theCUBE & NYSE @RSA 2024 | Anand Kashyap | Fortanix

theCUBE.net

Clips
More from theCUBE & NYSE @RSA 2024

Speakers

Anand Kashyap

Co-founder, CEO

Fortanix

play_circle_outline Anand Kashyap, CEO and Co-founder of Fortanix, discusses the company and its mission

Info

Anand Kashyap | Fortanix

Anand Kashyap

Co-founder, CEO Fortanix

search

>> Hey, welcome back to theCUBE After Dark. Come on in theCUBE After Dark, we're going wall to wall coverage here at RSAC 2024. My name is Dave Vellante. We love doing these meetups. We're here with NYSE. TheCUBE is co-sponsoring with Elastic Intel, Intel Capital, and Open Policy. Really excited to have Anand Kashyap here. He's the CEO and Co-founder of Fortanix. Good to see you, man. Thanks for coming to theCUBE.

Anand Kashyap

>> Thanks for having me.

>> Why did you start the company, Fortanix?

Anand Kashyap

>> You know, I used to work at Fortanix... Sorry. I used to work at Symantec, and Symantec was the leading security company at that time. And what I saw that we are fighting a war against the bad guys who were always winning. And the prevailing attitude was, can we raise the bar? It was not about can we stop the cyber attacks altogether. I looked at it and thought, can we do something better? There were new technological advances happening at that time. There was hardware-based security that was coming out, and hardware, as you know, was more immutable and software. So, we could use hardware to secure software in the cloud, then it'll be much more powerful. And that was the insight where we started using hardware to secure data in the cloud.

>> Okay. So, you're all about securing data, but you're hardware first, Fortanix, fort like strong.

Anand Kashyap

>> Yes.

>> Right? Tell me about the name. How'd you come up with the name?

Anand Kashyap

>> As you said, it's fort, like security. There were a lot of security companies which end with N-I-X or anix. Nutanix is a good name. And we said fort, like security, so let's use Fortanix.

>> Love it. Tell me about your product.

Anand Kashyap

>> So, we are a data security company. Our part is called Data Security Manager, and what it does is it protects data using encryption, key management, and all of that is built on top of a confidential computing technology. Confidential computing is when you use hardware to execution environment and all the data and software runs inside that environment. And that is what we have been doing.

>> So, it's a appliance, a virtual appliance? What is it?

Anand Kashyap

>> We have both, and we have a SAS as well. We have an appliance and we are setting into regulated environments where you need to get certain level of certification. So, we have FIPS 140-2 Level 3, you can only get that through an appliance, but then we also have a virtual appliance version. We also have a SAS version where we take our appliance deployed across 18 data centers around the world. And that is how we have created our SAS.

>> So, your SAS version is what? Software defined Fortanix? Is that what it is?

Anand Kashyap

>> You can say that, yeah-

>> But I don't have to install anything, you said.

Anand Kashyap

>> You don't have to install anything. You sign up, you get an API key, you start encrypting your data right away.

>> And where does the code and the system live? It's in the cloud, I can put it on-prem as well with the appliance?

Anand Kashyap

>> You can. So, appliance you can buy, you can run it in your own data centers in your own environment. SAS is running on our appliance, but in data centers around the world. So, think of it like a cloud, pure play cloud. You just sign up and start using it.

>> When did you start the company?

Anand Kashyap

>> 2016.

>> 2016?

Anand Kashyap

>> Yes.

>> Wow. So you're dealing with a very challenging technical problem building on top of confidential computing, which was just kind of emerging as a category at the time. So, what was the technical challenge of getting your product to market?

Anand Kashyap

>> The funny thing is when we started, the term confidential computing didn't even exist.

>> Right. Yeah, exactly.

Anand Kashyap

>> We used to describe it as we secure data, data in motion, and now we are securing data in use. Later on, the industry standardized the word or the phrase confidential computing, and now everybody knows what it is. But the challenge initially was availability. It was hardly available. Only Intel was the only chip, which had confidential computing and Microsoft Azure was the first cloud to have it. But over time it has improved. There's more availability across different chip vendors, more on different cloud as well. So, now it's much easier to go and deploy something in confidential computing.

>> Yeah, I mean, all the cloud vendors have it, but Intel has it. ARM obviously has announced. Okay. So, where are you in your cycle? Are you scaling?

Anand Kashyap

>> We are in scale mode, yeah. We have raised multiple rounds of funding. We did a series C a couple of years ago and right now we are at a stage where we are scaling. We are developing some business while we are developing the product as well. We are looking at some major industry trends like post-quantum computing, post-quantum photography. That's one of our focus areas. The other focus area for us is AI. Just like everyone, AI is a big trend and confidential computing has the potential to really, really create secure AI and we are looking at that as well.

>> How much money did you raise?

Anand Kashyap

>> So far, we have raised $120 million and the last round was $90 million.

>> And what was that, series?

Anand Kashyap

>> Series C.

>> Series C.

Anand Kashyap

>> Yeah.

>> Okay. So you're there. You've got product market fit.

Anand Kashyap

>> Yeah.

>> You're a scale and go to market. Tell me about some customers. What's the typical customer for you? Is it an enterprise? Is it somebody in between, a service provider?

Anand Kashyap

>> Our focus is on enterprise and we generally sell into three major categories of customers. Financial services, large banks. A lot of large banks are our customers. Healthcare is the other one. And then the third is public sector government. As you can see, all these three sectors value their data a lot. So, wherever data sensitivity, data security is very important, we are applicable over there.

>> So they have data, a lot of data on-prem. They have data in the cloud. How are they deploying your solutions? Is it a mix? Do they mostly do it in the cloud? They mostly do it on-prem?

Anand Kashyap

>> One of our customers said with Fortanix, they want to encrypt anywhere, decrypt anywhere. So, it doesn't matter where data goes, on-prem, cloud, SAS, they want to be able to use Fortanix, encrypt their data wherever they want, wherever they can, decrypt wherever. So, with our products, since it's available on-prem, it's available as SAS, it's available as a virtual appliance. You can really encrypt your data wherever you want, decrypt wherever you want.

>> And what's your AI play? Is it a situation where now AI has expanded the threat surface and created new attack vectors that you can protect? Explain that.

Anand Kashyap

>> I think what you're describing is using AI to improve security tools. What we are doing is the opposite of that. We are building security for AI, not AI for security, which means we are securing the AI deployment itself. Enterprises are very concerned about their data, leaking their environment, going to OpenAI, going to Microsoft, going to Google, and they don't really trust all these external parties. They want to make sure that even if the data gets used by external services, external places, they are still in control of the data. They can manage the security and privacy of their data. So, we are building security for AI.

>> What's unique about securing AI that is new that people should know about? What's different?

Anand Kashyap

>> There's a combination of things. It is not one single thing, but having a confidential computing-based platform on which AI runs, that itself gives its confidentiality, it gives its tamper-proof or integrity protection. And then on top of that, there has to be a control and policy layer that goes on top. Then you can get interesting enterprise features like role-based access control. You can get data loss prevention, things like that. So, a combination of the control layer and the bottom confidential computing layer makes it more unique.

>> We've talked a lot about confidential computing, but we really haven't explained what it is. Maybe for those that don't know what it is, essentially you're talking about fencing off access to certain components from anything that shouldn't have access, including the cloud vendor, including the virtual machines. Anything. Explain?

Anand Kashyap

>> Yeah. To me, confidential computing is very simple. It provides two basic security primitives. It gives you confidentiality or privacy. Anything that runs inside that trusted execution environment, which forms a confidential computing is private. Nobody can look at it. Your route user cannot look at it. Your cloud provider cannot use it, look at it, your service provider cannot look into it. That's important. The second important security primitive that confidential computing provides is integrity protection. Now if somebody tries to modify the code that is running inside the trusted execution environment, you can detect that. There's attestation. You can sit outside and see, using remote attestation, you can figure out, "Oh, the code has been modified, it's not the right code. You can't use it anymore." And that is a very strong primitive. The combination of confidentiality and integrity makes it so unique and very interesting.

>> Excellent. Thank you for that. What are your top priorities in the next 12 months? What should we be watching for in terms of indicators of you guys executing?

Anand Kashyap

>> At RSA, we just announced a new product that we call Key Insight. Key Insight has a capability to go in the cloud, scan for keys, encryption keys, scan for all the services that are there in the cloud and see how they're using those keys. So, now you have an inventory of how the encryption is being used inside your cloud environment. This is very powerful. A CISO wants to know what's going on and they want to use it for getting ready for post-quantum world, when PQC algorithms need to be deployed as the quantum computers come and they break traditional cryptography. So, we are very excited about that. In this RSA, we are demonstrating that in our booth.

>> It's quite a show, isn't it?

Anand Kashyap

>> It is. Absolutely.

>> Have you been to a number of them?

Anand Kashyap

>> Yeah, I've been coming here many years.

>> Yeah, of course. With your background at Symantec.

Anand Kashyap

>> Yes.

>> Anand, thanks so much for coming to theCUBE. Appreciate it.

Anand Kashyap

>> Sure. Thank you.

>> Good luck with everything.

Anand Kashyap

>> All right.

>> All right. Thank you for watching. Keep it right there. This is Dave Vellante and we're here at Lamar, part of RSAC. We're here with the NYSC and some of our other partners. Keep it right there. More action from theCUBE After Dark. We'll be right back.

Anand Kashyap | Fortanix

search

>> Hey, welcome back to theCUBE After Dark. Come on in theCUBE After Dark, we're going wall to wall coverage here at RSAC 2024. My name is Dave Vellante. We love doing these meetups. We're here with NYSE. TheCUBE is co-sponsoring with Elastic Intel, Intel Capital, and Open Policy. Really excited to have Anand Kashyap here. He's the CEO and Co-founder of Fortanix. Good to see you, man. Thanks for coming to theCUBE.

Anand Kashyap

>> Thanks for having me.

>> Why did you start the company, Fortanix?

Anand Kashyap

>> You know, I used to work at Fortanix... Sorry. I used to work at Symantec, and Symantec was the leading security company at that time. And what I saw that we are fighting a war against the bad guys who were always winning. And the prevailing attitude was, can we raise the bar? It was not about can we stop the cyber attacks altogether. I looked at it and thought, can we do something better? There were new technological advances happening at that time. There was hardware-based security that was coming out, and hardware, as you know, was more immutable and software. So, we could use hardware to secure software in the cloud, then it'll be much more powerful. And that was the insight where we started using hardware to secure data in the cloud.

>> Okay. So, you're all about securing data, but you're hardware first, Fortanix, fort like strong.

Anand Kashyap

>> Yes.

>> Right? Tell me about the name. How'd you come up with the name?

Anand Kashyap

>> As you said, it's fort, like security. There were a lot of security companies which end with N-I-X or anix. Nutanix is a good name. And we said fort, like security, so let's use Fortanix.

>> Love it. Tell me about your product.

Anand Kashyap

>> So, we are a data security company. Our part is called Data Security Manager, and what it does is it protects data using encryption, key management, and all of that is built on top of a confidential computing technology. Confidential computing is when you use hardware to execution environment and all the data and software runs inside that environment. And that is what we have been doing.

>> So, it's a appliance, a virtual appliance? What is it?

Anand Kashyap

>> We have both, and we have a SAS as well. We have an appliance and we are setting into regulated environments where you need to get certain level of certification. So, we have FIPS 140-2 Level 3, you can only get that through an appliance, but then we also have a virtual appliance version. We also have a SAS version where we take our appliance deployed across 18 data centers around the world. And that is how we have created our SAS.

>> So, your SAS version is what? Software defined Fortanix? Is that what it is?

Anand Kashyap

>> You can say that, yeah-

>> But I don't have to install anything, you said.

Anand Kashyap

>> You don't have to install anything. You sign up, you get an API key, you start encrypting your data right away.

>> And where does the code and the system live? It's in the cloud, I can put it on-prem as well with the appliance?

Anand Kashyap

>> You can. So, appliance you can buy, you can run it in your own data centers in your own environment. SAS is running on our appliance, but in data centers around the world. So, think of it like a cloud, pure play cloud. You just sign up and start using it.

>> When did you start the company?

Anand Kashyap

>> 2016.

>> 2016?

Anand Kashyap

>> Yes.

>> Wow. So you're dealing with a very challenging technical problem building on top of confidential computing, which was just kind of emerging as a category at the time. So, what was the technical challenge of getting your product to market?

Anand Kashyap

>> The funny thing is when we started, the term confidential computing didn't even exist.

>> Right. Yeah, exactly.

Anand Kashyap

>> We used to describe it as we secure data, data in motion, and now we are securing data in use. Later on, the industry standardized the word or the phrase confidential computing, and now everybody knows what it is. But the challenge initially was availability. It was hardly available. Only Intel was the only chip, which had confidential computing and Microsoft Azure was the first cloud to have it. But over time it has improved. There's more availability across different chip vendors, more on different cloud as well. So, now it's much easier to go and deploy something in confidential computing.

>> Yeah, I mean, all the cloud vendors have it, but Intel has it. ARM obviously has announced. Okay. So, where are you in your cycle? Are you scaling?

Anand Kashyap

>> We are in scale mode, yeah. We have raised multiple rounds of funding. We did a series C a couple of years ago and right now we are at a stage where we are scaling. We are developing some business while we are developing the product as well. We are looking at some major industry trends like post-quantum computing, post-quantum photography. That's one of our focus areas. The other focus area for us is AI. Just like everyone, AI is a big trend and confidential computing has the potential to really, really create secure AI and we are looking at that as well.

>> How much money did you raise?

Anand Kashyap

>> So far, we have raised $120 million and the last round was $90 million.

>> And what was that, series?

Anand Kashyap

>> Series C.

>> Series C.

Anand Kashyap

>> Yeah.

>> Okay. So you're there. You've got product market fit.

Anand Kashyap

>> Yeah.

>> You're a scale and go to market. Tell me about some customers. What's the typical customer for you? Is it an enterprise? Is it somebody in between, a service provider?

Anand Kashyap

>> Our focus is on enterprise and we generally sell into three major categories of customers. Financial services, large banks. A lot of large banks are our customers. Healthcare is the other one. And then the third is public sector government. As you can see, all these three sectors value their data a lot. So, wherever data sensitivity, data security is very important, we are applicable over there.

>> So they have data, a lot of data on-prem. They have data in the cloud. How are they deploying your solutions? Is it a mix? Do they mostly do it in the cloud? They mostly do it on-prem?

Anand Kashyap

>> One of our customers said with Fortanix, they want to encrypt anywhere, decrypt anywhere. So, it doesn't matter where data goes, on-prem, cloud, SAS, they want to be able to use Fortanix, encrypt their data wherever they want, wherever they can, decrypt wherever. So, with our products, since it's available on-prem, it's available as SAS, it's available as a virtual appliance. You can really encrypt your data wherever you want, decrypt wherever you want.

>> And what's your AI play? Is it a situation where now AI has expanded the threat surface and created new attack vectors that you can protect? Explain that.

Anand Kashyap

>> I think what you're describing is using AI to improve security tools. What we are doing is the opposite of that. We are building security for AI, not AI for security, which means we are securing the AI deployment itself. Enterprises are very concerned about their data, leaking their environment, going to OpenAI, going to Microsoft, going to Google, and they don't really trust all these external parties. They want to make sure that even if the data gets used by external services, external places, they are still in control of the data. They can manage the security and privacy of their data. So, we are building security for AI.

>> What's unique about securing AI that is new that people should know about? What's different?

Anand Kashyap

>> There's a combination of things. It is not one single thing, but having a confidential computing-based platform on which AI runs, that itself gives its confidentiality, it gives its tamper-proof or integrity protection. And then on top of that, there has to be a control and policy layer that goes on top. Then you can get interesting enterprise features like role-based access control. You can get data loss prevention, things like that. So, a combination of the control layer and the bottom confidential computing layer makes it more unique.

>> We've talked a lot about confidential computing, but we really haven't explained what it is. Maybe for those that don't know what it is, essentially you're talking about fencing off access to certain components from anything that shouldn't have access, including the cloud vendor, including the virtual machines. Anything. Explain?

Anand Kashyap

>> Yeah. To me, confidential computing is very simple. It provides two basic security primitives. It gives you confidentiality or privacy. Anything that runs inside that trusted execution environment, which forms a confidential computing is private. Nobody can look at it. Your route user cannot look at it. Your cloud provider cannot use it, look at it, your service provider cannot look into it. That's important. The second important security primitive that confidential computing provides is integrity protection. Now if somebody tries to modify the code that is running inside the trusted execution environment, you can detect that. There's attestation. You can sit outside and see, using remote attestation, you can figure out, "Oh, the code has been modified, it's not the right code. You can't use it anymore." And that is a very strong primitive. The combination of confidentiality and integrity makes it so unique and very interesting.

>> Excellent. Thank you for that. What are your top priorities in the next 12 months? What should we be watching for in terms of indicators of you guys executing?

Anand Kashyap

>> At RSA, we just announced a new product that we call Key Insight. Key Insight has a capability to go in the cloud, scan for keys, encryption keys, scan for all the services that are there in the cloud and see how they're using those keys. So, now you have an inventory of how the encryption is being used inside your cloud environment. This is very powerful. A CISO wants to know what's going on and they want to use it for getting ready for post-quantum world, when PQC algorithms need to be deployed as the quantum computers come and they break traditional cryptography. So, we are very excited about that. In this RSA, we are demonstrating that in our booth.

>> It's quite a show, isn't it?

Anand Kashyap

>> It is. Absolutely.

>> Have you been to a number of them?

Anand Kashyap

>> Yeah, I've been coming here many years.

>> Yeah, of course. With your background at Symantec.

Anand Kashyap

>> Yes.

>> Anand, thanks so much for coming to theCUBE. Appreciate it.

Anand Kashyap

>> Sure. Thank you.

>> Good luck with everything.

Anand Kashyap

>> All right.

>> All right. Thank you for watching. Keep it right there. This is Dave Vellante and we're here at Lamar, part of RSAC. We're here with the NYSC and some of our other partners. Keep it right there. More action from theCUBE After Dark. We'll be right back.