Elastic N.V. (ESTC) Earnings Call Transcript & Summary

Everyone, thank you for joining us today. Welcome to our webcast focused on Elastic's Security business. My name is Anthony Luscri, I'm the Vice President of Investor Relations at Elastic. Today, I'm joined by Santosh Krishnan, General Manager of Security Solutions at Elastic, who will discuss our security offering, differentiation, go-to-market and will conclude with a short product demonstration. We'll then be joined by Tyler Hopperton, Director of Managed Security Services at AHEAD, a partner of Elastic; and Koji Ikeda, Senior Analyst, Enterprise Software at BofA Securities, who will moderate the discussion. We will then conclude with a Q&A session. Please send your questions to Koji at koji.ikeda@bofa.com or via your Bloomberg terminal. Before we begin, let me cover our brief safe harbor statement. Our discussion may contain forward-looking statements and involve risks and uncertainties, which include, but are not limited to statements regarding our features and solutions, the expected strength, performance and benefits of our features and solutions and innovation regarding our features and solutions. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially, and we disclaim any obligation to update such statements unless required by law. For additional information, please see the risk factors in our SEC filings. Now for those of you potentially not familiar with Elastic, Elastic, the Search AI company is used by tens of thousands of customers, including more than 50% of the Fortune 500. The Elastic Search AI platform combines the power of search with AI to help companies get real-time answers, solve real-time business problems and achieve better outcomes. Now we focus on 3 solutions built on the Elastic Search AI platform: observability, security and search. That allows customers to realize value quickly with ease of use and compelling features in those areas, all built on a single stack, which in turn drives technology advantages across each of these solutions. Now it's important to note that we do not sell separate products or multiple SKUs. What we do sell is the extensible technology stack or the Elastic Search AI platform that can be used by customers for a wide variety of use cases and we expose purpose-built features via our solutions that drive out-of-the-box capabilities to address the specific needs of practitioners that are focused on search, observability and security use cases. It's also important to note that we have focused on being wherever the customer needs us to be. So of course, the platform can be deployed anywhere, whether it's on cloud or whether it's on-premise or via managed service -- via one of our cloud partners. Now finally, today's call will be focused solely on our security solution, which is slightly greater than 25% of our total business. Now with that, I'll turn it over to Santosh Krishnan, who is the General Manager for Elastic Security Solution. Santosh joined Elastic through the acquisition of Cmd in 2021, a cloud infrastructure security startup where he served as CEO. Santosh?

Thanks, Anthony. Getting into our security solution, our objective or mission in Elastic security is to bring the power of search and AI to large data sets in order to modernize the security operations center. That's in one line, what we do over here. In terms of the functions that we cover, it definitely covers threat protection investigation and response. To be a little bit more specific in regards to what it entails, we are in the business of collecting data from as wide an attack surface as possible, so ingesting data at scale; storing them, storing the data in a very economical fashion using hierarchical storage technologies, but at the same time, keeping it searchable so that we can run real-time detection rules on it as well as keep the data available for investigative purposes; and last but not the least, from that platform, our goal is also to orchestrate response and close the loop. So that, in a nutshell, is why we exist as Elastic Security. To give you a little bit of a context on where we participate in the security space and where we have been, it's important to look at the evolution of the SIEM use case itself. So SIEM is our primary use case as a lot of you know. If you look at the evolution of the SIEM, the SIEM 1.0, call it legacy SIEMs, it came about in the 2000s. And largely speaking, these were operational systems. So these were systems where you would centralize all your logs, you would essentially run your compliance workbooks through it. You would, of course, use it for some amount of investigations and so on, but it was still quite separate from the detection and response systems and so on. So it was largely for visibility purposes, ticketing purposes, assigning, triaging responsibilities to InfoSec team members and such. So that's sort of the birth of the SIEM, what we call 1.0. Elastic did not participate in this. In fact, Elastic didn't exist as a company at that time. We participated squarely in the next evolution of the SIEM, call it more the analytical SIEM. And this is when people started expecting things like threat detections, investigative workflows, orchestrating response, features like UEBA. So application of analytics on the data in order to render all those functions. And of course, those operational features, which were required for case management and ticket management and all of those also came for the ride as well, meaning those were subsumed into that second generation of SIEMs. Now interestingly, we introduced our product into market in 2019. So prior to 2019, we were not participants in a direct way inside of security. However, the community as a whole, people were actually building SIEM like systems on top of Elastic's ELK Stack, and that's what prompted the company to get into that. So largely speaking, we have been beneficiaries of that first evolution of the SIEM from an operational to more an analytical SIEM, and we have been beneficiaries of that replacement cycle so far. And that's really what has been driving our growth to a large extent from 2019 to today. Now an important thing to note, when we first introduced the product, we were largely augmenting existing SIEMs, so existing legacy SIEMs as well as some of the newer players at that time. We were augmenting them to provide those analytics functions on top of the data which was collected. And there were some feature functionality side of things that, of course, as any new product, we were not ready at that time. Over time, over the next couple of years, we actually added all those features. So we added features in terms of out-of-box detections, integrations, entity analytics, orchestrating response. Also made our feature set richer by the introduction of new query languages. In fact, some of you probably heard about our ESQL query language, which really surpasses most of the query languages out there for a SIEM. So by adding all of that feature functionality, we essentially transitioned away from augmenting an existing SIEM system to actually replacing them. And that's what has been driving our growth over the last couple of years now. Now the interesting part is that our view is that we are at the beginning of the next evolution of SIEM, which is why SIEM seems to be a little bit sexy again at this point. And that part of the evolution really is to bring to bear AI-driven technologies in order to automate still largely manual processes in the SOC. And I'll actually go a little bit more into what those manual pain points are in the SOC today despite the availability of second-generation analytical SIEMs. And while we were, let's call it, late entrants into the SIEM market in the past, we are leading the charge in the evolution to that AI-driven future. We call it AI-driven security analytics, maybe the world SIEM itself might go away. We will see what we call, what Gartner calls it in the future and so on. And the idea over here is not just AI assistance. Every company in the world is going to have AI assistance. What we are talking about over here is really to embed AI in practically every workflow that you associate with a SIEM. And some of those we have already introduced to market. We were the first in market with our AI assistant in security. And of course, it's one of the best still in the market today. But since that time, we have also introduced a lot of AI features, which are embedded into the workflow of the SIEM. So that's where we are leading the charge. So while we benefited from the legacy displacement cycle, we are leading the charge in the next evolution of the SIEM. And that's really, let's call it, a summary of how we participate in the market today. So when we look at our product portfolio in a nutshell, while we look at it as a holistic platform where we collect data, render detections, provide investigator workflows and orchestrate response, SIEM is still our majority use case. So most of our customers start their journey with security analytics and SIEM with us. And the idea over there, of course, is you can bring all your data as opposed to very specific endpoint data and cloud data and so on. You actually can bring all your data, and we provide all the functions, which I alluded to. As an option, we also provide extended protection for endpoint and cloud. And the goal over here is not to offer point products for endpoint security or cloud security, but think of it as an attachment to the security analytics platform. In fact, we don't compete in an isolated fashion on endpoint security and cloud security, but the customers who actually choose us for security analytics and SIEM, they end up using our contextual investigations, our extended detections and our response orchestrations in order to provide extended protections for endpoint and cloud as well. And in most of those cases, customers actually keep their existing EDR systems and their cloud systems in place. So there's no new tool to be added. But then they pipe all of that data into our security analytics system itself so that we can bring -- we can make this XDR thing a reality in some sense. Now at the end of the day, we also have our own agent. That's another option as well. So think of it as we start our customer journey with security analytics, where you bring in all the data and as an option, we essentially provide extended contextual protections for endpoint and cloud. and some of our customers also in the end, end up deploying our own agents so that we can actually provide the full solution in terms of EDR as well. So I did want to clarify that aspect because you will see us participate in many use cases. But at the end of the day, we are a true platform. It's not a portfolio of point products. And that platform is really an AI-driven security analytics platform. So that's where we are today. As a brief note, we also have this team inside of my organization called Elastic Security Labs, which is your typical research and response team they keep abreast of all the latest threats. We do a lot of first-party research as well. I urge you to go to our Elastic Security Labs web page, and you will see a lot of the newest threat findings from that team over there as well. Now a little bit about the vision. So I talked about this next evolution of the SIEM. If you look at the, let's call it, the pyramid of pain in InfoSec, if you look at all of those functions, which is the function of ingesting the data itself, how do you bring all of that data into a security analytics system, most systems like ours as well, we cover, let us say, 90% of ingest with out-of-box connectors. But there is still that 10% of data that you need to bring in, which might be custom data, which might be very specific to your organization. And that does lead to a lot of friction in adopting that security analytics solution. So you start from ingesting data. Same story on detection rules. We actually provide the 90th percentile of rules out of the box, but then an organization might be interested in that last 10%. So you do have to do rule offering and such, you have to create your own rule book as an organization. That's also a manual effort. And from there, of course, investigations. All of you have heard about alert fatigue. Frankly speaking, I'm fatigued hearing about alert fatigue, because you write more rules and you see more of these signals popping up on your screen, what to do about them. There is a lot of manual processes involved over there as well. And of course, to get a consolidated risk posture of your entire IT infrastructure and orchestrating response, there is a lot of manual processes in all of these even in the second-generation systems that we have today. Our vision for the future and some of it we have already introduced to market is really to bring to bear the power of AI on that same large data set in order to reduce the need for all of those manual processes. So for example, at RSA, we introduced this thing called Attack Discovery. And the idea behind Attack Discovery is not to focus on logs but how those logs all coalesce into an attack pattern. So we essentially show you the end-to-end attack pattern so that your InfoSec analyst don't have to worry about the thousands of alerts, which do get generated every day as a, let's call it, their highest priority. We are working on other similar innovations. Very soon, you will see us introduce automations on how to generate a pipeline for that custom data pain, which I mentioned. You can already use our AI assistant in order to author rules. So I mentioned the query language called ESQL. You can author ESQL rules. You can talk to our assistant in natural language, so that takes the pain away, the manual pain away and actually creation of the rule book itself. And then looking more towards the future, we are also working on automation on how to use AI to create run books, how to orchestrate those responses and such. So if you notice, what I'm talking about over here is not an assistant. It's not just about an AI system. Practically every company in the world is going to have an AI assistant. Our goal is to actually embed AI in the workflow of the SIEM, every one of these functions. We are, I want to say, a good portion of the way already there. Many of these functions are in technical preview right now, so it is not generally available. But we have been launching these capabilities at a constant clip since the beginning of this year. One of them -- so this is just to highlight the latest one is this thing called Attack Discovery. If you think about the previous generation of security systems, we took raw logs, we applied analytics on it, we applied machine learning on it in order to give you, let's call it, interesting events and we alerted you on it. So we essentially took logs, converted that into alerts. This takes us to the next level where we are essentially taking hundreds, thousands of alerts. We are vectorizing all of those alerts using Elastic's platform, using the vector database, which is inside of the Elastic platform itself. So really bringing the power of search and RAG together in order to paint to the picture of a potential attack in progress, the idea here being we don't want InfoSec analysts to be worried about all the alerts, which are in progress, but made only on the most relevant attacks that demand their attention. And this is what we launched recently. I want to say this is probably one of our best received launches ever in Elastic Security. When we showed that at RSA, we had everybody from partners to competitors at our booth, the entire time. So this is one of those capabilities that we are extremely, extremely proud of, and it's really exciting times for security as a whole. A short note on our go-to market. So suffice it to say, based on everything that I have said, our sales team lands with SIEM. So SIEM is the primary use case that they actually focus on, a little bit of how we actually operationalize our sales. We still use a general sales model because at the end of the day, Elastic is a platform that actions data across multiple use cases. So we do mirror that in our sales organization. So our sales team is a general sales team. But we do have an overlay team of security specialists that accompany those generalists as well. So that's really how we operationalize our sales model for security. And their primary purpose in security is to land with SIEM, much like we land with logs in observability, will land with SIEM in security. The expansion from there to extended protections for endpoint and cloud, for example, that's all product-led growth. We actually don't have our sales team go and sell and bake off endpoint on its own and cloud on its own. It's really all product-led growth. It's really our security analytics and SIEM customers who start trying out all these extended features that we have in product and a good portion of them convert. At the end of the day, we see that more as a consumption of the Elastic security analytics platform, not necessarily as I have some adoption of endpoint and some adoption of cloud and so on. So for us, it's really consumption of that entire analytics platform. That ties in with how we price things as well. So our pricing today is not based on use case. It remains -- so our pricing today is still based on consumption of the Elastic platform itself. That actually works out for us because there is no special license that is necessary either to adopt any of our solutions or use cases within our solutions. So when customers use more and more of these use cases, we see that as an increment in the consumption of the Elastic platform. So that continues to be our model over there. I'll sort of end the prepared part of this with some core differentiators because this comes up quite a bit. So in this evolution, how is Elastic placed? And at the end of the day, our core differentiator is the Elastic Search AI platform. This was the reason for us to enter the market that remains our core differentiator as well. Now when you tease that apart, in reality, our differentiator remains how we handle data at scale. Now there are a couple of aspects to it. One of them is how can we retain data for large periods of time without breaking the bank? So you might have heard about technologies like searchable snapshots, which are available as part of Elasticsearch. It is that technology, which allows us to store data keep it searchable. So these are all indexed data so that you can use it for your detection, you can use it for your ad hoc investigations, but keep it in an economical fashion. That's one part of data at scale. The other part of it is a technology called cross-cluster search and this allows us to have hybrid deployments. So we essentially have Elasticsearch clusters next to where the data is initiated as opposed to centralizing and backhauling all of that data into one place because that would then be associated with a lot of data transfer costs and latencies and so on. So we like to keep data locality using technologies like cross-cluster search. At the end of the day, how we cover the widest attack surface without the need for rehydrating data from data lakes and archival storage and so on and so forth, it's all out of the box. Our system takes care of that. That's one of the key reasons why customers choose us. And at the end of the day, since we keep it searchable, it's the speed. So if you talk to most of our customers, it's the speed at which you can interact with this data, interact with the detections, fire off ad hoc queries and get results in record time. So that speed is -- it comes because of the indexing architecture of Elasticsearch itself in the platform. Last but not the least and more recently, it is the combination of search and RAG that we provide in our GenAI stack that really provides that accuracy, which is required for all of those AI-driven automation, which I mentioned, the accuracy and the hyper relevance. Those are our core differentiators. Now of course, there are feature level differentiators that we do have. I mean, I talked about Attack Discovery. I talked about our AI assistant being first to market in security. All of those are feature-level differentiators, so to speak, but our core differentiators remain in the platform itself. Just to show some of these things in action, let me actually show you how Attack Discovery brings all of these things together. That's sort of a good, let's say, example of the kind of things where my team has been spending our R&D dollars.

Hello, everyone. My name is James Spiteri. I'm a Product Manager of Elastic and I focus on our security solution. Today, I have the absolute pleasure to be able to introduce our latest addition to Elastic Security, which is a feature we're calling Attack Discovery. This is designed to be able to help security operations teams of any shape and science to triage and investigate alerts really, really quickly, thanks to generative AI. So let's go ahead and dive right in. What you're seeing on my screen right now is the current alerts view within Elastic Security. So this is typically where as part of your daily security operations, you would go in just saying what alerts would have triggered this newer environment. And these are alerts either that we, as Elastic, have provided as part of Elastic Security, thanks to our Security Labs team or perhaps any alerts you might have crafted yourselves through our customer rule concept. It's slow day-to-day still, there's still 30 alerts, right, which isn't a significant number, but it's still not a relatively small one either. Where does why I even start. This is a challenge that security analysts and teams face every single day, that's normal. And again, I only have 30 alerts today. It's very common that you have a lot more than this. This is where Attack Discovery comes in, right? Instead of having to go through all of these, I'm just going to go pivot to this new Attack Discovery tab. And you can see here, it's a nice, very simple interface because we've tried to make this as simple as possible. It's saying 30 alerts are going to be analyzed. This is, like I said, using generative AI, so we do need our large language model hooked up, which as you can see, I've picked my large language model up here. This is an advantage of Elastic, is we allow you to bring whatever model you prefer. Of course, we are the search AI platform, so we're going to be doing a ton of things under the hood, leveraging all the power of Elastic to make sure you get the best and most accurate results as well. And all you have to do after we select the model is press generate button. This may take some time because, again, as a large language model, it's still going to have quite a bit of data to churn through to give you these results. So I'll pause the video right here and then come back as soon as these results are generated, and we'll go through them together. Okay. So we got our results back. I'll take a look at this now. At the top, we have a nice summary of what happened. We had our 30 alerts and they were broken down for us into 4 discoveries, which means these are 4 active things happening within my environment, which I'm definitely going to want to look into. And what Attack Discovery has done is not only has it told me there's 4 discoveries, it gave me as much detail about them as possible. So just really quickly glancing over them. If I just collapse all of these here, you can see there's pretty much something happening on each of the hosts we have here. And it's given a nice title to these discoveries depending on what's going on. So anywhere from a malware attack on macOS or a ransomware attack, malware attack via malicious office documents, so try to make that title a bit descriptive into what it's discovered. I probably won't go through each and every one of them here, but let's just start with the first discovery. And take a look at this content. Attack Discovery has, remember, went through all the alerts, identified these attacks and correlated any behavior. So it's then easy for me to understand in one go. So we have a very nice -- very quick summary here, which describes the entities involved. In this case, we have this particular host and this user. You can see there's interactions for all of these as well. So I can open the existing host and alerts fly out, you might already be used to. So that's all something you have at the tip of your fingers. But let's take a look at this. So it said -- let me take a look at the summary first. There are multiple alerts indicating potential malware attack on this macOS host involving suspicious processes, credential -- potential phishing attempts and execution of untrusted code. The attack appears to be a multistage and targets an elevated user account. So immediately, I know, okay, this is definitely a discovery that I should be interested in. But then take a look at the details. So there was multiple instances of a suspicious process name, which is mygoapplication.app. They have these characteristics. The process launched -- the process failed code signature validation, indicating it may be malicious. And then the process attempted to execute this command. Then our processing script was detected -- attempting display fake system dialogue to potentially phish for user credentials, and it gives me the command line as well. A suspicious finding was then created with full permissions and then executed with these arguments, potentially attempting to access the users log in key chain. So perfect, what more could I want than this? We also have a really great visualization indicating the malware attack tactics over here. We can see the alerts, which were involved. So we don't hide those from you. If you wanted to pivot to the alert view, that's where -- the alerts that were involved in this discovery, you can. So we highlight all of this here and you get the same alert experience you're already used to within Elastic Security. And we also take it a step further for you. So typically during an investigation, the actual investigation part is of the job. We then have to start reporting on it. So we've tried to make this really easy for you, too. So with a couple of clicks, we can go to the state action menu and say, we want to create a new case with this discovery. So it can add to a new case, you can see it automatically populated the name there as well as the description. Let's just change severity, that's the only thing we're going to change and then create the case. That's it. Now if we actually take a look at the case, we not only have the name and the prescription, but we get all of that richly-formatted data that was in the discovery. And we get all the alerts attached that were included as well. So now it's going to be easy for me to just continue this investigation, bring in other members of the team, so on and so forth. I didn't have to spend the time doing a lot of this. Very similarly, we've made it really easy for you to continue to ask questions about this. So perhaps you might want to say, okay, fantastic discovery. How do I potentially remediate it? Well, let's send this discovery to our assistant. So I can simply click on the view in AI assistant button. You can see we get a new chat with the discovery name. We also get the actual content from the discovery. And now, I can simply ask the question about this. So like how would I remediate this, for example. And then the assistant is going to do its thing and give us a really nice answer there as well. And by the way, all the privacy features you might already be used to with the assistants are all available within Attack Discovery, for things like anonymization, field selection, you still have full control over that. So we've put in a lot of hard work to make sure that your privacy is taken into consideration. And like I said in the beginning, you have the choice of models to use here as well. So we haven't taken that away from you. And now you can see, the assistant gave me these really nice steps to potentially remediate this. I could continue the conversation if I want. I could also go ahead and add this to the case that we just created, right? Why not? Let's go ahead and do that. And now we have the remediation steps as part of the case. So we've really tried at every step to give you as much help as possible, thanks to Attack Discovery and the AI assistant. I hope you're as excited as we are. We feel this is a really revolutionary bit of technology that's now available to all users of Elastic Security, and we're only just getting started. That's all I have time for you today. Please visit our website for more information or perhaps go ahead and start the cloud trial, and I will see you next time.

Awesome. Thank you very much, Santosh and James for the informative discussion as well as the demo. We're going to transition this to a more interactive session now. So this is a discussion with our partner, Tyler Hopperton at AHEAD and to be moderated by Koji Ikeda, BofA Security. So Koji, please go ahead. And by the way, please send your questions to Koji at koji.ikeda@bofa.com or via the Bloomberg terminal. Thanks.

Yes. Thanks, Anthony. Thanks, everybody, for joining here. Tyler, thank you so much for doing this. Santosh, thanks for your presentation. Super informative. I learned a lot, so thank you so much for doing that. Tyler, so I've got a couple of questions for you. I've also fielded some questions from investors already. So lots of different areas to go. But let's just start from a big picture perspective. And to give the investors some guidelines for the next 30 minutes here, I'm going to ask Tyler some questions for about 15 minutes. And then I want to ask Santosh and Tyler some questions that I fielded from the investors out there and digging in a little bit more. So to kick it off, Tyler, just from a big picture perspective, what is your role and responsibilities at AHEAD? And maybe tell us a little bit about AHEAD to get a little bit more knowledgeable about who we're speaking with here.

Yes, definitely. So Tyler Hopperton, Director of Managed Security Services here at AHEAD. I am responsible for ensuring people process technologies that we use to deliver managed security services for our clients are the best they can be for them and that then we're ultimately delivering a quality service to them 24/7, 365.

Got it. Got it. And so you're a partner and you're a customer of Elastic. So maybe talk to a little bit about what was that journey in becoming a customer. And maybe some of the other challenges that you had with some of the other vendors that you may have used in the past and how Elastic helps solve you those pains.

Yes, definitely. So I -- since starting at AHEAD, the managed security practice about 5.5 years ago, my focus has been building enterprise-grade security solutions for our clients and that we deliver 24/7, 365. The cyber threat landscape as we just heard, constantly evolving. And while everyone was on board with digital transformation with IT and business, it seems, from our perspective, security operations was being left out or being left behind. So we wanted to build managed security service that would allow us and by extension, all of our clients to keep up with those threats at the speed at which business is now needing to operate at to stay competitive. And we needed a platform that could support that. When I started, we didn't have that. It became my mission to define how we get there and then ultimately, execute on that vision, which is where we ultimately settled on Elastic.

Yes, no, no, that makes sense. And you touched upon a little bit, but I just wanted to dig into it, because I think the partner aspect here is very interesting. And so what does Elastic help you do to drive certain outcomes for your businesses and ultimately generate business for AHEAD?

Yes. I mean, since that move and everything we've talked about and everything we just heard from Santosh, we have seen nothing short of drastic improvements in really every metric that we track from typical security metrics and coming to the business side and when we're talking at managed services. On the security side, we've seen a 73% reduction in time it takes to investigate those security alerts that are being detected along with a 92% automated resolution rate of those alerts, which really allows our team to focus on what truly matters, like cutting through a lot of that noise. End result, we're delivering an average of 6.9 minutes mean time to respond to our clients which is doing well for the industry in the managed security and general security response space. Again, flipping to the business side, all of that easily translates. And we see this in customer satisfaction survey scores to, again, client satisfaction as well as employee satisfaction and retention. Again, by eliminating a lot of that noise, focus on what's matter, what's important, Elastic is directly helping us reduce and eliminate a lot of times, analyst burnouts, which is a problem and not only just for cybersecurity internally, but especially in the managed security space.

Yes. Yes, no, I wanted to dig into that comment a little bit. You just mentioned 6.9 minutes for the mean time to response. Help us frame what that means. What's kind of like the best-in-class mean time to response? And sometimes -- I'm sure you've seen customers come in and you're like, oh my gosh, I can't believe this is your MTTR. I mean, what does 6.9 mean in the context of the security world?

Yes. So 6.9 mean time to respond, so by the time we and Elastic are detecting a potential security threat, our team, leveraging Elastic and all its power is going from we know about a potential threat, we've now investigated all aspects of that. We have that clear picture of what's truly going on, and we know what steps need to be taken in order to properly remediate that and then close it out and actually take those actions. So 6.9 minutes to go from we have a problem to we can go back to sleep at night.

Got it. Got it. I wanted to ask you if you could walk us through some customer examples. Of course, don't name the customers unless you absolutely want to. But just how are your customers thinking about using SIEM from Elastic? And maybe share a little bit with us of how it's being applied today and the value proposition, right, from Elastic. What is generally the most powerful things that are coming out of the Elastic offering as you're implementing the solution at your customers that is really resonating out there?

Yes. I'd say our biggest overall theme with Elastic, we've positioned it with our service to be in both the hearts and brain of everything we deliver out of our managed security service. Every piece of data generated by our clients with security contacts, as Santosh mentioned, from audit logs, network traffic, visibility, user authentications jumping to vulnerability data, threat intelligence indicators, all of that's ingested correlated together to make one platform for us and our clients to be able to quickly answer really any question they could ask about their security operations in posture.

So within software, one of the themes that we think about is time to value, ease of implementation. Is this thing going to be a painful 2-year process? Is it going to be -- can I set it up in the next 5 minutes? Walk us through with Elastic. I think it would be helpful for the investors on the call to understand specifically with the security side, how easy is Elastic to set up? I mean, is it generally easy to set up in most instances? Are there certain instances where it could be a little bit harder? And when you are speaking with your customers out there, how are they telling you or describing to you how fast they're seeing that value come through the Elastic solution?

Yes. And that's one of our bigger decision criteria as we were evaluating potential options and moving away from our legacy platform, was how long, how easy it is to stand up, manage, maintain, keep it running, keep it functioning from a day-to-day basis. We ultimately -- big decision on Elastic was it checks all of those boxes for us. We can easily and centrally deploy new clients -- new Elastic clusters, manage them, monitor them, maintain them all within AHEAD self-service manner. We work -- we have great relationships with Elastic as a partner, and we've jointly worked on new features, new ways to help us be even more efficient. And that's -- end result, there's -- we've got a lot of high-level automations really at all layers from day 0, day 1 deployment to, again, the operations aspect I touched on earlier. All of that leads to, again, very fast time to value for our clients, which ultimately is time to security.

Tyler, got an inbound here, and I was thinking about this, too. So you mentioned a couple of times you did have a different offering before Elastic. Could you -- you don't have to tell us the name of the vendor unless you want to but -- or maybe help frame what was that type of vendor? Was it a super old legacy security vendor? Was it more next generation? Was it an open source solution that you created that you were selling? I mean, what did it look like? And maybe what was the trigger for you guys to reach out into the market and see, hey, maybe Elastic that could be this differentiated solution for us?

Yes. So that platform, we did have was AlienVault AT&T cybersecurity at the time. And it was very much in that in that model, we were looking at, that legacy SIEM trying to get to those security analytics use cases. We found rate -- it's been designed and worked well with small -- some medium-sized clients with our focus on, again, speed, scale, everything we just talked about in being able to deliver enterprise-grade security services, ingest any type of data source a client may want to have. The AlienVault platform really wasn't able to be as flexible or as efficient as we needed it to be. Or just on the speed side, a query that took -- that takes an Elastic on the order of magnitude, seconds to return data in an active security investigation took, at best case, minutes with the AlienVault tool set. And that really wasn't acceptable to us or our clients when every second really matters in a security investigation.

Yes. Yes. Yes. And so maybe the natural follow-up there is, as you try to get off this AlienVault and look for a new solution out there, I mean, you could just go to Google and type in SIEM and a lot of vendors show up. And so what specifically from the partner lens is so attractive about Elastic? It's offering? Maybe it's pricing model, the brand, whatever it may be, there is something else there that helped drive that decision to pick up Elastic. And maybe help us walk through that.

Yes. So it's both for us. Elastic as a platform and Elastic as a partner, both great to work with. We're a very firm believer in Elastic's open and transparent approach to security, and everyone benefits if one organization benefits from a security perspective. So it's -- as defenders, we're always going to be at a disadvantage compared to the attackers. But Elastic's approach in the security space means everything they're doing and by extension, now that we're partners, everything we're doing helped to raise that collective bar for cybersecurity across the entire market. And then again, on the business side, the practical side, again, platform tool sets, capabilities, they were the best out of everyone we've evaluated. Again, the flexibility, the openness was big for us. But just out of the box, plug it in and hit go was already above what we were looking at in terms of valuations as well.

Got it. I'm going to ask you 2 more questions, and then we're going to kind of segue into investor Q&A that we fielded over the past 24 hours. And for the investors on the call, if you have questions, please feel free to ping me on Bloomberg, and we'll work in your questions from there. And so, okay, last two questions for you here, Tyler. Before that Q&A session, we just saw a pretty interesting demo, that YouTube video for the Attack Discovery and Santosh was talking about it, too. I am by no means a security expert. I mean it looked pretty cool to me, but a lot of it flew over my bald head here. And so it was just like, what is it about that Attack Discovery functionality that excites you about it? Are you looking into it as a potential offering for your clients?

Yes. Short answer is definitely, yes. We're always looking for new ways to bring value to our clients. And we're talking managed security value means quicker, more accurate time to detection and taking the appropriate and measured response to those cyber threats. Attack Discovery is allowing our teams to more efficiently link together, dozens, hundreds, thousands of alerts into a cohesive story that enables our team to understand what's going on and paint a picture for our clients, so everyone knows what's going on for a potential security threat and what we need to do to properly remediate that.