Our second annual list highlights the growing importance of cybersecurity within the startup and venture scene.

59_CYBER60-2024-WIZ

Fortune Cyber 60

The threat posed by cybercriminals is constantly evolving. For these startups, success hinges on being one step ahead.

Cyber 60 2023-Wiz

Cyber 60

Company stage

Founded

Funding ($M)

Investors

Wiz Company Profile, Stock Price, News, Rankings

legacy

Wiz Company Profile, Stock Price, News, Rankings | Fortune

Philip Clark, Investor, Thrive Capital Assaf Rappaport, Co-founder and CEO, Wiz Interviewer: Allie Garfinkle, Fortune

Brainstorm Tech 2024: Google in Talks to Acquire Wiz for $23 Billion

Conferences

 Amy Challen, General Manager, Artificial Intelligence Sachin Dev Duggal, Founder and Chief Wizard, Builder.ai Jenny Griffiths, Vice President, Data Science, Oracle Moderator: May Habib

Brainstorm AI London 2024: Navigating Roadblocks And Catalysts To Enterprise-Wide Adoption

Photography by Joe Maher / Fortune Brainstorm AI

Hey, hi again, everybody. Uh really excited to talk about getting those po CS out of purgatory and into scale uh with a fantastic panel. Uh First to kick us off how many folks have got scaled use cases in production for generative A I in the audience hands up. OK. Just what we thought. Um How many folks if you know, are spending more than a million dollars a year on generative A I? More than 3 million, more than 5 million, more than 10. OK. Well, you guys know what my answer is. Um but uh that's great. Uh uh insight and data folks are early and the, the stat, this is accenture BC G. Lots of folks who pulled executives fewer than 10% of the generative A I explorations are in production. Uh There is a graveyard of unused chat applications when those use cases do go to production. So I do think um we are in a um a bit of a trough from a adoption uh and scaling uh perspective and let us dive into um uh this conversation with, with that in mind. Um You all have scaled use cases in production and I would love for us to actually just maybe rapid fire, share those before getting into what you had to overcome to get to scales. And then we definitely want to take questions in, in this session. Uh Sachin, I'd love to start with you at Builder. What are you guys doing? How are you using A I internally? Um We are proud partners, mutual customers. So um tell us a little bit about how you guys are using A I internally. Sure. So, you know, at builder, we use the entire length and breadth. So, right, the way from, you know what you call classical A I machine learning, both supervised, unsupervised. Um We actually, the core foundations of our platform are built on a knowledge graph. So graph theory is really important because it creates the reasoning engine to give generative A I guard rails for all intents and purposes. Um but also um is a really strong method for reinforced learning. Um And um and then we use computer vision. Um So when we produce applications, you know, the old way of testing was you had a human that looked at an application compared to, to design. Uh It takes a really long time, we can test an application across thousands of devices in 30 seconds using computer vision. Um And then obviously, which everyone's looking forward to is we use a lot of generous technology. Um Now, I would say uh we have our own work especially on the small um sort of small language model side. Uh But the, the, the use of commoditized LLM SI use commoditized Lucy because I know it's a new technology but it's commoditized, it's actually quite important because we work with just about everyone um both from an image video and sort of the the tech side. And that allows us to do everything from user story generation based on ragging with the knowledge graph through to what we just launched last week, code generation. Um where the the our error rate is is single digit percentage um in in code produce because it plugs into the rest of our plumbing. So, really across the spectrum? Awesome. Thanks for sharing, Amy. What about you at Shell? What are we doing? Um We're doing a lot because we have the remit of the whole of Shell, which is a very large integrated value chain energy company. Um but some of our best established use cases and when I say best established, I mean, 10 years, it's things like predictive maintenance which you can use, you could use it in traditional oil and gas space, but also um wind farms, also the Holland Hydrogen one where we're, which we're building uh to be operational a year or two, which will create um green hydrogen from the Holland Coast, North Wind Farm that is being designed to have these integration as well. So that's a use case where we've got um So tens of thousands of pieces of equipment um under predicted maintenance models. Um Other examples are, are, are eb charging network. Um We've got optimized charging across that to ensure that um it will charge as efficiently as possible from where you're at. And then you've got other applications um such as um our marketing and loyalty pieces. Again, really obvious use case people have been doing it for years, but these have been a cut for years. So we've got a long tradition of making all the mistakes putting into production, scaling it. And that has put us in a much better place for the newer use cases and things like TV. I come out, everyone gets really excited. It's the same problem. It's, it's not the technology, which is the problem, it's the scaling, it's the implementation to processes, it's the change management. And so we have got that framework to do this. We have got these practices and we're doing the same again. So it's, it's been a really good couple of years in terms of the improvements in the models and improvements in the capabilities. But we are just putting it into our um, existing frameworks and existing ways of working in order to scale it and get the value. Awesome. We're gonna come back to that. That's great. And Jenny, what about you? You are both building A I into your products and using A I internally. So maybe tell us about both those sides of skilled use cases. Now, that's a really good point. We do have a kind of two pronged approach. Um So my group um I'm in Fusion A I and basically we develop embedded A I applications for Oracle Fusion Suite. Um and that covers pillars like uh human capital management, uh supply chain management, customer experience, uh finance. So loads of kind of different applications, but we try and use the same core underlying technology for loads of different customers and loads of different applications. So it makes us think about how you can design A I at scale. Um And yeah, when it comes to what we've been doing with generative A I, we have 25 use cases go live just last quarter alone, um A lot of others as well. So we're beginning to see this kind of customer adoption. And from my point of view, what's been really lovely to see is kind of people lean in at scale for kind of business knowledge and business application, but also on a more academic level of we now have customers really engaging with us about how A I models are put together what kind of data we're feeding systems with. So we're seeing this kind of business awareness and kind of academic awareness rise hand in hand, which has been really great to see awesome the end user adoption that you are seeing. Let's talk now, just your and your internal use cases for for generative A I, we have heard over a couple of panels around the reskilling challenge and the training challenge, training almost feels like an understatement or the kind of skill that you need uh in a workforce to be able to really use A I as leverage. Right? It's such a different type of technology. Can anybody speak to the types of things they did to really get scaled end user adoption inside of their companies? That would be good advice. So I think, um you know, I I'll sort of start off, we've looked at the implementation in two different lenses. One is where are you using this to remove human variants? And where are you using this to remove entire human workload and they're very different or, you know, tasks that someone was doing? Um And so where you're using it to remove variants, there is a, there's a co piloting or a companion experience, right? Because you're usually arming the human being. So for example, Natasha is ra I and we'll speak to customers, but at the same time, we'll speak to one of our customer success team and tell them when a customer this is, you actually need to answer with this. So there's a, there's a benefit collective insight, but that is very jarring for someone who's not used to having someone listening in their ear and then telling them what to ask. Um and, and so I think there is a, there is an upward training process in that and you need to get people comfortable with the fact that there's an on the call. Uh I think the removing work is a little bit easier because you're basically saying, hey, listen, uh as a good example, you used to manage your day. We have customer success team. They used to manage their day. You're not gonna manage your day anymore. Someone you're gonna have this assistant that's gonna move your calendar around and sort things out so that we can use the right time slots through the right things because they're all connected. Um There, it's more of an education to get people emotionally comfortable with the idea that, you know, they're sort of one step removed from how they were running a particular task. Very helpful. Yeah. And the way that we've been approaching it, at least to my team is that we've kind of segmented it into the different user base and depending on who it is, who will be consuming the technology. We apply different ways of educating the end customer. So for data scientists with my team, this time last year, we introduced, we called it LLM Friday, which was terribly branded from my point of view. Um But it was basically just my team, every Friday just took the time off tasks just to learn about LL MS because it's this huge new technology that's come in and we needed to be experts quickly. So we've gone to kind of that extreme around education, to the kind of day to day education around how our customers are actually engaging with this. So it could be hints and tips around prompt engineering. And we have a center of excellence to be formed to kind of lead people on that journey, help them engineer those prompts. But then, you know, we're leaving that knowledge with them as time goes on and then you've got the actual outreach to customers um doing events, videos and podcasts, basically, any data that we can feed people around how to get the most out of these systems. And that's what we're seeing is really important. Yeah, absolutely. Um I was in a conference recently about 50 A I CEO S and um there was a one of those like Slido, you know, respond to um the survey question and the number of um CEO S that had built uh A I features into their products versus the number of CEO S where there was meaningful PNL impact from using A I internally like 10 to 1, right? And so the, the onus for actual adoption is being pushed on to the customer's customer. Um And but by the A I vendors, um and I, I do think um the, the scale of change is really one of those blockers to, to wide enterprise uh adoption. So I love that you're doing that. Um I do think that um uh inside of even the A I companies, the um the the steepness of that learning curve, right is really being felt, it's only getting steeper back to you Amy at Shell. So you all have got a uh a deep hit history of integrating A I into your processes and getting a workforce comfortable um with relying on A I to make super critical like life and death types of decisions. Tell us a little bit about the framework that you're now adopting in the generative A I world to scale these use cases. What can you share with the audience? I mean, boring answer is not that different. It's like because again, it's like any change program, you just have to go through the steps and it will really depend on the individual use cases as the other panelists have mentioned about exactly, you know, what will be the blocker to change. So for an example, like with the particularly with safety use cases, you might call them parallel running is a really good one. So we have this technology called operator round by exception where you basically complement and operators around on an asset with um computer vision technology to sort of detecting what's going on. Now, you run it everything in parallel the old system, the new system for a long time and identify the variances before you take anything out. Um That can just once you've seen something working for how long you need days, weeks, months people start building trust they start realizing what's going on. They also, it's a big part of like how, you know, you've got the right model, right? This is the feedback loop. Um And I think that's, that's really the key for me. This is agile scaling where you always have a joint team. It's always a technical team, but also a business team. Never do data science without the business. You're always integrating the feed lap loop at every stage and you're always listening to what people are saying and understanding or if it's not being used, why it's your problem, it's not the user problem and then only scaling up and only taking to the next level when you're actually comfortable with that. And I think there's just no way out of that. It's never the case that you get something and it's perfect because it just doesn't work like that. So it thank you so much. OK. Questions. Um We've got time for a couple that is a fast hand. You in the middle. Yes, please uh tell everybody where you're from, who you are before you ask your question, Sam. Yes. Business school Barcelona. So we've talked a lot about employee training, user adoption and so on. What about the executives? How do we get the executives to a point that they can redesign organizational processes, structures and even business models? Oh, I love that question. There are so many execs who have to fill in airtime at board meetings. Right now and those 10 minutes last for a very long time. So, um, he would like to take executive training. So, you know, one of the things that we've said to our executive team and, and that we have a weekly war meeting, which is sort of weekly action review last week, next week. Uh, and I sort of put a man to everyone's like in every, every second meeting I wanna know a problem you wanna solve because I think less about education, less about process is actually first agreeing, what is the problem we're trying to solve? And is it really a problem that needs to be solved? And then, and then the question is how will you use the entire landscape of it? I not necessarily just generative. How will you use the landscape of how to solve that problem? Right. And where do you need it? That's just our experience. Yeah, I love that. Yeah, I'd be inclined to agree actually, if an executive comes to me with a problem, I always try and get to where they're trying to be and what KP it is that they want to impact rather than how they think they want to get there. And that's not because they might, they might know the answer, but it's kind of good for the data scientists behind the scenes to verify the approach that you're taking and that's really come into fruition kind of this year with generative A I because a lot of people think they want generative A I's case. But actually it turns out they want a deterministic output. They want the same thing again and again and then it's up to me to go, well, in that case, you should be looking at plastic A I, and it's not worse or it's not better. It's about that kind of education around which technologies are appropriate or which, which stages and the only way you can get there is actually talk about where you want to get to right at the very end. Yeah, I love that. I think it's really easy for people to come to you and say they want Blockchain and JV, I in an app and you're like, I think you need to business process automation and it's not because people are stupid. It's because they're curious, which is great and then you can have a conversation and we've had no problem at all having interested executives in all of this and the curiosity is great, but ultimately, there's no substitute for expertise. So it's always a joint conversation with people who really know their business about what can be done and what's sensible, helpful. Thank you. Other questions. Yes, back there. Hi there, Mark Riley. Mark Riley from Matheson A I. Um my clients have got clear vision and road maps and plans, but the stumbling block is always identifying ro I getting it past the CFO. How do we, how do we make roi a meaningful prediction. Yeah, I love this question. I can take that too. Um So it is so imperative to get the CFO on the same page and I actually think not getting them on the same page as executives uh really can result in some twisted incentives like execs, not sharing the actual ro I because they don't want the budget taken away from them. And so especially in the early days, um where you want to be able to reinvest savings into more explorations and not disincentivize execs from really taking costs out of the business. Um The Roy conversation, you know, should not be politicized. Um We track Roy with our customers weekly, not everybody is doing that, but it certainly requires being able to partner with procurement and finance and have this be kind of board level um priority uh to make that happen. But it's absolutely essential. Uh I think a big part of why Po CS that seem to be successful at a small scale aren't scaling is the CFO doesn't actually know how much this is going to cost at scale. Everything is priced by tokens and you have no idea what it's gonna cost the organization to run this at scale. So including them is just incredibly important. Um making sure that Ry is part of um the actual POC because that builds the scaffolding for what you're gonna take to production from people to process. Is it so important. Yeah, and, and look, and I, I just said whenever we've done an implementation and we, we do this entire thesis beforehand, which is we think it's gonna cut cost by this. Here is the cohort of things we need to test it across, here's the period we need it for. Um And depending on how close we get to the result that becomes the gatekeeper for whether we move to production or not, you know, if, if the cost to have that ro I obviously exceeds the RO I, then it's not worth doing. Um And I think that's, that's built in a really good discipline to test very early. Uh versus where we've seen in the past is it's tested too late. Uh And at this point, it's like, well, has it not shipped? Versus you might actually make the call and we've done this a few times. It's just not worth shipping. Or the approach we've taken is not the right approach because the more you generate, the more cost you have, but you could use classical A I or knowledge graphs, for example, to reuse something you previously generated and then actually makes it much more economical. Wonderful. Thank you folks so much. Thanks to the audience. Well, that's it.

Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners
Moderator: Alan Murray, FORTUNE


Brainstorm Tech 2022: Meet The New Cyber Defenders

Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners
Moderator: Alan Murray, FORTUNE
Merav Bahat, CEO, Dazz 
Assaf Rappaport, CEO, Wiz 
Stephen Ward, Managing Director, Insight Partners



this is, you know, if you think about what's happened since we last gathered in aspen three years ago, you had incredible acceleration of digitization, you had everything moved to the cloud, you had this incredible moment where everybody went home and they took their computers with, with them and insisted they be able to access all of their data from their kitchen at all times. And then on top of that, a geopolitical crisis. So cybersecurity, the risk has obviously expanded greatly. Uh, and I'm pretty sure if there's one industry that is now, surely recession proof it is this one. So I'm delighted to have this panel, Merav Bahat, uh, is the Ceo of Daz assaf Rappaport is the ceo of whiz, we'll ask them why the preference for double Z's. Well, actually, you only have one Z, z's generally a preference and, and Stephen Ward is an investor in both, Uh, with inside partners. So Steven, let me start with you. What I mean is this, it's like the 4th of July and you sell fireworks, right, this is uh, cyber is a great place to invest right now because of the risk. It is, and I mean, I've spent 20 years as an operator, You know defending networks of Fortune 100. So I've been on that side for a long time, only been an investor for the past year. So it's, it's nice to be in an industry where you can take those experiences and apply them to the investment side, um, talk to sisters all the time and the demand is not going anywhere. Companies need to be protected And unfortunately there's assailants out there who are constantly trying to break in. You mentioned the global economic, you know, the situation that we're in with Russia and Ukraine and unfortunately large corporations get caught in the middle of that. Sometimes their targets, sometimes they get caught in the middle of it. So when you see an increase of attacks and you see, especially when wars are a combination of physical wars and digital wars, um, you know, companies like Wiz and as you are needed in order to protect these enterprises. Well, let's talk about both of them. You worked with Merav in a previous life, correct? So actually, both I met both of them when I was an operator when I was a C so at home depot, that's when we originally met and that carried over into the investment side, interesting. So you had some history with them. So tell us, tell us about your company. Um, so does is about security remediation, um, where you know, moving fast to the cloud and security in general has kind of two steps. Um, first is detect issues, understand, you know, your environment, your risk, your posture. And the second step is to fix those things. But what happened with the fast move to the cloud as you just, uh, you know, shared with us is that, you know, people in organizations has the tons of security depth and it means that when we come into an organization, they have, they could have six millions alerts or five million alert that hasn't been addressed. So to help this organization fix them fast, which means collaboration between security and depth which creating this responsible for this alert. This is what we do. So the problem you're trying to solve is the fact that there are so many alerts going on. Companies can't react fast enough. And how about wiz, so so kind of before of that if you think about the cloud, the security debt that's rushing through the cloud and we definitely saw it like accelerated during Covid, I think basically how do you realize what, what is the risk in front of you think about it that for example, they know they're great practitioners in insecurity but in order to solve cloud problems and we're talking about when we're saying cloud is not one cloud going to be multiple, it's gonna be Azure AWS G C P and multiple others and it's different technology stacks. Super complex problem. So the problem is basically how do you bring the best of the security to the death and the devops and that's kind of how do you mitigate the risk of that? So that's kind of the kind of, we're complimenting each other, we have mutual customers that were fun working together. So you find yourselves working with a lot of the same customers Stephen one of the, one of the things that that raises, I mean you listen to Morocco and I've talked about this. It's a much more complex environment for for security csos companies, those companies than it was before. Um uh but it also is a complex response I mean so I have to hire whiz I have to hire dot how many different solutions Do I have to have to protect myself against cyber attack? I mean how do you deal with the, just the sheer complexity of the problem? Yeah, the last place I was at Fortune 14 Um I had 71 security solutions but we had three data centers. We were in multi cloud like a soft said so I think what people sometimes forget is it's not just additional complexity. The scale is much bigger. You're replicating these data centers in the old days, you would have one data center that was brick and mortar, maybe you had to as a backup. Well now sometimes you have two centers And then you also have 2-3 different cloud environments. The scale is so much bigger now. Um and then on top of it, these cloud environments, once you get in, they're very similar So to hack into a one Fortune 100 or a Fortune 200. Those environments can be very different like those traditional on prem environment you get into cloud environments, they're all sort of built the same in a lot of ways, which means Attackers can spread so much more quickly, which means you have to identify those things faster and then you have to identify response by the way? None of you have used the word prevent. I mean it's prevention gone or is that just not the issue anymore? No, not not at all. Actually actually this is kind of the movie because things are happening so fast in the cloud and the ability of the Attackers to, to, you know, to get to rule the kind of environment is happening sometimes in seconds, you know, kind of prevention and the and is super important and that's kind of where shift left is coming like hey, how can we protect? How can hey, I know now the image of the cloud that I have and I know what changes are gonna happen by the develops or the developers themselves, how can I mitigate it before it happens And this is a crucial part of the process of protection. Yeah, there's another just to add another thing here. So prevention is always important. Everything we do is to prevent eventually. But when you look at incidents like look for share, I don't know, you know, it's like uh probably not, not, not, not all of you aware of that, but that was a big incident. Everybody who has clouds and you know, they have environments were kind of panicked about it. It was a couple of days before christmas and uh, it was nobody's fault. You couldn't prevent it in with any tooling, right? It's, it's an open source kind of some, some kind of library everybody uses. Right? So the thing here is how do you detect it fast and how do you immediately Fast? That's a different mindset in Southeast critical piece. Well, let's talk about the geo politics of this a little bit. I mean, I would have thought in february when when Russia marched in Ukraine that the countries that were supporting Ukraine would be in danger of greatly increased cyber attacks orchestrated by Russia. But we don't seem to have seen that at least if we have, I'm not aware of it. I mean, are you surprised? Why haven't we seen it? Is it still coming? How would you think there's an, there's an uptick right now? Most of it was between Russia and Ukraine. Like there were some major cyberattacks between them. Um, as NATO becomes more and more popular out there, you're seeing some of the other attacks occur on other european countries. But I think one really cool thing to think about is the level of sophistication didn't go up. It actually went down and what we realize is back in the day when Russia would use other sources in other countries to attack. A lot of those resources came from Ukraine, a lot of the really talented hackers were in Ukraine, but when they split and had this war, those Ukrainians basically said, we're not gonna do this, we're going to put all our resources into Russia. So what Russia has really done over the past 3 to 6 months hasn't been that sophisticated, we've been a little surprised the volume is still there. But the sophistication hasn't gone up. So there is an argument that Ukraine had actually had more talent from a cybersecurity standpoint than Russia did. I think just to add to that, maybe the the other side not seeing it doesn't mean it doesn't exist and that's that's important. You know, and we need to remember this cyber weapon and you know, you know, to a decision of Russia or any nation to attack another nation. We didn't see that. We saw it in the in the past, we saw it between actually Ukraine and Russia even not this year even in the past years before, but it's something that we don't know how nations going to react to that. So it's truly a weapon. The capabilities are there. We know that we saw the Russian, the Russian, the Russian the chinese, the Iranian capabilities in the world in action. And they're pretty, you know, sophisticated in a way, I've heard some national security experts say one scenario is that Putin gets frustrated in Ukraine and he wants to escalate his options are nuclear chemical cyber cyber is likely to be the go to option. Yeah. I mean, we've seen him uses this kind of Russia uses this kind of, you know, cyber attacks as the weapon right already. But I think that, you know, I think that is going to create some chaos chaos, I think it's we're gonna see, I think it's too early to say as a staff set against not seeing, it doesn't mean it doesn't exist by the way, you two both have national security backgrounds, right? That's the reason there's so many Israeli companies in cybersecurity. Yeah, I think the 828,200, basically the Israeli N. S. A I would say 80% of the entrepreneurs are coming from there, so we tend to have a bias Towards security, that's what we've done in 80 200. So I guess you'll see more more bias in the Israeli ecosystem for startups, for security and yeah, I think, I just add, I mean there's also the, you know, multinationals that coming to Israel and actually have acquired companies, I think that gives um you know, the founders from the 1st 1st start, you know, the, you know, the the 1st 1st timers actually to build um products to scale in scale and the ability to actually grow faster and bigger. And I think that why we see the next generation of companies out of Israel that are actually growing and not just selling after, you know, a couple of months and a great number by the way to hold on to is In 2021 VCS invested 8.8 billion into Israel that was tripled from the previous year, so a lot of money and how much of that was cyber related, do you think? I don't know how much of it was cyber um I do, I mean us personally as insight, we're the largest investor in Israel um specifically to cyber and then overall software, so we're pretty bullish on 80 280 100. And the talent that they produce in the ecosystem, they have their Is incredible being a government guy and and doing 12 years in the government here in the us. I'm, I'm envious and I'm also irritated over it because I want us to have that every time I go there, I'm meeting with folks saying, well, how do you do it? And how do we replicate it? Very, very difficult to replicate steven. What's the endgame here, the business end game now moving away from national security. But you know, if I were that, uh If I were in your shoes and had to buy 71 different security solutions, I'd say this is crazy. I mean, does that lead, is there going to be a roll up to these companies? The Daz and whiz get bought up by bigger companies where clearly there has to be some consolidation here. Where do you think that goes from here? I think it's all, look, there's just in the past three or four months and this happens every time there's sort of an economic tightening on these large enterprises, the csos will turn around and go, okay, we're gonna slow down a little bit. Our budgets are going to keep going up, but we're gonna slow down and look for efficiency for synergies between technologies. So they may turn and go, hey, I really want whiz and dad to work seamlessly in the environment, Some will turn and say, I'm gonna buy one new one to rip out three and there will be a rip and replace, um, hands down. Cyber needs to roll up. Like, uh, you know, being new to the VC world. I came in and said, I want to combine these three companies and make one and it was extremely naive of me to think that that's easy. Works that easy. Yeah, egos are usually didn't say just do it. You know, we already know they're gonna be too big for each other pretty soon. Um, yes, there needs to be a roll up. Um, and I think the tightening and where we are right now and the slowdown in investing. I think that will organically occur, um, over the next year. Well, it's going to be a fascinating area to watch. Thank you both for making the long trip here. Thank you, Stephen for putting in some perspective. Great to have you on the brainstorm tech stage

Wiz

Wiz in Fortune Rankings

Videos