Who Controls AI? The New Rules of Data Security and AI Governance | ft. Navindra Yadav & Ravi Sankuratri, Theom

Karthik Padmanabhan: Hello, everyone. Welcome to yet another episode of the Zinnov Podcast, where we talk about software, technology, and all things AI. I’m Karthik Padmanabhan, your anchor for today. 

Today, when we look at AI, it has truly started to mature. We can see AI impacting everything around us. AI, the true transformational power of AI is being unleashed.  

Organizations are racing ahead. There are AI getting embedded into products, services, and impacting consumers and businesses. But along with that comes great opportunity, and along with opportunity also comes in risks. There are questions being asked about data, about issues around privacy, security, and so on.  

And that’s what makes today’s conversation so relevant and pertinent. I’m today joined by two CEOs and co-founders who are solving exactly that problem. Thank you for joining us, Naveen and Ravi.  

Naveen today is a serial entrepreneur. A distinguished engineer. He has gone, started up multiple organizations, has an imminent career within Cisco, and today he started up Theom, an organization that looks at securing enterprise data in the AI era.  

And Ravi, along with him, holds patents in this particular area. Today, they’re creating a product, a software that really looks at managing not just data security, but looking at AI governance at whole. Thank you so much for joining us.  

Navindra Yadav: Thank you for having us. Today marks a very important day. 

Karthik Padmanabhan: As well. 

Ravi Sankuratri: Today is when we the Theom India office. Theom started way back in 2020, so it’s been six years into this journey. 

Karthik Padmanabhan: Why don’t you first of all tell us what is Theom? How did that idea come about, and where are you in the journey today? 

Navindra Yadav: So Theom is this product that actually protects data and AI for our enterprise customers. 

The idea started off, the genesis happened way back in our previous startup that Ravi and I started and eventually exited to Cisco. There, our customers often asked us, “How are you protecting our data?” So that particular product, or startup, was called Attrition Analytics. We used to get a lot of signals from its own customers, like various enterprises.  

I could never answer this to my customers very faithfully, is who’s actually looking at what data and who has access to what data inside a large data lake or a large data warehouse. And that’s something that most companies had a problem with, and it’s a blind spot in the industry.  

That’s the initial thing that we started off solving, and that problem has become much more acute with AI coming into the mix. Because with AI, now there’s another layer of abstraction that gets added. Who’s behind the AI? What are they accessing? What are they doing with that data? Should they even be doing this with the data?  

And should AI even be using that data to do certain functions, and so on and so forth? It’s become a harder and harder problem to solve. That leads us to Theom.  

Karthik Padmanabhan: Perfect. I’d love to understand the genesis of Theom, when that idea took shape and how did that grow. 

Navindra Yadav: So data is the most important thing. 

Data permeates all this organization. That’s what we’ve started off focusing on, is focus on the five Ws of data. Like what data does this company have? Who has access to it? Should they have even access to this data? I think, where did this data come from? Where is it going? Trace the lineage of the data.  

When is it getting accessed? Why is it getting accessed? If you can establish these five Ws, you can start solving a whole lot of problems. One of that set of problems is around the cybersecurity space, another is in the governance space, and so on and so forth. So that’s really what our foundation was, and that’s also what we named our company if you stitch all these dots together.  

Om is the sound of the background sound of the universe. It permeates everything, and that’s the same thing that happens with data. AI doesn’t function without data, and which is why we call the company also Theom. Wow.  

Karthik Padmanabhan: That’s awesome. That’s a great story. Ravi, Naveen credited you for having coined that word Theom. 

When you discussed the idea, what was going through your mind when the idea was floated, saying, “Here is an organization, let’s do this together.” How did that conversation happen? You have your fingerprints all over the product, so how did you think? How did you process that?  

Ravi Sankuratri: This started when we’re part of decision analytics, like Navinder said. 

And we also observed a pattern of even the larger enterprises, even the financial institutes moving their data from data centers into the cloud. And that’s where the whole flow of data, and we also observed, okay, that’s where the need of data security and whatnot. And we said, “Okay, let’s do that,” and that’s where we started.  

Karthik Padmanabhan: Super exciting. AI is now everywhere, and organizations are really moving ahead embedding AI into everything that we do. It’s impacting businesses, processes, consumers. But along with that, there is a real feel that the threat or the security aspects are being left behind, and it’s always play and catch up. 

Is this real? Can you give us a few examples and tell us what sort of impact it might have? 

Ravi Sankuratri: Got it. We’ll give an example from an airlines industry where the biggest challenge with AI, especially in the larger enterprises, how to enable the data, who can access what data and as well as AI should respond having in a context, okay, this person can preview the data. 

Example of an airline industry, the airline has multiple datasets. It could be a flight maintenance, it could be a finance data, it could be a customer KYC and whatnot, whatnot. 

Let’s assume you have an AI agent in an interface sitting out there. Ravi, when I ask for, okay, give me a, what is our quarterly results or quarterly ARR, as in a question to the AI agent, it should know that, okay, Ravi is from finance, it can answer. 

Or if Ravi is from a maintenance team, it shouldn’t be giving that information. And that’s a biggest challenge. Folks are spending billions of dollars in enabling AI, train on internal data and then enabling employees or the users within the company to make use of the data and also make agents automate. 

But at the end of the day, it should also know whom to, or what data and context and then what to act on it as well. That’s the biggest challenge. 

Karthik Padmanabhan: It’s a great insight, right? In the sense of AI governance and who can have access to data could lead to wide ramifications if people have access to the wrong set of data and how that’s actually getting processed. 

We also know that Theom works with a lot of financial organizations. Can you talk to us in the financial industry and give us some examples of what are the kind of challenges that they are facing? What should they be doing, and what they’re not doing today? 

Navindra Yadav: Yeah. I can pick some examples right there in the financial space. 

Let’s take there’s some arbitrary asset manager. It’s the same problem that Ravi was earlier trying to say. Depending on who’s asking this question, what’s the context? Context of the identity, who is asking, and context of the data you need to give AI different accesses at that point of time. 

So take this financial example that I was giving. So let’s say I’m tenant A on this asset manager thing, and I’m allowed to see the London Stock Exchange data. There’s another tenant B who’s not allowed to see the London Stock Exchange data. 

As this data is streaming into this financial institution, if the query comes to the agent from tenant A, employee of tenant A, then London Stock Exchange data is shown. 

Whereas when the query comes from tenant B, who doesn’t have access to London Stock Exchange data, the data should not be shown by the AI agent, neither should the AI agent use it in its processing inference and everything. Otherwise, you’re violating all these guardrails. These are the type of guardrails that need to be put into that AI fabric. 

It can’t be bolted on. It has to be built into the solution so that AI has regulation and governance built right into it, based on the context of the data and context of who’s asking the question and what’s that agent. 

Karthik Padmanabhan: It almost feels as though there’s AI being used for managing AI. Is that correct? 

Navindra Yadav: That’s 100% correct. That’s the only way to get ahead of this whole thing. Use AI to enable AI itself to deliver good results to the customer. 

Karthik Padmanabhan: Interesting. And are organizations not doing that today? And have there been any outcomes that have come out in the open today where you’re saying, “Hey, that’s manifested itself right now, and that’s a serious problem”? 

Navindra Yadav: Yes, there have been some of this, especially around personal data, like if you look at ChatGPT or any one of these tools. Sometimes there’s been these news stories, it’s been trained on personal data or some personal data came out, and that’s essentially an artifact of the engines learning something that they should not have learnt off things. 

So that’s an example of a guardrail that probably wasn’t inserted right or safety guardrails were not there. So guardrails can be of all different types. There could be safety guardrails, security guardrails, regulatory guardrails and things. All those guardrails today, these in the pre-AI era were hard coded in application business logic. 

Now, as application business logic is melting away, AI is coming in the front. These guardrails or regulatory controls have to go into the AI side of the house. That’s why our belief is enable AI using AI and then push all of these controls into it. 

Karthik Padmanabhan: I have a skeptical view to this. Like, when you start talking guardrail, security, governance, risk, right? 

It seems as if you’re slowing down the process. But we also know if done right, it can actually accelerate the process, right? What has your experience been? 

Navindra Yadav: That’s exactly what our experience has been. If you insert it inside things, it accelerates the process because now you’re not creating 100 different business rules. 

Your AI fabric has these guardrails built into them. The guardrails get described as regular natural language. It could be in any language, any human language, because AI now can actually translate from human language to computer controls. Controls actually get enforced inside the compute or the data layer and we just take regular English language, convert it into that. 

Ravi Sankuratri: On top of it, what Navindra has also said, there’s another aspect of it where if the guardrails are not present right now, most of the enterprise or the enterprise who have started early, they ended up duplicating the infrastructure because they’re now too narrowed down who can access. 

And so they end up training the same data multiple times and then trying to prevent it. So having these guardrails embedded into the agent itself solves that problem, which also saves a lot of revenue with respect to all that. 

Karthik Padmanabhan: That’s a great point, right? And of course, now coming to the question that I had asked about the heavyweights in this area around Zscaler and Palo Alto Networks, CrowdStrike and others. 

What are those distribution capabilities? Is there a point that you are solving which probably others have not honed in on? 

Navindra Yadav: So the unique thing, the USP of Theom, and which actually answers that particular question in another way, is Theom runs inside the data store. 

So this is why we have Snowflake as our investor. We have Microsoft as our investor. We have Databricks as our investors. We run inside the data platforms. None of these companies that you mentioned actually have their visibility sensors as well as their defense mechanisms built into the data store. 

So the way Theom has always looked at data is data comes in multiple different shapes and forms. There’s one type of data that actually works for revenue data. Companies like a bank, I was giving you an example, or an asset manager, their trading platforms generate revenue for the company. Then there’s another type of data, which is IT operations data that goes into the likes of Splunk and so on and so forth. 

And there’s a third kind of data, which is office data, the emails that we send to each other and things. So not all data is made similar. What Theom has gone and done is gone from the highest value data, which is the revenue-generating data, those type of data stores, like your Snowflakes, your data warehouses, your Oracles, your Databricks, and so on and so forth. 

And we go inside those data stores and have full visibility about what’s happening with the data. As queries are firing into that data store, what’s happening with it? How is it getting modified? And so on and so forth. So we can stop anything right inside that data store. Whereas all the other companies, the prior cybersecurity companies, they’re sitting outside. 

So that’s the key differentiation. This is why we can really enable AI. 

Karthik Padmanabhan: Awesome. So that’s about the product itself. Now tell me a little bit about your company and the ethos, because you are an AI organization built for AI organizations, right? And that gives you so much insight into how AI organizations should be or how AI-native organizations should be. 

And I can see there’s inherent technologists in you coming out every time that you speak. Earlier when we spoke, you spoke about the geek in you coming out as well, and both of you coming from that. How is your organization structured? What sort of empowerment, what sort of people are you hiring? 

How do you encourage them to innovate even further? 

Navindra Yadav: So what we’ve gone and done is like any other regular company, and then I’ll actually differentiate where we start differentiating. So like any other company, we have core engineering and product building, so the product team. 

Then you have sales, you have marketing, you have these different functions. So as an early-stage company, we focus more on product building and sales. Those are the two verticals that we get. Now we are building out all the other functions. Where we really differentiate from other companies is how we build the product. 

How do we actually take AI and use AI to build stuff and things like that, but not let AI ever get into control? So it always actually enables our engineers to do things better. So we’ve actually worked on a lot of methodologies and software designs as well as life cycle improvements that we have done, so that AI remains under the control of our engineers. 

Humans always have oversight. Humans actually use AI to increase their productivity. What we actually look for is engineers who are empowered 10X or their productivity goes 100X up because they have this 100 people team working under each engineer, which is actually doing things. 

And these are those skills that we teach our agents too, so that these agents create all these different skills. Produce things, but they’re always under constant oversight of humans, and humans then drive, “Okay, that’s right. This is right,” and then it keeps learning. 

Karthik Padmanabhan: And that’s ideally how an AI organization should actually function, or every organization should function, leveraging AI agents to do the work for them. 

Tell me on the business side of things. You’ve got investments coming in from some of the heavyweights in the industry as well. You’ve worked with Microsoft and you’re working with Anthropic and so on. 

In that, do you see them? Of course, you see them as working with them would give you a lot of insight into how they work and how you can use their product and so on. But do you also see the fact that they could be watchdogs over here, for instance? So that is a balancing act when you’re working with a large number of organizations and you’re a startup over there working with them. 

How have you found that balance to be? 

Navindra Yadav: So what we’ve gone and done with the likes of Anthropics, the OpenAIs and things, we keep relatively savvy about because we understand AI, we’ve never been shied away from AI. We know how it actually works, how these models work. We keep our data with us. 

We use the models trained over the general internet and so on and so forth. We use the models to do inference, but the data always stays with Theom. And Theom controls, Theom dogfoods its own controls so that the reasoning part of AI can be done by the Anthropics, the ChatGPTs, or OpenAIs of the worlds or Geminis of the worlds. 

We allow them to do the reasoning, but the data stays with Theom. Eventual actions are also controlled by Theom, so we never let our data bleed out of their environment. So we’re getting the best of both worlds. We get the latest models from them. We can leverage the latest models without actually building any risk inside. 

And as we are building this, we are learning how our customers should… So when we talk to our customers, we talk with a whole lot of confidence that this is how we do it, and we can exactly tell them this is the downside of doing exactly like Ravi was earlier describing, the earlier pattern we used to see with our customers, they used to replicate their data multiple times so that they could control for this dataset, these are the only actions you can take. 

But the downside of that is one is the cost side, where Ravi went. Another downside is your data gets replicated. Different copies of data means they drift from each other, your business decisions start becoming wrong, and so on and so forth. 

Karthik Padmanabhan: Terrific. And today, historic day in a way, in the Theom life, where they opened the Hyderabad office, right? 

And I can see the pride in your faces and the excitement in the team when the office itself was launched. Tell what does Hyderabad mean for us? What are your aspirations over here? What was the thinking behind Hyderabad, and what do you think you’re gonna get out of that? 

Ravi Sankuratri: I’m native from Hyderabad, so another place as well, with respect to what it is. And prior to Theom, we did tradition analytics. We had an experience of having it in your offices as well. And this time we said, “Okay, look at the infrastructures and Hyderabad suits us and then the talent pool.” 

We have Triple IT, ITs and BITS as well. And the niche, what we are looking at with respect to skills, especially on the data side of it and then the cybersecurity side of it. This is the talent pool where we could find a lot and we said, “Okay, let’s move forward with Hyderabad.” 

Karthik Padmanabhan: And what sort of problems do you think the Hyderabad team will be solving? 

Ravi Sankuratri: Pretty much everything what US is solving. We are coming within a pattern where we think it’s a pod system where you have folks paired with US and global teams. Hyderabad is one office. 

We have a presence in other places as well. So we’re making pods where people work as one global team, and they are trying to… They are center of the product. It’s not a back office or any of it. They are innovating and they are working along with the other global teams. 

Karthik Padmanabhan: Wonderful. And that would mean great opportunities, great problems to solve as well. Looking into the future, so how do you think all of this is evolving? Do you think that the AI products is going so fast ahead in terms of use cases and how it’s being deployed that security and governance are actually the ability to play catch-up is becoming more difficult, or do you feel that’s maturing as well? 

So can you give us a peek into the future, let’s say three years from now, how the AI landscape might look like? How does the data governance landscape look like? How would the AI control landscape look like? How does it hold for you? 

Navindra Yadav: I can give my opinion. Clearly AI is rapidly… The use cases that I see AI solving today, I couldn’t even fathom like few years ago that AI would be this advanced and so on and so forth. 

AGI, I think, is going to come faster, much faster, but let’s keep that aside. In terms of evolution, how I see this evolving, governance and security and regulatory controls or any type of supervision that you want to put into AI has to be natively embedded into the AI fabric so that all these controls are native. 

They can’t be sitting after. It can’t be post, like if you’re trying to shoot a video footage, you can’t do post-editing because by that time things are too late. You’ve lost context. You lost a lot of different things in the AI world because things move so fast. So it has to really be in the substrate. 

And I believe the Theom approach is what would succeed. That’s why we bet big into Theom, and we have put our lives, careers, everything on this thing because we truly believe in that, that it has to be embedded into the fabric and so on and so forth. And governance cannot be bolted on onto it because that’s when governance starts slowing down things. 

If governance is built into it, and if you change, you get a new regulatory control that you needs to be added, you just change that document. Automatically things percolate down, and you say from when which point, which point in the transactions that new thing gets applied or that new regulatory control gets applied, it gets applied right there. 

That’s the point we need to reach to, and I believe in the next three, four years you’ll see that happening. 

Karthik Padmanabhan: Traditionally, security governance risk has been a CISO problem, right? Do you see this continuing to be a CISO-owned issue, or do you see the ownership shifting to a CTO? 

Navindra Yadav: Yeah. So AI will also change. 

That’s a very interesting question. In my belief, AI will change organization structures also, and I’ll give an example later. But no, the answer is, regulatory controls or all AI controls will become a function or control that crosses different boundaries, like legal would have a say for certain things. 

Marketing would have a certain say for certain things because marketing, let’s say, acquires data from some third parties and so on and so forth. How that data can be used is also something that’s a control that needs to be pushed down. So security would come from a cybersecurity lens that the company’s assets are not being put at a risk. 

They’ll come from that angle. So this will cross through all different boundaries. 

Karthik Padmanabhan: I saw that you were going to be adding something to that. 

Ravi Sankuratri: Well, no, Amit. The data teams will be heavily involved as well, especially with the AI adoption model. 

Karthik Padmanabhan: Right. So it will sort of diminish from being just a security responsibility to becoming everybody’s responsibility to a large degree, right? 

Yes, that’s correct. And that would require a lot of education again. And in a way, at that point of time, agents have to be educated in terms of how to embed that. So it seems to be AI talking to AI, embedding it automatically with each other. Do you see that ecosystem evolving like that? 

Navindra Yadav: 100%. Context also has to be passed. Like, let’s say I ask a question to one of the agents. This agent started talking to another agent, which then reached the data. If that context of this is on behalf of Navindra doesn’t actually percolate along, that second agent will not know which records, for example, in the data it should look at, what it can do, and secondly, it should also know it’s running on behalf of Agent A. 

When Navindra directly talks to Agent B, maybe the actions could be different, but when Navindra talks through Agent A to Agent B, things… Like, for example, if I’m going into my portfolio and trying to change the beneficiaries of my portfolio, like something happens to me, and I’m talking to a benefits agent, and then there’s a portfolio agent. 

When I go through this benefits agent to my portfolio agent to go to my data, now that portfolio agent should think about my balance of my portfolio and things. So that context needs to pass. All of this is, it’s new territory. It’s just getting built. There’ll be startups getting built in all of these areas. 

Karthik Padmanabhan: Absolutely fascinating, right? In a way, sometimes when there’s an explosion in the AI industry that’s actually happening, there might be diminishing confidence in using some of that. All of this will actually give us added confidence in actually being able to use it. So we can start to use some of these products with a lot more confidence in saying, “Okay, you know what?” 

There are agents talking to each other. Our data is in safe hands. The responses that they’re getting is contextualized. We know that what we are asking and what we’re getting back is a lot more contextual, and we’re not there yet, right? And I think those are probably how it’s gonna come forward in the future. 

So very exciting field. What are your challenges? And typically, are people still looking at wanting to work with you? Are you seeing that adoption? What sort of challenges are you facing? 

Navindra Yadav: So it’s the classic challenges of a startup. We’re building a startup, so marketing, demand gen, and how do you get people to know about you as a company? 

This is one of the forums that gets the word out. There is something called Theom. There are multiple such things. Like everyone knows who Microsoft is. They can go to Microsoft to get a solution, and so on and so forth. So that’s one thing around awareness, the whole bag of awareness. 

Then another one is trust. You have to establish trust. Trust is not established overnight. It takes time with every customer that you go deliver a solution for. The customer becomes happy. That customer actually introduces you to two other customers. That whole network effect, it doesn’t happen overnight. 

It takes years, two, three, four years. Microsoft built its brand, I’m just picking Microsoft as an example. It built its brand over the years. Same thing Theom would need to build all of this brand, and so on and so forth. Those are our classical challenges. That brand awareness, brand trust, all of that impacts hiring, impacts customers. 

It impacts all facets of company building. 

Karthik Padmanabhan: Terrific. What we’re gonna do now is to do a rapid-fire kind of a question. So not longer answers, but very quick 30-second, 15-second answers, if you will, right? Starting with what you just said, for a budding startup entrepreneur today in the space of AI governance and data, what would your advice be to them? 

Navindra Yadav: Trust, believe in yourself, and build a robust solution that works for your customers. 

Karthik Padmanabhan: In your team and when you’re hiring for your team, tell me one quality that you’re looking for that should be embedded within every person in Theom. 

Ravi Sankuratri: Attitude towards work. 

Karthik Padmanabhan: And what attitude are you looking for? 

Ravi Sankuratri: Someone who takes the responsibility, someone who doesn’t need shepherding all the time, and someone who takes the responsibility and then moves forward. 

We are not in a business of micromanaging people. We want to let people do their own things and be passionate about it. 

Karthik Padmanabhan: What is fun at Theom? 

Ravi Sankuratri: Getting things solved on a day-to-day basis, and then every new customer, every customer is a new challenge for us, and it’s a new celebration as well. 

We are coming into different aspects of it, so yes. 

Karthik Padmanabhan: One life lesson from each of you that you wanna give to budding entrepreneurs and startups. 

Navindra Yadav: Always the number one priority should be, in my opinion, your customers. If you do right by your customers, no matter whatever it is, do right by the customers, everything else will fall in place. 

Ravi Sankuratri: Perseverance. Keep trying, keep doing it. It’s not an Instagram reel where things change in a minute. It doesn’t. You have to learn. You keep learning, and you have to keep trying and doing things right. 

Karthik Padmanabhan: Thank you so much. The two founders, CEO, COOs of Theom, they are solving what is so relevant in today’s industry. 

We can go confident in using AI products because Theom is at work making sure that the data is protected and governance is at play. Thank you everyone for listening to us. 

Ravi Sankuratri: Thank you. 

Karthik Padmanabhan: Thank you. Thank you. 

Ravi Sankuratri: Thank you. 

Navindra Yadav: Thank you so much.