Service is the future: Trend Micro's Chang

ARN: How important is the Philippine office to Trend Micro?

Chang: This is a new office. I've never been here. We moved here a month ago and this is one of Trend Micro's most beautiful offices. We have about 150 people here. In Japan we have 250 people, in Taiwan, we have about 200. Then there's the US. This is our fourth-biggest office, and we house a support centre here.

The Philippines is important. Viruses spread worldwide, within two or three hours, and there's no way that you can stop them without using the Internet and remote service technology, and you can work around the clock. Otherwise, how can we update the almost 25 million users that we have?

People talk about the new economy and dot-coms, but my own interpretation is, how do you use these intangible assets? This refers to the way we set the process, the way we detect viruses, the way we take this knowledge and use these technologies to deploy our solutions worldwide through the Internet. This, for us, creates the most value for our customers.

In the Internet economy, those with something intangible and who generate value are the most valuable assets.

In Asia, in every country - Japan, Taiwan, Hong Kong - (traditional investors) talk about buildings, land, real estate, manufacturing, and say these are key. And you need a good relationship with government. We broke all the myths. People here, they're 25 years old, and they saved the world!

The ILOVEYOU virus shut down servers in many companies worldwide for more than 24 hours. When companies in Wall Street shut down their systems due to the ILOVEYOU attack, Trend Micro was able to deliver a solution in two hours.

We also have good engineers in China and Taiwan, but they don't have very good language capability like we have here. In India, they also speak English and they have good engineers, but they don't have the creativity we've found here. In India, most of the engineers do outsourcing of coding. Coding is less creative and is usually in Cobol. But here we use the best technology and we have original ideas.

Network Associates recently settled a patent dispute with your company. What was that about?

Yes, that was about a simple patent. We filed a lawsuit and after two-and-a-half years, we ended with a cross-licensing agreement. Basically, they paid us a lot of money (in the settlement).

Five years ago, one of our engineers, our chief technology officer, said that she thought one day, viruses will come from e-mail on the Internet. People laughed at this then, because viruses came in from floppies and destroyed hard disks. So she patented this idea (of stopping the virus before it gets into the network).

Losing your data is a small thing, but disconnecting your communications is a bigger, much worse nightmare. You have to stop the virus before it gets to your corporate network. In order to get clean water most people have a filter in their tap. Our concept here was to push the protection to a bigger area, the reservoir or the corporate network.

How has the antivirus software business changed?

Five years ago, 80 per cent of our revenues came from packaged software. Now, it's down to 11 per cent. Most of these are Internet-related products.

The big change in the industry is that people no longer look at antivirus as a product, they look at it as a service. Users don't expect you to detect every virus, but they want you to respond quickly. Therefore, distributing shrink-wrapped software through distributors and retail shops is no longer that big a business. Even Symantec, which does the most retail business, is finding this to be true.

Internet service providers (ISPs) or application service providers (ASPs) can provide antivirus scanning as a service to their customers, and this is probably the best form of distribution.

But this Internet outsourcing is still in a very early stage, and people don't understand it that well yet. But it will be the most cost-effective way.

Will we see viruses on PDAs and mobile phones?

Right now, the operating systems on mobile phones are still proprietary. But iMode of (Japan's NTT DoCoMo) has Java applets. When attached files become popular on these devices, all computer viruses in the wire will go to the wireless world, too. We have projects to prepare for this that look at content security on wireless devices.

What's happening rapidly in the US and Taiwan is the shift to broadband, where the uptake for (Asymmetric Digital Subscriber Line) is very high. People are moving from dial-up to broadband, where the connection is always on. So people are also looking at personal firewalls, which is another area we can come up with a product. Another area of opportunity is Linux on the server. Linux is open source, which is good, but because it is connected and more open, hackers can use the same resource. The bad guys can use the same resources as the good guys. It's the price we pay for connectivity and an open environment.

What do you think is Trend Micro's edge over your competitors?

The biggest thing is our innovation. Our core technology. If you look at (Gartner Group), we are way ahead of our competitors.

The second thing is our strategy. Our competitors are all going to suites, but our customers want best-of-breed. They want a firewall from (Check Point Software Technologies). Customers know that there is no way one vendor can combine the four best products that are integrated. So don't even talk about combining four mediocre products and trying to stuff them down to the customers. They don't want it. That's why stock analysts give a big premium for CheckPoint, Verisign, Trend Micro and ISS.

Our challenge is to make it easier to integrate (these products). I've been lucky to run this company for the last 13 years. All my competitors just buy antivirus companies and glue them together. But antivirus products are unlike other software products, such as a database or word processor. You can say your database is better or your word processor is better. You can argue. But antivirus measures are very clear-cut. Either you catch the virus or you support the customer fast. That is a very clear measurement, and we have done well in this, and I'm going to continue being very focused on best-of-breed (antivirus solutions).

But you can see that our company has also moved from being an antivirus product company to a value-added services company. So today I provide antivirus service. Tomorrow, I can provide (Uniform Resource Locator) filtering or content security.

If you add (Symantec) and (Network Associates') market value together, it will be less than 60 per cent of Trend Micro, so we are the clear market leader and technology leader in this sector.

How will you retain customers?

We provide the service. This is the only way we can retain our existing customers and get customers from our competitors.

We went to the US as an Asian company in 1997, from nothing, we started from scratch. Today we own 25 per cent of the Fortune 200 companies. General Electric, Boeing and Microsoft use our product. We gain customers from our competitors. That is much more difficult than just retaining our customers.

People don't just want a brand name. In terms of brand name, our competitors are bigger than we are, but what the customer really wants is superior technology and a quick response service when a new virus comes out. And that's where our strength lies.

We can provide that service from our Philippine office. That's our biggest competitive advantage.

We just signed a contract with Sprint, including a service-level agreement that says if you have a virus problem, we can support you through the Internet within 15 minutes, anywhere in the world.

We have a world map over there, (which shows virus problems as they come up). Today there's still one guy in Scandinavia with a problem, and our people here are helping him fix it. That is something amazing!

How many support centres do you have worldwide?

Four - Philippines, Japan, Germany and the U.S. The biggest in terms of people and potential growth is the Philippines. We can support many English-speaking countries from here, because Philippine English is good, not like Chinese English.

When you say biggest potential for growth, what do you mean?

Unlimited growth. If I can hire more people, I will keep on doing that. There are no limits. We have a culture here that emphasises three "C"s: communication, creativity, and change.

Communication is not a problem here, but we tell our employees here that they have to communicate outside the Philippines as well. So that's why we've sent more than 80 people outside of the country.

The second "C" is creativity. In this company, we don't own a single office. We don't own anything at all, not even a single car. There's no company car in the whole world. We are an $11 billion company but we don't have a company car. We are trying to make everything virtual. So creativity is everything.

Then there's change. I cannot compare the Philippines with any country yet, because they are young, so they are going to change anyway. But change is important. It's an ever-changing world, so I want them to dare to fail. Don't be afraid of failure here. Failure here is normal, it's fine. Change is part of my last name, so it's important.

Are companies like Microsoft making it easier for virus writers?

No, I don't think so. People blame them, but you have to ask, why do people write viruses? For the last 13 years, I've found that there are all kinds of reasons that people write viruses. But one thing has been the same in the last 13 years: ego. They want to express their ego, fundamentally. As long as ego exists, people will write viruses. The ego motive means you need to make people see, so you will always choose the biggest platform. I don't believe that there are fewer viruses on the Mac because it is a safer environment than Windows. I don't believe that. It's because Microsoft has the bigger market share, and virus authors want to spread their viruses everywhere in the world, and say, "Yes! I can do it! See? I can do it!" That's their reward.

Do you think the Love Bug changed people's awareness?

The ILOVEYOU virus changed the perception from product to service. And a lot of people found that they were spending so much money on antivirus solutions but still got this virus. So there was some frustration. Then they said, "OK, we need gateway protection. We need to keep it from coming into the company." And some people began to ask: "Whose responsibility is it, anyway? Is that the ISP's responsibility?" I see things changing in this direction.

What is Trend Micro doing to reduce denial of service attacks?

That is interesting. That's another trend, where viruses (techniques) and hackers are coming together. The solution is tough. When the request comes in, you don't know if it's a bad guy or a good guy. When you pick up, then you slow down the system, and other people cannot come in. It's a paradox. I don't think there's a real solution in this higher level. Can we eliminate some of it? Yes, we can, say, detect the hacker's agent before the attack by using the same antivirus scanning techniques. The other way to do it is to go down to the hardware level and analyze packets and set up some rules about who is coming in. From a purely software point of view, it's hard.

What opportunities do you see in the business-to-business area?

Here, we're looking at five areas. The first is the Internet data centre, which provides the bandwidth. They can charge their customers for antivirus services and we can split the profits.

The second thing is e-mail outsourcing. More and more big corporations are outsourcing their e-mail. We can offer our services through their ASPs.

Then I think all the telecom companies in the world can also bundle this as a service when they provide their big leased lines.

Fourth, we talk about small ASPs. Suddenly in the last six months, there are hundreds or thousands of ASPs coming up. So we can go to the ASPs and say, "I know you are providing services to the dentist, or, you're providing special services for retail or accounting, By the way, we can provide antivirus services like Housecall (Trend's Web-based free antivirus scanner), as part of your service to your customer.

The other interesting thing is called distributed ASPs, where you can provide antivirus security on customer premise equipment. The customer keeps the server.

These are five major trends you can see that are picking up in US and Europe. Asia is not yet there, but is getting there.

Of course, our main revenues are still coming from so-called traditional systems integration, the value-added reseller, which is our biggest partner.

Until when?

For many, many years. I think five years. Most of them want to become ASPs, anyway, so it doesn't matter to me. I can have a telecom company ASP, then the ISP, then all these people who want to become ASPs. They can all be my customers, So I don't worry about that too much.