Backup ≠ cyber-resilience: the trap!

Thank you for having me on your show, and it's an honor to be here, not just to be with you, but also in Paris, France. It's one of my dear countries in Europe. I've been here probably 30 times in my life in tech. So yes, we had our Catalyst. We're doing a little bit like a Rolling Stones tour—we're not musicians, we're tech people—but we did one in New York City, Paris, and Singapore. So I took New York City and Paris, and I finished in New York City and then got on a plane, came here. We had a fabulous conference yesterday with many of our customers and partners. And then we also live-streamed this to all of Europe at the same time. So there was maybe two, three hundred people in the room, and then thousands of people watching, and then there may be tens of thousands who watch on demand, sort of like your show here.

Yeah, if you back up for a second, Cohesity's mission has been to protect, secure, and provide insights into the data. We kind of think about it as in those three stages. Protection is all about building that zero-trust platform which got Cohesity started. We invented the way in which you could store, make the platform immutable, and protect it from ransomware attacks. Security, we announced some important things yesterday. The third part is AI. But AI and agents can be used for good and can also be for bad, right? It's a little bit like that age-old debate about fire, electricity, or the printing press.

Water. Fire could be for good, but an arsonist could burn down a building. Printing press is good—lots of good books have been printed; some bad books have been printed. I'm an optimist, and I believe that AI can have a tremendous amount of good. It can help make our lives more productive. None of us today, when we're driving, open up a paper map; we use GPS. AI should make our productivity, our ability to search, summarize documents, and find information much faster. It should help us save lives with medtech and biotech advances. But agents can also be used in a way that might be either accidentally or intentionally harmful. For example, what if an agent maliciously or unintentionally—you remember they used to call that the fat-finger delete, where someone hits the wrong key and data gets deleted. If an agent is deleting data, we come to the rescue. So, what we announced in our defense posture in AI is a strategic partnership with ServiceNow, where they have a product called the Agent Control Tower that can build, register, manage, secure, and observe these agents. If it detects an agent is doing something malicious, it sends us a signal, and then we recover the data from the last point in time, because our backup and secondary data is just a time-series index of all the data you've had. We did a similar thing with Datadog. I expect many of the public clouds and security companies like CrowdStrike and Palo Alto to have that. So, that's playing AI on defense. We also made some advances in our AI-on-offense story. A few years ago, when LLMs came out, we went to Nvidia, and Jensen personally approved an investment in our company. He picked only one company in our space to invest in, and we were able to build, with Nvidia's help, a data product that can search all the data in our platform, especially unstructured data. You might have 100 million PDFs, and it builds a semantic layer vector database—what's called RAG, retrieval-augmented generation. We announced some advances there where that data can be a lake that integrates into Databricks, for example. So, that combination of both playing AI and agent defense and playing AI offense is what we announced at the conference.

I think with any technology, you have to be aware, like I said, that it will help us be more productive, but there will also be problems we have to anticipate. We call it responsible AI. So, we have to think about ways by which we help our clients and our customers take advantage of this in their enterprise or in their daily life. We have some very powerful companies who are the core of AI: Nvidia, Google, to a lesser extent Microsoft and Amazon, but they're also doing good work there, and then you've got OpenAI and Anthropic—those six companies, and Mistral here, for example.

Many of these companies are driving the advances of AI, and we want to take advantage of their technology. We embed their technology or build on top of their platform at Cohesity. But we also have to be sure in our area, which is protecting data, agents could actually do malicious things, either intentionally or unintentionally.

We have a very nice—

Yeah, you mentioned CERT, which is our Cyber Event Response Team. We have pioneered a very nice framework called the Cyber Resilience Five Steps. If you follow those five steps, you get to the nirvana state of security. It's a very good framework that we walk through. Step one is protecting all your data. Step two is keeping things in a cyber vault. Step three is doing threat hunting. Step four is application recovery. And step five is data security posture management. We have some very savvy security practitioners who can help them. A couple of the things that I would point out—just don't have time to go through all the five steps—but step number two is something that I find a lot of customers not doing, which is to keep at least two copies of your data. Maybe your first copy is near your data center, which may be 30 days worth of copy, and then the second copy might be 6 months worth of data as an archive. But your third copy needs to be in a cyber vault. What's a cyber vault? It's like a bunker which is air-gapped, separated from your data center. So, if something happens and all your data is hit, you have a third copy in a bunker that's separated from the network. That could happen either because of a disaster—you know, we're having wars right now and data centers are being affected—or it could be a cyberattack that completely takes down your data center. Then you have a third copy. So, I'm surprised often—

Exactly, you got it. But that third copy needs to be air-gapped. And we call that bunker, that cyber vault, Fort Knox, which is the name of an American bunker.

Yeah. Well, hopefully it's a bunker that's safe. But typically, if you follow that analogy, those drones in the cyber world are like a DDoS attack or something else. They typically get your network. But if your network is disconnected from your bunker, they can't get to the bunker because it's disconnected from the network. So, it's very rare that your third copy that's air-gapped is also going to get affected. And if you really cared about it, you could have a fourth, fifth, and sixth copy, too.

But at least three is important, right? You'd be surprised how many customers don't do that. So, that's step number two.

In our survey research—

Yeah, I would say 70% of our customers say that, but I don't know that they're actually doing the third copy.

They think they're safe, but they're not doing it. They think they have a cyber vault, but it isn't. So, we think that step two is a very important step that all our clients should do, and we preach that, so to speak. Step number four is what you talked about, which is our Cyber Event Response Team. There's an entire way in which you can practice application recovery, clean room recovery. The best analogy I give to someone who's not in technology is healthcare. My mom's a doctor, and I'm on the board of directors of Philips. If you think about what happened during COVID, there's a couple of lessons that we could take away from the pandemic that relate to security. During COVID, if you came to me and said, "I'm never going to get the pandemic," I'd say, "That's great. You have fantastic immunity. I wish I was like you."

Right, but if someone said that. The more important question is not: are you not going to get COVID? The question is: if you got COVID, how quickly can you recover? You want to be back in a day or a week, not a month or have to go to the hospital. That's the more important question. So, in our world, recovery is just as important as detection, maybe even more important. That's the first lesson. Secondly, during the pandemic, we did a lot of testing. You wanted to get on the plane, you had to test. You got off the plane, you test. You wanted to go into a particular building, you tested it. The same thing applies in the way in which we think about data and the entire aspect—we call it a digital jump bag or clean room recovery. In our data, in our world, we're always looking for sleeper cell malware in data.

Sort of like a disease, what does a virus need to propagate? It needs oxygen, right? In the same way, in our world, this malware needs compute, and then it starts to spread. That's the way in which it works. It's the very same principle. So, in step number four, both the technology and our services team—the one you talked about, our Cyber Event Response Team—acts like an incident response team to help our customers with best practices. Then we also work very closely with the big incident response teams like Mandiant. Kevin Mandia built a company called Mandiant; they sold the company to Google. Kevin's on our board. He looked at all the companies in our space and found that Cohesity had the best technology. Typically, I talk to him when there's a major event that happens in the world, especially in the United States, to find out what our posture needs to be. His firm, Mandiant, is now part of Google, and they have a big incident response team. Palo Alto Networks, another big cybersecurity company, also has an incident response team called Unit 42. So, we work very closely with them. There's also incident response teams inside Accenture and PwC, and local countries may have their own incident response teams. That's how we tend to work.

Yeah, I think that's the right posture to take, which is to be paranoid—not panic. Andy Grove, former CEO of Intel, said, "Only the paranoid survive." So, you don't panic. There's a difference between paranoid and panicking. In security, you have to be like a duck, right? The duck is paddling really hard underneath the water, but you're calm on the outside. If we're panicking, then it creates chaos. But we have to work really hard with technology to make the world safer. That's why, being in cyber—I've been 15 years in the security industry, and before that, I was in the applications and analytics industry both at Informatica and at SAP. So, I watched this industry over the last 20, 25 years. In security, you're always learning new things, and you're teaming with other players. We have a very good partnership with companies like Palo Alto and CrowdStrike, and now Google's bought Wiz. Many of our CEOs talk frequently at cyber events. We also help governments shape their cyber strategy. The US administration released a cyber strategy last week; we were involved in helping shape that.

It's intended to be high-level because you don't want a long, verbose document, but those five points are important points you can kind of expand on. We work the same way with the UK, France, Germany, and any NATO-friendly countries and democracies that have to worry about the attacks we've seen in the United States and many European countries. You think about the retailers in the UK last year, or Japan getting hit with the breweries—many of these attacks are very similar to the ones we've seen in the US. So, between the UK, France, Germany, Israel, India, Singapore, all of these countries, if we can find a way to share cyber intelligence information, I think we can keep the world safer.

As it relates to data, yes, because it's your last line of defense. It's a historical copy of everything you have. Backup and secondary data is just a time-series index of everything you have. As you said, if you can attack backup data, which is all the historical data, you're probably going to damage the company even more than if you just attacked primary data. For that reason, this area has moved from a storage topic—how do you store data—to a security topic in the last 5 to 7 years, and we are at the forefront of driving that. The way in which Cohesity was born was as a zero-trust platform built for that security and cloud era. But now you're in a new era where AI is at the front of what you can play offense and defense with. So, the notion of how things are done in a modern world for hybrid and multi-cloud, for a modern type of threat vector with cybersecurity and AI—that's the confluence of where we sit, and it's incredibly exciting.

I think the world is a lot more focused on how it helps for the good. We've not yet seen a major cyberattack driven by an agent that's taken down a big company. A lot of these are attempts, like drones that are automated. We haven't seen anything major as yet, but we have to be aware. Today, I think the big debate about AI is: how is it going to affect jobs? Are people going to lose their jobs?

It's a legitimate concern that we have to work through. But I think it's the same way that you think about other things in society. The steam engine became locomotive and electric, and then planes—yes, it displaces people who maybe were driving horses. Everything in society, my view is, over time through the Industrial Revolution, the Internet Revolution, and now the AI Revolution, we have to, as a society, keep moving up in our skill set. If your only value-add 40 years ago was your spell checker, you were going to get displaced by a word processor. If your only value-add is you can synthesize documents, well, LLMs can do that fairly well. If your only value-add is you drive a car, self-driving cars are going to impact that. So, as a society, we all have to learn how to evolve into higher and higher-level skills, which the productivity of AI will help us garner. I'm an optimist, and hopefully this increases productivity and new types of jobs open up, but some of the existing jobs in certain economies have to evolve.

It has a lot more impact; it's not just any technology cycle. It's very different in the sense that this one, unlike the cloud, the internet, or the PC, has much more impact on jobs for sure. I'm not at all underestimating that. But I do think we have to be adept at finding ways to adapt and use that to our advantage. The way I describe it to my team, it's like a tsunami coming at you. If you have something coming at you, you can either let it hit you or you can ride it like a surfer. Some of the best waves are what surfers like.

Hopefully it's not too high, but some of these big waves are what surfers look forward to. For our own view of it, I don't think Claude, the Anthropic code generation tool, is going to allow you to build a Cohesity overnight. If you ask it to build a Cohesity, it's going to take—there's a lot in our technology which is security, infrastructure, and data management. We invented many of these things 10 to 12 years ago, and the founders built incredible tech. But if we leverage it well, a lot of our code will start getting generated and built by Claude. That's what we're doing: about 30 to 40% of the code that my team builds now is being driven by Claude.

Yeah, it's tremendous. Cursor and all—

We were one of the first adopters, and I've always felt like—

The first form of it is in Claude. I'll give you an example: in a lot of what we do, we build connectors to connect to source systems to ingest that data. Connectors are a very repeatable set.