Cisco Systems, Inc. (CSCO) Earnings Call Transcript & Summary

Hello, everyone, and welcome to the Customer Spotlight: Melbourne International Airport and The Salvation Army webinar. I'm Mark Watts, your Webex producer today. In a moment, I will turn the session over to Gio Tan, but first, I have a few housekeeping notes to cover. [Operator Instructions] And at the end of the session, a survey will automatically pop up in your browser. Please continue to complete the survey. We really appreciate your feedback. With that, we are ready. So let's get started Gio, in a few seconds, it's all yours.

This meeting is being recorded.

Hi. Thanks, everyone, for joining today's call and this webinar. So today's webinar, we will hear from 2 customers, Melbourne International Airport and The Salvation Army. So the webinar recordings and content has been recorded ahead of time to ensure good webinar delivery. These were actually recorded at Cisco Live Melbourne, so if you were there with us at the conference, you have seen some of these activities going on. So for the first recording, you will hear from Lachlan McGill, General Manager from -- of Cyber, Risk & Compliance from The Salvation Army. His session will be moderated by Cindy Valladares, Director of Brand Strategy of Storytelling and Advocacy at Cisco. They will be here sharing about The Salvation Army's cybersecurity journeys and priorities. So Mark, can I get your help to play the recording, please?

So Lachlan, thank you for being with us today. It's a pleasure for me to get to know you a little bit better earlier today and for you to come with us to talk about The Salvation Army.

It's a pleasure to be here. Thanks for having me.

Good, good. So I did warn you that I was going to ask you questions that are not on the script. And the first one is one of those. So in preparation for this, I was stalking you a little bit online, and noticed that you love books. You love to read. So can you talk about your latest...

Of all the things I love, books is not at the top. But no, I do love books. I do love reading fiction and nonfiction. At the moment, I'm…

Security books? Business books?

I've read my fair share of security books.

You'd like to put it in practice now.

I'm actually -- I've actually had a crack at writing a security book. I've got to about 10,000 words and stopped.

What happened?

But I'm feeling the motivation again to get back into it.

I think so.

Yes, yes. I'd like to -- I'm at the age now where I'd like to impart some knowledge on to others.

So what is the book about?

It's about 7 key success factors in being a successful cyber security manager.

I love that. Can -- I'm not going to -- people have to wait for the book to come out to learn about the 7, but tell us at least one of the key success factors.

One of them would be when you're presenting to management, you have about 30 seconds to get their interest. If you present it for 30 seconds and nothing has been interesting, they'll lose interest and you've lost them. So first 30 seconds is crucial.

It's important. So I had a manager who told me, for those types of situations, be bright, be brief and be gone.

Very good. Okay. I might use that.

Okay. Now we should talk about security, but wishing you all the best in that book and you have to drop me a note, so we can read it.

Certainly.

So talk to me a little bit about how you're using Cisco Security solutions, right? We've partner to deliver benefits to your organization and your users. So talk to me a little bit about how you're using our security solutions?

Yes. So it's a little bit like if it's Cisco branded, we'll use it everywhere, but no. So we do use Cisco. That's our primary security suite. So e-mail, endpoint, web, some of the threat hunting stuff, vulnerability management. We used to use the CASB solution, but we didn't renew that license, but that was a good product, too. And then some of the integration pieces like threat response; Orbital, which is a really good product; and the Secure Malware Analytics.

Wow. Thank you. Thank you. That's good. So when you're evaluating solutions, what are the driving forces behind those investments that you are making?

So I'm acutely conscious that technology is not the be all and end all of a good security practice. So I'm conscious that for the security team at The Salvation Army, it's not a massive team. We've got a few people in there, but it's not a huge team. So I want a suite of products that's going to help us, not hinder us. So the great thing about the Cisco Security Suite is they all talk to each other. They all look and feel the same. So there's a familiarity with the experience that when the staff and the security team log on, it's familiar. They know what to do. They know where to go and the integration, and they can get the results they need really quickly and really efficiently. So that was one factor that was important. Cost, being an NFP, is obviously a factor for us when we're looking at technology. Cisco were very cost-effective.

Not for profit, right? NFP?

Yes, yes. So one other thing that I'd like to mention is that when you are wanting to partner with The Salvation Army, we want to know what you can do for us with our clients. So we help vulnerable people and disadvantaged people in the community. So if we want to partner with someone, we want to partner with someone who can help us in that area as well. And Cisco have got a track record of doing that. And we've been having lots of discussions with Cisco already about how they can help us in the community, and those conversations have been going really well. So that's something that's really going to the next level for our organization, and it's just -- it's wonderful a partnership that we have.

It is wonderful to be an employee to work for a company that supports the communities, and I am glad that our values align with yours, and we can help your -- the people that you help and achieve your mission.

Yes.

Yes. So when we were -- when you were looking at the solutions, right, can you talk a little bit about some of the business outcomes and security outcomes that you were trying to achieve?

Yes, yes. We wanted that visibility into the network, and we want an easy way to do that. So when I arrived at The Salvation Army, we had this disparate set of security products that was probably not up to standard. But what we needed, didn't provide us great visibility, didn't integrate. And we're probably legacy technology. And it wasn't looking good. But -- so what we wanted when we're talking to the likes of Cisco and other vendors was that whole, not just an uplift in security maturity, but that integration as well. So what we wanted from a business outcome is, obviously, message to protect us, which Cisco has done, but we wanted a way to report on that as well. So something that we've really enjoyed lately is Cisco has this rich set of APIs into their products that you can use to pull out all kinds of information that the dashboards may not even give you because they're kind of a bit niche. And you can pull them from all these different Cisco products and bring them all into one dashboard that you've designed which we've done.

You can customize it, tailor to your needs.

You can customize it, and we can get all kinds of reporting to show the business, "Hey, this is what we're doing to protect the Army." And I'll tell you what, once we've started getting all these reports out of the Cisco products and reporting up to the Board and executive management, the support and the funding and the admiration coming down from that level now is incredible. So we never had any of that before.

Well, I am glad that our solutions are making you and your team look good and providing budget for the things that you need to do.

Yes. Yes.

Good. So we talked a little bit about your being a charitable organization, right, not for profit. And sometimes security is not top of mind because you're serving the community, right? But can you talk a little bit about how you are developing your security program, maybe how you move the maturity curve since you've joined the organization?

Yes. So we report to the Board on our maturity every 2 years. And obviously, at the beginning, just before I start, the maturity was quite low. Two years on, fantastic progress. Two years on again, we're in a really good place now. Security, you're never finished. Security is one of those occupations where you have to be comfortable in the fact that no matter how much you do, it's never enough. But I think, the level of maturity that we've reached is a really, really good place at the moment. And Cisco have contributed greatly to that. But Cisco don't stand still either. So I'm in constant conversations with the team to see where we're going next. And Cisco brought in probably about 8 or 9 people about a month ago, and sat down with our leadership team, and they had the ANZ CTO from Cisco there, and he said, "This is where Cisco is going." And they said, "All right, where are you going?" We said, "This is where we're going." And we're now working with Cisco to bring together those 2 directions and seeing how they can help us.

Vision.

So my boss has asked me to develop a new sort of a security strategy because the last one's just finished. Now there are certain things that I'm working on in that strategy, and I've already had e-mails from Cisco saying, "I know about your strategy. I know what you're trying to achieve. Here are some articles. Here are some people you might want to talk to."

That's amazing.

They're stepping with me every bit of the way to develop my strategy, and there's not nothing in that for them. There's advantages for Cisco as well, and there's advantages for us, and it's a win-win situation. But we're looking at new Cisco technology to help us in that strategy as well.

So this is one of my other pop-up questions because based on what you said, you obviously had a lot of conversations with leadership, look at the vision, and hopefully, here at Cisco Live as well. So what kind of innovation that you've seen has grabbed your attention the most?

That's a very good question. This is my first day at Cisco Live even though it's the third day, so. But I know that later on today, we'll be looking at some new Cisco technology, so I'm pretty excited about that. Yes. Look, the CTO went over a fair bit of stuff that Cisco is doing in the next space with AI and with, I guess, common technology and platforms right across the security suite, making it more modular and just plug-in. And I think that's brilliant because even though there is a familiarity and consistent look and feel across most of the Cisco product, still some outliers that kind of look a bit different and work differently. But I found their vision of having that common platform and plug-in modules to be really exciting because it's just going to make it so much easier for us.

Well, I'm glad that we're aligning with what you're looking for. And hopefully, you'll get a chance to see some of that in person, too. So let me ask you, we talked a little bit about how was it before and what you're looking to do in the future. Is there anything else that you haven't mentioned on that particular question or journey for you?

About how it used to be and how it's going to be?

Yes. How it used to be -- yes, before Cisco, before you came…

I don't like talking about how much it used to be, how much it was like -- what's that?

It gives you pain or...

I just don't like to remember. And look, it's not a criticism of anyone or anything. It's just how it was. And a lot of organizations struggle with cybersecurity because it's hard. And most of the time, there's no return on investment. And when you're talking about risk avoidance, sometimes it's hard to use that stick when you're fighting for support and budget, but I'm very lucky that I work in a supportive organization when it comes to cybersecurity, and we've come a long way.

That's wonderful.

And because I have the tools to be able to prove how far we've come, because some of the reports and stats I'm getting out of the product, I continue to get support because it is a risk that's high on Board's agendas nowadays, and they're very conscious about it. And Internet is a scary place, but we're just glad that Cisco's in the ring with us and has got our back.

I'm glad we're providing value to you. Okay. So let's see. I know you have a really strong working relationship with the Cisco team. Are there some particular scenarios or teams that you've worked with where you've seen that partnership evolve?

So I've met so many people at Cisco now. We have our core group of people at Cisco that we know that we can go to and we can get assistance. There's a guy called Terrence, in particular, and everyone else will hate me for calling him out, but he's got this saying. He goes, "Leave it with me." And I do. And -- but I just have that confidence that he's always going to come back and deliver. And there's other guys Enrique and [ Roy ], and a whole bunch of others that you feel like you're the only customer that they have because they're so engaged, so switched on and so supportive. And we really do have a wonderful relationship, and I feel comfortable that no matter what kind of problem I have with cybersecurity, that I can call on Cisco and they can help me. I spoke about my strategy before. And my next 4- or 5-year strategy may include nothing to do with new Cisco technology, but they're still sending the articles and putting me in touch with people who can help me. Cisco is helping us with an educational program that can help some of our job seekers upskill themselves and find a job. And these are disadvantaged people in the community who are struggling to find employment. Now Cisco has gone off and worked with universities to try and help us develop programs that can help our community. So the relationship goes beyond -- well beyond technology.

Going the extra mile. Thank you for sharing that. So is there -- before I let you go, is there anything that I haven't asked you that perhaps you would like to mention?

No, I think I've pumped up the tires of Cisco enough for one day. No, I value the partnership immensely. And just -- I'm just glad that it's about people, I deal with -- you deal with people every day. You don't deal with a brand or a logo or a company. You deal with people. And Cisco employ good people, and we're lucky to have that relationship.

Well, thank you, Lachlan. I appreciate your time, and I hope this is one of many opportunities where we can tell a little bit about your story and how you're helping the vulnerable community in our areas. Thank you.

Thank you for having me.

Thanks. That was the first clip featuring The Salvation Army. The next one you'll hear from Melbourne International Airport, Cheuk Wong, talking about the Melbourne International Airport Cybersecurity journey with Cindy Valladares. Cheuk Wong is the Head of Cybersecurity at the airport itself. So Mark, can I get your help to play the second clip? Thank you.

Cheuk, good morning. Good afternoon. Thank you for being with us today. It's a pleasure to have you here with us at Cisco Security and talk a little bit about the security program at Melbourne International Airport.

Good afternoon. It's my pleasure and honor to be here today to have this chat with you. Very much happy to be here at Cisco Live and then consuming all the content. It's amazing to be here.

Yes. Well, that was going to be my first question, right? You've had the opportunity to look a little bit of the innovation that it's happening here, some of the product launches. What has caught your eye?

Actually, I haven't had a chance to be down here at the product solution center. I've been up in the meetings, the workshops and the keynotes. Actually, I've listened to several of those and very, very informative. Gave me things to think about. And I think the next thing is to be coming down here to actually walk around and explore the solutions. I mean, we use a lot of Cisco solutions in our environment today. And I'd like to see what's next coming up with the Cisco solution, what are the new feature sets and so forth and how it can help us.

That's wonderful. So before we get into the security questions, you were nominated as one of the finalists as the Cybersecurity Defender of the Year for APJC, so congratulations for that nomination.

Yes. Thank you. Thank you.

Would love to learn more about what that means to you, being nominated for such an award.

Look, first and foremost, I was very surprised to hear I was nominated, very honored. I mean, at the end of the day, for me, it's about doing my job and how I can support the business. Cisco is a key partner for us, and we use a lot of their products. And for Cisco to recognize that we are actually doing something great within our own environment, it's awesome, right? I just -- total surprise. I didn't expect it, but thank you very much.

And the other thing that is important, and we chatted when we were prepping, right, it's how the security industry needs a little bit more sharing, right? And part of this nomination is about how do we share best practices with others, so would love to get your take on that.

I think we don't share enough of it as an industry. It's hard for -- I guess, for people to share and company to share, hey, we've had an issue, and we need to address it. And people are scared of what are the impact or ramifications of sharing that type of information. But I think we all need to do a little bit more of that to share what the challenges are, what instances we have encountered so that people can learn from it and then be more proactive in their approaches, right, how they fix their processes, how they enhance the security control, et cetera, et cetera. I know the government is trying to do more of that, but it has been an issue in the past, and we want to do more of the sharing as well.

Well, and thank you for being here because you will be sharing a little bit about your security program. So thank you for leading the way. So my first question to you is you mentioned you use a lot of Cisco security programs. But what are the driving forces behind your security investments?

Yes, we do use a lot of Cisco security products. It was a conscious decision that we made several years ago to do a Cisco or to do a platform play, platform solution, instead of doing a spot solution because we thought that we would be able to get our controls up and running much quicker, operationalize them much quicker and more effectively, which will give us better insights in terms of what we're doing. And then we've been able to respond quicker. What drives us today is the threats keep changing, right? There's more and more threats. And with the introduction of AI, it doesn't help any of us, I guess, in terms of -- from a security practice. It's that AI is actually providing the ammunition for the bad actors to actually accelerate what they're doing. So we also have to use AI and new tooling to defend against that. Another driver for us is regulatory changes within Australia. SOCI has made a change and then now Australian government has introduced a new Australian cybersecurity strategy. Those will drive what our programs can then do. And obviously, our business requirements as well, through risk management, from the Board perspective. So that's what kind of drives our program.

Right. Great. You talked a little bit already about those business outcomes, right, staying connected to the business. And as a security executive, right, how do you look at the stack that you buy, the technology solutions that you buy to address your business challenges?

We're always evaluating new things. We're always looking for the next solution out there. Not necessarily we're going to go and implement it, but we want to see what's out there. We want to test it out, and we want to see what's going to give us the -- what's going to fulfill the needs that we have from a security perspective and as well as how do we actually get that working effectively in our environment very quickly. Putting in tools is easy. Managing them is hard. And managing them effectively is even harder. So that's what we're looking at. Obviously, at the end of the day, it's all about risk management. We've got to work out what the risks are in our kind of business, what is acceptable and then drive our solution to deliver the outcome that the business wants.

Okay. And this is not a question that was on our script, but you said something really interesting that I would love to ask you about. So at the airport, you manage a lot of personal data. You manage traffic patterns, right? You manage -- and then you have to also be -- stay on top of threats. So how do you balance all of those needs of the business, right, to meet your goals, your Board members' needs?

So we have a lot of threat intel, more so than probably we can consume at times. And the threat intel is important, right, because we need to know what's going on. And we can stay ahead of the threat actors. Just a little bit goes a long way. And yes, we use threat intel throughout our organization. Anything -- any time we see any new IOCs that's out from our partners, from the vendors, et cetera, we'll make sure we ingest them into our solution as quickly as possible so that we can get the best outcome we can. It's just about keeping up to speed of everything, and it's a challenge. And we're going to have more of that, right? Hopefully, we'll have more of that.

And that leads me to the question about our XDR solution, extended detection and response. I know you've evaluated it. You're ready to start moving into that. What caught your attention and saying, "Yes, this is a solution for Melbourne. This is how it could address my needs."

Look, I think for us, we've gone down that platform solution for a while now. And we see value in that because, not only do we get telemetry from one solution, but we get telemetry from multiple solutions from Cisco. And they're all integrated, to some degree, with each other. Then we're able to correlate that information much quicker and then be able to triage the issue, identify the issue. And then using XDR, will help us actually also being able to respond much quicker. And it's all about identification for us, quickly containment and then instant response, right, how do we respond as quickly as possible to minimize the impact of the business.

So we do reducing the mean time to detect and reducing the mean time to respond.

Correct, correct.

Fantastic. Thank you. Okay. I'll go back to my script. Okay. So you mentioned a little bit of that, right? But as an international airport that also offers domestic services, of course, you have many compliance requirements but are also affecting some of the security programs. So can you talk a little bit about that balance with compliance requirements and what you need to do from a security perspective?

Yes. So with the introduction of SOCI, which is the critical infrastructure, there has been a number of additional requirements that has come out from that, that has driven, to a certain degree, our security practices. We, as a company, have elected to kind of go down the path of implementing the ACSC's Essential Eight to demonstrate some of the compliance required. And again, that has helped us shape our programs to a certain degree. So there is a lot more regulation and a lot of regulation is driving that. But regulation and compliance is, in my mind, not security, right? Security is -- goes above and beyond compliance. Compliance is necessary, don't get me wrong, and it's probably the bare minimum that we need to do. But security is all encompassing. You have to look at hundred million thousand things. But -- and it's -- and whereas compliance is focused a little bit more on focused areas, more concentrated areas that you have to deal with, so there's a lot more to think about. And what drives the rest of our program beyond the regulations is just basically, we, being an airport, we're so huge. We have so many different systems. We have IT-OT and we need to look at everything, and we need to understand everything that's happening. So what drives me is getting the most visibility from our platform, then being able to make the informed decisions.

Great. Great. Thank you for sharing that. You talked about why Cisco as a partner with you, but I think that goes beyond just choosing the right technology, the platform. So can you share a little bit more about why Cisco, right, and, not only in terms of technology, but how you get the support from the rest of the organization?

Sure. We've used Cisco in our environment for many years now before I arrived there. It was a natural progression for me to look at Cisco as a securities solution provider for us. The presales team, the sales team has been great, right? Their customer experience team has been great in terms of helping us work out what the right solution for us, where when we have a challenge with a part of our environment around security, we actually can call Cisco and say, "Hey, we need to look at something to help us with this particular issue. Can you guys come down and workshop this and then let's work out what we can do." And we've had many of these sessions with the Cisco team. So my shout out to the Cisco team on assisting with that. Without their assistance, it would have made the implementation of the solutions and getting to the actual solution itself much more difficult and time-consuming.

I'm glad that -- that fly keeps bugging us.

That fly keeps bugging me, too. This is Australia, that's why.

I was going to say we -- maybe we have a mic-tense moment in the debate. This may be too U.S. of a centric of a joke. Cheuk, before I let you go, is there anything that I didn't ask you that you would like to share with our viewers?

Yes. Actually, first of all, can I give a shout out to my team?

Yes.

Shout out to my team at Melbourne Airport, gals and a group guys, day in, day out, 100%, 110% effort in helping us secure the airport, right? Can't do it without them. Security is not a one-man-show. Security is a team sport, right? So shout out to the team for all the work that they've done over the years. And as well as in security, you can't stay still, right? You got to keep learning, you got to keep looking at the next thing because threats keep changing. So if you stand still, you're going to be falling behind, so keep moving forward.

I get the sense that your team, not only has your back, but is an innovative and creative crew in security, so congratulations.

Yes, yes. Thank you.

Well, thank you for being with us today, Cheuk. I appreciate the conversation, and I hope this is one of many to come.

Thank you.

We'd like to thank you all for attending this event. We hope you found it informative. As a reminder, please take a moment to complete the confidential survey that has been posted in the chat panel. It will also pop up in your browser as you exit. Thank you again for joining, and have a great day.