CEO Matt Moynahan, discusses how the Cybersecurity landscape has changed with the emergency work from home directives many companies are currently following.

Episode Table of Contents

• [01:16] Working from Home Is the New Normal
• [04:52] How The Enemy is Waiting for Working from Home Weak Links
• [11:10] A Single Security Policy that Secures People Working from Home
• [15:31] A Broader Set of Capabilities Required When Working from Home
• About Our Guest

Working from Home Is the New Normal

Arika: We have a great guest. For a second time, we have Matt Monahan from Forcepoint, the CEO. Hi, Matt.

Matt: Wish I was invited back earlier and not under a crisis situation but that's okay. I'll take it.

Eric: I feel comfortable working from home when my CEO is working from home. So this is good.

Arika: Yes, he took the words out of my mouth. We're all here in our personal bunkers. Right now I think we're all adjusting to this new normal and there's just so much uncertainty. And Matt, as a leader of Forcepoint, one of the first questions I think we'd like to talk about is, you can plan for a lot of things, especially in cybersecurity companies, you're always planning for the unexpected to be prepared.

Arika: But I don't think anyone truly planned for this. It didn't matter how comprehensive your business continuity plan is. How are you handling things? That's my first question to you. How's it going?

Matt: Yes it's been interesting times for sure. You have companies do their best work preparing for the worst, and all of a sudden something catches you from left field and that totally throws those plans up in the air.

The Personal Impact and Economic Impact of Working from Home

Matt: I think this was a unique situation because it was a combination of both the personal impact and the economic impact converging at the same time. We've experienced recessions in the past, we've experienced unfortunate calamities globally in the past. These two things were right on top of each other, which led to the first.

Matt: Just with Forcepoint CEO hat on, obviously, health and safety of our employees was job number one. And I think we took pretty proactive steps early on to really make sure that we went into lockdown mode as soon as we had some visibility that this was bigger than a breadbox type of situation.

Matt: So we went into hunker-down mode on the personal safety side and then quickly went into the second phase, which was the economic safety, which is managing our company through a situation like this to weather a downturn that may be longer than people realize.

Matt: But I think we were fortunate to get on top of both of those things fairly early and are doing our best just like any other companies, I'm sure.

Eric: Matt, how do you think about approaching customers? They're going through the exact same calculations. They're taking care of their people depending on what industry you're in. You're trying to serve the American or your nation's economy in many ways. How do you prepare for that? How do you think about that?

Matt: We're a global company, Eric, obviously as you know, and so this is a global issue. So I think this is one of the first we've seen where instead of just monitoring a country in something they're going through, it's the globe.

A Moving, Rolling Thunder

Matt: I've been touching base with teams and town halls literally country by country by country basis because it's such a nuanced thing to everybody who's going through it and the epicenter keeps moving. So this is a moving, rolling thunder type of thing we're trying to do.

Matt: In the meantime, we're in the somewhat fortunate situation that we're in cybersecurity, which isn't slowing down, it's heating up. But one of the things that's just driven me nuts around the cybersecurity space as I addressed the employees was just the ambulance chasing. Take advantage of a calamity-type of approach which just is unbefitting, particularly with something like this.

Matt: So we've had to keep the lights on. We've had to go and sell and we have to go engage. But it really is less selling and more offering of help in the truest sense of the word, not in a disingenuous way, and offering outreach to our existing customers and offering to be there to prospects in a way that hopefully will only make us a stronger company on the other end. You've got to walk the walk in times like this.

Eric: So be available but don't jump on them and try to hock your product, if you will.

Matt: And do it in a genuine way. Relationships aren't events, they're long-term engagement and I think if you think in terms of a renewal or a sale, you're totally missing the boat with where cyber is going these days.

Arika: Well, and that said, I think some companies are more in survival mode than others right now, but in terms of cybersecurity, are you seeing more of an urgency?

How The Enemy is Waiting for Working from Home Weak Links

Arika: We now have people who are working and getting on the network from home. Hopefully they're doing it in a secure way, but we also know that the enemy waits for these types of weaknesses to go ahead and still proceed with attacks. And so are you seeing that type of urgency right now from customers, be it government or commercial?

Matt: I think this is a fascinating situation. I think this will be recognized as sort of the great awakening, a global awakening for cyber. And I don't think the implications yet have been fully thought through or experienced.

Matt: So let me start with the first one. In the old IT way, if someone said, "Hey, we need to go prepare the company to be 100% remote," IT would have come back and said, "I need $10 million and 10 months to prepare for it."

Matt: Or years.

Arika: Or, "We can't do it." They would have said, "We can't do it."

Eric: But you're right.

Matt: They moved. So the first thing is, and I think this is important for how the paradigm needs to shift in cybersecurity, companies should realize and wake up and take great pride in that overnight they changed things. They thought they could handle remote workers. They didn't know they were going to have to handle their entire company being remote.

Matt: I think the first one is take pride in IT's ability to move fast. And I don't think they fully have comprehended everything that has changed in this new world of cyber.

An Era of Permanently Working from Home Workforces

Matt: I tend to tell a lot of the prospects that I'm speaking with, this isn't around securing remote workforces.

Matt: This is around securing your people and data in an era of permanently remote workforces. And that's a very, very different mindset. It's nuanced, the story's still playing out, and hackers are clearly taking advantage of this.

Matt: One of the different things in this situation is just some of the fear and anxiety that has existed has made people the target for various attacks and phishing scams to steal credentials that I think the ramifications of which have yet to be seen.

Matt: So I know that, let's just say, every CSO now is heightened to the need to understand behavior on the networks in times like this because it's not about IT anymore. It's around who's on my network and what are they doing? Whether they're in home headquarters or now at the edge, completely remote.

Eric: I feel like we're in the age of the remote worker but it's about so much more than the remote worker. The fundamental components of protecting data and personnel haven't changed just because people went to home. The location where they work from might have changed.

Matt: This was the problem of cyber. Cyber has never focused on people as the tip of the sphere. It's always been tech. Then the edge, pre-COVID-19, was the internet of things. And now it's the internet of people. So if you look at what's happening with the world, how small does the world feel now? It feels incredibly small.

Eric: It's about 2,800 square feet for me. I don't know about you.

Boundaries Blurring in IT with Working from Home

Matt: Literally and figuratively. Something starts in China, a month later, it's in the U.S. So you see nation states lines blurring with immigration. You see boundaries blurring in IT with work from home, you see religions blurring. All this stuff happening in the world. It's all about people, it's the internet of people and that is the edge. People are the new perimeter. It's not a device. The devices are hanging off people.

Matt: I think hackers have proven that people are far more worthwhile attack points than Silicon and that's what they're doing. So I think that's why this is such an interesting period for us because people's behaviors now are driving the security architecture. It's not the other way around.

Eric: People are the new perimeter. I've heard you say that so many times, and I think this crisis, this global pandemic we're dealing in, really underscores how important that is. As an employer, you need to understand where your data is, how your people are interacting, but how to protect them, too.

Matt: Well, it's both. And that's why I say protecting your users, number one, from credential and identity theft. And they're being attacked and more likely susceptible when they're high anxiety, whether it's for the job, or health, their family. You've got kids going on CSO's laptops at home that never have done that, going to all sorts of websites. Talk about a BYOD, this is BYIT bring your own IT.

Matt: I've engaged with more CSOs over the past two weeks that are asking things around, how do you control printing to home printers?

A Mass Change to the Way Business Conducts Business

Matt: We've had examples of clients who have had employees upset with how they handled the COVID-19 process and steal information and publish it to Wall Street Journal and New York Times, which obviously can make executive's lives extremely difficult.

Matt: So again, I think the notion of misuse of data, theft of data, behavior, is all going to play out over the next decade as really it's not about tech anymore. This is around people and the tech they need to do their jobs and you better secure that high-level environment or else none of this matters quite frankly.

Arika: So Matt, you said you're having a lot of conversations with the CSOs, what kind of advice are you giving them beyond, I'm sure, how to print at home? But in terms of just what the new world order will look like and how they should be thinking about things in the future?

Matt: COVID-19, unfortunately, is a poster child type of use case where there's mass change to the way business conduct business. But our message has not changed. And this could have been an earthquake, it could have been a power generator outage, it could have been COVID-19.

Matt: It will be something and there may be other positive things. The cloud was one of those events. Now you look at what's happening at Microsoft and Amazon, this is here to stay.

Matt: I think this is around using this as a great case study. Sit back, don't think about tech. Ask yourselves, "What did you learn new about your people? What were most of your concerns around data? What data were you concerned would be stolen?

A Single Security Policy that Secures People Working from Home

Matt: What people were you concerned might turn against the company? Why? Be very introspective. And if you can answer those two questions, all the tech will fall out of the trees and can align for you to solve that problem. But if you're thinking about a point product and buying more, that's not the way the world's going to work.

Matt: So I do try to help prepare for a world where you need a single security policy that enables your people to be secure wherever they are and remove friction wherever they are when they're acting in accordance with the rights and privileges you grant them, full stop. And that's to protect them as well as your data. I think the shake-out from this is going to be felt for years to come.

Eric: Matt, we started chatting today about how IT just made it happen. In the past, they would have planned, it would have been huge. They just made it happen. Do you think security will follow? Do you think that now that we are remote, now that the workforce is disseminated out to homes and wherever, they'll just make security happen because they have to? Or will we go back to somewhat of the old norm?

Matt: I think it's a great question. And this is part of the reason why I'm so excited for Forcepoint. We have to make this happen. As soon as you show the ability to have a single policy, follow someone around wherever they go and protect them from nation-states who are trying to steal their credentials and also protect the company from bad behavior if that happens.

Paradigm Shifts Inside Cybersecurity

Matt: I think you're going to see a significant movement in paradigm shifts inside of cybersecurity. I think you're going to see convergence at the product level which has to happen. Lead to convergence and consolidation of the companies and cybersecurity has to come together, Eric, it has to.

Eric: Because they need outcomes. They don't need product.

Matt: They need outcomes. And the products have proven that independently, despite the effort of the most sophisticated CSOs out there. You can't stitch a bunch of stuff together to create a shield as well as you need to. And so cybersecurity is going to have to do it. I think that what we're talking about—forget   about the tech, take the capabilities and stitch them to use cases that matter for you.

Matt: If you can solve the use cases, you can solve customer problems. If you focus on features and benefits of a product, it's not solving the use case. If I ask a group of a hundred CSOs, "How many people want to deploy DLP?" A data leakage prevention technology.

Matt: A couple of hands will go up because of compliance and obviously it's a fairly sizable market. But if I ask that same group, "How many people want to stop data exfiltration in a hybrid cloud environment, particularly in a situation like COVID-19?" A hundred percent of the hands will go up.

Matt: Why is that? You would take 10 vendors to go solve the second problem. Anyone can go sell DLP. So this is really powerful.

An Increasingly Marginalized Cloud Stack

Matt: That's just going back, Steve Jobs or any Harvard Business Review article, and say, "What job is your customer hiring you to do?" Stop selling the technology and start solving a problem, doing a job for them. I think this was just going back to basics in many cases.

Eric: So let's talk 2025. We're all vaccinated, COVID-19 is somewhat behind us. Obviously, there's a tremendous amount of damage and loss and pain. What does the cybersecurity world look like five years from now with the learnings we're gaining right now, really? What does it look like in your mind?

Matt: I think it's going to accelerate the cloud. If you look at anything, whether it's Zoom or Microsoft Teams or just the explosion. If you have to put a box in the network, this incident clearly showed the impact that that will have on your ability to rapidly respond. So it may sound crazy to say that the cloud will accelerate, but it will accelerate, number one.

Matt: You will see Microsoft and Amazon continue to raise the bar of what good enough security looks like. And it won't be good enough because they're never going to take liability policy encryption keys on their shoulders. They will provide an increasingly marginalized cloud stack.

Matt: That cloud stack will get increasingly expensive because of the control they have and you will see baby clouds start to form. These interim, minor clouds that people can throw up because IT's so cheap.

A Broader Set of Capabilities Required When Working from Home

Matt: I think you're going to start seeing convergence of what were historical product categories and a lot of Gartner Magic Quadrants go away because it's bleeding into each other. So imagine a world where you have choice of platforms to go on from a security standpoint and not trying to cobble together products.

Matt: Your environment, instead of having 150 vendors will have five or six platform providers and security. I think that's where we're going. Those platform providers better play well together. It's very different than Amazon and Microsoft creating their own islands of compute.

Matt: Security vendors are going to have to integrate in a way they never have before and they're going to have to go deeper in providing a broader set of capabilities because a one-trick pony isn't going to cut it because no one's going to go with that.

Matt: And the other thing you're going to see is customers are starting to be relinquent, both because of the challenges of COVID-19 and others. It's got to be easy to deploy. They'll never put more than one endpoint on an endpoint from one platform provider.

Matt: Current endpoint technology, some enterprise have six, 10, 12 different ones on there. I think you'll see three, four, five, and that's it. There'll be one per provider. So a lot's going to go on. I could talk for hours about that, but I think it was underway, I think COVID-19 will accelerate a lot of this.

Arika: Well, I think we'd love to have you back. I think we actually would like to have you back sooner rather than later to talk about what really has been the response once things get back to the new normal. And hopefully some of the things that you've spoke to, those will come to fruition. So thank you so much, Matt, for taking time to speak with us today. We appreciate it.

About Our Guest

Matt Moynahan is the chief executive officer for Forcepoint. He joined in 2016, bringing more than twenty years of security, cloud services and technology industry leadership, ranging from product development to sales to general management. Throughout his career, Moynahan has been steeped in nearly every facet of security, including digital rights management, encryption, application security, network security, web and email security, and insider threat.

Under Moynahan’s leadership, Forcepoint launched a bold new approach to cybersecurity, centered upon enabling customers to focus on what matters most: understanding people’s behaviors and intent as they interact with critical data and IP wherever it resides. Moynahan also championed Forcepoint’s acquisition of the Skyfence CASB (cloud application security broker) business, furthering the company’s ability to protect data anywhere, including within cloud applications.

Before joining Forcepoint, he held a series of senior leadership positions, most recently as president of Arbor Networks. During his tenure, Arbor Networks gained a leading share in the distributed denial-of-service (DDoS) market, launched the world’s foremost cloud-based DDoS service and successfully moved into the Advanced Threat Detection (ATD) market.

Prior to Arbor Networks, he was the founding president and CEO of Veracode, the leading cloud-based application security services provider acquired by Computer Associates in March 2016. Previous to Veracode, Moynahan served as vice president of Symantec’s Client & Host Security and Consumer Products & Solutions divisions, leading the latter to $2 billion in annual revenue.

Moynahan holds a bachelor’s degree in economics from Williams College and a Master of Business Administration degree from Harvard Business School. He currently serves on the board of directors of Care to Compete, a nonprofit organization supporting athletes with brain damage and chronic traumatic encephalopathy, and is a member of the Big Brothers Big Sisters program.