Sanjay Poonen argues that scorecard no longer matches the threat environment. Attackers are moving faster, agentic AI is ...
What Sanjay Poonen said
Written from the verified transcript and checked against it. Every figure links to the moment it was said.
Sanjay Poonen, CEO of Cohesity, argued that organizations must assume they will be breached and focus on recovery speed, not just prevention. He cited the NIST framework and noted that while companies like CrowdStrike, Palo Alto, and Zscaler handle prevention, resilience is now paramount. Poonen discussed Cohesity's five-step cyber resilience framework to achieve a 'minimum viable entity,' emphasizing identity protection, three copies of data with an air-gapped cyber vault, threat scanning, application recovery practice, and security posture management. He highlighted partnerships with ServiceNow for agent control towers and involvement with Anthropic's Mythos preview to scan code for vulnerabilities. Poonen also discussed AI adoption at Cohesity, including using Claude Code, and the convergence of data protection and security, noting that boards are increasingly focused on cyber risk.
Key takeaways
Cohesity partners with ServiceNow for agent control towers, not building its own.
Cohesity is in the second wave of Anthropic's Mythos preview, scanning code for vulnerabilities.
Cohesity uses Claude Code and partners with Anthropic, OpenAI, and Google for AI.
We have to take an assumption that the bad guys have an open source version of that already. The importance of resilience has only grown. You have to assume that you're going to get breached. And ask yourself, how fast can you recover?
Welcome back to SixFive Summit 2026. We are unleashing AI, or at least that's the theme of the entire summit. And I think it's pretty clear what the benefits of AI are, but you need to make sure that you have the proper governance and you have the proper security to balance out all those benefits. Daniel, this has been a topic all over the SixFive pod and the SixFive Summit. I'm really glad we're talking about it a lot.
Yeah, security is only going to continue to get bigger. We saw, you know, there was this wave of sort of belief that AI was going to be security. And I think what we've come to realize is that AI is just massively increasing the size of the attack surface, the threats, the risk, and it's going to, I think, unleash an exponential growth opportunity for our cybersecurity industry. AI could bring, you know, some of the fragmentation out of it, as you and I talk a lot about on our shows, but as it brings it all together, we know that keeping data safe, keeping workloads secure, governed, sovereign, security's going to have a big role to play.
That's right. And enterprises are really having to rethink the way they think about data protection and recovery. And I'm pleased to introduce Sanjay Poonen to help us unpack this. Sanjay's the CEO and president of Cohesity. He's been on the show multiple times. Sanjay, it's great to see you, my friend.
It's been great. And yeah, you've been with us, Sanjay, over the years. I think, you know, we've got a half a dozen of these summits now in the books and you've done a number of them and of course you've been on the show many times over the years. It's been great to watch Cohesity grow. We'll continue to track that. So let's start off talking a little bit about, you know, cybersecurity broadly, right? We've spent decades building cybersecurity really around prevention. But the reality is, you know, we're not going to stop everything, right? That we've gone in these waves of trying to stop everything to knowing they're going to break in, but maybe only letting them break in so far and then how do we handle the threats, resolutions, get back. But like, you know, we are measured this industry by how well organizations can prevent attacks, but that's not realistic. So talk about security, business resilience, and why that maybe is a better measure of success.
Yeah, Daniel, I would say I adopt the Benjamin Franklin line a little bit and say the following. An ounce of prevention is as important as a pound of resilience. So if you think about the NIST framework, the NIST framework has detect and prevent on the left-hand side and recover, remediate on the right-hand side. And an entire industry of these great security companies like CrowdStrike, Palo Alto, Zscaler, others have focused on the left-hand side, whether it's the endpoint in the case of CrowdStrike or the firewall in the case of Palo Alto or web gateways like Zscaler. That's all detection prevention. We need those. That's sort of the ounce of prevention. But in the post-mythos world, an agentic attack is going to come at us in a more deadly fashion and a faster fashion. So everything, you know, Anthropic's doing a good job. We're part of Project Glass Wing. Some of our customers have been testing our code binaries when it started. So we're well inside the tent on what we see with these incredible models. And Anthropic and the US government has protected that from the outside world, but we have to take an assumption that the bad guys have an open source version of that already. So, if that attack's going to come at you faster, the importance of resilience only grown. You have to assume that you're going to get breached and then ask yourself how fast can you recover?
Poonen, S. (2026, September 21). Assume You’ll Get Breached. How Fast Can You Recover? | Cohesity [Interview transcript]. Six Five Media. CEOInterviews.AI. https://ceointerviews.ai/interview/2944757/
MLA
Sanjay Poonen. "Assume You’ll Get Breached. How Fast Can You Recover? | Cohesity." Six Five Media, 21 Sep. 2026. Transcript, CEOInterviews.AI, https://ceointerviews.ai/interview/2944757/.
BibTeX
@misc{poonen2026_2944757,
author = {Sanjay Poonen},
title = {Assume You’ll Get Breached. How Fast Can You Recover? | Cohesity},
howpublished = {Interview transcript, Six Five Media. CEOInterviews.AI},
year = {2026},
month = {sep},
url = {https://ceointerviews.ai/interview/2944757/},
note = {Speaker-attributed transcript with timestamps}
}
