Digital transformation for FinServ organizations with Smarsh and AWS

Patrick Palomo, VP of Solutions Engineering at Marsh: Thank you for that introduction. Appreciate everyone coming and spending some time with us this afternoon, taking time out of your busy schedule. I'm Patrick Palomo, the VP of Solutions Engineering and Architecture at Marsh. I've been with the firm for three years. Prior to that, I come from industry. I worked at JP Morgan and NatWest Markets where I ran risk, legal and compliance technology for over 10 years, solving problems very similar to the ones we're going to talk about later.

Let me introduce Blake to you. Blake, would you mind introducing yourself to the crowd?

Blake Sherwood, Director of Delivery Engineering at Marsh: Sure. My name is Blake Sherwood. I've been with the company for about two years and my background has usually been around security and compliance for the better part of a decade. My involvement with Marsh is to direct and handle platform, architecture and delivery for all our customers.

Patrick: Thank you Blake. We flew him all the way out from London just to speak with you all. So I certainly appreciate you making the journey.

For those of you who haven't heard of Marsh, we've actually been around for over 20 years. We were founded by Steven Marsh, hence the name Marsh. In one sentence, we help our customers manage digital communications for the purpose of regulatory compliance and mitigating risk. We primarily serve customers in regulated financial services - well over 90% of our revenue comes from finserv. The other balance comes from federal, state and local government where we have use cases that overlap.

Presently, we're over 1000 people in eight different countries and headquartered in the US out of Portland, Oregon. We have been recognized by Gartner seven times for being a leader in the industry. The way that we've worked to shape this marketplace is with partners, partners like AWS, technically partners like Zoom, Slack or Box, and more importantly with our customers.

Here's to set the scene for the problems that we solve. This is stats by Statista estimating the global data sphere reaching over 175 zettabytes by 2025. One could argue with the recent advancements in generative AI that could perhaps be underestimated just given the size and scale of that problem. Really the only way for us to manage that properly is via public cloud infrastructure.

On top of that, our customers face an ever evolving regulatory landscape. These are just a snippet of the fines that we've seen over the past couple of years. What we tend to see in the market is that customers are struggling with old regulations being applied to new modalities of communication, combined with brand new regulations coming out of Brussels around privacy, data protection and data residency.

So putting all that together, what most of our customers need, but very few have embarked upon, is a comprehensive strategy around managing their digital communications. You can see that. Well, I don't know how many of you communicated today with your colleagues at work across how many different modalities - you probably hopped on your phone, responded to an email, maybe a Slack chat, hopped on a Zoom call. That is the way that the modern workforce works and there'd be no indication that that's gonna change anytime soon.

I mentioned earlier the size and the scale of that, the breadth and that just leads to so many more areas to mitigate risk. You see from my earlier slide, the reputational damage fines that can come for missteps in this space. Having a comprehensive strategy clearly makes sense. Sounds easy. Here's kind of what gets in the way of that.

This is actually a sanitized version of an actual customer's architecture and it's pretty typical to what we see at many of our customers. This wasn't necessarily anyone's fault per se. What you see here on the left hand side is all the different modalities of communication today from voice, collaboration tools, mobile, including SMS from the carriers, WhatsApp, Signal, Telegram - I would describe that as just good old fashioned scope creep.

Folks had to make decisions, purchase point solutions at different points of time. Mergers, acquisitions, different divisions, geographies needing different systems of record, maybe a compliance team for a capital markets division needed to purchase a surveillance solution. So what you have here is quite common.

The challenge with this is that what you see is duplicate data all over the place across multiple systems that weren't necessarily designed in the first place to talk to one another. So it's complex, expensive. You have issues with data completeness, accuracy and timeliness. It's a challenge.

The budgets that our customers tend to deal with today have been outpaced by the pace of regulatory change and the explosion in communications data that we talked about earlier.

Here's our solution to the problem. This is the Marsh Enterprise Platform. We do specialize, we have a very long history in the capture of digital communications as I mentioned before, from voice to mobile to social - that's all brought into a comprehensive communications data warehouse that we call CommVault. And on top of that sit our applications.

So the first is what many recognize as an archive - it's a regulatory recordkeeping requirement for us to index and store that data to make it available for audit or its cousin eDiscovery. So for those who have colleagues in the legal space supporting litigation or legal ops, they're very familiar with their needs around early case assessment and trolling through data, exporting it to external counsel, other eDiscovery providers.

In the middle there, you have Supervision and Surveillance. So in regulated financial services, the compliance teams that we support need to manage programs, monitoring communications, detect potential fraud, market risk, insider trading, malicious intent or in some cases just negligence.

We kind of wrap that around a framework of APIs for extensibility and it's all of course supported on a public cloud framework with AWS.

Just to touch on what's so important about our relationship and history with AWS - these are kind of the four tenants that we tend to talk about. Blake is actually pretty well positioned to touch on these four tenants. So I'll hand it over to Blake and you can talk a little bit about availability, security, resiliency, and all the wonderful things that are important to our customers.

Blake: Thanks Patrick. Part of my role inside Marsh is to...well, as you can see, the ecosystem is changing quite extensively. The market is moving faster than technology can. We have to adapt very, very quickly and we focus on these four main areas because at the end of the day, we all like to go to sleep at night and not worry about our ecosystem.

Availability for us is really important because as we have been responding to that substantial data growth, we go north of somewhere near 10,000 EC2s for our entire fleet across five data center regions. So it's important for us to kind of take advantage of what Amazon proposes and what they advocate in regards to their feature set for EC2 Auto Scaling because simply put, managing that fleet and making sure high availability is five nines, 100% all the time, it can get very, very complicated. So a lot of the native features for AWS really help us out there and we focus on triple active high availability for a lot of our deployment.

The next one that's kind of near and dear to me is data residency and privacy. As anyone can spend 10 minutes on looking on the news, you'll see that there's a new headline every day. So a lot of companies are getting very, very concerned of where their data is centered. We had a bit of a challenge internally in the company is we have north of 100 deployments, near of 6000 EC2s dedicated to data storage. How do we respond to our customers needs going into each individual region?

So we had to come up with a way of deploying an entire bootstrap, entire region from top down from infrastructure all the way to applications in under 48 hours. Because as our customers got more inquisitive of what the actual market was doing for data residency, we had to be able to go to a new region very, very quickly. So we have a custom Argo workflow process in the background that will deploy our entire fleet with two people involved under 48 hours. So it's quite important to us to be able to respond to the demands of our customers.

And so scalability, as you can imagine, we have all this data, what do you do with it? They're gonna query it right? Now scalability for us is responding to latency, responding to availability issues, responding to performance. Now one thing that we are able to do with this fleet of EC2s and Amazon's auto scaling is we can swap out instance classes dependent on each customer's workload requirements. And we can do this in a very, very rapid fashion and we can do somewhere north of I think the latest statistic that I saw was about 500 EC2s per day we can swap out for an instance type.

Now this gives us a unique position of actually helping our customers respond to when they need their data, now they can have it.

Now finally, security. I think it touches a lot of areas but one thing that my department and myself focus on work quite heavily is it's one thing to have XDR, it's one thing to have pen tests and whatnot. But often we find that security, there's one big thing that really sticks out to us - what do we do with 100,000 secrets and credentials that are stored in our background? How do we manage our data? How do we do all these integrations, especially with a five data center region bootstrap?

Now we partnered with HashiCorp - they're a Vault solution and we have a quite intricate design flow in regards to how we manage our credentials. But we pride ourselves on this integration going back to, we can stand up a new region in 48 hours, top the top down. After that 48 hours is complete, our engineers can log on to follow their applications and update with no downtime.

So between all those four things, we get quite a lot of focus on moving faster to responding to the industry demands and changes.

Patrick: Thank you Blake. But I mean, just to go back to, to what our core expertise is, digital communications for our customers. That means the communications of their C-staff all the way down to an everyday employee as well as their most important customers. Where we are today is we are really critical infrastructure, a critical service for our customers. So security, availability, the scale that we talked about, data residency - this is not, these are not nice to haves, this is the foundation of any of this really allows us to deliver at the pace that we need to.

To kind of bring it all home, as Blake mentioned, this is really all about getting to outcomes faster for our customers leveraging public cloud. Just how many releases do you think we did last month, whether it's for functionality or just to keep the system healthy? What does that look like for us?

Blake: I think last month we clocked about 750 changes with about 250 differentiated releases. It's just not possible without the modern technologies that we have for availability.

Patrick: So to summarize kind of what we offer is an end to end, fully integrated platform with all the scale, resilience, security and agile delivery that our customers expect. You don't have to buy it all at once - categorically you would to get the most value. But the digital transformation that I was describing against that legacy architecture, that is a journey, it takes time and we're happy to consult with our customers on how we can help them progress on that journey.

I'm looking at the clock here. We wanted to leave plenty of time for questions from the audience. I know some folks have already expressed interest in a demo. I have one of my colleagues, Ryan Batch, in the booth - he's going to be doing demos. Our booth is just over here to the left. And if you're too shy in this setting, we are having a happy hour later at Sushi Samba. So stop by the booth, pick up an invitation.

With that, I'm happy to pause for any questions from the audience.

Audience Member: What exactly is your storage backend? Because when we're looking at the other, the diagram, you had a lot of Veritas in there, right? So what's your backend storage? Is it S3 for object storage?

Blake: We have constant conversations about ingress, egress, simple tiered storage compatibilities. We have a fairly extensive solution with tiered storage, we take advantage of the Intelligent Tier for S3. That's our biggest win. And we have a pretty intricate single tenant deployment aspect to keep our cost allocation. Our finance process is pretty tight where we can see our changes in actual spending patterns, anomalies, all those types of fun things. But yeah, the our customers have a constant conversation with us in regards to how much they're actually going to be paying for our storage. So we've developed some pretty interesting ways to get around that. But our primary one is the Intelligent Tiering for S3.

Patrick: Good question. I wouldn't want folks to leave the impression that because we supply a regulatory compliance solution, it's a license to operate issue, that means our customers have unlimited budgets. We see a lot of scrutiny on all spend regardless of how important it is for regulatory compliance.

The other way we help manage that, for example with eDiscovery - the reason we invest so much in APIs is because categorically, our customers will need to get data out of the platform. They might have to produce it to a regulator, a third party discovery provider. So it's gonna happen. So the way that we help manage that beyond what Blake just mentioned is we invest in early case assessment capability so that they can do more work in the tool to try and reduce the third party discovery cost by producing the least amount of data possible to help manage that. Does that touch on most of your questions?

Audience Member: Yes, you explained everything perfectly.

Patrick: Well, listen. With that, I will thank you all again for taking the time to spend with us today. I really appreciate it. Again, come find us at the booth over there, see Ryan for a demo. Come talk to Blake or I after this if you have other questions. We sincerely appreciate you guys joining us. Thank you Blake for your assist.