Black Hat USA 2026 | Dev Rishi, Rubrik

Clips
More from Black Hat USA 2026

Dev Rishi

General Manager of AI

Rubrik

play_circle_outline LLMs with tool access acting on behalf of users (definition of agents)

play_circle_outline Rubrik Agent Rewind enables rapid recovery from agent destructive actions

play_circle_outline Semantic Guardrails and Fine-Grained Agent Identity for Governance Beyond Traditional IAM

play_circle_outline Resilience requires linking observability to backups and minimizing recovery time

Info
Transcript

Dev Rishi, Rubrik

Dev Rishi

General Manager of AI Rubrik

In this interview from Black Hat 2026, Dev Rishi, general manager of AI at Rubrik, joins theCUBE's Krista Case to discuss the new guardrails enterprises need as AI agents move from experimentation into production. Rishi defines agents as models with access to tools, distinguishing them from earlier chatbots by their ability to take real action inside enterprise systems. He explains why traditional identity stacks fall short, since agents can hold legitimate permissions across multiple systems yet lack the human judgment to avoid combining them into risky outc... Read more

explore Keep Exploring

What do enterprises need to do (or put in place) to safely and effectively deploy AI agents in production? add

Why did Rubrik start investing in protections for AI agents (e.g., Agent Rewind), and what ongoing customer problems were they trying to solve? add

How should enterprises approach authorization and continuous authorization—including semantic guardrails—to manage AI agents' access and mitigate risks like shadow AI, given agents can perform many actions with varying levels of risk? add

How should organizations rethink resilience, recovery, and backup/observability strategies in response to the increased risks posed by AI agents? add

bolt Powered by CUBE AI

Dev Rishi, Rubrik

search

Krista Case

>> Welcome back to theCUBE. We're live here at Black Hat 2026 from the Mandalay Bay in Las Vegas. We're talking a lot about AI agents today and in particular how they're starting to move into production and really the challenges associated with that, which include the fact that they need kind of new controls, as they start interacting with enterprise systems, business processes, and sensitive data. We need visibility into their behavior. We need the ability to sort of govern what they're allowed to do, and we need the ability to also recover quickly if something goes wrong. These capabilities have all typically been kind of addressed separately. So things like identity, runtime security, observability, they all need to work together today to be able to deploy AI with confidence. I'm sitting down right now with Dev Rishi, GM of AI with Rubrik, to talk about this. Dev, thank you so much for joining theCUBE today.

Dev Rishi

>> It's my pleasure to be here. Thank you.

Krista Case

>> Yeah, really appreciate it. So Dev, AI agents, they're interesting because they're not a human, they're not a service account, and they're becoming these participants in business processes. So can you talk about maybe some of the key guardrails that need to be in place in order for enterprises to be able to deploy these AI agents in production?

Dev Rishi

>> Yeah, absolutely. So the first thing I think is helpful is just making sure we have a definition for what is an AI agent. I think if you ask 3 people, you might get 5 definitions. I like to start by saying agents really are just LLMs or models that have access to tools. So they're basically models that can act on behalf of a user inside of your company. It's a little different than some of the basic chatbots we saw a couple years ago where it was great to be able to ask, how many days off do I have this year? Or what's the population of Canada. Now we're talking about actual systems that can really do real work. One of the reasons I think agents are critical is if we're going to get the ROI that we're anticipating getting from AI, AI has to evolve beyond better chat, better search, and it's going to start to take action on behalf of our users. I use it to be able to write emails, create decks. That requires it to have access to my corporate email, to the place that we store presentations and otherwise. So then I think the question becomes, what kind of guardrails do we need to put on these AI agents? And the interesting thing about agents, like by my definition, which was like you have a model that's kind of non-deterministic, it can come up with a number of different outputs, and then you have access, which is federated by an identity and that's really core to it. I think about the guardrails there really needing to be less similar to what we've conventionally put on historical software, and more how we start to be able to say, look, if you or I were accessing Salesforce, accessing email, we have some judgment on how we would use that that the models don't. So I feel like you need a new class of guardrails that are a lot more intelligent and semantically aware to be able to actually secure and govern what agents are doing.

Krista Case

>> Absolutely. We've had the conversation here on theCUBE a couple of times already today about the fact that, to your point, Rishi, these AI models, they're designed to do a job. Yeah, and they're going to do that job. So they're also operating very dynamically. They're discovering information, they're invoking tools, and they're making these decisions sort of in real time. So can you talk about— I know Rubrik is actually entering this space, which is really interesting, and we'll get to that. But maybe you could address more specifically, some of the gaps that you're seeing in these traditional identity stacks that caused Rubrik to make the investment in this area?

Dev Rishi

>> Absolutely. I'll start off by telling you just why Rubrik started to invest in this and then what were the continued pains that we saw. So Rubrik is at its core a cyber resilience company, which meant that we helped organizations get back on their feet after they were hit by some sort of disaster. Used to be disasters were natural disasters, fire, flood. That's why you needed business continuity and disaster recovery. Then I'd say at the end of 2019, 2020, the disasters started to become more like ransomware and cyber attacks. So someone was maliciously inside of your system and holding your own data hostage. So Rubrik really started to layer on its services around business continuity and disaster recovery in that space. I think as we start to see what the new class of attacks or disasters look like, it's clear that they're really motivated by AI and agents, either internal because it's agents that the organization has given people access to that can be used in many different ways, or externally motivated. And so one of the first things that we set out to do is just, I think, be core, like, true to our mission and say, we wanna help organizations recover and be back on their feet, have resilience after an attack. So that started with a feature that we called Agent Rewind. The idea with Agent Rewind is if an agent takes a destructive action on some data that Rubrik is protecting, let you recover very quickly. In order to build Rewind, we needed to build some level of observability. We needed to see what the destructive action was so we could rewind it. We went out to market with that. And what we started to notice was that people loved the rewind concept, but they had a hair on fire problem today on just even the observability. The most consistent thing I learned when I was speaking to both CIOs and CISOs where people would say, I don't know what my AI systems are doing. I don't know where they're deployed. I don't know how many there are. I don't know what they're actually capable of doing. And so we started to see that, and then we noticed that the gap kind of continued, which was once you gave people observability, oftentimes they were extremely surprised and they didn't have a way to be able to put the types of controls that they wanted on it, which I think was both runtime security and also identity-based controls. And so that's what we looked to be able to bake into really one cohesive platform that did both the observability, the controls, and then also the ability to recover once you need it to.

Krista Case

>> That makes sense, Dev. I think enterprises are trying to solve, like you say, almost two things at one time. I think the shadow AI piece of it is still a very big problem. But at the same time, as they're turning the lights on, so to speak, they're also trying to put these guardrails in place. I had a chance to look at the announcement, and one thing that I know Rubrik was talking about is sort of this concept of authorization and continuous authorization. Definitely, as I'm studying the identity market, definitely seeing that that's going to be an important capability as AI agents start to enter the equation. Because they can take dozens of actions potentially in a single workflow, and each of those actions might carry a different level of risk. So maybe you could talk a little bit about how enterprises should think about approaching that challenge.

Dev Rishi

>> Yeah, maybe the first thing I want to summarize is, in my view, the existing identity and access management stack wasn't really well designed for AI agents. And a really crisp way to see that is, we use Claude quite heavily at Rubrik. And so my instance of Claude for Work has access to Salesforce and has access to my email. It has access to both using my credentials because I use it to summarize opportunities and write out emails. Those are both legitimate permissions that it has, but I oftentimes run into two levels of issues. The first is my agent should be able to do some operations, but not others inside of each of these systems. And sometimes that's very granular, which is to say, I don't want my agents to be able to edit any revenue fields in Salesforce, as one concrete example, because we use a lot of our reporting out of the core system of record. But it's not always obvious in Salesforce what exactly is a revenue field. There's so many different fields. It's almost like, if you or I saw one, we'd understand contract values are revenue fields. But duration or term might not be. And so what we sort of first put on is these semantic guardrails on what agents can access. From an identity standpoint. And then the second gap that we saw was that when you have these identity access permissions to an agent, it's very unprotected against lethal combinations. So my agent can start off doing legitimate work in Salesforce, pulling data, helping me summarize the quarter, and I might use it to then go write an email to a customer or prospect and say, how are we doing? That agent, I think, is prone to making the mistake of putting sensitive data from Salesforce into the email that it sends out. And there was nothing at the identity and permissioning layer, the way that we conventionally have approached it, that would have stopped it from being able to do that. Because it had legitimate rights to that data in Salesforce, it had legitimate rights to that email, but didn't have the judgment to exercise what it should have been able to do. That was one of the key gaps that we saw that we wanted to be able to solve.

Krista Case

>> So it really is about, like you say, that semantic judgment for the human at the end of the day. And do you think that, I guess, can you talk to how does a human remain in the loop when, maybe specifically when it comes to the Rubrik solution, but we're seeing that when it comes to making these decisions, it really needs to be, like you say, AI plus the human, AI kind of maybe identifying some of these potentially toxic combinations and then the human making the judgment at the end of the day.

Dev Rishi

>> Yeah. So I think in our experience, the only way that human in the loop works well is if you don't flood the human with the volume of requests they're going to make.

Krista Case

>> Absolutely.

Dev Rishi

>> And that's actually the hardest part. When we first started rolling out agents, I saw a lot of what we saw as preliminary approaches. That took the stance that, hey, the agent's acting on behalf of the human, so we're going to have the human authorize every action the agent's going to do. The issue with that is the entire bull case on agents is that they're doing 10 times as much work as a human in the same amount of time. And so if I'm sitting there and I'm hitting approve, approve, approve, we feel like it's more security theater than anything else. And so the approach we took is, we still want that judgment and that semantic understanding humans have. What is a revenue field? What it should or should not be able to do., but we wanted the speed of machine intelligence. And so what we did is we built a system that was AI in the loop, using a small language model at its core that's basically been trained to be a cybersecurity professional. And that system we call SAGE, stands for the Semantic AI Governance Engine, but it's really like our own agent for Agentic Security that we put in the flow of all of these interactions. And so it'll look over a given action and it'll determine whether or not to allow something or whether to block it, or most recently we just also released the ability where it can ping a human and say, this is something I need you to be able to look at. So I think part of the solution for human in the loop is recognizing these models are just acting way faster than humans can, and that's really a feature, not a bug. And so we need to use AI to help you secure and govern AI and put that in the workflow as well.

Krista Case

>> But I imagine it might take a little time to kind of build that customer trust. Maybe you could comment on that a little bit.

Dev Rishi

>> AbsolutelyI think, when we first started going out, I have to admit I was a little nervous telling people we're gonna use a non-deterministic AI model to enforce the controls. I do think two things though. The first is that I think a lot of customers recognized that this was the only way to completely solve the problem. Like they were sitting in the world where there was a lot of pressure to adopt AI and they had no real way to get their hands around it. And so I think they recognized that this was gonna be a part of the solution. And I think the second part of the solution, which our most recent launch around agent identity helps us address, is I think you really want both. You want these static 100% deterministic rule checks, and you also want an agent with an intelligent layer on top. And so with agent identity, what we've done is we've said, we wanna be able to take what the agent is able to access from an identity standpoint and make sure we're protecting the way it accesses that. By allowing you to do fine-grained identity-based policies. So you can say people in engineering should be able to access this resource, but people in sales probably should not be in the code base as one example. And that was something we could do a little bit more deterministically once we had our core identity gateways and other technologies built into our agent identity solution.

Krista Case

>> That makes sense. So it's about the human understanding what the policies are and things of that nature.

Dev Rishi

>> Exactly. It's about the human knowing that they can exercise the controls for all the areas where they can foresee the controls they need. And then knowing that there is a system that's constantly verifying, that's a little bit more intelligent and semantic, non-deterministic, but intelligent semantic in the background for anything they may have missed.

Krista Case

>> That makes sense. So, Dev, I think we've touched on this next one in bits and pieces, but I wanted to double-click a little bit on the observability component. With these AI agents, it's even beyond the data that they have access to. It's how they're operating, what other systems they're connected to, and the actions that they're taking. So, can you maybe talk about the observability piece and how we might think about refining that to address that gap.

Dev Rishi

>> Yeah, I think if you talk to any IT or security professional, if you walk these floors, the number one thing they'll tell you they want first is observability. And I think the reason for that is you can't really secure or govern what you can't see. But observability is a double-edged sword. the first thing is these agents are starting to emit so much traffic. At Rubrik, we see our internal deployment is on the order of trillions of tokens, right? That along with observability, you need a really good intelligence layer on top. I can't just dump everything the agents are doing into a dashboard or a view and expect you to be able to get value out of it. But then the second piece I think is how do you then start to have some sort of intelligence that goes through these systems and starts to discover what are the actual types of risk patterns? So I'll give you a couple of really quick examples. The first is when we hooked up Rubrik Agent Cloud into our own internal systems, we saw a few different types of things. The first was Claude Code loved to try and exfiltrate sensitive source code to public repositories. Again, not a conventional identity problem. it had the correct credential to GitHub via the developer, but it was something that the existing fabric was not built for.

Krista Case

>> Mm-hmm.

Dev Rishi

>> The second thing we started to see was spend was running away. These agents were so expensive. But once we had the correct observability systems built in, which means we're not only getting all the traffic, but we're able to run our models over it to understand where are these potential problematic areas, we started to see that not all the spend was something that we had to incur. 1% of sessions were driving 40% of the cost, and there was a lot more that we could drive once we had the observability in place.

Krista Case

>> That makes sense. Thank you, Dev. And I know a few minutes ago you were talking about Rubrik's background in resilience. And so I wanted to, also talk about the role of resilience in this AI operating model, because I do think that's an important piece of it, especially given that we know that AI agents are going to make mistakes. Right. So how do organizations think about preparing to recover from those mistakes before they have a significant or hopefully any impact on business operations?

Dev Rishi

>> Yeah, the first thing I think I want to say is that I think recovery has now increased in relative importance relative to anything else in your resilience or security stack. Main reason for that is Rubrik's always had this mentality of assume breach, which is that eventually something's going to go wrong. And I think AI agents have just amplified that by an order of magnitude. The best instance of this, I think, was the most recent thing we saw with the OpenAI cyber models that broke containment and ended up hacking some part of Hugging Face's. Repository.

Krista Case

>> Yes.

Dev Rishi

>> And, the way I think about it is like these, we consider them mistakes but obviously for that agent, it was just an approach to be able to optimize for the goal we gave it. These types of vulnerabilities and exploits I think are going to increase and be kind of almost a frequent occurrence. How you recover from it, I think, is a real challenge. Most resilience infrastructure wasn't built for— resilience infrastructure used to be something that you wish you never needed. Essentially, I think in the AI and agent space, I think that that reality is going to change. And if that means that you're using this thing that you had hoped you'd kind of dust off the shelf once every year if something bad happened, otherwise never think about, you need to really think about the way you are approaching resilience fundamentally differently. To me, there's two things that end up becoming important. The first is time to recovery becomes really important. Really simple argument for this. If the time to exploit an attack has now shrunk drastically, you need to be able to recover from that attack at the same level of order of magnitude faster. The second thing that I think is largely not obvious in a lot of cases, is you need to tie what you're doing for the observability stack to your resilience and backup stack, because ultimately it's gonna be too difficult to use the same manual approaches to be able to recover every single time. So you need to get the observability of what's happening, what's going wrong, and then tie it to where do I need to recover from? What's the correct healthy snapshot and backup to be able to go from and bring it back? Which is of course an approach that we've taken, but also I think a good reference architecture for anyone who's thinking about how to be resilient in this age and era.

Krista Case

>> Yeah, I agree, Dev. And I tend to think about resilience as a spectrum, right? So you have kind of the pre-attack pieces, which is kind of what the agent identity would address. And then you also have what we might traditionally associate with resiliency, which would be kind of the recovery end of things. So, like you say, having to make those connection points there.

Dev Rishi

>> I think internally we like to say there's peacetime and wartime, and what you do in peacetime allows you to be able to be better prepared at wartime.

Krista Case

>> Exactly, exactly. So, Dev, if you were, a practitioner walking the floor here trying to make sense of, everything that we've been talking about today, right, preparing for, this agentic AI era and making sure that we have these guardrails in place, what recommendation would you give to practitioners in terms of where to begin?

Dev Rishi

>> If I were a practitioner walking the floor here, I would be inundated and I would be a little confused. One thing that's clear as a practitioner walking around is that agentic AI security has to be a top-of-mind thing for me to be able to solve. There's too much pressure to be able to adopt these tools. And since we define agents as models with access, so much access that these tools have, that it has to become a top priority for me to be able to solve before the end of the year. So then tactically, how do I solve it? Well, most practitioners I think think about wanting two things. They want visibility and they want control. The way that I'd recommend you to think about this is visibility increasingly I think will become more commoditized and table stakes. I understand that right now it's an issue of not knowing where every single agent might be running and what's shadow and what's not. And I see a lot of different vendors starting to attack this problem, and I think there will be a good class of solutions in the market, and I think a number of them are solving these visibility challenges. Where I think things are gonna get more interesting is how you think about control. And then the third piece is something that you should introduce into the repertoire, which is, it's not just about visibility and control. Let's accept that things are gonna go wrong, and you need to add recovery and remediation into it as well. So those would be the three key pillars. On control, what I would argue is that you will need a system that will help you use AI to help you secure and govern AI. We just empirically see it's impossible to enforce the level of controls you want without that. And then the last piece I would put is, you want to be able to tie what you do in both your visibility and control to how you'd recover when something goes wrong. And I think the simplest way to be able to do that is to make sure however you've hooked up your observability system is talking to your resilience system. And of course, with Rubrik, we've built that into one platform, but if you're using another, you want to make sure that those two systems are talking, because what you do in peacetime is ultimately going to help you at wartime.

Krista Case

>> I love that analogy, Dev, and I couldn't agree more. Yeah, well, thank you so much for joining. This has been a pleasure. I really appreciate it, Dev.

Dev Rishi

>> No, thank you. It was a pleasure being here.

Krista Case

>> Thank you. Thank you so much for watching. Don't go anywhere, we'll be right back in just a few minutes with more live from Black Hat 2026.