How Is AI Transforming Cybersecurity and Security Operations? Kevin Nikkhoo

Welcome to the B2B Growth Blueprint podcast, where we talk with entrepreneurs, founders, and leaders at B2B services, tech, and SaaS companies to learn the systems and processes they've used to create success for their business. And we'll also learn from marketing and sales experts to provide insights to help you grow your business. I'm your host, Mark Osborne, and the podcast is brought to you by Modern Revenue Strategies and their 10x ROI B2B Growth Guarantee. Schedule a free diagnostic call to learn the fastest path to double your B2B revenues in just 90 days. Hello and welcome to another episode of the B2B Growth Blueprint Podcast. I'm your host, Mark Osborne. Today, I'm very excited to welcome my guest, Kevin Nikku. Now, Kevin is the founder and CEO of Zinex SOC, which stands for Security Operations Center. So Zinex is an AI-native security operations center platform that pairs a digital workforce of AI agents with human analysts to detect, investigate, and respond to threats in real time. He's a 4-time founder with more than 40 years in technology. Kevin has started and sold 3 previous technology companies before launching Xenex SOC. He holds a BS in computer engineering from McGill, a master's in computer engineering from Cal State Los Angeles, and an MBA from USC. Fight on! He's been a 2-time finalist for the Ernst& Young Entrepreneur of the Year, named Partner of the Year multiple times by both Microsoft and Oracle, and most recently a finalist for GTIA's inaugural Innovate Award at ChannelCon 2026. What sets Kevin apart is that he's technically enough to architect the product and commercial enough to take it to the market. So he combines both that technical expertise and that commercial expertise. He describes his own role as visionary and quarterback. spotting gaps in industries and building something to fill those gaps before the rest of the market gets there. So today he's joining us at an inflection point as the company is really growing and scaling, and I'm excited to talk to him about how he's creating a new category in the space and what that means for entrepreneurs and founders. So Kevin, welcome to the show.

Thank you very much for having me, and thank you for that nice introduction.

Oh yeah, absolutely. I've been looking forward to this conversation, but before Before we jump into some of these topics, why don't you tell our audience a little bit about your past? Obviously, you've done some really interesting things that got you here. Tell us about some of those twists and turns. Sure.

So I think I'm a techie at heart. I've always been interested in the latest technology. I still read a lot about technology and where it's going. I follow it. And very early on, when I was in college, as a matter of fact, I started my first company in, some of the audience may not even know, but it used to be PCs, IBM PCs with floppies that were flexible. You push it in. That's when I started and I actually wrote assembly code and very early on, on early processors and that kind of evolved and as industry grew, I grew with the industry, and my passion for technology and finding solutions really drove what I did over the past several decades. And in fact, the first one, just to give it a flavor, with that IBM PC and floppy, my team and I actually automated dental and medical offices with What's today is commonplace. Everybody's using it. But back then, word processing and spreadsheets were not common. And we created a menu on an IBM PC so that it can automate the receptionist work that they, you know, took appointments and bills and things like that. And customers paid a lot for it. So it started way back when. And I think that's my entrepreneurial spirit. and the desire to find ways to use technology to help customers that has, you know, given me opportunities. And I've been very fortunate to see those opportunities, but also help customers along the way.

That's great. So passion for technology from floppy disks to AI. So tell us more about sort of what made you start Zenix and what does Zenix really do today?

That's actually a very interesting story. So I was on the partner advisory for Microsoft, for Oracle, and for CA, which used to be Computer Associates. And in one of the meetings, CA invited me to be an observer, and they invited CIOs of Fortune 500. And in the meeting, they were talking about You know, security products that they had and, you know, what they did. And the audience asked how much and how long, and it was like 5 years and $50 million. And the reaction in the meeting was laughing. So I said, oh, okay, there must be an opportunity here. If the Fortune 500 is choking on this, there must be everybody else needing this. And, but there's no solution out there that addresses the larger, broader market.

Okay.

And I kind of started looking at that. And at the time, believe it or not, the word cloud did not exist back then, was data centers and computers in data centers. So it took a while before cloud computing, utility computing, as well as open source became acceptable. In fact, many VCs liked open source platforms because it reduced the cost of development. So eventually in 2011, I architected the stack and because at the time it was mostly VMware in a data center, later on it became cloud computing. But because of that, it allowed me to put an architecture together that the first version of Security Operations Center came about, but we were way too early in the industry because people did not think about security from the cloud. They said, "What are you talking about? All of my assets are behind my firewall. Everything I've got on-prem." And what really changed that was actually the cloud, because now most organizations have some or all of their assets in the cloud. And some on-prem, on-premise, which means that the, the, the attack surface is now much larger. And every day it's getting larger because you got BYOD, bring your own device. Now you got notebooks, you've got cell phones, you got tablets, and you go into the network and you plug it in. And, and that opens up a can of worms in terms of cybersecurity. You also have the issue of all the external factors, factors like You have your social media, you have your presence out there somewhere. So hackers could use that. So the whole attack surface is now significantly bigger. Excuse me. So what happened is that as the, as this attack surface grew, the opportunity for cybersecurity, what we offered became bigger.

Yeah.

And then, you know, it just took off and we were really early in the market, but it also allowed us to adjust with the market changes and improve. And we have, you know, we are on release 14 of our platform. So it's really grown into a much bigger platform. So this was not a young guy waking up in the morning and I said, oh, I got this idea I gotta do. It's, it was really an evolution of something that already existed and we saw how the industry changed and we changed with the industry until even today where AI is now the major component of our platform to address that.

Well, and although you're not a spring chicken, you've got—

No, I'm not.

You've got time and expertise in the space, but still it's more of an AI-native solution. So talk to us a little bit about the difference you know, between a regular SOC, you know, security operations center kind of platform versus what's different today and in your approach with ZenX?

Yeah, excellent question. But if you look at the evolution of the industry, it used to be, hey, I'm going to watch the firewall, right? Then it became, I'm going to watch, let's say, The desktops and the servers and so on. And then it became SOC, Security Operations Center, which said, oh, we can do it for you. But the traditional SOC has fundamentally one big issue. It doesn't scale. You gotta have a lot of people.

Because it's people, right? Like, yeah. Sort of people, yeah, dependent.

Correct. So you have to have eyes on the glass continuously. And they're not— the latest that I saw statistics is that there's like 4 or 5 million people short in our industry globally. Well, that's a very large number to address. So you cannot scale a security operations center if you're relying on people alone. So what we started thinking about several years ago is that Well, how can we do this that not only it scales, but it actually reduces the cost so that we can pass on those cost savings to customers? And that took us 3 years to develop. Now, what's the difference? A traditional SOC is relying on people, a lot of people, and they, they try to detect threats and address them. There's 2 problems with that. As I said, a lot of people, but also Speed of detection, and finally, the ability to put things together to understand what's going on at the enterprise level collectively, collectively of all the incidents. AI, on the other hand, solves that problem because of speed, scalability, and the ability to put all of these telemetries that you collect together for a much faster detection and response. But it's not a simple thing like, oh, I'm gonna use ChatGPT or, oh, I'm gonna use Claude. That's not what we're talking about. A native AI means that the platform is built to collect telemetry from any source anywhere and do it as part of the platform. So it's not a manual feed of something, some incident to ChatGPT and say, tell me what you're seeing. That's not native AI. That's not scaling. That's just validation by someone.

An extra tool for a person to use.

Exactly. It's, it's just a tool. AI native means that you give AI the ability to ingest in a very systematic way To look at all of the data across the entire enterprise. Examples are firewalls, routers, switches, Office 365, Google, AWS, Azure, email security, web security, EDRs, endpoint protection, and so on and so on. Not looking at it in isolation, but looking at it. in totality across the entire enterprise. Because what that does is that it identifies those very difficult things that human eye cannot see in real time or near real time. In fact, they might not see it at all.

Right.

Because it's a complex set of incidents that you bring it together. AI with its speed, and ability to put all of this together removes that obstacle. It allows us to be significantly faster. And by the way, if you do it right, a lot more accurate and scalable.

Right.

So the way we did it, as a matter of fact, is that through an ecosystem that we built, this is a large intellectual property that we've developed specifically purpose-built for cybersecurity detection and response. That it collects the data from any source anywhere, 100% agnostic because not every customer has the same thing.

Right.

It creates the message, normalizes the data so that it can be consumed easily. Then it goes through cleaning up the data. So AI only gets the security data that matters and then it combines all of the security incidents together. And that allows us to have a very accurate AI response, not, you know, prevent it from hallucination because garbage in, garbage out, right?

Right.

AI. And finally have a loopback mechanism that trains it well. This is not a simple thing, but if you do it right, it solves a lot of problems. And we've been really Dedicated to creating this thing so that we can help the customers easily, faster, cheaper, better.

Yeah. Well, and although it is certainly ahead of its time, it seems like the natural progression of how technology is expanding within organizations of moving from being a tool that requires a human to operate to instead being more of a platform that can do that upfront work around the data ingestion and then do that middle work around the data normalization and then do that analytical work around seeing the relationship between the data to then taking actions based on those insights that come out of that rather than a human assembling all the data and then putting it into a machine and asking it to, you know, normalize it, or a human then saying, now tell me, is this relationship there or is this? Instead, you can pre-sort of set a lot of those things. And what I love about large data solutions like this is they'll find things, as you alluded to, you know, that a human would never see because it's non-intuitive. And if you're relying on a system that's only answering questions that a human asks, a human's never gonna ask, is this related to, you know, this, you know, threat that we're seeing in the marketplace? Whereas a machine can actually sort of say, although it is not intuitive that these would be related, we're seeing some relationship here between—

Exactly.

This input variable and this output outcome. And then a human can kind of get creative and help sort of uncover what those connections are.

Precisely. You said it very well. And as a matter of fact, one thing I should add, even though this is a platform that's built because we service middle market and SMB, we do all the work, right? We are not selling the platform, we're delivering it as a service. What that means is that we've got humans in the middle of this. Why? Because we want to investigate the incident and be able to find the root cause, validate it. And when it's the, you know, when it's a true incident, then we inform the customers and we take action as needed. And that's very important because a platform by itself does not solve the issue for middle market. They don't have They want to focus on their core competency.

Yeah.

They don't need subject matter expert. They don't want to hire and retain security staff. They cannot run 7/24 operations. And for those reasons, they need a partner in security operations center. And this AI, native AI will help us address their needs cost-effectively and, and, you know, very accurately. without them having to worry about, you know, what's happening to my environment because they know somebody's watching it 24/7.

Yeah.

The other thing that I should add to that answer or that comment is that we also have autonomous response. What's recently is being called agentic SOC. And what that means is that a SOC should be able to respond automatically to incidents. And I always say we are moving towards an agentic SOC, but I don't think it's going to be 100% agentic. Why? Because you don't wanna shut down an e-commerce server or a manufacturing server or a hospital patient database because an incident came.

Right.

It has to be done carefully. There are certain incidents that lend themselves to, you know, a JITIX, so take action immediately when you see something. And there are some incidents that say, don't shut down the server, it's gonna impact us heavily, whether it's revenue, customer, patient, you know, other things that are mission critical for the customer. In that scenario, we work with the customer collaboratively to look at the incident and resolve it. So our model is AI plus human to address all of these factors, but not— I don't believe for middle market and SMB, the ideal of 100% agentic, although technically it's possible. But I don't think in practice is it— it's beneficial 100%. Yeah.

So you've been sort of hitting on some things that really reveal the other side of your coin that I talked about a little bit in your introduction, which is although you have a passion for technology and obviously the creds to back it up that you can actually build, you know, technical solutions, and technical solutions that represent real innovation ahead of their time. You also really understand your marketplace and this commercial aspect to the business. So to switch gears a little bit from, you know, not just the company and the solution you're building, but into your sort of mindset as a CEO and as a leader within a technology organization, A lot of what you've talked about in terms of the capabilities of the solution is because that's what this marketplace needs. And a lot of the way that you're describing the solution that you're building is around really sort of naming and claiming a need that you identified in the marketplace rather than just, well, we had a neat idea for a technology, so we wanted to bring it to market. So talk to us a little bit about that hat, that commercial hat that you wear. And, you know, a lot of our audiences, founders, entrepreneurs, some of which come from a technical background and need to commercialize that technical expertise— how do you embody that as you are, you know, building solutions for the marketplace to make sure that it's something that the market actually cares about, that's valuable, that you're connecting the value proposition to the things that your marketplace really cares about so that you can craft a category that's really valuable?

I would say in general, not only in technology, but in any business, in any industry, build it and they come. Is not the answer. You gotta understand the customer, the customer needs, and then try to fill the gap that is not being addressed. I've always looked at the technology capabilities as a toolset, not necessarily the solution. The problem has to be in the market and you gotta identify it in any industry and particularly for technology because it moves so fast. So you could identify these areas in these gaps fairly quickly and hopefully fairly quickly develop a solution for it, right? Whereas in other industry, the lifecycle is much longer than technology. Technology could have a 6-month lifecycle before everybody jumps in. But you have to push that envelope. And the way you push that envelope to use technology as a tool is to identify where the customer needs are and how we can help that. So I'm gonna translate that into what we do as a SOC, Security Operations Center as a Service, and what we do.

Yeah.

When you look at the customer, if we had thousands of people as security analysts. That salary has to be covered. The cost has to be passed on to the, to the customer, pushes up the prices and fees. That's not good for the customer. One issue, customer doesn't win. The second issue, it's not accurate. You have 1,000 eyes on the ball. eyeballs on, on the monitor. And then those guys are working independently, individually, even though if they escalate it to the next level, they still have to put it all together. That's a very difficult thing to do. Thirdly, AI attacks have become normal. Today, we are more worried about AI attacks than somebody doing something wrong because their attacks are so sophisticated that an innocent user might not even know that they're getting attacked. I get them all the time. And I know I can identify them. I'm getting all the time. They can, they pierce through all the tools that the customer has put in place. But the AI attacks are so sophisticated they can get through. So having just the security analysts, the people, the eyes on the glass doesn't solve that problem. So you gotta have a system. So look at the needs now. What are the customer needs? How do I protect myself against AI attacks that are getting more sophisticated, significantly more sophisticated? How do I reduce my cost so that I can How do I make sure that I don't get false positive all the time? Right? I don't want to be bombarded with things that it's going to take away from my core competence. I want to focus on what I do. I'm a manufacturing firm. I'm a financial firm. I'm a healthcare organization. I'm an educational institution. Why do I have to deal with these things? The customer needs are identified. So how do you solve those issues? That's where my head starts thinking. That's where I start thinking, okay, what can I do to help customers? I always say this, we only win, we only grow if our customers are successful. It's not about us. I said that in our staff meetings and I, it's our DNA. I push it hard. Don't tell me What you did. Tell me how the customer was successful. Tell me how you solved their problem. Tell me that in a matter of seconds or minutes, we got something resolved. I'll give you an example. We had a customer of ours that we had just onboarded. They, they had an attack that put them under tremendous pressure, and, and for 6 months they were doing everything manually. And thousands of people were impacted. And the moment we turned on our system, we saw a big hole. I'm not gonna go into details. I cannot. But they had a big hole, and we identified immediately. We just did our job. I got a call from the CIO, and he said, you earned your entire annual subscription. First day that you turned on the system.

Yeah.

And I appreciated the call and I said, thank you very much. I'm glad you're so happy with us. 3 months later, I get a call from the same guy. I said, oh, why is he calling me? Something went wrong. And I answer and he says, I want to thank you again. What happened? And he said, we just had a call from your office, from your team. That our administrator by mistake did something that he didn't even know and it opened up another big issue for us that you notified us within minutes and we immediately rectified the situation. And that tells you, you know, how much we appreciate, you know, we just wanted to tell you how much we appreciate it. So customer success is everything. It's not about what we do. It's about, do we measure, do we know the customer's issues, and do we know how to solve them? So going back to what goes on in your head about solving these problems, it's a customer perspective. I put myself in their shoes and I ask them, what are your issues? How can we improve? It's one of my, my, one of my favorite things to do is to spend time with customers, understand them. Tell me, please tell me. And I've said, tell me the bad stuff. Don't tell me that we're good. Tell me where we can improve. Tell me what areas we're not covering that requires coverage. Once you get that perspective, then you can develop products and tools that can help the customers. Long answer to your question. What happens in my head constantly? How do we help customers be focused on the customer, not what you have done? In our case, with the platform, we are proud of it. We think it's very good. I, I, you know, a lot of credit goes to my team that have done this, but, but it has to be from a customer perspective.

That empathy is so important and obviously what makes capability valuable and ultimately what drives the commercials of any business. And Kevin, you're obviously an expert, you know, a lot of really interesting topics and we could spend all day talking about it, but I got to be mindful of your time. But before I let you go, like, kind of give us the pitch. Like, what kind of companies does ZenX SOC really help? Like, Who should reach out to you? What kind of benefits could they expect from working with you?

As I said in my previous remarks, we service middle market and SMB companies with, you know, hundreds of employees to thousands and thousands, you know, 10,000, 20,000 employees where, you know, even we go as small as some startups in biotech and technology firms in Silicon Valley. So it's a little bit of a wider spectrum because our platform scales. But really the customer that we service is mostly in the areas, in the verticals of healthcare, financial, manufacturing, education and services industry, e-commerce, retail. Most of these organizations really wanna focus on what they do, right? They need somebody to become their true partner, and I'm not using the word partner loosely, that becomes their de facto virtual cybersecurity department. They don't have a cybersecurity department. They want somebody to be there for them 7/24 and help them maneuver through this to, to be eyes on cybersecurity to, you know, because they can't hire individuals and they wanna be, they wanna have 24/7, you know, they need a partner that can, that can do that for us.

Yeah.

So we, we believe in True partnership—that means it's not a one-way street. We don't sign a contract to do a transaction. We want to be engaged with that customer. We even do a health check every six months for free. Oh wow! On our dime. Why? Because we really want to address that customer. So SMB and middle market with compliance requirements. Companies that have cyber insurance issues because they cannot address all the requirements of cyber insurance, which, by the way, is a big problem. If anybody is listening to this, make sure that everything that you have put in place is auditable, that logs and documentation is there, because if, God forbid, something happens, then you have to prove that you have done your homework and you can validate, you know, that everything was done. Auditors require that or they will not pay the insurance money if there is an incident. So that's a very big one. And but we do it all automated. So when they work with us in middle market companies, SMB companies, everything is logged, everything is managed. And it's, you know, auditors can come in and see everything at any point in time. Very important for cyber insurance. Same thing with compliance requirements. If you are in a vertical in an industry that must meet regulatory compliance, that's where we do it automatically. In fact, we have a dashboard that shows compliance requirements. And are you meeting all the compliance requirements? If not, it identifies where not and you could go fix it right away. So it's always compliant. So those verticals and mid-sized company SMB is where we fit. And, you know, as I said, a partnership, not a vendor. Yeah.

And what's the best way to get in touch? How can folks engage with ZenX?

The best way is to send an email to sales@zenxsock.com. That is Xenexsoc.com or info@xenexsoc.com. Our website is has a wealth of information. You could see customer testimonials, partner testimonials, all videos. So it's really easy to to absorb that. Go to Xenexsoc.com and not only see our services, but I think more importantly, see what people have said about us. We are also on many independent customer testimonial sites, G2, TrustRadius, and all, and it's all there. So you get the services that we do, you get, but also you get a lot of third-party validation of what we do. And also you also see what we do that's different from everybody else that impacts you as a customer. So our website is a great place to start, and there's contact, you know, forms that you could contact us if you're interested. Xenexoc.com.

Awesome. Well, Kevin, thank you so much for joining us today. I learned a lot and really enjoyed our conversation. I'm sure our audience did too.

Well, thank you very much for having me. This was a great conversation. I appreciate it.

Talk to you soon.

All right, take care. Bye-bye.

Thank you for joining this episode of the B2B Growth Blueprint podcast. We hope you've gained insights to grow your business. If you enjoyed this discussion, please rate, comment, like on your favorite platform, and share to others who will find it useful. Do you know a CEO, founder, or leader at an early-stage B2B services, tech, or SaaS company who would like to be a guest? And share their story? Send us a note. Let's schedule a conversation.