62: Data Security in the Age of AI: Cohesity CEO and President Sanjay Poonen

Thank you. Thank you.

Yeah, absolutely. Happy to be here and thank you everybody. We've got a live audience in the room and hopefully many people listening. I think one of the things that's happened with data is first off the realization that it's exploding at a pace that's uncontrollable, because everything that you do generates data. It's like digital exhaust. So you think of the Library of Congress or whatever your favorite metaphor is of a library of the past where there was physical data, and now in a digital form your car emits data, your phone emits data. So data is exploding. And the second thing to note is it's very fragmented—fragmented in all different silos of storage. Those of us who have been in the data-oriented industry—I've been watching this for 25 to 30 years—you can divide it into structured data. Structured data are things like a database, everyone hopefully knows what a database is, it's got rows and columns, it's like a spreadsheet. And unstructured data are things like files—text files, maybe a PDF file or a word document, an image or a video. Those are unstructured data and all of that data is just exploding. And the first thing that you want to know about that data, especially as it relates to the enterprise and the government, is the bad guys want to get at it. Because if they can steal it or corrupt it, they have this thing now called ransomware that's become very common in the last 5 to 10 years. All of the data that's kind of secured and in some cases backed up has become the attack vector for ransomware. In the last 10 years, ransomware attacks have just been on the rise. And they're typically nation-state actors from a couple of countries—you can probably guess who those are. So all of us in the enterprise and the government need to have our guard up. There are certain rules of cyber hygiene, certain things that we could do. But the most important thing to that data—especially sensitive data, classified data, and in the banks, all of consumers' data—is to keep it secure from ransomware attacks. And the second thing you want to do once it's safe is: it's not valuable just if you're putting it inside a bunker. You want to use AI to get to that data. So Tammy, that's how we think about data. There's a security element of data and that's more paramount than the AI. But you put those two together—we've got NVIDIA in the room, they're an investor in our company—AI is now exploding everything. But you can't do AI before you've absolutely secured your data, because if you don't have the data, what's the point to AI?

Yeah. So you have to first understand both those two—when it's regulated or siloed or in many cases classified, you want to find a way by which you can get all of that data into a centralized platform that's secure. That's what our company has done. The founders are ex-Google folks who built an incredible platform that could ingest data—think of that as getting it from all these different silos into one centralized platform, and that place was secure from the bad guys and you could recover that data extremely fast. That was the core tech that was built about 12 years ago. And what we've built on top of that is just more and more sophisticated security to protect that data. Talk about government data, whether it's classified or unclassified—that data could be sitting either on-premise in the government's data centers, or in the government's cloud classified at various different levels of classification, or in a cloud that we manage as a SaaS service. All those places with the levels of classification. And once that data is in that secure place, there's a concept of what's called immutability—meaning you cannot write over data. Think of it like, I don't know, many of you are too young to remember what a tape was, but I grew up at the day and age where my first exposure to Michael Jackson was a cassette tape. And if you remember cassette tape, you couldn't write over it. You listen to segments of a song the first time, you could write over, but then it was frozen. That's the notion of immutability. You want to basically make sure your data is immutable in a secure place. It's encrypted. Those are the types of things we help the government and the enterprises with.

Yeah. Everything in life is complex until you start putting into categories. So typical data, like I described, even at the raw level you could think of it as structured or unstructured. Now let's go a little deeper. Typically inside that you'll see formats like this. I'll go a little bit technical but not too technical. There's a notion of what's called a virtual machine—that's a concept, I was at VMware, that VMware invented. So typically a lot of data exists inside a virtual machine, so we can go and get that data because we build very strong integration into various forms of virtual machine, VMware being the biggest of them. The second format of data we typically see is databases, and there could be tens of different types of database—common ones are Oracle or Microsoft or MongoDB and so on. The third form of data we typically see is files—think of files like a PDF file or a word document. And the fourth are some applications like Salesforce or Microsoft 365 or Google Workspace. So those are typically the four buckets of data. And if we go to one department, let's say on the defense side or the civilian side, you'll typically find those four—not much variance. So we'll go and work with many of you who are CTOs or CIOs of those departments. We'll work with your teams that have that infrastructure, be able to identify where that data is. The exact data might be different in each department, but they're typically in one of those forms: a virtual machine, a database, a file, or some other application. And we take that data, we build connectors to all of that data, ingest that data into a secure platform that typically sits in one of the government's enterprise locations—secure, classified, high level of security capabilities. Once that security is ready, now we're ready for AI.

Raise your hand if you understood what I said. All right, don't feel too bad.

I was warned not to get too technical.

Yeah. So AI is amazing, and for those of you who have children, it's amazing. Let me tell you a short story that motivates how powerful this is. I have an 18-year-old—she's now 19, just gone to college—and twin boys who are 15. And as she was getting into high school and doing physics—she's more a biology person, not so interested in physics and math like I was—I wanted to review physics and help her, and it was kind of jogging my mind to 20 or 30 years ago when I was in high school. I would read the textbook and the concepts would come back—Newton's law of XYZ. And then one day when I was going on a trip I said, 'Hey listen, I'm out for a couple of days. There's this tool called ChatGPT, but do me a favor—you're not using it to cheat, okay? You're using it to test your answers, okay? Because I want you to learn the concepts.' I came back from my trip and she said, 'Dad, you've been displaced. I don't need you anymore because I've now got the tool which helps me.' And you want that to be the way in which people learn—hopefully not cheating, but using it as a tutor.

I started playing with it in the early days when it came out. Whenever people started talking about it—LLMs—two, three years ago, and I was amazed. What I first did—I've been speaking on topics like this for 20 years, data and analytics, and then when I was in VMware and security—so I asked it to summarize a Sanjay Poonen speech from 10 years ago on this topic, and it did such a brilliant job. I was like, wow, this is amazing. And what struck me was the tool itself is powerful, but the company with the most amount of data and content was going to win, because ultimately the holder of that content was what we were summarizing, and it was a very powerful summarization tool. So if you didn't want to read— all of you are very educated, probably very good communicators—if you didn't want to read Leo Tolstoy, which is the biggest book I think anybody's asked to read in college, and you said, 'Summarize Leo Tolstoy,' they could do that really well. Now the early forms of ChatGPT, you never knew if that was accurate.

So if you were in college and you asked to summarize Leo Tolstoy and you asked ChatGPT to do it, it might what's called hallucinate—meaning it gives you a wrong answer—and then your teacher knew you were using it, but that's getting better and better and better. The ability to accurately summarize large amounts of data with GPT-1, 2, 3 now instead of version 5—OpenAI, Anthropic, very, very powerful. So the way to think about these LLM tools is it's the grand summarizer of large amounts of data. You give it a large document and if you didn't want to read it, it summarizes into a paragraph, and it's getting more and more accurate. So build on that concept. What does Cohesity do? We store a lot of data securely for all of you, many of your organizations. I've talked to some of you prior to this and we could do more to help you. We're very obsessed with keeping the country safe and keeping the enterprise safe. But let's assume all your data we kept safe on our platform. Just keeping it safe is part one. Now imagine that notion of what I described—the grand summarizer—helping you summarize large amounts of, let's take one document type, of PDFs. So some of your departments have a lot of PDFs, maybe in the hundreds of millions of docs. If you could run a flashlight or a summarizer on all that—and you're authorized to do it, because you don't want the wrong people accessing the information, so that's a big assumption we call responsible AI—but if you could have that tool now summarize 100 million documents. So in some cases you might have vendor contracts if you're in the DoD or some of the defense departments, but everyone has vendors they deal with. So think of contract documents, 100 million of them over the last 10 years, and you wanted to write a query of this sort: 'Summarize all the economic terms I've given the vendors I deal with and put it in a nice table.' That's what GPT and ChatGPT could do. Well, we built that tool for the data that's on our platform. It's a product called Gaia that we're very honored to build with NVIDIA, who invested in our company, because a lot of this is powered by their GPUs. And it's the first time that a tool of that kind—a generative AI tool—can be applied to that data. That's a very powerful concept.

Well, you have ChatGPT for bad guys. There is AI we use for a lot of our research algorithms for security, but this is—kind of, I would say, defense. This is intended to be a productivity tool to help you play offense, to help you get insights on the data.

And where you have those large documents, now you can search and summarize them. The other place it could be helpful is if you have a legal compliance case—you're trying to investigate things—and large amounts of unstructured data, searching and summarizing them. This tool, Gaia, is incredibly powerful.

So an agent is just like a robotic app that runs some things for you. Think of it like a sales agent or a travel agent. So this concept of Gaia could either be an app or an agent. And in general our view is that the way in which you do any task repetitively will be done by this agentic robot. For example, if you're repeatedly using spell check in a document, that could be something that's automated for you in an agentic fashion. Anything that you're doing repeatedly in life—the first form of a robot were these small little robots that cleaned your room. You remember that?

So—I just saw that. Wet and dry. That's AI for you. That's an example of an agent, right? It's doing work for you. Now, you take that same concept and apply it to anything in the tech world. Anything that you're doing repeatedly that someone could watch and learn and you authorize will become an agent that helps you. And wouldn't that be great in life? Why would you want to do something that's repetitive over and over and over again—you're like, 'I'm copying and pasting over and over again'—that should be done by a robot. That same concept could be applied to anything in tech, including security, which is our world.

Yeah, I think that's actually the right way to think about things, which is this is sort of the age-old debate—is fire helpful or not helpful? Is a typewriter helpful? You went back and asked, are these incredible technologies going to disrupt and change jobs? I've always viewed it through the lens of efficiency, which is, yes, if you want to use fire in a harmful way, you could burn down a house, but I choose to use it to keep ourselves warm. A typewriter—you could have written by hand, but thank God for a word processor, it's made us more efficient. So all of us should not fear AI. We should use it just the same way that you thought about that first example of the printing press, or a typewriter, or fire—in ways in which it will make us more productive. And that means we have to all move higher in the stack of our use of these tools as opposed to thinking of it as a threat. So the first time spell check came out, I'm sure people whose expertise was spelling probably felt a little threatened, but they all got to be better writers as opposed to just better spell-checkers. The same way I would say today, if the value-add of a new grad is being able to read large amounts of documents and summarize that, that's going to get done by these agentic tools. So you start now getting better at using them to write faster or using them to compose a musical tune better and faster. So I just think that all of these things make you productive. One of the most stressful things in our daily life is driving, right? And most accidents happen, some on the freeways, but a lot of them happen inside stop-and-go traffic in cities because someone's not being attentive—they're on their phone or what have you. Well, let's take this worry of phones and have you sit in the back seat and let the car drive for you. Does that mean that all of a sudden we make drivers more productive? So I think that's the way in which we've all got to think about the future of AI and agentic AI and how it's going to help our lives. Think about the future of anything that's repetitive that can get automated and done by a robot. And in our world of security, that means guessing what the bad guys are going to do and ensuring we build those algorithms. Now, let me tell you—the bad guys are also using agentic.

I think again of the fire. The same fire that's keeping you warm could be used by someone to burn down a house. So we have to be 10 steps ahead of the bad guys, because in our world of keeping the world secure, we got to be right all the time—the bad guys never do that. So coming back to your question about the current administration and efficiency and AI, one of the things that's incredibly powerful about this country is the best companies at AI, the best companies in security, are in the United States. So if you're American, you guys are extremely proud that the innovation is happening here. In security there's also a lot of good innovation happening in one of our great friends in Israel. Many of us work with companies there, some of us acquire companies. So in security, I think the United States and Israel is doing the most pioneering work in technology, in security. And if we want to be the country that the world admires for innovation, this is it. This is the best time. You're at the center of security and AI and cloud. And these tech companies—we're one small piece of many other great companies—are the most admired companies of the world. 25% of the S&P 500 are American tech companies. So all of us should feel very excited about innovation. If you're a young college grad coming out, we want that workforce to join and help drive innovation. And we need a lot more college grads who know about tech—men and women. Women, for example, studying computer science—I went back, I did my undergrad at Dartmouth, I went back to the computer science department there, and we need more women in that. So I think we need to see this now really driving.

I think there will always be a segmentation of three possible cloud systems. Private cloud are going to be very sacred to the nature of, let's say, a classified or secure part of the government that needs to stay in their private cloud, on-premises and so forth. Public cloud may be places where they say, okay, it's the website that is visible anyway to the world, the documents on that website are visible to the world, so it could sit in Amazon. But there is a third concept now developing outside the United States—what's called a sovereign cloud. So what's happening in many of the countries outside the United States, they say, given policies that every government is forming, including tariffs, we have to now build our cloud in Germany that has data in Germany. And legislation is starting to get formed, parts of Europe especially in the EU—there's a legislation called DORA which requires you to keep the data in the country of residence—France, Germany—and I think that trend is going to happen to some subset of the 150 or 170-odd countries. So I think we're going to be in a place where we've got a private cloud, a public cloud, and a sovereign cloud for each of these countries, and that's okay. From our perspective, as long as the formats of the types of data inside them—that's much more a location choice: is it on-premise or in an Amazon or in the country of choice? You're still going to find the types of data we talked about before: unstructured, structured, virtual machines, databases, files and so on and so forth. But it now does create—now in a company that's at Cohesity, we thrive on heterogeneity. The more diverse that data, the more you need us. So I'm being a little self-serving.