This is Resilience Universe, a podcast about leadership, resilience, and transformation at the intersection of AI and data security, hosted by Cohesity CEO and President Sanjay Poonen.
Hello everyone. Welcome to my next podcast. I'm here with my really good friend Thomas Kurian. Thomas, good to see you.
I've known Thomas for many decades. A short story: he and I grew up in the same town in Bangalore. Our families know each other. He went to the rival school. We actually competed with each other at SAP and Oracle. And then when I left and joined VMware, I was so happy to be finally his partner and friend first at VMware and at Google. We did some good things together. But here I'm really excited because I want to talk about not just what Cohesity and Google are doing together, but I want to talk about three topics during the course of this podcast. One is Google's vision for AI. That's really at the forefront of all of your minds. Security, now that they've acquired Wiz, that's a big part of the story, too. And third, his lessons of leadership. So maybe we could start with you took over now how many years ago? That's seven years. He's now CEO of Google Cloud and I think it was single-digit billions and now it's like 80 billion run rate. So incredible job. It's growing really fast. But I came back from your Google Cloud conference and it was all about AI. Where you could start then and give the listeners a little bit of what were some of those key themes that you're hearing that they should also hear about at the forefront of AI.
You know, we talked about two just really important things. One is AI has moved as the skills of models have evolved. AI has moved from primarily being used as a more expressive knowledge finding tool and knowledge management system, which was the first version if you think about chat. It then moved into content generation like you could create content with it. And now the big thing that we see a lot of people wanting and using our AI for is to build agents and agents whether they're to write code and help them assist writing code or to build agents to automate various tasks and processes within the organization. So we announced a new platform, Gemini Enterprise Agent Platform, that gives you all the capabilities to build and deploy and operate agents.
The second thing was in order to do AI well we've always felt you needed a stack and so we built a vertical stack. It's open at every layer but we're engineering a number of the pieces. So at the foundational level we have our own accelerators, TPUs. We've built our own models. We also offer a choice of Anthropic and other models but we do provide a suite of models, Gemini, in order to have agents do their work. Well, you also need to have them reason on information within the company. We call that context. And so we offer a new platform to build using a knowledge catalog rich context to help models reason well. Obviously with all the information happening on security threats from AI, we had a new security platform to protect companies' systems using AI and then finally bring it into day-to-day workflow whether this in our collaboration tools, customer service. So it's a whole stack as well. So our big two themes were around the evolution of AI from chat to now agents and second to do that well we offer a vertically optimized stack of technology to make you use agents really well.
And I think that stack is probably worth doing. Jensen talks about his five layer stack and that diagram that you showed at Google Cloud was a money chart. Maybe you can just walk through what are the three or four or five layers of that stack you mentioned a few of them. Yes. So the audience has it with clarity. I thought that picture was probably the most important picture for everyone to take away.
So the five pieces in our stack is at the foundational level sits the infrastructure. This is TPU accelerators, compute, storage, networking. On top of that is foundational models and research. So that's what we're doing with Gemini and our whole portfolio around Gemini, Imagen, Veo, all of our models. Next is the tool set to build AI systems out of it. This is our Gemini Enterprise Agent Platform which gives you all the tools. Then to reason on your data, what we call our Agentic Data Platform. This is the thing that takes all the data in the company and makes it available as context to models to reason on. And finally, our agentic security platform which protects you and protects your information, your corporate systems from the risk of AI. Finally, at the topmost layer, we're offering packaged agents, packaged agents for collaboration, packaged agents for customer service, packaged agents for research, etc.
That's great. So, you kind of have the Jensen version of the five layer stack and here you have this one. I think that's very important. What were you had a couple of use cases also from customers that you talked about? What are the most common use cases you're seeing of where people are applying Gemini and the agentic approaches in functions? I think a few of them are like customer service. What are the most common ones you see from the customer base?
The big ones I would say is you know we look at it across the different domains in a company. So in the back office we have a lot of people using Gemini to streamline the core processes within the company. So Virgin Voyages for example talked about how they're using Gemini to transform every element of how their organization works from finance to planning all the voyages to planning the food and other things that need to go on their legal department contracting. So one big thing we see is a lot of people using Gemini to enable their core workforce. Walmart does a similar thing. The second big thing that we see a lot of interest from customers is customer-facing. So Best Buy talked about how and a lot of them are sort of evolving. They start with I'm using it to help people find things online then buy them commerce and then handle upsell and cross-sell and finally service and they can do that from web from mobile from surfaces like Instagram so that you have access across all your channels so that's the second big area that we see. Third one is within the IT organization. We have a lot of people using it for the three big scenarios we see is for software engineering and coding to help do data analysis. You know today for example if you look at finance departments in many companies they used to say hey anytime we need to report numbers we always have to go to a database person to have them run all the queries. Why can't we just make this that I can just ask the question through a search system and have an agent go and find the data for me? So that's the data analysis and then cyber is the third part within the IT organization. So these are some of the big domains we see organizations using our AI systems for and we're doing many of that ourselves internally and I know many of our joint customers who are listening to this are also using that.
It's great. It's so exciting. You know, I came back from that conference pretty energized about the future of AI. Maybe we can shift now that you have Wiz, you're a prominent player. It's security at Sandiant. You've got this, there's so much talk today about these frontier models in the context of Mythos and other things. Yes, we just had a conversation a few minutes ago about why, you know, that's just one piece of it. And all the frontier models. If you're just trying to fix code and scan code, that approach isn't sufficient. Maybe you can walk through first why given that's very topically relevant, how you advise CISOs to think about right now they're all they're thinking about is scanning code. How would you get them to get their head out of that and saying would you think about the X and the Y and the Z dimensions of what could go wrong? You need a different approach.
So, you know, in general there are sort of three four important things that we talk to customers about. The first one is the risk from AI models is not just to source code of applications. The risk can affect binaries. It can affect firmware. It can affect a physical device like a network switch by compromising the firmware of that. And the reason is that models have gotten really good at understanding not just code but also configuration. Like for example they can understand your network and go if I access this switch then I can shut down this part of the network etc. So one thing is that models now have access to a lot more information and their ability to reason on them and so you need to think through what you are protecting is not just scanning your source code.
The second thing that we say is if you look at the rate at which models are advancing, you're going to end up scanning continuously and that can get both expensive but also just finding an infinite number of bugs you need a solution to help you repair it. So that's the second piece is scanning without fixing is not a solution.
The third one is when you look at the evolution of this whole infrastructure, the volume of applications, the volume of data, the volume of all the systems that companies run. If you then say I've got new models finding new things all the time, you then end up having to deal with an extraordinarily large surface area to patch, maintain, and update all the time. And so you can't just say I'm going to start at the start and go till the end because it's such a large estate of stuff. And the fourth complicating factor there's no one model that finds a superset of all the issues. In fact what many many companies are now reporting is a cheaper even a small open-source model with a good harness can find many of the vulnerabilities that a top-end model can do. So when you look at it, you know, you have these four issues. It's not just about source. It's about firmware, binaries, network, everything. Second, it's extremely frequent because you're going to have to get comfortable that models are going to come out all the time and just the volume of these issues is going to grow on you. The third one is just finding without repairing becomes challenging. And when you repair, you need to think about what are you going to focus on repairing. And lastly, no single model is the solution. You have to have a conglomeration of models. Like for example, saying this time I'm going to scan with this model. Next cycle I scan with another model. And so those are the four core beliefs we have based on all the data we've seen and based on what we're doing ourselves to protect Google systems.
