Bruno Kurtic left Sumo Logic after more than 13 years with a rare credential in enterprise software: he had seen one idea all the way through. He joined at inception in 2010, helped shape product and strategy, watched the company grow toward nearly 1,000 employees and about $300 million in annual recurring revenue, and stood through a pandemic-era IPO in front of the Redwood City office. Then came a $1.7 billion acquisition by Francisco Partners in 2023. He could have treated the arc as a finished argument. Instead, he stepped away and began asking what the argument had missed.
The year that followed was deliberately unhurried. Kurtic traveled, learned, served as an entrepreneur in residence at Sutter Hill Ventures and spoke with more than 100 technologists across generative AI, security and operations. He wrote multiple business plans. The exercise kept returning him to a familiar object: data, only now with a new kind of consumer. Enterprise data had always been messy. AI agents made the mess consequential at machine speed.
A career spent translating machines
Kurtic's career has moved between code, product and corporate strategy, but the work has shared a theme. At webMethods, where he spent six years, he worked as a software architect and product director. After earning an MBA from MIT Sloan in 2007, he advised large technology clients at Boston Consulting Group. At SenSage, he led product for a security information and event management system. Each stop involved converting noisy technical behavior into something an organization could understand and act on.
Sumo Logic made that translation continuous. Its cloud platform collected machine data and turned it into signals for operations and security teams. Kurtic worked on product, go-to-market activity and partnerships with companies including AWS, Akamai, CrowdStrike and Google Cloud. He is also named on granted patents covering technologies such as automatic parser generation and anomaly detection. The product lesson was plain: raw information becomes valuable when context arrives quickly enough to influence a decision.
Data visibility is the foundation of data security, governance, and management.Bruno Kurtic, 2024
By the time Kurtic left, the next version of that lesson was forming. Generative AI was making enterprise data easier to use, but also making it easier to use badly. An employee may search one database with a known purpose. An AI agent can move through several systems, combine information and act on the result. The interface looks simple. The permission graph beneath it does not.
The company he met as an adviser
Bedrock was not a cold start. Asheem Chandna at Greylock connected Kurtic to the company as an adviser during its incubation. That introduced him to Pranava Adduri, who had worked on large-scale data protection at Rubrik, and Ganesha Shanmuganathan, whose background included Cohesity. Kurtic spent roughly a year advising the team before joining full-time in 2024 as co-founder, president and CEO.
The choice condensed his year of exploration into one problem statement. Companies could not reliably secure data they could not find. They could not govern data they had not classified. They could not control AI access without knowing which identities, services and paths connected an agent to a sensitive asset. Bedrock would build a living map of those relationships.
The AI risk surface, in Kurtic's three-part frame
Data sensitivity
What is inside the data, and how carefully must it be handled?
Access and exposure
Which people, services and permission paths can reach it?
Agent capability
What can an AI system do with the data once access exists?
Kurtic calls the organizing layer a metadata lake. The data itself stays in customer environments. Bedrock collects and connects metadata about location, sensitivity, ownership, lineage, access and use, then keeps the picture current as the environment changes. Its serverless approach is designed to discover and classify structured, semi-structured and unstructured data without requiring customers to operate clusters or move payloads outside their boundaries.
The distinction matters because infrastructure and data behave differently. A server is discrete. It can be inventoried and tagged. Data is copied into a warehouse, exported into a document, transformed in a pipeline and pulled into an AI workflow. Its meaning changes with context. Its exposure changes with every entitlement. A static catalog becomes a photograph of traffic, useful until the cars move.
The operating sequence
The useful brake
Security software often arrives as a list of prohibitions. Kurtic's version is closer to traffic engineering. If a company understands sensitivity, exposure and agent capability, it can place controls where they matter and leave lower-risk routes open. He has described the objective as putting brakes in the system so an organization can move faster. The brake is valuable because it makes speed controllable.
This is also why he measures data visibility in operational terms. In interviews, Kurtic returns to mean time to detection, accuracy, time to value and operating cost. A classification system that needs constant rule tuning may be technically deployed and practically stale. A scan that is too expensive will happen less often. A precise map that arrives after the environment changes is an attractive antique.
Our mission is to build an enterprise-wide metadata lake that serves as the source of truth for data sensitivity, access, lineage and more.Bruno Kurtic, 2025
Bedrock's $25 million Series A, announced in November 2025 and led by Greylock Partners, gave the company capital to expand product development and go to market. The company has since deepened integrations with platforms including Snowflake, Atlassian and Google, launched ArgusAI for agent governance, and added leaders across engineering, marketing and revenue operations. Those moves are the ordinary machinery behind an ambitious architectural claim: one context layer can make several existing security and governance systems more useful.
The second-time founder's advantage
Kurtic's edge is not that he has seen the future. It is that he has seen enterprise adoption take a very long time. Sumo Logic's journey included fundraising, product expansion, strategic alliances, an IPO and a return to private ownership. The arc trained patience into the product thesis. Enterprises do not replace their security stack because a new diagram looks cleaner. A new layer has to fit existing workflows, improve the tools already paid for and prove its value against operating cost.
That experience shows up in Bedrock's API-first posture and its emphasis on bidirectional integrations. The metadata lake is intended to enrich systems such as SIEM, cloud security and data-loss prevention tools, while receiving signals back from them. It is less a castle than a train station. Its worth depends on how much context can pass through and whether the connections stay current.
There is a personal symmetry here. At Sumo Logic, Kurtic helped make machine exhaust searchable and actionable. At Bedrock, he is trying to make the enterprise data supply chain legible to machines and the humans governing them. The direction of translation has flipped, but the instinct is the same: collect the context that turns volume into judgment.
In April 2026, Kurtic wrote that the overlooked form of AI context is context about the data itself: origin, ownership, sensitivity, lineage, movement and risk. It is a less glamorous list than model benchmarks. It is also the list an enterprise eventually encounters when a prototype becomes a system.
His public shorthand is even sharper: AI agents are like humans moving at machine speed without judgment. The sentence lands because it removes the mystical language around agents. A fast worker with broad permissions needs an accurate map, clear boundaries and an audit trail. None of those requirements is novel. The scale and tempo are.
Build from the ground down
Founders are often told to start with the user interface because that is where the pain is visible. Kurtic started one level lower. The pain shows up in an AI application, a compliance review or a breach investigation. The common dependency is a trustworthy understanding of the data.
That makes Bedrock's name unusually literal. Kurtic says an organization must discover, classify, understand and contextualize its data before building AI systems on top of it. The metaphor is tidy; the work is not. Data is fluid, permissions sprawl, classifications age and business meaning refuses to fit neatly into a regex. Bedrock's bet is that AI can help maintain the map without taking custody of the territory.
Kurtic's second founding act is still being written. Its most portable insight is already clear. When a technology changes who can use information and how quickly they can act, governance cannot live only at the point of use. It has to begin underneath, where the organization can still answer the plain questions: what is this, where did it come from, who can touch it and what happens next?