Index Engines on Cyber Resiliency | Eric Herzog, Infinidat & Danielle Goode, Index Engines

Clips
News
More from Index Engines on Cyber Resiliency

Eric Herzog

CMO

Infinidat

Danielle Goode Coady

VP of Marketing

Index Engines

Christophe Bertrand

Principal Analyst

SiliconANGLE & theCUBE

Cybercrime, AI and the rise of recovery-first data protection

With a pathological footprint traceable to explosive global data growth, cyberattacks are the new digital pandemic. As a result, AI data protection isn’t just about backups anymore — it’s about resilience, rapid recovery and artificial intelligence-powered defenses.In an era where traditional defense methods struggle to cope with modern cyber threats, what long-term approaches can prudently safeguard enterprises as they innovate for the future?“We’ve come together [with Infinidat Ltd

play_circle_outline Exploring Cybersecurity at the Data Protection and AI Summit: Insights from Danielle Goode on Index Engines and Data Protection Tools

play_circle_outline Transforming Cybersecurity: Index Engines and Infinidat Partnership for Ransomware Recovery and a Recovery-First Mindset

play_circle_outline AI's dual role: enhancing cyber threats and empowering data protection strategies.

play_circle_outline CyberSense Research Lab's role in analyzing and detonate ransomware variants for training AI.

play_circle_outline Portion of discussions around investing in AI technology for ongoing threat analysis.

play_circle_outline Future challenges of AI in data protection and strategies to keep pace with evolving threats.

Info
Transcript

Eric Herzog, Infinidat & Danielle Goode, Index Engines | Data Protection & AI Summit

Eric Herzog, chief marketing officer of Infinidat Ltd., and Danielle Goode Coady, vice president of marketing at Index Engines Inc., join theCUBE’s Christophe Bertrand at the Data Protection & AI Summit to discuss how their companies are collaborating to reimagine cyber resilience. The conversation unpacks the strategic alliance between Infinidat and Index Engines, highlighting their shared commitment to a recovery-first approach.

The dialogue explores how InfiniSafe and VMware integrations are streamlining ransomware detection and recovery. Herzog sha... Read more

Eric Herzog

CMO Infinidat

Danielle Goode Coady

VP of Marketing Index Engines

Christophe Bertrand

Principal Analyst SiliconANGLE & theCUBE

HOST

Eric Herzog, Infinidat & Danielle Goode, Index Engines | Data Protection & AI Summit

>> Hello everyone and welcome back to the Data Protection and AI Summit. My name is Christophe Bertrand, principal analyst with theCUBE Research. This is a very special session. I have two partners in, well, not in crime, actually fighting crime together, cyber crime precisely. We have Danielle Goode from Index Engines and Eric Herzog from Infinidat. So Danielle, tell us about yourself. Tell us what you do and tell us about Index Engines.

>> Yeah, thank you so much. It's nice to be here. So with Index Engines, I'm VP of marketing and it's been a great ride. So far we know that cyber attacks are inevitable and I come from a long history of data protection and knowing that the traditional tools today don't always work and aren't always enough. Partnering with Infinidat on this, to your point, fighting cyber crime has been really, really engaging and special.

>> Thank you. And Eric, I think we know you well, but maybe a quick introduction again for people who may not know you and your legendary shirts.

>> Well, thank you. I'm Eric Herzog. I'm the CMO of Infinidat. Prior to that, I was the CMO of the IBM Storage Division, and prior to that senior VP at EMC. I've done nothing but storage for almost 40 years now. And I'm telling you, storage is cool. I love it.

>> I could not agree more.

>> It turns out that Danielle and I know quite a bit about storage too from the past, so it feels like a family reunion in many ways. So Danielle, I'd like for you to tell us more about this partnership and what Index Engines is doing with Infinidat and why did you come together in this partnership?

>> Yeah, storage is very cool. And the other thing that's also very cool is data integrity. So we've come together with a recovery-first mindset, and it's an interesting solution coming together because it's not only purpose-built for ransomware and recovery, it's built with a purpose. So we're really focused on redefining what cyber recovery is and what cyber resilience can be for organizations on how to re-engage trust from their stakeholders. So working with Eric and the team at Infinidat, we have the InfiniSafe line of products through storage, validating their snapshots and that data integrity that is so important so that when a ransomware does happen, because it's going to happen, it's not a matter of if but when. But when a ransomware attack does happen, the data is clean, validated, and can be recovered without malinfection or reinfection of the entire infrastructure.

>> Absolutely. We're talking 99.99% here. So this is very, very compelling. Eric, let's talk about your storage perspective, maybe also touch upon VMware environments because I think that's a big topic as well.

>> Well, we've been working with Index Engines now for a couple of years, and it was ready to go on snapshots, volumes, databases, files, but it didn't yet work in VMware environments. And despite the travails of what's gone on with VMware in the last couple of years, they still are ubiquitous. And our focus is the Global Fortune 500. So that's who we sell to. 28% of the Fortune 50 buy from Infinidat. So we are already working with Index Engines. We talked to them about here's what we think we need for VMware. We've been very tight in the VMware community. We're now also tight, by the way in the container community, but we've had a longstanding relationship and 90% of our customers use VMware. So we talked to the team at Index Engines. Here's what we need. Here's how it works. And so then their development team talked to our guys, got it together, and we announced the product for VMware environments. We've announced it a couple of years ago, but adding VMware environments, we announced roughly a year ago now, and it's been very successful. So we have enjoyed the partnership very well, and Index Engines is an outstanding team to work with and it complements the rest of what our InfiniSafe technology does. There's really six parts to what is InfiniSafe, and we have the one part that we do with them, but then the other five parts that we do. So all this works together, and we really think that CISOs who don't include enterprise storage as part of the comprehensive cybersecurity strategy are opening themselves them up to a wide attack. They've just gone on holiday and they left every window, every door not just unlocked but wide open. And by the way, they post on social media, they're on vacation, and by the way, there's a big giant sign in front of their house. And by the way, on all the highways close to their house, they took out billboards saying, "Steal my stuff. " So when you integrate enterprise cyber storage, resilience and recovery into a comprehensive cybersecurity strategy, you are protecting that valuable data. And as you know well from your past, Christophe, 90% of mission-critical and business critical data in the global Fortune 1000 is sitting on their enterprise storage. You got to protect it, not just worry about the network and the servers and obviously the edge is important, but you got to bring it all together. It's a team sport fighting cyber crime.

>> Exactly. And the reason why you are both here today is because we're going to be talking about the intersection of data protection and AI. That's really the topic for the summit, and it's really two sides of the same coin. So let me explain. First of all, from a market standpoint, I see three major trends sort of converging and really changing how, or morphing how this market is looking and how the technology is evolving. Number one, cyber resilience is a hot topic. Cyber crime is rampant. We've talked about that in the past in other summits. Data management is starting to converge because of compliance requirements and storage, et cetera. And of course, AI and AI is really two aspects that we'll cover today. AI is what I'd like to call AI as a friend and AI as a foe because a lot of these attacks now that we're seeing are powered by AI. And clearly there is a need to be able to in return, in a sense to scale, to be able to handle all those attacks that themselves are being scaled up by AI. So very interesting relations here. And then of course, AI is also a feature set in many ways. It's a capability that you want to build into your solution so that the people using it, the Fortune 500 or 2000, all of those enterprises well have the ability to scale as well because they don't have the ability to necessarily have all the people and the experts. So that's what we're talking about with this partnership. It is really far-reaching. It is about much more than cyber resilience. It's about the ability for you as an organization to build a safe AI infrastructure and leverage AI in doing so to be smart about protecting it. So let's talk about recovery because it's really about being driven by intelligence. Danielle, what are the hot topics you'd like to bring up on the recovery side? Because it's not about backup, it's really about recovery.

>> It is, it starts with protection and it starts with the defenses. So that can't go away. We still need the protection angle of this, but when an attack does happen, how will an organization recover? How will they minimize that impact? And I think that's really where our partnership shines. One of the things that we offer Infinidat is our CyberSense Research Lab. And what we do is we collect over 3000 ransomware variants every single day. We detonate them in our lab, and it's an AI patented process. So while storage is cool, data integrity is cool and most organizations now know that AI is cool, how good is your AI trained is the biggest, biggest thing to ask your vendor. If they're doing AI, how highly trained is it? Because we have a patent on our AI process. And I think that's really important to mention in this conversation because it's a very highly trained AI process. And one of the things for ransomware and recovery is knowing what can be recovered and what cannot. And that's what our AI ML engine and process offers.

>> Right. And because detection really is only the first step when you think about it and the fun part or not so much fun is what happens next when well, maybe you've detected something, action needs to be taken, you need to recover. Well, isn't this where you come in, Eric, with your solution?

>> Well, yeah. We have a whole process that complements.

>> So we for example, can interface with data center- wide cybersecurity packages SIEM and SOAR. So let's say for sake of argument, Microsoft Sentinel sees an attack, it'll automatically ping us. We will then right away take a snapshot. And then with our integration with InfiniSafe Cyber Detection, which we've done with Index Engines, we can then place potential candidates into a fenced forensic environment for recovery, so we can scan those snapshots. Now, obviously you can also use Index Engines and our cyber defense capability, our cyber detection capability, you can use that on a regular basis to scan also, if you will, like an early warning system. Once you found a known good copy, that's where we shine, whether it be in a backup repository or whether it be in primary storage. So for example, we put our money where our mouth is. We're the small guy fighting against the gorillas, right? So we guarantee recovery, SLA in writing to our accounts on primary storage of one minute or less. So in this example, we would go ahead, put it in the fenced forensic environment, use InfiniSafe Cyber Detection, which leverages the Index Engines technology, scan that snapshot. When you get our own good copy, and it could be four petabytes, 10 petabytes, 15 petabytes. We guarantee recovery in one minute or less. We do the same thing on the backup side. We do backup repositories work with Veeam, Commvault, Veritas, IBM Protect, you name it. We work with them and we guarantee recovery in 20 minutes or less. And in fact, in a webinar we do, just to give you real world illustration, and I'm old world, I'm almost 70 years old. So if you can't demo your software live, your software's no good. That's how we do it. So we demo it live. Obviously, it's recorded now, but at the time in that webinar it was live. We recovered four petabytes on an InfiniBox in four seconds. We then on the backup side, we use Commvault this time, but we use Veeam. We used IBM Protect and similar ones. We took a 25. 5 petabyte backup repository and recovered it in 12 minutes. Just no one can do that. So we partner up Index Engines, helps us with the scanning with InfiniSafe Cyber Detection. Then we take that with our capability of doing incredible rapid recovery to get their business up and running again. It's all about the recovery. That's next generation data protection. The old world, as Danielle already pointed out, yeah, that's just backup. Well, that's kind of way old school. I mean that's even older than me now I think about it. And that's pretty old. So you got to make sure you do the modern thing. And that modern thing is rapid recovery, being able to scan the data sets before you recover. Again, the last thing you want to do is get reinfected. That does you no good, waste time and time is money, especially with the global enterprise accounts that we deal with.

>> Right. And the reason why this is important is that we have research at theCUBE Research on cyber resiliency that shows that it takes multiple days. Many respondents have told us it takes multiple days to get back on track with what they have today. And therefore this combination that leverages AI again here as a friend against the AI as a foe, the attack, in combination with this extremely scalable and fast storage-based recovery that changes the game. Instead of days, you have a shot at minutes at scale. As I like to say, everything's fun and game until you add at scale at the end of the sentence. Well, at scale. And that's really the name of the game. We know that there's going to be a lot of data in the future, only more data. That's the only statistic we have on the future. And therefore protecting your domain is going to be absolutely critical. So what we have here also is another best practice that I'd like to maybe point out that AI is empowering here to protect the data infrastructure, which is the fact that you kind of want to run your analysis before the problem happens or try to catch it as quickly as you can and as widely as you can. So we talked about 99. 99% of the actual ransomware packets or attacks being detectable. What type of investment, Danielle, do you make in the AI technology itself to keep analyzing all the new threats that keep coming? How do you do this? Do you have maybe metrics on that?

>> Yeah, that is one of our unique identifiers. And without giving away a lot of the secret sauce, the CyberSense Research Lab is something that should really be talked about a lot more about how we do detonate the ransomware variants in our lab and how we continuously update the AI models to stay ahead of those new threats. And we actually morph the variants that we know that what the cyber criminals are going to do, we stay ahead of those. And there's a lot of conversation around partial encryption, shadow encryption, and then also we offer that self-learning AI and self-healing methodology within the AI lab to make sure that we're staying ahead of it. So there's a massive investment behind the scenes to make sure that our AI is highly trained. And it's a fascinating process when we talk about data protection and AI and cyber resiliency and cybersecurity because it enters into protecting today, but also for the future in that friend versus foe conversation that you've introduced here. What we're ultimately trying to do is make sure customers are protected, make sure organizations are protected from these cyber criminals and keep the business running. So that's the investment that we're making and working with really, really strong partners like Infinidat with InfiniSafe. It really just expands the accessibility.

>> Right. And the other thing is with this combination, one of the best practices is to be able to more continuously test your environment, which is something that is very hard to do unless you have extremely fast storage to be able to do that and very scalable. So it's one thing to detect and very important clearly, it's another to recover, we just talked about that. But what if you never had to recover because you're constantly in recovery mode in a sense? Eric, can you tell us about some best practices you've observed from some of your customers?

>> Sure. So we have really two use cases for InfiniSafe Cyber Detection. First of all, which we've already described, you've had an attack, you put it in fenced forensic environment, which you can create with our technology, and then you scan and then you find a known good copy. But that's ex post facto, right? It's after the fact. So we suggest to our customers that they practice just the way they practice disaster recovery. So what we suggest is that they come up with a scan timeframe, whether they should scan once a week, whether they should scan once every three days. And then what they do is they decide what they want to scan. We only charge for what they do scan. So for sake of argument, if we have a customer with one of our 17 petabyte arrays, and that's 17 petabytes in a single rack and they only want to scan a petabyte, we only charge them for that petabyte of scanning. The rest of an InfiniSafe, by the way, is at absolutely no charge. So we suggest whether it's once a week, once a month, but on a regular basis because then what you have is just the way you have SIEM and SOAR packages in the overall data center, being an early warning system or a security operation center. In this case, you have an early warning system on the storage side. You can then if you find something in Index Engines. And what we do with cyber protection has a great GUI and the capability of sending information the opposite direction. So the way our automated cyber protection works with SIEM and SOAR sending us data, once we detect something, we can send the data the other way and say, "By the way, the storage array 12, array 5, array 3 sees something or doesn't see something. " So that's a real advantage is not just doing it after the fact, but also using it at its own early warning system on the storage site. So those are the two real use cases where we use Index Engines with our InfiniSafe Cyber Detection capabilities.

>> And just to confirm, Eric, this is at scale. I mean, we're talking about petabytes of data potentially not just a laptop here, laptop there. This is real serious enterprise scale.

>> Yeah, I mean, when I talked about the recovery

>> that we did, we recovered four petabytes in four seconds. That could have been six petabytes, it could have been 10. On the data protection side, the traditional backup side, that was a 25. 5 petabyte Commvault repository. Well, guess what? We've done it with Veeam and IBM Protect as well. It all works the same. The idea here is for large enterprises because that's who we serve. Our average customer has over 20 petabytes. We have several customers with over a hundred petabytes just of our storage. And as you know well from the surveys you guys do at theCUBE, it's very common in the enterprise to have two storage vendors. So just us at a hundred petabytes in certain accounts, just imagine they've got storage from someone else as well. So it's really important at scale. As you said, it's hard to do at scale. And again, we guarantee A, both that our snapshots are indeed immutable. As you know well, some of the other storage companies have back doors. We don't. Sometimes that could be unfortunate, but we don't. So we guarantee A, that it's truly immutable, and B, we then guarantee the recovery, RTO, recovery time objective one minute or less on primary storage and 20 minutes or less when it's a data backup repository.

>> Right. And the point here, you could not do this in a sense without this combination of technologies, and that's really the message. Without the AI, this is actually powering or fueling the Index Engines' engine, as the name indicates. You could not be in that posture, in that position, nor alert other parts of the organization. So I think this is very key and very important to again, reaffirm. Danielle, I'm curious about what you think the future looks like from your standpoint with these language models evolving with the evolution of AI itself becoming more pervasive across the infrastructure. Do you think that people are thinking about data protection as a first step, or are they just running around building models and not protecting the infrastructure? Are you going to be able to keep pace and how are you going to be able to keep pace with the constant attacks and really the innovation coming from those cyber attackers? What's your take?

>> It's an interesting conversation. So I think there's a lot of people that are new to AI that are still trying to figure it out. And I think that this summit is a perfect example of why more conversations like this need to be had. And that being said, going back to your last conversation around telemetry and insights, telemetry and insights that you're going to gain from that pre-attack, if you will, or the everyday daily practicing of this is going to be just as important in using AI and ML for data protection or to protect the business. So it doesn't become just a data protection practice, it becomes a protect your business practice. And what we're doing to make sure that we stay ahead of this in the large language models is that self-learning and making sure that our innovation in the CyberSense Research Lab and then with the organization and with Infinidat is just constantly staying ahead of the morphing and making sure that we have the top talent that's needed to make sure that we can protect and recover when needed for these large enterprises. So I mean, I've never seen a better product market fit coming from a marketing person. So it's exciting to be in this industry. It's sad also in that given that friend versus foe, but knowing that we're the good guys on this side of the fence, it's about maintaining business continuity and serving the customer and the community. So it feels good to be doing something in the corporate world and with high technology that we're fighting the cyber crime together.

>> Yes, it's clearly a great partnership. So I think Eric, I'd like to get your take on maybe what you would consider a best practice considering obviously a lot of people are behind, they're behind in detection, they're behind in their ability to recover. What would be a best practice from your standpoint as maybe IT professionals and maybe some security professionals are watching this? And let's also ask the question, are AI professionals really understanding all the stuff that needs to happen behind the scenes for the infrastructure for them to be able to keep doing what they're doing? What's your view and are there best practices that maybe you've observed or you'd like to instill in our viewers?

>> So a couple angles. First of all, as I said earlier, you've got to, at the security teams, the CISO, if you don't have a CISO, it may be the CIO or the CTO who's got security underneath him or her. You've got to make sure that enterprise storage data protection is part of a comprehensive cyber security strategy. Second thing you have to realize that with the ubiquity of AI workloads now, so we talked about AI embedded into cyber detection with our partner Index Engines, but also as you do more and more AI workloads and you automate it more, you're leaving it with less management. So the Oracle guy isn't managing it. The SQL guys aren't looking at it. The Mongo guys aren't looking at it. The guys who's managing your VMware data stores, they're not looking at it anymore. You let AI do all that work, not necessarily on the IT side, but on the application side. So you need to make sure that as you move to AI, you're protecting those workloads. I mean, AI in some instances is supplementing some human, and if that human goes on vacation or sick, what do you do? You make sure you can cover it. So the AI workloads need to be protected. The more and more ubiquitous they get, the more important it is that those workloads get next generation data protection, including the capability of leveraging AI technology such as our partnership with Index Engines and Infinidat with what we call InfiniSafe Cyber Detection of how you're constantly doing it. And the last thing, a ransomware or malware attack or any cyber threat is a disaster. So since most big companies practice for the fire, the flood, the hurricane, the volcano, the earthquake, they should be practicing for malware and ransomware. If they check it once a quarter, a disaster, if they do it once a month, but they should just be part of the checklist. Okay, great. We tested in case there's a fire or some other natural disaster. Now let's figure out, we've had a cyber attack and walk through all the phases to recover.

>> And I think you forgot geopolitical problems because guess where a lot of the attacks are coming from and where they might be coming from even more in the next few weeks and months as we know, and other dangers held there. One final question, a bonus question for both of you. Now we talked about AI and the AI powered attacks. What about AI being attacked at its core with prompt injections? Is that something that maybe at Index Engines you guys are thinking about or working on already without divulging anything too secret? What's your take on this?

>> Absolutely. Of course. We're setting the standard or we're trying to set the standard in cyber resilience, and it's definitely on the roadmap.

>> Excellent. I'm sure we'll talk more about that. And Eric, what's your view on those prompt injections and what's the risk from your standpoint? Is that recoverable?

>> Well, again, AI workloads are now complementing humans, not replace them, complementing them. So again, you have to make sure that AI is doing the right job. If an employee is sick, they can't come to work, you got to get the right person to fill in. So anytime the LLM or the SLM or anything in that AI food chain is compromised, then all you did is put someone who doesn't know how to do accounting in accounting. That's what you just did. So you can't do that at the enterprise level. You've got to make sure that whatever you're using from all of the software around the AI workload is safe. And right now, if they are injecting, guess what? The AI software, which is doing other things in software is no longer safe. So you've got to make sure you cover that as well.

>> And you're right, in many ways, it's like any other workload. It cannot be an afterthought. Data protection and cyber resilience and really data compliance and management has a very natural consequence. All of these have to be built in from the design point. So that's why this partnership is so important. That's why we're very pleased to have both of you here at the summit and we'll talk more about each of your solutions individually in the next few sessions. Danielle, thank you so much for joining us.

>> Thank you both so much. I appreciate it.

>> Eric, a pleasure again.

>> Thank you. Love being on theCUBE. We love theCUBE.

>> And thank you to our viewers for joining this session, the Data Protection and AI Summit. My name is Christophe Bertrand, principal analyst at theCUBE Research. Thank you for your time and stay tuned. There's more coming.