Johnson Controls International plc (JCI) Earnings Call Transcript & Summary

And welcome to this critical session here, Davos 2025, the 55th year of the World Economic Forum. The crisis, the confidence in cyberspace. That's the mission of the 45 minutes we have together. I'm John Defterios. I'm a senior fellow here at the World Economic Forum. I'm a professor of business at NYU, Abu Dhabi and I spent my last 10 years of my time as a correspondent with CNN as emerging market senator based in Abu Dhabi and the connectivity we see from the Gulf here to Europe, United States and obviously, Asia. We want to welcome our viewers on the live stream here or watching. This is an excellent session because in the last 2 years of the Global Risk Report for the World Economic Forum, we've seen that the cybersecurity and cyber threats rank either four or five in the world rightly so. But I would say, as a former journalist, it doesn't earn its fair share unless there's a crisis that happens. We kind of think it's business as usual, companies are ready to respond, but with the on-take of artificial intelligence now and then over the next decade and then phasing into quantum computing, it's going to be more of our common vernacular, and I don't think the world is ready for that, and we want to redress what it means. But at the center of our discussion today is not only dealing with cyber threats, but it's also the impact that cyber threat does have. And then obviously, what impact it has potentially on a brand and reputation going forward. I want to thank the team that runs cybersecurity, the World Economic Forum. I've had a chance to work with them for the last 2 years. They hold an annual gathering for themselves in November. They put out an outlook report in the last week, and we'll make reference to it here in the discussion. If you'd like to do social media and provide some feedback here on this session, the hashtag is WEF25, and we're going to be taking questions from the floor about 15 minutes out. We invite those watching us on the live stream to do the same. Let me welcome George Kurtz. He is the Chief Executive Officer and Founder of CrowdStrike, Inc. Welcome to you. Öykü Isik is a professor of Digital Strategy and cybersecurity at IMD Business School. She focuses not only on the response by leaders in the cyber space and technology, but also the impact it has on brands. So it's great to have you. And George Oliver, Chairman and Chief Executive Officer of Johnson Controls. The two of you, G1 and G2, as I said in our pre-meetings, have dealt with major cyber incursions, and they've learned a lot through that exercise. I'm going to ask them about it, but also they can share their leadership and what was required after having a cyber threat. And Öykü, it would be great to have you weigh in on what it takes to be a leader today and how much should be devoted in terms of time and attention to cyber and then what impact it does have on our brand. I think it's a phenomenal topic that they've undertaken here. To provide some context, we have a cyber report that was put out in the last week here for the World Economic Forum. And they also did polling from that cyber security gathering that they had at the end of 2024, which I'll make reference to for those watching on the stream and here and live in the audience. I want to reference a recent report from the World Economic Forum in collaboration with the University of Oxford. It defines cyber resilience as the organization's ability to minimize the impact of significant cyber incidents on its primary goals and objectives, and we can bring that graphic up here. And what we're looking at here is the incident absorbing it as a chief executive or as a company and then the recovery. You can see that the recovery stretches out almost on a flat line here. What we're looking for and what I'd love to glean from the panel is like that V-shape recovery, the preparedness, the resilience that you try to build into an organization here. And I made reference to the global cybersecurity outlook report in 2025 it was just released last week. Supply chain interdependencies represent the greatest challenge. The report identifies six components. And if we can bring that up on the screen, please, that companies need to contend with in this world of cyber complexity. Geopolitical tensions, which are on the rise, and we heard from the European Union President today talking about this fractured world and how to respond. Cyber crime sophistication and many actors in play here. Supply chain interdependencies that made reference to that initial survey. Regulatory requirements, AI and emerging tech, which I talked about in my opening comments, Cyber skills gap, which I think is interesting. Only 13% of companies feel like they have the right cyber skills internally. There's a shortage of talent worldwide. Women in cyber is a big issue, which I think Öykü could address. And then 33%, 1/3 of the company said cyber espionage and a loss of IP as their top concerns. I made reference to the fact that both CrowdStrike and Johnson Controls had cyber incidents. So I think it's excellent to you only to come on the stage and talk about it. So George, as a CEO, take us through it. So what's it like to manage something that hits a company that has a very good reputation, the scale of the incursion surprise you? And then how did you deal with it as a CEO? And how did the organization respond and look at you and say, what do we do next?

Yes. So first, great to be here. Just to maybe reframe it, we didn't have an incursion, we had an outage. So July 19 was an interesting day, I guess, for us and the rest of the world, as you might imagine. And when something like this happens, you have to go back to your muscle memory, right? And we actually do work with a lot of companies that have cyber intrusions and we have that muscle memory. So we activated our crisis response team. We knew what the issue was. We were able to roll back the issue really within probably 70 minutes, but there's complexities in the operating systems to be able to recover some of those systems. Therefore, you had a much bigger outage. So once that was unfolding, then you kind of see the scale of it. And part of the challenge, I'm not sure everyone sort of remember or has a good appreciation, but there was another technology outage, a different company that had an outage at the same time. So what we needed to do was we needed to deconflict what was our issue, which we know how it happened, and we rolled it back. And we had to deconflict that from what was happening with another service provider, right? Because all you hear is outage. So what's ours, what's there's. In any event, we couldn't control that piece. But what we wanted to do was to be front and center. And there were two things that really came to mind. Number one, first was the customer, putting the customer first. We have -- you can see the scale of our customer base, right? We wanted to make sure that we got to our customers. We were working with them to roll it back. And there's things that we did to automate the rollback for them, but just the complexities of the operating system, there were manual things that had to take place as part of that. We needed to be able to get out and educate and tell people what it was they needed to do. And the hard part, some of it required physical interaction. So you had to have key strokes and people have to type things in. And there's a lot that went into it, even though it was a relatively simple set of commands for people that don't understand what -- how to do that, it takes time. But you have to get that information out. So one of the key things for me was take care of the customers. And the second piece, as this was unfolding is we need to let the world know this wasn't a cyber attack because people didn't know, right? And this is where basically we said, look, I've got to get on TV. And this is within a few hours.

Even people don't watch TV anymore. That's part of the challenge as well.

We need it to be on TV. Well, first thing we did was we got on Twitter. And we announced it. And then we had continuous updates, right? And this is -- this sometimes going to be hard because you've got teams of lawyers, teams at PR people, teams -- you go on and on as a big company, right? And you have to make a decision. And it's not easy in the first few hours without having all of the facts, and it's a bit of the fog of what's happening. Again, what's ours, what's theirs. How do we make sure we get the right message out. But for me, it was really important to be able to get the message out. It wasn't a cyber attack. We knew what the incident was. We rolled it back very quickly and then we were in the recovery mode, working with customers. And I think that really helped to settle a lot of folks down and then the heavy lifting of making sure that we can bring systems back online was an ongoing effort.

I'm going to circle back about your leadership because I want to bring in G2 as we said here, George Oliver, am I correct in saying you're going to retire is pretty soon? What a way to go out, right? Because you had a very big side of -- is that the first major crisis that you dealt with at Johnson? And then -- and I'd love to get the other George's input on this. As a CEO, like what's the first thought that goes through your mind when you get hit that hard? And I'd love to get Öykü's view on leadership and how do you prepare for a new era of a challenge that probably wasn't in our vernacular 10 years ago.

So I think it would be helpful to talk a little bit about Johnson Controls so you get an idea of what our infrastructure is like and the journey that we've been on. So Johnson Controls are about $28 billion globally. We operate in 100-plus countries. We're very distributed. And we're a company that has been made up of a lot of acquisitions with a lot of multiple systems that have come together into one. And so we've been on a journey on how do we take all of those systems streamline, get to one ERP, get to one operating system with similar type systems deploying. And we've been on a journey. And cybersecurity has been a key element of that. So as we're addressing technical debt, how do we make sure that when we look at our infrastructure, we have over 100,000 devices, 100,000 users and hundreds of thousands of applications. And so just to give a simple lesson, it's all about response. It's sensing at the device level, it's understanding access and understanding where the people that are coming into our network, where they're operating and then it's about applications and access to applications. So where all of that was being built and making sure that we're resilient. So when we had the incident or the -- there's always incidents and they're typically managed and contained. It's all about response,it's sensing and response, no matter what level the infinite is. And you'll find that whether it be a device or whether it be where someone's user credentials got compromised, there's going to be events. It's the ability to be able to sense and respond. So we did get an attack and we're able to respond pretty quickly. It did impact some of our network. And what I would say the most important thing is being -- is planning for what -- in the event that if you do have an event, not only from a technical standpoint, what's the response? But from a leadership standpoint, how do you respond? And what are your business continuity plans. And so immediately, it was on a weekend, you get notified that some of our systems were compromised and then you got to work. And it's easy to kind of try to self, do a self-assessment or you can stand up and lead. And so that day, we had our full extended leadership team across the globe activated, really assessing to make sure we understood exactly what was compromised, what is our plan. And the -- as we work through that, we continue to operate. And so we continue to stay focused on customers. The other thing is this idea of as you -- as George said, as you learn, you maintain transparency with your constituents. Because that's from a trust and respect and maintaining relationships, it's important. So right from the board to customers and making sure that as you're working with customers, you're keeping them informed relative to now where we are, relative to being able to continue to support them with critical services. We're building solutions company. So we do a lot of service, maintaining our customers' environment on a real-time basis. So that's important. So that really played out well for us. And then we stood up our leadership team on a daily basis and also engaged parties. So when you have a lot of technology like we do deployed, we maintain strong relationships with all of our partners. And so we not only activated our internal team and leadership with our business continuity, but also engage all of our technology partners to make sure that we, number one, understood, assess the incident and making sure that then we were working together to be able to effectively address it on a -- what I would say on the critical path to make sure that we're in a position with speed to be able to mitigate the risk and ultimately continue to operate. That's what we did. So I was extremely proud of it. It was a -- what I would say is, and then we can talk a little bit more about this in the discussion that cybersecurity is going to be part of the culture, and it's going to be embedded in everyone's behavior.

Where every company, would you suggest because you're a very connected company, obviously, that's right the same.

Because you always are a training and you're always putting together processes so that you mitigate any risk and any exceptions. But as you get into any type of incident, you understand, okay, was it a device, was it a user credential, was it access that wasn't -- once you get into them, you make sure that you create redundancies and then automation and the work that we're doing with CrowdStrike is a lot of the sensing and then the automation, so that then you have intelligence not only from a device but from a user standpoint. And then you can -- it's all about response. When you see something that's not right. How do you then respond. So part of that was when you go through this, then every leader in the company becomes an expert because not only are they -- they're involved previously, but really getting to that level of detail. And when we have, we have 100,000 colleagues across the globe. Then from a leadership standpoint, making sure that they're totally aligned and behaving with their actions, whether it be their access or how they're using devices so that they're ultimately making sure that all of the securities that we have in place being fully consumed and put to work. And so for us, it was as we look back, it was a test of our culture, our ability to be able to respond and activate a global team. And really continue to be able to operate the company while we're mitigating the incident and ultimately getting back to full operation. So I was extremely proud of the team and really a lot of our partners have stood up with us to make sure that every step of the way they were playing their role in supporting us to mitigate what we saw as being the contributing factors.

Okay. You raised a great point. It's a great leaping off point to Öykü. First, can you spend 10 seconds to tell the audience what your specialty is because it will help us in terms of your context of your research, Öykü?

Yes, of course. As a professor of IMD business, we actually exclusively do executive education. So first of all, it's a privilege to listen to two leaders talking about their experiences. This is what really makes a big difference. And my research is really on about Chief Information Security Officers and behaviors of organizations when it comes to dealing with cyber attacks.

Perfect. Okay, good. We have this case where you could have a prisoner's dilemma because you're in the game together, right? And you have this trust built up and then you face a strike and then that cohort starts to look at you and say, "Okay, I put all my trust in you and there was a failure". And then there could be panic from that partner or as George was explaining, everybody rallied to the cause. So what does your recent research advise future-looking CEOs because we know that threats are rising, and we'll get into this discussion about the developed and the developing world, right, and those vulnerabilities a little bit later. But -- and also that brand narrative that I addressed in my opening comments about rebuilding trust very quickly during an incident because we want that V-shape to rise quickly. Go ahead.

I love that visualization, the V-shape and we talked about shrinking the V, right.

Pretty good team that we work with.

Exactly, exactly. So -- and there are two things that Josh talked about may. The muscle memory. I love that reference because that only happens if you think detailed enough of scenarios and if you practice enough, right? And George talked about how it's part of the culture and how quickly you were able to continue working right, servicing your customers. So first half of that V absorbing the incident. That's a great example of that. So you were prepared, the culture was there. So you were able to despite the incident were able to operate. And the other one, the significant part of the resilience is that we actually can practice this enough so that we can, after absorbing, recover from the experience. I think there were two really good examples of long-term thinking and answering your question. The necessary shift from more traditional short-term cybersecurity thinking to a long-term resilience building thinking is I think these examples is greatly represented here.

But who would have thought 5 years ago that the brand would suffer if you don't respond. I mean, George was saying, look, I was ready to communicate, both of you said, I had to communicate to my partners, my customers and then you had to say, "I need to get ahead of the curve here". Go ahead, Öykü.

Because you talk about trust, right? How do we build trust. And the first question that comes to mind, especially -- there are, of course, anecdotes we can learn from when it comes to doing research, it all comes down to how do I quantify trust. What do you mean to us? Is it the financial health of the organization? Or are we talking about finding a way to measure the reputation of the organization. What we know from -- if you look at just from a financial health perspective, to be honest, we don't know much. We only have very little research on this because very difficult to collect reliable data at large scale to really understand. And the research are all over the place. But when you look at trust from a reputation perspectiven then we know for sure, minor incidents. We tend to actually forget organizations do recover from minor incidents relatively quickly with minimal stock value impact. But for major incidents, we do have evidence that it really takes quite a bit of time to recover back. But I want to add something here that most people don't think about which ties back to preparation is that what type of incidents we're talking about makes a difference. And we know this from research. So if it's an internal, insider threats then the perspective, the trusts on the organization really decreases. If this is an external threat, there's a threat actor, then really, it is less of a trust issue on the services of the organization. So if it's negligence, then the question arises around the culture of the organization, for instance.

Good. Both of your comments, led me to believe if you had to do this again, what would you have done differently? And there's always that question that comes up because you have businesses that need to sell cyber safety and security and fortifications. And when do you know you have the right tools? Go ahead, George.

Well, you never want to be in a position, but you have to prepare for it, right? And this is what we're talking about. We help a lot of companies go through incidents, and we drill ourselves. And this particular one, it's hard to put this in the playbook of what happens, right? But we used the same, again, muscle memory to be able to roll things out and activate our teams. I think as you go through any of these, there's always areas where you can pick out and go, "okay, we could have done that better, we could have communicated this or you come up with various scenarios. But I think, by and large, something like this in any incident, if you are upfront, if you're transparent, if you communicate not only one time, but frequently, and this was a big part of our response was we immediately said internally, and then we've said externally. We will tell everyone as much as we know as soon as we know it. And basically, we had a whole portal that we stood up, right? And then as we knew things, you just went to the portal and you got updated, right? So I think that really served us well.

And as the business has been hurt, as a result of it now, would you say the CrowdStrike brand suffered?

I think the trust is even up more. I mean, I'm walking around Davos, I run into the CEOs of many of our companies and they said, I had one organization. So we actually use CrowdStrike in our responses as the prototype for how you should respond. That was just last night. So I think -- again, everyone's going to have their own opinion, but I think our customers have looked at it and I think anyone in business or IT realizes things happen, and it's really how you respond. And we want to be known for our response to this not necessarily the incident that actually happens. So that's the way we would look at it. And again, could we do things better? I'm sure. But I think overall, with trust and transparency and communication, we did the best we could with what we had in front of us.

Öykü?

May I quickly add here, because we really do know that during the incident, communication is the biggest differentiator. And being transparent, honest and owning up to it does make a big positive impact on the image of the organization. But I wonder what you think about the possibility that in your case, product stickiness and vendor lock in, how much that play in, right? Clearly, for smaller organizations, this may maybe lead to or customers leaving. But I wonder if you -- if there is a way for you to kind of measure the impact of that?

Just so you can [indiscernible]. That's a great question. We're going to look at the vulnerabilities of SMEs in our next round. So I'm glad you brought it up. Go ahead, George.

Yes. I think when you look at this, I mean, we're a public company. We talked about our retention rates, right? They're 97-plus, which is fantastic. So even after the incident, I think when you -- to your point about the product and the stickiness, I mean the good news is we've got the best product in the market. So customers like it. And I'll just tell you a quick story of a customer. It was a large financial services company. We went through what happened, why it happened, why it won't happen again. And they said, "Look, you've got 10 years of trust deposits in the bank, 10 years of trust deposits. And on the 19th, you had to withdraw. But net you're positive, net you're way positive.

That was nice from a financial services company to say it and put it in that.

And it was -- but they went to -- he -- this system went to the board and said these -- if it wasn't for CrowdStrike, they recovered pretty quickly. If it wasn't for CrowdStrike of 10 years of protecting them, it would be a much different story. And this is, again, building trust over time. And I think that has really helped us out with a great product.

Right. I don't want to get into Midwestern values, but the company is based in Milwaukee and Wisconsin. For those who know, I know America, that's where they value it. I'm from the West Coast. So it's a little bit different mindset of like Blue Sky thinking.