In episode 101 of the IoT For All Podcast, Evan Cummack, General Manager of IoT & Wireless at Twilio, joins us to talk about device security and innovation in the IoT space. Evan shares Twilio’s approach to security through a device’s lifetime, his advice for companies getting started in the space, and what it’ll take to get IoT innovating at the rate of other leading technologies in 2021.

Evan Cummack is the General Manager of IoT at Twilio leading product, engineering, and go-to-market functions for the business unit. Evan joined Twilio in 2011 as one of the company's early employees and is credited with building several of Twilio's first products, consulting with Twilio's largest customers on their global communications solutions, and launching Twilio's IoT business.

Interested in connecting with Evan? Reach out to him on Linkedin!

About Twilio: Twilio is the unseen infrastructure powering communication behind the scenes. Chances are you’ve interacted with Twilio, you just don’t know it. If you’ve ever texted your Lyft driver, logged into your Netflix account using a texted security code, or texted your Airbnb host, you’ve used Twilio.

Key Questions and Topics from this Episode:

(00:35) Intro to Evan Cummack

(01:21) Introduction to Twilio and what prompted Twilio’s move to IoT

(12:06) Can you describe Twilio’s approach to IoT?

(15:30) What can be done to improve the rate of innovation in IoT?

(19:48) What do you think about when planning for the security of a device throughout its lifetime?

(22:59) How do you advise companies in choosing between full-stack IoT development platforms and building it themselves?

(26:10) What approach have you taken to security firmware updates? What have been the challenges there?

Transcript:

- [Announcer] You are listening to the IoT For All Media Network.

- [Ryan] Hello everyone and welcome to another episode of the IoT For All podcast on the IoT For All Media Network. I'm your host, Ryan Chacon, one of the co-creators of IoT For All. Now, before we jump into this episode, please don't forget to subscribe on your favorite podcast platform, or join our newsletter at iotforall.com/newsletter to catch all the newest episodes as soon as they come out. So without further ado, please enjoy this episode of the IoT For All podcast. Welcome Rohit to episode 19 of the IoT For All show. It's great to have you and thanks for taking the time to connect with us today.

- [Rohit] I'm delighted to be here, thank you for inviting me to the show.

- [Ryan] Absolutely, one of the best ways for us to kinda get this started would be to provide a short introduction about yourself and if you can give some relevant background information, anything you think the audience may find interesting, that'd be a great way we can start.

- [Rohit] Sure, so my name is Rohit Tripathi. I am a senior vice president, head of products and Go-to-Market for SAP Digital Interconnect, one of the end to end units within SAP. As a background on myself, I'm an engineer by training, worked in supply chain space, went to business school, after some stints in strategy consultant landing up in SAP through various roles. And now I'm running the products group here. And I guess that's got us into some of these discussions with you guys on IoT and other tasks.

- [Ryan] Yeah absolutely, I think, would you give a little bit context in kind of how you got into the space? I know, just doing some basic research you came from Boston Consulting Group and you have a background in that area. How did you kind of get into IoT, get into the role you're in now? What kinda triggered that change, or that at least evolution into there?

- [Rohit] Yeah, I mean, I think, if you think about it, right? Like from my supply chain days, right? Like the inventory tracking, shipments, managing supply chain activities is a challenge, right? It's something that we still face today in businesses. The first step of that was putting in enterprise software to address those concerns. But yet the real-time nature of that was limited. And I think in early 2000s if you guys remember then RFIDs were a big thing, that's when we started doing that to get some real time signals to address these things. And I think that what led me to get drawn to this whole machine to machine conversations, things to machines conversations, and which then now or time it has a evolved into what we referring to as IoT today. So I think it was that background that led that interest.

- [Calum] Could you talk a little bit more about supply chain? So that's obviously a big area in IoT, but I'd be really curious to hear about your experience and what you've seen since you've been involved, or were involved in that several years ago and have likely seen a lot of changes there as far as new technologies, enabling different applications. And when you first got into it, what was the cutting edge? Whether it's RFID or that enterprise software you mentioned and what does it look like today if you're still involved at all?

- [Rohit] Well, so in the very early days, right? And then even I was actually just barely getting out of college. So I'm not that old guys. So being that in. So in the '90s, very early '90s, if you think about what was happening in supply chain and the manufacturing world, that was the first wave of digitization, so to say. And essentially at that point in time, the basic materials planning processes were being digitized. The processes were being standardized and that's when the big ERP providers like SAP and others started coming into like being relevant and providing clear impact to the organizations. The next level then that grew once you had those processes standardized and material planning things in place, in the 2000s, the big thing was all about supply chain, planning and optimization, And that's where RFID and other elements started becoming relevant. I think the challenge then that these softwares and even the customers, you of them, faced was, that the hardware, the in-memory capabilities were not enough, or were very expensive to make things more real time. And I think now things have become more real time. Like we all expect things to be, information to be updated instantaneously, right? Like, of course there is some lag, but it's no longer acceptable for any manufacturing organization to say that we work on plans that are like one week old or two weeks old, or information is as of last month, right? So I think that's the biggest change and I think that's well connected within IoT are like leading that forefront now if you think of the manufacturing digital supply chain.

- [Ryan] Yeah, I was gonna say that to me one that I would guess would be the connectivity piece. So if you're dealing with supply chain, that's often global. And so if you're tracking--

- Right.

- [Calum] Thinking over very large geographies, that means you're gonna need certain kinds of connectivity. So like recently there's been a lot of an upsurge in IoT applications and things using like low-power wide-area networks like LoRa, but--

- Yes.

- There's a and so you have to install those in a specific area. Whereas if you're going--

- Yeah.

- Over borders or across states, you probably need cellular connectivity, or perhaps even satellite if you're going to remote locations. So what are your thoughts there as far as like the evolution of connectivity and how that's been impacting supply chain, or other Applications or applications you're involved with at SAP?

- [Rohit] Well, that's really, if you just, you mean I could not agree with you more, and I think if you think of the current supply chain today, right? Like you go, let's go from a factory, right? Like that's where things are built. Then they go to a warehouse where they are stored and then broken up into pallets and loaded into things, and then they are shipped, right? If you think of each of these three domains, connectivity is needed, but they all come with its own respective limitations or challenges. So when you're in the factory, actually, because it's fully under control, WiFi is actually a very reliable use of connectivity there, right? But then very quickly, one needs to switch over when it comes to a warehouse and you don't have more geographical disparity coming in, but it's still controllable and that's where things like LoRa become quite relevant as you are referring to. And you're spot on, right? Which is warehouse environment is perfect for those kinds of low-power connected options. But then once you put them on trucks, which are then crossing across state lines, or even when you think internationally they are crossing across country lines, or ships, then perhaps cellular and WiFi is the only option. And I think today in supply chain when thinking of connectivity this is something that one needs to, like for those of us in this business who are evaluating options of connectivity, they need to make sure that they address all three of these, right? And not just focus on one or the other, more importantly, I think people should think of connectivity when thinking of IoT. I don't think many people think of connected with you when they think of IoT.

- [Calum] Right, and not only just thinking of connectivity which is a critical piece of it, but you know what connectivity makes sense. And is that the only one you're gonna need? So, as you were just saying, if you need, the reason you need different kinds of connectivity for different contexts is because there are trade-offs. And so something like cellular is great for certain applications because you have a lot of the infrastructure already built by these cellular carriers--

- Right.

- They can transmit over large distances and can be very high bandwidth. I mean, particularly right now with 4G and with the coming of 5G even more.

- Oh yeah.

- But often the drawback is power consumption. And so you have devices and cost. So if you have thousands of sensors that you want to deploy somewhere and they're very low bandwidth, they don't need to let it send a lot of data. Maybe it's a temperature reading or soil moisture, then for those maybe cellular it doesn't make sense. But in the supply chain example, I find that really interesting because you could potentially have things that are moving across these different spaces, where they are in a manufacturing setting. So one connectivity type makes sense, but then they move and now they're being transported. And now that connectivity type might not make sense. So it seems like a core piece is you'd want things that can adapt to different kinds of connected pieces. Would you agree with that?

- [Rohit] Yeah, I mean, I think the element is that if, it's interesting that like as we are discussing through this, to some of our listeners it may appear that, oh, this is complex, right? Like we have already started to what was a simple us which was just connect my IoT device, right? Like we already making it sound that the complexity is increasing. So in a way, yes, we are bringing in different formats. But essentially what we're doing is, what we are saying is that one needs to think of these various dimensions of connectivity for the, actually the whole or successful execution of the IoT investments, right? And I think the element has to be not only looked at from what makes sense in that environment, but then also perhaps from cost perspective, right? Like, because, and cost, you touched upon power, which is one element of cost, but then there is of course always the direct cost of data that flows, right? And then the last part is thinking about security for the device, as well as the data that is flowing from the device, right? Let's not forget that. And so various protocols will have different levels and layers of security that can come in. And I think that's also the dimension to think of when looking at these options of connectivity and yeah, I mean, you're right, man, it has to be these different formats. There is not one answer to say, go do this and then you are connected for your IoT world.

- [Ryan] As I said, can you talk a little bit about then the IoT Connect 365 offering that you guys have, 'cause I think that kind of plays into this conversation pretty well.

- [Rohit] Yeah, I'm happy to. So just before we get into like why IoT Connect 365 and why are we doing this as SAP Digital Interconnect, just a background on the group. So SAP Digital Interconnect is we are in the business of providing last-mile reach and connectivity for various SAP applications. And then also for standalone non-SAP applications as well, like whether it is connecting businesses and customers to their employees, or connecting businesses and things to each other, or to the end customers, right? And I think our mantra is intelligently connecting everyone, everything everywhere. And so what we were doing to everyone with our various channels, and then now with rise of IoT with IoT Connect 365, we are bringing the same element of connectivity to businesses, right? And our objective is that we wanna hide the complexity that we just discussed from our end customers, right? Like we want to say that we be the one conduit to the end customer, but then on the backend, we deal with these various connectivity issues that are there, right? Like much like today, when an enterprise sends you an SMS, the enterprise doesn't really care which telecommunications provider that the end customer is on, right? They just want the message to be delivered. And so we helped them achieve that, right? Like we take care of the complexity and working on the backend to our APIs with various telco providers and then expose one single API to the customer and to the enterprise, I mean. And so that is something that helps them simplify that communication and we bring the same benefits on the IoT side with IoT Connect 365.

- [Ryan] Right, yeah, I mean, I think one of the things that might bring, kind of provide a little more context to what it is that you guys offering does as we could talk about some in individual situations or Applications that this is actually being used in now. I know you probably can't mention too many of the customers or clients per se, but at least talking about what kind of Applications are benefiting from the service and kind of what was happening before the service was installed and now using the service the kind of the benefits that they're seeing.

- [Rohit] Yeah, I mean, there are actually, we've got several customers across the globe, so let me talk one about in North America, this is a car manufacturer, right? And what they were deploying is, they were coming up with their new car models and what they wanted to get was some sort of connectivity options in these cars for getting information on maintenance, infotainment and related analytics, right? Like they they wanted these test cars that they were rolling out to communicate that back to their main systems and collect that information. And so, as you can imagine, what they want to find was connect with the option that works across geographies, these are cars, they will be driven, and when they are giving them out on lease to the end customers, you cannot really tell the customer, hey make sure that you always have it connected on WiFi, or only drive in this city or et cetera. So they wanted something that was more global. They didn't want to deal with like only this operator or that network, et cetera. So they came to us and what we started with them was like, let's do this in small steps, right? Like, rather than going and saying, let's install this in the entire fleet, start first with like a small proof of concept. And this started with like 40, 50 cars, deployed the eSIM devices, got the BI integration and sort of went live in the lab, right, so to say. And then they started collecting this information. And then within three to four months, they actually got enough comfort with the service that actually the quote that we got from them was like, it just works, right? And then they went live deploying it across their entire fleet. And now are live with the product, right? So in this case, the IoT Connect service is actually helping them, for them the IoT device is their car, right? It is helping communicate back information that they are taking back, right? It's a very interesting thing that not many people think of, cars as IoT device. However, if you ask one of my colleagues who drives a Tesla and he actually says that it is nothing but a mobile device with LTE connection. So that's what he refers to that. So it's because there's a battery pack, it has a mobile device and it has an LTE connection. So it's an IoT device.

- [Ryan] Absolutely.

- [Calum] Yeah, so there was something you mentioned I wanna touch on which was how you went from the proof of concept stage before moving on to a full deployment, and I think that's really important to emphasize, something we've seen from our experience is that by going through that proof of concept, not only can you help well prove the concept and prove value to the customer, so that they can feel comfortable about moving forward, but there's also a lot to learn in going through that process. So you can make refinements and adjustments as needed so that when you go to full deployment you have the highest chance of success as possible. But something I wanna bring up and my question here is I was reading through the connecting the internet of things white paper on SAP site. And one section I really liked was the eight must ask IoT connectivity questions.

- Right.

- And one of them was, are you prepared to scale? And just to read a quick excerpt it said, "Investing in short-term solutions that do not scale "has prevented enterprises "from meeting their future business needs. "For these organizations, lack of scalability "has caused significant disappointment "and caused them to fall behind their competition." So it seems to me like there's this balance where you want to be doing these proof of concepts to be able to, again, prove the concept before moving forward. But you also wanna do it in such a way that you're then able to go to scale, where it's not just a proof of concept that never makes it beyond concept stage. So how do you think about that? I mean, really any thoughts you have there, but just interesting hearing you bring up the proof of concepts, but then also going on to full deployment.

- [Rohit] Right, and I think, there are a few elements that we actually encourage customers to test out truly in the proof of concept stage, right? Like let's look at the first lens of the technology, right? Which is we encourage them to say, go for a solution, go for an approach that allows you to somewhat future proof your investments, right? Like, which is that can then create the solution that you're deploying today, which let's say works on the cellular network, will that in the future work on the more local WiFi, or LoRa, or Narrowband IoT networks as well? Can your investments deal with that, right? Because that's the first question that we encourage the customers to think about it, right? Like how are you thinking about five years down the road, right? At least a resemblance of what you think this could be, or how could it be used, or deployed. So I think we encouraged them to think of that dimension. That's the technology part of it. Then there is the element of cost, right? Which is how are you structuring the information that you're gathering, right? Like versus the cost that is required to gather that, right? It's to think of that scalability, right? Like what works beautifully in a proof of concept because you are collecting very valuable data and creating cool analytics, but then when you roll it out across the entire scale, the cost just escalate and now suddenly the question becomes like is it worth it, right? Because it just looks so good in the proof of concept because you're testing it out in maybe 50 units, but now scale out to a million units, is it worth collecting all of that information? And if so, then are you using it on the right format, right? So I think that is the other element of scale that we encourage the customers to test their hypotheses on. And then finally, there is the element of scale, which is geography, right? Like, what are their plans? Do they see themselves being say North America focused approach only, do they envision some things in the future that is more international? If so, where? Because those bring in other constraints not just connected, but then also regulatory constraints. So I think those are dimensions that we encourage people to look off or think of when they think of scaling.

- [Calum] Yeah, I'm glad you're doing that, 'cause from our experience we've seen what happens when those kinds of questions aren't answered, where something that's really important to understand, and if listeners out there are implementing or even building IoT solutions is that it's impossible to see into the future. And so to some degree, you'll never be able to know, but setting yourself up in such a way that you don't go down a path where it turns out that either cost or technology is prohibitive from moving beyond those early stages into what you might have invested a lot of effort. So as early as possible trying to do that work of all right--

- Right.

- What are we actually trying to accomplish here? And where do we see this going? Is this gonna be relegated to just this tiny geographic area? Okay, maybe we don't need cellular, maybe we can use LoRa to cover it.

- Right.

- But if you think we move beyond that to something that is more national, or even global, are you prepared to install all of the infrastructure of all these LoRa gateways to be able to handle that maybe at the beginning you should be building what something like NB-IoT, which is cellular IoT or maybe even something else.

- [Rohit] Right, and I think the other interesting part in this is that like, what I often find is that when people are thinking of IoT and deploying IoT strategies, I think in general and rightfully so most attention gets focused on, hey what kind of sensors we will need? And then the next question goes on is like, what's the analytics platform that we are using? How are we crunching that data? What data are we collecting? What insights can we get? Can we do some predictive maintenance? Can we do AI and ML on it? Everybody gets focused on those. And conveniently people forget how does the data go from the sensor to this platform? Right?

- Correct.

- [Rohit] And that's what do they got? I feel this, I don't know and then something will happen, maybe it's WiFi, right? And then I think that's where you have to actually encourage the customers to say, or people who are starting out these say, no, that's equally important, think of that as well, because that is an equally important contributor to your IoT strategy, how are you going to get those sensors to connect to that central platform, but you're doing all of the school stuff?

- [Ryan] I'm curious to hear a little bit about how active you guys are on your side in the proof of concept phase, kind of helping clients work through all these problems. And if you've encountered situations where the customer has not maybe thought through enough on the connectivity side, specifically about scale. So for instance, they choose one technology to build a proof of concept and then the right scale, or if it works but they wanna scale and then they go wanna go larger and they don't have that infrastructure in place. In that situation, what kind of advice do you have for companies who kinda make that mistake through their planning phases?

- [Rohit] Well, one is that it does require a lot of convincing, right? To people because it's amazing--

- Right.

- That how much one gets to tend like, fall in love with their own ideas or concepts that they failed to see, or they need to add something else, right? To improvise it. So, very simple example, right? Like let's talk of connected vending machines. You will say, oh, they are, yes We have the solution. They will all located in a building. Building has perfect WiFi. They're connected over WiFi. And that's how they will work. I have my connectivity figured out, great. How do you reset that machine remotely?

- Right?

- [Rohit] Suppose the WiFi drops or something happens, or you have to reset that machine. How will you reset that machine? You cannot have, the plan cannot be, because if you have to scale and you have to imagine you have like hundreds and thousands of these machines deployed in buildings across the city, across the state, you cannot have people go there and then manually reset the WiFi passwords on them or things. You need to build--

- Right.

- [Rohit] In a SIM in there, right? Like for these off one-time activities, right? You may not use it all the time, but you need to have that option, right? And I think it's pointing out some of these kinds of scenarios. Then you can see the light bulbs clicking and saying, aha, right? That's why we need to have this other forms scalability also built in, right? Or people will often go in and say that, oh yes we have this organization, we have SIM based connectivity, and across our company, we have a contract with this telco provider and we are going to go with them. So we have deployed their SIMs, we're done, thank you. Makes sense today, three years down the line that telco gets acquired by somebody else, or your company shifts allegiances, or through procurement processes to another telco provider. Now, what do you do with all of those SIMs that are installed in all those air conditioners that are hiding up in the various attics of your organizations like who goes and replaces those SIM. So you need to have, think about a connectivity provider that actually, a neutral SIM, right? Like that can then be moved conveniently. And so I think, it does require some of those kinds of situations where people do then come back and say that there are options that exist. And certain times it's also that people are discovering, or they're actually if you think of the digital world they're thinking with different business models. So they're also trying to see what works and what doesn't work.

- [Ryan] So if someone listening to this is thinking, okay I understand the challenge of I don't want to commit to a particular provider, or run the risk of any of those situations happening that you mentioned, whether it's being acquired, or whatever it may be. How is that avoided? You mentioned earlier briefly eSIM. Do eSIM solve this? If so, what are they? Like what are some of the approaches that someone could take to mitigate this risks?

- [Rohit] So one is that I think, think of there are various dimensions that I would say that people have to think about it, right? Like one is that you have to make sure that you hopefully are investing in a solution that has a global reach and scalability. You're thinking of solutions that support, that don't tie you down to a particular connectivity provider, right? Like that are more global. eSIMs help because eSIM's nothing, but, a digital SIM as opposed to like the actual physical SIM cards that we in insert in things. And then now, like for example, the latest iPhone now comes with it, or has the capability to install it. And then there are certainly more easy to program and adjust, but then also being SIM neutral is something that can help on the cellular side. But then also people have to look at things that can help go across, LoRa, Sigfox, Narrowband IoT options, right? And then finally, don't ignore the element of security, right? Like how do we make sure that we have carrier grade connectivity, network based protocols and firewalls to make sure that we are providing that protection. So I would say these are the four dimensions, right? And just on that point, I think that's something that we kept in mind as we were doing our SAP IoT Connect 365 offering because we wanted to make sure that we are addressing these dimensions in this context.

- [Calum] Yeah, so as a follow-up to that, it seems to me that there's this balance that needs to be struck in terms of having customers excited, which is good. And doing many of the things that can be done with IoT to digitally transform businesses, but also serving as a partner and an educator, and maybe sometimes pulling on the reins a little bit and saying