Hello, Cube community. Welcome back to San Francisco, California. We're here for the AI Security Summit with Snyk, an AI engineer. This is Jackie Maguire. I'm your practice lead and principal analyst for security at the Cube, and I am lucky enough to be joined by Sanjay Poonen. Welcome, Sanjay.
Thank you, Jackie. Thanks for having me here.
You wear many hats, but I think the biggest one is you are CEO and President of Cohesity, right?
But we were talking before we started filming and you have had quite an interesting journey. So, take us all the way back. You were talking about how you've been on the Cube more than most of our guests—we probably owe you some type of gold jacket or something at this point. You were saying that you've worked at SAP, you worked at a whole bunch of different places. So, can you tell us a little bit about your background and how you got to where you are today?
I know I'm currently CEO and President of Cohesity, but I'm also on the board of directors of Snyk, so I have a very special connection to this company and the conference. I've been 25-30 years in tech, but probably most relevant is I was President of SAP, and that's where I first met the Cube, John and Dave, as they were a small outfit doing incredible content, going deep on topics. And then I was COO at VMware. Both those roles—I was very fortunate to help practically double the revenue of those companies as they grew from 10 to 20 billion at SAP and from 6 to 12 billion at VMware. And most of my work has been at the junction of cloud, security, and AI. VMware was all sort of in the private cloud, public cloud journey, and a lot of what I also did there was security. And then the work at SAP was all around analytics at that time. We may have called it predictive analytics, but it's all sort of AI. And that's kind of where I find myself at the junction of now at Cohesity.
You were saying earlier that you're a data guy, right? And I think in this whole wave of agentic AI, one of the things that's become really apparent is that agentic AI is kind of automation on steroids. It can do a lot of other things, but one of the most basic capabilities is to automate things. And I think one of the reasons we haven't automated many things in the enterprise thus far is that we've kind of got a data problem. By design or default, most enterprises are sitting on mountains of data, lots of it's unclassified, lots of it's in these—we call them data swamps. So how do you think about that, and how data within an enterprise has evolved, and what are you hearing right now in the market in terms of the most pressing needs for enterprise data?
Yeah, I just got done giving a little keynote on that upstairs at the CISO track here at this conference. There's a saying, 'In God we trust.' I kind of add to that: 'In God we trust, but everywhere else brings data.' Maybe everywhere else brings secure data, especially in the context of AI-generated data. In the enterprise, we get the opportunity to work with data that's a little more confined—the mission statement of Google is to organize the world's data, that's a large universe. In the enterprise, your data is confined to what you store and collect, and even if you collect a large amount, it's some subset of the world's data. You can apply algorithms like retrieval-augmented generation more easily to a confined set, but you also have to have much higher security governance to ensure the wrong people aren't getting the data. In the enterprise, you also have to have role-based access controls. I'm the CEO of Cohesity, but I can't search somebody else's data. My legal team can do e-discovery during an investigation, but I should be allowed to search my data with ease and freedom. You have to have very strict role-based access controls to ensure the wrong people aren't searching and summarizing, and if you're going to do summarization—which is a lot of what ChatGPT and these LLMs do—you've got to make sure it's not hallucinating or getting the wrong summarization, because you could make business decisions that are wrong. All of these lead to a fantastic canvas for companies focused on security and AI data. That's what we do. We're an AI-powered data security company, the leader in our category. We obsess about understanding where this world is going. We have 13,000 customers, some of the largest brands, for example in banks. We work closely with them to understand where this is going and we've designed a platform to meet their needs.
So how do you think about, especially with banks and large companies, the regulatory model? A lot of these industries are very much old school. I come from investments where any conversation you have with a customer, you have to retain those records for seven years. Medicare—you have to retain 10 years from date of service. So as agents are stepping in and starting to do some of this work and they're generating lots of logs... you really don't have to log 90% of what humans do at work, right? But with agents it's much different. Agents are spitting off these logs constantly. So how do you see regulations changing and evolving to help get arms around the new way that people are going to be interacting with companies? It's not necessarily through a human who can be held accountable for compliance.
Yeah, I think if you start with some of the collaboration applications we use the most—email, Slack, messaging applications—in the consumer world, Snapchat deletes right after you're done, or you could have self-deleting emails. Different organizations have different regulatory requirements for how long you need to keep email or messaging. In certain very regulated industries like banking, that needs to be kept forever, but companies without regulations may decide to delete an email after a year. It saves them cost, it also saves them legal liability risk. If they're not required to do it, delete them.
Now, if a person wants to save those emails, you can go and ask for a special policy to save those emails or documents—that's separate. But the natural policy might be to delete. That only works for companies where regulation allows it. I think you can apply that same thing to AI. So if you've got AI that's transcribing a meeting, those documents of a Zoom session would follow the same policy as someone taking notes from that meeting, or the email minutes, or the chat log. I think you kind of go application by application and ask yourself what does the regulator let you do so you can get away with not having to store that much data. Storage is less of an issue in terms of cost—colder storage is getting cheaper, it's getting easier to both store and access. So we are always on the side of hopefully less regulation, because I think it actually helps freer information, freedom of speech. But because of regulatory pressures to keep certain industries like banking, telecommunications, public sector safe from corruption, those rules exist for good reason. The other thing happening in the regulatory world is certain requirements governments are now imposing. For example, in Europe, they have this regulation called DORA that requires data to stay in the country. We think there's going to be a lot more sovereign cloud requirements. Whether you like or don't like tariffs, it is waking up the rest of the world outside the US to say we need our own sovereign cloud where we store data on-prem. We think that's going to lead to a federation of sovereign clouds in the top 15 to 50 countries, to the extent the country can afford to build that infrastructure or work with a service provider. That's also going to be another place where you deal with how long you keep the data and where you keep it.
Yes. I agree that less regulation, or at least appropriate regulation based in reality—not the last banking crash from 15 years ago—is great. But what I think we've started to see is federal regulations have pulled back, some states have stepped up, and that's almost created a worse situation. To your point, there's a different privacy rule in California than in Oregon, than in Michigan. So we're not only having to consider country sovereignty in terms of data, but also now state-by-state privacy regulations. Some clarity there at least would be nice.
This is the nature of being in a federal system of union states. Any democracy is going to wrestle with that. I grew up in India, now I'm a citizen in the United States—last 25 years. But any democracy this large is going to have to deal with the yin and the yang, the pendulum swing of center versus states.
And I think the power does sit, as best as possible, in the local communities—states first, federal second. That's what I love about the United States and how we're built from a constitutional perspective. The good news is we should debate these things. Right, we should debate them in the local context and the national level. There's super smart people in the United States on all fronts—whether it's security, AI, or cloud. And I think in general the business communities—I talk to them, many of them CEOs, friends of mine I've known for years—there is a constant consensus to do what's better for humanity, better for tech in general. And that's what's made the United States one of the greatest countries for tech.
