Welcome to the Washington AI Network podcast. I'm Tammy Haddad, the founder of the Washington AI Network, where we bring together official Washington policy makers, DC insiders, and AI experts who are challenging, debating, and just trying to figure out the rules of the road for artificial intelligence. Welcome to the Washington AI Network.
We are back at the House of 1229 for a conversation that's at the very heart of national security. And as regular listeners know, we have been honored to host Trump administration officials who are working so hard in the fields that we cover. Of course, Howard Lutnick joined us for the AI Honors. We've had, most recently, Scott Cooper, TechForce, Patrick Witt, I think you guys know Patrick Witt. And tonight, we have a very special guest.
Please join me in welcoming Sean Cairncross. He is President, National Cyber Director. He's a long-time Washington important man, and there's no more important issue, Sean. Although, I don't know, you need to learn how to duck this job, I got to say. Welcome, Sean Cairncross, please.
And I also want to invite you to help me welcome Sanjay Poonen, who is the CEO and President of Cohesity. Thank you for being here.
That's the Sean Cairncross show. Okay. Sean, you released your cyber strategy, okay? Now, I want to read, if you don't mind, your pillars, if I may, just so everyone can write it down. Shape adversary behavior, promote common sense regulation, modernize and secure federal government networks, secure critical infrastructure, sustain superiority in critical and emerging technologies, build talent and capacity. Sean, that's a heavy lift. Oh my goodness. So, please take us through, not all of them, but how you're going to get this started.
Sure. Happy to do that. First, thank you, Tammy, for having me. I appreciate being here, and thank you, everyone, for taking the time to listen. And Sanjay, great to see you.
See you again. We've seen each other quite a bit the last few weeks.
Seen each other quite a bit, and looking forward to this conversation. So, the first thing I would say is we did put a lot of work into the strategy, but it is President Trump's cyber strategy. It's not mine. It's the administration's and the president's. And I think I make that point because I think it's an important one. What we're really trying to do here, and what the President is signaling for the first time, is from the top of the chain, a strategic direction for cyber as its own strategic domain. And for so long, this is an area that has developed with different authorities and different agencies operating on a tactical level, but the USG haven't really pulled back to say, 'What are we trying to achieve in this domain holistically? How can we lever every component of the USG to get done what we're trying to do in cyber, and how can we use cyber to help on a strategic level with what we're trying to get done fundamentally elsewhere?' So, that's what this effort is all about.
Okay, so adversarial behavior, how do you shape adversarial behavior?
Yeah, well, the first thing I'd say is right now, the incentive scheme here is way out of whack. We have seen this for decades now develop and scale and become more sophisticated on industry, on government networks and capabilities, whether it's espionage, nation-state related criminal organizations, scam centers, ransomware actors, or the like. And it's asymmetrical. It's a huge payoff for very little cost. And there are so many points of defense, defense just doesn't get the job done alone. And so, if you're on the adversary side of this, why would you slow down? Why would you stop? And as AI, artificial intelligence tools are infused into this mix, the pace picks up, the speed picks up, and it becomes even more rewarding. So, I think it's incumbent on the policy making set to say, 'The government has a role to play in defending US interests, US citizens, and industry.' And I should say, I know we've got international allies in the room here. I see the British are here, the Irish are here, I'm sure there are others. And we work in close partnership because we're facing the same threat actors, and this threat doesn't know borders. So, what we're trying to do is impose costs on those who engage in this behavior, figure out a way to do that using the whole of government. Some of it's cyber on cyber, but not all of it, to send the message that this behavior carries risk, and that calculus to engage in it maybe should be revisited. And Sanjay, what's the role of private industries?
Well, I've been in the security industry 15 years. When I first met Director Cairncross, it was at a conference last year. He came out to visit Kevin Mandia and myself. I hadn't met him before, but I'd heard a lot of good about him. He has a legal background, but he was very common sense. And he was asking our perspective as industry leaders. We had another meeting that he initiated this time. Kevin, myself, Nikesh Arora, CEO of Palo Alto, was there. It was again a really good dialogue between his office and the private sector and how we could help in partnership. If you think about us, we can play cyber defense really well, but we have ideas in cyber offense. You don't want all of us going on offense against a country. What can we do to go on offense if we know it's a nation-state? We need the government to play cyber offense. And on his first point, what I was really delighted about was the point in the paper that talks about the government now playing a lot more on cyber offense. We're also very excited to play a small role in helping write the Trump administration paper. But one of the other points that you read out was modernizing the government with appropriate secure infrastructure. That's where we play at Cohesity. Securing critical infrastructure. There were a couple of those six pillars that really resonated with us. He mentioned the fact that every NATO-friendly country and every democracy is going to see the same attacks that the US is facing. We're the biggest GDP, we're one of the biggest democracies, and typically, the bad guys attack us first. But what we saw in the UK with the retailers last year, what we saw in Japan with the breweries, were mirror attacks of what we saw in the United States. So, we'd love to first off keep America safe, but then use that to help the world stay safe.
Yeah, and just two follow-ups on that. So, specifically, it was no accident that the President signed the cybercrime EO at the same time as he signed the strategy. That signaling is we're now treating these organizations as transnational criminal organizations. So, that opens up the ability for us to say, 'How can we proactively get after this problem in a way that's not always reactive?' So, we're not waiting to do the remedial side of it and fix things, but say, 'How can we deny them the benefits of what they're doing, make their life hard, and deny them safe haven where they go hide out?' That's the first thing. And the second thing is, to your point, what the President has directed the administration to do is to be forward-leaning with industry to make sure that we're viewed as partners with our terrific innovators and the private sector that handles the critical infrastructure, defense, and operations for this country largely. First time I met this guy, I said, 'Look, this is what we're thinking about. This is the direction I think others want to go.' I kept looking for someone to say, 'No, you guys are nuts. Don't do this.' And their universal response was, starting with Sanjay, 'Yeah, what are we waiting for? This needs to happen. It's been waiting for from the top direction, and we're excited to have it.'
Well, it sounds like both of you are saying you're going on offense instead of waiting for something to happen. Is that a fair way to say it?
This is a proactive administration, and we believe in not letting problems fester and find their way to us.
But also, even the engagement of the private industry, because while watching our friend Phil Mattingly on CNN, something happens, and then we hear that government steps in, and industry, it's almost like this tick-tock after. But it sounds like you're coordinating in advance to maybe stop some of these cyber attacks, or not attacks, but just put this policy in place that would answer some of these questions in advance. Is that fair?
I think that is fair. I think there are two parts to that. There's the front end part, which, like I say, 'What can we do strategically to get after these actors?' And that involves the private sector, allows us to really scale in doing that. And there's so much work that you all do. They have great insight into this battlefield. Half the time, they're taking down networks as part of their standard operations. And so, it's aligning those priorities and figuring out how we can allocate resources to best get at this. The second part is the remediation side. Once something happens, what do we do about that? There, I think we've got great interagency colleagues now, FBI, DOJ, CISA, the NSA, who are terrific at helping identify and remediate those things once they happen. Now, what we're doing is saying, 'Great. Once that happens, what can we do in response? How can we better prevent this from happening again?' Sanjay?
If you look at the security industry, there's like 5,000 companies. But for the prominent ones, we're the leader in data security. Nikesh's company, Palo Alto, is the leader in network security. George Kurtz's company, endpoint security. We all get along and we like each other and even if there's overlap, we talk a lot together. And we all have a common interest, which is keeping the country safe. Many of us also have operations in other parts of the world. For example, Israel is a good example of a country which has really good security technology. We often have played with companies there, acquired them. We work with the UK MOD. So I think when we look across the entire world's substrate and landscape, we want to make sure that we're sharing best practices among ourselves. And when the government's willing to work with us, we are in an active dialogue with them. Because this requires a collaboration on both sides. And typically, all of us who are prominently involved have major companies in every industry. So we study the attack, whether it was Colonial Pipeline or what happened to United Healthcare Group or what happened to the Las Vegas hotels or most recently at Striker. And we have a very good view of what's happening there that we could then feed the intelligence agencies. And we need help from the government to say, 'Okay, now here are the facts we're seeing. I think it may be time to go on offense as an example.'
It has to work together. People may sleep on how important the private sector, particularly companies like Sanjay's and Cohesity, are in protecting daily life in America. And so if we're not sharing information in a way that's at relevant speed, at the right tempo, and it's actionable, then I think it's a disservice to everyone.
Okay. So Sanjay, I want to turn to agentic AI because that strategy also makes a bold commitment that AI can actually detect, divert, and deceive threat actors in real-time. Cohesity already uses AI to protect customers' data. How do you see agentic playing into all of this?
Well, I think it's a little bit like the age-old debate about any technology could be used for good or bad. Or even going back thousands of years ago to fire. Is fire good or bad? Keeps a house warm, but it could burn down a house. The printing press. Good books have been written, bad books have been written. The internet. I think when you think about AI and agents, there's a lot of productivity. Entire aspects of publications now are being transformed through the ability to take an entire Leo Tolstoy and summarize it in a half page. But when we think about agents in the future, just the same way that we're battling these jihad drones that are coming at us that only cost $10,000, the ability to create a new ransomware attack or a new agentic attack gets cheaper with agents. And that's an example of agents being used for bad. And as we've always talked in the security industry, we've got to be right all the time, they've got to be right only once. So if the ability to attack us, the cost goes down because they're agentic, we have to build a resilience framework for agents. So these are agents that could be potentially maliciously deleting data or unintentionally deleting data. And we have an entire framework of how we think about that. I think this now requires our research in the security industry to cover not just data and applications and identity, but also agents.
Okay. You often talk about the data iceberg. The idea that while we focus on the 25% of live data we see on the surface, there's a massive 80% submerged underwater in backups and archives that is often ignored. How can government, do you think, leverage its massive data archives?
There's a long kind of thing. I won't go through all the details here, but the point that Tammy's making is if you think about where data's stored, typically you divide data into two forms. Structured data is databases. If you're a technical person, it might be an Oracle or a Databricks. Unstructured data is files. And you probably have a lot more files than you have databases. And that's why 70% of the world's data is unstructured. And as this data ages, typically the government or any bank keeps a copy of it. It's called a backup or a vault. And that just accumulates. And the longer you have regulatory requirements to retain that data, that data just becomes the bottom of that iceberg. The bad guys discovered, 'Let's not go after the top of the iceberg. Let's go after the bottom of the iceberg because that's just your historical copy of everything you have. And if I can get all your history, you're likely going to pay me the ransom.' So the way in which you protected that secondary data had to change, and that's how our company was born. And I think you take any department of government, and the same thing applies to JP Morgan, any of the banks. Wherever you have more data, and especially unstructured data, you've got to make sure you have a policy to secure that. And one simple thing we recommend to everybody. We have five steps, but one that I'd point out, everybody should keep at least three copies of their data, with the third copy being in what's called an air-gapped cyber vault. An air gap means that this is my network, and Shawn's outside my network. I separate you from my network, and I keep my third copy with him. So if my entire network goes down, the third copy is in a safe place. That's what it means, an air gap and a cyber vault. In our world, we call that cyber vault Fort Knox, and we want to make sure that every company has that notion of a third copy cyber vault.
