 From the CUBE Studios in Palo Alto in Boston, connecting with thought leaders all around the world, this is a CUBE Conversation. Everyone, welcome to this CUBE Conversation here in the CUBE Palo Alto Studios. We're here with the quarantine crew. I'm John Furrier, your host. We've got a great guest, John Madison, CMO, and EVP of products of Fortinet. And today, more than ever in this changing landscape, accelerating faster and faster, certainly as this COVID-19 crisis has forced business to realize a lot of the at scale problems are at hand and a lot of things are exposed in terms of problems and opportunities. You have to take care of one of them, security. John, thanks for coming on CUBE and looking forward to chatting about your recent event you had this week and also the updates at Fortinet. Thanks for joining me. Yeah, it's great to be here. Nice to see you again, John. So more than ever, the innovation strategies are not just talking points anymore in board meetings or companies. They actually have to come out of this pandemic and operate through it with real innovation, with actionable outcomes. They got to get their house in order. You're seeing projects really focusing in on the at scale problems, which is essentially keep the networks running, keep the security fabric in place. This is critical path stuff, but the innovation coming out of it has to be a growth play for companies. And this has been a big thing. So you guys are in the middle of it. We've chatted about all the four to guard stuff and all the, you're seeing all the traffic. You're seeing all the impact. This work at home has forced companies to not only deal with the new realities, but it's exposed some things they need to double down on and things they need to either get rid of or fix fast. What's your take on all this? Yeah, and I think it took a lot of people by surprise. And the first thing I would like to do is thank our employees, our customers and partners for the work they've done in the last six to seven weeks. You know, what was happening was a lot of customers have built their work from home programs around a certain percentage, 5%, 10%, 15%, and that's what they scaled it for. And then all of a sudden, you know, everybody had to work from home. And so you went from maybe a thousand people to 10,000 or 5,000 to 50,000. They had to scale very quickly because this had to be implemented in hours and days, not weeks and months. Luckily, our systems are able to scale very quickly. We can scale using our security processing units which offload the CPU and allow a lot of users simultaneously to access through VPN, SSL VPN, IPsec VPN. And then we have an implementation at home ranging from a very simple Microsoft client all the way to our client, all the way to even off all the firewalls at home. So it really did work very hard to make sure that our customers could maintain their business proposition during these times. You know, I want to get to this work at home and I think it's a big SD-WAN story and you guys have been on for a long time. I mean, we've talked with you and your folks many times around SD-WAN and what it means to have that in place. But this work at home, those numbers are off the charts, strange. I mean, disruption, this was an unforeseen disruption. It's not like a hurricane or a flood, this is real. And we've also talked with you guys and your team around the endpoint, you know, the edge of the network. That's the explosion of the billions of edges. This is just an industry kind of inside baseball conversation. And then also the immersion of the lifestyle we now live in. So you have a world where it was inside baseball for this industry. Now every company and everyone's feeling it. This is a huge issue. I'm at home, I got to protect myself. I got data, I got to have a VPN. I mean, this is a reality that just wasn't seen. I mean, what do you guys are, what are you guys doing in this area? Well, I think it changes that this long-term architecture. And so, you know, in the past, we talked about there being millions of edges and people go, how can there be millions of edges? And what's happened is, if you're working from home, that's an edge. And so the long-term architecture means that companies need to take care of where their network edges are. Now there's some at home. They have them at the branch office. They have them at the enterprise and the data center and the cloud. Then they need to decide, you know, where to apply the security. Is it at the endpoint? Is it at the edges? Is it at the data center or cloud? An SD-WAN is absolutely essential because every edge you'll have, whether it's at home now, whether it be in your data center or your campus on the cloud, needs that SD-WAN technology to make sure you can guide the applications in a secure manner. What's interesting is, I actually deployed SD-WAN in my home here. I've got two ISP connections, one with Comcast and one with AT&T. Now that may be overkill right now for most people about putting SD-WAN in their homes. But I think long-term, the homes are going to be part of the enterprise network. It's just another edge. Can you take a minute to explain the SD-WAN? I would call it the, this is an old expression. This is not your grandfather's SD-WAN. I mean, it's changed. SD-WAN is the internet. I mean, basically at home, what does that mean? I just don't care what the products are. At the end of the day, they're working at home. So kind of SD-WAN has taken on a new broader scope, if you will. It's not just the classic SD-WAN, or is it? Can you take this through? I mean, this is a category that's becoming much broader. What's your analysis there? Yeah, again, I'm not saying that consumers are going to be putting SD-WAN in their homes right now. But if I'm an executive and I rely on my communication out, for lots of meetings during the day, work from home, I want it to be as reliable as possible. So if my one ISP goes down and I can't get on the internet, that's an issue. If I have two ISPs, I have much higher availability. But more importantly, through SD-WAN, I can guide the applications where I want when they want. I can make sure my normal home traffic goes off in a certain direction, with a certain kind of VLAN and segmentation policy, whereas my work can be completely set out. So again, I think SD-WAN technology is important for the home long-term. It's very important for the branch, for the enterprise and the data center. And for us, SD-WAN is built into all of us. All our 40 gates have SD-WAN, you just switch it on. We think it's a four essential technology going forward to drive that cloud on ramp. Real quick follow-up on that, for the folks in the enterprise, obviously the enterprise will make it easier for their customers, the users who are at home. So it feels consumery and visible, if you will. I think that's the short term. What are you seeing your customers and prospective customers thinking when they come back? As they operate now in this new reality, when they say, you know what? We really miss forecast of this. Now they have to get back to business. What are they going to do? Do they do more SD-WAN? I mean, what's the architecture? How does that get done? What's the conversation like, as this evolves for the next, it's going to slowly open up. It's still going to be a new reality for at least 12 months. What's the conversation with the customers right now when it comes to going in and taking care of this so it doesn't happen again? Yeah, what I'm doing, actually, I'm doing a lot of virtual EBCs obviously. We usually have 200 customers that come to our corporate quarters for executive briefings. And I'm doing actually more virtually. And a lot of the opening conversations is they don't think they're going to go completely 100% back to where they were. There's always going to be now a fraction of work from home people. They may move around some of their physical location. So as I said, the SD-WAN is that piece on the edge, whether it be home, branch, campus, or data center is going to be there to guide the applications, guide the users and devices to the right applications wherever they may be. Because it could be in the cloud, it could be in the data center, it could be anywhere. And then the key conversation thereafter for customers, long-term architecture-wise is, where do I apply my security stack? And the security stack consists of basic things like antivirus or IPS, more detection capabilities, even response type system. Given that stack, how much do I put on the edge? How much do I put at my endpoint? How much do I put in my branch? How much do I put at my campus, data center and cloud? And then how do I maintain a policy, a single policy across all of those? And then now and again, maybe I have to move that stack across. So that's going to be the key long-term architecture question for enterprises, as they move to a slightly different composition of workforce in different locations is, hey, I've got to make sure every edge that I have, I identify and I should deal with SQN. And then how do I apply the security stack across all the different elements? Great insight, thanks for sharing that. I want to get your take on now, speaking of working at home, you're also the CMO as well as the EVP of products, which is a unique job because you can talk about anything in the queue. We love it. You had an event, Accelerate 2020, the folks watching go to the hashtag on Twitter, hashtag Accelerate20, that's the hashtag. You'll see a lot of the pictures of the slides and some commentary. I was laying down some tweets all the analysts were as well. What are some of the highlights for you? It was a great presentation by the CEO. You gave a talk and there's a lot of breakouts. You had to do a digital event because you couldn't hold the physical event. So you kind of had a shelter in place kind of event. How did it go? And what are some of the highlights? Yeah, on the one side it was a bit sad. You know, we had four, what we call Accelerates arranged for this year in Barcelona, New York, Mexico and San Jose. We had to cancel all four of them. And I'm very quickly spin off a digital event, a virtual event. And, you know, we had some initial targets around, you know, each of our physical events we get between two and 3000. So we're thinking, you know, if we got to 10,000, this would be great. We actually ended up with 32,000 or something like that registered and actually the percentage that showed up was even higher. So we had over 20,000 people actually come online and go through our keynotes. We built it so you'd go through the keynotes, then you can go off to the training, what we call the breakouts in more detail. We did verticals, we did more technology sessions. And so it's great. And, you know, we tried our best to answer the questions online because these things are on demand. We had three, we had one for the US, one for Amir and one for APAC. And so there was different times. But to get that sort of exposure to me is amazing. 20,000 people on there listening and it connects into another subject which is education. And for the net for some time as invested, I would say, you know, my CEO says, well, I'll invest a bit more in education versus the marketing advertising budget. And I go, okay, okay, we'll work on that. But education for us, we announced a few weeks ago that education is now training is free for customers, for everybody. And we'd also been, you know, leading the way by providing free training for our partners. Now it's completely free for everybody. We have something called the network security expert which goes from one to eight. One and two of that are actually open to the public right now. And if I go to the end of last year, we had about two to 3,000 people, maybe a week, come on and do the training. Obviously the majority of doing the NSE one courses you get further through to 80, it's more technical. Last week, we had over 80,000 people that we just think about those numbers. Incredible, because people, you know, having more time, let's do the training. And what we're finding is as they're doing this training, they're going up the stack more quickly and they're able to implement their tools more quickly. So training for us is just exploded off the map. And there's new reality of all the unemployment and also people are at home and there's a lot of job. But as we've talked about the skill gap before in another CUBE conversation, it's more apparent than ever and why not make it free, give people some hope, give them some tools to be successful, there's demand. Yes, and it's not, you know, IT professionals, our NSE one is a foundational course and you'll see kids and students and universities doing it. And so grandmas, granddads, dads doing it. So we're getting all sorts of comments on social media about the training, you know, our foundation. Great stuff, that's great. And we'll put a plug on that and make sure we get that amplified for us. Really good stuff. I got to ask you about the event. One of the things I really liked about the presentation was from your CEO and you gave one as well, was the clarity around the vision of security. And a couple of things that were notable to me was the confluence of the collision between networking and security. And at the intersection of those two forces, you have an accelerated, integrated policy dynamic. To me, this is the heart of DevOps of what used to be in cloud, being kind of applied to security. You have data, you've got all kinds of new things emerging, new patterns, new signals, it's security. So you got to be fast. You got to identify things. So you guys are in this business, that's one force. And the other one was the billions of edges and this idea that there's no perimeter so everything's immersive. So illustrate some points of validation on that from your standpoint. Is that how you guys are seeing it unfold in the future or is that happening now? Can you give us a feeling for where we are and those kind of paradigms? Yeah, two good points. I think it's been happening. It's happening now, it's going to happen in the future. If you look at networking and our CEO, NZ, talked about this in that networking isn't really routing and switching. If you go back to 2000, you had 100 megabit. Now you have 400 gigabit. But the basic function hasn't really changed that much. Security's different. We've gone from a firewall, then we had VPN, then we had Next Gen firewall, then we had SSL inspection. Now we've added SD-WAN. And so this collision is kind of unequal in that networking's sped ahead and firewalling has stayed behind because it's just got too many applications on there. And so the basic principle, premise of the company of 40Net is to build that and bring that together. So first of all, accelerate the basic security network security functions so you can consolidate multiple functions on one system and then bring networking and security together. Really good example of secure SD-WAN or Next Gen firewall where you can accelerate. And so our security processing units and my analogy, simple analogy is GPUs inside games where the GPU offloads CPU to allow rendering to happen very quickly. It's the same for us, our SPUs, we have a network SPU and we have a content SPU which offloads the CPU to allow security and networking to be accelerated and work. Now coming to your second point about the perimeter, I'm not quite sure whether the perimeter's disappeared. And the reason I say that is customers still don't, they have firewalls on the front of the networks. They have endpoint protection, they have protection in the cloud. So it's not that the perimeter's disappeared, it's just got much larger. And so now the perimeter's sitting across all your infrastructure, your endpoints, your in-factories, you've got IoT devices, you've got workloads in different clouds. And that means you need to look very carefully at those and give visibility initially and then apply the control. That control may be a case of endpoint security, it may be a SD-man of the edge, it may be a compliance template in the cloud, but you need visibility of all those edges which have been created with the perimeter spreading across the infrastructure. It's interesting, you bring up a good point, we always have kind of debates over beers on this topic. The old model was moat, you know, you got the castle and the gate, but here the perimeter, the edge, if you believe there's an edge and I do believe you defined it perfectly, the edge is a perimeter, it's an endpoint, right? So it's a door into the internet, or the network. So is the perimeter just an end, and there's more doors, right? Or surfacing. Yeah, just think about it, the castle with multiple doors. Is the back door, sorry. It's a door, everyone's a door. There's just doors all over the place, and you have to define those edges and have visibility of them. And that's why things like network access control, you know, zero trust network access is really important, making sure you kind of look at the edge inside your WAN, inside your data center, and then it's like you found what workloads are spinning up, and what's the configuration, and what's there, and what's from a data perspective. Okay, so take me through your recommendation, if I'm a customer, I'm looking at my network, I got compute, I got edge devices and users, I realize there's a billions of edges on my network now and the realities hit me. I wasn't really being proactive on investing. What do I do? What's the playbook for me? As I start to rethink that, and what do I put into place? How do I get going now? I got to rethink it. I now recognize I got full validation. I got to manage this. I got to do something. What's your recommendation to me if I'm a customer? The key to me is, and I've had this conversation now for the last five years and it's getting louder and louder, and that is customers have spent a lot of money on point solution, point products. Even endpoint may have five point products on there. And so they're getting to the conclusion it's just too hard to manage. I can't find all the right people. I get so many alerts from so many security systems I can't work out what's going on. And the conversation now is, how do I deploy a platform? We call it the security fabric. How do I deploy that fabric across my network? I'm not saying you should go from 30 vendors to one vendor, that would be nice of course, but I'm what I'm saying is you go from 30 vendors down to maybe five or six platforms. And the platforms perform multiple functions. It could be there you attach a platform to design a platform just for a threat vector or a particular organization or part of the network. And so the platform allows you then to build automation and the automation allows you to see things more quickly and react to things more quickly and do things without manual intervention. The platform approach, it's absolutely starting to resonate. Yes, you've still got very, very large customers who put everything into segment policies, et cetera, but most customers now are moving towards a platform approach. I think as you see, and again, back to that collision with the intersection, we have integrated policies. If you're going to do any integration, which is the data problem, so we talk about all the time, a lot of different tools can create silos and there's a use case for that, but also it creates problematic situations. I mean, a platform gives you a much more robust capability to be adaptive, to be real time, to program and automate. Yeah, it's an issue if you've got 30 vendors and just be honest, it's also an issue in the industry. I mean, networking industry kind of worked out how to work together. You can use the same, different vendor switches and routers and they roughly work together. With cybersecurity, they've all been built totally separately not to even work. And that's why you've got these multiple layers. You've got a product, a security product and this got its own analytics engine, a manager. Then you've got a manager of managers and an analyzer of analyzers and the SIM system and then a, I mean, it just goes on. And it makes it so complex for people and that's why I think they look into something a bit more simplified. But most importantly, the platform must be friendly from a consumption model. You must be able to do an appliance where you need to do virtual machine, SAS, cloud native, container, whatever it may be because that network has changed and there's edges as those edges move, you've got to have a platform that's adaptable to the consumption model required. You know, I had a great conversation with Bill Quaid, you see your CISO over there and we were chatting around, you know, this idea of, I won't say customization but there's no one turnkey monolithic application. It seems to these platforms tend to be enabling where the CISO trend is to have teams building. Okay, and I won't say customized but building software to automate to solve their use case for their outcome. So enabling that is a trend we're seeing. So I think you guys are on the right track there. Any comment on your take on this enabling platform? Is that something that you guys are seeing that CISO is looking at more in-house development, more use case focus? Because they have the data, they got real time. They need to be building on a platform, not told what they could do. Yeah, I think you've always had this network team trying to build things fast and open and the security team trying to close things down and make it more secure. You know, it becomes even more problematic if you kind of go to the cloud where you've got pockets of developers kind of thing, do things in a dev ops way really as fast as possible. And sometimes the controls are not put in place. In fact, you know, as I said, the biggest issue for the cloud is not so much that, you know malware, it's more about misconfiguration. That's why you're seeing the big breaches and that's more of a customer thing to do. And so I think what the CISO is trying to do is make sure they apply the controls appropriately. And again, their job has become much harder. They haven't got all the multitude of endpoints that they didn't have before. They've got now their WAN, that's not just the closed MPLS network, it's all different types of broadband. 5G is coming towards the end of this year, next year as well. Their data centers may have decreased a bit, but they've still got data center capacity and they've probably got five or six clouds and 20 different SaaS applications that they've got to deal with and they've got to deal with developers in there. So it's a harder job for them and they need to be able to provide those tools but come back to that single point of management. Great stuff, John Madison, CMO, EVP, great insight there. It's almost a masterclass right there, you laid it all out on what's going on. A final question, any changes, what any other news updates on the Fortinet front? I know you guys got some, I didn't see the breakouts of the session, I had something else going on. I think I had to walk the dog and do some other things, but being at home I had to take care of things. What's new, what's out that people might have missed that's coming out of Fortinet? You're telling me you didn't have 60 hours for the breakouts, what's going on? Dedicated I don't think. Yeah, we have a lot going on. We have a big R&D team here in North America and Canada and we have a lot of products coming out. This time of the year we bring out our 40OS network operating system with 6.4 over 300 new features inside there including new orchestration systems for us to be around. And then also we actually launched our network processor 7 and the 40Gate 4200F powered by four network processors 7s. It's some system out there it can provide over 800 gigs of firewall capacities, got inbuilt VX LAN acceleration. They can do things like elephant flows, huge flows of data. So there's always new products coming out of Fortinet for sure those are the two big ones for this quarter. You guys certainly are great interviews to talk to great, a lot of expertise there. Final question, every company's got their culture, Moore's Laws, cadence of Moore's Laws Intel, faster, cheaper, smaller. What's the Fortinet culture if you had to kind of boil it down? What's it, you guys are always pushing great products out there all high quality, obviously security you got to be buttoned up and have good ops and controls but you still need to push the envelope and have it stay there. What's the culture if you had to kind of boil the culture down for Fortinet, what would it be? That's always an interesting question. The company's been going since 2000. Okay, the founders are still there. Ken Zees, CEO and Michael Zees, the CTO. And I think that one of the philosophies is listen to the customer very closely because you can get distracted by shiny objects all over the place. I want to go and do this. Oh yeah, let's build this. What about this? And in the end, the customer and what they want may get lost. And so we listen very closely. We use, we have a very high content of technology people who can translate the customer use case into what we should build. And so I think that's the culture we have and maintain that. So we're very close to our customers. We'll try and build it very quickly for them. Make sure it works. It needs tweaking, then we'll look at it again but very, very customer driven. Always great to hear from the founders. You guys had a great event, Accelerate 20. That's the hashtag. Some great highlights on Twitter, some commentary there and of course go to Fortinet site to check out the replays. John Massa, thanks for taking the time to share your insights here on theCUBE Conversation. I really appreciate it. Thank you. Okay, this is CUBE Cushion here at Palo Alto. We're bringing you all the interviews during this time. We have our quarantine crew. theCUBE is virtual. We'll do whatever it takes to get the interviews out there and get the stories out there and the people behind the tech making it happen. I'm John Furrier, thanks for watching.