Cisco Systems, Inc. (CSCO) Earnings Call Transcript & Summary

Hello, everyone, and welcome to the Cloud and Networking Security Trends in 2024 webinar. I am Mark Watts, your WebEx producer. In a moment, I'll turn the session over to Gio Tan, but first, I have a few housekeeping notes to cover. Please note, your microphone has been automatically muted. So feel free to ask your questions in the Q&A panel throughout the session. And to view the Q&A panel, click the 3 dots on the lower right corner of your WebEx window. To enable closed captions, click on the closed caption icon next to the meeting assistant on the lower left corner of your WebEx screen and click on the downward arrow and chose your language. At the end of the session, a survey will automatically pop up in your browser. Please click continue to complete the survey. We really appreciate your feedback. With that, we are ready. So let's get started. Gio, in a few seconds, it's all yours.

Thanks, Mark. So hi, everybody. Welcome to today's webinar. So today's webinar has been prerecorded ahead of time, and we actually recorded them at the Cisco Live Melbourne security stand last year. So in a few moments, you will hear 2 parts of this webinar. The first is by Corien Vermaak and Doug Brown, on the security trends in 2024 and the outlook. The second part of this webinar will be by Kartika and Marcelo, which will specifically dive into the secure networking space. So Mark, if I can get your help, could you play the first part of the webinar. And if anyone has any questions, please continue to post them in the Q&A tool. Our experts will be here to help answer them. And if you have trouble viewing this webinar, do also post in your feedback and questions as well. Thank you.

With me on stage today, I have Doug Brown. Doug is the Director of Cloud Security for APJC. Doug, do you want to give us a quick introduction to yourself?

Sure. As you said, I'm Doug Brown, the Director of Cloud Security in this region. What I do is essentially lead anything that's a Software as a Service offering that we have and anything that's important to our clients from a cloud perspective is pretty much the area that are on across Asia Pacific, Japan and China. So it's been awesome. It's an exciting role and especially with some of the innovations that we've got going on at the moment.

Absolutely. And we see Cisco do these readiness index studies. We really try and lead with value through some of the research that we do. One of these studies have recently show that some of the regions in Asia Pacific compared different to the world. What is your take on that?

Look, I think what we see is that in some of our particularly emerging markets in this region, which we have a number of, we're very lucky in that regard. They've been able to digitize their environments earlier than some of our traditional markets where we've got legacy that we've got to deal with. So they've been able to do the refreshes. They don't have to do that as much. They've come out with a fresh approach. They actually have some of those things in place already. But I also think that on the counter side of that, I do think that some of our mature markets are tougher on themselves when they respond to these surveys. They're a little more mature, they apply more mature thinking to how they respond. And so sometimes that can also cause a little tip in the scale in terms of the responses. But those emerging markets are just lucky in that regard for them to roll out new, that is where they've started, right? So they just are a little ahead of the curve in that, I think, so...

Yes. I think, Doug, you will agree with me on this. It's the one real observation from a leadership perspective that I have in the region is that we are early adopters. We are early adopters on a lot of things. And I find that our technology communities are really technically astute. These technology communities lead a lot of these adoptions. And that goes to one of my next questions. When you look at digital transformation and cloud adoption across the region, how do you see our clients doing that? And how do they layer in security controls in these considerations for cloud adoption?

Look, I think at mass scale, we've seen a huge move over the last few years to cloud, to people's transformation journeys. And that's been forced by a lot of what we've seen going on in the world. But I think that one of the things that I've seen -- and you're right, they are early adopters, right? So I love that comment because we see as well, green you and I, in particular, in this region, when we do come out with a new service, it's our clients. They're the ones who want to get it in, get it and try it and actually work with us on getting things right. So it's hugely exciting, right. But this whole move to having things as a service, hosting applications in cloud and so on, really has also given us an opportunity as a region to try and tackle some of the challenges that exist there. And what I've seen from our clients on the things that we are doing, I've seen a mass sort of response to some of the innovation that we're bringing to be able to put the control points closer to those cloud environments, give them the visibility into those environments. I think those are the important areas to look at, right? How do we control the access and identity that's going to those cloud environments and how do we actually get security and policy in place across those different environments as well. So...

Now I want to maybe just hover on this topic for a little bit because I think what we're seeing within the move towards software and cloud, there should be a true acknowledgment of the administration and deployment burden that it takes off our teams. What is your take on that?

Okay. So you give me a great leader into 3 things that are -- I'll quickly touch on, right? And I think you've seen them as our sort of guiding principles over the last little while, which is very focused on the user experience, right? So making it as easy for the users that you as an admin would be looking after an organization, just letting them get on with doing what they need to do, right? The second aspect of that is actually taking a look at the user who's the administrator or the operations team that are trying to run that because we know we have skills just sitting there waiting to go, right? No, we don't. We have a resource gap at the moment, which I think we can talk about a little further on. But making that easy as well, making that sort of admin interface as seamless as possible, one place to go to try and administer and run things, super important, and then bringing efficacy to what we do in terms of making it safer for everyone, critical. Those are the 3 things I would say that Cisco has been focused in all of our product areas to try and make those things as easy as possible for both our users, the teams who work with us to administer and manage things, right, and then the efficacy of what we're actually bringing to market.

Now Doug, it goes without saying that artificial intelligence has grabbed its unfair share of media through 2023. Now again, we've been using machine learning and supervised machine learning for so long [Technical Difficulty] and security it's now at a time where it's prevalent. And how do you see this technology change the future?

Okay. So I guess 2 things. I also I don't mind talking about this area, but I'm the same as you a little. I think we have been using some of this to some extent with machine learning, our statistical application and AI type models to do a number of things in security. But for me there are 2 things, right? So there's Ai4 security, which is very much using what we can do, again, to make people's jobs easier, to make this feel more accessible and to make us more successful as cybersecurity team. So it's actually using AI to drive security to be able to monitor, look at, look for strange behaviors in our networks, apply those, alert us, keep the human in the loop, but you might need 1 or 2 humans, not 10, right? So I think there's a huge gain there because we've seen that some of the sort of bad actors out there are actually using AI in exactly the opposite way to come after our users, to come after things like credentials, applications. They're using it as part of their reconnaissance, their activities. The spam e-mails are written so much better now because of some of the language models they're able to use to get these things out into market, right. And then there's security for AI, which I think we need to look at. So we need to actually secure how our users are using AI in their different environments. We have to adopt this. We have to encourage it and embrace it. But at the same time, we have to look about how we secure what we're doing. I mean [Technical Difficulty] to users, there was a recent thing that happened is public thing that came out of [Technical Difficulty]. One of the sort of big innovators in the market at set down that had a confidential...

So sorry, there is some audio issues at the minute. Mark, could you perhaps try and alternatively to play the video, if you don't mind. I'm so sorry, everyone. I think there is just -- give us a few minutes, we will try and sort the technical issues up just so that we can ensure a good playback experience. Mark, I don't hear the audio on my end.

The mobile market had sat down that had a confidential strategy meeting. One of the guys came out of the meeting and pumped the meeting notes into them and said, please turn this into my minutes from the meeting, which, of course, it does. But with generative AI, you see that using it then it's learned that, right? It's part of its base of knowledge. And so those are the things we need to look after. We have intellectual property and things like we need to guide our users against being able to do those things. So allow them to adopt but secure what's actually being shared and what's been done within those different areas. So I think those are the 2 things I would talk about when it comes to AI.

I think I want to add 2 patterns of thinking over there. One, it really goes back to that basic principle of people, process and technology. As the technology is ever changing, we have to write the policy so that our people can safely and ethically adopt some of this. And I think you said it so well. One of the [ citers ] that I recently met with said, he voices it to his users as -- think of it as the cookie monster, and be careful what you feed it because it learns from everything we give it. And Cisco has recently actually conducted a study around our organizations ready. And one of the things that was called out is really skills. Now I invite people to go and look at the AI readiness study from Cisco, but I want to take that skills element and deep dive that a little bit. I think we are at a place in the industry where we realize we don't have enough bodies. What is your take on that?

So -- just recently, there was a release on exactly this. So while we've actually had an intake in our space in terms of people, the gap is actually the biggest it's ever been. There are over 4 million jobs in this space globally, right? I don't make it specific to this region because I don't have that. But what it sort of says to me is that we have a job out there to actually bring people into this field, right? And we just talked a little bit about AI and things like that. And we've heard some great presentations just this week here at Cisco Live from some of our leadership and some thought leaders in the field around how this is actually going to help people who don't have knowledge in this space be able to come in and apply their sort of reasoning nature, their critical thinking and questioning to be able to fill some of those roles that we need in cybersecurity. So I think 2 aspects. We are going to be able to do more with less, so less being the people. But at the same time, I think we can lower the barrier to entry to our field and widen the net to people that were won as confident or maybe felt like they didn't have the knowledge because knowledge is really -- it's becoming a commodity in terms of that. So I think we're going to see that shift over the next few years. So we will be able to fill some of that. And I think that we can use some of the intelligent ways that we're building systems to actually augment that people growth that we need to do this, right? So that's my feeling is that if we embrace some of the new things that are coming that we'll actually be able to cover some of that resource gap, but it also lowered the barrier to entry because they're going to be able to look up all these things. They're going to be able to speak in natural language to some of the systems that used to require configuration, a huge amount of knowledge about how the system works. No longer is that going to be the case, right? They're going to be able to tap and I want John to be able to get to X application. And all the systems in between will allow that access and create the policy required to manage that. So I think that's a huge step forward in terms of what we're doing. What's your take on that?

I think, I absolutely agree with you. When I listen to the terminology around skill gap, I really see it as a 2-part problem. Yes, we do not have enough qualified people that's really entering and being invited into our industry. That's one part of the problem. But what I also find is that the academic bodies and academia are backing with honing the right skills. And through this week, I also heard some of the narratives talking about how we need more critical thinking and how we need more problem solving to your point, because the systems will do a lot of the democratization of the knowledge that was once only for a few.

Yes. Absolutely. That's -- I couldn't agree more. So you...

I think it's an opportune time, as you mentioned, to invite more people into our industry because -- for those that have that, I'm not technical enough or I don't quite have all the skills that I need. It's an opportunity to say, but you can augment your capability with these systems and naturally interface with them by asking them questions. I think it is a real big time for us in the industry. Now I want to ask you something on this as well. A lot of companies are upskilling. And actually, maybe one of the examples that I can give most recently, one of the organizations that we dealt with as a client had to reduce capabilities in some of their business units. But the citer said, I have so many roles and these people know our business. I will train them and bring them on board. How do you see this upskilling of existing resources become part of what leaders should think about?

Again, I think that's almost like an untapped market for those people to look at, right? And I completely agree. I don't think it's actually that hard to learn this field. I heard someone else talking about this saying it's a jargon fill the industry, and we make it so difficult. We do. We have all these [ jargon ], SWG, DLP, I mean, I could go through 100 of them, right? Like there are just so many little acronyms and sort of local jargon we use within that. So I think that will be simplified. I think it makes it easier for people to do those things. But I also see and Corien, I mean that's an area of passion for you, but we don't have enough women in this industry, right? It lowers the barrier to those individuals to come in and help us actually do what we need to do as well. And I think we're very lucky. In Asia Pacific, Japan and China, we have a diverse group of people. And for me, the thinking that those different people have, like we've talked about, that critical thinking, right, the thinking that different cultures and different people from different backgrounds bring to problems and solutions for me is paramount and what I guess, wow, love working in this region, right? So for me, I can absolutely understand what that is, and was telling you and why they'd be looking to do that, and it makes complete sense. And again, to the point on AI, I think that knowledge area is going to be really easy for people to cross the barrier to get across and get comfortable with the field. The other thing that I would say to all of you out there is essentially someone who gets into cybersecurity very rarely ever leaves cybersecurity. It's an interesting thing that you see, right? They come in and they stay in this field. I've been in this for a little too long, I guess. So well over 20 years in so I've been. when I first came in, it's because of the challenges, it was because of the way -- and it's just constantly changing, it's kept me engaged and plus -- for anyone who's looking at working in cybersecurity as that field, you will never find a more welcoming community of people to work with than those in cyber security. Everyone wants to help.

Yes. Absolutely. And Doug, you said something that I think really resonates with me. As a female that entered this industry, and the ability to use AI as a tutor. I remember my day in digital forensics. It was so daunting. I was the only female in my class, and all of the other guys at Home Labs, which I didn't have. And I remember how heavily I had to lean on them to help me with certain of the constructs -- and whatever so thankful for those that reached out in that way. But we also now have a bit of a confidence reach. If you are scared of asking the silly question, you have an opportunity to say to the AI, explain this to me, explain this in plain English so that I can hold the conversation, I think it's amazing. It opens up the doors to people that may have that little bit of a reservation as to how do I -- as the diverse candidate in this industry, not sound silly. It may not seem like a thing, but it actually is a thing. It's daunting to ask a senior engineer about their field if you don't actually know the topic. I'm going to ask you -- I know you're not a betting man, and you probably don't like predictions, but let's go. What is your prediction for our industry in 2024?

I'm not a betting man. But I do think there's some data available for us to kind of take a look at what we're doing, right? So I think we've heard from a few different sources that people are tired of having a plethora of different tools to use. So I think the platform approach I think that a little bit of consolidation, both from an economical perspective but also just from an administrative perspective, we spoke about the load on administration and operations. And I spoke a little bit about the expanded sort of attack surface that we've seen because, by the way, on that point, hybrid work doesn't mean people work from home all the time. It means they need office, they need home, they need flexibility. And what that's done for us is it's opened up this whole number of different areas that we need to cover, right? So I think the adoption of cloud security as a whole, some of the control points that we're going to be able to look after for that is going to be super important, right? I think we're going to see the adoption of some of the things we talk about or the start of it anyway. And just remember that during that adoption, we're all feeding the system. So we're actually teaching it to help those that are coming behind us anyway. But I do think that those are actually opportunities for us as an industry as well, right? So if you look at the way we can do some of the cloud control points now about getting users to applications and how identity is kind of the new perimeter for me. If I can look after Doug, and give him access to what he needs to do without going over the top, right, and I don't want to go into Zero Trust too much, but Zero Trust has been overplayed by, I think, the vendor space in terms of pick me, pick me, I'm a Zero Trust, if you buy my solution, I'm Zero Trust. Zero Trust is actually a design thinking. So I think that's -- that we need to start applying that approach in anger and taking a look at the never-assume trust continuously verify and then enforce lease privilege, so giving Doug access to what he needs, right, and do that from wherever he is. And the only way we're going to do that is by using cloud environments that perimeter security we have, super important for the corporate environment. But when we're going out and working on applications that are hosted elsewhere, we need to look after how our users are getting there. We need to look after how secure they are while they get there and who they are to be able to give them the access that they need.

And absolutely, as a closing thought, the perimeter has shifted to or switch to the identity. It's really at the edge of what we do. And I can't agree with your prediction more -- and with my interactions with leaders over the last year, the #1 thing that they tell me all the time is, Corien, I can say with near certainty that my teams are not using all of the advanced features, that is to my disposal. Everything is not integrated at the base, and I really need to reduce complexity. So I don't think you far off the ball there. Doug, thank you very much for your time. If you want to be and see any of the documentation that we referenced, please go to cisco.com. And they make for a good read. Thank you very much, Doug.