RSAC 2026 Conference | Zeus Kerravala, ZK Research

Clips
More from RSAC 2026 Conference

Zeus Kerravala

Founder & Principal Analyst

ZK Research

AI mints a new era for cybersecurity: theCUBE’s RSAC day four analysis

AI agents are unleashing a more chaotic era of enterprise cybersecurity, one in which identities are transitory, actions are autonomous and governance struggles to keep pace. But what if the growing threat to data security is also creating the industry’s next big opportunity?RSAC day four opened with those themes in focus, but none felt more urgent than the idea that ephemeral AI agents are breaking traditional identity and access models. These agents spin up, complete tasks, spawn new agents and deprecate themselves — a pattern that demands an entirely new approach to trust and governance, according to Zeus Kerravala (pictured, left), founder and principal analyst at ZK Research LLC

play_circle_outline NVIDIA GTC’s AI Factories and Ephemeral Agent Proliferation: Scale-Out Gains vs. Attack Surface and Governance Risks

play_circle_outline AI Secures AI: Shifting from Access Control to Behavioral Action Control for Agent Security

play_circle_outline Data remains the crown jewel; data protection, governance, and compliance critical for AI.

play_circle_outline Security narrative shift: from business inhibitor to enabler, facilitating faster, safer AI adoption.

play_circle_outline Data resilience + cyber recovery (micro-recovery) as essential defenses against agent-driven attacks.

Info
Transcript

Zeus Kerravala, ZK Research

Zeus Kerravala

Founder & Principal Analyst ZK Research

In this interview from RSAC 2026, Zeus Kerravala, founder and principal analyst at ZK Research LLC, joins theCUBE's Dave Vellante and Christophe Bertrand to discuss how AI is driving the cybersecurity attack surface from unmanageable to chaotic — and what that demands of security strategy, identity management and business models. Kerravala explains how every wave of AI infrastructure — from AI factories to physical AI and edge inferencing — compounds risk in ways the industry is only beginning to quantify. He highlights the particular challenge of ephemeral a... Read more

explore Keep Exploring

How do NVIDIA's new AI infrastructure and open-source models — including the emergence of ephemeral autonomous "claw" agents — expand the attack surface, and can identity/security solutions (e.g., CyberArk) effectively secure those ephemeral agents? add

Will AI be a friend or a foe for cybersecurity? add

Why aren't data companies getting more attention or visibility despite data being central to AI and SaaS — do they have to call themselves "AI" to get industry attention, or is compute actually the real infrastructure play? add

How can the security industry shift from being seen as a business inhibitor to a governance and security foundation that enables companies to move faster — and what pricing or commercial opportunities could that enable? add

Which company in the data-resilience/security space are you most fascinated by right now, and why? add

bolt Powered by CUBE AI

Zeus Kerravala, ZK Research

search

Dave Vellante

>> Hi everybody. Welcome back to Moscone West. We're wrapping up day four of RSAC 2026. I mean, it's been a great event. Cube's live wall-to-wall coverage. We've covered all the angles. Of course, we're talking everything AI, but we're going to kind of do a Day 4 intro/wrap with myself, Dave Vellante, Christophe Bertrand, who's been with me all week. Christophe, phenomenal job doing hosting. You're a real pro. I really appreciate the support here. And of course, our friend Zeus Kerravala, Cube alum, analyst extraordinaire. Good to see you.

Zeus Kerravala

>> Yeah, thanks. You had to spend the week with Dave.

Dave Vellante

>> Great observation space, Zeus. Obviously, you're deeper networking, you know security, you just know the industry in general. We were just talking, you and I were both the GTC last week and you made the comment that everything NVIDIA announced, the new infrastructure, the AI factories, the scale up, the scale out, the scale across, the physical AI, all of it extends. The open claw stuff that they did, the open source models, all of it extends the attack surface, doesn't it?

Zeus Kerravala

>> Yeah.

Dave Vellante

>> Very relevant to the show.

Zeus Kerravala

>> The Dave Vellante claw is going to create 10,000 more agents underneath that and you got to worry about securing that. And that was probably the most common conversation I had with people was around the rise of claws and what that means for identity. Palo made a big investment in an identity company and there's some questions. In fact, I asked Nakesh, can CyberArk really secure a world where you've got all these ephemeral agents? And understand, it's not just like a Dave Vellante agent or a Christophe agent. These things are going to spin up. They're going to complete a task. They're going to create new ones. They're going to deprecate themselves. So, they're very ephemeral. And it's unlike anything the security industry's ever had to deal with before. And so, even by his own admission, he says there's some work to do there. It gives them a good foundation. But clearly how you manage identities and how you onboard access and how you delegate trust and governance, all that's going to change. And I think we didn't really talk about that much last year because we were just kind of delving into agents, but that came across loud and clear. And then as you said, Dave, all the other things Jensen talked about, physical AI, edge AI, era of inferencing, our attack surface has gone from something that was unmanageable to begin with to completely chaotic. And I think this show is well-timed actually the week after GTC.

Dave Vellante

>> Christophe, G2 talked about moving from access control to action control. So, he was saying, you've got to watch every single action that agent takes.

Zeus Kerravala

>> Going behavioral, right?

Dave Vellante

>> That agent takes, you can't be taking snapshots.

Christophe Bertrand

>> Absolutely. And you have to track everything because at some point agents will be making decisions, talking to other agents, and you have to be able to trace everything. By the way, this is supposed to be a cybersecurity show and all I see is AI. So, I don't know what your take on this is. I wonder what next year will be. But based on the conversations we've had, one thing I've observed, I'd love your take on this is, everybody's saying, "Well, there's a good side to AI. It's going to help us be more efficient. It's going to make the cyber security defenders a lot more operationally efficient. But at the same time, we have to reign those agents in." Is AI going to be a friend or a foe for cybersecurity in your opinion?

Zeus Kerravala

>> Yeah. Well, it's both, right? And I don't think you can manage a world where AI is run amuck with human processes. I think you need AI to secure AI. And I thought about G2's comments and I've asked some security process question like, we don't really know what this new norm looks like. And so when you're trying to understand behavior, what's anomalous and what's real, do you actually have the baseline to fully understand that? And most of the people I talked to said they don't think we do, right? And so, there is a bit of a learning curve here. But I think that's where AI can help accelerate it. It takes people a long time to go through the data, understand and create those patterns, and understand what the baseline is so then you can take action, as G2 said. And so, AI can help us shorten that. But if you're a security team today and you're not on board with AI, you are going to fall behind very quickly because there's no stopping the train here, right? I mean, once Jensen says something, the cat's out of the bag and people are going to start using it. What's interesting actually about the claws, Dave, is everybody I've talked to that's deployed OpenClaw or some variant of it has done it on an air gap machine because they do not trust it to do the outcomes that they want to do.

Dave Vellante

>> I mean, I was talking to Lena Smart. She's a former CISO of MongoDB. And I was like, "You using OpenClaw?" And she goes, "Absolutely." And she goes, "But I know how to secure it." I'm a CSO. But to your earlier point, I mean, there are a lot of unknown unknowns here, the rubric of known-unknowns, known-knowns, etc.

Zeus Kerravala

>> More so than ever, right?

Dave Vellante

>> The unknown-unknowns are kind of scary and I think the known-unknowns people are sort of going after here. Christophe, to your point, I mean, it is an AI show. But it's interesting you had Eric Bradley on yesterday and the data suggests that cybersecurity is getting a healthy share of the budgets. They're not declining. They're increasing. AI is definitely increasing, but not necessarily at the expense of others. Cloud security may be flat a little bit, but identity's up, posture management is up. I mean, they're investing across the board in security, which is a positive. I think the market probably doesn't understand that, has it wrong, they're just calling it SaaS. "Oh, it's SaaS. CrowdStrike, oh, they're in trouble." So, that's an interesting dynamic that I think the market does have wrong.

Zeus Kerravala

>> No, the capital markets have acted very strangely. I don't think there's a question that, at the end of this, like if we look back two, three years from now, five years from now, there will be a big net increase in security spend. Now, where's that money going to come from? Well, I also think that we're going to be a whole lot more productive than we were before. We spend way more money on cyber than we did pre-internet, but people generate so much work than they did. And so the offset's worth it, obviously. And I think we're going to see the same kind of transition. And it baffles me that you look at Netskope since it's IPO, it's like one-third to price. zScanner's taking that big haircut, Palo's taking a big haircut. And I find it unfathomable that the street doesn't understand that security is as big a part of AI as the GPUs or the network. And so, you see the premium applied to those stocks and not to the security stocks. To me, it seems very counterintuitive.

Dave Vellante

>> Although NVIDIA's trading at maybe 20 times forward PE? I mean, we heard Jensen last week say he's got a trillion dollar backlog.

Zeus Kerravala

>> I thought that would pop the stock actually.

Dave Vellante

>> You would think, but it basically sold off, which is fascinating to me. And ARM announced, I think yesterday or two days ago, they're going to manufacture their own CPU or design their own CPU now as opposed to just license. They have the license model. That's a big move for them. I mean, they are pretty rich. And you look at all the other sort of silicon companies, Broadcom and others, are priced to earnings higher than NVIDIA. And yet they're driving the whole industry. So, I think there's a couple things there. I think people are just, "Wow, it's over four trillion. I mean, how high can it go? Law of large numbers." Jensen said they're actually accelerating growth. I think the other thing is, maybe people are concerned about Taiwan. There's an article in the Journal today that Trump is maybe okay with Xi taking Taiwan. Every word matters. "We're supportive of," which is not what the language is today, is different from "we object to." So we'll see what happens in May if Trump and Xi-

Zeus Kerravala

>> I do think from the investors I've talked to, everybody understands there's going to be net winners and net losers through this transition and it's not clear who those are going to be. We can guess, but I feel like investors right now don't want to stick their neck out and make that call too early which is a job to do though.

Dave Vellante

>> I think you agree. I think most people agree that NVIDIA is going to be a winner.

Zeus Kerravala

>> Yeah.

Dave Vellante

>> And the question is, okay, what's their runway? We think it's pretty substantial, as long as the innovation keeps coming, which it seems to be.

Zeus Kerravala

>> And I don't think people understand the moat they have either.

Dave Vellante

>> You're right. I mean, you hear all the time, you see articles of NVIDIA's moat is eroding because of TPUs or Trainiums or Mayas or Broadcoms or A6 or whatever. I think that's nonsense. I mean, you look at what he put forth, what Jensen puts forth every year, it's just remarkable. I think the harder one is software. I get why people are saying, "Okay, the multiples maybe should be compressed because of the discounted cash flows. If Anthropic's going to compete, maybe they're not as valuable." But I see what Palantir's doing and Salesforce is doing and others, and they're making investments in agentic and they're going to be able to add value. They're not all going to make it through. I do think we're going to see some consolidation like we saw with... Remember Manugistics and all the pre-SaaS companies that got consolidated, Siebel and others, that will happen. But the ones like ServiceNow and Salesforce, I think are going to actually do quite well in this era.

Zeus Kerravala

>> Yeah. And this is where the narrative around SaaS going away is a little, to me, ridiculous. What is SaaS? It is an interface into the data that sits behind it. And I do think that's going to change. And so, a decade from now, maybe there's no Salesforce dashboard. We just use a bunch of agents. But the data is still the data. It's still the big system or record that companies use. It's still the crown jewels of the organization. We just access it differently. And so, when you want to try and project out the winners and losers in the SaaS space, it comes down to who's got the most valuable data and can they make it easily accessible and frankly open to as many different AI agents as possible.

Christophe Bertrand

>> Exactly. So, let's talk about that because there are two things from just an architecture standpoint, data is still everything. It doesn't matter. And right now, data is not being protected enough. It's not being managed enough and we're trying to do a lot of AI with it. Now we're sort of building the plane as we're flying it. You cannot wait, right? You cannot wait to get everything done right with your data before you get into AI projects or you're going to be dead in the water as a company. But at the same time, what we're seeing now is people being well ahead of their skis and doing crazy stuff with non-compliant, not really secure agents and data. But what I'm curious about is, we know it's all going to be about the data. So why is it that data companies are not seeing more of... I don't know, more of a push or more visibility? Do you have to call yourself AI to be visible and get the attention of the industry? Or is actually the real infrastructure play on compute? Yes, I get. But isn't it actually around the data itself?

Zeus Kerravala

>> Yeah, I think there's a bit of prove it here and I think probably investors are waiting to see which ones get the uplift and can they actually monetize it. In fact, this came up in a lot of the conversations I had here from the security vendors. How do you price your product moving forward? Are you actually charging by token? Are you charging by utilization of the product? And if it's consumption-based, what's the net effect? You take the customer service space like a Salesforce or a Genesis or something, right? If you charge consumption, does it fully offset the loss of seats that you had before? And so, we're so used to one pricing model. And you think about it, anytime companies go through a repricing strategy or a business model change, you think of every company that's gone from perpetual to recurring, stock takes a big hit because the revenue takes a hit and then it starts to grow again.

Dave Vellante

>> Splunk's going through that now. I'm like, still? Where you guys been?

Zeus Kerravala

>> Chuck called it on the earnings call.

Dave Vellante

>> I know. But it's 2026. It's surprising. Were you in the analyst session with Jensen?

Zeus Kerravala

>> Yes.

Dave Vellante

>> Okay. Remember he said the most important slide that I showed was the Pareto, the XY. So, imagine on the vertical axis is throughput and the horizontal axis is, they called it, responsiveness. So think of it as latency, but it's more than that. It's responsiveness. And the vertical axis, that's kind of the training axis. And what he had is three curves. He had Hopper, Blackwell and Vera Rubin. And each subsequent curve was much higher throughput and the curve would tap out much later as you got higher up, meaning you'd be able to have sustained throughput and latency longer. And the gap between Blackwell and Vera Rubin was like 35X. I think I got that right. Or was that Hopper and Blackwell? I can't remember. But each subsequent generation, much more than Moore's law delivered, which was doubling every 24 months or 18 to 24 months, you're talking about 10X plus or more every year. He was talking about 10,000X in a couple of years. And so, quite amazing. Now, the reason I bring this up is because it relates to your point about pricing. He said every CEO needs to understand where they are on that Pareto curve. In other words, are you selling throughput like hyperscalers and NeoCloud selling training because every time you get to his old buy more, make more because my price goes down, my performance per watt improves. Or are you on the horizontal axis, which is where say OpenAI is with a freemium model, $20 a month, a $200 a month, or where Anthropic is going with coding and others, Codex with OpenAI, much, much higher cost. And he's saying, "You have to figure out where you are on this token. Are you on the vertical axis or the horizontal axis or both?" Why do I bring that up? Because the future is AI factories are manufacturing intelligence. You're going to tap that intelligence into that intelligence by paying for tokens through APIs. So the question I have for you guys is, what does that mean for the security business revenue model? Is it an ongoing service that is monitoring? Is it my AI SOC that is generating tokens that I'm paying for, not per token, but per outcome, reducing my risk by some amount? But it's ultimately comes down to the cost model. The economics come down to how much I'm paying for tokens and how much value I can create out of those tokens. What does that mean for the security business model?

Zeus Kerravala

>> That's a great question. In fact, I can't remember who I was talking to about this yesterday. They said customers sort of expect just stuff for free now, right? Like we add it in and they just... But Mike Rich from zScaler was talking. Customers are going to have to pay up for this sometime down the road. And I don't know if we know what that model is. I do think it'll be some element of token consumption and I think it will be tied to outcomes. I think the hard part too is doing the security insertion. Because if you listen to Jensen, he's trying to accelerate the throughput like as fast as you can and get rid of all the latency. So, you make a query and you get the answer, but can you do that securely without introducing some latency, right? These security tools don't work at line rate very often, right? There's always some sort of intermediary in there. But from a security pricing model, I think there's an opportunity if you can get to outcome-based and start showing, "This is what we blocked. It's protected your organization. You saved this much," things like that. The other opportunity for the security industry, and I've talked to a lot of people about this, is security historically has been the thing that gets in the way of the company. And if you remember Matt Garmon's analogy at Cisco's AI summit where he said, "If I put a plank across two peaks, I'm going to crawl across. If I put up handrails, I'm going to run across." So, the security industry has an opportunity to change its narrative and instead of being the department to know, be the underlying governance and security foundation that lets the company come out of the blocks running. No longer are you a business inhibitor. You're a business accelerator. Move as fast as you want because we're going to protect all the stuff you want and then if you can do that, now you can change your pricing model and start charging a lot more through consumption or tokens or whatever, because you're allowing the business to really crank up the speed at which it's working.

Dave Vellante

>> Yes, as a service.

Zeus Kerravala

>> Yeah.

Christophe Bertrand

>> Well, service is great, but I think the biggest issue I see is-

Zeus Kerravala

>> Well, that's actually a good way to think about it. Yeah.

Dave Vellante

>> I mean, you'd pay for that as a business.

Zeus Kerravala

>> Yeah, you would. Yeah.

Christophe Bertrand

>> But before you can come to a conclusion, what is security anymore? I mean, that's the biggest question I have. You want to price something out. Yes, of course, I think there'll be some tokenization component, et cetera.

Dave Vellante

>> What is security?

Christophe Bertrand

>> But what is security anymore? Is it recoverability, which would be what a Veeam or a ConVaT will talk to you about? Is it about identity management? Is it about managing agents? Is it about managing the data and making it secure because we agree data is really the lifeblood of the business. So, I think we need to see a little more consolidation, see where the chips fall, and I think that will dictate or drive a lot of how the pricing is done because you're talking about people coming from very different places. And of course there's going to be an economic reality to it. But with the levels of productivity we're talking about here, whatever we say now is probably a moot point in about six months.

Zeus Kerravala

>> Yeah. So that's a great point. And you had an on to ?

Christophe Bertrand

>> Yeah.

Zeus Kerravala

>> So, they to me are the most fascinating company right now because they have this traditional data resilience plan, backup and recovery. What is more boring than that stuff, right? And they've added this security component and they've gotten very granular in what they can recover. So, you want to talk about being secure, have the Dave Vellante agent go have at it. It deletes something, but right away, if you know that's bad, it can go recover, do micro-recovery to that exact moment in time. And so, I think one of the interesting things to watch for in this industry is how data resilience and security and cyber resilience come together to allow us not just to tell us, "Hey, something bad happened," but then be able to recover to that exact moment in time that we need. And if we're going to allow agents to run amuck, we have to have the capability.

Dave Vellante

>> And I think that becomes almost table stakes. We heard Bipol kind of talking about similar capabilities. I presume Cohesity has it and CommVault has its version of that.

Zeus Kerravala

>> They don't really have the security side. They've got the recovery.

Dave Vellante

>> Right, with their whole res ops. But most certainly, Rubrik talks that language.

Christophe Bertrand

>> And everybody has partnerships and great APIs.

Zeus Kerravala

>> But then do the cyber vendors, the Palos, the ? They should be thinking about partnering with some of them, right?

Dave Vellante

>> Yeah, for sure. The last thing I wanted to touch on is something you and I talked about on a breaking analysis a while ago, platformization and how real it is. We had data at the time from our partners at ETI that suggested that it ain't happening. There's new data that suggests at least some evidence, not necessarily of platformization, but consolidation. I'll share it with you. In 2024, there's a survey of over 500 CISOs. 9% said that they were able to decrease the number of vendors in their security stack. That number in 2026 is only up 1.10%. But those that said they're able to keep it flat has gone from 37% to 52%. And those that have said they are increasing the number of vendors in their stack has dropped from 51% to 35%. And to me, that last stat is the most significant. So, we're seeing the stemming of the increase in the number of vendors and the reasoning used to be we're increasing because we need to fill holes. Now, that's not the case. So, there is some evidence of consolidation. And you and I talked about this. I asked you at the time, I don't know if you remember this. What's going to be an indicator on that percent that can decrease? What's it going to be an indicator of platformization? And you said about 30% would be an indication of success of platformization. And I asked Nakesh that, he kind of danced around it and it's already happening and 100% kind of thing. But 30% was your metric, if I recall.

Zeus Kerravala

>> Yeah. And so I still think both can be true. In fact, if you go down in the Expo Hall, there's a bunch of new vendors I've never heard of before.

Dave Vellante

>> Yeah, I know, giving free cab rides.

Zeus Kerravala

>> And so here's the thing. Platformization is happening. There's no question. And so if you look at like a next gen firewall, what is that? It's a network security platform. Before, you used to buy an IPS, you used to buy a DDoS platform, you used to buy a firewall, right? You used to buy a VPN. Once those features become standardized, they get sucked into the platform and SaaS is the same thing, right? CASB, SWG, right? Those were all separate platforms, they've all consolidated down. So, as features standardize, they get rolled into these platforms. I think what happens is, I'm curious to see if that data stays that way because I'm expecting a big rise in AI security vendors. And so, generally the innovation curve has stayed ahead of that commoditization curve or the standardization curve, which is why companies are platforming and growing at the same time. I think the magic for the platform vendors though, and this is where I think they need to do better work. I asked Anand Oswald from Palo about this best to breed versus platforming. "Well, we are best to breed everywhere we have product." And I'm like, well, you shouldn't need to be.

Dave Vellante

>> You've always said that.

Zeus Kerravala

>> Yeah.

Dave Vellante

>> I remember going, back to Palo Ignite 2022, that's the first time we had that conversation. You don't need to be best of breed and a platform player.

Zeus Kerravala

>> Because the platform itself provides best of breed outcomes.

Dave Vellante

>> Yes, right.

Zeus Kerravala

>> Right? And so that's, to me, the challenge for the platform vendors is, what are those outcomes and can you prove them?

Dave Vellante

>> But it's marketing. All right, we got to go. Zeus, thank you so much. Christophe, appreciate your time. Keep it right there. This is Dave Vellante for The Cube. We'll be right back at RSAC 2026. We're live. Next guest in a moment.