EP279 Native Cloud Security: Is 'Good Enough' Actually Winning?

Guests:


• Gal Ordo (https://www.linkedin.com/in/galordo/) , Co-founder & CPO @ Native (https://native.security/)


Topics:


• In Episode 186 (https://cloud.withgoogle.com/cloudsecurity/podcast/ep186-cloud-security-tools-trust-the-cloud-provider-or-go-third-party-an-epic-debate-anton-vs-tim/) , we debated 'Native vs. Third-Party' as a binary choice. Native seems to be a third-party vendor whose entire existence depends on the belief that cloud-native controls are superior. Does your platform validate the 'Cloud Provider' side of the debate (that their controls are enough), or does the fact that you exist prove the 'Third-Party' side (that native interfaces aren't enough)?

• A key argument against native controls is an AWS WAF and a Google Cloud Armor don't behave the same way. If your tool manages native controls across multi-cloud, how do you handle the 'lowest common denominator' problem? Do you dumb down the policy to fit all clouds, or do you expose the unique complexity of each one?

• GuardDuty and SCC produce similar but meaningfully different results. How do you abstract across that so an analyst or IR team isn't having to dig into the exact meaning of the different JSON fields in their output?

• We often say native tools are 'good enough' for 80% of use cases but lack the depth of specialized third-party vendors (like a dedicated CNAPP or DLP). By betting your company on orchestrating native controls, are you effectively betting that 'good enough' is the future of the market? What happens when a customer needs a feature that the CSP hasn't built yet?

• What fraction of your users are taking this from a "I'm 80% this one cloud, I need great coverage there and good enough elsewhere" vs "I'm truly multi-cloud" or even scarier "I have a workload that is active spanning clouds"?

• Do your customers push you towards helping with the kinds of SaaS platforms that SSPM vendors cover?

• If AWS and Google Cloud suddenly decided to make their native security UIs perfect and unified tomorrow, would your company cease to exist? Or is the complexity of the cloud strictly increasing, guaranteeing you job security forever?


Related:


• Video version (https://youtu.be/QMXFmNjA6B0)

• EP186 Cloud Security Tools: Trust the Cloud Provider or Go Third-Party? An Epic Debate, Anton vs Tim (https://cloud.withgoogle.com/cloudsecurity/podcast/ep186-cloud-security-tools-trust-the-cloud-provider-or-go-third-party-an-epic-debate-anton-vs-tim/)

• EP160 Don't Cloud Your Judgement: Security and Cloud Migration, Again! (https://cloud.withgoogle.com/cloudsecurity/podcast/ep160-dont-cloud-your-judgement-security-and-cloud-migration-again/)

• The Great Cloud Security Debate: CSP vs. Third-Party Security Tools (https://medium.com/anton-on-security/the-great-cloud-security-debate-csp-vs-third-party-security-tools-6563e3dc6ac9)

• native.security blog (https://native.security/blog)

Видео EP279 Native Cloud Security: Is 'Good Enough' Actually Winning? канала Cloud Security Podcast by Google