Episode Transcript
John Jester [00:00:00]:
The number one issue I see now when I work with customers who have had data corruption tied to AI, it's not a cyberattack. It's actually a business-sponsored AI agent that was given permission to datasets beyond what it needed to perform its actions.
VO:
From KBI Media, I'm Karissa Breen, and this is KBKast.
KB [00:00:22]:
My guest today is John Jester, Chief Revenue Officer at Veeam. John gets pulled into a lot of board conversations about keeping the business running after an outage. We talk about why some companies pay the ransom even when they could get their data back, how AI agents with too much access are leaking and corrupting data, and whether you can undo what one agent did without rolling everything back.
VO:
If today's episode lands for you, Do 2 things, hit follow and send it to one person in your network who needs to hear it. That's how shows like this grow.
KB [00:01:00]:
Alrighty, let's get into it. Okay, so John, last time we spoke about whether organizations can recover. So now the bar feels higher. So is recovery enough or do leaders need to prove the business can keep operating whilst recovery is kind of happening? I really want to start there and build on this a bit more.
John Jester [00:01:27]:
Yeah, I think you make a good point there. When we talked about recovery, you know, years ago, it was all about, hey, can I restore the data? Can I get my applications up and running? And that was usually on the back of a cyberattack, could be ransomware, on the back of a natural disaster or some type of IT failure, systems failure, et cetera. And the bar there was very technically oriented. Can we recover this data? Can we get it back up and working? I call the second phase of that being, hey, how fast do we get the business back up and running? Not can we get our data back? How fast can we get it back? How fast can we get the business going? And that's where this conversation changed to be all about business continuity. Hey, how fast do I get my business up and running after I've had an outage? Not just getting the data back, but applications running, business process working, et cetera. And then kind of the third phase of this that I think is so important today is the way AI is impacting this. And obviously AI is operating at speeds way beyond humans, be it an IT admin making a mistake or a cybercriminal making an attack. So now the speed is way up, and that means we need more sophisticated tools.
John Jester [00:02:44]:
For governing AI agents, for understanding the data they interact with, what do they edit, what do they delete, what do they write? And having that ability to track that, govern it, gives you the ability to protect your data and in essence do a rollback. If an AI agent, either your own business-sponsored AI agent or a rogue AI agent takes actions you don't want on your data, how fast can you set your data back to the correct state? And that means you have to do precision recovery. We can't reset our entire data estate every time an AI agent makes a mistake. You'd have no business continuity performance if you did that. But this concept of precision recovery, I track each agent, I govern them, and I can undo what they do, gives you that much faster speed on business continuity, not data restore.
KB [00:03:35]:
Okay. So, John, you said before, how fast can a business Get going. So when you are out in the field asking customers that, what do people sort of say?
John Jester [00:03:45]:
So I think the, there's a couple things that come up when I'm talking to customers about this. So obviously RPO, RTO, some of these performance metrics we talk with IT leaders about, very, very important. And then like we just talked about, there's also now a metric of not just how fast the data got back, but a, a lot of times you've gotta orchestrate applications standing back up. They have dependencies on the operating system, on the data, on the data databases on the app layer. So people are really thinking about that process end to end. And frankly, the only way you can be confident is to actually go through, do the tabletop exercise and do the actual test and understand how fast you can get your business up and running. Veeam purchased a company called Coveware a little over 2 years ago. Coveware does basically incident response.
John Jester [00:04:36]:
When there's a cyberattack, They come in, they help companies restore, get their business back up and running, recover their data. And they have insights from working across the Fortune 500 on this and midsize enterprises. And what's fascinating is more often than not, a company can recover their data, which sounds fantastic, right? I've had a cyberattack, I can recover my data. But there were so many instances of companies actually having to pay The ransom to get decryption keys, not because they couldn't recover their data, but because the speed of recovery was so poor. They weighed the cost of, it's going to take me 2 weeks to recover my data, get my applications back up and running versus making this ransom payment, getting the keys back, being back online in a day. And they saw companies actually paying ransom payments because their speed of not just recovery, but recovery plus getting the business back to a healthy state was actually costing them a lot more than the cost of the ransom payment. So it was an interesting insight. You always think, oh, they couldn't get their data back, so they paid the ransom.
John Jester [00:05:47]:
There were more times it was actually speed of recovery, speed to get the business back up and running that drove that decision.
KB [00:05:54]:
Yeah, that's interesting. So would you say then we're going to start to see, unfortunately, more of these instances? Because you're right, like 2 weeks nowadays feels like a lifetime. People are not going to wait around until some business is back up and going, they'll go elsewhere. So because of that pressure, will we, will we start to see people unfortunately just pay the ransom?
John Jester [00:06:14]:
Well, we've seen it historically. And then what's fascinating, the trends that we have, and again, this is from our own Coveware business, actual, you know, engagement with customers is we've actually seen ransom payments flatten to even come down a bit. Now, why is that? A lot of this is people are being way more proactive now. So they've learned these hard lessons of, wait a minute, we've got AI operating at machine speed, hyperattacks that are coming in faster. We have to be prepared for it. I think a lot of customers learned from this. There is a massive difference between I'm confident I can get my data back versus I'm confident I can get my data back, my applications up and running, And my business back to executing in the right amount of time? So I think we've seen customers get much more proactive at doing that testing, doing the tabletop exercise, doing the actual recovery exercises, and that's actually got them in a more confident position when they have a cyberattack or they have a ransomware event. So I'm actually much more optimistic that trends are going positive because customers are being more proactive about getting prepared, putting the right solutions in place, et cetera.
John Jester [00:07:24]:
So there's actually some healthy indicators we're seeing there.
KB [00:07:27]:
Would you also say as well, John, that customers are confident perhaps, or over-indexing on their confidence towards getting their data back versus getting their business up and running? Or would you say it's quite equal in terms of equilibrium?
John Jester [00:07:41]:
Well, hey, if you can't get your data back, you're not going to get the apps back. You're not going to get your business back. So I think that ultimate dependency on data is always there. So you're never going to get around it. But like I said, The more common scenario is I've got a path to get my data back, but I don't have a path to get my apps back up, my dependencies covered, everything orchestrated, business back up and running in time. That's still more of a risk point than the actual data recovery. So that's kind of how I think about it. Data foundational, you don't get the data back, you're in a world of hurt, right? From a business standpoint, from a recovery standpoint.
John Jester [00:08:17]:
People kind of learned that, they've got the data part covered. The area to keep improving, and like I said, I've seen really good improvements on this when I look at the last 3 years of data, is, hey, I can orchestrate recovery, understand app dependencies, and I understand how to get the business back up and running properly as I do that recovery process.
KB [00:08:37]:
Where do you sort of think people's mindset are at the moment? Obviously, very, people are very focused on, well, how quickly can I get up and running, right? Because of how much it costs per day to, you know, in terms of loss of revenue. Disruption, long-tail impact of, well, that company sucked because I, you know, they went offline for 2 weeks, I couldn't get my fancy thing I needed to get. For example, if you're a retailer, would you say that is the biggest catalyst now for people moving perhaps a little bit faster than traditionally speaking?
John Jester [00:09:04]:
Customers have choice, businesses have a lot of competition. All these things put the pressure in there. And, and like I said, this is a business conversation. I think You know, data restore was very much in the IT realm. That's where most of the conversations happened 5 years ago, partly because of ransomware, right? Partly because there were just these massive companies that had business stop issues and, you know, the press around it. Business leaders became hyper-focused on, hey, what is our business continuity plan? Not what is our disaster recovery plan? What is our business continuity plan? Which means disaster recovery. It means cyberattacks. It means all these other issues that I brought up before.
John Jester [00:09:46]:
How do we make sure we serve our customers, we don't lose to our competitors due to reputational damage or due to inability to conduct business? So I think it's turned into much more of a business leader drive. And a lot of the meetings I get pulled into with customers are at that level now. Of course, the IT team is never going to walk into the business leaders and be confident if they don't have the right tech plan, they don't have the RPO, RTO stats to back it up. But the business leaders are pushing harder and harder to make sure they have confidence in business continuity.
KB [00:10:18]:
And so on that note, what would you say the difference between having recovery capability and having real recovery confidence? What does that look like?
John Jester [00:10:28]:
Yeah, so I think confidence comes down to, hey, have I done the tabletop exercise? Have I actually simulated recovery? Have I taken a storage array offline? Have I watched all the applications fail because of it? And then have I walked through that recovery process, timed it, tested it, not just said, is my data back up, but are all my applications running and healthy? Next step. Okay, so the app's back up, but what impact did that have on the business? And what ability do I have to go back and make sure I've got every transaction fulfilled? I've got every transaction closed out. From a business standpoint, I'm executing well. So like, I can't stress enough, tabletop exercise it, actually go through the simulation, take the arrays offline, understand what it looks like to be corrupted, or understand what it looks like to lose an entire data center. Do the failover. The customers that have these issues and get great business continuity, they're the ones that prepared, they're the ones that simulated it. And they're the ones that work that process end to end.
John Jester [00:11:33]:
That's what I see over and over. So, you know, preparation is so, so important. And, you know, there's a quote I got from the CEO of Coveware, and he said, hey, no one rises above their level of preparedness when there's a disaster, when there's a cyberattack, et cetera. Everyone basically converges on what they prepared for, and you're either going to get to that Or you didn't prepare properly and you're probably going to end up in an even more challenging situation.
KB [00:12:01]:
So when people say the word prepared, which I often hear, especially on interviews like this, people obviously have different definitions of what being prepared actually means. What does that sort of mean? Or how would you define that? Because it sometimes can appear to me when I'm interviewing folks that perhaps people don't understand at any fidelity what they should be preparing for, but it's like, oh, okay, we've got a bit of a plan printed on some paper stuffed somewhere in the company. We kind of practice it. And then we've got all these new people here. They kind of know as well. That's maybe their view, but I'm assuming that's not yours.
John Jester [00:12:39]:
Yeah. And again, it all comes back to what I said. Hey, when there is an issue, when there's a cyberattack, when there's a massive data center outage, you're going to land on your level of preparedness. And what does that mean? That means, like I said, you've done the tabletop exercise. You have a detailed plan. And you actually went through the failure, you followed the plan, you stress test it. Again, it's fascinating when we work with customers and there are these outages, what trips them up. And it can be incredibly basic things.
John Jester [00:13:10]:
One of the most basic ones we see is, okay, you've had a massive outage, your identity controls are down, you don't have any of your contact information. So your email system's down, your chat communication system's down. Your phone can't actually connect to your instance, could be Microsoft 365, could be something else. Turns out all your contact info is on your phone. We see so many customers, communication actually completely breaks down because they have no other way to communicate across the company with each other, executives, et cetera. So it can be incredibly simple things like having a directory that people have access to, having a second or a third cloud. that you can fall back into that has some of that data pre-populated that you need, contact information, has copies of the recovery process, the business continuity plans, et cetera. But it's just so interesting when you work with customers, it can be the small little things that really trip them up.
John Jester [00:14:09]:
And like I said, so many times it's literally like, we cannot communicate with each other, right? Like no one memorizes everyone's phone numbers anymore, right? It's all on your phone. It's all a saved contact, et cetera. You lose access to that corporate directory, you very quickly struggle to communicate.
KB [00:14:26]:
It's a very good point. So what have people sort of done in the past? Because you're right, like everyone's numbers are in your phone and obviously if that's not working, that's an issue. How, how people have communicated in times of a crisis, like on LinkedIn or?
John Jester [00:14:38]:
I actually see a lot of customers do an alternate cloud. So you might have Microsoft 365 as your standard communications platform. And then I've seen customers that will actually have another cloud communications platform set up, not for the entire company, of course, but for all the key stakeholders that are in the business continuity plan, et cetera. And they actually know if this incident occurs, hey, I log into this, I use this other platform, could be self-hosted in another data center, but it's actually pretty common to see this. Hey, we've got this failover communication plan that we go to. And the beauty of that is Hopefully you've made sure that that is a secured platform, you've got some corporate policies on it, et cetera. What is super dangerous is, hey, we're going to communicate randomly on some consumer platform. You might introduce another attack vector if you're under a cyberattack, if you take an action like that.
John Jester [00:15:35]:
So that's what we've actually seen is people using a secondary commercial communication system that they can secure, they can put IT policies on, et cetera. And they're, like I said, they're automatically making sure All my contacts that are in the business continuity plan are there. Some of the key procedures are mapped out there, et cetera. And I've seen some go as far as actually replicating like the last 7 days of email, et cetera, into that platform so that if you pop over, it's hot and I didn't miss a communication from a customer, et cetera. So fascinating to see the little things can really trip people up when you're going through a cyberattack or when you have a big natural disaster. But hey, Testing and preparedness, that's the key.
KB [00:16:18]:
And what was coming to my mind as you were speaking there, John, was every minute is critical then. So it's like if I'm fumbling around trying to find John's number, I can't find it. I don't know what to do. Every minute that goes by is even more critical than it was even before, because it could be that, you know, catching something within an hour versus, oh, it's 3 hours and we still don't know. You think companies are acutely aware of that, especially now with AI attacks and things that are going on, this seems that people putting weight behind the time it takes for me to potentially try to communicate with you quickly if I need something in that particular instance.
John Jester [00:16:54]:
Yeah, agreed. And I'd argue it's almost exponential now. So 3 or 4 years ago, we'd be like, oh, you've got a ransomware attack, you need to communicate with someone, you need to shut down systems that have not been impacted yet, right? Because you don't want that data corrupted or encrypted, etc. So speed there was important. Again, that's back when the threat actor was a person or a team of people roaming through your network, grabbing things, encrypting things, et cetera. This happens so much faster now with the rise of AI, with things happening at machine speed. So timing is key there on communication, clarity on process. So I don't have to call someone and ask them before I take an action.
John Jester [00:17:33]:
I know exactly what to do because it's documented. We tested it. Those things are important. Again, being proactive, right? Having the defenses up, taking the right steps so that you're ready to react as quickly as possible because the time impact is now exponential, right? Maybe it used to be linear 4 or 5, 6 years ago, but it's exponential because these things are happening at machine speed now.
KB [00:17:57]:
And then, so speaking of AI, with AI, how it's going, changing the workflows, for example, especially speed, does that change the question around resilience from, can we restore the data, to, can we trust the data that we are restoring? So, what are your sort of sentiments here? Because everyone's like, to do proper AI, we need really good data. Everyone knows how that works, but is that now a major concern for executives at these businesses?
John Jester [00:18:25]:
Yeah, it absolutely is. And let me break that down in a couple areas. So, I think the first thing is, If you're making business decisions based on AI recommendations, et cetera, the number one most important thing is you have to trust your data. So what we see from customers now is a tremendous amount of focus on, hey, make sure that we're training the LLMs on the right dataset. So go through, get rid of obsolete datasets, get rid of old things that could populate that LLM, cause it to make wrong recommendations. So Trusting your data is fundamental. If you don't trust your data, you cannot trust the recommendations or even worse, the actions the AI agents are taking. So I think that's just a fundamental thing is you've got to have the right dataset that you're training your models on.
John Jester [00:19:14]:
The second thing is when you implement AI agents and models across your business, it's incredibly important that you give them the right permissions and scopes. So the number one issue I see now when I work with customers who have had data corruption tied to AI, it's not a cyberattack. It's actually a business-sponsored AI agent that was given permission to datasets beyond what it needed to perform its actions. It was given permissions beyond what it needed, and it made mistakes and went rogue. Now, you've heard about the headline ones, PocketOS having their entire production database deleted along with the backups. That's more the headlines. What we see more is AI agents corrupting data or deleting datasets that a customer needed. And it turns out it's because they were permissioned too broadly.
John Jester [00:20:10]:
They didn't have the right governance in place, or they just leaked data. So they exposed data to the AI agent, which then exposed it to a line of business application or a person on things that they should not have had access to. And, you know, this most simplistic example of this is, hey, you roll out Microsoft Copilot, you roll out ChatGPT across your enterprise, you roll Claude out across your enterprise, you don't put the right permissioning, data security, identity and access controls across your data estate. And before you know it, employees are asking about salary information, reorganization, mergers and acquisitions, And those documents were out across your data estate for years, but they were off on a SharePoint site. They were very hard to find, et cetera. Well, guess what? All those tools I just mentioned are incredibly effective at finding things and responding to user queries or application queries, et cetera. So data leakage is simply, I was using an AI agent and I got access to things I shouldn't have known, an acquisition, A reorg, et cetera.
John Jester [00:21:20]:
That's actually the top issue I've run into when I talk to customers. It's like, hey, we rolled out this agent and we just exposed confidential data to employees, or somehow it leaked out through to our partners or even external to the company simply because I had a business-sponsored AI agent that was over-permissioned. So data leakage, when I meet with CISOs, that is one of the top concerns. It's not a cyberattack. It's, hey, we exposed data we should not have because we had AI agents operating with permissions that were too broad. So that's kind of category 2 that I see. So category 1 is you got to trust your data. You've got to train your LLMs with the right dataset so it makes the right recommendations.
John Jester [00:22:04]:
Second category here is identity access security controls across your data estate so that those AI agents do not leak data. Or touch and edit data they shouldn't have permissions to. Those are the 2 big things. I would put, you know, people talk about rogue AI, and that's employees bringing tools into the workplace. You know, you can now run obviously ChatGPT or Claude in a web browser. So it's not quite as simple as blocking the client install. A couple interesting ones I've come across lately is there are meeting agents that you can invite to your meetings. Super convenient, right? It takes action items, notes, et cetera.
John Jester [00:22:45]:
Well, it turns out like those get invited as just a person, right? An individual. But if the employee then turns around and gives data access rights to that agent, you now have this non-IT-sponsored AI agent operating, accessing data across your environment, using your employee credentials, et cetera. That very much fits in that same category too. It's just a different way it gets exposed. Instead of being a business-sponsored AI agent, it's an employee doing something, you know, kind of shadow AI. But those are the 2 ways I think about it. You've got to have great data if you want to trust the outcomes, the recommendations, and then you've got to have the right AI governance in place across your AI agents.
KB [00:23:29]:
We'll come back to that in just a moment after a quick word from our sponsor. When you're building a startup, every hour counts, and so does trust. Whether you're chasing your first enterprise deal or just trying to stay ahead of the compliance curve, Vanta helps you prove your security posture fast by automating up to 90% of the work for SOC 2, ISO 27001, GDPR, and more. Vanta gets you audit ready without the late nights and spreadsheets. Visit vanta.com/KBKast to learn more.
KB:
And then, so going back to your comment around data that had been deleted, et cetera, how often do you think this is happening with these businesses out there?
John Jester [00:24:15]:
So mass delete, like wipe out your entire production database, it's pretty rare, right? We're seeing the headlines when that happens. What I see way more frequently, frequently Is again, business-sponsored AI agent. It's set up on a specific task. It goes out and it makes mistakes. It corrupts a dataset or it writes a bunch of wrong things into a dataset, et cetera. If you've done things properly and you have the right governance on your AI agents, that means that you're able to monitor them. You understand every piece of data they read. What did they create? What did they delete? What did they edit? and you track that with precision, you now have the power to say, hey, I know exactly what actions this AI agent took.
John Jester [00:25:01]:
They were the wrong ones, and I want to simply undo those specific actions. So I call that precision recovery. If I want to go in and just undo this one line of business AI agent's actions over the last 24 hours, I can do that. That doesn't mean I gotta shut everything down, restore my entire data estate, go through my orchestration of spinning up the databases, So kind of that precision recovery I think is important because we know the frequency of that scenario is very high. And Veeam did a survey of our customer base and more than half of them said, hey, we had issues with AI agents taking actions that were not intended on our data. So I think that is way more frequent than the, hey, an AI agent wipes out your you know, production code or production database, et cetera. And again, it's a different problem. I can't shut everything down, do a full recovery.
John Jester [00:25:59]:
I just want to be able to undo those unintended actions. That's how you get the business continuity performance we talked about at the beginning while still being confident in empowering businesses to use AI. You know, if you think about someone like me, so I'm a CRO, At a software company, I of course am agitating. I want to take advantage of AI to have better CRM systems, better customer success systems. You know, how can I help the company generate more revenue, create more satisfied customers? So of course I agitate our CIO, our COO, our CISO, hey, let me use these AI tools, et cetera. They want to empower me. But if they don't have the right tooling for AI governance, if they don't have precision undo, they have to be very cautious, right? Which of course would create friction with someone like me. And I see, this is exactly what I see play out across our customer base.
John Jester [00:26:55]:
I'll be meeting with the CISO, the CIO, and they'll play this out like, hey, we're under a lot of pressure. We've got to adopt AI. We've got to implement it into more of our business process. But at the same time, I'm the one that's accountable for keeping this business running. I'm the one that's accountable for not making, not letting our data leak out to employees or outside the company. So, hey, help me do this in a responsible way. Give me the confidence that I can deploy AI aggressively in the business. I can get those great business benefits, but I know I can govern it.
John Jester [00:27:27]:
I know I can get business continuity if I do have an unintended consequence.
KB [00:27:31]:
Okay. So there's a couple of questions I have there. My first one would be going back to the undo. Slash rollback, I think we discussed last time. How many undos can you do or how far back can you go? Because it's like, I didn't notice until like now and it's a week later.
John Jester [00:27:47]:
Yeah, great, great question. So this one is going to be dependent on what technology you choose. Obviously, I'm going to advocate for using Veeam and Securiti AI, but the reality is the other data resilience vendors, some of them have some similar capabilities, et cetera. But this is all configurable, right? So how large is your dataset that you're protecting? How large does the offsite backup need to be? How much do you want to air gap? You know, at Veeam, we're huge advocates of 3-2-1-1-0, right? And that's 3 copies is your data backed up, 2 different types of media, 1 offsite copy, 1 immutable or air-gapped copy. And then of course, the 0 is just integrity, that you've tested it, you know, you can recover, et cetera. But that allows you to go back in time, frankly, as far as you want. So there's not a limitation on the time if you've got the data capacity, the tooling, et cetera, to do that.
KB [00:28:43]:
And then what would happen if something was deleted, you didn't notice, or someone in the company didn't notice, and then there's a crisis? Like, what happens then?
John Jester [00:28:52]:
Yeah, with this, this is, uh, where ideally you go to your data resiliency toolset or your AI governance toolset. And hey, there's going to be someone who owns that data estate. In every company, people are very good about, hey, I own this application or I own this dataset. You'd go straight to that person and they would understand, hey, what's my recovery process? What do I need to go through? Ideally, you've got a solution like Veeam or Securiti AI where you could do that precision recovery. Maybe you don't have that solution and it's like, hey, we're going to have to roll back the entire data estate to this period of time. That's going to have a lot bigger impact, a lot bigger outage, et cetera. But that's the way this goes. And that's why I say you really want to think about the AI era, the agentic era, and how you do business continuity.
John Jester [00:29:40]:
It has to be tied to how you did data resiliency in the past. You don't want to separate the two. If you link the two together, now you've got your entire data estate protected. You've got a change set across that data estate, and then you've got the tools to be able to go in and precision undo at any time in the past, right? That's, I think, the big change that you have to make to be ready for the agentic era, precision recovery. Like there's just no way to hit your business continuity goals if you've got to roll back the entire data estate every time you've got to undo the actions of an agent that did something you didn't expect.
KB [00:30:20]:
Would you say people are treating these items separately though? Or do you think people are looking at it more holistically, more collectively to your point?
John Jester [00:30:29]:
This is one of those things that's happening incredibly fast, right? You know, in all honesty, a year ago, I was sitting with customers, we were talking, everyone was doing AI pilots and tests and doing different things. But, but frankly, hadn't thought fully through, hey, what happens in this particular scenario? What if it's just a couple mistakes that an AI agent took that you want to undo? So I think collectively across the CIO community, across the CISO community, this awareness has exploded. And this conversation now, the last 12 months, like it's rare not to have the conversation. So if I'm meeting with a customer, it's extremely rare that we don't get into, how are you thinking about AI? How are you thinking about business continuity in the context of AI? And it's not just, like I said, you know, the cyberattacks get the headline news. And of course everyone's got to prepare for that. But 10 to 1 with my customers, it's either a business-sponsored AI agent making unintended changes, corruption mistakes, or shadow AI. Those are the 2 things that are coming up 10 to 1 over cyberattacks right now as it relates to agentic.
KB [00:31:41]:
And shadow AI is obviously another thing that people are sharing with me on the interview. So what are your sort of thoughts then around that? Because I mean, Everyone's got their preferences. We've seen it with, you know, traditional tech tools that people have used in the past. Well, I've used this tool before. I want to use it again, irrespective of if it's allowed or not. I'm just going to use it because it makes my life easier. So how are people that you are speaking to approaching this problem too?
John Jester [00:32:04]:
Yeah, so hey, the number one thing you've got to do is put a data security identity and access layer across your entire data estate. As soon as that becomes your fundamental AI infrastructure model, I can now see every AI agent and I can govern it. And it doesn't matter if it's a shadow tool someone brought in, it's business-sponsored, it's cyberattack. I now have that governance and I now have the ability to monitor the exact interactions that AI agent takes on my data estate. And as soon as I'm monitoring it, I'm tracking it. Now I get that precision undo capability I talked about. So That's why it's so important to not think, oh, what's my shadow AI strategy? What's my business AI strategy? What's my cyber attack strategy? I think if you break it into those silos, you're going to get too many gaps. There's going to be too many scenarios where things fall through the cracks.
John Jester [00:33:00]:
But if you take a step back and say, no, in my AI infrastructure model, I am going to have a data security identity and access control. in between my entire data estate and any AI agent interacting with it, that's where I get that power to manage shadow AI, to manage business AI, and then also to help me on cyberattacks.
KB [00:33:24]:
And then if we zoom out and look at boards, would you say in your experience, boards are still measuring resilience by whether the business can come back online? Or maybe the harder question to that would be is whether the customers, regulators, and the market will still trust it when it does. And I know we sort of spoken about trust a little bit historically, but talk to me a little bit more about that. And as I touched on before, like people aren't going to wait until a business comes back online. And when you see what happens, people get very impatient. They're already on Twitter, already making arguments. They're calling media people up to complain. So I'm just, I'm curious now. How are boards approaching this problem?
John Jester [00:34:09]:
Yeah, so very common. I'll have a customer call me, hey, board meeting's coming up. I've got a topic now. Help me get ready to pitch business continuity. So has the board moved beyond recovery to business continuity? 100%, right? So that's very much the type of questions we see, the preparation we put together. It's business continuity metrics underpinned You know, with recovery, data resilience, et cetera. So I would say, hey, they've moved on, you know, to the business side of this because of all the reasons you listed for quite some time. I now also get a lot of questions on boards are asking about AI and what you're doing to do this in a safe way.
John Jester [00:34:50]:
How are you implementing AI but not putting the company at risk? This is where that data leakage issue comes up a lot. I had a forum with about 30 CISOs out of the Fortune 500, and I just asked them, hey, who in this room has had to go to your board and notify them, hey, we've had a serious issue on leaking data? Now, it could be regulator that they had to notify, could be their own board, et cetera. 2/3 of the CISOs in the room in the last 18 months had to notify a regulator or the board because of data leakage. So again, it's not a cyberattack. It's not having the right identity access security controls across your data estate, but implementing AI very quickly, spinning up projects, those AI agents having permissions broader than the data they need to do their function, broader than the access controls they need to do their function, and that triggering a data leak. And again, it's one thing when you expose salaries across the company internally to the employees. It's a whole nother thing when you have data leak that gets outside of the company, and that could compromise your IP, that could, you know, have very confidential information. But I think 2/3 of these CISOs in the last 18 months, that got my attention, right? That's a, that's a pretty— tells you how serious this issue is and what a challenge it is.
KB [00:36:13]:
And then with business continuity, are we going to get to a stage in the future where customers won't know if there was like an issue? It's not like, oh, they were offline. It's just, okay, We've moved on, we've got the continuity in place, and we're just running it as is. It'll be seamless in terms of the outside world, so to speak.
John Jester [00:36:28]:
Hey, every business continuity plan, that is the ambition, right? Like, how do we have business continuity, you know, with the dream being, hey, no customer disruption, no business disruption, et cetera. And then there's normally the, hey, here's the SLAs that we think we can get to with our current state of technology, process, governance, et cetera. And those will not be zero impact, right? There will be specific amount of time, could be how long it takes to get transactions going again if it's an e-commerce customer, et cetera. But the ambition of course is always to be there. And we talked about AI and it's operating at machine speed and how that is a negative when it comes to criminals and cyberattacks, how it could be a negative if you make mistakes and have a rogue AI agent of your own. But it also gives you tremendous optimism on you can orchestrate recovery, you can orchestrate business continuity, you can leverage AI to help your business stay up and running, to react to cyber threats in a much faster way, to do the governance that I talked about. We already have agents that are monitoring other AI agents to look for patterns that trigger, hey, something's gone off the rails, there's access occurring that shouldn't. I don't want to come across like, hey, AI agents, like, oh, it's a threat to your business.
John Jester [00:37:44]:
It's going to cause data leakage. It's going to cause criminals to be able to attack you at a much higher velocity. Yes, that's true. But also customers are getting tremendous business benefits. That's why they're aggressively adopting AI and they want to get these AI agents out. They want to empower their business leaders to take advantage of AI. And 3, we should be more optimistic. That AI is empowering tools for business continuity, for data resiliency, for data security as well.
John Jester [00:38:15]:
So, you know, we should think about this in that balanced spectrum of, yes, there's some unintended consequences, there's threats, there's better tools now to manage this. And obviously the goal that everyone has is, of course, to get the business benefits of implementing AI and being able to do it with confidence, right? 'Cause if you know that you can govern it properly, you can undo it if it makes a mistake, you've got the confidence to deploy it, get those business benefits, and that, you know, one time out of 100 or one time out of 1,000 that it goes wrong, you track it, you undo it, and business continuity is there.
KB [00:38:49]:
And then just going back to your 30 CISOs example of two-thirds around the DLP side of things, do you envision like in the next 18 months that will get better? There'll be less people that put up their hands and say, I was impacted by this? Or do you think, from what I'm hearing from other people, these problems may get worse for a bit before they start to course correct, for example?
John Jester [00:39:10]:
Here's what's going to happen. AI adoption is accelerating. That means more surface area. That's going to drive up the number of incidents where this happens. So that says, hey, oh, it's going to be more of a challenge. But I would counter that with the tooling, the learning, The processes that I talked about, people are getting better at that. That's going to counteract that. So what I think you're actually going to see is it's probably going to stay at 2/3 for the next 18 months.
John Jester [00:39:36]:
Way more surface area countered with better tools, better process, better learning from everyone is kind of keep that flat. Even though the reality is AI adoption will be 10x over that period of time, you won't see 10x the number of You know, event requiring disclosure or data leakage, et cetera.
KB [00:39:56]:
And do you sort of envision, 'cause it sort of like becomes like a moot point, like they're sort of climbing that at the same time from what I'm hearing what you're saying in terms of trying to be better at it and learning more about it and then combating it, et cetera. So will it be more of a steady linear increase perhaps over the next 18 months and beyond?
John Jester [00:40:14]:
Oh, I think 18 months it'll be linear because the two will counteract. Then I think it gets better. So I actually think if you go beyond 18 months, we'll actually be in a better state. The tools, the process, the learning, the maturity around doing this properly will get so much higher that we'll see fewer incidents of data leakage. We'll see fewer incidents requiring disclosure, et cetera. So I actually am optimistic it gets better over time. I just think we're just in this very high AI adoption rate coupled with the lack of maturity on governance is what drove that, you know, 2/3 over 18 months had to disclose.
John Jester [00:40:51]:
The continued adoption, the continued rollout's going to keep pressure on that going up. But like I said, the tooling, the, you know, the software capabilities that Veeam is providing, the learnings that everyone is having on how to do this properly, the AI tools putting a priority on this because they know there's risk if they allow this to continue happening. I think all those things get us to a better state in 18 months.
KB [00:41:16]:
And John, final question. Do you think companies are scrambling to get all of this stuff sorted out? Or do you think like, no, they've, there is a level of confidence that they've gotten, they're doing it systematically, mechanically, they're going through the process. Or do you think there's like panic stations all around?
John Jester [00:41:31]:
Hey, it's all over the map, to be honest with you. There are some customers I meet with and like, I'm impressed, frankly, like They've got it down, they've got the tools in place, they're tracking, they're very confident, they feel that way. I've got customers telling me, hey, I'm incredibly worried. And Veeam did some surveys that had some numbers that were startling on customers having confidence in the actions their AI agents were recommending, customers having confidence that they understand the way their data's being interacted with and have the right tools to recover if things go wrong. There were some stats in there that were concerning. So I think it's all over the map. And again, 12 months ago, this was pilots.
John Jester [00:42:13]:
This was, let's test this, let's try this. Like we have moved from piloting things to production at scale implementation of AI incredibly fast. And that's why everyone's all over the map today.
KB [00:42:30]:
That was John Jester, everybody. The part I keep coming back to is that John asked a room of about 30 Fortune 500 CISOs who had to tell their board or a regulator about a data leak in the last 18 months, and 2/3 of them had. It wasn't attackers, it was their own AI agents with more access than they needed. If you're a CISO listening to to this, check which of your agents can see more than their job needs and ask your team whether you could undo what one of them did yesterday.
VO:
I read every reply. If you've got some thoughts on this one, send me a message on LinkedIn.
KBKast, Cyber For The C-suite.
