Cybersecurity: ‘We are fighting an asymmetric war,’ SolarWinds CEO says

SolarWinds CEO Sudhakar Ramakrishna joins Yahoo Finance Live to discuss the need for boundaries around AI systems, growing security threats, and the outlook for cybersecurity.

Video Transcript

BRAD SMITH: Growing security threats, including those from China, have pushed the Biden administration to call for better safeguards for US critical infrastructure, including cybersecurity. Now, President Biden's proposed 2024 budget increases the cybersecurity and infrastructure security agency, or CISA, budget to over $3 billion while boosting spending on several cyber initiatives, though there's a chance congress could approve more or less.

Joining us now for more on the mitigation of cyber threats is SolarWinds' president and CEO, Sudhakar Ramakrishna, who's here to discuss the use of artificial intelligence in cybersecurity as well as President Biden's cybersecurity goals. Great to have you here with us today.

First and foremost here, people should know, for those who are unfamiliar, you assumed the role of CEO SolarWinds. This was following the 2020 cyber attack. What were some of the biggest developments, when stepping into this role, that you saw as necessary or prioritized to change in how the company was operating?

SUDHAKAR RAMAKRISHNA: First of all, Brad, thanks to you and the team for having me here. I'm delighted to be with you, and discussing this very important topic for all of us in the broader community of technology and community in general.

As I stepped into the role, first of all, like any incoming CEO, I assessed the cybersecurity posture of SolarWinds and compared it to my background, which was also in cybersecurity, and started defining ways we have to enhance. Because the nature of the attack that SolarWinds had was very novel and sophisticated. And, as you know, if a determined state actor is after the property of a private company, then nine out of 10 times, or 10 out of 10 times, they're probably going to break through.

So we built a framework, which we call Secure by Design, that was comprehensive across infrastructure, application, cloud security, keeping in mind the complexity that is emerging as well as very focused on transparency, collaboration, and public-private partnerships because I don't believe any one company is actually capable of protecting itself because we are fighting an asymmetric war here. And so those were some of the initiatives under the framework of Secure by Design that we implemented. And to date, we still practice those.

- And Sudhakar, you recently hosted the public sector partner, Summit. So I want to ask about some of the conversations that you're having in the public sector, and really how the investments that you're seeing match the threats that you're also seeing.

SUDHAKAR RAMAKRISHNA: Great question. Thank you for asking that because the public sector, the federal, and the state, and local governments, are a very important constituent of our business. And they are experiencing significant and greater threats every single day. We've used a combination of technologies as well as integrations.

And I mentioned the word public and private partnership as well as the notion of community vision. What's important-- and you mentioned CISA in your opening remarks-- is the involvement of CISA has been increased after Jen took on the role. And we have been participating very actively in President Biden's initiatives across instituting better security controls, better security hygiene, and practices all across, both in the context of secure S-Bomb, as they call it as well as broader security practices, including the use of AI. And everyone is determined to fight it. But we have to fight it together.

BRAD SMITH: I'm going to tell somebody that their security hygiene is bad next time I'm able to get into their phone without knowing their password. I like that term. I'm going to use that. You know, at the end of the day, I think there's a lot of focus on where artificial intelligence comes into play for cybersecurity. This is not new. I mean, I've seen demos in the past of where artificial intelligence, or augmented intelligence even, has been layered into this approach. So what's new about it right now, here in 2023, versus five years ago?

SUDHAKAR RAMAKRISHNA: Brad, if you look at every enterprise, they have two issues. One is complexity is growing and their costs or budgets are not commensurate to the complexity growing. Added to that is the significant and constant security threats. And that's where AI comes into play. In our context, using our observability platform, service management platform-- so broadly speaking, the SolarWinds platform-- we have integrated AI opps to allow customers to improve their productivity and reduce their costs through simple mechanisms.

One is you may hear the term alert fatigue from people you speak to. People are getting too many alerts in the enterprise and they don't know which ones to prioritize. And if you don't prioritize the right ones, then security holes and security threats emerge. So using AI and machine language techniques, we create alert stacking, which eliminates alert fatigue and helps the customer focus on the right issues to address. That improves their productivity and reduces the cost associated with security breaches.

BRAD SMITH: Right.

SUDHAKAR RAMAKRISHNA: Two, extending that on, we also help them predict what could go wrong and also help them root cause it so they can continue to improve their overall security posture.

BRAD SMITH: So from the government entities that you work with, do you believe that the budgets have proportionally increased enough in order to keep pace with what you were mentioning ago, in the number of threats that are now emerging either from domestic or foreign actors?

SUDHAKAR RAMAKRISHNA: I'll give the government a lot of credit for making security a conscious topic amongst all of us and actually supporting us, both in terms of policy as well as continuing to focus on budgets.

Are the budgets sufficient? I'm not qualified to address that question, Brad. Are they increasing balances? Yes. And this is where I am a very strong proponent of public and private partnerships. Because as vendors, we need to continue to improve, and optimize, and help them increase their productivity as well. And so I see a sense of obligation on our side. But equally the government can share a lot of information with us, where together, we become more secure.

- And just very quickly, in terms of where the threats are coming from, we know that China tends to be the name that comes up. Where else should people be aware of?

SUDHAKAR RAMAKRISHNA: You know the usual suspects when it comes to state-sponsored attacks. You mentioned China is one. There's a few others. At the same time, with the advent of AI, that could be a proliferation of some of these because you can be a lone wolf and still use AI technologies to create threats.

And so we have to be vigilant across both nation states as well as individual, lone wolf attacks, small subgroups. And so this is a matter of constant vigilance and constant learning, is the way I describe it in terms of security.

- Thank you for taking the time to join us this morning. SolarWinds' CEO, Sudhakar Ramakrishna. Thank you so much.