Hi, I'm Mark Mcclain, CEO and founder at SailPoint, and welcome to our Identity Matters podcast, where I have the opportunity to talk with security experts, business leaders, and really smart people who are humble, hungry, and ready to tell us about their leadership journey. So I'm really pleased today to be joined by Sudhakar Ramakrishnan. I've known Sudhakar for quite some time, and he is the CEO of SolarWinds, a very familiar name in the security industry and a fellow Austin-based leader. So Sudhakar, so glad you could join us. Welcome to the podcast.
Thank you, Mark. Thanks for having me.
Well, listen, you and I have known each other for a bit, but go ahead and let's give folks a little bit of backdrop on kind of your journey to this point. You've been leading SolarWinds for a number of years now. It sort of has been on an interesting journey, like SailPoint, in and out of the public markets a little bit, and early on kind of an early leader in some of the IT management, but more and more kind of part of the global cybersecurity story. So if you were just going to kind of help folks get a current snapshot of where you are, how would you summarize where SolarWinds is today and kind of your mission in the industry today?
Absolutely, Mark. I've now been at SolarWinds almost five years. SolarWinds, as you mentioned, has had a very, call it, storied history over the years of serving customers, and our initial foray was in the broader space of monitoring software. So we became leaders in monitoring networks, systems, databases, and applications. Over the last five years, due to customer preferences, market changes, the whole notion of hybrid, and of course the security landscape, we've evolved from being a company focused on monitoring to now delivering what I call operational resilience to customers. And there are many connotations of it. But if you think about what does operational resilience mean to us and to our customers, it is, think of it as on a common platform delivering the ability to automate, observe, visualize, and remediate customer environments.
And these customer environments could be spread across multiple clouds, hybrid environments, can have networks, systems, databases, applications, etc., which is leverage the rich history of SolarWinds, but then translate it into today's world where, as you know, things like alert fatigue, things like productivity challenges, AI security are all hitting customers from different angles. So in that world, how do you keep them productive, how do you keep them running, and how do you keep them operationally resilient is what we do.
Well, and obviously, Sudhakar, that ties near and dear to our hearts. Obviously, in the world today, when you're doing IT operations, almost inevitably that has to at least incorporate, if not highly integrate with, the security landscape, because every IT operation in the world now is under some level of attack, typically by the outside and occasionally, as we all know, from the inside. You know, when you think about how much shifting and evolution there's been in the landscape around security, and you've had a familiarity with SailPoint, you know, when you think about the realm of security and within that even the realms of identity and trust, and what are some of the key things you see happening in around the market today that you think are really interesting.
I mean, from a market standpoint, I won't be telling you anything, Mark, that you don't already know. Concepts like zero trust, concepts like least privilege access, etc., etc., are around, have been around, and will continue as we move forward. But the way I think about security at large for all of us as security practitioners is how do we reduce the threat surface as quickly as we possibly can, and how do we reduce the threat window as quickly as we can. So I know it's easier said than done, but the more we try to do things, and that results in challenges around identity, that results in challenges around infrastructure security, application security, etc., etc., that is the way we can continue to improve. And the reason why I say continue to improve is the nature of security and the nature of security threats is such that no single company has all of the answers all the time. Many of us have really good answers most of the time, but not all of us have answers all of the time. And so we talk about depth in defense, and so it's not a single thing. There are many aspects to security that need to be addressed. One of my favorites, I would say, is that ultimately as providers of software to enterprises, our goal is to help them become more productive, more efficient, etc. And yet if you think about the notion of a firewall, or the image of a firewall is that of a brick wall, right? And it has sustained for a long time. And so my thought around security always is security should be about access, not about control.
So in other words, we can clamp every possible control we want and make it difficult for people to break through, but they may also result in lost productivity when you do that. If you make things easier or tougher for your employees, they're going to be less productive, for instance. So how do we address the challenge of making security embedded, pervasive, and accessible and not about control? I think therein lies a significant opportunity for innovation.
Well said. Yeah. And I think we all know, like you said, there's such resistance, especially in times of high innovation like we're living through right now around AI and agentic and LLMs and all that, that the business wants to move quickly to take advantage of new opportunities for efficiency, effectiveness, competitiveness, all those wonderful things we learned in business school. And at the same time, everybody's highly attuned to the risks that can come with new technology. And like you said, there's a sense of the right people getting access to the right things to do what they need to do for the business while ensuring that either the wrong people don't get access or the right people don't get access to things they're not supposed to, which could also lead to challenges. And it's like you said, it's ideally invisible control is another con, right? It's really access appropriately, which is sort of invisible control. I want you to be able to act like you can go anywhere you want.
When in fact, you can't go anywhere you're not supposed to go.
Exactly. Exactly right. Exactly right.
That's sort of an ideal world, right? Yes. And let me, you know, you're a great leader, Sudhakar. One quick thing on the background of you and I as leaders. I thought it'd be a fun thing. You know, we're in the realm of identity, and of course, identity security is about the identities in the enterprise that we're protecting. But we also think, you know, as companies, our companies sort of have an identity or a persona or at least a reputation, right? And you know, you've built a great company. Matter of fact, for those that don't know, Sudhakar inherited SolarWinds right after the difficulties came about from what happened to their business from an outside attacker. You know, you talked about building, in your case, sort of rebuilding not from a company you had before, but rebuilding the trustworthiness and integrity of a company that I think you've done a marvelous job with, both inside the company and out. How do you think about what it means to be, as a company's identity, to be a trustworthy, good partner in the market?
That's a great question, Mark. And you have done that, I would say, in SailPoint as well, to return the kudos and the compliments, and you've continued doing that. When I think about it, the way I reflect on it is first and foremost, do we have a purpose that matches to what customers might look for in a company? And that's the starting point as far as I'm concerned. And oftentimes it just becomes a set of words, but many times it is lived by you, by the company, by everyone representing the company. So to your point about identity, if we can truly translate our purpose into our actions, that would result in setting an identity that is worthy of living and being recognized. That's a starting point. Beyond that, I think it's a matter of can customers rely on you in good and bad times. That's an important element of it because we live in an interconnected world in more connotations than both of us can possibly describe on this call. And so in that world, how do we support one another is a very important element of what reflects in our identity.
Next is, do you really care? I mean, many times I've had customer conversations where I would tell them, for instance, hey, the technology choice that you're making, and it may have nothing to do with my company's technology choice, the technology choice you're making is not appropriate for your environment. And that's a matter of when the customers trust you to say such things because you truly care, and how do you get your entire company to be able to have those types of conversations with them. And then last but not least, do you as a company have the ability to learn and change? And are you humble enough to accept that you don't have all the answers, but you'll figure them out. So those are things that I think help customers believe us, build a dependable culture, and of course a company that can be identified as great.
Yeah. Boy, those are all wonderful tenets. And I, yeah, I think we certainly try to hold to some of those very same tenets.
At SailPoint. Matter of fact, one of my favorite things is our chief customer officer, Meredith, likes to say to customers, I'm not really here to make you happy. I'm here to make you successful. And sometimes I might have to make you a little bit unhappy when I tell you I need to do this to get where you need to go. I always joke that if you don't understand that, it's because you have never raised a teenager. If you raised a teenager, you understand at times I'm going to make you a little short-term unhappy to help you be a successful adult. And so there's some commonality there, I think, in what we do in companies, like sometimes we have to do the hard things to do the right thing for the long run, particularly sometimes even in the short run as well.
Well, that's great backdrop. You know, obviously, you know, the identity space is very interconnected with both, like you say, business advantage these days and security. And, you know, we've been using this word digital transformation for a number of years now. I don't know that we all saw how much digital transformation might actually be looming once AI and agentic swept onto the scene in an amazing way in the last whatever you want to call it, 12 to 24 months. Um, you know, when you think about the customers, we share a lot of large and very large in some cases enterprise customers, and you talk to what risks are keeping those folks up at night in either their IT world, their security world, and sort of the intersection. You know, what do you hear as the kind of the risks and the concerns that people are really worried about today?
There is a number of risks, Mark, as you well know, but I'll highlight a few that seem to be surfacing more and more to the top. One is, I believe customers are getting a greater and heightened sense of interconnectedness that they have with direct and indirect vendors. So for instance, the amount of open-source code that might be running in your environment or in your enterprise, you may not have a good idea of it at all because you only know the vendors that you're working with. You don't quite know, call it the software bill of materials that people use to create things that you rely on. And so what might be the vulnerabilities in that? What are the security aspects of it? How were they constructed? What kind of business risks might that create for me, etc., etc., because every business in some ways is a software business today, no matter what industry you may be in. So that's percolating more and more to the top. The second one, which you are in the middle of, is the whole notion of identity. Again, going back to the interconnectedness of it, we rely on third parties, we rely on partners, we rely on providing them access to our assets and infrastructure. What policies do they have? What training do they have? What internal controls do they have? Those things directly affect your core business as well. So identity becomes an issue. Increasingly, third-party nation-state attacks, and we have seen some examples of those even recently as well, just in the last week. So how do we learn from one another? So I'm a strong believer that when someone is afflicted with a security issue, that should not be viewed as a competitive advantage for somebody who is not yet afflicted with that. And instead, we as a software community need to jump in, create this notion of community vigil, and support them. And so that is the third item that I would highlight. I can keep going on, but I'll keep to those three for now.
Those are fantastic, and I agree with you 100%. I think we're all, especially as the world has shifted over 20, 25, 30 years now from attacks coming from kind of what we used to call hackers, right? People that were just trying to break in to prove they could. They may not have even had an evil intent to hurt your company or steal your money. They were like, sometimes, frankly, smart kids wanting to prove they could outsmart others with their technical prowess. That clearly moved to the criminal element a number of years ago, and now we've seen everything obviously in the world of, you know, phishing and ransomware and all of these things. And as you said, you know, we're recording this, by the way, in late October, and big, big news in the last few weeks about another apparent nation-state attack that hit a very big security vendor. You know, the realm now of we as individual software players, and again, this is exactly what you stepped into to try to help with at SolarWinds, you know, when a smallish, midsize even business is trying to fight against a country, that's an unfair fight. And so there's a sense of we have to band together, share knowledge, share help between the commercial community, all of us in the vendor community, and our customers who are often quite smart and understanding what's happening, and our government, right? Like you say, it's a sense of we all have to share our knowledge and advance our state of understanding more rapidly than the bad actors, right? And boy, that's a particular challenge in the rapidly unfolding world of AI, where we think everybody's got a new set of tools at their disposal, and we want to leverage those tools as rapidly as the next guy to make sure we're taking advantage of those ways in which that technology can help us fight against the bad actors while advantaging our business.
Yeah, in some ways these worlds, I was going to ask a question about complexity, and honestly, I think it sort of dovetails in with this whole concept and again this rapid evolution of AI and large language models that we're seeing all around us. When you think about kind of everything that you see happening in this increasing complexity, like you said, almost indecipherable tech stacks now, what all is inside that bill of materials, we don't always know that, as you said. And of course, all of our legal friends are worried that AI may be creating new parts of our code that we don't know exactly the source of that and how it got into our code, and there's all kinds of worries there as we try to be productive. And then you think about AI itself, when you think about kind of all simply call it the pros and cons of what that's doing to our industry, the upside, the potential that we see with AI, how you're thinking about it at SolarWinds, and then also the negatives and the concerns and the risks. You know, what are some of the conversations you feel like you're having that are really interesting about that in the world today?
I mean, like with anything, Mark, it is the responsibility. So I like to think of it as responsible AI. I mean, just like if you take a rudimentary example of coding, many of us who have coded for many years, one of the first things they teach us is how to do defensive coding. So it's again, responsible coding is the way I would describe it at that point. Now, if you take that and multiply that by a thousand-fold complexity and sophistication, you get into the world of responsible AI. I'm a net believer in it in terms of its ability to improve velocity, drive productivity, lower costs, and in general, like many key technology trends, be productive for humankind and humanity, so to speak, right? Equally, like with any good thing, there are dangers that are on the flip side. So if you use any tool like that without proper training, without proper context, you tend to misuse it, and I think the propensity and the opportunity, let's call it, to misuse is great. So the notion of ethical AI and governance of AI, I think, is a very important thing to me. Governance doesn't mean that, again, similar to what I said about security, should be about access, not about control. Governance should be about principles and rules and a way of working versus a way to impede progress.
Right. And as you just mentioned, we have those, call it, debates even internally about how much should we let loose, what should we do, etc., etc., and having that healthy, not so much friction, but tension of pull and push is important because together it'll build more empathy and better governance. But as it relates to us at SolarWinds, almost every function leverages AI in some way or another, and our products, we've been investing in AI-related solutions since about 2021. In fact, just on October 6th, on this day which we call SolarWinds Day, which is a Wednesday, we announced our upcoming AI products as well.
Yep. Now, I think, like you said, we've all seen a lot of technology over the years that is ethically or morally neutral. One could argue it can be used for good intent and bad intent. That's true of the internet. It's true of mobile computing. It's true of so many things, right? There are wonderfully great things for culture, society, business that have come out of these technologies. And as we all know, some dark side, some things that we wish weren't out in the universe, but they are. And that's part of what gives those of us in security part of that purpose you talked about earlier is to say, I'm going to help try to protect and defend enterprises who are trying to do good things so they're not distracted or hurt by those that are trying to do those other things. You know, when you think about, I know you've used that phrase in your business, secure by design, kind of talking about how do you not only have ethical AI, but secure AI, and that's, and these again gets beyond AI to just generally how do we build and leverage technology, right? Ethical and secure and safe for our users. We want to advance what we're doing for them, right? We want to create more capability and functionality that our customers can use while we don't certainly introduce more risk, but in fact ideally reduce the risk and make them safer and better. You know, when you think about how you guide your teams around some of those concepts, like, and you used a word I love to talk about, which is instead of problems, which can sometimes be solved, there are just tensions that we have to manage. This is a classic in that realm, right? Like it's not like you're going to be either secure or productive, you are going to have to be both. Yeah. Um, how do you think about, as you're such an experienced leader in technology, how do you think about guiding your teams as they're wrestling with some of those tensions today?
Yep. Specific to AI, Mark, or in general?
Probably we could say in general, but I think you and I both, our brains would go to the challenges we're seeing in front of us with AI today, right?
Yeah. In fact, we had, I would say, a spirited conversation on that even today.
And one thing I... Spirited is such a great word. I know what that might actually mean. One thing I'll say, and I'll come back to this topic in just one second, is another rampant thing that's happening is a proliferation of AI tools that are purportedly specialists in particular functions. So marketing will have a hundred of those, sales will have two hundred of those, etc. And so if you don't have the proper governance, we will then become very, how do I say it, very myopic with our interests, and we actually be inadvertently doing things that are at cross purposes to the overall goals of the enterprise. So what we have done is, again in the spirit of governance, under the leadership of our CTO, Sai, we have organized a cross-functional team that brings to bear any issues that might be either questions, issues, opportunities, ideas forward, and we try to do what's consistent with our organization's principles, of course, with the notion of speed, velocity, and at the same time security and other things.
But we've also allowed for, I would say, experimentation and ideation at an individual level and or at a team level. So the way the AI initiatives in the company started, where the product team started doing certain things, let's call it writing code with copilots and such, the support and customer success teams started doing things like even basically organizing knowledge bases and so on and so forth. The marketing teams did things with honing demand gen activities, etc., and also writing collateral, at least the first cut of collateral. And in our case, our legal team is also a big believer in AI and has been using it internally as well. So while the legal team usually is considered the policing function, in our case it's both helping us police ourselves or govern ourselves as well as a user of it, right? But instead of then saying, okay, the experimentation phase is done, now we need to start organizing things and be more streamlined. So the approach we have taken is for the benefit of every Salarian, there is a centralized tool that we use, which is much more internally focused, so internal information, which is firewalled so it doesn't go its way into some public LLM, and that's kind of our way of improving productivity with the responsible AI across the enterprise. So that's step one. So think of it as that initiative is funded by the corporation.
Above and beyond that, we recognize that there are specializations required, be it in marketing, sales, support, etc. There, the individual organizations or teams, I would say, have the ability and the freedom, and of course the spend, to do what they need to do, but they will do it under the auspices of this broader AI board that we have within the organization. I would say, touchwood, thus far, that seems to be working, where I get the right balance of healthy debate at the same time discipline and rigor in adopting the tools.
Yeah. No, it really is this sense of back to risk, right? We're ultimately in the business of managing risk in some ways with what we do in the industry. And there's a risk to being reckless about how fast you move in this realm. And there's clearly a risk to being too slow or too conservative. And I think that's the risk we're all trying to validate or manage, which is I don't want to rush headlong into this and, like you say, either ethical or just unwise, get myself in trouble with some of these amazingly powerful tools. You know, the old phrase kids with guns comes to mind here. Like this is some powerful stuff. You got to be careful who you let use it and what you let them do with it. But you realize there's risk to not letting it kind of get widely disseminated in your organization. Encourage people to bring their creativity and their innovation. Say, how can this make your work better, our company better, the thing you're doing for the business better? It is an incredible tension to manage today of the speed that I told someone the other day, Sudhakar, like I've never in my career felt quite the same sense of the foot is on the brake and the gas at the same time. People are trying to go fast and they're pressing on the brake at the same time because they see the risk and concern. Another friend said to me just literally today in a conversation, I'm not sure anybody has got this right, but my sense is we're underestimating...
How fast this is going to happen and what's going to change in the short run. And we're—I'm sorry—we're overestimating what's going to happen in the short run and we're underestimating how dramatic this will be, say, 10 years from now. Like, there was a sense it was all going to change the world in 24 months. Those of us who've been around a while went, yeah, probably not that fast.
Yeah. Yeah, my favorite on this has been—I mean, a lot of people compare the AI thing to different things, industrial revolutions, but the thing that I've heard that struck with me was the AI revolution is as significant as humans identifying fire for the first time. So if you think about what all happened in the world, a lot of things came out of that.
Right. Exactly. Yeah, fire and/or the wheel, I've been told, may have been the two most significant things that ever happened to humanity. But, all right. Well, this is—yeah, and like I say, we'll continue to monitor and all that. Let me shift gears a little because part of the fun on these podcasts is to talk about what's happening in the industry and technology and all that, but I also love bringing on folks like you who are seasoned, significant leaders. Been around the game a bit and seen some things. You've worked across a wide array of early-stage businesses, very large-scale businesses—you know, Citrix, Motorola, SolarWinds for a number of years. You know, you've obviously developed some leadership core beliefs, philosophies, whatever you want to call that. When you think about some of the core things that help you as a leader kind of guide your day-to-day leadership of the business, what are the things that make it click for you?
Just from a day-to-day standpoint, Mark, and I think I can relate to you because I've seen you in action as well. I'll describe it as: let's run very serious businesses because our work matters, but let's not take ourselves too seriously. And that's stuck with me for a very long time and I try to live by that. And it gives you a sense of grounding, it gives you a sense of balance, it keeps you humble, and it also keeps you curious all the time. At least those are the things that I have found within myself. And so that is something that I hold very near and dear as a principle. It also makes you a lot more accessible, which then means that you can learn things much faster, no matter where an issue or a topic might arise in the organization, and then hopefully it gives you better organizational agility. So that is a very key element of what I believe in as a core principle of mine.
Yeah. I love how those are highly interrelated concepts of, you know, being humble enough to learn and stay curious while not taking lightly the importance of the work you're doing and the importance of holding teams accountable and say we have to make progress and get things done. And I like to say, but there's no reason we can't have fun while we're doing it.
No, right? And so I think sometimes we take ourselves a little too seriously and we think about it as it being about us. It is not. And the sooner we realize that, the better. And so I try to keep practicing that.
