Transcript
Let's talk resilience and the latest happenings in AI. I mean, there's certainly no decrease in the fear that agents might do some things that they were not expected to do. Thank you, John. Thank you for having me. Always a pleasure. I think a lot has changed in AI, even in the last three to six months, like almost every weekly basis. In fact, one of my colleagues, she just came back from her maternity leave. And when she came back to the workplace, and she was like, the world has almost changed in office, how work gets done, and what AI could do in just four to five months she's been out on leave. So yeah, lots happening in AI, as you can even see this morning's news about Anthropic Model Opus 5 being used to break into open AI. And attackers, how they build agent swarms, how they build harnesses, how they can create sophisticated chaining events to chain vulnerabilities is becoming increasingly critical in workplace. And Druva is obviously looking into all aspects of how we use internally AI and how we use our products to defend customers against these threats. So what's changed for you then? I think internally and externally both. Internally, we've started building a robust platform, what we call Dru North, which automates a lot of back office and front office operations of sales and operations into a single agent platform. Things like deal desk and auto management and pricing guidance. And through building it, we also realized that agents are, in effect, like a dynamic set of applications and controlling and containing them for a particular action and how they interact with people and processes and systems is very complicated. And so we've launched this effort called AI Resilience, a category called AI Resilience for our customers and has sort of four big boulders. The first one being, you know, recovering against an AI threat. A rogue agent, a sophisticated agent swarm, when it attacks an enterprise, how do you recover? How do you know what arm or what change was done by who? And who is a critical question at this point to recover against it? We're also building what's called governance for AI to understand observability stack into agents to really build very powerful agentic evidence wards for legal and forensics teams to understand what agents did, how and when. We're investing into defense to make sure as agents attack backup systems, how the immutability actually comes across well from a governance and sort of from a defense point of view. How do you understand who you're dealing with, an agent or a human being? And finally, I think we are sort of trying to power majority of what we're doing through an agentic experience. So how do you access Druva? For example, today Druva is a plugin into Cloud. You could access and do everything or what we do as a company through a plugin in Cloud, right? So those are sort of four big boulders. Do you foresee a time when frontier models themselves might become a vulnerability? And I asked that because it seems like there were versions of these models that were being tested when they went out and did some of some of the no good that they apparently did, including they seem to have an intent that was different from what the humans who originally set their programming into motion had. I put it that way because of RSI, recursive self-improvement. Once you have agents, once you have AI building AI, it seems like there can be drift and intent where AI is leaving notes for future versions of itself, like, hey, never mind what the humans are saying, here's what we're going to do. That could be a mechanism through which I imagine a frontier model could put a backdoor into security products that are supposed to be providing resilience, that are supposed to be doing other things, if they're not. What happens if the model is working from its own playbook across different instances of itself? Does that make sense? It's a great question. And I tried to study the whole hugging face incident in pretty depth myself. Like, I think there are two parts of equation here, the model itself, and then the harness around it, right? The harness being, how do you build the protocol of agents to communicate? Or in this case, they figured out themselves, but like, how do you build a system that can communicate, they can chain events, they can record, they can learn, they could drift, they could do all those things. I think we all know that those harnesses can be built, very effectively built, which gives the scarcity of what used to really hold so far was the scarcity of resources of good redactors. Redactor wasn't the thing anybody could do, like you and I couldn't be a redactor that easily. The scarcity of the redactor goes away as these harnesses could really build agent swarms very easily, right? For 200 bucks, you could do an attack today, right? What's holding it back so far, and what changed in this attack was the model itself. And is the model being built with do no harm perspective, right? In this particular case of Hugging Face, the model was actually different. It's not a public model you and I see. The model was built a very persuasive and very persistent model. The level of persistence being in that model was much, much higher than what Frontier models today ship, right? So, that was different in that attack. The model itself was different. The question is, how much power do the Frontier labs contain to ship a responsible model? They do pretty high, right? And if the model is not built responsibly to make sure that it could be a lot more persistent, persuasive, manipulative, then it's today, definitely will give a lot of access to a lot of powers to a lot of redactors. Now, that said, open models are catching up. They're six or nine months behind, but those models can be fine-tuned. Those models can be adapted. Those models can be changed and manipulated, which could really, really create this problem at a massive scale. It occurs to me, and tell me if my metaphor is off here, you don't need Albert Einstein to be your security guard, right? The Watergate break-in was foiled by a security guard, not necessarily because of scientific knowledge, because he's paying attention, right? So, maybe in some cases, what protects you against high intelligence doesn't always have to be just as high or higher intelligence. It has to be a certain level of diligence, consistency, and trustworthiness. Am I right there, or no? I'm not sure yet. I think a lot has to be seen. I can see the messaging from a lot of cybersecurity CEOs today of using agentic processes in defense. It's not very clear yet. See, an act of offense, the agent swarm can be built to manipulate an offense. An agent swarm is a very dynamic application. In one hand, today's cybersecurity softwares, the majority of them, are a set of static rules. They are permanent rules, right? It's almost as if a machine gun is facing a piece of paper, right? The dynamic application will find its way through, like water going around, right? So, I don't think the static cybersecurity software, a simple set of rules, will be able to hold its weight against a very dynamic agent swarm. That said, using AI in defense isn't clear as well, because defense is about latency. Defense is about real-time decision making. Defense is all about a set of rules. You can't have ambiguity there, right? Or what exactly you're protecting and how you must act. And AI hasn't demonstrated a very robust set of defense mechanism to deter an attack. Now, what we do for a living is more post-breach, right? We do forensics, we do investigation, we do backup and recovery, and you have time to process information. You have time to be knowledgeable there. So, AI can be used effectively for investigation, building a SOC process, building an investigative process, doing backup and recovery. But through real-time defense, there's no good answer today. And the only answer majority of CEOs today is, well, you can hide your application behind my firewall or my applications. It isn't a good answer. The agent swarm will find its way. What do you make of the conversations crapping up now about cooperation to make sure that the testing and safety of frontier AI is up to snuff? It's hard to read how much of that is publicity versus true, genuine intent, quite frankly, because at Druva, I take my own work safety extremely seriously. I don't need to talk publicly about it. I am responsible for what my software does, what my company does, and I'm personally and professionally held liable for any actions Druva might do to give this customer. I don't need to collaborate with anybody for that, right? So, to some degree, responsibility of own actions and holding somebody accountable is very fundamental for what their work could do, right? So, on other degree, like on the other aspect of it, you could argue that the absolute power of AI isn't known yet. So, some level of collaboration could help. So, it's very, very hard to read what actions may flow out of these level of discussions, which would actually make AI safe. It's not very, very clear about what they're going to do about it. It seems to me that part of what they're after is trust, regardless of whether it's safer or not. They want the public to feel like it's safer. They want voters to feel like it's safer. It certainly seems to me that post-hugging phase, and especially after this, you know, ex-anthropic employee then came out and said, hey, don't trust them. They saw this tidal wave of negative publicity and breach of trust happening and had to say something to acknowledge that more needed to be done in order to, I don't want to say restore because it was never there, establish trust with the creators of this technology that's supposed to make everything better. That's a very good take, actually. And yes, I think I loosely use the word publicity. I think you frame it much better that it's probably the framing of trust around using of AI and the safety around it. That's actually a good take. So, I mean, not to take over, but as I'm watching this unfold, I'm thinking, all of these major frontier AI providers were born out of distrust. Right? The whole reason why open AI came around, you know, Elon Musk, Sam Altman, etc. were saying, boy, this is really dangerous. If we don't do this right in a way that's trusted, then it could be really bad. So let's start this. But now they don't trust each other. And then even within open AI, then Dario and, you know, the Amadeus said, okay, well, we don't trust these open AI folks, so we've got to start Anthropic. And then, you know, more open AI folks on the board didn't trust Sam Altman. And now within Anthropic, this former employee doesn't trust Anthropic. But now they're saying, but trust us, because we're going to work together, even though we hate each other and don't trust each other. It's kind of remarkable. It's kind of remarkable. I mean, in a way, it's good for the industry, if they actually take a strong action behind it to maybe establish a cross verification, establish something. Like, but to a certain degree, what models are doing is not that much more intelligent than a security researcher. They're just making the scale more accessible. Like, a model is still half the IQ of a really, really good red team engineer. But the scale is daunting. You could for 20 bucks, you know, launch a few agents, which could spend a time on an hour. That is what gives a lot of bad actors the ability and tools at scale, which I've never seen before. So I suppose that's going to lead to increasingly interesting conversations with your customers about their concerns and what they demand out of resilience and recovery products. Totally. I think with the customers, you know, it's a, it's a, every single CIO CISO discussion is all about AI. In fact, it was customer yesterday and, you know, and, and seven to 8% of the entire data set today has been just AI artifacts and sessions and, and all the things around it. We were the first to market with backup of cloud and governance of cloud and co-pilot and has been exceptionally resonating. And customers are even discovering and shockingly discovering the impact of AI and how much knowledge workers have moved away from doing the work the old way, which is almost a dependence on a tool, a co-worker or a cloud, and how it's just going to change the dynamics of a workplace and change dynamics of how they think about enterprise resilience. The overall, and what must it take to recover a business? It's quite something Jasprit. Thanks for catching me up here in this Fort Knox update. Appreciate it, sir. Thank you.
