HP Inc. (HPQ) Earnings Call Transcript & Summary

I think a lot of large organizations of the government have done a lot. I mean they really have. Obviously, it's a huge industry. A lot of monies are being spent. They've got the technical acumen, they've got the will to get it done. I think the challenges start as soon as you let me, the user, click on something, right? If you think about all the layers that are put into place, enterprises have been preparing, and they've been let down over the -- 3 decades. We didn't do this for 3 decades, right? And for 3 decades, they've been implementing architectures that say, today, I know I've got a problem. I'm going to buy a solution that solves for that problem. But architecturally, were they robust enough to survive 5, 10, 15 years? And so a lot of enterprises have been expanding a tremendous amount of their limited budget on trying to solve the problems that we know today. I mean, every vendor, all of us have these wonderful slides that show these are the things we protected you guys from, right? Everything that's known and understood and rationalized. And by the way, sometimes we're able to guess if something bad shows up that doesn't look like the stuff we've seen in the past, right? But how effective are those, 92%, 93%? These are the numbers you're hearing in the industry. So the challenge is, how do I put in a system that says, well, when you make that decision at the time you purchased the product, you bought it because architecturally, it is robust, and it can provide you that extra slide, well, we don't yet know the names of the attacks. We don't yet know what is yet to come, but it can still provide the protection because architecturally, it's a modern way of reducing the amount of risk potential to that endpoint. And I focus on the endpoint because 90% of the time, it comes to be at the endpoint.

So then what are the steps that organization should be taking to address these challenges?

Well, I'm on the record, too. Okay.

I didn't -- never said I wasn't going to put you on the spot.

That's right. That's right. I think the large enterprises and large -- the governments of -- that we work with, they're making the necessary steps. They are evaluating what are those modern ways of advancing and transforming their overall enterprise. And I think that's the first thing. The first thing is, what do you do and what keeps you in business, protect those assets dearly, right? And then how do you extend the same level of protections down to your users? I think that is happening. I think where we could help and I think where -- when you ask, are enterprises ready? Let's qualify the size of the enterprise, right? I think the real pain is being felt by the SMB market, right? The small and midsized market, they're in the business of producing something or they're delivering a service of some sort. And quite frankly, they may not have the means to hire 500 cyber experts that live around the world, doing nothing but reviewing the posture of an enterprise. They may have 1 person that has to carry the burden of IT and networking and securing and the like. And that's where I think -- one of the things that we've been working on is how do we take what we've learned and delivered to the enterprise and deliver that as a service down to the small and mid-market. And I'm seeing a lot of traction where a number of us out there that are actually trying to solve the cybersecurity problem. And we do it in a novel way, in a very differentiated way. But we're realizing that the large enterprises, they make decisions -- they put a lot of thought into it. And they have a lot of experts that can help them with that decision. And they evaluate, and they will run it and test it and make sure it operates in their environment. But how do you solve for the small and mid business, which today is suffering? Let's remember that for the past 3 or 4 months, their #1 objective was viability, right? And so now the question is, can someone that is a small and midsized business, a few hundred employees, they are doing everything they can to maintain their livelihood, the livelihood of their employees. Do they have the resources to hire a very expensive cyber expert or do they just look to an HP with what we're doing for Proactive Security around, hey, I'm going to ask you, you're experts in this, you understand endpoints, you understand how all these things work, you have technologies that work, let me just offer it as a service. And so your question is interesting because I think the large enterprises, they suffer, right? They're not -- they -- back to my earlier comments about when they bought the technology, it's sort of a whack-a-mole, right? Like I bought this thing and I'm going to try and I'm going to hope that it works in 2 years from now, which is why we've seen a cycle where it went from 10 years ago, the browser was the ultimate killer, right? The browser was bad, and then it was PDF. And then we were starting to see this move where AV wasn't cutting and you moved to a next-gen AV and then EDR and the like. We've seen these evolutions. Same architectures just on the back end, they've got more brains behind, other cyber analysts or they're looking at the cloud, to be able to enhance the overall visibility. But the reality is SMB, they may just be thinking about, I want the bare minimum because that's all I can afford. I don't have the expertise. I can't afford all these great technologies. And so maybe the large enterprises have the funding and the budget to make decisions every 2 or 3 years because their business has changed and their threat landscape has changed. But the SMB market, personally, I'd like to go focus a lot of time on the SMB market because I think that that's where -- they're struggling, let's help them, let's provide the expertise. Someone like yourself who has been doing this for so long, you understand the market, you understand the technologies. You know all of us out there that are trying to [ vie ] for business and make a difference, absolutely. But the SMB market, do they have the resources and the access to be able to make those decisions or shouldn't they be looking to experts to help them with those decisions and just implement solutions where they know my user isn't the cybersecurity decision-maker, my systems are protected as best as they possibly can. I've got the visibility into what's been affecting me in real-time, and I can continue on with the work. We have this -- we have a number of customers that call us and say you saved our bacon again. And that's not exactly the word that they use, but that's how they look at it. And they were saying, we were hit by [ MITM ], we were hit by ransomware, we were hit by all these things. Now for a large enterprise, they've got a number of systems and backup and all these things that will save them if something happens, right? But think about a small, midsized company that is going -- they're making that transition to the $100 million of revenue or the $500 million of revenue. They are growing. What would happen if all of their data were out in the street? You know as well as I do, they don't just encrypt the drive when they hit you with ransomware. They pull everything off the drive. And then they encrypt, right? So all of your personal details and your corporate IP and the like, they're all sitting on the street there, right? What is the impact there? And that's where I think we, as an industry, ought to be looking and delivering solutions that actually support the largest percentage of businesses. We all want the large enterprise, but -- don't get me wrong. But the biggest percentage of businesses out there that have these challenges are in that small to midsized market. And I think that's -- if we, as an industry, look to them and said, look, we got it, we're going to help you out. We're going to provide you with technologies that stop [ MITM ], stop the ransomware and stop all these attacks. And we're going to do it as a service. That then goes to the digital transformation, right? People are moving to as a service, people are moving to cloud, people are moving to modern architectures. And the small and mid business aren't going to be looking at AI engines and the like. What if they found a company that did? I think that's where companies are -- if they're prepared or not, I think that's the conversation which you're going to have.

Yes. And not for enough on a side note, all those SMB businesses, they're the partners -- business partners of big enterprise businesses.

That's right.

And that's that vulnerability channel right up into the large enterprise that the adversary is trying to take a hold -- advantage of.

How hard would it be if I'm trying to get into -- pick any large enterprise. And we know they spend. They have a $0.5 billion budget a year to keep that enterprise lockdown. If they have a -- to your point, a provider, a manufacturer support team. They have a law firm. If I want to know what someone's doing, I'm going after the law firm.

Yes. Yes. Exactly.

They're involved, right? And so as much data as the adversary has right now, who does Bob bank with, who does Bob -- who's his lawyer and all that? I'm going to go target them because Bob is an expert.

Yes. So one final question then. When you look at all the things that we've been discussing, how is HP helping to address these challenges?

So I came via an acquisition back in September. And when I was looking at the acquisition, I was trying to figure out like, okay, where do we land? And within days, weeks and months, I realized that actually, HP is a security company first. And I mean that when I say it. Think about the sheer volume and velocity of investments around platform security, around hardening their endpoints and their printers. And you start looking at as a security company and then they deliver their products. Now they don't -- people aren't looking at HP as a security company, but everything they do starts with call it that root of trust, meaning I understand the security posture of this device, and I'm going to maintain the integrity of that device. And so what is interesting is we at HP now are saying measure boot with a trusted BIOS. And let's make sure that device actually delivers at the time you're booting the machine, so Sure Start. When you start looking at if there is an issue, they've designed in this solution called Sure Recover, where within minutes, we can revert back to the known good image where even if the device is fully encrypted, we can undo that or Sure Run, which is one of those things that we all as the end user community adore, you want to turn something off. Well, your enterprise doesn't get by design, but Sure Run, which is designed in can do that. What we're doing with Sure Click Enterprise in terms of we stopped all those attacks. And we provide real-time isolation and then real-time identification of the entire kill chain with all the telemetry and the binary. So when you start looking at what enterprises are needing, back to my very first point. They need audit, they need control, they need visibility, the integrity of their enterprise. Those are the 4 things. By design, we've built those into the devices. So when we ship the devices, they're getting all these technologies. Yes, some of them are licensed, and there's some additional components to it. But for the most part, back to the SMB, back to those small businesses as well as some of the large enterprises, a lot of these technologies that we're delivering, we're delivering design into the device when we ship you the device. And that is a huge step forward, whereas before, we think 5 years ago, if someone needed to measure the boot cycle of a device and then actually take measurements with TPMs, all the dock we were talking about, what, 10 years ago, we were talking about TPMs, right? And there's no way of actually understanding was the BIOS modified or not. Well, now we actually -- we ship these devices with these technologies. And so I think we've seen an acceleration of capabilities because of hardware. We've seen the growth and explosion of cloud because of hardware. HP has taken hardware-based security and platform security seriously. And that's why I said HP is a security company first, where we're delivering these solutions, we can deliver out of the box to our customer [ set ].

That's great. So Sherban, thanks for sharing your insights with us. It's always great to catch up with you.

Looking forward to seeing you again in person.

Absolutely. Take care.

Take care. Thank you so much.