Hi, I'm Mark Mlan, CEO and founder at Sailpoint and welcome to our Identity Matters podcast where I have the opportunity to talk with security experts, business leaders and really smart people who are humble, hungry and ready to tell us about their leadership journey. So I'm really pleased today to be joined by Sudhakar Ramakrishna. I've known Sudhakar for quite some time and he is the CEO of SolarWinds, a very familiar name in the security industry and a fellow Austin-based leader. So Sudhakar, so glad you could join us. Welcome to the podcast.
Thank you, Mark. Thanks for having me.
Well, listen, you and I have known each other for a bit, but go ahead and let's give folks a little bit of backdrop on kind of your journey to this point. You've been leading SolarWinds for a number of years now. It's been on an interesting journey, like Sailpoint, in and out of the public markets a little bit, and early on, kind of an early leader in some of the IT management, but more and more kind of part of the global cyber security story. So if you were just going to kind of help folks get a current snapshot of where you are, how would you summarize where SolarWinds is today and kind of your mission in the industry today?
Absolutely. Mark, I've now been at SolarWinds almost five years. SolarWinds, as you mentioned, has had a very, call it storied history over the years of serving customers. Our initial foray was in the broader space of monitoring software. So we became leaders in monitoring networks, systems, databases and applications. Over the last five years, due to customer preferences, market changes, the whole notion of hybrid, and of course, the security landscape, we've evolved from being a company focused on monitoring to now delivering what I call operational resilience to customers. And there are many connotations of it. But if you think about what does operational resilience mean to us and to our customers, it is, think of it as on a common platform delivering the ability to automate, observe, visualize and remediate customer environments. And these customer environments could be spread across multiple clouds, hybrid environments, can have networks, systems, databases, applications, etc., which leverage the rich history of SolarWinds but then translate it into today's world where, as you know, things like alert fatigue, things like productivity challenges, AI security are all hitting customers from different angles. So in that world, how do you keep them productive, how do you keep them running, and how do you keep them operationally resilient is what we do.
Well, and obviously, Sudhakar, that ties near and dear to our hearts. Obviously, in the world today, when you're doing IT operations, almost inevitably that has to at least incorporate, if not highly integrate, with the security landscape because every IT operation in the world now is under some level of attack, typically by the outside and occasionally, as we all know, from the inside. You know, when you think about how much shifting and evolution there's been in the landscape around security, and you've had a familiarity with point, you know, when you think about the realm of security and within that even the realms of identity and trust, what are some of the key things you see happening in the market today that you think are really interesting?
I mean, from a market standpoint, I won't be telling you anything, Mark, that you don't already know. Concepts like zero trust, concepts like least privilege access, etc., are around, have been around and will continue as we move forward. But the way I think about security at large for all of us as security practitioners is how do we reduce the threat surface as quickly as we possibly can and how do we reduce the threat window as quickly as we can. So I know it's easier said than done, but the more we try to do things, that results in challenges around identity, that results in challenges around infrastructure security, application security, etc., etc. That is the way we can continue to improve. And the reason why I say continue to improve is the nature of security and the nature of security threats is such that no single company has all of the answers all the time. Many of us have really good answers most of the time, but not all of us have answers all of the time. And so we talk about depth in defense, and so it's not a single thing. There are many aspects to security that need to be addressed. One of my favorites, I would say, is that ultimately, as providers of software to enterprises, our goal is to help them become more productive, more efficient, etc. And yet, if you think about the notion of a firewall or the image of a firewall is that of a brick wall, right? And it has sustained for a long time. And so my thought around security always is security should be about access, not about control. So in other words, we can clamp every possible control we want and make it difficult for people to break through, but they may also result in lost productivity when you do that. If you make things tougher for your employees, they're going to be less productive, for instance. So how do we address the challenge of making security embedded, pervasive and accessible and not about control? I think therein lies a significant opportunity for innovation.
Well said. Yeah. And I think we all know, like you said, there's such resistance, especially in times of high innovation like we're living through right now around AI and agentic and LLMs and all that, that the business wants to move quickly to take advantage of new opportunities for efficiency, effectiveness, competitiveness, all those wonderful things we learned in business school. And at the same time, everybody's highly attuned to the risks that can come with new technology. And like you said, there's a sense of the right people getting access to the right things to do what they need to do for the business while ensuring that either the wrong people don't get access or the right people don't get access to things they're not supposed to, which could also lead to challenges. And it's like you said, it's ideally invisible control is another concept, right? It's really access appropriately, which is sort of invisible control. I want you to be able to act like you can go anywhere you want.
When in fact, you can't go anywhere you're not supposed to go.
Exactly. Exactly right. Exactly right.
That's sort of an ideal world, right?
Yes. And let me, you know, you're a great leader, Sudhakar. One quick thing on the background of you and I as leaders. I thought it'd be a fun thing. You know, we're in the realm of identity, and of course identity security is about the identities in the enterprise that we're protecting. But we also think, you know, as companies, our companies sort of have an identity or a persona or at least a reputation, right? And you know, you've built a great company. Matter of fact, for those that don't know, Sudhakar inherited SolarWinds right after the difficulties came about from what happened to their business from an outside attacker. You know, you talked about building, in your case, sort of rebuilding, not from a company you had before, but rebuilding the trustworthiness and integrity of a company. I think you've done a marvelous job with that both inside the company and out. How do you think about what it means for a company's identity to be a trustworthy, good partner in the market?
That's a great question, Mark. And you have done that, I would say, at Sailpoint as well, to return the kudos and the compliments, and you've continued doing that. When I think about it, the way I reflect on it is first and foremost, do we have a purpose that matches to what customers might look for in a company? And that's the starting point as far as I'm concerned. And oftentimes it just becomes a set of words, but many times it is lived by you, by the company, by everyone representing the company. So to your point about identity, if we can truly translate our purpose into our actions, that would result in setting an identity that is worthy of living and being recognized. That's a starting point. Beyond that, I think it's a matter of can customers rely on you in good and bad times? That's an important element of it because we live in an interconnected world in more connotations than both of us can possibly describe on this call. And so in that world, how do we support one another is a very important element of what reflects in our identity. Next is, do you really care? I mean, many times I've had customer conversations where I would tell them, for instance, hey, the technology choice that you're making, and it may have nothing to do with my company's technology choice, the technology choice you're making is not appropriate for your environment. And that's a matter of when the customers trusted you to say such things because you truly care. And how do you get your entire company to be able to have those types of conversations with them? And then last but not least, do you as a company have the ability to learn and change? And are you humble enough to accept that you don't have all the answers, but you'll figure them out? So those are things that I think help customers believe us, build a dependable culture, and of course a company that can be identified as great.
Yeah. Boy, those are all wonderful tenets. And I think we certainly try to hold to some of those very same tenets at Sailpoint. Matter of fact, one of my favorite things is our chief customer officer, Meredith, likes to say to customers, 'I'm not really here to make you happy. I'm here to make you successful. And sometimes I might have to make you a little bit unhappy when I tell you I need to do this to get where you need to go.' I always joke that if you don't understand that, it's because you have never raised a teenager. If you raised a teenager, you understand at times I'm going to make you a little short-term unhappy to help you be a successful adult. And so there's some commonality there, I think, in what we do in companies. Like sometimes we have to do the hard things to do the right thing for the long run, particularly sometimes even in the short run as well.
Well, that's great backdrop. You know, obviously the identity space is very interconnected with both, like you say, business advantage these days and security. And we've been using this word digital transformation for a number of years now. I don't know that we all saw how much digital transformation might actually be looming once AI and agentic swept onto the scene in an amazing way in the last, whatever you want to call it, 12 to 24 months. You know, when you think about the customers, we share a lot of large and very large in some cases enterprise customers, and you talk to what risks are keeping those folks up at night in either their IT world, their security world, and sort of the intersection. You know, what do you hear as the kind of the risks and the concerns that people are really worried about today?
There are a number of risks, Mark, as you well know, but I'll highlight a few that seem to be surfacing more and more to the top. One is, I believe customers are getting a greater and heightened sense of interconnectedness that they have with direct and indirect vendors. So for instance, the amount of open-source code that might be running in your environment or in your enterprise, you may not have a good idea of it at all because you only know the vendors that you're working with. You don't quite know, call it the software bill of materials that people use to create things that you rely on. And so what might be the vulnerabilities in that? What are the security aspects of it? How were they constructed? What kind of business risks might that create for me, etc., etc.? Because every business in some ways is a software business today, no matter what industry you may be in. So that's percolating more and more to the top. The second one, which you are in the middle of, is the whole notion of identity. Again, going back to the interconnectedness of it, we rely on third parties, we rely on partners, we rely on providing them access to our assets and infrastructure. What policies do they have? What training do they have? What internal controls do they have? Those things directly affect your core business as well. So identity becomes an issue. Increasingly, third-party nation-state attacks, and we have seen some examples of those even recently, just in the last week. So how do we learn from one another? I'm a strong believer that when someone is afflicted with a security issue, that should not be viewed as a competitive advantage for somebody who is not yet afflicted with that. And instead, we as a software community need to jump in, create this notion of community vigil, and support them. And so that is the third item that I would highlight. I can keep going on, but I'll keep to those three for now.
Those are fantastic, and I agree with you 100%. I think we're all, especially as the world has shifted over 20, 25, 30 years now from attacks coming from kind of what we used to call hackers, right? People that were just trying to break in to prove they could. They may not have even had an evil intent to hurt your company or steal your money. They were, sometimes frankly, smart kids wanting to prove they could outsmart others with their technical prowess. That clearly moved to the criminal element a number of years ago, and now we've seen everything obviously in the world of phishing and ransomware and all of these things. And as you said, we're recording this by the way in late October, and big, big news in the last few weeks about another apparent nation-state attack that hit a very big security vendor. The realm now of we as individual software players, and again this is exactly what you stepped into to try to help with at SolarWinds, you know, when a smallish, midsize even business is trying to fight against a country, that's an unfair fight. And so there's a sense of we have to band together, share knowledge, share help between the commercial community, all of us in the vendor community and our customers who are often quite smart and understanding what's happening, and our government, right? Like you say, it's a sense of we all have to share our knowledge and advance our state of understanding more rapidly than the bad actors, right? And boy, that's a particular challenge in the rapidly unfolding world of AI where we think everybody's got a new set of tools at their disposal, and we want to leverage those tools as rapidly as the next guy to make sure we're taking advantage of those ways in which that technology can help us fight against the bad actors while advantaging our business. In some ways, this world, I was going to ask a question about complexity, and honestly I think it sort of dovetails with this whole concept and again this rapid evolution of AI and large language models that we're seeing all around us. When you think about everything that you see happening in this increasing complexity, like you said, almost indecipherable tech stacks now, what all is inside that bill of materials we don't always know that, as you said. And of course all of our legal friends are worried that AI may be creating new parts of our code that we don't know exactly the source of and how it got into our code, and there's all kinds of worries there as we try to be productive. And then you think about AI itself, when you think about, let's simply call it the pros and cons of what that's doing to our industry, the upside, the potential that we see with AI, how you're thinking about it at SolarWinds, and then also the negatives and the concerns and the risks. How, what are some of the conversations you feel like you're having that are really interesting about that in the world today?
I mean, like with anything, Mark, it is the responsibility. So I like to think of it as responsible AI. I mean, just like if you take a rudimentary example of coding, many of us who have coded for many years, one of the first things they teach us is how to do defensive coding. So it's responsible coding, is the way I would describe it at that point. Now, if you take that and multiply that by a thousand factor complexity and sophistication, you get into the world of responsible AI. I'm a net believer in it in terms of its ability to improve velocity, drive productivity, lower costs, and in general, like many key technology trends, be productive for humankind and humanity, so to speak, right? Equally, like with any good thing, there are dangers that are on the flip side. So if you use any tool without proper training, without proper context, you tend to misuse it, and I think the propensity and the opportunity, let's call it, to misuse is great. So the notion of ethical AI and governance of AI I think is a very important thing to me. Governance doesn't mean that, again similar to what I said about security should be about access, not about control. Governance should be about principles and rules and a way of working versus a way to impede progress. Right. And as you just mentioned, we have those, call it debates even internally, about how much should we let loose, what should we do, etc., etc. And having that healthy, not so much friction, but tension of pull and push is important because together it'll build more empathy and better governance. But as it relates to us at SolarWinds, almost every function leverages AI in some way or another, and our products, we've been investing in AI-related solutions since about 2021. In fact, just on October 6th, on this day which we call SolarWinds Day, which is a Wednesday, we announced our upcoming AI products as well.
Yep. Now, I think like you said, we've all seen a lot of technology over the years that is ethically or morally neutral. One could argue it can be used for good intent and bad intent. That's true of the internet. It's true of mobile computing. It's true of so many things, right? There are wonderfully great things for culture, society, business that have come out of these technologies. And as we all know, some dark side, some things that we wish weren't out in the universe, but they are. And that's part of what gives those of us in security part of that purpose you talked about earlier, to say I'm going to help try to protect and defend enterprises who are trying to do good things so they're not distracted or hurt by those that are trying to do those other things. You know, when you think about, I know you've used that phrase in your business, 'secure by design,' kind of talking about how do you not only have ethical AI, but secure AI, and that gets beyond AI to just generally how do we build and leverage technology, right? Ethical and secure and safe for our users. We want to advance what we're doing for them, right? We want to create more capability and functionality that our customers can use while we don't certainly introduce more risk, but in fact ideally reduce the risk and make them safer and better. You know, when you think about how you guide your teams around some of those concepts, and you used a word I love to talk about, which is instead of problems which can sometimes be solved, there are just tensions that we have to manage. This is a classic in that realm, right? Like it's not like you're going to be either secure or productive, you are going to have to be both. How do you think about, as you're such an experienced leader in technology, how do you think about guiding your teams as they're wrestling with some of those tensions today?
Specific to AI, Mark, or in general?
Probably we could say in general, but I think you and I both our brains would go to the challenges we're seeing in front of us with AI today, right?
Yeah. In fact, we had a, I would say, spirited conversation on that even today.
Spirited is such a great word. I know what that might actually mean.
One thing I'll say, and I'll come back to this topic in just one second, is another rampant thing that's happening is a proliferation of AI tools that are purportedly specialists in particular functions. So marketing will have a hundred of those, sales will have 200 of those, etc. And so if you don't have the proper governance, we will then become very, how do I say it, very myopic with our interests and we actually be inadvertently doing things that are at cross purposes to the overall goals of the enterprise. So what we have done is, again in the spirit of governance, under the leadership of our CTO, Sai, we have organized a cross-functional team that brings to bear any issues that might be either questions, issues, opportunities, ideas forward, and we try to do what's consistent with our organization's principles, of course with the notion of speed and alacrity and at the same time security and other things. But we've also allowed for experimentation and ideation at an individual level and or at a team level. So the way the AI initiatives in the company started, where the product team started doing certain things, let's call it writing code with co-pilots and such, the support and customer success teams started doing things like even basically organizing knowledge bases and so on and so forth, the marketing teams did things with honing demand gen activities, etc., and also writing collateral, at least the first cut of collateral. And in our case, our legal team is also a big believer in AI and has been using it internally as well. So while the legal team usually is considered the policing function, in our case it's both helping us police ourselves or govern ourselves as well as a user of it, right? But instead of then saying, 'Okay, the experimentation phase is done, now we need to start organizing things and be more streamlined,' the approach we have taken is for the benefit of every Solarian, there is a centralized tool that we use which is much more internally focused, so internal information which is firewalled so it doesn't go its way into some public LLM, and that's kind of our way of improving productivity with responsible AI across the enterprise. So that's step one. So think of it as that initiative is funded by the corporation. Above and beyond that, we recognize that there are specializations required, be it in marketing, sales, support, etc. There, the individual organizations or teams, I would say, have the ability and the freedom and of course the spend to do what they need to do, but they will do it under the auspices of this broader AI board that we have within the organization. I would say, touchwood, thus far that seems to be working where I get the right balance of healthy debate at the same time discipline and rigor in adopting the tools.
How fast this is going to happen and what's going to change in the short run. And we're, I'm sorry, we're overestimating what's going to happen in the short run and we're underestimating how dramatic this will be, say, 10 years from now. Like, there was a sense it was all going to change the world in 24 months. Those have been around a while, went, yeah, probably not that fast.
Yeah. Yeah, my favorite on this has been, I mean, a lot of people compare the AI thing to different things, industrial revolutions, but the thing that I've heard that struck with me was the AI revolution is as significant as humans identifying fire for the first time. So if you think about what all happened in the world, a lot of things came out of that.
Right. Exactly. Yeah, fire and the wheel I've been told may have been the two most significant things that ever happened to humanity.
But all right. Well, this is yeah, and like I say, we'll continue to monitor and all that. Let me shift gears a little because part of the fun on these podcasts is to talk about what's happening in the industry and technology and all that, but I also love bringing on folks like you who are seasoned, significant leaders. Been around the game a bit and seen some things. You've worked across a wide array of early stage businesses, very large scale businesses. You know, Citrix, Motorola, SolarWinds now for a number of years. You've obviously developed some leadership core beliefs, philosophies, whatever you want to call that. When you think about some of the core things that help you as a leader guide your day-to-day leadership of the business, what are the things that make it click for you?
Just from a day-to-day standpoint, Mark, and I think I can relate to you because I've seen you in action as well. I'll describe it as let's run very serious businesses because our work matters, but let's not take ourselves too seriously. And that's stuck with me for a very long time and I try to live by that. It gives you a sense of grounding, a sense of balance, keeps you humble, and also keeps you curious all the time. At least those are the things that I have found within myself. So that is something that I hold very near and dear as a principle. It also makes you a lot more accessible, which then means that you can learn things much faster no matter where an issue or a topic might arise in the organization, and then hopefully it gives you better organizational agility. So that is a very key element of what I believe in as a core principle of mine.
Yeah. I love how those are highly interrelated concepts of being humble enough to learn and stay curious while not taking lightly the importance of the work you're doing and the importance of holding teams accountable and saying we have to make progress and get things done. And I like to say, but there's no reason we can't have fun while we're doing it.
