In a Bloomberg West interview, Symantec CEO Enrique Salem discusses the evolving landscape of cyber threats, framing cyberattacks as equivalent to acts of war due to their intent to disrupt economies, citing Stuxnet as a high‑profile example. He emphasizes the need for organizations to assume they will be attacked, prepare defensive measures, and establish clear remediation and counter‑attack plans, including strong relationships with law enforcement and governments. Salem addresses the difficulty of attributing attacks, noting that origins can be obscured and that Symantec works with authorities to improve attribution techniques. He outlines Symantec’s collaboration with governments worldwide, referencing President Obama’s statement on national vulnerability. The conversation turns to recent corporate breaches (Google, Sony, Lockheed), highlighting the importance of protecting critical information and users, and argues that many companies under‑invest in security. Salem stresses rapid patch deployment and clear communication to ensure customer compliance. Regarding Symantec’s business, he describes explosive data growth (62% increase, 800,000 PB) and identifies five mega‑trends—virtualization, mobility, cloud, and the shift to smartphones—that drive demand for security solutions. Symantec plans to spend $1.25 billion on acquisitions targeting mobile, cloud, and virtualization technologies, citing recent purchases of Verisign’s security business, PGP, and GuardianEdge, which together are projected to generate $165‑$185 million in revenue. He explains the acquisition process as market prospecting driven by line‑of‑business needs, aiming to accelerate time‑to‑market with third‑party innovations.
Chapters
We're joined today by Enrique Salem, CEO of Symantec, the largest security vendor in the world and maker of the popular Norton antivirus software. He oversees 18,000 Symantec employees in more than 40 countries and is an expert in the field of cybersecurity. Enrique, welcome to Bloomberg West.
Great to be here.
So you guys are now on the front lines of cyber warfare. Do you think that cyberattacks should be considered acts of war?
Well, they are equivalent in many ways. They have the same intent. They're basically trying They are trying to disrupt the economy. They are trying to bring something down. One of the most visible attacks happened last summer, what was known as Stuxnet, where an attack took down the uranium enrichment capabilities of Iran.
This opens the door for the U.S., though, to react and respond with traditional military force. What's your take on that?
Well, look, anytime that you deal with these sorts of situations, you've got to be ready to respond. Now, do you respond with traditional conventional weapons, or do you respond with a cyberattack of your own? —a lot of discussion about what is the appropriate way to respond.
Do you feel like— Enrique Salem, do you feel like you guys have got to change the way you guys do business in a certain way because now you're at the point where you're triggering what this nation will decide is war?
Well, what we have to do is we have to help people understand what do you need to do to be ready to deal with these attacks. And I think it's a simple, straightforward plan. You better know that you will be attacked, and so you gotta be prepared. How do you protect yourself? And then, how do you counterattack if there should be an incident? And that means you better have good relationships with law enforcement and with governments. And so we're helping people understand what they need to do to respond.
It also seems that catching who did it, who's behind the hack, is a new goal put on top of security systems, that finding the hackers really isn't the job of hackers, of, of of security virus software, for example, for years has just been about keeping the bad thing out or remediating the damage. But tracking back to finding out who's responsible has not been the goal of software in the past. Is that something that you guys need to start doing in the future? And will that add expenses to your software development?
Well, attribution of the original attacker is something that people are always interested in. And so what we try to do is help understand what is the source, where is it coming from. But as you know, one of the biggest issues with cyber attacks is that they can perceive to be coming from Eastern Europe, from China, from Latin America, when the perpetrator could be, quite frankly, anywhere in the world. And so this notion of attribution, we do spend time thinking about how do you do it, how do you do it effectively. And we're always working with law enforcement to help them determine who is the culprit. And we have some techniques that we use to make that happen.
How involved is Symantec in working with the US government to prevent these kinds of things?
Well, every day we work with governments all over the world, not just the US government, to help them think about how to be protected. Uh, President Obama, when he took office, he made a very definitive statement. He said, "We're under attack." He said, "Our nation's prosperity is linked to the security of our cell phones, our laptops, our networks." And he said, "We have to make sure we protect them." And so Symantec is actively involved not only with the US government, with governments around the world, to help them understand what are the steps they need to take to ensure security.
We've seen a string of corporate hack attacks— Google today, Sony, Lockheed. Could these have been avoided?
What you have to do is you have to think about what do you need to protect. What we find the most important thing to protect is the information that you use to run your business, because they're going after something. People are going to get attacked, they're going to get hacked, but what has to happen is you have to know what matters. And so in any of these cases They're after intellectual property. They're after credit card data. They're after your personal information. And so you got to protect it.
Are companies spending enough money on protecting themselves? Should they be spending more?
Well, thank you for that. We think they should be spending a lot more. And we believe that there are opportunities for companies to be more efficient in how they spend their money, but also to make sure they know what to protect. There's really two things to protect: users and information. If you do a good job of protecting those two things, you're going to be probably better off than you are today.
Enrique, I know that IT guys always blame the users for problems with their IT, but it seems to me that with the EMC story, EMC RSA, the, the fob attack that we learned about this last week against Lockheed, that Lockheed was warned 2 months beforehand that there was a problem with these fobs and whatever changes they needed to remediate, they didn't get done. What do you try to do to make your customers follow your updates? When they're worried about getting another sales call?
What's important is to make sure that you know what needs to be updated and also to make it clear to the department how quickly it needs to be updated. So if you give them what and how quickly, they should move pretty expeditiously. Now, sometimes if you've got a deployment that's hundreds of thousands of end users or devices, that may take some time to remediate. And so in every situation, you always want to think about how do you remediate very, very quickly because you are going to get attacked and it's important to have a recovery plan. Yeah, I talked to Lockheed yesterday.
They have 130,000 employees at the last 10-K filing. They wouldn't tell me yesterday how many users of the internet they have, their intranet. But to be clear, it seems to me the cost of remediation is greater than even the 130,000. You tell me if there's a problem at one company that needs to be fixed, you suddenly have to fix that at every company.
Usually when there's a major vulnerability, they're using what I'll call common technology, common code, for lack of a better word. You probably want to make sure that all of the systems are being remediated. In many cases, there are multiple factors at play, so something that may hit one company, they may not have all the information they need to go after another. But once you see something as high-profile as this situation, you really do need to think about how do you remediate all of the businesses to make sure they're protected against a potential future attack.
So let's talk about your business. Analysts say it is stable, but that you do need new revenue streams to keep growing. Give us an idea of what kinds of things you're investing in and where you're seeing results.
Well, what you see right now is our customers are dealing with explosive growth in information. Information was up 62% last year, 800,000 petabytes of data. That's enough CDs to go from the Earth to the moon. And so customers need help in dealing with that information explosion. You just talked about the threat landscape. It's become more toxic, more targeted. People need help protecting themselves. Three big trends around virtualization, mobility. There's more smartphones now than PCs as far as more were sold in December quarter. And you're also seeing a lot of new services from cloud computing. And so when you look at those five big mega trends, those create opportunity for companies like Symantec to help people protect their information and protect the people who use that information.
You said you'll spend $1.25 billion on acquisitions in mobile and cloud. Where do you see the biggest opportunities?
Well, the three areas that we're targeting are mobile, cloud, and virtual. And so what we're saying ultimately is that's what our customers need. What we're trying to do right now is make sure that as there's all these different mobile platforms— you've got Android, you've got iOS, you've got a webOS, you've got Windows. And so customers need help authenticating users, managing those devices, because every corporation is saying, I want my employees to be able to bring their own device to work. And so we need to help them enable that. And so that's what we're spending time talking about.
Mobile. Why are you doing that? Why are you doing all these acquisitions specifically in the world of mobile instead of developing it internally? What is it? X, you know, you guys spend a ton on R&D, but then you go out and buy these companies. For their innovation? What are they doing that you guys can't do internally?
What we do is we're looking at a couple of different areas. We touched a little bit on mobile. We also see opportunities in virtualization. We see opportunities in cloud-based services, and we're always developing capabilities internally. But we're also looking to tuck in or augment what we do with third-party technologies. And a lot of times it's a small piece of technology that we haven't put into our portfolio. And from a time to market perspective, it's just more expeditious to go out to a third party. We're very comfortable with a lot of the innovation we drive every day inside of Symantec, but we want to be able to use our resources to accelerate our time to market and get more customers to use Symantec technology.
Is there a certain way— how do you go about finding these companies? Is it your guys know this beat, or is it more about new threats develop and you can quickly acquire the small companies that have found ways to fight those new threats?
What we're doing every day is we're spending time, what I would call, prospecting the marketplace. Most of the things that we do are driven by our lines of business, where they will say to us, "We have a capability that we need." They'll work through our corporate development department, and we'll identify half a dozen prospects. Rarely is there only one company that does what we are interested in, and that allows us, quite frankly, to find the best technologies on the market and bring them into Symantec. Over the last year, We acquired 3 technologies. One was Verisign security business, PGP, and GuardianEdge. And last week at our Financial Analyst Day, we told the Street that we had forecast about $165 million in revenue from those 3 acquisitions and we did about $185 million.
All right. Enrique Salem with Symantec. The cyber battlefield changing rapidly. Great to have your insights on that here on Bloomberg West. Pleasure to be with you.
