A Vision For The Future Of Enterprise AI Security With Sanjay Poonen

"Danny Allan: Am I correct in saying you have the largest set of data in the world as –

"Sanjay Poonen: Yeah, about a couple of hundred extra bytes, which is in our space probably bigger by a factor of five than all of our competitors combined, protecting some of the largest companies, typically banks. Banks have a large amount of data. And about 25%, 27% of our revenue and customer base is banks. The world's largest banks are on our platform. And those people retain data forever. A large amount of that bottom of the iceberg of secondary data in the world is in banks.

[0:00:32] Guy Podjarny: You are listening to The Secure Developer, where we speak to industry leaders and experts about the past, present, and future of DevSecOps and AI security. We aim to help you bring developers and security together to build secure applications while moving fast and having fun.

This podcast is brought to you by Snyk. Snyk's developer security platform helps developers build secure applications without slowing down. Snyk makes it easy to find and fix vulnerabilities in code, open source dependencies, containers, and infrastructure as code, all while providing actionable security insights and administration capabilities. To learn more, visit snyk.io/tsd.

[INTERVIEW]

[0:01:12] Danny Allan: Hello, everyone, and welcome to another episode of The Secure Developer. I'm Danny Allan, your host, and I am very excited to be with someone that I have known for over a decade. He is an industry leader from Oracle, to VMware, to now Cohesity and Veritas, the acquisition that they made. But I'll allow him to introduce himself, and that is Sanjay. Sanjay, maybe you can introduce yourself?

[0:01:33] Sanjay Poonen: Yeah, Danny, you got it all right except it wasn't Oracle, it was SAP, which was a hard competitor for Oracle. But hey, I respect Oracle a lot. We partner with them and did so at VMware, but you had it almost all right. Formative years was SAP. 8 years vice president, and then CEO of VMware, where I was very fortunate to acquire your company and Peter, and got to know you and Deskton. And you did really great things for us. I'm very honored to serve on the board of Snyk. And I love the company and what you're doing for developers, what you're doing for security, what you're doing now in the world of AI. There's a lot we could explore. And a lot of respect for also the customer feedback, because we have – I mean, I'm in the security AI industry too at Cohesity now. We have some common customers who tell me about the experience of Snyk, because they know I'm on your board. And they all have positive things to say about you.

[0:02:21] Danny Allan: Well, that is awesome. And let's start on the data side. Because, obviously, what you're doing at Cohesity and with the Veritas acquisition is protecting data. And I always say that data is the most important part of AI. Would you agree with that statement?

[0:02:34] Sanjay Poonen: Yeah, I'd agree. I mean, we think it is the gold of the new economy. All these companies that are ultimately trying to create value on top of whether it's larger LLMs, LLMs or the GPU stack. Ultimately, the value is the possession of data, and that data ultimately. Even if you look at DeepSeek, part of the reason they're probably successful is because they are applying their algorithms to a ton of data that China has been assessing on.

[0:02:58] Danny Allan: Yes.

[0:02:59] Sanjay Poonen: So, I think the companies like Amazon that have a lot of data, they can pour over e-commerce models or Google. And then, of course, what ChatGPT and others are kind of driving. The more that you operate AI on data, the AI just gets better. Security is the same way. The more you build malware detection, threat hunting, some of those capabilities on top of large amounts of data, it's a little bit like looking at disease in health. The more that you're able to operate your disease algorithms on large amount of diseases, everything gets better.

I think both AI and security, whopping large amount. So, in some sense, our mission at Cohesity has been to protect, secure, and provide insights on the world's data. And given the fact now with our size and the acquisition of Veritas, we're the largest player and have a lot of enterprise customers, this process of AI and security and data has become very relevant.

[0:03:54] Danny Allan: Two questions on that. Because, historically, when I look back at data, people would always train on the production data sets, the live databases, and the live unstructured data. And there's always this promise of tapping the black data that all this data that was in these repositories that was locked up and unable to be used. Do you think that's going to change is my first question. In other words, you're going to be able to use the data protection, the assets that you have historically not on the production data to train on AI.

[0:04:19] Sanjay Poonen: Yeah, it's possible. We think of data much the same way you described it. Sort of like an iceberg. The top of the iceberg is that visible hot data, as you described. And as you described, the dark data, we put that underneath the iceberg. That's everything that ages. That's archived, vaulted, backups. We call that secondary data. If you think of primary and secondary data, the mission of Cohesity is to have all of that secondary data on our platform. As you know from your history, also in the backup industry, every one of the vendors play in this industry write that data in their format. The only people who can extract that data, of course, a customer can always recover that data, are the vendors themselves.

One of the things that was a breakthrough idea that we worked on with NVIDIA was the ability to recover that data through techniques like RAG, retrieval-augmented generation, directly from backup. Now you could then build a catalog if you would. And, actually, I'm going to be talking about these types of concepts at a mini keynote here at the Snyk conference. You could then use as a vehicle into your AI applications.

The benefit of that is you don't have to run these hot GPU cycles on all your hot data all the time. You can spin it up when you need it. And the amount of data is vast. And it's also all your historical data if your retention policies or all that. I think there'll be evolving aspect of customers saying I suspect the best first place – and we should have a dialogue if you agree with this or not. I think the first place this will probably start getting cracked is unstructured data.

[0:05:45] Danny Allan: Yes.

[0:05:46] Sanjay Poonen: Because unstructured data is 70%, 80% of the world, and structured data is 30%, 40% of the world. And if you think about large amount of PDFs, Word documents, eventually images and video, being able to search, summarize, analyze that in historical fashion is a big problem. And I think generative AI is going to be really great technology to solve that.

[0:06:05] Danny Allan: How do you balance? We have all this unstructured data and all these files. How do you balance the protection of that at a consumer level with the business need to curate it into an LLM to teach the LLM? Because there has to be a tension between those two things, I would expect.

[0:06:20] Sanjay Poonen: Yeah. I think we're inspired by – I mean, a lot of our founding folks came from Google. So we learn a lot from how some of these large companies like Google. I mean, if you take how Google thinks about that same problem you described in the context of photos, okay? You need to be able to retrieve a photo really fast of anything you did all the way – if you've got photos that you put into that repository of when you were born or whatever have you. But pictures of my kids photos from their young age. Pictures of me from whatever, 30, 40, 50 years ago. They've got algorithms for which you can recover that data really fast. But at the same time, you back it up really fast.

We have to think in that fashion, which is you want colder data to not have to pay the high price of storage, but you also want to retrieve it reasonably fast. You want to be able to compress that large amount of it, which, as you know, the technology, deduping that help you do that. But you don't want then the price of search summarization and recovery of that dedup data to be expensive. These are all the triangle, or rectangle, or multi-varied equation of optimizations you're trying to build in the retrieval of this.

I think in the past, the entire aspect of this industry, secondary data, was a storage problem and an efficiency of storage problem. Ransomware made it a security topic. And that's obviously well established. Many of our peer companies in the space have now very much pivoted to being at least nominally more security-focused. But this sort of AI focus of search summarization and analytics of data is a new frontier. We want to drive a lot of the tech innovation in that area.

We've been very fortunate to have NVIDIA invest in us and do work with them. I think NVIDIA, the three, four public clouds, and maybe the two LLMs are probably the companies that are doing the most work in this area. It's NVIDIA, Google, Microsoft, Amazon, to some extent, Oracle, and then Anthropic and OpenAI.

We've sought to stay close to those six companies, understand what they're doing. I know Snyk's taking a similar approach. I've been blown away by so much of this is happening. Internally, our own engineering now, whether it's GitHub Copilot or Cursor. I mean, there's so much going on in the world of generative AI.

[0:08:24] Danny Allan: It is amazing right now. And actually, if I may ask a question, are you using coding assistance inside Cohesity for the development?

[0:08:29] Sanjay Poonen: Yeah. I mean, listen, I was inspired by Microsoft saying 30% of that code is code-generated. We are seeking to get a significant part. I mean, the easiest place it is helping us is testing. Test harnesses can be built. That's easy. That should be done. But we're starting to see in many of our, for example, workload connectors, which are building connectors to all these sources.

I mean, if you've done an Oracle database connector, the difference between that and a SQL, Sybase, or DB2 may not be that much. An agent could probably learn what you did on Oracle and replicate for another database and get at least 70%, 80% of the starting point of the code. Ferret out the APIs that needs it. I think to the extent that some of these problems that are fairly repetitive can be done through an agent. You get productivity up. And we're measuring that productivity improvement that our engineers – we have the largest engineering team in our space. About 2x the size of our competitors. Size itself, I tell our people, is not going to be a competitive advantage. It's making this larger team more productive so they can do things at the speed of light.

[0:09:28] Danny Allan: And I know Cohesity built on a very modern stack. Your file system is second to none, as my understanding, within the industry in terms of being able to mail to file store and do data training on it. The Veritas was a different data set. Are you using AI to merge those? How are you reconciling those two stacks? And are you using AI to do it?

[0:09:47] Sanjay Poonen: Yeah, it's important to note that when we acquired Veritas, we only acquired 70% of the Veritas business called NetBackup. We left the file system, which was a product called Infoscale, inside another company called Arctera. We did not take the file system piece of Veritas. We left it back. We really picked up the data mover part of that, which was the vehicle of the business.

And yes, it runs on appliances with that file system, but we're having that data mover now sit on top of our file system. The first project we initiated from the moment – I would love to have started the moment we announced the acquisition, but we were technically competitors. We couldn't do it till we closed because we needed that code base. We've been able to – I think this month, we release NetBackup running on top of our file system.

So then you kind of have, theoretically, these two data movers. Our data mover from Cohesity called DataProtect, NetBackup, right into one file system. Once it's on that file system, all of the security procedures, which are essentially thread protection scanning algorithms, as well as the AI work on that, which are typically search summarization analytics algorithms. They can work on that file system.

And you are right. I mean, the sort of Googleesque founding of the company built a platform that was zero trust and extremely fast for cyber recovery of data. To this date, no one can match our speed of recovery from that platform. And we constantly are optimizing that with both software and hardware innovations.

[0:11:08] Danny Allan: How are AI engineers then? You have a common file system across these. And I correct been saying you have the largest set of data in the world as –

[0:11:16] Sanjay Poonen: Yeah, about a couple of hundred extra bytes, which is in our space probably bigger by a factor of five than all of our competitors combined, protecting some of the largest companies, typically banks. Banks have a large amount of data. And about 25%, 27% of our revenue and customer base is banks. The world's largest banks are on our platform. And those people retain data forever. A large amount of that bottom of the iceberg of secondary data in the world is in banks.

The second biggest vertical typically that has a large amount of data is public sector. These are departments of defense or civilian because they also have retention requirements. Third for us is technology firms. These are big tech firms in Silicon Valley and other places. They have projects that – because they use a lot of cloud. And you imagine who some of these companies are, where, naturally, they're positive for secure data. Fourth is healthcare and fifth is telco.

If you look at these five verticals, we have five other verticals that are very important. These all spend a fair amount on tech. They have a lot of data. And they're high risk and propensity to the bad guys trying to hit them. And then, of course, once you've got the security of that data figured out, the next thing we want to work with all of them is the AI on top of the data. We envision ourselves long-term being sort of a cross between a Databricks and a CrowdStrike, right? I mean, you're sort of a security company in one sense in protecting that data in a secure bunker, but then you're also an AI company to mine and basically get value out of that data.

[0:12:56] Danny Allan: The largest set of data, the fastest ability to recover that data. How are you thinking about exposing it to, I don't know, MCP servers or AI engineers? We have a lot of developers who watch –

[0:13:07] Sanjay Poonen: A really good question. Our board and I spent a lot of time thinking about it. I think the long-term value of that data is to create a data catalog, and I'll be talking about this in my keynote here, that is exposed to developers. We have an AI application called Gaia that we built with NVIDIA. That's an agent or an app that talks to those APIs itself. But we could kind of make that headless and have that catalog API set talk to other apps, right? It could talk to Agent Space from Google, or Glean, or Bedrock, or Copilot, or to all your AI developers building their own apps. That data catalog is something that we are spending a lot of time perfecting. It's certainly very, very pioneering in its thought. And because it sits on all the world's data, we can provide that.

What we're curious to know when we talk to developers here is what are the AI applications you want to build inside your company? And what are the apps that you want to build that are talking to historical data? Because that historical data is probably on our platform. We can expose that data to you. And then we're going and talking to our customers. Typically, the people who own the secondary data, backup secondary, don't know those AI apps because they're just the custodians of the data.

But when they talk to the developers, or the developers who are at your conference tell us, we will know. And then we can tune these APIs and the access of it. And then also the commercial monetization of it. Today, we make money securing the data. We also make money on access of the data, right? It's a little bit like the way AWS or Databricks, you kind of store the data, but then you also have it. We need to find out some optimization of those models where both the secure and the access, maybe there's a joint pricing to it. There's a lot we're trying to figure out together.

The other thing that's also been very interesting on AI that has a little bit of developer range but we're seeing a lot of interest now in a very important workload, identity, and resilience of identity. Because often, before you can even protect your virtual machines and databases, you're pointless doing that if your identity directory is hacked. And those active directory are human users. But eventually, they're agents.

[0:15:12] Danny Allan: Yes. [inaudible 0:15:12].

[0:15:14] Sanjay Poonen: Yeah, exactly. Securing your users, both humans and your non-humans’ identities, is becoming a big problem that we are at the crux of solving. We've announced an entire offering around that data resilience. That has also a lot of AI to it, both in the tech that's built in it, but the fact that the future of that world is AI agents that are non-human.

[0:15:33] Danny Allan: Yes. And that is so important because I always say the perimeter in an AI world is the identity. And the identity may not be a person. It's going to be an agent that is delegating access to different systems out there.

I want to pivot. You mentioned earlier that you have a relationship at Cohesity with Jensen, with the NVIDIA team. What are you doing with Nvidia from the Cohesity side?

[0:15:53] Sanjay Poonen: Well, Danny, just to back up a little bit. As from our time at VMware, because you were involved with the end-user computing VDI business. I remember asking our VDI team, "Why is it that one of our competitors," at that time it was Citrix, "did such a good job with graphics?" And they said, "Oh, it's because they built an integration through the GPUs into their hypervisor. And we should do the same thing." This was like circa 2013, 12 years ago.

I went to Pat, who was our CEO at the time, and knew a lot about CPUs and GPUs. And he said, "You should go meet this gentleman named Jensen." At that time, it was a gaming company. Nowhere close to the four trillion market capital. But despite 40 or 50 billion mark, an important company.

I went to his office. And he was an remarkable man. I mean, he was a teacher. He still is. Very humble, down to earth. And he taught me a lot of how the GPU works, what the connection is between the GPU and the CPU, and what we needed to sort of pass through. And I'm a technical person at heart. I understood it, and my engineers. But there was a little bit of a religious feeling between the VM or ESX team and the GPU team that they didn't want to sort of allow those passthrough and things of those kind.

Anyway, we worked through all that stuff, and we finally implemented our VDI product. As you know, Horizon, our user computing product, to use the GPUs, passthrough to ESX. And voilà, we had a product that was better than our competitor. Yeah. And I invited NVIDIA's CEO, Jensen, at that time, I think it's 2014 or so, to come and speak at VM World. This big conference. And it wasn't even a keynote. It was at our booth. But he just stood on a table and gave this speech like a prophet. And he was like this prophetic pastor or whatever have you. And that's what I remember of him. And I, till this day, tell him that story.

He was so galvanized to just get everyone understanding the power of these technologies that could then fast forward now to 10 years later. We had this idea around generative AI. And I was playing on ChatGPT. It's very clear, the company, the most amount of data. But I had no idea what RAG was. Both Jensen and Satya exposed me to this technology RAG . I thought it was a piece of cloth you wipe your windshield with. But then I studied every computer science paper. I had my founders and our founding team understand what RAG was. We built it. And we went back and showed what we were doing to Jensen. He was blown away. He's like he got it within 30 seconds.

Made the decision himself to invest in our company and featured us at his GTC keynote in 2024 and 2025. They're on our board of observers. We're very grateful. We're building our Gaia product on their stack. Now, what does it do for us? I mean, A, they're an investor, so we want to make them proud. But more importantly, building on that stack allows me to not have to write that code five times. What do I mean by five times? I don't want to write it on AWS, Azure, Google, Oracle, and private cloud, right? Their abstraction layer allows me to do things like PDR parsing, things that we need to do four or five times, and they built the libraries for that.

On top of CUDA, which is their core APIs, they have a set of enterprise AI libraries. And they work with the best open source people, productize. I mean, there is a charge for that. But the benefit to us is I save engineering times five, right? And then especially, one of the things that where this goes to a step further is when you go to the on-prem world, okay? In the countries outside the United States – I mean, good or bad things about these tariffs, whatever your opinion are politically, it has woken up the outside world to the fact that they need a sovereign cloud. Every country except the US says I want a sovereign cloud. European countries, UK, France, Germany, Netherlands, Middle East, whoever have you. And they want that stack, then where a lot of this AI capabilities, like Gaia, can be done on-prem without having to send any data to public cloud.

One customer said we want all the benefits of what you could do with retrieval-augmented generation and Gaia. But no data can be sent to public cloud. We were able to do that on top of the Nvidia stack running on HP, Dell, or Cisco servers. AI servers, right? We built this product initially in the cloud because it was easy for us to build that out. But then when we heard that we were able to get that same codebase now running on-prem and all of that stuff to have kind of a leading AI company. I talked to one of the team members of Jensen's, a lady named Kari Ann Briski. Super smart. Runs the enterprise AI. Her advice to us on where we go on this topic.

I mean, my advice to everybody here listening to this is surround yourself. Danny was one of those people to meet at VMware, and still is in a lot of stuff related to the world of tech. But find people in your circle of friends and contacts. I mean, everyone may have access to Jensen. But there's a set of people. I described them. For us, it's Nvidia, Google, Microsoft, Amazon. Maybe to some extent, Oracle, too. But then certainly the two LLM companies, OpenAI and Anthropic. They're the companies we need to learn from. Get close to them. You don't have to talk to the CEOs all the time, but they're people in their companies who we want to build on top of or evolve because they're gaining momentum in our customers, right? And if they're gaining momentum in our customers, it behooves us to stay close to their work in this world of AI.

Now, who's going to win among these players? There's some competition in the public cloud. I don't know. Time will tell. I mean, I would have started off saying like 2 years ago it was Microsoft because of OpenAI. Google's coming on strong with Gemini and all the things they're working on. Agent Space. They're strong. And the good for everything who's – everyone who's a developer, a customer, innovation among the four public clouds. When you were at VMware, I always said there was two public clouds, AWS and Azure. Now it's sort of four, AWS, Azure, Google, and Oracle.

[0:21:31] Danny Allan: Oracle is coming on with OpenAI.

[0:21:32] Sanjay Poonen: They got this work going on OpenAI, and Stargate, and everything. I think for customers and for developers, this is fantastic news, right? You get to drive a lot of the future of the world of AI. In our case, it's AI and cybersecurity. And just stay close to the smart people. I mean, for me, I wish I was a 22-year-old. Of course, this is the best time – you and I have kids, right? They're coming out, going to college, or soon will come out of college. I mean, to me, if I could be a 20-something or 30-something right now as a developer, this is the best time.

[0:22:02] Danny Allan: Well, my son is going to graduate with computer science this year. And I say all-in on AI. And I actually think this is a future of Cohesity, Sanjay. Because the same way that NVIDIA, they reached where they are now, I would argue, in kind of three plays. They did the gaming first. Then they did the crypto. The GPUs were used for all the crypto. And now they're obviously driving all this AI initiatives. And they had a common framework of CUDA. I look at Cohesity, and I actually see the same thing.

Started up in the backup data protection space. Second play, huge opportunity and growth on the ransomware. And the third opportunity is what you're doing right now, which is exposing the data to AI. What's the common framework? What's your CUDA? It's that file system that you have that exposes it for the training of all the diffusion models and LLMs, and everything that is out there.

[0:22:45] Sanjay Poonen: Danny, you should be our evangelist. You got it. I mean, we call this the act one, act two, act three story of Cohesity. If you watch my – every 6 months, we update the story of Cohesity to a 10, 15-minute story. If you watch my latest one that was just released this past week, I talk about exactly the point. I don't make the credits to CUDA, which is a very astute one. Thank you for that. I will put that in my library of good ideas. But I do talk about act one being data protection, act two being security, act three being AI. And they all build on top of the other. And the value gets higher.

As you know, the act one is price per terabyte is commoditizing. It's just going lower. If you're just doing pure backup, you're not making much money long-term on a price per terabyte basis. You add more security on that, whether it's a user-based pricing or terabytes, there's more value. Customers will pay for it. And certainly, AI. Gosh. I mean, it's amazing how much customers will pay to be able to search and summarize 10 or 100 terabytes of data.

[0:23:38] Danny Allan: Well, data is driving the AI revolution, and Cohesity is powering that. What makes you most excited for where we're going as an industry?

[0:23:45] Sanjay Poonen: I mean, Danny, as you know, to me, there's three things that motivate me life. One is people. I'm a people person. Yeah, I love people. I love serving people. I love building teams. And I've stayed close. And it makes me very proud to see people like you and Peter doing well, who are people I invested in during my years at VMware. And for me, life is a big circle, and you want everyone who you've had time with in your life to be successful. And I have north of 5,500 people that are my playground now. We had 20,000 people at VMware and 100,000 people at SAP. But I have to focus on that. That's the one.

Number two, I really get excited type of product innovation at the junction here of cloud security and AI. And the third, I love customers. I spend a lot of my time with our biggest customers. Understanding their pain points. Really getting to know some of the – we have 13,000 customers. But who's who in banking? Sometimes I'll just call them on a drive home or whenever there's like 15, 20 minutes, and you can ask them like insightful questions.

I was talking to a large bank this week. And within a half an hour my entire perspective on a particular topic changed by just understanding from them. And I view this as like having 13,000 product managers who can guide you on your product. My goodness, I don't need to talk to all of them. There's some subset of them that are advisory board, and they're constantly guiding us. "Go here, go there." And you just have to have the ability to then pivot very quickly to saying, "Hey, I'm sorting out the signal from the noise. I think that this is where we should go." Some ideas we have on our own, which is where we lead, but then we also need to listen.

When we listen and lead to our customers, and I'd include partners and other, we use Snyk internally, right? It's a good example, where I like the ability of kind of going modern on these. There was old ways of doing source code scanning, and there's new ways of doing it. Because I'm on the board, I try not to push my team. I encourage them to look at where developers are a thing. And then they make their own decisions.

We want to see companies like Snyk be very successful. I have an obvious vested interest on the board of directors. And I want to see this company be a pioneer in AI-driven developer security, application security, posture management, whatever the analysts call the space. You're closer to the space than me. But I think there's a tremendous opportunity ahead of us.

[0:26:03] Danny Allan: Well, yes. That is definitely true, tremendous opportunity. And Sanjay, I just want to say thank you. I've learned a lot from you over the years. And the one thing I remember about you is always talking about customer obsession and product innovation being dimensions of the plane, right?

[0:26:16] Sanjay Poonen: Hey, you know what, Danny? It's still the same. If you're from Cohesity and you're seeing that now, I was doing that 15 years ago, and Danny knows that better. But some things don't change in life. You got to stay true to that mission. And it's been my story for 25, 30 years. And I'm very grateful for that combo engine picture.

[0:26:32] Danny Allan: Yeah, definitely the case. Well, thank you all for joining us on The Secure Developer today. It was fantastic to have Sanjay here from SAP. Not at Oracle. But a leader in the industry, and that is driving the AI space. And we'll see you next time on the next episode of Secure Developer. Thanks, Sanjay.

[0:26:46] Sanjay Poonen: Thanks, Danny.

[0:26:49] Guy Podjarny: Thanks for tuning in to The Secure Developer. Brought to you by Snyk. We hope this episode gave you new insights and strategies to help you champion security in your organization. If you like these conversations, please leave us a review on iTunes, Spotify, or wherever you get your podcasts. And share the episode with fellow security leaders who might benefit from our discussions. We'd love to hear your recommendations for future guests, topics, or any feedback you might have to help us get better. Please contact us by connecting with us on LinkedIn under our Snyk account, or by emailing us at thesecuredev@snyk.io. That's it for now. I hope you join us for the next one.