Andy Cao and Hugh Thompson: Inside RSAC 2025’s biggest moments and boldest ideas

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors Building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this video.

Episode. Welcome to this RSA special episode of Inside the Network. Today we bring you two guests, Andy Cao of Project Discovery, winner of the Innovation Sandbox Award, the coveted award as the most innovative company of 2025, and Dr. Hugh Thompson, Executive Chairman of the RSA Conference. We will understand what sets Project Discovery apart and how This most innovative company of 2025 is tackling AI-driven challenges and what's next for this rising star in cybersecurity. Then with Dr. Hugh Thompson, we'll understand what it takes to lead the world's largest security conference and how RSA continues to evolve in these times. Let's get started.

Andy, congratulations. Thank you. The RSA Innovation Sandbox winner for 2025. Nobody guessed in this day and age of AI that Project Discovery would end up being the winner. Not even ChatGPT, not even Grok. You know, we, we ran a little poll with these different models and project discovery was like number 3 with all the models.

Tell us more.

How did you make it?

Well, I think, I think vulnerability management is still a big problem and AI is absolutely a big problem. But I think if you sit down with CISOs and you ask them where are they spending their dollars, where's their team getting bogged down, vulnerability management is still top 2, top 3. And so I think it was an opportunity to tell a story about reinventing a decades-old industry with an approach that with community. I mean, Doug was on here in a recent podcast talking about how community really powered security industry in the early days. And I think it's, you know, between solving a really big problem, automating it in a way that it's not magic AI, it's you can see these templates, you can touch them, you can edit them. And then you have this community backing behind it. I think it really creates an inspiring story around innovation that I think the judges could really rally behind. So we're really thrilled that they saw what we were doing.

You know, it's funny, in advance of this, Andy, we actually went and we pinged one of our former speakers, one of our guests, Ron Gula. You mentioned Tenable and you mentioned Nessus a couple of times in your presentation, your 3-minute presentation. I texted Ron last night and I said, hey Ron, like we have Andy on the show and we want to, you know, have, ask him a few questions and just imagine as if you were one of the judges, Ron, what would be the big question you'd ask? And so he sent me like 10 of them and I'm going to focus on just one just to start. He said, look, Project Discovery is really focused on this open source model, right? Like that's what differentiates you in the vulnerability management space. And that was something that he was very much pushing in the early days. He talks about this on the show. He said if Starbucks submits a scan template today on Project Discovery, who owns the scan? Is it you? Is it Starbucks, the customer? And the reason he flagged this was he said, well, in the future, let's imagine a world where Project Discovery potentially gets acquired and there's technically IP. Who holds the IP? Is it your customer? Is it the potential acquirer? Where does that, that IP sit?

We're an open source and community-first company. So if you look at our nuclei templates repo, it's an MIT license. It belongs to the community. And we— this is the only way you can get 10,000 detection templates. It's, it's because people know that when they contribute a template, it can help everyone around the world. Now, every contribution is reviewed by our internal team because our enterprise customers need to know that there's quality behind that. But ultimately, the only way we can build a sustaining ecosystem of innovation with our community is to make sure that this still belongs to the community. So the answer to that is it's an MIT license and it's still out there. Now, where we're going with this, and I kind of talked about a little bit in the talk is vulnerability management is not just CVEs. It can be findings from a bug bounty program, a pen test report. Your red team might find something. Nuclei templates, the customizability of these templates, plus the ability with AI now, we can generate nuclei templates for any vulnerability. And now you have vulnerability detection as code and our customers own these custom detections. I'll give you an example. One of our customers, Vercel, actually is using us to create a regression automation program around these vulnerabilities and detections that they have. And this belongs to them. So I think the community templates is a starting point, but the opportunities are endless in terms of what companies can really do with the syntax of these templates and really making their own kind of customized vulnerability management program.

Vulnerability management has a large number of incumbents. There is Tenable, there is Qualys. What was the key challenge that enabled the creation of your platform?

I mean, if you think about it, these scanners were built 20 years ago. I was in high school 20 years ago. And the world is so different today. And, you know, maybe 20 years ago, looking at versions, outdated versions in particular, were enough for vulnerability detection. But today, with the— I mean, you look at how many CVEs are released every year in 2025 versus 2005. It's just, it's a different landscape and security teams need to know what is actually exploitable. And I think what excites me is what we're doing with the Nuclei templates. It's not rocket science. It's not a big complex LLM behind a— in a black box. You can see exactly the steps that we're automating that any security engineer, pentester would do otherwise. And we're just unlocking all this automation that we feel like should have been automated years ago. And I think that's the foundation for us is starting with accurate detections, because no matter what prioritization engines you buy, what vulnerability aggregators you buy, if you're starting with hundreds or thousands of false positives, you're just going to end up with a lot of manual work.

You're a star now. You know, we can see the halo, the glitter around you after having won this coveted award, but every company goes through tough times. I mean, you have seen some dark days at Project Discovery. Help us appreciate the ups and downs that you have been through leading up to this day.

So in our talk on the final team slide, if you notice, we used Studio Ghibli images of our team and we wanted to go in that direction because we are not ex-Palo Alto executives who built security companies. And when I said we're hackers, misfits, and dreamers, that's really who we are. Our CTO was top 3 in the world on HackerOne. He's the hacker.

Wow.

Our CEO is a dreamer. He's got the vision and I'm the misfit. Like, I dropped out of VC. I was unemployed 4 years ago building a camper van and, and we're just figuring it out. And I think what unites us is this common drive, this grit, this resilience to solve this problem and to know that no one can come in and solve this for ourselves. And I think that was one of the things that we learned is like last year we had one of our early POCs with a large global financial institution. Team invites were not working. Scans were failing and we were getting messages at like 10, 11 PM my time. And, you know, God knows what hour in India for them. And it was— there were definitely some pretty dark days of, oh my God, can we build this? But I think it's that journey that founders need to go on to learn that that gives you that confidence that, yes, you can disrupt a billion-dollar industry. You got to just like focus on the thing at hand, solve this problem for the customer. Hey, if you didn't go well, what did you learn from it? And do better next time. And, you know, this is This goes out to all the early people who believed in us, who continue to share bugs with us. And, you know, but I think it's that focus on growth and learning that has really allowed us to get to where we are today.

On the topic of misfits, you talk a little bit about, you know, your career. And the awesome thing for our listeners is Andy and I have known each other for a decade. And, you know, he started off in venture.

It was pretty awesome.

You were at Trident Capital with one of our dear friends, Will Lin, and then subsequently you joined Sunstone, and then after that Comcast and You took a little bit of time off after, you know, Venture, and you described being in the camper van with your partner and spending a year off away from security, away from software. What did you learn from that experience and what did you bring back after that sabbatical?

Yeah, I'd love to tell you that there was one day that I woke up during my sabbatical where everything was just super clear. And I tell you, I still remember the first few weeks after I started. We'd like, we just bought this camper van brand new. It's like this empty shell of a thing. And I had just gone to Home Depot and this is when my my wife had just started going back to work. It was like in January and I was unemployed. The whole world was moving on from the holidays and I was like, what am I doing with my life? And it didn't come overnight, as I mentioned earlier, but just, you know, I worked 12 hours a day on that van, 7 days. I worked harder on that thing than I did in, in venture.

And yeah, you DIY'd that van.

I DIY'd it. It has a hot shower. It, it has a bro— it has a stove. A fridge.

If you go to Andy's LinkedIn page, you can actually see the picture of the van and click it and see the, you know, all the details.

You can see it. Yeah. And I think I came out of that realizing that I'm a builder. I— venture is an incredible industry and I have so much respect for what you do, Sid. But I think after the many years of being in venture, I came away building that van saying, you know, I want to, I want to build something. And I think that was a really— I realized what made me tick. I'd always been passionate about cybersecurity. So when I got introduced to Rishi and Sandeep, I just, I felt this kind of drive that I just, I hadn't felt ever in my life professionally. And the rest is history.

AI and automation is the talk in town. Everybody is talking how AI is transforming the future of cybersecurity. What is working in AI in your opinion? And what is fluff? What is buzz? And what are the overstatements?

Yeah, I think we have this vision of AI as empowering the people, our users. And I think if we take any inspiration from the dev and infra community. What has worked well with AI there? Engineers get code at the end of it that they can modify, that they can improve on. And so it's, it's a partner. It's not a replacement. And I think when we see AI in security, we want to continue to provide ways where the solutions can be transparent and customizable and empowering. So if you look at our AI solutions, it's not a black box. We are generating nuclei templates that clearly outline for a security engineer what we think we need to do to test for a vulnerability. And then we're empowering them to say, okay, if you want to make any changes, You can update the template. You can learn from this to write another one, right? I mean, that's how we are all learning from LLMs. And I think we should take inspiration from what dev and infra companies have done with AI to really empower security teams, not provide more black box solutions, which I think we've seen has really been frustrating for many security teams.

And as we're in closing, you look at the future, you look at the crystal ball and say, what would the next 12, 24 months look like? What are some things that excite you? What are some things that scare the bejesus out of you as you look at the, in the near future?

I mean, we're the Davids against the Goliaths here, right? And if you look at Tenable, Qualys, and Rapid7 combined generate over $2.5 billion in revenue a year. They are massive businesses, but they're built on foundations that I think many security teams are excited to move on from. And so we get excited about the opportunity to go against those giants in the industry and provide an opportunity for security teams to build on something modern.

Well, Andy, that's the fun part. Tell us what scares you.

The same thing. We're a team of 35. My first call with Gartner a week ago. Oh wow. Sharing with them our vision. And, you know, most people know us as an open source tool. And I think this opportunity with RSA is absolutely incredibly helpful for us. But I mean, you see, you can go on the expo floor. This, this, the security vendor landscape is filled with lots of dollars, marketing buzz. We got to find a way to cut through the noise. And so thank you for this opportunity to share the story a little bit. But we've got a lot of work to do.

There are a bunch of VCs that are hunting for you with $50, $100 million term sheets, just warning you that they'll be pushing those on you anytime soon here on the floor as you walk around. We walk in Vegas or in Times Square when you're walking around, there are people that are shoving these cards in your hands. There are term sheets being shoved in founders' hands around here.

Well, we'll take the order forms from CISOs first, but, uh, and then we'll get to the term sheets.

One last question from my end. You've won The Sandbox. If you were on the panel of judges, who would you be voting for?

Let me tell you, Russ, this was such a deep field. I mean, I sat through all those presentations and I— wow, what all these teams are building, opportunity ahead of them. I think it's incredible what this Innovation Sandbox does. I think if I had to choose one, I think it would definitely be the runner-up, Calypso.

They—

I had a chance to talk with the team at the X Lounge last night. They're up to some really, really great stuff, and I'm a huge fan of the team, the mission there. Um, and we've already set up some time afterwards to compare notes. I mean, this is a community effort, we got to work together. So huge fans of them along with the other 8 contestants.

Awesome.

Andy, thanks for joining Karthik, huge congratulations again. We're very excited for you and everything you'll build as you continue to go on this journey. And as a fellow former, you were a former VC, it's great to see that you've kind of had this second career. It makes it a little bit easier for Mahendra and myself to know that if we are terrible at our job, which we may be, we still have a second job to be founders and hopefully win RSAC.

Well, Andy, you're probably the only VC who's giving respect to the industry by becoming a founder.

You know, there's a question on there about what comes over from VC, and if I have time, I'd love to just share one thing. Some of the VCs I know are the hardest working people. I don't think VCs get enough credit.

Nobody's going to believe you when you say that, but please, taste, can give you, can give you.

But remember, he said only some.

But no, I think the work ethic, the grind, the willingness to sell to founders, the hustle, I mean, so much of that carries over to being, you know, a leader in a startup. So I have so much respect for what you all do, and I think there's a lot more that we share in common than I than I think people think.

Well, thank you, Andy. Thanks, guys.

Thank you for your kind words.

Thanks, guys, so much.

Thank you both.

Thank all of you.

Yeah. Now that was a fun conversation we recorded with Andy Cao at the Moscone Hall amidst the buzz of RSA. Let's shift gears to the heart of this conference itself. Up next, we're joined by Dr. Hugh Thompson, Executive Chairman of the RSA Conference, the world's largest cybersecurity gathering. Now RSA began 34 years ago as a user conference for the customers of the company RSA. The first conference in 1991 had just one panel, and I would guess it probably had no more than 40, 50 attendees. And this year it has 400 panels and over 40,000 attendees. And this year another interesting twist has been added to the name. It is RSAC, where C stands for content, connection, culture, and conversation. It gets beyond the word conference. Let's dive in with you. To take a look at these 4 C's of the RSAC.

Hugh, we're so excited to have you here on Inside the Network during RSA Conference.

I am happy to be here.

So, you know, let's start with kind of the early story of Hugh and the involvement with RSA Conference.

So, okay, how far back do you want to go, man?

I'm going to go, I'm going to try to go a little bit back.

So there we go.

You know, in 2022, you led the acquisition of a significant interest Oh, I think going back to childhood. No, no, no, no, we'll go. We may go there, but we only got 20 minutes, so we'll try to be excited. Yeah, yeah, go ahead. So 2022, you led the acquisition, significant interest of RSA Conference.

Yes.

Through your private equity firm Crosspoint, and you've been on the program committee for RSA Conference for 16 years. So it wasn't since 2022.

Yeah, yeah, yeah.

I've been the chairman of it for 16 years, like you said.

Pretty crazy. But over the past 3 years, you've really gotten involved. I think the new title is Executive Chairman.

Oh yeah, wow.

Yeah, that's how you— the special— they added the word. Yeah, that was, that was the cost. That was the extra cost to buy RSA Conference.

You got executive in there.

What has kept you excited about this conference and staying involved? And why did you decide to go and, you know, purchase a significant interest in the conference?

Uh, it's a great question. Yeah, and, and like you said, yeah, I've been involved with this conference, it feels like my whole life actually, but definitely whole professional life, and when I was a professor at Columbia through, you know, worked for a vendor called Blue Coat, CTO there, CTO at Symantec. But during that whole period of time, it was a passion for cyber, like a passion for how to help people defend and how to connect people. And I felt that every year at RSA conference, you know, when it was 5,000 people, when it was 10, when it was 15, when it was 20, and you know, now it's 44,000 people. That passion is exactly the same. And why would we purchase it, right? Which is a great question. I see this as an institution that must be preserved. It serves a vital function for this community. It connects people in ways that I think are so important, especially in these times. Tech's changing all the time, as you know. And when folks are thinking about new dilemmas, like what policies do I set on my AI agents, for example, you don't want to go out on a limb. You want to find out what some of the other verticals and some of the other players are doing in the space, and you want to collaborate as a community. This is a place where people do that. And so we want to grow it, we want to invest in it, and we want to make it bigger and better. And this year we launched a community platform with the goal being to connect people not just for one week, but try and get them connected for the rest of the 51 weeks of the year. So passionate about the space.

So awesome.

Yes, this is the 20th anniversary of the RSA Innovation Sandbox.

Thank you, man. Thank you for highlighting that. It It is.

And one of the major changes you did this year is introducing a mandatory $5 million investment for each finalist. Take us— like, could you talk through this history of how this decision came to be and what were the outcomes?

Yeah, no, happy to. So, you know, one of the things— and obviously I've been, been running this Innovation Sandbox for that period of time, right? And you get to see a lot of things. You see how these companies then play out afterwards, what happens to them. One of the biggest challenges that we've heard from them isn't so much raising capital afterwards, because typically this, at least in the last 10 years, it's become a platform that says, yeah, that's an important company if you got into the top 10. So will they be able to raise capital? Yes, they probably will. Will they be heavily distracted during that capital raise? Yes. What tends to happen is those companies get a massive amount of inbound interest right after they appear on a stage for ISB. How do we help them capture that interest and how How do we give them funding right away? So we worked on an instrument that we thought was the most founder-friendly way to provide them capital, an uncapped SAFE based heavily off of Y Combinator. And so the thought was, here's an instrument, it's going to be very palatable to those entrepreneurs, but as important, it's going to be very palatable to the venture capitalists that are already invested and the ones that might invest in the next round. So we're not setting a price, uncapped SAFE, we don't set valuation, but we're making a bet because we're not involved in the selection of those companies. It's selected by an independent panel of judges, just as it always has been. So that was the thinking— how can we help these entrepreneurs?

And just to clear up any rumors, okay, there were no changes, there was no negotiation after that.

We published a SAFE, we put it online. This is the SAFE, this is the side letter, and we did get some feedback. We get to add some feedback from the community, including myself, and from— yes, and some unnamed people that may or may not be on this couch, which is actually very valuable, which is very valuable. And as you know, we made a couple of tweaks which we published back out. And you know what? We learned a lot. We learned a lot during the process. This is something— and I know, Sid, you and I have talked about it— this is not a 20th anniversary, let's do a $5 million investment each. This is an ongoing program. And so we're going to learn a lot as we kind reflect on this cohort of top 10. But what I thought was amazing is same process that's been happening for 20 years. Judges adjudicate, they show up, here's 10 companies. We're like, okay, that's great. All 10 companies have accepted the SAFE, and the feedback that we've gotten from those companies has been great. And I'd encourage you to talk to some of those companies and talk to the judges too, see what their experience was like.

You know, Hugh, when you look at the way the 10 companies rise up to the top amongst a pool of what, about 2,000 300 companies that applied this year?

Yes, over 200 this year, about a 40% increase.

40% increase. And obviously the $50 million that is being deployed into these 10 companies, $5 million each, becomes a significant pool of capital. If I wear the venture capitalist hat, yeah, uh, the steps that a VC has to take to earn the trust and respect of a founder, you know, they're as follows. They'll wait till the announcement is made. Once the, the winner is announced, they walk up to the founder, they share the history of, I've invested in 25 cybersecurity companies, these are all the ways I'll value? Will you give me the privilege of investing in your company? So that's the dance a typical VC has to do to earn the trust of a winner. You've kind of completely turned that game around in a way where they get the money right out of the gate or even before they step on the stage. What would you say to, let's say, Ashim, if he was not on the judging panel to say, I'm trying to put my money into this company and you are competing with me now?

Yeah, no, great question. And Ashim, who's a really good friend of mine.

Yes, yes. I know I have talked to him about this.

Yeah, and I'm sure he counseled as the process was being designed because he has to straddle both sides of this equation carefully.

Right. And, you know, everything we do here at RSAC is with the community. So we went out and we talked to so many of the previous ISB top 10 finalists, as well as a ton of folks in the venture capital community and asked, what is the kind of instrument in here that would not impede your future ability to invest? Yeah, that was a core design principle for us. And obviously you're going to see this now play out in real time, right? You know, experiment year one and let's see how that goes. I think though, when they apply, they know the institution at least, which is RSAC. And what, what I saw, which is interesting behavior, all of those companies— I can't say all, there's 200 of them, so I haven't talked to, you know, the 200. But many of those companies then went out and they reached out to former ISB top 10 finalists and they just asked them, it's like, look, I like this competition. I know it's good, but I want you to tell me like really what happened to your company afterwards. Like how transformative was it? And, you know, if you're a founder, one of the big questions you ask is what are you bringing to the table as an investor? I think one of the things that comes with this competition is great exposure. Yeah. And if you get great exposure plus an instrument that is not just friendly to the founder but also friendly to the venture capital ecosystem around it, I think you got something great. We're going to continue to get feedback, but I can tell you that the feedback that we've gotten so far, now that we've actually done it, from both the companies who participated and the folks that are investors in those companies has been very positive. And again, I would encourage you to talk to those folks. Talk to the top 10, talk to the judges, talk to other folks who were investors in it, and you'll hear right from the horse's mouth. Pick anyone I'm not even suggesting anyone for you to talk to. I want you to pick at random and see what they say.

If you add up all the winners across the 20 years.

Yes.

And if you just do a blind pull, think of it as a mutual fund. I'm sure the numbers look pretty solid as an investor, I would imagine.

It does. It really does. You know, and you can imagine, you know, we're not going into this thing completely irresponsibly, right? So what we're, what we're betting on is a process which is truly a bet on the community. So for every year we follow the same process. We have a set of judges, those judges judges view, have a set of criteria that they look at, same criteria, things that you would expect. You know, I won't list all 5 of them, but what's the market potential? Is it a new solution? You know, how are you going to go to market? Who are the founders? That type of thing. And then they adjudicate it and it gets down to this top 10. We then backtested, well, what would it feel like to these companies if we had invested in this cohort and that cohort and the cohort before it? And the numbers were really compelling. They were really compelling. And why is that? You never know for Sure, right? Like, for example, is it that the judges and the process are so good that they pick the best ones, or is it semi-causal in the sense that these companies now get a stamp of being an Innovation Sandbox top 10, and thus if you're trying to get a meeting with somebody like a prospective buyer of the product, is it easier?

No, no, I'll just share one side note about the winner. We interviewed Andy Cao yesterday.

Okay.

And prior to that, we did a little bit of a fun experiment.

Oh boy.

We ran the top 10 into 3 separate LLM models, ChatGPT.

Oh boy, okay, okay.

ChatGPT, I know. And guess what, Hugh? Project Discovery was in all 3, but it was ranked as number 3 by each of those.

Really?

So I guess there is— Interesting. So I guess there is some human involvement that elevated that number 3 to number 1.

Apparently.

Yes. Maybe you don't need judges anymore.

Yes.

Is that going to be your 3 judges will be the 3 foundation models?

Yeah, 3 foundation models and just I was like, we'll throw Deepseek in there.

This is a Chinese angle here.

Oh my gosh.

Well, let's talk a little bit about, you know, other topics. One of the taglines that I remember from an old RSAC conference was RSAC is where the world talks security.

Yes.

Thank you, Sid.

Thank you, Sid. Such an amazing guy.

Great remembering that tagline.

But you know, there are 44,000 people who are here and they're founders, they're operators, they're customers, they're investors. And you're at the center of it all. You're talking to a whole bunch of these folks, what's the one or two key themes you're hearing again and again for this year? Everyone likes to talk about it on LinkedIn, like what's the theme of RSAC? What does Hugh think is the theme?

Look, I mean, of course it's not going to surprise you, it's AI, AI, AI, AI, AI. Okay, but that's okay. It was like that last year, but now it's getting a lot more nuanced. It's getting operational. It's like AI has made it operationally into our business, like it's in here. We've either used it in a customer support case, we're using it in a code generation augmentation case, not letting it run wild, but we're helping it assist, having it assist our developers. So it's real, like it's, it's in. How do we govern it? What about identity of, say, an AI agent that we've deployed? How do we have traceability on how this thing is operating inside of the business? So it's amazing. You saw the same kind of progression with cloud, just not as quickly. It's, ooh, cloud, is that good or bad? And then it's like, oh, cloud, we're up there. Now how should we think about configuration? And like which problems go away and which problems get introduced. You're seeing us go through a maturity cycle of AI in terms of cyber, and it's interesting to see that play out. So that's a big topic. Obviously, there's speculation about regulation, which regulations may be relaxed. Will Europe, for example, take an increased role in regulation during this next period of time? That's a big question that's opened up. And then, you know, I'd say another one is that people are getting more practical and real about potential switch out of some of the older cryptographic algorithms. You know, it seemed like, yeah, 2030-something was a ways away, right? You know, when NSA put a stake in the ground. But I think practically now people are thinking about what will happen, how do I do it, how long is it going to take to move into a post-quantum environment. And those are some of the big things that we're seeing.

RSA conference has always been about learning.

Yes.

What is one cybersecurity or maybe leadership book or resource do you find yourself recommending to everyone and also to founders?

Oh, that's a really, really good question. Okay, so I've written many books, but I'm not going to recommend any of those.

So, you know, I mean, there are two authors on this panel here, Hugh, just to say.

Oh, okay. I'm also not going to pander to the panel and recommend panelists' books, although, although that's a good strategy in general. But you know what I would say is I think about some of the books that sort of really helped me through. At the beginning, I was very focused on secure coding, right? So my first book was on how to break software security, so security testing. But a book that was fundamental to me was Writing Secure Software. And this was actually Michael Howard, who was at Microsoft at the time, still at Microsoft. I get it, it's on coding, so it's only one tiny piece. But if you understand the kinds of errors that happen in code, it helps explain a bunch of other problems that happen downstream. So I think that one is very fascinating. I actually think some of Bruce's books are really interesting— Bruce Schneier— because he takes a step-back view on how the ecosystem really looks like around cyber. I found those incredibly practical for somebody new that's coming into this space. And you know, the truth is we're in a new world, right? We've got agentic AI, we've got these LLMs all COVID effect. It's amazing how much you can learn to get up to speed with some of these things. And in fact, in a membership platform that we have, one of the things we've tried to do is create a RAG model where people can learn at their own pace, but it's grounded in talks that have already happened at RSA conference. So I think there's lots and lots of good resources for folks to get up to speed in cyber.

So Hugh, when we walk around the floor, there are several large companies that have very large footprints. You know, you could take an example of Cisco. I think they have two floors in the closest hotel booked completely to bring in their guests and CISOs, etc. I'm sure if you look at Zscaler, if you look at any of these large companies, this becomes kind of a central inflex point for all the customers, partners to come. But there is the elephant in the room. The big one that is missing here is Palo Alto. And if you see, let's say Nikesh or Nir walking by.

Yeah.

What would you tell them? They're not here. What would you as executive chairman tell them?

I would tell them, we welcome you back.

Welcome you back.

No, I know I say that and I say it earnestly. Because they are an important player in the cybersecurity ecosystem. No question about it.

Right.

And this first and foremost is a community.

Yeah.

Right. Security really is a community.

We learn from each other during this.

We learn from each other during the week. And, you know, there is not one person that you can't learn something new from. I don't care who you are. I don't care how much you think you know. And I would invite all of the participants that are the big ones in the space to participate in this community, because I can guarantee you many of the vendors, even if they aren't on on the show floor, they are going to be right around San Francisco right at this time. And it's a challenge for them and also for us, right? Because at RSAC, we are never satisfied. Like, if you ask me, hey, how'd this conference go? I'm like, okay, great, like, it's the biggest one ever, which it is, and, you know, really happy with, you know, the talks and the caliber and the keynotes and all of it. But what I'm also going to tell you is we're never satisfied. And so we're constantly looking for feedback from our sponsors as well. How can we better serve you? And that will be an ongoing ongoing mission. So I welcome the discussion.

Maybe one last question to end it all. All four of us are Bay Area based, you know, so—

that's right—

outside of this week, we're all here. We're here, here in the— here, you know, not just in the city but in the region. RSAC has been here in Moscone forever. There have been rumors of moving, moving out. Just give us the update. Like, are you gonna stay in SF? And we have a new mayor. What's the— what's the plan? What can you share with us?

It's amazing, you know. I said I'm going to share a story with you. So last year at dinner, right, at, at RSA. There's a dinner and somebody comes up to me and they don't ask me that question, right? But what they instead say is, oh, RSA is moving to Las Vegas.

They announced it to you, right?

Right.

They've announced it to me that it's moving in 2025 because this is in '24, 2025. What was ironic is we were standing right next to a poster that has the dates of RSA 2025 in San Francisco. But okay, so, so these rumors have gone along for long time. Like, look, I think that the city is making an earnest effort to continue to improve. I'm very optimistic. We had a great relationship with Mayor Breed. We have a great relationship with Daniel. He was here earlier this week, you know, walking the show floor. He understands the importance of RSAC into this environment. This event is massive. You can't just take an event and move the thing. And also Silicon Valley has a special place in technology. And so when we think about those questions, RSAC is here. 2026, you're going to find us right here. Actually, not right here right now. I think it's like, you know, 5 weeks earlier, but you're going to find us here and we're going to continue to work with the city to make things even better for our attendees. Now, you know, one of the biggest challenges is how big could or should the conference get? And it's for that reason that we've spent a lot of time thinking about this platform. How do we help people that really really internally can't get travel budget more than anything else to come, right? So we're continuing to find new ways to serve folks.

You—

three of us here on this side of this table are champions for founders. Our request to you is to continue to find ways to make RSA more and more relevant, more and more attractive to the founders that are just getting started or going through the early phases. Innovations Handbook is a great forum, but we hope that there'll be more such programs that will built into the, the broad spectrum of 4 or 5 days that we have here.

And, and we can't wait to go on that journey. In fact, we've got Innovation Sandbox. We've also got Launchpad, which is for companies that are a stage earlier. We formed something new this year, which is an offshoot of Innovation Sandbox. It's called the Founders Circle. Very exciting, right? There's only one way to get in, which is to be in the top 10. And it's all the top 10, not just the one from 2020, all the way going back. It was so inspiring to see those folks getting together, gathered up. We are 100% supportive in innovation. We have to have it in cyber or we're going to lose, right? Not as a conference, as a society. So anything that we can do, any ideas that you guys have of things we can do, we're completely open.

Thank you so much, Hugh. Thanks for joining us.

Thanks for having me. Thanks for having me.

Now that was a fun conversation with Hugh. By the way, not many know that he has a PhD in mathematics, hence Dr. Hugh Thompson. And oh, He's also authored 4 technical books and over 100 papers. But we just see him on the stage as the host of the Innovation Sandbox. As the executive chair of this entire conference, Hugh has done a lot for our industry. If you as startup founders feel like RSA should do something more, something creative or different for startups, please let us know and we will do our best to share it with Hugh and rest of his team. Now, as we wrap up this episode with some of our own observations, Sid, Ross, and I, we walked the floors, we did our 10,000 steps, many founders, CISOs, and VCs. And here we share some observations. And the best part, Ross saw the goat on the exhibition floor. Let's hear about that goat.

All right, gentlemen, here we are. RSA 2025 is over. Two questions for both of you. What is one thing that you observed, a major trend, a theme? And what is one funny thing that occurred during these past few days?

Well, it was, it was a fantastic week. My, it was so good that I can't even I can't speak anymore. My voice is completely gone. So for all of our regular listeners, if I sound weird, it's because I've been talking too much this week. And Mahendra, before I answer that question, I think the most important thing, given we have you on this episode, is it's no longer RSA, it's RSAC. And I think, you know, we want to make sure we get that right.

I see.

I see.

Now I see.

RSAC 2025.

Yes.

RSAC 2025. Well, you know, maybe I'll start with the funny thing.

Probably the—

there were a lot of funny things that happened over the week with both of you as well. But in my opinion, the funniest was I had my dear friend Rob, Rob Gilduta, bring his humanoid to an event we hosted at Foundation Capital's offices on Wednesday. And both of you were there. And it was just pretty crazy to see this humanoid walking around amongst CISOs, CIOs, founders, you know, kind of heads of M&A. And it became the kind of the star of the, of the entire kind of night. Everyone wanted to take a selfie and shake its hand.

It almost wrote a check. It almost wrote a check.

It almost wrote a check. I did, you know, Robert pasted a QR code on it and I was hoping that, yeah, you know, people were adding it on LinkedIn because it was definitely, you know, one of those cool things to see.

So wait, wait, Ross, did founders start to ask this humanoid for money? Like, what are you talking about you wrote a check?

Well, I don't know if they did, but you know, as it happens with VCs, you don't have to ask them for money in order for you to get the check. They come to you.

Yeah, the humanoid was wandering around and I think a few founders might be disappointed they didn't get a term sheet from humanoid.

I think the funniest part was we had a panel as part of the session and there were 3 CISOs, Subrah Kumar Swamy, the CISO of Visa, Ben de Bont, the CISO of ServiceNow, and Mike Elmohr, the CISO of GSK, and myself. And the humanoid was next to us and we were all laughing and saying, this is going to be the future CISO and investor in the room. So, you know, kind of like the past, the present, and the future all just, you know, sitting up on stage. And then maybe the funniest thing was right at the end, you know, I helped Rob kind of with two of my founders. I helped him take that humanoid back to his house and, you know, he called a Waymo. So we had a Waymo and we were trying, the four of us were trying to put that, you know, that humanoid into the back, you know, the boot, you know, of the Waymo and you should have seen There was this like robotic humanoid car, basically. You had a humanoid and then you had the four of us and we were trying to kind of put it in and it was the funniest thing on the street. I mean, there are people taking pictures of us as one of those like odd evenings, just so Silicon Valley. You don't see it anywhere else.

Yeah.

Like what are the human beings doing here? The Waymo should automagically talk to the humanoid. The humanoid should automagically go inside the Waymo and the two of them should take care of themselves. Like, come on, guys. Get on with the program.

Maybe in a year, maybe by RSAC 2026, that will be happening. And I hope not.

That will be happening.

That may be the end of the three of us doing anything of real prominence. You know, interesting kind of learnings. I mean, there are lots of learnings. Clearly, agentic AI was the talk of the town and Hugh talks about it in our show in this episode. But maybe the other interesting thing for me was I was pushing CISOs and CIOs on what they were seeing in in terms of, you know, spend and how spend was changing. And in the past few years, we've seen kind of the security budget grow very consistently between kind of high single-digit percentage to low double-digit percentage. So in the range of kind of 5 to 15% growth per year. And several CISOs and CIOs highlighted that given the macro conditions, given everything going on, we were likely going to see at least, you know, a cut. And the biggest question was, was that cut going to be half of what it was in the past? So if you were, you know, growing 8% annually a year, was it looking more like 4%? I think that that is a big conversation point. And for founders, you know, who listen in on this show, I think it's a big factor for all of us to consider because the flush budget, the increase in budget is typically the budget that a new startup goes after, right? That is the budget that's not been assigned and that allows you to go after, you know, a net new budget item and create a net get new spend. So I think in that world, we are going to have to think about all of us how to adapt to this kind of new spend changes. I think the biggest advice I'd have for founders as they're thinking about that adoption and how that may change is really factoring in that we have a big demand-supply imbalance in terms of human talent in cyber. And what Agentic AI and LLMs allow you to do is take some of the services spend, the human spend, and convert it to software. And so as you think about building new tooling, think about how how can you go and automate portions of the security workflow? And then think about how can you go and effectively market that automation to the customer so they understand that, hey, by using this software, I'm actually going to save money. And that will be a huge factor. And by using the software, I won't need to hire this additional talent because that budget increase, even if there's a shortfall, that's a total shortfall. That's going to be both software and services budget. And there's an opportunity to go and take some of that services budget and move it to software. Those were the two interesting facts.

Yeah, for me, I think the funny thing is just how screwed up our perception of risk is. Think about it from this perspective. Every single attendee of the RSAC was incredibly excited about Waymo. So every single one of us was getting into those cars and entrusting the machines with our lives. At the same time, a good number of people are still skeptical about the future of AI with respect to cybersecurity and whether or not we should be trusting AI to automate some of the tasks that humans are doing. So to me, it's almost like it's just fascinating the degree to which we are willing to risk our lives, but we are not willing to trust this, you know, robotic process automation with a few triage tasks in the SOC. Something that is in terms of learnings, I think two bits for me. One is that in 2025, it is no longer possible to scare CISOs into buying selling a new product. You have to communicate real ROI. You have to explain how does this product make them more efficient? How does this product help them save money? How did this product help them do more with less? And to your previous point, using AI to automate foreclosures is most certainly one way to do it, but there are many, there are plenty of other ways to do it as long as the founders keep the ROI equation in mind as they're thinking about building something new. The other bit for me is the growing gap between the discourse on social media and the real life. For example, there have been a ton of people on social media, like, leading up to the RSAC week talking about the questionable value. Hey, should we go to the conference? Does it make sense? Does it have a good ROI for founders? Does it have a good ROI for security leaders? And then you show up at the event and you talk to the actual attendees and you realize that the ones who are able able to plan their time well, know where to go, know whom to meet. They're getting a tremendous value out of that event. Like security practitioners, security leaders are able to meet their peers, are able to understand, you know, to benchmark their security programs against their colleagues' security programs. They're able to meet new innovative startup founders. They're able to understand how the industry is shifting, how the trend landscape shifting, what they should be paying attention to, a ton of value. In the same way, founders, if they are being proactive, if they're scheduling conversations ahead of time, if they're planning their calendar, if they're planning whom they're going to meet, which events they're going to attend to, they're getting a tremendous amount of value from all of that exposure to their, you know, to their customers, to prospective customers, to VCs, their other founders and learning from them and so on. On and so forth. Now, at the same time, some people can obviously question the value of the conference because they want the conference to happen to them instead of being proactive about their own time and trying to get value. The other bit is like the other way of in which I see this growing gap between the discourse on social media and in real life is how people discuss, is what people discuss, right? If you go on LinkedIn, you read some articles, everyone is talking about AI. CP, everyone is talking about agentic AI. Now you talk to buyers and you realize that they're still talking about the very same problems that they've been talking about 5 years ago. They're still talking about vulnerability management, endpoint security, email security, cloud security, network identity, and on and on and on and on. So the new technologies, where the new technologies are most impactful is where they're applied to the old well understood problems. And that's where the difference is made.

Yeah, I think for, you put You put a really good point, Ross, which is that I think the advantage of a big conference, certainly of RSAC with whatever, almost 45,000 attendees, is that it is truly where the world talks security. And there's this huge opportunity to go and meet people who are not in your network and get to know them. And as a result, get to go and get insights that you may not have been able to do one-on-one as you go and reach out to individuals over email or LinkedIn or through some other form. And I think that as our listeners are thinking about whether to go to a big conference, RSAC or Black Hat. I'd put those two as kind of very large conferences in our industry. And if you want to go and have those chance encounters and increase your network, these are the places to be. Mahendra.

Well, speaking of chance encounters, Sid, I remember the first RSA I attended was 13 years ago, and I was literally crossing the street coming into Moscone and somebody, I could hear somebody yelling out my name and I turned around and I walked back actually halfway from the street and this person introduces me to this founder. 2 seconds later, this person is gone. I have taken this founder's contact details and then I'm gone. So that chance encounter led to one of my early investments that gave me an 8x outcome on a cash-on-cash basis, right? So I am a big believer that these events, you know, 40,000 some people come in one week. I had almost, I don't know, I met almost 150, 200 people. I mean, granted, these are not deep conversations. But if I look at the rest of my year, probably I'll have another 100, 150 meetings. And then all of this is compressed in like 3.5 days, right? Still, the density and value is so immense. Now our world, you know, Sid, your and my world is sort of intertwined between these 3 legs of the startup journey. On one side, you have founders. The second leg is, call it investors, VC friends, if you will. And then the third leg is acquirers or say investment banks.

Anchors.

And so between those three, there were some pretty interesting observations. Amongst founders, I found some of this repetitive me-too startup ideas. And my one request to our audience of founders is that, uh, do some research. There are tremendous opportunities out there, but also try to stay away from the ones that so many other companies are doing. A slight variant on agentic AI is not going to give you a differentiation. It's not going to get the VC excited. So you have to think differently. I mean, to use the Apple slogan, think different. So that's one advice to founders. Now on the VC side, of course, a lot of parties, fancy dinners, lot of, uh, you know, events where you're sort of literally trying to jam 4, uh, you know, dinners in one evening. Uh, they tended to be a lot more, uh, interesting where you started to see how investors are thinking. And the big observation is investors are obviously, you know, being conservative, being very very picky. In some situations, the valuation dynamics are of course playing to the investor's advantage. And then finally, on the acquirer side, I had, you know, conversations with people from Cisco, Palo Alto. I heard some people describe how CrowdStrike strategy is evolving. And I think there is a very interesting world that is starting to play out there. And being aware of those with how the investment bankers are also working with those buyers, it's extremely important for around us to know how the big companies are thinking, how do they look at the geopolitical impacts, the changes in stock market, and how their own strategy is going to evolve. Of course, the big surprise or the big sort of event that occurred just prior to RSA is the Google Wiz acquisition. And I was hoping to get hold of some people around that acquisition, but I miserably failed because everybody was partying. So a couple of other high-level observations. In AI, there are these three areas, right? One is how can the models be protected? And So we have companies like Protect.ai that got acquired by Palo Alto. The second is how can the SOC or the life of the analyst be improved? So you saw so many different opportunities coming out there. And there I feel like the risk of differentiation still needs to be thought through. Finally, the third piece was how can the enterprise protect themselves when a lot of their employees are posing questions to ChatGPT or how they're downloading models from Hugging phase, how they are going about using AI in somewhat of a Wild West manner. And so we saw startups that covered those three areas. And I feel like it'll be interesting time to see how those three zones of opportunity play out for our founders.

So is nobody going to talk about the goat on the floor? Have you guys seen Van Vendor Goat?

I did see it, but I saw pictures of it. It was pretty crazy.

That was kind of cool. That was kind of cool. I hope next year on the floor, we can have a small petting zoo with goats and all the other kinds of animals and people can just have fun with kids.

Well, you know, some of the feedback though was also that like, that one could argue that there's some level of animal cruelty and the reasoning behind it is that they also had puppies and, you know, puppies are not supposed to actually be, you know, they're not supposed to, just like small babies, they shouldn't actually be spending a lot of time with a lot of people because it increases the risk of kind of them getting illnesses. So I think like they're positives, but they're all also negatives to just having animals animals kind of there, it feels a little bit gimmicky. So while it was a cool angle, I also worry a little bit about the animal cruelty there.

I think we should all unequivocally state for our audience that we do not support animals, human beings, or any other form of exploitation to promote your shit.

Yes, that's true. That's a great point. I think only you can promote it. You should be promoting big your stuff.

And I mean, to find an intelligent way to diverse, you know, differentiate yourself. If you think that you need an animal or a human being dressed in a certain way, or, you know, something that kind of borderline is silly, then maybe you should not be doing that business at all because you're not gonna get attention from the intelligent buyers.

Agreed. Agreed.

Thank you for joining us Inside the Network.

If you like this episode, Please leave us a review and share it with others.

If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.