Sumit Dhawan doesn't start with technology. He starts with people. That's the tell. In an industry stuffed with firewalls and frameworks, Dhawan keeps returning to one number - 95% - the share of cybersecurity failures that trace back to a human doing something they shouldn't have. Every acquisition he makes, every platform decision at Proofpoint, anchors to that fact.
He arrived at Proofpoint on November 28, 2023, the third CEO at the company in under two years. The board handed him a $1B+ revenue business with 3,700 employees and an enviable client list - 85 of the Fortune 100 trust Proofpoint with their email, data, and people security. Dhawan's first week was quiet. His second week was not. By early 2024 the acquisitions had begun, the leadership team was reshuffled, and the $5B ARR target was public.
That speed reflects a pattern. At Citrix, he spent 14 consecutive years - a rarity in Silicon Valley - moving through engineering, product development, marketing, and general management until he reached Group VP & General Manager. Not one function, not two. All of them, deliberately. "To be good at management I needed to have a good understanding of multiple key functions," he said in an interview with his alma mater. That cross-functional discipline is the engine behind how he thinks.
Before Citrix, there was IIT Roorkee - one of India's most selective engineering schools - then a Master's in Computer Science at the University of Minnesota, then an MBA from the University of Florida's Warrington College of Business in 2003, taken online. He was an early adopter of remote learning before that meant anything in corporate culture.
VMware is where the scale story gets interesting. Dhawan ran end-user computing for years, building VMware's leadership in mobile device management and desktop virtualization. Then came the bigger seat: President. Responsible for $13B in annual revenue. Worldwide sales, customer success, strategic ecosystem, marketing, communications - all of it. He also carried the Chief Customer Experience Officer title, overseeing professional services and technical support globally. When Broadcom came calling with the $70B acquisition offer, Dhawan was at the center of one of the largest tech deals in history. When that deal closed, he left.
Between Citrix and VMware came Instart - a web application security company where he served as CEO and ultimately guided a sale to Akamai. It was a reminder that he knows how to run a smaller, more focused operation - not just drive revenue inside behemoths. It's also why the Proofpoint bet makes sense. Proofpoint sits in a sweet spot: large enough to be a platform, focused enough to win on a specific thesis.
Dhawan's thesis at Proofpoint has three parts. First: consolidate the fragmented human-centric security market. Organizations run too many point solutions across email security, data loss prevention, identity protection, and cloud security. Proofpoint's platform is the answer, not another vendor on the list. Second: deepen rather than broaden. Don't chase every adjacent opportunity - build the capabilities that make the core unassailable. Third: prepare for growth. $2B ARR is a milestone. $5B by 2030 is the destination.
The acquisitions speak to that strategy with unusual clarity. Tessian brought AI-native email protection - the ability to stop threats that traditional rules-based systems miss. Hornetsecurity strengthened the company's position with managed service providers, unlocking a distribution channel that scales without proportional headcount. Normalyze added data security posture management, letting customers discover and classify sensitive data wherever it lives in the cloud. Three acquisitions, three deliberate gaps filled.
Gartner has since identified human-centric security as one of just three strategic imperatives for CISOs in 2024 and 2025. Dhawan was ahead of that call.
