Data Protection & AI Summit | George Biry, Index Engines

Clips
News
More from Data Protection & AI Summit

Christophe Bertrand

Principal Analyst

SiliconANGLE & theCUBE

George Biry

Strategic Channels and Alliances Manager

Index Engines

play_circle_outline Empowering Cyber Resilience: George Berry and Index Engines' Strategic Partner Ecosystem in EMEA

play_circle_outline History of Index Engines: 20+ years in indexing data and searching within enterprises.

play_circle_outline AI as a dual-force: beneficial for cybersecurity but also exploited by cyber attackers.

play_circle_outline Strengthening Data Protection and AI Resilience: Collaborations, Trust, and CyberSense in Modern Business Strategies

Info
Transcript

George Biry, Index Engines

Christophe Bertrand

Principal Analyst SiliconANGLE & theCUBE

HOST

George Biry

Strategic Channels and Alliances Manager Index Engines

George Biry, strategic channels and alliances manager at Index Engines Inc., joins theCUBE’s Christophe Bertrand at the Data Protection & AI Summit to explore how artificial intelligence is transforming cyber resilience strategies. Drawing on Index Engines’ 20-year legacy in data protection, Biry walks through the evolution from indexing tools to the company’s flagship solution, CyberSense.

Biry shares how AI is being weaponized by attackers — and how Index Engines is fighting back with ransomware detection and data recovery capabilities that prioritiz... Read more

explore Keep Exploring

What is George's role at Index Engines and how does he contribute to the company's operations in the EMEA market? add

What is the history and origin of Index Engines and its solutions for enterprise data search? add

What impact is AI having on the evolution of ransomware and the strategies of cyber attackers? add

What are the challenges associated with trusting data for AI applications and how can AI infrastructure be protected against attacks? add

bolt Powered by CUBE AI

George Biry, Index Engines

search

Christophe Bertrand

>> Hello everyone and welcome back to the Data Protection and AI Summit. I'm joined today by a very, very interesting company called Index Engines and specifically one of their channel and cyber resiliency specialists, George Biry, who is joining us today from the UK. George, I believe you cover the EMEA market. Tell us more about yourself, about Index Engines, about what you do.

George Biry

>> Yeah, thank you Christophe, and thank you for having me here. Very happy to be here. So as you mentioned, I'm a solution specialist for Index Engines based here in EMEA. And my role within the company is to drive our value proposition specifically around cyber resilience and our product CyberSense, to drive that value proposition through our partner ecosystem. So we have a very broad partner ecosystem. We work with a variety of different partners, and my role is to basically get those partners to be successful in driving that value proposition within their organizations, and most importantly, out to the end customers.

Christophe Bertrand

>> Yes, and it's absolutely key to have an ecosystem. Nobody can do this alone, and I think a lot of your end users and clients definitely leverage the expertise that the channel partners bring to the table. So an absolutely essential part of the conversation here. George, I think people probably need to know more about Index Engines because it's quite an interesting solution, very interesting organization. I will say you're not a startup. You've been in this business for a while and you've achieved a lot in support of cyber resiliency with your solution. Could you give us a quick history and then maybe we'll switch into more of a solutions conversation, but let's start with that.

George Biry

>> Yeah, yeah, certainly Christophe. So yeah, as you mentioned correctly, Index Engines, we're not a recent startup organization. We've been in business for some 20 plus years and we originated, as the name implies, we originated on the indexing side of the business. And actually our solutions that we brought initially to the market were to help enterprises be able to search within their data and to pull out relevant information. So at the time, if you look back some 20 years and you think about Google, Google came into the marketplace that became very good at helping customers search the internet. Well, Index Engines was tasked by their customers with optimizing a way to be able to search the enterprise. And what we came up with was a very clever algorithm, set of algorithms where we're able to search that data, search the data within an enterprise, and where does that data reside? It resides in the backup, and we're able to search the backup data and pull out relevant information and do it at volume, do it through millions of data objects, data sets, be they files or databases, pull the relevant information out. So that's really the original heritage of Index Engines. And then the next step within the organization was we were saying, okay, you're able to index so well, you're able to go after data so well and pull out the relevant in- depth information within the data. Are you able to compare the changes of data over time? Are you able to observe whether data has changed in a manner that could be indicative of a ransomware attack? So we basically leveraged on top of that some machine learning and we leveraged a very, what I call the crown jewels of our organization, which is our CyberSense research lab. We built a lab that was basically able to look at that data, look at it in-depth, and be able to understand at the byte level whether changes in data, and we're talking about millions of data objects are indicative of a ransomware attack. So that resulted in the product that we bring to market today called CyberSense. And CyberSense is the leading industry offering in terms of being able to detect the presence of a ransomware attack within a data set, and to be able to help customers recover from a ransomware attack and to have insurance that the data that they're recovering as the highest level of integrity within it. So that's a brief history of the organization that brought us here today. It took 20 years, a lot of engineering effort, but we are an industry leader in terms of being able to provide that level of cyber resilience to our end customers.

Christophe Bertrand

>> Thank you, George. And we'll talk about that in more detail. Actually, there's a great slide that I'd like to bring up here that's really an architectural slide that I'd like to talk to you about because it really captures what you were just saying about the AI power, the machine learning, the training that goes into your engine to truly understand what's going on at the byte level. Detect here we have 99 point 99% of ransomware. I mean, those are very interesting numbers given the consequences of an event being successful. I think this allows you to do based on all the sources you input, it really allows you to provide an environment I think that at the end of the day provides better RPOs and RTOs for organizations. What can you tell us about the architecture here of the solution and really what you do in the lab, because that's an interesting component. You literally detonate some of these ransomware executables to see what happens.

George Biry

>> That's absolutely right, Christophe. We detonate these ransomware executables, and what we do within our lab is we collect millions and millions of these datasets from customers. Files, databases, all different types of objects that are coming from customers. It could be actual anonymous data that customers have provided us. It could be files that were generating. We have a repository of these files that are residing within our CyberSense research lab. And then in addition, what we do is we subscribe to providers of ransomware variants, and these are industry available ransomware variants. They come in all different types of varieties. We take these variants, we compile it with other sources of ransomware, and then what we do is we inject it into that environment in a controlled manner and in a safe manner. And then what we do is that ransomware that we've detected or that we've detonated, it goes about and it goes about affecting these millions of files, maybe a subset of them, maybe a good number of them. And then what we do is based on that, and then once again, leveraging our indexing capability because the indexing capability that helps keep track of all these millions of datasets and leveraging this indexing capability to be able to observe how these files are being affected over time and whether the nature of the changes within these files are indicative of a ransomware attack. So we train the machine learning on this, and basically what we're looking at is we run these algorithms over and over again, leveraging the machine learning, leveraging the AI, and we basically look to get to a point where we're able to detect, be able to eliminate false positives and be able to actually be able to understand with 99. 99% precision that when we think there is a ransomware attack in a particular file, that is indeed the case.

Christophe Bertrand

>> So it's a very powerful solution. And of course, we've mentioned AI multiple times. So I'd like actually to take a step back and look at both sides of the coin with you, now that we've established how you do things, and we've talked a little bit about how AI can be used as a friend in this case. Let's talk about how, and we'll come back to that, how can AI is used today as a foe by the cyber attackers. So what are you seeing and how does that play out in the context of the partners you work with in the channel and the end-users leveraging?

George Biry

>> Yes. So AI is a foe. It's interesting, and I think you touched on it, Christophe. I mean, AI is in many ways, it's a force multiplier. It's a force multiplier for good, and it's a force multiplier for bad. And when we think about it in the context of AI as a foe, even if you look before when AI became prevalent and became a buzzword within the industry, what we were seeing was that ransomware was becoming more and more powerful. And what we were finding was that the traditional ways in which bad actors, the ransomware providers were affecting data, they were going well beyond total encryption. They're actually starting to do things such as partial encryption or slow encryption, and they were actually affecting customer data in a manner that was very, very difficult for traditional detection methods to spot a ransomware attack has occurred. So that's essentially what was happening before AI, and they were getting actually more and more sophisticated. And then with the advent of AI, essentially what it provided was it was an accelerator and it essentially provided with these ransomware providers the ability to accelerate the generation of ransomware code and to generate the detonation of it and to essentially become more sophisticated in how they actually penetrate a network. The traditional phishing that we see, which used to be the old email that would come in from a source that you think you trust and you click on a link and next thing you know you've given away some valuable details. With AI, that's become even more and more sophisticated. So what we're seeing is that AI is a foe and these ransomware individuals that are actually causing havoc within these networks, they're using leveraging AI to generate code and to essentially be more effective in attacking organizations.

Christophe Bertrand

>> Yes, and it's not just that the ransomware is getting better and smarter, it's also leveraging AI to be deployed more easily and literally at a broader scale in many ways. So I was thinking about the other capabilities that CyberSense brings to the table. So how would you say AI is now changing the game, and what do you expect in terms of that attacker side? What do you think they're going to go after next? And one of the things that comes to mind is those AI- powered cyber attackers leveraging those capabilities and AI itself to go attack not just the infrastructure, the data, but also AI investments, maybe injecting prompts and things like that. So what's your general view on where this is going and what are your partners saying as well? I'm curious about that.

George Biry

>> Yeah, I think a lot of these conversations I'm hearing from our partners are exactly that. When they think about the prevalence of AI in the industry, it's appearing in so many different areas. I mean, ChatGPT, which we know so very well, supply chain, AI making supply chains much more efficient and actually helping organizations be more streamlined. And I think the concerns that we're hearing from partners and reflecting back what they're hearing from customers is that as AI becomes more and more prevalent and more and more used as part of the business processes, the attack surfaces are being more and more exposed and they're being more and more automated, and there's a possibility that they couldn't be as well surveyed as they could in the past. So that's some of the feedback I'm getting from our partners with that respect.

Christophe Bertrand

>> Right, and this brings up a few other topics we've are discussing during the summit, which is you have to be able to trust the data in order to use the data to do AI with for business outcomes. So you think about the AI infrastructure itself being the target of AI-powered attacks, and then maybe the data being affected. So you can't even do AI with it. You get into this whole trust conversation. So I think clearly for me, having the type of capabilities you've described to be able to defend against AI as a foe is key. And I'd like to switch that back to that a little bit more because there's much more to uncover with CyberSense. So AI can be your friend. Clearly your engine has been developed over the years from ML to now ML-AI leveraging what was essentially an indexing data classification type of technology to really bring it, pivot it to this very, very powerful engine that leverages AI to be your friend, to defend your environment, to provide better cyber resiliency, better data protection. So how do you train AI? How is AI a solution? Our viewers are probably thinking and maybe confused. Okay, AI is definitely an enemy. It's definitely something I need to go build. Can I make it my friend to defend myself?

George Biry

>> Yeah, absolutely Christophe, and that's a great question. I mean the whole AI as a foe versus AI as a friend conversation. So when we pivot to AI as a friend, a couple of things come to mind in conversations I have with partners and reflections on this subject. The first thing is when you think about AI and deploying it potentially as a friend, one of the first things one needs to ask is how is it that I'm using AI? Am I using it as a tick box exercise or am I using it as actually generating real value and real ability to help safeguard my data? That's one of the first things that you want to have a look at when you're looking at AI as a friend. The other thing you want to ask yourself is is the AI actually able to investigate and protect data at the level of depth and accuracy that it's required to? And an analogy that one could draw on this is maybe you could take a sports analogy or even take a strategy game analogy, let's say chess or even another strategy game like poker. And let's say if somebody wants to be able to play chess or engage in poker and be very good at these two strategy games, then one would need to train and one would need to train with specialist coaches. One would need to train with specialist software. One would need to train against specialist foes, and it's through the training that one gains a skillset to be able to combat. So in the sense now of cyber resiliency, when you think about our CyberSense solution and work that we're doing in the CyberSense research lab, what we're doing is we are training our AI against the very latest and very best of malware that's being ejected into the data. So it's a constant training process. And what we're doing is we're making our AI and our CyberSense software as strong as possible to detect the malware variance and to be able to understand the evidence of data corruption, not just at the metadata level, but deep inside the files to look at the byte level, to look at the bit level, to look at how the data is evolving over time and to be able to detect with that 99. 9% accuracy that a CyberSense and a cyber attack has occurred. And that's really unique differentiator in what we do. You have the slide in front of you, the CyberSense research lab, it is our crown jewels within Index Engines. It is really where the secret sauce of our software generates from, and it's triggered to a lot of hard work by our engineering team that they've been working on this for a number of years.

Christophe Bertrand

>> Exactly, and that's what I was mentioning when we started this conversation. You're not new at this. This is something you've been doing for a long time, which is why you were able to really take the business from indexing to this extremely deep and broad engine that understands essentially the threats hitting the data itself. And again, I go back to this topic of trust in data, trust in data for your business, trust in data for mitigation of risk, but also for again, using for AI. So what's beautiful here is that you are essentially leveraging AI to combat AI- powered attacks in order to make the data usable for AI, for business AI outcomes that will bring value to the business. So this is sort of that the perfect triangle here in many ways. So let's double click on a couple of topics here, George, because I think there may be a full sense of security that happens when you hear, okay, I'm training my defense mechanism with AI. Well, there has to be a quality factor in the training. How do I, as an end user, considering your solution, look at that? How do I evaluate that you have the right mechanisms in place and what are you hearing from your partners and maybe some customer anecdotes in this area?

>> Yeah, so if I first speak to the quality of the training

George Biry

>> that our software undergoes in our research labs, there's a couple of key benchmarks that we train the software against. The first one is our SLA that essentially we're looking for our software to be able to detect a cyber attack within an organization and to report on that cyber attack with 99. 99% accuracy. That's our first SLA that we look at is to make sure that we're able to detect with accuracy. And delving a little bit deeper inside how we actually do this as the AI is training, once the software is detonated, or I'm sorry, once the ransomware is detonated within the research labs, what our machine learning and AI does is it actually goes in and investigates using the indexing. And essentially we have machine learning processes that are running in parallel and they're separate independent machine learning processes. They're running the same kind of processes, but they're doing it in parallel. And essentially what we're doing is each one of those processes is individually going after the millions of data sets that have been impacted and coming up with their own score, their own SLA score as to their ability to detect with accuracy. And as only when we get alignment across those different independent processes that they're all within the 99. 99% benchmark, are we confident that the software is at a level to be able to detect malware across all those millions of data sets with that 99. 99% accuracy? So that's a perspective from a technology point of view, from a partnership point of view, what we tell our partners, and it's quite important because many of our partners are coming from a cybersecurity background, and many of our partners are, they specialize in the prevention, preventing unwarranted access to the networks or unwarranted access to the data. And what we're telling our partners and what we're giving them a lot of confidence is that, okay, you may be very good at delivering those kinds of solutions and they are state-of-the-art robust solutions, but it's very important for you to articulate a message to your customers, a quality message to your customers that are saying that not only you going to be very good at preventing unauthorized access. You're also going to be very good at ensuring that when a cyber attack occurs, not if, but when a cyber attack occurs, you're going to be able to have full confidence that you're going to be able to find your goal copy data sets and bring them back into production. So actually, we're helping our partners talk to their customers about a complete end-to- end security solution for their environment.

Christophe Bertrand

>> And this is very powerful because at the end of the day, that's what I was mentioning, it's about recovery and recoverability and your partnerships and your alliances go beyond channel partners. It's also companies like Infinidat, a discussion definitely that we're going to be having also in this summit with Index Engines and Infinidat. So look, George, we've covered a lot of ground. You've given us a lot of great information. I think there is no question that a lot has to be done to make AI your friend in defending against AI- powered attacks. So this friend and foe conversation will probably go on for years to come, and it was great to hear more about Index Engines. George, thank you so much for joining us today.

George Biry

>> Thank you. Thank you, Christophe. It's been a pleasure.

Christophe Bertrand

>> And to our viewers, thank you very much. Please stay tuned. There is more coming up in an instant. My name is Christophe Bertrand, Principal Analyst here at theCUBE Research.