EP272 More Than Just Packets: Is NDR a "First-Class" Cloud Security Control?

Security. Hi there.

Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here as ever are myself, Tim Peacock, joining you from Seattle, Washington, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our new YouTube channel, youtube.com/@cloudsecpodcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. I made Anton do this episode by himself, listeners, because I was very busy doing my real job as a PM. But Anton, I understand you are preserving the dream of the '90s. Is that right?

That's an incredibly cynical take on something that may be experiencing a revival. Well, there are many, some things from the '90s are becoming revived in the mid-2020s.

That's true.

And I think one of the things is, of course, the beautiful habit of sniffing packets.

I thought the '90s were all about sniffing glue.

Okay, no, it didn't come out well.

No, this seems very silly. Why are we sniffing packets in a world of TLS 1.3?

Because actually there are a lot of ways to gain insights from traffic analysis And moreover, in the age of compromised firewall appliances, compromised VPN boxes, compromised clouds, there's a need to actually do traffic analysis. EDR, which would get a lot of airtime, mostly maybe not critical, but kind of highlighting the limitations, is not going to save you when things hit the fan. The proverbial— so it is actually a revival of a very nice—

The proverbial things hitting the fan.

The proverbial things. Yes, correct.

All right, well, that's very exciting. I can't wait to listen to this episode since I wasn't a part of it. And maybe without any further ado, let's turn things over to Anton and our guests.

And today on our show, we have Rajya Mukherjee, co-founder and chief scientist at ExtraHop, and Rafael Los, VP of client relations and strategic initiatives at ExtraHop. Welcome to the show. Hello.

Hello. Thank you.

So I'm just going to start with NDR, network detection and response, and I'm going to start in a really weird place. I wanted to start with some kind of skepticism about, hey guys, is this network thing really happening because cloud? But I'm getting more signals that NDR is actually coming back in a bigger way, and people are even launching NDR vendors, and that network detection and response are not the distant second fiddle after EDR, but it's kind of coming back. And what do you make of it? Is this true? Like, you obviously would know it because you are the one one of the premier vendors in this area. So tell me what's going on.

Look, the network never died, if you will, right? I mean, the rumors of the network's death as a source of intelligence were greatly exaggerated, to ruin a Hemingway quote. Basically, as people ignored the network, they found that they had coverage everywhere, and they thought they had coverage by using EDRs and various gateways and firewalls and north-south. But the bottom line is, if you take a look at the footprint of any enterprise, The network's there absolutely everywhere. The problem is we conflated implementation with goal. Yes, tracking the network, watching the network, watching all the behaviors is really hard. I'm going to say it's much harder than EDR because of the scale, because of the fact that you've got all this traffic and you don't want to bottleneck it. You want to make sense of everything happening from layer 2 all the way to layer 7. That is a hard problem. But because it's hard, it doesn't mean that it isn't valuable. And that's the thing. I think we went by taking tools like Bro and Zeek and Suricata and what have you and open-source tools. Mm-hmm. We said, okay, that doesn't scale, therefore there's no value. And that's false. That is false. There is value. It's harder to implement because there are precious few people who can keep up with that level of scale. But the organizations that we— when you see breaches today, Mm-hmm. and you see the east-west lateral movement, and you see devices that can't run agents, I'll tell you, the network is the best place to start. And if you wanna actually understand what's happening in any enterprise, you always start with the network. In fact, it's the first place you should look, and it's usually the last place you look because Every single one of us in operations takes a step back and says, and when people say, okay, what does the sniffer say? What does the packet trace say? The reason for it is simple, is the network is the polygraph of the enterprise.

I like that.

So, this is exactly, almost verbatim, the advice I would give to a client in my early Gartner days, 2010, 2011, 2012, 2013. And I almost repeat, I mean, I will give almost exactly the same advice about the starting point, about you don't need to scale to agents, you'd cover the devices you can instrument. This made sense, and it sort of still does. But then people show up and say, "What about SaaS? What about encryption? What about bandwidth? What about work from home?" And so, can you kind of make the same speech, but like set the calendar to 2026 and basically say, "Okay, you convinced me in 2013. You convinced me in 2015. Can you reconvince me for 2026? Like how does it work with the world of SaaS encryption cloud?" No AI, by the way. This is important.

Absolutely. And look, let me start with one thing. The initiatives that we've implemented from 2015 to 2026 have no doubt been noble. I mean, look, the bottom line is, you folks at Google, by releasing that paper on BeyondCorp, you actually revolutionized zero trust. But the problem is, today, people are using zero trust as a shortcut for not having to worry about things where people are, where there's actual breaches. I mean, it's kind of like saying, hey, we have cloud, we've got a cloud migration, therefore we have no network. That's actually not true. For the vast majority of enterprises, there is some east-west motion. There is lateral movement. If you're in a campus and devices are talking and they're not all peppering through this gateway and they're talking to one another, you are talking east-west. If you have a watch that is tethering to your phone, You've got east-west traffic. I mean, it's everywhere. The ubiquity of these devices that talk east-west is everywhere. Now, one of the things I'll also mention though is between 2015 and 2026, people will say, well, the network's useless because everything's encrypted.

Yeah.

We all remember this. Like in 2013 with Snowden leaks, everyone went off and they said, okay, we're going to implement perfect forward secrecy. We're going to implement ephemeral Diffie-Hellman key exchange. And therefore, even if you have the private key, you can't still look at the traffic. Look, before starting ExtraHop, my co-founder and I, we were the chief architects of F5 Networks, and we developed SSL acceleration.

Mm-hmm.

I'll tell you straight out, the way people do decrypt today, or the way they were doing decrypt, was fundamentally flawed. You don't need the private key to decrypt TLS traffic. Let me, let me make that really clear. Everyone's looking at the private key because they're saying, well, okay, I need to understand, I need to watch the entire transaction. So because, of course, in SSL, you've got the asymmetric exchange, then you have the symmetric key, asymmetric crypto, right? It's the symmetric crypto that encrypts the communications.

Yeah.

So the asymmetric exchange occurs so that you can derive and share the symmetric key. Now, from this point forward, you use the symmetric key for everything. Well, at ExtraHop, when we looked at this problem, after years and years of experience building this at F5, we said, okay, you know what? There's actually no reason for us to get in and track the asymmetric exchange. We don't need the private key. We just need a way to get at the symmetric key. So we look at that, and now by implementing hooks, whether it's in a load balancer, whether it's in through an agent, whether it's through a shared library, whether it's in part of an application or a middlebox or ZTNA or any sort of a network access, if you will, or any kind of Netscope proxy or zero trust proxy, if we have a way to get to that symmetric key And this is independent of perfect forward secrecy. We can decrypt the entire exchange. We don't have to worry about modular exponentiation. We don't have to worry about expensive crypto operations. We just get a copy of the symmetric key. And that's what we did. We took a step back and we said, we don't need to violate the security boundary. We don't need to be a part of that PKI, the public key infrastructure. We don't need to sign certs. We don't need a part of the CA. We're overcomplicating the problem. Let's just get a copy of that symmetric key and we're off to the races. And the beauty of it It allows you to surgically decrypt traffic. It allows you to control in a fine-grained manner the traffic you want to look at versus the traffic you don't want to look at. And thirdly, and most importantly, it allows you governance over who and what you can decrypt. It's a better solution. It's, in my opinion, in my admittedly biased opinion, it is what opens up the network as a source of data in this 80% encrypted world.

You know, you started describing it, and I immediately remembered some of that machinery, again, from the briefings we had in my Gartner days, is that you can see the data without doing kind of trust-violating things that people, you know, tend to cringe at.

Yes.

Like, again, access to private keys, to put it mildly. So, that at least deals with the biggest upset to NDR encryption, right? What about just value of people who, used to complain about agents. And again, my argument for why NDR first was always, you're talking about 10 boxes versus 50,000 agents. Would you rather do 10 of something or 50,000 of something? Like, 10 is simpler. Sorry, it's a much smaller number. But then encryption and bandwidth to some extent made it kind of debatable. How would— again, does the value change today? Does the— what about in the cloud? What if I'm in the public cloud environment? How does that change?

I think Rafael is I'm gonna let Rajat give you the more complicated answer, but I think the thing that we touched on just very, very briefly is, you know, one box versus 50,000, right?

It's—

but this isn't one or the other. This is like the endpoint sees processes and memory and things happening. What is actually happening here? The network sees who's talking to who, what's the model look like, what is that— the nature of relationships look like. You can find outliers that way, and everybody talks about being able to find all those— remember, identify previously unknown attacks. That's been the battle cry for every new security startup.

Yes, that's right.

Listen, I've been doing this for about coming up on 30 years soon.

You're not that old, are you?

And every time— I mean, before we did Security Board, there was a name for it, right? But anyway, every time I've gotten a peek inside or worked on an issue that's been like, wow, this is really novel, it never started with a, hey, look, there's a SIEM detection or an IPS detection or an EDR or antivirus detection.

Yeah.

It was always somebody looking at something doing something and going, hey, that's weird, right? And when you're looking at it from the network perspective, you're not seeing necessarily what's happening individually on that box. You're seeing how things are connected. You can see those outliers and build those patterns. Like, even if you're blind, like, obviously decryption is super important because we managed to poke both our eyes out and then wondered why we can't find the bad guy in the room. But it, you know, we could do analogies all day, but it's super important. And even if you can't see what's happening in every packet stream, you can see the patterns of behavior. You can see the ports and protocols. You can see what's going over them. You can, and the insights into that. That's why it's not an either/or conversation. But Raja, I mean, you know, you built this thing, like we can get cloud anywhere you can get packets from or information about network streams. This is a valid thing, right?

Yep. Yeah.

I mean, 100%. I mean, I agree with what Raf said. I'll actually add one more thing. And, you know, I'm looking for something over here that I can place a friendly wager with anybody listening on.

Okay.

This is, this is a fine staple opener. It's the first thing that comes to hand. I will bet you this fine staple opener against, I don't know, a penny, that if you in your organization know how many assets you have inside your environment, No, you need to travel to an alternate dimension to know that.

In our current reality, that's not a thing.

But remember, everybody says just do the basics, right? You just got to protect the things you need.

Right. Okay.

So, how about this basic task? Do you know how many servers you have? Let's do the basics. Sorry, I failed that test. Okay. What's the next step? Well, you failed the first step, so there's no next step for you, right?

Absolutely. So, if you don't know, I mean, abusing Donald Rumsfeld's philosophy of unknown unknowns, If you don't know where to put the EDRs, if you don't know where to put the agents, how are you going to manage them? And again, that is the place where the network absolutely excels. I'll tell you one thing.

Mm-hmm.

If you drop me into an environment where I'm trying to look around and understand what's there, I'm not going to look at the agents. I'm not going to look at the log files. I'm going to drop something on the wire and let's say, okay, what's talking to what? That's where we start. And that's how we should start our security strategy, period.

I think that starting from NDR was, again, it gives me massive flashbacks to when I was writing this advice for clients at Gartner. And I think the choosing between deploy 10 sniffers versus 50,000 agents, same analogy, I would say, hey, you should observe the network first and then decide on the agents. I still sense that in the 10 years that passed since that time, more people said, nah, we just do 50,000 agents. I don't know exactly why. And I think that today with compromised routers, compromised appliances, compromised boxes, compromised OT, the old advice is actually better than the new advice. Like, you start on the network and the yet-to-be-unnamed vendor VPN appliance wouldn't get popped, or at least you would know when it gets popped. So, why is that a thing? Why is that a bigger thing?

So, hypothetically, even if you do know every— say you're a healthcare network or you're a retail outlet or you're an industrial company. Hypothetically, even if you do know where and what every device is, what percentage of those can you put an agent on?

Actually, you guys should probably publish this statistic because I still see people who show up and say, we're going to do EDR. And I say, hey, do you guys plan to do logs or NDR? And they say, nah, we're just going to do EDR. And I look at them, what? Not even a SIEM? Not even for Anton? And they're like, nah, we just— we got this really good EDR. And I say, yeah, what about routers? And they say, well, if the router gets popped, eventually the attacker would go to where the data is, which is the machine, and it's instrumented. And I'm like, you guys are laughing not only because you're an NDR vendor, but because it's actually genuinely funny. And I say, okay, it's kind of sort of credible for a second, but what about people who reroute traffic or cause damage or destroy your network, and then you don't have a network and your endpoints have no connection? And they kind of say, well, I guess you're right. We'll try to do login. But it's just that it became kind of a delusion that EDR is enough. And again, I feel responsible personally because I coined the term, right? But why can't we beat harder against people who think EDR is enough? That's completely insane.

So, it's fundamentally, it's that same issue, right? The problem is that for the longest time, the network was deprioritized because it was difficult. Because it was difficult. So everyone's looking for the quickest hit first, and they said, hey, you know what, we can't protect our environment, so how about we just protect our database server, right? Okay, so they protected their database server, and then now they're walking around with an entire environment with every single laptop breached, and the CEO being used to spearphish, and all kinds of things happening inside the environment.

Mm-hmm.

So people conflate the number one difficulty for value Yeah. And then they said, okay, is my minimal viable product enough? And when it became not enough, then they started looking for a quick fix. And the quick fix is, look, again, I am not knocking zero trust at all. I'm saying it's a very, very good start, but we, we must recognize it for what it is, which is a start. If you want to understand, again, to use an analogy, if you will, if you wanna understand what's happening in the human body, you don't say, well, I just took a biopsy of a fingernail. You actually, you take an MRI, it's much better than taking a biopsy of fingernail. And so that's the same sort of thing. If you want, it's the MRI versus the targeted search for something we understand.

You know, I feel like this should be, I mean, we are pretty passionate about this and I'm always kind of sad that network is not getting, was not getting the attention. And I feel now like maybe more people will wake up and maybe those compromised routers would wake them up, maybe something else. But people who go to cloud where assets are largely known, And where east-west is a little different. How would you describe the NDR as a cloud security control? Actually, let me try my 3 AM test. If somebody wakes you up at 3 AM and says, hey, do you guys think NDR is a critical cloud security control? Would you say yes, no, or it's complicated?

Absolutely, 100%. And so I'll tell you, when cloud networking was in its infancy, when you couldn't set up any topologies and everything was in a VPC or virtual network or what have you, Yeah, I would say, okay, it's fairly well bounded. Everybody knows what's there. Right now, then things started changing when people started adding containers. Because now all of a sudden, you've got these microservices that spin up. And then things started changing more when you had contracts and services between SaaSs that we're using, that this infrastructure was using. However, right now, and I said we won't talk about AI, so I won't talk about AI, but now that we're talking about things like, we're talking about A2C, we're talking about MCP, You have these unknown contracts that are occurring because your workloads are talking to something else, something else. Now, there's no manifest, there's no clarity into actually what's happening, and something might talk and you don't have a good view as to what it might be talking about. It could be talking to something completely uninstrumented, a third party. Again, rather than going and begging the third-party vendor for their log files, you're much better off just seeing what went on, what the nature of that behavior is, what the nature and the flow of communications is, Is there something anomalous? Did I just hook up some rogue shadow MCP agent that causes all of my traffic to talk east-west and then bundle it up and go out somewhere to some command and control server somewhere on the internet? Well, you can cross your fingers and hope for a good log file that shows you that, or you can look at the network and the answer is right there.

You know, I was just typing the extra question to ask you not from the list, and it was about that exact thing you just pointed out. Like, I've met people who have too many agents, too many shadow AI agents in their environment brought by employees. And I mean, I'm being a little self-serving because I'm kind of trying to make an RSA presentation about it. But the point is that NDR does come up in some of these conversations. People say, how do you know that people use their own agents for work in the corporate environment? And somebody said, what about traffic analysis? And I'm like, yeah, but you need to be a lot more careful. Like, this is good MCP, bad MCP. That's kind of hard to do. But is this realistic? I think I sense that Rafael is kind of debating this a little bit in his head. So, or maybe your agent's skeptical, I don't know. So any reactions to this NDR against shadow agents? I know it's a scary question, so I'm not sure if he's—

Listen, I think anytime you're talking about, you throw the word shadow in front of anything, we had shadow IT, we had shadow cloud, now we've got shadow AI. And anytime you go into that type of discussion, you might as well be saying, how many servers do you have on your network?

Yeah, I hear it.

It's the exact same thing, different technology. And it's solving that same problem. Like, you aren't certain what you have. And where do, like, really serious security events transpire? It's on the edges. It's in the things you don't know you have. If you know it's there, odds are you can do a reasonable job protecting it. If you don't know, you know, your internal, I don't know, finance team is using some third-party AI platform to do financial analysis for, you know, merit awards for the next year. And suddenly you realize, like, that's probably not the thing we wanted to do. Holy cow, they're using our data for training.

Ah, right.

Again, unknowns, unknowns in security are bad, period, carriage return.

Yes, yes, that's right.

I mean, I'll also add one more thing over here, whether it's network or not, The bottom line is the vast majority of instrumentation for performance, for security, for application analysis, if you will, they're all self-reported. So, if you're relying on something, you're interrogating something and sort of saying, hey, if you want—

So, I'm gonna be like, I'm gonna be nasty and I'm gonna interrupt you. This is my second favorite argument in my Gartner days against the EDR obsessed. I'm like, you guys are aware that you're instrumenting the machine under the control of the attacker to report on said attacker. And for some reason, in 2015, people freaked out about it. But in 2026, people say, oh yeah, we do. And they just don't see the irony. Like, what's going on? Like, why isn't it painfully obvious?

Look, if you can instrument it, so can the bad guys. The first thing I'll do is, you know, if I'm going to get onto a system, not that I would ever do such a thing, but if I get onto a system and I want to backdoor the thing, I'm gonna replace the kernel modules with something that doesn't show my presence. You can't do that with the network.

But using 20-year-old technology, the tech for this is well known for a quarter of a freaking century.

It's been around forever. Yeah.

But it still works.

Yeah, exactly my point.

That's the thing. The reason it hasn't been solved is because it's hard and because it's architecturally— okay, I'll just come out and say it. It's actually architecturally flawed. to rely on a system that's part of the infrastructure to enforce security. You need that outside view. I mean, it's Heisenberg's uncertainty principle. If I can change the agent, if I can get onto that system, I can backdoor it. If I can change the kernel modules, modify the syscalls, if I can do these things, then how can I trust my observability?

Anton, you've heard me tell this story before, probably, but it's like doing forensics using a machine that is potentially compromised on a network that you know is compromised, right? Like, this isn't going to come out the way you think it is. Oh, look, there's nothing to see here.

It's like special counsel appointed by the executive branch.

Oh, geez.

Thank you. And then people who show up and say, oh, look, an EDR bypass. And I'm like, yeah, that's number 23,285 EDR bypass in the last whatever number of years. And it's like, Why are you acting surprised? There's an EDR bypass. You're on the same machine with the bad guy. But it's interesting, this used to be much more striking to security teams than it is now. The whole EDR is an— okay, fine. I think we've beat the EDR enough. Let's talk about the other bit before we start to close. Isn't this network sniffing stuff costly for high-bandwidth environments? Isn't there a pretty penny to be made by, well, you? Because you need to collect all traffic, shovel it somewhere, get hard drives, Like, help me with— if I'm afraid of NDR because of cost, how do you fix it?

So when we started ExtraHop, we didn't know a damn thing about the incumbents in the space. We didn't start with NDR in mind. We didn't start with any NPM in mind. We said, okay, we want a system that looks at the network, makes sense of what's on the network. And when we started, we were actually shocked to see that everybody in the space would look at packets, write them to disk, and then go back And try to figure out what's on the disk. And we said, okay, you know what? That's a great way to make sure that none of you— that you can't keep up with the flow of traffic. Because if you're running at multiple gigabits, how are you gonna write all that to disk and then—

Yeah.

Who's paying for hard drives?

Exactly. So, what we did was we made an architectural shift. I mean, the kernel that we've written at ExtraHop is zero copy all the way through. And I don't mean bounce buffering. I mean, it writes anything in all of memory We have 5 layers of caching in the system. I mean, our strategy to disk management is don't touch disk as much as possible. I mean, it's basically the—

Because money.

Exactly. It's the cache of last resort.

Yeah.

And what that results in is results in this platform that's able to scale massively. Because it's able to scale massively, you need less boxes. The one box can do more. It's not just speeds and feeds because you can do so much on this. We can write our interpretation engine on the system. We can run all these things on this. So, The performance is an enabling technology. I'll tell you one thing though, Anton. It took 2 years for us to hit MVP. Our prototype took 2 years. And in that time, our VCs were looking around saying, no, we're not nervous, kind of. When's it gonna be out? But that was the thing. It takes patience. It takes a lot. There's a significant moat to doing this the right way. Now, of course, you could take Zeek or Bro or one of these tools and modify it, but you'll be running it at user land speeds. Or if you've got something that's more commercial, you might have like a DPDK-based bounce buffer. So you bounce it in and it's still faster, but it's not zero copy. It doesn't run at that speed. And very frankly, that investment that you have to take in order to implement this, the cost savings over the long term aren't passed to the customer. So you're right. If you're deploying one of these old systems that are based on the Zeeks, on the Bro's, on the open source, use alarm systems. It will be slower. There will be more components, and it will be more expensive. But with our architecture, and this is not intended to be a shameless plug, but it's gonna come across as one. But with our system, because we focused on scale, because we built that moat from day one, we're able to do this with more simplicity and less instrumentation componentry for our customers.

Can I throw one more thing in here, Anton? Please do.

Please do. Yeah.

Because we're talking about economies and cost, one of the nice things that I can't tell you, I can't name many other security technologies that can say this, is if you're putting an NDR in place, right, you're watching the network, you're getting performance monitoring, performance uptime checking, like all the good things that come with the before, during, and after kaboom, and you're getting security benefits. So you're actually getting potentially 2 budgets worth. You're double dipping. As soon as— once you have the packets, once you have the evidence, you can convict 2 different Criminals, right? Actual criminals or bandwidth hogs and breaking pieces of software out there. So look, anything's as expensive as you want to try to make it. But I think if you're going to justify technology spend, especially in 2026 and beyond, you're looking at how much can I get out of this? You know, how much value can I get for my spend? This is 2x at least. So I think it's a pretty good place to put your dollars.

I think that actually is a credible argument. Yes, I feel like the utility for performance and other tasks is there. So we're getting to the end of the slot. And again, usually Tim does it, but I'll try to have to get with me doing it. We will usually end with one resource and one tip. Feel free to send me, you know, hot, extra hot blogs or whatever else. So one resource, one tip, and to account for one more question we had to skip is one prediction. How about one tip, one resource, and one prediction, ideally about the future, you know, to misquote Niels Bohr?

I can give you a good prediction about the future. It's more of this. In 5 years, we'll be talking about the same things we talked about 5 years ago. The technology may be slightly different, the landscape may be slightly different, but the problems don't change. This is cyclical. This is why you and I can still sit here, Anton, and, and Raja, and do this 20-some-odd years later on podcasts and analysts meetings is like, things are cyclical. We're coming back. We go edge, we go back to the endpoint, back to the edge, back to the endpoint, back to the edge. Like we keep going centralized computing. And I think, you know, my prediction is I think network becomes more important as we continue to move forward because with the speed of change on the endpoint and how quickly attackers adapt to their environment, knowing what's in that environment, How do we evade it? The only thing that's going to save you is the fact that you have a passive listening device the attacker can't see, so they don't know to evade.

Thanks, Ralph. So here's one tip. What I would say is, in terms of tips, deploy extra hop. See what happens.

That's very self-serving, but ultimately it makes sense.

Okay, you know what?

Or deploy anything on the network. Okay, you know, very frankly, Deploy an NDR, right? Even if it's not an XDrop, deploy Bro. See what you see. You're gonna be surprised because the richness of that network communication is something that every enterprise has to see. So deploy NDR. Of course, I'd prefer it if you deployed XDrop. Deploy NDR. One resource, if you go to XDrop's website, you can actually see a demo. So even if you can't deploy it inside your environment for whatever reason, VPC traffic mirroring, what have you, go to the website, xdrop.com, and there's a demo. And you click on the demo, basically put your email address in, and it will actually send you a link to a— not screen mockups, but to a live running instance on the backend. You can play with it. You can see how this thing works. You can see the lateral movement. You can see all the relationships there. So use that as a resource. Understand what you might be missing. And one prediction here I'm going to have is the— unfortunately, identity has reinvented the castle in moat. It's, we worked really, really hard to get rid of it and we're back.

We're back there again.

And we're gonna see, I mean, despite all the best efforts and best intentions, we are gonna see some major breaches in the next year to year and a half of large organizations that everyone knows based on the identity being assumed to be enough. And it's gonna get worse with the agentic AI and what have you, with shadow AI to Raph's point, anything that people don't roll out through governance, which is most things.

Yeah.

That's going to happen. And I think that is again going to drive the importance of the network up even further.

I like that. I really like that. And I feel like the identity also didn't save us. Yeah, that's a useful reminder in between that people doubled down on endpoint and identity, and they still missed. So, anything optimistic? Any fun reads? Any recent reports? But you guys should consider doing the percentage of systems that are even theoretically instrumentable. I feel like somebody should do it. You should pay some second-tier analyst firm to do it, and however you want to do it. That's actually really fun because intuitively, I don't know. I want to guess. I'm trying and kind of not succeeding. So, I think for some companies, maybe low, for some companies, maybe kind of high. So, I mean, of course, I want to offer you a Chromebook that you can't instrument, but it's a different argument.

Anton, I think it's a really good idea. Of course, right now that you've called them a second-tier analyst firm, we're going to have to be really careful about who we talk to.

The first year, don't take vendor money. That's the only reason for this, that you can't have first year doesn't take vendor money for, you know, research to order.

That's the only law. For sure. Yeah, I understand. I think it's a really good point. I think it's something that we definitely need to look at because it's right there. I don't think anybody would deny that it's a problem. The only problem is we haven't quantified it.

You know, you asked about anything I'm reading. I've always got a copy of Sean's book somewhere on my desk here.

Okay, this goes into my read material list. Yes.

Yeah, this is a critical link to the important parts of the business, that is the lawyers. A friend of mine once told me a joke and he said, you know, people think it's the CEOs that run companies. It's not, it's the GC. And, you know, you want to laugh at that, but then you realize it's probably more true than we'd like to admit. But, you know, I think as a tip, because Roger gave all the good ones, I'm simply going to say, as we move into another year, you know, 2026 now, and probably this will be good for the next couple. Focus on knowing what you have. Security starts with, you got to know what you have in real time, in some provable single source of truth way. Whatever technologies you deploy, know what you have because there is no chance of deploying security to things you don't know are there.

Yes, I love it. It probably would win you some Captain Obvious points, but it's actually completely profound at the same time. Like, that's— it may be obvious, but also completely missing in many environments. Okay, I'm spending my airtime on this, and it's a fun chat. So, thank you very much for being on the show. This was as fun as I expected.

Good to be here.

Thank you very much.

And now we are at time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.