Why AI Agents Break the GenAI Security Model with Devvret Rishi - #770

22:31And the reason why was that it used to be that you needed data backup for business continuity in case of like natural disaster, fire, flood. So think like a couple of decades ago, everyone started buying data backup because it was like if a flood hits the data center, how are you going to come back into business? But those solutions were, I'm not sure what the right word is. let's just say those solutions were like relatively basic at the time. It was like an insurance check mark that you hope you never had to use.

22:57Sam Charrington:I think also I'm feeling like heavyweight. Like I'm imagining a world that you're talking about where, you know, you said agents are everywhere. They're like constantly churning through things. If you're getting, you know, if you're getting kind of, you know, these alerts or triggers or whatever you would call them where, you know, hey, the agent did something, you know, not so right here. You're using an SLM, you know, so maybe not the smartest model. Like it's going to let some through. When I think of, you know, backup and recovery and even snapshotting, it's like this is a heavyweight process.

23:36Sam Charrington:It's not something that like, oh, the agent did it. Let's, you know, roll back. Oh, let's roll back. Maybe for, you know, a small individual database. Most backup and recovery for a long time has been like this heavyweight piece of software that you buy and you hope you never have to use. And you're like, if something goes wrong, you know, once every, however often, we'll like blow off the dust and like, you know, figure out how to be able to plug it in. I think the core observation that we have is like, I think agents are going to change that game. I don't think like that this now, the need for recovery and resilience is just going to be the once in a, you know, hopefully never ransomware attack or otherwise that you end up having.

24:14I think it's going to be much more frequent, both from external malicious AI driven attacks and internal inadvertent AI mistakes. The brilliance would be if you can tie a really good recovery system with a really good AI monitoring system. To your point, I don't think many people have that today because you ideally want to bundle and buy this together. Slight plug for Rubrik, which is actually doing this. But I do think that, you know, to your point, the core is like, can you find a system that basically architects both of these things together? Because you probably have something for data backbone recovery for like other compliance reason or other, is it possible to connect it into your observability?

24:52And I will actually say one misnomer is that the SLM is not as good at enforcement on the olive. Actually, we find that for domain-specific tasks, small language models that are tuned for a very specific task tend to outperform a generically prompt-engineered larger language model. So like when we benchmark our SLM versus at the time, I think we benchmarked to GPT-5.2 as an example, we found that not only were we in order of magnitude faster and cheaper, but we are also actually more accurate on being able to make a binary classification on whether or not to allow or disallow. And we've relatively consistently seen that fact when you just constrain the outputs of the LLM to be very low cardinality in terms of what it's supposed to do, which is exactly what you want from a guardian agent.

25:32Sam Charrington:Yeah, I could see that. I think what colored my perspective on that is thinking about with OpenClaw or, you know, personal agent, It is frequently said that you should use like a frontier model for your main orchestrator because your SLMs, you know, if you expose them to external untrusted data sources, they can be easily manipulated relative to a frontier model that, you know, A, is tuned better to be able to detect and resist manipulation. But also it's just like smarter, more parameters. So we've done a lot of benchmarking on this exact line of thinking. And we did it even in Protobase. Like we released a paper called LoRa Land because all of these are like LoRa tuned adapters, essentially.

26:18It was a technical detail. But what we found was that for open-ended, like for open domain tasks, you're 100 % right. Use a large frontier model. That's why the orchestrator or the planner should really be like a larger model. But if the more constrained you get into tasks, the better and better you actually tend to see performance.

26:36Sam Charrington:So if it's just a fixed domain classifier, then... If it's a fixed domain classifier, the best you could usually do is post-training with like SFT, you know, a small model on it. And then if you have a task like what we're talking about, which is simply, should this request be permitted or denied? Like that is actually the ideal type of task for an SLM. And that's where you're able to run it at super low latency. Now, I think to your point, like ultimately, I think that all prevention mechanisms are going to have some rate of false negatives. And like the agent world is just moving too quickly to be able to catch and block everything, which is why the resilience story is so important as well.

27:15We talked about the agents themselves,

27:19Sam Charrington:you know, being incredibly resourceful in trying to get their things done, right? And then we talked about, you know, using an SLM or an LLM as judge. I'm envisioning a scenario where your agent starts trying to hack your SLM to get its request through. And I'm imagining that it could probably be pretty good at that if it really figured out what was going on. Like, how do you, yeah, how do you prevent, you know, the agent like injecting something into the request that says, you know, this is a permitted action, blah, blah, blah. Or, you know, you know, the thing I'm getting at. Totally. And this is why it's so important for, I've seen a lot of people when they first think about this idea that we need AI to help secure and govern AI.

28:03The first thought is like, great, I'm already doing this. I'm putting guardrails into the prompt of my mom. And that's usually the first tag. And you're laughing, but I would say, in fact, most often, that's actually the usual take. So just like, I'd say, where does the state of the art in the universe? Step zero is like do nothing, essentially. Step one is like, I have a bunch of deterministic rules that I like configured in some cloud console somewhere that hopefully works for something or not. But it's very limited. Step two is like, I know that I need to use AI. I'm going to put these in the prompt of my model.

28:34And then step three is you have an external system policing the inputs and the outputs, which is what Sage is. Now, I think that, you know, even Sage is something that people might be able to try and attack. We haven't seen, like, we process trillions of tokens, you know, instead of Sage. And we haven't seen any, like, incidents of evidence where that kind of can be circumvented. And we also specifically post-train models that are watching out for this kind of thing. But I will say that this is the reason why you need an external system like Sage because what a lot of people will do is they'll say, I've put these 10 guardrails into my model prompt.

29:08That's the exact type of thing that the models are very good at certain event thing. And so even the external system might not be perfect, but it's a lot better than I think everything else people are using today.

29:19Sam Charrington:It's funny because, you know, I see so many of these like OpenClaw in particular, like YouTube videos, and they're like, and security is such a big deal. You really have to tell your model to be secure. Wait, what? Yeah, I see that this is, I think it's going to be like the clouds and the hyperscalers in some way, which is like, I think that the labs and other folks will build in some security processes within it. But I think you're going to need someone else to police the infrastructure. Like you aren't going to want the infrastructure to be policing itself. And this idea of like, hopefully the model will do the right thing.

29:59It probably will 95 % of the time, but that's a huge blast radius where things can go wrong.

30:04Sam Charrington:So you mentioned that Sage, you already have trillions of tokens flowing through this. How long has it been around? And is it like a SaaS offering? Is it open source? What's the kind of packaging for it? We went GA with the Rubrik Asian Cloud and Sage as the agent for agent security inside of the Rubric agent cloud. We went to GA with that product in February this year. So just a few months ago, actually. The reason we're already processing trillions of tokens is if you work with certain organizations that are starting to use these like agent harnesses, you're starting to notice usage go like this, right?

30:41And we saw it even internally here at Rubric. I think the question around like, how do we actually package it? We use it as a Rubric hosted version and can like, you know, do it directly as something that we host or we can deploy instead of the customer's environment, which tends to be important for some of our customers that are in more heavily regulated industry. So whether you want a hosted version or something that you host yourself, like we actually have both offerings.

31:05Sam Charrington:Okay. Talk a little bit about when you've deployed this, like you kind of just mentioned like, you know, if it's, you know, finds 95 % of things, that's still a huge blast radius. Like, I guess I'm trying to get a sense of like, when you have this running in the wild, like, you know, either anecdotally or percentage wise, like how often are you seeing things that otherwise would have just been shocking, but, you know, you're able to identify and stop those things. Is it rare or is it like - Realistically, it's all the time. Like I would say for deployments at scale inside of an organization. So maybe just like a couple of anecdotes from like our deployment here at Rubric, because I feel that we could more likely speak to those.

31:55You know, one thing we noticed pretty early on was we're using Cloud Code very heavily. And there's a bunch of things that you saw that you're like, yeah, I bet people were doing this. And now I see it and actually, you know, catch it in practice. For example, people putting like raw credentials in like request and response, right? So like the literal text is just there. It's like the thing that you're supposed to not do in Security 101. You see it there and you're like, OK, I want to block these types of actions in the future. So you can do that. But then we saw some more sophisticated types of things that were going wrong.

32:23and so Cloud Code is a very common use case for what we're securing and of course those coding agents have access to GitHub and others. One thing we noticed was that Cloud Code was really trying to post things that were internal and this happened like multiple times over the month internal source code to the wrong repository and the problem with posting it to the wrong repository was it was posting it to a public repo rather than private so it was actually taking like parts of source code and trying to package it up and put it into like these public GitHub gists. And so we saw this kind of relatively frequently.

32:59And there was even instances where like, if we looked back through the audit logs, I think, you know, and I don't want to misquote, but I think this is one of those things where like if you saw like the check, check, check, like at some point, the way that Claude code had communicated what it was requesting was pretty confusing. And so, but like technically it felt that it had gotten the human in the loop approval for it. But I think if we had like, you know, like the reason we were able to catch it is we were looking at the full context. We were looking at like, what is the thing that it's actually looking to post?

33:27What is the destination? We have a policy that says anything that looks proprietary and internal shouldn't go to a public source. Let's go ahead and catch it. And we even saw one crazy instance where Cloud Code tried to get around this like blocking we were doing of like GitHub public gist. And rather than like doing this as a text in text out system where it was like, all right, I'm posting to this URL. It spun up a browser window and we just started to see mouse clicks on certain coordinates. and we noticed that one of the coordinates actually was for a public gist. And so we were able to go ahead and catch and stop something like that as well.

33:59So this is obviously like one line of I think interesting things we saw, which was like more in the sensitive data exfiltration standpoint. We see other things like in terms of credentials and others like pretty, like I don't want to say like all the time, but it feels like it's all the time. And I think in general kind of reflects what I hear when I speak with leaders at large enterprise organizations, which is they're always surprised when they get like an audit report of what's actually happening with AI in their ecosystem. I spoke with somebody who told me like, you know, last year, I don't think I need the agent security governance thing because I think right now we have like three or four agents that are deployed.

34:33And I got dinner with them a few months ago and they're like, you know what? I think I was wrong. We did an audit. Guess how many agents were deployed? And I was like, it wasn't three or four, was it? And he was like, nope, it was 250. And I said, okay, got it. Like, it's just surprising, I think, at the rate at which these tools can get adopted internally. And when they reported that number,

34:52Sam Charrington:was that 250 people using Cloud Code or are these agents that are like, you know, 24-7 living on some infrastructure in the organization or? Mix of them, but it was a lot of like agents that were actually basically autonomous background agents. People had built like in the cloud, like on Copot Studios, one example, as a way to be able to just start to run tasks. I'm trying to form a question around it. I think that's essentially like pinging or pushing back on like, you know, AI only as a, as a means of securing, you know, these agent interactions. And, you know, I, you know, I could ask it from like an enterprise perspective, like, you know, are they going to, is an enterprise going to feel like they have enough control, you know, or even from my perspective, like, you know, I'm a little bit old school.

35:44Sam Charrington:And I feel like, you know, I want to say, okay. And in fact, it surprised me. I was looking at cowork, you know, and trying to connect a tool to cowork just the other day. And I was like, why doesn't it just give me the ability to say read only and not, you know, you know, everything. And it's hard to come to terms with, you know, not having that degree of control for people of a certain age. No, no, I think it's hard to come to terms with this for honestly everyone, which is like, I'm going to end up trusting, you're telling me I'm going to end up trusting AI model to help me do my security and governance posture.

36:22What I think is like one of the things you pick up as AI and for security is there's this concept of defense and depth, which you're usually going to layer in multiple of these solutions. My view is that the link that's missing today is that AI in the loop system. We have plenty of good rules-based systems. We have plenty of good like other configurations. A lot of people like, you know, I'm not saying...

36:40Sam Charrington:So you're not saying that it needs to be just AI or that AI is efficient necessarily. It's just that if you have anything today, it's probably insufficient at keeping up with the volume and you need AI for that. I'm saying two things, right? Like one of them is what you have is good, but you're missing this. The second thing that I actually believe is I actually think that this thing that you're missing is the most important piece of the puzzle. Because, yes, you want some of those deterministic rules. No doubt about it. But the example you gave, which was like, well, can I just go ahead and put this in read mode?

37:16Totally. You can put it in read mode. And a lot of ways that I've seen people secure certain infrastructure as they like look at my cloud code connecting to Salesforce in an email example. And they're like, don't worry, Doug, that would never happen to us. We disable all access to Salesforce. I'm sitting there and I'm like, how often can you just disable access as like the end solution if you're also getting board level pressure to go and adopt AI to enhance productivity? So my point of view, Sam, is like, there's a lot of instances where you might end up saying, I never want AI to touch this system.

37:49But I think the majority of the instances are, I actually do need AI to do some of the work. I need it to have that right permission, as scary as that is. But I wanted to be able to do it in the context of very secure runtime guardrails. And that's where I think we think about, that's why I think the AI in the loop system is the most important part. Ultimately, if your organization can continue by saying, we can block access for like everything, like the security posture will be blocking for everything, My point of view is you're just going to massively compress the ROI and AI that you get. I think the correct solution is going to be there's a class of things that are fully blocked.

38:22And you're like, I can't think of a single reason to do this. That can be deterministic in rules. And there's going to be a large, gnarly class of things that are going to be, well, it kind of depends on a policy enforcement. And it's based on the intent and the context. And that's where I think the end of the loop system comes in.

38:36Sam Charrington:I'm curious to what degree do some of the emerging protocols like MCP and A to A and the many, many other agent to agent and the like protocols change all this? Yeah, I think that they just introduced like a new surface area for where the problem basically shows up. So if I think about MCP or 8A, they're really good like interconnectivity protocols. And like they help, for example, MCP, modal context protocol introduced by Anthropic, like helps give agents sort of like an API they can understand the different applications that you might be running inside of your ecosystem. So I mentioned, for example, my cloud code uses an MCP connector to Google Drive.

39:17the thing about MCPs is that what we saw internally was like Cloud Code was approved for some subset of MCPs but if you actually looked at the MCPs that were connected to Cloud Code it was decently larger than the subset that were approved

39:33Sam Charrington:meaning exactly meaning that people were connecting Cloud Codes to custom MCPs and you know connecting it via like MCP servers to ones that maybe weren't on that initial So you had a centralized org that approved some MCPs, but you had MCP sprawl within the organization. MCP sprawl is a great way to put it. And you see some approaches to try and solve this, like an MCP gateway, and then you have to question, like, can I get everything through the gateway traffic or not? But again, like there's a number, there's like layers towards this. I think MCP does really help kind of, if it's executed perfectly, the centralization of access.

40:12It still doesn't solve this, like even if like I have the legitimate MCP connected to Salesforce, I have the legitimate MCP connected to my email, but MCP is not preventing me from exfiltrating Salesforce data to email. So it's not so much there, but it's helping me understand what application should be authorized or not to get my given agent. So I find it like a very helpful protocol. Similar with A to A for like agent-to-agent like communication, I think that all of these are very useful for like structuring and making the scheme a bit more consistent. It also makes some of our job in terms of the patterns to look for a bit easier as well.

40:46I do think that as like the evolution happens, there's an open question on like, will MCP continue to be the thing? Or will these agents just start to use like command line tools with parameters that they find directly in the documentation? So we see a mix of both, to be honest today. And so we've expanded our definition from what was just MCP tools to just all tools, which can include like direct API access in addition to MCP.

41:09Sam Charrington:But if you're injecting yourself over the wire or kind of in that wire conversation, it doesn't really matter to you because ultimately, whether you are on one side, you know, curling a request or using a CLI or using an MCP, at some point it's over the wire. Yeah, exactly. It doesn't really matter to us. I think, you know, with the slight caveat that sometimes organizations have policies defined for their MCPs, they may not have defined for their other tools. So we want to help people enforce the policies that they may have, but we're able to see the traffic regardless. Got it. Got it. And then observability is a big conversation with folks that are building agents and being able to review traces and things like that.

41:59Sam Charrington:that's often using a, you know, similar kind of approach to reverse proxy or something kind of between the agent and the other things that it's interacting with. You know, there the noise is even greater than, you know, your tool approval box. But do you find that that is, you know, is it valuable? Does it help you do your job? You know, how do you think about observability as a field relating to securing agents? It's funny because observability can be used really for two purposes. And I think there's distinct tools for, you know, the two purposes. So observability can be helpful for the people that manage the infra or the developers, where they're basically like tracking all their traces, they're doing evals over those, and they're trying to get a sense of like, are my agents, you know, useful or they do well or are they working?

42:52And then there's observability for security, which is a little bit more of the area where we're oriented towards, which is like, there are dangerous things happening. And you care about slightly different things in the two different contexts, right? I think to the extent that an organization is already thinking about agent observability, it's really good for us as a place to embed. Because I think about the rubric agent cloud is again, doing three things, like monitoring observability, kind of the consistent runtime enforcement with Sage, our small language model harness, and the resilience and rewind capabilities.

43:22When I talk to a customer, I usually tell them the second and the third I view is differentiated. The first I view is like over time, just commoditized. Like if you have an observability solution, that's great for us. Because what we want to do is like I view observability and visibility as kind of the base layer of the cake. And what you end up doing is actually building out your more security and governance practices on top of what you have. And so most organizations tend to only have like really good observability for like a small portion of their agent stack. So like to give you an example, a lot of organizations are like, yeah, we're building custom agents with LangChain on our cloud.

43:59We're using Copod Studio. We're rolling out Cloud Code. And by the way, like we just introduced Glean and Agent Force from Salesforce. So we've got everything under the sun. Typically, my guess is like that organization.

44:08Sam Charrington:Only that first party agent has any kind of observability. Yeah, probably those LangChain agents have a good observability stack and everything. That's an address. And then I'm standing there and I'm like, wait a second, but like cloud code is like usage is like over here in your organization. The LangChain agent might be like down here, but you know, the observability stack is only on one. So we want to unify all of those into one place. But I think to the extent that organizations, like OTEL, for example, like OpenTelemetry and others that are standardizing observability metrics have been massively helpful for us.

44:35And I think like we'll continue to be a tailwind as we go forward.

44:38Sam Charrington:Because you consume them or because the enterprise has thought about certain things, you know, through the process of getting that level of observability in place that lends itself to willing. Both because we consume logs like in a hotel compliant format. So if you've already had that system and process running, it becomes very easy then to start to direct those towards us. And then second, like now you're familiar with this idea of I'm going to have like a system processing through this data and I'll be able to make sure that I have kind of this immutable trace somewhere. When we talk about agents kind of producing so many actions and decisions that they kind of overwhelm the human and a loop oriented approach, to what degree is that really primarily an issue only for, you know, developers and folks using cloud code versus like people using co-work that are, you know, tend to be more interactive?

45:36Like, do you see that or do you see that, you know, independent of use case, like people just can't keep up? It's definitely more present in developer workflows today, but I don't think that's going to be the terminal state. I think the reason it's more present in developer workflows today is because coding agents are A, the most heavily used, but B, they also tend to have the most broad levels of access. Oftentimes, if I think about like a realistic cloud coworker use case, for example, it's like, help me make my deck or slides look better, like run this quick analysis in Excel. And today, I think that's where coworker is because it's newer than cloud code and others.

46:18I think what's going to happen over time is as you start to give this greater and greater level of access. So it's not just like making you a deck, but it's like running through reports and sales, like similar to how in engineering, we're not just like, hey, make, the button balloon, or like design the entire interface. I think as you start to do that, and you're looking at creating, you know, full, full stack plans, starting from Tableau, starting from Salesforce into Tableau, writing an email, having it go ahead and update something in your underlying system of record. I think things are actually going to start to introduce that same level of overhead.

46:51Because the fundamental reason for the coding agent asking permission and the co-work agent asking permission are really the same. It's like it's taking an action or operation on your behalf. So right now, developers probably have like 10 times as much permission and access on average than the conventional co-work agent might. I don't know if the co-work agents will get all the way to the same page, but I do think they're directly on that trajectory too.

47:12Sam Charrington:Do you find that the SLMs need to be tuned to use case or, you know, even more narrowly customer? Or do you ship them generically and they work the same? We find that it's helpful to tune the SLMs towards use cases being like policy enforcement. So like, you know, understanding session data, being able to arbitrate decisions on whether or not to allow or deny actions. We find that post-training the SLM for the organizational specific context hasn't been as critical so far versus like inference time customizations that we're able to do by being able to embed certain context from the organization at the time that the SLM is making the arbitration.

47:59So, you know, put simply today, I think like post-trained SLMs for use case, yes, ship the same one across customers and do an inference time customization for each customer.

48:11Sam Charrington:I think that's consistent with where the question came from, which is an SLM that's really focused on cloud code probably needs a, you know, different, you know, way of looking at the data and one that's focused on like, you know, things that are permissible in email conversations and like business user conversations. Yeah, and even higher level than that, like an SLM in general is going to be like trained to generate all the tokens in the universe still. But being able to go ahead and say like, look, what you're really looking to be able to do is be very good at decision boundary between risky and unrisky actions, I think is an area where you get like significant lift right out of the box.

48:49Sam Charrington:And we gloss over this earlier, but the broader Rubrik agent cloud, what is that doing? Yes. So the broader, so Rubrik as a company has really two core offerings, Rubrik security cloud, which is all about our data and cyber resilience. So think about backing up data across all the organizations, backing up identity systems, helping people recover very quickly. That's one. The Rubrik agent cloud is the view of like, it's essentially like the parallel products now. And the Rubrik agent cloud is all about making sure that organizations are resilient for now an AI-driven future. And that's the product that has the three core pillars from observability, runtime security with Sage, and then resilience and rewind.

49:30Sam Charrington:And what does the deployment process typically look like? This is the thing that I think I'm happiest about with the Rubrication Cloud. And one of the startup learnings, actually, I'll share. It's like, how do you optimize for time to value, right? But one of the challenges with, I would say, post-training as a process is that it's not immediate time to value. You need to collect your data set and then you get to like train modeled and you e-ballot. One of the great things with Rubric Agent Cloud is you can actually just plug it into one of your agent runtimes very easily and you start to see things relatively immediately.

50:00So if you want to hook into something like Copilot Studio or, you know, ChattoPT Enterprise, we just launched an integration with Anthropic and the compliance API. You can actually like basically do an API level integration. If you have the right permissions, it can take a few minutes to set up. and then the traffic is flowing, you're seeing all this runtime observability. And you can add on more integrations as time goes on, right? Like we hook into a number of different sources. We hook into the mobile device management suite or the MDM for an organization. We can get the gateway level. But to get started, what we usually recommend is like, let's just pick one, authorize it.

50:36And API level integration is pretty fast. And then you can start to see what the value looks like in that agent runtime. And then you can cover more of your stack as you want.

50:42Sam Charrington:And so when you take that first step and you do the API level integration, is the result of that primarily an observability tool or is that also all of the decision-making that we've been talking about? Like, do you have to do more to get to decisioning or is it just there? It's funny, the world moves quickly. When we first rolled out Rubric Asian Cloud, it was predominantly observability and then you would need to configure your policies and then we could show you what's violating a policy or not. And people love the demo because I would show them like, look, you connect into your system and now I can write a policy and I'd show them like, I'm just typing out a policy in natural language.

51:20So something like don't take sense of data and put it in an email and now I can go and like run it. But then when we were deploying to customers, we realized a lot of organizations don't know all the policies they want to enforce out of the box. Instead, what they want is like, give me 80 or 90 % of the answer.

51:36Sam Charrington:A catalog or something like that. Yeah, give me 80 or 90 % of the answer out of the box and then let me go ahead and pick and choose and customize as I want. And so what we launched relatively recently is a component where you hook us into the runtime and we are like, you're good. We are running immediately. And we are showing you, you know, we've just naively called it insights, but we're automatically showing you like what Sage is picking up as traffic, the runtime enforcement, what's dangerous. We're suggesting remediations for you, like create a policy to prevent this in the future. And then you can do the additional work to customize it further.

52:08But our goal has been like fast time to value and really solving most of the challenge out of the box. And so once you've connected it, that's really all you need to do to be able to get a large chunk of value up front.

52:20Sam Charrington:So given that the space is moving very quickly, where do you see it all going? What's next? What's coming? It's funny because earlier in the show, I think you did ask about, hey, if I'm old fashioned and I'm worried about this idea of like just deferring all control to an AI system or a harness, how should I rationalize that? we kind of took this bets last year that we wanted to do more and more and the loop. And I actually think last year when we made the bet, there was a part of me that was nervous and I used to hedge the answer a little bit more and say like, you're really going to want both.

52:52You're going to want deterministic and deterministic. I do see this world increasingly now just moving to AI systems that are running these processes more end to end. And so I think where the world is headed is, I think right now a lot of agents are still stuck in read mode. I think that's going to change. I think agents are going to graduate from read mode and go on to write, delete all the card applications because I think they're essentially going to be doing the types of work that humans are doing. I think token and inference spend is going to continue to scale up very, very quickly. I think we are going to see a series of large scale, I don't know how we want to call them, mistakes, incidences.

53:30I think agents are going to, I think that we're going to see a massive amount of productivity and I think we're also going to see some inadvertent incidences where things have gone wrong. And I think that what we're going to end up centralizing on is that there isn't another good way to be able to solve this problem. The rules in the human loop will still keep for certain applications because they also help us feel good and because they're necessary for some applications. But I think what we're really going to go center around is like we want these workflows to become increasingly AI first and that we're going to use the same type of technology that's introducing the risk to also be a part of that solution.

54:04So the world's moving very quickly. I think agent harnesses have like absolutely exploded earlier this year. I anticipate that to continue. I anticipate coding to be still a dominant use case through this year. But by the end of the year, I anticipate the same thing we're seeing for coding is going to be happening for many other types of, you know, sophisticated knowledge work. And I think we're going to start to see the same type of requests that we need now monitoring coding agents starting to extend across the agent stack. And I can't see another way to do it without being AI in the loop.

54:31Sam Charrington:Yeah, it's interesting when I think about that, I tend to agree. I wonder about like of the tools that I use, you know, for example, like the, you know, G Suite stuff. Does it have an ability to do snapshot? Like, can you hook in for that third pillar of yours? Like, do you have a way to say, hey, this agent just blasted this user's calendar. Can you restore it for me? So, you know, I do think that a large part of like Google Workspace is something that Rubrik does have integrations to be able to back up. Oh, really? Yeah. So this is tying over to the like traditional core product of... Core business.

55:13Sam Charrington:Yeah, exactly. So, you know, to the instances, I think there must be some instances where we don't back up, but certainly like a large chunk of like important, like where important information is, it tends to be the areas that we like to be able to back up. And Rubrik has built a large business on the backs of that. And so I think that it's a good question how do i make sure the agent like look to feel comfortable giving your agent full write and delete access to your calendar you'd probably feel a little bit better if you could rewind that action in case and ultimately that's why i think that this is like the third pillar and also the pillar that i think like we're you know the third pillar and also the way we approach the second pillar i think those are the two unique things we're doing because frankly a lot of people are going to be in the asian observability space um and if that's all you need to solution like there's going to be multiple vendors on there i'd have my point of view for maybe why us, but there's going to be other good vendors.

56:02But what we really think about differentiating us is like Sage and Rewind.

56:05Sam Charrington:Well, Deb, thanks so much for jumping on and sharing a bit about the way you're thinking about Agentex security. Of course. Thanks so much for having me, Sam. It was a lot of fun in the conversation. A lot of fun. Thank you.

56:30Thank you.