Kumar Saurabh: Building Sumo Logic, LogicHub, and AirMDR and why immigrants make great entrepreneurs
December 12, 2024 • 52 mins
In this episode, we sit down with Kumar Saurabh, CEO and co-founder of AirMDR, which provides a new approach to managed detection and response with an AI-powered virtual security analyst. A serial entrepreneur, Kumar has been at it for two decades. Before AirMDR, he co-founded Sumo Logic, the first cloud-based SIEM, and LogicHub, one of the pioneers of SOAR.
Kumar’s journey as an immigrant founder offers a unique perspective on why immigrants often succeed as entrepreneurs and how institutions like the Indian Institutes of Technology (IIT) have produced some of the world’s most successful tech leaders. Drawing on his experience, Kumar explores why large companies struggle to innovate, the competitive edge startups hold over established players, and how founders can identify opportunities in markets that may appear crowded. He also shares actionable insights for founders on hiring top talent from leading companies and scaling a startup with the right team.
Having collaborated with premier venture capital firms like Greylock, Sutter Hill, Sequoia, and Accel, Kumar provides invaluable advice on selecting the right VC partners, what to look for, and common mistakes to avoid. Kumar’s story is a testament to resilience, innovation, and the power of identifying opportunities in enterprise tech, making him a leading voice in the startup ecosystem.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Sid Trivedi (00:05):
Welcome to Inside the Network. I'm Sid Trivedi.
Ross Haleliuk (00:09):
I am Ross Haleliuk.
Mahendra Ramsinghani (00:11):
And I am Mahendra Ramsinghani. We have
spent decades building,investing, and researching
cybersecurity companies.
Sid Trivedi (00:20):
On this podcast, we invite you to join us inside the
network, where we bring the bestfounders, operators, and
investors building the future ofcyber.
Ross Haleliuk (00:32):
We will talk about the hard parts of the
founder journey, launchingcompanies, getting to product
market fit, raising capital, andscaling to an exit.
Mahendra Ramsinghani (00:43):
And, yes, we will also be talking about
epic failures.
Sid Trivedi (00:47):
But, Mahendra, we're here to make the founder
journey easier.
Mahendra Ramsinghani (00:50):
That is correct, Sid. But we cannot make
it too much easier becausestartups are hard. And, of
course, you already knew that.
Ross Haleliuk (00:58):
Alright, you two. Enough. Let's get started with
this week's episode.
Mahendra Ramsinghani (01:06):
Our guest today is Kumar Saurabh, a
remarkable innovator, a founder,and entrepreneur whose journey
almost took a different path. APhD, a potential academic
trapped in the hallowed halls ofsome educational institution.
But thankfully, instead, Kumarchose the road of being a
(01:27):
builder, entrepreneur, and afounder. And the cybersecurity
world is much better for it.Kumar's story begins at
ArcSight, one of the pioneeringcompanies in the SIEM space or
security information and eventmanagement.
Before it was even a category,Kumar joins as a software
engineer at this pre revenuecompany. And by the time
(01:49):
ArcSight goes public, he hasrisen to the director of
engineering. At ArcSight, Kumarled the co relations team, which
was the technological epicenterof the company developing
sophisticated filtering,prioritization, data mining, and
reporting engines. That wouldbecome the backbone of the
modern SIEM platforms. As thecloud computing wave began to
(02:13):
reshape the technologicallandscape, Kumar saw an
opportunity and co founded SumoLogic.
Serving as its chief technologyofficer and challenging the
traditional, clunky, on premsolutions. Sumo Logic was taking
the advantage of the cloudnative revolution, offering
instant deployment, elasticscalability, and zero
(02:36):
maintenance. Kumar was nowreimagining how businesses
approached data insights anddeployment of cybersecurity
offerings. Now in his latestchapter, Kumar is riding the AI
wave with AirMDR, his lateststartup. As a co founder, he's
on a mission to bring agentic AIinto the world of the SOC or the
(02:59):
security operations center,empowering analysts and bringing
AI driven innovations to MSSPsor Managed Security Service
Providers.
It's a bold vision that promisesto transform how we approach
cybersecurity. And in fulldisclosure, Foundation Capital
and I are investors in AirMDR.Across 2 decades of his
(03:22):
entrepreneurial adventures incybersecurity, Kumar has
accumulated a wealth ofinsights. He represents the rare
breed of a founder engineer whocan build products that scale,
adopting the latest technologyofferings and delivering
revenues as well as generatingfinancial returns. Today, we'll
dive deep into Kumar's journey,exploring his thinking, his
(03:44):
insights, and hisentrepreneurial spirit that
keeps defining a new innovativechapter with every wave.
Let us get started.
Sid Trivedi (03:55):
Welcome, Kumar, to Inside the Network.
Kumar Saurabh (03:57):
Thanks, Sid. Thanks for having me.
Sid Trivedi (03:59):
So we're gonna talk about a few different topics,
and let's start with yourimmigrant beginnings. You
studied computer science at IITKharagpur and graduated back in
1999. IIT alumni have gone on tofound some of the biggest
companies in Silicon Valley,from Zscaler to Sun to Nutanix
to Cohesity and many, many more.What makes this group of schools
(04:21):
such a hotbed for software andfounder talent?
Kumar Saurabh (04:24):
I think when I look back, 1st and foremost,
getting into IITs, when Igraduated, and this is probably
like 20, 24 years ago, therewere only 5 of them. Right? And
computer science batches arelike 50 people. So I don't know,
100 of thousands of peopleprobably applied to get in, and
so you have to kind of show upin the top 250 to get into
computer science. So so thefirst thing I would say is there
(04:47):
is a there is some I mean, theselection is not perfect, but
there is certainly, like, peoplewho are strong in, you know,
math, science, and engineering,things like that, getting to
that.
So there is a first levelfiltering effect right there
that comes in. There's a couplemore things I would say. Brand
is a big thing, right? So eventhough it's IITs or Indian
(05:08):
universities, they're actuallyvery well known all over the
world. Even in the UnitedStates, I benefited from that
all across.
The network is pretty strong,right? So when I started doing
startups, I had people who hadgraduated earlier than me that
were already doing startups,right? Like Bipul Sinha from
Rubrik or Anshu Sharma fromSkyflow, right? Both of these
(05:30):
people are ex IIT Kharagpurgraduates, right? I personally
knew them before I started thecompany, so you have a lot of
those role models or people whohave done this before, and one
of the less appreciated thingsabout it is being an IITian
gives me a certain kind offamiliarity in recruiting
talent, recruiting engineeringtalent, right?
(05:52):
So I can talk to any IITcomputer science grad, and there
is a little bit of like thatcommon background, that alumni
network. So over the years, Ihave found like it's far easier
for me to attract really highquality talent, maybe folks that
have gone through IT and thingslike that. So combination of all
of those effects does help in abig, big way, going to ITs and
(06:16):
graduating from there.
Sid Trivedi (06:17):
We had Slavik Markovich on before, the founder
of Dscope and Demisto. He talkeda lot about Unit 8200 in Israel.
Now that's a very that's not aschool. That's certainly a
military branch within the IDF.Would you say that IIT has kind
of similar value for foundersfrom India?
Kumar Saurabh (06:34):
I think IT is definitely have a broad I mean,
it may not be necessarily aroundcyber, but the quality of talent
is really pretty high. And yourun into IT grads, IT alumni in
a lot of different positions andthe alumni network does actually
help you quite a bit, right? SoI can reach out to even Ashu for
(06:57):
example at Foundation Capital,right? There are a lot of people
ex IIT graduates and there issomething to that alumni
network. People do help out.
Right? You can reach I getrandom emails or or LinkedIn,
people reach out and if theyhave gone to an IT, there is a
little bit it it rises above therest, and you reach out and you
try to help. And I have receivedthe same help multiple times in
(07:20):
my last 20 plus years.
Ross Haleliuk (07:21):
You moved to the US in 2000 to pursue a master's
degree at Columbia. Whatconvinced you to come here to
the States rather than build acareer in India?
Kumar Saurabh (07:31):
So believe it or not, when I was in undergrad, I
wanted to be a theoreticalcomputer scientist. Right? And I
wanted to do a PhD, right, whenyou are like 24 or pretty
idealistic, right? And one ofthe professors at MIT, his
student, Luca Travissant, whoactually went was a professor at
(07:52):
Columbia, went to Berkeley.Unfortunately, he passed away a
year or so ago.
I was his first PhD student. Sohe was looking for a PhD
student. He reached out, and Iwas delighted as anything
because I had looked at hisresearch papers, and they were
just, pretty awesome researchpapers. But after a year into
PhD, I realized that I'm on thewrong career track. I'll become
(08:13):
a professor if I keep doing whatI'm doing, and I like to build
things.
So a year or so after that, Ikind of dropped out. So it was
pretty much chasing that PhD intheoretical computer science is
why I first came to US. It wasonly after doing 1 year of PhD I
I kind of came to therealization that PhD is not
(08:33):
where my heart is, and my I am,like, an engineer, a computer
scientist. I like to buildthings. I like to use things
that I build, and,theoretically, computer science
was not very conducive for App.
Mahendra Ramsinghani (08:45):
Wonderful, Kumar. So you could have been
doctor Kumar, but you're Kumar,and we still love you for that.
From Columbia to Silicon Valley,that's one shift that has
occurred inside the UnitedStates. And then from India to
the US, that's a big shift.There is a theory about
immigrants being founders, beingscrappy, being hungry, and you
(09:06):
see it across the board.
What is it about immigrants thatmakes them the crazy ones?
Kumar Saurabh (09:11):
I think there are few things. Right? One of,
especially from India, Irealized that I had the PhD
offer, but I couldn't go for asemester because I didn't have
enough money, right? So it'slike starting a company and for
the first time founders, right,you have to find a way to start
something from nothing, right?And so I kind of worked for 6
months, saved up enough moneyfor the air flight for the 1st
(09:33):
month of expenses.
I'll tell you this, is theresourcefulness, right? Trying
to stretch the dollar, right?Trying to get more done with
less, right, is like whether youlook at many of the stories from
Jeff Bezos and whatnot, likefrugality and being able to do
more with less is a trade that'svery useful, especially if
you're going from 0 to 1, right,because the resources are
(09:56):
scarce. You still got to makeprogress. And I think that is
like a character trait thatpeople who immigrate,
especially, you know, let's sayfrom India or so where the
resources might not be thatmuch.
That's a big one. The fact thatyou leave a country that you
have spent 23 years and areready to enter a new country
where you probably don't knowanybody else, right, is another
(10:18):
character trait is you're readyto take a little bit of risk and
jump into the unknown with alittle bit of confidence that
you'll figure it out. Andstartup journeys are like that,
right? When you start a startupon the 1st day, you don't I
mean, you might have a plan,but, you know, the plan will
probably change along the way,but you still have to have the
confidence that you'll figurethings out along the way. And I
(10:40):
think these are some of thecommon traits that become very
handy when you're starting acompany, especially from from
scratch.
Mahendra Ramsinghani (10:47):
One quick follow-up to that, Kumar, is
that, you know, you make theleap to land here. There is also
this theory about the soil isnourishing. You know, if the
entrepreneur is the seed, thecommunity, the culture, the
legal framework, there are somany things about the United
States that makes it very highlysought after for entrepreneurs.
(11:08):
I mean, can you talk can youflip the script on the other
side to say what made you feelwelcome here, and how did you
find your way to the first phaseof your career?
Kumar Saurabh (11:17):
I think that that second bit is probably an even
bigger influence, I would say.Right? And and I think even the
difference between, I mean,nowadays New York has a very
thriving tech center and so onand so forth, right? But if I go
back in 2,001, there was amarked difference between, you
know, the tech scene in SiliconValley versus even New York at
that point, right? And the factthat I ended up at Series A
(11:40):
company, right, pretty much bychance, and to see that company
grow and, you know, working withhuge Zamanzi was the CTO, one of
the smartest people I know atthe ArcSight, right, To, I was a
kid straight out of school.
So the ability to work withpeople like that gives you the
confidence that you can actuallystep out and start your own
startup as well because you haveseen the movie once or twice,
(12:03):
right? So so I think that thatexperience, that opportunity to
be part of a startups I mean,nowadays, there are other parts
in the world where there is agood thriving startup community,
but I was extremely lucky tofind myself from New York to
Berkeley to back in Sunnyvale ata startup that was a pre
revenue, pre one o customer, andalmost, like, humongous amount
(12:25):
of luck. The company almost dieda year later, could not raise
series b. I had a tough timeraising series b, somehow
managed to scrap together a$5,000,000 series b. And then 8
years later goes IPO, and acouple of years later after
that, get acquired by HP.
And I think there are 5 or 6companies, today in cyberspace
that have come out fromexarchitect. And ArcSight was a
(12:47):
small team, relatively speaking.It was not the scale of Google.
So I think that opportunity tobe part of a start ups is a big
opportunity for founders.
Sid Trivedi (12:58):
You know, you talked a little bit about
ArcSight. And so let's let'sdive into your career. And
you've spent the last 20 years,Mark, really building software
for the security operationscenter. And and all of that
started at ArcSight, which youjoined after graduating from
Columbia. You're one of thefirst few employees there, and
ArcSight really helped to createthe SIEM or security information
(13:19):
and event management market.
That whole category was builtbecause of ArcSight. Why did you
join ArcSight, and what was itlike being in security 20 plus
years ago when everything wasnew, when SIEM didn't exist as a
category?
Kumar Saurabh (13:32):
So I think the reason I joined ArcSight, one, I
got lucky because we're goingthrough a downturn, and the big
company we're not hiring. Sothank God, HP and Sun were not
hiring because I wonder what mytrajectory would have been if I
had ended up at one of thosecompanies. Right? So I got
lucky. It's a blessing indisguise that it was going to a
market turn and happened to beVP of engineering at Arts had
(13:55):
reached out to me.
I put my resume on some job siteand within a week, right from
the day I put my resume on thejob site, I think I put it on
Sunday. On Tuesday, I got anemail saying, hey. Very
interested. Can we fill out thistechnical test? Six questions.
2 hours later, I turned aroundand sent they're like, oh, looks
good. Come by, interview onThursday. And on Friday, they
(14:16):
made a job offer, and I actuallyaccepted it on the spot. I
didn't even look at the second,3rd, or 4th company. So I just
love the people.
Like, I interviewed with HughJumanzi, couple of people, early
employees at Arts. Just love theteam and the problem that they
were solving, and I did not knowabout the cyber. So early days
(14:36):
of it was was just going tovarious science courses. Right?
So I took GCIH and GCIA backwhen to kind of educate, and our
side was very good in sponsoringthose and and training up its
employees.
Many of them had never been incyber before so that we can
start learning the basics ofcyber and start breathing and
(14:57):
living that life, right? So thatway, that was how it felt very
early on, and we're working withvery early customers in the
beginning. Intel was one of theearliest customers at ArcSight,
tremendous learning experience.And by the time ArcSight was at
version 3.0, it was a prettydarn strong product. And right
around that time, Gartner camearound and they started kind of
(15:19):
coining the term the SIEMsecurity, and then it became a
category.
And for the next 5 years fromthen, ArcSight almost, like, was
always, like, up and to theright on the Magic Quadrant for
a number of years.
Ross Haleliuk (15:30):
In 2010, together with your former ArcSight
colleague Christian Biedgen, youfounded Sumo Logic, the first
cloud based SIEM. What createdthis opportunity in the market,
and what advice do you have forfounders looking to identify
which existing categories areready to be disrupted?
Kumar Saurabh (15:49):
So I get I got very lucky. I mean, I I felt I
in last 21 years, I have felt ittwo times, and the second time
was just like a couple of yearsago. I remember very vividly
that Christian Bedgin and StefanZier was the chief architect at
Sumo, so he was literallyemployee number 3 after
Christian Nye. All 3 of us wentto a talk that Werner Vogels was
(16:11):
giving, and he was giving a talkabout this thing called Cloud
and how AWS do. There was acompany that, you know, you put
a bunch of, you know, picturestogether and they'll build a
video out of it, put some musicbehind it.
I even used that for my wedding.And they were running all in
Cloud, no Cloud, no on preminfrastructure. And the New York
Times took something that wouldhave taken $6,000,000 and one
(16:34):
software engineer because theycould scale it and run it on,
you know, 10,000 or a 1000servers at a time did that over
a weekend in under $6,000 So itwas a very compelling case that
cloud is bringing a new kind ofscale. And we used to say that
ArcSight in a way was solvingthe big data problem, but it was
a scale up strategy, a scale uparchitecture, not a scale out
(16:56):
architecture. Right?
Nowadays, nobody does I mean,very few people do a scale up.
Everybody does a scale out.Right? And so that was that was
an moment is that, you know, werun into so many scalability
challenges at ArcSight. What ifyou could run a cloud based log
management, a cloud based SIEM,and suddenly you get the scale
(17:17):
of 10,000 servers and all ofthat infrastructure, and you
take away the operationaloverhead so it becomes easier
and easier to operate for thecustomer.
And on the back end, you get atremendous amount of scale. And
we knew that many of thecategories, right? I wouldn't
name names, someone in 2020asked me, how is it obvious that
(17:39):
cloud is now going to be themain thing? I'm like, that was
obvious 10 years ago, right?Because, I mean, this is where
you look at these mega trendsand you don't know exactly how
the path will take in theintermediate 1 year, 2 year, 3
year, 4 year time frame, butthere is no doubt that in 10
years, it is fundamentally goingto change architectures, change
(18:00):
product categories.
And I said I felt it 2 times inmy in my career, and the second
time, it's is the same way Ifeel about AI. It's like what
will happen in 2025, in 2026might be up for debate. Right?
But if you look 5 years, 7years, 10 years farther out,
there's no doubt in my mind thatit will fundamentally change a
(18:21):
lot of product categories,including one that is near and
dear to my heart, which issecurity operations.
Sid Trivedi (18:28):
You mentioned this kind of insight in recognizing
the value of the the the cloud,Kumar. Once you figured that
that piece out, why didn't youand Stefan and Christian just
build this in at on ArcSight? Imean, you had all of the the
scalability, the distribution in2010. Why didn't you try to
build it in?
Kumar Saurabh (18:45):
Without getting into too many details, who says
nobody did, right? But this isthe classic, you know, this is
amazing, right? There is a verygreat book, Creativity Inc, Ed
Capmel, maybe I'm butchering hissecond name, right? But he talks
about a hungry beast and an uglybaby concept of this, right? So
hungry beast is the part of thebusiness that's working well,
(19:07):
right?
And ArcSight was a hungry beast,big sales team, $1,000,000
deals, right, commonplace. Nowyou go in and say, I want to do
this small little thing in thecloud. Like, why would you do it
in the cloud? Nobody's askingfor cloud, right? In fact, 99
out of a 100 people will tellyou don't do it in the cloud.
It's like, we'll never put datain the cloud, right? So it's
(19:30):
basically the ugly child is theugly baby has to be protected
and given enough oxygen to grow.And actually very many large
companies, quite honestly, suckat it, right? They accidentally
suffocate and they starve theugly baby. It never gets a
chance to even become ateenager.
And so guess what? You know,that's why I love the Bay Area,
(19:53):
the early stage VC and fundinginfrastructure that is like,
Hey, if you have an idea of anugly baby, people take the risk,
right? And sometimes it doesn'twork out. Sometimes it does work
out. So that was the reason.
And I've seen that movie playout more than once, right? Where
there's a fabulous idea, bigcompany could have done it, but
(20:15):
somehow they never are able toexecute very well because they
don't fund it, they don't createa protective area around the
ugly baby. So give ugly babyenough time to grow up.
Mahendra Ramsinghani (20:26):
And so, Kumar, how big was ArcSight when
you decided to make the leap interms of headcount or such?
Kumar Saurabh (20:33):
I think I I joke that I have never worked at a
company for more than 6 monthsthat's larger than 5 100, 600
people in my last 21 years. So Iwould have to guess that it was
right around the time where Iwas thinking 600 people seems
like too big a company formeetings are moving very slow.
Not as innovative as it used to3, 4 years ago. And it's not
(20:54):
like it happens one sudden day.It's a frog in the boiling water
kind of thing till one day youwake up and realize it's too
darn slow and not innovativeenough.
And then once some creativityspark goes off, you're like,
okay, I gotta step out of thisand kind of start things from
scratch.
Mahendra Ramsinghani (21:12):
So I think your threshold is the 500 ish
mark, and you get to kind ofjump out at that point.
Kumar Saurabh (21:19):
I think it's not the size of the company. I tell
people that impatience is bothmy feature and my bug. So I'm
not a very patient man. And overtime I have grown comfortable
with that. It's like when peoplesay, oh, it can be done in the
next week, it's like, what'swrong with tomorrow?
Right? And when you ask thatquestion, a lot of people get
(21:40):
like, no, it can be donetomorrow. And 9 out of 10 times,
if you don't give them a choice,it has to be done tomorrow, and
they kind of take it that it'snot changing. It has to be done
tomorrow. 9 out of 10 times, itactually gets done tomorrow.
So, so I think the biggercompanies kind of start to lose
this a little bit over time, bitby bit, bit by bit. And when it
(22:03):
becomes too much, that's thetrigger where I go, like, why
does it take 2 months to dosomething that can be done in 2
days? And that's that's one ofthe telltale signs where I'm
like, okay, something gottachange.
Mahendra Ramsinghani (22:15):
And so now you made a leap. You are
starting Sumo Logic. I mean,give us a sense of what was the
starting journey like, and thenwhat was Sumo at scale? You
know, at its peak, customers,operations, servers, etcetera, I
mean, give us a sense of thatjourney from start to its peak.
Kumar Saurabh (22:32):
So I was there for the 1st 6 years, right, and
and I think Sumo went IPO in2020, and if I remember
correctly, got acquired a P firmin a couple of years later. When
I was there, you know, we wereprobably doing 40, 50,000,000 in
ARR. Had, I would probably sayclose to a 1000 customers at
(22:52):
that point, right? And so I lookat this as 3, 2 year my 6 years
with Sumo, I split that into Imean, there was a period, 6, 9
months of the ideation andgetting to the point where we
started the company. But thecouple of years was after that
was really building thisscalable platform.
And then 2 years after that wasperhaps the most interesting
time period because the onboardcustomers. And the platform and
(23:16):
even the cloud was so new thatfor every 8 quarters, every last
2 weeks of the quarter, I didnot sleep all night. Right?
You're lucky if you get 3, 4hours of sleep because at 4
o'clock in the morning,something breaks. Right?
And your pager goes off. You hopon Slack. There are another 5
(23:40):
engineers up at 3 AM, and we aretrying to fix. It was
colloquial, you know, we'refixing the plane while we're
trying to fly at faster andfaster speed. So that was a
great learning experience interms of not only seeing the
business grow, that was oneinteresting aspect of it, but
also the other interestingaspect was how do you take a
system that was meant to run 10,20 customers and scale it 10x,
(24:04):
right, in a couple of years ormore?
And that was a great technicallearning experience. And the
couple of years after that, thelast 2 years was more of a
management. And I actually put acouch in my office because my
job became calming people downand stopping them from killing
each other because they had atechnical argument. In the heat
(24:26):
of the moment, those argumentslook big, but if you step back,
you know, how do you resolvethose conflicts? How do you get
a group of 100 very strongengineers to work together?
I mean, that is a challenge Iactually quite honestly enjoyed
for a couple of years, but afterthat, you know, I'm more of a
builder, whether it's producttechnology or a company builder,
(24:47):
and not as much. I can domanagement for a little bit. I
enjoy that in small doses, butwhen that becomes 90% of your
job, that's not the ideal fitfor me.
Mahendra Ramsinghani (24:58):
Yeah. And, Kumar, I think you're one of the
rare technical founders who hasbuilt things that have scaled
very rapidly. For our audience,what are some lessons they
should keep in mind as theythemselves are building their
startups? This notion ofdesigning to scale, what are
some things that, they need tobe, very, very thoughtful about?
Kumar Saurabh (25:21):
There are a lot of I I think Google has a pretty
tremendous engineering culture.Right? And I have also seen
companies that don't have theculture and that crumble under
the technical debt, right? So ifyou ignore the technical debt,
it grows on you, right? And, youknow, Christian and I, Bruno, we
(25:41):
many times had, you know, headbutting with our CEO because
we're building a lot of featurefunctionality that the customer
wants sometimes at the cost ofnot investing enough in the
platform, right?
And as a CEO now, when the showis on the other foot, I have
more appreciation for, you gotto invest in the technical debt.
You got to invest in theunderlying platform and somebody
(26:03):
has got to champion for that.Another thing that I would say
is like the rigor. And I thinkthe rigor around even things
like root cause analysis and soon and so forth, and you're
constantly rebuilding theunderlying platform. There are
some components of the systemthat we had to redo every year,
right?
(26:23):
And so we were on V4, V5 ofcertain components of the system
because you scale it 10x and theworkload increases another 10x.
Sid Trivedi (26:30):
Kumar, we I wanna move over to, you know, the
topic of Gen AI, and you talkedabout these kind of 2 cycles
that that you have seen cloud,and then, obviously, what's
happening today with with Genai.You've certainly started your
3rd company now, AirMDR, andthat that was something you
founded last year, and and I'vebeen fortunate to to to work
with you on that that journey.What was the reason behind why
(26:52):
you decided to go and build AirMDR? What was this this focus
on, you know, building anautomation first MDR? What
motivated you to kind of say,hey.
This is where I wanna spend mytime for the next decade?
Kumar Saurabh (27:04):
So for a long time, even as an undergrad, I
did AI, but AI at that point wasminuscule, right? Trivial
compared to what is possibletoday, the scale at which you
can build models, all theinfrastructure is there today,
right? So it's a very different,it's almost like a golden age
for the AI, right? And so, but Ialways believe that whatever
(27:28):
people can do over time,machines will do it better,
faster, cheaper than people. AndI am perfectly comfortable with
that outcome, right?
If I have to go 5 miles, I wouldrather drive. There is no pride
in me running. I can neveroutrun a car. I'd rather drive a
car, and even better would be acar that drives itself just gets
(27:50):
me from point A to point B,right? So I fundamentally
believe in that, right?
And 5, 6 years ago, I startedautomation was the best you
could do, right? But do yourealize that automation is not,
like there was a category calledSOAR, and I say tongue in cheek,
there is no I in SOAR. There isno intelligence in SOAR. SOAR,
(28:12):
someone intelligent has to tellSOAR what to do. And when AI
happened, right, it was not justabout the language models, but
what the language model kind ofshowed a peek into the world
where you can build this AIagent that can actually AI agent
is the vessel of thatintelligence.
And the UX is much better,right? So you can now, it's not
(28:35):
some neural net that you don'tknow how it works, but it just
works, right? No, these days,the models can actually converse
in natural language with you. Sothe UX has become much better
and the intelligence has gottenmuch better. So I really think
that, you know, various AIagents, and this is what I
believe that will happen in next1, 2, 3, 4, 5 years, is that AI
(29:00):
agents will actually be able todo 60, 70 percent of the work
better than people that aredoing that today in the whole
world, right?
And it will be a journey to getto that point, Yeah.
Sid Trivedi (29:13):
I think you talked a little bit about AI agents and
leveraging them in the SOC.There's several companies that
are kind of doing this in cyber.I mean, there's probably 15 plus
companies. What are you doingthat's different? What did you
see and you said, Hey, this iswhat the world is not doing,
similar to the way you figuredout cloud based SIM was the
future with Sumo?
Kumar Saurabh (29:31):
Right. So I I I think there are a couple of
things, right, just like atSumo, right, I remember in the
early days, there was a verylarge bank. I think it was UBS
or something. They called us oneday, and I happened to be the
sales guy, the CEO that took wewere all in one my office,
right, happened to be there. Wetook the call, the UBS guy goes,
would you run your software onprem and we'll write you a very
(29:54):
big fat check?
And the sales guy just hung up,thank you, see you later. And we
were all delighted that thesales guy was able to walk away
from a very big fat checkbecause he understood that the
whole point of the cloud is tonot run on prem, run it as a
server. The whole point of thisAI agent, I believe the ultimate
form is to run the AI agent as aservice, not as a software that
(30:17):
gets deployed in other people,but just do the entire work end
to end. I believe that is a farbetter model. One, it's a far
better model for the customerbecause when I talk to
customers, 80, 90% of thecustomer is small to medium
sized customers.
Just want the problem ofdetection and response to be
taken care of, right? Now thereare 1% of the very large
(30:39):
companies, and I think they willcontinue to buy software, just
like there are still peopletoday that would only deploy
things on prem. But I think manyof the cloud companies have
shown that you can build a verylarge company being purely
cloud, right? And so theapproach that we are taking, we
fundamentally believe that it'sbetter for the customer. And
(30:59):
more importantly, when you ownall the different layers of this
stack, right?
The data, the detection, thetriage investigation response,
the people, the processes, youcan integrate that much more
tightly than if 90% of the stackthat you need to operate is
owned by some other company thatmoves very slow. And you are
(31:19):
expected to produce the results,but you only own 10% of the
stack. Right? And so this is oneof the fundamental differences
from almost every other companythat's working on the AI agent
for SOC. They're mostly doing itas a software, and we are doing
it as a service, and we aredelivering detection and
response as a service for smalland medium sized companies, and
(31:41):
medium sized companies could be5,000 people strong.
Sid Trivedi (31:44):
And by this, you mean you're not actually
exposing the agent to thecustomer. You're exposing the
end result as
Kumar Saurabh (31:51):
Absolutely. So we are delivering the end result,
but we don't put the onus oftraining, making sure that the
virtual analyst is actuallyworking and working well on the
customer. We take that on ourpart. We do provide them
visibility. So we're we believein 100% visibility to the
customer.
You can lift the hood, lookunder it. But at the end of the
(32:12):
day, who owns the responsibilityof making sure AI analyst works
really well? It's not thecustomer. It's the provider.
It's the builder of the AIagent, and the customer gets the
outcome.
And the outcome that they expectis detection, triage,
investigation response as aservice.
Ross Haleliuk (32:28):
In the Bay Area, there is a lot of excitement
about AI and its potential totransform security. However,
outside of the Bay Area, manycompanies are more cautious or
even skeptical. From yourperspective, how does the view
of AI in cybersecurity differbetween the Bay Area and other
regions?
Kumar Saurabh (32:47):
Yeah. That's a that's a very interesting
question. My experience has beenthat there is something
something either good or bad inthe water in Bay Area because
there is a heavy degree ofoptimism, right? And some can
even say, like, unrealisticamounts of euphoria around AI.
Some of it might be a little bittoo far fetched.
On the other hand, right, I'vebeen to, not to pick any place,
(33:09):
but I did happen to go to Dallasa couple of times in October.
And at one of the dinners, notonly people were not believer in
the AI, but they were almostskeptical. Right? And I think
what changes that is is a bit bybit journey, like seeing is
believing. Right?
Like if you read a researchpaper on chat GPT, you would not
(33:30):
believe it, but if you could login and you can actually get your
hands on the keyboard and usechat GPT, then you'll be
impressed and you'd be wow. So alot of that has to happen in the
space of AI. The more peoplebecome familiar, right? I own a
Tesla and I was very skepticalabout self driving, till I
started using it. And I couldnotice a change in my own
(33:52):
mindset, how well the technologyis improving, right?
And it's probably, it stillneeds more work, right? But you
can see the progress. And thesame thing is happening in AI
and cyber. As more and morepeople experience it, they'll
become more of a believer andless of a skeptic. And security
people are skeptical by nature,right?
So that's their default, that'sthe place where they start. And
(34:16):
I think healthier skepticism isgood. And I think as they get
more hands on familiarity andthis can see the outcomes and
the value of AI analyst orapplication of AI in cyber work
and deliver results, that's whenthey will start changing their
opinion.
Mahendra Ramsinghani (34:32):
I think, Kumar, there's a great
observation there betweengeographies, adoption curves.
And I wanna go back to that partwhere you talked about Sumo
Logic. You're catching on to thecloud wave. But there is this
big legacy part that is tryingto say, well, can you do this on
prem? And you guys are, like,strong and disciplined enough to
say no.
(34:52):
Now take that same analog forthe AI phase that we are in, and
where is where is the resistancegonna come from? How do you
break across that resistance?
Kumar Saurabh (35:01):
This is such a wonderful question. We just saw
so we did POC with 2 very largeSOC teams. Right? 1 had 30
people, 1 had 80 SOC analysts inthe team. Right?
And one team is full on thebelief in the world where AI
analysts should do 80, 90% ofelectronic investigation
(35:23):
response. So they're full intothat, and they bought in, and
they're all in there. In theother case, we showed them the
technical win. We showed themwhat was possible with that. But
instead of investing in thistechnology, they went and hired
13 more people on the team.
And so this is the inertia,right? It's like, this is why I
believe doing it as an MDR hasan advantage because even when
(35:46):
you give them the technology,show them how it works, show
them the outcomes, changing theorganization to work in
different ways, changing 30people's mindset, changing the
processes is not something thatevery company can accomplish.
And that is another reason whywe are doing it as an MDR
because time is of the essence.I would want this technology to
(36:07):
be in the hands of as manycompanies as possible in couple
of years as opposed to taking 6years to get there.
Mahendra Ramsinghani (36:14):
You know, that's a fascinating observation
that, between 30 80 analysts,one of them is just grabbing on
to everything that you have tooffer, and the other is saying,
well, we'll go ahead and hiremore people. Or, you know, if I
use the horse card versus cardanalogies, like, we're gonna,
you know, buy more horses. It'snot gonna help you to get to
(36:34):
your destination faster,unfortunately. So there's gonna
be an interesting, shift herethat occurs. You know, this is
your 4th startup, Akbar.
When you look at the companythat's gone public, companies
that got acquired in your past,you've done it all. What keeps
you excited? What keeps yougoing? And, where do you find
your mojo?
Kumar Saurabh (36:54):
I think I honestly find making a little
slice of future, being able tosee it and then make it a
reality in a few years, right?It's a pretty, pretty satisfying
thing to do, Right? And andluckily, you know, there is
always every few years, there issome new technology so you can
(37:14):
move the envelope forward. Youcan get a little piece of, like
and I understand certain areasright around data, around data
driven operations, SecOps,DevOps, these are the areas that
I understand. And whenever thatopportunity presents where you
can take where you can imagine amuch better future, and then you
get the opportunity to work onmaking that vision of the future
(37:37):
make it a reality.
I think I find myself blessedthat I get paid for doing that,
right? In a way, it's like, itis an incredible role, it's an
incredible opportunity. So aslong as I keep finding
opportunities like those, I keepworking on those. So just to
flip that around, Kumar, what'syour biggest frustration, or
what what do you find holdingyou back? I think, though, you
(37:59):
know, the part of it is itsconstraints, and I think it's a
healthy I think I almost feellike constraints breed
creativity.
I do believe in that. Right? AndI I think it's not there are
very few things actuallygenuinely get me frustrated.
Right? So it's like, you know,999 out of 1,000 things are
(38:20):
solvable.
Right? And and very rarely arethere things that are truly that
frustrating. Right? So there'smaybe that's just the
personality type. It's like, ittakes a lot to get me
frustrated.
I think what gets is how do weget 100 and 1000 and tens of
thousands of the customers tokind of go along? That is
probably I find as the hardestchallenge. Like building the
(38:43):
technology and showing it in thesmaller parts, but getting your
whole industry to kind of movein a certain direction. Once you
see it happen, it's veryfulfilling to see that. That's
also probably the mostchallenging part of it.
Sid Trivedi (38:56):
As we go into our last section of this podcast,
let's talk a little bit aboutlessons for founders. And, you
know, one of the things I'veseen you do really well, working
closely with you in AirMDR, isyou have this truly unique
superpower in recruiting talent.And that talent includes both
finding, you know, high qualitycofounders to join you, having
(39:19):
individual engineers joiningyou, individual sales leaders.
You're just fantastic at it. Youcan convince people who haven't
even thought about joining astart up as early as this to
come and join.
What advice do you have forfounders, particularly first
time founders, who are lookingto hire that critical employee
or convince a cofounder to leavetheir job and join them in a
(39:40):
startup? Like, how do you do it?
Kumar Saurabh (39:41):
Yeah. I I I think that's you know, there is a
little bit of, you know, meme ordebate going on this whole
founder mode and manager modeand things like that. Right? And
I think I come at it from a morenuanced perspective of it.
Right?
You have to at many times peoplesay, hey, it's your company.
Right? And I think you, as afoundry, it's a first time
(40:02):
foundry, it's a little bit of,like, it feels good to say it's
my company, but it really takesa lot of people to build a
company. Right? So, so the firstof all, it's realization that
you want other people in thetent and you're ready to give up
your Legos, right?
If you are going to hold on toall your Legos, then you're
(40:23):
constraining the kind of peopleyou're going to attract, Right?
Because other people want toplay with Legos as well. Right?
So part of it is to figure outwhich Legos you should give. But
whenever you give up the Legos,I mean, the art of the
delegation is you are stillresponsible for the results and
the outcomes at the end of theday.
Right? So how do you strike thatbalance of giving up? So I'm not
(40:45):
a big believer in, like,micromanaging and controlling
everything. On the other end,I'm also not a believer in just
get letting the reins lose trackof this script, so to say. Like,
you still have to own theaccountability.
You still have to be closeenough, so you know when to step
in, when to pull in. So that's afine balance. But that is one of
(41:06):
the things. And the other partthat, so the, it starts with the
first part of it is willing togive up parts of the company,
parts, big pieces, impactfulpieces of the roles to other
people, right? Trust them to dothe right thing and bring them
in.
There's other part that I wouldsay during the interviewing
process, right? You're selling,you're also buying, but you're
(41:28):
listening like any, like most ofthe sales processes have a
discovery phase at the verybeginning, Right? And many of
the sales people, right, when Iused to go on the sales call,
it's like, I want to pitch youwhat I'm doing, as opposed to
asking questions, learn anddiscover. And over time you
change your approach. And in therecruiting phase, if you listen
carefully and you ask questionsthe right way, people will tell
(41:50):
you what, where they want to goin 2 years or 5 years, right?
And then it becomes acollaborative problem solving
exercise. Can we get you therehere? And how do we make this
the best place that you can get?And once you problem solve with
those people, one out of 10times, you can't make this the
best place for them and youwon't be able to close. But 8 or
(42:11):
9 out of 10 times, if you gothrough the process, listen
carefully, do the discovery,figure out where people want to
go and find that opportunity.
And when you find theopportunity that requires giving
up the Legos, be open to givingup the Legos. If you do all of
those things, you can probablyrecruit pretty awesome talent.
Sid Trivedi (42:29):
Maybe a follow-up to that. I mean, most of the
time, founders aren't actuallyrecruiting from other start ups.
They're recruiting from largercompanies. So the difference is
you're you're trying to convincesomebody to leave their cushy
job. What are the things thatyou use to try to convince those
folks?
I mean, obviously, theyrecognize that they're not gonna
get paid as much and theyrecognize they're gonna get real
equity, but what's the piecethat actually convinces
(42:51):
individuals to say, hey, I wannago and do this much earlier?
Kumar Saurabh (42:54):
Like, look, what I believe is that it's a game of
self selection, right? And Ithink if you want a nice cushy 9
to 5 job, you should probablywork at Intuit, right? Or there
are many companies where, youknow, it's a very, nothing wrong
with that. Like, look, I do notjudge that, right? That's not
for me and that's not foranybody who wants to join a
(43:17):
startup, right?
And so you can, it's not wrongfor someone to say like, look,
I'm looking for a Monday toFriday 9 to 5 job. That's okay,
You should go somewhere else.Right? I do not try to recruit
those people at all. Right?
I try to recruit those peoplewho are like, who are looking
for something more, who arelooking to make a bigger impact.
And people who have that itch,they might have been working at
(43:37):
McAfee, they might have beenworking at Google, and they feel
like they're a tiny cog in thishuge machine and what they do
does not make an impact. And ifthey are talented, right, those
are the people that you can veryeasily attract, right? Because
at a startups, you're prettymuch the maker of your own
destiny, right? And what you doactually has a very immediate
impact that you can see.
(43:58):
And a lot of people find thatvery exciting and attractive.
Ross Haleliuk (44:01):
What happens when you hire someone who is not a
good fit for a startup? I knowthere are plenty of talented
people at large corporations whohave a very romantic idea of
what working at a startup wouldlook like. Many are used to
having a lot of resources attheir disposal, large budgets,
great teams, and many maystruggle without having such
(44:22):
support at a startup. How haveyou navigated this problem, and
has that ever been a problem foryou?
Kumar Saurabh (44:28):
I know within less than 90 days, more like 30
or 60 days, if I made a mistake.Right? If someone passes the
filter where I figure that outafter they join, I ask myself a
really hard question is like,that's a mistake I made, right?
And I do make those kinds ofmistakes, but the chances I made
those mistakes have gone downdrastically over the years. And
(44:49):
the way of this is I own whatworking in a startup is like,
right?
I don't expect people to work110 hours, right? It is
sustainable pace, but it isgoing to require, like I will, I
tell people engineers to join,if your product doesn't work on
a Saturday or a Sunday or onThanksgiving or on Christmas, I
(45:11):
will call you, right? And Iexpect you to pick up the phone.
If that scares you, you willrun. You will not come back for
the next interview after that,after hearing me clearly tell
you that, that I have no shamein that fact that I will call
you, right?
So part of it is like, it iswhat it is, right? I'm brutally
(45:31):
honest about it. I try to givepeople a dose of reality before
they join and it's not foreveryone. And it is for a
certain group of people thatjust love, I mean, I've worked
with people who have worked withme. Like there are people at
Sumo who've been there 12 years.
There are people at Logic Appthat joined in early and left
the day result. So I have foundpeople that want that and
(45:55):
they've worked through that foryears in very, very hard
situations. So it's about selfselection. There are startup
people and there are big companypeople. Big company people
should go to big companies, andstartup people should go to
startups.
Ross Haleliuk (46:07):
That is a very rational and a very wise way of
looking at this. So question foryou, Kumar. You've worked in the
past with 4 of the biggestbrands in enterprise
infrastructure investing. You'veworked with Greylock, with
Sutter Hill, Sequoia, and Accel.How much does the brand of the
firm matter when a founder ispicking Avisi?
And how do you balance the firmreputation with the individual
(46:30):
partner you're going to beworking?
Kumar Saurabh (46:31):
It's very funny because we started this
conversation talking about IITs.IITs have 500 graduates from
each one of them every singleyear, right? So there are
probably thousands of IITs,right? If you actually mapped
out like where different peopleof these are, there is a
humongous amount of variance,right? But I think it's a
(46:52):
signaling, right?
If you had a 5.0 or 4.0 GPA fromMIT or Stanford, that does say
something, right? So brands andinstitutions have a certain
signaling effect, right? So thatis a fact, right? On the other
hand, I think, I always believethat at the end of the day, you
work with people, you work withpartners very, very closely,
(47:15):
board members, right? And theyare part of your team, right?
And I think they're part on yourteam, they are board members,
right? So I think I would put awhole lot more value on the
person that you're working with.You know, how much did they go
out of their way to help youeither make introductions to
customers, other investors,other executives. I have seen
(47:38):
firsthand how, you know, boardmembers can be super helpful in
attracting and recruiting reallyhigh quality, very senior
talent, both at Sumo, in priorcompanies, even here at Air MDR,
working with Sid and all ofthat. Right?
So so I do think that brand doesmatter. I would probably put 20%
of the weight on the firmitself, but 80% of the weight I
(48:00):
would put on the person fromthat firm that you are working
with. Because that's the personthat you are spending a lot of
time, sometimes every week.
Mahendra Ramsinghani (48:07):
You know, speaking of, the IIT networks
and how these networks haveproliferated, how they've gone
on to become successfulfounders, One question that
comes to mind, Kumar, is thatnow imagine you have completed
the journey with AirMDR, okay,and, there is a young immigrant
who just landed at the shores ofthis great country and is asking
(48:29):
you for advice. You know, whatare some, top 2 or 3 pieces of
advice you'd give to somebodywho comes in in terms of
building their career,entrepreneurship, and, achieving
success?
Kumar Saurabh (48:42):
I think on the founder side, right, I think I
would give a meta advice isthere are a lot more people that
have been down this journeybefore you. And I got this
advice maybe in 2004, 2005,right? As a young engineer, I
wanted to build everything. Andone of my managers said, Kumar,
(49:02):
you can go online and check ifsomebody has already done it.
And 8 out of 10 times, 9 out of10 times, other people have done
it.
And in the founder kind ofstage, if you're a first time
founder, there is lot of thingsto know, but there are also a
lot of people who have done thatjourney before you, right? And
people are generally superhelpful if you reach out to
(49:24):
people, and people will take thetime, give you 30 minutes, give
you an hour. So one piece ofadvice that I would say is reach
out, ask for help, genuinely askfor help. And starting the
company and all of that, that'sprobably, you know, there is ton
of material on, even on YouTube,on podcasts like this, right?
(49:45):
You know, you listen todifferent people's journeys and
different decision points thatthey had to take.
So there is a lot of informationout there, but one piece of
advice would be to would be toreach out to people who have
been down that path before you.And even if 1 or 2 people are
willing to help you, that can beimmensely powerful in terms of
guidance, in terms of mistakesto avoid, in terms of questions
(50:08):
to think through. And make yourown decision, but they can give
you a framework because they'veseen the movie before. If you
have seen the movie 3, 4, 5times before, you can actually
predict, okay, here are thedecision points you're gonna
face. And that advice, I getthat from board members,
investors, other senior peoplein different kind of roles.
So I I find a lot of valuereaching out to people and
(50:29):
asking for help advice. Butagain, at the end of the day,
you gotta own the decision. Yougotta make your own decision,
but getting different pieces ofinformation and input is super
helpful.
Mahendra Ramsinghani (50:38):
I couldn't agree more, Kumar. You know, we,
we live in a in a time and ageography that is, very
interesting. America as acountry has been, kind of the
landing pad for entrepreneursfrom across the world. And what
you touched on has been sort ofthe DNA or the fiber of this
country's entrepreneurial zealis that somebody who is
(51:01):
successful is always willing tohelp, is always willing to
engage and give back in a in ameaningful way, and I think
that's what makes, our journeyalso very special. You've done
this now four times, right,ArcSight, Logic Hub, Sumo Logic,
AirMDR now, and you continue tonot only inspire other founders,
(51:22):
but also help them behind thescenes in your own way.
So we wanna say a big thank youto you for being such a positive
force in the world ofcybersecurity. You know,
innovations, entrepreneurship,raising capital, building teams,
I mean, these are not for thefaint of heart, and the fact
that you continue to do thiseach day and every day is a big
(51:43):
source of inspiration for a lotof us out there. So thank you,
Kumar.
Kumar Saurabh (51:46):
This has been a lot of fun. Enjoyed the this
discussion. So thank you forhaving me on, and it was a
wonderful conversation.
Sid Trivedi (51:53):
Thanks, Kumar.
Mahendra Ramsinghani (51:54):
Thank you, Kumar.
Sid Trivedi (51:57):
Thank you for joining us Inside the Network.
Ross Haleliuk (52:01):
If you like this episode, please leave us a
review and share it with others.
Mahendra Ramsinghani (52:06):
If you really, really liked it and you
have some feedback for us, wrapit on a bottle of Yamazaki and
send it to me first.
Sid Trivedi (52:15):
No. Don't do that. Mahendra gets too many gifts
already. Please reach out byemail or LinkedIn.
Welcome to Inside the Network. I'm Sid Trivedi.
Ross Haleliuk (00:09):
I am Ross Haleliuk.
Mahendra Ramsinghani (00:11):
And I am Mahendra Ramsinghani. We have
spent decades building,investing, and researching
cybersecurity companies.
Sid Trivedi (00:20):
On this podcast, we invite you to join us inside the
network, where we bring the bestfounders, operators, and
investors building the future ofcyber.
Ross Haleliuk (00:32):
We will talk about the hard parts of the
founder journey, launchingcompanies, getting to product
market fit, raising capital, andscaling to an exit.
Mahendra Ramsinghani (00:43):
And, yes, we will also be talking about
epic failures.
Sid Trivedi (00:47):
But, Mahendra, we're here to make the founder
journey easier.
Mahendra Ramsinghani (00:50):
That is correct, Sid. But we cannot make
it too much easier becausestartups are hard. And, of
course, you already knew that.
Ross Haleliuk (00:58):
Alright, you two. Enough. Let's get started with
this week's episode.
Mahendra Ramsinghani (01:06):
Our guest today is Kumar Saurabh, a
remarkable innovator, a founder,and entrepreneur whose journey
almost took a different path. APhD, a potential academic
trapped in the hallowed halls ofsome educational institution.
But thankfully, instead, Kumarchose the road of being a
(01:27):
builder, entrepreneur, and afounder. And the cybersecurity
world is much better for it.Kumar's story begins at
ArcSight, one of the pioneeringcompanies in the SIEM space or
security information and eventmanagement.
Before it was even a category,Kumar joins as a software
engineer at this pre revenuecompany. And by the time
(01:49):
ArcSight goes public, he hasrisen to the director of
engineering. At ArcSight, Kumarled the co relations team, which
was the technological epicenterof the company developing
sophisticated filtering,prioritization, data mining, and
reporting engines. That wouldbecome the backbone of the
modern SIEM platforms. As thecloud computing wave began to
(02:13):
reshape the technologicallandscape, Kumar saw an
opportunity and co founded SumoLogic.
Serving as its chief technologyofficer and challenging the
traditional, clunky, on premsolutions. Sumo Logic was taking
the advantage of the cloudnative revolution, offering
instant deployment, elasticscalability, and zero
(02:36):
maintenance. Kumar was nowreimagining how businesses
approached data insights anddeployment of cybersecurity
offerings. Now in his latestchapter, Kumar is riding the AI
wave with AirMDR, his lateststartup. As a co founder, he's
on a mission to bring agentic AIinto the world of the SOC or the
(02:59):
security operations center,empowering analysts and bringing
AI driven innovations to MSSPsor Managed Security Service
Providers.
It's a bold vision that promisesto transform how we approach
cybersecurity. And in fulldisclosure, Foundation Capital
and I are investors in AirMDR.Across 2 decades of his
(03:22):
entrepreneurial adventures incybersecurity, Kumar has
accumulated a wealth ofinsights. He represents the rare
breed of a founder engineer whocan build products that scale,
adopting the latest technologyofferings and delivering
revenues as well as generatingfinancial returns. Today, we'll
dive deep into Kumar's journey,exploring his thinking, his
(03:44):
insights, and hisentrepreneurial spirit that
keeps defining a new innovativechapter with every wave.
Let us get started.
Sid Trivedi (03:55):
Welcome, Kumar, to Inside the Network.
Kumar Saurabh (03:57):
Thanks, Sid. Thanks for having me.
Sid Trivedi (03:59):
So we're gonna talk about a few different topics,
and let's start with yourimmigrant beginnings. You
studied computer science at IITKharagpur and graduated back in
1999. IIT alumni have gone on tofound some of the biggest
companies in Silicon Valley,from Zscaler to Sun to Nutanix
to Cohesity and many, many more.What makes this group of schools
(04:21):
such a hotbed for software andfounder talent?
Kumar Saurabh (04:24):
I think when I look back, 1st and foremost,
getting into IITs, when Igraduated, and this is probably
like 20, 24 years ago, therewere only 5 of them. Right? And
computer science batches arelike 50 people. So I don't know,
100 of thousands of peopleprobably applied to get in, and
so you have to kind of show upin the top 250 to get into
computer science. So so thefirst thing I would say is there
(04:47):
is a there is some I mean, theselection is not perfect, but
there is certainly, like, peoplewho are strong in, you know,
math, science, and engineering,things like that, getting to
that.
So there is a first levelfiltering effect right there
that comes in. There's a couplemore things I would say. Brand
is a big thing, right? So eventhough it's IITs or Indian
(05:08):
universities, they're actuallyvery well known all over the
world. Even in the UnitedStates, I benefited from that
all across.
The network is pretty strong,right? So when I started doing
startups, I had people who hadgraduated earlier than me that
were already doing startups,right? Like Bipul Sinha from
Rubrik or Anshu Sharma fromSkyflow, right? Both of these
(05:30):
people are ex IIT Kharagpurgraduates, right? I personally
knew them before I started thecompany, so you have a lot of
those role models or people whohave done this before, and one
of the less appreciated thingsabout it is being an IITian
gives me a certain kind offamiliarity in recruiting
talent, recruiting engineeringtalent, right?
(05:52):
So I can talk to any IITcomputer science grad, and there
is a little bit of like thatcommon background, that alumni
network. So over the years, Ihave found like it's far easier
for me to attract really highquality talent, maybe folks that
have gone through IT and thingslike that. So combination of all
of those effects does help in abig, big way, going to ITs and
(06:16):
graduating from there.
Sid Trivedi (06:17):
We had Slavik Markovich on before, the founder
of Dscope and Demisto. He talkeda lot about Unit 8200 in Israel.
Now that's a very that's not aschool. That's certainly a
military branch within the IDF.Would you say that IIT has kind
of similar value for foundersfrom India?
Kumar Saurabh (06:34):
I think IT is definitely have a broad I mean,
it may not be necessarily aroundcyber, but the quality of talent
is really pretty high. And yourun into IT grads, IT alumni in
a lot of different positions andthe alumni network does actually
help you quite a bit, right? SoI can reach out to even Ashu for
(06:57):
example at Foundation Capital,right? There are a lot of people
ex IIT graduates and there issomething to that alumni
network. People do help out.
Right? You can reach I getrandom emails or or LinkedIn,
people reach out and if theyhave gone to an IT, there is a
little bit it it rises above therest, and you reach out and you
try to help. And I have receivedthe same help multiple times in
(07:20):
my last 20 plus years.
Ross Haleliuk (07:21):
You moved to the US in 2000 to pursue a master's
degree at Columbia. Whatconvinced you to come here to
the States rather than build acareer in India?
Kumar Saurabh (07:31):
So believe it or not, when I was in undergrad, I
wanted to be a theoreticalcomputer scientist. Right? And I
wanted to do a PhD, right, whenyou are like 24 or pretty
idealistic, right? And one ofthe professors at MIT, his
student, Luca Travissant, whoactually went was a professor at
(07:52):
Columbia, went to Berkeley.Unfortunately, he passed away a
year or so ago.
I was his first PhD student. Sohe was looking for a PhD
student. He reached out, and Iwas delighted as anything
because I had looked at hisresearch papers, and they were
just, pretty awesome researchpapers. But after a year into
PhD, I realized that I'm on thewrong career track. I'll become
(08:13):
a professor if I keep doing whatI'm doing, and I like to build
things.
So a year or so after that, Ikind of dropped out. So it was
pretty much chasing that PhD intheoretical computer science is
why I first came to US. It wasonly after doing 1 year of PhD I
I kind of came to therealization that PhD is not
(08:33):
where my heart is, and my I am,like, an engineer, a computer
scientist. I like to buildthings. I like to use things
that I build, and,theoretically, computer science
was not very conducive for App.
Mahendra Ramsinghani (08:45):
Wonderful, Kumar. So you could have been
doctor Kumar, but you're Kumar,and we still love you for that.
From Columbia to Silicon Valley,that's one shift that has
occurred inside the UnitedStates. And then from India to
the US, that's a big shift.There is a theory about
immigrants being founders, beingscrappy, being hungry, and you
(09:06):
see it across the board.
What is it about immigrants thatmakes them the crazy ones?
Kumar Saurabh (09:11):
I think there are few things. Right? One of,
especially from India, Irealized that I had the PhD
offer, but I couldn't go for asemester because I didn't have
enough money, right? So it'slike starting a company and for
the first time founders, right,you have to find a way to start
something from nothing, right?And so I kind of worked for 6
months, saved up enough moneyfor the air flight for the 1st
(09:33):
month of expenses.
I'll tell you this, is theresourcefulness, right? Trying
to stretch the dollar, right?Trying to get more done with
less, right, is like whether youlook at many of the stories from
Jeff Bezos and whatnot, likefrugality and being able to do
more with less is a trade that'svery useful, especially if
you're going from 0 to 1, right,because the resources are
(09:56):
scarce. You still got to makeprogress. And I think that is
like a character trait thatpeople who immigrate,
especially, you know, let's sayfrom India or so where the
resources might not be thatmuch.
That's a big one. The fact thatyou leave a country that you
have spent 23 years and areready to enter a new country
where you probably don't knowanybody else, right, is another
(10:18):
character trait is you're readyto take a little bit of risk and
jump into the unknown with alittle bit of confidence that
you'll figure it out. Andstartup journeys are like that,
right? When you start a startupon the 1st day, you don't I
mean, you might have a plan,but, you know, the plan will
probably change along the way,but you still have to have the
confidence that you'll figurethings out along the way. And I
(10:40):
think these are some of thecommon traits that become very
handy when you're starting acompany, especially from from
scratch.
Mahendra Ramsinghani (10:47):
One quick follow-up to that, Kumar, is
that, you know, you make theleap to land here. There is also
this theory about the soil isnourishing. You know, if the
entrepreneur is the seed, thecommunity, the culture, the
legal framework, there are somany things about the United
States that makes it very highlysought after for entrepreneurs.
(11:08):
I mean, can you talk can youflip the script on the other
side to say what made you feelwelcome here, and how did you
find your way to the first phaseof your career?
Kumar Saurabh (11:17):
I think that that second bit is probably an even
bigger influence, I would say.Right? And and I think even the
difference between, I mean,nowadays New York has a very
thriving tech center and so onand so forth, right? But if I go
back in 2,001, there was amarked difference between, you
know, the tech scene in SiliconValley versus even New York at
that point, right? And the factthat I ended up at Series A
(11:40):
company, right, pretty much bychance, and to see that company
grow and, you know, working withhuge Zamanzi was the CTO, one of
the smartest people I know atthe ArcSight, right, To, I was a
kid straight out of school.
So the ability to work withpeople like that gives you the
confidence that you can actuallystep out and start your own
startup as well because you haveseen the movie once or twice,
(12:03):
right? So so I think that thatexperience, that opportunity to
be part of a startups I mean,nowadays, there are other parts
in the world where there is agood thriving startup community,
but I was extremely lucky tofind myself from New York to
Berkeley to back in Sunnyvale ata startup that was a pre
revenue, pre one o customer, andalmost, like, humongous amount
(12:25):
of luck. The company almost dieda year later, could not raise
series b. I had a tough timeraising series b, somehow
managed to scrap together a$5,000,000 series b. And then 8
years later goes IPO, and acouple of years later after
that, get acquired by HP.
And I think there are 5 or 6companies, today in cyberspace
that have come out fromexarchitect. And ArcSight was a
(12:47):
small team, relatively speaking.It was not the scale of Google.
So I think that opportunity tobe part of a start ups is a big
opportunity for founders.
Sid Trivedi (12:58):
You know, you talked a little bit about
ArcSight. And so let's let'sdive into your career. And
you've spent the last 20 years,Mark, really building software
for the security operationscenter. And and all of that
started at ArcSight, which youjoined after graduating from
Columbia. You're one of thefirst few employees there, and
ArcSight really helped to createthe SIEM or security information
(13:19):
and event management market.
That whole category was builtbecause of ArcSight. Why did you
join ArcSight, and what was itlike being in security 20 plus
years ago when everything wasnew, when SIEM didn't exist as a
category?
Kumar Saurabh (13:32):
So I think the reason I joined ArcSight, one, I
got lucky because we're goingthrough a downturn, and the big
company we're not hiring. Sothank God, HP and Sun were not
hiring because I wonder what mytrajectory would have been if I
had ended up at one of thosecompanies. Right? So I got
lucky. It's a blessing indisguise that it was going to a
market turn and happened to beVP of engineering at Arts had
(13:55):
reached out to me.
I put my resume on some job siteand within a week, right from
the day I put my resume on thejob site, I think I put it on
Sunday. On Tuesday, I got anemail saying, hey. Very
interested. Can we fill out thistechnical test? Six questions.
2 hours later, I turned aroundand sent they're like, oh, looks
good. Come by, interview onThursday. And on Friday, they
(14:16):
made a job offer, and I actuallyaccepted it on the spot. I
didn't even look at the second,3rd, or 4th company. So I just
love the people.
Like, I interviewed with HughJumanzi, couple of people, early
employees at Arts. Just love theteam and the problem that they
were solving, and I did not knowabout the cyber. So early days
(14:36):
of it was was just going tovarious science courses. Right?
So I took GCIH and GCIA backwhen to kind of educate, and our
side was very good in sponsoringthose and and training up its
employees.
Many of them had never been incyber before so that we can
start learning the basics ofcyber and start breathing and
(14:57):
living that life, right? So thatway, that was how it felt very
early on, and we're working withvery early customers in the
beginning. Intel was one of theearliest customers at ArcSight,
tremendous learning experience.And by the time ArcSight was at
version 3.0, it was a prettydarn strong product. And right
around that time, Gartner camearound and they started kind of
(15:19):
coining the term the SIEMsecurity, and then it became a
category.
And for the next 5 years fromthen, ArcSight almost, like, was
always, like, up and to theright on the Magic Quadrant for
a number of years.
Ross Haleliuk (15:30):
In 2010, together with your former ArcSight
colleague Christian Biedgen, youfounded Sumo Logic, the first
cloud based SIEM. What createdthis opportunity in the market,
and what advice do you have forfounders looking to identify
which existing categories areready to be disrupted?
Kumar Saurabh (15:49):
So I get I got very lucky. I mean, I I felt I
in last 21 years, I have felt ittwo times, and the second time
was just like a couple of yearsago. I remember very vividly
that Christian Bedgin and StefanZier was the chief architect at
Sumo, so he was literallyemployee number 3 after
Christian Nye. All 3 of us wentto a talk that Werner Vogels was
(16:11):
giving, and he was giving a talkabout this thing called Cloud
and how AWS do. There was acompany that, you know, you put
a bunch of, you know, picturestogether and they'll build a
video out of it, put some musicbehind it.
I even used that for my wedding.And they were running all in
Cloud, no Cloud, no on preminfrastructure. And the New York
Times took something that wouldhave taken $6,000,000 and one
(16:34):
software engineer because theycould scale it and run it on,
you know, 10,000 or a 1000servers at a time did that over
a weekend in under $6,000 So itwas a very compelling case that
cloud is bringing a new kind ofscale. And we used to say that
ArcSight in a way was solvingthe big data problem, but it was
a scale up strategy, a scale uparchitecture, not a scale out
(16:56):
architecture. Right?
Nowadays, nobody does I mean,very few people do a scale up.
Everybody does a scale out.Right? And so that was that was
an moment is that, you know, werun into so many scalability
challenges at ArcSight. What ifyou could run a cloud based log
management, a cloud based SIEM,and suddenly you get the scale
(17:17):
of 10,000 servers and all ofthat infrastructure, and you
take away the operationaloverhead so it becomes easier
and easier to operate for thecustomer.
And on the back end, you get atremendous amount of scale. And
we knew that many of thecategories, right? I wouldn't
name names, someone in 2020asked me, how is it obvious that
(17:39):
cloud is now going to be themain thing? I'm like, that was
obvious 10 years ago, right?Because, I mean, this is where
you look at these mega trendsand you don't know exactly how
the path will take in theintermediate 1 year, 2 year, 3
year, 4 year time frame, butthere is no doubt that in 10
years, it is fundamentally goingto change architectures, change
(18:00):
product categories.
And I said I felt it 2 times inmy in my career, and the second
time, it's is the same way Ifeel about AI. It's like what
will happen in 2025, in 2026might be up for debate. Right?
But if you look 5 years, 7years, 10 years farther out,
there's no doubt in my mind thatit will fundamentally change a
(18:21):
lot of product categories,including one that is near and
dear to my heart, which issecurity operations.
Sid Trivedi (18:28):
You mentioned this kind of insight in recognizing
the value of the the the cloud,Kumar. Once you figured that
that piece out, why didn't youand Stefan and Christian just
build this in at on ArcSight? Imean, you had all of the the
scalability, the distribution in2010. Why didn't you try to
build it in?
Kumar Saurabh (18:45):
Without getting into too many details, who says
nobody did, right? But this isthe classic, you know, this is
amazing, right? There is a verygreat book, Creativity Inc, Ed
Capmel, maybe I'm butchering hissecond name, right? But he talks
about a hungry beast and an uglybaby concept of this, right? So
hungry beast is the part of thebusiness that's working well,
(19:07):
right?
And ArcSight was a hungry beast,big sales team, $1,000,000
deals, right, commonplace. Nowyou go in and say, I want to do
this small little thing in thecloud. Like, why would you do it
in the cloud? Nobody's askingfor cloud, right? In fact, 99
out of a 100 people will tellyou don't do it in the cloud.
It's like, we'll never put datain the cloud, right? So it's
(19:30):
basically the ugly child is theugly baby has to be protected
and given enough oxygen to grow.And actually very many large
companies, quite honestly, suckat it, right? They accidentally
suffocate and they starve theugly baby. It never gets a
chance to even become ateenager.
And so guess what? You know,that's why I love the Bay Area,
(19:53):
the early stage VC and fundinginfrastructure that is like,
Hey, if you have an idea of anugly baby, people take the risk,
right? And sometimes it doesn'twork out. Sometimes it does work
out. So that was the reason.
And I've seen that movie playout more than once, right? Where
there's a fabulous idea, bigcompany could have done it, but
(20:15):
somehow they never are able toexecute very well because they
don't fund it, they don't createa protective area around the
ugly baby. So give ugly babyenough time to grow up.
Mahendra Ramsinghani (20:26):
And so, Kumar, how big was ArcSight when
you decided to make the leap interms of headcount or such?
Kumar Saurabh (20:33):
I think I I joke that I have never worked at a
company for more than 6 monthsthat's larger than 5 100, 600
people in my last 21 years. So Iwould have to guess that it was
right around the time where Iwas thinking 600 people seems
like too big a company formeetings are moving very slow.
Not as innovative as it used to3, 4 years ago. And it's not
(20:54):
like it happens one sudden day.It's a frog in the boiling water
kind of thing till one day youwake up and realize it's too
darn slow and not innovativeenough.
And then once some creativityspark goes off, you're like,
okay, I gotta step out of thisand kind of start things from
scratch.
Mahendra Ramsinghani (21:12):
So I think your threshold is the 500 ish
mark, and you get to kind ofjump out at that point.
Kumar Saurabh (21:19):
I think it's not the size of the company. I tell
people that impatience is bothmy feature and my bug. So I'm
not a very patient man. And overtime I have grown comfortable
with that. It's like when peoplesay, oh, it can be done in the
next week, it's like, what'swrong with tomorrow?
Right? And when you ask thatquestion, a lot of people get
(21:40):
like, no, it can be donetomorrow. And 9 out of 10 times,
if you don't give them a choice,it has to be done tomorrow, and
they kind of take it that it'snot changing. It has to be done
tomorrow. 9 out of 10 times, itactually gets done tomorrow.
So, so I think the biggercompanies kind of start to lose
this a little bit over time, bitby bit, bit by bit. And when it
(22:03):
becomes too much, that's thetrigger where I go, like, why
does it take 2 months to dosomething that can be done in 2
days? And that's that's one ofthe telltale signs where I'm
like, okay, something gottachange.
Mahendra Ramsinghani (22:15):
And so now you made a leap. You are
starting Sumo Logic. I mean,give us a sense of what was the
starting journey like, and thenwhat was Sumo at scale? You
know, at its peak, customers,operations, servers, etcetera, I
mean, give us a sense of thatjourney from start to its peak.
Kumar Saurabh (22:32):
So I was there for the 1st 6 years, right, and
and I think Sumo went IPO in2020, and if I remember
correctly, got acquired a P firmin a couple of years later. When
I was there, you know, we wereprobably doing 40, 50,000,000 in
ARR. Had, I would probably sayclose to a 1000 customers at
(22:52):
that point, right? And so I lookat this as 3, 2 year my 6 years
with Sumo, I split that into Imean, there was a period, 6, 9
months of the ideation andgetting to the point where we
started the company. But thecouple of years was after that
was really building thisscalable platform.
And then 2 years after that wasperhaps the most interesting
time period because the onboardcustomers. And the platform and
(23:16):
even the cloud was so new thatfor every 8 quarters, every last
2 weeks of the quarter, I didnot sleep all night. Right?
You're lucky if you get 3, 4hours of sleep because at 4
o'clock in the morning,something breaks. Right?
And your pager goes off. You hopon Slack. There are another 5
(23:40):
engineers up at 3 AM, and we aretrying to fix. It was
colloquial, you know, we'refixing the plane while we're
trying to fly at faster andfaster speed. So that was a
great learning experience interms of not only seeing the
business grow, that was oneinteresting aspect of it, but
also the other interestingaspect was how do you take a
system that was meant to run 10,20 customers and scale it 10x,
(24:04):
right, in a couple of years ormore?
And that was a great technicallearning experience. And the
couple of years after that, thelast 2 years was more of a
management. And I actually put acouch in my office because my
job became calming people downand stopping them from killing
each other because they had atechnical argument. In the heat
(24:26):
of the moment, those argumentslook big, but if you step back,
you know, how do you resolvethose conflicts? How do you get
a group of 100 very strongengineers to work together?
I mean, that is a challenge Iactually quite honestly enjoyed
for a couple of years, but afterthat, you know, I'm more of a
builder, whether it's producttechnology or a company builder,
(24:47):
and not as much. I can domanagement for a little bit. I
enjoy that in small doses, butwhen that becomes 90% of your
job, that's not the ideal fitfor me.
Mahendra Ramsinghani (24:58):
Yeah. And, Kumar, I think you're one of the
rare technical founders who hasbuilt things that have scaled
very rapidly. For our audience,what are some lessons they
should keep in mind as theythemselves are building their
startups? This notion ofdesigning to scale, what are
some things that, they need tobe, very, very thoughtful about?
Kumar Saurabh (25:21):
There are a lot of I I think Google has a pretty
tremendous engineering culture.Right? And I have also seen
companies that don't have theculture and that crumble under
the technical debt, right? So ifyou ignore the technical debt,
it grows on you, right? And, youknow, Christian and I, Bruno, we
(25:41):
many times had, you know, headbutting with our CEO because
we're building a lot of featurefunctionality that the customer
wants sometimes at the cost ofnot investing enough in the
platform, right?
And as a CEO now, when the showis on the other foot, I have
more appreciation for, you gotto invest in the technical debt.
You got to invest in theunderlying platform and somebody
(26:03):
has got to champion for that.Another thing that I would say
is like the rigor. And I thinkthe rigor around even things
like root cause analysis and soon and so forth, and you're
constantly rebuilding theunderlying platform. There are
some components of the systemthat we had to redo every year,
right?
(26:23):
And so we were on V4, V5 ofcertain components of the system
because you scale it 10x and theworkload increases another 10x.
Sid Trivedi (26:30):
Kumar, we I wanna move over to, you know, the
topic of Gen AI, and you talkedabout these kind of 2 cycles
that that you have seen cloud,and then, obviously, what's
happening today with with Genai.You've certainly started your
3rd company now, AirMDR, andthat that was something you
founded last year, and and I'vebeen fortunate to to to work
with you on that that journey.What was the reason behind why
(26:52):
you decided to go and build AirMDR? What was this this focus
on, you know, building anautomation first MDR? What
motivated you to kind of say,hey.
This is where I wanna spend mytime for the next decade?
Kumar Saurabh (27:04):
So for a long time, even as an undergrad, I
did AI, but AI at that point wasminuscule, right? Trivial
compared to what is possibletoday, the scale at which you
can build models, all theinfrastructure is there today,
right? So it's a very different,it's almost like a golden age
for the AI, right? And so, but Ialways believe that whatever
(27:28):
people can do over time,machines will do it better,
faster, cheaper than people. AndI am perfectly comfortable with
that outcome, right?
If I have to go 5 miles, I wouldrather drive. There is no pride
in me running. I can neveroutrun a car. I'd rather drive a
car, and even better would be acar that drives itself just gets
(27:50):
me from point A to point B,right? So I fundamentally
believe in that, right?
And 5, 6 years ago, I startedautomation was the best you
could do, right? But do yourealize that automation is not,
like there was a category calledSOAR, and I say tongue in cheek,
there is no I in SOAR. There isno intelligence in SOAR. SOAR,
(28:12):
someone intelligent has to tellSOAR what to do. And when AI
happened, right, it was not justabout the language models, but
what the language model kind ofshowed a peek into the world
where you can build this AIagent that can actually AI agent
is the vessel of thatintelligence.
And the UX is much better,right? So you can now, it's not
(28:35):
some neural net that you don'tknow how it works, but it just
works, right? No, these days,the models can actually converse
in natural language with you. Sothe UX has become much better
and the intelligence has gottenmuch better. So I really think
that, you know, various AIagents, and this is what I
believe that will happen in next1, 2, 3, 4, 5 years, is that AI
(29:00):
agents will actually be able todo 60, 70 percent of the work
better than people that aredoing that today in the whole
world, right?
And it will be a journey to getto that point, Yeah.
Sid Trivedi (29:13):
I think you talked a little bit about AI agents and
leveraging them in the SOC.There's several companies that
are kind of doing this in cyber.I mean, there's probably 15 plus
companies. What are you doingthat's different? What did you
see and you said, Hey, this iswhat the world is not doing,
similar to the way you figuredout cloud based SIM was the
future with Sumo?
Kumar Saurabh (29:31):
Right. So I I I think there are a couple of
things, right, just like atSumo, right, I remember in the
early days, there was a verylarge bank. I think it was UBS
or something. They called us oneday, and I happened to be the
sales guy, the CEO that took wewere all in one my office,
right, happened to be there. Wetook the call, the UBS guy goes,
would you run your software onprem and we'll write you a very
(29:54):
big fat check?
And the sales guy just hung up,thank you, see you later. And we
were all delighted that thesales guy was able to walk away
from a very big fat checkbecause he understood that the
whole point of the cloud is tonot run on prem, run it as a
server. The whole point of thisAI agent, I believe the ultimate
form is to run the AI agent as aservice, not as a software that
(30:17):
gets deployed in other people,but just do the entire work end
to end. I believe that is a farbetter model. One, it's a far
better model for the customerbecause when I talk to
customers, 80, 90% of thecustomer is small to medium
sized customers.
Just want the problem ofdetection and response to be
taken care of, right? Now thereare 1% of the very large
(30:39):
companies, and I think they willcontinue to buy software, just
like there are still peopletoday that would only deploy
things on prem. But I think manyof the cloud companies have
shown that you can build a verylarge company being purely
cloud, right? And so theapproach that we are taking, we
fundamentally believe that it'sbetter for the customer. And
(30:59):
more importantly, when you ownall the different layers of this
stack, right?
The data, the detection, thetriage investigation response,
the people, the processes, youcan integrate that much more
tightly than if 90% of the stackthat you need to operate is
owned by some other company thatmoves very slow. And you are
(31:19):
expected to produce the results,but you only own 10% of the
stack. Right? And so this is oneof the fundamental differences
from almost every other companythat's working on the AI agent
for SOC. They're mostly doing itas a software, and we are doing
it as a service, and we aredelivering detection and
response as a service for smalland medium sized companies, and
(31:41):
medium sized companies could be5,000 people strong.
Sid Trivedi (31:44):
And by this, you mean you're not actually
exposing the agent to thecustomer. You're exposing the
end result as
Kumar Saurabh (31:51):
Absolutely. So we are delivering the end result,
but we don't put the onus oftraining, making sure that the
virtual analyst is actuallyworking and working well on the
customer. We take that on ourpart. We do provide them
visibility. So we're we believein 100% visibility to the
customer.
You can lift the hood, lookunder it. But at the end of the
(32:12):
day, who owns the responsibilityof making sure AI analyst works
really well? It's not thecustomer. It's the provider.
It's the builder of the AIagent, and the customer gets the
outcome.
And the outcome that they expectis detection, triage,
investigation response as aservice.
Ross Haleliuk (32:28):
In the Bay Area, there is a lot of excitement
about AI and its potential totransform security. However,
outside of the Bay Area, manycompanies are more cautious or
even skeptical. From yourperspective, how does the view
of AI in cybersecurity differbetween the Bay Area and other
regions?
Kumar Saurabh (32:47):
Yeah. That's a that's a very interesting
question. My experience has beenthat there is something
something either good or bad inthe water in Bay Area because
there is a heavy degree ofoptimism, right? And some can
even say, like, unrealisticamounts of euphoria around AI.
Some of it might be a little bittoo far fetched.
On the other hand, right, I'vebeen to, not to pick any place,
(33:09):
but I did happen to go to Dallasa couple of times in October.
And at one of the dinners, notonly people were not believer in
the AI, but they were almostskeptical. Right? And I think
what changes that is is a bit bybit journey, like seeing is
believing. Right?
Like if you read a researchpaper on chat GPT, you would not
(33:30):
believe it, but if you could login and you can actually get your
hands on the keyboard and usechat GPT, then you'll be
impressed and you'd be wow. So alot of that has to happen in the
space of AI. The more peoplebecome familiar, right? I own a
Tesla and I was very skepticalabout self driving, till I
started using it. And I couldnotice a change in my own
(33:52):
mindset, how well the technologyis improving, right?
And it's probably, it stillneeds more work, right? But you
can see the progress. And thesame thing is happening in AI
and cyber. As more and morepeople experience it, they'll
become more of a believer andless of a skeptic. And security
people are skeptical by nature,right?
So that's their default, that'sthe place where they start. And
(34:16):
I think healthier skepticism isgood. And I think as they get
more hands on familiarity andthis can see the outcomes and
the value of AI analyst orapplication of AI in cyber work
and deliver results, that's whenthey will start changing their
opinion.
Mahendra Ramsinghani (34:32):
I think, Kumar, there's a great
observation there betweengeographies, adoption curves.
And I wanna go back to that partwhere you talked about Sumo
Logic. You're catching on to thecloud wave. But there is this
big legacy part that is tryingto say, well, can you do this on
prem? And you guys are, like,strong and disciplined enough to
say no.
(34:52):
Now take that same analog forthe AI phase that we are in, and
where is where is the resistancegonna come from? How do you
break across that resistance?
Kumar Saurabh (35:01):
This is such a wonderful question. We just saw
so we did POC with 2 very largeSOC teams. Right? 1 had 30
people, 1 had 80 SOC analysts inthe team. Right?
And one team is full on thebelief in the world where AI
analysts should do 80, 90% ofelectronic investigation
(35:23):
response. So they're full intothat, and they bought in, and
they're all in there. In theother case, we showed them the
technical win. We showed themwhat was possible with that. But
instead of investing in thistechnology, they went and hired
13 more people on the team.
And so this is the inertia,right? It's like, this is why I
believe doing it as an MDR hasan advantage because even when
(35:46):
you give them the technology,show them how it works, show
them the outcomes, changing theorganization to work in
different ways, changing 30people's mindset, changing the
processes is not something thatevery company can accomplish.
And that is another reason whywe are doing it as an MDR
because time is of the essence.I would want this technology to
(36:07):
be in the hands of as manycompanies as possible in couple
of years as opposed to taking 6years to get there.
Mahendra Ramsinghani (36:14):
You know, that's a fascinating observation
that, between 30 80 analysts,one of them is just grabbing on
to everything that you have tooffer, and the other is saying,
well, we'll go ahead and hiremore people. Or, you know, if I
use the horse card versus cardanalogies, like, we're gonna,
you know, buy more horses. It'snot gonna help you to get to
(36:34):
your destination faster,unfortunately. So there's gonna
be an interesting, shift herethat occurs. You know, this is
your 4th startup, Akbar.
When you look at the companythat's gone public, companies
that got acquired in your past,you've done it all. What keeps
you excited? What keeps yougoing? And, where do you find
your mojo?
Kumar Saurabh (36:54):
I think I honestly find making a little
slice of future, being able tosee it and then make it a
reality in a few years, right?It's a pretty, pretty satisfying
thing to do, Right? And andluckily, you know, there is
always every few years, there issome new technology so you can
(37:14):
move the envelope forward. Youcan get a little piece of, like
and I understand certain areasright around data, around data
driven operations, SecOps,DevOps, these are the areas that
I understand. And whenever thatopportunity presents where you
can take where you can imagine amuch better future, and then you
get the opportunity to work onmaking that vision of the future
(37:37):
make it a reality.
I think I find myself blessedthat I get paid for doing that,
right? In a way, it's like, itis an incredible role, it's an
incredible opportunity. So aslong as I keep finding
opportunities like those, I keepworking on those. So just to
flip that around, Kumar, what'syour biggest frustration, or
what what do you find holdingyou back? I think, though, you
(37:59):
know, the part of it is itsconstraints, and I think it's a
healthy I think I almost feellike constraints breed
creativity.
I do believe in that. Right? AndI I think it's not there are
very few things actuallygenuinely get me frustrated.
Right? So it's like, you know,999 out of 1,000 things are
(38:20):
solvable.
Right? And and very rarely arethere things that are truly that
frustrating. Right? So there'smaybe that's just the
personality type. It's like, ittakes a lot to get me
frustrated.
I think what gets is how do weget 100 and 1000 and tens of
thousands of the customers tokind of go along? That is
probably I find as the hardestchallenge. Like building the
(38:43):
technology and showing it in thesmaller parts, but getting your
whole industry to kind of movein a certain direction. Once you
see it happen, it's veryfulfilling to see that. That's
also probably the mostchallenging part of it.
Sid Trivedi (38:56):
As we go into our last section of this podcast,
let's talk a little bit aboutlessons for founders. And, you
know, one of the things I'veseen you do really well, working
closely with you in AirMDR, isyou have this truly unique
superpower in recruiting talent.And that talent includes both
finding, you know, high qualitycofounders to join you, having
(39:19):
individual engineers joiningyou, individual sales leaders.
You're just fantastic at it. Youcan convince people who haven't
even thought about joining astart up as early as this to
come and join.
What advice do you have forfounders, particularly first
time founders, who are lookingto hire that critical employee
or convince a cofounder to leavetheir job and join them in a
(39:40):
startup? Like, how do you do it?
Kumar Saurabh (39:41):
Yeah. I I I think that's you know, there is a
little bit of, you know, meme ordebate going on this whole
founder mode and manager modeand things like that. Right? And
I think I come at it from a morenuanced perspective of it.
Right?
You have to at many times peoplesay, hey, it's your company.
Right? And I think you, as afoundry, it's a first time
(40:02):
foundry, it's a little bit of,like, it feels good to say it's
my company, but it really takesa lot of people to build a
company. Right? So, so the firstof all, it's realization that
you want other people in thetent and you're ready to give up
your Legos, right?
If you are going to hold on toall your Legos, then you're
(40:23):
constraining the kind of peopleyou're going to attract, Right?
Because other people want toplay with Legos as well. Right?
So part of it is to figure outwhich Legos you should give. But
whenever you give up the Legos,I mean, the art of the
delegation is you are stillresponsible for the results and
the outcomes at the end of theday.
Right? So how do you strike thatbalance of giving up? So I'm not
(40:45):
a big believer in, like,micromanaging and controlling
everything. On the other end,I'm also not a believer in just
get letting the reins lose trackof this script, so to say. Like,
you still have to own theaccountability.
You still have to be closeenough, so you know when to step
in, when to pull in. So that's afine balance. But that is one of
(41:06):
the things. And the other partthat, so the, it starts with the
first part of it is willing togive up parts of the company,
parts, big pieces, impactfulpieces of the roles to other
people, right? Trust them to dothe right thing and bring them
in.
There's other part that I wouldsay during the interviewing
process, right? You're selling,you're also buying, but you're
(41:28):
listening like any, like most ofthe sales processes have a
discovery phase at the verybeginning, Right? And many of
the sales people, right, when Iused to go on the sales call,
it's like, I want to pitch youwhat I'm doing, as opposed to
asking questions, learn anddiscover. And over time you
change your approach. And in therecruiting phase, if you listen
carefully and you ask questionsthe right way, people will tell
(41:50):
you what, where they want to goin 2 years or 5 years, right?
And then it becomes acollaborative problem solving
exercise. Can we get you therehere? And how do we make this
the best place that you can get?And once you problem solve with
those people, one out of 10times, you can't make this the
best place for them and youwon't be able to close. But 8 or
(42:11):
9 out of 10 times, if you gothrough the process, listen
carefully, do the discovery,figure out where people want to
go and find that opportunity.
And when you find theopportunity that requires giving
up the Legos, be open to givingup the Legos. If you do all of
those things, you can probablyrecruit pretty awesome talent.
Sid Trivedi (42:29):
Maybe a follow-up to that. I mean, most of the
time, founders aren't actuallyrecruiting from other start ups.
They're recruiting from largercompanies. So the difference is
you're you're trying to convincesomebody to leave their cushy
job. What are the things thatyou use to try to convince those
folks?
I mean, obviously, theyrecognize that they're not gonna
get paid as much and theyrecognize they're gonna get real
equity, but what's the piecethat actually convinces
(42:51):
individuals to say, hey, I wannago and do this much earlier?
Kumar Saurabh (42:54):
Like, look, what I believe is that it's a game of
self selection, right? And Ithink if you want a nice cushy 9
to 5 job, you should probablywork at Intuit, right? Or there
are many companies where, youknow, it's a very, nothing wrong
with that. Like, look, I do notjudge that, right? That's not
for me and that's not foranybody who wants to join a
(43:17):
startup, right?
And so you can, it's not wrongfor someone to say like, look,
I'm looking for a Monday toFriday 9 to 5 job. That's okay,
You should go somewhere else.Right? I do not try to recruit
those people at all. Right?
I try to recruit those peoplewho are like, who are looking
for something more, who arelooking to make a bigger impact.
And people who have that itch,they might have been working at
(43:37):
McAfee, they might have beenworking at Google, and they feel
like they're a tiny cog in thishuge machine and what they do
does not make an impact. And ifthey are talented, right, those
are the people that you can veryeasily attract, right? Because
at a startups, you're prettymuch the maker of your own
destiny, right? And what you doactually has a very immediate
impact that you can see.
(43:58):
And a lot of people find thatvery exciting and attractive.
Ross Haleliuk (44:01):
What happens when you hire someone who is not a
good fit for a startup? I knowthere are plenty of talented
people at large corporations whohave a very romantic idea of
what working at a startup wouldlook like. Many are used to
having a lot of resources attheir disposal, large budgets,
great teams, and many maystruggle without having such
(44:22):
support at a startup. How haveyou navigated this problem, and
has that ever been a problem foryou?
Kumar Saurabh (44:28):
I know within less than 90 days, more like 30
or 60 days, if I made a mistake.Right? If someone passes the
filter where I figure that outafter they join, I ask myself a
really hard question is like,that's a mistake I made, right?
And I do make those kinds ofmistakes, but the chances I made
those mistakes have gone downdrastically over the years. And
(44:49):
the way of this is I own whatworking in a startup is like,
right?
I don't expect people to work110 hours, right? It is
sustainable pace, but it isgoing to require, like I will, I
tell people engineers to join,if your product doesn't work on
a Saturday or a Sunday or onThanksgiving or on Christmas, I
(45:11):
will call you, right? And Iexpect you to pick up the phone.
If that scares you, you willrun. You will not come back for
the next interview after that,after hearing me clearly tell
you that, that I have no shamein that fact that I will call
you, right?
So part of it is like, it iswhat it is, right? I'm brutally
(45:31):
honest about it. I try to givepeople a dose of reality before
they join and it's not foreveryone. And it is for a
certain group of people thatjust love, I mean, I've worked
with people who have worked withme. Like there are people at
Sumo who've been there 12 years.
There are people at Logic Appthat joined in early and left
the day result. So I have foundpeople that want that and
(45:55):
they've worked through that foryears in very, very hard
situations. So it's about selfselection. There are startup
people and there are big companypeople. Big company people
should go to big companies, andstartup people should go to
startups.
Ross Haleliuk (46:07):
That is a very rational and a very wise way of
looking at this. So question foryou, Kumar. You've worked in the
past with 4 of the biggestbrands in enterprise
infrastructure investing. You'veworked with Greylock, with
Sutter Hill, Sequoia, and Accel.How much does the brand of the
firm matter when a founder ispicking Avisi?
And how do you balance the firmreputation with the individual
(46:30):
partner you're going to beworking?
Kumar Saurabh (46:31):
It's very funny because we started this
conversation talking about IITs.IITs have 500 graduates from
each one of them every singleyear, right? So there are
probably thousands of IITs,right? If you actually mapped
out like where different peopleof these are, there is a
humongous amount of variance,right? But I think it's a
(46:52):
signaling, right?
If you had a 5.0 or 4.0 GPA fromMIT or Stanford, that does say
something, right? So brands andinstitutions have a certain
signaling effect, right? So thatis a fact, right? On the other
hand, I think, I always believethat at the end of the day, you
work with people, you work withpartners very, very closely,
(47:15):
board members, right? And theyare part of your team, right?
And I think they're part on yourteam, they are board members,
right? So I think I would put awhole lot more value on the
person that you're working with.You know, how much did they go
out of their way to help youeither make introductions to
customers, other investors,other executives. I have seen
(47:38):
firsthand how, you know, boardmembers can be super helpful in
attracting and recruiting reallyhigh quality, very senior
talent, both at Sumo, in priorcompanies, even here at Air MDR,
working with Sid and all ofthat. Right?
So so I do think that brand doesmatter. I would probably put 20%
of the weight on the firmitself, but 80% of the weight I
(48:00):
would put on the person fromthat firm that you are working
with. Because that's the personthat you are spending a lot of
time, sometimes every week.
Mahendra Ramsinghani (48:07):
You know, speaking of, the IIT networks
and how these networks haveproliferated, how they've gone
on to become successfulfounders, One question that
comes to mind, Kumar, is thatnow imagine you have completed
the journey with AirMDR, okay,and, there is a young immigrant
who just landed at the shores ofthis great country and is asking
(48:29):
you for advice. You know, whatare some, top 2 or 3 pieces of
advice you'd give to somebodywho comes in in terms of
building their career,entrepreneurship, and, achieving
success?
Kumar Saurabh (48:42):
I think on the founder side, right, I think I
would give a meta advice isthere are a lot more people that
have been down this journeybefore you. And I got this
advice maybe in 2004, 2005,right? As a young engineer, I
wanted to build everything. Andone of my managers said, Kumar,
(49:02):
you can go online and check ifsomebody has already done it.
And 8 out of 10 times, 9 out of10 times, other people have done
it.
And in the founder kind ofstage, if you're a first time
founder, there is lot of thingsto know, but there are also a
lot of people who have done thatjourney before you, right? And
people are generally superhelpful if you reach out to
(49:24):
people, and people will take thetime, give you 30 minutes, give
you an hour. So one piece ofadvice that I would say is reach
out, ask for help, genuinely askfor help. And starting the
company and all of that, that'sprobably, you know, there is ton
of material on, even on YouTube,on podcasts like this, right?
(49:45):
You know, you listen todifferent people's journeys and
different decision points thatthey had to take.
So there is a lot of informationout there, but one piece of
advice would be to would be toreach out to people who have
been down that path before you.And even if 1 or 2 people are
willing to help you, that can beimmensely powerful in terms of
guidance, in terms of mistakesto avoid, in terms of questions
(50:08):
to think through. And make yourown decision, but they can give
you a framework because they'veseen the movie before. If you
have seen the movie 3, 4, 5times before, you can actually
predict, okay, here are thedecision points you're gonna
face. And that advice, I getthat from board members,
investors, other senior peoplein different kind of roles.
So I I find a lot of valuereaching out to people and
(50:29):
asking for help advice. Butagain, at the end of the day,
you gotta own the decision. Yougotta make your own decision,
but getting different pieces ofinformation and input is super
helpful.
Mahendra Ramsinghani (50:38):
I couldn't agree more, Kumar. You know, we,
we live in a in a time and ageography that is, very
interesting. America as acountry has been, kind of the
landing pad for entrepreneursfrom across the world. And what
you touched on has been sort ofthe DNA or the fiber of this
country's entrepreneurial zealis that somebody who is
(51:01):
successful is always willing tohelp, is always willing to
engage and give back in a in ameaningful way, and I think
that's what makes, our journeyalso very special. You've done
this now four times, right,ArcSight, Logic Hub, Sumo Logic,
AirMDR now, and you continue tonot only inspire other founders,
(51:22):
but also help them behind thescenes in your own way.
So we wanna say a big thank youto you for being such a positive
force in the world ofcybersecurity. You know,
innovations, entrepreneurship,raising capital, building teams,
I mean, these are not for thefaint of heart, and the fact
that you continue to do thiseach day and every day is a big
(51:43):
source of inspiration for a lotof us out there. So thank you,
Kumar.
Kumar Saurabh (51:46):
This has been a lot of fun. Enjoyed the this
discussion. So thank you forhaving me on, and it was a
wonderful conversation.
Sid Trivedi (51:53):
Thanks, Kumar.
Mahendra Ramsinghani (51:54):
Thank you, Kumar.
Sid Trivedi (51:57):
Thank you for joining us Inside the Network.
Ross Haleliuk (52:01):
If you like this episode, please leave us a
review and share it with others.
Mahendra Ramsinghani (52:06):
If you really, really liked it and you
have some feedback for us, wrapit on a bottle of Yamazaki and
send it to me first.
Sid Trivedi (52:15):
No. Don't do that. Mahendra gets too many gifts
already. Please reach out byemail or LinkedIn.
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Therapy Gecko
An unlicensed lizard psychologist travels the universe talking to strangers about absolutely nothing. TO CALL THE GECKO: follow me on https://www.twitch.tv/lyleforever to get a notification for when I am taking calls. I am usually live Mondays, Wednesdays, and Fridays but lately a lot of other times too. I am a gecko.