The Biggest AI Security Problem Isn't the Model. It's This. | Devvret Rishi

What is an AI agent, really? Strip away the hype, and it's a model with access - to tools, APIs, databases, email, anything that lets it take real action instead of just generating text. That access is exactly where the risk lives, and Devvret Rishi, GM of AI at Rubrik, and former co-founder & CEO of Predibase, joins Craig Smith with a string of real-world incidents that make the case concrete: AWS reporting four major outages in 90 days after deploying coding agents, a Meta-related agent that deleted someone's emails while they were actively asking it to stop, and Rubrik's own internal pilot catching incidents that, without governance in place, would have gone unnoticed. The conversation lays out the impossible choice most enterprises are facing right now - block AI agents and forfeit the ROI boards are demanding, or grant access and hope nothing breaks - and walks through how Rubrik's approach uses small, fine-tuned AI models to enforce plain-English security policies on every single agent action in real time. It closes on one of the most underexamined risks ahead: as agents increasingly talk to other agents to get work done, a layer of activity is forming that no human is watching, and the question of who's accountable when something goes wrong in that layer is only getting more urgent. Subscribe to Eye on A. I. for weekly conversations with the people building and deploying the future of AI.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  We define agents as just really like models with access, so like access to tools or APIs that can start to do work inside an organization.

• 0:08Craig S. Smith?

  Once these become agents unseen and visible to the humans, talking to each other, transferring data to each other, you're really vulnerable because you don't know where the data is going. Beyond agents having access to tools and to databases, agents are talking to each other. Where do you see this agent economy going?

• 0:29Speaker 00

  There's a question about like, will AI agents and AI like cause job displacement? AI may not, but someone who knows AI.

• 0:37Craig S. Smith?

  We're going to talk about Rubrik. We're going to talk about Rubrik Agent Cloud.

• 0:44Craig S. Smith?

  Can you start by introducing yourself to listeners? Tell us a little of your background so far as it's relevant, particularly education and what you were doing before Rubrik.

• 0:59Speaker 00

  Yeah, I can start at the beginning, maybe. And I'll just say that I I'm deaf. So I was one of the co-founders and CEO for PredaBase, which was a generative AI infrastructure company. We started right before the beginning of the gen AI wave in 2021, and really were helping organizations build and then deploy the precursor to large language models, which were really pre-trained deep learning models. It came out of our experience at Uber and Google, which is where I and my co-founders worked.

• 1:27Speaker 00

  You know, prior to starting the company, I was at Google for about five years. Before that, I was always in the AI space, doing my masters and others kind of in core computer science and stats. So that's really my backgrounds. My company was acquired by Rubrik last summer. And so we actually joined forces with kind of our core machine learning and LLM infrastructure platform. So we were the model backbone that drove deployments of AI in Fortune 500 organizations, faster tech forward moving companies as well. So we really had a really broad gamut. And when we joined forces with Rubrik, the core idea was we wanted to take the platform we had built and mix in what Rubrik did really well. Rubrik is a data and cyber resilience company.

• 2:12Speaker 00

  It started off its core offerings around making sure that businesses were resilient to downtime and data, layered on security offerings for cyber. And with the acquisition of my company, Predabase, we're building kind of a combination of like our AI platform plus data and identity security into a net new offering we called a Rubrik Agent Cloud. The core goal in the observation that we had is that AI is coming very quickly.

• 2:37Speaker 00

  The AI tools and models are actually getting quite good very quickly as well. And so people are starting to adopt these tools en masse. But the thing that's actually slowing down their ability to deliver ROI is that I think that there isn't a great framework to manage the risk of what these agents do inside of an organization. So that's a challenge we set out to solve with the Rubrik Agent Cloud.

• 2:54Craig S. Smith?

  Before cyber resilience and that sort of thing, Rubrik was focused on what? On making sure that all the ports to the data were closed and all the various things that people screw up, that leaks data.

• 3:16Speaker 00

  I can tell you a little bit about the early days of both Predabase and Rubrik. And Rubrik, I know from being here, but I think Rubrik really started its early days with a mentality of assume breach, which was to say that there's lots of solutions that we're trying to say, well, let's make sure that the, you know, door is locked.

• 3:36Speaker 00

  But the real thing you needed to be able to do was make sure that as attacks actually happens, for the ones that would get through the defenses or successful, did you have a way to be resilient towards your business? It used to be the case that most of the things that drove business downtime were like natural disaster, fire, flood. These were the things that you kind of conventionally bought that insurance policy for. But increasingly over time. That became more geared towards ransomware attacks and cyber. So, security became really the primary threat vector that acquired business resilience. So Rubrik really thought about regardless of the types of instances in which you might, your business might be put at that risk, whether that's something like the natural disaster of old or the cyber attack of new, like how do we provide a way that your business can

• 4:20Speaker 00

  basically be resilient or bounce back regardless from both of those situations? That was really its core genesis and then it started adding more capabilities around prevention and detection over time. So you got kind of a layered approach towards the defense. You knew that things could only get so bad if anything did come through, but it started to layer on based on the data understanding, the identity understanding it had. Mom, I think Rubrik recognized that the next threat vector, if you thought about like natural disaster, fire, flood, and then cyber attacks, we think that the next threat vector is going to come from AI and specifically agents that are deployed in an organization. We define agents as just really like models with access, so like access to tools or APIs that can start to do work inside of an organization.

• 5:02Speaker 00

  And that's why I think it motivated Rubrik to do the acquisition of PredaBase, my company, because what we actually had really started off on is like building the core infrastructure platform on which people were building models and starting to deploy agents as well. So we wanted to bring all of that in-house to be able to say, we've secured you in natural disaster, fire, flood, and cyber and security, and now also for the upcoming wave of agents.

• 5:25Craig S. Smith?

  Your background, what was your, what were you doing at Google? Were you in agentic or security?

• 5:33Speaker 00

  Yeah, it's funny. So prior to Google, I was both doing Android Masters, kind of currently in computer science and stats, focused on resilient like machine learning algorithms, specifically for like privacy preserving use cases. Then I went over to Google and I worked on across a number of different teams, including Google Research, where I was working on, if you remember, the early days of agents actually looked like the Google Assistant as well, which was like this embedded assistant in all these different devices. We were working on more deep learning focused use cases within the assistant. So that was my first exposure to agents. More than a decade ago at this point. And then the second area that I worked was actually on Google Cloud's AI platform.

• 6:15Speaker 00

  So I remember we hadn't even named it Vertex AI when I was there, which is the name of it now. But we were really forming kind of the initial basis for the fact that more people were starting to do machine learning and AI workloads on the cloud. How do we build a platform that people could actually use across all that? So that's what I was working on until the end of 2020, the pandemic, when I met my co-founders, who had built these frameworks at Uber to make it easier to be able to use machine learning internally and build these applications. These frameworks got popular, so they open sourced them. As things happened in the open source, it got popular externally. And so we all decided to team together and start a company around it, which was Credebas in early 2021.

• 6:54Craig S. Smith?

  When you say Rubrik Agentic Cloud, why cloud? Is it a bunch of different components? Is it an ecosystem? Or are you literally saying it's in the cloud and then we apply it to whatever system?

• 7:08Speaker 00

  The honest reason for why Rubrik Agent Cloud is because Rubrik today, I think, before the Agent Cloud had one primary product, which is called the Rubrik Security Cloud. And the core intuition behind the Rubrik Security Cloud was as organizations were thinking both about their on-prem, but also shift from on-prem to cloud migrations. How do you secure that transformation that's happening in the organization? And then when we rolled out like the Agent Cloud, we realized like AI was a whole new system where your conventional security principles didn't really hold up. And so we thought we needed a new approach. We wanted to name it the Rubrik Agent Cloud as kind of a mirror towards like the Rubrik Security Cloud. And I think the core thing about the Rubrik Agent Cloud is that it really speaks to the fact that agents exist everywhere in an ecosystem.

• 7:52Speaker 00

  And when I say everywhere, I mean, they can exist on your laptop as something you're running. We think about like instances like OpenClaw or, you know, Claude Code and others. They can run it in like a cloud environment that you manage. It can run in a number of different places. But what you want is a single kind of control plane across all of those. That gives you the visibility and what are these agents doing and some level of control over those agents as well. And so that's what we think our like Agent Cloud basically does is it hooks into these different environments and allows you to be able to have that visibility and governance.

• 8:22Craig S. Smith?

  I've spoken to a lot of agent orchestration companies that are building, there's the LLM.

• 8:31Craig S. Smith?

  Foundation, there are these agentic build platforms where you can build and deploy agents. There's, there are now companies that are building just the orchestration layer so that you can keep track of what these agents are doing. Are you guys orchestration or are you a layer above that?

• 8:51Speaker 00

  We're a layer above it. My point of view is that there's lots of good orchestration tools that exist out there. There's lots of good platforms to build agents today. You know, each of the hyperscalers has their own agent platforms, including orchestration. So Vertex AI has, you know, their own agent, uh, ADK. You have Bedrock inside of AWS with Agent Core. You have a suite of tools inside of Azure. Salesforce has Agent Force. ServiceNow is an agent platform. Plenty of good ways now to be able to build agents. What we've noticed is actually hard is how do you place some level of controls around making sure that the agents, regardless of where they're built, actually have some level of consistent runtime guardrails on what they can and can't do.

• 9:33Speaker 00

  And this actually, I think, is a very tricky problem because agents look less like conventional software. And inside of an IT organization, a little bit more like what you or I might be able to do.

• 9:42Craig S. Smith?

  Yeah.

• 9:42Speaker 00

  And so like my agent as an example, which my agent, the one I use most heavily is just out of personal use is like Claude Code and Claude Co-Work. My agent has access to Salesforce and my agent has access to email because I use it to write emails and I use it to summarize opportunities in Salesforce. But what I don't want it to do is take something that's sensitive from Salesforce and put it out and send it out in an email autonomously, right? And so that's just one thing that happens with Claude Code and Co-Work that I need to secure. But if you're using a different agent harness, if you're using OpenAI's Codex, it'd be the same concern. And so my view is that there's lots of different good systems. They're building excellent ways to integrate into the different areas, good harnesses, good orchestration frameworks, ways to be able to run into cloud like Anthropic launched managed agents yesterday.

• 10:25Speaker 00

  But how do you have a consistent way to be able to monitor, observe and actually runtime guard whale? Any of the things that those agents are doing? That's where we come in. So if you think about like the core layer, it's like your models and your MCP tools or your other API tools. The layer above is going to be Like your agent platform builders plus orchestrators. And then what we think about is like having the security kind of umbrella across this with the Asian cloud.

• 10:47Craig S. Smith?

  Does that apply if if an enterprise is using a combination of agent builders, a combination of orchestration, can you apply this across?

• 11:00Speaker 00

  That's one of the settings where I think it's the most compelling. And frankly, I think that this would be true for most enterprises, sort of similar to how you saw in the cloud era. Like you had organizations adopting multi-cloud. I think you're seeing even more of that in the AI era because these things are coming out so quickly. I think where Rubrik Agent Cloud actually really shines is you have multiple different agent platforms that you're using. At Rubrik, we ourselves have multiple different agent platforms. We in fact have like a couple of different coding agents that we have, including Claude Code. But we also build agents on top of Vertex AI. You know, we have agents that are built and also other third-party tools that I'm not even mentioning. And so the question is like, how do you secure across all of this? This is where I think, you know, our agent cloud provides tremendous amount of value really at day zero.

• 11:42Speaker 00

  Because oftentimes what people want to know even at the beginning is what are the agents that are even deployed in all these different ecosystems? So we can plug in, provide the automatically discovered and scanned inventory, and then allow you to start to get the system of control across all of this.

• 11:55Craig S. Smith?

  Yeah, one thing I've wondered about, you know, there's a lot of talk about the the security risks of agentic systems. And and something like Rubrik Agent Cloud, is it of sort of belt and suspenders? That you you just don't want to worry about security? Or are there examples of very real examples of agents going rogue? I know you have a program or a campaign right now with this Chungar. That this little.

• 12:33Speaker 00

  Have you seen Chungar?

• 12:34Craig S. Smith?

  I haven't, but we were talking about it earlier. Is how real are are the risks? You know, and I use OpenClaw on my primary computer and everyone's like, oh, my God, you're crazy.

• 12:48Craig S. Smith?

  I don't know. What is the risk?

• 12:50Speaker 00

  I, nine months ago, when we started to talk about it, there were probably like one or two of these incidences that I think were, you know, important to to flag as like what the risks could be. Now, my feeling is that the like, it's almost.

• 13:09Speaker 00

  You're really stuck between a rock and a hard place. Where I see organizations take two things. They either A, take a posture that like, this stuff is too risky, so we're just gonna block access. And then you have a question about why is our A O I not go, you know, delivering R O I. It's like the code book, because we said we have, you know, the agent, but it can't access any tool internally. Of course, it can't deliver R O I. The second is where you say, we're going to, um, you know, for lack of a better phrase, basically grit our teeth. And just say, go and hope nothing goes wrong. And you give agents access to the different tools. And as a user of these tools myself, I think you mentioned you use Open Cloud. Like I use also other like local cloud coding harnesses. The agent does ask me permission for things. Yeah.

• 13:51Speaker 00

  Oh, my gosh, it's asking me permissions every 20 seconds, every 30 seconds. I totally transparently, I'm hitting accept, accept, accept at a certain point. And it's not that, you know, it's not that these things are like necessarily all dangerous. But it's asking for root permissions to certain folders. I had an example where I was asking the agent to create a document. And, um, you know, the agent noticed that my Google Drive connector was disabled. So my agent wasn't supposed to go go through Google Drive. So what did it do? It spun up a browser window, typed in drive.google.com, clicked upload, and then opened up my file navigation. Now, was that scary? Yeah, that was scary. Did anything bad happen in that instance? Nothing bad happened in the sense that I didn't have any local credentials on it.

• 14:33Speaker 00

  But actually, I think since we started talking about it in the last nine months, we've seen incident after incident where this has gone wrong. Small example would be like the coding, uh, uh, agent that like deletes production databases. I think there's at least two different examples now of publics like areas that publicly posted. Where an agent got access to a production database because, you know, you're hitting yes, yes, yes, or something along those lines. And poof, like, you know, your database is dropped altogether. That's a nightmare for any organization to go through. I think, um, A W S had its, um, post where it said after coding agents got rolled out. They had four C V one outages in about 90 days. Which for A W S, like, and it might have been shorter than 90 days, but for A W S, like, the hallmark of like stability, cloud resilience, that is what you buy them for. S L A is what you buy them for.

• 15:18Speaker 00

  That's incredible, right? Like, this company has processes, but these agents are going through them very quickly.

• 15:24Craig S. Smith?

  Yeah.

• 15:25Speaker 00

  Meta, I think, like, had its own, like, incident as well, where I think it was an instance of Open Claw that actually got access to, you know, someone's email inbox and deleted largely their emails. And so I think, and look, we shared a blog post too, where we did a limited release of Claude code. And just even in our individual organization, we saw three different instances of things that we knew, like, should not be happening. We were able to catch, but we were only able to catch because we had Agent Cloud hooked in. And Agent Cloud uses AI to actually secure and govern all these things. Like, we saw an instance where, you know, people were writing and connected into GitHub, writing these Gist, and the Gist was accidentally shared to a public domain, not the private GitHub.

• 16:06Craig S. Smith?

  Sounds like anthropic.

• 16:07Speaker 00

  It's not, it's, and of course, there have been a number of leaks that I think we could be talking about in the last week or two in the market as well. But I guess, like, my quick point of view is, I think, nine months ago, it felt maybe a little bit more belt and suspenders, like, you know, let's make sure that the, let's make sure that the things are placed correctly in order. But where I think things are now is you really are stuck between two types of choices. Either block access altogether. And my guess is somewhere, some boardroom or some CEO is going to be like, why aren't we getting ROI with AI? Or enable access. And kind of, in some ways, like, live with the fact, unless you have a solution that's actually monitoring everything that the agents are doing and can enforce these policies, which is like what we've built for us internally and now Packaging.

• 16:52Speaker 00

  Unless you have that, it's sort of like, you know, deploy it and maybe have some grit teeth and hope nothing goes wrong. But these agents are quite promiscuous, I think, in what they can access.

• 17:01Craig S. Smith?

  I've read about some of these cases. I haven't read a good analysis of what went wrong. I mean, the email, the woman that's, like, forensically typing, "Stop deleting my inbox", and it just keeps on deleting.

• 17:15Speaker 00

  I think what often goes wrong is actually quite simple. It's like the agent was doing the right thing 90% of the time, and then just decided to take one wrong action. But the wrong action can happen like that, because the agents are operating so fast. Like, what do I love about the agent? It does what took me a week, like, you know, it does it in an hour.

• 17:32Speaker 00

  Also somewhat bad when that thing that might have taken me a week would be something that struck there.

• 17:36Craig S. Smith?

  Agent Cloud, Rubrik Agent Cloud, how do you deploy it? If you've got, for example, Claude Co-Work running, Claude Code, Open Claw, maybe someone's doing something with Open Claw.

• 17:51Speaker 00

  And maybe you're using Copilot as well as Microsoft, you know, as part of your Azure subscription. I mean, I think typically I see three different places that people are building agents and then I can cover how Rubrik Agent Cloud deploys. The first is like you're building, you're building and using agents on your client, like on the desk. So that's like Claude Code, Open Claw, Claude Co-Work, they're all local. The second is that you're building agents that are in the cloud. And this is like, maybe you're using things like Copilot Studio from Microsoft or any of the managed services from hyperscalers. And then the third is you're like truly building something homegrown. Like you just got your OpenAI API key or your Anthropic OpenAI key and you're like, you know, wiring it up through one of these orchestration frameworks. The Rubrik Agent Cloud has actually hooks into each of these different types of ecosystems.

• 18:35Speaker 00

  So direct API integrations, it can integrate with your mobile device management system as example to get a sense of like what the local is happening, has an AI gateway as well. So it provides a way to hook into each of these systems and then immediately start to get like the logs and monitoring and survivability inside of our platform. And then also start to push down its level of control that it has. And so our offering can deploy either as a fully managed SaaS offering, which deploys in, you know, the cloud managed by Rubrik, or inside of our customers' VP C, inside of their virtual private cloud, and really can hook into the three different kind of surface areas where we see agents get built and deployed.

• 19:09Craig S. Smith?

  And when you say hook in, is it like an API? Someone's enabling?

• 19:15Speaker 00

  Yeah, yeah. We have multiple different ways that we can hook in. And so we, you know, the simplest way people often get started is if you're building an agent like in Copilot or Copilot Studio, you can provide like your Azure API credentials and like, you know, Agent Cloud is automatically plugged in, has access to the right side of things on its back. If you're running on the endpoint, then like we can integrate with an existing like mobile device management tool, like an MDM that you have. And then if you, and then otherwise, like if you're just again, using your own APIs, we can give you the API from the verification account to use as well. So a little flexible in how we can kind of get there. API integration, give you an API you can use or integrate with your MDM. All different ways that RAC, as we call it, verification.

• 19:56Craig S. Smith?

  I just want to talk about how much do you know about how OpenClaw works and the security vulnerabilities?

• 20:05Craig S. Smith?

  Partly because I'm using it.

• 20:07Speaker 00

  I think enough to be dangerous would probably be my answer. I think OpenClaw really has a lot of the same types of security concerns that I think we would have with some of the conventional desktop agents with like an enhanced level of concern in the sense that it's like not necessarily managed or federated historically. I think when the open source project was getting distributed by, you know, a central party like Claude Codes or CoWorks might be, which has some inbuilt guardrails. So yeah, enough to be dangerous. I think, you know, organizations oftentimes take a few different types of postures. Like one of them is like we ban OpenClaw outright. In that case, you have a problem of like, how do I know if OpenClaw is even running in the organization? So that's one of the problems that we saw right out of the box. Like, how do we monitor and detect? And then there's, you know, what can OpenClaw do, which is another area where we help.

• 20:52Craig S. Smith?

  And what does the, what does the product look like? Is it, is there a dashboard that a human monitors? Or is it all agentic? And you just get an alert if something's going wrong?

• 21:04Speaker 00

  Yeah, there is a dashboard that like a human can access and monitor. And the product really has, I think, like three key, let's say, journeys that you can think about. The first is the dashboard will show you like the inventory. The inventory will tell you what are all the agents that are running? What are the different tools that this agent can call? And again, this is across the different places your agents might be built. What are the identities associated with those agents? What models are they calling? So it's like all that visibility, like in one place, just so you have it. The nice thing is all of this is like automatically discovered and scanned. You don't like go in there and automatically and manually register. That's like the first user journey is the dashboard and the visibility. The second thing, which I think is like one of the more powerful things in the product, is we have a technology we've called Sage,

• 21:49Speaker 00

  which stands for Semantic AI Governance Engine. Really came from our observation that a lot of the customers I worked with would have a policy that they wanted to make sure their agents were consistently adhering to. Something like, so I spoke with a customer in healthcare yesterday and they said like, "Hey, you know, agents are not supposed to give clinical diagnoses." No idea how to look at and write a static rule, like a string match, and be like, "Hey, is what the agent said a clinical diagnosis or not?" So our view is like, what you need to do is instead of having like human judgment, try and look at everything that an agent was gonna put out, because that's way too slow. We're actually gonna have these small language models that can be fine tuned and deployed to run on every single agent inputs and outputs, to see if it violates any custom policy that you define.

• 22:32Speaker 00

  So we call that system Sage, and really what you can do is you can go into the platform and you just type out a natural language. You could literally type out, "Agents should not give clinical diagnoses." And then we expand on that. We like fill it in with some examples. We show it with examples. We'd flag on what we wouldn't. We'd flag on as borderline cases. And you can deploy that as a guardrail that'll actually run automatically and everything, and then trigger an alert when something goes wrong. So that's the second experience. The third and final experience is inside of our platform, you can also double-click into an agent and get a sense of like, what's all of its map of actions. So you can see kind of the trail of like, what did it do? When did it do it? And then, you know, if you need to, you can rewind an action as well to the previous snapshot we have from our Rubrik's backup.

• 23:12Craig S. Smith?

  You guys had an app with Ludacris playing rewind or wind it back with on that. How do you rewind an action?

• 23:25Speaker 00

  It's a complicated thing, but I think that the core of it is that Rubrik actually is lucky to protect a lot of the data for, you know, many of our large customers today. And so as we protect the data, we actually maintain like iterative snapshots of like the underlying data source that we might protect. You can consider it's like an Azure SQL database or Salesforce instance. And so if an agent takes a destructive action, you know, let's say on Salesforce or on Azure SQL database, like the first thing we get is like, we get the observability that the agent took that action. Because that's, you know, the first journey that I mentioned. So if we notice a destructive action and a user wants to then say, "This was incorrect. Rewind it back to the previous snapshot." We can then use the power of Rubrik in the backup in order to be able to restore it from there.

• 24:11Craig S. Smith?

  Uh, the, uh, this is a SaaS offering you were saying, uh, is it priced, how is it priced? Is it a buy seat or, or some enterprise subscription?

• 24:25Speaker 00

  Yeah, we do a kind of like right sizing towards the individual company and like the use case. The product is new, so we went, um, GA recently, earlier this year. And so we've actually been iterating with our early customers on the preferred pricing way. Uh, but we've been baking in kind of a license fee that gives them certain tiers of usage.

• 24:45Craig S. Smith?

  Yeah, with the explosion of, uh, of agents being used by individuals, uh, not enterprises. And, and as, as important as the enterprise use is, I, I, I think the individual use of agents is going to be as, as large a market as in time as people become comfortable. Uh, do you offer a consumer, uh, subscription or, or something that's geared more toward an individual user or small company?

• 25:25Speaker 00

  It's a good question. Um, we don't do a subscription for individual or consumer use today. I would say if you're a small to medium business, like it's certainly still like we're open to reaching out. We can look to set up, we have some starter plans, but we really think about the opportunity. There's certainly personal and consumer risk that exists. But the thing that I think motivates us is that most of the businesses and the enterprises, I think are actually either like not adopting AI or adopting AI with a very rich support posture because of a lack of way to be able to do this for the enterprise solution. And that's the market that I think we're most of both they stay on right now. So we think about like global 2000 enterprise really as like some of the key folks, the early and large AI managers.

• 26:08Speaker 00

  And there's a lot of personal users in that market. Like Claude cowork is something that people will use as like using their business subscription for, you know, the mix of both business and sometimes slightly personal tasks. But like, we think about anything running inside of the business context, using your business infrastructure, act the CRIT infrastructure, that's what we want to be able to protect.

• 26:28Craig S. Smith?

  Yeah, uh, there's been a lot of talk of, uh, the agentic enterprise. I mean, enter these, uh, agentic, uh, native startups, uh, that are challenging legacy businesses. Uh, so I would imagine this would be something they would want. Is that right? It's if they're building an entire business, I mean, the, the, be beyond, uh, agents having access to tools and to databases, agents are talking to each other. And as that fabric expands, uh, you know, humans aren't going to know what's happening between the agents in that layer. Uh, is, is

• 27:11Craig S. Smith?

  that something that you're looking at? I mean, where do you see this agent economy going?

• 27:17Speaker 00

  Well, I think one part of your question was predicated on like these more agentic native organizations. And then I think another part is like how we think about the agent to agent communication that they're kind of enabling. On the first, I would kind of summarize by saying probably anyone who feels like they have something to lose, uh, when it comes towards like the business value that they have and are trying to accelerate it AI, find value here. And so if you're even a smaller organization, but you've built some level of like, uh, IP that you want to make sure that you have some protection around your database is sensitive. Certainly this gets more and more relevant as we become a larger organization, you have stake, you're a public company, you're regulated. Uh, but really I think about is anyone who has something to lose and are going to go and unleash agents

• 27:59Speaker 00

  on that, you'll probably want like a level of protection against it. And I just want to like underscore, there's a very good reason you unleash agents on the sensitive things that you have something to lose, which is like, that's how they actually ultimately drive productivity and ROI. But to your, um, second question, which is around like the agent fabric, how does that evolve? I think that, um, we see this first party inside of Rubrik today, which is a lot of what agents do is they go call another agent. You know, you have your triage agent, Yosha is like getting maybe a first lines, um, board. And then you have your next step of an agent that's looking to be able to go like do a resolution or investigation. Um, I think that the same primitives of how you want to secure and govern agent-to-agent interaction

• 28:42Speaker 00

  apply from when you're a single agent to a multi-agent workflow, which is that you want to be able to make sure that what's going into each agent and coming out of each agent is something that you have an opportunity to check on. So if an agent is receiving an input and then rescuing a route clip to another agent, you want to be able to apply your bar brows on that input and also that output. And so then you kind of make sure every node in the graph or every edge connecting those nodes in the graph is secure. And that's the way we've been approached, guys. Yeah. And so we can see things like, is the agent, you know, classic example for where this can go wrong, right? Is like, Agent A doesn't have access to sensitive data, but Agent V has access to sensitive data. And you want to make sure that Agent A doesn't actually get and return sensitive data via Agent B.

• 29:25Speaker 00

  So as long as you're running the guardrail on like, what is Agent A getting in this input? What is Agent A getting as output? You've got to call Agent B, and you're kind of like intercepting that at the point at which we recognize something is sensitive.

• 29:34Craig S. Smith?

  The scenario is one that I've talked to people about for a couple of years now, since the whole agentic movement started. Once these become the agents unseen and visible to the humans, you know, talking to each other, transferring data to each other. Yeah, you're really vulnerable because you don't know where the data is going and who's...

• 30:02Speaker 00

  There's a loss of control, but...

• 30:03Craig S. Smith?

  Yeah, yeah, exactly. And the orchestration layer is supposed to take care of that.

• 30:09Speaker 00

  Yeah, I think the orchestration layer takes care of making sure that the calls are kind of chained, let's say, correctly. Yeah. But oftentimes misses the context on what, like at an organizational level, should it be happening from like a policy template? So the orchestration layer does a great job of saying something like, Agent A needs this information to fulfill its request, so let's go to Agent B and kind of go into it. But I think like that introspection of like, well, should the request be called, or is the context that's coming in to be able to fill this request actually appropriate for Agent A? That's where I think you need the layer on top.

• 30:43Craig S. Smith?

  Who is the the end user in the organization? Is this the IT department that's applying this? Is it the C suite? Is it the individual user who has access to an agentic platform?

• 31:03Speaker 00

  AI has moved so quickly through the enterprise that we certainly see that there's a few different areas that have interest in it. But there's two that I think say now that are kind of the strongest. The first is within IT, there's usually an AI platform team. That AI platform team may have titles like AI enterprise architects or otherwise. And they're thinking about how do they build trust and governance out of the platforms that they're actually enabling organizations? And, you know, their employees to be able to use. And so that's like one area. And then the second area is within security. Oftentimes I think within security, there's a few different stakeholders, but maybe within like sec ops. Like they're concerned around what are the AFIS? You know, the concern of yesterday was like, might have been like, did an employee accidentally exfiltrate some of the data? And now it's gotten exacerbated by the agentic future.

• 31:46Speaker 00

  And so that's the second stake goal that we see in those strong look. There's certainly others that we see like governance risk and compliance tends to be an organization that has like a heavy, you know, amount of oversight here as well. And then we even see like in the CTO or VP engineering organizations, there's a demand for guardrails. But it's like enterprise IT and AI architects, as well as like inside of security and security architects are the two places where we see this as the user.

• 32:10Craig S. Smith?

  How's the uptake? I mean, this is all new.

• 32:13Speaker 00

  Yes.

• 32:14Craig S. Smith?

  And and do you think that the the the security layers of the Rubrik agent cloud will eventually merge with the orchestration layer be be folded into the orchestration? Either because Rubrik builds on an orchestration layer or somebody acquires Rubrik? Or I mean, I I imagine that this is all going to converge into one thing.

• 32:43Speaker 00

  Yeah, you know, I think that my point of view actually might feel a little bit different, which is I think that there will be many good solutions for where people build into play agents. And the way that I think that our CEO is kind of framed it is like you will want a Switzerland like player to actually secure and govern the different agents that are actually being built. You probably won't want like the model company to also be policing the models that it's necessarily opening out like might do a decent job towards a towards a large extent, but I think you'll want like a system of controls above and beyond that have your enterprise and IT context as well. And so the way I think about it is like, I think Rubrik Asian Cloud is going to remains orchestration kind of platform neutral or agnostic to the extent that we can.

• 33:27Speaker 00

  I don't want to have a strong point of view on which model to use or which platform you use as you're building out your agents. We want to just try and make sure we deliver a kind of consistent governance and security experience regardless.

• 33:38Craig S. Smith?

  The competitive landscape that you're facing, I would imagine that there are a lot of companies who are already in in the security space that are moving in this direction. I mean, it's obvious agents are the future. How do you position yourselves to stay competitive?

• 34:03Speaker 00

  I think Rubrik did something very unique, which was it was a day of security company. So a security company kind of by DNA that acquired a model infrastructure company like my startup PredatorBase. And so I think one of the unique differentiations that combination has actually brought in is a lot of security companies, I think, approach the challenge here in a conventional security way. But what we've decided to do is like, we're saying the only way you can secure and govern AI is to use AI and saw. So that's where Sage and our small language model differentiation, built and deployed on top of the PredatorBase platform, I think is in some ways a large part of the competitive advantage we have against other organizations that might see the same problem. You know, what we often say is like, if you are going with us, you probably want

• 34:47Speaker 00

  to buy the thesis that I need to use AI to help you secure and govern these agents. And we can uniquely do that. And it has to be small language models because there's no way you could deal with the latency or cost footprint if it wasn't. And so, you know, we think about that as a core part of our differentiator, mixed in with the data and identity signals that Rubrik has internally as a organization. So I think there's certainly competition in the airwaves, I would say. I think that the reality is a lot of product that's either new or still being announced. You know, we went here earlier this month, sorry, earlier this year, but I think a lot of the external products are maybe coming soon is what I hear.

• 35:23Speaker 00

  And I think that there will be good offerings that oftentimes will be complementary to what we have as well. And then maybe good competitive offerings too. The differentiation we'll continue to lean on is number one, our ability to use like AI to secure our government agents. Predicated on credit basis technology around small language models. And then number two, data and identity context, we're yes.

• 35:42Craig S. Smith?

  You said you're you're really targeting the Fortune two two thousand. Was that under?

• 35:47Speaker 00

  I think that global two thousand enterprise tends to be like some of the

• 35:52Speaker 00

  like most. I think they're like organizations that have a combination of like a risk profile where they want to be able to make sure that things are done in a secure way, but also the pressure to adopt AI. We really think about anyone who is deploying AI at some level of scale and looking to be able to give it access, like the type of user who's looking to graduate from read to write. You know, simple read agents, write agents, that's kind of the person that we're looking to target. And Ruby's customer base, I oftentimes think about as like the global two thousand enterprise, really a large country.

• 36:21Craig S. Smith?

  You know, there's famously over the last year, been a lot of pilot programs. Very few, I mean, the production putting into production is ramping up. But as you said, you know, you just, a lot of companies just don't want to take any risks. They're kind of watching the market. How how is the penetration in the global two thousand for for agentic workflows? Do you do you have a sense of that?

• 36:51Speaker 00

  My view is that there is, and in speaking with a lot of the conversations, especially at the exact level, is that there's tremendous pressure to adopt AI. I I spoke with CISO recently, who, you know, was part of a panel. And I think he said, like, I think all of our CDOs went to the same retreat for a week where the boards were like, you must adopt AI faster. But then they kind of hit this difficult reality, which is that, okay, we need to adopt AI, but in order for AI to do anything useful, we need to have access. And I can't, you know, the existing architecture that I have wasn't built for agents to have this access securely. It's pretty much conventionally the story I hear, I think.

• 37:30Speaker 00

  Repeatedly. And so in terms of penetration in the Global 2000, I'd say like, I see tremendous pressure. So I see a lot of projects that have been spun out. But I also see a lot of pain, maybe, in like the very early phases of those projects, which is just kind of like slow down there. Like, let's go and figure out how are we supposed to do this? Let's have a meeting. Let's do a design job. Let's go through a committee recruitment process. And the committee itself is still frankly trying to figure out what are the level of controls? We had the same problem, you know, in terms of like, what would be process look like, the internally at Rubrik? And I think what we realized is like, we need to go away from like people and paper and process to something that's actually the software product platform solution. And that's why we built what we built. But in terms of like, I think what's the level of penetration I see?

• 38:15Speaker 00

  Lots of interest, lots of like, and also lots of like funded pilots.

• 38:19Craig S. Smith?

  Yep.

• 38:20Speaker 00

  And I think a big question around, a big open question that's holding back the progress from being as fast as I might like it to be around like AI risk and I'll be with me, so.

• 38:29Craig S. Smith?

  Yeah. So you guys must be growing very fast.

• 38:34Speaker 00

  It's been a lot of fun, I think, post acquisition as well, to be inside of Rubrik and actually see the growth, yeah.

• 38:38Craig S. Smith?

  Yeah, but I mean, in terms of the the addressable market. So your addressable market are people who are implementing agentic workflows. And that's only beginning, really. I mean, we're still at the kind of the

• 38:57Speaker 00

  Yep.

• 38:58Craig S. Smith?

  This early slope.

• 39:00Speaker 00

  We're in the early adopters, and I guess it might be for where a lot of the organizations are. But the, I think the pace at which it's graduating from like early adopter towards the healthy middle. I think, no, it's the fastest in any technologist trend that I've seen in terms of how much this is being pushed. And it's being pushed top down. It's being pushed bottom up. It's like a lot of pressure that needs building this is.

• 39:18Craig S. Smith?

  Yeah. So what's next for, for Rubrik Agent Cloud? I mean, are you, where do you go from here besides?

• 39:28Craig S. Smith?

  Expanding your customer base.

• 39:31Speaker 00

  I really think about like, you know, the core of our mission is to help secure and accelerate the world's AI transformation. We think that limiting risk is a huge part of that. So our approach at Asian Cloud is to be able to use AI in heavier ways to do that. So where we're going to go is right now, like a user can define their guardrails as they want directly in natural language. We're going to be building more agentic workflows to help out on this. And so you can think about this as like today, it's very human to loop in like how to govern, but can we actually even ease the burden on that side? It's like one natural area that we want to be able to go. And the second is like, there's plenty of surface area out there still for us to cover in terms of place to avoid applying Asians or new test of use case that people might be running into. And so I think we've got our work cut out for us.

• 40:12Speaker 00

  But really the thing that's most motivating is like, yeah, we see a definitive need for this in the market. And like, I feel the pain that I think a lot of the folks on the other side of the table feel because it's sort of like, what do you mean? You want me to give access, you know, my Asian access to my system or record for all my customer data? But also how can I get my agent to meaningful work if they can't access my customers? And so like, I think I see that pain. We have an odd opportunity to be able to pull into it. We're continuing to invest in ways that we can use AI as like a high leverage way to be able to solve a problem. And I think we're going to continue kind of focusing on the mission of securing, accelerating the AI transformation.

• 40:48Craig S. Smith?

  I mean, when you go out and talk to, to companies, are you kind of an agent evangelist saying, look, you're afraid of deploying agents in your enterprise because of the risk or security concerns?

• 41:06Speaker 00

  It's funny, I don't think of myself as an agent evangelist. I will say, I think everyone should be adopting this technology at a much heavier rate because of the incredible upside potential that it has. And I ultimately think that those, there's a question about like, will AI agents and AI like cause job displacement? And I think like the view that I've conventionally heard that tracks is like, AI may not, but someone who nails AI. Yeah, naturally. And I think that's going to exist at the organizational level too. It's like, who's using AI at best? I believe going to dictate a lot of what happens over the next five years. So I don't feel like I, if someone's not, let's say a believer that AI is the right solution towards them. I think that's totally inappropriate conclusion and want them to be able to go forward with it. The place that I think I feel the most.

• 41:52Speaker 00

  Kindred spirit or ability to help is when someone recognizes that this is the right solution, but they might be stuck on how to get started because they have this one stuck between a rock and a hard place problem.

• 42:02Craig S. Smith?

  Is most of your, the adoption that you see of Rubrik, open Rubrik agent cloud, I'm sorry, coming because you're out talking to companies about how to make agents secure so that they can get the ROI, they can, they can start on that journey? Or are enterprises that either have a pilot or are integrating an agentic system into their enterprise realize, hey, that we need a security solution and they're out looking and find you? I mean, oh, yeah.

• 42:40Speaker 00

  You know, because I've been like doing this kind of part of the pipeline building piece for at least like five or six years now. And I will say something feels different in this market, which is we try not to pitch very heavily in terms of like what it is that like we do or not. We describe the pain in a conversation. Sometimes we describe this in a webinar or a marketing event. Sometimes we describe it in direct customer conversation. I think we're very transparent in saying like, the solution might not be for where you are right now, but if it is like, we'd love to go and have the conversation. We've been lucky enough that I think there's so much interest in the market that we've been able to not have to pitch so hard. So we kind of just describe like, here's, basically the narrative is like, here's the pains. We know these pains because we ran into that at Rubrik. Here is the worry that we thought about approaching them as a problem in terms of like the solution architecture.

• 43:25Speaker 00

  Here's what that looks like as a product to prove engagement. If that sounds like it's the right, that if you believe into our thesis that you need AI to help you secure and govern agents and that data and identity context is important, that you need to be able to do this at runtime protection, they're going to have agents in a number of different places. We kind of believe a few of these things, then it's, and like this is a timely issue for you, we should definitely have that next conversation. And if not, like, you know, we're happy to revisit in six, six to nine months. So I'd say it's like a healthy mix of both outbound and inbound. But regardless for both, we're at the phase where we're not really like trying to push this at all on anyone, but we've been getting a lot of pull because people recognize that's kind of an issue that they're facing to bear.

• 44:02Craig S. Smith?

  Yeah. Can you talk a little bit about what's happening under the hood? I mean, how, what is happening? And, and the interface for setting it up, you say, you know, the, the Rubrik agent cloud goes in and, and scans a system and sort of, a lot of the setup is automatic, but it does, yeah, how, how does, how does that work? And is there a conversational interface, that was gonna ask?

• 44:33Speaker 00

  Yeah. So Rubrik does have a conversational interface called Ruby, which is essentially a conversational interface towards the Rubrik platform. In terms of the setup for what it looks like and, you know, what's going on under the hood, you can really think about what's going on under the hood in like maybe three key phases. The first is like, we're connecting in. What is connecting in means? It means that we're getting exposure to the agent runtime, such that it can help expose its logs, like the literal prompts, the responses, the tool calls, everything that's coming out of the system, directly into our visibility page. So like, the very first thing is we're doing is like, we're getting those hooks in to the runtimes in those three different service areas we are, where we're starting to see prompts, responses, and tool calls flow through our system.

• 45:16Speaker 00

  We then use that and like the, or flow to go and populate, this is an agent, here's its scrap. We're kind of like showing you like the literal map of like what it could be. The second thing that's kind of going on under the hood is you're defining policies. Now, we have a number of policies that you could just like enable in one click. So you could say things like, you know, prevent prompt injection, or make sure our agents are read-only on that by default, just in one click. But what we also allow you to do is define your custom policy in English. So what's happening under the hood is you, you enter like a, essentially a prompt, like your own individual text. And we will go and expand that definition with a number of like best practices we know. We'll give it reference definitions, examples. We'll allow you to confirm. And then in the backend, what we'll do under the hood is we'll actually

• 46:01Speaker 00

  just still listen to a small model that can be deployed on very efficient infrastructure and start to put it in line with the prompts and responses that we are seeing in that first, you know, bucket that we looked up to. And then the third thing we're doing is we are giving you some like alerting and control under the hood. So anytime like this smart agent Sage is basically picking up on something that was mistaken, Sage is like popping up an alert that's saying, here's something that went wrong, or just blocking it altogether if it's configured in that way.

• 46:30Craig S. Smith?

  So so Rubric Agent Cloud itself is an agentic system, is that right?

• 46:36Speaker 00

  I think that Rubric Agent Cloud is a platform that has some agentic workflows running within it. Yeah. And we'll continue to have more and more agentic workflows running in and over time.

• 46:46Craig S. Smith?

  Yeah. Say whatever you want to say to close the boat.

• 46:50Speaker 00

  I think maybe just to close, the biggest thing I would say is, you know, since when I started in the company at Preda Base to like where I am today, I think like the models have gotten so much smarter, the sophistication around the harnesses and the orchestration frameworks have gotten so much better, that I think that now the bottleneck is really like, how do we securely manage the risk these agents are going? I think that's like the big open opportunity. I think the lack of it is why you see the ROI question a lot of organizations and like, that is, I think, the biggest thing that I'm personally, and it's just an impassioned about solving is, how do we like securely exonerate the world's ad transformation by giving you, you know, the ability to really trust what their agents are doing?

• 47:31Craig S. Smith?

  Yeah. Okay.