Ahmed Rubaie learned to read systems on a factory floor long before he ran a cyber company. As a student he paid tuition at a ladder plant and found himself watching the line. “After two days at the machine I had run out of things to think about, so I watched the work,” he said. “Plenty of jobs wanted a clear process – some wanted a robot. That is how I still explain AI. It is the same mechanisation instinct, only for white-collar work.” The idea stuck: process first, technology as the scaler. “If you get the process right, tech makes it effective – and it stays effective as you grow.”
His first Silicon Valley tour was at Ariba when “the cloud” sounded like heresy. “People thought we were mad,” he said. “It was never only about technology – it was about shifting risk. Instead of owning infrastructure and headcount you pay as you go.” The software looked like procurement yet the value ran through finance. “In reality we were helping CFOs save money,” he said. “That is where my affection for technology comes from – enabling the business.” The lesson would become a habit: follow the money, then design the machine that moves it faster and with less risk.
Security as management
Rubaie resists the habit of boxing security as a product list. “I think of security and IT as one bucket,” he said. “As digitisation expands data grows and the attack surface shifts, so security becomes a business discipline. It is risk management, like cameras in a hotel lobby.” He entered the field first as an investor.
Operating a security company turned curiosity into mission. “Enterprise data volumes are daunting,” he said. “Our job is to give customers context so they can protect their environment.” Context, in his telling, is the difference between a dashboard and a decision.
Remote work dissolved neat perimeters and gave attackers room to evolve. The answer, Rubaie argues, is not chase but context. “By the time you read about an incident it did not happen yesterday,” he said. “Artefacts can sit in a network for years. Most tools only keep ninety days.” Anomali’s cloud architecture splits compute from storage so teams can hold and query long histories.
“We run retroactive forensic searches at scale and correlate them with billions of live events,” he said. “Done well you move from reaction to prediction – you study behaviour and spot deviations before they bite.” The point is to make time an ally. Keep the record. Use it.
Polishing the Chevy – or swapping it
Legacy stacks need not be ripped out on day one. “Think of us as an optimisation layer,” he said. “We improve ingestion, filtering and correlation so teams can find the needle.” Where culture and appetite allow he goes further. “In one large global financial institution we replaced a sprawl of seven or eight tools,” he said. “We added an agentic-AI layer for analysts, trimmed and normalised data, enriched with intelligence and focused people on what mattered across petabytes.” The result was stark. “They cut budget by more than half – and detections rose on the order of ninety percent year on year,” he said. “That is disruptive architecture delivering more for less.”
For cautious shops the route is gradual. “We ‘polish the Chevy’ first – tune pipelines, clean data, prove value – then step forward when they are ready,” he said. The test is practical: does the analyst’s next hour change. “If a tool does not change what an analyst does in the next hour it is ornamental.”
AI with guardrails
Anxiety about autonomy is real. Rubaie argues for governance over panic. “AI must be done the right way – with ethics and guardrails,” he said. There will be job shifts just as there were on factory floors. “Human beings find new paths.” He applies the rule personally. “As a CEO I use several AI tools in parallel,” he said.
“I am not asking them to think for me – I am asking them to sharpen my thinking.” The insistence is almost domestic. He tells his family – a surgeon, a financier, a future dentist – to look for the gains now, not wait for a policy to tell them what is allowed.
When asked for a forecast he returns to the data plane. “Expect convergence of IT and security,” he said. “Running thirty tools on one side and twenty-five on the other to solve the same problems is waste.” SaaS already won the argument. The arc, in his view, runs from systems of record to systems of intelligence to systems of action.
“Those of us who build in the valley should be judged by the actions we enable, not by the gloss of a dashboard.” Action, in this frame, is the morning queue that is shorter and sharper, the retro hunt that runs across years rather than weeks, the board deck that shows risk and spend in plain figures not counts.
Rubaie’s factory tale endures because it shrinks the noise to craft. Define the work, wire the steps, let machines carry the load while people decide. “Treat it as a data problem,” he said. “Get the process right and technology will scale it.” The line has changed since the ladder plant, but the habit has not – watch the flow, tighten what is loose, and keep your tools honest.
