Nishant Doshi likes a moving target. Not in the carnival sense, where the game is rigged and the prize is a stuffed bear, but in the enterprise-software sense, where the target was a file yesterday and may be a paragraph inside an AI prompt tomorrow. He has spent more than two decades watching computing change the shape of information, then building security and analytics products for whatever shape came next.
The career looks almost suspiciously tidy in retrospect. At Symantec, Doshi worked close to malware, endpoints, network protocols, mobile devices, and social networks. Then cloud software began to redraw the corporate perimeter. He says he pitched executives on investing in cloud, software-as-a-service, and APIs. They declined. He left and co-founded CirroSecure, a startup designed to secure the SaaS applications that companies were rapidly adopting.
Palo Alto Networks acquired CirroSecure in 2015. Doshi joined the buyer and helped build and scale the products that became Prisma SaaS and Prisma Cloud. Then he left security for an adjacent invisible system: the work of software engineering itself. His next company, Propelo, connected data from development tools so engineering leaders could see where delivery slowed, where quality suffered, and where process got in its own way. Harness acquired Propelo in 2023.
The recurring trick: notice what the old map leaves out
There is a practical pattern here for founders. Doshi does not merely chase new technology. He watches for a change in infrastructure that makes an old management model incomplete. SaaS made the network perimeter incomplete. Modern software delivery made a manager's sprint dashboard incomplete. AI is now making the file incomplete.
A file used to be a convenient unit of control. It sat on a server or in cloud storage, carried a name, and moved as a recognizable object. Security products could classify it, restrict access, and inspect it at a boundary. But people increasingly move information as fragments. They paste a passage into a chatbot, summarize a proposal, combine a customer record with a spreadsheet, or ask an agent to gather knowledge from several systems and produce something new.
“Lineage gives you memory, and memory is what turns reactive alerts into proactive protection.”Nishant Doshi
That sentence is the center of Doshi's argument at Cyberhaven. A traditional security alert is often a snapshot: this user sent this content to this destination at this moment. Data lineage tries to preserve the plot. Where did the information originate? Who handled it? What did it become? Which identity, human or machine, moved it next? The ambition is to make security less like checking a passport at one border and more like understanding an itinerary.
An engineer learns to read the room
Doshi's technical credentials came first. He studied electrical and electronics engineering at the University of Mumbai and Syracuse University. A former Symantec colleague described him as experienced in reverse engineering binaries and protocols, able to move between low-level programming and complex architecture. In 2011, he discovered a serious Facebook privacy flaw that led the social network to change its platform.
Yet the later chapters depend as much on reading organizations as reading code. Propelo was built around a familiar executive frustration: software production generates torrents of activity, but leaders still struggle to tell which processes help. Doshi also helped create the Engineering Excellence Collective, a peer community for senior engineering leaders. He described their job as challenging and, often, lonely. The answer was not another analytics panel. It was a room where practitioners could compare notes and codify useful practice.
This is an appealingly consistent quirk. CirroSecure mapped activity in cloud apps. Propelo mapped engineering work. Cyberhaven maps the movement and transformation of data. The collective mapped knowledge usually trapped inside separate companies. Again and again, Doshi chooses systems where valuable context exists but is difficult to see.
From founder-led research to an operating company
Doshi joined Cyberhaven in September 2024 as Chief Product and Development Officer. The company itself began with a deep technical idea. Its founders had participated in a DARPA Cyber Grand Challenge and developed graph-based data-lineage technology. Under CEO Howard Ting, Cyberhaven moved from research project toward commercial security company. Doshi arrived after the company announced an $88 million Series C and rapid bookings growth.
In May 2025, Ting moved to the board and Doshi became interim CEO. The transition placed a repeat founder in charge of a company whose original founders remained central to its technology. In a later conversation with co-founder and CTO Volodymyr Kuznetsov, they discussed the delicate shift from founder-led management to scalable leadership: preserving the sharpness of the original idea while making roles, decisions, and execution work for a larger organization.
By fiscal 2026, Cyberhaven reported triple-digit annual growth, customer growth above 50 percent, and a $100 million Series D at a $1 billion valuation. It also released a unified platform combining data security posture management, data loss prevention, insider-risk management, and AI security. Company numbers deserve the usual corporate-announcement caveat, but they show the operational assignment Doshi accepted: turn a distinctive technical foundation into a broad product while the market changes underneath it.
The platform bundle also reflects a buyer's problem. Security teams have accumulated separate products for finding sensitive data, stopping leaks, investigating employees, and governing AI. Each tool can produce its own version of the truth. Doshi argues that lineage can act as connective tissue because the same history follows information across those categories. In theory, a team spends less time reconciling alerts and more time deciding which movement actually matters. It is the Propelo instinct applied to security: connect the scattered operational exhaust, then make it legible to the person accountable for the outcome.
The insider is now a workflow
For years, the phrase “insider threat” summoned a familiar character: the resentful employee carrying secrets out the door. Doshi's newer example is subtler and more ordinary. A loyal employee uses an over-permissioned agent. The agent gathers data from several systems and sends the result somewhere it should not go. Everyone may have followed an instruction. The risk lives in the assembled workflow.
This is what he means when he says the security model has flipped from outside-in to inside-out. Firewalls, endpoint protection, and cloud controls were built around keeping hostile actors away from trusted resources. AI agents can already sit inside the environment, use legitimate identities, and act far faster than a person. The actor may be authorized. The combination of data and destination may not be.
Doshi's prescription begins without theatrics: map which AI tools and agents are in use; understand how information moves across human-to-human, human-to-AI, and agent-to-agent workflows; then choose controls that can trace and respond at machine speed. He is equally careful about the role of automation in the defense. AI can assemble context and remove investigative drudgery, he argues, while people retain the judgment to block, allow, escalate, or dismiss.
His movie analogy makes the distinction easy to remember. Occasional scans are like screenshots taken every ten minutes: sharp enough to show a scene, too sparse to explain the plot. Continuous lineage aims for the full film. The metaphor is friendly, but the engineering demand beneath it is severe. A useful system must observe events across endpoints, browsers, cloud services, and AI tools; connect transformed fragments to their origins; and do so without turning ordinary work into a procession of false alarms. Context is valuable only if it arrives quickly enough to change the decision.
“The human stays in the loop for judgment. The AI does the heavy lifting of analysis.”Nishant Doshi
It is a useful limit. Plenty of enterprise AI pitches treat the human as an inefficient appendix waiting to be excised. Doshi treats judgment as the scarce part and context-gathering as the chore. That distinction carries the pragmatic stamp of someone who has shipped products inside both startups and large companies. Automation is valuable when it makes the responsible decision clearer, not when it merely makes a decision quicker.
A career organized around context
Doshi's story is less about predicting the future than noticing when the present has acquired a new shape. At Symantec, software moved toward cloud services. At Propelo, development moved across sprawling toolchains. At Cyberhaven, knowledge is moving through prompts and agents, often without traveling as a complete file. Each shift leaves incumbents clutching a map that is accurate in detail and wrong in outline.
The stealable lesson is to ask which old noun has stopped describing the customer's problem. Perhaps “file” has become “workflow.” Perhaps “user” must now include software acting with delegated identity. Perhaps an “alert” without history is only an interruption. Category creation often begins as grammar: rename the unit, and new product requirements become visible.
There is also a quieter leadership lesson in the path from founder to acquired executive to founder again and now CEO. Doshi has repeatedly crossed the seam between invention and operation. He has thanked collaborators publicly, built a peer group around lonely engineering work, and joined Cyberhaven with explicit appreciation for the research and commercial foundation laid before him. The tone matters. A leader inheriting a technical vision cannot pretend to have invented the past. He has to make it useful for the next stage.
The next stage will be untidy. AI agents are proliferating faster than governance, and the vocabulary of security is trying to catch up. Doshi's aspiration is straightforward: give enterprises a single view of sensitive data across endpoints, SaaS, cloud, people, and agents, then let them adopt AI without losing control of the knowledge that makes the business worth protecting.
It is a large assignment, but at least it is consistent. The data moved again. Nishant Doshi followed.