VAST Forward 2026 | Randy Hayes, VAST Federal & Robert Linger & Josh Salmanson, Leidos

Clips
More from VAST Forward 2026

Randy Hayes

VP

VAST Federal

Josh Salmanson

Vice President, Leidos Defensive Cyber Practice

Leidos

Robert Linger

VP Information Advantage Practice

Leidos

play_circle_outline Agentic tools/AI agents provide scalable triage and automation, reducing false positives.

play_circle_outline Data-centric approach: unify, clean, and connect telemetry for better AI-driven outcomes.

play_circle_outline Governance and Calibrated Trust Framework required for auditable, responsible agent actions.

play_circle_outline DPUs/GPUs (NVIDIA) accelerate computation enabling real-time access control and zero trust enforcement.

play_circle_outline Metrics evolving: mean time to know replaces traditional dwell time for detection effectiveness.

play_circle_outline Tool bloat problem: enterprises run dozens of overlapping tools, causing maintenance and integration burdens.

Info
Transcript

Randy Hayes, VAST Federal & Robert Linger & Josh Salmanson, Leidos

Randy Hayes

VP VAST Federal

Josh Salmanson

Vice President, Leidos Defensive Cyber Practice Leidos

Robert Linger

VP Information Advantage Practice Leidos

In this interview from VAST Forward, Randy Hayes, vice president of VAST Data, joins Rob Linger, vice president of information advantage practice at Leidos, and Josh Salmanson, vice president of cyber defensive practice at Leidos, to talk with theCUBE’s Dave Vellante about the critical intersection of cybersecurity and AI ROI. The experts analyze a shifting threat landscape where adversaries now breach environments in under 30 seconds, far outpacing traditional defensive alerting systems. Salmanson explains why modern security has evolved into a complex data ... Read more

explore Keep Exploring

How are agentic tools and sensor-based deployments being used to scale expert triage, address volume/velocity/variety problems, reduce SOC false positives, and mitigate deployment risk (for example via BlueField DPU–based sensors)? add

What challenges do organizations face when integrating multiple point products and specialized infrastructure to build low-latency, easy-to-manage AI systems for complex security analytics? add

How can federal agencies safely deploy autonomous AI agents (including agents managing agents) while ensuring trust, auditability, governance, and cost controls, and what frameworks—such as Leidos' Calibrated Trust Framework—address these concerns? add

Can zero trust be effectively deployed now, and how have newer architectures (e.g., DPUs and GPUs) improved the computational capability needed to enforce it? add

How are cyber incident detection and response metrics changing, what should be communicated to boards of directors about those changes, and how should success be measured? add

How will AI operating systems (for example VAST) change the cybersecurity SaaS landscape — specifically regarding tool bloat, ROI pressure on providers, and how organizations consolidate and deploy capabilities? add

bolt Powered by CUBE AI

Randy Hayes, VAST Federal & Robert Linger & Josh Salmanson, Leidos

search

Dave Vellante

>> Hey, everybody. Welcome back to Salt Lake City. My name is Dave Vellante, and you're watching our continuous live coverage of VAST Forward, VAST's first ever customer conference. All made possible by Solidigm. We've got a great panel here. We're talking about the most important topic probably in the industry, other than AI. Everybody wants to talk about AI, but really it's around security, cybersecurity. We've got three guests. To my right is Randy Hayes. He's the vice president of VAST Data Federal. And then Rob Linger, who's the Vice President of Information Advantage Practice at Leidos. And Josh Salmanson is the Vice President of Cyber Defensive Practice at the same firm. Gentlemen, welcome. Thanks so much for coming on, theCUBE. It's good to have you.

Josh Salmanson

>> Thanks for having us.

Randy Hayes

>> Thanks for having us.

Dave Vellante

>> This is a super important topic. At theCUBE Research, we've said that, look, 2026 has to be the year of enterprise ROI. And in order to get enterprise ROI, you've to have trust and security is at the heart of that. It can't be bolted on. It's got to be designed in. All the bromide that we've heard before. We're going to hear it at RSA this year.

Josh Salmanson

>> Yeah.

Dave Vellante

>> We'll be there. You'll be there. We're super excited to have you on here. But Josh, I wonder if you could set up the threat landscape as it exists today. We got nation-state adversaries. You're running at machine speed, you've got automated phishing. It's a whole new world where humans just can't respond anymore. Set the tone for us.

Josh Salmanson

>> So the adversaries have picked up on the new technology a lot of faster than most of the enterprises have. And we'll be hearing a lot of cool metrics around cyber over the next month because everybody's getting ready for RSA. But in the last six, seven months, two different research reports have come out and showed that adversaries are getting into an environment in under a minute now. They're doing everything that they're going to do on the objective and they're getting back out. In one case, I think CrowdStrike said 30 seconds this week for their report. So it's getting faster all the time. The problem is the systems that we have in place today take a much longer time to alert the staff that there's an issue. So data comes in and hits a sensor, then it goes through a pipeline, then it gets to a tool called the SIM. And then once it's in the SIM, it goes from there to a queuing system where it sends a ticket out to somebody to address. That could be 30 to 45 minutes. The adversary's already gone. And without making a change in the fundamental architecture for our defenders, we're not going to be able to keep up.

Dave Vellante

>> So you all have a session today around best practice for national security deployments. You guys are obviously leading that, gathered the community. What's that all about? What are you going to be sharing with people? And maybe we can touch on a little bit out of here.

Randy Hayes

>> Yeah, sure. So I think there's a couple of things that to think about is, like Josh said, the threat is so much faster and so much more advanced than anything that we've seen before. And so we have to make sure that the community together is working together to solve these problems. And so that's why VAST Federal and Leidos has really come together to solve some of these really hard problems. And so I think that's one of the really interesting things about this conference, about RSA, is that everybody's working together to solve these problems. And so I think that's one of the really most important things about this conference, as everybody is talking to a lot of different customers together and customers are talking to customers and trying to solve these really, really hard problems.

Dave Vellante

>> And that is a theme of this year's RSAC. It's RSAC now, it's not RSA anymore. I always forget to say that, force of habit. We'll be at Mobile World Congress next week, MWC now. At any rate, I wrote a blog 10 years ago criticizing the industry because there wasn't enough collaboration. You saw people taking proprietary data and trying to monetize it. That's I think gone. Rob, I'd love your thoughts on that, but I'd also like to better understand what the Advantage practice is at Leidos.

Robert Linger

>> Sure. So the Information Advantage practice at Leidos really centers around everything data, AI, automation. But we focus in a lot on the data, which is why we love working with VAST so much. Because at the end of the day, as you were saying, it's the year of ROI, right? We need to start seeing the returns. And to get to those returns, we have to get to outcomes. And if your data is not good, your outcomes will never be good. So to tie back into sort of what Josh was talking about with the threat landscape, it's sort of a double-edged sword, where we need to use these tools to be able to defend, attackers are using these tools to attack. But at the same time, in order to get ROI, we have to be able to connect all of this data together. And there's an old adage in cyber security that if it's connected, it's vulnerable. But we're in a space where in order to properly use AI to its fullest capacity to get ROI for the government or for any particular enterprise, you have to be able to allow that AI access to certain types of data from a single place. So while we're trying to get this ROI, we're sort of setting up our own threat platform and we have to be able to defend that quickly and effectively.

Dave Vellante

>> So there's always these milestones in cyber, whether it's Stuxnet or some novel supply chain hack. We saw the Anthropic hack, I guess it was earlier this year or late last year. You've now got agents, you're sort of touching on that, you're giving access to AI. We know there's going to be this multi-agent hack and it's going to get into different systems and one agent's going to infect another one, and yet the industry has to move forward. So how should we be thinking about, I don't know who wants to take this, maybe it's a question for all of you.

Josh Salmanson

>> Yeah, all of us.

Dave Vellante

>> How should we be thinking about agentic security? Take it beyond the buzzwords because everything's agents and agentic, but what does that really mean? How does it change the way in which we think about defenses?

Josh Salmanson

>> I'll start with just the agentic part first. The way we're seeing the initial use cases are it's helping us to solve these volume, velocity, and variety problems in a very different way. I can put an agentic tool behind a sensor now and have it do the work of a couple of SMEs at scale. So to quote a friend of mine that has one of these tools in his company that we're really providing a triage now that we couldn't do in the past, I can scale up and scale out. So instead of having 100 agents dealing with 1000 problems, I can now have that very focused sensor, have an expert sitting behind it that has infinite scale associated with it. And we're going to address the problem of the good quality data getting into the core, which Raul will talk about, so that we can do the more comprehensive analytics. But the more I can knock down the bad data and the false positives that most SOCs have to deal with on a daily basis, like 90% of their traffic is false positives. So they're chasing that all day long instead of focusing on the real problems. We're taking agentic slowly and as the new tech, like the BlueField DPU cards start to get more vendors building their sensor tech on those cards, we'll take the risk out of it infecting the environment the way you described in the question.

Dave Vellante

>> Josh, to your earlier point about the adversary is highly capable, they're using these tools extremely effectively. They're probably ahead of the game in that sense. So it used to be that 99% of the attacks you could stop with your cybersecurity infrastructure, that 1% was left to the humans and the humans could pretty much deal with it. But that's totally changed, hasn't it?

Josh Salmanson

>> Right.

Dave Vellante

>> Humans can't deal with that 1% anymore because the volumes that are coming in. So we need AI to-

Josh Salmanson

>> We have a customer that sees about 120 billion events a week.

Dave Vellante

>> A week. So it's impossible.

Josh Salmanson

>> And if you can't use advanced data science ... It's no longer a cyber problem, it's a data science problem.

Dave Vellante

>> And then now, so that gets me, Randy, to the point about that Josh set up earlier around data. It's interesting to me to see the SaaS attack, the SaaS-pocalypse that's going on in the stock market now with all these SAS companies getting hit and including the cybersecurity companies. "Well, they're SaaS, they must be getting killed." But there there's a data moat that these guys have. I mean, it's their threat intelligence. But explain to the audience why cybersecurity, coming at it from a data problem is the right approach, the right vector.

Randy Hayes

>> Sure. So I think there's a couple of problems that people have historically run into. There are point products that are specifically built to solve a problem, and then there's infrastructure that's built for that specific application or point product. And then you have lots of these. And they don't necessarily always communicate very well together. And so I think that's one of the really interesting things. When you start looking at speed and low latency, and all of these things, you have to have something that's easy to manage, easy to use. And if you look at all of the different components, whether it's the VAST operating system, or it's NVIDIA DPUs, or it's Morpheus software, or all the great work that Leidos is doing from just putting all of these things together and making it usable by traditional admins that maybe don't necessarily understand AI. It's really easy now to go online and say, "Hey, show me a video of a cat jumping up and down screaming," right? Okay, fine, no problem. It's a whole different problem to say, "Hey, show me all of the analytics around where all the attacks came from and what ports they were coming in," and all these other little variables that you have to look at. And so by having something that goes from data all the way up through database analytics, and then able to then spawn agents and have agents managing agents. And I think probably the biggest thing and why the federal government's been a little bit slow to adopt some of this stuff is our adversaries don't play by the same rules. We have rules for a good reason. And so I think one of the big things we talked about earlier today was trust. And so we have to be able to audit all of the actions. We can't just let these agents do whatever they want because it's going to end up being super problematic for a bunch of different reasons. But I think when you start looking at all of the governance that we've also built into the platform and then all of the experience that Leidos has to bring to bear, we can build something together that allows us to build that end-to-end threat detection and dissemination and response in a way that's also governed and auditable so that we can show, "Hey, this is every single action that was taken without a human in the loop." And so I think that's one of the biggest challenges that we're solving jointly together around some of those challenges that the federal government basically puts on us for good reason. And so-

Robert Linger

>> At Leidos, we have a framework that we put together called our Calibrated Trust Framework that is designed specifically to address sort of that agentic flow that we were just discussing. Because when you're talking about, initially we had trusted AI and that was really more about building trust in the systems that you had and the type of work that they were doing. But now as we start to push that out further, and we have agents, like you said, sometimes you have agents managing agents, you have to have a level of calibrated trust across those systems so that you can step into them in a way that is responsible, auditable. And at the end of the day, let's be honest, you have to have some sort of way to ensure that you have cost controls and auditability across those consumption-based capabilities. So I think calibrated trust is going to be a big part of the government's adoption of these types of .

Dave Vellante

>> So Rob, I want to pull on that thread a little bit, and Josh, maybe you could chime in as well. So Randy, just listening to you, it reminds me of some of the frustrations I hear from practitioners, which is I love the NIST frameworks and this concept of zero trust. It's really hard for me to operationalize. And so does AI make that easier or harder?

Josh Salmanson

>> Yes. The benefit with the newer architectures that we're seeing and we're repurposing for cyber now is that the decision time to respond is much better. And with zero trust, it's very complex computations that have to happen to determine if you can provide access to any data through any of these different mechanisms. And we didn't have the computational capability five years ago to effectively put the access control policies and the access control points into place. The speed that we're talking about now, that I can do transactions within an environment that's NVIDIA DPU and GPU, and all of the other technologies that are available now, the speed that I can do that and cross-reference all of those different sources is much faster. And because of that, I think we're going to catch up defensively for some period of time until the attack vectors change again. But zero trust is absolutely deployable once we have good data and we really are able to enforce identity across all of the different machine accounts, the system accounts, and then the actual humans using the systems.

Dave Vellante

>> And the metrics are changing as well. I remember dwell time used to be the big metric and now it's like doesn't matter anymore because they're in and out in 30 seconds, is the new ... Every year I go to Fal.Con, CrowdStrike's conference and the number keeps compressing. I think it was 70 seconds last year.

Josh Salmanson

>> I think it's 29 this year if I read the report right. I think it's 29 this year if I read the report right.

Dave Vellante

>> It's under 30 seconds. So yeah. So speed matters. So how are the metrics changing? What should we be communicating to boards of directors? We can scare them, that's easy, and the reputation risk, et cetera. But how do we measure success?

Josh Salmanson

>> That's a very complicated question.

Robert Linger

>> That's a good question.

Josh Salmanson

>> Well, one, I think we can start to develop much more refined metrics now. The computational capability, the ability to deal with telemetry underneath the system, all the metadata that exists now, I think we're going to end up with a new metric. We use it internally. There's still some magic around how we get to it, but we use it to our mean time to know. And you have to do it almost forensically, because how long did that zero day exist in our environment before they launched it. It's not necessarily going to come from a sensor, but it's how long after it got there did we find it so that we could clean it up? And my hypothesis with what we talked about with the eugenic tools and with the core of the data now being GPU based instead of CPU based leads me to the belief that we're going to be able to hunt at a much better capability than we ever have before because we can automate all of the traditional vectors of hunt, CVE, KEVs, all of those paths. Now, systems can do automatically as the new telemetry comes in. But we can do very complicated multivariate hunts now across this data in sub seconds, in seconds versus the four and five hour index tax time we'd have to pay under the traditional SIM structure.

Dave Vellante

>> So the premise I'm hearing is unifying data is fundamental, that accelerating time to know is now enabled by, largely by NVIDIA and their innovations, and that this allows automation to happen at machine speeds. And it allows us to keep up.

Josh Salmanson

>> Well, but it allows us to see what's changing in the data because of the capabilities. VAST is engineered into it too. So one of the things Jeff talked about this morning in his conversation was about the way that VAST handles all of that data. Instead of big groups, you deal with smaller groups. And we'll see those changes much quicker than we ever would before because of the way the metrics are going to start to be accounted for. The tools today aren't tracking them, but it's not going to take us very long before we can convert the telemetry to show us the things that are now important.

Dave Vellante

>> So we have this never ending battle. I think RSAC, the conference is now 35 years old. It's the 35th anniversary. I remember the early days Art Coviello would stand up every year and say, "We're failing. We spent more, we're less safe." You're like, ugh, shaking everything. It feels like this industry does so much innovation. The speed of innovation, the collaboration is amazing, but the challenges don't get any easier. How would you describe the state that we're in today? We've touched on a lot of this. And AI is sort of this pivot point. I know it's going to be both. Who's going to win, adversaries or defenders with AI? I mean, it's kind of both, right?

Robert Linger

>> It's always going to be a game of cat and mouse. It always has been with cyber. It always will be with cyber. It's just the hard truth of it. But one of the things that I see coming, and it ties back to the ROI conversation once again, is yeah, there's a lot of SaaS providers right now that are feeling some pressure and they're feeling that pressure because of a number of reasons. One, you have companies like VAST that are pulling their abilities into the AI operating system, which brings a lot of capabilities under one umbrella. So it starts to allow you to eliminate tool bloat, because right now cyber is rife with tool bloat. We have enterprises that'll buy 16 different tools, and if you wanted to build a Venn diagram of the capabilities they provide, it would mostly just be a big dark circle with little slivers on the outside. So people are buying duplicate capabilities to try to catch up on this race. But if you have a system and a capability, using AI, to manage all of your infrastructure, all of your data, all of your sensor feeds from one place that makes sense and you're able to consolidate your efforts around that, then you can start to eliminate that tool bloat and then slash use AI to build out those small pieces of capabilities that you need when you need them. in any way, you throw them away when you're done.

Josh Salmanson

>> Which ultimately is the strategy because those additional vectors that the adversaries are exploiting is that tool bloat, right? You teed it up very nicely when you explain ... You kind of laid out all of the big attacks that we've seen over the years. 70, 80% of the tools that exist in a lot of these environments were designed to solve that problem. And the adversary doesn't ever use that again, right?

Robert Linger

>> For attack.

Josh Salmanson

>> Yeah. So we're seeing something novel every time versus ever seeing the thing we bought tool number 41 for again. And the big challenge for the operational teams and the SOCs is they've got to maintain all these parsers to keep these, you said what, 16? Most of our SOCs have 70 to 80 different tools in them. It's very difficult to maintain. And just keeping the parsers working between the tools so that you can get the data cleaned and filtered and stuck into the right tool to do the analysis is that 30 to 40 minute gap between when an adversary does something and when we actually know about it.

Dave Vellante

>> That's such a good point. You're right. You got your end users relying on circa 2000 AV and the adversary's just having a field day.

Josh Salmanson

>> Yeah.

Dave Vellante

>> So this is a key topic that we've been watching, listening to. You get CEOs like Nikesh, who's awesome, but the marketing is always ahead of the reality. His whole platformization thing. CrowdStrike has a sort of similar consolidation maybe with partners. But we're just starting to see some light at the end of the tunnel in terms of tools consolidation, and then AI comes in and now you got to the agentic tool. And when you talk to practitioners like yourselves, you say, "Well, why do you keep going after those new tools?" Because it's solving a problem that's filling a gap that I have and nobody else really does it. And so it's like this continuous catch up. So do you see the day where we're actually going to be able to consolidate the tools? I would suspect there's going to be some consolidation of the number of companies, but the VC money keeps coming in and the innovation keeps coming. Do you see that, within the next 12 to 18 months, practitioners being able to take 70 or 80, cutting it in half or-

Robert Linger

>> I think that it's possible. Will we see it? Likely not.

Dave Vellante

>> Really hard to do.

Robert Linger

>> Because organizations have built up talent, personnel and talent, that specialize in these tools across time. And at the end of the day, we're humans and we care if Jim's got a job tomorrow. And so I think we're going to continue to see an outpace in new tools being built and at the tail, we're going to see sort of a laggard of consolidation along the way. But it's a problem that's difficult to solve.

Dave Vellante

>> And Jim is probably better than AI in those probabilistic moments. Where it's not deterministic, you want Jim there. Today, yes.

Robert Linger

>> But what about tomorrow?

Dave Vellante

>> Well, what about tomorrow?

Robert Linger

>> Do the capabilities continue to just ... They grow and expanded at such an astounding pace right now. We have these conversations a lot within Leidos where we say, "Okay, this is what the world looks like today. This is what we can do reliably with AI." And then we look back and say, "Okay, what conversation did we have last month?" And last month, we were saying, "It can't do X, Y, Z." And now we're saying, "Oh, well it does XY, Z now, but now it can't do-"

Josh Salmanson

>> One, two and three.

Robert Linger

>> One, two, three. But next week it's going to do one, two, and three.

Dave Vellante

>> I remember when robots couldn't climb stairs. It wasn't that long ago. And now look at what's-

Josh Salmanson

>> We're living in the hockey-

Dave Vellante

>> They're making coffee for us over here.

Josh Salmanson

>> We're living in the hockey stick culture now. Everything that used to be a nice slow linear growth is now, and that's-

Dave Vellante

>> Exponential.

Josh Salmanson

>> That exponential growth now, it applies to everything. It's not just the technology speeding up, it's the problems. And they multiply because these enterprises are all very complicated. There's lots of things going on and you got to keep the business going, but you got to secure it too. And I think we'll have a transition period as the legacy architectures start to fade away. But I truly think we're not going to see a breakthrough until we get off of CPUs because that's one step at a time. It goes down the process, but it's one step at a time. When we can parallelize a lot of these activities, then we're going to get a breakthrough. We're going to get caught up. It may be three to five years, but I think it's going to come faster than we expect it to simply because tech, in the last five years, has felt more like Moore's Law than anything I've ever ... The changes on a daily and monthly basis in the last two years, it's hard to comprehend how much has changed from 25 years ago to now.

Randy Hayes

>> And I think the other, just with the general thought process of this conference of VAST Forward, what does the future look like? I think we're going to be in a place where we're going to have AI agents doing basically pen testing on all of our networks and all of our different things and saying, "Hey, AI, how would you attack this network? Give me all the possibilities of how we can attack this network," and then we can solve for that problem. Because I guarantee you our adversaries are using .

Josh Salmanson

>> Randy, we're already looking at those tools right now because they allow us to put the context of risk back into risk management. If you know what your governance structure is and you say, "I'm compliant to all of my requirements, but how secure am I?" The question has always been, "Well, it says I'm compliant. Everything's green in my GRC tools," but you're not secure at all.

Robert Linger

>> Compliance doesn't mean secure.

Josh Salmanson

>> Yes, it absolutely doesn't mean security. And what we're doing is building a new method of risk scoring so that we can tell you what your compliance is, but we can also tell you what your cyber posture is simultaneously for every system and put it into the context of risk where it's important for your organization.

Randy Hayes

>> That's awesome.

Dave Vellante

>> And to your point, we got to wrap, but to your point about parallelism, the other thing is that's happening is the cost per tokens is plummeting. And then with Vera Rubin, which is coming on, I think NVIDIA announces tonight, so I'm sure we're going to hear some comments there, that cost is going to keep coming down, down, down. It's Moore's Law on steroids. And we look back and remember how awesome that was. This is awesome times 10 or 100.

Robert Linger

>> Well, just one thing on that note though, because I've been tracking this since ChatGPT got super hot. Yeah, the cost per tokens go way down, but at the same time, our capabilities consume more and more. So is that line going to trend up? Is it going to trend down? But that's another space where I point back to VAST, this is their show, but I do believe in what they're doing on having that on-prem capability so that you can have your big chunks of consumption be CapEx rather than a managed service that you're providing out of the cloud.

Dave Vellante

>> Right. And so that's what brings up a good point, Rob, is the thought exercise of, well, what could I do if I weren't compute constrained? And I think that day will come and it's going to drive more consumption. It's like our phones, they never get faster because we're doing more with them.

Josh Salmanson

>> But the disaggregated structure of VAST and the ability to have your VAST clusters anywhere in any geography and have them all work together as one might actually be a saving piece for cyber. Because I won't have to move data to another location to do my analytics anymore. I can do distributed analytics and correlation across an enterprise now in a way I couldn't do before.

Dave Vellante

>> And we didn't talk about real time, but near real time is a key topic here. Guys, thanks so much for this great conversation. We'll see you at RSAC Conference in San Francisco in a few weeks. Thanks for coming on.

Josh Salmanson

>> Thank you very much.

Randy Hayes

>> Absolutely. Thanks for having us.

Dave Vellante

>> And good luck with the session this afternoon.

Randy Hayes

>> Great.

Josh Salmanson

>> Appreciate it. Thank you.

Dave Vellante

>> And thank you for watching VAST Forward, VAST's first big customer conference. Hopefully we'll see many, many more. This is Dave Vellante for theCUBE, brought to you by Solidigm. We're right back to Salt Lake City right after this short break.