Information Services Group, Inc. (III) Earnings Call Transcript & Summary

Good morning, everyone. Welcome to Lookout and ISG joint webinar on Rationalize IT Spend to Optimize Cybersecurity Posture. I am Jolene Goh, Sales Manager from Lookout. Let me do a quick introduction of our speakers and the company they represent before we got into the webinar. Our first speaker is Don Tan from Lookout. Don brings with him over 17 years of technical, sales and management experience in the cybersecurity industry in Asia. He currently holds the post of Senior Regional Director, where he is responsible for the business in Asia Pacific region. Founded in 2007, Lookout is focused exclusively on mobile device and mobile app security and is a founding member of Post-Perimeter Security Alliance. With 190 million users globally and having the largest corpus of analyzed mobile codes in existence, Lookout is the market leader in the mobile security space. Our next speaker is Deepraj Emmanuel, Director of Asia from ISG. Deepraj has extensive experience in successfully driving differentiated strategy and execution for some of the largest initiatives in Asia, focusing on helping organizations plan and undertake a risk-averse approach to large complex technology-enabled business transformations. ISG is a NASDAQ-listed leading global technology research and advisory firm founded in 2006. They focus on helping companies achieve operational excellence and faster growth. It's trusted by 75 of global top-100 enterprises, with 1,300 professionals across 21 countries. For this webinar, we have prepared some interesting topics for you. We will go through the world as we know it, the future, where -- just give me a minute, sorry. I think I jumped a little bit too quick. Sorry, let me go back to this one. So for this webinar, we have prepared some interesting topics. We will go to The world as we know it, The new future, Where do we go from here? And at the end of the webinar, we will provide you with some key recommendations as a takeaway. We will have a Q&A session at the end of the webinar. Hence, if you have any questions, please feel free to put them into the question box, and we will answer them at the end of the webinar. Without further ado, let me hand over the presentation to Don.

Thank you, Jolene, and a warm welcome to everyone on the call today. I know you have many choices and selections of webinars you can attend, and we are delighted to have you join us on this call.

Very warm welcome as well. Thank you so much, all of you, for coming to the webinar. I really appreciate the time that you are giving to us today. So Don, how have the last couple of months been for you?

Deepraj, it seems like the current situation with COVID and lockdowns and generally just the complete halt to the economy has impacted all of us at all different levels. The virus per se has wreaked havoc throughout the population and economy. And it kind of changed the world we know it. The world today seems a whole lot more volatile, uncertain, complex with tons of ambiguity. And as much as on a personal level, I think this has caused quite a fair bit of anxiety, both for individuals and businesses. So I think this is a fair statement that most of us can relate to.

Absolutely, Don. So as we look to the current shelters-in-place, we look at things opening up. A lot of it is now starting to sink in. A lot of people are getting accustomed to what has been widely now defined as a new norm or the new reality. I think what is important is to really sort of focus on whether this is something that is here to stay.

Again, to that point, Deepraj, I think, like, all life-changing events, if you remember, SARS back in the early 2000s, 9/11, how that has changed the travel industry, introduced new regulations as we crossed through immigration, I think COVID is going to be a big life-changing event. There will be definitely certain elements of it that will stay. And I think what will happen is, it's definitely going to redefine how we live and coexist, whether is it between social interactions, between friends and family or business communications and even, for the matter of fact, how we learn, right? And I think one of the biggest sticking point, the biggest issue that most of us face is I think it's a lack of clear separation between work and life, right? What used to be a 30-minute to 60-minute travel to work has now become a 3-step process from your bedroom to your study. And again, this has brought forth a whole lot of convenience as well. Having the ability to work from home now then allows us to also adopt or accelerate the adoption of a lot of these new technologies that are out there. It has redefined what it means by eating out. We kind of order out and then eating in, right? Of course, it has also made it so much more convenient when it comes to buying daily necessities or just essentially quite a luxury item.

That is really interesting, Don. I mean I think, fundamentally, we also need to examine whether this is setting a new global culture.

Well, as I said earlier on, right, I think COVID-19 is a life-changing event. Most -- some experts are saying is once in a lifetime. But there will be certain elements that will ramp up emphasis. But I think the biggest question is, is this -- is everyone really worried? Right? At various levels or, I would say, at various age groups, what you're going to have is the fear of change, as the older part of the population tend to resist things from happening and learn something new, but I think what COVID has really done is to kind of throw us off the deep end and give us the push needed.

And Don, do you think that this basically affects how enterprises are also behaving today?

Deepraj, that's a very, very good question, I think, top of every executive mind and all management today, as they think of how lockdowns today have brought the economy to a complete halt, and this is something that has never been seen before, how it's impacted earnings from a top line perspective and how companies are trying to strive to see how they can accommodate this falling top line. Executives are currently thinking hard to see what they can do to spend less and still remain competitive, right? And I think one of the key things that is very different from what we have seen over the course of time is that one of the key pivots we have is cloud and mobile technology and that might just be the silver bullet that we need, right? For years, companies have been dabbling with a motion of allowing employees to work remotely and giving them the necessary flexibility. Pressured with cost reductions. I think this lockdown gave the push that most companies needed. The pandemics have kind of shown that companies can operate effectively virtually with no physical footprint. And they're starting to realize that -- and think that -- do I really need expensive real estate in order to function?

That's interesting, Don, because then I would say that the social experiment that you talked about earlier has not become a pretty big enterprise experiment as well, correct?

Exactly. It feels like this time that most of us don't really have a choice, whether be it individually or from a company perspective. And I think that this will redefine how we work and play. But I think what I wanted to know from you is based on your experience and the customers that we have been talking to in the industry, what do you think the future holds for us?

Absolutely, Don. So fundamentally, what we see, I think this is something which I personally do believe we will overcome. This is just another bump in the road like there've been so many. I'm hoping against hope this period of the pandemic will come to an end. But I think what we need to definitely focus on is the fact that the culture that is being established during these times might definitely stay. And that is something that we do need to adapt to. We need to be able to align to what is the new world, the new norm looking like.

Right. And I think you're right. If you remember earlier on in the previous slide, I talked about how cloud and mobility might potentially be the pivot point. In fact, the trend has been around for a while now, at least the last 10 years. It has kind of laid the foundation for us whereby most companies have some shape or form of their data in the cloud, if not all. And again, from a -- this is not something that's broad-based. You see the smaller companies starting to adapt to this more aggressively and much larger organizations starting to accept this, right? From a user perspective, you then have users now spending more time on their mobile devices. And this has accelerated tenfolds, especially during this period. And you see utilization of mobile device has now become the focal point of life, right, not just from a personal aspect of things, but from a business perspective as well. And what's really scary is these devices are exclusively connected through a shared medium. What that means is that unlike the traditional cable to PC approach. There's not really cable that you can plug to your phone. What essentially this means is that the corporate perimeter has disappeared.

Sorry, did I hear you right? Did you just say that the corporate perimeter had disappeared?

Yes. So this has been happening for a while now. It's not something new. And the hackers and the bad actors know about this, right? And this has been reflected in the exponential growth in mobile-related incidents that we have seen in the last couple of months, right? So how we look at things is, we believe that the world we live in has changed. We have been changing for a while now. What really set the ball in motion was when BlackBerry first introduced the phone and then that kind of accelerated later on with the introduction of the first iPhones, right? As companies started embracing mobility, they have kind of evolved the way they interact with their users, trying to drive more efficiency, productivity by giving them the ability and flexibility to work from anywhere and any place. And what we have also seen, right, interestingly, in the last couple of years, this effect has also trickled down to how businesses engage with their customers. In fact, I believe that we are now living in the pit of the next digital revolution whereby we are experiencing broad-based growth and adoption and consumption of mobile technology, right? And you are even seeing -- and for the first time ever, you are seeing companies that have appeared that are exclusively on a mobile device. What I mean by that is that we are exclusively interacting with their customers and engaging with their customers through a mobile application. The likes of whether be it Uber, Grab, Foodpanda, and, of course, there are some more to come.

But that sounds like quite a good thing, isn't it, where all of these different facilities are available to a lot of different customers. Is there something -- is there a reason why you're actually highlighting this specifically?

Yes, you see, Deepraj, the problem is this, as companies chase revenue, the big focus of any company essentially is to make money, right? And I think you can agree with me on that. But the focus on the business is to make as much as I can. But unfortunately, through the mad rush, as they start adopting technologies that can enable and drive their business, security has always taken a backseat, right? That means that I'm not going to do anything until something happens. And most companies fail to understand that this initiative has exponentially broadened their cybersecurity risk surface. Traditional legacy security policies might no longer apply, right, because we have always -- from a security standpoint, companies have always built a layered approach. And the main goal of focus and the main goal of protection behind it is always that main walls of your office or your company, right? And it's always under the notion and assumption that users are going to be protected behind these layers of security there have been. Failing to see this early might be implications that might later lead on to something much bigger. And so let's take a quick poll and kind of see what our audience thinks about this. All right. And the question is, do you have security software installed to protect your mobile devices, whether is it personal or corporate-owned? And Deepraj, as we wait for the results to come in, based on your interactions with some of the biggest companies in the region, how do you see the impact of corporate IT spend versus security rationale?

That's a very interesting question, Don. Fundamentally, I think there has been a significant change in behavior in the way how a lot of corporates are actually aligning their security spend in line with their overall IT spend. I think, fundamentally, a lot of companies are being very careful. There is a lot of pressure on driving excessive cost savings. But maybe it's important that we sort of look at this with a wider lens and maybe look at some of the key behaviors that we're seeing globally and in the region as well. So this is really interesting. I'm looking at the poll results. And effectively, I think, to answer the question, do you have security software installed to protect your mobile devices, 60% of our audience today have said no, and 40% have said yes. And you see, this is very key because it sort of just reinforces some of the points that you were making earlier, Don. There is a whole lot of focus on trying to make sure that the way of moving forward is to be able to survive, to save, to be able to scale the storm. But then I think the question really is, are we missing out on some of the key elements that do require focus from a security and from a risk posture. So I think what would be very useful is if we could actually just maybe get onto a bit more detail on what we are seeing with a number of different organizations at play. The bigger picture is that the focus is to survive rather than transform, and the focus is to be able to have reduced IT spend across all sectors, some very excessive, some trying to still sort of run their core functions. But what we've seen is that, to a certain extent, there could be certain perceptions that are driving decisions being made. And when that actually is quantified to be able to determine what is essential spend, then sometimes the focus just becomes to reduce cost. It's not necessarily to look at new business models in the wake of the current global crisis. And effectively, I think while we are looking at a number of employees and customers being empowered digitally to access their core functions and perform their duties, the consideration of the risk factorial, that is at a minimum. I think this is something which we are seeing constantly. Is that something that you're seeing as well?

Well, we know that organizations are cutting down on nonessential spend. And this has impacted different industries in different ways, some more than others. But from across industry's focus perspective, I think, on cost reduction, different behaviors do drive different kind of activities. But based on your experience, Deepraj, do you think this approach is effective, especially in this new world that we live in?

So Don, what is really interesting to note is that when you look at how this particular approach actually works in the current global scenario, a couple of interesting points to highlight. Companies are, as you saw on the previous slide, looking at significant targets of cost reduction. And that might actually definitely help the balance sheet to look better, right? And it might appear as if you are able to sail the storm, there is continuity, and we don't disagree with that. I think the fundamental question, however, is that is it just about the cost reduction right now or is it to still be able to grow, be relevant to customers in the long term? So surviving the storm is one absolute focus point right now. But then most of the approaches that we've seen with a lot of customers tend to being more short term and these approaches can hamstring business growth. And if the optimization of the short term is not coupled with the long-term transformation in mind, then there's going to be a significant impact on a number of companies on their competitive edge that they present to their customers today.

Okay. But if I just stick this from a personal point of view, right, like stick myself, for example, I would always go -- especially during the situation right now, I would always go and look for the best [ in the town ], right? Most of us -- or most -- maybe some of us might not compromise on quality, some might. Do you think this is something that the enterprises are also doing?

I believe a number of enterprises are doing this. And when enterprises do this, the effect is multifold. It can cause drastic outcomes, not -- we are not painting a broad brush here. We're not saying that every organization actually has -- is under the same lens and has the same practices, but I think we do need to look at the current behavior of a lot of organizations that we work with.

So you are saying that enterprises are doing this, and this is a pretty strange phenomenon. Are you saying that this is something that only impacts the smaller guys? Or this is something kind of across the board?

So Don, what is interesting is that I don't believe it is to do with just the size of the organization. I do believe that it's really the nature of the people, the decision-makers who are basically executing some very key decisions as part of scaling the current storm. It's human nature to react. I think it is definitely more well thought out process to be able to respond to something after sufficient factor has been considered. But what we're seeing in a number of cases is what is called the heat-of-the-moment focus, right? So we see significant impulsive spend to be able to take care of specific use cases that have actually been paused because of the COVID situation. There is an adequate focus on the risk that some of these decisions might actually sort of bring in, and there's obviously an extreme focus on cost. But I think what's extremely important is that organizations need to avoid doing something like this. I'll give you a good example. Very recently, we were talking to one of the key large enterprises that we actually deal with almost on a monthly basis on a number of different engagements. See, they had their security posture pretty well lined up in the traditional set of what they were doing. And within 2 weeks, I think when the directors actually came for employees to be accessing confidential company information remotely, they had to buy a whole lot of VPN licenses because the number of licenses that they had in the past was not equal to the number of employees. Now whether it was the right or the wrong decision, that is subject to talking to the decision-makers there. But fundamentally, I think what's important to note is that a situation like this has actually taught us that we do need to keep the alignment to the security posture pretty close to heart, and the focus is not just to keep the lights on, but to be able to actually look at it more holistically. I wonder what enterprises should also do to be able to avoid something like this from your perspective.

You see, Deepraj, the thing is this. As your -- in as your slide, as you mentioned, in the heat of the moment, right, a lot of time, anxiety drives emotions, right? And we fail to contemplate what is going to happen in the mid to long term and kind of just look at the sky above the -- where we are living, right? I think it's very important. And this not only applies to whether it's your security posture or what you intend to do with the business per se, right? But before planning a journey or before embarking on a journey, I think it's very important what every one of us need to do is to kind of pick a destination because how I look at things is that you have to know where you're going to go before you can plan your journey there. And a lot of organizations that we work with do not really consider security as the risk, at least not during the current crisis. As you said, most of them are in survival mode. And it seems to me that the focus on security posture is really -- came down a notch. The priority is not as high as it used to be, especially during times like this.

That is very interesting, Don. I would assume that it should be exactly the reverse because organizations would definitely focus on the security posture in these troubled times. So why don't we do this? Let's go and ask our audience on what they think. I think it will be great to maybe just look at another poll question. And the focus of this is to really sort of look at whether you believe that the IT spending that you have in your organization today, the nature of it, the way how it is being done in this particular time might compromise your security posture. Even as our audience actually complete the answers to that, I think it's important to note it's not just a general behavioral question, where the security posture figure as an important part of what is happening in your organization. I think it's something to do with the focus on this current time because a lot of behavior has definitely changed. So we've got, again, some very interesting responses. I think we've got 75 people -- 75% of our audience who believe today that the security posture is being compromised, 25% believe that it isn't, actually. And that is something which, I think, we do need to discuss more. Don?