The Biggest AI Security Problem Isn't the Model. It's This. | Devvret Rishi

0:00We define agents as just really like models with access. So like access to tools or APIs that can start to do work inside an organization. Once these become agents unseen and visible to the humans talking to each other, transferring data to each other, you're really vulnerable because you don't know where the data is going beyond agents having access to tools and to databases. Agents are talking to each other. Where do you see this agent economy going? Yeah, there's a question about like, will AI agents and AI cause job displacement? AI may not, but someone who knows AI. We're going to talk about Rubrik.

0:39We're going to talk about Rubrik Agent Cloud. Can you start by introducing yourself to listeners? Tell us a little of your background so far as it's relevant, particularly education and what you were doing before Rubrik. rubric. Yeah, I can start at the beginning, maybe. And I'll say that I'm deaf. So I was one of the co-founders and CEO for Predibase, which was a generative AI infrastructure company. We started right before the beginning of the Gen AI wave in 2021. And really, we're helping organizations build and then deploy the precursor to large language models, which were really pre-trained deep learning models.

1:22It came out of our experience at Uber and Google, which is where my co-founders worked. Prior to starting the company, I was at Google for about five years. Before that, I was always in the AI space doing my masters and others in core computer science and stats. So that's really my background. My company was acquired by Rubrik last summer. We actually joined forces with our core machine learning and LLM infrastructure platform. So we were the model backbone that drove deployments of AI in Fortune 500 organizations, faster tech forward moving companies as well. So we really had a really broad gamut.

2:00And when we joined forces with Rubrik, the core idea was we wanted to take the platform we had built and mix in what Rubrik did really well. Rubrik is a data and cyber resilience company. It started off its core offerings around making sure that businesses were resilient to downtown data, layered on security offerings for cyber. And with the acquisition of my company, Predabase, we're building kind of a combination of like our AI platform plus data and identity security into a net new offering we call the Rubric Agent Cloud. The core goal and the observation that we had is that AI is coming very quickly.

2:36The AI tools and models are actually getting quite good very quickly as well. And so people are starting to adopt these tools en masse. But the thing that's actually slowing down their ability to deliver ROI is that I think that there isn't a great framework to manage the risk of what these agents can do inside of an organization. So that's the challenge we set out to solve with the Rubrik Agent Cloud. Before, cyber resilience and that sort of thing, Rubrik was focused on what? On making sure that all the ports to the data were closed and all the various things that people screw up that leaks data.

3:16I can tell you a little bit about the early days of both Predabase and Rubrik. I mean, a rubric I know from being here, but I think rubric really started its early days with a mentality of assumed breach, which was to say that there was lots of solutions that were trying to say, well, let's make sure that the, you know, door is locked. But the real thing you needed to be able to do is make sure that as a tax actually happens for the ones that would get through the defenses and were successful, did you have a way to be resilient towards your business? It used to be the case that most of the things that drove business downtime were like natural disaster, fire, flood.

3:53These were the things that you kind of conventionally bought that insurance policy for. But increasingly over time, that became more geared towards ransomware attacks and cyber. So security became really the primary threat vector that acquired business resilience. So Rubrik really thought about regardless of the types of instances in which your business might be put at risk, whether that's something like the natural disaster of old or the cyber attack of new, like how do we provide a way that your business can basically be resilient or bounce back regardless from both of those situations? That was really its core genesis.

4:25And then it started adding more capabilities around prevention and detection over time. So you got kind of a layered approach towards the defense. You knew that things could only get so bad if anything did come through, but it started to layer on based on the data understanding, the identity understanding it had. Yeah. Mom, I think Rubrik recognized that the next threat vector, if you thought about like natural disaster, fire, flood, and then cyber attacks, we think that the next threat vector is going to come from AI and specifically agents that are deployed in an organization. We define agents as just really like models with access.

4:57So like access to tools or APIs that can start to do work inside of an organization. And that's why I think it motivated Rubrik to do the acquisition of Predabase, my company, because what we actually had really started off on is building the core infrastructure platform on which people were building models and starting to deploy agents as well. So we wanted to bring all of that in-house to be able to say, we've secured you in natural disaster, fire, flood, in cyber and security, and now also for the upcoming wave of agents. Well, your background, what were you doing at Google? Were you in a GenTech or security?

5:33Yeah, it's funny. So prior to Google, I was both doing my undergrad master's concurrently in computer science and stats, focused on resilient machine learning algorithms, specifically for privacy-preserving use cases. Then I went over to Google, and I worked on it across a number of different teams, including Google Research, where I was working on, if you remember, the early days of agents actually looked like the Google Assistant as well, which was like this embedded assistant and all these different devices, we were working on more deep learning focused use cases within the assistant. So that was my first exposure to agents more than a decade ago at this point.

6:10And then the second area that I worked was actually on Google Cloud's AI platform. So I remember we hadn't even named it Vertex AI when I was there, which is the name of it now. But we were really forming kind of the initial basis for the fact that more people were starting to do machine learning and AI workloads on the cloud. How do we build a platform that people could actually use across all that? So that's what I was working on until the end of 2020, the pandemic, when I met my co-founders, who had built these frameworks at Uber to make it easier to be able to use machine learning and internally and build these applications.

6:43These frameworks got popular, so they open sourced them. As things happen in the open source, they got popular externally. And so we all decided to team together and start a company around it, which was credit-based in early 2021. When you say Rubrik agentic cloud, why cloud? Is it a bunch of different components? Is it an ecosystem? Or are you literally saying it's in the cloud and we apply it to whatever system? The honest reason for why Rubrik agentic cloud is because Rubrik today, I think, before the agent cloud had one primary product, which is called the Rubrik security cloud. and the core intuition behind the rubric security cloud was as organizations were thinking both about their on-prem but also shift from on-prem to cloud migrations how do you secure that you know transformation that's happening in the organization uh and then when we rolled out like the agent cloud we realized like ai was a whole new system where your conventional security principles didn't really hold up and so we thought we needed a new approach we wanted to name it the the Rubric Agent Cloud is kind of a mirror towards the Rubric Security Cloud.

7:45And I think the core thing about the Rubric Agent Cloud is that it really speaks to the fact that agents exist everywhere in an ecosystem. And when I say everywhere, I mean they can exist on your laptop as something you're running. We think about instances like OpenClaw or Cloud Code and others. They can run it in a cloud environment that you manage. It can run in a number from different places. But what you want is a single kind of control plane across all of those that gives you the visibility and what are these agents doing and some level of control over those agents as well. And so that's what we think our agent cloud basically does, is it hooks into these different environments and allows you to be able to get that visibility and governance.

8:22I've spoken to a lot of agent orchestration companies that are building. There's the LLM Foundation. There are these agentic build platforms where you can build and deploy agents. there's, there are now companies that are building just the orchestration layer so that you can keep track of what these agents are doing. Are you guys orchestration or are you a layer above that? We're a layer above it. My point of view is that there's lots of good orchestration tools that exist out there. There's lots of good platforms to build agents today. You know, each of the hyperscalers has their own agent platforms, including orchestration.

9:03So Vertex AI has, their own agent ADK. You have Bedrock inside of AWS with AgentCore. You have a suite of tools inside of Azure. Salesforce has AgentForce. ServiceNow is an agent platform. Plenty of good ways now to be able to build agents. What we've noticed is actually hard is how do you place some level of controls around making sure that the agents, regardless of where they're built, actually have some level of consistent runtime guardrails on what they can and can't do. And this actually, I think, is a very tricky problem because agents look less like conventional software and inside of an IT organization, a little bit more like what you or I might be able to do.

9:42And so like my agent, as an example, which my agent, the one I use most heavily is just out of personal use, is like Cloud Code and Cloud Code Work. My agent has access to Salesforce and my agent has access to email because I use it to write emails and I use it to summarize opportunities in Salesforce. But what I don't want it to do is take something that's sensitive from Salesforce and put it out and send it out in an email autonomously, right? And so that's just one thing that happens with cloud code and co-work that I need to secure. But if you're using a different agent harness, if you're using OpenAI's codex, it'd be the same concern.

10:13And so my view is that there's lots of different good systems. They're building excellent ways to integrate into the different areas, good harnesses, good orchestration frameworks, ways to be able to run in the cloud, like Anthropical launched managed agents yesterday. But how do you have a consistent way to be able to monitor, observe, and actually run time guardrail? any of the things that those agents are doing. That's where we come in. So if you think about the core layer, it's like your models and your MCP tools or your other API tools. The layer above is going to be your agent platform builders plus orchestrators.

10:43And then what we think about is having the security umbrella across this with the agent cloud. Does that apply if an enterprise is using a combination of agent builders, a combination of orchestration? Can you apply this across? That's one of the settings where I think it's the most compelling. And frankly, I think that this would be true for most enterprises, sort of similar to how you saw in the cloud era, like you had organizations adopting multi-cloud. I think you're seeing even more of that in the AI era because these things are coming out so quickly. I think where Rubrik Agent Cloud actually really shines is you have multiple different agent platforms that you're using.

11:20At Rubrik, we ourselves have multiple different agent platforms. We, in fact, have a couple different coding agents that we have, including Cloud Code. but we also build agents on top of Vertex AI. We have agents that are built and also other third-party tools that I'm not even mentioning. And so the question is, how do you secure across all of this? This is where I think our agent cloud provides a tremendous amount of value, really at day zero, because oftentimes what people want to know, even at the beginning, is what are the agents that are even deployed in all these different ecosystems? So we can plug in, provide the automatically discovered and scanned inventory, and then allow you to start to get the system of control across all of this.

11:55Yeah. One thing I've wondered about, you know, there's a lot of talk about the security risks of agentic systems and something like Rubrik Agent Cloud. is it sort of belt and suspenders that you just don't want to worry about security? Or are there examples, very real examples of agents going rogue? I know you have a program or a campaign right now with this Chungar, this little... Have you seen Chungar? I haven't, but we were talking about it earlier. is how real are the risks? And I use OpenClaw on my primary computer and everyone's like, oh my God, you're crazy. I don't know, what is the risk?

12:51Nine months ago when we started to talk about it, there were probably like one or two of these incidences that I think were important to flag as like what the risks could be. Now, my feeling is that like it's almost you're really stuck between a rock and a hard place where I see organizations take two things they either a take a posture that like this stuff is too risky so we're just going to block access and then you have a question about why is our aoi not good you know delivering roi it's like the code because we said we have you know the agent but it can't access any tool internally of course it can't deliver roi the second is where you say we're going to um you for lack of a better phrase, basically grit our teeth and just say, go and hope nothing goes wrong.

13:38And you give agents access to the different tools. And as a user of these tools myself, I think you mentioned you use OpenClawed. I use also other local coding harnesses. The agent does ask me permission for things. My gosh, it's asking me permissions every 20 seconds, every 30 seconds. Totally transparently, I'm hitting accept, accept, accept at a certain point. And it's not that these things are necessarily all dangerous, but it's asking for root permissions to certain folders. I had an example where I was asking the agent to create a document. And the agent noticed that my Google Drive connector was disabled.

14:17My agent wasn't supposed to go through Google Drive. So what did it do? It spun up a browser window, typed in drive.google.com, clicked upload, and then opened up my file navigation. Now, was that scary? Yeah, that was scary. Did anything bad happen in that instance? Nothing bad happened in the sense that I didn't have any local credentials on it. But actually, I think since we started talking about it in the last nine months, we've seen incident after incident where this has gone wrong. Small example would be like the coding agent that like deletes production databases. I think there's at least two different examples now of public areas that are publicly posted where an agent got access to a production database because, you know, you're hitting yes, yes, yes or something along those lines.

14:53And poof, like, you know, your database is dropped altogether. That's a nightmare for any organization to go through. I think AWS had its post where it said after recording agents got rolled out, they had four Sev1 outages in about 90 days, which for AWS, like, and it might have been shorter than 90 days, but for AWS, like the hallmark of like stability, cloud resilience, that is what you buy them for. SLA is what you buy them for. That's incredible, right? Like this company has processes, but these agents are going through them very quickly. Yeah. Meta, I think, like had its own like incident as well, where I think it was an instance of OpenClaw that actually got access to, you know, someone's email inbox and deleted.

15:33I read about that point, yeah. And so I think, and look, we shared a blog post too, where we did a limited release of Cloud Code. And just even in our individual organization, we saw three different instances of things that we knew like should not be happening. we were able to catch, but we were only able to catch because we had Asian Cloud clicked in, and Asian Cloud uses AI to actually secure and govern all these things. Like we saw an instance where, you know, people were writing and connected into GitHub, writing these gists, and the gist was accidentally shared to a public domain, not the private GitHub.

16:06Sounds like entropic. It's not, and of course, there have been a number of leaks that I think we could be talking about in the last week or two in the market as well. But I guess like my quick point of view is, I think nine months ago, it felt maybe a little bit more felt and suspenders. Like, you know, let's make sure that the things are placed correctly in order. But where I think things are now is you really are stuck between two types of choices. Either block access altogether. And my guess is somewhere, some boardroom or some CEO is going to be like, why aren't we getting ROI with AI? Or enable access.

16:39and kind of in some ways live with the fact, unless you have a solution that's actually monitoring everything that the agents are doing and can enforce these policies, which is like what we've built for us since internally are now packaging. Unless you have that, it's sort of like, you know, deploy it and maybe have some grit teeth and hope nothing goes wrong. But these agents are quite promiscuous, I think, in what they can access. I've read about some of these cases. I haven't read a good analysis of what went wrong. I mean, the email, the woman that's like frantically typing, stop deleting my inbox.

17:14And it just keeps on deleting. I think what often goes wrong is actually quite simple. It's like the agent was doing the right thing 90 % of the time and then just decided to take one wrong action. But the wrong action can happen like that because the agents are operating so fast. What do I love about the agent? It does what took me a week. Like, you know, it does it in an hour. Also somewhat bad when that thing that might have taken me a week would be something that's dropped there. Agent Cloud, Rubrik Agent Cloud, how do you deploy it? If you've got, for example, Cloud Cowork running Cloud Code, OpenClaw, maybe someone's doing something with OpenClaw.

17:51Maybe you're using Copilot as well as Microsoft as part of your Azure subscription. I mean, I think typically I see three different places that people are building agents, and then I can cover how Rubrik Agent Cloud deploys. The first is like you're building using agents on your client. like on the desktop. So that's like Cloud Code, OpenClaw, Cloud Codework. They're all local. The second is that you're building agents that are in the cloud. And this is like maybe you're using things like Copilot Studio from Microsoft or any of the managed services from the hyperscalers. And then the third is you're truly building something homegrown.

18:25Like you just got your OpenAI API key or your Anthropic OpenAI key and you're like, you know, wiring it up through one of these orchestration frameworks. The Rework Agent Cloud has actually hooks into each of these different types of ecosystems. So direct API integrations that can integrate with your mobile device management system, as example, to get a sense of like what the local is happening, has an AI gateway as well. So it provides a way to hook into each of these systems and then immediately start to get like the logs and monitoring and servability inside of our platform and then also start to push down its level of control that it has.

18:54And so our offering can deploy either as a fully managed SaaS offering, which deploys in the cloud managed by rubric or inside of our customers, VPC, inside of their virtual private cloud. and really can hook into the three different kind of surface areas where we see agents get built and deployed. And when you say hook in, is it like an API? Someone's enabling? Yeah. We have multiple different ways that we can hook in. And so the simplest way people often get started is if you're building an agent like in Copilot or Copilot Studio, you can provide your Azure API credentials and Agent Cloud is automatically plugged in, has access to the right set of things on its backend.

19:34If you're running on the endpoint, then we can integrate with an existing mobile device management tool, like an MDM that you have. And then otherwise, if you're just, again, using your own APIs, we can give you the API from the Rubric Agent Cod to use as well. So a little flexible in how we can kind of get there. API integration, give you an API you can use or integrate with your MDM. All different ways that RAC, as we call it, Rubric Agent Cod. I just want to talk about OpenClaw. How much do you know about how OpenClaw works and those security vulnerabilities? partly because I'm using it. I think enough to be dangerous would probably be my answer.

20:10I think OpenClaw really has a lot of the same types of security concerns that I think we would have with some of the conventional desktop agents with like an enhanced level of concern in the sense that it's like not necessarily managed or federated historically. I think when the open source project was getting distributed by, you know, a central party like Cloud Codes or Coworks might be, which has some inbuilt guardrails. So, yeah, enough to be dangerous. I think, you know, organizations oftentimes take a few different types of postures. Like one of them is like we ban OpenClaw outright. In that case, you have a problem of like, how do I know if OpenClaw is even running in the organization?

20:45So that's one of the problems that we solve right out of the box. Like how do we monitor and detect? And then there's, you know, what can OpenClaw do, which is another area where we help. And what does the product look like? Is there a dashboard that a human monitors or is it all agentic? and you just kept an alert if something was going wrong. Yeah, there is a dashboard that like a human can access and monitor. And the product really has, I think, like three key, let's say, journeys that you can think about. The first is the dashboard will show you like the inventory. The inventory will tell you what are all the agents that are running?

21:21What are the different tools that this agent can call? And again, this is across the different places your agents might be built. What are the identities associated with those agents? What models are they calling? So it's like all that visibility like in one place just so you add it. The nice thing is all of this is like automatically discovered and scanned. You don't like go in there and automatically register and manually register. That's like the first user journey is the dashboard and visibility. The second thing, which I think is like one of the more powerful things in the product, is we have a technology we've called SAGE, which stands for Symantec AI Governance Engine.

21:52Really came from our observation that a lot of the customers I worked with would have a policy that they wanted to make sure their agents were consistently adhering to. something like I wouldn't so I spoke with a customer in healthcare yesterday and they said like hey you know agents are not supposed to give clinical diagnoses no idea how to look at us and write a static rule like a string match and be like hey is what the agent said a clinical diagnosis or not so our view is like what you need to do is instead of having like human judgment try and look at everything that an agent was going to put out because that's way too slow we're actually going to have these small language models that can be fine-tuned and deployed to run on every single agent input and output to see if it violates any custom policy that you define.

22:32So we call that system Sage. And really what you can do is you can go into the platform and you just type out a natural language. You could literally type out agents should not give clinical diagnoses. And then we expand on that. We like fill it in with some examples. We show you what examples we'd flag on what we wouldn't flag on as borderline cases. And you can deploy that as a guardrail that'll actually run automatically and everything and then trigger an alert when something goes wrong. So that's the second experience. The third and final experience is inside of our platform, you can also double click into an agent and get a sense of like what's all of its map of actions.

23:02So you can see kind of the trail of like what did it do, when did it do it, and then you know if you need to, you can rewind an action as well to the previous snapshot we have from our Rubrics backup. You guys had an ad with Ludacris playing rewind or wind it back. is on that. How do you rewind an action? It's a complicated thing, but I think that the core of it is that Rubrik actually is lucky to protect a lot of the data for many of our large customers today. And so as we protect the data, we actually maintain like iterative snapshot of like the underlying data source that we might protect. So if you consider this like an Azure SQL database or Salesforce instance, And so if an agent takes a destructive action, you know, let's say on Salesforce or on Azure SQL database, like the first thing we get is like we get the observability that the agent took that action because that's the first journey that I mentioned.

24:00So if we notice a destructive action and a user wants to then say this was incorrect, rewind it back to the previous snapshot, we can then use the power of rubric in the backup in order to be able to restore it from there. Yeah. This is a SaaS offering you were saying. is it priced how is it priced is it by seat or enterprise subscription yeah we do kind of like right sizing towards the individual company and like the use case the product is new so we went GA recently earlier this year and so we've actually been iterating with our early customers on the preferred pricing way but we've been baking in kind of a license fee that gives them certain tiers of usage Yeah.

24:45With the explosion of agents being used by individuals, not enterprises, and as important as the enterprise use is, I think the individual use of agents is going to be as large a market in time as people become comfortable. Do you offer a consumer subscription or something that's geared more toward an individual user or small company? It's a good question. We don't do a subscription for individual or consumer use today. I would say if you're a small to medium business, like it's certainly still like we're open to reaching out. We can look to set up. We have some starter plans. but we really think about the opportunity there's certainly personal and consumer risk that exists but the thing that i think motivates us is that most of the businesses and the enterprises i think are actually either like not adopting ai or adopting out of a very risk for posture because of a lack of way to be able to do this for the enterprise solution and that's the market that i think we're most about if they stay on right now so we think about like global 2000 enterprise really as like some of the key folks, the early and large AI dodgers.