Episode 95 of The Security Podcast of Silicon Valley aired on May 19, 2026, with Jon McLachlan hosting. The guests were Pranava Adduri, co-founder and chief technology officer of Bedrock Data, and George Gerchow, its chief security officer. Bedrock Data, which started out as Bedrock Security, describes itself as data-centric security, governance and data management (Bedrock Data): it finds and classifies what data a company has, and with its ArgusAI product, which data its AI models and agents reach. George set the stakes in his first answer.
“you go through a security incident, what’s the first thing that pops into mind is, like, did any sensitive data ever get out?”
George Gerchow, at 3:25
The conversation was recorded in early 2026. The tape places it: Pranava says Argus “was actually something that we launched right before re:Invent,” and George’s best day was the day before, when Bedrock “opened up a new HQ here in San Mateo.” Bedrock announced ArgusAI on November 17, 2025 (Bedrock Data). Its press releases carried a Menlo Park dateline through December 30, 2025 (Bedrock Data), and the next one, on March 19, 2026, is datelined San Mateo (Bedrock Data). The last section below covers what Bedrock has done since.
This page is the rest of it: a section for each part of the conversation with the sources beside it, fourteen figures, sixteen clips from the tape, a LinkedIn card, the full transcript, and four tools: a quiz, a scorecard for whether your team can say yes to an AI request, a calculator for what gets through your guardrails, and a timeline from Box to ArgusAI.
A note on the numbers before the sections. The hundred petabytes was a customer’s question at AWS, not a measurement, and George’s 100, 200, 500,000 people was a thought experiment about how data piles up. The percentages that are Bedrock’s come from its own survey, and they’re labeled that way where they appear.
A hundred petabytes and nothing to pick with
Jon asked what Bedrock Data does, and Pranava answered with where the idea started.
“But I was actually thinking about Bedrock when I was formerly an Amazonian. I was sitting at AWS. AWS sees some of the largest customer environments in terms of data volumes.”
Pranava Adduri, at 2:00
Amazon Web Services is the Amazon subsidiary that sells on-demand cloud computing platforms and APIs on a metered, pay-as-you-go basis (Wikipedia). Pranava’s LinkedIn has him there from March 2019 to July 2020 as a software development manager for data protection services, in Seattle (LinkedIn). The customers he described were worried about ransomware, the kind of malware that holds a victim’s data hostage until a ransom is paid (Wikipedia), and the standard advice was to back up the data that matters.
“But then the natural follow-up question is, if I have a hundred petabytes of data, what data do I back up? I can’t back up everything. So there has to be a risk-based approach to doing this.”
Pranava Adduri, at 2:29
Picking requires knowing what each piece of data is, and that’s where the tools ran out.
“Except none of the technologies that were available at the time could handle those volumes of data in any reasonable cost, or even had the ability to scale to those sizes.”
Pranava Adduri, at 2:37
He left AWS in July 2020 to be an entrepreneur in residence at Greylock, one of the oldest venture capital firms, founded in 1965 (Wikipedia), and his LinkedIn dates Bedrock from January 2022. Bedrock’s own account says the need came out of conversations with dozens of CISOs and data teams, and that the founders and the Greylock team worked closely together from there (Bedrock Data). Pranava put the goal in one sentence.
“So how do we enable that? That’s what we started Bedrock with the idea of doing.”
Pranava Adduri, at 3:06
From Rubrik’s ransomware team to data security
Jon brought up the startup before AWS.
“You’re one of the founding engineers at Rubrik, another security company, right?”
Jon McLachlan, at 6:29
Rubrik is a cloud data management and data security company in Palo Alto, founded in January 2014, and listed on the New York Stock Exchange since its April 2024 public offering (Wikipedia). Pranava joined in April 2015 as a founding engineer and later managed engineering there until March 2019, by his LinkedIn. He described the company’s turn in the same terms as his own.
“And so Rubrik started as a data protection journey. But when ransomware really started becoming a boardroom priority, telling that story, making sure that people were resilient against it, that’s what took Rubrik in the direction of security as well.”
Pranava Adduri, at 6:50
“I was actually part of the team that shipped the first version of ransomware discovery and response. That was kind of the foray from data protection into data security for me.”
Pranava Adduri, at 7:01
Before Rubrik he spent three years at Box, the Redwood City company that sells cloud content management and file sharing to businesses (Wikipedia), as a backend engineer from May 2012 to April 2015. His LinkedIn lists a metadata service and a patented geofence encryption feature from that time, and internships at Salesforce in 2011 and VMware from 2008 to 2011. Since January 2019 he has also been a programming director at Advancing Women in Product. Startups were the habit from the start.
“I would say I’d mostly been at startups right after graduating.”
Pranava Adduri, at 6:12
“And it was very formative in terms of culture, in terms of working with a talented pool of engineers, and really learning what you could do if you sprinted with a group of smart people.”
Pranava Adduri, at 6:41
Ransomware as a business
Jon’s reaction to the Rubrik story was about the attackers’ side of the market.
“It’s interesting the sorts of things that attackers will come up with in ransomware, kind of falls into that bucket of just, like, really nasty, like, trying to make a business out of the malware”
Jon McLachlan, at 7:13
George took it a step further.
“Yeah. They’re starting to talk, too, more and more.”
George Gerchow, at 7:33
“And there’s so many different threat actor groups that are getting together and doing that.”
George Gerchow, at 7:38
Ransomware as a service is that business model with a name: developers write and sell the malware to other criminals, often called affiliates, who launch the attacks and don’t need technical skill of their own (Wikipedia). For a defender, the effect is the one Pranava’s AWS customers felt: more attackers with the same tools, and a backup plan that only works if you know what to back up.
We forgot about the data
George’s first answer explained why he joined a company this young.
“No, I think it’s a great description. You know, data security in general and just understanding data has been a problem for a long time, Jon.”
George Gerchow, at 3:13
“Great people like Pranava, Ganesh, and Bruno. So I’m super happy to be here this early on.”
George Gerchow, at 3:41
Those are the three co-founders: Bruno Kurtic, president and CEO, Pranava as CTO, and Ganesha Shanmuganathan, chief architect (Bedrock Data). Bedrock announced George as its chief security officer on April 22, 2025. The release lists nine years as chief security officer and senior vice president of IT at Sumo Logic, through its IPO and its FedRAMP work, a stint as interim CISO at MongoDB, the Center for Policy & Compliance he founded at VMware, and more than fourteen years on the IANS Research faculty (Bedrock Data). Sumo Logic is a cloud-based data analytics company focused on security analytics and observability (Wikipedia), and MongoDB, Inc. makes the MongoDB database for unstructured data (Wikipedia). He said both companies made the same mistake.
“we just always kind of, like, forgot about the data. Those are two very data-driven companies and data-driven customers.”
George Gerchow, at 7:53
“But we always, like, sort of protect the endpoint or try to manage everything through identity. And why not just go after the data itself? Who’s interacting with the data? How’s the data being used? When was the last time that it was touched?”
George Gerchow, at 7:59
Endpoint security protects a network where laptops, phones and other devices connect to it (Wikipedia), and identity and access management makes sure the right users have the right access (Wikipedia). Both are about the routes to data. George’s questions are about the data, and his problem was scale, along with a line between his job and someone else’s.
“I think the scale part was always where I struggled. You know, it was like, I wasn’t necessarily the owner of the data. It was always someone like a Pranava, a CTO type that owned it, but I was responsible for the stewardship or protection of that data. But the scale was just out of control.”
George Gerchow, at 8:14
The cost of not knowing shows up at the end of an incident.
“And then closing the incident, Jon, and going, oh my goodness, like, did I close it?”
George Gerchow, at 8:36
“And now all of a sudden someone’s going to put it, you know, like, on social media that they actually exported the data out of the environment. I just didn’t know.”
George Gerchow, at 8:41
The new gold
Jon had started from the threat model, which in his telling is always about the data.
“Like, all of those layers of security are to protect the most sensitive assets, the most sensitive data. And that’s really the core of threat modeling, of, like, what are we protecting? It’s not the compute so much, right?”
Jon McLachlan, at 3:55
Then he turned to the direction of travel.
“I see it, you know, 10x-ing, 100x-ing, especially now that it’s kind of the new gold.”
Jon McLachlan, at 8:57
“And at its very core, it’s data. And so as the value of data is going up, I imagine that the value associated with securing that data is also just skyrocketing.”
Jon McLachlan, at 9:24
Bedrock’s own numbers point the same way. Its 2025 Enterprise Data Security Confidence Index, announced on December 30, 2025, found that 82% of the organizations it surveyed have trouble finding and classifying their data, and that 60% of security teams have taken on AI governance (Bedrock Data). Those are Bedrock’s survey figures, and the report has the method.
You can’t have AI without data
Jon asked whether Bedrock felt the value of securing data going up. Pranava said yes, and split his answer in two: how companies should look at data, and how security and engineering get along.
“But fundamentally, to your point, you can’t have AI without data. That’s kind of, like, the foundational mantra.”
Pranava Adduri, at 9:58
“But in order to be competitive with AI, to be competitive as a company and innovate at the rate of your peers, you need to first have an understanding of what data you can use to enable that.”
Pranava Adduri, at 10:04
He listed three ways companies use their data for AI, from the lightest to the heaviest.
“We see people trying to be competitive at the copilot level, where they want to connect a copilot to all their SaaS repositories and now operationalize that knowledge.”
Pranava Adduri, at 10:19
“We see people trying to build in-house agents that are taking some of the data and their infrastructure and all the historical data that they have to create better client experiences on the product side as well. And then for the hardcore teams, they’re training their own models as well.”
Pranava Adduri, at 10:28
A copilot connected to company documents usually works by retrieval-augmented generation, where a large language model looks things up in a set of documents before it answers (Wikipedia). Microsoft Copilot, the chatbot Microsoft launched in February 2023, is one example (Wikipedia). Each step down Pranava’s list gives the AI more of the company’s data, and more ways for it to come back out.
The office of no does not work
The second half of Pranava’s answer was about what security does with all that pressure.
“The pressure to consume these tools and capabilities to be competitive is so high from a business perspective. If you don’t have a sanctioned path, they will come up with a shadow path to do it, right?”
Pranava Adduri, at 10:56
“They will spin up a personal tenant of GPT and connect it to whatever upstream SaaS they need to get their job done.”
Pranava Adduri, at 11:07
Shadow IT is the old name for this: systems a department deploys to get around the central IT team’s limits, which can help people get work done and also adds security and compliance risk (Wikipedia). With AI, the system is a chat window and the data is whatever someone pastes in. Pranava’s conclusion was about the goal, not the tool.
“So the name of the game here is not how do you block, it’s how do you enable, and how do you give people the right guardrails to run faster, right?”
Pranava Adduri, at 11:14
“How do I enable the business, not how do I say no?”
Pranava Adduri, at 11:23
We wrote up the leadership side of this in Stop saying no and the shadow path itself in shadow AI governance. The scorecard below asks the questions that decide which way a request goes.
Use what you know about the data
Pranava’s next point turned data security into a source of ideas, not just a list of risks.
“In fact, use the fact that we know the data to actually enable finding data to build new initiatives. If you’re trying to build a new model and you didn’t know you had customer data in this form factor in a certain environment, well, your models are not going to be as effective, right?”
Pranava Adduri, at 11:34
The same knowledge is what lets someone stop a project before it’s a problem.
“hey, you’re building fast, but this particular model might be in trouble because of the data it’s exposing, right?”
Pranava Adduri, at 11:57
“So kind of this idea of how do you actually enable the business, actually build more, but also give the scaffolding and guardrails to allow them to catch themselves in the one or two off chances that something risky is about to happen.”
Pranava Adduri, at 12:02
Data governance is the set of policies, standards and practices that decide how data is created, managed and reused (Wikipedia). Pranava’s version runs both ways: the same inventory that tells you a model is exposing customer data tells you where the data for the next model is.
Stay out of my stuff
Pranava handed the second half of the question to George, who answered with the history of the job.
“Yeah, no, absolutely. I think you said something that was very key about not being the office of no.”
George Gerchow, at 12:15
In George’s telling, through his years at VMware and companies like it, the chief information security officer, the executive responsible for the strategy and program that protect a company’s information (Wikipedia), reported into corporate infrastructure and had a lot of friction with engineering. VMware is the Palo Alto virtualization and cloud company Broadcom bought on November 22, 2023 (Wikipedia). Then the cloud came.
“And then when cloud started coming out, engineers really started doing most of the security. You know, they were like, stay out of my stuff. And then CISOs were like, no, no, no, slow down, cloud, like, slow all these things down.”
George Gerchow, at 12:35
AI, he said, changed the arrangement again.
“because of the amount of data and because engineers are trying to move fast, I’m seeing a shift to where CISOs, progressive CISOs, are now starting to report to the CTO.”
George Gerchow, at 12:53
“And what that does is it gives the CTO now the responsibility of, hey, I got to move fast, but I also have to be secure.”
George Gerchow, at 13:03
“And personally, like, Jon, I welcome it. You know, like, I want the business to move forward. I want the right guardrails to be in place. But we have to, as security people, get out of this traditional bucket that we’ve been in and start thinking like engineers.”
George Gerchow, at 13:21
Jon took the thought one step further.
“Thinking, like, almost like product people, of how do we use security to enable the business to just, like, supercharge it into the future of AI.”
Jon McLachlan, at 13:32
The reporting line George described isn’t universal, and he didn’t claim it was: it’s what he’s seeing among the CISOs he calls progressive. The companion post Stop saying no puts survey numbers beside it.
I’m kind of his customer
George’s own arrangement at Bedrock is an example of what he described.
“Yeah, exactly. I mean, that’s so well said, you know. And, you know, like, coming from MongoDB, that was kind of the structure there. And then now, like, working with someone like Pranava is like, I’m kind of his customer in a lot of ways, you know.”
George Gerchow, at 13:40
“I was about to say, you’re the customer of Bedrock, right?”
Jon McLachlan, at 13:51
Jon asked whether that made George “the product strategist, not just the CISO,” and George said it did.
“In a lot of ways, yes. In a lot of ways, my needs affect what we’re building, and what I’m seeing with customers”
George Gerchow, at 14:02
His LinkedIn describes the internal side of the job: he runs Bedrock’s program on AI agents, chairs its AI governance committee as the company works toward ISO 42001, and runs its trust center (LinkedIn). At MongoDB, where he was interim CISO and head of trust from January 2024 to April 2025, he set up the company’s first trust advisory board, by the same account. A security leader who is also the first customer gets to shape the product before it ships, which is the same argument Jon made about security and product people.
Who really owns the data
Jon asked what it feels like to get to full visibility of a company’s data as a CISO. George’s answer started with ownership.
“It feels so good in the way that now it’s not just about the security of that data, but I feel like I can also enable innovation by the business. Because who really owns the data? It is not the CISO that owns the data. It is the business that owns the data.”
George Gerchow, at 14:27
“And the business needs that data to be able to make predictive decisions and drive innovation for customers to be able to leverage products better.”
George Gerchow, at 14:44
He stopped short of calling it peace of mind.
“I wouldn’t say peace of mind, because we’re paranoid people, you know, just by the nature of what we do. Got my tinfoil hat, you know. Have it right over here.”
George Gerchow, at 14:56
“Put it on. I’ll put it on sometimes.”
Jon McLachlan, at 15:05
“Yeah. Exactly. But it gives you this level of confidence and risk reduction, which we’ve never had before. Like I said before, we’ve always tried endpoint, identity, perimeter, and all these things.”
George Gerchow, at 15:06
Then he gave Jon’s opening point back to him.
“it’s about the data. So why not look at it from a data-first perspective?”
George Gerchow, at 15:21
The split George drew, an owner in the business and a steward in security, is the one his earlier story turned on: at Sumo Logic and MongoDB someone like a CTO owned the data, and he was responsible for protecting it. Ownership decides what the data may be used for. Stewardship makes sure the answer is known and enforced.
How many pictures are on your phone
George’s way of explaining the scale problem to people outside security starts with their own phones.
“And I love having these conversations with laymen, like people who aren’t in our industry. And I’m always like, how much email do you have? Like, how much email do you accumulate? How many pictures do you have on your phone?”
George Gerchow, at 15:30
“And so I’m like, you never go back and delete anything. So I explained it to them that way. And I’m like, now stop and think about an enterprise. And now all of a sudden you have 100, 200, 500,000 people, and how much data just stacks up there.”
George Gerchow, at 15:46
Then he listed what visibility has to include.
“When you have visibility of that data, know the lineage, the entitlements of that data, how it works, what’s sensitive, what’s not”
George Gerchow, at 15:58
Each word in that list has a plain meaning. Data classification sorts data into categories by attributes like its type, content or metadata, and labels them (Wikipedia), which is how you know what’s sensitive and what’s not. Lineage tracks how data is created, transformed and moved across systems over time (Wikipedia). Entitlements are who and what may reach it, and the principle of least privilege says each part of a system should reach only what it needs for its job (Wikipedia).
Good brakes help you go faster
Pranava picked up where George stopped, with what visibility makes possible.
“I like to think about this adage of, like, good brakes help you go faster.”
Pranava Adduri, at 16:13
Brakes are what let a driver go into a corner at speed, and the conversations he has with companies, he said, start from the opposite position.
“A lot of the conversations that we have now, they take on a similar tune to, we are rolling out AI. As we roll out this AI, we want to use it to be competitive, but we don’t know what data is going in, right? And as a result, we can’t control necessarily what’s coming out.”
Pranava Adduri, at 16:16
“And so usually the conversation then evolves to, can you please help me understand what AI I have at play? Like, what have I deployed?”
Pranava Adduri, at 16:31
“And then, can you help me understand what data I’m sending to it, right? So then I can begin to understand what’s okay, right? As we’re sprinting, which projects are okay and which projects are putting me at risk.”
Pranava Adduri, at 16:39
What a CTO gets from that, in his account, is a sorted list.
“here are the ones that are doing well. Here are the ones that we need attention to in terms of reshaping, in terms of reworking some of the data.”
Pranava Adduri, at 17:01
Where did the data come from?
Jon brought the same question in from the compliance side. He hears it on sales calls.
“I’ve been on many potential new customer calls where I’m discussing with another potential customer’s security team, like, okay, so here’s an AI product. You’ve done some training. Where did the data come from? Do we know what type of data is in there?”
Jon McLachlan, at 17:26
“And if you look at, you know, to go back to the GRC a little bit, there’s new standards out there, like the ISO 42001. This is the new AI safety, safe, ethical, and secure AI.”
Jon McLachlan, at 17:44
ISO/IEC 42001:2023 sets out requirements for an AI management system, and ISO calls it “the world’s first AI management system standard” (ISO). GRC is governance, risk and compliance, the program side of security. Jon’s point was that an auditor’s question and an engineer’s question have become the same question.
“but where is the data coming from? And what type of data is going into that training? Data provenance, right?”
Jon McLachlan, at 18:12
Data provenance, or lineage, is the record of where data came from and what happened to it on the way (Wikipedia). YSecurity runs ISO 42001 programs, and the training data question is one of the first a certification body asks.
From cradle to grave
George’s version of provenance covers what happens after data is created.
“Yeah, you’re speaking our language, you know. It’s copies of data. When it comes to data provenance, you know, like, from cradle to grave, when data is created, but how does it move? And what are the copies? And does it still have the same entitlements to it?”
George Gerchow, at 18:29
Then he gave the example that makes it personal.
“manages 50 people and all of a sudden starts putting all of the reviews or comments inside of ChatGPT and then says, okay, spit something out that helps me give a yearly review on this person? You laugh, but is it happening out there? And do we know that?”
George Gerchow, at 18:55
“I’m sure it is.”
Pranava Adduri, at 19:10
“Yeah, and that’s a little bit scary, because that’s going to end up in the training set”
Jon McLachlan, at 19:11
Jon then imagined the same check at the other end, inside an AI company deciding what to train on.
“maybe for the purposes of building a better future, building a more private LLM that’s just as good, maybe we don’t want to have that in our training set, right?”
Jon McLachlan, at 19:32
Information privacy covers how data about people is collected and shared, and the expectations and law around it (Wikipedia). A performance review is personal data twice over, about the employee and from the manager. George’s question wasn’t whether it happens. It was whether anyone would know.
A data bill of materials
George handed the question to Pranava.
“Yeah, Pranava, actually, that’s kind of, like, where Argus fits in in a lot of ways, too, you know, if you want to describe that a little bit.”
George Gerchow, at 19:43
Pranava started from software.
“I liken this to SBOM and software, right? You have your binary that you’re vending. There’s the software dependencies of those binaries, and then there’s the downstream dependencies of those binaries as well, and libraries as well.”
Pranava Adduri, at 20:07
“And so in that same way, models have a DBOM, a data bill of materials. What data made its way into the training phase? Where did that data come from?”
Pranava Adduri, at 20:17
A software supply chain is the components, libraries, tools and processes used to build and publish a piece of software, named by analogy with the supply chains of physical goods (Wikipedia), and a software bill of materials lists them. Pranava had written the data version down in July 2024: “A DBOM is a comprehensive inventory of” all data going into a model in training and fine-tuning, and all data a model can reach at inference, such as retrieval and copilots (Bedrock Data). On the show he added the controls a DBOM should show.
“Then, in most organizations, they have controls or requirements that say that data has to be anonymized before it can get to the training phase. But if it doesn’t, that’s a potential source of the model getting tainted.”
Pranava Adduri, at 20:34
“For example, in certain domains where the company might be procuring data from data vendors, there might be terms around what granularity of data can be used when training a model, right?”
Pranava Adduri, at 20:51
Data anonymization removes personally identifiable information from a data set so the people in it stay anonymous (Wikipedia). The vendor terms are the part people forget: purchased data comes with a contract, and the contract follows the data into the model. Pranava’s last step was the inventory itself.
“So how do you start with the inventory of your AI workloads, whether it’s agents, copilots, et cetera? How do you look at the data supply chain that’s going into it? And that snapshot is what we call the DBOM.”
Pranava Adduri, at 21:07
“A DBOM. I love it. I love it.”
Jon McLachlan, at 21:17
The companion post AI data bill of materials has the field list and how to start one, and Bedrock’s DBOM page has the vendor’s version.
Argus and the gap
Then Pranava described the product George had mentioned.
“And to what George was talking about, Argus was actually something that we launched right before re:Invent.”
Pranava Adduri, at 21:20
“And the idea is, when you look at a model, on the left side, compute the DBOM, what all went into it. And on the right side, look at the guardrails to figure out what the guardrails enable, what do they block, and what do they allow? And that gives you a gap analysis.”
Pranava Adduri, at 21:25
“Based on what’s going into the model, or the agent or the copilot, you have this potential of what might be coming out.”
Pranava Adduri, at 21:38
“And it’s a way of coming back to what I was originally talking about, which is responsibly enabling innovation. How do you let people run fast while monitoring the gap analysis and seeing where you might be getting in trouble?”
Pranava Adduri, at 21:49
Bedrock’s launch release, on November 17, 2025, describes the same two halves: ArgusAI shows what data a company’s AI models and agents reach in training and inference, and checks whether the guardrails in place stop sensitive data from leaking. The release puts the problem in one line: “the constraint has shifted from deploying AI to governing it” (Bedrock Data). The same day, Bedrock announced a $25 million Series A led by Greylock (Bedrock Data). The calculator below runs the gap analysis on example numbers.
Innovation has to change the world
Jon stepped back from the product to the larger point.
“That’s beautiful. I love solutions to ginormous, extremely difficult problems that you could just drop into place.”
Jon McLachlan, at 21:59
“It’s like, innovation, I think, in order for it to really be innovation, it has to have the potential to change the world. If it doesn’t have the potential to change the world, I’m hesitant to put it in the category of innovation.”
Jon McLachlan, at 22:40
“we have to think about what it means for the technology not just to work and to be magical, but to be adopted. And I think that adoption piece is where security and data provenance and the controls and thinking about social impacts, maybe even, of what’s going on really comes into play here.”
Jon McLachlan, at 23:00
“So it’s a massive enabler to help everyone move fast.”
Jon McLachlan, at 23:18
“We love that. Enabling. We love it.”
George Gerchow, at 23:26
“This is a community thing. And so building an entire company to just nail it just seems spot on. Right place, right time. Congratulations.”
Jon McLachlan, at 23:34
A new home in San Mateo
Jon asked both guests for their best day so far. George went first.
“I’ll go first, because Pranava’s will probably be more profound. Mine was yesterday.”
George Gerchow, at 23:50
“Yeah. Well, yesterday we opened up a new HQ here in San Mateo. And the feeling I got, Jon, when I walked in, I was just overwhelmed with emotion and happiness, gratitude, which you’ve said a few times, to be part of this”
George Gerchow, at 23:57
The details were the ordinary ones of a startup moving in.
“there was, like, furniture mismatched all over the place, a ping pong table in the back that didn’t really have a net set up, but we were all excited putting it all together. Pranava dorking out inside of server rooms, closets, with the wiring and everything else.”
George Gerchow, at 24:21
“Like, we did great stuff at re:Invent. We’ve released great products. And when I first met the team, it was fantastic. But yesterday was just my best day.”
George Gerchow, at 24:43
Pranava agreed it was up there.
“Walking the office for the first time yesterday and just kind of seeing, like, you know, this is our first proper home, right?”
Pranava Adduri, at 24:56
Bedrock’s press releases moved with them: the December 2025 releases are datelined Menlo Park, and the March 19, 2026 release about ArgusAI is datelined San Mateo, as is the April 22, 2026 release that followed it.
Four days in March 2023
Pranava’s other best day was the end of his worst weekend.
“I think an equally high-emotion moment for me, funny enough, was there was a scare we had a couple of years ago when SVB went under. And I remember the entire weekend thinking, what am I going to do? Like, I have to make payroll.”
Pranava Adduri, at 25:04
Silicon Valley Bank failed on March 10, 2023 after a bank run, the third-largest bank failure in United States history and the largest since the 2008 financial crisis (Wikipedia). Bedrock had its money there.
“And when we found out that we would be getting our funds back, that was kind of like a new lease on life.”
Pranava Adduri, at 25:21
“Yeah, I imagine that would have been just absolutely terrifying as a founder, to have a major operational piece like your bank just go belly up and then end up in the news for all the wrong reasons.”
Jon McLachlan, at 25:47
The planning he did in those days outlasted the scare.
“In hindsight, it was such an interesting four days, because I remember I got on the phone with my co-founder, and we basically just said, what if we only get this much back? What if we only get this much back? And we had, like, four levels of what do we do if we only get this much money back.”
Pranava Adduri, at 25:58
“And it turns out that plan was the plan we should be executing all along anyway, because it was a much more focused plan. It forced us to really cut out a lot of projects that weren’t in the critical path, right?”
Pranava Adduri, at 26:24
“Well, good job turning something from a scare into a win”
Jon McLachlan, at 26:35
CISOs who don’t want to see it
Then Jon asked for the hardest day.
“What about the most difficult day along your journey so far?”
Jon McLachlan, at 26:51
George went first again, and his answer was about his own profession.
“I would probably say the most difficult day was early on, trying to talk to traditional CISOs about what we do.”
George Gerchow, at 27:00
“And the reason why is because I find that sometimes in the CISO world, you show them a problem and they’re like, I don’t want to see that problem. No one’s asking me about that problem.”
George Gerchow, at 27:10
“And especially, like, in AWS environments, when we find, like, sensitive data in lower environments. My expectation was that they would be like, I’m solving this problem. I’m so glad I know now. I’m going to go get it.”
George Gerchow, at 27:31
Lower environments are the development, test and staging copies of a system, where production data tends to end up without production’s controls. George’s worry was about why someone would rather not know.
“And Jon, that, like, is disturbing in some ways, because when I came up in this industry as a security person, it was a strong ethical thing that we had, you know, like, a very strong ethical component to being a CISO.”
George Gerchow, at 27:57
He tied it to the legal pressure CISOs have been under, court cases included, and asked the question directly.
“is it getting to a point now to where the CISO is trying to reduce their own risk as much as the company’s risk, if not more?”
George Gerchow, at 28:23
Jon answered with values.
“The CISO is being run over by other leadership in the organization, by the board of directors, by wanting to take risks. That can be hard. But we have a core set of values, and you have to ask yourself, why did you get into security? Like, why are you taking on this leadership role?”
Jon McLachlan, at 28:42
The hardest days
Pranava’s first answer was a joke about the calendar.
“The cheeky answer to your question is four days ago, four days prior to that.”
Pranava Adduri, at 29:05
“It went from the worst day to the best day, like, four-day span right there.”
Jon McLachlan, at 29:10
Then the real one.
“But jokes aside, honestly, days where you have to let people go are always the hardest days. Because at a startup, there’s a very specific type of person that is well suited for early stage, right?”
Pranava Adduri, at 29:16
“And if it’s not working out, it’s always better to have that conversation earlier rather than later, but it never gets easier, right?”
Pranava Adduri, at 29:29
“Necessary, but not easy.”
Jon McLachlan, at 29:36
Pranava said he still has good relationships with the people the company parted ways with, and one told him it worked out.
“And I remember I was catching up with one of them not too long ago, and he actually said that for him, he actually retooled afterwards, and he’s actually way happier now. So you’re right, it actually does end up being better in the longer run for all parties involved.”
Pranava Adduri, at 30:01
A hardcore boss and Winners Dream
Jon asked about the people who shaped them.
“I know I absolutely would not be where I am if it weren’t for a lot of amazing folks that I’ve had the great honor and pleasure to work with and work under and work alongside of.”
Jon McLachlan, at 30:21
George went back to VMware.
“there was a guy when I first got to VMware that was so hardcore in his feedback and the way that he just would tell me I was doing something stupid. And I needed it. I needed it at that time.”
George Gerchow, at 31:19
“And a lot of it goes to what Pranava was saying about letting people go and doing hard things. I think that guy, more than anyone, taught me how to do hard things that would have, like, potentially good outcomes for everyone.”
George Gerchow, at 31:49
Pranava named his father first, and then a book.
“I would say one for sure is my dad, but also there’s a lot of authors that taught me how to think about certain problems, right? One called Winners Dream by Bill McDermott.”
Pranava Adduri, at 32:05
“I think it really taught me what it means to be relationship first and be very genuine in how you approach a sale. It really taught me how to look at it from a perspective of how to do right by the customer.”
Pranava Adduri, at 32:15
Bill McDermott has been CEO of ServiceNow since November 2019 and was CEO of SAP before that. He wrote Winners Dream: A Journey from Corner Store to Corner Office with Joanne Gordon, and it won a gold medal for business memoir of the year from the Axiom Business Book Awards (Wikipedia). A CTO taking his lesson from a sales memoir fits the rest of what Pranava said: the security question and the customer question keep turning out to be the same question.
An invisible layer at the speed of machine
Jon asked what success looks like, as far into the future as they wanted to go.
“When we look into the future, and I’ll let you decide, like, how far we’d like to travel into the future, could you help us see what is that vision?”
Jon McLachlan, at 32:41
George’s answer was about his peers.
“it’s going to be just trying to set an example for a lot of my peers as to how to be more open-minded, how to enable a lot of the technology that we’re seeing today, how to have the gumption to stand up to the board when the board is saying, how are we using AI, which is the wrong question”
George Gerchow, at 33:05
“And then I marry that with Bedrock Data and just being around a lot of great people that are highly determined, like Pranava, to do the right thing and bring value to our customers in a responsible way.”
George Gerchow, at 33:25
Pranava’s answer was a layer.
“I think for me, from a vision perspective, there needs to be a layer that understands what data an enterprise has”
Pranava Adduri, at 33:47
“All of that needs to be powered by something. And right now, it’s human best judgment.”
Pranava Adduri, at 34:10
The reason it can’t stay human is the loop he called the data echo chamber.
“So I think going forward, especially, I use the term data echo chamber. There’s the data you have, goes into AI, people ask prompts, it puts out new data”
Pranava Adduri, at 34:15
“As you enter into this, like, rapid acceleration, there has to be a layer that’s understanding what’s going on at the speed of machine, not at the speed of human, to keep up with it.”
Pranava Adduri, at 34:26
He gave a talk with that name, The Data Echo Chamber: Governance in the AI Era, at Web Summit on November 12, 2025, and a second one the next day called Saying “No” is Your Best Friend for Getting to PMF (Bedrock Data). The second title is about product-market fit, the degree to which a product meets a strong market demand (Wikipedia), and it’s a fair counterweight to the rest of this page: a founder still has to say no to most product ideas. Researchers have a name for one version of the echo chamber too, model collapse, the degradation of models trained on uncurated synthetic data or on other models’ outputs (Wikipedia). Pranava didn’t use the term, and the page adds it only as context.
“And kind of where I see this going is, I kind of see Bedrock as being this invisible layer that understands your data, that injects that context into every aspect of a business, right?”
Pranava Adduri, at 34:35
“And it’s not just about building another single source of truth, as beautiful as I think our product is. It’s about meeting the customer where they’re doing their work.”
Pranava Adduri, at 35:02
His examples were a just-in-time access portal, a data annotation process and a security workflow, each getting Bedrock’s context where people already work.
“So I see it as the invisible layer that permeates the business, understands what data is present, and helps turbocharge every single workflow that’s there with that data context.”
Pranava Adduri, at 35:32
Be fully present
Jon’s last question was the show’s usual one.
“If you could go back in time and meet your younger self, would you? And would you have any advice for yourself?”
Jon McLachlan, at 35:50
“And the advice I would give myself would be more on the personal front than the professional front.”
George Gerchow, at 36:02
“and just savor every single second and moment that I have with them”
George Gerchow, at 36:16
Pranava started with the obvious answer and moved past it.
“And beyond telling myself to buy more Apple and Google stock, I actually think George said it really well, right?”
Pranava Adduri, at 36:43
“I think at the end of the day, whatever you take on, whether it’s spending time with your family, whether it’s being very, whether it’s building a project that you’re super passionate about, being 150% there and doing it fully”
Pranava Adduri, at 36:52
“I would say it’s about being more fully present.”
Pranava Adduri, at 37:15
“I think at the end of the day, productivity is an emotional output, right?”
Pranava Adduri, at 37:30
“Be present.”
George Gerchow, at 37:53
“Be present, yeah. Be in the moment.”
Jon McLachlan, at 37:54
What happened after the tape
Bedrock kept building the layer Pranava described. Some of it was announced before the episode aired, and some since.
The AI risk surface. On March 19, 2026, Bedrock expanded ArgusAI beyond mapping AI systems to their data and checking guardrails. It now covers what the company calls the enterprise AI risk surface, “the full exposure chain” across the AI agents a company deploys, the Model Context Protocol servers and connectors that give them access to systems and data, and the sensitive data itself (Bedrock Data).
More agents. On April 22, 2026, Bedrock said ArgusAI governs AI agents built on Google Vertex AI Search and Dialogflow (Bedrock Data).
On air. Episode 95 went out on May 19, 2026, and the video version on YouTube on June 11, 2026 (YouTube). George joined the board of advisors of Cofense in May 2026, by his LinkedIn.
Remediation. In late October 2026, Bedrock announced that its AI-assisted remediation is generally available, with Jira and ServiceNow integrations (LinkedIn).
Entitlements in 2027. On November 3, 2026, Bruno Kurtic posted the third of his predictions for 2027, about identity and entitlements.
A video from Bedrock Data: Bruno Kurtic's third prediction for 2027, that reconciling identity through entitlements to classified data becomes the foundational data security and AI security initiative of the year.
Bedrock Data · November 3, 2026
His argument in the post is about the entitlements George listed on the tape: nobody can enforce a rule like keeping third parties away from personal data without knowing whether that data is in what a third party’s agent can reach. The next day, November 4, 2026, George spoke three times at the IANS Charlotte Forum, on MCP and agentic AI, on deepfakes and social engineering, and on a keynote panel about vulnerability management in an age of AI-assisted discovery (LinkedIn).
The part of the conversation that aged best is the plainest. Know what data you have and who owns it. Write down what went into each model, and compare it with what the guardrails block. And when the business asks for something, have a path that says yes, because the people asking will find a path either way.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
How much data did Pranava's example AWS customer have, the question that started Bedrock?
- A hundred terabytes
- A hundred petabytes
- Ten exabytes
b. "if I have a hundred petabytes of data, what data do I back up?" Transcript, 2:29.
-
What did Pranava say people do when there's no sanctioned path to an AI tool?
- They come up with a shadow path
- They wait for security to approve it
- They stop using AI
a. "If you don't have a sanctioned path, they will come up with a shadow path to do it, right?" Transcript, 11:03.
-
Who did George say really owns the data?
- The CISO
- The cloud provider
- The business
c. "It is the business that owns the data." Transcript, 14:42.
-
What adage did Pranava use for visibility and guardrails?
- Trust, but verify
- Good brakes help you go faster
- Move fast and break things
b. "I like to think about this adage of, like, good brakes help you go faster." Transcript, 16:13.
-
What does Bedrock call the snapshot of the data supply chain going into an AI workload?
- A DBOM, a data bill of materials
- An SBOM
- A data map
a. "And that snapshot is what we call the DBOM." Transcript, 21:15.
-
How many levels did Pranava's plan have while SVB's fate was unknown?
- Two
- Ten
- Four
c. "And we had, like, four levels of what do we do if we only get this much money back." Transcript, 26:09.
Can you say yes?
Pranava’s test for a security team was whether it can say yes to an AI request and know what it agreed to. Eight questions on how close your team is.
Scorecard · eight questions
Can you say yes?
Answer for your company as it works today. If two answers fit, pick the lower one.
-
Can you list every AI workload that touches company data: copilots, agents and models you train?
- No, not with any confidence
- The ones that went through an approval
- Yes, from an inventory that updates itself
"can you please help me understand what AI I have at play? Like, what have I deployed?" See Good brakes help you go faster.
-
For your most important model or agent, can you say what data went into it and what it can reach?
- No
- Roughly, from the team that built it
- Yes, from a written record of sources and processing, a DBOM
"What data made its way into the training phase? Where did that data come from?" See A data bill of materials.
-
Is your sensitive data classified, with its lineage and entitlements known?
- No
- Classified in the main systems, without lineage
- Classified everywhere, including copies and lower environments, with lineage and entitlements
"know the lineage, the entitlements of that data, how it works, what's sensitive, what's not" See How many pictures are on your phone.
-
Do you know which sensitive data your AI guardrails block and which they let through?
- We don't test the guardrails
- We tested them once, at launch
- We compare what goes in with what the guardrails block, and recheck when either changes
"And that gives you a gap analysis." See Argus and the gap.
-
When a team asks to use a new AI tool, what happens?
- The answer is no, or there's no one to ask
- A review that takes weeks
- A sanctioned path with an answer in days, conditions included
"If you don't have a sanctioned path, they will come up with a shadow path to do it, right?" See The office of no does not work.
-
Who owns each important dataset?
- Nobody in particular, or security by default
- IT
- A named owner in the business, with security as the steward
"It is the business that owns the data." See Who really owns the data.
-
Is data anonymized before it's used for training, and does anyone check?
- We don't train, or we don't know
- There's a rule, and nobody checks it
- There's a rule, and the record for each model shows it was followed
"they have controls or requirements that say that data has to be anonymized before it can get to the training phase." See A data bill of materials.
-
Where does security sit when engineering starts something new with AI?
- It hears about it at launch
- It reviews the design when asked
- It works with the CTO from the start, as a partner in the product
"I'm seeing a shift to where CISOs, progressive CISOs, are now starting to report to the CTO." See Stay out of my stuff.
Without an inventory, every yes is a guess, so the answer is no and the work moves to a shadow path. Start with a list of AI workloads and the data each one reaches, and open one sanctioned path with a published answer time.
You say yes to some requests, but you can't always say what you agreed to. Write a DBOM for your three most exposed models, name an owner for each dataset, and test what your guardrails let through.
You know what data you have, what each model took in and what the guardrails stop, so you can say yes quickly. Keep the inventory automatic, recheck the gap when models or guardrails change, and keep security in the room from the start.
What gets through your guardrails?
Pranava’s gap analysis compares two lists: the sensitive data that went into a model, and what its guardrails block. The calculator runs that comparison across your AI workloads with example numbers. Put in your own.
Calculator
What gets through your guardrails?
Four numbers: your AI workloads, the kinds of sensitive data that reach each one, the share of those the guardrails block, and the share of workloads you have a DBOM for.
Your 12 AI workloads give sensitive data 48 paths in. If the guardrails block 75% of them, 12 still get through, and about 8 of the 12 workloads have at least one. With a DBOM for 25% of the workloads, you can see 12 of the 48 paths, and 36 are a guess.
The defaults are an example, not figures from the episode. A path is one kind of sensitive data, such as customer records or vendor data with use terms, reaching one workload. The count of workloads with a gap assumes each kind is blocked independently at the same rate, the simplest version of the gap analysis in Argus and the gap. Real guardrails are uneven, which is why Pranava's version compares the actual lists.
From Box to ArgusAI
Everything on this page sits on one timeline, from the year Greylock was founded to Bedrock’s predictions for 2027. Filter it by thread.
Timeline · 1965 to 2026
From Box to ArgusAI
Filter by thread. Dates are from the public record except where marked as part of this show.
- Greylock
One of the oldest venture capital firms is founded, the firm that would later lead Bedrock's Series A (Wikipedia, on this show).
- Box
Aaron Levie and Dylan Smith found the company where Pranava would work from 2012 (Wikipedia, on this show).
- IANS faculty
George joins the IANS Research faculty, where he still is (LinkedIn, on this show).
- Box
Pranava starts as a backend engineer, until April 2015 (LinkedIn, on this show).
- Rubrik
The Palo Alto data management and security company is founded (Wikipedia, on this show).
- Sumo Logic
George becomes chief security officer and senior vice president of IT, until February 2024 (LinkedIn, on this show).
- Rubrik
Pranava joins as a founding engineer, and later manages engineering, until March 2019 (LinkedIn, on this show).
- AWS
Pranava manages software development for data protection services in Seattle, until July 2020 (LinkedIn, on this show).
- Greylock
He becomes an entrepreneur in residence (LinkedIn, on this show).
- Bedrock
Pranava co-founds the company with Bruno Kurtic and Ganesha Shanmuganathan (LinkedIn, Bedrock Data, on this show).
- SVB fails
Silicon Valley Bank fails after a bank run, the third-largest bank failure in United States history (Wikipedia, on this show).
- VMware
Broadcom completes its purchase of VMware, where George met the boss whose feedback he needed (Wikipedia, on this show).
- ISO/IEC 42001
The standard for AI management systems is published, which ISO calls the world's first (ISO, on this show).
- MongoDB
George becomes interim CISO and head of trust, until April 2025 (LinkedIn, on this show).
- Rubrik goes public
Rubrik lists on the New York Stock Exchange (Wikipedia, on this show).
- The DBOM
Pranava writes down the data bill of materials as an inventory of what goes into a model and what it can reach (Bedrock Data, on this show).
- A chief security officer
Bedrock names George its CSO (Bedrock Data, on this show).
- The data echo chamber
Pranava talks about governance in the AI era at Web Summit, and the next day about saying no on the way to product-market fit (Bedrock Data, on this show).
- Series A and ArgusAI
A $25 million Series A led by Greylock, and the launch of ArgusAI (Bedrock Data, on this show).
- Confidence index
Bedrock's survey finds 82% of organizations struggle to find and classify their data (Bedrock Data, on this show).
- The recording
Jon talks with Pranava and George the day after Bedrock opens its San Mateo office (on this show).
- The AI risk surface
ArgusAI expands to agents, MCP servers and connectors, and the sensitive data behind them (Bedrock Data, on this show).
- More agents
ArgusAI governs agents built on Google Vertex AI Search and Dialogflow (Bedrock Data, on this show).
- Cofense
George joins Cofense's board of advisors (LinkedIn, on this show).
- Episode 95 airs
The episode goes out on Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- On YouTube
The video version goes up (YouTube, on this show).
- Entitlements
Bruno Kurtic's third prediction for 2027, on reconciling identity through entitlements to classified data (LinkedIn, on this show).
- IANS Charlotte
George speaks on MCP, deepfakes and vulnerability management at the IANS Charlotte Forum (LinkedIn, on this show).
What to do this week
Five things, in the order the episode suggests.
- List your AI. Write down every copilot, agent and model that touches company data, the three levels Pranava described, and where each one gets its data. If you can’t, that’s the first answer to his question, “what have I deployed?”
- Write a DBOM for three. For your three most exposed workloads, record the data sources, the processing between raw and training-ready, whether anonymization happened, and any vendor terms. The companion post on the AI data bill of materials has the fields.
- Run the gap analysis. Compare each DBOM with what the workload’s guardrails block, and fix the gaps that carry customer or regulated data first. The calculator above shows why the count is usually higher than it feels.
- Open a sanctioned path, and name the owners. Publish how a team asks for a new AI tool and how fast it gets an answer, and put a named business owner on each important dataset, with security as the steward. The scorecard covers the rest.
- Get help with the parts you can’t staff. Our Training Data PII & Secret Scrubbing team can clean what goes into a model, our Corporate Shadow-AI Detection & Mitigation work finds the shadow paths, our ISO 42001 program turns the records into an audit, and you can book 15 minutes with us.