation states that have weaponized vulnerabilities in the marketplace, and they’ve put real capital to work in terms of uncovering new vulnerabilities and developing what’s called zero-day war chests, right? So there are war chests of vulnerabilities that nobody knows about, and they keep until they need it, until a rainy day, when they need to actually exploit this. I think one of the more notable events that I’ve found really interesting was [inaudible] back in 2017, right? This is a what many consider or many regard as a Russian attack on Ukrainian infrastructure. And it got out of hand pretty quick. What’s largely thought to be the case is Russian GRU, which is their military intelligence unit, delivered this exploit on a company that provides Ukrainian attack software. And the attempt was to bring down Ukrainian infrastructure. And it worked. But the blast radius expanded very quickly outside of Ukraine, and it expanded globally, worldwide, and within a matter of, you know, minutes, brought very large global enterprises to their knees, including Maersk, which is a large global shipping company. So, it was found out that this wasn’t necessarily a ransomware attack, but it was disguised as a ransomware attack. But probably one of the more meaningful pivotal points in cybersecurity history that really opened people’s eyes to hybrid warfare, right? And hybrid warfare we’re seeing is very real, and there are a number of consequences that need to be considered when we have geopolitical escalation. And then we’ve seen this in recent times as well. The latest conflict between Russia and Ukraine, and now, between Israel and Hamas. Both using both digital and physical hybrid warfare techniques to attack the other. So it’s become a pretty meaningful catalyst for the growth of threats in the marketplace. And, you know, the other part from an economic perspective, each of these nation states injecting capital, it’s like nation state-sponsored cyber R&D to develop exploits to exploit these vulnerabilities in the marketplace.
JACK ATHERTON: You’ve spoken about this before, but when you think about the vertical exposure that software has, cyber typically over-indexes on federal spend, and this is probably a big driver of that spend at the moment. Is there anyone within your coverage that stands out as being overexposed to federal?
BRIAN ESSEX: 100%. So yeah, it is a pretty meaningful vertical of spending within cybersecurity, and even more so recently with the Biden executive orders and initiatives there. But within my coverage, I would point to Tenable, which has a percentage of revenue, probably the largest percentage exposure to federal spending within cybersecurity. Followed by CyberArk. And then there are others too that have acquired or are pursuing what’s called FED RAM status, which qualifies them for Cloud-based federal cybersecurity exposure.
JACK ATHERTON: Okay, and you touched on the Biden executive order.
BRIAN ESSEX: Yeah.
JACK ATHERTON: I cover tech, but I sit on the trading floor, and security standards are getting increased attention across the rest of our trading floor and other sectors, other companies that need to focus on this increasingly. Can you talk about what Biden’s executive order is aiming to achieve, and maybe just dovetail that into what AI has to do with this?
BRIAN ESSEX: So the first executive order that’s notable was one that was drafted last May. And this kind of underlines what I would call maybe an inflection point of the way that enterprises and government entities have been thinking about cybersecurity, which is you’re in a situation where you can no longer just prevent cyber-attacks, right? There’s a running joke in the industry. There’s two kinds of companies: there’s companies that have been hacked, and ones that don’t know they’ve been hacked. There’s a pivot in the industry now that has been occurring over the past several years towards cyber resilience. All right? So it’s knowing that you’re probably going to get hacked. And when you do, you want to be best prepared with regard to how to respond to that attack, and that means becoming more resilient, that means deploying frameworks like zero-trust. And that’s essentially what the Biden executive order outlined, it’s a framework for government entities to develop a more resilient cyber posture. It was notable because it almost served as a leadership by example kind of framework where now you have from the top down, right? The awareness of cyber threats, among other things, with regard to potential impact to our national infrastructure, right? So even some of the larger enterprises like JPMorgan Chase are considered, in some cases, part of our national infrastructure. How do we make those pieces of infrastructure the most resilient? And this is basically a set of standards or framework to start to push government entities and just by leadership by example, enterprises to follow this set of principles to develop a better security posture and cyber resilience. So that was, that was the first and it’s been progressing quite nicely. And we’re now starting to see some of the spending that’s materializing because of some of those initiatives. And then the latest one just recently was another executive order with regard to developing standards, or at least a framework for artificial intelligence, to make sure that artificial intelligence technology is developed safely, to think about governance and implications to the data that could potentially be exposed. And then, you know, when we think about geopolitical impact, another thing to consider would be the fact that we have elections coming up next year. And that could be a concern. This past election, I know deepfakes kind of emerged as a topic of interest. And if you think they were interesting last election, just wait till you see this time around, because they’ve gotten so much better. So there are a lot of different topics that can arise due to the emergence of artificial intelligence, and the acceleration of development of that kind of technology that is becoming noticed by the highest levels of both enterprise and government.
JACK ATHERTON: Something to look forward to next year or maybe not.
BRIAN ESSEX: Yeah.
JACK ATHERTON: So, just moving on to the overall health of the software market, on this podcast in the past, we've talked about how enterprise vendors come under pressure this year as a result of recessionary fears, higher rates, a push for enterprises to cut costs, and focus on profitability. It feels like a slightly different environment within security software versus the broader enterprise spend space. And, Brian, you’ve been at lots of industry conferences over the last few months. How do you think management teams are feeling about enterprise spend at the moment, and as we move into 2024?
BRIAN ESSEX: Great question. Yeah, I think it is different. First of all, high level, I think software is relatively well positioned, as particularly as enterprises adopt more technology as part of their becoming more technology companies than they have been in the past. But specifically with security, with the recognition that we’re in an elevated threat environment, and it’s only getting worse. And at the very highest level, management teams, the C-suite, boards of directors are very aware of the threats that exist, it’s top of mind for CEOs. And the awareness and the concern is at such an elevated level that there’s a lot of support for incremental spending on security and a lot of concern about developing good cyber resilience within enterprise environments. And that leads to more durable budgets, which is I think what we’ve seen over the past several years. One thing that’s important to note is they’re not immune to some of the other factors that, persist throughout the tech sector. Things like elongated sales cycles, greater budget scrutiny, enterprises are still careful to scrutinize what they’re spending on and making sure they’re getting the most out of that spend. So that’s certainly a factor. But I think overall, we’re still seeing a relatively healthy spending environment across security, particularly I would say, within the highest priorities of spend, right, which generally are also the largest addressable markets of spend. So they tend to line up relatively well.
JACK ATHERTON: And is there a highest priority of spend within security? Are there certain products, tech, firewall endpoint, how do you think about the highest of priorities?
BRIAN ESSEX: I mean, there is and it depends on the enterprise. And it depends on what the exposure is. But, generally speaking, and I’ve been involved with, we’ve done surveys of Chief Information Officers, I’ve done them for over a decade. And they tend to be the top three categories consistently, they’ll move around a little bit, but it tends to be network security, identity management and endpoint security. And then within those, you’ve got certain segments that may become elevated at certain times. So it may be firewalls right now, not the top priority. Zero-trust network architecture is a pretty high priority within network security. Within identity management tends to be privileged access management, particularly after some of these ransomware attacks. Companies like CyberArk have designed technology to address specifically the threat that was exploited, or the vulnerabilities that were exploited, with both MGM, Caesars and Clorox. So we tend to see those move up, depending on what the environment is like, and what the profile the company is like, they may have different priorities, but those generally tend to be the ones that rise to the top.
JACK ATHERTON: So one of the big themes that we’ve seen emerge across software over the past few years is this winner-take-all platform approach. This has been especially relevant for Microsoft as they’ve pushed harder and harder into AI and they’ve rolled out their copilots across the entirety of their tech stack. Is this same theory relevant for cybersecurity? Are you starting to see the emergence of platform winners? And if you can talk about how Microsoft fits into this debate, that would be great.
BRIAN ESSEX: That’s a great question. Over a couple of decades covering this industry, it’s been a consistent topic of discussion, right? There's always been this debate that enterprises have had, do we go with best of breed, or do we go with the platform. And historically, you know, whenever a company has decided to purchase technology from a platform, there’s been something that they’ve given up from a best of breed feature functionality perspective, right? I think we’re starting to see that change. But absolutely right now, platformization is a big driver behind budget consolidation and growth of certain vendors in our space. Some of the more prominent ones that I cover would include Palo Alto, CrowdStrike, Zscaler. SentinelOne is emerging as a platform member as well, where you have platforms that have expanded from what initially was a foothold around best of breed technology in a space, right. So for Palo Alto, it was network security. For CrowdStrike, end point. But in any regard, they’ve expanded it to adjacent markets, and have kind of built a platform. And now we’re seeing the benefit of their ability to consolidate the number of vendors that enterprises need to manage while at the same time, being able to offer best of breed or best of suite technology on those platforms. I do think that, you know, we will see some segments where best of breed technology will still be able to gain some share. There are some very high priority areas of spend, like cloud native application protection, security, where we’re seeing some, you know, emerging vendors get some meaningful traction. But in any event, there is absolutely a desire for companies to reduce the number of vendors that they have to manage. The other thing that’s really interesting is what we’ve seen over the past few years, and I think we’re just starting to see the initial signs of the benefit of this, but it’s the emergence of the proliferation of data lakes and AI, or artificial intelligence, machine learning-driven data analytics. And what I mean by that is when you have some of these platforms that are able to develop enough scale and able to, build ecosystems with enough robust data and analytics on top of them. From Microsoft’s perspective, what they’re doing is very interesting because they do have one of the largest end point estates in the marketplace. And that’s very valuable real estate. And with what they’ve got, not just on the end point side, but the identity side, and they’re edging into network security as well, so they’ve announced that they’re entering the market with secure service edge technology relatively soon. So that gives them exposure into several meaningful and large addressable markets within software and within security. Their ability to leverage the development of artificial intelligence and copilots across that ecosystem is extremely valuable. So I think it’s really interesting what they’re doing. It’s really interesting how they're evolving their platform, but I’d also be careful to note that the security vendors are doing this too. Certainly an interesting and rapidly evolving segment of the market to be able to layer on artificial intelligence on top of exposure that each of these companies have.
JACK ATHERTON: And you’ve touched on how AI is starting to evolve the security software space, but can you maybe give a few examples of specifically how the companies are embracing AI and how it’s starting to impact the product set?
BRIAN ESSEX: I mean AI is a really interesting topic because we’re seeing it impact the industry in a number of different pretty meaningful ways. And the way that I typically start to frame it out is one from demand as well as supply. On the demand side, I always say that hackers are early adopters of new technology. So one of the things that artificial intelligence, particularly generative AI, is able to do is it’s able to upscale or level up a certain coder’s ability to develop an application. And what I mean by that is you may not necessarily need a lot of specific domain expertise, or you may not need to be particularly skilled in a certain area of coding to develop a meaningfully malicious threat. We’ve already seen an acceleration in terms of the severity and volume of threats in the marketplace. So, the demand is definitely there. On the supply side, one of the most meaningful things that’s affecting enterprises right now is a lack of talent. So we have all these systems in place to evaluate threats over enterprise networks and generate alerts, but we don’t have enough talent or enough manpower to evaluate all these threats. But now, one of the areas of what I call low-hanging fruit is the ability to elevate effective skill levels for threat defense. So what we’re seeing, and this is the case with Microsoft Security Copilot, is their effort to address this issue, right? Enable security operations analysts or employees that need to evaluate threats, enable them to do it more efficiently and more effectively. And that’s what we’ve seen as well with Palo Alto’s XSIAM, what CrowdStrike is developing with Charlotte AI and, and SentinelOne with Purple AI is exactly this — it’s the ability to leverage generative AI to make headcount more efficient. There’s a deficit of headcount, there’s essentially zero unemployment within security operations centers because there is a lack of talent, and it’s one of the initial ways that enterprises are leveraging generative AI to make operations more efficient as quickly as possible.
JACK ATHERTON: Cool. So we’ve discussed a lot today. In summary, we’ve gone through the several positive drivers of demand for the security software space as we run into next year, creating a nice setup. We talked about the evolution of the competitive landscape, the rise of the platform winners and how Microsoft slots into all of that debate, and then we talked about how AI is evolving both the product set within security software, but also creating a more sophisticated threat environment. So with that, I’d like to thank everyone for joining. I’d like to thank Brian for joining me today in what has been a very interesting conversation.
BRIAN ESSEX: Thank you for having me, Jack.
[END OF EPISODE]
