A Customer Was Hacked. Hitesh Sheth Turned the Postmortem Into Vectra AI

The useful clue arrived inside bad news. Around 2010, while Hitesh Sheth was chief operating officer at Aruba Networks, a customer told him it had been hacked by state-backed attackers. The software involved had been sold during his previous tenure at Juniper Networks. No available system, the postmortem concluded, could have prevented that particular breach. Yet the customer had found the intruders by studying network traffic collected for an entirely different purpose. Ordinary communications had betrayed extraordinary behavior.

For a career operator, the conversation could have ended as a painful footnote. For Sheth, it became a design brief. If attackers could pass through the front door despite the locks, perhaps security needed to become better at noticing what happened next. The network was not merely plumbing. It was a witness, and witnesses are valuable when they know which details matter.

That thought sat with him until the economics caught up. Machine learning was improving. Compute was becoming cheaper. Storage was becoming cheaper too. By 2012, Sheth believed the three curves had crossed at a point where software could inspect immense volumes of network behavior and identify the signals of an attack quickly enough to help. He left Aruba and began building Vectra AI.

Call it stubbornness, if you will, but I had a feeling that there is a chance that this could actually work.Hitesh Sheth on leaving an established operator role

A career spent inside the pipes

Sheth’s bet makes more sense when read backward. He grew up in Mombasa, Kenya, the son of a chemist working in oil and gas. His parents were not wealthy, and he has described paying for an American education as a lesson in family sacrifice. Many peers looked toward Britain for university. Sheth looked to the United States, where the combination of computer science and opportunity seemed stronger. The University of Texas at Austin offered what he called good “bang for the buck.” He earned a BA in Computer Science there.

His first job was as a Unix programmer at Santa Cruz Operation. Then came engineering management at Oracle, work at Liberate Technologies, seven years at Cisco, four at Juniper, and finally Aruba. The titles grew, but the subject remained remarkably consistent: the systems that let machines communicate, and the organizations required to turn that infrastructure into a business.

Along the way, he collected an education in bad timing. He worked on streaming video roughly two decades before recalling the effort publicly, and on a connected-home device he described as a predecessor to the iPad. Neither became the defining business of its moment. Sheth does not tell those stories as secret triumphs. He calls them setbacks and says the lesson was to get better each time. Silicon Valley celebrates being early, but customers rarely pay extra for the privilege of waiting for the world to catch up.

Vectra’s moment looked more promising, although the pitch sounded strange in 2012. Artificial intelligence still carried a whiff of science fiction. Sheth says people repeatedly advised him not to touch it and wondered why he would leave a public-company role instead of running another established business. The doubters were not foolish. They were pricing technical risk honestly. Sheth simply believed the customer problem and the changing cost curves justified the attempt.

The first model was wrong

A sympathetic investor helped. Sheth found one in Vinod Khosla, whose firm had people incubating a related idea. The groups joined forces. Years later, when asked for advice to AI entrepreneurs, Sheth reduced the lesson to seven words: “Don’t chase valuations. Chase the right investor.” A fashionable price can flatter a founder. A believer who understands the technical premise can keep a company alive long enough to discover whether it is true.

Discovery was not immediate. Sheth has said Vectra’s platform simply did not work for its first 18 to 24 months. The problem was not a shortage of data science. The team had failed to marry its methods to the right data. Once it recognized the mismatch, the insight became a bedrock principle for research and development.

This distinction sounds obvious only after someone has paid for it. Data is abundant in enterprise security. Attention is not. Every alert that sends an analyst toward harmless activity imposes a tax on the next serious warning. Sheth’s thesis became less about finding every anomaly and more about assembling behavior into an intelligible attack story. An attacker may change tools, addresses, or credentials. Movement through a network still creates relationships and patterns.

The company’s language evolved from network detection and response toward a wider view spanning identity, public cloud, SaaS, endpoints, and hybrid environments. The central idea remained stable: use AI to find signal in data that indicates compromise, then deliver it with enough speed and context that a security team can act.

IQ, EQ, and incomplete data

Sheth’s leadership advice is similarly pragmatic. Spend as much time as possible with customers. Surround yourself with strong advisers and find a coach. Recognize inflection points, because changes in the business often require changes in leaders and operating models. Build culture deliberately. None of this reads like a founder mythology. It reads like someone who has managed inside several large organizations and knows that good technology can be quietly strangled by the wrong structure.

He describes effective leadership as a balance of IQ and EQ: connect dots with incomplete data, then rally a team beyond what it thought possible. He adds accountability to the mix. A leader’s poor decision reaches beyond employees to families and customers. The sentiment is serious, but not abstract. Sheth’s own path began with parents stretching to make education possible and later depended on customers being candid about where products had failed.

An effective leader balances IQ and EQ.Hitesh Sheth on making decisions when the picture is incomplete

Mentorship has been another constant. Sheth singles out Charles Giancarlo, once his manager at Cisco and later a Vectra board director, as a “360” person who can see all sides of an issue. The phrase reveals what Sheth appears to prize in counsel: not certainty, but range. Cybersecurity produces no shortage of confident answers. The harder skill is holding technical, commercial, and human consequences in view at once.

What changes when everyone has AI

By 2021, Vectra AI had raised a $130 million round led by Blackstone Growth at a $1.2 billion post-money valuation. Blackstone’s relationship was notable because it had first encountered Vectra as a customer. In 2025, Vectra acquired Netography, bringing its cloud-native observability into the platform. In 2026, the company introduced platform capabilities aimed at AI-powered enterprises and launched Vectra AI Pro for security operations using AI agents.

The market has now rushed toward the vocabulary Sheth once had to defend. His response is to narrow the claim. “Everyone has AI today,” he said at the launch of Vectra AI Pro. The relevant advantage, in his telling, is not the presence of AI but its application to attacker behavior. As attacks accelerate, security teams and their automated agents need trusted signals, not an ornamental chatbot perched on an alert queue.

That view also explains his resistance to the recurring claim that the network is dead. Clouds, identities, endpoints, applications, and AI agents all communicate. The network records those communications. Sheth calls it the central nervous system of the enterprise and argues that it provides a cross-domain view of how risk moves. A stolen identity can masquerade as a legitimate user. Its behavior still has to travel somewhere.

His stated ambition is broader than product category. Vectra’s vision, he says, is to make the world safer and fairer. He wants defenders to gain the upper hand rather than merely reach parity with adversaries. The language is idealistic; the method is almost stubbornly operational. Choose the right data. Reduce the noise. Keep the customer close. Make the response faster.

The breach that started this story was never a neat founding parable. A customer had been harmed, the existing tools had failed, and a useful clue appeared almost by accident. Sheth’s contribution was to keep looking at the clue. Years of infrastructure work told him where to look. Two years of a malfunctioning product taught him how. The result is a founder’s lesson that survives the AI fashion cycle: when the obvious defense fails, pay attention to what the system is still trying to tell you.