Screaming in the Cloud - Cyber Resilience Beyond Prevention with Anneka Gupta

Episode Date: October 30, 2025

When attackers are smart enough to hit your backups, recovery becomes your best defense. Rubrik’s Chief Product Officer, Anneka Gupta, joins host Corey Quinn to break down what true cyber r...esilience looks like in today’s multi-cloud world. From AI-driven recovery to surviving ransomware with your data (and reputation) intact, this episode covers what it really takes to bounce back when everything goes sideways.Show Highlights(00:00) Introduction to Ransomware and Backups(00:25) Welcome to Screaming in the Cloud(00:32) Introducing Rubrik and Annika Gupta(01:26) What Does Rubrik Do?(02:18) Evolution of Backup and Recovery(03:37) Challenges in Cyber Recovery(05:33) Rubrik's Approach to Cyber Resilience(08:44) Importance of Cyber Recovery Simulations(09:40) Security vs. Operational Recovery(11:28) Assume Breach: A New Security Paradigm(14:29) Multi-Cloud Complexities and Security(27:45) Hybrid Cloud and Cyber Resilience(29:25) AI in Cyber Resilience(33:09) Conclusion and Contact InformationAbout Anneka GuptaAnneka Gupta is a senior executive leader with a proven track record of scaling successful B2B SaaS businesses from the ground up. She’s led across product, tech, go-to-market, and operations, always with a customer-first mindset. Known for turning complex challenges into big wins, Anneka brings energy, innovation, and real-world results to every team she leads.She’s been recognized as one of San Francisco Business Times’ Most Influential Women in Business and 40 Under 40, as well as a Rising Star by AdExchanger and Marketing EDGE. Oh, and AdAge once named her one of the Top 10 Digital Marketing Innovators.Linksrubrik.com/sitchttps://www.linkedin.com/in/annekagupta/Sponsor: Rubrik 

Transcript
Discussion (0)
Starting point is 00:00:00 Attackers have gotten very smart. They realize that they have to go after the backups in addition to the primary environments because if a organization can recover, then they're not going to pay the ransom. And the reality is that the vast majority of ransomware events are attackers just trying to make money. Welcome to Screaming in the Cloud. I'm Corey Quinn. and this promoted guest episode is brought to us by our friends at Rubrik. They also bring to us their chief product officer.
Starting point is 00:00:35 Anika Gupta has been there for about four years now, and, well, first, thank you for dating to put up with my slings, arrows, and other implements of misfortune. I'm excited to be here. Thanks for having me. This episode is brought to us by our friends at Rubrik, who apparently think your cloud data deserves better than crossing your fingers and hoping ransomware doesn't find you. They protect your data across AWS, Azure, Google Cloud, and even Oracle Cloud because someone has to. See, while you're busy explaining to leadership why that S3 Bucket was accidentally public for six months,
Starting point is 00:01:08 Rubrik is making sure you can actually recover when things inevitably go sideways. Cloud breaches average $5.17 million last year. That's a lot of explaining. Check out rubric.sitc before circumstances require you to. So let's start at the very beginning here. What does Rubrik do followed up with, and what does a chief product officer at such a place do? Absolutely. So Rubrik is a security and AI operations company.
Starting point is 00:01:38 We help organizations recover their data when they've been hit with cyber attacks, such as ransomware, and we help them build cyber resilience into their infrastructure and strategies. We're also doing a lot around helping organizations operationalize. AI. As a chief product officer, my day is quite varied, but my role fundamentally is about enabling our product strategy and product roadmap and really thinking about what is it that we can solve better for our customers and how do we continue to innovate and innovate and innovate in this highly evolving landscape at the intersection of data security and AI. So I'm going to back up a little bit here and date myself somewhat. I'm an old crusty
Starting point is 00:02:25 have been from once upon a time. And I've always tended to view the idea of cyber resilience as being a fancy upmarket term for make sure that you take backups. We start talking about AI. It's odd. We've had tape robots since the last century. I get the sense that events may have outpaced me in this particular part of the world. It feels like it goes beyond backups today. That's a great question and a great perspective. I think that we end up talking to a lot of people that share this perspective, too. If you think about the technology of backup and recovery and the way that the use cases have evolved, really, originally, it was really around natural disasters and natural disasters that were going to hit your data center or operational issues
Starting point is 00:03:09 that, again, end up hitting your data center. But what we've seen is, first of all, as the data landscape has evolved, as organizations both have data that are still in their data center, data that's in the cloud, data that's in SaaS app. Now the surface area is so much broader, and the challenges are so much broader as well. Then on top of that, what we've seen is that there's been an evolution where it's not just now about operational failures or natural disasters. It's actually, a lot of the time, organizations are having to recover from cyber attacks. And when you're actually executing a cyber recovery, it's actually quite different than
Starting point is 00:03:47 operational recovery. Because in a cyber event, it's not just about, hey, recover everything to the most recent point. In a cyber event, you have to answer critical questions like, what was the blast radius? How do I find a clean point of recovery so I don't reintroduce malware into my production systems? How do I quarantine the malware? How do I know if sensitive data was impacted? All of these questions you have to answer before you actually do a recovery. And the challenge is, is that to answer those.
Starting point is 00:04:19 questions without a technology like rubric, it often takes weeks, months in order to actually be able to find that clean point of recovery and to answer all these questions and to get back up and running. And what we have seen firsthand is with our customers is that they've been able to shorten that cyber recovery time by about 100x. And that has allowed them to be more confident that in a cyber event, they can actually minimize the overall downtime of their business, which is hugely impactful because in a cyber event, it's not just the ransom that you may have to pay. It's actually the cost of downtime for your business, which can massively outsize compared to what a ransom might be. How challenging has been to productize this? Because I think back
Starting point is 00:05:04 at the places that I've worked as a grumpy CIS admin, which we then call, you know, DevOps or platform engineering or SRE, which is the same thing. They just pay better. Great. The problem that I found was that Planning for backups and restores, because no one cares about backups, they care very much about restores, but getting back to a point of viability was a highly bespoke process in every case due to architectural limitations, implementation decisions that have been made in years past, and, of course, the specifics of a given business model. Absolutely. So the way that rubric architected our systems from day one was really figuring out how we could build a unified platform that could create a single way, to manage and operate your backup and recovery across on-prem cloud and SaaS. And so we have built things that makes it super operationally easy, way easier to deploy where you don't need as much hardware on-prem. And in the cloud, we have cloud-native ways of deploying our technology.
Starting point is 00:06:05 And so it becomes a lot easier to operationalize across this whole ecosystem. And the reality is that the way to do recoveries well and fast, across these different surface areas is really different. And the limitations and technical challenges are very different. Also, when we think about how do you actually scan for malware and find clean points of recovery and know what was impacted. Well, how you really do it or how you tell the auditors you do it? I think those should be congruent.
Starting point is 00:06:37 They should make it. Yeah, but it's really hard. Like, as you said, in previous to customers using rubric, often what our customers have to do is rehire. the data, then run some kind of scanning on the head data, and that can take a really long time. Instead, the way that rubric is architected is that we have a single data and metadata layer where we actually can scan the backups and in real time provide insights into here's where we found malware, and we can do that both like every time we're taking snapshots as well as going
Starting point is 00:07:11 back through the historic data. So the ability to scan in place really enable, organizations to just do all of that upfront work without having to, like, set up whole separate infrastructure and take valuable time in setting that up and then actually running the scans. I've always found that when you start setting these things out, people care about them very much right after they really should have made it a point to care about it a smidge and more than they did already. No one is as zealous about backups as someone who's lost data, guilty.
Starting point is 00:07:46 How do you get people to care about this before it becomes a barn door horse situation? I think people are already making that shift. Like what we have seen with our customers is that since like 2019, 2020, 2021, as ransomware became a bigger and bigger challenge and organizations were really facing it, boards were asking the management teams, hey, what's your plan for ransomware? And as there was more publicized examples of massive attacks, on healthcare companies, on colonial pipeline, on casinos, on, you know, all of these very, very publicized attacks, now it is very top of mind. I think also what we're seeing is in highly
Starting point is 00:08:29 regulated industries, there's a lot more regulation coming out saying that, hey, you have to have a cyber resilience and cyber recovery strategy. It is unfortunately the case that people often invest still too late, but I do think that that psyche is changing around it. And I think the, where we're going in the future is saying, hey, you actually not should not just have this as an insurance policy, but you actually need to be doing cyber recovery simulations and cyber recovery testing on an ongoing and frequent basis, because you don't want to find out when you're in the middle of a cyber event that, hey, you actually didn't have the right technology or strategy or people or process in place to actually do those recoveries.
Starting point is 00:09:12 When you keep talking, referred to it as cyber, I hear this is much more of a security angle than my historical experience with. And they are aligned on a common axis. Whether it's because there's an attacker that wound up deleting data, or I once again did one of my hilarious database stunts that I'm sure will laugh about someday when the bleeding stops, I found that you care about a lot of these same things. Are you looking at this more as a security story? Is it more of an operation story? Or is there, is this a distinction without difference? I think it's kind of a distinction without a difference in that anything that we're building for cyber is also going to serve well in an operational recovery where a developer dropped a database table or where there was
Starting point is 00:09:54 some kind of server outage in your data center or where you had some kind of deletion or encryption event in your cloud environments like all all of the technology is the same to support both I think in the cyber scenario you just have these additional questions around the blast radius finding a clean point in recovery that are very different than what you would have in other cases where you might have to execute a recovery. So a question that I have to ask, it might be slightly impolite, but that's sort of my brand, and I tend to go with it, is that if I take a look at how folks care about things in business, there are two real categories.
Starting point is 00:10:32 There's the proactive idea that this could triple our market share, it could quintuple our revenue, summoned the board, great. And then you have the reactive side of things, security being one example, backups being another, AWS cost, high, buying fire insurance for the building, all things that should definitely be done and cared about, but you can throw effectively infinite money at these things as a white elephant until you have no money left, and it doesn't get you any closer to the business milestone that you're targeting at. How do you go to market in a story like that? I think if you look at, Security specifically, the spend going towards security is skyrocketing, but most of that
Starting point is 00:11:15 spend is going towards prevention technology. And the challenge with that is that people are investing more and more in cyber prevention, and yet there are more and more cyber attacks. There's a real challenge there if you're really focused around prevention. What we focus on is assume breach. Assume that you have already been breached. Assume that an attacker is either already in your system or a risk. going to get there, what are you going to do about that? And how do you actually recover and respond
Starting point is 00:11:44 to that? And so that is a separate area where traditionally there's been a pretty big underinvestment there. And so our message is, hey, you should be, like, you have to assume breach. I mean, because of the prevalence of cyber attacks. And if you just keep investing in prevention, prevention, prevention, you're never going to actually make your business resilient. And then you're going to be susceptible to the inevitable moment where an attacker breaks through your four walls and is able to breach your environment. You folks have been on the record as saying that I forget the exact number, but some horrifying percentage of security incidents. Backups have been compromised. I believe it was a majority of the time. Yes. For certain providers, you can actually go out on the
Starting point is 00:12:32 internet and see how ransomware groups are specifically compromising the backups. Rubrik has been architected day one from a security first mindset. So we have multitude of controls around the backups themselves that prevent the backups from getting compromised during an attack. Now, cynical question that I have to ask, is that entirely because the backups were explicitly targeted? Or is part of this because they've been compromised for two years? Things have naturally gone organically into the backups before someone finally noticed that they had a problem. It's one of those seno evil approaches to security approach. As best we can tell, we've never been breached is sort of a statement of proud ignorance. It's a great question. So what I will say
Starting point is 00:13:15 is that when malware lands in a primary environment, it can get copied into the backups, right? So that's a potential point of compromise. But what I will say is like usually that malware is not going to be activated on the backups. It will just be in the primary environments. And we have capabilities that help you find malware specifically in the backups when it lands or shortly thereafter if it's a new new malware that was detected. Attackers have gotten very smart. They realize that they have to go after the backups in addition to the primary environments because if a organization can recover, then they're not going to pay the ransom. And the reality is that the vast majority of ransomware events are attackers just trying to make money. It's not these like
Starting point is 00:13:57 massive nation-state actors, those are obviously there too, but it's a lot of cyber attackers for hire or people that are just trying to extract money out of organizations as quickly as possible. In order to do that, they have to try to compromise the backups as well. And for legacy solutions where they were not built with the security first mindset, where they're taking backups over open protocols, where the data is not immutable on the first copy, like all of these things that are just not very secure, that leaves the back. backups themselves susceptible, and the attackers will go after them. Roughly five years ago, I put out a blog post titled Multicloud is a worst practice.
Starting point is 00:14:36 And despite my opinion on that, which has evolved somewhat, but not entirely, the world has clearly gone multi-cloud, either by strategy or by accident. Sometimes it's for great reasons, sometimes it's for terrible ones, but it leads to massive expense in terms of infrastructure sprawl, in terms of the cost of complexity that ties into this. What are you seeing? Because that has to have security and resilience impact. Absolutely. And I think not only are our organizations multi-cloud, and often it is by accident, right? It's a organization acquired another company that happened to have, that happened to use a different cloud provider than their main cloud provider. Or two different departments within the same
Starting point is 00:15:20 company decided to use different cloud providers for different reasons, and that didn't get caught and reconciled together. There's a lot of reasons why people end up in this multi-cloud state. They're not only in a multi-cloud state, but they're in a hybrid cloud state. So they still have important data that's sitting on premise, as well as data that's in the cloud. Now, the challenge with all of this is that if you're managing a cyber resilience strategy with five different tools, one for your cloud environment, one for your SaaS apps, one for
Starting point is 00:15:49 AWS, one for Azure, one for GCP, one for OCI. If you're using different tools for all of this, then first of all, the operational complexity is really high. And second, actually making sure that you have a strong cyber resilience strategy across all of these when they may not be uniform and have uniform capabilities is very challenging. So what we see is that often organizations with this kind of complexity, one way they can manage the risk is by having a unified platform that helps them with cyber resilience across all these apps so that they have a single construct and way of managing cyber resilience and managing whether they are actually in compliance with their own policies, being able to manage that in a central way.
Starting point is 00:16:33 It's always strange to me seeing environments from a costing perspective where, oh, yes, we're spending a large amount on backup because it's worth it. You dive into it a little bit and you ask leading questions, and it turns out that they're backing up a fleet of web servers that have thousands of them and they are spending at great expense imaging each one of these things when the entire web server fleet is created about 200 lines of clown formation. It's, hmm, maybe there's a better way to do this. This gets worse in the multi-cloud story. I mean, for a while back, I found that one of the more cost-effective things companies could do is turn off all of AWS's first-party security
Starting point is 00:17:08 services and just suffer the breach because it costs less money when all is said and done. With multi-cloud, that is no longer tenable. People are forced to go in a direction of third-party providers that, frankly, have a better user experience, so thanks for that, but also starts letting them reason around this in a sensible way. So I guess my question for you is, is multi-cloud actively serving to make security worse? Like, are we just giving people bigger attack surfaces while patting ourselves in the back for avoiding lock-in, even though we didn't? Rubric.com slash S-I-T-C. That's rubric.com slash S-I-T-C. Any time you're talking about the surface area expansion of data and applications, that is
Starting point is 00:17:53 increasing the risk to your organization. It's increasing the number of entry points that an attacker has. It's increasing the amount of surface area that your security teams have to monitor. So there is inevitably a risk associated with it. I think most of the organizations that I talk to that have multi-cloud environments, it is not because they explicitly chose it for a vendor lock-in reason, it's usually because they evolved into that through acquisition, through not having a centralized IT team or infrastructure strategy, and ending up in that state. There are some that are trying to play the clouds against each other and get a better deal, but I think it's becoming more and more common knowledge that, first of all, you're increasing
Starting point is 00:18:38 your operational complexity and you're increasing your security risk area. So I think that it's a challenging position to take. And also, like, you usually, the more that you commit to a given cloud, the more you can get discounts based on that commit. So if you're spreading that commit across multiple clouds, then you're just not going to get the best deal. So I think that's a big piece. Cost is super important for our customers. And we, you know, when we deploy our technology in the cloud, we are cost optimizing the storage of backups massively. compared to the native solutions that the cloud providers provide, because that is one of the
Starting point is 00:19:17 benefits in addition to cyber resilience that we need to provide. Otherwise, it becomes, as you said, cost prohibitive to actually provide these services. I should point out that as we're recording this, we are in the day after AWS's big meltdown for availability that lasted half a day. And I really hope that by the time this publishes, people don't come back and have to ask which one. So we're going to be optimistic on that. But there's a lot of knee-jerk reactions of, oh, we're going to start going multi-cloud for everything. We're going to start spreading things out
Starting point is 00:19:46 so that we aren't subject to this. But so many of these stories are not, this is how we eliminate a single point of failure. Here's how we add a second single point of failure at tremendous expense and then act surprised later if we actually do this. But these conversations happen every time
Starting point is 00:20:01 that there's a significant notable cloud outage. But people generally don't do that once the panic has subsided. And people have the strategy they have for a reason, and those reasons are no less valid today than they were a week ago. I agree with that. And I think that there are multiple – there's multiple types of risk factors that companies are inevitably thinking about. They're thinking about, okay, like what happens if my tenant gets compromised or my account gets compromised by a cyber attacker? They're thinking about what happens if the cloud goes down in this region or zone.
Starting point is 00:20:37 They're thinking about what if the cloud totally goes down and I have to fail over to a secondary cloud. Like there are a range of different scenarios that companies are worried about. And we see this and we talk to them all the time. And I think there's a, you, as with any risk, you have to ask yourself, like, what's the expected outcome of this risk actually manifesting? How costly is this to your organization? And is this risk worth managing? One of the things that we've found to be quite successful for organizations is using our technology to be able to keep a copy of their applications and be able to do a recovery cross-region. So thereby you aren't reliant on a single region in the cloud and like a multi-region outage is much less likely than a single region outage.
Starting point is 00:21:26 And so there are coping mechanisms. I think truly doing cross-cloud recovery, backup and recovery, is quite challenging for a cost perspective, operational perspective. There's so many aspects of that that make it not super realistic today. I do see companies doing a rehydrate the business level of backups to another provider, not necessarily because there's a tremendous risk of AWS suffering its first ever global network outage. They've never had an issue that hit every region. They've had control plane issues. But it's easier for some of these companies to do this than explain to their auditor every period why they didn't do it. It checks a box.
Starting point is 00:22:05 That feels like it is much less tied to the specifics of risk and more of a decision that they make. There are a lot of check-the-box capabilities that people want to be able to offer. And we think about those and offer solutions, different kinds of solutions for those check-the-box features. And then there's stuff where that needs to be operationalized really well because it is. is something that you will likely rely upon in a real event like cross-region application recovery and being able to orchestrate a full application recovery across the different resources and data that make up your application as opposed to doing it on a service-by-service basis. So there's a lot of things that are like real challenges that you want more than a checkbox for
Starting point is 00:22:46 and then there's some stuff that's understandably you need a checkbox for the auditors and that's kind of the way it goes. It's always difficult to test these things because you can simulate a full region outage of your cloud provider of choice whenever you want, but there are other companies involved in the critical path of getting you in front of customers.
Starting point is 00:23:03 And you can't test their ability to survive that with their critical path vendors and so on and so forth. And so it winds up being a giant thorny knot because everyone cross depends on everyone else. So we see these challenges of how do people come back up when everyone is codependent
Starting point is 00:23:18 on one another already working. And that's where some of the fun firefighting engineering tends to come into play How do you think about that? There's always going to be externalities and things that you haven't tested and that you're going to have to deal with in real time. That is just the nature of doing business. You cannot map out every single dependency between all of your technologies for all of your applications. So I think one is figuring out what are your, what is your minimum viable business?
Starting point is 00:23:47 Like what are the applications that are absolutely critical to servicing your business that you cannot live without? So then you shrink kind of your surface area. You're really thinking about those applications. And then test what you can test. Like go and test the pieces that you're able to test. And that way you get the reps in on the things that you can control and the things that you can see and the dependencies that you do know about. And that way when, you know, let's say you're able to test and manage 80% of those things, then when you're hit with the real cyber event, you can spend all your brain power on the 20%
Starting point is 00:24:23 that is unexpected, because in an event, there's always going to be unexpected issues that emerged. Some of them may be technology. Some of it may be people in process, like, oh, you don't have the phone number for this vendor that you thought you had the phone number for, right? It's simple. Or you do, but it turns out they have one or two other customers that might be in the phone tree ahead of you. Yeah, exactly. So there are many things that you can control, but I think if you have the ability to actually test recoveries for things that are incredibly, like for the applications that are really incredibly valuable to you and you're ill. able to cover 50 to 80 percent of that whole process, that just sets you up even better for
Starting point is 00:25:00 when you actually have to face a cyber event. What do you think people are mostly getting wrong right now when you take a look at the broad sweep of how they're thinking about cyber resilience? I think specifically in the cloud, there are a couple of patterns that I see. One pattern is people thinking that because the cloud is redundant, that means that they are actually protected in a cyber event. But the reality is that if the data is corrupted, redundancy only means that that is going to get replicated throughout. Replication is not a vacoff. You learn this at your peril. Correct. Yeah. So I think that's one thing that's not super well
Starting point is 00:25:40 understood all the time is that that's not a cyber recovery strategy. That's a failover if your infrastructure is down, but your data is fine. The second thing that I would also mention is that every cloud company has their own native backup solution that essentially is taking cloud snapshots of the environment. There are a lot of challenges with these solutions. That is putting it very charitably. Yes. And I think a lot of people are like, well, this, I have a solution because I have native backup. And the reality is, is that there are a lot of gaps in native backup, even from like an immutability, recoverability, granular recovery. And then when you talk about all of the cyber capabilities of being able to detect malware, find a clean point of recovery, detect the blast radius, all of that, then the tools are really lacking.
Starting point is 00:26:30 And so that is the cyber resilience plus the actual like granular capabilities and mutability and on top of that the cost that some of the native backup solutions add to your storage bill is quite high. So with our solution, like, we optimize all of those pieces, and we're not just limited to a single cloud. So in your inevitable sprawl of multi-cloud, because of the way your business has evolved, now you have one solution that can cover all of that. It's worth pointing out as well that it's easy to become overly negative when looking at a lot of the first-party offerings. I mean, I've stared too long into that abyss, and it has gazed deeply and thoroughly into me, which probably explains a lot. But these are hard problems, and it's very tricky to start building things that are holistic solutions for folks. We've been talking about cloud, but there's an awful lot of hybrid out there. It turns out that building data centers wasn't knowledge lost to the ancients, and now only three specific companies can do it.
Starting point is 00:27:30 Lots of companies have on-prem facilities and are in a variety of different hybrid approaches. What's your story for those folks? That's like our ideal customer, honestly. We have so many organizations that we support that have a piece of their applications on-prem, some of their applications in the cloud, some applications that span on-prem and cloud and have different components, and being able to have a single solution and platform to be able to provide cyber resilience across all of these applications and have the same paradigms, have different ways of actually taking the backups and doing the recovery themselves
Starting point is 00:28:06 based on the tools that are available in each of these environments, it's really important. And that's why a lot of our customers come to us because they want that solution that's going to span across. And they also want the flexibility of saying, hey, maybe in three years I'm going to move even more of my application to the cloud. Will you be there with me on my journey or am I going to have to start from scratch? They don't want to have to start from scratch.
Starting point is 00:28:29 I will also point out that you have a variety of approaches that makes sense for a modern cloud infrastructure. I've worked with so many, quote unquote, legacy vendors, which, you know, a condescending engineering term for it makes money, where you go in and there, oh, so what are your instances for your database? Like, it's DynamoDB. What do you mean instance? Like, what's that? Can you just pull a disc image from it? And then we close the page and look at something more reasonable for us. But as a closing thought, and I understand that this might be controversial for, well, most companies, but I'm going to roll with it anyway. When it comes to cyber resilience, it's one of those things that absolutely positively has to work. When people are dealing with rubric, they're already having a pretty bad day on some level. Why is this a great spot for AI? Oh, that's a great question.
Starting point is 00:29:13 I think, I mean, AI... I try to keep as not insulting as I possibly could, and I feel I may not have succeeded for it. I don't know. I don't think that that's an insulting question. AI is a double-edged sword, right? There are wondrous capabilities that AI is going to give us, and there's things that we're investing in from improving our solutions, leveraging AI, and then AI is also a risk, right, that has to be managed.
Starting point is 00:29:38 And so when we think about AI, you know, I was telling you earlier about the journey of people having to recover from natural disasters and then cyber events, they're going to have to recover from AI making mistakes as well. So this is just going to be another vector of risk that you are that's going to necessitate having really great capabilities around recovery. Now, I think like AI is obviously still in its infancy and there's a lot of challenges that organizations are facing as they think about the adoption of AI and how they can truly get value from it because I think, you know, if you talk to survey organizations, most
Starting point is 00:30:17 organizations say AI is a top priority, but most projects are stuck in prototype. They're not getting to production. It is certainly not the top of the spend curve in the common case. Correct. Correct. And I think, but there's a big challenge around how do you provide monitoring for AI agents, governance for AI agents and remediation when AI agents make mistakes. So that's something that we're thinking about in the context of our platform and where we can offer it. And we're also looking at In this complex sprawl of data and infrastructure and applications, what are the ways that we can use AI to help organizations monitor their infrastructure better and make recommendations of like what are their most critical applications? How can they be protecting these applications better? I think there's a lot of use cases like that that we can troubleshooting failures in backup and recovery.
Starting point is 00:31:12 Like, all these use cases are things that we're also looking at, well, can we use AI to make it better, to make it simpler, to make it easier to operate our technology and provide cyber resilience to large enterprises? Yeah, and I think that that is a reasonable take on this. There's a lot of challenge that I have with folks that are tripping all over themselves to take what they already are doing and already going to market with. And, nope, it's AI, it has been forever. But it does change some things. Not everything. I don't think that it's clearly not valueless, but I also don't think we're going to properly summon God through JSON.
Starting point is 00:31:48 I think the truth probably is somewhere between those two. And we're still figuring out as a society what that looks like. Technology advances. And taking an approach of optimism, but with a sense of caution to it, seems reasonable. Yeah, I think so. I mean, I think with any technology, there's great advantages that come with it, but you have to figure out how to leverage it. And at the end of the day, it has to be solving a real problem.
Starting point is 00:32:10 And that's, I think we're still in the time with AI we're trying to figure out how to make it, like how to take this technology and leverage it to solve really interesting problems. And it hasn't been totally figured out yet, especially for the large enterprise context. I think you're right. We're going to see where this plays out. I'm very curious to see how it goes. But fortunately, if it winds up not doing what we had hoped and ends up being an entire boondogling disaster, well, at least we'll have some resiliency around our. data. I sure hope so. Thank you so much for taking the time to speak with me. I appreciate it. Yeah. Thanks for having me. If people want to, if you want to learn more, where's the best place
Starting point is 00:32:48 to them to find you? If you want to find me, I'm on LinkedIn. You can look up my name. I work at Rubrik, Chief Product Oppositor. If you want to look up Rubrik, go to rubric.com, and you can also find us on all social media platforms. Yes, and I believe the New York Stock Exchange or are you NASDAQ? I can never remember who's on which is team. NYSC, RBRK. Apologies. Yeah, it's one of those things where it's certain people care very much and for the rest of us it just gets lost in the details. Anika Gupta, chief product officer at Rubrik, I'm cloud economist Cory Quinn and this is screaming in the cloud.
Starting point is 00:33:22 If you've enjoyed this podcast, please leave a five-star review on your podcast platform of choice. Whereas if you've hated this podcast, please, leave a five-star review on your podcast platform of choice, along with an angry, insulting comment that we're just going to scatter to the winds because we will not be taking care of that data. Thank you.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.