Sanjay Poonen, Cohesity

Clips
More from The AI Security Summit 2025

Sanjay Poonen

President & CEO

Cohesity

Where data meets defense: How AI is rewriting the rules of cybersecurity

The intersection of data, artificial intelligence and security is reshaping the enterprise landscape.Cohesity’s Sanjay Poonen unpacks the intersection of AI and cybersecurity with theCUBE.As generative and agentic AI redefine automation, enterprises grapple with the challenge of turning massive, unclassified data stores into actionable intelligence in a secure manner. From the evolution of regulatory frameworks to the rise of sovereign clouds and hybrid computing, Cohesity Inc. is positioning itself at the forefront of AI-powered data protection and developer security

play_circle_outline Welcome to the AI Security Summit featuring Sanjay Poonen, CEO of Cohesity.

play_circle_outline Sanjay's background includes leadership roles at SAP and VMware, focusing on security and cloud.

play_circle_outline Unlocking Future Opportunities: AI-Driven Insights and Collaborative Cybersecurity Innovations from Cohesity and NVIDIA

Info
Transcript

Sanjay Poonen, Cohesity

Sanjay Poonen

President & CEO Cohesity

At The AI Security Summit in San Francisco, theCUBE’s Jackie McGuire sits down with Sanjay Poonen, chief executive officer & president of Cohesity and member of Snyk’s board of directors, to unpack how data security and AI intersect inside highly regulated enterprises. Poonen traces his journey across SAP and VMware to his current focus at Cohesity, where the company protects massive volumes of enterprise data and applies strict role-based access controls to enable trustworthy AI (think: search, summarize and analyze without hallucinations). He explains why a... Read more

explore Keep Exploring

What is Sanjay Poonen's professional background and career journey? add

What is your current role and your experience in the technology industry? add

What is Cohesity's focus in relation to data protection and insights? add

bolt Powered by CUBE AI

Sanjay Poonen, Cohesity

Jackie McGuire

>> Hello CUBE community. Welcome back to San Francisco, California. We're here for the AI Security Summit with Snyk, an AI Engineer. This is Jackie McGuire. I'm your practice lead and principal analyst for security at theCUBE, and I'm lucky enough to be joined by Sanjay Poonen. Welcome, Sanjay.

Sanjay Poonen

>> Thank you, Jackie. Thanks for having me here.

Jackie McGuire

>> You wear many hats, but I think the biggest one is you are CEO and president of Cohesity, right?

Sanjay Poonen

>> Yes.

Jackie McGuire

>> But we were talking before we started filming, and you have had quite an interesting journey. So take us all the way back. You were talking about how you... I think you've been on theCUBE more than most of our guests. We probably owe you some type of gold jacket or something at this point.

Sanjay Poonen

>> No, I owe you guys.

Jackie McGuire

>> But you were saying that you've worked at SAP, worked at a whole bunch of different places. So can you tell us a little bit about your background and how you got to where you are today?

Sanjay Poonen

>> Yeah. No, I'm currently CEO and president of Cohesity. I'm also the board of directors of Snyk. So I have, a very special connection to this company that we're at the conference of. My most relevant, I've been 25, 30 years in tech, but probably the most relevant is I was president of SAP and that's where I first met theCUBE, John and Dave as they were small out for doing incredible content, going deep on topics at SAP, and then I was COO at VMware and both those, I was very fortunate to help practically double the revenue of those companies as the company grew from 10 to 20 billion at SAP and from six to 12 billion at VMware. And most of my work has been at the junction of cloud security and AI. VMware was all sort of in the private cloud, public cloud journey. And a lot of what I also did there was security and then the work at SAP was all around analytics. At that time, we may have called it predictive analytics, but it's all sort of AI and that's kind of where I find myself at the junction off now at Cohesity.

Jackie McGuire

>> Yeah. We were saying earlier that you're a data guy and what you're thinking about and I think in this whole wave of age, Agentic AI, one of the things that's become really apparent is that to me, Agentic AI is kind of automation on steroids. It can do a lot of other things, but one of the most basic capabilities is to automate things. And I think one of the reasons we haven't automated many things in the enterprise thus far is that we've kind of got a data problem. So by designer default, most enterprises are sitting on mountains of data. Lots of it's unclassified, lots of it's in these, we call them data swamps. So how do you think about that and how data within an enterprise has evolved and what are you hearing right now in the market in terms of what the most pressing needs for enterprise data are?

Sanjay Poonen

>> Yeah. I just got done giving a little keynote on that upstairs at the CISO track here at this conference. Just a few highlights of that. I mean, I sort of joked there's a saying "In God we trust." I kind of add to that, "In God we trust, but everyone else brings data. Maybe everyone else brings secure data, especially in the context of AI-generated data. I think listen, in the enterprise, we get the opportunity to work with data that's a little more confined because it's not... I mean, the mission statement of Google is to organize the world's data. That's a large universe of data, in the enterprise, your data is a little more confined to what you store, what you collect, and in some cases, even if you collect a large amount of data, it's not the world's data, some subset of it. And you can apply algorithms like retrieval of went to generation a lot more easily to a confined set. But you also have to have a lot higher security governance practices to ensure that the wrong guys aren't getting the data. In the enterprise, you also have to have role-based access controls. I mean, I'm the CEO of Cohesity, but I can't search somebody else's data. My legal team can do e-discovery of anybody's data during an investigation, but I should be allowed to search my data with ease and freedom all the way back to when any of the oldest documents are, or maybe someone who takes my role or whatever in the future. But you have to have very strict roles-based access controls to ensure the wrong people aren't searching, summarizing, and that if you're going to do summarization, which is a lot of what ChatGPT and these LLMs do, you got to make sure it's not hallucinating and getting the wrong summarization because you could make business decisions then that are wrong. So all of these lead to a fantastic, I think, canvas of how companies that are focused on security and AI data, that's what we do. We're an AI-powered data security company. We're the leader in our category. We obsess about understanding where this world is going, work closely. We have 13,000 customers and some of our customers are the largest, for example, in banks. We work closely with them to understand where this is going and we've designed a platform to meet their needs.

Jackie McGuire

>> So how do you think about, especially talking about banks and large companies, the business model, or I should say the regulatory model for a lot of these industries is very much old school. So I come from investments where any conversation you have with a customer, you have to retain those records for seven years. And I always use Medicare as an example. Medicare, you have to retain 10 years from date of service, all of those records. So as agents are stepping in and starting to do some of this work and they're generating lots of logs, I always think about this, you really don't have to log 90% to use an arbitrary number of what humans do at work, but with agents, it's much different. Agents are spitting off these logs constantly. So how do you see regulations changing and evolving as we go forward to help try to get the arms around the new way that people are going to be interacting with companies? It's not necessarily through a human who can be held accountable for compliance.

Sanjay Poonen

>> Yeah, I think if you start with some of the collaboration applications that we use the most, email, Slack, messaging applications in the consumer world, Snapchat deletes it right after you died or whatever have you, could have self-deleting emails. Different organizations have different regulatory requirements from the government to how long you need to keep email and messaging. In certain very regulated industries like banking, that needs to be left forever, but companies that don't have regulations may decide to delete an email after a year. It saves them costs. It also saves them the legal liability risk. If they're not required to do it, delete them. Now, if a person wants to save those emails, you can go and ask for special policy to save those emails or documents. That's separate. But the natural policy might be to delete. Now that only works for companies where regulation is high. I think you can apply that same thing to AI. So if you've got AI that's transcribing a meeting, those documents of a Zoom session or whatever, follow the same policy as someone who's taking notes from that meeting or the email minutes or the chat log of that meeting. So I think you kind of go application by application and ask yourself, what does the regulators let you do that you can get away with not having to store that much data? Now, storage is less so the issue in terms of cost. Cold storage is getting cheaper. It's getting easier to both store and access. So we are always on the side of hopefully less regulation because I think it actually helps freer information, freedom of speech, all those kinds of things allow less regulation. But because of regulatory pressures to keep certain industries like banking, telecommunications, public sector, certain agencies safe from corruption, those rules exist for good reason. The other thing that's happening in the regulatory world is there are certain requirements that governments are not having in certain countries. For example, in Europe, they have this regulation called DORA, requires data to stay in the country, and we think there's going to be a lot more sovereign cloud requirements that force... I mean whether you like or don't like tariffs, it is waking up the rest of the world out of the US to say we need to have our own sovereign cloud where we store the data on-prem and we think that that's going to lead to a federation of sovereign clouds in the top whatever, 10, 15, 20, 50 different countries to the extent that country can afford to build that infrastructure stack out there, or they work with a service provider or a cloud service provider to do that. That's also going to be another place where you have to deal with this sort of notion of how long you keep the data and where you keep it.

Jackie McGuire

>> Yeah. I agree that less regulation or at least appropriate regulation that's based in reality that exists today, not the last banking crash from 15 years ago is great. But I think what we've started to see is federal regulations have pulled back, some states have stepped up, and that's almost created a worse situation where now to your point, there's a different privacy rule in California than there is in Oregon and there is in Michigan. And so we're not only having to consider country sovereignty in terms of data, but also now state-by-state privacy regulations. So some clarity there at least would be nice.

Sanjay Poonen

>> This is the nature of being a federal system of union states. Any democracy's going to wrestle with that. I grew up in India. Now I'm sitting in the United States last 25 years. But any democracy that's large is going to have to deal with the yin and the yang, the pendulum swing of center versus states. How do you ensure that a large country, 300 million plus in the US, a billion plus in India, I think that's the joys of being a democracy. I'm a big believer in long-term, the democratic organizations will figure that out. I think the power does sit as best as possible in the local communities, states first, federal second. That's what I love about the United States and how we're built from constitutional perspective. I mean the good news, we should debate these things. We should debate them in the local context of where we are in the national level. There are super smart people in the United States on all fronts, whether it's security, whether it's AI, whether it's cloud. And I think in general, the business communities, I talk to them, many of them CEOs, friends of mine I've known for years, we may compete in certain areas, but there is a constant consensus to do what's good for the better of humanity, the better of tech as general, and that's made the United States one of the greatest countries for tech, I meant.

Jackie McGuire

>> Yeah. I agree. And I think one of the things that's great is that AI and machine learning and the ability we have now to kind of capture and understand data, I think we have an opportunity to replace some of the regulation we've needed with transparency. So coming from investments, one of the reasons we had to retain those records is because it wasn't always transparent to customers what's going on in the background. So if something happens they don't like, we have to pull all this documentation out. But I think right now we probably have an opportunity to enable them to access that information. I mean, we can make information available to end users at a way we never could before. So maybe transparency is one of the things that helps kind of supplant regulation and that if you know what's going on, you can see what's going on, maybe you don't need to retain as much information for litigation purposes.

Sanjay Poonen

>> Yeah. I mean, listen, our focus at Cohesity is to protect, secure and provide insights into the world's data. We have hundreds of exabytes of data we protect, but once we protected that data, the most important thing is then unlocking that data for insights. So we've been working with NVIDIA to build out a generative AI application guide that's not really getting a lot of interest from our customers. It essentially allows you to search, summarize, and analyze all that secondary backup data and primary data in one place. So it's an incredible AI application. So those types of AI use cases I think are going to help break through the way in which you get both transparency in data, but work in a regulated fashion.

Jackie McGuire

>> Yeah. Absolutely. So we'll start with Cohesity. What do you think your biggest challenge over the next year is going to be and what are the biggest opportunities you see at Cohesity to help your customers?

Sanjay Poonen

>> Well, listen, we have no dearth of great customers. We're 13,000 customers and the biggest, largest brands in five key verticals, but there's probably 10 verticals all together are our customers. So I could fill my road map of just these customer advisory boards that we have. So you take, for example, the largest banks work with us. They've got a list of they want us to do, and I don't have enough engineers to get it all done. Even if I have AI robots helping us drive some of that, that's our biggest vertical. Public sector is our second. Third, our tech companies. Some of the largest tech brands are our customers. Healthcare and Telco are the five. But then you can get to other industries like manufacturing, retail, but we take those top five, they all have very interesting nuances like healthcare. It's everything from payers, providers to farmers, incredible what they want us to do in the world of data, securing that data and providing AI on that data for all workloads. So one of the things that's been kind of big opportunity for us, we have a five-step cyber resilience framework, which starts off with saying ensure that every workload is protected, building out workload connectors and ability to protect that requires a lot of ingenious, but also a lot of brute force. We have the largest set of those and we got to constantly work to expand those. The second thing we talk about in that framework is ensuring that you have three copies of your data. The third one being cyber vaulted. So the beauty of this is if you work very closely with your customers, they will push you to some of the innovative things. We were the first to drive a zero trust security platform 12 years ago in 2013. We were the first to kind of drive an AI initiative within NVIDIA in the last two years. So you kind of want to be the first. You'll never be the first and only, but you want to then be the first and best at doing these things. And I like the fact that in our industry, even though it's competitive, we have honorable competitors, but we're number one in share, and certainly among the enterprise world, we're very and the other piece for me that's very gratifying about where we are at Cohesity is we protect about 200 exabytes of the world's data. And that's probably four or five times all of our competitors combined. And that gives us a real vantage view into scale of how big these systems need to be if you want to cover the world of where security and AI is going.

Jackie McGuire

>> Yeah. So one of the things that I've been talking about with a lot of leaders the last several months is this kind of return to hybrid computing, this concept that maybe we shouldn't be paying to ingest petabytes and then egress petabytes and send them between services. So do you see that as an opportunity as well in terms of being able to help coordinate on the on-prem piece and the cloud piece?

Sanjay Poonen

>> Yeah. I think we were talking about this before the show started. I think the concept of charging money to egress data, it's like Hotel California. You can't have a structure where you can check in where you can never check out. I think the cloud companies are getting that. If you look at the modern... I've seen them all change their policies on egress. That was 10 years ago. It's old school. I think everyone's kind of getting the memo like, "Hey, listen, we have ingress too." But you also, even if your egress was cheap, there's bandwidth issues. You can't just take zettabytes of data in and out of the cloud. There's network, there's cables, you got a fiber you got to worry about. So you clearly want to have a tiering structure. And if your data really needs to be very local to AI algorithms, keep it on-prem or I mean all the clouds vendors now have on-prem. AWS has Outposts and Azure has Azure Local. There's ways Oracle has Oracle-like customer. There's ways by which you get the best of hybrid even among... The other thing phenomenal I think that's going to change some of this is the sovereign cloud phenomenon. If you go outside the US, there's a tremendous disposition now. I sort of sense that little bit of VMware, but then the public cloud wave took off so far. But now I think what's happening in the world of tariffs and people adjusting to nationalistic considerations for each of their countries is they want to build sovereign clouds. And I think-

Jackie McGuire

>> In open source, right? Your own net, that's a really interesting-

Sanjay Poonen

>> They could all drive it and they want local nationals owning and driving those clouds. France needs to have a sovereign cloud owned and driven and managed by French people. And the same in Germany and UK and Italy and whatever in Europe. And then you go to Middle East and Japan and Australia and Singapore. So I don't know what it will result in, what is the number of countries in the world, 170, but at least the top 15, 25 GDPs will have enough money to invest in sovereign clouds. And those will also have its requirements in ingress, egress data. Will it even be a public cloud that does that sovereign cloud or will it be a local service provider? Because the service provider could be telcos, that could be service providers who are very good at cloud computing. So it's not clear to me that all of it are going to be public clouds that own the sovereign cloud game outside the US, in the US, and the public clouds have a very strong position. And even there, if you'd asked me 15 years ago or 12 years ago when I started at VMware, who are the public clouds that matters was Microsoft and Amazon. But now it's AWS, Microsoft, Google, and Oracle. All four. And they're all vying for strong positions with very competitive stacks. And so I think if you're a customer or developer, it's a good time. You get to play these four off each other.

Jackie McGuire

>> Oh, yeah. Absolutely.

Sanjay Poonen

>> I mean, multi cloud is here to stay. Clearly AWS is number one. They've got a lot of things that they're doing the best of anybody, but there are other things that other clouds are doing also in nuance. Google's coming on really strong in AI. Microsoft's got Office 365, they've got email applications. Oracle's got still a lot of Oracle databases that need to run in a cloud. So I think when you nuance this and you talk to customers, you get to see where they're deploying these cloud technologies, where they're deploying LLMs, and what we've tried to do at Cohesity is really follow where our customers are going.

Jackie McGuire

>> Yeah. Last question. You're on the board of directors for Snyk. So I guess now the same question for Snyk. What are you really excited about for Snyk for the next year? Where do you see their biggest opportunities?

Sanjay Poonen

>> Well, one of the things that's exciting, which I think is smaller company like Cohesity, but it's extremely innovative and very similar to the early days of Cohesity. I mean, there's a founder and a founding team, but this is a developer. There's a developer and security story around this that is so much of a learning experience. You go to the room here with all the developers here. It's not the audience I talk to, but I want to know what is on top of mind because I have developers in my company and many of the large banks who are customers of Snyk, there's tens of thousands. One bank told me there are 40,000 people that are now the scale of that problem. And where does AI driven co-development, whether they're using GitHub Copilot or Cursor, where does Snyk fit into that? So I've been really impressed. Peter Bocquet has been a friend of mine. We acquired his company at VMware and he worked for me there. And I love him and his team here. Many of the people are people I've known for years. I've been a big fan of tech and obviously I have a vested interest and I'm a cheerleader. At the board, you don't run the company, but you oversee and you really want to cheer lead their success. So I'm very proud of what the team's done, but what I've liked about it most is the traction they're getting from these enterprise customers, big, big brands, and the incredible buzz I hear about them from developers.

Jackie McGuire

>> Awesome. Well, Sanjay, thank you so much for joining us today. Really happy we could make this happen.

Sanjay Poonen

>> Thank you so much.

Jackie McGuire

>> Thanks. For theCUBE, I'm Jackie McGuire. We've got more news and analysis from the AI Security Summit in San Francisco, California. Stay tuned.