For someone who has spent most of their life in a tropical land, Pune, India, landing in Minneapolis in February with temperatures of -30 degrees Celsius can be daunting. Little did Sumedh Thakar realise that close to two decades later, he would become the CEO of Qualys, a cybersecurity company in the US.
“We had to walk to the office across a frozen lake. It was a shock, and in hindsight I would say a crash course in resilience – observe quickly, adapt quickly and keep moving,” recollects Thakar. For him, choosing computer engineering in a city known for its automotive sector wasn’t an obvious route, but curiosity got the better of him. Thakar’s first role was building pricing logic for an airline reservation system. “This was before I had ever taken a flight”, added Thakar.
While Thakar, CEO of a cybersecurity firm, doesn’t see himself as a security visionary with grand plans, he’s a pragmatist driven by curiosity. After starting his career at Patni Computers in Pune, he dreamed of working in the US, but the company he joined in California failed during the dotcom crash.
“Getting laid off isn’t something that you discussed openly with people back home. Failure sticks to you in our culture,” explained Thakar. Thus, the choice to join Qualys then wasn’t a dream to build in cybersecurity; it simply was a serendipitous opportunity in front of him.
However, the inflexion point came when internet banking was launched back home in India for the first time. Thakar realised then, despite the convenience it provided, his father preferred the cumbersome method of queuing up at the branch, as he did not trust the internet passwords.
It crystallised a simple truth for me – technology only wins when people trust it. Cybersecurity would be the enabler of digital life,” added Thakar. It was a decade ago that Qualys promoted a position that is now mainstream – there is no security without backup and no backup without security.
Modern frameworks reflect that integrated posture. In 2017, Qualys introduced Active Protection, which utilises machine learning to detect and block ransomware targeting backups – a foundational step in protecting the very mechanisms of recovery.
Today, AI sits across the platform, not just at the endpoint. The goal isn’t only sharper detection; it is to reduce the cognitive load on defenders – to automate repetitive triage, suppress false positives, and surface the proper context so humans can make better decisions.
“Practically, we give customers a hacker’s eye view of their estate so they can close likely pathways before adversaries exploit them. Crucially, we’re leaning into agentic AI – goal-oriented, task-specific digital workers that deliver outcomes, not open-ended chat,” added Thakar.
Within the Risk Operations Centre, Qualys has launched an AI marketplace where teams can “hire” agents, such as a ransomware analyst, who will conduct a week’s worth of evidence gathering, prioritisation, and remediation workflows under human oversight.
“Anyone who has tried to recruit a specialist for a two-week surge knows how impractical that is; digital workers let you scale capability immediately, while your scarce experts focus on judgments that genuinely need them,” said Thakar.
Along his career path, Thakar progressed from engineer to manager, to VP, and ultimately became the President and CEO of the company in 2021.
“Along the way, we opened our Pune centre from a tiny space above a Blue Dart depot on JM Road; we interviewed candidates at a café on the corner so the office wouldn’t put them off. Today, a significant share of our innovation originates from Pune. The through-line is the same: seize the opportunity in front of you, learn fast, and focus on the societal value of secure, trusted systems,” recollected Thakar.
The math is simple: we all get 24 hours in a day. Thakar believes that to multiply impact, you must build and empower an exceptional team. “Early on, many of us try to do everything ourselves; you quickly learn you aren’t brilliant at everything. And even if you were, you don’t have the time to do everything. The shift is to hire people who are better than you in their domain, set a clear intent, remove blockers, and let them run. It is then that leadership becomes a force multiplier,” explained Thakar.
The job is about building clarity, alignment, and enablement: be precise about the outcome, ensure everyone shares the same picture of success, and create the conditions for talented people to execute effectively.
“That also means being comfortable with approaches that aren’t yours, provided they serve the goal – and having the discipline to step in only when intent and outcome diverge,” said Thakar. However, what keeps him going is the race that never ends. When one paradigm is stabilised, the next arrives.
“It is AI today, which will soon turn to quantum. Attackers evolve, so defenders must evolve faster. That perpetual motion keeps the work meaningful. There’s always a hard problem to solve, and when you solve it well, the upside is societal: safer payments, trusted identities, resilient services that people can rely on,” explained Thakar.
It is Thakar’s pragmatism that shapes how he reads this current wave. He explained that we’ve gone from the cycle of client-server to virtualisation to cloud. In this AI-native era, companies compose AI services to deliver outcomes instead of writing everything from scratch.
It’s a fork in the road: incumbents that bolt AI onto old architectures will be outpaced by those willing to re-architect around it.
Today, attackers run like businesses – they have targets, cadences and incentives. Artificial Intelligence lowers its cost to probe millions of assets and identify weak links that can lead to breaches. However, defenders too can wield the same leverage. “The approach is to inspect the environment exactly as an adversary would, close the most probable paths first and then use agentic AI to shoulder the heavy lift so experts focus on decisions that move risk,” explained Thakar.
“I was never excited by open-ended chat for operations; goal-driven agents that produce measurable outcomes are the step-change. Pair those agents with governance and human-in-the-loop control and you get speed and safety: what to fix, in what order, with what evidence – executed faster than a human-only team can manage,” added Thakar.
None of this is carte blanche for chaos. Thakar argued for speed with guardrails: strong governance, clear ownership, visible metrics. Of the growing regions, for Qualys, META is both an ever-increasing revenue contributor and a co-creation zone. The company brings global lessons and also learns about local requirements, including sovereignty, speed, and sector context.
In a region that’s economically, technologically and politically dynamic, he sees the Gulf investing heavily in secure growth.
“A company is its people, so consequential missteps usually stem from three areas. First, vision: I wasn’t clear enough about the destination. Second, alignment: I assumed a shared picture when it didn’t exist – tell ten people to draw ‘the big tree in grandma’s backyard’ and you’ll get ten different trees. Third, people: I didn’t hire early enough, or I hired for skills rather than fit, resilience and learning velocity,” he added.
No one makes a decision believing it’s wrong; only outcomes render that verdict. The discipline is to learn fast, be transparent about reality and move forward with tighter alignment and stronger teams. “When hiring, I’d rather hear a candidate walk me through a failure—what they learnt and how it changed their practice – than hear they’ve ‘never failed’. In cyber, as in life, resilience compounds,” said Thakar.
His advice to tech leaders: don’t fight the wave, lead it. Challenge teams to rethink architecture, workflows and operating models for AI-native execution. Tie investments to risk-based outcomes, what threats are removed, which controls are automated, which costs are taken out, and measure them.
“Push for speed with strong governance. People get comfortable; part of the CEO’s job is to keep the organisation constructively uncomfortable so it doesn’t get left behind. Our own natively built agentic-AI capabilities within the Risk Operations Centre came from that constant internal challenge,” Thakar concluded.
