CDOIQ Symposium 2024 | Kabir Barday | OneTrust

theCUBE.net

Clips
More from CDOIQ Symposium 2024

Kabir Barday

Co-Founder, Chairman & CEO

OneTrust

play_circle_outline OneTrust Security company background and growth in data privacy and AI market

play_circle_outline Ensuring Data Security and Responsible Governance in AI: Shifts and Challenges Ahead

play_circle_outline Formation of AI governance committees in companies for responsible use of data

play_circle_outline Navigating the Competitive AI and Security Market Through Responsible Data Use

play_circle_outline Comparing AI Governance Approaches: Consent Management and Third-Party Data Security Importance

Info
Transcript

Kabir Barday | OneTrust

Kabir Barday

Co-Founder, Chairman & CEO OneTrust

Kabir Barday, CEO of OneTrust Security, discusses the company's growth in response to privacy laws, expanding to responsible data use in AI. He emphasizes the importance of AI governance for permissions and compliance controls. Market dynamics drive the need for differentiation. Barday highlights the shift towards responsible data usage. Challenges include consent management and third-party data risks. There is a growing demand for AI governance capabilities. Regulations impact data privacy and compliance, driving the need for technology solutions. Barday str... Read more

explore Keep Exploring

What led to the creation and growth of OneTrust as a company? add

What is the challenge with approaching AI from different perspectives such as security, ethics, privacy, and data governance, and how are companies starting to address this challenge? add

What are companies starting to do in response to the crowded market and frequent M&A activity in the AI industry? add

What is the speaker's perspective on standing out in a fiercely competitive market, particularly in the enterprise software sector, and what is their strategy for differentiation in the area of responsible AI use? add

What are the three key areas that companies are starting with when building their AI governance program? add

bolt Powered by CUBE AI

Kabir Barday | OneTrust

search

>> Hi everybody. Welcome back to CDOIQ. You're watching theCUBE's coverage of the 18th annual event here, the gathering of chief data officers. We're here in Cambridge, Massachusetts. I'm Dave Vellante with Sanjeev Mohan. Kabir Barday is here. He is the co-founder, chairman, and CEO of OneTrust Security. Great to have you. Thanks for coming on.

Kabir Barday

>> Thanks. My first time at this event.

>> Awesome. Stephanie set us up. She's been on many times. Great guest from days gone by, helped us get theCUBE going back in the big data days and, wow, what a run it's been. You guys have been around for, what, five years roughly?

Kabir Barday

>> Eight.

>> A little more than that, eight years.

Kabir Barday

>> 2016 we started.

>> 2016. Why'd you start the company?

Kabir Barday

>> So, data privacy was the big emerging trend. I worked at a cyber security company actually at the time. We had built a technology that monitors employees' phones, bring your own device monitoring technology, and they're all sorts of unintended privacy consequences of trying to do good things to be helpful for our customers. And so, discovered this emerging set of privacy laws and rules and decided to start OneTrust, had a lot of help, and then the GDPR passed and things just exploded from there. And so, we grew very quickly. We went from zero to 100 million ARR in three years, which is slow in today's world. I think Wiz did it in 12 months. But, we did it in three years. And we are at about 14,000 customers today, about 500 million ARR, about 2,000 employees around the world. And we've expanded from privacy to responsible use of data in AI. How do you collect data transparently, automate all the compliance obligations, and then enforce the policies when you're using the data?

>> So, first of all, congratulations, amazing. It's interesting. At RSA a year ago, the talk was how the bad guys were going to use LLMs to write better phishing emails. And, of course, this year everybody was talking about, which is your wheelhouse, was how do you secure the AI? And that's really what you do. So, it was kind of interesting to see that shift. Did you see it as well? Did you hear how everybody was talking about securing AI, whereas, a year ago it wasn't?

Kabir Barday

>> So, it's interesting. So, in my role, I go to a lot of these conferences. I meet with a lot of these customers. And so, what's unique is I've seen this from RSA, the security point of view. I went to an ethics conference and saw this from the chief ethics officer point of view, went to IAPP and saw this from a privacy point of view, now the data point of view, even from a sustainability and ESG point of view. It's the first time in my career that I can go to any single one of these conferences and the keynote is the same and all the sessions are the same. And it's how do we responsibly use data in AI? What's complicated is, every single persona is looking at it just from their angle. So, you go to RSA, they see AI as a security problem. You go to an ethics conference, they see it as an ethical problem about fairness and bias. You go to a privacy conference, they're like, no, this is a privacy GDPR problem. The reality is all of-

>> We go to the data conference, it's a data problem.

Kabir Barday

>> It's a data governance problem, and it's a quality problem, it's a lineage problem. And so, you have all these people approaching it from different angles and there's got to be something that brings that together. And that's what we are focused on, is thinking about what really does this look like as all these teams start working together? And the number one thing we're starting to see companies do is starting to form an AI governance committee with all these stakeholders at the table. And then, they're starting to say, what people, process and tools do we need to go build the new architecture of responsible use?

>> So, the dynamics, let's talk about the dynamics in your business. It's a highly crowded market. It's getting more crowded. Startups come in every day. We're seeing some M&A quite a bit actually. We hear big news this week is Wiz getting acquired by Google for some huge number. We'll see if that actually happens. But, it seems like the funding's not stopping. The new startups and the innovations. You're seeing edge security, you're seeing AI security, all kinds of specialization. How do you think about the dynamics of your industry and where do you guys fit?

Kabir Barday

>> Look, as a founder of a company, you always want to be wary of empty restaurant syndrome. If there's nobody eating next to you, then you're probably at the wrong restaurant. And so, I think a fiercely competitive and a crowded market is a good thing if you have an opportunity to be the outlier, number one. You don't want to be in the middle of a pack of a crowded market. So, I think there's a lot of goodness in what we're seeing. The other good signal is in enterprise software you never have a big enough market until Microsoft, Salesforce, some of these giants are in your market. So, you're starting to see, it didn't go through, but Salesforce look at Informatica like data management, data security. They're looking at all these different things. Microsoft is here at this conference thinking about Purview and all these different things. So, the market is good and the market is ripe, but in enterprise software it's been a bloodbath except for two categories, AI and security, and we're at the epicenter of the combination of that market. So, I think it's very exciting. Now, the thing is how do you differentiate and stand out? And what we have seen is, you can segment the market in data security, and then everything else. And I think what's interesting about the responsible AI problem is that the everything else problem is even bigger of a problem than data security. Data at rest, data access controls, these things have been around forever. The new challenges that are complicating this are, do I have permission? Do I have purpose specification? Do I have the right compliance controls? Am I enforcing minimization? Am I enforcing pseudonymization? These are things that are way more interesting and way more unsolved and create an opportunity to really have a brand that's differentiated and not blended in with the security companies. So, that's been our strategy is really calling that responsible use of data intentionally not data security, and playing nicely in that ecosystem rather than competing with data security companies.

>> Interesting. But, you're still generally in that space.

Kabir Barday

>> Yeah, I think in a category, the public markets would see us as a cyber security and an AI company.

>> Which is actually a really good thing, right?

Kabir Barday

>> If we get the Wiz multiples.

>> It was funny, I was listening to Peter Thiel the other day from a couple of weeks ago at the Aspen Institute, and typical VCs is, well, you want to be a monopoly, and there is no monopoly in your space, which is in a way, I would say as an entrepreneur, that's a good thing, unless you can be the monopoly. And I don't know, Microsoft is maybe the biggest, and it's hard to tell how big they are because they're big at everything. But, I think maybe Palo Alto is the next biggest, but it's very small slice of the market, and the market's enormous because as you said, data security is like everything else. And I don't know, it's almost a measure of 100 billion plus. So, what are you doing here?

Kabir Barday

>> So, what we are finding is that the requirements on privacy, consent, compliance, third party management, all these things used to be legal disciplines and compliance disciplines that would just sit in a corner-

>> Back office stuff....

Kabir Barday

>> in a GC organization. Now, the risks of AI, what we talked about, there is no machine learning. Once you put data into the machine learning algorithm, you really can't take it out. And we talked about there's now been five algorithmic and data deletion orders issued to companies with five-year bans. So, companies are seeing that one wrong mistake of data put into the machine learning algorithm contaminates the entire thing and creates a dramatic competition risk, a dramatic trust risk, brand reputation risk and enforcement risk. And so, companies are now saying, this privacy third party risk, these new types of issues can't be standalone. They actually have to be architected as part of my data architecture. For example, if I'm collecting data with the right permissions and consent, we're number one in the world in consent and preference management, that signal can't live in a legal tool. That signal has to be metadata embedded in my CDP, embedded in my Snowflake and my Databricks architecture. And then, when I access that data through my data catalog, I need to check for not just sensitivity and user, but I need to check for the third dimension now, which is purpose. Do I have purpose and permission for that use case? Based on that purpose and permission for that use case, have I orchestrated the right policies to enforce on that data so that my data user isn't having to write a calendar reminder to delete the data manually in three months, whatever it is, how do we enforce that? So, what we're seeing is this traditional world of risk management is actually being merged into the data architecture. And so, that's why we're here to learn more about that with the chief data officers.

>> So, well, beginning of this year, I wrote my predictions document, like all good analysts do is to write about predictions. So, I had four predictions for AI, and three of them have come true, but one of them I feel is still struggling. So, the first one was about the platform unification of structured, unstructured. The second one was personalizing of AI through Rad, vector databases, fine-tuning. The third one was on AI agents. The fourth one that I am hearing from customers is struggling is AI governance. And when I asked them why are they struggling? So, they tell me two reasons. One is that they don't even know what use cases to put the AI to use. So, they're like, did we get the act together? AI governance seems to be putting the cart before the horse. But, the second problem they're saying is that we don't know what AI governance means. Is it governing the models and what data goes into it and trains, or is it the usage? So, how do you define data AI governance? Where does data governance and AI governance begin?

Kabir Barday

>> I love the question, and these are such overlapping concepts, but different enough that organizations are thinking about an AI governance program and technology different than data governance, technology and tooling. When we talk to companies about their AI governance program, they're really starting in, I would say one of three areas, very like blocking and tackling. The first is consent management. To govern AI, fundamentally you need to make sure the data you're putting into that AI has the right permissions and purpose.

>> But, how do you know what OpenAI has done? They don't publish. They don't tell you.

Kabir Barday

>> Well, this is for your proprietary first-party data. So, what's happening is, well, first of all, OpenAI is built on third-party data. Third-party data is dead. So, first differentiation using third-party data is dead. Second, your ability to use third-party data, year one FTC ruling away from that, no longer being-

>> It's teetering.

Kabir Barday

>> And even in the corporate America, death of third-party cookies, privacy laws make it impossible for consent to move between third parties, because it's not possible to be clear to the first party who the third parties are. So, companies are all moving to first-party data strategies. And differentiation is not who trained the most public data on their LLM, it's who has the most proprietary first-party data. That proprietary first-party data has to be collected with permission and purpose, and the right retention and minimization. So, that's the first thing we're seeing companies build in this foundation. That's because that not only helps you with your AI governance, but also helps you with personalization initiatives, non-AI data driven projects you need that for too. That's really the bridge. That's for in-house data that you're using to train your algorithms. The second, third-party management. Third-party management, a lot of times when we start conversations with companies about AI governance, they lead to third party management discussions, because a majority of a company's AI risk and practice is from your software supply chain. This is all shadow IT that's going through your technology vendors to all your business users, Salesforce, everyone else just upgraded their application with their copilot and it just came. It just came, right? The cloud, you just get version updates. All of a sudden your users are typing data into these tools. So, number one, you ask a company, do you know which third parties-

>> Even search, if you think about it.

Kabir Barday

>> Just ask a company, which third parties are using AI models, and what data are your users putting into it? Crickets. And that's a massive exposure. And the regulations in AI that are emerging put the responsibility both on the deployer and the provider. So, you can't just blame Salesforce for doing that. You're responsible for having your arms around this. And so, third party management is a really important area. And then, we've developed a dedicated AI governance capability. There are really two different camps of dedicated AI governance. So, the surveys show that AI governance as a discipline, 50% of that is actually run by privacy programs. 50% of that is run not by privacy programs, by maybe a data engineer or a security program or a data governance professional. So, we're seeing companies that have already built a pretty robust privacy infrastructure of assessments, of mapping your data, just add AI as a new domain set of questions and analysis.

>> Regulated companies typically, or not necessarily?

Kabir Barday

>> We actually see the majority of our demand comes from what I'd call non-traditionally regulated industries. Because, look-

>> The quasi kind of guy.

Kabir Barday

>> Because, traditional regulated industries have had data governance teams, some process-

>> They got that nailed....

Kabir Barday

>> for years, they got it, something gone. Now, privacy and AI regulation changes the definition of a regulated industry because data's regulated. Every industry is regulated. So, there's this massive tail green field of 80, 90% of the market that has never been served that are looking to do things. And these are a lot of technology vendors, airlines, even like CPG, we're seeing a lot of these types of brands, a lot of B2C companies that have that direct interface with the consumer, because that interface is, there's super power to collect data. And so, you have to protect that trust at all costs.

>> Is there more AI adoption in regulated industries or unregulated?

Kabir Barday

>> I don't know the stats on this. What we are seeing across the board is that these use cases move in waves. So, you see, like right now we're seeing just a massive wave of transportation, airlines, CPG, pharma, consumer goods. We're seeing a lot of entertainment brands, sports, trying to drive, these brands that have big personalization initiatives that are now being AI powered personalization initiatives that are trying to differentiate, that are trying to get better ROI from their marketing spend, reach more users. Those are the use cases that we're seeing drive the most excitement.

>> Which is interesting, because a lot of the industries you mentioned are actually not regulated.

Kabir Barday

>> Exactly.

>> So, which means the regulated industries are saying, because we've been regulated, so we were mandated to manage our data and they don't need as much help.

Kabir Barday

>> I think it's a maturity curve. All of these, any kind of risk-driven market, it's hard to look at size of company. It's more practical to look at maturity of their governance program. And I think you're right, the traditional government, healthcare-

>> Financial services....

Kabir Barday

>> financial services, thank you. These types of organizations have a higher maturity.

>> Maturity, correct.

Kabir Barday

>> And so, they've been doing these things for years. Maybe they're using legacy technologies, they have more -

>> Machine learning....

Kabir Barday

>> they have three lines of defense. So, there's certainly opportunity there, and we see a lot of opportunity.

>> Of course.

Kabir Barday

>> But, the opportunity shapes differently than in the 80% of the market that is seeing this for the first time.

>> So, these, are they executive orders, these regulations, the five, that's a tailwind obviously for OneTrust.

Kabir Barday

>> So, the five or enforcement actions that have come today in AI have been from the FTC section five, which gives the FTC generic power to enforce unfair and deceptive business practices.

>> Which basically means that they can bring you to court or something.

Kabir Barday

>> If it's unfair or deceptive. If you say you do something and you don't do it, that's unfair.

>> It's classic , and I could rant on that, but you love it, so it's great for you.

Kabir Barday

>> Look, well, I don't have a position on it.

>> No, but it certainly helps your business. All this complexity and need to...

Kabir Barday

>> Complexity requires technology and automation to tackle. I think that's true.

>> For sure. I want to remediate that risk or reduce that risk. Now, here's my question. A lot of times when these enforcement actions or executive orders or regulations are put forth, what's happening in Europe and obviously gets adopted, oftentimes in the United States, a lot of times the large companies, it gives them a huge advantage because the small guys don't have the resources to deal with that complexity. Can you help companies across the board, or is this really just a big company thing?

Kabir Barday

>> So, we have 14,000 customers. About 1,200 of those are kind of enterprise Global 2000, 80 of the Fortune 100. The other 11,000 are Joe's bait shop to the-

>> SMB...

Kabir Barday

>> Belize Cement Company, to the funeral home, private equity. It's all across the map. So, what's really interesting about this market is, when you look at the regulatory drivers, you mentioned that the big companies are either advantaged or disadvantaged in this. The reality is we're seeing the big companies lobbying for more regulation.

>> Yes, because they're advantaged. They can use it as a moat and a blocker for the disruptors.

Kabir Barday

>> Well, the big companies are multinationals. They already have to comply with all this stuff in Europe. So, if these smaller companies that are U.S. only don't have to comply with those, then the big companies are actually at a disadvantage in some areas-

>> For a period of time....

Kabir Barday

>> for a period of time. But, you're seeing more big companies lobby for. The difference is, what level of prescriptiveness do which companies want in these regulations. Or some schools have thought that we want this to be very prescriptive, because companies just want to be told what to do. They're going to do it. That's the compliance culture in America. And it's fine.

>> That's what Zuck wants.

Kabir Barday

>> But, other companies are at the train of thought, which is we're on the bleeding edge. No regulator is going to understand this. And the biggest risk of AI is not these privacy and security things. The biggest risk of AI is not using AI, because AI is going to cure cancer, save lives, solve safety applications, democratize access to education,

>> Make better defense, all these things.

Kabir Barday

>> You have these, which is why I say we all have an opinion on regulation, so to speak, because there are different motivations and different issues. Whether there's a federal privacy law or 50 different state laws, it's going to be hard no matter what. Actually, it's easier for us to build technology if there's one law. So, it's a complicated web of issues.

>> What I love about compliance, like large companies want compliance. Sam Altman goes to the Congress.

>> He wants this because he wants that regulatory capture, exactly.

>> He wants to cut out the small players.

>> Elon's behind. He said, no, he doesn't want that.

>> But then, he goes to Europe and they said, we are going to regulate you. And he says, okay, then I'm cutting you off.

Kabir Barday

>> The devil's in the details on, regulate what and how?

>> Correct.

Kabir Barday

>> Exactly.

>> But, the takeaway is that we're getting more regulations or enforcement actions around privacy, and that is something, that's the core of what you guys do.

Kabir Barday

>> That's core of what we do. Risk compliance, collect data in a compliant way, manage your compliance and risk programs, and then use data in a compliant way. That's the core of what we do.

>> Well, listen, thanks so much for, and you're speaking here at the conference, is that right?

Kabir Barday

>> Right after this.

>> Did you just summarize your talk?

Kabir Barday

>> Yeah, responsible use of data in AI. This is a new architecture that's being built.

>> Fantastic. Love it. Kabir, thanks so much for coming on theCUBE.

>> Thank you so much.

Kabir Barday

>> Thank you. Thanks for having me. Thanks, Sanjeev.

>> Great to see you, man.

Kabir Barday

>> Excellent.

>> All right, keep it right there everybody. Sanjeev Mohan, Dave Vellante. We'll be back right after this short break. You're watching theCUBE's coverage CDOIQ from Cambridge, Massachusetts. Be right back.