IT Press Tour 70: Cohesity

For the 5th times, Cohesity joined The IT Press Tour and it was the opportunity to get a company and product update form Sanjay Poonen, CEO and president, and Vasu Murthy, CPO.The company and strategy part was covered by Sanjay Poonen and he insisted on the “post-Mythos world”. The mission evolved and covers now the need “to protect, secure and provide AI insights into the world’s data”, with the vision “Resilience Everywhere”. He described the company in three acts: Protection, Security and AI.

Click to enlarge

He also called Cohesity a cross between CrowdStrike or Palo Alto Networks on the security side and Databricks or Snowflake on the data side. Cohesity has about 12,000 customers, concentrated in the Global 2000, and protects some 200EB of data, which he compared to a million Libraries of Congress. In his words, that immutable backup history is “sedimented” data, and it is “gold” that should be used, not only protected. Speaking about a recurrent question relates to its IPO, Poonen insisted that the company is profitable and this is “on the horizon” but gave no date.

Click to enlarge

Act 1, protection, is about leaving “no workload left behind”: VMs, databases, files, identities, SaaS apps, and now agents. Eighteen months after the Veritas merger, Cohesity says it has the industry’s widest set of workload connectors. Poonen described the job as a “pipes and lake” problem, with recovery speed as the differentiator inherited from the founders’ work on Google’s file system and Nutanix.

Act 2, security, follows a five-step cyber resilience framework: protect every workload, cyber vaulting (including the air-gapped Fort Knox vault), threat scanning, clean-room application recovery, and the “Minimum Viable Company”. Banks such as BNY Mellon and JPMorgan helped shape that last concept. Cohesity’s Cyber Event Response Team acts as a “mini-Mandiant”. Poonen’s message on agentic attacks was “assume breach”: they are faster and cheaper to launch, so practicing recovery matters more. As the slide put it, “an ounce of resilience is as important as a pound of detection.”. This Minimum Viable Company model reminds me what HyperBunker told us during the 65th IT Press Tour in December 2025 in Athens, Greece.

Poonen said Cohesity was the first company in its market admitted to Anthropic’s Project Glasswing, after both he and customers pushed for it. Those customers, including US government agencies and banks, described Cohesity as their “last line of defense”. Cohesity’s security researchers ran Mythos over the full source code while some customers scanned Cohesity binaries, and the findings are being fixed. Cohesity then repeated the exercise with OpenAI’s GPT-5.x-Cyber, Google’s Gemini Cyber model, and Nvidia’s open-weights effort, joining the Open Secure AI Alliance. So far, Poonen said, Mythos is the strongest of these models. Products built on these adversarial models are coming “in weeks and months”. He named four “consequential” AI companies: Nvidia, Anthropic, OpenAI and Google, with Microsoft as a likely fifth. Nvidia and Google are investors in Cohesity, as are AWS and IBM.

Click to enlarge

Murthy argued that useful AI needs three actors:

• Agents, which are flexible and persuadable but cannot tell instructions from data
• Deterministic systems (systems of record, guardrails, resilience platforms), which are predictable and keep the immutable record
• Humans, who remain accountable, approve irreversible steps and set the rules

The Cohesity Data Cloud combines a control plane and apps, the NetBackup and DataProtect data movers, and the SpanFS-based platform. Poonen likened that stack to a burger and Murthy articulates the AI strategy with three pillars:

• Cohesity Maestro: AI skills for resilience teams. The five resilience steps now appear directly in the UI. In a demo, Claude, connected to Cohesity over MCP, flagged a payment platform that had no air-gapped copy. It proposed a fix, and the operator approved it before the product confirmed the change. About a dozen NetBackup and DataProtect customers are testing this approach. Privileged operations stay with human identities
• Agent Resilience and Cohesity DSPM. Agents have state: tools, memory, model configuration and vector stores. Cohesity’s first release discovers, protects and recovers agents on Amazon Bedrock, with near-continuous backups about every five minutes. Murthy’s example of why it matters was an email-triage agent hijacked by hidden instructions, whose memory had to be reset. Integrations with ServiceNow and Datadog will trigger recovery over MCP, for example after a mass deletion. Discovering agents remains hard because there are about 25 agent platforms. Murthy also said Cohesity plans, though not yet publicly, to let customers test against Mythos through the product
• Gaia and the Gaia Catalog. Gaia turns backup data, which is already versioned and classified, into a zero-copy semantic layer for GenAI. Cohesity claims 80-90% fewer tokens and more than 40% lower AI infrastructure cost. Access is through the Gaia UI and an MCP server, and a Catalog API for Databricks and Microsoft Fabric is due in Q1 FY27. US Patent 12,619,501, granted May 5, 2026, covers embeddings-based retrieval from backups. As an example, Rijkswaterstaat, a government agency in the Netherlands, runs Gaia fully on-premises on an Nvidia stack

Click to enlarge