Cognizant Discovery 2025 - Using AI to enhance security and resilience

Thank you, Nikesh. Thank you for joining us. I'll give a little brief introduction for Nikesh. He doesn't need one. He's a celebrity CEO. He's one of my favorites.

He says that to everyone.

Nikesh spent quite a bit of time in Google, T-Mobile, SoftBank. and at Palo Alto Networks since 2018. The stock of Palo Alto Networks since 2018 has gone up 8 times?

7.

7, okay.

But who's counting?

So he's been— he has had an extraordinary run. Palo Alto is actually in some ways probably the largest cybersecurity company on the planet. Um, I mean, you're having a rub-off. You got onto the Uber board and the Uber stock went up.

You want a board member? Is that what you're saying?

No, I was, you know, I was just seeing the Uber stock and then I was seeing why is it going up, and then I saw you went onto the board. So I mean, uh, you know, it's, uh, it's extraordinary, I would say, corporate leadership. So Nikesh, let me tee up the first question to you. I saw one of your recent podcasts with Nikhil Kamath in India about how—

The guy has a lot of followers.

He has millions of followers.

Yes.

And I'm glad you got onto that show because it's had a rub-off in India in a big way. So there's one specific thing which stuck to me. You spoke about information asymmetry being the moat or the differentiator for Enterprises, actually individuals. And then that mode has switched to expertise. I mean, the internet created that mode, and then expertise is on your fingertips now. Now, if expertise is on your fingertips, what's the next big differentiator?

So, so let me say it in my words. First of all, thank you for having me here. Happy 4th of July for All of you who care. And I come from India. So do you. Culturally, we actually had a caste system where the people who had the most knowledge sat at the top of the pyramid. And if you go back historically, that's actually how the world was governed. People who had the most information and probably the most ammunition, arms, had the most power. So information's always been correlated with power. And I worked at Google, actually. I remember this is the room we started Google Zeitgeist Conference in 2005, 20 years ago. So when Google came about, the fact that you could get access to the same information wherever you were in the world, as long as it was online, was a big sort of empowering moment for a lot of people. If you're in You'd have to wait for 2 days for the newspaper to show up in villages in India. And I'm sure it's true about outskirts of England. And that suddenly, that information asymmetry continues to vanish. And because of that asymmetry vanishing, it empowers a lot more people, makes them more able to do things. And the reason I talked about that was, I think what we are witnessing, and I saw all the agentic stuff and my agent's going to talk to your agent, we're going to have a handshake and buy me a ticket and all that stuff is cool. But I think there's a more substantive trend that is happening, which is that intelligence is going to start getting normalized and the intelligence advantage is going to shrink. Because if you have a powerful LLM in your hand, which can tell you pretty much the answer or recipe to most known things, Yep. then what makes you smarter than me? I know everything that you know. So then the question will become, we went from information to applying intelligence. Now if the intelligence is normalized, what is your differentiator? How am I better than you? Because we both have access to the same intelligence on demand. And I think that then what becomes is, how do you take that normalized intelligence and solve the unknown problem? Because most known problems will be solved by AI agents. If I've seen it 500 times, I can do it right the 501st time. So, if you believe that, I think we're going to get onto a very systemic shift. And I think we're thinking too short-term. We're too focused on the next 12, 24 months because we're trying to sell enterprise software. So, I get it. I got to show you something that works. But we're too short-term focused about talking about my agent can talk to your agent. I think the entire workflows will get reimagined, entire way we work. Not the company you work in. The way we work will get shaped. And the biggest question I am getting now is, since I have a 27-year-old daughter, I was with the CEO of GlaxoSmithKline yesterday, and she's like, what should I be telling my kids? What should they get ready for?

Absolutely. In fact, the gap between occupations and the gap within an occupation is going to shrink. Exit barriers to jobs are going to completely disappear. You're going to have expertise on your fingertips. Look, purposeful problem finding is going to be a big endeavor. Machines and humans are going to work together. They will solve problems. Let's switch a little bit back to security. Who would— I mean, you launched a product on AI runtime security, Prisma AI. How does that work? I mean, how do you— I mean, that's one of the biggest challenges all enterprises are having. I mean, how do you secure your models? And models are very democratized now. Everybody's, you know, trying to do their own thing. Um, tell us a little bit about how you conceptualize that product, and is that creating— gaining momentum for you?

So let me parse the answer in 2 parts. Let me just do a quick 2-minute primer on. Look, security is the most recent technology industry. Security didn't make any sense without connectivity. Before the internet came about, before things were connected, security was your mainframe terminal accessing your mainframe in your office. And if you could keep people out of your office, you were secure. The moment you started connecting every customer, every user, every employee from every remote corner of the earth and putting your stuff in the public cloud, you suddenly became— your attack surface expanded enormously. Now, with this expanded attack surface, what has also happened in parallel is that people have found a way to economically extract value. Many companies are getting ransomware. There's a recent example in the United Kingdom. It's become par for the course. Bad actors will go attack your infrastructure and try and get access to it. The current global average time required to figure out what happened is 4 days. The current time to the fastest clock time world record is 23 minutes to get in and out with extracting crown jewels and locking down your systems. There's a security asymmetry too. It takes you 4 days to figure out what happened. It takes them 23 minutes to do bad things to you. I think they both have to converge to near real time.

Do they have better— the bad guys have better skills or—

They have better odds. They only have to be right once. We have to be right 100% of the time. They only have to find one chink in your armor. And now with AI and the ability to attack your system with multiple systems, they can go after everything. You know, all these agents you're talking about, if I could have 500 hacker agents come after infrastructure, you have no chance. Today, the only problem hackers have is one human being trying to get through your entire infrastructure. If I have 500 hacker agents, we're coming after your systems. So you better increase your response time. as quickly as you can. Now, in that context, there are 2 challenges. One is how do you reduce your response time or how do you get— figure out your stuff faster? So that's where your company and ours are working together. And you're one of our marquee customers as well. We're saying the future of security is different. The paradigm has to be ingest a lot of data, analyze a lot of data using both precision and generative AI, figure out the answer and try and stop the attack as quickly as you can. That's one side. The other side we're discovering is many of our customers like yours are experimenting with AI. And typical experiment with AI requires them to take some amount of data, whether it's Context Factory or context data, connect it to a public LLM, put 'em together and say, tell me what's going on or solve this problem for me. Now, AI models have introduced a whole new interesting thing where in traditional software you get a deterministic response. You write a piece of code, you expect it to do certain things, you test it, ah, it's doing what I expect it to do. Most software is deterministic. AI is non-deterministic. It can give you a different answer tomorrow, which could be equally right. And we call it learning, reinforcement learning. It learns and it gives you a different answer. So by definition, if you can't predict the outcome of a piece of software, you have to inspect both input and output. Security has never inspected output. We always inspected input. So your LLM could spit out malware. It could be dormant. It could spit out bad things. How do you stop it from happening? How do you solve that problem? So that problem is what our AI firewall solves. We look and make sure that your AI model that you're using is not contaminated, can't be hijacked, doesn't have bad behavior. And then we inspect the outputs coming out saying, let's make sure whatever output is coming out is inspected so we don't end up in a situation where our model brain has gone rogue on us.

Got it. And how do you see this from a lens of, I mean, you've been a big evangelist of integrated security stack.

Yes.

And almost all enterprises I know of have bought best-in-breed boutique-pointed solutions over a period of time. And this is an evolving technology, so everybody did not have everything.

Yes.

And they ended up buying because they had to secure it at that point of time. Now, what they're also stuck with, as I talk to CIOs across the spectrum, is they've invested into it. They know the integrated platform makes sense, but they still can't come out of it because they've invested into it. What's your solution for that? I mean, how do we— how do you navigate an existing investment, which is boutique, in a, In a technology cycle which is getting integrated? Yes.

So if you look at the evolution of security, every time a new technology has come about, a bespoke security solution has been created for it. I'm building data centers, let's put a hardware firewall. I'm going to the public cloud, let's get a VM or a software firewall. I'm going to have my employees dial in from home, let's do a VPN and let's do a remote network solution. I'm going to write code, let's do code security. So we have actually built very bespoke security solutions for each security decision. And this is now after 7 years, I can say this under one flawed presumption. The flawed presumption is my security product will find all bad things and stop them, which implies that my solution is so good, I will stop all bad things. Now that doesn't sit right with the idea That we still see breaches, we still see attacks, which means something gets through somehow. All these best-of-breed solutions, something must be getting through. It's either bad configuration, bad policy, bad hygiene, bad behavior employees, or something gets through.

Or they don't know what they don't know. Right.

But the point is, the fact that something's getting through is that this strategy is not working. You know, Marks& Spencer would not get breached if this strategy was working because they have all the security products at the edge. Every customer has them. Which means your breaches are coming from something that gets through. The question is, what is your solution to stuff that gets through? So security's actually trying to solve the problem of the unknown bad, not the known bad. The known bad gets stopped. The unknown bad needs to be analyzed. The only way to understand unknown bad is to look across your entire infrastructure and say, what are the signs that I find that I can stitch together to solve this problem? So our view is, In the long term, security migrates into a bunch of sensors to stop what they can. Whatever doesn't get stopped goes into a large data lake where we run tons of analytics and we connect that back to the enforcement points and say, I found a solution, go plug that hole. That recursive loop has not been built in security historically. We have spent the last 5 years building that recursive loop. We have a product in the market called XSIAM where we start by replacing your SOC and going and delivering what we believe is industry best in class, roughly minutes in median time to detect and respond, which is in days right now, which is what we're doing with you. But our aspiration is to get to near real time. And our aspiration is then to connect that feedback loop back into your sensors to say, I found another bad thing, stop it too.

Ethical hacking. I mean, one of the things I'm always petrified is how are the bad guys able to hire so good people?

And the economic model is structurally different.

Tax-free, you know, they work 24/7. Um, how do you tackle— I mean, ethical hacking was a way to— I mean, creating hacking communities and bringing the good guys into the good communities versus the bad communities. All that was so much told, but very little has happened around it.

Well, I think part of it is always like, look, we have— many of us, not just us, you— we all have smart technical people, right? We're not paying $100 million like Mark Zuckerberg is to hire people for AI, but we have been paying people enough. So we all have smart technological people. And the challenge right now is hacking into a company is extremely easy. If it's like security, it's like, you know, if you say I've got a security guy, well, the other guy comes with 3, then you're in trouble. You have 3, they come with 5. So the question is, at some scale, we can penetrate most companies, right? We have a team that does this, ethical hackers, ethical red teaming, ethical pen testers. We can hack into most companies we want to. That's not the problem. So, and you have enough good people who actually will work with you to protect the hacking from happening, pen testing from happening.

Do they have better software than us?

No, the thing is, if you look at the world's biggest attacks, they actually are not complex.

But is this also true that they're much more synchronized as a consortium in comparison to we're trying to secure our own thing? But it isn't like the policymakers, the consortium of companies, everybody is coming together and rallying behind it. It never happens that way.

Most of the technical infrastructure in many of the companies which have been around for a while is extremely fragmented, extremely disparate. Lots of stuff that you talk to every CIO and CISO, anybody in the room, you obviously have like 7 transformation projects and you wish you didn't have pieces of tech. I was gonna say something else, a piece of technology which is obsolete, which is still in infrastructure.

Yeah.

It's just hard. It's hard ripping out technology, replacing it. So while you're doing that, there are security flaws in there. The question you asked is today the most lucrative, a business where you're unlikely to get arrested and make money is hacking. Like there was this same group of people which did Marks& Spencer's, Scattered Spider. They attacked Las Vegas on a weekend, 3 hotels. They took $47 million on a weekend. The joke in Vegas is the first time somebody walked out of Vegas with $47 million. The only difference is they weren't even there. I'm sure if they were there, they wouldn't be able to walk out. But they were able to take $47 million of ransomware out of Vegas, and they haven't been found. So you don't have to get in a car. You don't have to do a car chase. You don't need James Bond or Daniel Craig running behind you. You can just do it from your mother's basement, which is probably where you are playing Call of Duty while you're trying to hack the Wynn in Las Vegas. And then you get some version of crypto. It gets deposited in a hardware key, and it's sitting in a box somewhere because You can't use it, you'll get traced, but you took $47 million away.

Do you see the security landscape in Europe being very different to the rest of the world?

Is the security landscape— the security landscape in Europe is different.

I mean, even how you reach out to— is the enterprises—

There are 2 or 3 fundamental differences. One, in general, and this is broad generality, The European tech stack is on the margin slightly older than the American tech stack, generally on the margin if you look at it. The second thing is Europe is disproportionately higher managed service than the US is. In Europe, there's a lot more managed services businesses with third party, and it's probably scale and size of businesses, complexity of technology. It's a higher managed services business than the US is. which has its pros and cons. A managed services partner is more likely to get the technology skills required to make the transformation happen. So from that perspective, it's a lot easier to work in Europe and effect transformations once you set your mind to it. It's harder in the US. You've got to convince them one at a time. But it is different from an adoption of technology. Culturally, US is much more prone to risk-taking, much more flamboyant. So they will try—

New things.

New things faster, which means sometimes they work, sometimes they don't. So I mean, look at cloud adoption. Cloud adoption is higher in the US than it is in Europe.

So what's your advice to CISOs or CIOs in this room who are kind of looking for, you know, what do they do? What are those 2, 3 things you believe they should really be doing in security?

Look, I think fundamentally, if you look historically, as I said, most technology companies have some version of sensor software at the edge. You have something that's protecting your endpoint, something that's protecting your infrastructure. You have firewalls and everybody has them. You're not a CIO or CTO if you hadn't put the right controls in place. So you have them. I think people should transform their SIEM/SOC or data store as you've traditionally known it. Most SOCs in the world are 17 years old. That's when Splunks and Curators and ArcSights and Securonix came about. They were designed at a different time when it was expensive to ingest data. It's expensive to store data. Analytics tools didn't exist. Machine learning was not a thing. That has changed. There's state-of-the-art technology out there from Palo Alto Networks, which you can deploy, where if you can go back and go to your board and say, listen, my median time to detect a security incident is in minutes, and my time to resolve is in minutes, you get a card to play for another few years. If you spend your time trying to redo your entire perimeter and your time to detect and remediate is 4 days, It doesn't matter how pretty your gates look. Once they get in, they'll get, and you won't find out for 4 days, you're in trouble. So my only recommendation is with the current state of technology, the state cost of data ingestion, the cost of bandwidth, the cost of analytics, focus on remediating the security incident, block it. Then we'll sort of like solve the A&E problem right now, and we'll go solve the beautification of the gates later.

Terrific. Let me add one last question to you. I saw one of your recent podcasts on— or rather heard your podcast on leadership.

Yes.

Tell us the 3, 1 or 2 or maybe 3 valuable traits which you kind of really feel like leaders should have. You spoke about paranoia in one of them.

Yes, I just said paranoia. But look, I think I discover, and I'll say this in the context of people in the room, I've run into almost 1,000 technology leaders in the last 7 years, even more, in working with them, selling to them. There are times to be captain and there's times to be coach. Do not coach your copilot while you're about to crash land the airplane. Generally a bad idea. That is not a coaching moment. That's a moment to tell them to get the fuck out. So get out of the way. I'm going to land this thing down.

Okay?

This is not a good idea. People get confused. Oh, I'm a coach. These people will— how will they learn if they don't fail? Dude, you're on the same plane. But anyway, so there is a time to be captain and coach. I think right now, given the technology transformation the world is going through, this is the time to be captain. It is not a time to be a coach. It is not time to rely on your best technical person. It is time to become your own best technical person. That's why I'm going for these walks. I don't believe my team can get together and decide on a consensus basis what the right answer is. There will be a bet which will have to be made. That bet is going to significantly impact my life. Hence, if it's going to impact your life, you're on the plane, you might as well decide how to land the plane. So that's one thing. I think this is the time to play captain from that perspective. 2, that doesn't take away from the fact that you need 8 people around you who are really good and you trust, who can help you do things that you want to get done. And in my working at 30 years, I have been blessed. I have some amazing people I got to work with. And my job was to get them to do really well as a team. And then it's kind of interesting. Those 8 people, possibly some of them would fail without the other 6 or 7 around them, but it works together. So sometimes it's not the best person for the job, it's the best combination of 7 or 8 people in that job. And last but not the least, I'll say, look, my job is to relentlessly inspect, focus, set the North Star with my team. And I'm relentless. I am relentless. I will keep inspecting until I accept an answer that is going to work. So I'm going to— for risking putting this on the internet and getting myself in trouble, I'm going to tell you an anecdote. You can go Google it. There's a German general who said this about people. There are 4 traits of people: lazy, hardworking, smart, and stupid. Have you heard this one?

No. Okay.

So he says the smart and hardworking, they were for consulting. They're very smart. They produce beautiful decks and they produce beautiful ideas and outcomes. And you can rely on them because they're really smart. We should make them work in strategy roles. They said the not so smart, 'cause you can't say stupid, not so smart, And not so hardworking. You put them in repetitive jobs with clear workflows, clear metrics, clear understanding. You put them in customer support, you put them in inventory, you ding ding ding ding wake them up, make them wear their clothes, and make them go for a jog, and make them wash their clothes, and make them eat at the right time, and brush their teeth the right time. So you don't trust them to decide anything; just make them follow process. That's fine. You found jobs for these two people. He said the lazy. and smart are destined for leadership. Because they will find a way to do it with less, do it faster, find another way to get there because they don't want to do it the hard way and the long way. However, the ones you have to be most careful of are the stupid and hardworking. Because one day you might say yes to their proposal. With that, I rest. Thank you. All right. Thank you so much.