Mitsubishi’s Billion-Dollar Bet on OT Cybersecurity with Nozomi Acquisition

[00:00:00] Speaker 2: Hi, I'm Craig Duckworth,

[00:00:10] Speaker: I bus

[00:00:12] Speaker 2: and today Dino, I wanna talk about the billion dollar acquisition, cash out exit, whatever you wanna call it, of Nazomi to Mitsubishi. How's that sound?

[00:00:23] Speaker: crazy, but I think, but.

[00:00:25] Speaker 2: Yeah, it is that, but. I think it'd be a good conversation. I think there's a lot of people in the industry that are trying to figure out what it means, how it applies to them, how it applies to the industry as a whole, what it does to other competitors or competition in the marketplace.

[00:00:44] Speaker 2: Clarity Arm as Dragos.

[00:00:48] Speaker: And we've seen these acquisitions of these, uh, cybersecurity platforms. It's not new, right? We saw Microsoft get Cyber X of course, Tenable's a security company that picked up, um, indige. Um, did Honeywell get one? Schneider, did Schneider get one? I I know Siemens hasn't done anything yet as far as going after a particular firm or rock Rockwell partner with clarity early on.

[00:01:12] Speaker: But

[00:01:12] Speaker 3: yeah.

[00:01:13] Speaker: I think it's just more of these very large automation technology companies. Um. Wanting to get cybersecurity, you know, kind of built into their industrial control system platforms, right. Back to that cyber informed engineering play. You know, how do we get better at, um, implementing cybersecurity, which I'm a big fan of as part of the OT environment, because that's, that's kind of been the mystic piece, right?

[00:01:38] Speaker: We talk about the ITOT convergence a lot. Um. And, and the, the challenges for IET to really be able to, to make, um, uh, deep inroads into the industrial arena, um, with implementing technologies that they've chosen for the organization without really working with the, um, the industrial side of their business.

[00:02:00] Speaker: Um, and I think this is just another avenue demonstrating that the, the OT ecosystem, as I always state, has to get better at this, right? They have to start driving the cybersecurity initiative because it just can't get all the way there by themselves.

[00:02:17] Speaker 2: I know you're a hundred percent correct and I think this demonstrates, you know, maybe this is the first. Exit of, of the other ones. You know, there's been speculation on is this gonna make it more difficult for the others in the, in the marketplace because it sets such a high bar, this set a billion dollar bar.

[00:02:36] Speaker 2: You know, now, you know, you're looking at what's the run rate, what's the, uh, the return on investment, what's, you know, the, the numbers look like based off of the amount of capital they've taken over their series rounds, and it sets a high number.

[00:02:52] Speaker: Right. Well, think of what the design group did, right? As far as getting, you know, acquiring Delta technology, right? And adding an OT cybersecurity practice into their control system. Piece of the business, right? It's just a continuation of, of that, that roadmap that, uh, I think is really what's gonna be the game changer for, uh, you know, improving the cybersecurity postures within these manufacturing environments.

[00:03:16] Speaker: You know, we, we had this conversation, you know, with with with our federal government friends, you know, talking about cybersecurity, right? And some of the things that they're witnessing and seeing around the globe and, um, and the attacks that are, that are, that are unfolding and have unfolded and. Trying, how can they be a better partner, you know, for, you know, the American based companies.

[00:03:40] Speaker: But even though it's more of a global thing in, in improving, uh, cybersecurity in, in this industrial world.

[00:03:47] Speaker 2: Well, and, and part of a, you know, a little sidebar, the one thing that I, I took outta that yesterday, which was the most important thing is this is happening now. This is not a matter of if, this is a matter of when, this is, you know, this is a you. This is a global event. We've, we've talked about the geopolitical pieces in the past.

[00:04:09] Speaker 2: You know, you look at the tensions rising between Ukraine, Russia, between US and China, between e, everything, it, it, it's, nothing's, nothing's changed. We're, and unfortunately, I hope that the. Manufacturing industrial clients are not becoming numb to all of the incidents in saying, you know what, we're just gonna sit back and let the cards fall where they fall because there's a new one out every single day and it, we, there's nothing we can do about it.

[00:04:39] Speaker 2: I hope that's not the case.

[00:04:41] Speaker: Yeah. Well, you know, and, and a lot of clients as, as we both know, are starting to, to not so much dabble, but we're actually starting to take a really hard look at these, uh, cybersecurity technologies for the plant floor. I think what, what the struggle for them is, is expertise and resources. On being able to, um, you know, when they look at the cost of, of hiring an organization such as ours, think of managed services in the IT world, you know, taking that same practice of managed services and applying that to, uh, the industrial sector.

[00:05:14] Speaker: Um, and it's not an uncommon theme to manufacturers because, you know, I would say. 80, 90% of manufacturers hire engineering companies anyway to help them with their control system work that they're doing, right? Whether it's lifecycle replacement, whether it's improving with efficiencies, whether it's Brownfield, Greenfield expansion activities going on, nobody can go and do it by themselves.

[00:05:36] Speaker: They have to rely on, you know, specialized organizations that do this. The same is true for cybersecurity. For those organizations that think, well, you know, if I hire managed services, I'm gonna pay, you know, just say $300,000 a year. 'cause I got, uh, six plants or 10 plants. I can go hire three people. Well, yeah, you can go hire three people, but are you one, are you gonna get to keep 'em?

[00:05:58] Speaker: Can you find 'em? And can you hit the ground running when you do get 'em? Right? And the answer to that is, no, no, no and no. So, um. You're gonna have to start relying on organizations to really assist you with not just standing these tools up. That's not really the hard part. The hard part is, is actually being able to fine tune that technology and fit it into your plant.

[00:06:21] Speaker: The whole localization, as we call it, operationalizing that, that system, you know, to, to extract the value and benefit that you're really looking for, um, from the investment made in these cybersecurity technologies.

[00:06:34] Speaker 2: Well, yeah, to totally agreed. And, and part of, you know, and, and part of the speculation is did Mitsubishi. Acquire a Zomi for their managed services platform to try and bring this to their clients. And I don't know that answer. I think that, you know, on the surface it has been said that they intend to keep this as a separate operating unit and continuing to.

[00:07:03] Speaker 2: To, to allow them to operate autonomously and we'll just provide financial backing and security as they continue to grow and advance the technology. Again, I think we heard that same story from, from Microsoft when they bought Cyber X, didn't we?

[00:07:19] Speaker: Right. Well, well, and, and assuming has a lot of clients out there. Right. That, that, that have their technology and, um, and some of 'em aren't any, any relationship at Alna Mitsubishi. Right. They might be purely a Rockwell slash SNAs, you know, um, client. And, you know, the one thing that I I, that I found interesting, and I think it was released, but the whole idea where, um.

[00:07:42] Speaker: Mitsubishi was embedding the Zomi technology into their controllers. Right? Which is something we've talked about in the past. It's like, you know, at what point will these automation technology vendors actually build modules that go under their control systems to provide this intrusion detection and intrusion prevention capability?

[00:08:02] Speaker: Right within the control system itself. Um, which I think is a great model, you know, but, you know, is that gonna be Mitsubishi and the Z's focus? You know, we've seen that, um, you, you take clarity, for example, when they acquired ATE and they, they rebranded it as X stone and then they kind of lost their, their, um, their focus on their, uh, on-prem solution.

[00:08:25] Speaker: Because they were spending all their time and engineering resources focusing on, uh, their new cloud-based solution, which became exome. And, and so some of their, their on-prem solutions suffered a little bit from that, you know, because they weren't getting the same level of, um, uh, uh, resources applied for that technology.

[00:08:45] Speaker: Right. Especially in the, in the stage that we're at today, which is still, you know, growing and maturing within, you know, these platforms.

[00:08:53] Speaker 2: Right. No, totally agreed. And you know, I look at it, um, first off, I I congratulations to the entire zombie team. That's a huge, huge, huge effort. You know, they've put 12 long, hard years into this and to be able to exit, period. Because if you look at the number of businesses that start up that don't make it past 18 years, that don't go anywhere, that's, that's a huge accomplishment.

[00:09:20] Speaker 2: So to their team, hats off, kudos all the way around, you know? But as, as I look at this from an OEM standpoint or an. Industrial automation standpoint, I'm gonna put myself in someone else's shoes. Let's say I'm, I'm Rockwell now, and I'm trying to integrate. Nazo into Rockwell because I wanna penetrate the North American market and I know I need that technology to be successful.

[00:09:49] Speaker 2: Unlike the rest of the, the world where maybe Siemens or Yoga Gall or someone else is more prevalent based on geographical region, is Rockwell gonna say, well, I don't know, because now you're owned by. Mitsubishi, which is a competitor of them, does. Do you think that'll have any bearing or any play at all into this acquisition or how, how would you look at it if you were kind of on that side of the fence?

[00:10:17] Speaker: Well, I, I'm looking at to see which one of these firms now become an I go IPO, right? Which I think is in order to, to keep the acquisitions that we're seeing from happening, I know a couple of 'em want to, want to get to that IPO status, right? And become a publicly traded company. And this may help fuel some of that, you know, to drive it to the, you know, even though it was a a billion dollar investment.

[00:10:44] Speaker: Um. You know, the acquisition of omi, is that right? It was a billion dollars for them to acquire it, you know, and, and their market cap compared to some of the others is, was smaller, you know? And so at, at some point here, we're gonna see one of these, one of these, uh, cybersecurity companies become, I think a publicly traded company.

[00:11:06] Speaker 2: Well, I think if you, and that's one way to look at it, but if you look at the financial aspects of what they, what they exited for, which is almost a billion dollars, and you look at the amount of capital in the series rounds that they've taken, they've taken a lot less than Dragos or Clarity or Armas. So it's gonna push that valuation for the others up higher and set that bar a lot higher from a return standpoint.

[00:11:34] Speaker 2: And I think that either VCs or the market or the IPO Arena is gonna gonna look for better financial returns versus where they stand today. And while I don't disagree that you'll see some of these go IPO, it may push it to 26 or 27 until that happens.

[00:12:00] Speaker: Yeah, but you know, the IT companies take Microsoft and Tenable, you know, at the end of G and Cyber X acquisitions a few years ago. They, they've kind of, they haven't dominated the OT cybersecurity arena, you know, compared to this particular acquisition is purely into that OT environment, right? I mean, this is all around the industrial control system space.

[00:12:24] Speaker: Um. We operate in that, in that realm. Right. And I think that's primarily you take, uh, clarity not ARM is definitely in, in OT space, but they also play in that it slash i space healthcare space, you know, clarity. On the other hand, Dragos on the other hand are, you know, they're, they, those, those guys are really control system cybersecurity software companies.

[00:12:49] Speaker: Right? Um, and, and I think they need to stay, you know, pure to that. And to that OT world versus blending with it, you know? Um, and I don't, I don't think, you know, that we're gonna see, um, the merging of these with, with a, like a, would a CrowdStrike acquire clarity, for example, you know, or Palo Alto, you know, or Fortinet or one of those types of organizations, you know, where they really want to get their hands on the, on that.

[00:13:23] Speaker: I that those organizations have the way that they're able to, the algorithms, the machine learning, you know, the way those platforms operate with within these industrial environments. So, you know, the good news that there's a lot going on at the same time, it still looks a little messy.

[00:13:39] Speaker 3: Oh, it's, it's absolutely a little messy.

[00:13:42] Speaker: You

[00:13:42] Speaker 3: it's definitely a little messy. Um,

[00:13:49] Speaker: Really what else we could add about the Mitsubishi OMI acquisition per se, you know, except it's, um, it's off the press.

[00:13:57] Speaker 2: it's, it's, yeah, straight off and it's, again, I think it's for groups like design group systems integrators that are technology agnostic. As long as they continue down the path they are and they continue to allow. Others to to sell and implement and operationalize and localize their technology and drive that.

[00:14:24] Speaker 2: Market. I think it's, it's a good thing. I don't see any downside at all at this point. Again, you got a very talented group of individuals from the co-founders to the CEO to the, the channel and the sales and the. The developers that have spent a lot of time putting effort into it, and it's a great product that, you know, finally reaps some benefits.

[00:14:47] Speaker 2: I'd like to see 'em all stay, hopefully they, they do. Sometimes money changes that stuff and you know, as long as they can continue to keep some core staff, then they'll be fine. I think.

[00:14:57] Speaker: Yeah. Yeah, I don't know who's moving the chest pieces around. That's for sure.

[00:15:01] Speaker 2: Yeah, no, same here. You know, hopefully it gives them an opportunity to continue with, with part of their ai. Initiatives 'cause that was a big piece that they were running, is how do they integrate AI for some of those decision making processes from an automation standpoint vista of, to try and help part of that, um, decision making process.

[00:15:28] Speaker: Yeah, well. It's like the cloud versus on-prem. You know, the manufacturers, when you're dealing with the, the OT teams when it comes to their plants, like things to be on-prem. Because they wanna be able to think that, that nothing outside the plant is gonna prevent them from running. Right. So they like to be able to be in control.

[00:15:46] Speaker: Right. Makes sense. Control, because they are control freaks. Manufacturers are, and if when things are up in the cloud, to them, that's beyond their control. Right. It's one thing to send data out there to, um, you know. For, for algorithms, for forecasting, you know, for forensics, for data analysis, whatever. But when it comes to the day-to-day stuff they want, they like that stuff to be on prem, you know, and, and manufacturers are still, you know, play the card of air gap.

[00:16:15] Speaker: We see less and less than that, and every single manufacturing facility we go into. You know, there's always, uh, there's always physical connectivity question is how do you logically separate it and how are you managing that? And, and even for those organizations that believe that they've, you know, put something in place to say, look, I've put in microsegmentation, you know, I've put in some intrusion prevention things, you know, to really harden my cybersecurity posture.

[00:16:39] Speaker: That's great and those are great steps, but how do you make sure it stays that way? The trust would verify, right? Because things change over time. People make mistakes, people push out patches, people change configurations. New equipment comes into the environment. Um, and so when those things happen, do you have a good mechanism for tracking that you know, and you know, versus, uh, you know, how do you do that today if somebody goes out there and puts a new asset in your plan? You know, puts a new machine in and, and what is its, what is that machine's role? What is it communicating with? What is it trying to communicate with? Who's supporting it? How are they supporting it? How are they remoting into it? You know, all of those things need to be taken into consideration, and then you have to be able to track that once, you know.

[00:17:23] Speaker 3: Well, yeah,

[00:17:24] Speaker 2: and you know, but organizations still are, let's, let's call it. Struggling, for lack of a better term, to, to play catch up. And, and we had this morning, we, we were on a call this morning where again the statistic was out there that only 13% of organizations are in what we would call that.

[00:17:52] Speaker 2: Walk, run stage of whatever technology they have. The other 87% were still in the unaware, or I don't know, or I don't care phase almost head in the sand type environment. So, but that's the same stat that we've seen from Gartner and Forrester and everybody else for the last five years. And I don't know why organizations aren't.

[00:18:19] Speaker 2: Taking this more serious, especially after yesterday with the, the conversation that we had with the federal team.

[00:18:27] Speaker: But it, it, it's the resources. They don't have individuals within their environment who know how to deal with this stuff. At the end of the day, you know, they've got an IT team and they're really good and probably stretch very thin, just managing and taking care of the enterprise environment that they're responsible for.

[00:18:46] Speaker: You know, versus how, how do I become more entrenched in what's going on inside my manufacturing environment? So I, I, so I can make me, you know, make, uh, uh, a positive impact, you know? And, um, it's hard. If, if you're not working in that space every day, all day and really understand that environment, you're not gonna, you're not gonna have much influence and you're not gonna be able to make that positive impact.

[00:19:11] Speaker: You know, if you're trying to do it from states away or from arms length, whatever you want to call it, and trying to implement some cybersecurity strategy because you're not bringing the OT people along with you, which is really required in order to make this successful. Right. And so when, if you're, if you're constraint on resources, budget, you know, expertise, you're gonna startle like this, right?

[00:19:35] Speaker: I mean, I, I talked to an organization a week or so ago, they never even heard of some of these OT cybersecurity companies, right?

[00:19:41] Speaker 3: that blows my mind.

[00:19:42] Speaker: They're a manufacturer, right? So back to your 87% number, there's still a lot of that out there, but it's just because it hasn't come across their desk. They haven't had time to look at it, or they just don't have the right people to be able to help them with that.

[00:19:55] Speaker: Right. And that's where you gotta, you gotta start looking at your, um. Your, uh, partner, OT partner ecosystem to find out what the capabilities are of these system integrators and OEMs that, that you're working with. Right? Back to the comments that we've made on, on a handful of these podcasts is those CISOs and CIOs are gonna really have to make a.

[00:20:14] Speaker: Uh, a positive move towards becoming a little bit more engaged with who our partners are on that side of the fence. I would like to know who they are. I'd like to know what their capabilities are, whether their partner relationships, you know, what kind of practices do they have? You know, they do that with their IT partners.

[00:20:31] Speaker: You need to do the same thing with your OT partners.

[00:20:34] Speaker 2: Yeah. There's, there's no reason to, to do this alone. You know? And, and I know that, that we've said this like. A, a a hundred times find out who your local systems integrators are that are doing the bulk of your work. Sit down and have quarterly business reviews with them the same way you do Microsoft or Cisco, or your cloud provider or your endpoint protection.

[00:21:00] Speaker 2: And it, it does that. And it happens on ot. It may be happening, but it's happening in a vacuum with the plant team only, and it is not part of that. But if when they seeso or CIO is being tasked with securing the manufacturing side, they have to expand their purview. They have to include everything in that plant that rolls up to them or, or, you're right.

[00:21:29] Speaker 2: It, it doesn't work.

[00:21:30] Speaker: mm-hmm.

[00:21:32] Speaker 2: They've, they've gotta find new friends.

[00:21:35] Speaker: Sorry. You gotta make some new friends, you know, in order to be successful at this, there's no doubt about it because, and we've seen that work, right? We have seen, regardless of how we got engaged, it's always really good because it's a win for both sides.

[00:21:50] Speaker 3: absolutely.

[00:21:50] Speaker: You know, and, and that's what it is looking for, is they're, they're looking for a win.

[00:21:54] Speaker: And I more, I, and more, ideally, they want somebody that's a true partner that's already a partner with the plan. The plan already trusts the plan's, already been doing work with them for years, decades, spent millions and millions of dollars, you know, doing machine control, integration activities of all stripes and sorts, leverage those people.

[00:22:16] Speaker: And, and, and really find out what their capabilities are. 'cause I, I promise you, you're gonna start seeing more of this, this OT ecosystem coming to the table. IE Mitsubishi buying the zny. Now, when you start looking at Mitsubishi machine centers, you know, you're looking at a DCS or whatever it's probably gonna come with in it,

[00:22:38] Speaker 3: Absolute.

[00:22:39] Speaker: whatever they br.

[00:22:43] Speaker: OT Cybersecurity Technologies built into those.

[00:22:48] Speaker 2: Yeah, well, absolutely it is. You know, that's, that's the long, I think that's the long game. How do you take this technology and I as a automation vendor, OMI Rockwell, pick a stripe, makes no it for Siemens. How do I take this and give myself a competitive advantage? And I say every PLCI have. Just like OnStar, we've talked about this.

[00:23:11] Speaker 2: Most cars come with OnStar and it's even free for the first 30 or 60 days. You choose to pay for that going forward, enable this out of the box technology from a security standpoint, and, and no ciso, no security professional on the planet is gonna say, you know what? I don't need that security stuff. Go ahead and turn it off.

[00:23:39] Speaker 2: I'm good.

[00:23:40] Speaker: what gonna happen though, is that it, let's say you're a big Mitsubishi shop and the Zmi is coming in, in, in that machine center, and you've bought, let's say, one of the other vendor stuff. Maybe you're using something that's IT related. Maybe you're using a for Scout or a tenable like tool. For example,

[00:23:56] Speaker 3: Yep.

[00:23:57] Speaker: what one, you're not gonna be the, the OT team's not gonna allow you to avoid the warranty.

[00:24:02] Speaker 3: Nope.

[00:24:02] Speaker: By saying, oh, we we're gonna put in Tenable into that DCS, that Mitsubishi DCS get that zmi stuff out there. That's not gonna happen. Right. So now you're gonna end up with, with another platform

[00:24:14] Speaker 3: Mm-hmm.

[00:24:14] Speaker: that's gonna be embedded into that, and that's, and you're, then you're back to that OTIT split. Right.

[00:24:19] Speaker 3: Right.

[00:24:20] Speaker: So that, that's the reality of, of a scenario like that.

[00:24:23] Speaker: And so it will take their toys and go home and the problem's gonna become the OTs responsibility of cybersecurity for those Mitsubishi systems that have omi, uh, integrated and built into that control system. Right? And it's almost that, that, uh, that mindset, Rott needs to start playing that type of a, of a game and saying, look.

[00:24:43] Speaker: I, I know there's tools out there that can help me be successful, help me improve my cybersecurity posture, help me with process integrity. It, I really appreciate your help, but you're not getting me where I need to go. I'm gonna have to go my own path. You know? And some organizations have the capability of doing that and some don't.

[00:25:01] Speaker: You know, maybe it has, has more, more weight within the organization and kind of tot that. But then when, what happens then is your, um. You're, you're, you're weakening your position from a cybersecurity perspective because it is never gonna get the depth of where they need to go to be successful in there.

[00:25:17] Speaker: They're going to go as far as they can usually to that IDF switch within the plan somewhere, and they're done because everything on the control system layer it belongs to. The asset owner at the end of the day is gonna be the one responsible for safety and security for those control systems, right.

[00:25:34] Speaker 3: Yep. No, a hundred percent.

[00:25:36] Speaker: You know, you can start working with their partners and, and, and working together across that spectrum.

[00:25:42] Speaker: Or you both are gonna go build your own, your own little fiefdoms and go.

[00:25:46] Speaker 2: Well that's, that goes back to OT needs to start owning this stuff and you know, it needs to help them along, but at the end of the, at the end of the day,

[00:25:55] Speaker: So get outta the way. Just get outta the way because once these automation technology vendors start bringing this stuff in, you're not gonna be able to get it out.

[00:26:04] Speaker 3: It's a game over. Yeah. It's.

[00:26:05] Speaker: those layer two unmanaged switches that they put in or that version of Windows they're running on those hmis. It is what it is and that's what they got.

[00:26:13] Speaker: And the, the clients using that to make a million dollars a day's worth of goods and they're not gonna let anything upset that apple cart.

[00:26:20] Speaker 2: Well, the, the lifecycle replacement is way too long in ot. It's usually measured in decades and.

[00:26:28] Speaker: if the CapEx spent right.

[00:26:30] Speaker 2: So it's, it's a different, it's a completely different beast. We've, we've said it over and over. It and O2 are different. This, the entire ecosystem is different. I can't say it anymore differently. It's different.

[00:26:41] Speaker: All right. And, and when we get involved in doing what we do for clients that even been using these tools for a number of years and only found out you're, you're not using it entirely to its fullest extent capabilities. Either you've got it, it's either been architected wrong, it's configured wrong. 60% or more of the assets in your plant, you know, that you're not even having visibility into. So what was the benefit of spending millions of dollars of doing this only to be half?

[00:27:08] Speaker 3: Yeah. No.

[00:27:10] Speaker 2: Well, great conversation. Dino. I think that we've kind of covered all this. I appreciate it. For anybody out there listening, if you got questions, you need any help, organizations like ours, we can, we can lend a hand. We can. We're in the plants all day long, let us know. We're here to, to help continue to listen and follow us and, you know, improve every single day.

[00:27:30] Speaker 2: That's all we can ask is that you've taken the right steps to get better period over period.

[00:27:34] Speaker: Yep.

[00:27:35] Craig: I.