Rubrik CEO Bipul Sinha: Cyber Resilience in the Age of AI

I just do what is in front of me, and that's what I've been doing. The world has unfolded for me to go from engineering to venture capital to now at Rubrik.

Being a database guy for so many years at Oracle, the biggest challenge with the database was that your data format and your inference engine were tightly coupled. So you can't take the Oracle data files to SQL Server to interpret. But LLM broke that coupling. So you can bring any data to LLM as long as it is textual, LLM can interpret it. So that dissociation meant that we didn't need to build a data engine like the inference engine. You can get LLM as the inference engine. The power comes to the data. So once we realize that Rubrik has data, identity, and apps information, which platform is more powerful to deliver the AI? Once we realize that, then we say, aha, so let's first build a vector search interface on Rubrik.

The hardest day for me was in November 2019 when we had a few quarters where we didn't have great results.

Good to see you, Guru.

I'm three things. I'm a software engineer, that allows me to think about how to build things. I'm also an investor and venture capitalist mindset, which actually allows me to look at markets and identify emerging opportunities. And I'm also a founder CEO that is scaling a business, that allows me to bring people, culture, scaling. And all three together, I believe, is what is required to build a great company. But I didn't plan none of it. In fact, I had the most unplanned career because I truly believe that when the rate of change, particularly in the technology industry, is so high, you can't plan for the future. What you have to do is, whatever opportunity is in front of you, you have to maximize that opportunity and leave the rest to whatever happens as the future unfolds.

So when I was at Oracle, I had the greatest platform, so to say, to meet the smartest people. We were building products together. We were innovating together. We had patents together. I worked with Nutanix founder CEO Dheeraj Pandey. I worked with Snowflake founders, both Benoit and Thierry, and worked with numerous people at Oracle who were really, really talented engineers who built Hive at Facebook, who created the data messaging platform at Facebook and Google and other places. And so this kind of understanding that you have to maximize the present opportunity — you have to maximize whatever you are doing today — creates the future without you even striving for it.

Because back in the late '90s and early 2000s, Oracle was the only company that was building a large-scale distributed system based on Linux platform. There was no other distributed system platform company that was focusing on Linux. And that's how Google actually took a lot of Oracle engineers. Same thing happened at Facebook, same thing happened at other places. Guru, if you look at Oracle, that was the original fountain of talent. Not just the engineering talent. If you look at the leadership talent, CEO talent, it is the same.

And Benioff too.

I wanted to look at business holistically. And although I was a good engineer — I have lots of patents in distributed computing — but I didn't feel like my passion is to just build the technology. I wanted to look at business holistically, from marketing to sales, to really understand why would this business make an impact in the professional lives of our customers. And I asked around, everybody said you need to have a Wall Street experience, you need to have a business school degree. So I decided to kind of go part-time to business school because I was too old for the full-time. So I joined Wharton part-time, and after my first or second semester, my finance professor called me and he said, 'Bipul, what do you do?' I said, 'I'm a director of engineering at Oracle.' He said, 'Why don't you go to Wall Street? Because you have some unique ability to read financial statements.' And that triggered this whole journey of looking at finance. And that's how I first tried investment banking for a summer, and I felt like that was going too far from my roots. So I said maybe venture capital could be a good combination of business and technology coming together.

I got to know Dheeraj back in 2003 when I first hired him as a senior engineer in my team. And obviously, Dheeraj is an exceptional individual, exceptional entrepreneur. I learned a lot from him. Very quickly he became manager of a sister team, and we were best friends since. He has this unique ability and unique grit to not just take an idea and refine it and refine it, but also take it to the maximum possible value that the idea can create. And you know, business is about an individual who don't take no for an answer. And I knew that Dheeraj is someone who will not take no for an answer, and he will figure out a business around the original idea of hyperconvergence. It was a radical idea.

But my style of investing was always that I want to be the first check in every company. Be it putting together the founding team of Braze or investing first money in Hootsuite. All of my investments were oriented towards finding a unique individual who had this unique perspective around a certain market, and then believing in that individual and enabling that individual to go the maximum distance to take that idea and create a company around it.

I felt that I had an edge in venture capital. I was able to identify trends and companies, but I was not satisfied. I felt that my career's arc is bigger than just being an investor. And also this whole idea that I always had was, if you ask someone who was the founder of Microsoft, nobody can give you the answer, but who is the founder of Microsoft, everybody knows. So I felt at some point that Silicon Valley is about creation, about creating an enduring institution that is bigger than yourself. And what would be my contribution to the story of America, the story of Silicon Valley, and how do we create an enduring institution? So that was the idea, to go out and forget all the venture capital success or failures and start fresh and take new risk.

And then the second thing was I always believed in non-consensus markets. So as you said, backup and recovery was not sexy. Back in 2013, all the cool kids were mobile, social, Uber was all the rage. But if you look at backup and recovery back then, it was a $20 billion market and probably the last market in IT that had not been innovated on for almost 15, 20 years, and the last potential transformation of a very large spend in core IT. In fact, this was, as I used to think, this is the last train that was leaving the station in IT, and I had to somehow catch this train and transform this market. So that was the idea: how do we take an A+ team and A+ technology and go after this neglected backwater of IT and make it full front in terms of the importance of data, importance of cyber, importance of what could come. In fact, the first website of Rubrik — that was our stealth website — we used to call ourselves 'world's data management platform.' So in some ways, in 12 years, we have come full circle.

So when Rubrik started, backup and recovery was primarily in the data center. The cloud was starting to happen for mission-critical applications where businesses needed operational recovery or cyber recovery capabilities. So we had to go where the market was, and the market was in the data center. So we figured that if we create a converged appliance software that did the full function, fully automated, cloud-connected, we can really make an impact. But if you're making an architectural change, you can't make the business model change at the same time. So we started selling on boxes, on perpetual sales model, and so perpetual license and maintenance, because we couldn't do two changes. We were already converging three pieces of software into a single product. But the idea was that that was our step one. And then three years later, four years later, we actually introduced a subscription. And then another three years later, we introduced SaaS. So it has been a journey of serving the customer where the customer is, then taking the customer on a journey to a SaaS platform. Because we created — and it took us six, seven years to build Rubrik's Security Cloud, that is a single control plane for all your data irrespective of the location. Because our whole idea was that although infrastructure is fungible and commodity — that's why it's going to the cloud — data is not, and locality of data don't matter. Nobody can say my data that sits on-premises is okay for hackers to take it away and my data that sits in the cloud is the most critical data, because every piece of data is equally important. So our vision was, can we create this singular control plane and policy engine that is multi-cloud, multi-location, data-location independent, that provides full cyber recovery, cyber resilience.

It's a very funny thing. In 2016, we actually started working on cyber recovery, ransomware detection. In fact, as part of our hackathon that we do every year, one of our founding engineers came up with this idea to detect ransomware. And that was triggered because one of our very early customers had one of the first ransomware attacks. It was a small hospital in Louisiana.

And we got a call from the CIO, and he said, 'Every system is down other than Rubrik, and I don't know what you guys are doing, but whatever you are doing, keep doing.' Because the only system that survived that attack was Rubrik, and they got a ransom note to pay, and they didn't have to pay. So we sent our engineers to figure out what has happened here. And then our engineers came up with this idea that, hey, we have an architecture that is cyber-attack resistant, but how about we detect in our system when these attacks happen? So we created this cybersecurity product very early. We got the best security product award for a backup company. None of our customers would buy it. Terrible. None of our customers would buy it in 2017, 2018. We used to give it out for free. This is saying that cyber is the number one issue, and they said we don't have a cyber problem, and ransomware was not as big a concept, right? And then 2019 happened when ransomware started to pick up steam, and we were the only game in town with an architecture purpose-built for cyber attack with the detection and hunting capabilities built in.

Honestly, it's not just the edges. The core of the company has to be oriented towards learning. And how do you get learning? You can only learn when you accept that you don't know much. And when do you accept that you don't know much? When you feel not like success. And how do you feel not like success? You don't let the past impact your success. Your past successes impact your ability to think today. So we always have this thing in Rubrik that we are a company that has no finish line. So when you have a company that has no finish line and you want to be always defining and redefining and redefining who you are, then you're not worried about what is making us successful today.

What made us successful in the first three years of Rubrik has no bearing into what Rubrik would become. Even what we do today has no bearing in what Rubrik would become, because Rubrik is not what product we sell. Rubrik is not what technology that we deliver. Rubrik is about our people and our culture. And these are the only two things that will endure in the midst of the age of acceleration. If you think about three years ago, four years ago, nobody knew about generative AI. As I was saying, like ten years ago, ransomware was not even in the lexicon. Who knows what will happen three, five, ten years from today? So the company has to be prepared and not be burdened by the past, because as soon as you get burdened by the past — which could be success or failure — you are unable to see the opportunities in front of you. That's why we always say we don't want to be the prisoners of our own imagination.

It's very interesting. As I said, when Rubrik's stealth mode website was 'world's data management platform,' so our original thesis was that if we can bring all of the enterprise data together, including the metadata, including the application and user lineage, we can create a truly self-defined data platform and we can supply this data for various use cases. Our first use case was backup and recovery. Our second use case was cyber recovery, cyber resilience. Third use case is identity. And so what we then realized was that in the world of generative AI, what was our biggest problem in the beginning? That we didn't have standard APIs for people to use Rubrik's data because we are not a SQL interface, and if we created a new API, somebody has to program to that API. So you are cutting out the majority of the applications. In the world of generative AI, what we saw was that the application interface is now vector search. So if we can convert Rubrik data into vector searchable data, and since we already have identity and we already have data governance and data classification built into it, we are the most secure data platform.

And the second observation was that being a database guy for so many years at Oracle, the biggest challenge with the database was that your data format and your inference engine were tightly coupled, right? So you can't take the Oracle data files to SQL Server to interpret. But LLM broke that coupling. So you can bring any data to LLM as long as it is textual, LLM can interpret it. So that dissociation meant that we didn't need to build a data engine like the inference engine. You can get LLM as the inference engine. The power comes to the data. So once we realize that Rubrik has data, identity, and apps information, which platform is more powerful to deliver the AI? Once we realize that, then we say, aha, so let's first build a vector search interface on Rubrik.

Yes.

Wow. But here is the interesting part: since when we capture physical data, we also capture the permissions. So the application permissions is reflected as is in Rubrik, right?

That's right. And so if you think about line of business trying to access data, they want to maintain the original permissioning. The agents will maintain the original permissioning. So we have that piece. And then we acquired Precisely, that allowed us to leverage this data to tune the model. So you fine-tune the application-specific model, you can do inference serving. Then this idea that Rubrik has data, identity, governance, plus inference, we can do agentic rewind. So we can do agentic inventory, to agentic access, to agentic tuning, to agentic rewind — because rewind has been our original business. So it turns out that we have this capability to deliver the most complete agent management and operations platform.

I can't predict the future. I only work on what is available to us today. But we have lots of ingredients. And I believe that Rubrik has the opportunity to become one of the most important, if not the most important, AI company in the enterprise.