 Live from Las Vegas, it's theCUBE. Covering VMworld 2017, brought to you by VMware and it's ecosystem partner. Hi, I'm Stu Miniman joined by Justin Warren and you're watching SiliconANGLE production of theCUBE here at VMworld 2017. Three days of wall-to-wall coverage. Sometimes people ask me, Stu, you guys are doing so many interviews. You know, isn't it tiring? And I say, well, when I get really good guests, it makes my job really easy. We've had lots of customers on. I've been enjoying Justin Miniman. One of the people that I've gotten to get to know through the VMware community, I'm thrilled to be able to bring back on the program is Steve Herrod, who is now the managing director of General Catalyst. Steve, thanks so much for joining us. Thank you. I feel like a veteran of this program. I love that. Yeah, I remember back when we created like one of our first, what we called Sizzle videos, we had B-roll from you and Pat Gelsinger before he was on the VMworld side. That's right. You are always welcome on our program. We're glad that we could find time that fit on both of our schedules. You made a guest appearance, a younger Steve Herrod, maybe, in the keynote had a lot of us laughing. So, that was fun to be back. I think the story's kind of interesting. I don't know if it got lost in the dialogue a little bit, but the idea was something seemed super novel at the time and it becomes kind of the new normal. And I think that was the point he was trying to make. And it was truly the case back in the early years of VMware, trying to convince people to do these virtual machines was like ridiculous. Oh, yeah. Now it's out of these other topics. I think back, I've worked with VMware for 15 years. I think back to how many people I explained, like what is virtualization? When V-motion first came out, the awe and excitement on everybody's, but it's 2017. Come on, virtualization's like the legacy. Now it's cloud and developers and blockchain and everything like that. Serverless. That's right. I guess that brought up serverless before I did. So, that's great. See, what's happening in your world these days? What are some of the big conversations? Yeah, this is one of my, obviously one of my favorite conferences to come back to, also just to really see what's going on at a top level, mostly because of the customers that are here and then obviously the infrastructure vendors. But I know I feel like as I get older and go through this industry longer, you see a lot of the new things that are popping up. And for me, it's always been about heterogeneity. And when we started VMware, what actually mattered is you had different vendors of servers and it caused chaos by having different server vendors. That's, by the way, tamed, yeah, exactly. It was like the BIOS or the HAL and Windows had to change or something. And no one talks about that whatsoever now. But if you just kind of squint your eyes a little bit, the heterogeneity is now, am I in a public cloud or a private cloud? Or maybe do I put my software into a container versus a VM? I always like looking at what is the heterogeneity and then what are real customers supposed to do with it? How do they navigate it and what companies can be built that help you sort of smooth it out and use the different things. I've been doing that all my life and continue to look for companies that do that. Yeah, that mix of different things in customers, particularly enterprise customers who have like nine of everything. It seems like with VMware and the AWS now being more, well, we're friends now. Whereas previously it was like, oh no, you have to pick one or the other. It's like the heterogeneous nature of things is that well, actually no, we need to work with multiple of it. You all need to play nicely with each other. Otherwise we can't use you because even if I had M&A for example, I go and buy someone, they might have something different. And that seems to get lost a bit. The vendors seem to focus a lot on green fields. So do you think that this kind of we're friends and yes, you can use both of us and it's all good? Do you think that's going to be, that's the way it should always have been and that's going to be good for customers. They're going to adopt this a lot more than they might have with something which was like, no, no, no, you have to choose. I think that's absolutely right and the way I've always seen people doing things, the customer always wins. That's kind of every time I have a startup who's gotten created and they have a great customer and they say blank vendor won't work with us. I have them call the customer and tell them to tell their other vendor work with a startup. And the good news is any company is successful is super customer centric and they do listen. I think in this case it's really fascinating. If you think about it, it used to be like you've been coming this forever. It used to be VMware was about server consolidation. That's like the furthest thing from anyone's mind now. Right now it's the real limiter to doing these new things tends to be people and operational skills. And so the idea that you can use the same way you're used to working with infrastructure, the same way that you grade storage and the same way you think about it and then apply it into a world that just kind of outsources all of the underlying goo that they used to do on the servers. It makes a ton of sense from a VMware customer standpoint. And obviously as you look at the relationships they have with Google or with Amazon, they're very incited to have new cloud services that people are able to consume. And the number one problem for them is how do you get real important apps to leverage these new services? So if it's symbiotic in the sense that maybe some of these existing apps as you start to morph them they can leverage a Amazon or a Google service. And so it's helpful on the needs of the public clouds as well. Yeah. One of the areas where the heterogeneity of the environment causes even more complexity is security. So I know that that's something you've looked at a while. We've talked to some of the companies that you work with. Heck, I think IoT, the surface area is just changing by orders of magnitude. Security top issue being discussed here. Pat Gelsinger got up on stage and says, hey, I need to apologize for the industry because we failed you. It's not fixed yet. So Steve, why haven't your portfolio companies fixed all of this yet? What's your take on what VMware's doing? And yeah. I mean it's obviously something people if there was the cube in 1981 it would have been talking about security as a challenge. But I do think things have changed quite a bit as of late. I think the number of really advanced attackers, truly nation states or organized crime going after it and it's the same reason that robbers rob banks. It's because that's where the money is. And so I think the sophistication has gone up at the same time when the complexity of the environment has gone up a ton as well. And so I would say if we were in the good old days of less sophisticated attackers and like a closed and data center with no roaming mobile phones or SaaS like we'd probably be in pretty good shape. But the combination of those has really made it take to the next level. I think, you know, I think you have to really look at the complexity of those changes right now. I think the fact that there is a public cloud and a private cloud and that you have a device that has certain characteristics and then you have your server. It leads to the heterogeneity that we're talking about before. And so I really obsess over companies that can come in like VMware certainly trying to do as well. But they really try and come in and make something where a single way of thinking about security applies wherever stuff is running. And I think it's just too complex to have to have different admins, different policies, different everything. And certainly if nothing else, it'll keep you from moving faster and leveraging the full cloud models. Yeah. And given that security has been an issue for forever, it seems like that's something that just doesn't change. Is that due to the fact that we haven't actually done anything about it the right way? Or do you think that it's just an inherent situation that is not going away because the problem is humans and the problem is always humans. It's everything is a people problem. But in this case, is security, is it just going to be something that we have to manage rather than solve? I personally think that I'm pretty optimistic we can do so, so much better than we have. I think it's always been... We are coming off a pretty low bar. So that's... I thrive under low expectations, so it's really good. But on a serious note, I think a lot of the way that people have looked at security has always been the cat and mouse game where I'm trying to stay ahead of the other guy. And whether it's zero days or whether it's... I mean, now we're getting malware infected through ad networks that show up on your favorite websites and through emails, like the sophistication of spam attacks or phishing attacks are just ridiculous now. I mean, it looks so realistic. So I'm just a bit of an advocate of let's totally think a different way about how we do security. And one thing I talk about often, I'm really obsessed with is the notion of, okay, we're always going to try and stuff the bad stuff from hitting, but now we actually have to stop it from doing damage once it's in. And that's where, whether it's the segmentation that goes on the network or whether it's... I have companies that are really focused on doing it in web browsers. The notion that you really have to sandbox and keep things in the place is something I think is going to be a big step forward. Even like a database level right now, whenever you hear, I broke into Anthem Health and stole like six million records. Like maybe we have row by row encryption or maybe we have ways that, again, try your best not to have them happen, but when they do, let's just stop the damage from being as big as it is. So like a model like that, I think will be a really important part of the security posture going forward, which just people haven't put enough effort into. Okay. Steve, we've talked to you last few years about developers. This year, I know they've got a hackathon, but I don't see as many hoodies. There's no longer developer track. Even Pivotal made an announcement this morning. I'm like, come on, they didn't bring James Waters out. Rob Mee's all dressed up looking proper with blue shirt and the blazer and everything. So where are the developers for the community here? Well, I do know, like when we were first starting to introduce developer track, the day we announced the spring acquisition for those that were around for that, there was complete stairs and just like this audience is a great, great audience, mostly focused on infrastructure. And thus, it really wasn't a good fit there. So I think part of it is just knowing your audience, knowing that the goal of this particular conference is to make IT enable development of apps in a new way. So I think it's very smart that it's changed the focus quite a bit. But I do think when you have this type of solution, you're trying to solve all the problems in the hypervisor layer or in the management tools layers that you have. I think as you go and take the security model a little bit further, some interesting announcements and good things going on here, but I'm kind of obsessed also with how do we make developers do a better job of having the applications be protected in the first place. And so there's a lot of research and interesting startups that are around self-protecting software. And it's like really putting at an even higher level in the stack. And that's not something that you would do at an infrastructure layer. It's something you would actually do at a developer conference or developer focus. So I think you got to just be careful that you know your audience, you're certainly talking about the right solutions, but you're aware of the different approaches to doing this. And especially for things like DevOps, you really need to really immerse yourself with how people are developing and shipping their software to get the solutions in place. Yeah, it does feel like VMware has stopped apologizing for existing. So, you know, sort of bringing developers and saying, you know, we have a developer track. It's sort of like, oh, no, no, no, we're cool. We really we're cool. And that whereas letting that go feels more like, no, no, we know who we are. And this is our audience. We will be the best us we can be rather than trying to be someone else. I think the buzz I've gotten just from walking around as you all said as well, like this has been a very positive VM world. And again, it's not only not being apologetic, but it's also like real announcements and real partnerships that are shipping. You know, obviously the Amazon and Google being big ones, but just across the board, you know, there's a lot of positive, if you even look at like the top tracks that are going on, it's VMware on AWS. So there's like real progress. And I think there's real interest in that side of things that makes you not have to focus on, you know, some of the developer stuff that might have been focused on in the past. Well, certainly they're doing well on things like NSX and Visa, and which just seemed to be selling like hotcakes. So that helps. And customers like it. Yeah, Steve, speaking of the public clouds, I mean, we felt this year, we're finally starting to see some of these things come together. For a few years, we were almost like, oh, you know, messaging was like, they don't exist or their booksellers are, you know, they win, we all lose and everything. I was at the AWS Summit in New York City a couple of weeks ago, and there's a couple of sessions done by VMware. Amazon's in the booth. Andy Jassy gets a big applause here. Last year, I've been at re-invent for a number of years, a big AWS show. I know you've been there for years, starting to see some of the people that were early in this community playing there. How do you see those worlds colliding, the landscape, the competition, the co-opetition? What interests you there these days? I think it's pretty clear, and people have been talking about this for a while, but it's more clear to me than ever that there's always a swing back and forth of decentralized, centralized. I think what we're really trying to find out is what are the boundaries going to be between applications that live in the public cloud and applications that stay on premises, and it's usually tracking some level of certification, some level of data movement, all the things that you all have talked about before. But I think whether it's 50% is in the public cloud or 80% or 20%, I think that's where these lines are being drawn now, and it's very obvious that customers who want some of the benefits of the public cloud are going to be using more, and VMware needs to be the guider to help them get there. And likewise, Amazon and Google, they'd love to have more of the on-premises workloads and have a way to really speak to those more valuable, in many cases, applications. So it makes perfect sense, and this is like this battle that'll be going on forever. And I don't want to forget this either. What I think is also fascinating is we also have these, you know, people talk about edge computing, but whatever it is, there's increasingly powerful devices, network connected even further from the data center. So I think we're going to have, in the end, we're going to have these edge device things. You're going to have your own data center, and then you're going to have a plethora of public clouds and SaaS offerings. And I think, again, just getting back to the master theme, how do you tame and let people effectively use these different layers and protect them? That's going to be where I think a lot of interesting companies are born. Yeah, no, that's a great point, because sometimes people conflate some of these things, because for me it was the public cloud kind of pulled from the data center, and now you've got the edge kind of pulling, you know, that relation for the public cloud, and that interest and dynamic, and you know, where a customer lives, what's the role of IT in the future? What's the role of the CIO? Some of the things, do you look at those pieces? I try to, you know, I actually tried to create this, I tried to make this nerdy formula on like, the number one question for IT has traditionally been like, where should I run stuff to be most cost effective, most responsive from a time standpoint to my customers, that I can secure it based on the type of data, that I can pass certain certifications. So in many ways, when we got started with VMware, it was all about let's take inventory of all my applications and bucket them, and choose which bucket could be virtualized, which had to stay native, now they're bucketizing them and saying which ones could run in a public cloud, which ones need to be rewritten, and I think at the end of the day, an IT, a good IT team will know the business value and like the goal of these applications, and then help provide the easiest way to run them in the right place for what they're trying to do. And again, whether it's these end devices or whether it's their own data centers or elsewhere, I think the idea that they're a broker of services, some of which they provide themselves and some of which they outsource, I think that's the modern IT role. Yeah, that's quite a substantial change from what IT has traditionally done, and there has been talking to customers and service providers and vendors. There has been a shift in ability, I think, but it feels like it's still only just getting started rather than it being well advanced. Is that what you're seeing as well? I do, it's a real shift, like you're saying, I think it's, we used to say, it's like moving from the builder of services to the broker of services, so I do think that's a good analogy where it used to be if I don't build it myself, I can't offer support for it, I can't do cost controls, I can't offer it quickly. And so now I think they're just realizing, their job is to get you the best thing for what you need to do. And again, some percentage of that time, it is by building it themselves. Yeah, okay, all right. Steve, I'll give you the final word with the wild card, you know, VR, AR, AI, ML, blockchain, Ethereum, you know, what's exciting you these days? What things are you looking? John Furrier is going to run up here and tell you about the ICOs soon, I think, but you know, as you're bouncing around the valley, what's real, what's interesting, especially from your technology. I have an awesome job, but like you, I get to meet interesting people all day long and all of them have interesting ideas where their world is going. All of them are optimists, they think they're going to be the one to deliver it. So I love that part of it, but cutting through what's real and what's hype versus not is really the core job. I guess for you as well. I would just say, as with the traditional Gartner Cycle, things get so overblown and then reality settles in and then they go forward. I probably get five pitches a week on this is machine learning for blah. And if you even know a little bit about AI and ML, you realize, no, you're using stats. You're like, it's just being used so many ways. We used to do that with the cloud, cloud washing it was called at the time. So anyway, I do think there's a lot of really substantive things going on. I love the blockchain work. I think it's also been a little overinflated, but the idea that you can do distributed brokering and keep consistency is going to play out in all sorts of areas. Maybe John's ICO will be a sign of the future for the core piece there. But I'm a big fan of what's going on with the combination of proper machine learning that's accessible by mere humans and that has cloud resources to back it. And I think it's those two things that you have to have both of them to really just start attacking a lot of problems. And we look at, certainly I look at the ones as they apply to security and to things like that, but they apply across everything from medical to almost every other part of our life. So I see a lot of those right now and I think it's going to be a pretty big change as we head forward. Awesome. Well, Steve Herrod, always put pleasure to have you on the program. Thanks so much for joining us. For Justin Warren, I'm Stu Miniman. The Cube will be back with lots more coverage from VMworld 2017. Thanks for watching theCUBE. Thank you.