Security Confidential S17 E6 Santosh Kaveti

Manoj Tandon:
Hello everyone! This is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. We have another fabulous guest here today, and I’ll introduce him in a moment. But first, please hit the Like and Subscribe button! We live in a world of algorithms, and showing us a little love helps us keep bringing you great content and amazing guests.

Without further ado, I’d like to introduce our guest, Santosh Kaveti, CEO and Founder of ProArch. Santosh has been in the business for over 20 years. He’s built this company from the ground up, attracted major investment, and become a driving force in the technology industry. He’s an experienced technologist, entrepreneur, investor, and advisor — and he also does social work, which we’ll touch on later.

His company, ProArch, is a major player in the energy, healthcare, life sciences, and manufacturing sectors. Welcome to the show, Santosh. I really appreciate you being here.

Santosh Kaveti:
Thank you, Manoj. You’re very kind with your words, and I’m glad to be here. I do have to make one comment, though — this happens to us all the time because of how our name is spelled. It’s actually pronounced Pro-ark — short for “Professional Architects.” That’s where the name comes from.

Manoj Tandon:
Ah, so why the “H,” then?

Santosh Kaveti:
Well, we picked the first syllables from “Professional Architects,” but yes, we often have to correct the pronunciation. We’ve even thought about changing the “H” just to make it easier. But when you’re established across five countries, with teams everywhere, changing everything isn’t simple. Maybe one day we’ll have the courage to do it — but for now, it’s a great conversation starter!

Manoj Tandon:
Got it — Pro-ark. That makes perfect sense now! So tell me — was that the original vision for the company when you started it?

Santosh Kaveti:
Yes, exactly. The vision was that everyone should aspire to be a professional architect — whether that’s an architect of code, infrastructure, or systems. The idea is that there’s an architect in each of us, striving to build something meaningful.

Manoj Tandon:
That’s fascinating. Let’s rewind a bit — how did you get to the point of wanting to “unleash” this professional architect? I imagine you’re in Atlanta now — were you always based there, or was it a long journey?

Santosh Kaveti:
It’s been a long journey. In short — I came to the U.S. for my master’s degree. I was actually planning to pursue a PhD in Applied Mathematics, but life happened. I dropped out, took a job as a programmer, and about five or six years later, I founded ProArch. That’s how it all started.

Manoj Tandon:
That’s a big leap. In the Indian diaspora, people usually want their kids to get a stable job, work in a big company, and retire comfortably. Dropping out of school and quitting a good job — how did your family react?

Santosh Kaveti:
I get that completely. But I grew up around people who took risks and followed their convictions. My dad, for example, earned his law degree at 60! So I was surrounded by people who believed in taking chances.

When I dropped out, it wasn’t rebellion — it was necessity. I had to support my family. I got a programming job, and as I worked, curiosity drove me. I kept asking “why” about everything, which probably annoyed my coworkers — but it got me promoted! People would say, “You’re asking too many questions — go solve the problem.”

Eventually, I realized there had to be a better way to do things, and that curiosity led me to start ProArch. I was lucky — my family supported me completely. They didn’t just approve; they helped me execute.

Manoj Tandon:
That’s great to hear — and a bit unusual! What do you think makes the U.S. such fertile ground for entrepreneurs compared to, say, the Far East?

Santosh Kaveti:
First off, India today is absolutely booming with entrepreneurs. We have offices and customers there, and I’m amazed at the digital adoption and innovation. But in the U.S., what I learned professionally is how to be passionate and how to pursue something all the way.

The U.S. gives you freedom and opportunity. There’s less “noise” — fewer hurdles. In the Far East, entrepreneurs often face more bureaucracy and cultural barriers. Here, your conviction and work ethic really define your outcome.

Manoj Tandon:
I couldn’t agree more. So let’s talk tech — when you started programming, what era was that? Java? C? COBOL?

Santosh Kaveti:
It started with COBOL! We were modernizing an ERP system that ran on HP 3000 green screens. Later, we migrated to client-server, then Java, and eventually .NET. I’ve seen the full evolution. And believe it or not, COBOL is still everywhere — especially in banking.

Manoj Tandon:
Yes, and it’s a good consulting job today — not many people still know it! So what made you think, “There’s a better way to do this”?

Santosh Kaveti:
Honestly, inefficiency. We were spending millions on things that didn’t matter. Priorities were off. People focused on compliance checkboxes instead of real risk or value.

That’s when I started rethinking things. Compliance shouldn’t be the goal — it should be the result of good security and hygiene. I shifted from thinking “How do I pass the audit?” to “How do I build trust and resilience?” That mindset change shaped everything for me — and for ProArch.

Manoj Tandon:
That’s powerful — and something we’ve heard echoed in many episodes. But as a CEO, you’ve internalized it. The industry, though, still feels stuck in product-driven, checkbox thinking.

Santosh Kaveti:
Exactly. It comes down to having the wrong conversations — security as a budget line item or a blocker instead of a business enabler. Security shouldn’t have its own budget; every business function should. That’s how you build a security-first culture.

Manoj Tandon:
Beautifully said. So how does ProArch help clients shift from checkbox compliance to risk-based security?

Santosh Kaveti:
We start by asking: What are you trying to protect, and why does it matter? We involve multiple stakeholders — not just IT or the CISO. Once we understand business priorities, we model the risks, quantify them, and build a roadmap.

We deliberately remove compliance from the first phase. Once we’ve defined and prioritized real risks, compliance becomes easy — a byproduct.

Manoj Tandon:
That’s a fantastic approach. And you’re right — cybersecurity is often seen as the department of “no.” Have you seen examples where security actually enabled business growth?

Santosh Kaveti:
Many. For example, during M&A activity. Some of our manufacturing clients acquire multiple plants each year. We help assess cyber and business risks pre-acquisition — that enables faster, safer integration.

Another area is AI. Business leaders now ask, “If I use Copilot, what data am I exposing?” Those conversations are enabling, not restrictive. AI is driving a culture of data awareness — and cybersecurity is part of that.

Manoj Tandon:
That’s true. But once you train AI models on data, you can’t just “delete” it. How do you mitigate that risk?

Santosh Kaveti:
Exactly — there’s no undo function. The only way to manage that is to establish proper data ownership, classification, and access control before enabling AI. Many companies don’t have that yet.

Now, thanks to AI, business leaders are realizing they need it. They’re asking the right questions: Who owns this data? How is it labeled? What’s its lineage? AI is forcing organizations to fix their data governance — and that’s a good thing.

Manoj Tandon:
I completely agree. And speaking of data — those old data lake projects everyone had — do they help or hurt now?

Santosh Kaveti:
They actually help! The shift is from data lakes to data products. AI lets you monetize and extract value from data — but only if it’s secure and well-classified. Data privacy and protection are the foundation for innovation.

Manoj Tandon:
Let’s talk about ProArch itself. How do you define what you do?

Santosh Kaveti:
We call ourselves business engineers. We approach problems with an engineering mindset, but always in a business context. We work across data, AI, security, compliance, and infrastructure — because those worlds are converging fast.

Manoj Tandon:
When you raised capital, what convinced investors that a services company was worth betting on?

Santosh Kaveti:
We were growing organically at 20–25% CAGR and had completed two acquisitions. Our financials were strong, we had zero debt, and we had a deep Microsoft partnership. That combination — steady growth, platform focus, and M&A experience — made the case.

Manoj Tandon:
And how do you ensure cultural fit during acquisitions?

Santosh Kaveti:
We’re not in an acquisition spree — every deal matters. Our expectation is that 1 + 1 = 1 at first, then maybe 1.5. Integration takes time. We focus on complementary capabilities and culture, not just cost optimization.

Manoj Tandon:
You also do OT security work now. How did that come about?

Santosh Kaveti:
That came from an acquisition in upstate New York. They had power plant clients, while we were already in transmission and distribution. We saw a major visibility gap in OT — so we built solutions to bridge it.

At first, just mapping all devices in the OT network was eye-opening for clients. Then we moved into anomaly detection, patching, and integrating OT and IT data for deeper insights.

Manoj Tandon:
That’s huge. Are you also integrating with plant historians like PI Systems?

Santosh Kaveti:
Yes, absolutely. Historian data is where the real value lies — it’s essential for real-time insight.

Manoj Tandon:
And how do you handle air gaps and disaster recovery?

Santosh Kaveti:
We segment as much as possible, keeping core systems isolated, but you still need to connect OT and IT for analytics. So we do it securely and test disaster recovery frequently.

We run drills because in energy and healthcare, uptime is everything. A rehearsed response beats panic every time.

Manoj Tandon:
Exactly. And many backups can’t even be restored when needed!

Santosh Kaveti:
Right — or worse, they’re not secure. Testing and securing backups is critical.

Manoj Tandon:
You’re clearly a visionary. How do you see AI transforming the energy sector?

Santosh Kaveti:
We’re moving from AI enabling workflows to AI making decisions. Soon, it’ll make strategic decisions — optimizing energy mix, predicting maintenance, even suggesting plant-level strategies.

It’s already happening. There are hedge funds run almost entirely by AI — so why not power plants next?

Manoj Tandon:
And as storage improves, decentralized generation will take off.

Santosh Kaveti:
Exactly. Efficient storage will completely change how we think about renewables and grid economics.

Manoj Tandon:
We’re at time — please, tell our audience where to find you and any final thoughts.

Santosh Kaveti:
Thank you, Manoj. I’d just like to say — no one is “too small to care.” SMBs are being targeted more than ever. Cyber risk isn’t isolated — a small vendor’s breach can ripple across 10 or 15 companies.

Take a Zero Trust approach: trust nothing, no one — inside or outside. And invest in employee awareness. Regular training and phishing simulations save companies millions and protect their reputations.

Manoj Tandon:
That’s great advice — and a perfect note to end on. Santosh, thank you for spending your time with us. You’ve been fantastic, and I hope to have you back soon.

Santosh Kaveti:
Thank you, Manoj. It’s been a pleasure. I really enjoyed the conversation.