Dreamforce 2024 | Adrian Kunzle | Own

Clips
More from Dreamforce 2024

Adrian Kunzle

Chief Technology Officer

Own

play_circle_outline Shared responsibility model for data protection in Salesforce environments.

play_circle_outline Leverage of APIs and AI in data protection and analysis for Salesforce.

play_circle_outline Importance of independent data backups for ransomware and cyber resilience.

play_circle_outline Exploring Compliance and Governance in Data Protection Solutions: AI Utilization, Archive, Anonymization, and Privacy

Info

Adrian Kunzle | Own

Adrian Kunzle

Chief Technology Officer Own

search

Christophe Bertrand

>> Welcome to theCUBE. We're at the New York Stock Exchange Office in San Francisco, and we're covering Dreamforce 2024. After a great keynote this morning, I have the pleasure of welcoming Adrian Kunzle who is the CTO of Own. How are you?

Adrian Kunzle

>> I'm very well. Thank you, Christophe.

Christophe Bertrand

>> Well, we've known each other for a while. We've talked a few times in the past few years about the fact that somehow people think that there are magical people in the cloud backing up your size environment and specifically namely Salesforce. Why isn't that true?

Adrian Kunzle

>> Well, it really kind of all boils down to the shared responsibility model, right? There is a lot of things that Salesforce does do for you in the cloud. They worry about the network. They worry about your storage. They worry about the processing. What is fantastic is they even worry about the disaster recovery. You get full 100% disaster recovery capabilities. What they don't help you with is the data that you put into the SaaS application. And that's really where Own comes into play. That data, as they have repeatedly said, is your data. They don't get to use it, fiddle with it, whatever. And along with that responsibility of putting it in comes a responsibility of keeping it there. And if you think about these amazing SaaS solutions, they're full-blown platforms that have people with wide-ranging, access rights capabilities. There are admins working in there that you're developing things. You're doing new releases. You've got lots of integrations. All of those things put you at risk of either corrupting or losing some data. And so, again, back to that shared responsibility model, understanding what the SaaS provider is doing for you, but then understanding what you are also responsible for is absolutely vital. And one of the things you're responsible for is keeping the data in there.

Christophe Bertrand

>> Right. And it's interesting because there is actually a pretty large proportion of number of people do not understand the shared responsibility model. They say they do, but they don't really look at the numbers. And there are a number of other people who actually think, to my point, that there are magical people out there. So I think there's still a lot of education that's needed. Now, talking about Salesforce, obviously, there's been a lot of work through the years. They offered up a couple of key APIs for protecting the environment. The bulk API comes to mind, but obviously there's always that risk with an environment that you don't manage because, well, it's a service. That's the nature of the environment. That risk of entropy in a sense where you essentially are trying to catch something you can never catch from a backup standpoint. And of course, because it's a shared model, you're not running this in your data center. You can't snapshot a set environment. That would not be nice for other people.

Adrian Kunzle

>> No.

Christophe Bertrand

>> So what work have you done at the API level and integration level with Salesforce to be able to provide that consistency across what could be multiple, many, many levels within Salesforce?

Adrian Kunzle

>> So we work very actively with that team. I actually was at Salesforce for a number of years prior to joining Own, and that team was part of my organization, so I'm very familiar with what they've done. And it's been a great partnership. They produced bulk API v2 a few years ago, which helped a number of aspects of trying to get the data out. We've worked with them actively on getting files out, which proved actually to be a fairly slow process. But for some customers who have literally billions of files, it's a very, very important part of the backup. I think one of the things that has been the best part of working with Salesforce specifically is the richness of the metadata API. So we have had a principle in the company from day one that we literally back up everything. You actually have to do work to turn off certain pieces and customers do for security concerns as well. But we try and get everything. And the richness of the metadata APIs in the Salesforce platform have been great to just... If you add a new object, you don't have to tell Own, recover. It just finds it and starts backing it up. So this ability to be dynamic through the life of having our product has been, I think, a huge benefit to a lot of our customers.

Christophe Bertrand

>> Right, yeah. Because it's kind of complex. You have all of these records. You have, to your point, essentially it's a semi-structured environment, for lack of a better term. I don't like structured than unstructured, but I call it semi-structured. And you're right, for large organizations, and I mean Salesforce organizations, in this case, it could be millions, billions of files very quickly. So another concern that comes up often is, "Well, every time I hit that API, am I using my credit of governor limits?" How is that manageable? How do you potentially parallelize access? How do you optimize that?

Adrian Kunzle

>> So we have a engine on the back end. It's part of our secret source that flips between the three primary APIs that you can get data out of based on the work it's trying to do at the time. We also actively use the kind of the Delta API that says, "Give me all the records that have changed since yesterday." So that's a good way of getting a much smaller set out. So part of what we've built is the algorithms for auto-tuning. When do you use one? When did you use another? Which objects do you use? Which one is for, et cetera? And for the most part, we have had customers that have some API constraints. Not really at the volume level, but a number of simultaneous bulk jobs, for example. But that's really been it. In most of the cases, we fly well enough below the radar that it's pretty easy.

Christophe Bertrand

>> Well, that's important because obviously the last thing you want to do is slow things down or even shut down, get shut out of your environment when you're actually trying to protect it for very good reasons. Well, let's talk about a couple of hot topics. I'll start with the first one, ransomware, cyber resilience. So what's your take on ransomware in Salesforce environments? I know there are lots of protections in place, but the reality is it can affect access, it can affect lots of different parts of the infrastructure and not necessarily actual data, but it could also affect the data depending on how creative these people are. So what have you seen and what do you do to help in the context of cyber recovery, which is really what I'm interested in, the outcome, the recovery piece.

Adrian Kunzle

>> So I am unaware of any real ransomware attack on a Salesforce customer at this point, which is fantastic. That company spends a huge amount of money defending against this, which is amazing. But nevertheless, to your point, people say it's when, not if, right? And touch wood, nothing ever happens, but it is vital that you've got an independent copy somewhere else. And that's a lot of what our customers take a degree of comfort in. They obviously buy our data protection solutions for more than just the ransomware pieces, but you do have this independent copy. It is in completely different infrastructure. It's protected by completely different front doors, access controls, etc. And it's in a form that is relatively easily recoverable. And that goes in a couple of ways. You can obviously get at the flat files. So we've had customers that have experienced outages who have just pulled those files and distributed them to people so they can carry on working. Simple as that. With our new Discover product actually, there's also the opportunity to have yesterday's data available through an SQL interface. So you could also potentially build an alternative access path that way. And then obviously on the back end, we're doing a lot to make sure that it's on immutable storage and things can't change and that you've got validation. We have a specific product called Blockchain Verify, which allows you to provably demonstrate that the backups have not been modified at all. And so this separation of the data from the source system is really about the best that you can do in this world to try and prevent the ransomware attackers from going after your backups first and then going after your main data.

Christophe Bertrand

>> Right, absolutely. Because you're right. I mean, the access piece is what probably would keep me awake at night. Things can go wrong. People make mistakes. Ransomware attackers are pretty savvy, and if somebody gains access through your environment, it's pretty easy to go really wreaking havoc in an environment just because you have access, and that's unfortunate that it can happen. So lots of great initiatives here. So the other big topic, hard to miss AI.

Adrian Kunzle

>> Yeah, very hard to miss.

Christophe Bertrand

>> Heard about this one?

Adrian Kunzle

>> Just a bit.

Christophe Bertrand

>> So I'd like to ask you two questions in one, all right, which is, what are you doing in terms of data protection for AI, and then how do you leverage AI in data protection in your own solution? So first of all, okay, lots of AI activity. There will be more, lots of data being created, probably not as much as we think, but still I think that number is growing with new models and the need for more data to create more data. What do you do to protect AI environments in the context of Salesforce and then or extract or help extract some of that data, and then what are you doing in terms of leveraging AI for yourself?

Adrian Kunzle

>> Yeah. So for the first part of the question, the primary thing we've been focused on is how do we help customers activate all of that history? We are firm believers that in the world of AI and even in the world of analytics, your historical data is the fuel that can help drive your business forward. And it's bizarre when I think about it each time, just how hard it is to collect that historical data. It's typically not in the SaaS provider's environment. They often have audit history, but that audit history is not accessible in a normal way. We have literally a snapshot of the state of the org going back every day for as long as you've been a customer. So our main focus has been building this new product we call Discover. What that allows you to do is very, very simply pick the set of objects, relationships that you want, and we preserve the Salesforce structures and specify a time period. So if you want all of your contacts, your opportunities, your leads and your accounts for the last six months, we will pull all of that out of the backup and arrange it as a time series data set in an SQL or OData queryable engine. So you can bring a Looker, a Tableau, or your analysis tool of choice to the table and start doing as simple things as just trend analysis. If you're a wealth manager, if you are storing account balances in Salesforce, often it's through an integration and every day the banking system replaces the account balance with Salesforce. Well, you can't trend that number. You can if you go to the backups because you can see every day how that number has changed. So this ability to go trend certain values in the data set that you just can't with the existing systems is we think incredibly powerful and part of what we're enabling our customers to then lead into doing things like churn analysis, next best offer, those sorts of things as well. So that's been our primary focus. There are other things we think are really interesting in there specifically because our customers already trust us with their data. Event monitoring. And what is going on in your instance is we think actually we can bring an interesting dimension to that. Right now that is done typically off event logs, right? What does a user clicked on? What does a user? What report does a user run, et cetera? We can actually add data change into that. And so we have work going on internally to augment what is a normal user behavior stream with patterns that we see in how the data is changing and hopefully get to a point where we can detect malicious activity and other things that way. So those are our two focus areas. Discover is available now. We have customers using it, which is great. To your other point of protecting those AI models, we've explored that a little bit. I think you're absolutely right. We are starting to build models that have taken time to develop, time to train, and we're going to want to be able to snapshot those and maintain them. We don't have a product in that space at this point, but I do think that's a big opportunity going forward.

Christophe Bertrand

>> Absolutely. So a couple of things you brought up that are interesting. I think the fact that you literally own, pun intended all of the data and the history of it, let's talk about compliance and governance. I think that's another big issue that comes up often. And again, connected to the point around AI, you can't reuse data that's not compliant. It would be too much of a risk, but how do you know what's compliant or not? How can you help?

Adrian Kunzle

>> So a lot of what we've been doing in that space, and that's mostly around our archive product, is being able to allow the customer to define policies specifying what can't be kept and how to get rid of it. Obviously, some of that should no longer be actioned in the day-to-day operating system, but still needs to be retained for regulatory purposes. The complexity of the compliance space is just getting horrendous at this point and is a real challenge for, I think, many CIOs. So archive allows you to take data out of your operational system, get it away from people that might use it for things they're not meant to be using it for, but you can still retain it in the archive for whatever, seven years or whatever you need to keep it for, and then we get rid of it after that. The other piece that's really exciting is, so we've done a lot of work on our anonymization engine in our Accelerate product. We are now starting to turn that towards production because we've had a lot of customers request, "Look, I want to know that there was a record there, but I can't have the person's name in it, or I can't have any PI in it, but I want to know that that was an account," let's say. And so now we can use that anonymization engine to get rid of the sensitive data in the record, but keep the fact that, I don't know, the gamer played 255 games. These are the different game types, etc, etc. We don't know who they are anymore, but there's still a record there and that's useful for reporting. And potentially if that person comes back, again. Those are just a couple of examples of how the system has always been data privacy compliant and that you can lodge correction and forget requests. What we do, we don't actually modify the backups, but we mask them so that whenever they get read, the person that's asked to be forgotten's data just never appears again. So if you have to do a restore, you can guarantee that that person's data won't accidentally restore back in. And we propagate that actually into Discover as well. So if somebody ask to be forgotten, it'll propagate through to any of the backups in the Discover product.

Christophe Bertrand

>> Right. That was, I remember a few years ago. That was the biggest question that people had around GDPR. Well, we have to delete everything, forget people. And like, "Well, no, you can't. You have them in your backups and you don't want to forget them. They may have obligations."

Adrian Kunzle

>> Exactly.

Christophe Bertrand

>> Absolutely. So that's interesting. So what we're seeing is really the convergence or the confluence of cyber security or cyber resilience, data protection and compliance in many ways. So it's the new way of managing data. And certainly in SaaS environments, it's absolutely critical. Look, we've covered a lot of ground. Thank you so much for joining us today on theCUBE. And to our viewers, thank you so much for joining theCUBE. I'm Christophe Bertrand, principal analyst here at theCUBEResearch. We're at Dreamforce 2024 in San Francisco at the New York Stock Exchange Office. Thank you very much for watching us.

Adrian Kunzle | Own

search

Christophe Bertrand

>> Welcome to theCUBE. We're at the New York Stock Exchange Office in San Francisco, and we're covering Dreamforce 2024. After a great keynote this morning, I have the pleasure of welcoming Adrian Kunzle who is the CTO of Own. How are you?

Adrian Kunzle

>> I'm very well. Thank you, Christophe.

Christophe Bertrand

>> Well, we've known each other for a while. We've talked a few times in the past few years about the fact that somehow people think that there are magical people in the cloud backing up your size environment and specifically namely Salesforce. Why isn't that true?

Adrian Kunzle

>> Well, it really kind of all boils down to the shared responsibility model, right? There is a lot of things that Salesforce does do for you in the cloud. They worry about the network. They worry about your storage. They worry about the processing. What is fantastic is they even worry about the disaster recovery. You get full 100% disaster recovery capabilities. What they don't help you with is the data that you put into the SaaS application. And that's really where Own comes into play. That data, as they have repeatedly said, is your data. They don't get to use it, fiddle with it, whatever. And along with that responsibility of putting it in comes a responsibility of keeping it there. And if you think about these amazing SaaS solutions, they're full-blown platforms that have people with wide-ranging, access rights capabilities. There are admins working in there that you're developing things. You're doing new releases. You've got lots of integrations. All of those things put you at risk of either corrupting or losing some data. And so, again, back to that shared responsibility model, understanding what the SaaS provider is doing for you, but then understanding what you are also responsible for is absolutely vital. And one of the things you're responsible for is keeping the data in there.

Christophe Bertrand

>> Right. And it's interesting because there is actually a pretty large proportion of number of people do not understand the shared responsibility model. They say they do, but they don't really look at the numbers. And there are a number of other people who actually think, to my point, that there are magical people out there. So I think there's still a lot of education that's needed. Now, talking about Salesforce, obviously, there's been a lot of work through the years. They offered up a couple of key APIs for protecting the environment. The bulk API comes to mind, but obviously there's always that risk with an environment that you don't manage because, well, it's a service. That's the nature of the environment. That risk of entropy in a sense where you essentially are trying to catch something you can never catch from a backup standpoint. And of course, because it's a shared model, you're not running this in your data center. You can't snapshot a set environment. That would not be nice for other people.

Adrian Kunzle

>> No.

Christophe Bertrand

>> So what work have you done at the API level and integration level with Salesforce to be able to provide that consistency across what could be multiple, many, many levels within Salesforce?

Adrian Kunzle

>> So we work very actively with that team. I actually was at Salesforce for a number of years prior to joining Own, and that team was part of my organization, so I'm very familiar with what they've done. And it's been a great partnership. They produced bulk API v2 a few years ago, which helped a number of aspects of trying to get the data out. We've worked with them actively on getting files out, which proved actually to be a fairly slow process. But for some customers who have literally billions of files, it's a very, very important part of the backup. I think one of the things that has been the best part of working with Salesforce specifically is the richness of the metadata API. So we have had a principle in the company from day one that we literally back up everything. You actually have to do work to turn off certain pieces and customers do for security concerns as well. But we try and get everything. And the richness of the metadata APIs in the Salesforce platform have been great to just... If you add a new object, you don't have to tell Own, recover. It just finds it and starts backing it up. So this ability to be dynamic through the life of having our product has been, I think, a huge benefit to a lot of our customers.

Christophe Bertrand

>> Right, yeah. Because it's kind of complex. You have all of these records. You have, to your point, essentially it's a semi-structured environment, for lack of a better term. I don't like structured than unstructured, but I call it semi-structured. And you're right, for large organizations, and I mean Salesforce organizations, in this case, it could be millions, billions of files very quickly. So another concern that comes up often is, "Well, every time I hit that API, am I using my credit of governor limits?" How is that manageable? How do you potentially parallelize access? How do you optimize that?

Adrian Kunzle

>> So we have a engine on the back end. It's part of our secret source that flips between the three primary APIs that you can get data out of based on the work it's trying to do at the time. We also actively use the kind of the Delta API that says, "Give me all the records that have changed since yesterday." So that's a good way of getting a much smaller set out. So part of what we've built is the algorithms for auto-tuning. When do you use one? When did you use another? Which objects do you use? Which one is for, et cetera? And for the most part, we have had customers that have some API constraints. Not really at the volume level, but a number of simultaneous bulk jobs, for example. But that's really been it. In most of the cases, we fly well enough below the radar that it's pretty easy.

Christophe Bertrand

>> Well, that's important because obviously the last thing you want to do is slow things down or even shut down, get shut out of your environment when you're actually trying to protect it for very good reasons. Well, let's talk about a couple of hot topics. I'll start with the first one, ransomware, cyber resilience. So what's your take on ransomware in Salesforce environments? I know there are lots of protections in place, but the reality is it can affect access, it can affect lots of different parts of the infrastructure and not necessarily actual data, but it could also affect the data depending on how creative these people are. So what have you seen and what do you do to help in the context of cyber recovery, which is really what I'm interested in, the outcome, the recovery piece.

Adrian Kunzle

>> So I am unaware of any real ransomware attack on a Salesforce customer at this point, which is fantastic. That company spends a huge amount of money defending against this, which is amazing. But nevertheless, to your point, people say it's when, not if, right? And touch wood, nothing ever happens, but it is vital that you've got an independent copy somewhere else. And that's a lot of what our customers take a degree of comfort in. They obviously buy our data protection solutions for more than just the ransomware pieces, but you do have this independent copy. It is in completely different infrastructure. It's protected by completely different front doors, access controls, etc. And it's in a form that is relatively easily recoverable. And that goes in a couple of ways. You can obviously get at the flat files. So we've had customers that have experienced outages who have just pulled those files and distributed them to people so they can carry on working. Simple as that. With our new Discover product actually, there's also the opportunity to have yesterday's data available through an SQL interface. So you could also potentially build an alternative access path that way. And then obviously on the back end, we're doing a lot to make sure that it's on immutable storage and things can't change and that you've got validation. We have a specific product called Blockchain Verify, which allows you to provably demonstrate that the backups have not been modified at all. And so this separation of the data from the source system is really about the best that you can do in this world to try and prevent the ransomware attackers from going after your backups first and then going after your main data.

Christophe Bertrand

>> Right, absolutely. Because you're right. I mean, the access piece is what probably would keep me awake at night. Things can go wrong. People make mistakes. Ransomware attackers are pretty savvy, and if somebody gains access through your environment, it's pretty easy to go really wreaking havoc in an environment just because you have access, and that's unfortunate that it can happen. So lots of great initiatives here. So the other big topic, hard to miss AI.

Adrian Kunzle

>> Yeah, very hard to miss.

Christophe Bertrand

>> Heard about this one?

Adrian Kunzle

>> Just a bit.

Christophe Bertrand

>> So I'd like to ask you two questions in one, all right, which is, what are you doing in terms of data protection for AI, and then how do you leverage AI in data protection in your own solution? So first of all, okay, lots of AI activity. There will be more, lots of data being created, probably not as much as we think, but still I think that number is growing with new models and the need for more data to create more data. What do you do to protect AI environments in the context of Salesforce and then or extract or help extract some of that data, and then what are you doing in terms of leveraging AI for yourself?

Adrian Kunzle

>> Yeah. So for the first part of the question, the primary thing we've been focused on is how do we help customers activate all of that history? We are firm believers that in the world of AI and even in the world of analytics, your historical data is the fuel that can help drive your business forward. And it's bizarre when I think about it each time, just how hard it is to collect that historical data. It's typically not in the SaaS provider's environment. They often have audit history, but that audit history is not accessible in a normal way. We have literally a snapshot of the state of the org going back every day for as long as you've been a customer. So our main focus has been building this new product we call Discover. What that allows you to do is very, very simply pick the set of objects, relationships that you want, and we preserve the Salesforce structures and specify a time period. So if you want all of your contacts, your opportunities, your leads and your accounts for the last six months, we will pull all of that out of the backup and arrange it as a time series data set in an SQL or OData queryable engine. So you can bring a Looker, a Tableau, or your analysis tool of choice to the table and start doing as simple things as just trend analysis. If you're a wealth manager, if you are storing account balances in Salesforce, often it's through an integration and every day the banking system replaces the account balance with Salesforce. Well, you can't trend that number. You can if you go to the backups because you can see every day how that number has changed. So this ability to go trend certain values in the data set that you just can't with the existing systems is we think incredibly powerful and part of what we're enabling our customers to then lead into doing things like churn analysis, next best offer, those sorts of things as well. So that's been our primary focus. There are other things we think are really interesting in there specifically because our customers already trust us with their data. Event monitoring. And what is going on in your instance is we think actually we can bring an interesting dimension to that. Right now that is done typically off event logs, right? What does a user clicked on? What does a user? What report does a user run, et cetera? We can actually add data change into that. And so we have work going on internally to augment what is a normal user behavior stream with patterns that we see in how the data is changing and hopefully get to a point where we can detect malicious activity and other things that way. So those are our two focus areas. Discover is available now. We have customers using it, which is great. To your other point of protecting those AI models, we've explored that a little bit. I think you're absolutely right. We are starting to build models that have taken time to develop, time to train, and we're going to want to be able to snapshot those and maintain them. We don't have a product in that space at this point, but I do think that's a big opportunity going forward.

Christophe Bertrand

>> Absolutely. So a couple of things you brought up that are interesting. I think the fact that you literally own, pun intended all of the data and the history of it, let's talk about compliance and governance. I think that's another big issue that comes up often. And again, connected to the point around AI, you can't reuse data that's not compliant. It would be too much of a risk, but how do you know what's compliant or not? How can you help?

Adrian Kunzle

>> So a lot of what we've been doing in that space, and that's mostly around our archive product, is being able to allow the customer to define policies specifying what can't be kept and how to get rid of it. Obviously, some of that should no longer be actioned in the day-to-day operating system, but still needs to be retained for regulatory purposes. The complexity of the compliance space is just getting horrendous at this point and is a real challenge for, I think, many CIOs. So archive allows you to take data out of your operational system, get it away from people that might use it for things they're not meant to be using it for, but you can still retain it in the archive for whatever, seven years or whatever you need to keep it for, and then we get rid of it after that. The other piece that's really exciting is, so we've done a lot of work on our anonymization engine in our Accelerate product. We are now starting to turn that towards production because we've had a lot of customers request, "Look, I want to know that there was a record there, but I can't have the person's name in it, or I can't have any PI in it, but I want to know that that was an account," let's say. And so now we can use that anonymization engine to get rid of the sensitive data in the record, but keep the fact that, I don't know, the gamer played 255 games. These are the different game types, etc, etc. We don't know who they are anymore, but there's still a record there and that's useful for reporting. And potentially if that person comes back, again. Those are just a couple of examples of how the system has always been data privacy compliant and that you can lodge correction and forget requests. What we do, we don't actually modify the backups, but we mask them so that whenever they get read, the person that's asked to be forgotten's data just never appears again. So if you have to do a restore, you can guarantee that that person's data won't accidentally restore back in. And we propagate that actually into Discover as well. So if somebody ask to be forgotten, it'll propagate through to any of the backups in the Discover product.

Christophe Bertrand

>> Right. That was, I remember a few years ago. That was the biggest question that people had around GDPR. Well, we have to delete everything, forget people. And like, "Well, no, you can't. You have them in your backups and you don't want to forget them. They may have obligations."

Adrian Kunzle

>> Exactly.

Christophe Bertrand

>> Absolutely. So that's interesting. So what we're seeing is really the convergence or the confluence of cyber security or cyber resilience, data protection and compliance in many ways. So it's the new way of managing data. And certainly in SaaS environments, it's absolutely critical. Look, we've covered a lot of ground. Thank you so much for joining us today on theCUBE. And to our viewers, thank you so much for joining theCUBE. I'm Christophe Bertrand, principal analyst here at theCUBEResearch. We're at Dreamforce 2024 in San Francisco at the New York Stock Exchange Office. Thank you very much for watching us.