How Cyber Sales Teams Beat Incumbents in AI Security: Richard Stiennon, Founder & Chief Research Analyst, IT-Harvest

At the start of 2025, Richard Steen tracked 80 AI security vendors. Today, in the middle of October 2026, he tracks more than 560. And frankly, every time you listen to this, in November or listen to the future, there's going to be 10, 20, 50 more probably in the space. Now, Richard has met cybersecurity itself since before most of today's sisters even were in the workforce. He sold the first checkpoint firewall ever to Ford back in the 90s. He was a Gardner analyst in the aughts. He was a Fortinet CMO in the teens. And he's built his own firm, an analyst firm and also a database called Heidi Harvest, where he tracks every single vendor in cybersecurity and all the products that they have. So there's no better person to help us make sense of the AI security space. We talked about how it's how he splits it up, how security buyers are thinking about spending AI security and a lot more. Here are three or four things to listen out for in this episode. Firstly, how he thinks this is a hugely opportunistic time for startups right now because of one way buyers are thinking differently about their stack than they've ever thought before. Also, where the lines are between AI for security and security for AI, and where the opportunity really is in those buckets and the submarkets below them. He was advising the CMO of an AI security startup the two things that you'd have them do and do right now without any delay. And then finally, one last thing to listen out for is he talks about the guardrails around AI that CISOs are thinking about are buying first and where they're spending their money. So we cover a lot of ground in this episode, uh a lot of detail in there, and uh a lot of good things to take away when we're trying to make sense of AI for security. Here's Richard. Well, Richard, welcome to the podcast. Thanks for having me, Andrew. Yeah, we're tackling something that is top of mind for a lot of people these days, which is how on earth do I make sense of the AI insecurity, let's call it, right now, space. There seems to be a lot of companies, a lot of people claiming things and maybe a lot of confusion both on the go-to-market side but also the buyer side. So we're gonna try and deconstruct all this and use your experience and your knowledge to try and make it all make sense for us, Richard. But before we do that, we have to turn to the cyber go-to-market talk podcast, spin the wheel. What do we call it? The magic wheel or the the wheel of misfortune. I've got like that, loads of different names for this whole thing. I'm gonna spin it right now and it's gonna cover the subject, and we'll tackle it towards the end of the discussion.

So here we go.

All right, you're gonna be in the cyber donut hot seat. And what we're gonna do is present you with a scenario about an early stage cybersecurity company and see what your immediate thoughts are without any preparation whatsoever, are about how to help them solve their problems. So hang tight for that. We'll come back to that towards the end. Cool. All right. So, Richard, the the original genesis of this episode was a post you put out, I think, a week or two ago now, where you made the point that in the IT Harvest database, which you produce and and track and use, there are, I think you said 567 companies in the big, big space of AI security. And, you know, probably by now, two weeks later, that might be an R30 or 40 in there, who knows? But it means for a very confusing and market for everyone, salespeople, marketing people, but also buyers as well. So let's let's talk about the breakdown. We can't just look at it all in one big number, 560. How should we be thinking about breaking it down into some subparts that uh we can more easily digest?

Yeah, I'll talk about what I'm doing because I've got to break that down, right? It's the category is too big. And I wrote that Substack and a press release when the number of AI security vendors exceeded the number of GRC vendors, which is just crazy to think about. So, first of all, the the really big demarcation is between companies that apply AI to solve existing cybersecurity problems or yes, cybersecurity problems. And that's actually the area that's most interesting to me. The other is security for AI, right? So, in and so let's break that down. Security for AI came first. In a very unusual occurrence, the EU created an AI regulation well before any of us were thinking about where this was all going. So summer of 2023, so just you know, six months after ChatGPT, but obviously, you know, bureaucrats, they were working on it for well over a year. And they, if you read it, it's a lot about well, we're not going to sell toys to kids that talk to them and manipulate them and stuff like that. So great. But there are regulations that you have to comply with if you're creating products for sale in the EU. So what came first was okay, how do we protect our users and how do we protect our company from users amusing their access to AI? And if you think about it, the very first use case for AI was we're gonna just use a web browser to get to ChatGPT and we're gonna ask you questions, which include, hey, here's a medical record, you know, or a list of medical records, or, you know, the last 200 people I talked to over the phone to get their credit cards. You know, so you're gonna be putting PII in there, health information, financial information for the company. And a lot of those things, yeah, if you really look at it, right? The OpenAI and anthropic don't train on your data, right? And they say right there, they don't train on your data. And that's just not how AI works, right? It's not constantly learning. And that'd be awesome if it did. Just imagine the things it could learn. But it's you know, a massive hundred million dollar effort to train these AI among us. And they're not grabbing your data, especially when they say they're not. But that doesn't matter because your data went out of your control. So, in a compliance regime, especially HIPAA, you violated if somebody uploads medical records to Chat GPT, you know, you're gonna get a fine for it. So you have to do something. So the guardrails that prevented that were the first solutions that are out there and are selling. And uh, and that's the first concern for CISOs. You know that CISOs, their first reaction to anything is not to allow it, right? And I I remember going into Palm Pilot when I was still at uh Gartner, and the IT guy told me, well, they just don't allow Wi-Fi. You know, they they blocked Wi-Fi, right? It's not gonna happen here because that's crazy talk, you know, letting people get access to the internet and hold meetings and stuff from the conference room. So, of course, the person telling me acknowledged that the very first thing anybody did was bring in Wi-Fi routers, you know, from home that they'd bought at Best Buy. And so they had to institute scanning for Wi-Fi. And that's where what what do we used to call it? Wisp wireless I WINDS, wireless ideas to discover all these things. And if you go back even further, I I sold the first checkpoint firewall to Ford Motor Company, and at the time Ford was had internet access, and they're blocking access to the internet for people other than for email. So within you know weeks, people were using these services where you email the URL to the server and it would respond with full HTML of the web page. So through email, and if you clicked on the links there, hot links had generated new emails that would bring the next page to you. It's like people are gonna find a way around these controls. Anyways, that is the first reaction of most organizations, especially you know, big ones, to innovation like this. It's like, yeah, we're just not gonna allow it. Sounds risky, right? This is two years ago, we didn't know the advantages. We didn't know that every single developer had to use AI in order to do their job. And obviously, marketers, salespeople are just totally leveraging AI today. So we got to put guardrails in. Okay. So you say you go, you'll go to a company and you'll say, hey, we've got a guardrail, use ChatGPT, you use Microsoft, Google, whatever, we're gonna provide guardrails. And they say, yeah, but everybody's using perplexity. So then you go, oh man, we got to develop a tool to discover all of the AI that's being used in your organization. It immediately moves you from the guardrail business to the governance business, right? Because the very first step in governance is always discovery. So there's a lot of the guardrail companies right now are evolving and melding with the governance companies and vice versa. And they're taking another direction, too, because if you think about it, if we're gonna say you're not gonna be able to upload credit cards or financial information or PII or health information, that sure sounds like DLP to me, right? So it is. It's exactly DLP, but it's for a new channel. And every single solution, uh over 30 of them or guardrails, use AI in order to make those decisions. So gone are the regular expressions, which made DLP so difficult to deal with, right? Because you can't write them generally enough to catch all the edge cases. AI can do that. Very expensive if you use the foundry models or frontier models. And that so the DLP vendors, so Gabriel people realize that wow, this actually works, and we can actually do this without having we can we have policies, the kinds of things that you don't want to share with the world. We can say no healthcare information, but we don't have to define every single instance of healthcare information because the AI is smart enough to figure that out. And why not just do that for email as well and file transfer and FTP servers and all the rest? We can start doing DLP that's driven by AI for the entire organization. And I think, and especially when you look at the DLP vendors, right? It's like the one who pretty much owns the space is semantic. You know, come on, if you can't compete against broadcam, what are you doing in this business? So huge opportunity there. And then the, but then there are others that are kind of more core to doing AI, and those that uh protect the model or the data that you use your AI on. So there's model protection is a subcategory that I track. Data federation is another one. So now you can have a common pool of data and share it just with particular partners and they use fully homomorphic encryption. I can say it, but I'm not saying I understand it. But it is the magic way that you can have multiple people using stuff and they can't see what the other person does, and it's all encrypted. So those are the the security for AI stuff. The AI for security is just so awesome. And I think the every single area of security has solutions now that are AI native. They brought AI to the table to do it. So let's talk about vulnerability management. You know, obviously the bane of every CISO's existence, right? It's something that you kind of have to do because there are a bunch of regulations that say you have to do it and you have to be able to approve and be audited that you're doing it, but you still have 40,000 vulnerable systems that you're not patching every week because it's too hard and it breaks things, so you don't do it. So along comes AI that can step in and replace, you know, take the results from your scanner, or you'd use the ONESIS free scanner and use that to identify the critical vulnerabilities, enrich the data with the CVEs and the exploitation scores and all the rest, decide which ones have are reachable, for instance, while looking at network traffic, and then stage one of these implementations is well, we're just gonna connect right to Jura and we're gonna create trouble tickets for and tickets for each system that has to be patched. Uh, we're gonna find the patch, we're gonna make it easy for you, and we're gonna, you know, maybe test the patch in a sandbox. And we're gonna find the person who's responsible for the system and bug them until they they fix it. So it is automating vulnerability management. And it's it's gonna take a while for most organizations to take the next step, which is it's just gonna fix it for you. And we're not far off, and I I talk to organizations that are already doing it, but we're it's just getting better and better as it will. So another one is email security. This is one you can try at home if you've got access to Chat GPT, and I've been doing it for a couple of years now. So you so you get a really good phishing attack, right? It's like you're like, wow, you know, I don't want to research all these, you know, find the URLs or put it in a sandbox and detonate it. So you just show full headers, you know, in your email client, control A, control C, cut and paste it into Chat GPT, and now I just say fish question mark, and it gives me a complete analysis, right? And it'll it'll say, yep, this is legitimate. It really is from DocuSign, DKIM is good, SPF is good, and all this stuff. Or it'll say, no, this is definitely a scam. Or it'll say, I wouldn't click on that, I'd go directly to your account over there and do it. And then I went beyond that because what what other thing besides full headers on an email is just a mess, you know, block of data like that? It's crash reports from your computer. So your computer crashes, and you can set a report, which nobody ever does because why would I, you know, there could be passwords and all sorts of good stuff in that crash report. So you just you just don't do anything with it. Well, now you can open it up and you can cut and paste it into Chat GPT, and it'll tell you what triggered the crash, what memory leak, you know, what did you have running while it was doing it, and all the rest of that. So obviously, automating email security with AI is a logical step, right? Just look at every email. And while you're there, look at, you know, you've looked at the email, you've read the email, you've determined if it's spam or not. And you can, or business email compromise, whatever it is. And but you can also, you know, say, hey, this is an important one. I'm gonna send a text to to you that you just got a response to your sales pitch. These are things you don't want to miss. I know I'm guilty of missing emails, you know, that I've been waiting for. For some reason, they just slip by. Of course, I get 500 emails a day and don't use any particular tool. I've got to make sure I look at them. I'll go back and search. You know, where's that? I sent that yesterday. I'll go in and respond and I'll search on it. But AI applied to emails is going to be game-changing for everybody. And not just security aspects, but the productivity aspects. The the other areas, oh yeah, and the most important area right now is SOC automation. Because if there's one onerous task, we talked about vulnerability management, that's onerous. But the folks in the SOC who are doing triage on alerts, uh, very, very important job. They're on the front end of the attack service, and they have to recognize when they're under attack and take action. And AI can do that, right? It's been doing it for over two years. I first wrote about it in 2025 when I realized, wow, if this works, everybody's gonna need it immediately. This is gonna be one of the fastest uptakes of any technology in the cybersecurity history. Because why wouldn't you do it? If it's if you're doing 100% triage and you and it's working 24 by seven, holidays, etc., and you don't need that incredible staffing burden to have a sock. That burden is so so heavy that I suspect there aren't very many actual socks anywhere. So whenever I talk to somebody who has a SOC solution, I would always question, you know, that's not a very big market, right? I bet I could name the 50 top SOCs in the United States. You don't run into them very often. There are, yeah, they're people distributed that are getting alerts. But most organizations, of course, outsource ignoring alerts to MSSPs. So there are a lot of SOCs at MSSPs. That's their job, that's what they do. But you know, for the most part, they're they just send alerts. They don't have any ability to do anything about it. Some do, some actually get in there and take, you know, we'll shun an attack or TCP IP reset kind of stuff. So now we're in this era of automated response. And I think it's getting, you know, there's you'll see vendors talk about human in the loop, and they they do that only to make the CISOs comfortable, right? That they're not gonna have automated, because everybody used early versions of AI and it hallucinated, and you do not want hallucinations on your network because there'll be it'll be rebooting systems and attempting to clean them up right in the middle of important presentations, whatever. But we are also getting it to the point in the world where security is important enough that rather than take the the side of, you know what, we don't want any false positives. We we'd rather have the possibility of a positive thing, you know, a bad thing, than the possibility of stopping a good thing. That's switching, right? And it has to switch because the timing of the attacks are are accelerating to, you know, that maybe it was days before, certainly hours now, if not minutes. So we have to be fully invested in SOC automation. And I think that's playing out, right? There's there haven't been any failures of the, you know, I had counted 82 six months ago. I've seen people say there are 150. It's harder for me to discover when a established vendor, as you know, you you use the platform, Andrew, you know, I I categorize them once in the beginning. But and if the vendor pivots into AI security, I don't capture that. Or if it's Palo Alto and they introduce an important AI security thing, I I don't count them as AI security, right? Until I do the re-ingestion, which we're doing right now of all products. So in the next three weeks, we'll have all that done. We'll be able to tell you how many AI security products there are. And it's probably well over a thousand by now. And it to the point where, yeah. Oh, and let's talk about the acceptance part of it, and the part of the CISOs, right? CISOs are being directed to do stuff with AI, which I've I've never seen before. I mean, and I didn't believe it the first time I heard people talking about it, but I am hearing from our CISO end users that yeah, they're getting direction from on high, you know, the board or the CEO telling them to deploy AI, right? Because I don't know how how a message can ever get to that level, but it did. And here we are. So maybe the first time. But I know I've never heard of you know board saying to the CISOs, you know, do security or do more security or double your budget, but all of a sudden we're there.

All right, a lot to take in there. So let's let's rewind. I've got a couple of very specific questions for you. You you know, you made the statement that the the big models, you know, they don't train on on your data if that's what you if you pay for it, basically, right? Right. I've heard you know pretty well-respected CTO type folks out there saying, eh, I don't believe that. You know, they don't believe it. You said, you know, we're paying them all this money to whatever they say, they're still training on our data. I don't see how they're not. What's your sense on the reality around that? My sense is they're not.

They absolutely aren't. Especially if they say they're not. Now, you know, look at we all have always trusted Microsoft and Google, who's I mean, Google has always trained their algorithms on our Data through Gmail, right? So, you know, if you're talking about buying something in your in your email, you will get ads about buying that thing. And that's always been the case. Like there's zero privacy using Gmail. And you know, probably the same thing with Office 365, right? It's, you know, large companies do have a predilection to, you know, steal data. So, but the, you know, the even though OpenAI and Anthropic are valued at trillions of dollars, they're not large companies yet. Right? They don't have a CFO type looking out askew a little bit more profits out of little products, right? They are going full bore forward, making better models. And they they do need new data sources. And maybe they like some of that data, but it's just, I don't know. It's uh it's not very useful data. As both Google and Microsoft are demonstrating, right? They do not really have an edge because they got a whole bunch of data in in their chronicle or or sentinel. And they they talk about having all this data. They they shouldn't, they just never ever acknowledge that they've stolen your data to build really good responses or training, etc. Yeah, it's no evidence of it.

And I think the other side of that is, you know, I think intuitively people would get the idea that should I really be uploading our financials into anything, right? Never mind uh a model, right? But are there any instances where something's somehow come out the other side, right? Where someone's done a search and go, oh, that's interesting. I got the Pepsi Financial showed up in my on my uh ChatGPT search right there. Yeah. Is there any kind of evidence that's actually happening?

Nope, I haven't seen that. The only thing I've seen is Oh, yeah. Early on, there were actually fake reports, and the New York Times published them, that you could recreate text from a book. And, you know, that's uh you know they were proven to be false, but there's always that suspicion, right? They because they definitely were trained on books. But now there's so many guardrails if you ask it to reproduce, uh, as I just did. I was looking for the quote from Moonazarish Mistress by Robert Heinlein, where the main character and the the guy who's narrating the story, Manny, goes through his argument about whether a machine can be intelligent or not. So very appropriate for a modern conversation. And you know, I just ran into these guy girls because I can't reproduce that for you, but I can summarize that and then give a little quote that summarizes it all, which was all I needed. So the quote was basically I don't care if the pathways are biological or platinum.

You know, if it's intelligent, it's intelligent.

Now on the the way my mind worse than that, Richard, then is that people are investing in the guardrails just because I don't know, is it because it's the right thing to do, or or do they have are they concerned about people finding out that they're they might be putting stuff into these models, right? If I'm a coup if I'm a customer of a law firm, you know, I I just don't want you doing that sort of stuff, right? I just don't want to want to happen.

Yeah, yeah. Even though your customers are taking anything you send them, they're posting it into their AI model to analyze the contract, right? You have to. Or even DocuSign just gives you a summary, right? It tells you the important things out of it. It's like legal stuff is turning into this complicated program, and the only way to interpret it is with AI. So everybody on both sides is doing it. So I think, yeah, it's it's really a regulate uh regulatory compliance requirement. You do not want you know former employees to leave the company and say that you know you're you're connecting your HR system directly to AI and letting it make all these decisions.

It's the illusion of what that means rather than the reality, I guess, in some ways. That's right. And and one of the things I found is that some, I don't know of all vendors, but I I do tend to see people swapping in the phrase governance like somehow it's security as well. I don't know. They it's it's very blurry, let's say, about, oh, if we do this, this, and this in governance. When you ask them what does that mean, they start talking about, in my mind, security things. You know, we're really taking control of things, right? How would you draw the line between a governance program and a security program around AI?

What a great question.

So it goes back to whether it's AI or not. The difference between governance and security program is the security program is what's taking action to stop attacks and also make yours harden yourself with configuration and vulnerability management. The governance part of that is to make sure that you're doing that. You know, you it's one thing to think you're doing it or to buy a tool that claims to do it, but you may not have turned the tool on. You may not be, you may not have configured the tool to take action. And that's where governance comes in, right? You have to prove that you're doing what you think you're doing and what you say you're doing. So that's really the main difference. So that's why they're so tightly coupled. You can't have governance without security.

Right. And the external regulations, interesting, you know, the EU AI came out so early. It's you know, the EU being very prescient in their uh in their focus series.

Usually the, you know, first of all, there's the techs, and then there's a bunch of technology to address them. And then 10 or 15 years later, the standards catch up with it. Based on what happened 15 years ago. Right, exactly. Exactly. That's why, you know, IDS is still, you know, something that you're supposed to do and keeping blogs of everything and yeah, vulnerability management for that part, right?

Yeah. Let me ask you about something. You talked about a lot of different segments. I'm kind of interested in one area because I I lived and breathed the not as a practitioner, but as a salesperson, the DLP thing, you know, back in the aughts and also a little bit in the in the teens. I feel like it is one of these technologies that had a lot of promise, but got completely, you know, the worst thing in the world. If you talk to many security folks, it's like I'll never touch that sort of stuff ever again in my life. And someone say, I kind of have to because you know, there's real.

I heard of a company that I heard of a company that had 40 people checking DLP events.

Wow.

Full-time jobs.

Yeah.

Wow. And that's this that's the dirty secret about it, right? Many people were doing DLM, not DLP, right? It's a lot of live alerts.

Yep, alerts, right? We can't stop you know the CEO from sending something, but we can alert if he if he or she did.

So let's let's let's translate that into putting guardrails on AI, then. So I I I kind of liken it to this, right? You're at a company and you've got your policy. You've you spent weeks and months creating this very good policy of what should happen. You then into you then put in your guardrail solution, and there's a lot of them out there right now. And then your head of the retail division accidentally somehow drops the retail projections not into the enterprise version of Chat GPT, but into their personal one. There's not gonna be, you know, you're basically blocking them from doing their job at that point. I'm wondering what the what the accuracy has to be in like to call it modern AI DLP versus the old regex stuff to say, no, that's acceptable. You know, we're good with that, right? Is it 80% accuracy? Is it 95? Is it 99? You know, where do you think that lies?

Yeah, it better be about 95% accurate. But the beauty is that remember that for DLP when you talked about unstructured data, the vendors, especially out of Israel, come back and say, Oh, so we're gonna take fingerprints, hashes of you know, every chunk possible of your documents. So a PowerPoint, right? We'll just take all these fingerprints, then we'll look for those on the network. And if we see it, we'll it'll trigger the alert. Just think about it. Well, that's a lot of fingerprints, right? I mean, because if somebody, if somebody cuts and pastes, then you they include the period or they don't include the period at the end of the sentence, totally different hash, right? So that's really hard. But for an AI, you say, hey, you know, do not allow any emails to go out that mention, you know, Andrew in a pejorative way. Yeah. You could not write a regex for that. But definitely, you know, the latest versions of OpenAI and Anthropic and Kimi could do that easily. That is just that stuff is simple. So I think that's the that is why DLP is going to have a new life now. Because you'd be able to do stuff like that across many avenues of communication. Right.

It seems like the pure play DLP companies who actually say the words DL, the letters DLP, yeah, it seems like they've got a renaissance right now, right?

Yeah, yeah. Yeah, absolutely. And it, you know, and it's it's easier for, and as is often the case, it's easier for a startup to come in and say, those guys suck and we're good. Whereas whereas the legacy vendors have to say, oh man, we used to suck, but now we don't. I don't know if you've ever had to sell that, but it's not hard to sell.

Oh, it's the oh, we're we're not your grandfather's uh semantic, right?

We're yeah, yeah, yeah. That's right. That's right.

We're this amazing new dimble company. But I I I let me ask you about that though, because it brings up an interesting question. You know, being at big companies, you know, it's the old thing, right? We we're gonna release 4.0 of our product in in June of next year, and we're gonna have all this product product management, you know, stuff, and we're gonna have some development work, and then it's gonna go on, and you know, we'll probably release it in June of next year, but it's gonna get half the features because we never kind of got to develop all the ones we wanted to and all the rest of it. And I feel like in these big companies, it feels like to me, and tell me if I'm wrong, they're still operating under that sort of model a lot, right? We we got to really be thoughtful about how we do this. And yet the reality is right now, if you and some of these startups around this area, they're they're chucking out features every day, right? They're just operating so much faster and much more in tune with the market, it seems like. Uh, I'm wondering what that means for these big companies, what how they're gonna adapt and and really kind of work with this.

Yeah, you know, they will they will learn because it it's it's a totally different way of product development. You know, we've gone from waterfall to agile to whatever. And now it's and I I see that, you know, my CTO, Max Million, and I watched him at work, and you know, and we we've got a couple of competitors that, you know, just uh we gave them a demo of what we do last year, and they just stole it, right? They named it the same, they just stole it and they recreated everything, vibecoded it, and grabbed a bunch of data using AI. And but they got funding, and so they've got you know two or three million dollars. So they hired a front-end engineer and a back-end engineer and a data engineer, and going, Max million will have an idea, spin up 50 agents, and work on the idea, and either implement it or decide that it's not gonna work this way and have to do something else. You can do that in half a day. And imagine if you've got a front end and a back end and a product manager, uh, yeah, it's a week to make a decision whether or not to even try doing it. I don't care if you've got infinite tokens to spend. You're gonna your cycle time is gonna be weeks instead of hours. And it's and I just see that going on every England. Yeah, Max Million is working miracles for us. And I'm sure we know startups are doing that right and left. I I see how fast they're kicking out products.

And these big companies are buying these startups. I'm wondering how they're gonna try and retain that DNA and not try and you know spread their dirt all over them and say, no, no, no, no, we've got to slow things down a little bit here.

Right, right.

You're gonna bring in my people to run your development. We're gonna do it my our way, right?

Yeah, because they'll lose all those people. That's and those people that understand that fast build it first. You know, so there should never be a meeting talking about a possible feature and how to develop it. Right? The meeting should always be here's a feature. I put it together last night, you know. So we really you know, should we make it available to our customers or not? Yeah, the question is is it ready or or not? No roadmap for three months' time, right?

That's right. Yeah.

Yeah.

And it's yeah. Let me go back to so you were talking about applying AI to securities, the second catchment you talked about, right? That and I as you were talking, I thought of two buckets. So I'm wondering if this is the right way to think about it or the wrong way to think about it. One is it feels like there's an increased efficacy in products because they're able to use the DLP's the classic example, right? But sure, there's a bunch more like that. Which, okay, well, you know, we're suddenly able to do things that we weren't able to do five, 10 years ago. And this is good for us, you know, the email side, the stock side, things like that. And then the R side is on the people side, right? You know, there's always been this headline, oh, there's three million unfilled jobs in cybersecurity or whatever it is, right? Yeah. Suddenly, if that's true, right, and you see the tier one analysts, you know, we don't need so many. If that's what's going to happen. Is that the right way to think about this? Those two buckets, or is it different other buckets where this might have the biggest impact?

I think that's a good way to think of it. Or another another way is, you know, the people bucket and the data bucket, right? So you don't need people to manage data anymore. And then in the people bucket, it's you know, customer-facing stuff. You still need people, not for long, but you do you need them today. Sales still need people. Also, possibly not for long. So I think, you know, so those are good ways to think about it. But I think that AI enhancement is the way to think about it today is that AI enhances certain people, you know, gives them 10x, 100x capabilities. And you gotta, you know, you're you're gonna have to encourage that. It's always gonna be hard. It's just like in the uh, well, in your world, you know, there are salespeople that are 10 times better than everybody else in the organization. And you try and see what they're doing and mirror it to everybody else. That'll continue to be the case, but it's possible to, for a salesperson, to using AI to immediately get ahead of the game. It's possible for any of us to do anything. It's uh the stories I hear, I uh talk to people on planes and they'll pop open their full phones and start showing me all the you know agents they got running right now, building their product and stuff, or they'll show me their finished products and that we're a self-refactory era. Yeah. Yeah. I'm I realized, I heard one story, I realized, wow, I can. There's I've got a manufacturing project that I've always wanted to do, and all of a sudden I realized I can just do it now. It's amazing. This is crazy.

Yeah. But let's think about the the buyer side now. We've talked a lot about what vendors are doing, things like that. I think, I think, now again, tell me if you think I'm wrong. I think at least two things to be true. One is, you know, there's not many practitioners who've done this before, right? I'm looking for that job description that says, I'm looking for the AI security engineer with five years or 10 years experience, right? Right, right. See if they can find that. But you know, a lot of people are sitting there going, okay, well, you know, we need to pull from our experiences in the past, but this is a new arena for us. So that's one thing. And the second thing I sense is that they can't do it all. They can't just say, okay, we need to protect all AI, right? I mean, you could go on, you could have a massive team try to do it and you still wouldn't get through it, and you have a massive budget and you still get through it. So, where are the priorities for large enterprise right now? Where are they spending money in all these different areas that we talked about?

Yeah, so I mean, the the first thing they think about is how can we spend money to save money, right? Which is would definitely how can we replace roles using AI. And of course, the people that are left are gonna feel like they've got more responsibility and more tasks, so they're gonna want more money. So, and that's always first. Now, the part that gets the boards excited is how can we use AI to make more money, not just save costs. And so that's what's going on within security companies for sure. I guess it's going on across the board, but uh, some industries, software industry, is really susceptible to improvements thanks to AI. Or HR, customer service, customer success, all things that can be approved with AI and therefore make more money. You probably notice, I don't know if you how technical you get with even using AWS. So I go, I I use AWS for my DNS. And it's like, yeah, I know what some of these terms mean, but you know, I don't know whether to pick a 30 millisecond time to live or not. And whatever. Anyways, AWS has added AI to their Cluji platform. And now you just ask it, okay, I want to do this. Oh, here. And it opens up the screen to where you got to do it, right? And this that's the future of of SaaS, I think, is having AI assist you along the way, or just do the job. Yeah, so I think the I think CISOs are gonna look at, you know, the the how can they save money and do things more efficiently, better products, you know, that everybody has problems with their legacy products. It's just that everybody uses, you know, let's pick on cyber art for for privileged access management. So, but maybe we should talk to some new AI first company that's figured out a better way to do it. And so I think there's a lot of that going on. It's like, you know, I've never seen the level of reflection of what we already have and whether or not we should replace it as we have done. I've never seen the levels that we're at, right? So that's you know, shot across the bow to established vendors who quite often feel they've, you know, they've they've got thousands of customers, and the startup has 20. And how in the world can they compete against you? You know, technically they shouldn't be able to compete against you, and yet they do. And you know, all of a sudden they get a valuation of two billion dollars, more than your public company that does the same thing, right?

I've got 500 million dollars of revenue and only valued a billion, and these guys have got nothing. Yeah. That's right.

What happened to you? Exactly. It's a Tesla versus GM thing.

It's like we need to use more AI in a website to get a higher valuation.

Yeah. I think Elon Musk paid more for Twitter than GM's market cap at the time.

That's crazy.

So in in that world, I get I get that, right? If I was a CISO, I'd be saying, okay, let's figure out how we do things better, choose better products. What about on the guardrails side? Because that's not, you're not replacing, you're adding at that point. There's nothing to replace, right? So that's going to be an incremental spend and probably people that go with it. Are they doing that? Are they spending in that area or are they spending other areas? You know, how's that?

Yeah, they're spending in that area. They they feel that they can't take advantage of AI and get people to be more productive, and not just in their departments, but for the rest of the organization, until they put the guardrails in place. So they they do that quickly. Now, quite often they have to say, and you're not allowed to use other stuff. Universities are really bad at this. So they've decided we're going to use Microsoft, you know, because we have a deal with Microsoft. We spent a lot of money with them. They gave us this co-pilot thing. So you got to use Microsoft. So, of course, everybody is immediately stuck with, you know, let's face it, the worst AI tool set that you could use. Just like, just like Teams is the worst video conferencing solution you could use, and that goes on and on. So organizations are stuck that way, right? Is they they bought guardrails that do a good job of protecting Microsoft or whatever. But that is not the best model. And and users switch models very, very fast.

Yeah, exactly. I didn't like that. Let me just take up my phone and just use my favorite.

I'm going to put my point my phone at the screen. You know, there are things that are not allowed to leak through DLP, and I'm going to take pictures and get my answer and I'll I'll probably got raised.

I've done my job so well. That's right. Everyone has to know, right?

Exactly. Exactly. So and so it is a little bit of um you know uh wax mole you can't stop people from working around your your guardrails.

So let me ask you about that. So I remember 25 years ago, you know, there was this companies would be saying, well, we've got to ban Facebook, because you know, no one should be using Facebook on company time. And then there was all these exceptions. What's that? Right. Except the marketing people. They were an exception. Except the marketing people, except for these people, except for the CEO, except for and suddenly it's like, uh, just whatever, just go, just go do it, right? You know, people just throw their hands up in the air. Is that what's gonna happen here, or are we gonna be able to implement, you know, proper, actually realistic guardrails now that actually will help the business rather than hinder the business?

Yeah, I think that's a good example because actually the the end result was okay, we're gonna have company policy that you shouldn't do Facebook on company time and tell people that we have a policy like that. It's the same thing, I think, for AI, is we're gonna have written policies, you know, so which it goes totally against the whole concept of zero trust. We are actually gonna trust our employees to act responsibly. And then, you know, you have a layer of guardrails on top of that to detect when massive abuse is happening, right? Because somebody Yeah. They should just know that it's a HIPAA violation to upload a health record, period. So if and then you know, if that's important, maybe I'm sure there by now there are tools that anonymize the health record before you upload it. So which is yeah, a ways around this. And it slows you down a little bit. You're not gonna be as agile as the company that you know doesn't have SEC looking over their shoulder.

Yeah. Yeah, I'd be interested to see that it plays out because I think I don't know. I think it's it seems to me to be more ripe with edge cases around this.

Yeah.

You know, it's like I kind of think, you know, someone wants to use their Canva in the marketing department that uses its own model. They can use this over here, and before you know it, you say you got to use Microsoft, except here's the 48 different edge cases we need to somehow support as well. Right.

Right.

It's gonna be interesting to see how that plays out.

Just like somehow all those security guys get to use MacBooks.

Right. There you go. Let let's cast our lens going forward then. We've already seen a bunch of consolidation, you know, of companies getting picked up left, right, and center over the last year. You know, you put the right which the right title somewhere.

That's not consolidation.

Right?

That's okay. That's how the security industry grows. Opportunistic. Is it? No, it's strategic. And uh, you know, MA guys use that term. And it's strategic because a large vendor cannot predict the next great product that they have to have. So they just wait. The market tells them, right? It's like uh, I don't know, Google sees Wiz growing its cloud security and Google's cloud company, so they buy Wiz. They they failed miserably to invent their own, you know, cloud security solution, Chronicle. You know, they were gonna spin it off as a separate business and all that. It just didn't work. And that's just how it works. And that's why, you know, uh Semantic used to grow. Semantic, you know, I think they acquired, I don't know, it was hundreds of startups. And some of them work, some of them don't. That's how Cisco grows their security business, right? Remember uh Ironport was the first time the Ironport people just revamped the entire Cisco organization. And yeah, now it's probably umbrella or that uh having the same impact. So that's not consolidation. Consolidation is when there are fewer vendors. And I've been tracking all the vendors for 25 years, and there are more every single year. So nothing's consolidating. We're exploding. And it now, the one thing that is gonna happen is you know, 400 vendors in the space, there are there is gonna be a lot of acquisitions, right? Because there are already 4,000 vendors there, and you add another 400 vendors, there's plenty for the established vendors to acquire to you know, leapfrog capabilities. So that's gonna happen, right, left, center. Of course, that will create a whole bunch of rich technologists that had a successful exit who are very fundable, and they'll go off and start new companies, probably in security. So, yeah, it's just it has a self-fulfilling capability or loop there. Now, the other thing is that as a category, you know, I'm already working on revamping my ontology to exclude AI for security in AI security, because every company has to use AI for security, right? For their products. So we're well down that path already, right? If if there are 567 AI native companies, there's more than that who have already introduced AI security products who are established vendors. So it's kind of like harving out products with interfaces, right?

It's like every product is interfaces.

Yeah, that's right. Yeah. Yeah. Trend Micro took the astounding step and smart step of, you know, because micro is kind of an aged name, to they change their name to Trend AI. That was really brilliant. And that's not gonna come back to bite them, right? Because AI is the thing and will be for the rest of our careers. So we're gonna see that happen by this time, you know, next year. I'll have gotten rid of the SOC automation and you know, uh AI for email security, pen testing, that's the other big one that AI is being used for. It's just automated pen testing is going to be AI driven, has to be. So all that's already happening, but we'll be pretty solid by this time next year. So so that'll change the makeup. There'll still be security for AI, no question. And you know, that I think will continue to grow at these at these paces.

And I imagine at that point you you sub sub create sub markets underneath that, right? To try and delineate who's doing what and what way. Or maybe maybe it's easier for companies these days to spread horizontal have more capabilities, and suddenly you'll have mini platforms.

It bugs me when, especially in Europe and the Middle East, the they just have this. It's actually a you know a sales approach. In I ran across it the first time when I was competing for the website design for Lear company. So a big automotive seating manufacturer. And our competition was this company I never heard of, and I would dig into them, and these guys were customer first. So they had a customer, Lear. So they didn't develop products to try and sell them to Lear. They went to Lear and said, What do you want to buy? And Lear would say, Well, we need forklifts and our plants. They would sell them forklifts. We need we're building new plants and we need stakes for the you know to stake out the property. These guys would manufacture the stakes and sell them to Lear. It was a quite a cool product uh industry. In Germany, it's just like that. So a German company will just develop products based on what the customer is looking for. So you end up with companies that have identity products, network monitoring products. And it makes it very difficult to categorize them. I'm not saying they should make my life easier. And that's the case too with startups in the AI space, in the Middle East in particular. So they're just they're just like doing six of them. Because why not? It's so easy, you know, and it's so logical, and it needs to be done now. Why not just do them all across all the different categories? It's breaking the model, right? You're supposed to have a single product, take it to market, get funding, grow it, and then sell.

Are they relying on a less sophisticated buyer, though, to to be okay with that? I wonder. Mid-market?

SMB. I don't know. I think the buyers in Germany are super sophisticated. That's true. They they value the trust relationship with their suppliers more than more than they would here, I think.

Okay. All right. Yeah. Richard, let's go back to the spin the wheel game here. Okay. So we we landed on Cyber Donut Hot Seat. Now, the Cyber Donut, just you know, I two or three years ago on the podcast, we had six months of episodes where we were saving this company called Cyber Donut. They've taken some funding. There's unrealistic expectations for the board, and the CMO and the CRO had to replace the team. And we kind of, as guests came on, we talked about how we're going to solve things. I've resurrected Cyber Donut. It's still an entity going forward. Let's think about how we can help them in this situation. So here we go. So you're the CMO at Cyber Donut, going back to your Fortnite days. This is a Series A AI security startup, one of the 500 in the space. The same three pure play companies and CrowdStrike show up in every single deal. So they're maybe a little bit struggling for differentiation. And the board wants pipeline doubled now. Well, in two quarters, but pretty much now.

What would you advise them to do? Oh boy, oh boy, oh boy. AI security startup.

The advice that I give everybody is to move faster. You know, the the uh because I do talk to a lot of startups that call me when they're in the process of interviewing CISOs. And I say, stop doing that. I'm telling you, you just talked to me, and I'm telling you that the idea is valid because there's 150 companies doing it and they're all getting funded. So you better have your product ready to go to market next week and get funding. And if you can't get funding, forget it, right? It's just move on, find something else. And I would say, but if they already have the product, then the they have to generate the message, right? Because the the in AI security, the products are kind of self-defining and the demand is already there. So you have to tap into it. And the only way to do that is to make some noise. So my advice is to make some noise and do it in, you know, you you could, if you're on the defensive side, protective side, then you should do better research. You know, just find something and you know, have a team right now looking for swarms of AI agents, rogue agents on the internet. Because you find that, and that's going to be big news, and you're the one who found it with your, you know, the demonstrations you've got a great research team. And maybe they use your tool to to find it, which is even a better, better solution.

So make some noise is the is the first thing to think about. Just just I know we're running out of time here, just one question for you. Why do companies seem so reluctant to make noise? I don't understand it.

Uh, you know, it's the same mindset that makes them not release products fast enough. You know, it's it's they're risk adverse. Uh, because there's there's always blowback. You know, it's easier to just do something that, you know, okay, we we have a webinar and it generates, you know, 250 leads, and that turns into 20 demos, and one turns into a Greece pipeline. Depending on how you measure your pipeline or when you measure it. Or, you know, we could, I don't know, whatever. Have a seat, you know, Palo Alto obviously thought it was valuable to have a seat at the table at the White House meeting and pander to the president of the United States. Right. Maybe that helps them. I don't know. Right.

Right.

So I I can't imagine anybody asking the sales team or the CMO to double a pipeline in that short of time frame at Palo Alto because that'd be really big. Right.

Yeah, yeah. But not a problem for a small company. But it'd be probably talking three to five million in pipeline that'd be added. I just think it's interesting how you know companies are in that mode of we're trying, we're trying to change the world, we're trying to make our mark, we're trying to be successful, but you know, we're gonna hold back a little bit in some areas, right? Don't really make so much of a splash. It's like, I don't know.

Yeah.

We'll get to lose at this point.

Right, just do it. Just, you know, and and you know, for sure, if you want to go all in on marketing, look at what the guys who sell the subscriptions to Razers, you know, that whatever, a dollar a month or something. Somehow that worked. And it launched with a single ad that they made for TV, right? It's consumer. So and and it was a great ad, still is a great ad. And it just clicked, right? But you don't know it's gonna click. You can't have psychological profiling and have have madmen tell you that's gonna click. It you just do it.

Yeah. Well, I wish more were like that, that's for sure. Richard, why don't you give us the the one-minute plug for IT Harvest and what you're doing with that?

Okay, so IT Harvest is an AI-first company. You might not see it yet because you know, we've we've got a platform that gives you access to data on the entire cybersecurity industry, all the vendors, and all of their products. But it's a collection of that data that needs AI and the analysis and presentation of it. And we are weeks away from launching a version that's all new, you know, basically nothing shared with the old one except the list of vendors. And that even that is growing at tremendous speeds. And uh, and the big news is instead of just being priced out of the market for most individuals, you'll be able to get access for $39 a month.

Oh, wow.

Yeah. So it's gonna you know give you at least a first stop when you're doing research on the cybersecurity industry looking for a product. If you're a vendor and you'll, you know, a lot of vendors come to me and say, What do you say about us? I've sent them screenshots. And now I can just say, get out your credit card and buy access and go look at your pro profile. Three or nine bucks a month, you can afford it.

Yeah. Yeah. Yeah, I I find the I find your data to be incredible. It's it's a great insight into the whole industry and trying to understand what companies are doing, see what's going on.

Oh my gosh. I know, I know. We we've tapped into you know public records for public companies now. So now you can get all the financials, which we we need that because later on we're gonna have models that project what they do down to startups and come up with the financial models for the entire industry. But as we did it, you know, we we captured all the insider traits going back more than a year. And and you can just scan through that and you can see every single congressperson who bought stock in Cisco. It's like I never would have thought to research that other than you know, individually. But now we can have a trend line for you know the cybersecurity congressional investment trend and and show the events. You know, did they buy before or after the CrowdStrike event? And how you know amazing.

I see Nancy Pelosi portfolio is the best portfolio ever.

Yeah, yeah, yeah.

I love that. All right. Well, listen, Richard, I appreciate you joining us, helping us understand the the kind of broader AI for security or security for AI marketplace. And I wish you every success of your launch as well if the AI version of Heidi Harvest is coming up. Thanks, Andrew.