Honeywell International Inc. (HON) Earnings Call Transcript & Summary

Hi, all. My name is [ Dan, ] and I'll be your chief inflight attendant. Welcome aboard. On behalf of the crew, we want to welcome you onboard Airside LIVE Flight 2:30, Innovation and Privacy for IoT Device Data. We have turned on the fasten seatbelt sign, and prior to takeoff, we want to go through a few safety guidelines. First, we'll have a live Q&A after the presentation, and we recommend activating your microphone and camera for the Q&A portion of the session. To do this, simply use the button in the upper right-hand corner of your screen to share your video and audio. You will automatically be placed in the queue where you join us live to ask your question. You can also ask your question in the chat section located on the right-hand side of your screen, if you're a little camera shy. At this time, please make sure your seat backs and tray tables are in their full and upright position and take -- make sure that your seatbelt is securely fastened. Please set your portable electronic devices to airplane mode until the announcement is made upon arrival. So sit back and relax as I turn it over to our pilot, Muthu, Vice President of Enterprise Analytics at Honeywell. Muthu, feel free to take it away.

Thank you, [ Dan, ] for the kind introduction. Hello, everybody. Happy to be part of the conversation here today. Excited to share some thoughts around IoT data and governance and data privacy. This is a point of view based on our own experience at Honeywell, working with lots and lots of industrial companies of our size in the IoT space. And I would love to have a good chat at the end of this call about other experiences and questions in the area. So as we all know, just a small introduction, I belong to Honeywell's Connected Enterprise, which is our software arm of Honeywell. We are a big player in aerospace, as you -- many of you may know, in home devices, in process industries. Our software division is focused on building tools that make enterprise performance optimization for large industrials. And we have been doing this. You see our campaigns about Honeywell Forge as a platform, which is an OT system of record. We have quite a bit of installed base in industrial experience in this space and working IT/OT data. It is kind of why we're sharing some of these findings and the gaps in the marketplace today with the rest of you folks to also get some feedback. As you can see, we have our software products in IT/OT space, doing closed-loop process management in multiple refineries, oil and gas industries, like the predictive maintenance on APUs and flights. Over 60% of buildings in the world are connected with Honeywell building management solution and closed-loop energy management analytics. And we've got quite a bit of presence on cyber footprint that allows us to work with a wide variety of IT/OT data and especially the OT devices, and is challenging us and also giving us a lot of opportunities to innovate in this space in about managing governance, security and privacy in this new world of sensitive data everywhere. By definition, operational technology was never designed to work together. I mean most of the companies evolved over a period of time, especially you take an oil and gas company, they've evolved through a process that has not changed for many, many years. It's continued to evolve. And there are many, many operating silos within the enterprise where assets don't talk to each other. OT assets don't connect with IT data and the life cycles are very complex. And in terms of process, that is multiple processes and multiple facilities and they don't come together well. And so just the data aggregation in itself is a big problem that the industry is solving, the OT system of record, which is one of our solutions of Honeywell Forge is one of the attempts at bringing this data together at scale for our customers. And in the ever-increasing world of 7 billion-plus devices that's coming online, with expansion of significant amount of IT clouds, there is a massive amount of value to be unlocked. And every industrial customer, we speak to, are very, very curious on how to bring this here and how do we manage governance and privacy and compliance issues around these data sets, and what can we do differently to get a handle on the problem. So the -- what is the challenge? The challenge is let's start with what do we want to do as industrial companies. If you want to cover our data because the regulations are changing, and it is -- every country is updating their laws in terms of what data can be shared, cannot be shared, viewed, export control, ITAR. We're all familiar with the new privacy rules. With COVID also, there is a lot of health care data -- sensitivity around the data on private information. And then there is compliance to contracts in terms of what you can and cannot do that your customers dictate because they're reacting to their own data governance environment that they are part of and based on these regions we are part of. So all of that is for IT plus OT landscape seems very daunting. And on top of it, if you add the needs of GDPR rules that has very strict regulations around what you can and cannot do and take privacy data very seriously in terms of deactivating them based on personal requests, now you're looking at very fine-grained security access needed based on who you are, where you are, what you do. And it has to be applied across the landscape because we are integrating this data for value creation. And so by definition, integrating means all of this data comes together. And now we have to apply all -- every one of those 4 things at scale. So it's very easy to get a very complicated environment set up going and very long cycle times to implement. The systems of records themselves exists in multiple varieties, edge devices, where really the security focus in edge devices is about maintaining the integrity of the device operation. So there are many solutions that you would find it is easy. There is a reason people might get into your network, but even how do you stop them from actually malfunctioning the device or making the equipment work differently than they're supposed to. So the security is all focused around that process integrity of the edge function, which is very different from a security and compliance on the IT data set. And very, very different from the security and visibility needed to data created from your Zoom conversations and Slack and Teams and collaboration environments and your core ERP functions. So we've got this variety of systems of records that are coming together. You've got a lot of key capabilities that are getting more complicated on a daily basis. And if you just look at the types of data that this governance, compliance and security needs to be applied to. We have a range all the way from completely unstructured data to time series data, to event logs, to structure data to video and audio data as it's proliferating more and more. And so is it possible to have a holistic approach to all of these data sets in one place because it's -- we can talk all about OT security, but it is very tightly linked to IT security as well because the collection of both OT and IT is where the value is being created. And that has been our experience rolling out applications for our enterprise customers is then IT data marries with a little bit of OT or more OT data. There's tremendous amount of value and use cases being unlocked. So the ability to manage them cohesively is -- should be part of the strategy. You can -- don't want to have different solutions for different sets of these data and types of the data, which makes them very complicated. And that's kind of the approach I want to talk a little bit about today. So if you really think about the main consumers or where the need is coming from, we see 2 types of requirements of all of this data. One is all of this data from OT and IT combines from edge devices into an enterprise cloud environment and cloud is making it easier for the data to be accessed. And it becomes what we call the [ Uber staging ] environment because it has the flexibility to deal with a variety. Then people have coming up with concepts of data fabrics, created all of these complex data sets, data mesh. We call it OT system of record to begin with and marry that with IT. So there's different terminology, but they all mean we need an [ Uber ] environment where you have the ability to stitch this data together for the use cases that you want to apply to. And the consumption happens by virtue of applications on the cloud that are going to use this data and give you back insights on ROI or by ad hoc teams, your own data science and analytics teams and the employees accessing this data for insights on a daily basis to get value out. And it is very important to design the governance, compliance and security, not only for both sets of that usage at scale. And there is -- we found it to be very useful to kind of solve for all types of data as opposed to solving for individual types of data. So what are the key stages that we have realized as important is as the data from OT edge devices comes through, it usually goes through a process of tagging first in terms of the time sensitivity, it gets through tagging and there is an intelligent amount of data extracted from the OT of what is needed. The unstructured data goes through a 2-stage process in terms of extraction of key information and context plus tagging. The IT systems data simply comes into getting mapped. But in the end, they all come into 2 different spots. In most companies today, the strategy is to get them into a data schema that is renormalized and is helpful for multiple use cases. And more and more companies as we see, including us, find very useful to create what we call as enterprise operational knowledge graphs, which captures the relations and the behaviors between these data and the assets so we can actually better apply AI to that. So that layer of what we call as intelligent ELT creates that cloud from layer. And there are a couple of solutions evolving in that space, but it's a very, very important pillar of how that is orchestrated for your company uniformly. And the second layer is once that intelligent ELT layer is created, there is a need for automated profiling of data for privacy and governance and compliance rules. And this is a critical intelligence and we found this automated profiling here to be very scalable, if it is spanning all of the data types and not just applied for IT or OT separately because the lessons and the learning that the AI engines have in this layer is very important. And the more context they get, the better they are at profiling. But it has to be automated because manual profiling or semi-automatic profiling is just not scalable. And solutions around this particular layer is essential for the next level, which is then once you profile and say something is private, something is sensitive, how do you have the ability to automatically quarantine that data, but make sure that it is actually exposed only to personalities that have access to it with a unified fine-grained access control across the different data sources. Now that's a very easy thing to say, but it is actually the product like we see Okera right now and there is a few other products coming into market. They're starting to address this problem holistically where you get a unified fine-grained access across different data sources. And -- but the ability to automatically quarantine is equally important as we have found because you don't want sensitive data to be there and not governed and ensure that it is actually tagged and quarantined until somebody reviews it before it gets available to the security layer. And then the consumption happens in the app as well as the business systems. So the key lesson that we are seeing here is each of these 3 pillars have multiple solutions in the market. The broader the scope of each of that solution is to the types of data, the better off we are in terms of the architecture. So what do I mean by that is you can have an automated profiling data privacy tool for OT edge data, but it is actually better if you can have the same solution be extended for your IT and unstructured data. Same way people -- it is great if you have an automatic way of quarantining assets in your data lake, which is possible today with many tools, but it will be even better if that automatic quarantining works even for your stream data that's coming from OT and is able to work with your other data sources that you have in the landscape. So the broader the -- for each of the people is a broader the solution is in terms of coverage of data types, the better off in terms of outcomes and the simpler the architecture. So a quick view of what are the different products that has to be implemented. For the integration layer, it's easy -- there are many solutions coming to market. We call these data liquidity engines, which, again, these are AI-based. We are all used to data integration projects that runs for many, many years. But we are already seeing products including we have developed our own products in this -- in this area, where we are able to integrate IT and OT data in a matter of 4 to 6 weeks, sometimes in most cases, less than 10 weeks. Even if they are disparate sources of information, they can be married automatically using AI into a schema that's actually very usable. So that AI-based data liquidity engine helps you bring -- build that cloud layer first. Follow that with an automatic AI-based data profiling engine, we see quite a bit of products in the market doing this well now in terms of recognizing incoming data. But they don't -- I'll talk about what they don't do well today in the next deck. But there are products emerging in this space. The quarantining space is about consistent policy enforcement. So you need a product, either it's part of your data profiling product ideally, but it could be a separate product. And in itself that connects with the data profiling product, but you need one that can be used to consistently quarantine data where you think is sensitivity and compliance issues are raising automatically. And in the fine-grained access control that all of you will be familiar with because it's across sources. And you also need a tool set to make sure that all of the events all the way from the profiling to the final access is audit trails are created across the ecosystem and preferably in one space, one spot uniformly and not 10 different spots. And then dynamically being able to scale this entire capacity for whatever volume we're anticipating in the future. So that is kind of the framework we think is useful going from the OT devices to value creation where you will encounter IT data sets by definition, and how do you actually design something holistically for both areas. This is kind of an industry based on our experience, we've looked at a lot of products. We've used a lot of products. We have created our own solutions to bridge the gaps in Azure, Slack, AWS and others. And we actually think that the mature products for AI-driven liquid engine emerging very much. Fine-grained access, you will find quite a bit of products in this area. And also for the audit trails, you have multiple solutions that you can evaluate. Where we really feel there is a lack of solutions in the market today is really building context -- contextual data around OT on the data profiling side. And it is fairly easy to get profiling done on structured data sources today. The OT data profiling are, especially for privacy and additional contextual. So what happens is in the OT world, I can bring it up, product information, but when I marry that information with my bill of materials, it actually becomes much more sensitive. So sometimes what happens is it is not the single data element that actually creates a sensitivity level. But a combination of data together, like a personal data from my device, my device ID with my name, with my health care data is a lot more sensitive than just my device ID on itself. So what we don't find good solutions for is that handles this complexity around context-based sensitivity. There's not enough solution that do the job well, and there is not enough solutions that can be trained to do that well, and we have built some custom solutions on our own to do this today. And you also don't see a lot of great solutions for automatic profiling of video, audio data for compliance and sensitivity in terms of publishing and quarantining. And the automatic quarantining is also not robust in terms of extensive ability to apply the same product across multiple sources. We are able to -- we have auto quarantining products for data lakes, and they work very well. But they don't work for the time series data that we have. They don't work well for the document data we have. So there is a need for these tool sets to expand into additional data drives and data sources, and that is where we see the gap overall. So with that, I think, hopefully, that gives you a framework of how to approach the solution. The good news is there is not a lot of different areas you need to tackle. I think if you go through the 3 pillars and ensure that you pick the right product for each of those 3 pillars and has maximum coverage in terms of span, you will be able to get most of the governance, compliance and privacy issues sorted out for the evolving landscape. With that, I think we can go to the Q&A.

Thank you, Muthu. That was wonderful. We appreciate you sharing your insights. I thought the key designs and the key stages were very interesting to see and be presented out in front. So I did see one question that came through. And while we're going through this, we welcome others to either join through the video and audio button in the top right-hand corner or through the chat session on your bottom right. But one came in from Spencer, and he asked how does Honeywell execute the data classification and tagging?

Yes. So it's a great question. So we actually have -- in data classification, we actually have our own -- in the Honeywell Forge platform, we've got an integrated data science environment that we have been able to develop algorithms to train on our name entity recognition in our enterprise. And we have been able to successfully integrate them with the big data security tools. That's -- as an example, Okera is one of them, privacy is another one, where we're able to feed those tags into those environments, so they actually then watch for those data elements to come in. And when they show up, they are actually able to automatically quarantine them and wait for approvals before they get exposed to the users. So that is one of the ways that we're doing. And as I said, that most of the solutions that we are finding is having our ability for AI engines to recognize our own internal data and then combining them with the tool sets that's available in the market.

That's great. That's great. Any other questions for Muthu while we have him? We have quite a few extra minutes here. I see another one just came through. This is from [ Dev ]. And how do you implement automated quarantining?