Lev Matveev, SearchInform: In the Russian market of cybersecurity there is a race of arms and opportunities

Lev Matveev: If to judge by money, then the Russian developments in the world market do not take still any place. And the reason is clear, it is corporate sales, and in the new, unfamiliar market, a sales cycle rather long – two-three years. On the other hand, if to estimate quality of the Russian products, then Russia much more advances the western developments on the level of technologies and functionality. The western products often detect a problem in the simplest way so even normal investigation cannot be made – there is no archive, there is no possibility of intellectual search. And in this regard the Russian developments have a chance to become in information security field No. 1 in the world.

Lev Matveev: We can estimate only a segment in which we work, i.e. developments in the field of DLP. And, we estimate it only in respect of licenses, without the cost of the equipment and all other. Proceeding from data the companies, statistical by quantity, with the state it is more than 200 employees, all license market is about one billion dollars USA, technical support – still plus 20-30% annually.

Growth potential at the Russian market big – it for March, 2019 is mastered approximately for 10%. More and more companies are concerned by information security support. We see it including on our presentation demonstrations - so-called Road Show which are carried out annually in 20 - 25 cities of Russia. Presentation actions within the road show are attended by representatives of several thousand Russian companies.

Lev Matveev: Can. For March, 2019 we do such attempt by means of cybersecurity outsourcing.

Lev Matveev: In a segment of SME we often observe a situation when in the company from 50 – 100 computers, simply there is no person who will be engaged in information security. The chief executive is ready to devote to questions cybersecurity, say, on an hour a day, and a position for the person who would work on it all working time, it is not provided in staff of the company. And in this situation we, together with partners, are ready to provide the specialist on the terms of outsourcing. We hope to expand by means of this service the market as there are many solvent companies which are not buying means of cybersecurity just owing to the fact that there is nobody to work with them.

Lev Matveev: Our researches show that the market becomes more mature, realize more and more companies that it is necessary to be engaged in information security. And we promoted it much, having implemented the cybersecurity systems more than in 53 universities of Russia. It was net patronage – we free of charge installed programs, trained teachers and we continue to support this direction. The market was helped also by the annual conferences which are already mentioned above which we hold already within 12 years. At the same time, understanding of a perspective of cybersecurity so far more is peculiar to private companies and state corporations, and here at the level of the state which announced digitalization by the trunk direction of development of the sphere of management, about information security, unfortunately, forget. We try to inform of importance of work on cybersecurity officials, we communicate with a number of governors, ministers, but process goes not too quickly and still not too effectively.

Lev Matveev: Abroad we observe not trends, but stagnation. The information security – in the form in which it is implemented in an exploration portfolio of most foreign vendors, acts as the stepdaughter. For McAfee, for example, a DLP system is not a main product, and for Symantec too not the main. Among world developers there are not enough companies for which the cybersecurity would be a mainstream. A DLP system is based, first of all, on high-quality information search, and the western DLP are more similar to "excuses" for ensuring "paper" security. Mass leaks from the system of Marriott hotels and some other similar cases visually confirm it. So abroad it is not less problems with cybersecurity at all, than in Russia, and I would even tell that 10 times more. And the main problem is that there just there are no high-quality tools. Conditionally speaking if it is necessary to dig a long trench, but there is no excavator, it is difficult to make it.

Lev Matveev: In the Russian market of cybersecurity there is a race of arms, opportunities and it is good. It is already insufficiently simple to intercept e-mails, analyzing them on a key word. Integration with other systems therefore we also released the product "SearchInform of SIEM"^[2], the solution "KIB SearchInform ProfileCenter"^[3] is necessary], we prepare for release two products on audition of files and control of databases. Thus, the market of cybersecurity moves to complete solutions. I will notice that our company was and remains fashion-makers in the market. From the moment of entry into the market we technology advanced and we are still ahead of competitors for 3 – 5 years, constantly offering the market something new. For example, we made interception of Skype in 2007, and the closest competitor implemented such opportunity only in 2012, in 2010 implemented "elational graph" which showed communications between employees, competitors implemented it several years later. To colleagues on the market to keep afloat, nothing else remains how too to implement the appeared functionality. From here both race of arms, and higher quality of developments of all Russian producers of DLP solutions.

Lev Matveev: By our estimates, we control more than a half of the Russian DLP market. And it without iron, the equipment, infrastructure, communications. SearchInform – the Russian cybersecurity producer of products having implementation at one client more than 56 thousand computers. Besides, we the producer having offices in all federal districts. In due time we made strategic decision that from our nearest office to the customer there has to be a night by train, and it is a maximum. It is impossible to service, for example, Vladivostok from Moscow at least because of time difference. And in general it should be noted that the companies in Russian regions treat service from Moscow badly. The perspective of cybersecurity is rather delicate, the number of questions is discussed personally, during the visit on customer premise therefore there has to be a local guru, from the region, to it more trust. Colleagues on the market, observing our progress, too began to open offices in certain districts.

One more evidence of our leadership – high cost efficiency of use of our solutions. At the expense of powerful analytics our systems allow one cybersecurity specialist to control several thousands of employees. We created in structure of the company special department of implementation which together with the client configures security policies, helps to look for unfair employees, insiders and critical events.

Lev Matveev: No. Even before restrictions for products of the western producers, foreign DLP vendors, combined, occupied at most 10% of our market so their leaving was almost imperceptible.

Lev Matveev: It is a lot of examples of successful application of our solutions in defense industry – 70% of the Russian MIC use our software, and in domestic aircraft industry. Many manufacturing enterprises, most banks use our products. From top-15 banks ten – our clients, ten of top-15 production associations – besides our customers. Everywhere it yields result. We revealed conditional statistics: as a rule, if a system is customized qualitatively, then in the company in half a year dismiss from 0.5 to 2% of personnel. These are unfair and dishonest workers who profited at the expense of the organization.

Lev Matveev: We have examples when employees create pseudo-partner or pseudo-dealers, selling them products at a discount, a set of the facts of falsification of documents, commercial offers from competitors – besides, with a sales objective at a discount and the subsequent receiving rollback. Situations in respect of abuses and violations of personnel a set. For this reason the DLP solution is not the cost item, and investment. In a year it pays off on economy of money due to suppression of actions of unfair employees. And damage will not be caused to image of the company that is not less important.

Lev Matveev: It is several directions of development of technologies and solutions. One of the major, borrowing about 50% of the total amount of works, – completion of systems under needs and wishes of clients. The second direction – optimization of speed of work of solutions that it is especially critical on large volumes. I will note here that we raised performance for the last three years three times. One server is capable to hold not 2.5 thousand final computers with agents any more, and about 7.5 - 8 thousand. It as for the movement on a way of optimization of our solutions, their further improvement.

One more direction – modern technologies. In 2018 we released the "KIB SearchInform of ProfileCenter" which is already mentioned above which we adapt for English, we want to enter with this system international market. By the fall of 2019 we are going to release the file auditor which is already mentioned above – the product allowing to control who and what file opened whether access rights are violated, whether preserving of copies, change of the file and so on is made. It is extremely demanded by the market. And one more innovation direction – the access control to databases allowing to investigate who made requests with selections for unloading for the party or for other incorrect actions. We too constantly develop our SIEM solution. Thus, at us there is a lot of directions of development, but at the same time we remain in the sector of the market of cybersecurity.

Lev Matveev: It is rather an analog. The matter is that we have very high requirements to specialists – to engineers, programmers, testers. And, as we know, it is not so simple to find good specialists therefore programmers at us sit on 20 cities of Russia. Some work at office if in this city there is an office of our company if there is no office – work at home, we established with them remote cooperation. Any IT company has personnel problems, unfortunately. There are such areas where specialists of 10 - 15 people to all Russia, and it is necessary to cooperate with such worker in that city where he lives because not all are ready to move to Moscow, St. Petersburg or other large center.

Lev Matveev: Indeed, exactly the ecosystem including permanent customer interaction with which we organized a chat. Besides, we hold an annual special forum for clients on which we do not invite neither to the press, nor integrators, nobody – only we and our clients. Within several days we discuss made in a year, we adjust and we upgrade plans.

Lev Matveev: We support cloud computing, we control everything that goes to a cloud from the systems of the client, but on our belief a DLP system after all should work not in a cloud. Technology nothing prevents to place the DLP solution in a cloud. However, except interception of e-mails and other functions, we, for example, qualitatively write video from the screen, and these are large volumes and "drive" them to clouds is problematic, not the fact that communication channels will sustain. Besides, the Internet can be available and stable not everywhere that is relevant for the geographically distributed companies.

Lev Matveev: For March, 2019 – yes. In the Russian market the company already has a brand, we are known and respect, in a portfolio of SearchInform there are large implementations, a set of reference projects practically in any field of economy. In other countries business goes heavier as we are forced to create a brand from scratch.

Lev Matveev: The strategy of the movement the same – to improve quality of software what also the cybersecurity outsourcing which is already mentioned above is intended to promote to. We hope that for few years the market will strongly be warmed because the companies which have no selected security officer will buy this service, and then will want to have the specialist in cybersecurity in the state.

Lev Matveev: In Russia we, in fact, have no partner network unless several sales associates. We do not work with big integrators as we have offices through the whole country. And here in the West, we build sales based on a partner network, actively we look for partners in India, Singapore and other countries.

Lev Matveev: With programming at me it was always good - in due time, still being a student of university, I took the second place at the Belarusian Olympic Games on programming among students. Then there were many businesses connected with information technologies. Since 1995, I worked at the market of unstructured search, and in 2005 we were unrolled towards a perspective and solutions in the field of information security, entered this market. At that time DLP products were "curves", search was implemented only by words. As specialists in full-text search, we made at once as it is necessary: the main thing – not to intercept information and to dump everything intercepted in a garbage heap, it is necessary to detect the necessary information, on the one hand, to guarantee a minimum of false operations, and with another – to increase cost efficiency of DLP solutions.