SaaStr 808: AI and Cybersecurity: Scaling Rubrik to a Billion Dollar Enterprise with Rubrik's Co-Founder and CTO

0:01Welcome to the official Sastr podcast where you can hear some of the best Sastr speakers. This is where the cloud meets. Up today on the Sastr Podcast. AI is not cheap. And people are saying, okay, if you're going to spend this much, what's the ROI, right? And this is where a lot of projects are getting stuck because they're not able to prove ROI. So the way we are doing it is we are looking at it as business metrics. I'll give you an example. For engineering, we have a plan of release, right? Roadmap. Can we reduce the net delay in roadmap items to delivering that to the business? So if we say, oh, we deliver in Q3, did we deliver 15 days later, 30 days later?

0:38And we want to reduce that. So that's a business metric that the business understands. And then we have AI metrics where we say how much code is generated by AI. But that's an internal metric. At the end of the day, we measure ourselves by did these two business metrics actually go down? If they didn't, then it doesn't matter. I can do 100 % AI code. If we don't meet those business metrics, it makes no difference to the business. Hey, are you tired of listening to hours and hours of sales calls? Recording is yesterday's game, folks. Yesterday's game. Attention.com unleashes an army of AI sales agents that auto-update your CRM, build custom sales decks, spot cross-sale signals, and score calls even before the coffee is cold.

1:18Even before the coffee is cold. Teams like Bamboo HR and Scale AI already automate their sales and rev ops using customer conversations. Step into the future at attention.com slash saster.

1:55That's adio.com slash Sastr. Hey, everybody, get excited. We just hosted 10 ,000 of you at the Sastr Annual and AI Summit in the SFB area. It was insane. It was off the charts compared to last year. It was a deep dive on everything new, everything AI, everything go to market. And we're getting ready because Sastr AI is coming to London in December. It's Christmas with Sastr on December 2nd and 3rd. We're bringing Sastr AI to the heart of Europe. This is your chance to connect with thousands of Sastr and AI executives, founders and investors all sharing the secrets to scaling in the age of AI. If you're a founder, a VC, a revenue leader, Saster AI in London is where the future of B2B meets the power of AI.

2:35And we just announced tickets and sponsorships. So don't wait. SasterLondon.com to grab your tickets. Saster AI in London, where B2B meets AI and the next wave of innovation begins. See you there.

2:54Well, good morning, everybody. How are you doing? My name is Kit Colbert, formerly CTO of VMware. Took some time off and just started as platform CTO for Invisible Technologies. We're very lucky to have Arvind with us today from Rubrik, who's the CTO and co-founder of Rubrik. So Arvind, maybe tell us a little bit about Rubrik for those that don't know the company or don't know them very well. First of all, thanks for having me here. so rubric we started rubric about 11 years ago and the goal was really build a platform that provides cyber resilience to businesses from the time we started to now cyber attacks have only been increasing and our goal is to provide a whole set of tools both if in case there's a cyber attack how we can recover quickly and what can you do before a cyber attack to protect your data which is your most critical asset we just finished as i said 11 years we've been rounded out the last decade by going public last year.

3:52So now we're on to the, thank you. And now we're on to the next decade of driving the company forward. Cool. So let's talk about your growth and your progress to date. I think we've got a slide here with some of the high-level numbers. Amazing, amazing results. Again, congratulations. Over a billion in ARR. Yeah. You know, you started with a core product and then you scaled to multiple products. This is, I think, a challenge a lot of companies have as they're looking to grow and continue scaling. How do you think about that? I mean, I imagine there's challenges both from an R &D engineering perspective as well as a go-to-market perspective.

4:29No, great question. I think so. With any company, right? So as you build out products, there's a certain scale at which, you know, a certain part of the product grows to a certain scale. You can only grow it so fast, right? Because there's a natural friction. So the way we have thought about it is that we need multiple kind of curves of innovation, right? So as one product gets to a mature stage, and there's still a lot of growth ahead of it, but it's not going to grow at like 100 % anymore. That's when if you can bring in a second product, which now accelerates the business, and that starts growing at like 100 % every year.

5:00And that kind of, so overall, your overall curve of growth stays high. And we've been doing this with multiple products. and we think of ourselves as really having multiple pillars in the data protection, data security, and now AI space. The way we have done it is, you're absolutely right, there's the R &D aspect, and then there's a go-to-market aspect, which is very critical. On the R &D side, we've been running a lot of the new products that we sell today in our portfolio, all started with the hackathon project. We've been running hackathons since we just finished our 10th hackathon last year.

5:39So we've been doing it from year two of the company. And it all starts with a few engineers spending 24 hours hacking up something and saying, hey, here's an interesting idea. And then we have, last year, I think we had 130 submissions. Out of that, we take the top 10, we review them, and then we go into, we actually go and review all the presentations and then pick out ideas that may be interesting and then take it to product. So almost all of them started that way. Wow. And then, of course, there's a whole question of as we get into a new space, there's a whole kind of like build versus buy question, right?

6:14And there have been cases where we felt usually when you want to build is either you don't have the skills needed, or you don't have the right kind of DNA, or there's a company that's already achieved momentum, and if you can bring that in. But there have been cases where we started with a build option, and then we realized, you know what? Let's just go build this. It's easier to build it. and we've gone the other way as well. So there's a whole build versus buy question. And then as you bring these products in or even build it organically, over time as you start scaling, you have to start thinking about platformization, right?

6:47Initially, you start doing stuff that's very one-off and then you say, okay, now for example, for cloud products, earlier each team kind of built their own products soup to nuts. Now we are actually taking all the core platform areas and creating a generic platform that you can build on. So that's kind of on the R &D side. and then obviously you have to make investment decisions how much you invest in the core business versus innovation and so on. And then on the go-to-market side what we've built is we've actually built a go-to-market incubation engine. So the way it works is when you're starting a new product typically if it's a new buyer it's hard for a large core sales team to go and do that because they're selling they're used to selling in a certain way.

7:26And the current product works well and they know they can sell other ones. And then how does it fit into the new product it's hard to go enable like 500 sellers to do this. So what we do is we create a, initially we create a go-to-market incubation team and these folks, they only make money if they sell this product, right? So they're waking up every day thinking, okay, what's the angle here? And so they can do the initial path finding. And then what they do is they say, okay, this is the, and obviously there's a lot of product iteration as well. So it's all to think of it as a pod, there's engineers, product managers, sales folks, maybe one marketing person.

8:00They're all iterating on the message and the product. And then once you see, okay, that this has legs, then we transition to what we call a product line sales team. And this is, think of it as scaling these two to three sellers to maybe like 10, 20 sellers. You can now go and really, again, again, they only get paid for selling this product. So they go and now scale this to the next level. So think of it as zero to 10, 10 to 100. And then once it hits 100 million or something, then you can say, now enable that. Of course, by that time, you hashed out the message, you hashed out what resonates, who's the buyer, how do you go?

8:31so the whole decks and everything, all of that have been built. Yeah, I imagine at that point, the core sales team would have some conviction in this product that they'd take it to a customer. And the product is also probably more mature, so you're not hitting bumps on every POC that you do. So then it gets ready to scale. So we have this conveyor belt of what we call RX, which is our incubation to product line sales to core. And we have done multiple products in this fashion. Okay, that's great, actually. I love that. Really good advice. So let's continue talking about scaling. And a couple of numbers up there, 39 % year-over-year growth, which is amazing.

9:08And 80 NPS. And getting a score that high is pretty rare, actually. I don't know many others that have it. So I'm kind of curious, as you go through this really rapid scale, you're branching out to multiple products, how do you keep that customer satisfaction so high? Yeah, the one learning for me through this journey is that, especially with large enterprise customers, I know there's this advice that say no to 95%. I don't believe in that. I think you have to say yes to everything. Because if you miss a large Fortune 500 customer, it may be a 100K deal. Down the road, that's a 20, 30X lifetime value you can build with a customer.

9:46So you have to figure out, you have to say yes, but then you have to figure out what is that piece of it that they truly need and distill it down to that. In terms of supporting customers, one of my co-foreigner and I were actually the first support people. So from like the first beta customer we had, anything goes wrong in the field, we'd be the folks taking the call, working with the customer, figuring it out. And a lot of our founding engineers would do the same. So there's been a culture of this customer first, let's make customer successful mentality that's been there from the beginning. And that is kind of like - Interesting.

10:21and percolated through the entire organization. Even today, if a customer says, hey, I have a problem, engineers will drop everything and jump on it. I support sales, everybody will drop everything and they'll jump on it. So that's definitely, part of it is culture. And we always keep emphasizing that make the customer successful. Nothing else matters. So, I mean, I think it's important just to pick on that point a bit that you as a co-founder were there, CTO were there hands-on, in support doing that. So I've seen a lot of engineering cultures that have kind of an ivory tower sort of mentality.

10:57They're not as connected with their customers. I'll give you an example. There was an early stage. There was a customer at 4 p.m. They said, this customer is really in bad shape. It was a law firm. There was some issue and their email system was impacted. So literally, I booked a flight for that night, took the red eye. I was with them two days and just sitting there until it was resolved and then flew back. So you've got to do things like this in the early stages, and you've got to show that you care. And the other learning is that, obviously, as you scale, you know, that it jumps in the road.

11:29Not every implementation will go as planned. But what I've learned is that what customers need is, first of all, be transparent. Don't try to tell them something that you cannot do. I'll give you an example. Very large retailer in Europe. They had this huge Oracle database. They came and said, we need this. And without this, if you don't have it, we're not going to buy you. So initially, there were a lot of questions, can we do it? Then we realized this is, no, we really can't meet the requirements. So one of my engineers and I actually went in front of the customer and said, you know what, what you want today, you want like a 7x reduction in time, it isn't going to happen today.

12:08But we will invest in this, and in six months, we'll be able to deliver it to you. But if you want to go with somebody else, we would totally understand that, so you should make the choice. They said, okay, we'll think about it. Next day, I came and said, you know what, we'll go with you. So being transparent not trying to sell them something that later they realize isn't there I think is key. The other thing is there will be mistakes. Again with customers all they want is acknowledge your mistakes. We are very very open about this was our we did this we didn't do this well this was our bad and we start with that we start with the thing this wasn't the experience you should have had these are the mistakes we made and we are doing stuff to fix that and here are steps to that we will get you to a better place.

12:47And usually when you're honest, I think a lot of people are not able to do that and because their customers get irritated saying, at least acknowledge the problem. So that's what we've seen and this is something that we have a truly world-class support team. Our chief customer officer, I mean, he's amazing. The team he's built and he was the one who took over from us and threw us out of the support room. You guys go build the product and he's really built this great support team and even when you lost POCs, our customers say, you know what, your support team is fantastic. But that's true that it percolates all the way from sales to support for engineering.

13:23And so, yeah, it seems like there's a deep level of customer intimacy that you guys have had from the beginning. Yeah, absolutely. Cool. Okay, so we're on the AI stage. So let's talk a little bit about AI. Now, I tend to break AI down to a couple of different buckets. We think about it in terms of technology vendors. How do we build AI into our products? And then how do we leverage AI internally in terms of our internal operations? and how we execute. So I'd like you to talk about both of those. Let me start with the product. What has your product strategy been around AI? Yeah, so I mean, you're absolutely right.

13:54We're thinking of it exactly. What can we do in the product and what can we do internally? So let's talk about the product. The product, we think of it as in kind of two ways. One is our product today is not easy, right? If you think of an average customer, they're using the rubric platform to protect their data that could be sitting in the data center, could be a VM, could be an Oracle database. They're using it for cloud, for, again, cloud VMs, cloud databases, object storage, and then they're using SaaS as well. And then there is, we have built a whole suite of security products, which very often the IT persona may not even have the skills if there is an attack.

14:30They don't even know what to do next. So the first step is to really, can we actually provide an assistant or co-pilot, if you will, for the rubric product to really make it easy? And that's what we call Ruby, is kind of this AI companion for our SaaS platform. And what it does is it really says, so for example, if you say, oh, we found a piece of malware, they're like, okay, what's an IOC? And we say, okay, this is what it means. And then it's like, what should I do next? Here's what we'd recommend. And what this does is it uses our knowledge base, documentation, support articles, wikis, and also is able to query the product itself through APIs, put it all together and answer the question.

15:10So that's kind of what we're building. So that's the, I would say, making our product more usable. We want to do, as we scale, we want more and more self-service. If there's a problem, don't come to support. Just handle it. So that's what customers want. And that's what will help us scale. The second piece is really about how can we, as our customers are on this AI journey, how can we enable them to build the AI applications they need? And again, there are tons of more. There's lots of stuff on the foundation models. And obviously that's the core of everything. But most of the time is not spent in foundation models.

15:40Nobody's training models. The work is in, okay, how do I get access to the data that I need to solve this particular use case? How do I make sure that, first of all, am I adhering to the security permissions that are there? And then more importantly, even if you have access to some data, what if somebody put something sensitive in there? The financial documents exposed to all of engineering. And then every engineer can ask a question and will get an answer from that. So this is where a lot of the time is spent. Almost like we've heard like 80 % of AI POCs don't make it to production. And very often, Inpostec is saying no.

16:17And we even talked to CISOs who said, we don't want to say no, we want to say yes. But we don't even get half good answers for the questions we are asking. And then our realization was, over the 11 years, we've been building exactly all of this. A, we take all that enterprise data, put it in a single platform, so it's easy to access it. It's automatically getting refreshed every day, every few hours. we understand permissions so we can actually make sure that you only see the data that you're permitted to see and then we can automatically suppress any sensitive information mask it so that it doesn't go into the model once it goes into the model you don't know how it's going to manifest itself on the other side 100 % so we were like wait everything we're building is really well suited for the problems that the enterprise is facing and that's why we announced the product called Annapurna which is really and it's very early stage I would say we're still exploring the right use cases and customers are also in the very early stage of innovation, but that's where we see a lot of potential there.

17:10I'm very excited about where we can make that. That's cool. So what I heard is that there's actually two sort of aspects of this. There's one of how are you enhancing your product with generative AI to help the customer and automate a whole bunch of stuff, make them better at what they do. But then that second bucket seemed to be you're actually helping the customer do AI themselves. They have AI projects. Can we solve the data problem from it? Focus on your business use case. Focus on your workflow. Focus on building the right kind of agents. But don't worry about the data. Yeah, which is definitely what I've heard as well.

17:40There's a massive level of scrutiny and concern about what sort of data. Do you have data leakage? Where is that going? How can you manage that? 100%. Okay, got it. Okay, let's change tactics and let's talk about using AI internally within Rubric. How are you as a company adopting AI? Yeah, so for the very same reasons, we actually at very early stage, We set up an AI governance committee. The goal there is to really have InfoSec, legal, everybody coming together with the goal of enabling AI adoption across the company, but doing it in a safe manner. And that has been very effective. But then there was a lot of grassroots stuff.

18:20Somebody saying, hey, I want to try this. They would go to the committee. They'd evaluate it and say, hey, is this secure or not? And then if it's secure, they say, okay, go ahead and do it. So we started seeing a lot of projects pop up. Then we said, okay, let's bring it all together. there are lots of tools being used maybe we can consolidate and also we are building with Anupurna we've said a lot of the stuff we could just build on top of the our own platform so we actually did a whole AI summit I don't know you're asking about like how do the how do the legal team handle it it's actually a VP of legal was actually running that initiative she's like let's let's get this going I think this is the first time but we were talking backstage about this I think the first time I've ever heard of like legal running this thing so she she was like let's go make this happen let's adopt a rubric-first strategy so that if we can leverage our platform, let's use that.

19:05So what we did, we brought in, like, people across all organizations, people were sharing notes on what worked, what didn't. We gave some basics on how generative AI works, RAG, and all of that. And then now they're going back and they're coming up with, each org is going to come up with, these are the business metrics I want to solve, and these are kind of initiatives I'll do, and these are how I'll measure the success of the AI initiative, like AI-specific metrics. So we're going to have that cross-functionally and then make sure that as a business, we're able to do that. But one of the learnings is that even if you put these tools out there, people just don't adopt it easily.

19:39They try it once, doesn't work. They're like, oh, no, I'm not going to go there. So you've got to keep pushing people to go adopt it, saying, no, no, no, things have changed. Let's go try it. Let's go try it. Give me feedback. Let me fix it. Now try it. So you kind of have to keep pushing so that people adopt it in an organization and while balancing security and everything else that you need to do. so it's not I mean if you look at LinkedIn you feel that everybody is like doing AI like crazy but in reality in an organization there's a lot of work to make that happen. That's what we're focused on.

20:08It's still early but. Well I imagine a lot of people don't really haven't really internalized how different it is to like their workflows can be using AI. Like it doesn't occur to them. And to be honest definitely on coding we're seeing some huge potential gains that we see. So we are really pushing everybody to start using AI for their coding. Obviously in research and any kind of product research and things like that, there's a lot of stuff that AI can help with. So yeah, so we are adopting tools and trying to do that in a safer manner so that there's standardized ways in which we can do that.

20:42Got it. One question I had for you was to combine these two AI discussions. I'm curious if you've, your experience doing this yourself, putting AI into practice. And what you mentioned before about how most businesses, they have AI initiatives, but they're not successful. So what are you learning about it? And how are you applying that in your customer discussions? Yeah, I think the thing is that you have to bring, first of all, you've got to bring all the different stakeholders together. There's legal, infosec, you've got to make sure that they are aligned. Because if they're not, then you're going to run into all the soft bottles.

21:13So bring them early to the conversation so that they are, they agree that this is the right approach and then everybody is aligned and pushing that forward. And then I think there is a lot of, you got to put stuff out there. People have got to try this. And then there's a lot of things that people can use their imagination and they're very creative. They can do all sorts of things with that. But until you get it out there, get the adoption going, you're not going to see what the real value is. So I think you need to give people time to experiment, get familiar, experiment, and then the best practices will show up.

21:45So it requires, So we are, within engineering, we are running it very programmatically. They're monitoring this. We're saying how, look at the metrics. What will help drive those metrics? Where are the bottlenecks? Are there specific teams that are struggling? So you have to kind of almost run it as a program. Got it. And imagine as well, you being founder or co-founder probably helps as well. You'll founder mode on it. Yeah, sometimes I would put my co-founder hat on and there you go. All right. Okay, we have just a minute left. But if you want to ask a quick question, we can go into the lightning round here.

22:15Quick question then. So about adopting AI in the business, how do you evaluate ROIs? Do you really take care of it before POC or after POC? Please share your experience. Thank you. Great question. This is actually the biggest challenge, right? Because AI is not cheap. And people are saying, OK, if you're going to spend this much, what's the ROI, right? And this is where a lot of projects are getting stuck because they're not able to prove ROI. So the way we are doing it is we are looking at it as, so rather than just look at any AI-specific metrics, we are looking at business metrics. I'll give you an example for engineering.

22:50For engineering, we are saying, A, can we, we have a plan of release, right, roadmap. Can we reduce the net delay in roadmap items, delivering that to the business? So if we say, oh, we deliver in Q3, did we deliver 15 days later, 30 days later? What was the net delay, right? And we want to reduce that. So that's a business metric that the business understands. The other thing is, can we make sure that while we're doing this, hopefully by moving faster, are we keeping the quality bar high? So we have what we call like a quality index that looks at defects per account and stuff like that, or cases per account.

23:28And we're saying, are we making sure that we drive those down? So at the end of the day, and then we have AI metrics where we say how much code is generated by AI or how much, what is the MTTR for certain defects and stuff like that. But that doesn't, that's an internal metric. At the end of the day, we measure ourselves by did these two business metrics actually go down? Right, if they didn't, then it doesn't matter. I can do 100 % AI code. If you don't meet those business metrics, it makes no difference to the business. So at the end of the day, I think you have to wear the business hat, whether you're in R &D or go to market, it doesn't matter.