Fernando Serto. From Brazil to Sydney

Hello and welcome to We Are Cloudflare. I'm João Tomé, I'm a storyteller at Cloudflare and with me is Fernando Serto. I was trying to do it with an English pronunciation but I don't need because Fernando is Brazilian and we could actually do this in Portuguese, in Portuguese, totally in Portuguese, but let's not do that for our audience. So welcome Fernando. Thanks João, it's a pleasure to be here. So you're the principal architect and evangelist at Cloudflare, right? Yeah, so I'm part of the field CTO group in Cloudflare, so what people see me as a chief technologist and chief evangelist for Asia-Pacific, so it's been a great experience for the last, coming up to 11 months so far. Lots of really interesting conversations with customers, so it's been great. We entered the company at the same time, in September I think, so we are in the same class in a sense. That's right, class 187, if my memory serves me right. Exactly, exactly. And interesting enough, you're based, you're Brazilian but you're based in Australia. Actually, you work in Australia for 20 years now, right? Yeah, it's 21 years, yes, yeah. And funnily enough, I am in Brazil at the moment and I was in San Francisco for RSA last week, so I offered some help to the team here in Brazil and so I just came back from Sao Paulo today, so I'm in my parents' country town today, their country house, so yeah, working across all sorts of time zones as well. Exactly, that's quite amazing. And I'm in London, I'm not based in London, usually I'm in the Lisbon office, but because of Connect, I'm in London right now, I'm in a phone booth, but let's try a different type of thing, because usually we do this We Are Cloudflare TV stuff at home or in a phone booth. Let's try to see a little bit of the office, because here right now is 11 p.m., so there's no one here at all, the office is quite big and it's completely empty, so this is actually one of my favorite areas, like a library type of area, quite amazing. Wow, that's a pretty cool office. Yeah, it's been really interesting as well, the experience for both of us, starting during the pandemic, right? And last week, obviously the offices in Sydney haven't been open for quite a while now, but last week I had the opportunity to visit our headquarters in San Francisco, and for someone who has been in the company for 10, 11 months, and it feels like it's been five years already, and I've only now been able to visit one of the largest offices we have across the globe, it was a pretty good experience as well. Absolutely, absolutely. Just to give you a little more insight, here I have the time we'll have for the segment, it's something from our London office, and there's the lava lamp, the so popular lava lamp, and here is a t -shirt, this is not one of the more known, but it is a security phoenix t-shirt from the Califlare security team from 2018, and his ear on loan from the museum of John Graham-Cumming, our CTO, so there's a bunch of t-shirts here. Some pretty cool memorabilia there. Exactly, exactly. These offices are becoming something else, very interesting. In Australia we have offices, right? You work usually at the office? Yeah, yeah, so we have an office in Sydney, and it's coming up to, I think, 50 of us in Australia now, so I was employee number 29, and a very short time ago, right? So it goes to show the growth of pretty much every region that we have a presence in. Absolutely, absolutely. Let's go into a little bit more of your history. So first, let's go back in time and try to understand how did you start to be interested in technology? How do you start to build your career in Brazil still? How was that process? Where are you from originally? Yeah, so I was born in this town here where my parents live now, and it's called Sorocaba. So it's about 100 kilometers away from Sao Paulo towards the country. I've started in IT because my dad was in IT, and he was a CEO of a large American company in Brazil for quite a while. So he's been retired for 20 years now, so he retired at the age of 54. It doesn't happen that often, but he had a great career in IT as well. I started with sort of just the curiosity of playing with computers and sort of looking into how things work in the very early days of the Internet, right? I'm talking 1990 probably, and 92, 93 maybe. I remember we had an Apple 2 computer for a while when I was growing up, and my brother and I used to program in BASIC on that computer. And one day, we asked for a PC, and dad brings back a bunch of boxes at home, and we look at that. There was one of them resembled a computer, and everything else was just parts, right? And he told my brother and I, well, if you want a computer, you got to build one, right? So for us, it was sort of understanding how every component of a computer worked. Obviously, things have changed a lot since then, but then from a security perspective and more building a career in IT, I went to a graphics, like printing, sort of designing, and the end-to-end process of how magazines were built and things like that, but back in, that's my high school. And one of those schools that you come out with a trade, it's called Senai in Sao Paulo, so it's funded by different industries and things like that. And it was sort of, what do I do from now on? And I was already into Linux and very early days of Slackware for anyone who comes from a technical background. And I got a job at a service provider as building websites, as a web designer. You didn't went to college back then, because you did like that? I did, but I have a degree in marketing. Oh, interesting. Yeah. And so before I went to college, I got a job at an Internet service provider as a web designer. And I met the guys who were actually running the ISP from a technical perspective. And obviously, a couple of them were really into security. And I got to meet a lot of and get involved with a lot of the guys from the offensive side, right? Because back then, there was no laws against digital crime, especially in Brazil. So there was a huge underground community in security, especially on the offensive side. So I've made a lot of friends then. And it was just a passion, sort of understanding how things work and what does consist of hacking something. And all the concepts that we talked today about Zero Trust and moving laterally in a network and all that, we used to do back then. So it was sort of a really interesting way into how the offensive mind works. And very early on, I started to get jobs. I worked for different service providers as a Unix engineer. Then I moved to Australia. I was doing pretty much every... What made you move to Australia? Because it's not an obvious choice. Because although it's in the South Hemisphere, it's pretty far away. It is, yeah. In those days, I think it used to take, I think it was about 36 hours to go from Sao Paulo to Sydney. So quite a journey. But my little sister was already living in Sao Paulo. And I had a on my birthday in Sao Paulo. Not something I'm proud about telling people about Brazil, but it does happen. It's a different environment here. And it was sort of, I'm going to try and move overseas and see how that works. And it worked pretty well. And it was an opportunity, right? An opportunity in terms of going there, in a sense. Yeah, yeah. So then my first job there was a jack of all trades for a small company that ended up being acquired by Accenture at the time. So there was a department in Accenture called Accenture Marketing Sciences. That was pretty much created with the acquisition of this company that was called Memetrics at the time. And then from then on, my next job was at Fujitsu as a Unix engineer looking after middleware. And the early days of people doing payments and driver's licenses, renewals and things like that online. And I had a lot of customers in that space from a government perspective. And sort of, you can see where the career progresses, right? And obviously eventually I ended up working for a vendor in pretty much the same space as Cloudflare. And in the last year, I made the choice to join Cloudflare. Right. You were seven years at Akamai, right? There. Correct. There in Australia, because you're not in Australia right now, but there, right? Yeah, yeah. In those seven years, I started to help Akamai build a business unit that was around Zero Trust. There was phenomenal growth at the time from a people perspective. And it was really interesting to see the early days of talking to customers about Zero Trust, and they were like, what? Are you an alien kind of response? And where we are now, right? Where everyone is pretty much moving to that framework. And I'm talking 2014, 2015, right? Talking about Zero Trust then, it was like, nah, get out of here. That's witchcraft. Yeah. They were wrong, what they would say like that. Oh, a hundred percent. Yeah. Today, we see the amazing difference that it does for so many already. Yeah. I'm interesting also to understand, because going to Australia, was there a moment where you thought, well, this is so different? In what way do you see differences there in the tech sector? But not only that, your adaptation there in the beginning and the progression there after? Yeah. I think the migration to any countries is always going to be a challenge, right? From visas to moving to permanent residency to becoming a citizen. It's quite a journey, right? And it's not a given that you're going to be allowed to stay in the country forever, right? So it's based on skills. It's based on your ability to speak English fluently, which sometimes I still doubt myself if I'm there from a communications perspective. But you already have a small Australian accent. Little bit of an Aussie accent, yeah. Yeah. It's one of those things that when you want something and you really go and try and get it, the road may be rocky, but it's not impossible, right? And I think that probably what made me stay was Australia is a country that the very early adopters for technology, right? So in the very early days of AWS, for example, Australian organisations had the largest, from a percentage perspective, the largest amount of companies using cloud in anger, right? Not just playing with it, like actually moving workloads to the cloud. Obviously, our idea of cloud at the time was really picking up virtual machines that they had on-prem and shifting to AWS, right? And obviously, AWS was the only player at that time. Even what we see people doing with our platform today from a serverless perspective and things like that, there's not many countries that are that forward thinking from a, let's do things differently. Technology is here to change things. I've had a digital driver's license for, I don't know, probably four or five years already on my phone. So I walk around in Australia, never carry a wallet, right? So every ID, every interaction with the government is digital now. We have that in Portugal, two years it started. But the funny thing is if a policeman and most policemen don't have like machines that can read and can confirm that. So you have to show your- The physical license. Yeah. So it's like, it's possible, but if the officer doesn't have the reading material, it's a problem. So- Yeah. And just to give you an idea, right? Prior to Akamai, I worked at Telstra. And before that, I worked at Fujitsu, as I mentioned before. Between the time I was in Fujitsu for about four years and probably about four years at Telstra as well, there was like a big push to modernize police cars. So all the tech that you can think of in police cars, we already had in Australia, like probably close to 10 years ago, right? So the number plate recognition, which everyone hates, right? Because it picks up when your car is unregistered. It knows if your driver's license is expired because it's real-time communication with the data centers. So sort of that building the infrastructure to be able to do things like additional driver's licenses and additional Medicare cards and things like that, it's been built a long time ago, right? So now we're sort of layering on with what else can we do in the country to help citizens, right? And even healthcare and the health space, there's a lot of stuff coming up every couple months with how to interact with hospitals and doctors and things like that, right? I'm interested also to understand a little bit of, since you began at Cloudflare, what do you saw in terms of the Australian market? So it's the APAC, but now it's called APGC market, exactly. So what do you saw in terms of differences there of the market? Did the pandemic help in the way people saw, not only in Australia, but in the whole region in a sense? Yeah. I talk a lot about Australia because that's what I call home, but I spend very little time in Australia. Like we saw, you were in India two weeks ago, right? One week ago, you were in San Francisco. Now you're in Brazil, always representing Cloudflare. So always moving around. Yeah. Just before the pandemic, I did close to 40 weeks away from home in 2019. So I always try and be home on the weekends, but I spend a lot more days outside of Australia than inside of Australia. But to answer your question about the pandemic and the changes, it was quite surprising in a way because everyone was caught in the, are we ready for this, and I think that even though we always prepared for the worst from a resiliency availability perspective, I don't think we ever had the ability to foresee that 100% of staff in large organizations, the largest banks in every country would be in government departments and would be working remote. So the types of technologies that we had at the time with the technologies like VDI and remote access to the means of VPN, it just couldn't scale. And that was probably the biggest eye-opener for a lot of organizations. There's got to be a better way, right? And for not just ourselves who are doing a lot of work with customers to replace VPN, to provide a much better user experience, every vendor in that space is doing well because of the amount of transformation that's going at the moment in every organization. So we talk a lot about Zero Trust, but I think for us in Cloudflare, Zero Trust is a portfolio of products, and everything that touches the user and the user experience, and we're talking about IT and third parties and anyone who needs access to internal things, that was probably the biggest shift in how they do things and focusing on the user experience a little bit more than just purely, you work from home once every two weeks and who cares if performance is a big crap during that day that you work from home, right? Now, it has to be the same sort of experience as if you were inside the office, right? And it troubles your work. If you have a bad connection, if you're using a web-based application, or not a web-based application, but you're using those sorts of things, and the Internet is bad, or the service is not working well, or your contact with your network or your team is not working well, that impacts completely your work, your flow, your organization, your focus. It's pretty much incredible. I remember the days of going to some sort of government department branch, like you need to renew your driver's license, I'm sorry, the systems are very slow today. And it's very rare for you to hear that these days, right? Because I think that, because of these things that we carry in our pockets, the expectation for that instant response to whatever you need, right? It's sort of a, no one has the time to wait five, 10 seconds anymore, right? In the screen. So then it's, or the patient, sorry. So then when we translate that into the physical world, we expect the same sort of thing, right? So that sort of access, when you're talking to a call center, when you're going now back to seeing people in person, you have that sort of urgency, right? Even if you have nowhere to go, you still have the urgency to get the response, right? It's more frustrating now that you tasted the magic of the Internet, how it could be. Correct. Yeah. And I was in a meeting yesterday in Sao Paulo with an organization that does, sort of from, they started as a payment gateway for web services and they started to sell credit card terminals for merchants. And I asked them, what was the shift during the pandemic? Because they're not selling as many machines anymore. And the response was that the payment through web services and the types of services they have from retail banking now have really surpassed the need for physical credit card contact type of thing, right? So it's just how the world adapted, but we're still doing the things that we do, we're just doing it in a different way, right? And the digital platform that we're able to provide now has really changed how organizations can be a little bit more creative in how they retain revenue and retain the user base and retain employees because we now enable them to work in a hybrid or remote fashion and they don't need to go into the office anymore, right? Let's go back a little bit. You already explained this a little bit, but let's be more clear. What does a principal architect and evangelist do in a sense? You already explained that you go about the world, meet customers, partners, and share how our technology can help them. Mostly is this, right? Yeah, it's funny, right? Because the title principal architect is not something that we use at all. And I think it was just how HR managed to get my headcount raised and Jonathan Dixon, the managing director and VP for Asia Pacific. But my role is really, I'm part of the field CTO group, so I'm the field CTO for Asia Pacific, Japan and China. And the role is probably for a technologist is probably the most interesting role. And I get approached by our pre-sales engineers that they want to do that type of role one day. And it's sort of a bridge between Cloudflare and what the customers are trying to achieve, right? So it's sort of a bit of a role where we had the opportunity to co-create with customers. I get access to early roadmap items. I know the direction that Cloudflare is going and going into organizations and talking about what we can do for them today and also what we can do for them in the future and what else they want us to do for them in the future. It's a pretty cool job, right? And a lot of what I do, the evangelist part is really, I'm a marketing resource in a lot of ways. So a lot of the conferences that we do, I'm the main speaker for Asia Pacific. I'm trying to change that a little bit, so I don't need to travel as much, but it's sort of trying to get the word out there into what Cloudflare does today. I think when I looked at Cloudflare from a competitive perspective in my days at Akamai, we only really cared about solving problems related to web application firewalls and distributing our service. If you look into the size of our portfolio now, during RSA, I did five or six executive briefings with customers from mostly Latin America and Australia. And talking about what we do from allowing customers to run their corporate network on top of Cloudflare now, very few people know about that, right? So the role that I do is really getting the word out there of what else do we do, supporting our marketing efforts from field marketing and also product marketing, right? And how do we tackle the customer's problems and how do we build a better messaging to get the word out there that there's a better way of doing what you're trying to do today, right? Of course. And there's a lot of things we can add there. There's Cloudflare 1, which is like the whole package of things. But do you have like first a favorite product of yours and next a product that you think that is being more impactful in the customers you are reaching out and hearing their stories? I would say my favorite product by a long shot is our remote browser isolation. And I'll tell you why, because the experience of working with remote browsers, there's a lot of reasons that I'm not going to get into a lot of detail on why customers should look into that, but there's a lot of threats that are exploiting vulnerabilities on the browser itself, right? So a lot of the challenges that organizations have is all around the, I can control the server side. I can control my perimeter, even though the perimeter has dissolved a long time ago, but I can control, build security around the application itself, right? However, once the browser is being rendered, you have no control whatsoever on what's installed in that device, right? Especially if it's on a managed device. The only way we do this is really controlling what applications users can have in their devices. So if you think of Google Chrome, for example, with the amount of Chrome extensions that are in the Chrome store, like all these can be used to take data out of the browser, right? Understanding what fields are in a form, trying to exploit the user, gain access to the machine and so on, right? The user experience to solve that problem with remote browsers is a pretty obvious one. When you see the browsers rendering in a remote desktop, for example, it's a pretty poor and laggy experience, right? I've been a user of remote browser installation since the day I joined Cloudflare and I didn't know, right? So there's no impact to user experience at all. And now we're looking into environments like call centers, for example, right? Where agents are not even allowed to have access to other tools, but sometimes they're still going to have their phone in their pocket. So to be able to put watermarking in this section. So even if someone takes a photo, it's still pretty obvious that it's that's being stolen in a way from systems that they shouldn't really have access to. And just basic things like being able to disable copy paste and upload the documents and doing a lot of really cool ways to control third-party access into applications and all that, right? So it's probably my favorite product. When I joined Cloudflare, when I was going through the interview process, one of the people interviewing me was David Harnett, who's one of our directors in the product management group. And he came from S2, which was the acquisition that we made that enabled us to have that type of technology now. And so as soon as I started talking to him, I was like, oh, sorry, are you the guy who came from S2? It was sort of a, you know, I love that. I wasn't even an employee yet. I love that product. Always a good way to start a conversation. Yeah. But then, you know, if you look into probably the, you know, the biggest adoption for us, it's sort of, I don't know what the exact split in percentage will be between our application services portfolio and our Zero Trust portfolio, right? Because most of the conversations that I have today are around, you know, IT problems, right? So we're talking about Zero Trust and what, you know, around Cloudflare One, around, you know, giving customers the ability to run a network as a service type of environment on top of Cloudflare, you know, firewall as a service and that type of thing with, you know, remote access and secure web gateway and, you know, CASB all bundled in as well, right? And you see that making a difference for those customers? Yeah. Yeah. But the, I think on the web space and, you know, all the work that we're doing from an API security perspective is really changing the game. And we see a lot of customers moving from legacy web application file infrastructure is just because of how difficult it is to be accurate when you're talking about API security, right? And now with the API gateway coming out, I think it's next month. I can't remember what date it is. Yeah. I think so. I think so. Yeah. It is really giving people the ability to do all the services that they used to do at the entry point in the cloud environment or, you know, in the data centers, we're actually doing all that at the edge, right? So the speed of response and, you know, the ability to couple that with our workers platform and, you know, serverless and, you know, now serverless with, you know, us supporting MQTT brokers on that as well. So there's, you know, from a building external facing apps is such a huge change in capability, right?