How Skyhigh Security Builds Data Protection Into the Platform to Stop Shadow AI | Sanjay Castelino

Russ Fordyce (00:00): Welcome back to the Winner Circle, everybody. I'm here today with Sanjay from Sky High Security. They are another winner in the Fortress Cybersecurity Awards. They are on the front edge of security, actually securing that edge and helping enterprise and businesses secure that edge edge. Sanjay, welcome to the winner circle and congratulations on the award. Sanjay Castelino (00:00): Hey, thanks Russ. I'm really happy to be here and we're really excited to receive this award and and be recognized for from a data protection perspective. Russ Fordyce (00:00): Well, it is I we we were talking just a second ago. This is what a what a time to be in kind of edge security as these AI agents and AI all over the place. The edge of our networks and the edge of our systems are really kind of the the attack vector now. Tell us kind of what, you know, kind of give us that view of sky high security. What are you guys doing about and how are you helping businesses? Sanjay Castelino (00:00): Yeah, no, for for sure. You know, Sky falls in an established category called the secure service edge, but but what that really means is that as a business, we're thinking about how to protect organizations from threats both inside and outside of their network as people are accessing technology. And it's not just about the access of that technology, but about how they're using the data inside of those. inside of those systems. And and if you think about that, when when businesses slow down, when they when they say, we don't want to adopt, let's say, AI as fast as we'd like, what what they're worried about is leaking sensitive data. What they're worried about is someone having access to things that they shouldn't. And so Sky High at its core is about helping organizations protect against those threats, both internal and external. Russ Fordyce (00:01): Yeah, and it it is it is a huge problem now. I can't imagine. I mean, I I know personally how corporations dealt with it when, you know, a few years ago when I was still in the corporate world, you know, the the the edict was don't use AI. You know, when it first came out, it's like you cannot use AI because they're worried just about that. The companies have intellectual property inside of that, inside of that moat that they've built in their security system, and now you're handing it to this. basically teenager, you know, AI. and so data protection's really gotta be a massive, massive problem and concern for all these executives. What drew you personally into this problem? What what made, you know, data protection specifically, you know, topical for you versus the dozens of other places you could have spent your career in security? Sanjay Castelino (00:02): Yeah, y y you know, I I think for me, at at its core, data protection is about helping organizations operate the way that they want to and need to, right? L like I said, if you think about what modern organizations really value besides operating and and you know, turning out product is what makes them special is is the data that they have about themselves, about their customers, about their intellectual property and and being able to allow customers to tap into that, to accelerate their own organizations, but do it in a secure way is is just exciting to me. It's y you know, I like to think about it as it's not just a piece of technology we're shipping. It's it's we are really on the forefront of helping to protect organizations as they go about their their day jobs, if you will. Right. And and that's an exciting proposition, right? Not not everyone gets to show up to work every day and say, hey, that's the purpose of of why we are we are who we are. Russ Fordyce (00:03): Well yeah, I mean your job's one that's really hard. I think it's build the biggest, strongest wall you can and make it invisible for all employees, right? It's that's that's kind of what you're trying to do. And make it as big as possible to the outside. So it's you know, this giant wall, but to the employees it's invisible. And that's a that's a real ch challenge, I think. How do you describe kind of sky high's value prop to a you know, to a CISO who's already got five security vendors and doesn't want a six? Sanjay Castelino (00:04): That is that is right. Sanjay Castelino (00:04): Yeah, no, it's a it's a it's a great question. And I think it's one of the challenges that that CISOs have is the cybersecurity market is so crowded and a lot of it sounds the same, right? Because the everyone's talking about protecting you from threats inside, outside. and so so truly how how we sort of talk about the world is w we we focus on the fact that it's not just access but it's access and use of that data to help accelerate business right your point about being transparent and invisible to users is so very important and and I'll give you a a a very demonstrable example of that. one of the things that you have to protect against is is things that people do in their web browser, right? And one strategy for For doing that is for people to use only specific web browsers that are quote unquote secure enterprise browsers. Well, that's really difficult. You've just changed the user's workflow, you've got to maintain one more browser and the and the user's environment. It's a lot of work. we accomplished the same thing and said you can use whatever browser that you want, and you can turn that on in five minutes using policy. Right. So so making it simple and providing that power is is really important to us. The other part is is value and cost effectiveness. And this is something we have been recognized for by by analysts, by our customers. We we try to keep it simple, right? That you know, we recognize that delivering these services have lots of different types of costs associated with them. But at at the end of the day, if you're a customer, you want A relatively simple proposition to to be able to buy technology like this. And so a good example is a customer of ours, Secreti in Brazil, who's a very large financial institution. You know, w we made it simpler for them by by adding more power and capability to their solution, cut the time to resolve incidents from hours to minutes, right? That's a massive Sanjay Castelino (00:06): impact for you as a as a financial institution. But not only did we do that, but we cut the cost of delivering their solution in half. Right. And so that is to me how we approach CISOs, right? It's not about the fact that there aren't lots of ways to go solve this problem. It's let us show you how we can solve this in one streamlined way, giving you a lot of flexibility in how. You deploy how it's used within your organization to make it work for your organization, and then let us do that for a fraction of the cost. Russ Fordyce (00:07): I I've run into similar situations in that in in my career sales and marketing, especially in telecom when we were replacing, you know, kind of legacy equipment. You're talking about cost savings. Just, you know, deploying a new system versus an old system saved you money because your costs went down. You were using legacy connections, all sorts of, you know, hard to get equipment, that type of stuff. Maintenance costs were generally significantly more. So you could come in, you can make that pitch pretty easy, but you're replacing something or Or maybe yeah, you're generally replacing something or helping a process. You know, to get a fifty percent gain is a a pretty monster gain. Why do you think that kind of this data protection market has been so underserved for so long? Sanjay Castelino (00:08): You know, I I I think part of it is that for a while, especially through COVID in the SSE world, people had employees going from offices out, you know, into their homes. And and there was just a I'm gonna call it a gold rush for a minute. the gold is on the on the supplier side there, of just hey, everyone needs something and and they need it now. And so there's a premium to be charged for all of that and and lots of disparate solutions, right? and and that not just it's not just a cost from direct buying a product perspective, but it's also a cost from managing lots and lots of different solutions. And so now we're we're entering an era where there are other demands on budget. we'll talk about AI here in in a bit, I'm sure. but there are There's also just inefficiency in how people are working. And so being able to look at solutions that can address the needs of the business, not just today's needs, but where we're going, and do it in a single platform, which reduces the operating cost of running it, and do it with a vendor that gives you the flexibility to deploy the technology pieces the way that they need to be, configured for your environment. That's just the the how the market is evolving, right? And I think it's a natural evolution from this time when there was a rapid expansion. Russ Fordyce (00:09): Well, that's a very good point. It's I I I forgot about COVID for a minute. But it was if you were if you were if you were in technology, it was everybody was grabbing everything they could to either protect, expand, promote, do whatever they had because you know the world was so changed. It also, you know, we've in my world, we've been trying to convince, you know, companies and corporations to be teleworkers, to have remote workers for decades. And, you know, I obviously were selling services to support. Sanjay Castelino (00:09): Yeah, exactly. all of us did. Russ Fordyce (00:10): That COVID boom really kind of pushed us all into telework, right? We went from you know 5% of the workforce workforce to you know 48 or 50 or 60% of the Americans who could work from home and did for a while. What that did was it it had data, you now had data on the web, in the cloud, private apps. Now you've got data all over AI. Why is unifying all the data protection so hard across all of those things? It seems almost impossible, but If you're a corporation and you're tunneling everything in, how why is it so hard to kind of unify that protection across all those apps? Sanjay Castelino (00:10): Yeah, it's a a a great question. So so I think people had built up the idea pre-COVID that there was sort of a perimeter around their organization, right? We we we have the data inside, we can control it. That that wall had started to break down with the introduction of SaaS services and sort of broader adoption of of all of that. But but to your point, COVID sort of just blew up the wall completely, right? Now it Now data is everywhere. And being able to look at where that data is, whether it is in a database sitting in your data center, something sitting in AWS or Google Cloud, something sitting on a laptop, or something that's actually in transit, is a very difficult technical challenge. And so you had technology piece parts in all of those areas. But nothing that looked at it in one consistent way. And and now with AI, the the question needs to be asked, where is our sensitive data? Right? and and honestly, to adopt AI in a accelerated way and to do it in a way that is also safe for the organization, you have to understand where that where that sensitive data is. And that that's something that Sky High introduced a product for called DSPM or Data Security Posture Management. And that gives you visibility into where all the data is. The second part of that is that's great. I know where it is. Can you help me protect it? And and integrating those two pieces is something that is very unique to Sky High. you have people in the DSPM world, you have people in in what was thought about as the CASBY world or or endpoint DLP world and and those two things are very separate. But really there's no reason to be separ then no reason for them to be separate. So what we did is we took our engine that that looked at data, that identified sensitive data, using either your rules, machine learning, what what as the case may be, and we allowed that to not just see where the data was, but to then enforce the policies to protect it. Sanjay Castelino (00:13): And and the one thing that I think makes Sky very unique in that regard is that engine spans our entire platform. So it doesn't matter how you're accessing the data. we're able to apply those data protection rules wherever you are, in the office, remote, you know, on a mobile device, on a cell phone, that approach is is critically important to us. Russ Fordyce (00:13): Now as you roll these out, what surprised you most about how customer are actually using the DSPM and AI governance capability once Sanjay Castelino (00:13): Y you know, I I don't know that it was a a surprise per se, but but I think most customers, as was the case when SaaS came out, underestimate the number of services actually being used to have AI. So we we go and catalog you know, thousands of of of services to look at various different risk attributes of of those AI services. So that customers can make smart decisions about what do we allow, what do we block, what do we what do we sort of pseudo-allow. Yeah, we we may allow you to go to a site, but not allow you to copy and paste data into that into that site. And so customers were surprised, I think, first of all, by just the number of services people were using. And then I think the other surprise was for them to realize how they needed to protect themselves against those services. so if if if I were to sort of expand on that for for a moment, the entire idea of web protection, which is part of this secure service edge, right? I think you may have mentioned it earlier. Like, how do I make sure that people go to only websites that we want to allow them to go to when they're you know at work? people thought that was the be-all and end all of of protecting data because I even if I allowed you to go to a site. I would be able to protect the data that you were sending to that website. Well, with AI services, they use new technologies, well, not that new, but been around for a little bit. WebSockets. WebSockets cannot be broken up as the data is actually in transit, right? And so you have to look at that data in in the browser. And so it's a good example of where. I was mentioning the secure browser capability earlier. Now that we have that, you're able to look end to end. Someone goes and takes a piece of a document that you think is sensitive, copies it, goes to Chat GPT, pastes it there, and hits you know okay. we will block that because A, we knew it was sensitive. You copied and pasted it, even a piece of a document from a from a sensitive document, you put it into the browser. Sanjay Castelino (00:16): We will say, nope, you can't you can't do that because that's sensitive data. And that is that type of capability, tying all that together is is what makes Skyha unique, right? We're with we're tying all these pieces together with that underpinning data protection engine to to really make it come together in terms of allowing enterprises to adopt AI. Russ Fordyce (00:16): Yeah, I I imagine that's a great demo when you're in a boardroom. you know, here let me let me open up something, you know, a confidential file and try to paste it into a web form. because it I mean, how often do we do dumb things like that? I was you know, we were talking earlier about, you know, our my AI has every password API key known demand now. And I mean, you want to talk about a vulnerability, you know, copy and paste. Sanjay Castelino (00:16): It is Sanjay Castelino (00:16): That's right. That's right. Russ Fordyce (00:17): It makes it too easy. Yeah. Sanjay Castelino (00:17): That's right. We we'll we'll talk about security after we're done with this. Russ Fordyce (00:17): Yeah. How do you build kind of that trust with a security team that's already kind of skeptical of cons kind of consolidating all those multiple tools into kind of one? Sanjay Castelino (00:17): Yeah, I look, I think this is the this this a challenge I think has been around for a long time, right? in various generations and types of technology. It's it's best to breed versus platform. And and the argument is always, hey, let's use the platform, it's cheaper, it's easier. and and I think that can be true up to a point, right? I think sometimes Platforms are sold as a bunch of disparate products and technologies. Maybe companies acquired a bunch of stuff over time, but it isn't really integrated. And so what people are trying to do is say, hey, you'll get all these benefits, but really it's a financial bundling of a bunch of products. And I think that's where security teams really do have to be a bit skeptical and and see the products in action, right? How many consoles do I need to go to? How do I edit a security policy and how do I how does it permeate its way through this whole system? and I think that's really a a good test of the platform. And then lastly, does it do as good a job? Because I think a lot of times what you'll hear people say is, yeah, you know, we we have I'm gonna take our our segment, SSE, right? Great, we do we're fantastic networking company. We We came from the access side, but what you find is they don't really do data protection the way it needs to be done, right? Or they don't do it at scale, right? So so you know, for example a good example for us is you know we do fingerprinting of data. I I mentioned, you know, being able to tell if you copied and pasted a snippet of a document. Well, that's where we are fingerprinting a a file. Well, enterprises have a lot of files. And a lot of data. And so we can do billions of cells in in hours. Some of our competitors can do billions of cells in weeks and months. Well, weeks and months doesn't work because data's changing. Right? So that's where I think the rubber meets the road. So, you know, first, what's the experience look like? And then second, am I making compromises in capability? And if you are, then then I think. Sanjay Castelino (00:19): You have to very carefully look at, you know, is it worth it to go platform? Right? 'Cause am I really going to get the benefit for the cost savings, right? Getting getting a a lower performing solution for lower price is not a it's not a bargain. Russ Fordyce (00:20): No. And y you were mentioning earlier on you know that the surprise that the boardroom kind of feels and the security team feel is how many services people are actually using. I I want to step back to that for a minute because it it got me thinking about kind of the olden days when Wi-Fi came to to our shores. And I remember it very well because you know, we all had laptops and stuff and nothing to connect to them. And then Wi-Fi came in and s very slowly you had these kind of shadow IT networks coming in. I imagine all those services, you're finding this kind of shadow AI too. I know, you know, when when a couple of years ago I was saying we we had that no AI mandate initially from from the bosses. of course we were using AI. There were we were being very deliberate and protective and, you know, our own on our own accounts, but we were using it. And I'm sure they if they had had something like this, they would have known that. But How big a role is that in the in the enterprise these days as kind of AI just invades everything that we Sanjay Castelino (00:21): Yeah, look, I like I said, I think everyone's always surprised at how many services people are using. Because to your point, as as employees, people want to be productive. They they they want to make use of st of the things that are available to them. I think the challenge is is that they don't necessarily always understand the risks that that they're taking, right? And so different organizations have different I'll call it tolerance for that risk. And so some will say, hey, we just want to know what everyone's using, but we're not going to stop anyone. Others will say, hey, you know, unless you're using these two services, we're blocking everything else. And you can imagine a whole spectrum of policies in between here and there. And so I think the the the willingness to use AI is a is a corporate decision. The ability to then protect it, to have a an ability to take a zero trust approach with AI, which which really is critical, really is what we enable, right? Because everything moving at the speed of AI now, and we're we're talking about people using AI, but but obviously we're already seeing agentic AI solutions operating in in organizations. And for those, those are moving at machine speed. Which means if you've got things that are open and you know the your your your teenager gentic AI decides it's going to consume all that data and do what it needs to with that, not out of any malintent. it's just gonna go do what it thinks it needs to go do. and so the the whole idea of this zero trust framework, if you will, and implementing controls where no Russ Fordyce (00:22): Been given a job. Sanjay Castelino (00:23): Human or non-human user is trusted in the network explicitly, right? It's always to a specific application to a specific data set at a specific time. That's the fundamentals of what we're implementing. And and the it's actually driving one of the big changes in the way that is architected. So you know, for for COVID, we were worried about people from the outside coming in, right? Because all of our employees went home. And so that that when we thought about zero trust, we thought about outside in. with the Gentik AI, we are now also thinking about inside in and inside out. And and and that's a that's a big shift because it changes how you architect the zero trust solution. and again one of the ways in which we've always approached it is to be able to put parts of our solution inside your network and parts outside your network in a very native way. So we've got physical and virtual appliances you deploy in in your infrastructure if that's how you chose to do it, or you can use the cloud. Either way works. And it's it's proven to be very beneficial for customers as they're thinking about agentic, because now they can put zero trust inside the network so that solutions that are going laterally and trying to access data inside the network also have zero trust enforced. Russ Fordyce (00:24): Is that what you'd kind of tell security leaders and founders if they had one thing to remember from this is kind of that zero trust mentality for data protection? Sanjay Castelino (00:24): I absolutely. I mean you know, when you think about the speed of AI, you have to assume that y you know, you take a zero trust approach. Because otherwise you you risk all of your data being accessed by a genetic AI services because you can't control the speed at which AI agents are come cropping up. Because again, AI agents are being developed by all of us as employees, and And you can't control that they're going to do just the things that you thought they were gonna do. Right? These are not deterministic systems like old coding was. Russ Fordyce (00:25): No, and and we d there's still humans in the loop too, right? I mean, you know, the I think all the data points to most of the majority of kind of breaches having a human element involved, whether it was social engineering or or something else. Where does that data protection fit into defending human targeted attacks? Sanjay Castelino (00:25): Yeah, look look, I I think you will see human targeted attacks and AI targeted attacks and and and at the end of the day, the zero trust approach applies to both of them. Right. If you see yeah, classic example we we see with when we look at user behavior. So again, it's part of the the the solution is if if Russ logs in in in New York City and twelve seconds later l Russ logs in in Beijing, China, yeah, we probably should stop Russ from accessing things. Because chances are Rust didn't didn't invent teleporting from New York City to Beijing. So you know th this type of zero trust infrastructure absolutely applies to human targeted attacks as well as it applies to to agentic. It's just you see different behaviors. and but at the same at the same time Th the the the zero trust approach works if you implement it in and and implement it fully. Russ Fordyce (00:26): As your sales teams kind of go out and have these conversations with boardrooms and CEOs and IT leaders, how many of them are actually kind of having already have policies for AI apps? Sanjay Castelino (00:27): I think they do. The the vast majority of them started very simply and and not long ago. So what is it, July of twenty-six, I would say eighteen months ago, there were already policies, it's just that they were very binary. Allow a block. Right. And and it it was a good nine months of allow a block. now what we're seeing is an evolution in sophistication. Hey, we cannot block. We must allow because business depends on it. Therefore, what does allow actually mean? And that's where you get into all the sophistication that we've been talking about, which is I want to accelerate AI adoption. I need to accelerate it. How do I do it in a safe and secure way so that the business can move forward at the pace of AI? Russ Fordyce (00:27): G that's exactly right because that's you know, that's what our management team said two years ago. That's and the only answer at that time was stop. Right? That's that that that's the only other answer is just stop doing. Sanjay Castelino (00:28): That's right. Sanjay Castelino (00:28): That's right. And and and I think everyone knows now that is not not an option. Russ Fordyce (00:28): No, no. Especially if you're a technology company. Sanjay Castelino (00:28): That's right. Russ Fordyce (00:28): Sanjay, thank you so much and congratulations again on all the success and all the awards. This is a great platform. It makes all the sense in the world to me. I I wish you all the best in the world and can't wait to see where you guys where you guys go from here. Sanjay Castelino (00:28): Well thanks Russ. I I again thank you for the award and and I really enjoyed the conversation. So thank you for taking time.