Full Transcript for Google Cloud CEO Thomas Kurian on AI agents, security, and the future of enterprise tech

back office, we have a lot of people using Gemini to streamline the core processes within the company. 00:05:56.583 --> 00:06:22.250 Thomas Kurian: So Virgin Voyages, for example, talked about how they're using Gemini to, you know, to transform every element of how their organization works, from finance to planning all the voyages to planning the food and other things that need to go on their legal department contracting. So one big thing we see is a lot of people using Gemini to enable their core workforce. 00:06:22.333 --> 00:06:51.625 Thomas Kurian: Walmart does a similar thing. The second big thing that we see a lot of interest from customers is customer facing. So Best Buy talked about how and a lot of them are sort of evolving. They start with I'm using it to do help people find things online, then buy them. Commerce. And then handle upsell and cross-sell and finally service. 00:06:51.625 --> 00:07:16.167 Thomas Kurian: And they can do that from web, from mobile, from surfaces like Instagram, so that you have access across all your channels. So that's the second big area that we see. Third one is within the IT organization. We have a lot of people using it for the three big scenarios we see is for software engineering and coding to help do data analysis. 00:07:16.250 --> 00:07:38.000 Thomas Kurian: You know, today, for example, if you look at finance departments in many companies, they used to say, hey, anytime we need to report numbers, we always have to go to a database person to have them run all the queries. Why can't we just make this? But I can just ask the question through a search system and have an agent go and find the data for me. 00:07:38.000 --> 00:07:56.500 Thomas Kurian: So that's the data analysis. And then cyber is the third part within the IT organization. So these are some of the big domains we see organizations using our AI systems for. And we're doing many of that ourselves internally. And I know many of our joint customers who are listening to this are also, you know, I think using that. 00:07:56.500 --> 00:08:26.292 Sanjay Poonen: So it's great. It's so exciting. You know, I came back from that, that conference pretty energized about the future of AI. Maybe we can shift now that you have Wiz, you're a prominent player in security. You had Mandiant. You've got this. There's so much talk today about these frontier models in the context of Mythos and other things. We just had a conversation a few minutes ago about why, you know, that's just one piece of it and all the frontier models, if you're just trying to fix code and scan code, that approach isn't sufficient. 00:08:26.333 --> 00:08:40.625 Sanjay Poonen: Maybe you can walk through first why, given that's very topically relevant, how you would if I see source to think about right now that all they're thinking about is scanning code. Yes. How would you tell them to get their head out of that and saying, would you think about the X and the Y and Z dimensions of what could go wrong? 00:08:40.667 --> 00:08:57.583 Thomas Kurian: You need a different approach. So, you know, in general there are sort of 3 or 4 important things that we talk to customers about. The first one is the risk from AI models is not just to source code of applications. 00:08:57.708 --> 00:09:07.417 Thomas Kurian: The risk can affect binaries, it can affect firmware. It can affect a physical device like a network switch by compromising the firmware of that. 00:09:07.417 --> 00:09:37.167 Thomas Kurian: And the reason is that models have gotten really good at understanding not just code, but also configuration. Like for example, they can understand your network and go, if I access this switch, then I can shut down this part of the network, etc.. So, one thing is that models now have access to a lot more information and their ability to reason on them, and so you need to think through what you are protecting is not just scanning your 00:09:37.250 --> 00:10:03.500 Thomas Kurian: source code. Yeah. The second thing that we say is if you look at the rate at which models are advancing, you're going to end up scanning continuously. And that can get both expensive, but also just finding an infinite number of bugs. You need a solution to help you repair it. So that's the second piece is scanning without fixing is not a solution. 00:10:03.583 --> 00:10:30.083 Thomas Kurian: The third one is when you look at the evolution of this whole infrastructure, the volume of applications, the volume of data, the volume of all the systems that companies run. If you then say, I've got new models, finding new things all the time, you then end up having to deal with an extraordinary large surface area to patch, maintain, and update all the time. 00:10:30.125 --> 00:10:57.042 Thomas Kurian: And so you can't just say, I'm going to start at the start and go till the end, because it's such a large state of stuff. And the fourth complicating factor, there's no one model that finds a superset of all the issues. In fact, what many, many companies are now reporting is a cheaper. Even a small open source model with a good harness can find many of the vulnerabilities that a top end model can do. 00:10:57.042 --> 00:11:22.583 Thomas Kurian: So when you look at it, you know you have these four issues. It's not just about source, it's about firmware, binaries, network, everything. Second, it's extremely frequent because you're going to have to get comfortable that models are going to come out all the time, and just the volume of these issues is going to grow on you. The third one is just finding without repairing becomes challenging. 00:11:22.583 --> 00:11:47.500 Thomas Kurian: And when you repair, you need to think about what are you going to focus on repairing. And lastly, no single model is the solution. You have to have a a conglomeration of models, like for example, saying, this time I'm going to scan with this model. Next cycle I scan with another model. And so those are

the four core beliefs we have based on all the data we've seen and based on what we're doing ourselves to protect Google systems. 00:11:47.500 --> 00:12:11.000 Sanjay Poonen: That's great. Maybe we can talk now in that context. How does Wiz fit in? The picture you now acquired with Wiz is now commonly used by many of our joint customers. Given what you've just said, how can Wiz be part of that solution that sees should also do and and capturing risk. So recognizing this this this this list of four issues we've generally said you need to do for things. 00:12:11.083 --> 00:12:53.833 Thomas Kurian: First you have to plan and prioritize. What of all the many systems, applications, databases that you're going to prioritize first to do. Wiz gives you this graph of all the resources you have and systems, databases, applications, etc. and allows you to see which ones of those are most at risk. Which ones are, for example, things you can protect by taking them off of public IP addresses, putting them behind a defense in depth, like for example, in a zero-trust environment, so that you get some time to figure out what you know, what to remediate. 00:12:53.833 --> 00:13:27.833 Thomas Kurian: So that's one thing it does. So step one is plan. Step two is scan. So, on scanning in general we tell people you need to maintain a software asset management system that tells you these libraries and these applications were scanned with this model at this time. So, Wiz gives you that ability to maintain that library and track it so that you can then say, okay, you know, a new vulnerability was found and it was found with this model. 00:13:27.833 --> 00:13:56.167 Thomas Kurian: Well, when I look at my systems, luckily I just finished scanning and fixing using that version, so I'm likely safe from it. So the second is it allows you to scan to manage your software asset management. Third is, we built in to the process of remediation. So for remediation we offer two solutions. One, several people say hey I've got old code. 00:13:56.167 --> 00:14:21.708 Thomas Kurian: It has vulnerabilities. Should I just rewrite it in a modern system? So we've integrated Gemini as well as other models so that you can help rewrite it. And then you need to deliver a patch. And to do the patch we're introducing a new product called Code Mender. Think of it as an agent that's built on top of Gemini, that looks at your code, looks at the changes you made, and can generate a patch. 00:14:21.833 --> 00:14:42.625 Thomas Kurian: Now, to deploy that patch you have, generally you need to know on what of the many systems in your company. For example, how many virtual machines need to be patched with that new library, and then if there's a change in that library, what are the dependent ones you need to change at the same time? And Wiz gives you that as well. 00:14:42.708 --> 00:15:12.708 Thomas Kurian: Finally, you know, you may think you're done, but you're never done because the models keep improving. And our general approach has been you want to. The last step is to continuously test yourself. And so, because it's better you find a vulnerability before your adversary does. So with Wiz we have built something called a red agent. Think of it as a red teaming agent that you can deploy that autonomously, test your environment. 00:15:12.708 --> 00:15:41.000 Thomas Kurian: And so what Wiz brings is it's not about scanning, it's about the toolset to repair. And to do that you need to prioritize. You need to then scan. You need to then remediate it. And you need to deploy and then monitor yourself Wiz is built in using all of the models out there, we built those tools as agents into Whiz with works with Google Cloud. 00:15:41.000 --> 00:16:00.083 Thomas Kurian: It works with AWS, it works with Azure, it works with on-premises environments. So we give people that as a central plain of glass to protect themselves with. I think that's a very comprehensive. In those last few minutes. You plan, you scan, you, then you know, you're fixing your mediating and then you're testing that whole loop and you repeat that. 00:16:00.083 --> 00:16:33.042 Sanjay Poonen: That's a very comprehensive process that I'd recommend. All we were last week listening to this entire vision in Google's security briefing. And we're excited at Cohesity to continue to partner. Now, one of the things we've done together in the security domain is to ensure that we are perspective, because we're on the right side of NIST. If you think of Mist as detect prevent and then the right side is recover remediation, we just assume that it's a matter of when everybody gets it, because the frequency and the speed of these models and everything we're doing is about recovery of data and apps very quickly. 00:16:33.042 --> 00:16:53.667 Sanjay Poonen: What we've done is sought to integrate deeply with all of the core Google services we could run. Now, a third copy of cyber vault in optimized storage of Google. But one of the things we're also hearing from customers is this notion of being able to run in a sovereign cloud outside the U.S., because many of these cases, they want the data in their country. 00:16:53.708 --> 00:17:10.500 Sanjay Poonen: That's right. I understand that's a big part of Google's effort, especially out of the US. Talk a minute or two about why the sovereign clouds are important for the non-U.S. countries, and maybe even for the federal inside the US. So we built since 2020, we've built sovereign offerings. 00:17:10.583 --> 00:17:26.167 Thomas Kurian: These sovereign offerings address sort of three important things. One, there are customers in international markets who are worried about, you know, government access to the information or lack of control of the information. 00:17:26.167 --> 00:17:51.958 Thomas Kurian: And so we built a version of our of Google Cloud. We call that Google Cloud dedicated or trusted, which allows a customer to control the location of the

data, to control the way that the data is encrypted. They get to keep the keys and keep the keys even away from Google. They also control who has access to their environment. 00:17:51.958 --> 00:18:27.458 Thomas Kurian: So, they have all of that. In France and Germany, we now have accredited local partners who operate the cloud on our behalf and provide an additional supervisory control over SANS, and that's in France. And we just announced an equivalent one in Germany. And those are meant for regulated enterprises, government agencies, etc. we also provide an air-gapped environment, which is become incredibly popular with intelligence services. 00:18:27.542 --> 00:18:46.208 Thomas Kurian: Government customers regulated, for example, telecommunications and financial services. As it runs fully air gapped. It can run Gemini and our AI platform, for example, and people want to use that to deal with highly classified or confidential information. 00:18:46.375 --> 00:18:54.917 Thomas Kurian: That's being deployed in many, many countries around the world. And so these give you the ability to use our latest tools, but in compliance with government needs. 00:18:54.958 --> 00:19:18.708 Sanjay Poonen: Fantastic. So there's a lot we're doing at Cohesity with with Google Cloud, I forgot to mention. And Security Domain were also heavily involved in Mandiant getting Mandiant feeds in our threat scanners. So and this of course in the sort of cyber vaulting area deploying Cyber Vault and Google Cloud, but also taking advantage of sovereign cloud. I thought maybe we could end on a on a different note, talk about a softer topic. 00:19:18.792 --> 00:19:49.375 Sanjay Poonen: You're an incredible leader. I watched your career flourish from Oracle to Google. One of the things I admire about you, how you're able to go from a 50,000ft level down to a five foot level so effectively. So, maybe you can give a lesson to all of the aspiring leaders. How do you manage the combination of detail, what I call helicopter leadership, being able to to be able to fly at a high level on your need to because you're talking to maybe CEOs and heads of states and other times you've got to be deep in the engineering. 00:19:49.417 --> 00:19:55.042 Sanjay Poonen: What are some of the the tips and tricks you'd give some of the aspiring leaders, the younger folks who want to be a Thomas one day? 00:19:55.250 --> 00:20:11.667 Thomas Kurian: I've been fortunate to always work with great people. So, you know, particularly in the technology business, it's always important that we recognize that the products and the way we bring them to customers is because of the ideas people have. 00:20:11.708 --> 00:20:52.958 Thomas Kurian: And so one important lesson we've always had is an aspiration to attract great people who can come up with these ideas and also lead. That's one. Second, you know, it's a courtesy for the teams I work with that I can get to the detail with them. You know, it's a simple thing

that if you're an engineer or an engineering team and you're working hard on something, that the person leading the organization is willing to get into sufficient detail, that they appreciate what you're working on, and that gives them a sense of fulfillment also that the leadership understands. 00:20:53.042 --> 00:21:15.250 Thomas Kurian: Lastly, in this environment that we're all in, where the pace of technology is moving so quickly, it's really important, at least for us. It has been true the last many years, but even now, at this AI moment, to prioritize. And so, we are very clear how we that we need to do fewer things better rather than lots of things. 00:21:15.250 --> 00:21:57.333 Thomas Kurian: And when you make prioritization decisions, it's enormously helpful if the the leadership and the organization both has a coherent vision, but also they trust that the leaders making the decisions understand that and are making decisions based on an understanding of the products and solutions and customer needs. So, all those have been important. And so I spend a lot of time reading documents, talking to the engineers, meeting the people in the organization so that we can build a cohesive, you know, organization that has continues to have great aspirations and also takes care of our customers. 00:21:57.375 --> 00:22:18.750 Sanjay Poonen: I like one key word there—cohesive. Sounds like my company there. But this is I mean, you could you could spend hours with this guy. He's so able to distill some of the details. One of the things I enjoy about my conversations with him or walks with him, is he takes a very complex topic. It's a it's a, it's a mark of a great teacher being able to take a complex topic and simplify it. 00:22:18.750 --> 00:22:38.042 Sanjay Poonen: And all of you leaders, my advice to you is the better you can get at being able to drive the complexity that so much of this tech is involved in. And make it simple. I like to call it Sesame Street simple for people. I often I like going to the keynotes. I was used to go to Thomas's keynotes at Oracle even though I was at SAP. 00:22:38.083 --> 00:23:00.417 Sanjay Poonen: I'd watch him, but now at Google Cloud too. It's an amazing, amazing gift. Maybe just in closing, Thomas, for the CIOs and CISOs, they're watching you in a couple of other clouds. They're watching the frontier models. You're involved in both the cloud game and the frontier model. You know, what advice would you give them and how they should be thinking about the next few years in tech? 00:23:00.500 --> 00:23:23.625 Thomas Kurian: I you know, I think you should assume that we always say the capabilities of models are going to advance. The best technology teams are not looking at these models as a replacement for their people. I mean, just as an example we at Google are really committed to making sure our engineers become world class at using the models to write code, 00:23:23.875 --> 00:23:28.625 Thomas Kurian: but we're not looking at the models as a replacement for our teams. 00:23:28.708 --> 00:23:56.667 Thomas Kurian: And the third is that the organizations that get really good at adopting this technology and having their people become really skilled at using it, are actually the ones that are going to succeed. And so there's I think part of what we try to talk to people about is that having lived through this whole AI moment for so many years at Google, you know, if you look back, we've been working on AI for many, many years before this. 00:23:56.750 --> 00:24:28.500 Thomas Kurian: That's right. And you know, if you look at Google, we've we've mostly grown because we've been brave enough to accept the technology and integrate it. Rather than to resist it or to fear it. And I think some of the noise in the media is making people very anxious about job displacement and other things. And sort of getting in the way of people wanting to adopt the technology, learn it, and then become great at using it in their day to day. 00:24:28.583 --> 00:24:41.917 Sanjay Poonen: Right. Well, thank you so much, Thomas. I appreciate the time together. I hope you enjoyed this podcast together. And there are many, many learnings. I'm sure I'm going to be watching it and rewatching it a couple of times. Thank you once again. Thank you, thank you. Sanjay.