AI and Cybersecurity: Scaling Rubrik to a Billion Dollar Enterprise with Rubrik's Co-Founder and CTO

AI is not cheap.

Welcome to the Future of Sales Podcast with you, your host, Jason M.

Lemkin. And this is where a lot of disaster speakers— projects are getting stuck because they're not able to prove ROI. So the way we are doing it is we are looking at it as business metrics. I'll give you an example. For engineering, we have a plan of release, right? Roadmap. Can we reduce the net delay in roadmap items to delivering that to the business? So if we say, oh, we'll deliver in Q3, did we deliver 15 days later, 30 days later? and we want to reduce that. So that's a business metric that the business understands. And then we have AI metrics where we say how much code is generated by AI, but that doesn't, that's an internal metric. At the end of the day, we measure ourselves by did these two business metrics actually go down, right? If they didn't, then doesn't matter. I can do 100% AI code. If we don't meet those business metrics, it makes no difference to the business.

Hey everybody, get excited. We just hosted 10,000 of you at the SaaStr Annual and AI Summit in the SF Bay Area.

It was insane.

It was off the charts compared to last year.

Last year.

It was a deep dive on everything new, everything AI, everything go-to-market. And we're getting ready because SaaStr AI is coming to London in December. It's Christmas with SaaStr on December 2nd and 3rd. We're bringing SaaStr AI to the heart of Europe. This is your chance to connect with thousands of SaaS and AI executives, founders, and investors, all sharing the secrets to scaling in the age of AI. If you're a founder, a VC, a revenue leader, SaaStr AI in London is where the future of B2B meets the power of AI. And we just announced tickets and sponsorships, so don't wait. sasterlondon.com to grab your tickets. Saster AI in London, where B2B meets AI and the next wave of innovation begins. See you there.

Well, good morning everybody. How you doing? My name's Kit Colbert. Formerly CTO of VMware, took some time off and just started as CTO, platform CTO for Invisible Technologies. We're very lucky to have Arvind with us today from Rubrik, who's the CTO and co-founder of Rubrik. So Arvind, maybe tell us a little bit about Rubrik for those that don't know the company or don't know them very well.

First of all, thanks, thanks for having me here. So Rubrik, we started Rubrik about 11 years ago. And the goal was to really build a platform that provides cyber resilience to businesses. From the time we started to now, cyber attacks have only been increasing, and our goal is to provide a whole set of tools, both if in case there's a cyber attack, how we can recover quickly, and what can you do before a cyber attack to protect your data, which is your most critical asset. We just finished, as I said, 11 years. We've rounded off the last decade by going public last year. So now we're on to the— thank you. And now we are on to the next decade of driving the company forward.

Cool. So let's talk about your growth and your progress to date. I think we have got a slide here with some of the high-level numbers. Amazing, amazing results. Again, congratulations. Over $1 billion in ARR.

Yeah.

You know, you started with a core product and then you scaled to multiple products. This is, I think, a challenge a lot of companies have as they're looking to grow and continue scaling. How do you think about that? I mean, I imagine there's challenges both from an R&D engineering perspective as well as a go-to-market perspective.

No, great question. I think so with any company, right? So as you build out products, there's a certain scale at which, you know, a certain part of the product grows a certain scale. You can only grow it so fast, right? Because there's a natural friction. So the way we have thought about it is that we need multiple kind of curves of innovation, right? So as one product gets to a mature stage and there's still a lot of growth ahead of it, but it's not going to grow at like 100% anymore. That's when if you can bring in a second product which now accelerates the business and that starts growing at like 100% every year and that, that kind of— so overall, your overall curve of growth stays, stays high. And we have been doing this with multiple products and we think of ourselves as really having multiple pillars in the data protection, data security, and now AI space. The way we have done it is you're absolutely right. There's the R&D aspect and then there's a go-to-market aspect, which is very critical. On the R&D side, we've been running a lot of the new products that we sell today in our portfolio, all started with the hackathon project. We've been running hackathons since we just finished our 10th hackathon last year. So we've been doing it from year 2 of the company. And it all starts with a few engineers spending 24 hours hacking up something and saying, hey, here's an interesting idea. And then we have— last year, I think we had 130 submissions. Out of that, we take the top 10, we review them, and then we go into— we actually go and review all the presentations and then pick out ideas that may be interesting and then take it to product. So almost all of them started that way. Wow. And then of course there's a whole question of as we get into a new space, there's the whole kind of like build versus buy question, right? And there have been cases where we felt usually when you want to build is either you don't have the skills needed or you don't have the right kind of DNA, or there's a company that's already achieved momentum and if you can bring that in. But there have been cases where we started with a build option and then realized, you know what, let's just go build this. It's easier to build it. And we've gone the other way as well. So there's a whole build versus buy question. And then as you bring these products in or even build it organically over time, as you start scaling, you have to start thinking about platformization, right? Initially you start doing stuff that's very one-off and then you say, okay, now for example, for cloud products earlier, each team kind of built their own products soup to nuts. Now we are actually taking all the core platform areas and creating a generic platform that you can build on. So that's kind of on the R&D side. And then obviously you have to make investment decisions, how much you invest in the core business versus innovation and so on. And then on the go-to-market side, what we have built is we have actually built a go-to-market incubation engine. So the way it works is when you're starting a new product, typically if it's a new buyer, it's hard for a large core sales team to go and do that because they're selling, right?

They're used to selling in a certain way and the current product works well and then they know they can sell other ones.

And then how does it fit into the new product? It's hard for, it's hard to go enable like 500 sellers to do this. So what we do is we create a— initially we create a go-to-market incubation team, and these folks, they only make money to sell this product, right? So they're waking up every day thinking, okay, what's the angle here? And so they can do the initial pathfinding. And then what they do is they say, okay, this is the— and obviously there's a lot of product iteration as well. So there's a— it's almost think of it as a pod. There's engineers, product managers, sales folks, maybe one marketing person. They're all iterating on the message and the product. And then once you see, okay, that this is, this has legs, then we transition to what we call a product line sales team. And this is, think of it as scaling these 2 to 3 sellers to maybe like 10, 20 sellers who can now go and really, again, again, they only get paid for selling this product. So they go and now scale this to the next level. So think of it as 0 to 10, 10 to 100. And then once it hits 100 million or something, then you can say now enable that. Of course, by that time you've hashed out the message, you've hashed out what resonates, who's the buyer, how do you go. So the whole decks and everything, all of that have been built.

Yeah, I imagine at that point the core sales team would have some conviction in this product as well, like that, take it to a customer.

And the product is also probably more mature, so you're not hitting like bumps on every POC that you do. So then it gets ready to scale. So that's kind of what— so we have this conveyor belt of what we call Rx, which is our incubation to product line sales to core. And we have, we have done multiple products in this fashion.

Okay, that's great. Actually, I love that. Really good advice. So let's continue talking about scaling and, you know, a couple of numbers up there, 39% year-over-year growth, which is amazing, and 80 NPS. And getting a score that high is pretty rare, actually. I don't know many others that have it. So I'm kind of curious, as you go through this really rapid scale, you're branching out to multiple products. How do you keep that customer satisfaction so high?

Yeah, the one learning for me through this journey is that especially with large enterprise customers, I know there's this advice that say no to 95%. I don't believe in that. I think you have to say yes to everything, right? Because if you miss a large Fortune 500 customer, it may be a $100K deal down the road. That's a 20, 30x lifetime value you can build with the customer. So you have to figure out, you have to say yes, but then you have to figure out what is that piece of it that they truly need and distill it down to that. In terms of supporting customers, one of my co-founders and I were actually the first support people. So from like the first beta customer we had, anything goes wrong in the field, we'd be the folks taking the call, working with the customer, figuring it out. And a lot of our founding engineers would do the same. So there's been a culture of this customer first, let's make customers successful. Mentality that's been there from the beginning, and that is kind of like—

interesting—

percolated through the entire organization. Even today, if a customer says, hey, I have a problem, engineers will drop everything and jump on it. Support, sales, engineers, everybody will drop everything and they'll jump on it. So that's definitely— it's part of it is culture. And we always keep emphasizing that make the customer successful. Nothing else matters.

So, I mean, I think it's important just to pick on that point a bit that you as a co-founder were there, CTO were there hands-on in support doing that. Because I've seen a lot of engineering cultures that have kind of an ivory tower sort of mentality. They're not as connected with their customers.

I'll give you an example. There was an early stage, there was a customer at 4 PM. They said, this customer is really in bad shape. It is a law firm. There was some issue and their email system was impacted. So literally I booked a flight for that night, took the red-eye. I was on, I was with them 2 days and just sitting there until it was resolved and then flew back. So you got to do things like this in the early stages and you got to show that you care. And the other learning is that obviously as you scale, you know, there'll be bumps in the road. Not every implementation will go as planned. But what I've learned is that what customers need is first of all, be transparent. Tell them, don't try to tell them something that you cannot do. I'll give you an example. Very large retailer in Europe. They have this huge Oracle database. They came and said, we need this, right? And without this, if you don't have this, we're not going to buy you. So initially there were a lot of questions. Can we do it? Then we realized this is no, we really can't meet the requirements. So one of my engineers and I actually went in front of the customer and said, you know what, what you want today, You want like a 7x reduction in time. It isn't going to happen today, but we will invest in this and in 6 months we'll be able to deliver it to you. But if you want to go with somebody else, I would totally understand. We would totally understand that. So you should make the choice. They said, okay, we'll think about it. Next day they came and said, you know what, we'll go with you. So being transparent, not trying to sell them something that later they realize isn't there, I think is key. The other thing is there will be mistakes. Again, with customers, all they want is acknowledge your mistakes. We are very, very open about this was that we did this, we didn't do this well, it was our bad. And we start with that. We start with saying this wasn't the experience you should have had. These are the mistakes we made and we are doing stuff to fix that. And here are steps to that. We will get you to a better place. And usually when you're honest, I think a lot of people are not able to do that. And because their customers get irritated saying at least acknowledge that the problem. So that's what you've seen. And this is something that we have a truly world-class support team. Our Chief Customer Officer, I mean, he's amazing. The team he's built, and he was the one who took over from us and threw us out of the support room. You guys go build the product. And he's really built this great support team. And even when you lost POCs, our customers say, you know what, your support team is fantastic. But that's true that it percolates all the way from sales to support to engineering.

And so, yeah, it seems like there's a deep level of customer intimacy that you guys have had from the beginning.

Yeah, absolutely.

Cool. Okay, so we're on the AI stage, so let's talk a little bit about AI. Now, I tend to break AI down to a couple of different buckets. We think about it in terms of technology vendors. How do we build AI into our products? And then how do we leverage AI internally in terms of our internal operations and how we execute. So I'd like you to talk about both of those. Maybe start with the product. What has your product strategy been around AI?

Yeah, so I mean, you're absolutely right. We are thinking of it exactly what can we do in the product and what can we do internally? So let's talk about the product. The product, we think of it as in kind of two ways. One is our product today is not, it's not easy, right? If you think of an average customer, they're using the Rubrik platform to protect their data that could be sitting in the data center, could be a VM, could be an Oracle database. They're using it for cloud, for, again, cloud VMs, cloud databases, object storage, and then they're using SaaS as well. And then there is— we have built a whole suite of security products, which very often the IT persona may not even have the skills. If there is an attack, they don't even know what to do next. So the first step is to really— can we actually provide an assistant or copilot, if you will, for the Rubrik product to really make it easy and That's what we call Ruby, is kind of this AI companion for our SaaS platform. And what it does is it really says, so for example, if you say, oh, we found a piece of malware, they're like, okay, what's an IOC? And we say, okay, this is what it means. And then it's like, what should I do next? Here's what we'd recommend. And what this does is it uses our knowledge base documentation, support articles called wikis, and also is able to query the product itself through APIs, put it all together and answer the question. So that's kind of what we have built. So that's the, I would say, making our product more usable. We want to do as we scale, we want more and more self-service. There's a problem, don't come to support, just handle it. So that's what customers want. And that's what will help us scale. The second piece is really about how can we, as our customers are on this AI journey, how can we enable them to build the AI applications they need? And Again, there are tons of— there's lots of stuff on the foundation models, and obviously that's the core of everything. But most of the time is not spending— is not spent in foundation models. Nobody's training models. The work is in, okay, how do I get access to the data that I need to solve this particular use case? How do I make sure that, first of all, am I adhering to the security permissions that are there? And then more importantly, even if you have access to some data, what if somebody put something sensitive in there? Financial documents exposed to all of engineering, right? And then every engineer can ask a question and will get an answer from that. So, so this is where a lot of the time is spent. Almost like we've heard like 80% of AI POCs don't make it to production. And very often InfoSec saying no. And we even talked to CISOs who said, we don't want to say no, we want to say yes, but we don't even get half good answers for the questions we are asking. And then our realization was over the 11 years we've been building exactly all of this. A, we take all the enterprise data, put it in a single platform so it's easy to access it. It's automatically getting refreshed every day, every, every few hours. We understand permissions so we can actually make sure that you only see the data that you're permitted to see. And then we can automatically suppress any sensitive information, mask it so that it doesn't go into the model. Once it goes into the model, you don't know how it's going to manifest itself on the other side.

100%.

So So we were like, wait, everything we're building is really well suited for the problems that the enterprise is facing. And that's why we announced the product called Annapurna, which is really around— and it's very early stage. I would say we're still exploring the right use cases and customers are also in the very early stage of innovation. But that's where we see a lot of potential there and very excited about kind of where we take that.

That's cool. So what I heard is that there's actually two sort of aspects of this. There's one of how are you enhancing your product with generative AI to help the customer and automate a whole bunch of stuff, make them better at what they do. But then that second bucket seemed to be you're actually helping the customer do AI themselves. Like they have AI projects.

Solve— can we solve the data problem for me? Focus on your business use case, focus on your workflow, focus on building the right kind of agents, but don't worry about the data.

Yeah. Which is definitely what I've heard as well, that there's a massive level of scrutiny and concern about what sort of data— do you have data leakage? Where is that going? How can you manage that? Okay, got it. Okay, let's change tactics and talk about using AI internally within Rubrik. How are you as a company adopting AI?

Yeah, so for the very same, same reasons, we actually at a very early stage, we set up an AI governance committee. The goal there is to really have InfoSec, legal, everybody coming together with the goal of enabling AI adoption across the company, but doing it in a safe manner. And that has been very effective. But then there was a lot of grassroots stuff, somebody saying, hey, I want to try this. They would go to the committee, they'd evaluate it and say, hey, is this secure or not? And then if it's secure, they say, okay, go ahead and do it. So we started seeing a lot of projects pop up. Then we said, okay, let's bring it all together. There are lots of tools being used. Maybe we can consolidate. And also we are building with Annapurna. We've said a lot of the stuff we could just build on top of our own platform. So we actually did a whole AI summit. I don't know, you were asking about like how do the legal team handle it. It's actually a VP of legal was actually running that initiative. She's like, let's get this going.

I think this is the first time, but we were talking backstage about this. I think it's the first time I've ever heard of like legal running this thing.

Yeah, so she was like, let's go make this happen. Let's adopt a rubric-first strategy so that if we can leverage our platform, let's use that. So what we did, we brought in like people across all organizations. People were sharing notes on what worked, what didn't. We gave some basics on how generative AI works, RAG and all of that. And then now they're going back and they're coming up with— each org is going to come up with these are the business metrics I want to solve and these are kind of initiatives I'll do and these are how I'll measure the success of the AI initiative, like AI-specific metrics. So we're going to have that cross-functionally and then make sure that as a business we are able to do that. But one of the learnings is that even if you put these tools out there, people just don't adopt it easily. They try it once, doesn't work, they're like, oh no, I'm not gonna go there. So you gotta keep pushing people to go adopt it, saying, no, no, things have changed, let's go try it, let's go try it, give me feedback, let me fix it, now try it. So you kind of have to keep pushing so that people adopt it in an organization and while balancing security and everything else that you need to do. So it's, I mean, if you look at LinkedIn, you feel that Everybody is like doing AI like crazy. But in reality, in an organization, there's a lot of work to make that happen. That's what we're focused on. It's still early, but—

Well, I imagine a lot of people don't really— haven't really internalized how different it is to like their workflows can be using AI. Yeah. Like it doesn't occur to them.

And to be honest, definitely on coding, we are seeing some potential, huge potential gains that we see. So we are really pushing everybody to to start using AI for their coding. Obviously in research and any kind of product research and things like that, there's a lot of stuff that AI can help with. So yeah, so we are adopting tools and trying to do that in a safer manner so that there's standardized ways in which we can do that.

Got it. One question I had for you was to combine these two AI discussions. I'm curious if you've— your experience doing this yourself, putting AI into practice and what you mentioned before about how most businesses, they have AI initiatives, but they're not successful. So what are you learning about it and how are you applying that in your customer discussions?

Yeah, I think the thing is that you have to bring— first of all, you got to bring all the different stakeholders together. There's legal, InfoSec. You got to make sure that they are aligned because if they're not, then you're going to run into all sorts of bottlenecks. So bring them early to the conversation so that they agree that this is the right approach and then Everybody is aligned and pushing that forward. And then I think there is a lot of— you got to put stuff out there. People have got to try this. And then there's a lot of things that people can use their imagination and they're very creative. They can do all sorts of things with that. But until you get it out there, get the adoption going, you're not going to see what the real value is. So I think you need to give people time to experiment, get familiar, experiment, and then the best practices will show up. So it requires— so we are Within engineering, we are running it very programmatically. We are monitoring this, we're saying, how— look at the metrics, what will help drive those metrics? Where are the bottlenecks? Are there specific teams that are struggling? So you have to kind of almost run it as a program.

Got it. I imagine as well, you being founder or co-founder probably helps as well. You'll founder mode on it.

Yeah, sometimes I have to put my co-founder hat on and—

There you go. All right. Okay, we have just a minute left, but if you want to ask a quick question, we can go into the lightning round here.

Quick question then. So about adopting AI in the business, how do you evaluate ROIs? Do you really take care of it before, like, a POC or after POC? Please share your experience. Thank you.

Great question. This is actually the biggest challenge, right? Because AI is not cheap and people are saying, okay, if you're going to spend this much, what's the ROI, right? And this is where a lot of projects are getting stuck because they're not able to prove ROI. So the way we are doing it is we are looking at it as So rather than just look at any AI-specific metrics, we are looking at business metrics. I'll give you an example for engineering. For engineering, we are saying, hey, can we— we have a plan of release, right? Roadmap. Can we reduce the net delay in roadmap items, so delivering that to the business? So if we say, oh, we'll deliver in Q3, did we deliver 15 days later, 30 days later? What is the net delay, right? And we want to reduce that. So that's a business metric that the business understands. The other thing is, can we make sure that while we're doing this, hopefully by moving faster, are we keeping the quality bar high? So we have what we call like a quality index that looks at defects per account and stuff like that, or cases per account. And we're saying, are we making sure that we drive those down? So the end of the day, and then we have AI metrics where we say how much code is generated by AI or how much, what is the MTTR for certain defects and stuff like that. But that doesn't, that's an internal metric. At the end of the day, we measure ourselves by did these two business metrics actually go down, right? If they didn't, then doesn't matter. I can do 100% AI code if that is not, if we don't meet those business metrics, it makes no difference to the business. So at the end of the day, I think you have to wear the business hat, whether you're in R&D or go-to-market, doesn't matter. You have to wear the business What are the metrics you would track there? And then have secondary AI metrics that would hopefully drive these higher level metrics. So at least that's, again, we haven't cracked the code yet, but that's the process. That's the process we are following right now.

That makes a lot of sense. Stay grounded, focus on the business metrics. Don't get caught up in the, in the high ground.

Signal to noise is low. All right.

Well, thank you all for the questions and Arvind, thank you so much. Really appreciate it.

Thanks for the opportunity.

Thank you.