WEBVTT - Lonne Jaffe on Cyber Security Startups

0:00:06.720 --> 0:00:10.280
<v Speaker 1>So venture capital firms investing roughly three point one billie

0:00:10.280 --> 0:00:13.560
<v Speaker 1>and into a record two seventy nine cybersecurity companies last year.

0:00:13.600 --> 0:00:15.600
<v Speaker 1>That actually number sounds low because I feel like there's

0:00:15.640 --> 0:00:18.520
<v Speaker 1>a new one coming to talk to us every week.

0:00:18.800 --> 0:00:21.279
<v Speaker 1>But this data according to CB Insights. Here talk about

0:00:21.320 --> 0:00:25.360
<v Speaker 1>the VC money and interest in cybersecurity specifically. Lonnie Jaffee,

0:00:25.360 --> 0:00:28.560
<v Speaker 1>Managing director at Inside Venture Partners in our Bloomberg eleven

0:00:28.640 --> 0:00:31.720
<v Speaker 1>three oh studio Inside Ventures, though based in New York.

0:00:32.120 --> 0:00:33.839
<v Speaker 1>Nice to have you here, Welcome, great to be here,

0:00:33.880 --> 0:00:35.960
<v Speaker 1>Thanks for having me. Tell me about I do feel

0:00:36.000 --> 0:00:38.440
<v Speaker 1>like you know, um, I talked about this with my

0:00:38.440 --> 0:00:41.080
<v Speaker 1>producer Paul Brennan. I say, it feels like here's another

0:00:41.120 --> 0:00:44.400
<v Speaker 1>cybersecurity firm. M Are they that different? Are they all

0:00:44.440 --> 0:00:46.120
<v Speaker 1>going to merge one day and they're just gonna be

0:00:46.159 --> 0:00:49.000
<v Speaker 1>one big cybersecurity firms. Tell me a little bit about

0:00:49.040 --> 0:00:52.040
<v Speaker 1>all the money go going into it, uh and the

0:00:52.080 --> 0:00:54.760
<v Speaker 1>growth that we're seeing in this field. So it's one

0:00:54.840 --> 0:00:58.520
<v Speaker 1>of the more important secular growth opportunities in the technology industry,

0:00:58.560 --> 0:01:02.480
<v Speaker 1>and so a lot of entrepreneurs are looking to innovate

0:01:02.520 --> 0:01:06.280
<v Speaker 1>in the space, and so that's attracting capital, it's attracting attention.

0:01:06.400 --> 0:01:08.760
<v Speaker 1>A tremendous amount of the innovation is happening in smaller

0:01:08.760 --> 0:01:12.680
<v Speaker 1>private companies and not in the traditional larger security software venders.

0:01:12.760 --> 0:01:14.959
<v Speaker 1>Why is there so much going on in terms of cybersecurity?

0:01:15.000 --> 0:01:17.400
<v Speaker 1>They're all doing different approaches And is it because there's

0:01:17.440 --> 0:01:19.960
<v Speaker 1>all different type of kind of attacks and threats and

0:01:20.360 --> 0:01:23.880
<v Speaker 1>concerns when it comes to cybersecurity. So one of the

0:01:23.920 --> 0:01:26.959
<v Speaker 1>big secular changes that's happening is a shift from a

0:01:27.120 --> 0:01:29.880
<v Speaker 1>perimeter based approach where you kind of locked down the

0:01:29.920 --> 0:01:33.360
<v Speaker 1>outside of you shut down your walls, and two more

0:01:33.400 --> 0:01:36.120
<v Speaker 1>of a kind of biological or an immune system approach

0:01:36.160 --> 0:01:39.440
<v Speaker 1>to security where um so, so in the human body,

0:01:39.440 --> 0:01:42.280
<v Speaker 1>you have your skin, and the skin protects you from

0:01:42.360 --> 0:01:45.080
<v Speaker 1>viruses and bacteria. But if that's all you had, you

0:01:45.080 --> 0:01:47.400
<v Speaker 1>would be in trouble, right, we also have the immune system,

0:01:47.440 --> 0:01:49.760
<v Speaker 1>which is inside the body and it watches for things

0:01:49.800 --> 0:01:52.200
<v Speaker 1>that are not the self and then it attacks those

0:01:52.240 --> 0:01:55.920
<v Speaker 1>things and it can produce antibodies and um and that

0:01:56.040 --> 0:01:58.440
<v Speaker 1>gives the immunity over time. And so some of the

0:01:58.560 --> 0:02:01.760
<v Speaker 1>more interesting companies we're seeing are doing things that leverage

0:02:01.840 --> 0:02:05.520
<v Speaker 1>artificial intelligence or various types of machine learning to learn

0:02:05.560 --> 0:02:07.600
<v Speaker 1>over time what kind of attack vectors are going to

0:02:07.640 --> 0:02:10.040
<v Speaker 1>be emerging and then and then address them. Kind of

0:02:10.120 --> 0:02:14.560
<v Speaker 1>smart cybersecurity exactly. And it's smart in the sense. So

0:02:14.840 --> 0:02:17.040
<v Speaker 1>one thing the companies themselves can get better over time

0:02:17.040 --> 0:02:18.919
<v Speaker 1>as they get more customers their product, it's better, so

0:02:18.960 --> 0:02:21.480
<v Speaker 1>they get good investments. But from a customer perspective, it's

0:02:21.480 --> 0:02:24.320
<v Speaker 1>also great because the customers. The product improves as more

0:02:24.360 --> 0:02:27.600
<v Speaker 1>customers start using it because they can essentially share antibodies

0:02:27.600 --> 0:02:30.160
<v Speaker 1>with each other. That's really fast. But going back to

0:02:30.200 --> 0:02:31.480
<v Speaker 1>how you would describe me, I feel like it's like

0:02:31.480 --> 0:02:33.440
<v Speaker 1>a castle. Right. You have the wall and that's one

0:02:33.480 --> 0:02:35.480
<v Speaker 1>way of protecting, and then you have the fighters within

0:02:35.520 --> 0:02:38.200
<v Speaker 1>the wall that can kind of, you know, go specifically

0:02:38.320 --> 0:02:40.480
<v Speaker 1>whatever kind of comes at them, and they and the

0:02:40.480 --> 0:02:42.560
<v Speaker 1>fighters need to learn, right. So a lot of the

0:02:42.600 --> 0:02:46.840
<v Speaker 1>child well, so like anti virus software as an example,

0:02:46.880 --> 0:02:49.720
<v Speaker 1>you used to do things like look for specific signatures,

0:02:50.000 --> 0:02:52.000
<v Speaker 1>and really what you're doing there is you're waiting for

0:02:52.040 --> 0:02:54.160
<v Speaker 1>someone else to get attacked and then to publish the

0:02:54.200 --> 0:02:56.959
<v Speaker 1>information about what the attack involved, and then you look

0:02:57.000 --> 0:03:00.280
<v Speaker 1>for that specific thing. So we're invested in one company

0:03:00.280 --> 0:03:04.000
<v Speaker 1>called Silence that does antivirus software, but it looks for

0:03:04.120 --> 0:03:07.400
<v Speaker 1>things that viruses and worms like the want to Cry

0:03:07.400 --> 0:03:11.480
<v Speaker 1>attack that lockdown people's computers and asked for bitcoin ransoms.

0:03:11.760 --> 0:03:14.720
<v Speaker 1>It'll it'll learn what kinds of things they do instead

0:03:14.760 --> 0:03:17.160
<v Speaker 1>of looking for a specific signature. So it will get

0:03:17.240 --> 0:03:19.359
<v Speaker 1>better over time, and it can share the information between

0:03:19.360 --> 0:03:21.600
<v Speaker 1>companies without sharing any proprietary So, Lonnie, what do you

0:03:21.639 --> 0:03:23.520
<v Speaker 1>say to kind of investors? I think about our audience,

0:03:23.560 --> 0:03:26.920
<v Speaker 1>do smart audience? You know who do see and we

0:03:27.000 --> 0:03:29.760
<v Speaker 1>have on as guests. I mentioned a lot of cybersecurity

0:03:29.760 --> 0:03:32.560
<v Speaker 1>companies that come in, Um, what are the questions that

0:03:32.560 --> 0:03:34.040
<v Speaker 1>they need to be kind of being asked if they're

0:03:34.040 --> 0:03:37.480
<v Speaker 1>thinking about investing in a cybersecurity company. So, if you're

0:03:37.480 --> 0:03:40.400
<v Speaker 1>going to bet your business on a cybersecurity company as

0:03:40.440 --> 0:03:42.640
<v Speaker 1>a as a customer, you need to make sure that

0:03:42.640 --> 0:03:45.400
<v Speaker 1>they're going to be well resourced so resource to be successful,

0:03:45.560 --> 0:03:48.600
<v Speaker 1>and that their product is is differentiated in a way

0:03:48.640 --> 0:03:51.560
<v Speaker 1>that is not only better than the alternatives today, but

0:03:51.600 --> 0:03:54.560
<v Speaker 1>we'll get better more quickly. So you know, being confused

0:03:54.560 --> 0:03:56.640
<v Speaker 1>with that kind of machine learning that not only gets

0:03:56.640 --> 0:03:58.600
<v Speaker 1>better within a given enterprise, but where you can share

0:03:58.640 --> 0:04:02.280
<v Speaker 1>between enterprises, just an example. There's a company, dark Trace,

0:04:02.360 --> 0:04:05.000
<v Speaker 1>that we invested in earlier this year. Um they have

0:04:05.600 --> 0:04:09.200
<v Speaker 1>uh it's a group of British intelligence officers who got

0:04:09.240 --> 0:04:13.000
<v Speaker 1>together with with mathematicians from the University of Cambridge and

0:04:13.040 --> 0:04:17.800
<v Speaker 1>they built technology that uses sophisticated mathematics and it looks

0:04:17.920 --> 0:04:21.239
<v Speaker 1>for anomalies, it gets it builds a sense of self

0:04:21.279 --> 0:04:24.520
<v Speaker 1>within the company, and then it learns what's normal and

0:04:24.520 --> 0:04:27.160
<v Speaker 1>what's normal is constantly changing. And then when it sees

0:04:27.200 --> 0:04:31.960
<v Speaker 1>a problem, it'll be able to quarantine the the issue

0:04:32.040 --> 0:04:34.200
<v Speaker 1>and then it allows you to address it. And and

0:04:34.200 --> 0:04:37.560
<v Speaker 1>it also shares information not about your your company specifically,

0:04:37.560 --> 0:04:40.520
<v Speaker 1>but about essentially the problem itself, so that other companies

0:04:40.560 --> 0:04:43.000
<v Speaker 1>can react more quickly when an attack happens, and speed

0:04:43.040 --> 0:04:45.560
<v Speaker 1>becomes absolutely essential. So are there things that you see

0:04:45.560 --> 0:04:47.760
<v Speaker 1>in the news in terms of cyber texts you like

0:04:47.960 --> 0:04:50.680
<v Speaker 1>that should have never happened. I know that there's the

0:04:50.720 --> 0:04:54.240
<v Speaker 1>technology and the cybersecurity firms that are out there that

0:04:55.160 --> 0:04:57.960
<v Speaker 1>this should never have happened. Well that the recent Equifax

0:04:58.000 --> 0:05:00.640
<v Speaker 1>breach is a good example of one that was in

0:05:00.680 --> 0:05:03.520
<v Speaker 1>some ways of very unforced error. Right. You had in

0:05:03.640 --> 0:05:07.440
<v Speaker 1>March the Apache Struts project, a couple of researchers discovered

0:05:07.440 --> 0:05:09.719
<v Speaker 1>that it had a vulnerability. They put out a patch

0:05:09.800 --> 0:05:13.120
<v Speaker 1>on the same day. Months later, the patch still hadn't

0:05:13.120 --> 0:05:16.520
<v Speaker 1>been deployed to the machines that got attacked, and UM

0:05:16.520 --> 0:05:19.920
<v Speaker 1>and the attackers had months to just operate within the enterprise,

0:05:19.960 --> 0:05:23.000
<v Speaker 1>building web hooks and taking a hundred and forty three

0:05:23.000 --> 0:05:25.960
<v Speaker 1>million people's personal records, which comes at a huge personal cause.

0:05:26.000 --> 0:05:28.200
<v Speaker 1>That's a ton of time in the digital world. It is, yeah,

0:05:28.240 --> 0:05:31.159
<v Speaker 1>to kind of play around, poke around, grab information. Yeah,

0:05:31.160 --> 0:05:32.680
<v Speaker 1>so that's the kind of thing where if you have

0:05:32.720 --> 0:05:35.640
<v Speaker 1>an immune system running inside your enterprise, even if you

0:05:36.000 --> 0:05:38.560
<v Speaker 1>even if you have an error and the perimeter you

0:05:38.560 --> 0:05:41.280
<v Speaker 1>can sometimes catch those issues and address them. UM. I

0:05:41.279 --> 0:05:44.000
<v Speaker 1>feel like cybersecurity continues to evolve, like everything else in

0:05:44.000 --> 0:05:45.800
<v Speaker 1>this world just got about thirty seconds left here. What

0:05:45.839 --> 0:05:47.400
<v Speaker 1>do you see as kind of some of the newer trends.

0:05:47.400 --> 0:05:49.040
<v Speaker 1>I feel like ransomware was a big thing that we've

0:05:49.080 --> 0:05:51.760
<v Speaker 1>been talking about over the past year. What happens next

0:05:52.160 --> 0:05:54.240
<v Speaker 1>one thing I'm worried about and we haven't seen much

0:05:54.240 --> 0:05:55.719
<v Speaker 1>of this, although we did see an example of it

0:05:55.760 --> 0:05:59.960
<v Speaker 1>earlier this year in India. Is um is people using

0:06:00.040 --> 0:06:04.200
<v Speaker 1>machine learning or AI for attacking, So systems that can

0:06:04.240 --> 0:06:08.480
<v Speaker 1>go into a and learn how to avoid being caught,

0:06:08.640 --> 0:06:10.240
<v Speaker 1>and you know that that will spark a bit of

0:06:10.240 --> 0:06:12.839
<v Speaker 1>an arms race, so hopefully, so hopefully we won't see

0:06:12.839 --> 0:06:15.160
<v Speaker 1>that anytime soon, and it becomes smarter and smarter and

0:06:15.200 --> 0:06:17.840
<v Speaker 1>figuring out how to get in exactly. UM, this is

0:06:17.839 --> 0:06:20.280
<v Speaker 1>a great conversation. Thank you, thank you. Hope you come

0:06:20.320 --> 0:06:24.120
<v Speaker 1>back to here. Lonnie Jaffee, imagining director at Inside Venture Partners.

0:06:24.120 --> 0:06:26.200
<v Speaker 1>They are based in New York City. Lonnie, in our

0:06:26.360 --> 0:06:30.599
<v Speaker 1>New York eleven three oh studio on this Friday, you're

0:06:30.640 --> 0:06:33.360
<v Speaker 1>listen to Bloomberg Markets. I'm Carol Masser in our Bloomberg

0:06:33.360 --> 0:06:36.000
<v Speaker 1>eleven three oh studio and this is Bloomberg Radio.