A Vision For The Future Of Enterprise AI Security With Sanjay Poonen

Speaker A: Am I correct in saying you have the largest set of data in the

Speaker B: world as it about 200 exabytes, you know, which is, uh, in our space, probably bigger by a factor of five than all of our competitors combined, protecting some of the largest companies, typically banks. Banks have a large amount of Data and about 25, 27% of our revenue and customer basis banks, the world's largest banks are on our platform and those people retain data forever. So a large amount of that bottom of the iceberg of secondary data in the world is in banks.

Speaker C: You are listening to the Secure Developer, where we speak to industry leaders and experts about the past, present and future of DevSecOps and AI security. We aim to help you bring developers and security together to build secure applications while moving fast and having fun. This podcast is brought to you by Snyk. Snyk's developer security platform helps developers build secure applications without slowing down. Sneak Snyk makes it easy to find and fix vulnerabilities in code, open source dependencies, containers and infrastructure as code, all while providing actionable security insights and administration capabilities. To learn more, visit Snyk IO tsd.

Speaker A: Hello everyone, and welcome to another episode of the Secure Developer. I'm Danny Allen, your host and I am very excited to be with someone that I've known for over a decade. He is an industry leader From Oracle to VMware to now Cohesity and Veritas, uh, the acquisition that they made. But I'll allow him to introduce himself. And that is Sanjay. Sanjay, maybe you can introduce yourself.

Speaker B: Yeah, Danny, you got it. All right. Except it wasn't Oracle, it's SAP. This is a hard, competitive Oracle. But hey, I respect Oracle a lot. We partnered with them and did sort of VMware, but you had it almost all right, formative years was, um, you know, SAP, uh, eight years where I was president and then, uh, CEO of VMware where I was very fortunate to, you know, acquire your company and Peter and got to know you and Desto and you did really great things for us. So I'm very honored to serve on the board of Snyk and I love the company and what you're doing for developers, what you're doing for security, what you're doing now in the world of AI. So there's a lot we could explore and a lot of respect for, for the. Also the customer feedback because we have, I mean, I'm in the security AI industry too. At Cohisti now we have some common customers who tell me about the experience of Sneakers they know I'm on your board and they all have positive things to say about you.

Speaker A: That is awesome. And let's start on the data side because obviously what you're doing at Cohesity and uh, with the Veritas acquisition is protecting data. And I always say that data is the most important part of AI. Would you agree with that statement?

Speaker B: Yeah, I'd agree. I mean we think it is the gold of uh, the new economy, all these companies that are ultimately trying to create value on top of whether it's larger or the GPU stack, ultimately the value is the possession of data. And that data ultimate, if you look at, you know, even if you look at Deep Seat, part of the reason they're probably successful is because they are applying their algorithms to a ton of data that China has been assessing on. Yes. So I think the companies like Amazon that have a lot of data, they can pour over in E commerce models or Google. Um, and then of course what Chad and others are kind of driving, the more that you operate AI on data, the AI just gets better. Security is the same way. The more you build malware detection, threat hunting, some of those capabilities on top of large amounts of data, it's a little bit like looking at disease, um, in health. The more that you're able to operate your disease algorithms on large amount of diseases, everything gets better. So I think both AI and security who operate on a large amount, so in some senses our mission at cohesive has been to protect, secure and provide insights on the world's data. And given the fact now with our size and the acquisition of uh, Veritas, we're the largest player and have a lot of enterprise customers, this process of AI and security and data has become very relevant.

Speaker A: So two questions on that. Because historically when I look back at data, people would always train on the production data sets, the live databases and the live unstructured data. And there's always this promise of tapping the black data that, you know, all this data that was in these repositories that was locked up and unable to be used. Do you think that's going to change? Is my first question. In other words, you're going to be able to use the data protection, the assets that you have historically, not on the production data to train on AI?

Speaker B: Uh, yeah, it's possible. We think of data much the same way you described it, sort of like an iceberg. The top of the iceberg is that visible hot data as you described. And as you described the dark data, we put that underneath the iceberg that's everything that ages, that's archived. Vaulted backups, we call that secondary data. So if you think of primary and secondary data, we, uh, you know, the mission of Cohisti is to have all of that secondary on our platform. As you know from your history also in the backup industry, every one of the vendors playing this industry write that data in their format.

Speaker A: Yes.

Speaker B: So the only people who can extract that data, of course a customer can always recover that data are the vendors themselves. So one of the things that was a breakthrough idea that we worked on with Nvidia was the ability to recover that data through techniques like RAG retrieval, augmented generation directly from backup. Now, you could then build a catalog if you would. And actually, I'm going to be talking about these types of concepts at, uh, a mini keynote here at the SNYK conference. You could then use as a vehicle into your AI applications.

Speaker A: Uh-huh.

Speaker B: The benefit of that is you don't have to run these hot GPU cycles on all your hot data all the time. You can spin it up when you need it. And the amount of data is vast. And it's also all your historical data if your retention policies are all of that. So I think there'll be an evolving aspect of customers saying, I suspect the best first place, and we should have a dialogue if you agree with this or not. I think the first place this will probably start getting cracked is unstructured data. Yes. Because, you know, unstructured data is 70, 80% of the world and structured data is 30, 40% of the world. And, you know, if you think about large amount of PDFs, Word documents, eventually images and video, being able to search, summarize, analyze that in historical fashion is a big problem. And I think generative AI is going to be really great technology to solve that.

Speaker A: How do you balance. So we have all this unstructured data and all these files. How do you balance the protection of that at a consumer level with the business need to curate it into an LLM to teach the LLM? Because there has to be a tension between those two things, I would expect.

Speaker B: Yeah, I think we're inspired by. I mean, a lot of our founding folks came from Google, so we learned a lot from how some of these large companies like Google. I mean, if you take how Google thinks about that same problem describing the context of photos, you need to be able to retrieve a photo really fast of anything you did all the way. If you've got photos that you put into their repository of when you were born or whatever, have you But I certainly pictures of my kids, photos from their young age, pictures of me from whatever 30, 40, 50 years ago. They've got algorithms for which you can recover that data really fast, but at the same time you back it up very fast. So you have to think in that fashion, which is you want colder, um, data to not have to pay the high price of storage, but you also want to retrieve it reasonably fast. You want to be able to compress that large amount of it which you know as you know the technology, the deduping that help you do that, but you don't want then the price of search summarization and recovery off that dedupe data to be expensive. So these are all the triangle or rectangle or multivariate equation of optimizations you're trying to build in the retrieval of this. I think in the past the entire aspect of this industry, you know, secondary data, was a storage problem and an efficiency of storage problem. Ransomware made it a security, uh, topic. And that's obviously well established. Many of our peer companies in the space have now very much pivoted to being at least nominally more security focused. But this sort of AI focus of search summarization and analytics of data is a new frontier. We want to drive a lot of the tech innovation in that area. We've been very fortunate to have Nvidia invest in us and do work with them. I think Nvidia, uh, the three public, three, four public clouds and maybe the two LLMs are probably the companies that are doing the most work in this area. So it's Nvidia, Google, Microsoft, Amazon to some extent Oracle, and then Anthropic and OpenAI. So we've sought to stay close to those six companies, understand what they're doing. I know Snyk's taking a similar approach. I've been blown away by so much of this is happening like internally, our own engineering now, you know, whether it's GitHub, Copilot or Cursor, I mean there's so much going on in the world of generative AI.

Speaker A: It is amazing right now. And actually if I may ask the question, are you using coding assistance inside cloud for the development?

Speaker B: Yeah, uh, I mean, listen, I was inspired by Microsoft saying 30% of that code is code generated. You know, we are seeking to get a significant part. I mean the easiest place it is helping us is testing, so it's going to be built. That's easy, that should be done. But we're starting to see in many of our, for example workload connectors, um, which are building connectors to all these sources. I mean, you know, if you've done an Oracle database connector, the difference between that and A SQL or Sybase or DB2 may not be that much. Right. So an agent could probably learn what you did with Oracle and replicate it for another database and get at least 70, 80% of a starting point of the code. Yes, ferret out the APIs that needs it, you know. So I think to the extent that some of these problems that are fairly repetitive can be done through an agent, you get productivity up. And we're measuring that productivity improvement that our engineers, we, uh, have the largest engineering team in our space, you know, about two exercise more of the competitors. So size itself, I tell our people, is not going to be a competitive advantage. It's making this larger team more productive so they can do things at the speed of light.

Speaker A: And I know cohesity built on a very modern stack. So your file system is second to none. Is my understanding within the industry in terms of being able to mail to file store and do data training on it. The Veritas was a different data set. Are you using AI to merge those? Like how are you reconciling those two stacks? And are you using AI to do it?

Speaker B: Yeah. It's important to note that when we acquired Veritas, we only acquired 70% off the Veritas business called Netbackup.

Speaker A: Right.

Speaker B: We left the file system, which was a product called Infoscale, inside another company called Acterra. So we did not take the file system piece of Veritas, we left it back. So we really picked up the data mover, part of which was the built for the business. And yes, it runs on appliances with our file system, but we're having that data mover now sit on top of our file system.

Speaker A: Okay.

Speaker B: So the first project we initiated from the moment I would love to have started, the moment we announced the acquisition, but we were technically competitors, we couldn't do it till we closed because we needed that code base. Of course we've been able to, I think this month we will release net backup running on top of our file system. So then you kind of have theoretically these two data movers, our data mover from coast to call data protect, net backup right into one file system. Once it's on that file system, all of the security procedures, which are essentially threat protection, scanning algorithms, M as well as the AI work on that, which are typically search summarization, analytics algorithms, they can work on that file system. And you are right, I mean the sort Of Google esque founding of the company built a platform that was zero trust and extremely fast for cyber recovery of data. So to this date no one can match our speed of recovery from that platform and we constantly are optimizing that uh, with both software and hardware innovations.

Speaker A: So how are AI engineers then? So you have a common file system across these. And am I correct in saying you have the largest set of data in the world as it is?

Speaker B: Yeah, about 200 exabytes, you know, which is uh, in our space probably bigger by a factor of five than all of our competitors combined. Uh, I think the next large is about 18. The next large after is 14 and the next largest, it's 2, you add them all up were probably 4 or 5. It's largely because when you have a company like Veritas has done this for a long time and cohesive was also protecting some of the largest companies, typically banks. Banks have a large amount of data and about 25, 27% of our revenue and customer basis banks, the world's largest banks are on our platform and those people retain data forever. So a large amount of that. Bottom of the iceberg of secondary data in the world is in banks. The second biggest vertical typically that has a large amount of data is public sector. These are departments of defense or civilian because they also have retention requirements. Third for us is technology firms. These are uh, big tech firms in Silicon Valley. Other places they have projects that because they use a lot of cloud and you imagine some of these companies are where naturally they're posture for secure data. Uh, fourth is healthcare and fifth is telco. So if you look at these five verticals, we have five other verticals that are very important. These all spend a fair amount on tech. They have a lot of data and they're high risk and propensity to the bad guys trying to hit up. So we go. And then of course once you've got the security of that data, figure out the next thing we want to work with all of them is the AI on top of the data. So we envision ourselves long term being sort of a, you know, a cross between a databricks and a crowdstrike.

Speaker A: Right.

Speaker B: I mean you're sort of a security company in one one sense in protecting that data in a secure bunker. But then you're also an AI company to mine and you know, basically get value out of that data.

Speaker A: So the largest set of data, the fastest ability to recover that data. How are you thinking about exposing it to, I don't know, McP servers or AI engineers, we have a lot of developers who watch this.

Speaker B: Really good question. And our board and I spend a lot of time thinking about it. So I think the long term value of that data is to create a data catalog. And I'll be talking about this in my keynote here that is uh, exposed to developers. So we have an AI application called Gaia that we built with Nvidia, that's an agent or an app. Uh-huh. That talks to those APIs itself. But we could kind of make that headless and have those, that catalog API said talk to other apps.

Speaker A: Right.

Speaker B: Uh, it could talk to agent Space from Google or Glean or Bedrock or Copilot or to all your AI developers building their own apps.

Speaker A: Yes. Yeah.

Speaker B: So that data catalog is something that we are spending a lot of time perfecting. It's certainly very, very pioneering in its thought. And because it sits on all the world's data, we can provide that. So what we're curious to know when we talk to developers here is what are the AI applications you want to build inside your company and what um, are uh, the apps that you want to build that are uh, talking to historical data? Because that historical data is probably on our platform.

Speaker A: Yes.

Speaker B: We can expose that data to you and then we're going and talking to our customers. Typically the people who own the secondary data backup. Secondary don't know those AI apps because they're just the custodians of the data. But when they talk to the developers or the developers who are at your conference tell us, we will know. And then we can tune these APIs and the access of it and then also the commercial monetization of it. Like today we uh, make money securing the data. Mhm. We also make money on access to the data. It's a little bit like the way AWS or databricks, you can store the data but then you also have it. We didn't find out some optimization of those models where both the secure and the access, maybe there's a joint pricing to it. So there's a lot we're trying to figure out together. The other thing that's also been very interesting on AI that has a little bit of developer range, but we're seeing a lot of interest now in a very important workload, identity and resilience of identity. Because often before you could even protect your virtual machines and databases, you're pointless doing that if your identity Active Directory is hacked and those active directory are human users, but eventually they're agents.

Speaker A: Yes.

Speaker B: So being able to. Right, exactly. So securing Your users for humans and your non humans identity is becoming a big problem that we are at the crux of solving. We've announced an entire offering around that data resilience that has also a lot of AI to it, both in the tech that's built in it, but the fact that the future of that world is AI agents that are non human.

Speaker A: Yes. And that is so important because I always say the perimeter in an AI world is the identity. And the identity may not be a person, it's going to be an agent that is delegating access to different systems out there. I want to pivot. You mentioned earlier that you have a relationship, cohesity. Ah, with Jensen, with the Nvidia team. What are you doing with Nvidia, uh, from the cohesity side?

Speaker B: Well, Danny, just to back up a little bit, as you know from our time at VMware, um, because you were involved with the end user computing VDI business, I remember asking our VDI team, you know, why is it that one of our competitors at that time, it was Citrix, did such a good job with graphics and they said, oh, it's because they built an integration through the GPUs to their hypervisor and we should do the same thing. This was like circa 2013, 12 years ago. So I went to Pat, who is our, uh, CEO at the time and knew a lot about CPUs and GPUs, and he said, you should go meet this gentleman named Jensen. Okay.

Speaker A: Yeah.

Speaker B: At that time, you know, it was a gaming company, nowhere close to the 4 trillion market capital is, but it's probably 40 or 50 billion mark. I have an important company.

Speaker A: Yes.

Speaker B: So I went to his office and he was an remarkable man. I mean he was just, he was a teacher. He's a, he still is very humble, down to earth. And he taught me a lot of how the GPU works, what the connection is between the GPU and the CPU and what we needed to sort of pass through. And I'm a technical person at heart, I understood it and my engineers. Right. But there was a little bit of a religious, uh, feeling between the VM or ESX team and the GPU team that they didn't want to sort of allow those pass through and things of this kind. And we worked through all that stuff and we finally implemented our VDI product as you know, Verizon, our end user computing product, to use the GPUs, pass through, through to ESX and voila, we had a product that was better than our competitors. And I invited, uh, Nvidia CEO Jensen at that time, um, I think it's 2014 or so to come and speak at VMworld. This is this big conference and it wasn't even a keynote, it was ad out booth. But he just stood on a table and like gave the speech like a prophet. And it was like this prophetic pastor or whatever have you. And that's what I remember of him. And I to this day tell him that story. He was so galvanized to just get everyone understanding the power of these technologies that could then fast forward now to, you know, like ten years later. Uh, we built, we had this idea around genitive AI and I was playing on ChatGPT, I was like, it's very clear, the company the most amount of data. But I had no idea what rag was. Mhm. So both Jensen and Satya exposed me to this technology rag. I thought it was a piece of cloth you wipe your windshield with. I mean, but then I studied every computer science paper, had my founders and our founding team understand what rag was. We built it and we went back and showed what we were doing to Jensen. He was blown away. He's like, he got it within like 30 seconds, made the decision himself to invest in our company and featured us at his GTC, um, keynote in 2024 and 2025. There on our board of observers, we're very grateful. We're building our Gaia product on their stack now. What does it do for us? I mean, either an investor, so we want to make them proud.

Speaker A: Sure.

Speaker B: But more importantly, building on that stack allows me to not have to write that code five times. What I mean by five times? I don't want to write it on aws, Azure, Google, Oracle and private cloud.

Speaker A: Right.

Speaker B: So their abstraction layer allows me to do things like PDF parsing things, things that we need to do four or five times. And they built the libraries for that. So on top of CUDA, which is that core APIs, they have a set of enterprise AI, uh, libraries and they work with the best open source people productize. I mean there is a charge for that. But the benefit to us is I save engineering times five, right? Yeah. So. And then especially one of the things that this goes a step further is when you go to the on prem world in the countries outside the United States, I mean one of the, I mean good or bad things about these tariffs, whatever your opinion on, apolitically, it has woken up the outside world to the fact that they need a sovereign cloud. Yes. Every country that the US says I want A sovereign cloud, you know, European countries, uk, France, Germany, Netherlands, Middle east, whoever have you. And they want that stack then where a lot of this AI capabilities like Gaia can be done on prem without having to send any data. The public cloud. One customer said, we want all the benefits of what you could do with retrieval, augmented generation and Gaia. But no data can be sent to public cloud.

Speaker A: 100%.

Speaker B: We were able to do that on top of the Nvidia stack running on hp, Dell or Cisco servers. So we built this product in the cloud because it was easy for us to build that out. Uh, but then when we heard that we were able to get that same code base now running on Prem and all of that stuff to have a kind uh, of a leading AI company. I talked to, you know, one of the team members of um, Jensen's, a lady named Carrie Ann Briski, super smart, runs the enterprise. Her advice to us on where we go on this topic. So I think my advice to everybody here listening to this is surround yourself. Danny was one of those people to me and still is in a lot of stuff related to the world of tech. But find people in your circle of friends and contacts. It doesn't. I mean, everyone may not have access to Jensen, but there's a set of people like I described them. For us, it's Nvidia, Google, Microsoft, Amazon, um, maybe some extent Oracle too. But then certainly the two LLM companies, OpenAI and Anthropic, they're the companies we need to learn from.

Speaker A: Yes.

Speaker B: Get close to them. You don't have to talk to the CEOs all the time, but they're people in their companies who we want to build on top of or evolve because they're gaining momentum in our customers. Right. And if they're gaining momentum in our customers, it behooves us to stay close to their work in this world of AI. Now, who's going to win among these players? There's some competition in the public cloud. I don't know, Time will tell. Like there's a. I mean, I would have started off saying like two years ago. Is Microsoft because of OpenAI, Google's coming on strong.

Speaker A: Yes.

Speaker B: With Gemini and like incredible things. They're working on space, they're strong and the good for everything. Who's everyone who's a developer, a customer, innovation. Among these four public clouds, like when we were at VMware, I would have said there was two public clouds, AWS and Azure. Now it's sort of four AWS, Azure, Google and Oracle.

Speaker A: Oracle's Coming on with this work, going

Speaker B: to OpenAI and you know, Stargate and everything. So I think for customers and for developers this is fantastic news. Right? You get to drive a lot of the future of the world of AI. In our case it's AI and cyber security and just stay close to the smart people. I mean for me, I wish I was a 22 year old in. Of course this is the best time you and I have kids, right? They're coming out, going to college or soon will come out of college. I mean to me if I could be a 20 something or 30 something right now as a developer, this is the best time.

Speaker A: Well, my son is going to graduate with computer science this year and I say like all in on AI and I actually think this is a future of Cohesity. Sanjay, because the same way that Nvidia they reached where they are now, I would argue in kind of three plays. They did the gaming first, then they did the crypto. The GPUs were used for all the crypto and now they're obviously driving all this AI initiatives and they had a common framework of cuda. I look at Cohesity and I actually see the same thing started up in the backup data protection space. Second play huge opportunity in growth on the ransomware. And the third opportunity is what you're doing right now which is exposing the data to AI. Now what's the common framework? What's your cuda? It's that file system that you have that exposes it for the training of all the diffusion models and LLMs and everything that is out there.

Speaker B: Danny, you should be our evangelist. You got it. I mean we call this the Act 1, Act 2, Act 3 story of cohesity. Yeah. If you, you know, watch my. Every six months we update the story of Kohdi to a 10, 15 minute story. If you watch my latest one that was just released this past week, I talked about exactly the point. I don't make the CUDA which is very astute one. Thank you for that. I will put that in my library of good, good ideas. But I do talk about act one being data protection, act two being security, act two being. Yeah and they all build on top of the other and the value, the ties, you know the Act 1 is price per terabyte is commoditized. It's just going lower because you're just doing pure backup. You're not making much money long term on a price per terabyte basis. You add more security on that whether it's a user based pricing or terabytes there's more value. Customers will pay for it and certainly AI. Gosh, I mean, it's amazing how much customers will pay to be able to search and summarize 10 or 100 terabytes of data.

Speaker A: Well, data is driving the AI revolution and cohes powering that. What makes you most excited for where we're going as an industry?

Speaker B: I mean, Danny, as you know, I sort of like, to me, there's three things that motivate me. Like, one is people. I'm a people person. So I. Yeah, I love people, I love serving people, I love building teams. And I've stayed close and it makes me very proud to see people like you and Peter doing well. Who are people I invested in during my years at VMware. And it's just for me, life is a big circle and you want everyone who you've had, you know, time with in your life to be successful. And I have, you know, north of 5,500 people that, uh, my playground now. Yep. We had 20,000 people at VMware and 100,000 people at SAP. But I have to focus on that. That's the one. Number two, I really get excited about product innovation at the junction here of cloud security and AI. And the third, I love customers. So I spent a lot of my time with our biggest customers, understanding their pain points, really getting to know some of the. You know, we have 13,000 customers, but the who's who in banking, I'm constantly like, sometimes I'll just call them on a drive home or whenever there's like 15, 20 minutes and you can ask them, like, insightful questions. I was talking to large banks this week, and within a half an hour, my entire perspective on a particular topic had changed by just understanding from them. And I view this as like having 13,000 product managers. Right. Who can guide you on your product. My goodness, I don't need to talk to all of them. There's some subset of them that are advisory board and they're constantly guiding us. Go here, go there. And you just have to have then the ability to then pivot very quickly to saying, hey, I'm sorting out the signal for the noise. I think that this is where we can go. Some ideas, we have our own, which is where we lead, but then we also need to listen when we listen and lead through our customers. And I'd include partners in that list. We use Snyk internally. Right. It's a good example where I like the ability of kind of going modern on these. There was old ways of Doing source code scanning, and there's new ways of doing it. And, you know, because I'm on the board, I try not to push my team. I encourage them to look at where developers are thinking and then we make their own decisions. So we want to see companies like Sneaky very successful. I have obviously invested interest in one of the board of directors, and I want to see this company be a pioneer in AI driven developer security, application security, posture management, whatever the analysts call the space. You're closer to the space than me, but I think that's a tremendous opportunity ahead of us.

Speaker A: Well, yes, that is definitely true. Tremendous opportunity. And Sanjay, I just want to say thank you. I've learned a lot from you over the years. The one thing I remember about you is always talking about customer obsession and product innovation being the inventions of the plane. Right.

Speaker B: Hey, you know what, Danny? The picture is still the same. If you're from cohesion, you're seeing that now. I was doing that 15 years ago and Danny knows that better. But some things don't change in life. Yeah, you gotta stay true to our mission. And it's been my story for 25, 30 years. And I'm very grateful for that combo engine picture.

Speaker A: Yeah, definitely the case. Well, thank you all for joining us on the Secure Developer today. It was fantastic to have Sanjay here from SAP, not Oracle, but, uh, a leader in the industry and that is driving the AI space. And we'll see you next time on the next episode of Secure Developer. Thanks, Sanjay.

Speaker B: Thanks, Sam.

Speaker C: Thanks for tuning in to the Secure Developer brought to you by Snyk. We hope this episode gave you new insights and strategies to help you champion security in your organization. If you like these conversations, please leave us a review on itunes, Spotify or wherever you get your podcasts and share the episode with fellow security leaders who might benefit from our discussions. We'd love to hear your recommendations for future guests topics or any feedback you might have to help us get better. Please contact us by connecting with us on LinkedIn under our SNYK account or by emailing us at the SecureDevnyk IO. That's it for now. I hope you join us for the next one.