RSAC Conference 2025 | Alex Hesterberg, Superna.io & Andrew MacKay, Superna.io

Clips
More from RSAC Conference 2025

Alex Hesterberg

CEO

Superna.io

Andrew MacKay

Chief Technology & Strategy Officer

Superna.io

play_circle_outline Superna.io's Real-time Data Security and EMC/Dell Partnership: Preventing Ransomware Attacks on Production Data

play_circle_outline Enhancing Security Capabilities with Ransomware Defender: Empowering Teams, Containing Attacks, and Monitoring Threats

play_circle_outline Importance of security at the data layer and preventing exfiltration

play_circle_outline Collaborating between storage and security teams for incident response automation

Info
Transcript

Alex Hesterberg, Superna.io & Andrew MacKay, Superna.io

Alex Hesterberg

CEO Superna.io

Andrew MacKay

Chief Technology & Strategy Officer Superna.io

Dave Vellante of theCUBE sits down with Alex Hesterberg, CEO of Superna and Andrew MacKay, Chief Technology and Strategy Officer of Superna during RSAC 2025 to talk about the future of data security. The conversation highlights the rising urgency around protecting data in real time and how Superna is helping businesses stay a step ahead.

Hesterberg shares how Superna’s approach redefines the relationship between storage and security operations, closing critical gaps with real-time protection strategies. MacKay explains how understanding user behavior... Read more

explore Keep Exploring

What company has been in the cybersecurity industry for about 14 years and started its partnership with EMC and Dell to deliver real-time data security, including the ability to lock out attacks in real time? add

What kind of telemetry are you capturing for your product Ransomware Defender, and how do you utilize it for sub-second attack containment at large scale in the AI world? add

What are some traditional security technologies that have traditionally ignored the data layer? add

What actions would a security team appreciate in order to take actions towards protecting data? add

bolt Powered by CUBE AI

Alex Hesterberg, Superna.io & Andrew MacKay, Superna.io

search

Dave Vellante

>> Hi, everybody, welcome back to RSAC Conference 2025. My name is Dave Vellante. John Furrier is also here. This is day one. We've also got some action going on tonight with the NYSC over at the Embarcadero, theCUBE after dark, so you can check that out. Alex Hesterberg is here, he's the CEO of Superna.io. He's joined by Andrew McKay, who's the CTO and CSO, chief strategy officer. Is that right?

>> Yeah. - Okay. Gentlemen, welcome. Superna, new to me.

Dave Vellante

>> Tell me about the company.

Alex Hesterberg

>> Yeah. So we like to think about it as one of the best-

>> kept secrets in cybersecurity. The company's actually been around about 14 years. Started its partnership with EMC and Dell delivering real-time data security. Meaning detection of actual events, extortions, ransomware on production data, with the ability to then lockout the actual attack in real time. And that process, that product has been around for quite some time now.

Dave Vellante

>> I remember this, I remember but I don't think they announced though, they disclosed that it was Superna back then. But I remember that lockdown feature that they had at EMC. Yes, okay.

Alex Hesterberg

>> Yes. - Ringing a bell.

Alex Hesterberg

>> So that was originally, that was Superna.

Dave Vellante

>> Superna has now, over the course of the last several years, launched into the ecosystem of technology partners in cybersecurity. So when we were seeing events take place in real time at the actual data layer and then actioning against those events, we would then take all the forensics of those attacks. And now we deliver them natively into CrowdStrike's Next- Gen SIEM or SentinelOne, or even ServiceNow for ticketing and for automation of all the different things the security team can do. And now, over the course of the last couple of years, we've also invested in what we were going to refer to as the data attack surface management, which Andrew can go into in depth.

Dave Vellante

>> So you guys have always solved data problems. There are those who would say security is a data problem. Is that how you think about it?

Alex Hesterberg

>> We looked at security from the view of your data, so when you work backwards from your data and look out, you see hosts, you see users. And so we looked at security in a totally different way because we live in the unstructured world. And so when we did that, we came up with unique ways to map out your attack surface. We can use things like classification and understand the risk to your data. Because we're classifying your data, we can see permissions. We found that when we did that, we're able to map out risk vulnerabilities and exposures that matter because it's your data, versus a host that doesn't access data.

Alex Hesterberg

>> If you think about it, every single piece of security technology has always been rooted more in network and application, and identity access management and firewalls and intrusion detection, but not the data. Not your actual, precious endpoint that's holding your production data. That was just always seen as something you always had to back up, and if an attack made its way there, you're instantly in this recovery motion. What we end up bringing to the table here is the tenets of security, the instantaneousness of prevention and locking out and denying access, and we apply it to the storage layer. And by the way of our integrations, we now make the storage layer and attacks there, and what we stop, a part of the incident response automation process. So security teams don't need to learn about data and operating systems on a storage platform. And the storage teams don't need to learn anything about automated response for quarantining a host or kicking a host off the network. So in this way, we bridge the gap between the security world and the data world.

Dave Vellante

>> So you guys have some really interesting claims that caught my eye. You have a product called Ransomware Defender, is that right?

>> Yes. - And you talk about sub-second attack containment

Dave Vellante

>> at very large scale like petabyte scale,

Alex Hesterberg

>> which is the AI world that we live in now. So my question is what kind of telemetry are you capturing? How are you doing this?

>> Are doing this. So all storage systems have an audit log,

Dave Vellante

>> the audit log records the changes to the data. The changes to the data are new data, modifying data, deleting data. We're listening to the changes of your data, and so that's a continuous threat evaluation where we're listening to the logging of the audit systems. And by doing that, we can actually, literally see business data being modified, created in real time. And when we do that, we're doing real-time analytics and we're now able to see patterns in the user activities. So if I could see your account is renaming a lot of data for some reason and you don't normally do that. We see that in real time, because we're listening to the business data as it's being created.

Dave Vellante

>> Go ahead, please. - And why this is important

Alex Hesterberg

>> now, a couple of things. Traditional security technologies that we've all depended on for a very long time have traditionally ignored the data layer. The story at the data layer for security has been backup and recovery, make a snapshot and recover. What we found is that over the course of time, infiltrations, exfiltrations, ransomware attacks can sometimes make their way in very quietly, to the point where they're not even detected. We see and detect those things, so we're actually preventing any kind of spread.

Dave Vellante

>> So the reason why that's important too, because I'm a firm believer in cyber resilience and air gaps and great because you got to be able to recover, but as you know, what attackers are doing, they're exfiltrating data. They're not holding, they're just keeping the data. They have your data and then you get the ransom note and you say, "Ha, I can recover. " They say, "Ha, I'm going to release all this data and you're going to be screwed. "

Alex Hesterberg

>> That was one of the biggest topics at the Gartner Conference in Vegas last year, at the end of last year. The reason why this is particularly important now is because that's been seen as a vulnerability, as a gap, not having security wrapped around your actual data layer. The extortion thing is really important to look at, and I'll talk about that in a second. But two years ago, Julia Palmer, who owns the Magic Quadrant for File and Object, she actually created a new category called cyberstorage. And she was looking for technologies that were able to detect attacks on the actual storage layer, on the production data layer. And she did this because she was meeting with all these customers who were ending up in The Wall Street Journal or the Financial Times with some kind of breach or some kind of an attack. And the natural line of questioning is, "What are you doing? What are you doing to protect your data? " And the answers were all eerily similar, "I've got intrusion detection, or a firewall and antivirus. And I've got backups and I got snapshots, and I got four vendors for everything. " Okay, then why am I reading about you in The Wall Street Journal?

Dave Vellante

>> And it makes for a better Magic Quadrant than storage arrays. You remember what happened to storage arrays? Everybody went into the upper right because it just became an oligopoly.

Alex Hesterberg

>> I spent some time in that world.

>> You know what I'm talking about, that's a lot.

Dave Vellante

>> what's this analyst's name? It's very clever.

Alex Hesterberg

>> Julia. - Julia.

Dave Vellante

>> Palmer. - Palmer.

Alex Hesterberg

>> P-A-L-M-E-R. - Very clever.

Alex Hesterberg

>> She's been the Magic Quadrant owner for File

Dave Vellante

>> and Object for about a decade now.

Dave Vellante

>> Give her props. It's interesting how this market shifts.

Dave Vellante

>> Obviously, I come from the data world as well,

Alex Hesterberg

>> and then you saw with Bipul's company, Rubrik.

>> Yeah. - Rubrik became basically declared, "Okay,

Dave Vellante

>> we're a cybersecurity company.

Alex Hesterberg

>> " And they got this great valuation and they're all over this place, so it's really interesting. And a lot of traditional vendors would say, "Well, no, that's not our play," but now everybody's leaning in to this space. It's like this is the gift that keeps on giving. It's terrible to say that, but chaos is great for criminals but it's also great for the vendor community, and it's just like this is a never-ending problem. So help me understand your relationship with Dell. You're going to be at Dell Tech World.

>> Yep. - You guys, I think,

Dave Vellante

>> are coming on theCUBE at Dell Tech World, which is amazing.

Alex Hesterberg

>> Yeah. - Probably, I'm guessing Monday night,

Dave Vellante

>> which is our opening night.

Alex Hesterberg

>> I think so. - Maybe, maybe not. I don't know, we'll see.

Dave Vellante

>> We got a great relationship with Dell.

Alex Hesterberg

>> They put us right in the middle of the action. They build a wonderful set. All the execs come on, the customers, the partners, other analysts, it's phenomenal. So are you inside of products like PowerScale or how does that all work?

Alex Hesterberg

>> Yeah. So I'll let Andrew double-click on a couple of these things, but we launched with PowerScale. We launched with ECS, which is now going to be called ObjectScale.

>> Yeah. - We'll soon be launching support

Alex Hesterberg

>> for PowerStore as well.

Dave Vellante

>> And from a Dell perspective, they're an incredible partner of ours and we've been selling with them and through them for many years. We'll be launching our OEM with them shortly, but one of the things we heard from our customers as well is they don't have just one storage vendor. They usually have many. Some of them have partial cloud, different vendors on-prem. So one of the first things we did was to start working with different enterprise storage platforms, to be able to accommodate for customers that were invested in Dell, that maybe they were also invested in VAST or in Qumulo, or in Pure Storage, or Hitachi or AWS. And so we had built these relationships and these integrations to be able to cover data no matter where it was. And then be able to integrate into any of the SIEMs or XDR endpoint technologies that their security teams have already invested in and already been trained on.

Dave Vellante

>> So you got cloud angle as well.

Alex Hesterberg

>> Yes. - So it's hybrid.

Alex Hesterberg

>> Yes. - So you're Switzerland of this space,

Dave Vellante

>> but you've got close relationship with Dell,

Dave Vellante

>> but you can accommodate the heterogeneity that exists in the world. How much of a technical challenge is that for you guys?

Alex Hesterberg

>> Well, unfortunately for the storage world, there's no common logging format. Everyone does their own thing, so some of the work is adapting our technology to each of the devices because they all have a different logging format. But we've been at this for many years, we're many years into this, and so as we add new vendors, it gets quicker and quicker and quicker. And so at this point, we probably cover, I don't know, 80% of the unstructured data vendors in the market today. So most of our customers are multivendor and occasionally vendors switch, someone goes in and wants to replace their storage. So we allow customers to migrate that licensing around and we can protect their data basically wherever it lives.

Dave Vellante

>> You're the bridge between the storage admin role and the SecOps role.

>> Yes, that's a good way to- - You were referring to

Dave Vellante

>> that a little bit earlier, I think, just in terms of

Alex Hesterberg

>> the storage guys don't have to worry about security. The security guys don't have to worry about storage, but when stuff happens, things go wrong, bombs are dropping, people have to collaborate.

Alex Hesterberg

>> Yes. - Are you a catalyst for that collaboration?

Dave Vellante

>> What have you seen? Do you have any examples of customers that have worked together and brought those two worlds together? I wonder your perspectives there?

Alex Hesterberg

>> Yeah, so it's not just the catalyst, it's the mission. We call it the data to security gap. And more often than not, if you go talk to a CISO today, the Gartner survey that came out at the end of last year. They were asked to rate what they consider to be the most important responsibilities of their job, and where they would rate their effectiveness or their ability to go deliver. And the two areas that popped up with the biggest gap, were data security and the ability to respond to an incident at the time of an event. So we took those two things head on and we brought the data layer into the security world, into incident response, into the automation. And we brought all the responsibilities that the storage teams could do, kept them where they were. So we are never asking a storage team to learn about security workflows. We're never asking security teams to learn about storage workflows. But at the time of an event, the security team is fully outfitted with all the forensics of an attack, so they can go execute the workflows that they've been trained on. The storage team has everything they need to be able to respond to an event as well, but nobody needs to learn about each other's technologies. The security team stays in their SentinelOne or the CrowdStrike or the Palo Alto, and the storage team stays within their Dell, within their Pure, within their Hitachi world.

Dave Vellante

>> What I'm looking for, we just did a survey with our partner, ETR. They did the survey, they're a partner. And they were asking the CISO what other areas, the SecOps team, what other areas of responsibility they had. And I'm trolling through it and I was shocked at how many different areas they touched. It was IT, it was parts of the business, it was data, data platforms.

Alex Hesterberg

>> Appliance. - Governance.

Alex Hesterberg

>> Supply chain. - It was so many questions here.

Dave Vellante

>> Yeah, it was supply chain.

Dave Vellante

>> It was really quite amazing how many pieces they touched and the application piece of it. IT infrastructure, business continuity, privacy, data backup, data management, on and on, the supply chain. And so if I understand it correctly, you guys are helping them not have to worry about being experts in all those other businesses?

Alex Hesterberg

>> Correct. - You guys are taking care of that

Dave Vellante

>> as the automation layer, if you will.

Alex Hesterberg

>> We looked at the mandate of a CISO's incident response plan, and it's basically to protect the digital assets of the corporation. That's their mandate.

Dave Vellante

>> Yeah. - But strangely, all the tools

>> and technology that they invest to do that, none of them actually touch data. Endpoint protection doesn't actually touch the storage device, doesn't actually create snapshots in the storage device. So we looked at what actions would a security team appreciate in order to actually take actions towards protecting data? So we looked at things like creating snapshots. We gave that power to the security team. If they believe the data's under threat, I probably want to snapshot that data because I'm the first line of defense. I see the threat coming into the corporation because I've got my dashboards, my SIEM, my SOAR. How can I take an action that'll protect my data? As opposed to the attack happens and they're powerless because they don't have the ability to run a little playbook or something. So we gave them snapshotting, we gave them user lockout. We gave them capabilities that just don't exist in the incident response world, which is an odd thing. Because it is the mandate of the security team, to protect the digital assets of the corporation, so we've empowered them.

Alex Hesterberg

>> You brought up something I wanted to talk about, extortion, so the crime of stealing the data and just extorting it, and now I have it as an external bad actor. If you don't see that attack, if you don't see that nefarious behavior, whether it's internal or external, once the data's gone, it's gone. It's not about having a backup or having a snapshot to recover from, your data is now outside of your four walls. Your risk posture is far greater than if you didn't have a backup of it. So seeing that attack, seeing that infil and exfiltration, seeing that nefarious behavior and being able to detect it and stop it at the data layer. And then invoke the security protocols to be able to do quarantining and host lockdown, these are the things we automate.

Dave Vellante

>> Yeah. So backup's one thing, recovery is another thing, stopping exfiltration is really the thing that you're trying to solve. And so you've got to do this at runtime essentially in near real time, because you hear everybody has the stats on the compression time in terms of exfiltration.

>> From the beginning

Dave Vellante

>> to the actual incident, it's getting shorter and shorter.

Dave Vellante

>> It's like minutes now, right?

Alex Hesterberg

>> Minutes, that's right.

Dave Vellante

>> So you've got to do this at runtime, don't you?

Dave Vellante

>> So one of the most underused features of storage is snapshotting.

Dave Vellante

>> Right. - Right? So backups means you did something wrong,

>> which means you didn't leverage the technology you already owned. So we leveraged the technology that everybody owns already as a way to recover, so we call it recovering data in place. We don't need backups because the snapshots contain versions of the data. As long as you know which version is the good version, you don't need a backup. So our solution's able to recover data without backup, because we're using the snapshotting that's existing in the storage and we generate more snapshots during an attack, and we're tracking all user activity. So we have this giant map, we can navigate it, and we can pull out your good data and restore it in seconds from the primary storage.

Dave Vellante

>> And your snapshot granularity is so tight that the amount of data that they could exfiltrate would be so tiny?

Dave Vellante

>> That would be more of a ransomware scenario where they're modifying data, but the exfiltration one is an interesting one. When data gets exfiltrated, it's just a data read. So if we know who reads data, that's good. If you start reading too much data, we know that's not normal for you. So the first place to go protect a data exfiltration, guess where? It's your data. It's going to tell you who's reading and who shouldn't be reading right now. It's Saturday, why are you reading a terabyte of data on Saturday? That's the layer that we listen to, so we can see those types of subtle behaviors.

>> So you shut that down

Dave Vellante

>> essentially, or the system shuts that down?

>> We could take it all the way from an alert saying,

Alex Hesterberg

>> "This looks a little strange. " Potentially, it looks like Julia or it looks like Mike coming in, they're credentialed. It's just strange behavior. Maybe we want to flag on it, maybe we don't want to lock them out. But then if we determine they're starting to delete or they're hitting a certain threshold that the security team says, "No, no, no. If they're doing something strange and then these other things occur, we can issue a lockout denying them access, not just to the array that they're touching, any storage under our management. " So we essentially prevent them from doing any future damage. Then within the CrowdStrike or ServiceNow, or SentinelOne or Palo Alto Cortex interface, they will see the forensics of the event. The who, the what, the when, the path, the share, the host, the IP, what exactly occurred, and then they can go execute their workflows to go quarantine the host or conduct an investigation. And all of that stays within their own toolsets.

Alex Hesterberg

>> The entire root cause of the incident is delivered to the incident response team, without any additional questions they need to ask. It's this IP, it's this user, it's this data.

Dave Vellante

>> And the degree of automation that they choose to implement is up to them.

Alex Hesterberg

>> Correct. - That's not your choice.

Dave Vellante

>> What are you seeing in that regard in terms of willingness? Because I remember somebody, John Oltsik just wrote a piece. He said he remembers back in 2000, whatever it was, '03, Gartner declared the end of alerts with real-time incident response and IDR, whatever it was. It never happened, because automation is a scary thing to people. Is that changing with this more greater affinity to?

>> I would suggest the conversations go like this every time. You talk to the security team and you ask them some basic questions like, "What actions do you take in your incident response that might actually recover data or protect data, or prevent a user from destroying data? " And they said, "I don't have the ability to do that. " And then we explain what we do and they say, "I didn't know that was possible. " And the very next question after they hear what we do is, "Do you integrate with? " And then they list off all the vendors that are here for us to integrate with, so they immediately see the value. They know it's a gap in their ability to respond, and what they want is integration, integration, integration. That's the number one requirement, because incident response doesn't work without integrations.

Alex Hesterberg

>> We started seeing it in sales cycles when we were going shoulder to shoulder with our teammates in the field, our brethren and sistren on the side of the storage world. At these storage meetings, security teams start to show up and they go, "What do you have that's going to be protecting this data against ransomware? What do you have that's going to give me audit and forensics about who's touching what? " And the storage teams are not used to answering those questions, so the security teams show up. And we now outfit those teams with all the answers that they need, according to the NIST framework. We actually design most of the capabilities of what we do against the NIST framework, so that they would look at it and go, "Oh, you're speaking my love language. I know exactly what it is you do. " And one of the things we're really excited about, so what we talked about a lot today were endpoint and XDR, and SIEMs and SOAR integrations, and again, a lot of the companies here are integration partners. But where we're taking this next, I'm going to hand it to Andrew, because what we've been able to start doing is everything we just talked about was, I'll call it right of boom. So the boom happened and now you're trying to recover or trying to reduce the blast radius. Where we're going next is left of boom, with partners like Tenable and Armis.

Alex Hesterberg

>> Okay, yeah. Yeah, so everyone struggles with patch management. It's not a super sexy topic, but the reality is we're not going to patch your way out of the problem. We can't patch fast enough. So many claims about prioritization being the number one requirement in order to reduce your risk, and again, we looked at this from the lens of data. Well, why would I patch a machine? Well, I'm worried it gets compromised. Why am I concerned about that? Well, I'm concerned that my data will get breached. Oh, so your real concern is data. So if we work backwards from the data and said, "Well, let's take a look at what kind of data. Is it PHI data? Does it have PCI, a credit card? " Let's look at what's in the data. Let's look at the permissions to the data. Let's look at the protection level of the data. Let's look at the user behavior of that data and put it into an AI model, because why not? And what do we get? We get a prioritized list of machines that are interacting with your data that we believe should be the number one thing to remediate, because a breach of these machines would result in a breach of this dataset. So when you work backwards, it turns out the list of things to patch is tiny, it's really, really small Today, the problem is, "Oh, look at all the machines I have to patch. I got to scan them every week, or I got all the vulnerabilities and I got to sort them. " No, look at your data, look at the risk, and then see what hosts are touching your data.

Dave Vellante

>> Oh, they're rolling into the keynotes. Make the last point, because we got to jump.

>> So we call this, we're just launching it this week at RSA,

Alex Hesterberg

>> we call this data attack surface management. I guess you could say we're launching it here on theCUBE. You're the first to know.

>> Oh, data attack surface management.

Alex Hesterberg

>> Data attack surface management.

Dave Vellante

>> A new product category? - We hope so.

Alex Hesterberg

>> We think so. - We'll get the Gartner guys on that.

Dave Vellante

>> Talk to our research team at theCUBE Research, we'd love

Alex Hesterberg

>> to get briefed on that.

Dave Vellante

>> We'd love it too. - All right, good. Guys, thanks.

Dave Vellante

>> We're looking forward to seeing you next month

Alex Hesterberg

>> at Dell Tech World as well, and around the show this week. So thanks for coming on.

>> Appreciate the time. - Appreciate the support.

Dave Vellante

>> Thank you. - Thank you.

Alex Hesterberg

>> All right. Okay, keep it right there.

>> Dave Vellante for John Furrier,

Dave Vellante

>> Jackie McGuire and John Oltsik.

Alex Hesterberg

>> We'll be back right after this short break from RSAC 2025.