David DeSanto on Anaconda’s AI Platform, Open Source Growth, and the Future of Secure Software | AWS re:Invent 2025

Hey, good morning everyone. It's Alan Hummel, and welcome to our day two coverage of AWS Reinvent 2025. We're live at the win, uh, right here in Las Vegas, covering reinvent.

And, uh, I hope you had a chance to look at some of our coverage from yesterday. We had some really great discussions. We had a lot of analysts, a lot of different AWS partners.

We hope to have some AWS people, I think we have scheduled later this afternoon as well. But let's kick off our day with what, for me, personally, is a highlight. If you've ever watched our event coverage in the past, this man may be, uh, familiar to you.

My friend David DeSanto. David, well, if you know David, you know this, but David ran product at GitLab for five years, Uh, three and a half years of CPO and yeah, two and a half before that. So you're either there about five and a half, six years.

Um, always a really smart guy. I always a great interview. He loved talking with him, but he's not here.

This is not David DeSanto of GitLab anymore. This is David DeSanto. I'm proud to say the CEO of Anaconda.

David, first of all, congratulations, man. Yeah. I'm really happy for you.

Oh, thank you. Yeah, I, uh, truly excited to help Anaconda go into their next chapter. Absolutely.

You know, I, I, I didn't hope didn't embarrass you, anything like that, but I wanted to talk about the GitLab experience because for our audience, which is DevOps and Cloud native mm-hmm. And cyber and so forth, you know, GitLab is a, is an important company in the ecosystem. Um, and you are an important person in taking that vision and running with it.

Tell us how you wound up at Anaconda. Yeah. So first, yeah, it was a great runick at Lab.

We saw the company grow almost exponentially. It was less than 300 people when I started, and my last day was over 2,600. Right?

And so, uh, the journey to Anaconda does start with GitLab. Going to GitLab. I re-embraced the open source community in a way that I hadn't since ICSA labs many years before that.

And that time was great, you know, uh, our first conversation was me coming out and saying like, we are going to add security and compliance to GitLab. I remember that. Yeah.

And then, uh, the last quarter I was at, that's part of their revenue is over 53% of it. So it was a really great run, great company cheering them on. Absolutely.

Uh, but yeah, I was ready for my next challenge. And so when thinking about what I would do next, I explored, do I wanna stay in the DevOps space? Do I wanna go back to security?

And I realized I could do security and AI all in one place. And that was Anaconda. Aha.

There's, there's the word, two minutes in, and we've mentioned ai. Yep. Um, Well I think I said this once before, but you can't spell David without ai, so That's true.

So yeah, This is true. You haven't mentioned that one. My, My wife did say, I have to stop telling that joke, but Well, look, we've got a new audience here.

You got a new title. They may not remember it. So, David, some people in our audience I'm sure are familiar with Anaconda, but there's plenty of people who aren't.

Let's, let's start real foundational and build our way up. Give us the Anaconda story. Yeah.

So Anaconda came out of a consultancy. The two founders of Anaconda had a company called Continuum Analytics, and they were doing consulting work for data science within the financial services space. And what they found out was that they were building new Python packages to support the work they were doing, and they decided that, hey, this should be a product company.

And so they started Anaconda, the first products name was Kanda. And that's what a lot of people think of that provides thousands of trusted, secure data science and AI packages for Python. Uh, but the company has continued to grow beyond that.

And one of the reasons why I joined is the story that they are currently on. Anaconda can help you with secure python development, but we do so much more than that. Uh, earlier in the year we launched our AI platform that helps you apply security and governance policies to how AI applications are being billed, really.

And, and the yeah, the most recent, which I'm the most excited about, I cannot take credit for it 'cause it, you know, came out I think three weeks after I started. But, uh, our AI catalyst component of that platform, what it does is provides a curated list of open source models that we have validated or secure. We include the lineage of where they came from, how they were trained.

We Oh, I love that. Yeah. We rate them on performance and that could be in different quant sizes.

And we also then give them the guardrails to make sure that it operates as best as it can. And so what really excites me about it is we are already helping people run inference, and it kind of starts a desktop app before we became a platform and now a, a SaaS offering. Mm-hmm.

But the cost to run AI models as part of development is very expensive. Like I learned that when I was at GitLab. Right.

Um, and so what we've done is also make it possible to run a micro in inference on the developer's laptop. Wow. Which then is that same model that needs to, So you don't pay the token penalties.

Exactly. And then when you're ready, we can see what you did with the model locally and tune as it gets deployed into production. So, wow.

Yeah. The best way to describe it is, you know, what a GitLab is for DevOps Anaconda is for AI native development. You know, it's funny you mentioned that term.

I was, I was out in Brooklyn actually a couple weeks ago for this AI native Devcon. Hmm. There's this whole burgeoning community, um, you're probably aware of AI native development.

Yep. Uh, uh, guy Ani from sny, who's now, I forget, the Tesla is his new company. They're very active in that community.

Um, and I, I went out there, I was blown away. It re it reminded me of going to a DevOps days 10 years ago. Yeah.

Right. That, that same tinkering, geeky we can make, I love playing with it kind of stuff. And it was, it was a, it's a great community.

Um, let me just kind of shimmy eyes this for, if you don't mind. There. There you go.

So we, we've got Anaconda started as a company providing services on Python scripts And helping companies with their data science development. Yep. Hence the Python Anaconda connection.

Exactly. Okay. It then shifts to more of a product model, but it's an open source product model, which is still open source today.

Yes. Oh, Correct. Yeah.

We have a very healthy, free offering. Mm-hmm. Uh, it allows people to get in the door using Anaconda and mm-hmm.

One of the things that really blew me away as part of the process to join was that 95% of the Fortune 500 use Anaconda today. Really? Yeah.

And we have over 2 million, uh, community contributors. That's correct. And 50 million users.

2 million contributors, yep. Code, yeah. Code contributors to the open source Source codes.

Wow. Yeah. It's actually a really great story.

Uh, one of the founders is, uh, Peter Wang Uhhuh known very well in the open source community Sure. And within the data science community. And he's still an active part of the company.

Mm-hmm. Um, you know, he and I talk about what we wanna do next together. Yeah.

And that reach that we continue to have is because he is always out meeting with customers, potential customers. Two weeks he's in Boston for a, uh, meeting around how do you set some AI standards Yeah. As part of development.

And so we continu to lean into that because, you know, that is really the core of the company to your point. Yeah. You know, we started as a package manager condo, but now we have the AI platform and we wanna allow people to still come up, get used to using it, get the value out of it, and then want to come and then join and, and pay for either our shorter tier or enterprise tier.

I love it. I'm gonna jump into what the story, the, the different tiers are in a bit. I wanna come back to what you were mentioning this newest offering that you're so jazzed about.

Yeah. The AI catalyst. Yes.

The AI catalyst. Now look, you mentioned package managers. It's been a rough couple weeks for package managers, hasn't it?

It has with this shy ude and, and all of that. It sounds like this AI catalyst may be just what the doctor ordered, right. If, if I'm a user mm-hmm.

Of of package package manage, uh, package packages, I wanna make sure that my package manager's giving me something that I'm not. Correct. Introducing malware into my, my ecosystem.

This only works though with the AI models that you're using, right? The AI packages if you Will. Uh, yeah.

That and all of the con packages. Okay. All the condu.

Yeah. So because we still use the con package manager, um, we have a very unique build system for building all the packages we provide. And so we're able to actually take things apart, fix the vulnerability, and say in the binary part of the package, put it back together, and then make it available.

And so a lot of people think of anacon to first as a trusted distribution because we're providing, you know, to thousands of Python packages that we know are secure and are able to scale. Now. I get it.

Yeah. I got it now. It took a little while.

Sometimes I'm slow on the uptake. Oh, no. And, But if you think about it, there's then that natural transition into the platform, right?

It's one thing to start your development, but it's not thing to get that prototype into production. Absolutely. And, and look, I, you know, just quite frankly, it is, you know, we live in a world of, let's call it Frankenstein software, where software is more assembled than code written, if you will mm-hmm.

At some level. Right. And, you know, and you security background, you know this, we talk about software, supply chain security all the time and, and how stuff, you know, SBOs mm-hmm.

And what have you. I think the biggest weakness in our system today is the software and packages that we're downloading from all these repos and, and, and depots and what have you. So, you know, the fact that you're do, you're on guard here with the condo packages mm-hmm.

Is, is a huge thing. Give us an idea of scale if, you know, you may not know this off the top of your head, but like how many downloads a day, a week, a month? Yeah.

I don't, don't know that off the top of my head, but Kanda is hit all the time, almost 24 7 with people pulling packages. So very healthy community. That's how we can have 50 million users really, uh, yeah.

Using Anaconda every month. The thing that is the most incredible to me is what you just touched on. And this is part of that why joined in the journey.

Uh, you can only do so much with the actual packages themselves. Yeah. But when we're talking about the platform, there's like the starter, which is kind of like, hey, a team's getting together.

Uh, but the business tier actually provides what you're talking about. It provides an AI bill of materials, can track vulnerabilities for you. Uh, we're working on how to help auto remediate those as well.

And so the customers that end up on a thing, like the business tier of the platform, they're getting, uh, full visibility into their AI life cycle. And that's really powerful. 'cause as you said today, it's very common that vulnerabilities will sneak in some way.

And we're heavily reliant on packages that we've not created. We're reliant on our IDs to be secure. We're, you know, worried about the things that happen after the code is merged.

And anacon is just in a really great spot to help with all of that. You really are. You're right, you're right at the, the nexus, if you will, of, of where all these come together.

I love it. Now you mentioned different tiers. Mm-hmm.

So obviously there's probably a free open source tier where hey, it's open, it's open source, have at it. Then you have, you mentioned the SaaS model. Yeah.

So the product, uh, you can self-host. Mm-hmm. com.

Mm-hmm. Um, but yeah, the big difference is not necessarily whether you're hosting it yourself or using our, our SaaS offering. It's really about the free version gets you up and going, if you're an individual developer provides you a lot of power.

If you now wanna operate as a team and start having some structure around it, you go into the starter tier, which starts to introduce a lot of that. Um, but when you're ready to talk about AI bill and materials security and governance and having policies that prevent malicious packages from being installed, then you end up on the business tier. And that's where all that security and compliance functionality is, including dashboards, policies you can create and so forth.

I love it. Um, to, so I'm an old school open source guy. What pers 50 million users is a crazy number.

Yeah. You may not know this, you may not be comfortable even saying it. What percentage of those are just pure free open?

I mean, usually it's 98, 90 7%. Yeah. Yeah.

So there, uh, a large percentage of it is that open source community. Sure. Um, but that's something that's very important to us.

Sure. It is. You know, what I learned, uh, working with Open Source, I'm so excited to be, you know, leading a company that has a open source first mentality is that like you get more value out of that free tier than you could if you try to bundle that up and put into a paid tier.

And it's ultimately because you get all those contributions, uh, you actually are able to get onto the community, be it events like reinvent Yep. And have conversations with the actual builders and doers. And that's not something that commonly happens if you only start with a paid option or you're not open core.

I love it. Let's, um, let's talk a little bit about Reinvent. You mentioned it.

Yeah. We're here. Um, is there like a formal partnership?

You know, what, what are you doing at Reinvent? Yeah, so we're in Booth, uh, 1327. Mm-hmm.

So if you're at the show and you wanna check out, you're watching This live now, you wanna run down there, go run down Run, uh, before we run out of giveaways and swag. Right, exactly. Uh, some really great swag.

But, uh, in our booth we're actually demoing the AI catalyst offering and we're showing people all the other things Icon can do that are not just, you know, being a package manager, uh, but to speak to the partnership AI catalyst this new com Yes. Part of our platform that launch exclusively on AWS and we joint announced it yesterday. Oh, Great.

Uh, and it also included that it's now available in AWS marketplace. You can go and, and buy it yourself. You don't have to go through all the hassles of like, the steps to get to that point.

I Love it. What do, and so yeah, that's a good example of the partnership mm-hmm. And spill right on top of AWS but there's so much more we're looking to do with 'em.

Uh, you know, we're looking for better integrations into Bedrock customers, like using Anaconda with SageMaker. So getting a nice embed story there. Yes.

We were just talking about SageMaker this morning on Dextron Gang, And so yeah, the partnership is great, but we're just gonna keep on building on top of it because they're a really good partner. You know, I've worked with 'em across multiple companies and yes, they're always exactly as great as they seem and that's really great to have a partner like that. Absolutely.

You, you know what's interesting is I I I, we were talking off camera and I, I mentioned, you know, this year's reinvents a little different. It's very AI focused and everything else, but I'll tell you what it is focused on, it's laser focused on developers. Mm-hmm.

Right. They really are kinda reestablished because when you, you know, you've been around, you know, I know it was the developers who made AWS Yeah. It was those guys whipping out their credit cards and, you know, building in spinning up instances and, and doing stuff that, that made AWS what it is.

And it, there is a renewed focus on the development process. Of course, AI is changing how developers develop, and it sounds like you're, you're responding to that as well at Anaconda, but make no mistake, that's the focus here. Right?

Yeah, no, what I would say is, I, I took away a couple things, uh, just from Matt's opening keynote. Yes. Uh, the first is, it's all about the hardware.

And I think that's something that people don't always think about. You know, we were talking, Well, that was supposed to be the thing about cloud. You didn't have to worry about the hardware.

Yeah, That's a good point. Uh, but I was gonna say the, uh, you know, when you're talking about ai, it kind of starts at that, right? Yes.

You gotta have the right tructure. It's made hardware sexy. Yeah.

And so to see that lead off with mm-hmm. What they're doing to make it a lot approachable for non-developers to get into an environment and know it can work was really good. Uh, definitely the AI lean in mm-hmm.

Uh, was very, uh, prominent as well. But the one thing I would say, uh, and it, I can't believe I'm saying this, like it's my first reinvent, you know, but what it feels like is like if you were to take, uh, a cube con make it significantly larger, Four types of size, and It's only about the developers. Yeah.

Like that's the, the vibe here. And it's actually great. Yeah.

So this is, I don't know how many, certainly since COVID is the fourth, probably yet since COVID alone, um, this is pretty much it. It's, it's, it's a, I mean, you know, it's nice. CubeCon is the, like a perfect size.

Mm-hmm. 12,000, 14,000. It's big, but not too big.

It's a, it's kinda like building a company, right? Mm-hmm. You can build a company that has 10 million, 15 million in revenue, and you have one kind of management team.

You go wanna build a company that has 75, a hundred million in revenue. It's a different management team. Mm-hmm.

You wanna go build a company that's IPO-ing, it's a totally different animal. It, it's the same thing with conferences. You get a conference of 60,000 plus people.

Mm-hmm. You, you, you know, hyperscale, it's, it's, it's about scale and they do a great job with it, considering everything that's going on Here. Yeah.

No, and I would say too, for those who are watching this and are here but haven't really like, gone over to everything that's going on, it does not feel like there's that many people here. Like they've done a really good job. Yeah.

Being, Well, it's spread, spread so forth. Yeah. I, I agree with that.

You know what, David, we didn't even mention the website, how to engage. Of Course. I mean, obviously it's open source, you can get it, but what, what is the best website?

Yeah. com in there. It'll point to the dis uh, installers.

If you wanna install locally, it can walk you through creating an account for SaaS and getting up and running really quickly. Uh, the other thing is that if you just go to like the doc site as well, to your point, you'll learn about more of the open source focus and how you can contribute code. com.

But ultimately, like what I would say is if you're looking to build AI, and you might not be a developer, or in some cases, you know, I won't say I'm very young, but like I programmed in, you know, c outta college, right? But I don't know how to get into Python. With Python now being the number one language worldwide and ACON can help you with all that helps you build applications even if you're not technical.

Well, AI could help you with it now too, right? Yeah. I would imagine Anacon is going to use AI to help if you don't know how to develop in Python.

You don't know Python. Yeah. To teach it to you and help you develop it.

I mean, it's a crazy world we're coming into. Oh, no, for sure. And what I would tell people is like, it's so easy to get started.

I, as part of the interview process, wanted to play with the product and you can get a cloud notebook up and running with one or two clicks, really? Uh, yeah. The a Anaconda AI system is just there, uh, it's front and square.

And I was asking it questions of things that I used to do 10 years ago with Anaconda, like, how do I do this today? And it was very easy. I felt very, uh, productive and able to actually build something without having, you know, a lot of this, the knowledge that was just built into the platform.

So yeah. Anacon, lemme ask you a hard question, David DeSanto, do you still consider yourself a developer? Yes, I do.

Okay. I do. And and here's why.

There, you know, um, I was a developer for a long time. I was an engineering leader. Uh, people say I went to the dark side to go into product and Uhhuh, I don't think David graduating from college would know that David would be a CEO of the company, right.

Company. But those roots are still really important. And so whether that is me building stuff to play with, uh, me working with our engineering team and finding things that maybe we can make better, you know, it's great to roll up your sleeves and just be in that, especially with a very technical company.

And I won't tell you the apps they built are pretty bad, but, you know, They don't have to be great. The fact, you know what I, I said it tongue in cheek. Yeah.

But the fact of the matter is, is it, I always tell my team, you gotta be able to walk the walk, not just talk the talk. And so the fact that you could play with it and make some, it doesn't, it doesn't have to be the greatest app in the world, but you could get your fingernails dirty with it gives you a perspective that helps you understand who your customer is, who the users are. Yeah.

It's important. No, and you're right. You Can't be too abstracted outta that.

No. And what I tell people is like, even though I'm now CEO of a company that's almost 500 people, when we announce our series C, we're at 150 million in revenue. You know, it's still important to me to be thought of as a developer and like a vulnerability researcher.

Mm-hmm. Because all of that is what has helped me be successful in my career. And so what I'd say to people out there who are like, I dunno what I want to do or do I wanna switch roles, go to a different company, you know, find the thing that you want to do and just do it as best as you can.

And it's just so rewarding. And, you know, Anaconda is there to help people take that journey for themselves. I love it.

David, man, congratulations. Thank best of luck at Anaconda. We, you know, I'm sure now that you're there, we'll be talking a lot, doing more, looking forward to hearing great things.

But this sounds like a great opportunity for Anaconda and a great opportunity for you. It's a good match. You know, thank you very much for having me, and I always love the catch up.

It was a pleasure. All right. com.

Go check it out. We're live at AWS reinvent. We're gonna be back in just a minute.

We've got tons of great stuff coming up. Stay tuned.