Are you getting ready for the upcoming RSA Conference, the world’s leading information security conference and exposition? The event is quickly approaching, taking place April 24-27, 2023 at the Moscone Center in San Francisco. This year’s theme: Stronger Together. In the cybersecurity industry, no one goes it alone. Instead, we build on each other’s diverse knowledge to create the next breakthrough—exchanging ideas, sharing our success stories, and bravely examining our failures.
Ahead of the show, VMblog received an exclusive interview with Nathan Burke, Chief Marketing Officer at Axonius, a leader in cybersecurity asset management and SaaS management.
VMblog: To kick things off, give VMblog readers a quick overview of the company.
Nathan Burke: Axonius was founded in 2017 by our CEO Dean Sysman, our CTO Ofri Shur, and our Chief Architect Avidor Bartov. We started with a simple, yet difficult question: how many assets do you have, and are they secure? By collecting, normalizing, deduplicating, and correlating data about devices, identities, software, SaaS apps, and security controls from hundreds of data sources, Axonius provides three things:
- A comprehensive asset inventory – to show all users, devices, software, SaaS applications, cloud instances, vulnerabilities, and more.
- Queries to span disparate data sources – to let customers ask questions, get answers, and uncover gaps and risk.
- Automated actions – to trigger based on any query.
VMblog: What market needs or problems are you addressing in the security space?
Burke: Despite having access to some of the most sophisticated tools on the planet to protect against, detect, and remediate threats and vulnerabilities, security teams still struggle to answer basic questions like, “How many Windows devices are in my environment?” or, “Which of my cloud workloads are misconfigured?” That challenge is getting even more complex with time as the sprawl of devices, users, cloud services, SaaS applications, and software continues to increase.
By connecting to the various security and management solutions you’re already using that know about assets, Axonius gives organizations a single system of record for all infrastructure to:
- Accelerate incident response investigations by providing access to timely, comprehensive information without having to search through disparate data sources.
- Improve vulnerability management by surfacing which assets aren’t being scanned for vulnerabilities and helping security and IT teams prioritize remediation.
- Find gaps and discrepancies in your CMDB and improve CMDB maintenance.
- …and so much more.
As a result, even when tools change, security and IT professionals can rest assured that they will always have the same visibility, query functionality, and response actions as before to keep their organization safe and secure.
VMblog: How can attendees find you at the show? How many folks are you sending? What can attendees expect?
Burke: RSA is arguably the most important conference in our industry every year, and more than 50 Axonians will be on-site to help attendees better understand how we can help solve some of their toughest asset management challenges.
You can find us at Booth 734 in the South Expo Hall, and there, you’ll be able to see demos of our solutions and ask questions of our experts. We’re also giving away game consoles this year, which contain over 400 popular games including Super Mario Bros, Galaga, and Donkey Kong. Additionally, if you already know you want to meet with us, request a meeting here.
VMblog: What are some top priorities for security leaders at RSA to consider this year?
Burke: Nearly every organization has felt the impact of the recent economic downturn and has been forced to reevaluate spend. For IT and security teams, this has meant smaller budgets and needing to find ways to get “more bang for their buck.” But as IT and security leaders continue to ressasss their tech investments, they should also prioritize cost optimization and work to identify inefficient spend.
Inefficient spend shows up in all areas of an organization, but within IT and security teams, it can often be found in two main areas: manual labor and unused or overlapping infrastructure. We recently published an ebook on the topic titled, “Cost Optimization: The Consensus IT and Cybersecurity Priority,” which readers can find here. In summary, there are a lot of things that IT and security professionals can be doing to put dollars back into their organization – and justify their teams at the same time.
VMblog: What are some of the security best practices you would deem critical?
Burke: First, you have to know what you have – everything from devices to cloud instances to SaaS applications and users. Only when you have ongoing asset visibility can you then improve your organization’s detection and response, vulnerability management, cloud security, and more. So security teams need to prioritize creating a comprehensive and accurate asset inventory so that they can better track changes, take action and secure assets.
Second, organizations need a long-term, collaborative, and effective SaaS strategy. Over the last few years, the consumption of SaaS applications has dramatically increased. In fact, 66% of IT and security professionals spend more on SaaS applications today than a year ago. But as adoption rates continue to surge, SaaS apps introduce a slew of challenges for security and IT professionals to tackle, including ensuring employees are properly onboarded and offboarded from applications and securing sensitive data stored and shared across the company’s SaaS app stack. This is why organizations need to adopt a comprehensive approach to SaaS management that solves IT, security, risk, and finance teams’ challenges by giving them a single source of truth into every SaaS application.
VMblog: The keynote stage will be talking about major themes this year. But what trends is your company seeing that we should be aware of in 2023 and beyond?
Burke: We talk to hundreds of IT and security professionals every month to learn about their challenges, discoveries, strategies, and priorities when it comes to managing and securing their assets and reducing their attack surface. Aside from a focus on understanding where unrealized or overlapping investment can be recovered, many of our customers have also expressed a desire to demonstrate their strategic value to an organization.
Security and IT teams do more than prevent breaches and have worked hard to move away from the perception that security is the department of “no.” Instead, they can help an organization identify and save on wasted costs while contributing to top line revenue. And we’ll continue to see security teams remind us of this by emphasizing their collaborative nature. There’s a reason Gartner identified human-centric security design as a top cybersecurity trend for 2023.
VMblog: Does your company have any speaking slots at RSA? If so, can you tell us more about those sessions so people can get them on their schedules?
Burke: We have three speaking slots at RSA this year, including:
What Does Progress Mean in Security?
When: Wednesday, April 26 at 3:20 PM
Where: North Expo Briefing Center, Booth 6545
IT and security teams are being asked to do more with less, all while proving their value beyond reducing risk. Security maturity models, scores, and frameworks exist – but aren’t one-size fits all. Above simply saying, “We need to show security progress” as a goal, this session seeks to address and discuss what the word “progress” means in cybersecurity, including:
- What Goals Matter? How do we assign objective, defensible measures to identify progress?
- What Roles Do Tools and Process Play? How can we evaluate the efficacy of tools, processes, and controls and their value over time?
- How Should We Build Our Teams and Skills? What are the areas of investment needed today, and where should we proactively invest in our people for tomorrow?
Who Says Cybersecurity Can’t Be Creative?
When: Tuesday, April 25 at 9:40 AM
Where: Coming soon; Keep an eye on the RSAC agenda
Creativity is a rare and vital skill for anyone looking to enter or excel in cyber. Only by taking a creative, innovative approach to cybersecurity can security teams stand a chance of stopping an attacker in their tracks. Embracing creativity forces practitioners to move beyond asking old questions and expecting the same answers. This session will help move programs from the reactive to the proactive. Panelists include Daniel Trauner, Senior Director of Security at Axonius, Caitlin Sarian, Global Lead of Cybersecurity Advocacy at TikTok, Chris Cochran, CEO and Cohost of Hacker Valley Media, and Mari Reisberg, a creativity coach. The panel will be moderated by Axios cybersecurity reporter Sam Sabin.
Whoa, You’ve Been the CISO for 3 Years at Your Firm-Now What?
Monday, April 24 at 2:20 PM
Where: Coming soon; Keep an eye on the RSAC agenda
Three years into a leadership tenure at a firm, might leave some asking whether to stay or go. This session from CISOs to CISOs, featuring Axonius CISO Lenny Zeltser and Yael Nagler, CEO of Yass Partners, provides a framework to assess the current impact and explore the options ahead. Attendees will leave with a toolkit to unstick, continue to evolve, stay energized and figure out where to go next based on their experiences, observations, and trends in the industry.
VMblog: And beyond RSA, what is on the horizon for Axonius? Anything we should keep an eye out for?
Burke: We’re always working to enhance our solutions and find ways to increase the value we bring to our customers. Along that line, we’ll be making some announcements in mid-May that will help our customers manage their assets with even more control and insights. The amount of assets an organization has will only continue to increase with time, and we want to be the solution that can help every organization manage that complexity and be their system of record for all infrastructure.
VMblog: As a show sponsor, do you have any tips for attendees to better prepare or handle the conference?
Burke: Every year, I write a guide to RSAC, which you can find here. It outlines the trainings, keynotes, and even parties attendees should be most aware of. While RSAC can be overwhelming, planning out your schedule ahead of time and making sure you attend the sessions that will give you the most actionable takeaways is my best advice. And of course, to come meet with Axonius at our booth!
##
