The Breach Is Decided in Your Network Before It Starts – Midday Keynote Presentation
You built what connected the world, and you decided what could reach what. Then the cloud providers made those decisions instead, the security budget went to agents and detection, and the work became a ticket queue. The network did not stop mattering. For fifty years everyone agreed on its three jobs, encrypt data in motion, govern every exit, segment so one compromise stays one, and almost no one did them, because each one done wrong takes production down. That fear is earned, and everyone in this room has been through it. Now the physics changed. Attacks move faster than any team can react, and the only control that works at machine speed is structural, which puts the decision back with the people who think in paths. Doug Merritt shows how to put a dollar figure on what an attacker can reach in your network. The measure is called Reachable Value at Risk. When you compare your estate before and after containment, the two questions that end every network budget request, how likely is a breach and what is the data worth, no longer need an answer. What remains is how far an attacker can reach and how long they have, and both are numbers you already know how to measure. Uri Fridman, former CISO of SiriusXM, explains why he handed the security decision to his network team. You leave with the metric, the method, and a claim on the 2027 security budget that only your team can make.
Doug Merritt spent six years leading Splunk, the company that defined the detection era of cybersecurity. He now leads Aviatrix, where he is making the case that detection is no longer enough.
As Chairman, President, and CEO of Aviatrix since July 2023, Merritt has expanded the company from the market leader in multicloud networking into Zero Trust protection for both cloud networks and cloud workloads, creating a new security category in the process. In 2026 he declared the arrival of the Containment Era, the industry’s third security era after perimeter and detection, grounded in a simple thesis. Trust will be violated. The only question is whether your architecture bounds the blast radius when it is. Coming from the leader who helped build the detection era, the declaration resonated across the security industry, drawing responses from practitioners, CISOs, and the architects of the very tools he was questioning.
Merritt has backed the declaration with a rigorous body of research on containment, blast radius, and the mathematics of modern breach defense, work that is reshaping how CISOs and boards respond to industrialized attackers, AI-scale offensive capability, the coming post-quantum migration, and a cloud that ships insecure by default. Aviatrix delivers the architecture the era requires through innovations like the Distributed Cloud Firewall, which enforces intent-based policy at every workload rather than at a chokepoint, and cloud-native, quantum-resistant, high-performance encryption. Aviatrix is trusted by the world’s most regulated enterprises—healthcare, financial services, manufacturing, and government—where the cost of a breach is measured in halted operations rather than headlines.
From 2015 to 2021, Merritt was President and CEO of Splunk, where he led the shift from on-premises software to a cloud-first SaaS company. Under his leadership, annual recurring revenue grew from $220 million to $3.12 billion, and cloud grew from less than one percent of bookings to more than half.
His earlier career spans product and go-to-market leadership across enterprise software. At Cisco he was Senior Vice President of Products and Solutions. At SAP, as President of Products and Technology and an extended Executive Board member, he pioneered the GRC solutions division and built it from under $10 million to more than $800 million in license sales in five years. At PeopleSoft he ran the Human Capital Management product division and returned it to double-digit growth. He co-founded and led Icarian, one of the earliest cloud application companies, and later led Baynote, a behavioral personalization firm.
Beyond Aviatrix, Merritt is an active investor in private technology companies with the majority of his focus on the cybersecurity landscape. His leadership rests on five principles refined over three decades: relentless curiosity, leading with empathy, purpose before action, radical accountability, and celebrating success.
Merritt holds a B.S. from the University of the Pacific. He lives in Texas, is married with four children, and has completed nearly one hundred triathlons, a discipline that still shapes how he leads.
