 theCUBE presents Ignite 22, brought to you by Palo Alto Networks. Welcome back to Las Vegas, guys and girls. Lisa Martin here with Dave Vellante. This is day one of theCUBE's two-day coverage of Palo Alto Networks Ignite at the MGM Grand. Dave, we've been having some great conversations today. We have a great two-day lineup. execs from Palo Alto, it's partner network, customers, et cetera. Going to be talking about infrastructure as code. We talk about that a lot. How Palo was partnering with its partner ecosystem to really help customers deliver security across the organization. Yeah, we do a predictions post every year. Hopefully you can hear me. So we do this predictions post every year. I've done it for a number of years. And I want to say, it was either 2018 or 2019, we predicted that HashiCorp was one of these companies to watch. And then last August, on August 9th, we had SuperCloud event in Palo Alto. We had David McJanet in, who's the CEO of HashiCorp. And we really see Hashi as a key player in terms of affecting multi-cloud consistency. Sometimes we call it SuperCloud. Building on top of the hyperscale cloud. So super excited to have HashiCorp on. An important conversation. We've got an alumni back with us. Ashwin Ramesh is here, the senior director of alliances at HashiCorp. Welcome back. Yeah, thank you. Good to be back. Great to have you. Talk to us a little bit about what's going on at HashiCorp, your relationship with Palo Alto Networks and what's in it for customers. Yeah, another great question. So Palo Alto has been a fantastic partner of ours for many years now. We started way back in 2018, 2019, focusing on the basics, putting integrations in place that customers can be using together. And so it's been a great journey. Both are very synergistic. Palo Alto is focused on multi-cloud. So are we focused on cloud infrastructure automation and ensuring that customers are able to bring in agility, reliability, security, and be able to deliver to their business. And then Palo Alto brings in great security components to that multi-cloud story. So it's a great story all together. Some of the challenges that organizations have been facing, Palo Alto just released a survey, I think this morning, if I can find it here, what's next in cyber organizations facing massive headwinds, ransomware becoming a household word, business email compromise being a challenge. But also in the last couple of years, the massive shift to multi-cloud where organizations are living and operating need to do so securely. It's no longer nice to have anymore. It's absolutely table stakes for survival and being able to thrive and grow for any business. No, I think it's almost a sort of rethinking of how you would build your infrastructure up. So the more times you do it right, the better you are built to scale. That's been one of the bedrocks of how we've been working with Palo Alto, which is rethinking how should IT be building their infrastructure in a multi-cloud world and I think the market timing is right for both of us in terms of the progress that we've been able to make. So Terraform has really become sort of a key ingredient to the cloud operating model, especially across clouds. Kind of describe how partners and customers are implementing that cross-cloud capability. What's that journey look like? What's the level of maturity today? Yeah, great question, Dave. So we sort of see customers in three buckets. The first bucket is when customers are in the initial phases of their cloud journey, so they have disparate teams in their business units try out clouds themselves. Typically there are some events that occurs, either some sort of a security scare or a cloud cost event that triggers a rethinking of how they should be thinking about this in a scalable way. So that leads to where the cloud operating model, which is a framework that HashiCorp has and we use that successfully with customers to talk them through how they should be thinking about their process, about how they should be standardizing how people operate and then the products they should be including. But then you come to that stage and you start to think about a centralized platform team that is putting in golden workflows, that is putting in a as-a-service mindset for their business units, thinking through policies at a corporate level, and then that is the second stage. But this is also in some customers more around public clouds. But then the third stage that we see is when they start embracing their private cloud or the on-prem data center and have the same principles address across both public clouds and the on-prem data center. And then Terraform scales for any infrastructure, so once you start to put these practices in place, not just from a technology standpoint, but from a process and product standpoint, you're easily able to scale with that central platform organization. So it's all about that consistency across your state, irrespective of whether it's on-prem, in AWS, Azure, Google, the Edge maybe? I mean, that's starting, right? And so when you talk about the, break it down a little bit, process and product, where do you and Palo Alto sort of partner and add value? What's that experience like? Yeah, so I think, as I mentioned earlier, the Bedrock is having ways in which customers are able to use our products together, right? And then being able to evangelize the usage of that product. So one example I'll give you is with Prisma Cloud and Terraform Cloud to your point about Terraform earlier. So customers can be using Prisma Cloud with Terraform Cloud in a way that you can get a security context telemetry during an infrastructure run and then use policies that you have in Prisma Cloud to be able to gate a run or to implement a run or make sure essentially it is adhering to your security policy or any other audits that you want to create or any other costs that you want to be able to control. Where are your customer conversations these days? We know that security is a board-level conversation. Interestingly, in that same survey that Palo Alto released this morning that I mentioned, they found that there's a big lack of alignment between the board and the C-suite staff, the executive suite in terms of security. Where are your conversations and how are you maybe facilitating that alignment that needs to be there because security, it's not a nice to have. Yeah, I think in our experience, the alignment is there. I think especially with the macro environment, it's more about where do you allocate those resources? I think those are conversations that we're just starting to see happen, but I think it's the natural progression of how the environment is moving and maybe another quarter or two, I think we'll see greater alignment there. So when I saw some data that said, I guess it was a study you guys did, 90% of customers say the multi-cloud is working for them, that surprised me because you hear all this negativity around multi-cloud. I've been kind of negative about multi-cloud, to be honest, like that's a symptom of M&A or multi-vendor, but how do you interpret that? When they say multi-cloud is working, how so? Yeah, I think the maturity of customers are varied, as I mentioned through the stages, right? So there are customers who, even in the initial phases of their journey, where they have different business units using different clouds and from a C standpoint, that might still look like multi-cloud, right? Though the way we think about it is you should be really in stage two and stage three to leverage the real power of multi-cloud, but I think it's that initial hump that you need to go through in being able to get oriented towards it, have the right set of skill sets, the thought process, the product, the process in place, and once you have that, then you'll start reaping the benefits over a period of time, especially when some other environments events happen and you're able to easily adjust to that because you're leveraging this multi-cloud environment and you have a clear policy of where you'll use which cloud. So I interpreted that data as, okay, multi-cloud is working from the standpoint of, we are multi-cloud, okay? So, and our business is working. But when I talk to customers, they want more to your point. They want that consistent experience. And so it's been by, to use somebody else's term by default, Chuck Whitten I think came up with that term, versus by design. And now I think they have an objective of, okay, let's make multi-cloud work even better. Maybe I can say that. And so what does that experience look like? That means a common experience from my, all the way through my stack, my infrastructure stack, which is, that's going to be interesting to see how that goes down, because you've got three separate clouds and doing their own APIs. But certainly from a security standpoint, you know, the PAS layer, even as I go up the stack, how do you see that outcome, you know, in say the next two to five years? Yeah. So, you know, we go back to our customers and you know, they're very successful ones who've used the cloud operating model. And for us, the cloud operating model for us includes four layers. So on the infrastructure layer, you know, we have Terraform and Packer. On the security layer, we have Vault and Boundary. On the networking layer, we have Console and then on applications, we have Nomad and Waypoint. But then you really look at from a people process and product standpoint. For people, it's how do you standardize the workflows that they're able to use, right? So if you have a central platform team in place that is looking at common use cases that multiple business units are using and then creates a golden workflow, for example, right? For these various business units to be able to use or creates what we call a system of record for cloud adoption. It helps multiple business units then latch on to this work that the central platform team is doing and they need to have a product mindset, right? So it's not like a project that you just start and end with. You have this continuous improvement mindset within that platform team and they build these processes, they build these golden workflows, they build these policies in place and then they offer that as a service to the business units to be able to use. So that increases the adoption of multi-cloud and also more importantly, you can then allow that multi-cloud usage to be governed in the way that aligns with your overall corporate objectives and obviously in self-interest, you know, you'd use Terraform or Vault because you can then use it across multiple clouds. Well, let's say I buy into that. Okay, great. So I want that common experience closer. So when you talk about infrastructure, how, take us through an example. So when I hear infrastructure, I say, okay, if I'm using an S3 bucket over here and Azure blob over there, they got different APIs, they got different primitives. I want you to abstract that away. Is that what you do? Yeah, so I think we've seen different use cases being used across different clouds too. So I don't think it's sort of as simple as, hey, should I use this or that? It is ensuring that the common tool that you use to be able to leverage safer provisioning is Terraform. So the central team is then trained in not only just usage of Terraform open source, but there's Terraform Cloud, which is our managed service and Terraform Enterprise, which is the self-managed but on-prem product. It's them being qualified to be able to build these consistent workflows using whatever tool that they have, or whatever SKU that they have from Terraform, and then applying business logic on top of that to your point about, hey, we'd like to use AWS for these kind of workloads, we'd like to use GCP, for example, on data or use Microsoft Azure for some other type of collaboration that they're trying to use. But the common tooling remains around the usage of Terraform and they've trained their teams. There's a standard workflow, there's a standard process around it. Ashwin, I was looking at the survey, the HashiCorp State of Cloud Strategy Survey, and it talked about skill shortages as being the number one barrier to multi-cloud. We talk about the cyber skills gap all the time, it's huge, it's obviously a huge issue. I saw some numbers just the other day that there's 26 million developers, but there's less than three million cybersecurity professionals. How does HashiCorp and Palo Alto Networks, how do you help customers address that skills gap so that they can leverage multi-cloud as a driver of the business? Another great question. I think I'd say in two or three different ways. One is be able to provide greater documentation for our customers to be able to self-use the product so that with the existing people, for example, you build out a known example. You're trying to achieve this goal, here is how you use our products together and so they'll be able to self-service. So that's one. Second is obviously both of us have great services partners, so we're always working with these services partners to get their teams trained and scaled up around these skill gaps. And I think I'd say the third, which is where we see a lot of adoption is around usage of the managed services that we have. If you take Palo Alto's example and this Palo Alto will speak better to it, but they have their SOC services that you can consume. So they're performing that service for you. Similarly, on our side, we have a HashiCorp platform, HCP, where you can consume vault as a service, you can consume console as a service, telephone cloud is a managed service so you don't need as many people to be able to run that service and we abstract all the complexity associated with that by ourselves, right? So I'd say these are the three ways that we address it. So zero trust, of course, big buzzword. You know, we heard this in this morning keynotes, you know, AWS is always saying, hi, well, we'll talk about it too, but okay, customers are starting to talk about zero trust. You talk to CISOs, they're like, yes, we're adopting this mentality of, you know, unless you're trusted, we don't trust you. So, okay, cool. So you think about the cloud, you've got the shared responsibility model and then you've got the application developers are being asked to do more, secure the code. You get the CISO now, asked to deal with not only a shared responsibility model, but shared responsibility models across clouds and got to bring his or her security ethos to the app dev team and then you got to audit, you know, kind of making sure they're like the last line of the fence. So my question is when you think about code security and zero trust in that new environment, the problem with a lot of the clouds is they don't make the CISOs life any easier. So I got to believe that your objective with Palo Alto is to actually make the organization's lives easier. So how do you deal with all that complexity in specifically in a zero trust, multi-cloud environment? Yeah, so I'll give you a specific example. So on code to cloud security, which is one of Palo Alto's sort of key focus area, is that Prisma cloud and Terraform cloud example that I gave, right, where you'd be able to use what we call run tasks, essentially, webhook integrations to be able to get a run or provide some telemetry back to Prisma cloud for customers to be able to make a decision. On the zero trust side, we partner both on the Prisma cloud side and the Cortex XOAR side, XOR side, around our products of vault and console. So what vault does is it allows you to control secrets, it allows you to store secrets. So a Prisma cloud or a Cortex customer can be using secrets from vault affirmarily for that particular transaction of workflow itself rather than, and so it's based on identity and not on the basis of just the secrets sort of lying around. Same thing with console, helps you with discovery and management of services. So Cortex and you can automate, a lot of this work can get automated using the parts that I talked about from zero trust. I think the key thing for zero trust in our view is, it is a end destination, right? So it'll take certain time, depends on the enterprise, depends on where things are. It's a question of specifically focusing on value that Palo Alto and Hashicob's products bring to solve specific use cases within that zero trust bucket and solve one problem at a time rather than try to say that, hey, only Palo Alto and only Hashicob or whatever will solve everything in zero trust, right? Because that is not gonna be possible. And to your point, it's never going to end, right? I mean, you've talked about Cortex bringing a lot of automation. You guys bring a lot of automation. Now they just bought, Hello Alto just bought Cider, security. Now we're getting into supply chain. I mean, it's going to hit it at the edge and IoT. You know, the people don't want another IoT stovepipe, right, they want that to be part of the whole picture. So it's, you're never done. Yeah, but it is this continuous journey, right? And again, different companies are different parts of that journey. And then you go and rinse and repeat, you maybe acquire another company and then they have a different maturity. So you get them on board on this. And so we see this as a multi-generational shift as Dave liked to call it. And you know, we're happy to be in the middle of it with Palo Alto Networks. It's definitely a multi-generational shift. Ashwin, it's been great having you back on theCUBE. Thank you for giving us the update on what Hashi and Palo Alto are doing, the value in it for customers, the cloud operating model. And we should mention that HashiCorp yesterday just won a technology partner of the year award. Congratulations. Very thrilled with the recognition from Palo Alto Networks for the technology partner of the year. Congrats. Thank you. Keep up the great partnership. We appreciate your insights. Thank you so much. We're our guests and for Dave Vellante. I'm Lisa Martin, live in Las Vegas. You're watching theCUBE, the leader in live enterprise and emerging tech coverage.