KnowBe4 Snowflake QBR Workshop — Pitch Prep (v2)

v2 rebuilt 2026-06-26 eve around the founder's own agenda design (which superseded the v1 generic agenda) + the team division of labor that emerged from the phData channel. Internal phData prep — do not publish.

The opportunity (snapshot)

A Snowflake partner invited phData (+ other SIs) to run a half-day onsite at KnowBe4, structured around a QBR, Clearwater/Tampa, July 15 (date locked), ~30 attendees across the full org range — executives, managers, data engineers, analysts. Decision Tuesday 6/30; internal prep Monday 6/29 (Gary may call an early-Monday internal sync).

Context (Sam Saks relaying Snowflake AE Dan Coletti):

• Enterprise Expansion account; renewal closes 1/29/2027.
• Snowflake + phData ran a 2024 data-science workshop with KB4 that did NOT convert — but leadership has changed since (fresh shot; learn from why it stalled).
• Dan is excited by the 321GO concept; even if 321GO isn't shown, KB4 will want a Cortex HOL.
• Big AWS shop; Dan knows the AWS AE — possible joint AWS/Snowflake/phData AI strategy.
• KB4 = Vista-Equity-owned (2023, $4.6B); security-awareness / phishing-simulation; ~70k B2B customers; 2,500-3,000 employees.

Their three asks (founder's sharper restatement)

1. How do we use the Snowflake semantic layer? They currently build one semantic view per report — no leverage, conflicting metric definitions.
2. What should our org ontology be? (Deflate the buzzword: ontology ≈ effective dimensional modeling — name your entities and events. Continuation of #1.)
3. How do we leverage the ontology in multiple places? = the Snowflake MCP governed with RBAC.

Team division of labor (from the phData channel)

• Dom Rocco (SVP Applied AI) → case study = Crowdstrike (a security-industry peer to KB4 — strong relevance, resolves the "no FS reference in vault" gap). Also floated an accelerator, "Agent Plexus" — NOT findable publicly; likely internal/new. Confirm with Dom what it is and whether it's client-shareable before citing it.
• Gary Duma (Sr ML SA) → building the end-to-end demo over the weekend: Cortex Agent-generated/accelerated semantic view(s) → Snowflake MCP service → Claude Cowork, RBAC in place. Building it with CoCo (= Snowflake Cortex Code) in a weekend as itself a selling point. Channel update by Sunday.
• Founder (Ben) → owns the workshop flow/pedagogy (the design below is his), ex-KB4 insider intel (worked there 2019 — dated, "a lot has changed," but still the only insider read in the room; esp. why 2024 stalled + the new-leadership picture), the 321GO / "where this goes" narrative (Dan's most excited about it), and Gary's architecture sounding board (the demo IS the CAF MCP→Cowork→RBAC pattern). Also building his own version of the demo for learning (ideal Anthropic-cert prep) — to bring to Gary as a collaborator ("here's a flow + a build, want to blend?"), NOT as a competing alternative.

phData accelerators (context, since Dom referenced them)

"Accelerators" = phData's prebuilt, reusable solution IP (templates, reference architectures, codified playbooks that compress delivery). Public named ones: Customer Data Platform Accelerator, Clinical Cohort Creation Accelerator. Umbrella = phData Forge ("AI-native delivery system": Forge Agents/Skills/Catalog/Studio) — adjacent to the founder's CAF/321GO world. ("Agent Plexus" is separate and unverified — see above.)

The workshop design (founder's, refined)

Core constraint: no access to KB4's sandbox ahead of time → the teaser/destination demo runs in phData's environment, framed as "by the end of the day this is implemented in YOURS." Live build during the day depends on KB4 provisioning a dev sandbox + sample data for the session (see logistics).

Altitude principle: start at the destination, then flow high-level → lowest-level. Front-load the teaser + big picture so execs and busy managers get the value and can leave; curious managers + ICs stay for the hands-on build.

The medallion spine (the conceptual through-line):

• Bronze = raw source data. Take inventory of what KB4 has access to.
• Silver = the business logic layer: map out events and entities = their ontology.
• Gold = the semantic layer: aggregates ready for activation (Cortex Analyst, MCP).

Big-picture talk track for ask #1 (the semantic-layer evolution — founder's narrative): business logic was historically bundled per report → conflicting metric definitions. BI tools added shared data models, but locked into the BI tool. Then warehouse logic layers let multiple apps get the same answer — but a semantic view per use case keeps the same risk. Endgame: a well-modeled silver business layer + the semantic layer as your gold layer. Centralize there and you can activate everywhere — BI, reverse-ETL back into source systems, enriching other targets, Excel, and MCPs for agentic access.

Running order

PART 1 — everyone (~75 min)

1. Teaser / destination demo (~10-15 min) — the Cowork-agent-over-MCP end state, running in phData's env. "This is where you're headed; by end of day, a piece of it lives in your environment."
2. Big picture (~30 min) — the semantic-layer evolution narrative above + the Bronze/Silver/Gold framing + "activate everywhere." Exec-relevant value + the day's arc.
3. Events & Entities workshop (~30 min) — keep execs/managers IN. This is their business, not Snowflake mechanics: facilitate "name your entities and your events." High participation; captures domain knowledge only they have; they leave having contributed. (This is the Silver/ontology definition.)

→ BREAK (~10 min) — placed on this seam deliberately: rest + covers the exec/busy-manager departure gracefully + resets the room for the hands-on crew.

PART 2 — curious managers + ICs, hands-on (~115 min) 4. Semantic layer definition — define the gold semantic view(s) from the events/entities just identified. Cortex Code (CoCo) intro to accelerate the Semantic View definition. 5. Activation 1: Cortex Analyst + Snowflake Intelligence — activate the semantic layer against the first activation target. 6. Activation 2: custom Snowflake MCP → Claude Cowork (RBAC) — build the custom MCP, connect Cowork, demonstrate RBAC gating. The destination, now built. 7. Closing thoughts + roadmap to their env + Q&A.

(One 10-min break is enough for a half-day; add an optional 5-min stretch mid-Part-2 if energy flags.)

Success story

Crowdstrike (Dom owns it) — a security-industry peer to KB4, so the relevance lands harder than any FS reference. Founder's insider angle can help tailor why it parallels KB4's journey.

Logistics + the one real risk

• Live build needs KB4 to provision a dev sandbox + representative sample data for July 15. No pre-access → can't pre-build in their env. Confirm provisioning on Monday's call; signals phData runs these professionally.
• Pre-build (phData side): the teaser demo + a fallback build that mirrors KB4's data shape, in phData's env, so the day works regardless of their provisioning. The MCP server must be internet-reachable from Anthropic IP ranges (known CAF constraint).
• Budget per the brief supports travel/resources for the selected partner.

Honest prep gaps

• Don't wing the Cortex Analyst / Snowflake Intelligence / MCP hands-on — confirm who's run these live (Gary's demo build covers most of it; founder's parallel build is the learning hedge).
• 2024 didn't convert — the founder's read on why is the highest-value intel to surface internally before Monday.

Open items / what's still needed

1. Founder → phData channel (before Gary's Sun update): a tight KB4 insider brief (the room, decision-makers, why 2024 stalled, current data-team pain) + offer to pressure-test Gary's demo architecture. (Ray offered to help draft this — awaiting founder's KB4 facts.)
2. Confirm with Dom: what "Agent Plexus" actually is + client-shareable?
3. Monday call: KB4 sandbox/data provisioning for July 15.
4. Once flow is locked → Ray turns this into a clean leave-behind one-pager/deck; that presentation-bound version gets a fresh-eyes verify pass before founder presents.