Speed Data and the Future of Information Security

Speaker A: Welcome to Champions and Challengers, discussions on the legal edge of Fintech, hosted by Greg Listini and other attorneys from Bricker Graydon, a full service law firm with more than 200 attorneys with expertise in financial services, insurance and insurance tech law, and clients across the country where we feature CEOs, founders, legal advisors and industry professionals exploring business technology, regulatory trends and legal trends that are reshaping the financial services industry.

Speaker B: Welcome to Champions and Challengers, a Fintech legal review. I'm Greg Listini, an attorney practicing in the government relations and insurance regulatory spaces, and I have the pleasure of leading our regulated industries group here at Bricker Graden. I am so pleased to welcome the show today. Megan Garza. Uh, as the communications manager for Varronis, Megan crafts high engagement external communications, manages the brand content style guide and hosts the hit video interview series Speed Quick conversations with cybersecurity leaders. She is also actively involved in volunteer work supporting organizations like the Red Cross and Meals on Wheels. Outside of work, Megan loves to travel with her husband and dote unhealthily on their pit bull bear. I had the pleasure of hearing Megan speak at Insurtech on the Silicon Prairie in Omaha last year and met her there. Megan, thank you so much for agreeing to be on Champions and Challengers. It's great to have you on. Welcome.

Speaker C: Thank you for having me, Greg.

Speaker B: Yeah, I feel, uh, you're the expert here, so I'm still nascent in the podcast world. Yeah, yeah, give me a rating afterwards. I really appreciate you being on and your talk at, um, Insurtech on the Silicon Prairie was really interesting. Can you start by telling us a little bit about your background and then about Varonis and your role there?

Speaker C: Sure. So I have been with Furonis a little over three years and as you mentioned, I serve as the communications manager, which means I wear a lot of hats. So whether it be doing a podcast, interviews, working with our, uh, media director on product announcements and press releases, um, interviewing our customers about their experience with Furonis, or, you know, hosting speed data. And for those who aren't familiar with Furonis, we are a security provider that takes a, uh, data centric approach to protecting sensitive information. So that's wherever it lives, whether that's in the cloud with the big three hyperscalers, or in SaaS or Salesforce, you know, countless others. And what we do is while traditional cybersecurity approaches focus solely on the perimeter and keeping the bad guys out, we know that once you've been breached and fingers crossed, it never happens to anybody, uh, uh, you can't be unbreached. So we protect what the threat actors and malicious insiders want the most, which is your data.

Speaker B: Talk a little bit more about that because you, uh, know, I saw some of the content that you more than likely put on Vernis, uh, website and you know, you had some great videos on there about access to the data. Right. And who has the access, which I thought was just a really neat. Maybe is not the right word when you're dealing with cybersecurity.

Speaker C: But.

Speaker B: But really interesting approach, uh, that you said, like you said, is not from the outside looking in, but keeping your own house in order first.

Speaker C: Yeah. So one of the stats that we like to quote is, which. It's a big stat. Um, unfortunately it's true. But on the first day of employment, employees have access to over 17 million files. Day one. Right. And so that's what's so great about Varonis is that we're able to help our customers see where internally their sensitive data is exposed and see who has access to that data that maybe shouldn't. So, you know, Greg. And it maybe shouldn't be able to see HR and the payroll and what Suzy and um, legal is making. So we're able to kind of determine where that sensitive data is for our customers, lock down access, and then proactively monitor it to make sure that there's no suspicious activity with malicious insiders or with external threat actors.

Speaker B: You know, interesting sidebar. Uh, and I know you guys deal a lot with AI now as well. That's integral to everything, you know, cyber security. I heard someone talking the other day that even if with the closed loop AI systems, you know, we use Copilot here. Right. And it only uses kind of our own system to generate the responses.

Speaker C: Yeah.

Speaker B: They're seeing examples of individuals literally asking the question, is my job safe? And then the AI going and grabbing internal memos about downsizing and that sort of thing. So it almost seems like the advantage to uh, a, uh, customer Vernis would be twofold. Right. Not only making sure that the data is where it needs to be internally, but then safe from external threats.

Speaker C: Yeah, because the way copilot works is it monitors whatever the users permissions are. So it's, it's just following orders. Right. So if a user has access or permissions to entirely too much data, which is nine times out of the 10 out of, uh, nine times out of 10, the case copilot doesn't know that it's not supposed to tell you this information. Right, Right. So if you say what is our CEO making? If you have access to that, whether you should or shouldn't Copilot will say, oh, this user has access. This, I'm allowed to give this information. Here you go. And so Varonis is able to determine who actually needs access to what and then lock down, uh, that access so that people aren't unintentionally able to pull up information they shouldn't with Copilot.

Speaker B: Yeah. So the joke that I always make is no one graduates from law school and says they're going to be an insurance attorney. You kind of somehow fall into it and find your way there. How did you get into the insurance industry and what was your kind of journey up to where you are now?

Speaker C: Yeah, so I had the privilege of hosting Tim Callahan, who is the, ah, chief information security officer for Aflac on speed Data. Um, his episode is fantastic, by the way. Little plug there. And shortly thereafter Tim reached out to me because insurtech on the silicone prairie was looking for guest moderators and Aflac is a huge partner of InsurTech. So when they came to Tim, he fortunately thought of me.

Speaker B: Yeah.

Speaker C: And so as you mentioned, our panel, it was fantastic. It was about solutions for cyber risk management and we had amazing guests on. So we had folks from Aflac and then also AWS and State Farm and Cowbell and they touched on how compliance and regulation are influencing development of cyber insurance policies and again, how AI is being used to help mitigate cyber issues, but at the same time being used by bad actors to infiltrate company networks.

Speaker B: Yeah.

Speaker C: I've also been able to host several of our own Varronis customers on speed data and they work for cyber insurance companies, hospitals, health care providers, insurance companies, you name it.

Speaker B: Uh, high, high data, highly sensitive data companies are all going to be right in your wheelhouse. Right. With all the communications that you do for the company. We've had other guests on before talking about especially sort of mid market companies, convincing them that they need to be aware of this and worried about it and thinking about it. How do you approach that, uh, from a communication standpoint to make sure it's top of mind for people that are maybe thinking about their P and L or their next sales cycle or whatever, and they know that cyber's out there and it's scary, but to convince them to invest early and particularly with the way that Varonis manages the data, uh, for them.

Speaker C: So this is great timing because I just interviewed somebody the other day, uh, Hal Wing, um, he's at Century, uh, and he and I were talking about how he said, in today's world, with advancing AI and data growing exponentially, you cannot not be invested. Cyber security. Right. Because I was talking to him about how do you get the buy in, you know, from the board on the importance. He said, really, it's just table stakes at this point. The key is being able to communicate to the board and to the other C level executives the importance and to really distill it down to what matters to them, which might be P and L. So you say, okay, well, you know, I need to allocate this much of my budget toward cyber security. And, and at first they might kind of balk at that, but then when you explain how this is actually going to make us money in the long term, because it's going to secure our data, we won't have breaches. Um, it's going to keep our customer, um, trust intact and our reputation whole, and it's going to mitigate any potential damage if there is a breach, like, we can lock down the information and we'll have minimized the blast radius, which is what we call the information that can, uh, be accessed just with one compromised login. And so you really kind of just distill it in a way that makes sense to where they understand, okay, this is what the benefits are of having a strong cybersecurity posture. And then also, this is what would happen if we don't have it. They're smart people, so they can pretty clearly, uh, understand why it is such a priority and why it is a need and not necessarily a nice to have.

Speaker B: Yeah. Are there things in your view and your experience that folks are missing when it comes to their cybersecurity, uh, either knowledge or the steps that they're taking in that. In that world?

Speaker C: I think so. In doing, you know, dozens of these interviews, cybersecurity and IT leaders. One of the major things that I keep hearing that everybody is on agreement with is the importance of having a game plan so you aren't caught on your heels when things go wrong, because they will go wrong. Right, Right.

Speaker B: Uh, it's not if, it's when. Right.

Speaker C: Exactly. So even organizations with data only on premise, where everything is within your four walls, you don't have as much control as you think you do. Right. So you'll discover all sorts of things happening in your network that you didn't even know were happening. Um, and again, this is, this goes back to Varonis. Being able to help our customers pinpoint where sensitive data is exposed, who has access, what they're doing with it because organizations today are facing a vast and growing blast radius. And almost all CISOs that I've chatted with have emphasize the importance of having a solid incident response plan in place because when you're breached, you don't want that to be the time where you

Speaker B: trying to turn figuring out what to say.

Speaker C: Right, yeah, exactly, exactly. Um, and then again, if you do have a data security platform like Varonis, should an incident ever occur, that impact will be small because the data has been locked down, the blast radius has been minimized and uh, we're constantly alerting for any suspicious behavior or abnormal behavior and detecting kind of from the earliest sign of an attack.

Speaker B: Yeah, that's great. Um, so you know, as we sort of introed and I talk about on this, my area is more the insurance regulatory. And so from the cybersecurity perspective, there's obviously a lot of, you know, there's different measurement systems, there's different sort of requirements whether you're in the US or the European markets. Um, and there's a lot of uh, sort of terminology that I'm not always familiar with. So. Varonis was recently awarded the Forrester WAVES leader and customer favorite data security platform. Um, in that they said Varonis vision of harnessing deep data insights to automate remediation for data security outcomes stands out. It's demonstrated ability to execute and its approach to innovation and supporting services reinforce its differentiation. Um, that's. That sounds really, really cool. But can you break that down and tell us kind of what that means and what this distinction, uh, means for the company?

Speaker C: Sure. We were very excited about this, um, and you know, proud.

Speaker B: Right.

Speaker C: I think it serves as a validation of what we at Varonis and our customers at Varonis have known for a while, which is essentially there's no better option to secure sensitive data than Varonis. Um, we like to say we find, we fix, we alert. So we find sensitive data, uh, or overexposed data, we automatically remediate those risks and misconfigurations so that you don't need to be doing the work on the back end. And then we proactively alert our customers of potential threats because at the end of the day, the reason we go to work every day is to help our customers and you know, sounds a little corny, but really the world protect data. So yes, that is a huge uh, accomplishment and acknowledgement for us and something that we're super proud of.

Speaker B: Yeah, I mean that's like, you know, as you said and the website really highlights this a lot. Just the massive Amounts of data that is being moved and exchanged. And that data is critical to most companies livelihood. Right. So that makes it that much more important. Um, what are some of the more interesting guests you've had on your podcast? And specifically you talked about Tim at Aflac, but you know, in the insurance world, if you can highlight those, I think, you know, the folks that listen to this would, would like to hear about that other. Other than going and watching all the Speed Data episodes. Right.

Speaker C: So asking an interesting, uh, guest. This is like having to pick a favorite child. Right?

Speaker B: Favorite child, yeah. Right.

Speaker C: I know because all of my guests have been amazing. Right. And they've all taught me so much about what it's learned, what it's like working on the customer side in cybersecurity, and they've given me amazing perspectives. Um, so again, back to data being such a massively growing thing. Um, one of my guests who, uh, uh, Shesh Conde at Salesforce, he talked about the cyclical nature of data and how we've been through this several year cycle where we look at data as an asset. Data is fantastic. And then suddenly GDPR came in and everyone's like, whoa, data's a liability and I only want to keep as much data as I need and it can use. And. But then here comes the Gen AI revolution, which is all about data, and you need data to run your LLMs, and data's an asset. And so it was just super interesting to me because I'd never thought about that kind of cyclical nature before. I'll tell you, I've had guests who jump out of planes for fun. Yeah. Who do Iron Mans. A guest who owns a jazz music label. I mean, it's incredible. I remember one guest, uh, Alexis Bunnell, she's the CIO of the U.S. air Force Research Lab.

Speaker B: This woman, no pressure there, right? No pressure.

Speaker C: She works side by side with Nobel Prize winners. She worked at Google, she worked at the Ministry of Interior. She was one of the first employees of the Internet Trade Association. She served in war zones in the United nations to support DoD operations in Afghanistan and Iraq. And then on top of all that, you know, in her spare time.

Speaker B: Right, right, right.

Speaker C: She found time to teach, uh, marketing courses at Pepperdine. So, yeah, that episode really stuck out. But like I said, I've interviewed a lot of folks from the insurance side and healthcare side, cyber insurance side. Um, yeah, definitely check out all episodes.

Speaker B: Yeah, that cyclical nature of data is really interesting, as you said. I mean that once you think about it that way, it's good for business. For you. Right. Uh, and for us, truthfully, but makes it so that you very rarely see the same thing twice.

Speaker C: Yeah.

Speaker B: Um, so, you know, it's funny, you're talking about the Air Force and sort of we're talking about cybersecurity. We're recording this in March of 2025. There's a lot of news about sharing information on different platforms. Um, so if you're listening to this later, you can go back and uh, look at the news headlines from.

Speaker C: Give a little signal as to what we're talking about.

Speaker B: Right, yeah, exactly. But I'm, but so to that point, social media obviously is a big part of everybody's lives and communication platforms. Um, I'll show my ignorance. I had heard of signal but was not aware of the details and the nuances of it before this. But when you think about how many different ways you're communicating with people these days and or sharing your data, how has that played into what you all have had to think about again, the cycle of data, how it's changed?

Speaker C: Yeah, social media is kind of, um, a double edged sword when it comes to data privacy and cybersecurity. So on one hand it's great for sharing and connecting and for your grandmother to keep track of your children and getting likes. Um, but then on the other hand it opens the door to all sorts of risks like phishing, social engineering, identity theft. And then when you add all the new tech features like facial recognition recognition and deep fakes and AI voice generation and location tracking and in all the different social media apps, you know, that can definitely create even more privacy headaches. Um, so one thing I want to make sure that users of social media know, which I think they do. But just to reiterate, while social media has its perks, definitely users, um, still need to make sure and stay alert when it comes to protecting their information online and limit what they share.

Speaker B: Yeah. So can you tell me a little bit more about the typical Varonis customers at larger companies? Is it, you know, mid level, all, all the above, that sort of thing?

Speaker C: I mean our customer roster, we have over 8,000, 8,000 customers and it ranges. Um, I would say our, you know, if you were to kind of pinpoint, uh, like what is your typical customer, it's going to be enterprises, it's going to be companies, um, with more than 2,000 employees who, because they're large, they might be, you know, distributed and they, they might be siloed in some areas. And so Varonis is able to kind of create like a holistic picture of their data security. So, and then some have teams who, you know, they're necessarily the cybersecurity teams, are strapped for resources. And so then we come in and kind of act as like a partner or an extra, you know, an extra resource and monitor that data so that they can be working on other things. Uh, Varonis has mddr, which is managed data detection, um, and response, and that offers 24, 7, 365, proactive, uh, coverage. You're not going to have employees who are working literally around the clock, just, you know, constantly looking for suspicious behavior or, uh, you know, abnormal activities. And it wouldn't be feasible to have that. And so Varonis is able to come in with the MDR team, um, and watch that for you, watch the data for you, so that you don't have to. But that's kind of. That's who our customer tends to be, is someone who needs that kind of protection, that needs that holistic view and then just needs help, you know, identifying, locating, locking down and protecting that data.

Speaker B: Yeah, so that was going to be another question, leads to another question that typically, you know, obviously, I'm sure you guys do an assessment and, you know, there's an initial phase, but then you kind of travel with your clients through their work. Right. I mean, you're always, I'm assuming you're always plugged in in some way, uh, to make sure you're providing what they're looking for.

Speaker C: Yeah, well, what we do is for potential new customers is we offer, uh, it's called a data risk assessment. It's absolutely free, just takes, you know, it only takes a little bit to run up and, um, we'll have information, uh, you know, running within, you know, 24 hours. We'll be able to get back to them with a report that says, this is where we identified sensitive information. This is where we found over permissive information. This is where we found stale data. Most of the time, potential customers are like, whoa, I like, I never realized how much data we have exposed or how much stale data we have. And then the good thing about the DRA is even if they decide for. For one reason or another not to necessarily move forward with Varronis at that time, they get that report that they can then, you know, kind of like, uh, as we were speaking, take to the board, take to the C levels and show them that, like, this is what we discovered. This is a problem that we need to take care of and kind of get that buy in for next steps for moving forward.

Speaker B: Yeah, great. So, um, tell us a little bit about what you see as next for Varonis and maybe, you know, for, uh, your role there as well.

Speaker C: One thing coming up very quickly is the RSA conference, which Varonis is a platinum sponsor of and is always a huge player at. So tons of our customers and vendors stop by our booth. Um, and that's where we show, like, our latest innovations, the roadmap, product demos. They can chat with our executives, and then we have some amazing swag. We have some of the best. I'm telling you, like, people line up for it. And I'm super excited because I get to go this year. So it'll be my first, uh, year at rsac, and I will be doing some on site speed data interviews, which will be fun.

Speaker B: That'll be fun. Yeah.

Speaker C: Yes.

Speaker B: Where is that Megan Tell? Is it in Vegas?

Speaker C: In San Francisco.

Speaker B: San Francisco. Okay.

Speaker C: Yeah. So I'll be doing the speed data interviews on site, so stay tuned for those to premiere soon. So I'm very excited about that. And, you know, we're constantly innovating and releasing product updates and new features and just. I just feel like we are just. We are just go, go, go. And there's no end in sight for us. The possibilities are endless.

Speaker B: That's great. Okay, so we call the podcast champions and challengers. So we always ask everybody, tell us about a champion you've had in your journey professionally, and then some challenge that has sort of shaped how you operate today and who you are today.

Speaker C: He's probably going to kill me, but without being too much of a cornball, I'd have to say my husband, Chris.

Speaker B: That's a very common, uh, answer. So that's totally.

Speaker C: He has always been my biggest cheerleader, and sometimes I wish I could just see myself through his eyes. Although if I could, I might not be very humble. He's very highly of me. He's a marathon runner.

Speaker B: Okay.

Speaker C: And I hate running, but I always travel with him and cheer him on, and I've watched him compete in races in Berlin and London and Chicago. And so it made me start to wonder, like, could I ever do a marathon?

Speaker B: Uh-huh.

Speaker C: So I signed up for my first one, and now he is helping me stay on track. I'm also super into CrossFit, and I wake up at 4am every morning to go to clock class. Let me tell you, that is not always easy, but I love the challenge. I feel like challenges shape who you are. I'm naturally competitive. Anybody who knows me will tell you that. And it's just. I always feel so much better and stronger and healthier and have more energy when I work out. So loving that challenge, allowing it to kind of shape me and having, like, beneficial outcomes through that hard work and effort and dedication so that in the end, you know, the, the juice is worth the squeeze.

Speaker B: Yeah, but I'm training for a marathon has put, uh, some other challenges into perspective, I would imagine.

Speaker C: Yeah, I have, uh, 12 miles to run tomorrow.

Speaker B: You're also breaking my. You know, I've always said there are people that run marathons and there are people that cheer for people that run marathons. I'm in the ladder now. You're crossing over that line.

Speaker C: I was. Got sucked in.

Speaker B: Awesome. Well, thank you again so much for being on. Megan, can you tell everybody how to find Varonis? Anything else that you want to say about the Speed Data podcast or anything like that before we wrap up?

Speaker C: Yeah, absolutely. So, varonis.comv a R-O-N-I s.com and then to check out all the Speed Data episodes or to be a guest on my show, it's Varonis.com speed data.

Speaker B: Awesome. All right, well, can't thank you enough. This was great information. Uh, we really appreciate it for all of our listeners. Thank you. Remember to follow the podcast and follow Speed Data as well. Thanks so much, Megan.

Speaker C: Thank you.

Speaker A: Thank you for listening to Champions and Challengers, produced by Bricker Graydon. Join Greg Listini and other Bricker Graden attorneys for our next podcast covering the latest fintech related legal topics. The views expressed by the participants of this program are their own and do not reflect the views of Bricker Graydon. None, um, of the content included in this podcast is intended to be legal advice and does not create or imply an attorney client relationship.