Name: Andrew Wheeler, HPE
Uploaded: 2026-09-29T16:00:00.000Z
Duration: 29 min 29 s

More from Sovereign AI: From Strategy to Reality

Andrew Wheeler

HPE Fellow & Director of Hewlett Packard Labs

HPE

31:57

Info
Transcript

Andrew Wheeler, HPE

Andrew Wheeler

HPE Fellow & Director of Hewlett Packard Labs HPE

In this interview from Sovereign AI: From Strategy to Reality 2026, Andrew Wheeler, HPE Fellow, senior vice president and director of HPE Labs at Hewlett Packard Enterprise, joins theCUBE Research's Dave Vellante to discuss why sovereignty has become the newest boardroom priority alongside AI and quantum computing. Wheeler explains how security has always been embedded in HPE's design lifecycle, extended through capabilities such as Juniper's firewall technology and HPE Zerto's backup and recovery services. He details how agentic AI is expanding the attack su... Read more

Andrew Wheeler, HPE

(INTRO)

Dave Vellante

>> Hello, I'm Dave Vellante with theCUBE Research, and I'm here with Andrew Wheeler, who's HPE Deputy CTO and Director of HPE Labs. Andrew, welcome. Good to have you on.

>> Yeah, great, Dave. Great to be here.

Dave Vellante

>> You have a pretty unique background and position. Obviously, you're talking to a lot of leaders, high levels of government and industry. They got a lot on their minds these days. They got AI, agentic disruption. They're worried about misuse. What are some of the top concerns that you're hearing?

>> Yeah, no, you're spot on there. In fact, even with most of my customer engagements, given my, like you said, unique role in the company, guaranteed I get asked two questions every time, something about AI and then something around quantum. But now I would say the latest one coming in the conversation is around sovereignty. So it's some combination of those three guaranteed to come up in every external conversation that I have.

Dave Vellante

>> And we're going to get into the sovereignty, but I want to ask you about security because the misuse moment changed sort of the CISO's posture, right? It was, hey, this AI thing, we got to worry about it. We got to put it on our roadmap. They might have sent out some of their ninjas to go research it. Then misuse happens and all of a sudden it becomes a boardroom issue. Not that security wasn't beforehand, but it became an issue of, hey, we have to remediate immediately. We have to spend money in that category and call our top vendors. But when I think of security companies, there are literally hundreds, if not thousands. But HPE typically is not thought of as quote unquote security vendor. So how should we think about HPE in a security context and how are you positioning your capabilities there?

>> Yeah, well, to some degree, I would agree with that, with kind of that perspective or assessment. But look, security has always been part of the HPE, you know, our design priority and what we really, you know, focus on and are quite proud of. And that goes into a lot of things that we do internally that a lot of times customers the outside world never really sees everything from kind of this secure design lifecycle that we have, the mandatory security training we do for all of our engineering. And so a lot of what we do comes out within, you know, features within the infrastructure itself. So that's probably what most people would kind of associate us with. But it's also worth mentioning, especially given the latest acquisition of Juniper, you know, that's also really strengthened our product offerings. So, whether it's through the SRX firewall capability that comes through there or some of the zero trust services we have in our security domain and portfolio. But it extends beyond that. If I look at our HPE Zerto and how we deliver protection, backup and recovery, working with our storage system. So we've got kind of this mix of product capability directly targeted at the security domain. But a lot of it is certainly embedded within the infrastructure that we provide across servers, networking and storage itself.

Dave Vellante

>> That's interesting. I'm just thinking you've got kind of the perimeter covered. You got now the network piece with Juniper. Of course, HPE always had networking. Juniper just sort of supercharges that with really an AI context. And then of course, Zerto, you mentioned Zerto, your recovery.

>> Yeah.

Dave Vellante

>> How, and maybe we'll get into this later, but when you think of infrastructure, you're kind of moving already at machine speed. So much of security, pre-generative AI was humans sort of remediating things or at least protecting. And now everything's happening at machine speed. You guys from an infrastructure standpoint, are already operating at machine speed, but I'm interested in how sort of AI has changed your thinking and your customers' thinking around how you defend.

>> Yeah, you know, it's interesting, you know, if I go back, you know, even a year or two ago, right? A lot of those conversations, you know, we talked about, you know, at the start of the call here was around, AI adoption, everyone really trying to accelerate AI adoption. Well, okay, mission accomplished. And so what we see with this is really an expansion of both the exposure and the attack surfaces now that we've got, you know, even these models get more and more sophisticated over time. So there's an element of, well, how are we harnessing and using that, you know, ourselves to increase, you know, production capability, efficiency. But now understanding, you know, this rise of agentic AI and how that's expanding the threat landscape, what does that mean for our developers, our development life cycles? And so now we're having to, you know, build even more of that into our tooling, just understanding the rate at which vulnerabilities can be found and exploited. But, you know, our ability to shorten that duration from vulnerability to exposure means now that we've got to kind of retool how we do things internally.

Dave Vellante

>> Thank you. You mentioned quantum earlier, and it's interesting because on the one hand, the customers that I talk to, they're trying to figure out AI and get that right. And where's the ROI and where's the monetization and what about security? But not too long ago, quantum looked like it was a long ways off. But as we know, adversaries are exfiltrating encrypted data, hoping to decrypt down the road when quantum computing becomes commercially available. So all of a sudden, post-quantum cryptography is like a here and now current concern. Can you explain PQC and why it's such a challenge? It's a challenge that CISOs, Chief Information Security Officers need to address today and now?

>> Yeah, yeah. Great, great question. And you're absolutely right. So PQC stands for post-quantum cryptography. And we look at it as an emerging cybersecurity threat that is based on what we see as the rapid progress of developing what we call a cryptographically relevant quantum computer or quantum computing. So, at a high level, a lot of the cryptographic algorithms that we use to protect data at rest or in transit, you know, protect things like digital certificates, some, not all of those, but some of those algorithms are potentially exposed to the power of a quantum computer, particularly those algorithms that really rely on prime factors, okay? Because that's something, at least in theory and concept, that a quantum computer is really good at. So for PQC then, that conversation becomes, well, okay, what's your readiness? What are you doing to safeguard against the advancement of quantum computing? And so for HPE as a company, like most of these topics, we have to take two perspectives on that. First of all, HPE is a large enterprise company ourselves. So we need to be doing things internally that equip us and make sure we're ready for that era. And then on the customer side of this, well, we have to make sure that our products now are also ready for that timeline. So we're working. This is again one of the benefits of that unique role I play in the company is I help develop points of view or, you know, maybe the team develops IP that are what we would consider beyond the horizon. Quantum started as one of those areas, you know, years ago. And so as we saw this coming, as we saw the advancement, we said, look, as a company, we have to get ready for this. We know there are now initiatives and legislation, frankly, mandates that are coming from the US and Europe alike that are going to mandate, look, if you're going to sell products into us after this date, they need to be quantum-proof. The algorithms for how you secure things have got to— you've got to be moving to these new algorithms that are quantum-proof by a certain timeline. So we had to start doing that inventory as a company. And so we've been on this journey now for a few years. But for the rest of our customer base, this is a frequent topic of conversation when we get together to help, just, hey, do you know this is coming? Here's what you need to be doing to get ready for it. You know, the approach. And we work closely with them on their PQC readiness.

Dave Vellante

>> It was like a Y2K moment all over again. Exactly. So what should people do about it? What customers— you mentioned you've got experience internally. So does it start with just understanding what's encrypted and then determining what the risk level is and then re-encrypting those assets?

>> Yeah, no, you're going the right direction. It definitely starts with an inventory just to understand, look, what is in your enterprise? That relies on understanding, again, whether it's code signing, whether it's your digital certificates, anything that requires a level of authentication. First of all, it's getting an inventory and understanding, well, what do you rely on today? And if you're procuring something, understanding those products you're bringing in-house, okay, how do they work? Across these elements. And so you work with both, you know, in-house and what you do as well as what you're procuring. And you just ask that question, you know, do an inventory of where things stand today, understand what, you know, especially from a regulatory standpoint, what guidelines are you under so that then you can put a timeframe together. And that's one of the services we offer as a company through our Advisory and Professional Services to work closely with our customer base on that exact approach.

Dave Vellante

>> Okay. So HPE and/or its partners have tooling and services to help customers do that prioritization and then go through that cycle. Okay. PQC isn't the only major challenge, of course, that CISOs have to worry about. We talked about SBOMs. I know you guys were part of the whole Glasswing initiative. And that really changed the game when it came to things like posture management, obviously vulnerability assessment, patching itself. Organizations are rethinking how they patch. It's almost, you remember the patch window? It used to be Patch Tuesday meant Hack Wednesday. You had a 24-hour window. Now you just, it's like constantly having to update, but there is no more window? Cyber defense has completely changed. So take us through your role there in Glasswing, and again, your thinking on post-SBOM activities.

>> Yeah, really a lot to unpack here, for sure. we've, through our participation in Project Glasswing and being part of that initial evaluation, look, we have a really deep understanding of the implications And we've taken a number of steps to basically shore up our own internal design lifecycle, how we do things. And because it's— I think part of what it's taught us here is, you just don't have the luxury now of discovering some vulnerability, like you say, Okay, putting a patch together, maybe rolling that patch out in 30 days or the windows now are so short. And I say this all the time with AI, look, it's the genie's not going back in the bottle. So rest assured for everything good that AI is bringing us and how we're using it for our own levels of efficiency, you know, bringing new ideas to market faster, all that great stuff. Well, look, we know the threat actors see it as a tool as well. So of course they're going to exploit it and try to get ahead of the curve to the point where you see examples of this in the news cycle where even as a vulnerability gets theorized, okay, or maybe in the open source community, something gets put out there, hey, this was discovered. Their ability to take that little bit of information and then go exploit it before patches can actually take hold. That is a big problem. So, in a lot of ways we're leaning on our experience delivering, I'm old enough, I've worked in groups. We call ourselves, mission critical, right? We worked in an area that was all about mission critical computing. Well, everything is mission critical now, whether it's the computing, the storage, the networking. But some of the techniques that were developed, years ago, talking about, live migration or, live upgrades, right? You know, that's where, putting that into deployment is critically important so that as things are identified, as things are fixed, you don't have these long, long windows that are available to be exploited that we can quickly work, within our customer base to get those patches deployed.

Dave Vellante

>> You mentioned earlier sovereignty as a topic that has come up a lot. I think a lot of people— frankly, there's a lot of misconceptions about sovereignty. People think it's sort of only something that's outside of the United States, that's territorial, like where does my data reside? But there's much, much more to sovereignty beyond territory. You got legal issues, you have operational issues, you got a tech stack itself. How open is it? How much choice and optionality do I have? Am I going to get locked in? And of course there's financial sovereignty. If I blow through my annual token budget in one quarter, that's an anti-sovereign pattern. So what's your perspective on sovereignty and how is HPE helping its customers with those challenges?

>> Yeah, just like the last thing we just talked about with, AI's impact on security, I would say, this is another area where AI has really, turned up the heat, as it relates to sovereignty. So it's really, kind of burst on the scene as organizations and governments, really start to grapple with or understand the strategic implications of local autonomy and control of critical workloads such as AI. I think of it a little bit as this sovereignty as being really a natural extension or evolution of a lot of the data privacy regulations that have been kind of rolling through various government bodies worldwide the last few years. I think the last stat I saw on this, something like over 170 countries worldwide have enacted some national data protection or privacy framework. So now AI is just really adding kind of, more fuel to that. And, we're seeing things like the EU Cyber Resilience Act and, okay, well, what does that mean? You know, that has huge implications for, for tech companies. And, for companies doing business within, in this case, the European Union. But yeah, so it's like I said, AI is really just adding kind of more and more fuel to that fire. And I don't think it's slowing down anytime soon.

Dave Vellante

>> Yeah, I think you're right. It is a natural evolution of some of the governance and regulatory and compliance things that went into effect now a decade ago. But this next topic that I want to talk about has really raised the stakes, and that's agentic and agentic security. There's using AI to defend, and then there's you've got to secure agents, as we saw with the OpenAI Hugging Face incident, that it doesn't even have to be a malicious intent. you saw in that particular case, the agents, they were just trying to pass a test. And of course their adversaries are using AI at scale to be much more effective with phishing and other things. What do folks need to know about agentic security and the risks around that?

>> Yeah, look, I think the first one is, there's just— there's no one single answer here. So I think agentic security is it takes something that we call defense in depth. So that means with the security foundation, you need security foundation levels at every level. So it's going to take a range of controls. It's going to take visibility, alerting, response, right, to ensure the safe operation of autonomous agents. So that means everything from our perspective, that's everything from, again, the servers and the storage and the networking to the management and that's all working together to ensure you've got the right visibility and control. So I know we've got some announcements that we're going to be making over the next several weeks that showcase this idea of defense in depth. So yeah, stay tuned for that.

Dave Vellante

>> Well, it sounds like a lot of it is just tried and true security practices. It's just happening now at machine speeds. you mentioned services before. You can't go out and buy sovereignty. Sovereignty is not a SKU. It's something that you have to— you're in control. You have to architect it. And that's where I think services can provide some good guidance and fill some gaps. So we've talked about some of the security environment and sovereignty. I ask you to put your research hat on, sort of the other part of your role, break out your binoculars or maybe even the telescope. What's coming in the next several years?

>> Yeah, let's see. Well, since we're on quantum, there's at least one more element of quantum that I see coming or that we're working on. So when we talk about quantum, it's typically quantum computing we're talking about. But there's actually two other branches of quantum. One is quantum networking and another is quantum sensing. So for us, right, networking being very near and dear to our hearts, obviously a core part of what we do. One of the things that we're looking at with respect to quantum networking is something called quantum key distribution. So basically this is looking at using quantum properties to securely distribute encryption keys between parties. So ultimately that allows us to enable very highly secure communications. Again, not settled science on this one. So we still have the community's got a lot of research and work to do in terms of how do we operationalize this, how does it compare to alternative approaches. But certainly one of the things, as we look to extend kind of this concept of zero trust networking, quantum key distribution very well could play a key role there. So that's kind of one item. The other one I'm also very excited about, and it's this notion of confidential computing for AI. So when we talk about confidential computing today, we talk about, well, look, you can secure data at rest, And industry, you know, HPE solutions, very strong on that. We just talked about the threat of quantum and how if I'm going to secure data at rest, well, it better be with the right algorithms. Okay. But there's protecting data at rest. Well, where else do I need to protect data? I need to protect data while it's in transit. So if I'm going from one server to the next, whether I'm going from a cloud environment to an on-prem environment. or all of the combinations of that, you want to make sure that some threat actor can't get in the middle and get your data. So again, we have very good secure protocols that can do that today. Also want to underscore the importance of making sure those are quantum safe. But kind of the last domain is, well, how do we protect data as it's actually being operated on, whether that's in a CPU, a GPU, or some other accelerator. So there's kind of this area we're working on, other members of the industry and the academic community are working on, which is now how do we secure compute? How do we ensure, especially for running like an AI model, AI inferencing, How do we ensure that both the model is protected, my data that goes into that model is protected? So then once I add it all up, I have a very secure story for all of my data, whether it's at rest, in transit, or being operated upon at runtime.

Dave Vellante

>> A couple of interesting points just to follow up on that. When the AI moment happened, networking obviously became really important and it was sort of the next bottleneck. And that led to sort of security challenges. In a similar way, you mentioned quantum networking and quantum, you know, some security aspects with key distribution. Do you think quantum computing will have a ChatGPT-like moment? I guess the answer is yes, but are we— is it sort of near-term, mid-term, or long-term?

>> Yeah, there's always a lot of talk about Quantum Supremacy, which essentially is a version of how to answer your question. Are you going to have that AI-like moment? And yeah, look, I think eventually we will. What form does it actually take? And are we all just going to kind of wake up overnight and it happened and it hits the news cycle? I mean, it could very well happen like that. But if you look at whether it's the, you know, investment levels happening worldwide, you look at the academic community, you look at the startup community, you look at everyone that's really trying to achieve that moment of quantum supremacy, which for us means that quantum solution can solve a meaningful business problem or scientific problem in a way that we could not do otherwise on a key metric, whether that's time to solution or maybe there's a power profile or just realizing, you know, getting to a solution at all there's a real— you know, look, there will be, I think, essentially that moment. Now, will it happen in the security domain? Will it happen in healthcare? Will it happen in material science? Everyone's kind of placing their bet where they think it'll happen first. So I probably won't reveal my card just yet on that one. But yeah, I think eventually we will see that breakthrough.

Dave Vellante

>> And it ties into sovereignty, don't you think, Andrew? Organizations and governments are trying to— AI has catalyzed this sovereignty trend. Quantum, when it hits, it's going to be that sovereignty discussion is going to go up even a higher level.

>> You're absolutely right. And it's for a lot of the same reasons I think the sovereignty topic has exploded around AI. As a nation, you don't want to be left in a situation where you have no answer. Or you have, first of all, you want to make sure you're properly defended against anything that quantum could do from a threat standpoint. But then also as a capability you want to make sure that you're equipped and your country essentially is poised to take advantage of the benefits that come with quantum as well. So it's a very natural, I think, evolution to the discussion and the news cycle going from AI to quantum in terms of that sovereignty discussion.

Dave Vellante

>> Yeah, and it's not just governments, it's organizations as well. And it's— people, I think, need to understand sovereignty is not binary. It's a spectrum. It's a matter of how much risk you're willing to take and taking that risk consciously and having resiliency built into your business. Again, consciously, you are in control of your own sovereignty. Nobody can confer sovereignty to you.

>> That's right. All right.

Dave Vellante

>> Let's summarize, Andrew. We have a big month coming up. How would you characterize what your customers specifically and maybe markets generally can expect in the coming months?

>> Yeah, well, I think, look, first of all, I think it's great to have a month of awareness around cybersecurity. And I think for our customers and the market overall, first of all, just, you know, again, be tuned in to those challenges. And then, you know, for us as a company, we want to showcase some of the solutions that are out there for the emerging type of threats that we've talked about here today, whether that's post-quantum computing, everything around AI-powered attacks, agentic security. And so, yeah, we have, you know, a number of announcements that are coming out. We have a number of assets that we can also equip people with a number of white papers around all the topics we've touched on today. So first and foremost, I think having just that time of awareness around this, but then also just knowing that like we talked about security being a key element of this digital sovereignty, And again, organizations needing to put together a long-term strategy that's anchored by a very strong foundation in security. So if you take away nothing else, get going on that journey. Make sure you've got a strategy around that. And like I said, we're going to be making a number of announcements here through October that are going to keep stacking more on top of this. But No, I really, really appreciate you hosting the discussion today.

Dave Vellante

>> Well, you have a front row seat to all this, Andrew Wheeler. So thank you so much for spending some time with us. Really appreciate it.

>> No, thank you.

Dave Vellante

>> All right. And thank you for watching. This is Dave Vellante for theCUBE Research, and we'll see you next time.