Black Hat USA 2024 | Bruno Kurtic | Bedrock

theCUBE.net

Clips
More from Black Hat USA 2024

Bruno Kurtic

Co-founder & CEO

Bedrock Data

play_circle_outline Bedrock Security's focus on data protection and understanding data for security efforts

play_circle_outline Challenges in the security industry with product sprawl and data governance

play_circle_outline Exploring AI Evolution: Advancements in Generative Data Analysis and Security for Intelligent Applications

play_circle_outline Bedrock Security's solution for data discovery, classification, and data security

Info
Transcript

Bruno Kurtic | Bedrock

Bruno Kurtic

Co-founder & CEO Bedrock Data

TheCUBE is covering Black Hat in Las Vegas with CEO of Bedrock Security, Bruno Kurtic. Bedrock Security focuses on putting data at the center of security efforts. The growth of data requires enterprises to compete and differentiate using their data securely with AI reasoning. Bedrock's approach involves discovering and understanding data to prioritize protecting sensitive data. The security category has 13 categories with a shift towards centralization with data lakes. Data models are evolving towards separating data from databases for intelligent application... Read more

explore Keep Exploring

What was the key catalyst for Bedrock Security and how does it fit into some of the narratives we're seeing today? add

What are some observations about the current state of information security and the lack of consolidation in the industry? add

What is the impact of increasing reliance on data in enterprises and how can new technologies like generative AI be securely utilized in this context? add

What core problem is the company solving and what are their expectations for the venture's trajectory? add

bolt Powered by CUBE AI

Bruno Kurtic | Bedrock

search

>> Hello. Welcome back to theCUBE coverage here at Black Hat in Las Vegas. This is theCUBE's coverage. We're in our filming CUBE studio suite we call the luxury box of content. I'm John Furrier, host of theCUBE. We're here with CUBE alumni, Bruno Kurtic, who's the co-founder and CEO of Bedrock Security, former with Sumo Logic. I think you've been on at least 20 times, Bruno. In fact, 2013, our first AWS re:Invent, we were on, you were on with Sumo Logic. Great to see you. Thanks for coming on.

Bruno Kurtic

>> Thank you. It's great to be here again.

>> I know you just came off pneumonia and a cold, so we'll take it lightweight here, but I really want to get into it. You've seen many ways of innovation. Multi-startup entrepreneur. You've seen opportunities. You've seized them. You built great value in your ventures. Sumo Logic was legendary. Now, Bedrock. The market's different. As an, again, seasoned entrepreneur, as you look at the opportunity out there, what did you see? What was Bedrock about? What was the key catalyst for Bedrock Security and how's that fit into some of the narratives we're seeing today?

Bruno Kurtic

>> Ah, great question. What I saw is the fact that the whole purpose of security efforts in an enterprise are really, they all exist to protect data, but there was really no way to put data at the center of security efforts. Most of our efforts, including at Sumo Logic, were to try to secure users, networks, infrastructure servers, but it was all in the hope to secure data. And there was multiple different problems that were standing in the way of actually securing data and one was being able to cope with the scale of that data and the other one was understanding what's in the data, so you know what to protect.

>> I did a little survey of just a spot survey in the security category, InfoSec or information security. There's 13 categories these days. You got managed service, endpoint protection and all different approaches, but there's so much product sprawl. I did a tweetstorm yesterday and all this consolidating vendor. No one's consolidating. It's gotten worse, mainly because of the threats. So you got all these categories. They're legacy, so it seems that a lot of weird things are happening. Not weird things, but industry things. We're back to silos, but in a way to protect centralization with data lakes. So the data model seems to be evolving and modernizing towards back to the old way, but different and I want to get your thoughts on this, because in all of our generative AI coverage, it comes down to intelligence. Apps need data. They need it secured, they need it real time, low latency and it's got to be relevant, which means how data is handled. And that's why there's all this discussion around open table formats. Cataloging is separated from the database, so data's changing. What's your reaction to that? How do you see that engine? Because performance is great, getting better with compute and silicon. Now this next layer is impacted. What is your vision and what's your reaction to that?

Bruno Kurtic

>> So data is absolutely changing and it hasn't stopped, hasn't slowed down. We know from the last decade, that digital transformation has really pushed the growth of data and the creation of heterogeneity of that data. So the challenge, I think my view on this is that at a fundamental level, enterprises must use their data to differentiate, must use their data to compete. Data is involved in building new products, new services, in optimizing the enterprise and serving customers better. All of these things are absolutely reliant on data. And now that we are adding new technologies on top of these data lakes and data layers like generative AI, we're starting to really think about how do we securely and use this data in a sanctioned way rather than just essentially let anybody touch this data, which then creates exposure vectors, it creates all kinds of potential challenges out in the future? And so right now, we have the two side of the coin of generative AI. One is that it is a tool that can help us understand data much better than we ever could, because that's what generative AI is all about. And number two, it is also the thing that scares us a lot about how we use that data, so it's on both side of that coin.

>> Yeah. I think we might've talked about this on theCUBE a few times, because I've been always talking about data as code and we saw this coming a decade ago, but not to this level of positive disruption. I see the market as a disruptive enabler, but this idea, dealing with data, you guys have this AI reasoning vision. I don't want to get into that, but thinking about data not just as a discrete element, but as an active almost code is becoming more of the same. In fact, one of the trends we're seeing is that the best AI apps are closer to the silicon, as close as possible, so there's almost a shift back to kernel developing. Kernel is a broad term, but system programming, low-level code, it seems to be where all the best apps are doing the best performance, because there's a lot of inference, reinforced learning. And reasoning comes into that, so the reason you have to understand the data, the context. Can you share your vision of Bedrock Security, how you guys are looking at that? Because this seems to be looking at data differently than the old school ways of the database. Yeah. Like a database. Okay. I have a database and I query it. Now generative's the new category, so how do you see this?

Bruno Kurtic

>> So I think that there's a couple of challenges there. One, before you start reasoning about the data, you first have to know where is your data, because you can't govern or secure or protect the thing that you cannot see, so there are really two fundamental principles that Bedrock takes to heart. First one is we do discovery at scale, meaning we essentially let our system crawl through your environment in a sanctioned way without moving any data to find all nooks and crannies of where your data lives. And this doesn't just mean in your database. It means in your object stores, file systems, in your unmanaged databases, in your document repositories. Everywhere where data might live. And once you know where the data is, now you have to figure out what is in that data, because there's enough data out there to make up a lifetime of anybody's work. And so the question is how do you prioritize your efforts on making sure that you are focusing everything you do on data that's sensitive, that's important, that has PII, that's governed, that's regulated? And so the AI reasoning engine that we built, the whole purpose of that is to apply a generative AI approach or actually a derivative of that approach that is used for us to skip over and not have to use rules and tune all of that, but let the brains of the large language models actually go and figure out what's in this data, so we can tell the operators what they need to focus on.

>> Remember the early days of that when XML was forming, as well as about these framework data, about data. Almost we're living in that time now where you have to have data about the data, number one, and two, do you store it everywhere? We still have a distributed computing paradigm developing and that's the beautiful thing, so cloud operations on public cloud or on-prem or Edge, it's all cloud native, but it's distributed computing theory. So okay, if you believe that, then you say, "Okay. What's the data strategy for deploying that?" Is it hosted data everywhere? Is it data lakes? How do you see that?

Bruno Kurtic

>> So I think long gone are the days of security teams and data teams controlling what's going to happen to the data ahead of time. Developers push code to production every day, many times a day. Data as code, as you said, we're generating data at a tremendous velocity. We're copying that data for testing development, product development, for model training, for all these things. So my perspective on this is that you let the data be where the data's going to be, but you're taking a proactive approach to the posture management of the data. So if you have a system that can always find all of your data and can always tell you what's in the data, now you can let the people who are actually generating, using it actually do what they need with that data, so that the business can move quickly. But you can be proactive about managing exposure, managing access, managing entitlements, managing all these things that matter to your business. So rather than trying to prevent things from happening, you make sure that you create processes around the data, so that it can be safe.

>> So that's an enablement strategy. Right. I heard you correctly. Okay. Great. That sounds a lot like security back 10 years ago. Build security in from day one. How many times have we heard that? So are you saying the same thing? Data security is build data governance and catalog management upfront and let the data fly.

Bruno Kurtic

>> Well, you let the data fly, but what you're doing continuously as the data flies, you're constantly watching where it lands. You're performing analysis of the data such that you know, you said earlier, data about data. We call this metadata. We're collecting metadata about data, we're classifying the data, we're determining what's the sensitivity level, what's in the data, what type of documents they are. These financial documents, are these IP documents and things like that? And we persist that and we use that information now, this meta level information to govern what happens on the security layer. So we're not actually telling people, "Go build security everywhere." We're actually saying let the data land where it needs. We will make sure we tell you where it is and we'll tell you what it is, so you know what to do with it.

>> Bruno, let me get your thoughts on this, because one of the things we were speculating with theCUBE research, we just did Supercloud 7 last week, obviously, we all saw compute and storage get separated that created a lot of good things. Separating data from the database is now where we're seeing all the action.

Bruno Kurtic

>> Correct.

>> That's why all the discussions around open table formats and cataloging and governance, because cataloging is where the action is, not the database, because you can have semi-structured, unstructured and structured data all playing in these data lakes. And then finally, if you do that right, then you can enable the intelligent applications, which will need free access to all the data, wherever it is and let the application get the data, call in, almost like a procedure call. Get the data. That's the paradigm flip. That didn't really exist years ago. Do you believe that to be the case, that this is now a real significant trend that separating the data from the database and then allowing that, I won't say federated catalog, but a smart catalog? Because if you can do the governance upfront, then you can have observability on data and that's what, I think, you're saying. Am I getting it right?

Bruno Kurtic

>> It is. You're getting it exactly right. That's the fundamental premise that we believe in Bedrock. The data catalog largely has failed the enterprise. Data catalogs are typically governed. They're static, they don't get managed, they're not up-to-date, they're typically siloed to the specific data sources. And we are now operating in a world where we can actually construct a live up-to-date data catalog at scale across all data systems, because we have now the ability to find all the data, to interrogate all the data and actually persist that data catalog or meta information about the data and then serve it to everybody who needs that data downstream.

>> It's interesting. I love chatting with you, because we're riffing, but also, you're getting a lot of knowledge out there. This reminds me of the old networking days when you had policy was a big deal. In a way, the policy's built in and the generative aspect of the data is just handled at, I won't say runtime, but run call time. It seems to be the trend. Okay. So if that's the case, I want to get your reaction to this. Our observation with theCUBE research team and some of the things we've been having on the CUBE, conversations on theCUBE is that it seems to be that the people doing the best with generative AI have two common characteristics. One is they have somewhat good handle of their data. Not perfect. No one's perfect, but they're not in the Stone Age, living in the data warehouse only days. And they have end-to-end workloads, end-to-end processes, because they can see everything end-to-end, because they actually have workloads running. Banking apps, stuff pre-generative AI, they seem to be doing the best. What's your reaction to that? Is that something you see? And just to verify it, I did a tweet yesterday. I ended up getting thousands of views that's just a comment to someone else. I said vertical integration and end-to-end workflows is the new developer playbook with open source code for speed. Kernel developers will rise as it's a systems revolution. Your reaction to that tweet and also this idea that we're seeing end-to-end.

Bruno Kurtic

>> Yeah. I do agree that end-to-end workflow and vertical integration allows you to actually have the control of what goes into your generative AI. The challenge with generative AI projects today, there is many, many of them ongoing. Only about 10% of them go into production. And the reason for that is because once you get to that production stage, somebody in the organization says, "Are you sure you can guarantee me what went into the system?" Because once it's in the system, it's a black box. Nobody can tell what's in it and with a clever person on the other side of that system, you can get anything out of the system that you want. So one of the aspects of this that I think we're trying to solve and we see enterprises struggling with are two. One is data bill of materials. What is the data bill of materials? Can you compute and create a data bill of materials for all of your generative AI applications, so you can guarantee that you know what's going in, so you know what's going to come out? That's number one and that's one of the solutions that we deliver. The number two is something we call trust boundaries. And trust boundaries, essentially, back to your mentioned earlier of a policy, a policy basically says like this. Our models will look at your data. They will get trained on your data. They'll understand that certain type of document sensitivity levels are going to be with this category of data and you're going to draw a boundary around it. What we're going to do then is we're going to monitor as data starts moving and sprawls. If we find anything that's similar to this data, that might want to map to this data using generative AI techniques like factorization, embeddings, we will alert you and notify you when anything that's supposed to be within inside the trust boundary is outside of the trust boundary. So those two concepts-

>> Like a recommendation engine.

Bruno Kurtic

>> Exactly. Exactly. And it gives you a live view. Hey, you've got something running out of your pen. Put it back in the pen, because you want to know where your sensitive data goes. It might go to a generative AI project that you don't want it to go to, or you might want it in the bill of materials that goes into it.

>> It's interesting. The instrumentation of data is fascinating. The world's changed. Go back to when you started Sumo Logic. That was a while ago. Okay. The world's changed. What's different now? Because data's in everything. It needs to be instrumented. It has to be freely available. What's different about Bedrock that you're doing now that was not possible even years ago?

Bruno Kurtic

>> That's a great question. At Sumo Logic, when we started Sumo Logic was in 2010. The secular shift of the time was cloud migration. Cloud was becoming a real enterprise technology and it enabled us to disrupt a lot of old school technologies through better architecture, better efficiency and hands-off management of technologies. Right now, we still benefit from cloud migration and majority of the enterprises are still moving to the cloud, but we now have this generative AI secular shift, which enables us to do things we could never do before. We can now use essentially artificial intelligence to reason about the data. What it's really good at, it's really good at looking at data, understanding what it is, summarizing what it is and even generating things that are based on what it knows. And those things enable us to do things that are so much more powerful than before. Before, we had to rely on rules to classify data sets. We had to rely on rules to fire alerts. Now we can actually use AI to both augment those rules, to write those rules and to actually operate within a ruleless environment and essentially determine what is happening without you having to write and maintain rules, which opens up a world of opportunity for us.

>> Like what?

Bruno Kurtic

>> Opens up the ability for us to essentially determine that I have a bunch of sensitive data in here. We have a customer of ours that is in biotech space, which I find a fascinating use case. What they have is they operate on DNA sequencing and they asked us, "We have these DNA sequences that we want to make sure never get used or moved anywhere where they're not sanctioned to be." And we're like, "Okay. How do you do that by regular-"

>> What's sanctioned?

Bruno Kurtic

>> Exactly. How do you do it by regular expression? You can't. What they wanted to know is if anybody copies a section of a DNA sequence and it appears somewhere else in the infrastructure, they want to know about it immediately, because that's a violation of internal rules. We trained our generative AI engine on their sequences and we can take a fragment view of these sequences and we can detect, even if somebody modifies a sequence, that it is coming from the original that needs to be tracked. That was never possible before. This is only possible now, because we have this derivative generative AI approach for it.

>> I share your enthusiasm and I want to get your expert thoughts on this next discussion around neural networks. In fact, you mentioned vector embeds. There is now, I would say, also the new possibility that digitization's going to happen much faster. Okay. So let's just say that Bedrock Security will go the trajectory of Sumo Logic. You guys create this really cool layer of smart data, you understand everything. What's going to happen next is you're going to digitize the data, so it'll be in some sort of neural network form, say math. Not expression or rules, so that's the value, is to be smart about where things are at scale. That's the big thing. What is a neural network? For people out there watching, whether they're a CXO, CISO, CDO, whoever, people who are really trying to think about the foundation for the next 20 years of their business, you're starting to see some digitization even on the currency side. Actually, Bitcoin is getting more traction with government and corporations and you're going to see online digitization. Maybe even media's digitized someday, but things are stored differently. A neural network is not necessarily database and also different fields. How would you explain this wave of neural networking everything?

Bruno Kurtic

>> Yeah. To keep it-

>> Or is that the right word even?

Bruno Kurtic

>> No. It is an interesting concept and try to keep it on a level that our business audience can understand. Neural network is essentially a representation of the way that the human brain... Actually, it's based on some of the visual cortex of how it works. And what it does, it essentially can consume information in such a way where it synthesizes it in a way that using that plus the transformer model, which was the addition to it during the generative AI explosion, enables us to effectively train a brain on a bunch of data and then ask it questions using these similarity models such as vector embedding, cosine similarity and others, that can really quickly associate something in a very high precision way with something that it is similar to and it is relevant to the question.

>> And it's big sets of data too, not-

Bruno Kurtic

>> Huge sets of data, internet size sets of data, so it can essentially enable you to take all of your massive caches of data and you know what it looks like when you try searching for a bit of data in your data repository. What a neural network and the generative AI model will allow you to is not find a bit of data. It will help you find the answers.it'll be able to jump over many steps of what does it take to search for something, read something, interpret it and then come up with the answer. It's going to jump over all of that and give you the answers .

>> I think to your point about generative AI and transformer, it's now awakened I would call a sleeping neural network theory and neural networks have been around since the '80s. I remember when I was in computer science, we talked about neural network. Oh, yeah. Yeah. AI. But now the scale of performance of hardware and silicon, the transformer, gen AI, that is the secular shift that's going to ignite knowledge graphs, neural nets and I think that's going to be a game changer. Obviously, my dog might believe that I'm going to die on that hill. I think it's going to happen, of course, but how it comes back to security is what you were saying earlier around reasoning. So now the next step is reasoning. You got reasoning in your product, so you got to be thinking about things differently with Bedrock Security in the sense that you've got some secret sauce out there that's going to reason. Can you share, as you mentioned, vector embeds? How do you get the reasoning right? Because that's a hard problem.

Bruno Kurtic

>> The reasoning in the use case that we are currently focused on is in the intersection of three things. One is what's in the data? Two is what are the entitlements to that data once you know what's in it? And three is what is the actual activity you're observing on that data? So the intersection of those three is what we call our AI reasoning engine. And the purpose of it is to really try to help our customers understand what is at risk at any point in time within data sets. And what determines something being at risk is is it sensitive? Number one. Is it overprovisioned? Is the access to it over-provisioned? Number two and number three, are people either using it or not using it? If they're not using it, can you restrict usage to it? Can you wind it back down to least privilege and things like that? So that's what our reasoning engine looks like and the way that it comes into play, I'll give you another example from a customer, who's a financial services customer. We were looking at crawling through the data and we were like, "Okay. It looks like you have a bunch of offer letters sitting here in this area in a lower environment that is overprovisioned to people. It says people's PII, financial information, all these things that absolutely should not be there. Did you know it was there?" And the way we reasoned about it is we looked at a bunch of financial documents in their actual ERP repository and recognized the similarity between the offer letters and those documents that were basically able to tell them, "Hey, you've got something really sensitive sitting over here. Did you even know?" That's the reason.

>> And that was available to people?

Bruno Kurtic

>> That's right.

>> Right. So let's talk about Bedrock, because I think this is what everyone wants to know. You guys got some seed funding, 15 million. Greylock, they invested in your other company. Great firm. Tier one. Super set of partners over there. What problem are you solving with the venture and what's your expectation? You got customers. You mentioned you have some customers. What's the status of the company? Sounds like it's been going for a while. You got some customers. What core problem are you solving and what's your expectations for this venture, next trajectory, the next leg of the journey?

Bruno Kurtic

>> Yeah. So the status of the company is we are out of stealth. We have a GA product. We have multiple customers, who are paying customers, who are using us. We have many engagements with new customers, but here's what we're solving. We're solving at the most fundamental level, the two areas that we talked about earlier. We call it the bedrock. The bedrock of every enterprise needs to be can I discover my data, can I classify my data? That is the foundation. On top of that foundation, once you have that foundation, now you can do many things. You can create a catalog. You can create a metadata repository. You can perform data security posture management if you understand the entitlements. You can perform compliance verifications. Am I in compliance with various regulations? You can do IP tracking like some of our biotech customers and others. But also, as importantly, you can also bring the data context to other security efforts. For example, in Sumo Logic, we had a SIM. One of the big problems in SIM is everybody gets too many alerts and can only get through maybe 10% of alerts. Well, what if I could tell you from Bedrock which of your alerts overlap with where sensitive data lives? Could that be the prioritization engine for you to be looking at alerts? Could I tell your CNAP provider that the vulnerabilities they're discovering are related to the data that is sensitive versus data that is not sensitive? Where should they prioritize their work? So in the sort of world where data is growing exponentially and security resources are growing linearly, can I give those security people more direction on what to focus on? .

>> And that's also going to help them very technically. I can also imagine that with that smart cataloging, you can almost in real time with code, spin up a catalog for an app that's secure. Here's your secure data for your whatever use case. That's what you're getting to.

Bruno Kurtic

>> That's right. And everything in Bedrock is exposed through APIs, so we enable our customers to tap into our APIs, essentially bring the data context into every application, into every process that they run.

>> Well, congratulations on the venture. Psyched to have you back on theCUBE. Final question for you is that when I talk to organizations that are progressively pushing the envelope on replatformerizing their enterprise, they're looking at a 20-year horizon. "I need to reset my foundation." A lot of it is either inertia, they can't get it done, because of politics and other stuff that's in the way. Other stuff is just they have too much legacy stuff. They can't unwind what they have and some of the cases, they don't even know who implemented the systems or where the data is, or we have data somewhere, but where's the person? What's the metadata? Are the patches all updated? They have this litany of just problems. So what's your advice, or well, one, are organizations ready for Bedrock and two, how are they thinking about this replatformerization, or is it a little bit further down the road?

Bruno Kurtic

>> Yeah. So it's a great question actually. It's a dual world out there still. We've got a lot of people who are cloud native, but many, many people or companies are cloud. They have a bunch of cloud and a bunch of on-prem. Where the data sprawl is happening and explosion is happening in the cloud, because that's where developers are moving new apps, that's where workloads are, that's where generative AI efforts are. That's where the explosion of data is happening. That's where the sprawl is happening. And then there's all of this legacy stuff that's happening on the enterprise side. Completely different architectures, completely different requirements for technology being deployed. My, basically, guidance to my customers is focus on where your explosion's happening, get a handle of your cloud, get a handle of understanding where your data is, get a handle of operating and collaborating with your development teams, security and developers working together to make sure that that's secure and then we'll walk backwards and solve your legacy stuff.

>> Bruno, great to have you on theCUBE. 11 years ago, you were on for the first time, Sumo Logic. Back in the saddle, at the helm again of a startup. Great. Out of stealth. Congratulations.

Bruno Kurtic

>> Thank you.

>> Look, I'll shake your hand for sure. You're awesome and thanks for all the master class you just laid down. Give a quick plug for Bedrock Security, what you're looking for. Obviously, you're hiring. Give a quick plug.

Bruno Kurtic

>> Basically, we would love to have conversations with enterprises who have large amounts of data, complex data sets, sensitive data sets at hundreds of terabytes of scale and come find us at the booth at Black Hat, or come to our website.

>> Yeah. Even went there. All right. Bruno's here, laying it down again. The hot startups are going to change the categories. We are expecting out of this secular trend, this next big wave, new brands, companies that are going to come out of the woodwork we won't even see yet are coming. A whole nother inflection point's coming. Of course, theCUBE will have it there for another turn around the track. This is theCUBE. I'm John Furrier, your host. Thanks for watching.