Transcript: Silicon Valley Secrets: From 3x Exit Founder of Baffle io Ameesh Divatia

They wanted to always understand how the customer was using the product. Came up with a very interesting angle about how you could use data networking concepts for optical networking. And that was my first startup late 90s. Um, second startup was in the storage networking area. The third one was a turnaround for me, which was in the silicon photonics space and then baffle in the data protection space. All three of my previous startups were acquired, um, and the teams were, you know, well compensated. The second one, not as much as the other two, but. You were at Cisco at probably one of the most interesting times, right? During the dotcom bubble. What was the, and I think at one point wasn't Cisco like the highest valued company? It absolutely was and I was right there. So this whole Nvidia story is something that we have lived through. Um I don't want to say it doesn't end well, but all I want to say is it doesn't stay like this forever. Nice. Any advice for whoever is inside Nvidia that you did or didn't do. Be humble. That's it. Just be humble. You know, you Nvidia is a very different story, right? Nvidia is a startup that was uh has been around for 30 years, right? It's it's an overnight success that took 30 years is what they say, right? Yeah. They've completely deserved what they have, but it will be disrupted. One of the things that I always tell entrepreneurs is um don't ever rely on somebody else to find you the exit. It's something that you have to do over the course of time. You have to build the relationships. You have to always uh be open about sharing what is important. Don't share your your crown jewels, but be open about sharing your value proposition. Know about starting a company or being a founder that you wish you know when you were first starting or starting your first company. This is a tough one because um as an engineer, uh founder, entrepreneur, you always tend to fall back on the fact that the technology will sell itself. Um that is seldom the case. Hey Amish, welcome to the startup project podcast. Thank you Naraj. Um it's great to be here. Uh so we like to feature you know companies and founders, uh you know that are solving interesting problems. Um and you're solving you know one of the interesting problems about data protection. Um but before getting into, you know what baffle does and uh how you're solving that problem. Uh can you give a little bit of uh introduction of yourself and your journey to now and your past experiences so that the audience understands where you're coming from. Absolutely. Well, um I've had uh traditional engineering background. Uh grew up back in India, got my bachelor's degree there, came here for graduate school. And um after graduate school got into what was at that time a very, very hot space, the computer networking industry. That's what I did my masters in and um you know, that's something that I was fascinated with very early on as to how computers can be connected together and how it can evolve into a much larger IT paradigm than what the traditional desktop or mainframe based models were. So, I got started um in the networking silicon space. Uh my first job was as an application engineer supporting networking silicon. Uh very quickly I started to move into more of an architecture role because I was always very uh interested um one of the things that you do when you are in a semiconductor business is always try to get the big picture and understand what the system level view is. So I wanted to always understand how the customer was using the product. And that's something that has stayed with me forever. I always try to get the big picture. If I'm working on something right now, I know I'm performing an important job, but I want to make sure that what what the implications are to the overall business. So moved into more of a system architect role as uh things evolved and eventually went to work for a system company back in the day, a company called 3com, which was one of the big three along with Cisco and and what was called synoptics in. So spent um about three years there and uh decided that I wanted to go out there and do something on my own. So started to ideate uh quit my job, went to, you know, figure out what I wanted to do, came up with a very interesting angle about how you can use data networking concepts for optical networking and that was my first startup late 90s. Um second startup was in the storage networking area. Um and the third one was a turnaround for me, which was in the silicon photonics space and then baffle in the data protection space. So as you can see my journey has taken me through uh very different spaces. Um I I like to learn new things. That is probably one thing that's that's common. Uh I like to go after very, very complex technical challenges. Um again, I can go through a few of them that um that that we've been through. And then finally, you know, have been extraordinarily lucky, you know, um all three of my previous startups were acquired, um and that the teams um were, you know, well compensated. The second one, not as much as the other two, but again, it's it's all about macro conditions and everything else. But in every case, what we did was what we built a completely new market for the acquirer or for the space in general. So as as looking at your uh career and you were at Cisco at probably one of the most interesting times, right? In during the dotcom bubble. Yes. What was the and I think at one point wasn't Cisco like the highest valued company? It absolutely was and I was right there. It was sort of the Nvidia of dotcom bubble. Exactly. So this whole Nvidia story is something that uh we have lived through. Um I don't want to say it doesn't end well, but all I want to say is it doesn't stay like this forever. But it was it was euphoria, right? You would get into the office in the morning and see the stock up six bucks, everybody smiling and and we literally thought we could take over the world. That was exactly the idea. And actually again, it was just extraordinarily lucky because we were newly acquired into Cisco. There's two things about Cisco that was amazing. First of all, they always reinvented themselves. John Chambers used to have an edict that every four years companies have to reinvent themselves and he had a team that truly believed that. So we were acquired into Cisco and we built a completely new business um on the optical networking side. So when you second thing about Cisco is when you get acquired, you are treated very, very well. You're you're you're like the new kid on the block, so you get lots of attention. I remember distinctly I had uh at that time there was a record of uh you know, 33 EBCs in a quarter. So it was insane. Every day, you know, who's who of the networking world and uh on the Telecom side from a provider perspective, AT&T, you know, Verizon, all the international uh telecom players, um you know, Deutsche Telecom, you know, France Telecom, what was Reliance Telecom at that time. Everybody would be in the EBC every day and you know, we would be there presenting to them and they would just slap it up. Magical time. So yes, I think we have seen it. I think we've seen hyper growth phases. Um and uh yeah, nothing lasts forever, but when you when you're in it, it's a lot of fun. Nice. Any advice for whoever is inside Nvidia that you did or didn't do. Be humble. That's it. Just be humble. You know, you Nvidia is a very different story, right? Nvidia is a startup that was uh has been around for 30 years, right? It's it's an overnight success that took 30 years is what they say, right? Yeah. They've completely deserved what they have, but it will be disrupted. I mean we we all talk about Apple, right? Apple wasn't what it what it is today and it will not be what it is today. But you know, um every company has to fight to be the incumbent and be the the one that can drive the the industry. Some more successfully than others, but nothing lasts forever. So your company before baffle was also acquired by Cisco. That's right. So, we actually one of the other things that I've done a lot is um getting involved with acquirers or prospective acquirers very early. So, one of the things that I always tell entrepreneurs is um don't ever rely on somebody else to find you the exit. It's something that you have to do over the course of time. You have to build the relationships. You have to always um be open about sharing what is important. Don't share your your crown jewels, but be open about sharing your value proposition, come across as being humble, as being able to to learn all the time. So, Lightware was actually um a company that I got into um after it was sort of past its first development stage, the first time I had done that. And one of the things that we did very early on when I got there is it was a very capital intensive project, right? Silicon photonics is manipulating the silicon process, which means you have to work very closely with the silicon fab. Make sure that they do things that you want them to do in terms of tuning the process. You can't do that all by yourself. You need a big brother. So we actually literally went out there and shortlisted a bunch of companies that we went and talked to and said, look, we have this amazing technology, but we need somebody to help productize it. And yes, not all the risk is out of it. Um there is still a lot of risk whether this thing will even work. And um we had some history with Cisco, but we actually got a few others interested as well. And eventually Cisco did not just get interested, they actually invested uh $20 million out of a $40 million round in the company and literally started to work with us. Um they said if you can build this, this would change the game. It was a very simple value prop. You needed to pack a terabit worth of throughput in a router blade and it was not possible with existing technologies. So they gave us a form factor, they gave us a spec and said if you can do this, we and it takes this much power and cost this much, that's what will solve the problem for us. Cudos to the team. They did it um within less than two years. And at that point Cisco just couldn't let that technology be out there because it would have been very, very critical for their success and decided to buy. And it was the first time that they had actually bought an Optics company. After that they bought many more, but they never bought the component company. They always wanted the component vendors to compete amongst themselves. But this was so strategic that they had to buy it. Is this something actively used today or Oh absolutely. It's it's a billion dollar business line right now. Um just for this product and then they have expanded beyond that. They bought you know, a few other companies that are all part of the same business unit. And you served as a partner um at an investment fund or I don't know what this is in Carter. Yeah. Yeah, so after that I was done running things, operating roles are always hard and um you know, you want to break from that. So one of the things that I thought of was, hey, maybe take my expertise to figure out how to help others, uh seed them uh at a very early stage and then mold them through that. So, um my CFO, one of my mentors and I started in Carter as a seed stage fund just to invest in companies. We never quite formalized it. Uh we would just go in there and invest in companies. It's like eight different companies we invested in. Six of them have been acquired by now. Um so it was a very interesting experience to be on the other side. Very quickly though, I got bored of of that role because all said and done it's not like running the place. Um it is you're watching, you're letting the entrepreneur run it. Um not something that I um wanted to do at that and again a great idea came along, which is how baffle really started. So that's where I jumped back in. And you mentioned that you've always created new categories, right? Uh how did sort of was baffle a new category at that point of time uh and how did that came about? Yeah, so not at that point of time, but we definitely had had the vision to create a new category. So if you look at data if you look at security in general, back in the day when security products first came along, they were protecting the pipe. The you know, network capabilities had just gone into mainstream and everybody had a data center in their basement and or in their closet. So you had to protect anybody coming in from the outside and attacking your asset because your server and your data is all sitting there and that's where the network wave started. Everybody was worried about the fact that hackers could get in. So that led um in addition to just monitoring, it led to putting boxes there and that led to what we call the device wave because now you had to make sure that you had a firewall there which would protect the data and detect if any hacks are coming in. Today we are in the identity boom. So everybody's talking about protecting their identity because they don't own the infrastructure anymore. The the data center is no longer in your closet, it is in the cloud. So it's only about identity. That's the only perimeter you have. We think this is setting it up very nicely to the next big thing, which is actually protecting the data because identity can only go so far. There's so many ways of actually fishing and figuring out how the credentials are, guessing passwords, which by the way still happens to be the easiest way to get in. So if you protect the data at the record level with encryption, there is no way to actually look at the data unless you have access to the keys. So now you're making the job of the hacker much harder than what it was before. Security has always been about that. It's always been about a race between the hacker and the hacked. So you want to make sure that you're constantly trying to make the the job of stealing your data difficult because at some point it becomes unprofitable. So that's where we feel like data is going to be the next big frontier where if you protect the data at the record level, then you don't really care if there's a hack that happens because whatever is stolen is not important. It's it's cipher text. So that's the category that we're creating. We call it datacentric protection. the industry starting to gravitate towards that, especially with the whole GNI explosion because now, if you want to get good outcomes from your data using GNI technologies, by definition you have to share your data because all of these uh models are constantly evolving. It's impossible for people to set it up inside their own environment again in their closet, right? It has to be in the cloud. It has to be running there, which means you have to move the data there. And that's the fundamental problem that we solve, which is once the data moves to the cloud, you don't want the cloud vendor to see the data. Not because the cloud vendor will steal it, it's somebody pretending to be the cloud vendor that you really worry about. Got. So I mean my question was about that because now everything is in cloud at what abstraction level does, you know baffle come into picture and who's your typical customer? Yeah, so we operate at the application tier. You know, it's a pure application layer solution. There is no dependence on any kind of processor operating system or programming language for that matter. We intercept the packet that goes between the application and the database. So we are a network level proxy. That's the architecture. A typical customer is actually the the one that's responsible for infrastructure in the cloud. But it doesn't start there. It starts with compliance regulations and actually something that uh has evolved during our lifetime. We started the company back in 2015, GDPR came into effect only in 2018. So we timed it so that in in hindsight it looks like timing was great because the compliance regulations came along later. So security is the one that sets the rules. The data analyst or anybody who is responsible for data outcomes including GNI researchers, prompt engineers, they actually want the data to move to the cloud. So they go to the security guys and security guys will say no way we'll let you do this unless you comply and that's when the infrastructure provider, the one that's responsible for the database has to adopt baffle as a solution. So uh I mean there's a lot of uh criticism about GDPR in terms of like you know, it's too much regulation with GDPR and it makes harder for startups to um for whenever there's any big, you know, privacy regulation, I think this is sort of like one of the one side argues that this only benefits big companies and it doesn't benefit small companies. What are your thoughts about that? Well, um if you ask me, regulation is not going far enough actually, right? Because if regulation was great, everybody was compliant, then we would not have hacks. So regulation if anything has to keep getting better. But one thing about regulation is that it should be something that's easy to adopt because we want our um customers to actually differentiate themselves based on their capabilities and based on their security posture. If it's constantly the regulators chasing you, you'll always find ways of getting around it. The good thing about datacentric protection is that if you adopt these policies, it's a proactive measure. It's not reactive. It's proactive. You're protecting your data, you're ensuring that your customers data is not going to be stolen. And that actually enhances their reputation. That makes sure that you are actually able to provide a better posture, which is something that builds trust. Trust is the most important thing in in our business, right? You want to trust the SAS provider that you work with or the infrastructure provider that you work with. And so that's I think where regulation should should really help. Um GDPR is, yes, it is owrous in some aspects because of the individual rights, but again, if the tooling exists to go make that happen, it will be beneficial to the to the companies that adopt it. Obviously GDPR has now been taken to a whole new level with things like CCPA and now CPRA. So it's proliferating. I don't think it's worth fighting it. Um what is important is to embrace it so that it makes you look better to your customers. So when GDPR first came out, I think this was the argument. Like did things improve and did the tooling evolve that like let's say a 5 or 10% small company can also comply with GDPR? Absolutely. One of the big things about GDPR is the right to be forgotten and the bring your own key model. I mean that's something that we have enabled, right? We are enabling bring your own key for any SAS vendor that's out there. It used to be something that was very, very complicated. You had to do it yourself essentially. You had to buy an HSM, you have to know crypto and you have to encrypt your data in a certain way and then manage the keys. We've completely abstracted all of that away from the from the developer because we do it transparently. You just tell us who the tenant is. So there is some data changes needed. You make sure that the tenant ID exists in the column and then you associate a key with it and that's all we need. Everything else is handled by our tool where we make sure that you enable the ability to assign a key to a tenant. If the tenant wants to trash the data, they just take the key away and the data becomes invisible. Talk to me a little bit about, you know, your initial go to market strategy like uh because when solutions are all now placed on cloud, it is sort of like a how did you pitch your early customers to adopt baffle? Yeah, so you again, an entrepreneurial um suggestion always is that you don't want a channel day one. If you have a channel day one, you'll never know what the end customer is actually doing. So you always want to go direct. And the key ingredient is to find early adopter. Find a pain point that only you can solve so that the early adopter really gravitates towards your solution and then champions it. In our case, we found that because we all found a very interesting gap in the industry, which is that postgress databases, which by the way is the fastest going database out there because there's a lot of migrations away from traditional databases like Oracle for example to postgress. Uh huge cost savings and all that. Postgress does not have any native encryption capabilities whatsoever. So what our customer, first customer was trying to do is to do a do it yourself strategy. They would go and they try to build them, build it themselves and fail miserably. Um there were some open source uh submissions out there that they tried to use PG crypto is one of them. Just completely slowed things down. The application did not work. So we found that particular use case to be very, very important to demonstrate how this would work and that led to many other customers using it in a similar way. The SAS use case was very similar as well. They were trying to do it yourself and they came across us. They actually all of these by the way found us. We did not go find them. That's a good sign. So digital marketing strategies SEO SEM is absolutely critical for any business of any size these days, fortunately or unfortunately because nobody likes to be called. You and I don't like to be called with a pitch, right? You're automatically you're starting out with a negative balance at that point like, why is this person calling me. But when you need something, the first thing you do is go search. Whether you do use GNI for that or use just traditional search, but you go search because we are used to finding things ourselves. So that's where you have to advertise, you have to write lots and lots of content and yeah, unfortunately you to spend money to get there. Uh to be able to be known and be able to get that recognition. But again, there's well established strategies to go do that in terms of success stories and evangelizers and all of that. So that's what we did, you know, we started out with a direct strategy, we continue to actually have a lot of our stuff going direct. But then to scale, once we have the beach heads, we have gravitated towards a strategy where we use the cloud vendor themselves to be our channel. If you think about it, um it's counter intuitive, right? Because in some ways the cloud vendor always says, I'm very secure, you know, you're much more secure than your on Prem, which is true. They also have the shared responsibility model where they say, you know, if you lose your data, it's your problem. I'm giving you the tools. I'm not going to protect you there. You you are on your own. So what we always pitch to them is, hey, you know, we're going to help you implement that shared responsibility model so that the customer takes control of their data with these tools. And that's exactly why it it works where because of our tool actually the cloud vendor has a tremendous upside because they can migrate their customers to the cloud and make 10x 100x of what they would actually pay for us. So, that's the evolution of the strategy. Direct first, channels later. And then you know, there's more stuff that will come as we go, um especially as we get into system integration and things like that. You know, security is such a cat and mouse game and it keeps evolving and you know, keep hearing a brand new security startup every uh you know, two years becoming a unicorn, you know. Uh what are the trends that are happening in security as an industry right now? Well, I think the most important trend is this evolution, right? Which is that what security has always been one of a checkbox, right? They you you sign up um a security vendor and they come in and look at your stuff and say, yep, you're good, you know, this is the the checklist, this is a dashboard that shows you exactly what's going on. If you're going to get hacked, we're going to warn you. And I think that's getting more and more difficult. As you can see actually it's something that's already started to happening. Things like sim logs are completely being reimagined, right? Especially with GNI. Um there's a massive migration away from traditional sim logs to AI based sim logs or automated monitoring and alerting. So I think um the space is evolving from that perspective. The monitoring itself is evolving. But what we believe very strongly is monitoring is great to identify problems, what about remediation? Discovery is a very big space as well. You discover data, you classify it. Well all of that is great, but just because you classify it doesn't make the problem go away. If anything it highlights the fact that you have an asset that needs to be protected. So remediation is the big trend. How do you remediate data so that it becomes invisible? Encryption is one technique, masking, tokenization, you know, are other techniques that can be used depending on how the data is going to be used downstream. If you don't need to recover the data, you should just mask it. If you need to see the same format, you need to do format preserving encryption. So that's really what we focus on a lot, which is we allow field based control and granularity to figure out how to transform the data so that it is safe in environments that you don't control. I mean you brought up GNI, so I want to just just get a sense of, you know, how you're thinking about GNI both as an entrepreneur and someone who has seen multiple cycles of you know, technology channels. Um are you actively using GNI in your product uh or you know in your business or you're thinking about using it to create new products or features inside your uh product? Like both as a leveraging it aspect or as well as integrating aspect. Like how are you seeing and would love to know your vantage point because you've seen so many cycles. Absolutely. So well, from a cycle perspective, I think we are in a multi-year cycle here. This is going to be a massive productivity improvement, no question about it and we are seeing it. We are seeing it in multiple places. You obviously start with the with the development aspect, right? So our engineers use co-pilots all the time now and it's uh remediating a lot of things that they other than just figuring out how to do something, which doesn't happen as often, but what does happen very often is CVs, right? Making sure that you're not using something that is compromised and something that needs to be updated. So it's very intrenching to our development process. We use it in our customer success environments as well because we have a lot of history now that has built up over the years. So if there's a problem, somebody's having a container problem where they cannot open up a certain port, you know, it is available for them to go search on. That that's one of the things that we demonstrate because the use case is very simple. When an engineer first comes on board and wants to learn about the product and wants to troubleshoot a problem, they don't need to know who the actual customer is, but they can actually benefit from the data. So what we do is we tokenize the customer name, put it in the repository and then run GNI models on it. Very straightforward use case, but it does achieve exactly what we set out to do, which is better outcomes rather than our static you know, listing of our of our tickets. So they can go in there and look at it. From a product perspective, we think uh it's going to completely transform data discovery. Data discovery has never been uh a problem that has been um fully solved, lots of false positives, false negatives, all kinds of things happening because data it's hidden in weird places. You know, the NER capabilities that are coming out now, again, early, but they have a lot of promise. So yeah, we expect to completely integrate it across all our functions. Obviously our sales guys use it all the time as well because whenever they want to write an email, they go chat GPT and and and write and write better uh product blogs and lots of different things that that we use. So we go to market is another big area where general is going to have a huge impact. Um If you're, I mean you're you're a repeat entrepreneur, if you are advising or thinking about starting a new company right now, um where are the places you would go and look for or do you have ideas around uh what would be, you know, a great opportunity to go after? I have lots of ideas, but you know, um implementation is where the the the devil is and more importantly commercial fit and and the ability to sell is uh or adopt get it adopted is very, very important. Um I strongly feel that we are uh in a phase where ease of use, ease of adoption is critical. It doesn't matter what it is, but make sure that you think of ease of use ease of adoption sooner than later. I think there are a lot of very interesting problems that GNI is uh is putting up and everybody's been talking about it, but I think one of the biggest ones is GNI lies and lies with authority. So you want to figure out ways by which you can detect that. Um that's a massive, massive opportunity if if if you can solve that. Um and I think in general, um data is going to be more and more important going forward. So anything in the data realm and the ability to actually get the right data set in the hands the right people is always going to be a very lucrative area to go after. Are you uh are your customers doing data deals? Have you seen any trend of uh that happening? Yeah they In fact, one of the things that we say is that, you know, data sharing was always something that enterprises did because it had benefit, but it was very selective. They didn't want to share it as often. They would bring their customers into an internet before they share it and all that. GNI is completely changing that. You have to share your data, you have to sell your data, data you know, data deals, data agreements are becoming more and more common. But it is very hard to do it in a way where you don't compromise your customers trust. And that's where this datacentric security models and privacy enhanced computation are going to be critical to make that happen. There is still a tremendous problem in terms of making it easy to use. Um and I think that's where I see a lot of innovation coming where you're able to share data but share it securely. So this is your fourth company. Um is there a sort of checklist or a mental model that you follow when you jump into a new idea to evaluate it or like to say okay, this is a big enough opportunity for me to pursue? I wish I wish. Uh no, there is no such thing. It all four happened for very different reasons. Um I think I think the most important thing is you have to get excited about an idea. Um and the second most important, but sometimes it becomes more even more important than the first one, which is that you find the right team to work with. You know, it's it's like a movie, right? You first have to get excited about the plot, about the story, but you need the right team to put together around it, you know, the right team of actors. And you know, the Ocean's 11 model is what a lot of people think of and it's it's somewhat relevant because you want to find people who are subject matter experts in their areas. Um when you find somebody who's trying to settle to many different areas, that's a warning sign. Don't don't get that person. You want everybody to believe in themselves and others. That's the best way to build a team. So yeah, that's that's the formula. You you want to make sure that you get excited about the idea, you find the right team. And then of course, there's a whole slew of commercial things that you have to go through, which is find the right market, make sure that it is really uh a very important solution and not just a nice to have. So a lot of other things are going but those two are the most important to start with. Uh so we're almost at the end of our conversation. I ask some common questions, some quick questions to all my guests. Uh so first question, uh what is your consumption like? What what do you consume? Uh where do you consume your information? What are the books or podcasts or whatever that you like consuming? Yeah, well, um fortunately or unfortunately, LinkedIn is a big source of my information just because I have to keep track of it anyways, but you know, it's definitely one place that I always visit to make sure I know what's going on. There's some good influences out there that I that I track. Um other than that, I think the I definitely like uh reading, you know, business books, um but not not necessarily all of it. I try to get the gist of it very quickly. You know, uh through something like a blinkest or whatever. But um um yeah, I like to read about entrepreneurs. I like to read about innovators. So a big fan of Walter Isaacson. He writes really, really well when it comes to capturing a person's history and. What who are the entrepreneurs you most admire? Um so let me start with actually the the founding fathers of this country, right? Um I think they were the ultimate entrepreneurs because when they invented what they wanted to do in this country, they completely rewrote the model from scratch. Something that you realize when you go to other Commonwealth countries and see how even today there's such a big shadow of the imperial regime that they still maintain. America is different. And that's actually what gives me the most confidence in in America's future because we do things differently. Yes, we will have twists and turns, but overall, I think the way they wrote the Constitution, the way they actually put us in in this independent thinking mode is really, really innovative. Um nearer term, of course Steve Jobs I think uh was an amazing entrepreneur, so is Elon Musk. Um yeah, so I think the usual, right? I don't have a lot of other interesting uh entrepreneurs to point to. Oh, who who are your mentors who helped your career? I've had a lot of them. Um I obviously starts with with my family, right? Um you know, you have to have a very supportive spouse who's uh who's always there to to always not just support you but also to give you the right level of feedback and critique. Um obviously my my father was a big uh influence in my life as well. Um and it's and then I've had a lot of other mentors in in in Silicon Valley when I was first starting out, um I could very easily go to many other people who had started companies before and they helped me along the way and continue to help me today. Um what do you know about starting a company or being a founder that you wish you know when you were first starting uh or starting your first company? This is a tough one because um as an engineer, uh founder, entrepreneur, you always tend to fall back on the fact that the technology will sell itself. Um that is seldom the case. So that's something that it's a lesson to always learn um and more importantly adapt. You asked early on about lessons about checklist, right? There is no such thing. You have