Databricks Data + AI Summit 2026 | Andrew Krioukov, Databricks & Patrick Wright, National Australia Bank

Clips
More from Databricks Data + AI Summit 2026

Andrew Krioukov

GM of Lakewatch

Databricks

Patrick Wright

CTO

National Australia Bank

play_circle_outline Machine-Speed Defense Against Agentic LLMs: Countering Hyper-Automated Attacks in the AI Era

play_circle_outline Hiring software developers and data experts for security ops

play_circle_outline Widening telemetry and ingesting diverse data types

play_circle_outline Organizational bottlenecks and democratization of company data

Info
Transcript

Andrew Krioukov, Databricks & Patrick Wright, National Australia Bank

Andrew Krioukov

GM of Lakewatch Databricks

Patrick Wright

CTO National Australia Bank

In this interview from Databricks Data + AI Summit 2026, Andrew Krioukov, general manager of Lakewatch at Databricks, joins Patrick Wright, chief technology and operations officer at National Australia Bank, to talk with theCUBE's John Furrier about the transformation of enterprise security from manual operations to agentic, data-driven defense at machine speed. Wright frames the threat landscape plainly: attackers are now hyper-automated, deploying agents and large language models to find vulnerabilities faster than the developers who wrote the software. Kri... Read more

explore Keep Exploring

What has changed in the last couple of years in the cyber threat landscape, and how should banks respond? add

How should organizations rethink and restructure their security operations, tooling, and staffing—beyond traditional SIEMs and human-centric workflows—to handle the increasing velocity of threats that require detection and containment in seconds or milliseconds? add

What is your vision and plan for using AI and integrated data platforms to improve cyber defense? add

How will the adoption of AI agents change the work environment, and what challenges or bottlenecks does this create for managers and organizations? add

bolt Powered by CUBE AI

Andrew Krioukov, Databricks & Patrick Wright, National Australia Bank

search

John Furrier

>> Welcome back to theCUBE's live coverage here in San Francisco for Databricks' Data and AI. I'm John Furrier, host of theCUBE. This conference has got 31,000 people up again. Keeps getting bigger and bigger. Soon they're going to bust out, probably end up in Las Vegas, a bigger venue, because the growth of data and the growth of AI is significantly happening at the same time. Of course, the AI infrastructure's continuing to build out. We got super computing enabling massive growth and new opportunities and challenges, as the next panel's going to talk about security, this next industry veterans, we've got Andre Krioukov, ZM of Lakewatch at Databricks and Patrick Wright, CTOO, Chief Technology and Operations Officer at National Australia Bank. Got that right, not Australia. Guys, thanks for coming on theCUBE. Really appreciate it.

Patrick Wright

>> Thank you for having me here.

John Furrier

>> It's getting loud in here. People are packed.

Andrew Krioukov

>> It is very loud in here.

Patrick Wright

>> Yeah.

John Furrier

>> Security, the tagline has been, "What's built in from day one." Okay. I get that. But now we're at a whole nother ballgame with security and agentic on the horizon. We heard from Databricks today, very straight up, transparent. We're not ready for prime time. You got to get it right. You got to get the data right. It works in certain use cases, but it's not yet going to be the silver bullet because lot of things to get wrong. Nobody wants to hear that in security.

Andrew Krioukov

>> No, nobody does.

John Furrier

>> Nobody does. So what is the State of the Union for security right now? Because this growth has benefits. What are you seeing out there right now for security in the AI world? Approach, best practices? What's your thoughts?

Patrick Wright

>> Yeah, I'll start. Maybe you can add onto it. What's changed in the last couple of years is the attackers are now automated. They used to be automated, but now they're hyper automated with agents and large language models that can find vulnerabilities that haven't yet been found by the people who wrote the software. That's point one. Point two is the velocity of software development is increasing dramatically. And unfortunately, I'm one, developers don't always write secure software. So I think the number of vulnerabilities is going to continue to increase. And so we have to respond in particular as a bank. We've got to start battling all this at machine speed. And security operations teams used to be that. People looking at keyboards at three o'clock, looking at screens at three o'clock in the morning, it's changed dramatically. And so what needs to happen is we've got to pivot everything we do to widen the telemetry of data we look at and to automate the work that was traditionally done by a security operator and do it in an agentic way.

John Furrier

>> So Lakewatch, successful product. You got the Panther acquisition, that came in late last night, big keynote announcement. Obviously not a lot of specifics to talk about. And you guys don't usually have all those details out, but what does that mean directionally for you?

Andrew Krioukov

>> Yeah. Well, to be honest, it's really the same vision we had for Lakewatch just moving faster, getting it done at a bigger scale. So Lakewatch has from the very beginning been focused on how do we help you bring in as much data as possible. And really to Patrick's point, you have to have all of the data at your disposal here to be able to stop the attackers. The attackers are going to get in through any means they can. They have agents now where you can automate so much the attack process and we're seeing this, basically more attacks at a bigger scale using previously unknown vulnerabilities. And so data's going to be fundamental to the defense.

John Furrier

>> Yeah. I can see it being in your stack, obviously the capabilities. So the question is, how do you see that coming into the stack and what does this do for people that want to replace their legacy SIMs? Because this is an opportunity, as you mentioned, the environment's changed. If you took situational awareness in the market, this might be an opportunity. Thoughts on that?

Andrew Krioukov

>> Yeah, absolutely. Absolutely. We're seeing both the recently released models we've all been reading about, right? Mythos, Codex, et cetera. All of that is definitely a tailwind. Folks are waking up and realizing that a legacy solution, it has manual processes where humans are spending half an hour investigating an incident and you might have tens of thousands of those incidents every single week. How are you going to keep up with that? And those numbers are only going to keep growing. So you need to apply agents, you need to be able to see all of the data. Those are fundamental tenants of what we're doing with Lakewatch. And at the core level, this is a big data problem.

John Furrier

>> Yeah.

Andrew Krioukov

>> This has moved from being a specialized domain to big data.

John Furrier

>> Patrick, talk about this because you're CTO and ops, so you have to run everything on the stack for security. SIMS, outdated, this brings up an opportunity. What's your view on this for people watching as you look at the ops side of this and the technology, not necessarily Panther, but just security in general, how do you look at this holistically and fight this and organize around it?

Patrick Wright

>> I think there's actually, I think, a retooling of the industry that needs to happen. Traditionally, your security teams were highly dependent on very specialized software that while it's evolved, it hasn't fundamentally changed that much over the years. It's gotten better at what it does, but it still fundamentally has the same basic capabilities. And then Signal came out of those tools to humans who would then look at them on a screen at three o'clock in the morning and that pattern just doesn't work anymore. As Andrew said, the velocity's going to increase dramatically, it already has and the intensity and the time that we have to actually determine that there's a problem and contain it is going to shrink from 30 minutes or 10 minutes to seconds.

John Furrier

>> Milliseconds.

Patrick Wright

>> Milliseconds.

John Furrier

>> Yes.

Patrick Wright

>> And so we have to fundamentally rethink it. And one of the things I'm really pushing on with my team is I need to hire software developers and data experts, not your traditional security operations teams. They need to be able to write software to help find signal in the noise.

John Furrier

>> The agent opportunity is massive because you can actually cross boundaries too. You can say, "Hey, I'm seeing something at the network traffic." You can look at the data. I can quarantine that instantly in seconds. That would have taken a day. If malware comes through CrowdStrike or Palo Alto, whatever, like, "Wait a minute, something happened." It could be a full day. You want that in seconds. That's the North Star, milliseconds, and then you want to have remediation. And that involves agents talking to maybe other systems. How do you think about that and how should people really understand this new normal?

Patrick Wright

>> Yeah. So the way we think about it, yes, I do think they will talk to other systems. The way we're thinking about it is how do we, in as close to real time as possible, get the behavior of all the systems that matter into Lake Watch as fast as humanly possible? And there's a lot of capabilities that have been built in the last couple of years by this company. And I do believe once you get it there, we can start doing something with it, but we have to widen the aperture. Sometimes as Andrew said, a fraudster or a cyber event may actually first manifest itself by a server spiking from a performance problem, or it could be a network port that drops. It could be an increased number of online account takeovers or fraud that happens with our customers. So we've got to bring all that data in to actually understand.

John Furrier

>> Fast.

Patrick Wright

>> Fast.

John Furrier

>> Accuracy is key.

Patrick Wright

>> Correct.

John Furrier

>> All right. Let me ask you a question about Databricks because one of the themes fast coming out of this event as well as other events we've been covering is the role of partnerships change because they got so much good stuff coming out of the oven on the tech. You got a lot of velocity on technology. You already got a high velocity pace of play in your business. How do you partner with Databricks? What are you guys doing? What's working? What are you going to double down on?

Patrick Wright

>> Yeah. We have a very high trust relationship and I think partnership, they start with trust. So when we have a problem or we've caused an issue and we can have an honest conversation with Databricks about what our problem was and likewise, when Databricks has a problem, we can have an honest conversation with them as well. And I think partnership has to be two-way. It has to be high trust. And look, we're building our core data lake for the entire company on Databricks and we're a few years into that journey and we think it's a great company-

John Furrier

>> You mentioned something before we came on camera about putting security in with all your data earlier. What does that mean? Because I think I really like that approach. Explain your ideas around your security data. You had mentioned, "Hey, we're going to put all of our security in where the data is. "

Patrick Wright

>> Yes.

John Furrier

>> Is that the data lake, what does that look like?

Patrick Wright

>> Well, there's a couple of different ways to think about it. One of which is when we bring the data in, it has to be secured. That's the first point. And so there's a lot of capabilities that Databricks brings to solve that, which we don't have the time to talk about. The second thing is that the traditional security data set that your average security person would look at is often in a separate system from where your business runs itself. So the data lake that the business uses to run itself, to look at P&Ls, financials, even things like fraud and financial crime and network availability, systems available, they're all separate systems. And so we see there's real value in getting all of that stuff in one and then allowing either a business process or a security process in the lake watches to actually harvest meaningful insights off all that data. And so that's why I think that this is such a good platform for that.

John Furrier

>> It's really innovative. Andrew, for you on your division, what's your strategy going forward? What's your focus? What do you optimizing? Obviously you're acquiring, you got organic growth and inorganic. What's your vision? What's your plan?

Andrew Krioukov

>> Yeah. Well, I think it comes back to the problems that we're discussing right now, right? It's the attackers are moving faster at bigger scale using AI. Defenders need to be using AI everywhere as a first class tool throughout, right? That's the only way we're going to keep up. And so the strategy really is making it possible to bring in diverse types of data. Databricks is a brilliant platform for this course. So we can do structured, unstructured, you can pull in telemetry logs, the bread and butter of SIM, but you can also pull in data that you couldn't represent in a SIM. Maybe it's code or Jira tickets or Slack messages, all of that context that then you can give to an agent and the agent can find out if I'm say logging in from San Francisco today and then two minutes later I log in from Mailburn. Is that because I'm testing something with NAB or is it because my machine was compromised? Where's the context for that? You can provide that, you've solved a huge problem.

John Furrier

>> Actually, you mentioned context and agents. So I have to ask you, what are you most excited about with Genie agents, what you saw coming out here? Because if you get the context right, get the data right, now you can start deploying agents and agents will do some work. What's your-

Patrick Wright

>> Well, I think about this whole area, whether it be data or AI or both of them together. Our job in technology is to democratize the company's information. So to get as much information in the hands of as many people as we possibly can as soon as possible, whether to manage a security incident or manage a P&L, our job is to make it easy for them to get what they need to run the business better. The interesting thing about what agents can do is in today's world, they turn everyone into superhuman because they allow you to, in essence, delegate tasks, automate tasks, and actually move much faster than you could at human speed. And so I think together it's a really, really exciting time to be a builder as many of us are in IT, it's-

John Furrier

>> Yeah. You're an engineer in a builder. It's a great time, if you're curious. I guess my final question, Patrick, for you is how is that affecting your organization? Because now you're going to have a different kind of work environment. Almost you have an intelligence injected into your company and all the systems. What's your view as a manager and leader?

Patrick Wright

>> I can tell you, it's really hard. What we find is that we create other bottlenecks. And take software development, which everyone's doing right now and what we do is we inject whatever the tool of the day is to write software, Python code and Genie or Java code with Cursor. It doesn't matter. And then all of a sudden the security red teaming, they're the bottleneck or the compliance guy to the bottleneck or the tester. So we're actually having to try and systematically work through the upstream and the downstream bottlenecks so we can actually create a much faster software factory, but it's going to be everywhere. It'll be in security. But when we start really going hard at the rest of the company, whether it be in finance or HR or as bankers, everyone's going to have this conundrum about how do we speed the company up?

John Furrier

>> It's classic innovation. Problem moves to the next bottleneck. Work on that. And then hopefully get to the end and say, "Are we done yet?"

Patrick Wright

>> Yeah. We're never done.

John Furrier

>> We're in a great in time. What's your upside vision of your organization? Looking forward things start to play out, you start to see some automation, you start to see agentic kick in. What's the preferred future look like for you?

Patrick Wright

>> We're really committed to being a simpler, faster bank. And what that means is it's a complicated thing to say, but we believe we have too many products and too many processes and we need to remove the complexity so that we can actually speed up. Now the models will help with that I do believe and the democratization of data and the agents will help with that, but we have to simplify our companies so we can speed up. I do believe the whole planet is speeding up and we must as well.

John Furrier

>> Patrick, give me the final word. What's your vision, preferred future and put a plugin for your group news, value proposition, put a plug in.

Andrew Krioukov

>> So what's the future? I think the future is going to be agentic. It's going to be how do we supercharge the SOC? How do we make them have them be able to answer this giant volume of alerts that they're seeing, do much smarter detections, move away from signature based detections to more risk based and really meet this coming AI threat that we're seeing? So that's really what we're focused on and we're building fast.

John Furrier

>> You got a lot of work to continue to do. There's plenty of things to work on. Every day something new comes out. We saw that with the models. You pointed that out. Thanks for coming on. Really appreciate it.

Patrick Wright

>> Yeah, thank you.

John Furrier

>> I'm John Furrier, you're here live-streaming from the show floor of Databricks' Data and AI Summit. Again, security is a big part of it, governance, the data equation makes it work. And again, the velocity of opportunity and also challenges as a management challenge. It's a people challenge, but AI can bring that superpower and that's what we're hearing here on the floor. We'll be right back with more. Thanks for watching.