Transcript
I'm your host, Rick Vanover, the Rickitron. Today, my guest is Avinash Ramesh. Thanks for joining us, Avinash. Hey, Rick. It's a pleasure to be here, and amazing to see the entire vibe here. Brilliant. Yeah, we've got a good vibe going on, and hopefully you're going to bring some fresh perspectives to wake up to. So Avinash, take a moment, introduce yourself and your role. Yeah, absolutely. So I lead what we call as secure AI in Accenture, and data protection. So that's primarily my role. I'm based out in London, and I'm a managing director in Accenture, and can't be more excited to be in this role than at this point in time. So yeah, absolutely. Well, it's wild times that we live in, in that role, and Veeam and Accenture do a lot in this space together, and really solving real problems in the market so that the audience does not have to wake up to some bad news. So that's why we are doing this. So I'm going to start with some probing questions for you. The first is a claim, and push back on me if you don't think I'm right. Here at Veeam, we're really working on data and AI trust. It's the message that we're bringing to market. And part of the claim that we're making is that data may not be trustworthy. What's your take on that? I mean, it's a very interesting perspective, right? Because the fundamental belief with AI is autonomy without trust is exposure. That's the bottom line. So that's the perspective that we take into the market. So it kind of aligns with the data trust, the trust in basically what we are building, and the trust in the outcomes is basically what is going to measure the success in this particular area. And yeah, I mean, data and being untrustworthy, I think that's a balance here, given the fact that a lot of the clients have invested a lot of time in data governance and all the things that generally, I mean, for example, security, AI does. And this is basically the fabric on which the trust is going to get built, where we are going to scale autonomy. So that's basically what my perspective is. And when I look at clients, different clients are at different speed or for levels of trust, I would say. And that I think is going to continue to be either a gap or an enabler along the journey. I love that how different clients are at different points in different velocities in their journey. And I think that there might be scenarios where folks are getting stuck. There's like a blocker, an inhibitor. Where are some of the areas that you see folks getting stuck with AI? Yeah, almost every day, I would say at the moment, given the fact that firstly, the organizations are looking to scale and move fast to continue to have a competitive edge. So that's given, right? I mean, there's an ambition and people want to move in that direction. But the leaders who are currently sitting and grappling around like to solve this problem are in reality getting stuck. I'll probably unpack this a bit, right? I'll give a client example. A couple of weeks back, I was there in a workshop with a set of clients who were looking at a specific AI use case to start looking at rolling it out and scaling it, right? So there was like in American terms, attaboy type of a high fives after the POC was done, the pilot was like executed and the technology worked, right? And the next question was, what next? And one of the guys raised his hand and said, hey, if this doesn't do what it's supposed to do on a Monday, who owns it? This kind of like created a bit of a silence and a pause in the room. And that I believe is a very crucial moment. And that's the place where leaders are trying to find the answer when intelligence is getting scaled faster than your operating model and your foundation. That's probably where leaders are getting stuck. AI becomes very, I would say, it's nice to have and it's like in an experimental stage, but it soon becomes very consequential when it touches your financial outcomes or your customer experience or your regulatory requirements. And this is what leaders are grappling at the moment. If I have to be a bit more specific in the space, right? When that is a level of investment that the clients have done, for example, in cyber architecture and operating model, but none of these investments were planned for the level of autonomy that we are looking at. So the surrounding ecosystem needs to catch up for us to have the leaders having basically a pathway to be scaling AI. And until then, it's almost like trying to run, because we are in the place of innovation, a future hyperloop in a subway rails, and that's never going to work. I think that's really fascinating. I love the, if it breaks on a Monday, who's responsible? Who will remediate that? That's really central to some of the things we're doing here at Veeam and we're on a journey, especially after we have closed the acquisition of security AI here at Veeam and what we're bringing with the data command center to really give the visibility, first of all, because that's one thing. Throughout this season, Avinash, we've really been talking about explainability. So great business benefit, fancy schmancy solution, love it. But can we explain it? Can we show the data flow? And then more importantly, should things not go as expected? Do we have that resilience angle, that recovery angle? That is the Veeam of today. Now would you say there's maybe heightened scenarios, changing conditions based on maybe financial services, healthcare, public sector, maybe any other verticals? 100%. So for example, in financial services, some of the, what we call as the big eight banks that we work with, the first thing that they're looking at is explainability and containment because that's basically what is going to be the name of the game in front of the regulators. Especially in UK or Singapore where the regulatory guidance is such at high standards, we are always going to be at the place where these aren't questions needs to be answered first. Because you mentioned data graph, I think the first question that's going to be like, which app has got access to, which AI app has got access to what data? Is it governed? Is it controlled? Is it inspected? Those type of questions need to be answered for underwriting ourselves when it goes into a faster payments use case or it's going into a mortgages use case for underwriting type of scenarios, right? So that's on the financial services where it's highly regulated, requires a lot more stringent focus on controls. On the other side, if you look at fast moving sectors, the same tension applies, but it's very different. They have to move fast to continue to have a competitive advantage to have, let's say, an AI first interface back into their customers and there the challenge is how can I do it without brand being impacted, trust being violated or privacy being taken for a toss, right? I mean, these are the areas that we are grappling with and I'm sure, I mean, to your point, resilience is going to underwrite all of these things, both from resilience from able to recover if something happens and resilience to also show that, okay, that the system can withstand something that kind of like goes south. And that is something to wake up to. I love, Avinash, that you hit a word actually that's in the rictionary. It's my own personal little dictionary, explainability. I think that's a highly underrated discipline now and data command graph is a fantastic way to go about that. I think that's fantastic perspective. So when you go talk to leaders, decision makers, what kind of advice are you giving them to reduce the risk but go forward in some of these AI projects confidently? What resonates from the advice you give? A hundred percent. So first thing, when I told the example about clients, the first question that was asked is what happens on a Monday, right? It's not lack of trust in the model. I think that bus has passed. That is like amazing progress that's happened in the models and the inferences and so on. So no one's like really second guessing saying that is this model going to work for us, right? I think the question that they're asking is also can we build it? That's not the question. Can we control it is basically becoming the essence, the emotion that's underlying for these lack of trust. Am I in control? Can I make sure that what I'm building and what I'm putting and what I'm trying to be accountable for is going to work? And that is basically a disjoint view at the moment. Security owns the controls. Data owns the governance. AI teams own the build of the app and basically Infra owns resilience. That isn't a cohesive way of bringing them together and that's probably what is causing a lot of inertia. And our advice to leaders is if you try to find all the answers on day one, it's never going to happen because this is an evolving space as well, like multi-agent architectures coming in, some of the new features that you guys have rolled out at the moment, which is addressing some of these observability gaps and ability to trace back to what exactly each multi-agent architectures are probably, I mean, performing. These are things that you cannot wait for answers before you kick off. So our view is scale AI based on what is available today. And yesterday I was talking to a CISO here at RSA. So the same question was coming up saying, hey, where are you with AI? And his question was, I don't want to be an inertia in an organization. I want the experimentation and the innovation to continue, but I also want to start building what are the foundational capabilities that's a must have. If we wait for all the answers, I don't think after the internet era, we would have delivered anything back into the business. I love that you broke those different disciplines down. That's a common theme that we've seen across the guests where they all need to be working together. It's no longer the us versus them. When you go through these conversations with organizations, do you find some blind spots and how do you mediate those? So AI has become probably the best cyber maturity test for organizations. Wow. That's a really good zinger. Yeah. Because it has started to, it's not creating new weaknesses. It's starting to quickly explore and expose the weaknesses that's already there underlying. If your identity processes and your data governance or your resilience is not being thought through or your monitoring and observability is not strong enough, AI is not creating, it's amplifying it. The second blocker that I see is AI is moving at machine speed. And in cybersecurity, the challenge that we've got is it has always been asymmetric. Attackers versus defenders has been asymmetric. Attackers have to succeed only once. Defenders have to succeed every time, which is get the gap is getting amplified by AI. So the second question that comes in, I mean, there was like a big recent news about AI platform getting hacked because of exposed APIs and prompt malfunctioning and injection. So these kind of like creates a bit of inherent nervousness for clients and leaders whose companies have not invested in the foundations, right? So our focus has been to go and create a bit of mindshare to help the clients to understand that, okay, these foundations are irrespective necessary. These are the traditional controls that needs to go in. So this is, I would say, is one of the key blockers, right? The second part of it is the blind spot that we always have seen is what do you see AI as? Because there's a duality aspect here. AI can be looked at as an application or it can be looked at as an identity. So it co-exists. We never had this type of a paradigm earlier. Humans and non-human identities were a separate domain. Application security was a separate domain. AI has converged it. And that understanding, if it's not there, that creates another blocker because you kind of like have to treat AI like how you treat human identities. Like when you design, it's like almost like onboarding. When you're building, it's almost like giving that an identity, then managing the life cycle. On the other side, we have something called secure velocity, where when you're using AI to build AI, how do you secure the build itself? It's like I was listening to a podcast, right? I mean, factories like the Gigafactory, it's basically like a machine building a machine. That is exactly what's happening now in the software space. That's a machine that's building a machine. So how do we secure that pipeline is also something that leaders are grappling with as a blind spot. That is fantastic perspective. I'd say at Veeam, we've seen a blind spot basically emerge as a new category. And what I mean by that is I grew up in this first generation of protecting against natural disaster, hardware failure, operator error, those types of things, infrastructure, critical infrastructure issues. And then this second generation of resilience becoming more interesting was around cyber threats. Really, both of those were human identity or non-human if you would include natural disaster. But now there's this era of third generation of risk, agentic, so non-human and moving very fast. I love your comment where AI will manifest the foundational challenges, observability, resilience, overall security, posture, all those other things, that's fantastic. That's awesome. Do you ever see, Avinash, a scenario where organizations are wanting to move at a velocity but governance, some of their business rules are inhibiting the classic trade-off of innovation velocity and business requirements and environments. How do you guide organizations through that? Sure. I think this is probably also something that we are as a firm looking at. What does the change management look now? How do we help clients metamorphize or change the way that they execute these type of programs and projects? And this is where Accenture comes in play with our methodology of rolling out AI, secure AI, lifecycle AI ops. How do we bring all these together and stitch and show value to our clients? It's no longer about building a deterministic software or putting a course on table. At some point, I believe, the moat is going to be around data and resilience, which you guys focus on, and helping the business to understand that it can move at a pace and don't have governance. So we have set up something called AI controls for COE from our responsible AI team. It's just a minimum viable set of controls that you want to put in, not to stifle innovation. So those are the models that we're going to go with clients. Obviously, we don't want to compromise their inherent business risk or inherent challenges that they might face along with this. And we don't want to be, as I said, right, autonomy without controls as exposure. We don't want to put them in that exposed zone. Accenture benchmarked actually clients in our reinvention benchmarking model, where we kind of like found that about 67% of the organization are currently what we call as exposed zone. And that's what we are going after, to go and help those clients to get and harness the power of this particular technology with partners like you, Veeam, and security to talk about resilience, which you rightly highlighted. If something goes wrong with the data update, how do you recover it back? How do you restore it back to the previous state, right? I mean, those are things like clients do not understand yet, and that's what we are trying to educate. Yeah, that's the Veeam of today. That is exactly what we're in the market for right now. And if you haven't seen Veeam lately, oh, should you, should you? All right, I got one last question for you, Avinash. What does responsible progress look like in success in an organization? I mean, the ambitions are high, the goals and the pressure from boards to drive more AI solutions and keep in mind their security requirements, governance, and more. But what does responsible progress look like? I think responsible progress for me is not allowing intelligence to scale while the operating model is catching up. I think that is probably going to be the biggest challenge for clients. If you have to progress responsibility, you need to tackle that first. How do we bring that convergence back in from an operating model, from a cyber operating model perspective, from other platform and infrastructure operating model perspective? Because there are multiple players here at the moment, and if one part just races off and the other part is kind of like held back because of their own challenges and governance, I don't think it's going to help. Boards are super ambitious at the moment. Like probably everyone is like talking about, okay, how can we look at progress in the space? And obviously they're equally nervous when people with resilience hat or a risk hat go and present their papers to the board saying that, hey, by the way, these are the type of risks that needs to be addressed. So marrying these two would require clients to start first tackling the operating model side of it, the inherent weaknesses that's there in their current controls that needs to be uplifted, and then start looking at at least some early gateways into like prompt firewalls or inference gateway type of enforcements because we believe AI model, so anything that has got autonomy has to be going through a trust huddle. Anything that it talks to the model needs to be governed. Anything that needs to be talking to the internal tool needs to be validated, and anything that goes external needs to be inspected. So this trifecta is basically what we call as trust in your progress. When you have this trifecta ready for your progress, I think that's probably what is going to be the catalyst for you to scale AI. And then just imagine if you feed it clean data from a compliance standpoint, from a ROT analysis, from a permission standpoint, all those things, again, the Veeam of today. Avinash, thank you so much for joining us here on the podcast today. Thanks, Rick. Pleasure. And it was a great conversation. All right. That wraps this episode of the Wake Up Podcast powered by Veeam. You can find this episode and more at a podcast platform near you and more fresh information to wake up to at veeam.com. Thank you. Thank you.
