7- Benjamin Haddad - Negozioak sortzea eta ekintzailetasuna zibersegurtasunaren esparruan_en

Bonjour,

c'est un plaisir d'être ici, mon nom est Benjamin Haddad, je suis part de l'Accenture, je suis based en Israël, où je runne un équipe à Accenture qui est focussé sur la sécurité de

l

'innovation, donc c'est ce que je vais vous

parler.

Je

vais vous

parler de questions pour le panel, mais aussi, je

vais vous

présenter. Je pense que je

vais vous parler

de

l

'interruption. Je pense que

nous

avons plus d'enlèvement

avec

les quelques slides que j'ai eu. Cyber-secret innovation est une partie de la plus grande discussion qui est en train de

faire

à Accenture et qui relatez à des partnerships que nous avons avec très matured companies. As the largest consulting group in the world, a big part of what we do is actually solving client problems by helping them

implement

the technology choices that they have made. For example, you see here logos like Intel and like SAP perhaps and others that are mature technology companies that solve well-known problems.

The

relationship with the hottest startup, which is the bottom part of this slide, is the ventures part and is about realisation and accepting at the leadership level of Accenture worldwide that the current partnerships, the current established alliances that we have with technology players today, like Microsoft, like all the big names that everybody knows here, are going to change. are going to change and they're going to change much faster than we think. This has been mentioned today in part due to new technologies. Just look at cloud, which until five years ago was really a vague concept that only a few people could talk about and today Microsoft generates 17 billion out of cloud.

So does Google, so does Google,

so does a

number of other players, IBM, and there is a very long tail. I think Alibaba grows its cloud business at 100% year on year. And this is true throughout a number of technology domains. Everybody speaks about blockchain, everybody speaks about AI. So our role as a corporate in helping our clients to identify the right

game

changer is really one that is taken very seriously with a constant relationship with the hottest startup. We track 200,000 startups globally

and

our role there is to utilise the expertise that we have with 400,000 employees. Some of them have a very strong expertise in a technology domain in a very specific area. Some of them understand very well an industry, the problems of an industry, the problem of a client within that industry. And matching all of that, all of that global cross industry expertise, we think we have a lot of advantage to put at the table to identify faster the next generation winners.

And

so the approach is really one that looks like a bridge, essentially, and that talks about, you know, an asymmetric information problem. There has been, and it's very well documented, it's not a new problem, but the journey to innovation, I'm sorry to say, is a major failure. You have had so many tech bubbles that have exploded because people jumped the guns, went way too quickly into thinking that this is the next thing. And burned cash destroyed value in the company. And this is something that we think we can help solve because the fact that it hasn't worked doesn't mean that it's not needed anymore.

There's

a lot of statistics speaking about global 2000 corporates and the rate of disappearance of these global 2000 corporates. If you were a corporate in the 50s, you would have a chance to survive that is much stronger than a chance of today to survive. This is, again, due to technology change, business model innovation. Yet, on the other side of the equation, the startup world is a very risky world. There is a mortality rate of about 80%, meaning within three years, 80% of startups fail and disappear.

That

creates, inherently,

a

very big problem to really engage with these clusters of innovation. Obviously, there are other problems which is,

it

is extremely hard to test and then deploy innovation at scale. There is a thing that we call the death after the POC. Many startups, especially in the earlier stages of their development, are looking for a proof of concept. And this is, you know, the first signs of traction that they have with a client. But due to, you know, current legacy systems, due to current bureaucracy, due to inertia, due to a number of reasons, it is extremely hard for many large corporates to move a startup from something that is just a proof of concept on a small scale to understand whether it works to full scale implementation. And so there is a huge paradox with a lot of innovation on one side.

We track 200,000 startups globally. 200,000 startups globally and there are more, which is gigantic. And on the other side, a need for innovation, but also a difficulty to apply the innovation on a big scale. And so as Accenture,

we

think that

methodology

and discipline, program management and consulting around a roadmap to change can help solve some of this asymmetry that you have described in this bridge. We're present as a global network and leverage the footprint of Accenture around the world to do exactly this job, meaning all these dots that you see here around the world are people like me that are meeting everyday entrepreneurs to understand, you know, what they're up to, meeting everyday venture capitalists to understand why they have invested in this one and not in this one, and really maintaining the relationship with key ecosystems of innovation.

In my case, I'm based in Israel, as I was mentioning before, you know, it's called Startup Nation to some people. The more appropriate name should be the Cybersecurity Nation. It attracts, it is second in the word for venture capital investment in cybersecurity. There are about 500 cybersecurity investments, startups investments in accelerators, investments in R&D doing security. It's a very small and highly co-located cluster of cybersecurity innovation where, obviously, it's exciting to do the job, but more importantly, it provides us with a benefit to work with our partners, our clients all around the world, and let them access this innovation. If you are

a

small firm, it is perhaps much harder to get access to those pools of innovation. Of course, you can do the random trip to Silicon Valley and to London and to other ecosystems and to Israel, but maintaining on a continuous basis the pulse with what's happening, what's hot, what's coming, what is valuable, what is less valuable, is extremely expensive. Even if you can do it, maybe if you're a bigger firm, we still think that, you know, a bank remains a bank, and therefore, they will maybe not have exactly the same level of technology expertise that we can bring at the table by being exclusively focused on that as a consulting shop.

So, we do it on a continuous basis and, you know, in Israel, for example, maintain relationship with Team8, which is a joint venture that creates startups on a continuous basis, and others like accelerators, etc.

Now,

what's really funny, I think, in cybersecurity is that you have sort of a replica of the startup mentality but amplified. What I mean by that is simply that every entrepreneurs, and we maybe don't state that in a very explicit way in those very polished slides, but typically, startup entrepreneurs are looking to replace the status quo. There is an inherent, not violence, but desire to change what is existing and bring a solution that you, as an entrepreneur, believe is better. It's exactly the same mentality that you are seeing in cybersecurity, sometimes politically motivated, sometimes not.

But there is a motivation from hackers to impact organization nation states in a very radical way, and sometimes completely destructive way, somewhat similar to entrepreneurs. Microsoft has not become Microsoft because it ticked all the boxes, if you know what I mean. They also did some stuff that, you know, today you would think is not politically correct.

And

this slide talks a little bit about that, but also about another thing. Essentially, here, you know, if you allow me for the analogy, I think today we, in cybersecurity, were something like in the Middle Ages in Europe, where you had all the kings of this little region building their own castle, beautiful castles, and reacting to the neighbor by building the highest possible wall. That's the very bottom part of this chart, hard perimeter security. Up until recently, meaning 10 years ago, 12 years ago, cybersecurity was only a matter of choosing a firewall. Choosing a 90 virus, choosing a firewall, and you had a cybersecurity program, so-called.

This

is the Middle Ages still today in many, many places all around the world. The vast majority of people don't have a sophisticated equipment for cybersecurity threats, and it is about building the highest possible wall, just a firewall. Which is fine, you need to do the basis, it's okay. But I guess some people are realizing that hard perimeter security is just not enough.

Back to the analogy, today, one out of two attacks and data theft involves an insider, involves a compromised access of your employee, and that basically means that it's the people within your castle, your corporate citizens, the people that you less suspect to be involved in an attack, that are actually in need to be monitored, to be understood. If they log at strange areas, in strange IPs, in strange locations, there is definitely, you know, you could call them a tier two of more sophisticated people that do this kind of, you know, behavioral monitoring, risk-based metrics, et cetera, all the way to

operate

effectively and be maybe a little bit more proactive rather than reactive in protecting against threats. But there is definitely no finish line. This is going to evolve. This curve is virtually infinite, and you recognize it from the title as well. There has been a constant reactivity to the industry, both on the client side and on the startup side, to the hackers. I think in cybersecurity, the difference with any technology domain is that the driver to innovation is not scale, but it's the sophistication and the complexity of the attacks. And this is really growing. We are seeing, some people have talked about IoT growing the complexity. It's absolutely true.

Cloud is still not so well understood. Blockchain, it's even worse. And today, attackers have a huge drive, often backed by nation states, to create ever more complex attacks, and there is an explosion of malwares. I'm going to use this slide, actually, just for that specific point.

There

are many good reasons in cybersecurity for the adoption of artificial intelligence-led solutions. It is well known that there are too many jobs outstanding that cannot be filled in cybersecurity. I was just reading now there are 3.5 million jobs outstanding in the world in cybersecurity that are not filled, not much. You do not have enough CVs that can match with the offers in the cybersecurity world. Skill shortage is a major, major issue. When I did this slide, as you can see, 1 million security jobs remain unfulfilled. This was a slide from last year.

This

boomed from 1 million to 3.5 million this year. It is absolute. And so, given the skill shortage, the drive to adopt solutions that can do what human people could do, in theory, is huge. Right? Because it allows you to utilize the few personnel, the few people that you actually can find, to do the higher end tasks.

And

rising costs, obviously, and new threats. All of these, I won't stop too long on this slide. But

if

you look at the

bottom

part, back to the increasing sophistication and complexity of attacks, there is today an emerging trend, but clearly exploding, around AI threats. Meaning, malwares are learning how to penetrate your perimeter as they attack you. Maybe the first time, the malware wasn't itself so successful, but the malware are being coded to learn from their unsuccessful penetration and become more successful as they go. And this is something that, again, speaks about the increasing resources of some threat actors, nation states. Some of them have been mentioned, some of them have not been mentioned. We know who they are.

But it creates a huge drive, I think, for this slide, which looks extremely complicated, but it basically says one simple thing. You better start with whatever you are, what business you are in, it doesn't really matter. You could burn your cash in cybersecurity so fast, just like with any innovation. It is our point of view and a firm conviction that it is much better to start with the prioritization of your need. First, some people have spoken here about vulnerability assessment. They are definitely part of the picture.

We believe that, you know, whether you're in financial services, which is FS here, or you're in resources, a natural gas company, rather than going first to the market of the solution to the exciting ecosystems of innovators and meet plenty of startups, there is an advantage in first trying to work out the use case that you should prioritize for capital allocation. Understand if you are most exposed to an attack on your data center, or if it's the mobile phones that you give to your employees that are not well secured. Start with that. Forget the solutions. Really understand your environment, your vulnerabilities, and then map that perhaps with two or three innovators.

Again, each of these blue boxes have hundreds of innovators within it. You can imagine you double click on the blue box and you would have all the map of the innovators. Hundreds, very often.

We

think, again, you should talk to three of them after you have understood the dark blue blocks for your specific case. That's the approach that we propose as Accenture, and it's really,

you

know, the name of my team is Accenture Ventures, but I think it's very different from most corporate ventures team in the sense that we are not an arm's length, financial arm that just take bets. But we very much believe that it's on the basis of use cases and of documented problems and priorities that our clients have that we can discover the future and understand what entrepreneurs has a better chance to reinvent the future and what maybe not. So this is really the approach where we say, okay, discover, discover, prioritize, document it very well, to then map and understand, you know, how this problem relates to the external world.

Again,

you know, prioritize there. Don't meet everybody. There is, I think, time to market that can be accelerated. But then it's a continued journey that we're proposing where we're saying

working

with a small start-up, even if it is not so small anymore and it has, you know, several rounds of investment and it's quite mature and many clients, a start-up is still a start-up. It is something a little bit funny that I do as a, you know, day-to-day is that you discover, in working with start-ups from very early on to fairly late in their development, that start-ups have a natural tendency to over-promise and under-deliver. It's not because they're bad faiths or they're liars, not at all.

It's just that from their perspective there is a route to solving a solution sometimes that's much simpler than the actual reality of a complex client or the actual inertia of a complex client or the culture of a client, etc. And so we think, as Accenture, that there is a role to, for someone in the middle that's neutral, to project manage, to guide, to measure the results, to service this. You know, if it works well, to have a road map on how to implement it on a much bigger scale rather than just finding the right part, finding the right priority, the right partner and then disappearing. So we very much believe in, you know, a company journey that starts with vision and strategy.

I'll skip this slide because I see I have only two minutes. I'll give you an example. In GDPR, which is not only, of course, a cybersecurity question, but definitely one of those strategic priorities where people are willing to put budget against it to find partners that will help them solve this compliance, this huge compliance issue.

So

this slide is a sort of

illustration

of how noisy the ecosystem is. As you can see, the blue buckets, security risk assessment, compliance analysis and report, all of these are categories from the GDPR regulation. And then some clients will have a very high rating of one bucket in red. Some others will have a green, but it's not so important because they are already equipped. So what we do is mapping their priorities to a few recommended players that seem to have a mature solution that can be scaled on a bigger, on a bigger, and work with them then to project manage the relationship, measure the result, and basically say to the client, working with a very small startup can be a huge distraction.

You are busy people, you need that innovation, but sometimes excessive aggressivity from the startup and ambition means that they will drive you nuts for one small line of the NDA. Give us that complexity. Give us also the complexity of managing the whole relationship for more than just a product, because obviously startups are known for technology, for good innovations,

but

they fail in all the other things, in support, in all the operational model, and so we manage that as a service, all the research as well. This is a typical, you know, collaboration that we run at a client where we manage the project as a pilot, measure the result, understand really what needs to be done if it's successful to be implemented on a larger scale, but then also in the third wave, service it on an ongoing basis, whether it's for support, whether it's for research, support I mean first level support, right, people of the software calling and saying it's not working, and sometimes it goes as far as being a full SOC

management,

not just one product support, but a full security operation center of a client, of a group of clients, that are then all of a sudden equipped with best in class tools. I'll end on the last 30 seconds here with a view of the Israeli ecosystem. I think one of the reasons that I was kind of invited here was to grow the relationship between these two interesting clusters of, on one side obviously industrial power and on the other side innovation. This is something that we are seeing in Israel as a very relevant reason why Israel has built a world-class ecosystem of innovation.

There has been long history in building these pillars, but essentially I think one of the reasons why you are going to see more and more innovation in cyber security coming from Israel just like you have in the last 10 years is that you have a very vibrant and healthy set of players, whether it's venture capital, whether it's R&D centers, there are 350 R&D centers of large corporates doing security innovation. The role of government is huge, et cetera. So I'll end here on an invite for all of you to come and visit us in Israel. We would be very happy to host you, maybe for a safari, as we call it, a digital safari.

And then obviously if you want to speak more about how can we increase maybe the bringing of innovation into this small enterprise world, I'd be happy as well to connect. Thanks again.

Thank

you very much. Thank you.