Black Hat USA 2026 | Dave Russell, Veeam

Clips
More from Black Hat USA 2026

Dave Russell

Senior Vice President, Head of Strategy, Acting CTO

Veeam Software

play_circle_outline Veeam at Black Hat 2026: Security Resilience Messaging — Prevention, Detection, Withstand, Recovery

play_circle_outline Expanded CISO role: business-focused continuity and minimal viable operations

play_circle_outline Importance of testing and recovery verification versus tabletop exercises

play_circle_outline Balancing AI Adoption and Guardrails with Data Hygiene for Resilience and Safety

play_circle_outline Veeam Data and AI Trust Platform, Securiti AI Acquisition, and Precision Recovery to Known-Good State

Info
Transcript

Dave Russell, Veeam

Dave Russell

Senior Vice President, Head of Strategy, Acting CTO Veeam Software

In this interview from Black Hat 2026, Dave Russell, senior vice president and head of strategy at Veeam Software, joins theCUBE's Krista Case to discuss how cyber resilience is evolving from a prevention-only mindset into a broader business continuity discipline. Russell explains why resilience today means preparing for recovery, not just stopping every attack, given the complexity of modern systems and increasingly sophisticated threat actors. He details how the chief information security officer role has expanded to include board-level conversations about ... Read more

explore Keep Exploring

Why did Veeam decide that Black Hat was the right show for them to attend and to make a major presence? add

What conversations are CISOs having about resilience and minimum viable operations at events like Black Hat, and how do they view the role of vendors (for example, Veeam) in supporting a security‑through‑resilience operating model? add

Why should organizations perform testing and recovery verification (beyond tabletop exercises) to ensure systems are recoverable and resilient? add

How should an enterprise balance implementing guardrails for AI adoption with ensuring data resilience and business continuity so it can recover if AI-related (or other) incidents occur? add

What role does data resilience play in helping organizations withstand attacks or incidents involving AI agents and models, and how can platforms and practices (such as inventorying AI agents and precision recovery) enable fast, secure restoration to a known-good state? add

bolt Powered by CUBE AI

Dave Russell, Veeam

search

(INTRO)

Krista Case

>> Welcome back to theCUBE's live coverage of Black Hat 2026. We're here at the Mandalay Bay in Las Vegas. And one thing that's really interesting at this security show is that we're actually hearing a lot of conversations about resilience. From my perspective, there needs to be sort of this continuum where we have our prevention and detection, but we also have our ability to withstand cyber incidents and recover quickly from them. I'm joined here today by Dave Russell, who's SVP and head of product strategy with Veeam. Dave, thanks for sitting down with theCUBE today.

Dave Russell

>> Yeah, it's good to see you again, Krista.

Krista Case

>> Yeah, it's great to see you as always. So Dave, I understand it's Veeam's first really big push here at Black Hat. You've had some attendance in the past, but you've got, I saw your big splash here outside the Business Hall. So can you talk to why Veeam decided that Black Hat is the right show for Veeam to be at.

Dave Russell

>> Yeah, and you really set it up very nicely in that resilience is much more understood now from a security perspective, and then the definition of what resilience means. Yes. You could say that cyber in the last handful of years has raised some level of awareness. Yes. AI is raising more levels of awareness, but then what does resilience mean? And I think one of the nuances that really led us, even prior to an acquisition of a security company we made, was the fact that resilience from a security perspective doesn't really mean 100 % stop something bad from happening. It means, okay, try to stop everything bad, of course, but if that doesn't work, and there's a good probability at some point, because of the complexity of systems, because of the sophistication of attackers, and in some cases just because of accidents, there are going to be issues that arise, So resilience isn't this sort of mindset of make sure it never goes bad, but what do you do if it does?

Krista Case

>> I agree, Dave. And I think you hit on something really important, which is that it's not so much about preventing. It's about, again, the ability to withstand. So I'm interested in maybe some of the conversations that you've been having with CISOs. We've had actually a few CISO guests on theCUBE today. And again, what we're hearing is that they're increasingly in this role where they're responsible for having conversations with the board to do things like understand minimum viable operations and plan for what will happen if something goes wrong. So I'm curious, what kinds of conversations are you having here at Black Hat and are you getting some questions on, hey, what does Veeam do and how might that fit in with this security through resilience operating model?

Dave Russell

>> Yeah, so from my perspective, the role and expectation of a chief security officer is greatly expanded. it's no longer perimeter security, intrusion detection. None of those things went away, by the way. Their job only got more complex. So the level of detections and systems that you want to put in place to prevent bad actors, 100 % still the same. However, to exactly your point, what the expectation is now, what does it take if something goes badly? What does it take to get the minimal business back up and running? Thinking about things less in terms of technology and specific preventions and more in terms of a business context of what's the criticality of bringing what kinds of systems online, what order, and timeline as well.

Krista Case

>> Absolutely. Absolutely. And what are some of the measurements that you would recommend practitioners think about if they're trying to measure what their resilience is?

Dave Russell

>> Well, it's really hard not to advocate for testing because otherwise you basically have a strategy of hope and expectation. And you don't really know with confidence if you're going to be able to live up to that test or not. And we go so far as to say tabletop exercises, that could be okay, but that's in and of itself probably not enough. It'd be like you and me having a conversation, saying, Krista, do you think you're recoverable? And we talk ourselves into maybe a higher level of availability and resiliency than may actually be the case. So really recovering systems from a proof perspective, we offer recovery verification tools, but now we're uniting that with security technologies as well on both ends of the spectrum so that we can have confidence, assured levels of recovery and resiliency.

Krista Case

>> Yeah, absolutely. And I think we're going to need to like you say, have that planning. And then we're also going to need to have the guardrails in place, especially as we start to adopt AI. so can you, I guess, maybe talk to how you think about balancing sort of, those guardrails so that the enterprise can adopt AI, but then also making sure that you have the resilience capabilities in place in the event that something does go awry?

Dave Russell

>> Yeah, and I'll say something that I hope doesn't sound too provocative, and I don't want to make it sound simplistic, but we like to say that if you have good data hygiene, if you have good, trusted, and reliable data that you have confidence in, and your ability to recover that, that some of the toolset that you deploy, some of the training that you actually put your administrative teams through, those runbooks and those tools can be utilized for when weather events hit, when cyber events hit, or when AI internal events or external attacks could go in a bad direction for you, it's still a business continuity and data resilience conversation. There's some uniqueness, don't get me wrong, but a lot of those same steps, the answer isn't go deploy another thing or yet another specific, unique, one-off, isolated, something that's not part of a combined platform taking a more holistic approach.

Krista Case

>> You mentioned platforms, right? And we've been having a little bit of healthy debate here in theCUBE over the last few days because I do think that as security and IT teams are pressured to respond more quickly to these cyber threats and they're also pressured to move quickly to make sure that they are not inhibiting the enterprise's ability to adopt AI, we might start to see more appetite to sort of consolidate down this overall cybersecurity tool chain. I'd be interested to get your reaction in terms of what degree do you think that might be possible?

Dave Russell

>> Yeah, and if you take a very academic view of what is a platform, you could start to enumerate certain capabilities all the way to the notion of do you have a single unified control plane, one centralized policy engine? Many of those things are aspirational. So whether or not it's truly a platform definition, I think the notion that you're getting at of, do you want to go best of breed or try to reduce the stack? I think overwhelmingly we're hearing from CISOs and even from our partners that resell that they think that collapsing the tool set, trying to get more value out of what you already do have deployed is far more interesting to them than go add yet another thing that needs to be configured, potentially managed, et cetera.

Krista Case

>> Yeah, and I think we're obviously not going to see rip and replace.

Dave Russell

>> That's right.

Krista Case

>> And I think, especially when we think about security, these practitioners are already very inclined to the best of breed, right? That's sort of how they've grown up. So that makes a lot of sense. But Dave, as we walk the show floor, there's all of these startups that are kind of pitching AI native capabilities and they're pitching their ability to kind of solve this whole host of point solutions. And with our guests, I'm trying to get a sense of sort of how do we think about navigating a lot of that noise? From your perspective, what would you recommend a practitioner look for to try to really understand if a technology has some meat on the bone and really is going to start to address some of these problems?

Dave Russell

>> Yeah, it almost pains me to say this because I'm kind of more of an engineer mindset than an MBA or something like that, but I think you have to approach it the other direction from the needs of the business. Like you mentioned, minimum viable business or what is the outcome you're trying to achieve before getting to the implementation, before getting to the product.

Dave Russell

>> Absolutely

Dave Russell

>> then, after deciding on what's really the top outcome we want and do we already have things at our disposal that we can utilize as at least part of the solution, then looking at, okay, where do we fill in those gaps? And in some cases, it could be, all right, it's time to switch vendors, it's time to look at something new. We're very much trying to advocate for, we have the most deployed data resilience solution and the number one market share. So how can we start to infuse more capabilities into that platform? Now we've made a strategic acquisition of Securiti AI, and we're looking also in the other direction of how do we take production level security and governance and be able to apply that to a data resilience context as well, so it's a meeting in the middle versus now go deploy five more tools. nobody has the budget nor the appetite for that.

Krista Case

>> Right, that makes sense. And so you're talking about kind of the AI governance piece of it, and I'm really interested to see sort of how that stack evolves moving forward, especially given that I feel like this market is very dynamic and it's kind of, we're still, we're going to be learning a lot over the next 12 to 18 months about what it takes not only to kind of thwart these actors, but also what it takes to secure and govern AI use within the enterprise. As someone in product, right, how might you think about listening to customer feedback and sort of evolving your capabilities to make sure that you're keeping pace with how these requirements are changing?

Dave Russell

>> Yeah, we try to be very, very market-driven and respond to partners and users. We have a very rich community ecosystem as well where we get feedback and try to listen to service providers, to end users, and now increasingly through board level conversations, CISO level conversations as well. And I think the key becomes don't just build it because you can or because you're interested in it, but does it really go solve a vital problem? And there's no shortage of problems to go solve. But to your point, things are evolving. I feel like even since RSA, I think that was March, was it? not that many months have transpired. But even the messaging on the show floor of hundreds and hundreds of vendors has slightly evolved. So we're all trying to respond and move quickly as our shared understanding evolves as well.

Krista Case

>> Absolutely. There's been a lot of change, like you say, even just over the last five or six months. And I think when we think about data resilience, I think about, again, the Anthropic Mythos and the story that that's created in the community. We've seen the Hugging Face incident that happened just a couple weeks ago. So how do you think about maybe the role that data resilience plays in terms of, helping organizations to make sure that they're able to withstand some of these attacks?

Dave Russell

>> Yeah, so now Veeam has expanded, we call it a Data & AI Trust Platform or a model and approach, where on the front end, we're looking to inventory and understand what AI agents may be running, and to be able to understand and visualize what they have access to and what identities, whether they're human or agentic, have access to certain activities or information. But as you say, if something does go wrong, what do you do? Well, what you do is what you've always done, which is recover quickly to a known good state. And what we're doing is applying more intelligence into that precision level recovery to where we can take the smallest amount of data, as accurately defined as we can make it, now guided and informed by a security view on the production environment. So being able to marry exactly what restore point and what subset of data is required right now. It's a bit of a variant on minimum viable business. It's trying to look at what data do you need, How quickly and accurately can you get back to where you want to be?

Krista Case

>> Yeah, absolutely. And that requires a lot of preparation, you were mentioning earlier in the conversation. Maybe you could elaborate a little bit on what really is that going to look like moving forward in terms of making sure that we're prepared to be able to prove that we could recover from something, for example, a Hugging Face incident.

Dave Russell

>> Yeah, in part, it's do you have a tested recovery plan? So some of these things sound very basic, and we could have had a very similar conversation, at least conceptually, even five years ago or longer, do you have a system of record? Can you prove that you're going to be able to recover or not? Can you prove that you actually have a good inventory of the identities of the agents? All of those things that we think we're delivering to market that add value so that you don't have to start from scratch. We can automate a great deal of that. we can discover and go and have visibility into things. That's for many organizations, not just large enterprises, really taking inventory of what they've got is something that they're flying blind on, and that's before you introduce agentic activities.

Krista Case

>> Absolutely, Dave, I think security teams are trying to almost solve both ends of that spectrum right now. They're trying to, like you say, get that visibility, but then they're also trying to make sure that they can put those controls in place. So are you seeing that as well?

Dave Russell

>> Yeah, and you kind of alluded to it earlier that from a controls perspective, you don't want to inhibit. That's been the historical tension of do you want to go fast or do you want to go safe? And really, business would prefer to do both or some credible trade-off and balance of the two. That's really what we want to bring is enable the speed, and that's a lot of what when people say they have an AI initiative. It's not AI for AI's sake. It's AI because we want a new business initiative, a new marketing campaign, or something that requires speed. So now how do you do that without potentially going into blind spots, opening yourself up to new exposures? That's what we're really trying to reduce both the friction but also the time for them, if the worst should happen, to get back to a known good state rapidly.

Krista Case

>> So, Dave, we've talked about a lot of different things today, and if I'm a practitioner trying to figure out where to begin, and would you have one or two recommendations for a place to start?

Dave Russell

>> one of the things I always like to say is it's good to learn from other people. So we do have a Data & AI Trust Gap report, meaning the gap being what is the variance between data AI and the trust that you have in that.

Krista Case

>> Yes.

Dave Russell

>> Just two quick stats, because they marry on top of each other well, 88 % of organizations we surveyed said that they're either piloting or in production with AI agents. Only 7 % felt confident that they could fully command or govern those agents. you don't have to be too quick at algebra to figure out that's not a good ratio, right?

Krista Case

>> Exactly.

Dave Russell

>> No one wants to be there.

Krista Case

>> Exactly.

Dave Russell

>> So I would say that report, Data & AI Trust Gap report, is good to look at just to see what is the current state. Oftentimes, an organization says, well, we're really unique, and they do have uniqueness, but their problems typically aren't that different. So understand that you're not alone. You're probably facing something that others are as well. So that notion of awareness is good. But then the next step is go pilot other solutions. And start, though, first with where do we think we're exposed? Take inventory of the capabilities you've got. We like to think that we're bringing strong value to the market. But do something, don't wait for something to happen to respond to it. You come from a data resilience background. You can probably remember whenever a natural weather disaster took place, suddenly after the hurricane, people wanted to talk about disaster recovery. It's heartbreaking to say, well, that's good to have the conversation, but I can't get the data for you that you haven't already protected. So let's think about that before an incident. That's the parallel I would use with AI systems as well, is start thinking now, start thinking about the governance aspects of that ahead of time.

Krista Case

>> Yeah, and I do think that there's starting to be more mindfulness. I think there's recognition that these cybersecurity incidents truly are business continuity issues, and that we need to make sure that we are prepared.

Dave Russell

>> Yeah, and the difference that I would say is, historical disaster recovery oftentimes affected a machine, maybe a branch. Now cyber could take out the company, but maybe it took out the company in a period of months. Now you're at machine speed, which we talk a lot or dwell a lot on the security, which is on the negative aspect, meaning a malicious notion, of which for sure we have to be concerned with. But one of the biggest threats could be an institution -owned agent doing something accidental. It was rogue in the sense that it didn't do the behavior as expected, but it wasn't with malicious intent.

Krista Case

>> I believe they need to be treated like malicious insiders. these AI agents, they're programmed to do a job, and they're going to find a way to do that. And again, we saw that with Hugging Face, so I certainly agree with you. So, Dave, there's a lot in flux right now. and hopefully we'll have the chance to sit down at Black Hat 2027. What are some of the things you think we'll have learned or that we will learn over the next year?

Dave Russell

>> I think we'll move from theoretical to more of a grounded understanding. Believe it or not, just in the last couple of days, I've actually evolved my opinion on some things. And I'll give you but one example. So I was thinking, if we could actually subset out in production the number of copies of old data that you've got, or redundant, obsolete, trivial data, could that have a positive impact on your AI outcomes? And I actually had three different conversations where a customer said, absolutely, because we have evidence where we actually accessed an old document through our agent, came to a wrong conclusion, and discovered it later. Further, one person even said, we determined that only half a percent of our model data had to be inaccurate to completely throw off the rest of the model. That's an incredibly tight tolerance. So I think one year from now, what are we going to learn? That little things matter. Garbage collecting on the front end of production is no longer going to be a luxury item, but probably a mandate, exposure mandate, an AI quality mandate, an attack vector reduction mandate. So I think, and I hope we're going to get a little better at data management and a lot better at understanding we need to prepare ahead of time.

Krista Case

>> I agree. it's the whole garbage in, garbage out. If you're training your AI on, like you say, trivial or obsolete data, you're not going to get those outcomes that you're looking for. And as you mentioned, too, it expands the attack surface. Well, Dave, this has been a pleasure as always. Thank you so much for sitting down with us today.

Dave Russell

>> Great to see you again. Thank you.

Krista Case

>> Great to see you as always. Thank you. Thanks so much for tuning in. We'll be right back in just a few minutes with more from Black Hat 2026.