Box’s Global CIO on Tackling Saas Sprawl & Empowering IT Leaders | The New Automation Mindset Ep. 37

Today, business is technology, and technology is business. CIOs have evolved to being business leaders that have a technology focus. The great thing about the CIO role is that it is one of the few roles in the c suite that you are required to understand all aspects of the business. You have to know and understand marketing. You need to understand finance. You need to understand operations. You need to understand customer service because technology is threaded and embedded through all of those parts of the business. If I were starting a company tomorrow, in the first 90 days, I would hire an enterprise architect and I'd hire a data architect, because I think a lot of the issues that are encountered later in the maturity cycle, particularly for technology companies, a little foresight upfront, setting the foundation around the data architecture, setting the foundation for the application architecture, I think would provide tremendous scalability and tremendous efficiency later on. The human change is always the most difficult for technology. Changing the way people work is the hardest thing to do, but at least you could maybe simplify it by easing the challenge on the technology side by having that foundation.

Well, first off, Markus, thank you for having me on the podcast. I appreciate it, getting to spend this time with you. Certainly, it was a bit of a shift, but not too much of a shift because I did spend about 10 years in software and smaller startup companies, financial services and software. So it was almost a bit of a return to the space if you will. But there were a number of things that were certainly interesting about the role and what the opportunity presented. There are two facets to my role, so I have an internal and an external. So internally, I do the things that CIOs do and focus on running IT, security, operations, keeping things reliable, up and running, investing in new systems, doing limitations, enhancements, et cetera. And then I have a significant external part to my role. So I spend a lot of time with customers. I spend a lot of time with our sales teams, marketing, go to market strategy, product strategy, and giving the CIO perspective. And part of my internal role really was to architect the technology environment which can enable growth by operating at high velocity, driving scalability to meet the business needs, not just currently, but really the needs of the future as well. I was a customer for a long time at my previous company. It's an area and a space that I think is really still in its nascency in terms of value and understanding and importance to the enterprise. So all of those things, and then you combine a phenomenal culture at Box, and just two really impressive founders and leaders with Aaron Levie and Dylan Smith, and it was kind of a no brainer.

Yeah, there was that movement several years ago. And the common joke is CIO stands for career is over. But I think it is more like career is on the upside. It is, the role has evolved. Like many other roles in the c suite, the role has evolved. And where it started in infrastructure and providing back office automation and really kind of just run the business kind of aspects, it has evolved into something that's much more integral. I think today business is technology and technology is business. CIOs have evolved to being business leaders that have a technology focus. The great thing about the CIO role is that it is one of the few roles in the c suite that you are required to understand all aspects of the business. You have to know and understand marketing. You need to understand finance. You need to understand operations. You need to understand customer service, because technology is threaded and embedded through all of those parts of the business. And really it's getting to be more and more where it doesn't matter what business you are in, you have to have some level of technology understanding and some aspect of technology within your business. So the title thing, at the end of the day, I think it's really about what are the business outcomes that are being generated? What are the problems being solved? That's gonna define the impact of the role. And whether it's CIO or CDO, Chief Digital Officer or Chief Transformation Officer, I think there's always gonna be the technology focus, and it's really how do you make sure that technology is driving, supporting, enabling the business strategy, and the goals of the business? I think that's really what it comes down to is making sure that it's being invested in a way that provides a return for the business. Just as you would invest in marketing campaigns, as you would invest in new factories or anything of that nature, I think you have to take the same approach.

Yeah. And I think as I mentioned earlier, the evolution of technology and how important it has become to businesses, it's not just the backbone, or the skeletal structure, it's the nervous system, it's the heart, it's the brain. It has become critically important to how businesses operate that other areas and other leaders have realized, hey, I need to understand this. And I think for a while there, the old IT view was everything takes 12 months and costs a couple of million dollars. And unfortunately, we probably didn't evolve as quickly. The recognition of the opportunity may have come a little bit later, but I think it's definitely changed. It's definitely shifted. And I think there are a couple different viewpoints that you take on this. There is the hard line centralized, everything has to run through IT. I think that is a recipe for limited success. I think it's a recipe for other parts of the business taking ownership. I think if you view it as an opportunity to educate, an opportunity to tap into capacity, an opportunity to bring people into the fold, to change the mindset and say, I'm the consultant. We've been the experts here. We understand how to manage and operate technology. We understand how to deploy it effectively. Which those are skill sets that are still absolutely necessary. You can't... How many times have you seen where something gets deployed in the business and IT doesn't have awareness of it, and then all of a sudden there are issues and there are problems, because you need professionals that understand how to operate and maintain those things long term. I've always been the view of, let's use judo to kind of redirect that energy. Redirect it in a positive way, and not fight it. At the end of the day, if we're all aligned to the same outcomes, to the same goals, how we achieve that should be together. It shouldn't be, oh, that's in your area, or that's in my area. You see time and time again, teams that are aligned, businesses that are aligned and are in sync execute so much better and are so much more successful. I don't think it should be any different for technology. If you're getting alignment on how customer operations should run, and you want everybody in the company out of a customer focus, or you want everybody to be conscious financially and be fiscally responsible when they manage, same thing with technology. I want everybody to have an understanding of how technology enables their part of the business, how we can help support that, how we can help them innovate, how we can help rethink, not just for the short term, but also for the long term. That requires getting out and talking to people. That requires building those relationships. It requires understanding, what do you want to achieve and how does technology fit into the picture? How is it essential to your business? Alignment is absolutely critical. And I think that's not just for CIOs, but that's for any executive.

So first off, I love SaaS. When SaaS came along, it was the next evolution. And what it provided was an ability to deliver with speed. It provided velocity. Time to value was short with SaaS, but as you mentioned, because it was so easy, and because it's proliferated so much, you have an application to solve every niche problem that arises now. And so the conversation, and kudos to our industry for shifting the conversation to, hey, I've got an application I can go buy to solve this problem, versus, hey, what is the problem I'm trying to solve? Let me understand the problem and then let me figure out how technology is gonna help me resolve that or solve that. It is an issue and I'd love to say that Box was immune to it, but we weren't. I think particularly for technology companies that have gone from startup to a mature company, you look at how the evolution there, and typically applications are bought by a business owner. It's bought by somebody in finance. It's bought by somebody in marketing or in customer operations or in sales. It isn't until you get critical mass and somebody looks at the price tag and says, well, we're spending a lot of money in this space. And like, I'm just looking at our project management tools and we've got four or five of those things that are basically doing the same thing. And so it is definitely an issue and talking to other CIOs, it's on everybody's mind. I don't think there's a CIO I haven't spoken to that has talked about consolidation and simplification, because all of that comes with cost. It comes with administrative costs. It comes with licensing costs. It comes with labor costs. When you think about how do I scale an organization, how do I scale a company? Simplicity is essential to scalability. And having complexity and agility in the right places. And when you have application sprawl, it creates inefficiency. It creates inefficiency not just in the technology side, but in the business side too, because you're trying to stitch these things together. And your plumbing becomes complex and your data movement between applications becomes complex and that adds additional cost. And so these are things that people, not just technology companies, but many companies are struggling with. How do you manage it? How do you put the right governance in? How do you architect it? I think SaaS will continue to be popular because it does give you the ability to quickly stand something up to implement in a way that you can iterate off of to where you can avoid what everybody wants to avoid, which is the big hairy IT project that goes on for years and costs millions of dollars. I think the challenge that you see is that a lot of times, the longer term view from a roadmap or an architecture view wasn't applied. And now you've got these issues where you have application sprawl. You don't have the right governance and you're trying to simplify. You're trying to consolidate both from operational efficiency standpoint and a cost standpoint.

So one of the things that we started with was starting with the data. Catalog of the applications, capabilities, functionality and cost, ownership, and start to look at, okay, where do we have overlap? Where's the low hanging fruit that we can very easily turn things off, not renew, decommission, et cetera? And then where are the things that maybe are a medium level of effort that'll require maybe moving some data, implementing some functionality in another app so you can retire? And then there's the bigger lift items, like you're gonna consolidate major functionality or core applications into a single platform or maybe two platforms, three platforms. But I think you always have to start with the data. You have to be able to present to the stakeholders. You have to use that to be able to craft a story as to why you think that there's value and benefit in going on this journey. You have to find where the purse strings are. Ideally that budget gets centralized and becomes centrally managed. I'm a big believer, having a finance background in my career, that everything flows from the dollars. And being able to put governance around that and control or guide, really, that spend is critically important. And it's not just the budgets. There are other things, where can people maybe put software on a credit card or a corporate card? So you really have to look at all aspects of how the money is flowing into these different platforms. And then you have to go through the exercise of mapping this stuff out. You have to look at the business capabilities. What are the business capabilities that we need? What are the business processes? What are the apps that support that? That very quickly you start to identify overlap in capabilities and that helps influence your roadmap and the journey that you're gonna go on and at least facilitates the discussion of where do we have opportunity to simplify and consolidate? You talked about roles. I think if I were doing a startup tomorrow, if I were starting a company tomorrow, I think one of the first roles in the first 90 days, maybe certainly 180 days, I would hire an enterprise architect and I'd hire a data architect. Because I think a lot of the issues that are encountered later in the maturity cycle for companies, particularly for technology companies, a little foresight upfront, setting the foundation around the data architecture, setting the foundation for the application architecture I think would provide tremendous scalability and tremendous efficiency later on. If I need to move out of managing this part of the business in spreadsheets, I need an application. Well, I already know how I'm gonna plug that into the ecosystem. I know if I need to integrate or pull data I already understand how that's gonna happen. And then it doesn't become a silo. It really becomes an engine to the data and the processes that are already supporting the business.

Oh yeah. I mean, that is a very common story. You just described what I covered, how companies get started, startups, and how they evolve, where the applications live in these silos. And I think it's hard, right? It's hard when you're trying to survive the next day, the next month, the next year, when they're in the early stages of uncertainty and you are really focused on the survival of the business. But I don't think, at the same time I would counter with, let's be glass half full and assume that we are gonna make it and we are gonna have a quote to cash process and we're gonna have a source to pay and we're gonna have closing the books. And I don't think it takes a lot of effort or energy and it doesn't need to be a whole army of people. One person can be tasked and maybe with additional responsibilities for at least thinking about that, how are these things going to ultimately be stitched together and how do we need to be thinking about that for the future? Because the challenge of coming in later is not only the technical challenge is harder, because now you have applications that have lots of data, they have processes that are embedded within and you have probably lots of human middleware that is doing the integration in some shape or form, but you also have to change... You have the challenge of changing the way people operate, and the human change is always the most difficult for technology. Changing the way people work is the hardest thing to do, but at least you could maybe simplify it by easing the challenge on the technology side by having that foundation. And maybe you don't have to look two, three years in advance but maybe you start looking 12 months in advance and our projected growth is this. This is what we think it's gonna look like. Here's what we believe we're gonna need. And, again, start thinking about the building blocks for that so that it's not reactive, there's some proactive effort to the technology aspect of the business and then you don't have to worry about it. Then it doesn't become a bigger project. It doesn't become a bigger effort. And in some cases you're not taking stuff away from people or you're not giving them sense that you're taking something away or forcing them to do something different.

No, it does. And this gets back to, you can probably find an app to solve every little discrete problem that you have as a business, but I think you have to take a step back. You have to gain some altitude and really look at what is the capability that you need, how much of that do you need? And to your point, do I have the Lego blocks that I can combine together to get this solution? You start to break down, ok, what is contract lifecycle management? It's content, contracts. It's e-signature. There's probably some intelligence, some categorization, some metadata associated with that. Box is the intelligent content management platform, does all of that. And then there's workflow, sometimes simple, sometimes advanced, sometimes complex. Maybe occasionally you need to pull things in from another application. Workato is a really great solution for doing that and doing it in a reliable and stable way. So hey, can I get 90% of the way there? Probably. And that's an operating principle for us. And something that we've worked very hard to ingrain with our business stakeholders and our partners is, let's look internally first. What do we have in the portfolio? Can it get us 80%, 90% of the way there? Because the reality is, if you've got 20 requirements, of course the business stakeholder or whoever the sponsor is, they want all 20. But when you start to attach value to every single piece and you start asking the question like, what is this doing for the business? You inevitably get to, hey, there's probably two or three things that don't really matter. And so we could go spend a couple hundred thousand dollars or more on a new application which we then have to integrate, we have to manage, we have to get the skillsets or we can get you 90% of what you need by stitching together and combining the blocks that we have. And again, it gets back to making sure you understand the environment, making sure you understand the architecture and the capabilities of each application. What are your core applications? What are they designed for? Because ideally I'm putting as much functionality and capability in our core applications. The things that I know, they're not gonna change. They're there for the long term. I need them to be stable. I need them to be reliable. I need them to be enterprise grade at the next level. Maybe it's kind of core minus one things that maybe need a little bit more flexibility but are still probably fairly critical. And then there's that last part where you need the agility and maybe you want to be able to swap things out because you want best of breed or you want the latest and greatest because it is directly impacting your pipeline. It gives you ability to drive more revenue. It gives you ability to very quickly take out cost, but that should be a small part of the environment. And that's where, when I talk to other CIOs and we talk about this, I say, look, I want that core part to include as much as possible because if that's fairly immutable then we understand we're gonna put that core functionality into this area. But for things that we want to be agile, there is a component, a market dynamic or a market component or an innovation component that's gonna give us a competitive advantage. Yeah, let's go do that. But our competitive advantage is in our financials, how we do the books, our competitive advantage is how we get our message out, how we get and educate more people on Box and intelligent content management and what that means and how it's important to their business. So those are the things that are really what... I want that agility because that's the area that changes a lot.

I would say it varies. It varies. I think I do talk to CIOs who take that approach and have that viewpoint who understand that even in the custom side, pre built components and being able to standardize your foundational components even if you're building from scratch is incredibly important. I mean, that's kind of software building 101. What I find that is most common is getting to... Understanding what is the value of that? What is my core business? Is something core to my business such that I should have a software team, I should develop it custom? And I encountered this in the energy industry where we were largely off the shelf software that we configured and customized to our needs but there were areas that we looked at and said, look, it is trying to stitch together what is available isn't going to get us what we need. It is a competitive advantage such that we do want to build it and manage it and potentially it's a revenue generating opportunity for us. It's a massive differentiator. And so you get back to the value aspect of it and looking at it from a portfolio perspective how I'm going to invest in this. Am I gonna buy it or am I gonna build it? And that gets back, there are three things that are gonna dictate my approach and how I think about the environment on a day to day basis. And that is, how am I maximizing value? How am I making sure that every dollar we spend is 1.5X or 2X or 5X, that we are getting the most out of our money that we're spending? How am I mitigating risk? Am I taking the right risk? And two dimensions to risk, are we taking the right risk and innovating where we need to, but are we mitigating the cyber threats and all the other risks of stability and reliability risks? And then the third thing is managing cost. And I think you take those three dimensions and you apply that to those decision points, and you come out with, okay, maybe I need to build this. Maybe it is such a differentiator. I think where you see this kind of gone awry is where you get this kind of over extension into the build mentality is, oh, well, that CRM, we're gonna have to customize it, so you know what, we're just gonna build our own CRM or we're gonna build our own building platform. I think that's where you really have to ask why, why would you do that? There are plenty of companies that do that. It's not core to your business, but hey, building maybe the digital experience for your customer, or building the mobile experience for your customer, the web, something unique and plugging that back into package. Yeah, that's... Okay, maybe that's how, you know, you differentiate. Maybe that is a competitive difference.

Interesting. So I have a viewpoint and then there's what I glean from conversations, but my viewpoint is very bullish on it. I think it is, AI, particularly Generative AI, does have a long term potential to really change the way that we do work and how work gets done. I think it has an immense positive outlook. The positive outlook is very strong in terms of its ability to scale, and this is, mentioning earlier, I'm very focused on scalability, I think that opportunity is pretty sizable there. I think we've got some time that it's gonna take to get there. The conversations that I have, and this is, I would share this viewpoint, is where is the enterprise value? How am I generating competitive difference? Almost universally, CIOs and leaders that I talk to have come to the opinion of, hey, the ChatGPT and the CoPilot and that stuff for the digital assistant, personal assistant, it's cool, it's interesting, and I get some productivity uplift, but what's next? What is gonna drive much larger value, much more quantitative value? I think we've seen the areas where, in code development we certainly have seen value there in some of the customer or user interactions and resolving issues, one click resolution, self service. We've certainly seen an uplift there, and I think that's where most people are looking. There are some other pockets of areas, maybe in marketing, writing copy, campaigns, those kinds of things. They have value, but I think people are looking for how do I really change my business? That's changing pockets. It's maybe turning the dial a little bit, but like, how do I really scale up? How do I get to this point of driving transformative change? And I think when you talk about AI agents and the workforce, and what does that future look like? Maybe that is something that is possible in the next few years. If I need to execute on a marketing campaign and I want to do outbound email and calls and messaging and targeted messaging, maybe I have the ability to spin up an AI agent workforce that goes and does that and handles that. When you think about some of the manual intervention points in processes, maybe there's an AI agent that can handle that, and you are starting to see some of that where we obviously see the future, because unstructured data and content is a fuel for Generative AI. And that's where the value's gonna be generated, is managing that, articulating, hey, here's the value, having an architecture that's flexible, that allows you to expose AI capabilities into your existing technology stack and leverage the model ecosystem. I think that's incredibly important. And to get back to some of the earlier points I made around architecture and having that flexibility and understanding how that's gonna work, the challenge a lot of us have are, everybody is coming out with their AI flavor, everybody's got an AI component, typically it's focused on that area, whatever that application is focused on, whether it's sales or marketing or HR or customer service. I want something that is gonna drive value across all areas. I want an architecture and this is where Box AI comes into play. I want architecture where I can leverage my existing investments. I have the governance and I have the level of control and understanding, and flexibility around security. The security of my data. I know that it's secure externally, it's not being used to train models that can be used by my competitors. I know that internally the access management controls are being respected. And people have access to what they should have access. They don't all of a sudden have access to data that they wouldn't have. Those things are super important to most CIOs. And so you see in this area, a lot of companies are building their own platforms. Because I think that there's still the viewpoint on risk associated with using somebody else or having multiple versions or flavors in your environment is still pretty bearish right now. And so where we feel like we can make a difference is being able to provide our customers that solution that gives them the ability to safely experiment with AI, that gives them the scalability to expose through APIs into their existing technology stack, to be able to leverage the best of breed of LLMs. I personally think that kind of flexibility in your architecture is essential because this is a market that's changing. It's moving and you're gonna see consolidation, companies that were built on ChatGPT 3, 3.5, the next version comes out and they're gone. They're irrelevant. So I look for a solution that's gonna give me a hedge to how fast it's moving to the consolidations that's gonna occur, but I can still continue to grow with.

Thank you. Thank you for having me. I appreciate it.