Jason M. Lemkin explains how hyperscalers enforce near-zero tolerance for vendor breaches. A material incident exposing private data ends the partnership, though minor issues fixed quickly may be forgiven. When vendor products are interchangeable, customers can switch easily, but non-fungible services trap them despite security failures.
Jason, I'm sure you've got an opinion on this in terms of, bluntly, the Macaw hack and then losing Facebook as a customer.
Well, just two thoughts. One, not that long ago, I was with part of the management team of one of the leading hyperscalers, and what he said— and I was with him when there was a minor security issue with the third-party vendor, relatively minor, but not like this, not like all of the private data of all of McKerbin and exposed. And what he said was, there's not much higher on our list with partners than when this happens. There's not much higher. Like, we, we have no tolerance. It's not worth it. There is no tolerance. And in this case, they got a pass because it was a relatively minor issue with a vendor that was honest, and they fixed it, and it did not lead to actually any internal data issues. It was just an external issue. But it was crystal clear, there is no tall— there is no— it is not worth it for us. So that is troubling. And the other thing, and I'm not an expert in the data labeling or mercure space, what I don't know is how fungible the products are at some level. The more fungible it is, right, the more freedom you have to route that to what's left at scale or whatever the guys at Handshake want to do or whatever they want to do. If it's, if it's not fungible, you can, you can, you can bang your chest, uh, but you're still, you're still, you're still stuck using them. But, but that moment, like that when I was with that hyperscaler.
Number one criticism of the space is that all the largest customers are customers of all of them. And so they are generally heavily fungible.
And so I would be very worried because this comment was chilling from this executive is like, this is the highest thing on our list with third-party partners is security. We're exposing our, our applications to folks we'd rather not expose it to because our ecosystem— we'd rather have no partners because there is so much confidential stuff flowing through what we do at all levels. So we have no, we just have no tolerance for anything that's material. I just don't see how you would come back from this if you've crossed, there's just no, unless you have to. I think it's, I think it's, it's potentially death. And the reason I bring it up is in the old days, like through 2023, in our lifetimes, you always gotta pass once as a vendor.
