In this interview, Enrique Salem outlines the massive, ongoing shift from on-premise data centers to cloud infrastructure—a transition he frames as a 20‑year migration still in its early innings, with half a trillion dollars still spent annually on traditional data centers versus a $30 billion cloud market. He argues that security must evolve alongside this move, beginning with proper configuration management as the most basic safeguard. Salem then introduces the concept of "frictionless" or API‑first security, emphasizing that modern security solutions need to be easily integrated into developers' workflows rather than bolted on as afterthoughts. He highlights emerging challenges as organizations adopt containers and Kubernetes, noting that operationalizing and securing these cloud‑native applications is still nascent. Finally, he discusses data security in SaaS platforms such as Slack, S3, and GitHub, pointing out that control over data within these apps is limited and that the industry must shift from manual, rules‑based approaches to automated detection and management of data risks.
Chapters
I think what you try to look for is what are the big waves that are happening in the marketplace. So if you think about it, we are in a 20-year transition from on-premise to the cloud. And why do I say that? You look at the biggest companies today that are doing cloud infrastructure, companies like AWS, You know, it's a $30 billion business. But if you look at what gets spent in the data center on an annual basis, we're still spending half a trillion dollars. Half a trillion dollars is spent in the data center today, every year. So we're still in the very early innings of this migration. And so the question for all of us is, what is security going to look like as we migrate from on-prem to the cloud? And I think we've just scratched the surface. A lot of folks are dealing with configurations. You know, how do I make sure that my configurations or my cloud infrastructure is correct? I would say that is the very basic beginning of what has to happen. And so I still think that there's a lot of changes that are coming as companies really start adopting true cloud-first initiatives inside of their companies. And so I think there's a huge opportunity there. The second thing I spend a lot of time talking about is this idea of frictionless security. What do I mean by that? We used to build security products that would be added onto or connected to the infrastructure. Every security product now needs to think about how do I make it easy for developers to integrate my capabilities into what they're doing, or easily integrate with the infrastructure. And so kind of an API-first security solution is what we're expecting to be an important evolution of security.
[Speaker:ENRIQUE SALEM] So you mentioned cloud, and this is a very big topic for us in our investment strategy. Can you be more specific, but what are the new security challenges of corporates as they migrate to the cloud? In different stages of their migration, there are different challenges.
Yeah, I think when you look at what's happening in cloud migration, we see the adoption of new technologies like Kubernetes and what's gonna happen as you move to a, containerized world and what are the solutions you're gonna need? And I think, again, we're still very early in what these solutions are doing and I don't think we've done a good enough job of thinking through how do I operationalize these cloud applications and what does it mean to secure them?
[Speaker] What are the challenges around data security in cloud?
[Speaker] Well, the interesting thing about data security in the cloud, and this is what when I was saying this idea of frictionless security, our SaaS applications, every one of them, whether it's Slack, whether it's S3 buckets, whether it's GitHub, all of these technologies are valuable data is being stored in them. And if you think about what control you have or what control businesses have over that technology, it's fairly limited, right? I can, if you take a company, that's heavily using Slack, you don't have a lot of controls over what people are putting into those applications. And so from my vantage point, I would tell you that the data will move into the apps, and the controls inside the apps are still too primitive. Because historically we've done a lot of things that are rules-based. We've done a lot of things that require human intervention. And we have to do a much better job of automating the detection and management of that data in the application.
