Kanaiya Vasani has a useful habit for an age of artificial intelligence: he keeps returning to the evidence. In cybersecurity, evidence can be awkward. It arrives as packets and protocols, encrypted sessions and identity trails, a vast mechanical diary written by machines for other machines. Most executives would rather begin with the dashboard. Vasani begins several floors below it, where the network records what actually happened.
That instinct was earned over more than 30 years in networking and security. His resume moves through cable-video infrastructure at Terayon, core routing at Juniper Networks, cloud and DNS security at Infoblox, and network detection and response at ExtraHop. It crosses research and development, product, marketing, strategy, general management, and corporate development. The titles change. The recurring job is translation: turn deep infrastructure into a product, then turn the product into a business that can survive the next architectural shift.
Now Vasani is ExtraHop's Chief Product Officer and Chief Marketing Officer. The combined brief suits him. He is responsible both for what the product becomes and for the language used to explain it. His present argument is more architectural than promotional. Security operations centers, he says, cannot meet AI-assisted attacks with the old procession of alerts, queues, and analyst handoffs. Yet simply adding an AI agent to that procession changes little. The agent needs structured context, the authority to act must be governed, and the model should be the part a customer can replace.
The long apprenticeship
Before agents, there were cue tones
In 2005, Vasani was explaining a different sort of invisible infrastructure. Terayon's CherryPicker platform helped television providers process digital video. As telcos converted programming from MPEG-2 to MPEG-4, the conversion could strip out cue tones needed to insert local advertising. Terayon built software to put the cues back. The detail feels wonderfully remote from an agentic SOC, but the product problem is familiar: preserve the signal that lets a complex system make the right decision downstream.
Vasani rose to vice president of marketing and general manager of Terayon's cable data business. He helped restructure and reposition the company before Motorola acquired it in 2007. At Juniper Networks, he held senior leadership posts and led products for the core routing business, closer still to the high-speed arteries of the internet. The work taught scale in its least metaphorical form. Packets must move. Interfaces get faster. Architecture meets physics.
His education had prepared him for this border crossing. Vasani earned a master's degree in computer science at the University of Minnesota Duluth and another in management of technology through the Carlson School of Management. He also earned a bachelor's degree in computer engineering at VJTI in Mumbai. The pairing is almost too neat: understand the machine, then understand what an organization can do with it.
From product marketing to GM and vice president of marketing, followed by the company's acquisition by Motorola.
Senior leadership across core-routing products, business development, and corporate development.
SaaS and business development, then executive leadership of products and corporate development during a cloud and security expansion.
Product leadership widened to include marketing as the company makes network context central to autonomous security operations.
The transformation business
At Infoblox, the translation problem became corporate. The company was known for core network services, particularly DNS, DHCP, and IP address management. Vasani first appeared publicly as vice president of SaaS and business development, describing ways to connect on-premises network services with cloud-delivered security. By 2019 he was executive vice president of products and corporate development, responsible for a portfolio expanding into security, analytics, edge services, and cloud.
The business changed with the product. During his tenure, Infoblox moved toward SaaS, developed a hybrid DNS security platform, and expanded beyond the network administrator's traditional toolkit. Vasani helped double the core network-services business, incubate and scale the security business, and navigate both a take-private transaction and a later sale. In March 2022, AsiaOne Magazine recognized him for his role in the company's cloud-first DNS and security transformation.
Corporate transformations are often retold as a single inspired pivot. The work Vasani describes is less cinematic. Architecture must accommodate the installed base. New services must integrate with the security stack customers already own. A cloud product must feel like an extension of core infrastructure, not an eviction notice. Product strategy here is choreography: move a mature business without asking its customers to leap.
The present wager
An agent is only as clever as its context
Vasani joined ExtraHop as Chief Product Officer in early 2024, alongside a $100 million growth investment. ExtraHop's raw material is network telemetry. Sensors observe traffic across data centers, cloud environments, and physical and virtual infrastructure. The platform parses activity from the packet layer through application transactions, establishes normal patterns, and looks for behavior that departs from them.
This matters because modern intruders increasingly arrive wearing valid credentials. Once inside, they enumerate systems, execute familiar administrative tools, move laterally, stage data, and try to disappear into ordinary traffic. Endpoint software sees one part of the story. Identity systems see another. The network records the conversations between them. Encrypted traffic complicates the picture, which is why Vasani emphasizes decryption at scale, protocol depth, and packet evidence.
Agents are only going to be as smart as the context they can reason on.Kanaiya Vasani
The sentence is the spine of his agentic SOC thesis. A traditional security operations center behaves like a batch processor. Alerts arrive as logs. A first-level analyst triages them, builds cases, and escalates difficult work to a second or third level. Investigation can take hours or days. Against an attacker using AI to find and exploit weaknesses in seconds, that staircase is too leisurely.
From escalation ladder to live pipeline
His proposed replacement is not a robot analyst sitting in the same chair. Telemetry arrives continuously. Behavioral detections fire in real time. Relevant evidence is attached immediately. Agents connected to knowledge graphs investigate and help drive the response, either with a person supervising or, in bounded cases, autonomously. The workflow becomes a pipeline measured in minutes.
The hard part is giving the agent a usable version of reality. Asking a model to grind through raw packet captures would make the token meter spin while leaving meaning uncertain. ExtraHop instead organizes network activity into records, time-series aggregations, identities, assets, behavior maps, blast-radius information, and correlated detections. An agent can start at a high level and descend into detail when the case warrants it. The product is not merely collecting more data. It is preserving layers of meaning.
The proposed agentic SOC stack
A horizontal peace treaty
No company owns that whole context layer. ExtraHop sees the network. CrowdStrike has endpoint context. Identity platforms, cloud providers, and threat-intelligence companies each hold another fragment. Vasani's architectural answer is also a diplomatic one: the vendors must cooperate.
The Agentic SOC Alliance emerged after ExtraHop and ReversingLabs took a roadshow through 12 cities and spoke with more than 100 senior security decision-makers. The pattern Vasani heard was not a request for one more agent. Customers wanted a framework. The alliance organized that framework into three parts: context, a harness, and models.
Context is the durable representation of what is happening. The harness governs what agents can access and do, manages state and memory, routes human approvals, and keeps an audit trail. Models reason over the evidence, but they remain interchangeable. That ordering is a quiet rebuke to the industry's model fever. Models will improve and change. An enterprise still needs control, and a missing fact cannot be reasoned back into existence.
The alliance is also an admission that the security industry's vertical silos have become liabilities. For decades, customers sent endpoint, identity, threat, and network feeds into a data lake, then asked humans to find the needle. AI can examine more hay, as Vasani likes to point out, but it works best when the evidence is already correlated. The architecture turns cooperation from a partnership slide into a product requirement.
The network remains the immutable source of truth for the modern enterprise.Kanaiya Vasani
The optimism of an infrastructure realist
Vasani is not shy about the risks. Agents can escape sandboxes. Automated attacks compress the time between discovery and exploitation. Unauthorized AI use can move sensitive information beyond approved controls. He describes transparency and control as conditions of AI advantage, not paperwork to be added later.
Still, his view is ultimately optimistic. AI may let defenders inspect the signals human teams had to tune out. Behavioral anomalies that once drowned in noise can be correlated with identity, endpoint, and network context. For perhaps the first time, he argues, defenders could operate at the speed and scale of attackers.
It is an optimism grounded in old lessons. Preserve the cue tone. Respect the packet. Build the integration. Let the installed system evolve. Keep the evidence legible as it climbs the stack. Vasani's career has moved from one generation of network machinery to another, but his current bet would be recognizable at every stop: when the system gets faster, abstraction becomes useful only if it carries the truth with it.