79. Why Cloud Governance is a Game Changer in 2025 (with Ez Natarajan, Founder & CEO of CoreStack)

Karthik Chidambaram: Hello everyone, and welcome to a brand new episode of the Driven by DCKAP podcast.

We have with us EZ Nararajan, Founder and CEO of a cloud governance company, CoreStack. EZ, thank you so much for joining me on the Driven show. 

Ez Natarajan: Well, thank you, Karthik, for inviting me to the show. Happy to be in the show and sharing whatever I can share for the viewers. 

Karthik Chidambaram: EZ, tell us about cloud governance or CoreStack, right? So what is, for the audience who are not very familiar with CoreStack, what is the core of CoreStack? What does CoreStack do?

Ez Natarajan: CoreStack is basically a SaaS platform that helps end customers or enterprises to use technologies with confidence. When I say technologies, specifically cloud technologies offered by AWS, Google, to build their business applications with confidence that gives end security, optimized performance.

And a business outcome that increases the velocity of the end customer who is using the technology to build their business in the next stages. 

Karthik Chidambaram: But let's say I am a Cloud user, or I'm an AWS customer or like, let's say a user showing. So one of my challenges always has been the rising cost, right?

So they say, you know, they get me and I can get you a free account. I start using you for free. I remember this even at our company at DC care. Suddenly one month we had a very hefty bill and that some instance was running and maybe I didn't notice or something of that, right? So why did this? Why does this problem happen?

And do you guys So that, 

Ez Natarajan: that's sort of the very basic foundational problems that we address as part of our core side, one of the product, we call it as Spinoffs. It basically addresses, you know, how effectively are you using the cloud? Are you paying for the value that you're getting? And is there any scope for you to optimize your spend without compromising the outcomes that you're getting?

Right? So that kind of covers it. And it's a ton, like your providers, they get you with free accounts and desubscriptions and only use the cloud and you start building your applications in the cloud. And eventually you find that now I am in a position of not being able to move out and I do end up paying.

So you don't want to move out because the technology is not valuable. You do not, you want to move out because you consider the cost you're paying is probably higher than what you think, what you think would pay with other providers or what is the value. that you're getting as a return on investment.

Costac solves the return on investment problem for you. Exploiting the underlying technology, getting the customers the best outcome of whatever the technology they have chosen to use. If you feel confident that I'm getting the best, but there is nothing you're going to feel that, hey, am I overpaying?

Because that's the best you'll get. So we solve the missing dimension of, are you getting the best? 

Karthik Chidambaram: And do you guys cater primarily to larger customers or do you also cater to mid market customers? 

Ez Natarajan: We our sweet part I would say is Fortune 1 to Fortune 25, 000 customers, right? As part of GoToMarket, we work with these segments of channels and partners in the ecosystem.

We work with managed service providers. We work with the world's largest distributors. We work with the systems integrators and the global large systems integrators. We work with the WOS. So based on the kind of challenge that leverages the technology to create the value for end customers, you know, we end up catering to SMC or SME to upper mid market to typical enterprise.

Again, Fortune 5000, MRI segment, the remaining, we put it on a SMC, SME segment. That's what we cater to. Largely, Elmore market is primarily through champions and partners. 

Karthik Chidambaram: So at DC Cal, you work with a lot of distributors, right? So distributors is our core market, large distributors and no market distributors as well.

But these distributors, a lot of things have legacy systems. Things they're trying to do, say they want to move to the cloud and let's say I want to move to the cloud. I'm a distributor. I want to move to the cloud. I have three options, right? AGI, Amazon, Google, Microsoft, and then there's also Oracle and other providers, right?

How do I know which one to choose? 

Ez Natarajan: This is a big question because most of the times, you know, unless you are a greenfield startup or a new generation company that is starting on cloud. The question of how do I choose is answered intrinsically by what they're already doing, how they are doing, and what are the choices they have to leverage the newer technology, right?

In our case, we see more than 70 percent of the enterprise customer base is virtual reality. It's a brown sheet. There are, you know, started in the last 10 years only. There are companies that have started, grown big in the last 10 years, but most of the, you know, customers have had the streets be cloud ish.

So they had business applications, they had their workflows, they had their services, and the choice of what technology to choose has been very easy for them, right? But how do I transition to that? The complexity lies there. The choice of where do I transition, that becomes easier. Whereas for the Dreamfield companies, technically, as you said, right, I know, hey, who gives me the, you know, the compute or the total services at the low cost, that because the initial driver, but that because the trap for you to get in and it's trapped on the technology.

But now the, you know, true multi cloud architecture, multi cloud cloud process and the fact that it's the way you understood today, hey, you, you don't want to be with. One cloud technology for reasons of cost alone, rather than cost of value that is getting created. And today, some of the services of AWS is outstandingly great compared to the competitive providers, right?

Same with Microsoft, same with even BigQuery is the top selling service for Google, right? So the choice of what do I want to use, I think in the greenfield companies, based on what they want to achieve. And all of them have technology experts. Who either in house or an advisor or a partner who actually drives the technology for them, advising them, Hey, you need to broadly choose this technology.

What CoStat does is, how can you extract or maximize the value of the technology that you have chosen? One dimension. The second dimension is, what is the glass ceiling that is available on the technology that you cannot get anything more? You extracted the maximum out of it. If you're continuing to choose.

Extract more, or you want more outcome, then probably your decision on the technology needs to be revisited. And that because we go to, you know, we create value for the end customers through partners, the partners, you know, it eases or it makes the job of the partner easier to advise the customer, to counsel the customer, to show them what is the ultimate path that is available and all of that shots.

So we truly became an, you know, truly agnostic platform in terms of not suggesting. What you should use rather than how to maximize the outcome of a technology that a customer has already chosen. 

Karthik Chidambaram: Okay, so the customer chooses the technology and you try to maximize the outcome based on the technology the customer chooses, right?

But on the cloud, let's say I choose AWS and then for the same application. Can I also choose Azure? 

Ez Natarajan: Yes, there are customers in the enterprise segment and even in the mid market, we see that they truly build, you know, business continuity and availabilities of 3, 9, 4 miles or even some applications are going to like Media Ahead time where they gave me.

We see that 5 miles of availability is needed because even one night of availability causes them, you know, a few million dollars of business for them. So they're willing to pay a little more and build resilience. Across platforms and with, you know, a grand of no containers across the platforms. More and more containers are coming in so you can run this.

EKS or AKS does not matter. So the decision of wanting to run on multiple platforms to meet the solidity requirements if they are geographically in different, you know, countries to build the business continuity from availability standpoint or even to meet the regulatory requirements, right? I know they prefer, you know, to Cannot have the data move on.

So there are regulations, there are sorority, there are performance, even cost for that pattern becomes a driver to choose, you know, between the tutorial and OX. 

Karthik Chidambaram: And course track helps with that in terms of, let's say around Multiple platforms. Coastside also does it. 

Ez Natarajan: Yes. Coastside is a true multi cloud platform that starts with an assessment of what is your current maturity of using the tool?

What's your business? In which regions, which countries, which geographies are you operating in? And what are the regulatory requirements about that from a regulatory standpoint or from a geography standpoint or from a compliance standpoint? And then how well are you using it for performance, availability, cost?

Automation all of that dimension and gives you a like a blueprint of a trace of maturity is this. And based on the technology you've already chosen, what is the gap that you have and how much can they quickly, you know, address? And then you, you first start to build that gap, right? Once the partners actually help build the gap, then comes the choice of, oh, how do I increase the velocity?

If I have to get more outcome, if I have to, you know, increase my throughput, if I have to increase my performance, if I have to add more customers, if I have to add, you know, more regions, what do I need to do? What technology is best? And that comes the next piece 

Karthik Chidambaram: and choosing the platform also depends on the skill set, right?

I mean, obviously, if I'm very good at AWS, then I also need to learn Azure. There needs to be a different thing for us. It's all that comes into play as well, for sure. 

Ez Natarajan: In the last five years, if you look at- it was talent as being one of the key drivers of choosing a technology based on customers existing investments on their people, right?

More and more, what we see is the acceptance of multi cloud is becoming very vibrant with the technology providers themselves. Few years ago, AWS wouldn't have accepted multi cloud, right? So, but whether it's like SOP or Google, okay, accepted it for sure, yeah. But now all the top providers accept that the reality is, hey, I have to co exist with other technology and that has allowed the knowledge ecosystem to build on a natural basis.

So today you find a talent in the market, you definitely will find a talent who knows clum, not just one clum, it's probably at least two clums, a lot more. Once you know, the capabilities and how to leverage, how to use, how to, you know, manage the basic services of two clouds. Learning third fourth is not a big challenge, right?

Knowledge as such from an employee standpoint is not a key driver to choose a technology. However, there may be an additional investment that is required. If you have chosen a technology that's not in the company, not being used, And you chose it for specific business reasons, then you need to actually augment additional response of, you know, training and elevating the employees and that is where the partners come in, right?

So when, when the cloud providers accepted multi cloud, now the part of the ecosystem has truly moved and that is there. Costa kind of platforms thrive because we are a true agnostic multifold platform committed to deliver are committed to maximize the value of the cloud for the customer through the partners.

So we have capabilities for the partners who. You know, partners can use that to deliver the value and the value on a two multi cloud deliver to the customers. So it becomes an easy outcome for see the best value by us. 

Karthik Chidambaram: So we talk about maximizing on prem. Can you also talk a little bit about cloud governance?

What essentially is cloud governance and why do I need it there? 

Ez Natarajan: And we coined this term cloud governance six years back, right? Thanks to my CTO for coming up with these words about cloud governance, because back then the industry was talking about cloud management, that even Gartner had a partner in cloud management the other day, some thoughts about cloud management.

So we, you know, have been taking the lead to understand cloud governance. Because governance at some point of time has been thought of as a velocity reducer. You put roadblocks, you know, at the moment you talk about governance, but what we said was, you know, governance is an enabler. You want to do things right and fast, right, but the traditional understanding of governments is you end up doing things right, but then you end up things being slow, but cloud, the advantage of cloud is velocity.

The advantage of cloud is speed. The advantage of cloud is. You know, getting there faster than ever before. And if you don't have governance on that, then you're going to, you know, compromise many things. It can be security, it can be business, it can be money, it can be, you know, your reputation. There are a lot of things around it, right?

How can you put a governance on a system that is fast moving? Cloud itself is fast moving, it's high velocity. When you say, I want to govern the fast moving stuff, it cannot be reducing the speed. And that's where we said, you know, we want to introduce cloud governance, and we defined the basic tenets or codes.

You know, cloud governance to us means building the C level or C suite of a company who are very critical for the business to perform. So who are those C suites? You know, a CFO comes in. A CIO comes in, a CTO comes in, a Chief Information Officer comes in. So these are three or four people who are core for the business to function.

I have head of product and development, I have head of technology, I have head of finance, and I have head of security compliance coming together. See the elephant or a dinosaur with a single source of truth. In the market, because governance was not defined, for the management, there have been a lot of point solutions and those point solutions led to multiple sources of truth.

And the C suite has always been looking at a merchandise source of truth and never been able to make conscious, consensual decision that will move the velocity forward or that will move the business forward. What COSAT did was, we said, our top governance is going to address the financial part of it.

It's going to address the automation, availability, performance part of it. It's going to address the security and compliance part of it. That's the three basic targets. And any new services customers want to use, even today, the last four months, Apple, the advent of Virgin AI, there have been a lot of AI services.

Let's call it as new generation of computing capabilities that are coming in. Those need to be used in a, in a cohesive way that delivers outcome. And they said this is, this defines cloud governance. And this brings the, the C suite that I talked about. CFO, CIO, CDO, CSOs come together to solve the risk problem.

That's how the o holistic Cloud governance ship emerge. And we continue to believe that we are moving the needle because our industry is talking about cloud governance. Now, if you see AWS leaders and they go to the stage, they talk about, Hey, our governance is important. You know, you see that from a Microsoft, you see that from Google.

So we take pride in saying that, you know, we're calling that word first. 

Karthik Chidambaram: So essentially you create a category with dominance, right? Cloud dominance, yes. Yeah, and talking about security, right? I mean, I think that's also a very big challenge, right? For instance, I had one of our customers there in healthcare and they had a leak security breach, right?

And that was an AWS instance. But we didn't even know that that was happening, right? So it's actually a mistake from our end as well. So how do you deal with that? And let's say I'm a distributor, okay, or a manufacturer, what are some of the basics I need to take care of in terms of security? 

Ez Natarajan: First of all, security though, Karthi, needs to be everybody's challenge, right?

Or everybody's responsibility. The cloud providers basically provide basic security guardrails, not an outcome. It's a guardrail given to you as part of The services they offer, turning off the guardrail, turning on the guardrail, defining the limits of the guardrail is all into the customer. When it comes to securities, most of the times what happens is, when you don't have a continuous guardrail validation ecosystem, nobody starts bad.

You buy a new refrigerator, you know, buy a new TV, you don't mishandle it in the first week, second week, third week. But then when everybody in the household starts using it, that's when some settings change, some display modes change, you know, all that happens, right? So it's the same thing that happens in the cloud world, where after a few weeks, a few releases, a few engineering updates that are happening, you know, you, the guardrail that you set from a security standpoint, say, in this case that you talked about, you know, and encryption, and then, you know, authorization, authentication mechanism, which is truly validated.

Could have stopped this from happening. I'm sure day one, there was authorization, authentication, and encryption, it was all there. Someday, some point of time, the authorization could have been, you know, revoked for some technical reason. Or encryption could have been revoked for some technical reason. And then the report, no.

That's it. Then onwards, you know, you are, are you know, less acute the surface, which is going to compromise you. And obviously the attackers are out there. Right? I mean, everybody, you know. And when they find the vulnerability, that's it, you are getting exposed. So that is where Coastrack comes into the picture.

What we guarantee as part of our SecOps offering is a continuous, and not just on our SecOps, Coastrack platform is a continuous cloud owners platform. Right? You do some things knowingly, unknowingly, the next They on the next action on the next to the point gets you back to what it was supposed to be from a guardrail standpoint, right?

So companies can define my guardrail. Hey, this is my guardrail. This has to be always kept. If you have to create an exception to break the guardrail for some reason, tactically, for some period of time, you may have funded Boeing visiting it, but CoStat takes care of going and putting it back without your knowledge.

And that kind of automation ecosystem is not offered by your providers. This companies have to build on their own with the basic capabilities that are being offered, or they have to depend on some tools. If you go with the point solutions, they do it for their divulgation. Say a FinOps tool will do it for finance optimization.

And you may never pay, overpay a bill, but that would have compromised your security. That would have compromised your availability. A security solution would never let you You know, be surprised on a security, but you're going to be surprised by cost to the next month. And this is where a single source of truth and integrated platform like CoStack is needed.

And we see the demand more and more and more now because the unit of consumption by a customer per year is on the next and that means that customers are spending more money every year. So they want to get an outcome that is optimized across the board. You know what we define as our own setting. 

Karthik Chidambaram: This has been a fascinating conversation, EZ.

Learning about cloud governance, at least for me, right? It's like cloud governance 101. So that's been great intro for the audience as well. I would like to end with this question. How do you keep yourself updated on what book are you reading right now? 

Ez Natarajan: Reading has been one of my passions, I would say. But, you know, getting time to read is a challenge.

The latest book I'm reading, I've been advised by many of our well wishers, is Built to Last by Jim Kollitz. I'm reading them right now. But there are some books I've, you know, mentioned that for people, it is a mental insight for reading, that moved me to do things in a little better way. One thing that I say for anyone who wants to improve their productivity and get a better outcome over a period of time, read the book called Compound Effect.

It's a very, you know, pressuring thought process and a mindset that you will build to do things on a continuously better way. The other book, if you want to change your lifestyle, if you want to, you know, you can do anything, just get off your technology. If you want to change your life forever, you know, one must read Robert Kiyosaki's Rich Dad Poor Dad and the Conspiracies of the Rich.

Version 2 or of the second Conspiracies of the Rich is a must read book if you want to become rich, so. 

Karthik Chidambaram: Thanks for these great recommendations, Ez. I really enjoyed chatting with you and thank you for your time. 

Ez Natarajan: Thank you very much, Karthik. Really appreciate how you made the show. 

Karthik Chidambaram: Thank you.