Cover Story
The security veteran who found the real problem wasn't the perimeter
There is a specific kind of experience that comes from spending three decades inside the rooms where software gets broken, fixed, sold, and shipped - and Bhagwat Swaroop has been in most of those rooms. He started writing code at Intel. He watched the internet change everything at Symantec. He saw email become the world's most dangerous attack surface at Proofpoint. He helped enterprises lock down identities at One Identity and digital certificates at Entrust. Then, in July 2025, he took the CEO chair at Sonatype, the company whose core argument is that the real vulnerability in modern software isn't the perimeter - it's the open source components sitting inside every application you've ever shipped.
The career logic is almost too clean. Start at the silicon layer. Move up through every threat surface the industry discovered along the way. Arrive at the top of the stack - the software supply chain - right when the world is finally ready to pay attention to it. The SolarWinds attack in 2020, the Log4Shell vulnerability in 2021, the cascade of supply chain incidents since: each one made the case Sonatype had been building since 2008. By the time Swaroop arrived, the argument had won. What remained was execution at scale.
"I'm honored and excited to join Sonatype, which has long pioneered secure software development, at such a pivotal moment for the future of open source and AI," Swaroop said when his appointment was announced. The word "pivotal" was doing a lot of work. Open source powers roughly 80-90% of modern application code. AI is now generating code at a pace no human team can audit manually. The intersection of those two facts is precisely where Sonatype competes - and where Swaroop has placed his next decade.
His argument cuts against conventional security thinking in an important way. The industry spent most of its history trying to build better walls: better firewalls, better email filters, better endpoint detection. Swaroop sees that model as increasingly insufficient. "Developers are now the front line of cybersecurity," he has said publicly. "Attackers understand that compromising a single developer's workspace can be far more effective than breaching a corporate firewall." The consequence is a strategic reorientation - from protecting the network perimeter to protecting the moment of creation.
That reorientation maps directly to what Sonatype does. The company's Nexus platform scans open source components before they enter a build, flags known vulnerabilities, enforces policy, and gives development teams intelligence they can act on in the pipeline rather than after deployment. With over 620 billion data points on open source components and a proprietary intelligence engine that detects malicious packages - including behavioral analysis that catches novel threats - Sonatype's technical moat is hard to replicate. Swaroop's job is to turn that moat into a business that scales.
The Wharton-trained engineer who never stopped being an engineer
The three-part education reads like a deliberate strategy, even if it wasn't planned that way. A BE in Instrumentation and Control from Delhi Institute of Technology gave Swaroop the foundations of systems thinking - measuring, controlling, feedback loops. An MS in Electrical Engineering from Arizona State deepened the technical grounding. The Wharton MBA gave him the language to turn technical insights into P&Ls and market strategies. The combination is relatively rare. CEOs with hard engineering training who also have first-tier business school credentials tend to run organizations where the product and commercial teams actually understand each other. At Sonatype, where the sales conversation is inherently technical - you're selling security intelligence to teams who understand exactly what a CVSS score means - that matters more than at most companies.
His career between degrees and the corner office ran through some of the defining companies of enterprise security's modern era. At Symantec, the company that built antivirus into a category. At NetApp, where data management became a strategic asset. At McKinsey, where he developed the frameworks that would later help him turn Proofpoint's email security business from a product into a platform. At Proofpoint, as EVP and General Manager, he oversaw a business protecting hundreds of millions of inboxes - and learned what it meant to defend communication infrastructure at global scale.
One Identity was a different kind of challenge. Identity-centric security was still an emerging category when Swaroop ran the business as President and General Manager, and the task was partly market education and partly execution. Then Entrust - a 30-year-old company navigating a digital transformation of its own identity and certificate business - where Swaroop served as President of Digital Security Solutions from 2023 to 2025.
Each stop added a layer. Email. Storage. Identity. Certificates. Open source. What looks like a varied resume is, from the inside, a continuous study in what it takes to secure the digital infrastructure that modern organizations depend on. The security stack, built one chapter at a time.
