This is Resilience Universe, a podcast about leadership, resilience, and transformation at the intersection of AI and data security, hosted by Cohesity CEO and President Sanjay Poonen.
Hello everyone. Welcome to my next podcast. I'm here with my really good friend Thomas Kurian. Good to see you. I've known Thomas for many decades. A short story: he and I grew up in the same town in Bangalore. Our families know each other. He went to the rival school. We actually competed with each other at SAP and Oracle. And then when I left and joined VMware, I was so happy to finally be his partner and friend, first at VMware and then at Google. We did some good things together. But here I'm really excited because I want to talk about not just what Cohesity and Google are doing together, but I want to talk about three topics during the course of this podcast. One is Google's vision for AI, which is really at the forefront of all of your minds. Security, now that they've acquired Wiz, that's a big part of the story too. And third, his lessons of leadership. So maybe we could start with—you took over now how many years ago? That's seven years. He's now CEO of Google Cloud and I think it was single-digit billions and now it's like 80 billion run rate. So incredible job. It's growing really fast. But I came back from your Google Cloud conference and it was all about AI. Where could you start then and give the listeners a little bit of what were some of those key themes that you're hearing that they should also hear about at the forefront of AI?
You know, we talked about two really important things. One is AI has moved—as the skills of models have evolved, AI has moved from primarily being used as a more expressive knowledge-finding tool and knowledge management system, which was the first version if you think about chat. It then moved into content generation, like you could create content with it. And now the big thing that we see a lot of people wanting and using our AI for is to build agents—agents whether they're to write code and help them assist writing code, or to build agents to automate various tasks and processes within the organization. So we announced a new platform, Gemini Enterprise Agent Platform, that gives you all the capabilities to build and deploy and operate agents.
The second thing was, in order to do AI well, we've always felt you needed a stack. And so we built a vertical stack. It's open at every layer but we're engineering a number of the pieces. So at the foundational level we have our own accelerators, TPUs. We've built our own models. We also offer a choice of Anthropic and other models, but we do provide a suite of models, Gemini, in order to have agents do their work. Well, you also need to have them reason on information within the company. We call that context. And so we offer a new platform to build using a knowledge catalog, rich context to help models reason well. Obviously with all the information happening on security threats from AI, we had a new security platform to protect companies' systems using AI. And then finally bring it into day-to-day workflow, whether it's in our collaboration tools, customer service. So it's a whole stack as well. So our big two themes were around the evolution of AI from chat to now agents, and second, to do that well we offer a vertically optimized stack of technology to make you use agents really well.
And I think that stack is probably worth doing. Jensen talks about his five-layer stack and that diagram that you showed at Google Cloud was a money chart. Maybe you can just walk through what are the three or four or five layers of that stack—you mentioned a few of them. Yes. So the audience has it with clarity.
I thought that picture was probably the most important picture for everyone to take away. So the five pieces in our stack: at the foundational level sits the infrastructure. This is TPU accelerators, compute, storage, networking. On top of that is foundational models and research. So that's what we're doing with Gemini and our whole portfolio around Gemini, Imagen, Veo, all of our models. Next is the toolset to build AI systems out of it. This is our Gemini Enterprise Agent Platform which gives you all the tools. Then to reason on your data, what we call our Agentic Data Platform. This is the thing that takes all the data in the company and makes it available as context to models to reason on. And finally, our Agentic Security Platform which protects you and protects your information, your corporate systems from the risk of AI. Finally, at the topmost layer, we're offering packaged agents—packaged agents for collaboration, packaged agents for customer service, packaged agents for research, etc.
That's great. So you kind of have the Jensen version of the five-layer stack and here you have this one. I think that's very important. You had a couple of use cases also from customers that you talked about. What are the most common use cases you're seeing of where people are applying Gemini and the agentic approaches in functions? I think a few of them are like customer service. What are the most common ones you see from the customer base?
The big ones, I would say, is—we look at it across the different domains in a company. So in the back office, we have a lot of people using Gemini to streamline the core processes within the company. So Virgin Voyages, for example, talked about how they're using Gemini to transform every element of how their organization works, from finance to planning all the voyages to planning the food and other things that need to go on, their legal department, contracting. So one big thing we see is a lot of people using Gemini to enable their core workforce. Walmart does a similar thing.
The second big thing that we see a lot of interest from customers is customer-facing. So Best Buy talked about how—and a lot of them are sort of evolving. They start with: I'm using it to help people find things online, then buy them—commerce—and then handle upsell and cross-sell, and finally service. And they can do that from web, from mobile, from surfaces like Instagram, so that you have access across all your channels. So that's the second big area that we see.
Third one is within the IT organization. We have a lot of people using it for the three big scenarios we see: software engineering and coding, to help do data analysis—today, for example, if you look at finance departments in many companies, they used to say, 'Hey, anytime we need to report numbers we always have to go to a database person to have them run all the queries.' Why can't we just make it so that I can just ask the question through a search system and have an agent go and find the data for me? So that's the data analysis—and then cyber is the third part within the IT organization. So these are some of the big domains we see organizations using our AI systems for, and we're doing many of that ourselves internally. And I know many of our joint customers who are listening to this are also, I think, using that.
It's great. It's so exciting. You know, I came back from that conference pretty energized about the future of AI. Maybe we can shift. Now that you have Wiz, you're a prominent player in security. There's so much talk today about these frontier models in the context of security and other things. We just had a conversation a few minutes ago about why—that's just one piece of it—and all the frontier models. If you're just trying to fix code and scan code, that approach isn't sufficient. Maybe you can walk through, first, why—given that's very topically relevant—how you advise a CISO to think about: right now all they're thinking about is scanning code. How would you get them to get their head out of that and say, 'Would you think about the X and the Y and the Z dimensions of what could go wrong?' You need a different approach.
So, you know, in general there are sort of three or four important things that we talk to customers about. The first one is the risk from AI models is not just to source code of applications. The risk can affect binaries. It can affect firmware. It can affect a physical device like a network switch by compromising the firmware of that. And the reason is that models have gotten really good at understanding not just code but also configuration. Like, for example, they can understand your network and go, 'If I access this switch then I can shut down this part of the network,' etc. So one thing is that models now have access to a lot more information and their ability to reason on them—and so you need to think through what you are protecting is not just scanning your source code.
The second thing that we say is, if you look at the rate at which models are advancing, you're going to end up scanning continuously—and that can get both expensive but also just finding an infinite number of bugs. You need a solution to help you repair it. So that's the second piece: scanning without fixing is not a solution.
The third one is, when you look at the evolution of this whole infrastructure—the volume of applications, the volume of data, the volume of all the systems that companies run—if you then say, 'I've got new models finding new things all the time,' you then end up having to deal with an extraordinarily large surface area to patch, maintain, and update all the time. And so you can't just say, 'I'm going to start at the start and go till the end,' because it's such a large estate of stuff. And the fourth complicating factor: there's no one model that finds a superset of all the issues. In fact, what many companies are now reporting is that a cheaper, even a small open-source model with a good harness, can find many of the vulnerabilities that a top-end model can do. So when you look at it, you have these four issues: it's not just about source, it's about firmware, binaries, network, everything. Second, it's extremely frequent because you're going to have to get comfortable that models are going to come out all the time and the volume of these issues is going to grow on you. The third one is just finding without repairing becomes challenging, and when you repair, you need to think about what are you going to focus on repairing. And lastly, no single model is the solution. You have to have a conglomeration of models. Like, for example, saying this time I'm going to scan with this model, next cycle I scan with another model. And so those are the four core beliefs we have based on all the data we've seen and based on what we're doing ourselves to protect Google systems.
