By Sending proprietary data to external frontier models exposes enterprise IP to training pipelines outside your control. Regulatory pressure, competitive risk, and the threat of credential or workflow data surfacing in a competitor’s model are forcing a rethink of where AI runs and what it touches. Telemetry data from applications, networks, and infrastructure adds a second, largely unaddressed layer to this problem.
In this interview on TFiR, Kamal Hathi, SVP and GM of the Splunk Business Unit at Cisco, breaks down how enterprises are separating document data from telemetry data, why both require in-boundary AI approaches, and what architectural patterns are emerging to keep enterprise AI fully inside the enterprise perimeter.
Guest: Kamal Hathi, SVP and GM of the Splunk Business Unit at Cisco
Show: TFiR
Here is what every platform engineer and enterprise security team needs to know.
Technical Deep Dive
Q: Why can’t enterprises handle AI data the same way consumers do?
Kamal Hathi, SVP and GM of the Splunk Business Unit at Cisco, draws a clear line between consumer AI habits and enterprise requirements. Enterprises own proprietary data that represents their intellectual property, and allowing that data to feed external frontier model training pipelines creates direct competitive risk. Consumer AI products are designed for convenience; enterprise AI must be designed for control, compliance, and IP protection.
“The proprietary data that a company owns is very important: their IP is their ownership. And if you want AI to be effective, you need to be able to train on that data.”
Kamal Hathi, SVP and GM of the Splunk Business Unit, Cisco Splunk
Q: What are the two main categories of enterprise data that AI touches?
Hathi identifies document data (legal agreements, presentations, video, audio, health records) and machine-generated telemetry (logs from applications, network infrastructure, and compute) as distinct categories with different risk profiles and different AI use cases. Document data is more commonly considered for AI today. Telemetry data, which is critical for security monitoring and performance management, is underutilized for AI despite being generated continuously across the enterprise.
“There’s another kind of class of data which is telemetry. When you are doing anything in the enterprise, any application, network infrastructure, your logs are being generated all the time. And this is really important because when you think about security, you’re trying to understand whether or not your environment is secure against external threats.”
Kamal Hathi, SVP and GM of the Splunk Business Unit, Cisco Splunk
Q: What is the specific IP risk when enterprises use third-party AI recording and transcription tools?
Hathi points to third-party meeting recorders and transcription services as a concrete example of uncontrolled data export. When meetings are recorded by an external service, that speech data can be used to train new models, potentially exposing proprietary workflows, drug discovery processes, or competitive strategies to external parties. The concern is not just data storage but the downstream use of that data in model training that the enterprise cannot audit or control.
“Having your meetings recorded by third-party recorders, all that data goes to understand the speech, but then it also might get used to train new kinds of models that take your IP and now a competitor understands how to go build a new drug. This is what you don’t want to happen.”
Kamal Hathi, SVP and GM of the Splunk Business Unit, Cisco Splunk
Q: What techniques are enterprises using to run AI without sending data to external models?
Hathi outlines three approaches enterprises are adopting: fine-tuning existing models on proprietary data and running them internally, using retrieval-augmented generation (RAG) to query internal data stores without exporting raw data, and deploying small language models pre-built for specific domains entirely within the enterprise boundary. Each technique trades some generality for control, keeping data inside the organization’s own account and infrastructure.
“Enterprises are trying increasingly to not send that data to an external frontier model, but maybe to have a model, sometimes fine-tuned, run themselves. They do what’s called RAG, which is the augmented generation retrieval. There are various techniques people use in order to avoid exporting data.”
Kamal Hathi, SVP and GM of the Splunk Business Unit, Cisco Splunk
Q: Why are small language models running inside the enterprise perimeter becoming the dominant pattern?
Hathi describes a growing trend toward bespoke, domain-specific small language models that run entirely within the enterprise’s own data center or cloud account. These models are pre-built for specific solutions, tuned by the enterprise itself, and never expose data to external training pipelines. The trade-off of scope for control is increasingly acceptable to enterprises that need to satisfy legal, regulatory, and competitive requirements.
“We’re seeing examples of organizations using smaller language models that are pre-built and focused for specific solutions. They all run in your data center, in your account, in your boundary, and it’s completely tuned by you, completely controlled by you, and it’s not really going anywhere.”
Kamal Hathi, SVP and GM of the Splunk Business Unit, Cisco Splunk
Resources & Documentation
- Cisco Splunk, enterprise security and observability platform with AI capabilities built for telemetry and log data
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Let’s look at this area where we tend to take data, where the AI is and which actually is totally fine with consumers. But that is not how enterprises should operate. So first of all, do you see in the enterprise space the same trend that enterprise are actually taking their data to AI or no, they don’t want to, but they have to. I want to understand the lay of the land.
Kamal Hathi: There are a couple of things going on there. One, I think data is a very broad topic. Most companies think about data that deal with documents or things that are more, I would say human language. So you look at legal agreements, or there are presentations or even videos or audio health data. These are all the kinds of things that people deal with. Now that’s whole different ballgame. You should worry about privacy. There’s all kinds of laws against those kinds of things, which is very important. Then there’s another kind of class of data which is telemetry. So when you are doing anything in the enterprise, any application, network infrastructure, your logs are being generated all the time. And this is really important because when you think about security, so example, you trying to understand whether or not your environment is secure against external threats, someone is exploiting your network, someone is moving around, taking credentials, whatever, right when you are worried about performance of an application, is it running fast enough, is it slow? Is your infrastructure being utilized correctly? Are you using too much power? Whatever it is, these things are based on telemetry and that is the kind of data that actually is not used as much for AI, it turns out. So there’s two interesting categories. But regardless of that, the proprietary data that a company owns is very important for one aspect is that their IP is their ownership. The second aspect is if you want AI to be effective, you need to be able to train on that data. That becomes important for both these kinds of data and we can come back to what that really means. So when it comes to really specific solutions that are built for enterprise, I think enterprises are trying increasingly to not send that data to an external frontier model, but maybe to have a. Sometimes they end up doing fine tuning of various kinds of models, run them themselves. They do what’s called rag, which is the augmented generation retrieval that you can do around it. There are various techniques people use in order to avoid. I think what people are really scared about is for example, having your meetings recorded on people at these third party recorders and all that. And all that data goes to understand the speech. But then it also might get used to training new kinds of models that take your ip and now a competitor understands how to go, for example, build a new drug. This is what you don’t want to happen. So I think there’s a line between what you do with the data, how do you end up exporting it, what kinds of models are using? Many, many. I think we’re seeing examples of organizations using smaller language models that are pre built and focused for specific solutions. They all run in your data center, in your account, in your boundary, and it’s completely tuned by you, completely controlled by you, and it’s not really going anywhere. And that’s an example of something we’re seeing more and more very bespoke, very focused for certain kinds of solutions.
