Skip to main content
Christopher Witter

Christopher Witter

Cybersecurity leader specializing in threat hunting and detection & response; former leader of CrowdStrike's Falcon OverWatch; current roles at Dropbox and Nebulock.

Jun 15, 2026

15:15
What would it take you to overcome the resistance of no, no, no, I want one vendor, one tool? That's more of a winter question, maybe.
15:22
Yeah, no, I mean, it's simple.
15:24
It would come down to like, you know, do I have the people to operate the tooling, right? It would be hard, I would say, because you think about what are the largest data sources for most organizations, right? You know, maybe it's my EDR, a 300,000 employee environment, right? And I don't have a lot of cloud or I'm moving to the cloud.
15:41
Like there are still organizations out there that unbelievably are still like on the fence, still have on prem, still, you know, doing their own data centers or something.
15:50
And so where is the source of all that data and pain? Because to Alex's point, like if I have someone who can write the parsers and I'm getting it for cheap and free, like I'm now DevOps tied to that forever.
16:03
When my firewall vendor moves a field, I break the entire pipeline and I have to dedicate people to that.
16:09
And they have to be aware of it, and then they have to fix it in a timely manner and maybe backfill data or whatever.

20 MINS LATER

36:43
I mean, unless they're coming out with MCPs, but I don't really see that happening yet.

We value your privacy

We use cookies to understand how you use our platform and to improve your experience. Click “Accept All” to consent, or “Decline non-essential” to opt out of non-essential cookies. Read our Privacy Policy.