Sumit Dhawan: Leading Proofpoint’s AI evolution and building toward $5B in ARR

Welcome to Inside the Network. I'm Sid Trivedi.

I am Ross Haleduk.

And I am Mahendra Ramasinghani. We have spent decades building, investing, and researching cybersecurity companies.

On this podcast, we invite you to join us inside the network where we bring the best founders, operators, and investors building the future of cyber.

We will talk about the hard parts of the founder journey, launching companies, getting to product market fit, raising capital, and scaling to an exit.

And yes, we will also be talking about epic failures.

But Mahendra, we're here to make the founder journey easier.

That is correct, Sid, but we cannot make it too much easier because startups are hard. And of course, you already knew that.

All right, you two, enough. Let's get started with this week's episode.

Today we're joined by Sumit Dhawan, CEO of Proofpoint. Sumit has spent his entire career at the intersection of infrastructure, cloud, and cybersecurity, holding leadership roles at companies like Citrix and VMware before taking the helm at Proofpoint. As president of VMware, he led the $70 billion divestiture to Broadcom. And along the way, he's built a reputation for being a leader who combines empathy, technical depth, and above all, a founder's mindset, acting like an owner no matter the role. In this episode, Sumit shares the pivotal lessons he learned scaling some of the world's most iconic companies and why empathy is the cornerstone of great leadership. Above all, how he's shaping Proofpoint to grow rapidly and tackle the evolving threats enterprises face today. This is a conversation full of hard-earned insights you won't want to miss.

Welcome, Sumit, to Inside the Network.

Thank you for having me.

So we're going to talk about a whole bunch of different topics today, but we really want to start by talking about your early days. You got multiple degrees in computer science and business. You're at IIT Roorkee, and then you're at University of Florida for your MBA. And you have a pretty impressive track record leading at some pretty large companies, Citrix and VMware in particular. Take us back to the beginning and what the journey of tech and leadership was like. Were there a few pivotal moments or lessons from those early days that shaped the way that you lead as a CEO today?

Great question. Thanks for having me again. Listen, I've been fortunate to work at great companies under amazing CEOs and leaders. Who I've had a pleasure of learning from, observing, and they have mentored me, whether it was the CEO at Citrix or the CEO of VMware. And, you know, my pivotal moments through all of those were different as I was growing up in my career. Early in my career, the pivotal moment for me was to gain as strong of a background in doing multiple roles. So that you can build empathy across functions. It does make you jack of all, you know, master of none, but still it gives you the background and foundation to actually then lead the company. And then later on, as you start running more and more of business line leadership, I think a pivotal sort of learning I had was acting as a founder and the owner of the company, regardless of the role you're in, And that gives you sort of this sense of ownership, which is very much needed as you step into more and more senior leadership roles of running a company. At the end of the day, you're accountable for thousands of employees that are working for you and the company that you're leading. And you're accountable for leading them and taking them to the best possible successful outcome that they all deserve. So I think those were the two pivotal learnings for me in these great companies and amazing growth stories that both of these two companies, as you mentioned, have, and the amazing leaders that they both had in terms of their CEOs.

Sumit, I'd love your thoughts also on just being an IRT alum. I mean, a lot has happened in terms of the importance of the group of universities and how much of an impact they have had in terms of creating amazing CEOs. Did those early years at IIT influence you in some way?

Yeah, I think IIT is an amazing place, you know, and for any of the listeners here who have been to IIT or know people from IIT, it sort of creates this sense of ambition and aspiration. You sort of come to a place that has amazing group of students who have maybe done well in their own small communities or schools that they have grown up with. But then when they land into this place, they find that, you know, there is many, many, many more people with tons more acumen, ambition, you know, and so that's just a moment of humbling. So that was kind of a humbling exercise for me and built a sense of ambition for wanting to do more and and wanting to learn from both the people who were there as well as making sure that you can do more because you kind of see how more can be done by having all of this intellectual horsepower around you.

Sumit, after leading several large teams at established enterprises, you joined the web app security startup Instaart as a CEO. At the time, Instaart was just over 100 people, at least that's however many I was able to find on the internet, and the company was playing in a highly competitive, in a very fast-moving space. You were able to restructure the business, you were able to drive growth and ultimately lead the company to an exit to Akamai. Talk to us about the experience and what it taught you about cybersecurity and the startup world, given that you came from larger enterprise into this massive startup universe.

It was great learning. Okay, I think I came in and the company had this great unique technology. That had been purposed into multiple product solution areas. And unfortunately, what that led to was very high spend because you're acquiring customers and solving the needs of these enterprise customers. And as we all know, when you're building a new business in the venture world and you're acquiring enterprise customers, these enterprise customers don't just buy the product as it stands today. They just keep expecting a certain pace and certain set of capabilities to be built. And the company had stretched itself, even though there was a common technology platform, stretched itself for doing so in 3 different areas on top of the same technology platform. And so as a result, just the required rate of investment to keeping up with customer expectations, not to mention the spend that more these growth— the growth companies have to have to acquiring new logos was so high that we had to focus. We had to restructure ourselves. That's sort of what I sort of mean by restructuring. And so we focused out of those 3 problems into 1 problem, and we had to also almost let go of certain customers and revenue in other areas and then build the company up from there. And then once you build the company with 1 specific focus areas where you have a repeatability and a successful outcome of meeting these enterprise customers with needs of not just today, but in their future roadmap asks, then we had enough of a momentum where we could find the right home for that technology and the people who were working on it to be something that was extremely complementary to Akamai's business. So that's what led to it. I mean, learning for me was essentially in a larger company, the importance of cash flow. Is a little less and you're looking at several other metrics, you learn the importance of cash flows. And then when you have even a smaller group of employees who on an everyday is looking up to you to how they're going to make, you know, their paycheck true or not next— at the next paycheck, that sense of responsibility was something that I learned at Instart. I probably would not have been able to learn it without getting into that seat at nStart.

I think it would be fair to say, Sumit, that the seeds of your cybersecurity journey probably were planted at the time when you were at nStart. Of course, you went back to VMware for several years, this time 4 years. Prior to nStart, you spent 5 years at VMware and 2 very separate phases of VMware's journey. Before we dive into Proofpoint and the world of cybersecurity, I want to spend a little time on those two phases at VMware. In the first phase of your career, you're heading up the end-user computing business as SVP. Everything is moving up and to the right. In the second phase of your career, you come back. This time you're leading the entire $10+ billion operation and getting the company ready to put it in the hands of Broadcom. Two very different phases of VMware. I mean, share with us some of the experiences in the growth phase and then back into the consolidation phase.

Yeah, very well said, Mahendra. The first one was the growth phase. Both of them were transformation phases for VMware. One was one business to multi-business and growth phase of diversifying the revenue and the portfolio by having more than one business unit. This was the phase where the company went from just having predominantly a data center virtualization business to end-user computing and network virtualization, and even putting the early beginnings of the cloud business. Those were the business units that were set up. And once you set up more than one business to multiple business units, there are several implications, as you can imagine. So, so, so that was that phase. And then in the second phase, was transformation towards cloud recurring revenue. And then tail end of my tenure at VMware was obviously making sure that we execute on our plan for both transformation and what we had signed up to our investors and the board as a standalone company while handling all of the various constituencies that required approvals globally from regulatory perspective and handling both of those. And so that you can hand over the company to the new, you know, the new spot. So those are very, very different, very different times and different roles that I had at the company.

And of course, you capped it off nicely with a $70 billion enterprise value as you transitioned out of VMware. Now, Being in the world of infrastructure, I'm sure you had a lot of options. The world is a much bigger playground and you came to the world of cybersecurity. Help us understand how your decision-making process went about.

You know, there were two areas I was kind of intrigued by as I made a decision to go do something different around the time of the acquisition getting completed. One was around the whole developer software. The other one was cybersecurity. In both cases, I saw the market structure kind of non-sustaining in the state it was in. It was highly fragmented, very point products. And, uh, and I sort of felt like this doesn't seem like the right fit. So my thesis, uh, in the future, it just doesn't make any sense to let this sort of whole thing continue. And so those were my two primary areas of interest to join because I thought these are— this is an industry that's going to go through a transformation. So, so then the, the right player in those industries would be one that has incumbency, market leadership, and size. Okay, once you have incumbency, market leadership, size, and of course, certain sort of differentiation in the underlying technology, that gives you an ability to participate in that next era of a market change, okay? And with the right leadership focus, at least you have a potential and a possibility to go make that happen. And so looking at that as the backdrop, Proofpoint turned out to be one that I got excited about. The more I learned about it, I sort of saw a company that had huge, you know, market leadership in the space that it played in, which was, you know, email security and had the starting points of certain other areas the company was expanding to and the revenue was diversifying, differentiation from the competition. And there is no there's the incorrect assessment from the public market that email security is going to go away or will get sedimented into a network box or in for a platform provider. And so once I sort of believed in that fundamental, then that led to a conclusion that, hey, Proofpoint can be a company that really takes— helps drive this next era of cybersecurity. We can be a major player in it. And I got excited about leading it and making sure I participate in that.

So, but you talked a little bit about Proofpoint. So let's dive a little bit deeper. And you described just Proofpoint's commanding position in email security. For our listeners, many of them will know this, but the company started in 2002 and it went public about 10 years later, and then subsequently was taken private in 2021 for just over $12 billion by Thoma Bravo. It had several leadership changes following that, and you ended up joining the company as the new CEO in 2023, roughly about 2 years after Toma had taken the company private. I'm curious, like, what was the decision-making behind joining the company that had gone through its, you know, amazing heydays, had had the complexity of a, you know, a private equity partner, and then had had multiple leadership changes already happen? How did you think about that? And you mentioned Proofpoint's ability to be very much on the top of email security. I 100% agree with that, but I think, you know, you're a big Warriors fan and Steve Kerr has said this multiple times that you can't stay on top forever. I'm sure that was running through your mind that is there, you know, there's only one way to go when you're up on top and that's down there. There's no way to go any higher than the number one. So how did you think about balancing that?

It's a great question. Listen, I think when I was looking at it, I sort of didn't quite— so there were a few questions in there. One was about the fact that, listen, you're a leader. Is there a scope to go any higher? It's one way, one question. The other question you asked was, is there a— was there a concern I had about just the last two CEOs leaving in the last two years? Okay. I think they— to me, the former was easy, okay? I wasn't coming here to make Proofpoint an even bigger market share leader for email security. That wasn't the goal. That wasn't the thesis. That wasn't the right strategy. It was to coming back to, hey, cybersecurity has a sprawl. There is going to be an architectural consolidation in cybersecurity. And I felt like there were sort of these detection and response technologies. There were networks consolidation happening through SASE, and some consolidation had to happen on the preventive part of cybersecurity. And that's largely become a human thing. It's humans that get attacked and humans that lose data. And once I understood that there is a potential for that being something that Proofpoint can have a dominant position in, that's not That's not saying that you're already at the top and you're only going to potentially hard to go up. That's saying that there is a market that you can take on, which is based on where you have strength in. Okay. So that's kind of sort of to me like, okay, once you become really, really successful in the G League, now you get to play in the NBA, right? So to me, that's sort of how I saw it. Okay. Here is it. Here's an opportunity to take Proofpoint from G League where we We are dominating, we're winning, to now sort of this team that takes on a bigger cybersecurity market. And, you know, listen, when we went private, we went private at a revenue run rate of $1.2 billion annually. We crossed more than $2 billion already, and we are well on our way to be close to $2.5, and our aspiration is to be a $5 billion company by 2030. We call it Project 5x30 within Proofpoint. So, that was my frame of mind. So hopefully that answers the first question. Any questions on that before I answer your second one?

No, I think you put it very well, and we'll talk a little bit about where you expand in subsequent questions, but I think you put the framing very well.

Okay, and then the second question is, listen, the leadership transitions and whatnot, My perspective is if you believe in the fundamentals on the market, if you believe in the fundamentals of aligning with the board and the investment thesis and the aspirations of the board in terms of what they see, then it's a leadership challenge for the CEO to come in and get that sorted out. And I didn't feel like I— there is no CEO seat that comes in that says, hey, this is a beautiful ship. It's sort of sailing in the right direction. And just come in and make sure that you put your headphones on and sit and do nothing. So to me, that was easy. That there was no— that wasn't a worry at all. It's something, okay, as long as we are aligned on what we want to go do strategically and we have bold aspirations that's aligned with mine. And listen, I had a dinner with the So my interview process was very straightforward. We had a discussion on sort of what we wanted to do over the course of a few days, you know, and then I said, and they said, hey, we're ready to make a decision. I'm like, I'm surprised you are. If you are, I want to meet for dinner. I met for dinner, both the chair and the lead board members, and I said, here's my plan, here's the aspirations, what I want to do, here's how I would do it. They looked at it and they're like, you're wrong on this, but you're right on everything else. I said, explain how I'm wrong. They explained it to me. We debated it. They were right. I was wrong. I said, OK, you're right. Let's move forward. We had the offer. I signed it. So to me, that showed that there was an alignment with the board, and there was the speed of decision-making, which I really liked, that made the decision easier.

That is a great story. And let's dive deeper into it, and let's talk a bit about the leadership challenges. So you've led business lines at large public companies like VM, where and then now at the private equity-owned firm. What do you find different about running a PE-backed company?

This was my first experience with private equity, so I, I didn't know what I didn't know. And, you know, I sort of asked a few people in other leadership positions at private equity firms, and what I learned was, number one, I was getting very inconsistent answers. Like so different that I was like, okay, this doesn't quite add up. Okay. So my first conclusion I drew when I was sort of comparing notes was there's nothing called working for a private equity as a consistent answer. Okay. There is probably some degree of consistency working for a public company. There's probably some degree of consistency working for a venture company, but there is no consistent answer across private equities. That's the first thing I learned. In other words, every private equity company a sponsor has a different model. Second thing I learned was, which was after the fact, was that what really, really matters is no different than what matters in running a public company in a healthy fashion, which is focus on achieving the right business results with discipline. Okay? At the end of the day, the One thing that private equity does really, really well is having spot— putting a spotlight on, and this is more maybe about Thoma Bravo because I have no experience in any other private equity. So what I really, really liked working with at Proofpoint with Thoma Bravo, which was a strong positive surprise, was just a spotlight on numbers in deep format, which is really onerous and painful for people in finance and people in business intelligence because the amount of work needed in producing all of that data is high. But I kind of jokingly compare Thoma Bravo as like Apple Watch. If any— I don't own it, I don't like it, but I know who own it, people who own it. You know how it buzzes you every now and then and tells you to stand up if you have been sitting for too long? Okay, do you always stand up when it buzzes you? No. Okay, but it's a good reminder. Every 3 times it buzzes you, you know, you maybe you stand up. Soma Bravo is no different. It'll show you all the metrics and make sure that you have a mirror right in front of you. Now, there are always ugly spots that we can see when we have mirror in front of us. Do you always act on them? Can you always act on them? You know, no. So that's the relationship we have, okay? They would— there is this healthy discipline of looking at metrics. There's a healthy discipline of them pushing me, nudging me, and us debating whether it makes sense for us to fix or what are the things that make sense for us to fix. But then they require and they lean on me and my leadership to make sure that we go sort of plan it and execute it. There is no playbooks, okay? They don't tell me, here's our playbook, go pursue it. There is no target metrics. There is no— as much as it is for any kind of public company, you're operating in a certain growth, there's some rule of expectations. We are very similar. And from governance perspective, given we are in much later stage with them, we are operating as if we are in the public company because that's what we aspire to go be. As early as we can. So that's kind of how I have learned of working with Toma Bravo. And it's been quite positive. I know some teams get bothered by Apple Watch nudging you too much. But listen, as long as you can take it the right way and do what's right for you and your health or you and your business in this case, it's not a bad thing.

Sumit, you mentioned the word empathy early on in our program. And then as we were talking about Toma Bravo and this notion of results and discipline, how do you look at the future in the go-to-market and growth areas? These are two broad areas where the numbers roll back in and Tomá Bravo or your board is watching the growth. So when you think about go-to-market, there are different tactics. There are different ways you can reach your customer. And we'd love to hear what has worked very well and how are you changing that.

And I think at the end of the day, I can sort of say what we've done over the course of last 2 years, and that's the foundation of where we are headed on the go-to-market side. Proof point, you know, when one of the things we decided when I joined was we, I felt like we had too many, we had our sort of fingers into too many things. And if we wanted to go win in the world of cyber, even though we agree that there is going to be fewer players, I didn't think in the world of cyber, good enough is going to be good enough. Okay? You need the depth of the solution as long as you're serving it to enterprise. That depth of the solution that comes in the form of efficacy and many, many more things these days. You know, now there is more and more sort of, you know, AI in terms of how things like SOC power up, of course, integrations. So there are sort of several elements that go into building that depth of solution. And we had our fingers into maybe too many things because the world of cloud and mobile had opened up this large surface area of threats, and CISOs can sometimes lead you into too many things if you're not careful, right? So we had made that mistake, too many acquisitions that were not connected together. So we focused, and by focusing what we were going to do, we said we were going to be the best at two things that people do. People collaborate with each other and people deal with data. Okay? And we are going to build the best possible solution on collaboration security where email is part of it, but collaboration is happening now across multiple dimensions. People are collaborating through suppliers and third parties. There are risks that are happening because of internal people's accounts getting taken over. In the service desk and whatnot. So, there's a whole threat landscape due to digital collaboration. And then there is a sort of data risk and compliance and just information risk aspect because of people handling data. So, we created expertise in those two details that overlay our account teams and we sunset all the go-to-markets. And we sunset and end-of-life everything else. Okay? It wasn't done to cut costs. Actually, we— it led to achieving our growth targets and achieving our margin targets because we were able to focus. We actually doubled down in certain areas. Yes, were we— had we gotten fiscally not disciplined, every company does. Okay? It's just cycle that you sort of make some investments. Not every investment pans out. And as a leadership team, you have to make a decision to double down in the areas that pan out and take investments out of areas that didn't. You know, some of you are venture guys. You guys do that in the form of your portfolios. In the world of corporate, we have to do that in the form of our initiatives and businesses and the bets we place. And that's what we ended up doing, okay? And by doing so, on the go-to-market and the solutions we would go, we built rich expertise and we doubled down on R&D in these areas. And I was really pleased to see at the beginning of the year, whether it's Gartner Magic Quadrant market share in data security, which was a brand new space, it's become a sizable part of the business. We took over market share leadership against Symantec and any of the other DLP players. Now we have expanded into DSPM and we integrated the first ones to have DSPM and DLP together. At our upcoming Protect conference, we are going to expand that for Agentic Security as well. That's related to data. So we feel like we are clearly the innovation leader, market leader there because of focus. And we extended our email protection to a full range of threat protection solutions so that just an email security player can't just address the needs of today's threat protection requirements, okay? And that's what happened through going deep in those two areas. And we really came out of everything else from a go-to-market perspective.

Thank you, Sumit. And speaking of AI and speaking of how you've been bolstering up your portfolio, there is the build versus buy strategy. How should we think about Proofpoint's role in building versus buying as you look at the future?

First of all, I'm very excited about the future. Okay. We didn't, of course, I didn't expect that coming into the role. We sort of drew We put, in our view, we put human in the middle, and we said all aspects of human-centric security is what we would sort of sediment into our platform. And we keep going deep into the areas I mentioned. And things have actually gone to some extent, I would even say, ahead of plan in that dimension. We are looking at two areas of now growth in terms of the future. One is this human-centric security problem is now impacting every business of every size in every local. That's not something that I saw even 2 years ago. Okay. I have not seen customers of really small size saying they need best-in-class security for phishing protection and supplier protection and SaaS security protection, things that they would've never brought up 2 years ago. They're bringing it up now. So we expanded into— we had an option. To answer your question, Mahendra, where we could have sort of built that. We actually had all the email security underpinnings, and we could have built this solution for microbusinesses that are served through MSPs. In fact, we even had a product line, but we saw we didn't have a business. You need a reach. You need a program. You need expertise to be able to deal with partners in a certain way. You need academies. You need communities. So there is an aspect of this full value chain of everyone from distributors to ecosystem to MSP providers and, of course, end users. And there's a whole sort of needs that come in for providing that solution when you're serving a brand new market segment. So we decided we were going to play in that market segment through an acquisition of a market leader in that space. And we announced the acquisition of Hornet Security. And we are really, really excited and waiting to get that closed hopefully anytime soon. And then we continue our journey in having this human-centric security now brought to every customer of every size. That's our mission there. The second thing is we are quite excited about— well, I shouldn't say the word excited because it's a pain for our customers, even though the era of AI opens up a broad issue when digital assistants and copilots and agentic AI comes to shape. Last week, I hosted a special meeting with 6 CIOs only through the network. It was not with CISOs on purpose. And I was amazed to sort of hear from them how much and how fast and how much AI they're adopting and the pace at which their mandate is at this point in time to adopt agentic. And And that— when I showed them, listen, the human security problems extend to Copilots and agents, they were like, we got to solve them. Humans get socially engineered. Agents get prompt engineered. Humans lose data. Agents lose data. Humans get credential phished. Agents get certificate phished. But at the end of the day, there is an intent of communication that's going to the agents. And if that's not— if that's misunderstood, just like humans misunderstand the intent, if that's misunderstood by agents, that's vulnerability. That's risk. So the good news is there is some things we can use from what we have, but there are many things, Mahendra, we don't know. And we are going to be looking in the ecosystem to see what's complementary that fits into our extension of providing security for AI. Not AI security is going to be big, but what fits in as a natural extension from humans to digital assistants to humans.

You talked a little bit about the human factor and AI risks. I'm curious, I mean, even in email, we are seeing a very different type of attack. I think of it as zero-day phishing in that this is the first time when an individual, an employee gets an email that is a phishing attempt. Today, we are seeing these types of attacks where it's the first time that email ID has ever been used. It's a highly personalized email to that individual, and it doesn't have any links. It doesn't have any attachments. It's trying to get that individual to communicate back and forth. There's a lot of different ways that attackers are leveraging the new kind of tooling that has been built by some of these large foundation model companies. I'm curious, just in email security, how do you think about that at Proofpoint? How do you think about how do we fight this new type of AI attack?

Yeah, it's a great one. I think first of all, we weren't proud of it, but what happened with us after the advent of ChatGPT, and maybe it was not attributed to ChatGPT, even tools like Grammarly could do this. We saw actually for the first time, our drop in efficacy was noticeable. We take pride in number of sort of things we miss versus number of things we block. And that's usually in 99.9-plus percent. That's how we measure. And these are advanced threats. These are not simple spam. It dropped below 97, and it was all attributed to a more sophisticated set of attacks that were more conversational and had an intent behind them that was malicious, yet the communication was fine. So we determined that semantic analysis is no longer sufficient. We've always had all kinds of models that are deep learning models that continue to enhance rapidly after you learn about a potential threat and you improve the semantics. But we ended up building then for the first time intent-based models. Intent-based models use language models. So they are language models-based models that at this point in time are defending and protecting our customers.. And these models are detecting the intent of communication. And you can't rewrite a message. As long as the intent is the same, our models will score them to be high risk. And then you can do a bunch of things— quarantine, to warn, et cetera, et cetera. And our efficacy has gone up back to 99.9-something percent. And so we feel like this is not going to be the end of the race. There is a constant investment that we make in new model creation and threat research, and the two work closely together. And we are seeing more sophistication, not less sophistication. We are seeing compromises across not just an attacker to an individual, but compromise to an individual's ecosystem of collaborators, and then regular communication starts before something nefarious comes in. We are seeing channels of communications to be more than one. More than email, sending through Teams and whatnot. So our Threat Protection now platform is expanding to cover this any-to-any protection, where more than just an attacker to person, you're protecting all the ecosystem of an individual by building a communication graph and then checking any maliciousness or abnormality in that, as well as doing so across multiple communication channels. And I believe over a period of time, email security will become a feature of that kind of a system that protects from these future generation of attacks that are going to be multidimensional.

Sumit, there are many conversations about how AI is changing the threat landscape, like what is happening, how it is enabling the defenders to offer better types of defenses. I'm curious, from your vantage point, you have thousands of customers. You're seeing the kind of things that most startups out there do not have the visibility into. What is, like, what are you seeing when it comes to AI? How is AI being used in the wild? What are some of the novel attacks or attack methods? You mentioned some. I'm curious if there is others that you haven't seen being talked about publicly. And what does the actual customer adoption look like?

Yeah, firstly, I would say the Even though it's very difficult to technically attribute every attack to generative technologies, we tried that first and we were like, what's— we will only be wrong and we can be wrong by several percentages. So we sort of stopped that exercise. But what we see is clear patterns. The volume of advanced threats have gone up significantly. It's a big, big jump that we are at this point of time seeing. Second, the places and the type of customers that are getting attacked is changed drastically. We are seeing attacks in Japan, Korea, Middle East, you know, where there is money, but language had been a barrier. Language is no longer a barrier. Okay, clearly we know that attackers didn't go out and learn Japanese and Arabic. You know, this is clearly the generative technologies that are coming into play. And then what we are starting to see is attacks being made on Copilots. We're starting to see communications with white text in email that is non-human readable to build asymmetry in context between Copilots and humans so that at some point in time, a prompt can come into humans with asymmetry in context that leads to potential fraud or malware. So we're starting to see those kinds of sophisticated attacks. We see them now. In our systems. We are detecting these. And it's hard for us to— what do you do with those, right? So we are also in our engineering labs and working with customers figuring out how do you score them? Because it's got nothing in it. There's no link in it. There's nothing. It's just got some white text, which you can clearly tell is text to train a model. It's language. It's not like pixels, okay? So there's clearly something that's intended to happen with that. With that communication and is non-human readable. So those are the kinds of issues our threat research and our modelers are dealing with at this point in time. And this is the Ross AI defending or competing against AI. That's what's happening. And so in terms of adoption, the good news for our customers is at the end of the day, we take pride in 85 out of Fortune 100, and 30% of enterprise sort of email is secured by us. So at this point, this is global numbers. So to me, at this point in time, when we enable a new model, it gets activated for our customers within a matter of days. So we just roll it out with any rollout practices you would see in the cloud. It's a very modern tech stack. It sort of gets enabled rapidly, which is both good and bad. It protects the customers, but many times the customers don't even know that they got additional protection. So sometimes we have to sort of keep telling them, no, no, trust us. We added a bunch of these models that without us, you would have probably seen bad stuff come in. But that's what's happening. It's AI defending against AI every day in our labs today.

Let's talk a little bit about the changes in the email security landscape. I mean, certainly Proofpoint and Mimecast have been the clear leaders, and Proofpoint well above Mimecast if you just look at pure numbers. And both of you focused on the secure email gateway approach. And then we saw kind of the second generation of email security players. And, you know, let's just highlight two of them, Abnormal and Material. And their focus was on this API-based approach. Instead of, you know, using the secure email gateway, let's use API to, you know, provide the same level of capability, but with a little less kind of emphasis on being in line. Now we're seeing kind of a net new generation of players. Many of them are stealth, which are kind of the AI native startups, the ones who are going to use AI agents instead of the traditional regex-based model. I'm curious, as you see kind of the new generations play out, how do you think about changing where— areas where you think Proofpoint should change its approach and areas where you want to stick to the core secure email gateway approach that has allowed Proofpoint to be the significant leader that it has been for well over 20 years?

You know what we have learned? This is not an either/or. It's a market segment issue. That's what we learned. Will there be customers that'll go from one segment to the other?

Yes.

But broadly speaking, this is a market segmentation aspect. If you look at all of our success, all of our market share, it is typically in larger enterprises. Let's call it 5,000 and above, and maybe those numbers can change based on the geographies and what. And then, so what we found out when we did an assessment of speaking with customers and just trying to understand what was happening was larger enterprises, they have teams, when they went to Office 365, they didn't get rid of their teams that operate the infrastructure for protecting Office. So, they have the team, and they actually prefer a solution that does multistage defense of pre-delivery, post-delivery, and click time. That's sort of how our system works, which is Gateway is a foundation, which is pre-delivery, but we keep protecting all the way. There is an after-the-fact API that's built into it, but it required our Gateway. But when we spoke with customers that were a little smaller, they said they have cyber teams, they have a CISO, but once they went to Office 365, they lost all the teams that managed, operated, and secured Exchange. They didn't need them, okay? So there was no one to operate a gateway. There's nothing wrong with the tech, just no one could operate it. So there were too many knobs that someone had to make a decision on, and there was no one to make a decision on it, okay? So that's the fundamental issue. There's no other issue, really. So, we said, okay, that makes sense. There's like this team that needs a set it and forget it and let the configurations as defined by their gateway in Office 365 play all the gateway-centric things. And after that, you clean up anything that comes in after the fact. So, that's why we acquired a company called Tessient. We waited for that product to have an exact same detection stack as our enterprise product. And that shipped in March of this year. And we are seeing now great traction with that product in that segment that we didn't really play. And we are not the— I would not say we are the market leader in that segment. We are a challenger at this point in time. And our team is challenging. Now we are in the market. We are competing with some of the names you mentioned. And we'll see how we fare. We are proud of what we bring to the market in terms of efficacy and the quality of efficacy, and now a product that integrates with Office 365. And then this new generation of agentic one, I think at the end of the day, there is a lot of models that are already very sophisticated in our solutions and maybe even the second era solutions. I won't speak for them, but in our solutions, these are as sophisticated as they get, and they're only getting better. We are going to bring some agentic technologies on top, agents that can help end users, agents that help the SOC. And sort of it's our belief is unless you're going to micro customers who really don't want any technologies and they don't have any cyber team, purely providing an Agentic solution, it's not just premature but may not ever be desired. We're going to closely watch. Okay, we have been wrong in the past. We may be wrong in the future, and we're not going to hold a firm opinion. On this and we'll be nimble and agile as the customers respond. But we are gonna bring our Agentic solutions here at our upcoming conference in September. I encourage all the audience here to attend. It's called Proofpoint Protect, but we intend to bring those solutions as something all our customers will be able to avail day one.

Many of our listeners are founders or aspiring founders in cybersecurity who are maybe going through some ideation journeys, maybe they're validating, the ideas that they would like to pursue. Given your experience building products at scale and now, and also previously leading a startup, what advice would you give to cybersecurity entrepreneurs that are starting out today? Are there areas that they should focus on to avoid some well-known pitfalls? Or maybe if they're looking to innovate in a domain with established giants, is there anything else they should be doing?

Yeah, I mean, I think there are going to be 3 types of startups in the cyber world. Unfortunately, the first one, which is a gap, a problem, and a solution, that has tended to be the biggest volume of startups. Okay. I would say be very thoughtful and cautious in that space because you're talking about potentially, you know, the other 2 being more interesting that I'll go through. Second, is any aspect of securing AI. I feel like that is an area where enterprises are— enterprise architectures are not established. So startups who have the ability to pivot faster and are able to sort of build solutions at maybe a higher velocity, rate of velocity, have possibly a leg up. Just in terms of how they find their wedges in terms of various issues that will exist, okay? So I think that becomes probably a fairly good area for startups if you are investing in protecting AI. I think it will have a very similar dynamic as cloud did for emerging, you know, the whole sort of security space that emerged from it. I think the last one is disruption, which is disrupting the incumbent architectures, you know, SOC, like disrupting XDR or disrupting SASE or disrupting Proofpoint, you know, major sort of spends. If you're really one that can take that on, it's not a bad area. You can obviously— disruption is always a good thing for a startup. Obviously, it's the highest risk. But highest reward situation, which is what startups sort of tend to get optimized for mostly because of the investment framework from the venture capitalists. So I'd say those are the 3 broad categories. My only recommendation to the entrepreneurs would be that in the past, the first category was rewarded. It's hard. It's hard in the first category, all the way from investors to potentially even at the end of the day. If you wanna be a part of a company, it's a little harder. The other two just seem instinctively at this point of time, even though I'm not a venture capitalist, better places for entrepreneurs.

Sumit, as we wrap up, you mentioned early on in our conversation today that your internal goal is 5x30, getting to $5 billion in revenues by 2030. Clearly a very ambitious goal. If you widen the aperture a little bit and look out into the next 5 years, what are some areas where you feel like large swathes of opportunity lie for a company like yours?

Firstly, I feel like it's not ambitious enough. But so I think, listen, but to answer your question, the markets we are in, we have established ourselves as technology leadership, market leadership, ability to execute and win customers, make them successful with our technology. Make them fans of our products. And even in the markets we are in, if I look at just sustaining our growth rate and market, and of course growing our market share because we are growing much faster than the market, we think we, you know, we have ways to grow and go. Okay. Secondly, I'd say the— and that's the reason I say that is because like I mentioned, we are a challenger in this mid-enterprise space through the solution we launched. We've just opened up our sovereign solutions in India, Singapore, Middle East, Japan. These are just new markets. We haven't even— we don't have any kind of market presence as we do in the US, for example. So there is sort of significant opportunity for us there. Second, I think I see a natural adjacency and growth in the two areas I mentioned. In particular, in going into microbusinesses and MSP, we have a we have a great start. Yesterday and day before, we had our top managed service providers hosted as an advisory council. I think they feel a lot of pain right now in terms of providing high security at high service levels through a standardized architecture. And we think we can be the one complementing their XDR solution as— that's it. It's us and XDR that can possibly provide the foundation of all MSPs. And then lastly, I think the world of digital assistance and agentic security, which is just a natural extension of human security, that's an area where we are setting up a horizon, we calling it Horizon 3 in the whole Horizon 1, Horizon 2, Horizon 3 framework as an area of investment for us. And we are gonna invest that both organically and look at landscape of potential M&A opportunities. You know, the one thing on this 5x30 is one thing we can lose track of when you're just looking at it through the lens of numbers is who we are. And you sort of start diluting yourself and your focus into many things or little things that are not necessarily related to your mission and purpose at hand and your sort of right to play and right to win. So we have used that as a mechanism to define the scope along these 3 areas I mentioned. OK, tons and tons of opportunity to grow by addressable market growth that's happening in the core markets, this MSP space and agentic security. Have we figured out answers in all of those three? No, but that's why I said it's 2030 and not 2025 or '26.

Thank you so much, Pankaj. You know, your background coming from the world of infrastructure and having worked with companies like Citrix and VMware brings a very unique perspective to the world of cybersecurity. And most importantly for our audience, you laid out the 3 types of companies that founders should focus on, filling gaps, securing AI, as well as disrupting incumbents. I feel like this has been a very productive conversation for us today, and I sure hope that our audience will benefit from this. So thank you so much.

Yeah, thank you for having me. And the more the cyber ecosystem develops through the investments, the more we benefit. We obviously love to partner and acquire the technologies that get built. So any of the startup founders, do think about us, talk to us as you're thinking about your growth plans and potentially taking the technologies that you've built to the next heights. Maybe we can help.

Thank you for joining us Inside the Network.

If you like this episode, please leave us a review and share it with others.

If you really If you really, really liked it and you have some feedback for us, wrap it on a bottle of Yamazaki and send it to me first.

No, don't do that. Mahendra gets too many gifts already. Please reach out by email or LinkedIn.