Name: Beyond Availability: True Google Workspace Resilience in the AI Era
Uploaded: 2026-08-05T17:48:05.661Z
Duration: 31 min 4 s
Description: Beyond Availability: True Google Workspace Resilience in the AI Era

Transcript for "Beyond Availability: True Google Workspace Resilience in the AI Era": Alright. I'm gonna just go ahead and toss-up the slide deck. Alright. Awesome. Well, and for everyone rolling in and and, and coming in, we really appreciate you joining us today to talk about true Google Workspace resiliency in the era of AI. So just a quick agenda that we're gonna go over real quick is we're gonna talk through the threat landscape around Google Workspace, how Rubrik's approaching this landscape, a deeper dive into how the solution works, discussing safely adopting Adjemtik AI in your organization, and then some small and short demos. Today's speakers, right, is myself. I'm Andrew Keyes. I'm one of the regional directors of SaaS at Rubrik, and I'm joined with Ramya, our director of, SaaS engineering at Rubrik to walk through this. Once again, just thank you for coming, and I'm gonna hop right into it. So we're gonna start with the Google Workspace threat landscape. So starting off, let's talk about the challenges that we've been seeing across the industry and how much this landscape has changed over just even the last few years. Over the past few years, when speaking with customers, the two most common areas that they're worried about when it comes to data loss are something like a fat finger deletion or misconfiguration that causes data loss past maybe like a native soft delete function. Now, especially with the adoption of AI, we've seen almost a 50% increase in cyberattacks across Google Workspace. And in 84% of these attacks, they're completely malware free, meaning they're actually just stealing credentials through, through phishing, adversary in the middle attacks, or myriad of different tactics to steal your credentials, bypass MFA, and then escalate permissions. And these are some of the same exact attacks that have impacted MGM, Jaguar Land Rover, State of Nevada, Stryker, and even most recently, the OpenAI model that escaped its sandbox and used harvested service credentials to breach Hugging Face. So the modern question we really gotta respond to now in order to help our customers is this. How do we ensure cyber resiliency and clean recovery for tier zero application that's mission critical to the business like Google Workspace? And the main reason, this is so important is because when you adopt SaaS applications like Google Workspace, in their service agreement, there is a shared responsibility model that clearly outlines this. So Google's responsible to you as the customer to provide uptime and availability of the platform and services to ensure there's physical and logical security in their data centers and to ensure when you go to log in to your Google Workspace, it's there. Right? And the services is available for you. But if you look at the bottom here, when this with these SaaS models, the actual data and identities are 100% responsible, and your responsibility as the consumer of these services. So this is the customer's all of your data, the company data, everything around that is your responsibility to ensure that it's resilient, protected, and you can recover it. As users of these services, a lot of the customers we talk to are using things like g Drive as their backup and storage repository for everything they work on on a day to day basis. And they're under this assumption that the file stored in g Drive or the emails and events in Gmail and Google Calendars are just always gonna be there, really until that worst case scenario where they're not. And the scary part about incidents that impact Google Workspace is the threat actors are no longer breaking in, but stealing credentials and logging in as if they were employee at your company. In fact, last year, ninety percent of cyberattacks were through a compromised identity. Ninety percent is staggering. And as I mentioned to you earlier, eighty two percent of attacks are malware free, meaning your organization can spend all the money in the world on prevention, detection, and any of those tools. But in the end, none of them are a 100% able to actually stop the breaches from happening since people are just logging into the system. And once inside your environment, they are just free to move around as if they were employee, moving laterally, understanding where sensitive data lives, and ultimately escalating credentials to super admin and creating persistence so they can just come and go as they please. And once a bad actor has these super admin rights in a Google Workspace, there's a delete all function where they could completely wipe away your entire state. So now we have to approach security in an assumed breach mentality and switch our thinking to resiliency and recovering to a clean known state via cyber recovery. The other pillar here is now AI and how that's impacting security. Something I mentioned earlier was that breach from open a AI's model where they were able to identify exposed credentials on the open web and chain them together in order to successfully hack Hugging Face. Just to find a solution relevant to an evaluation task, it was given in a sandbox environment. In addition, it actually, also compromised four other third party accounts, including a customer code base running in Modell Labs infrastructure. And then more recently, Claude just did the same thing last week. So we have to now create guardrails, governance, and have a plan of rate of action when something like this occurs, and you need a way to roll back these changes. Because whether a bad actor is using agents to try and weaponize this technology or you're gonna be use utilizing AI agents internally either via Gemini or other platforms connecting to Google Workspace via an MCP server, and now that agent's going and deleting data out of Gmail and OneDrive, you needed to ask yourself how are you gonna restore the data back or ensure that this is not gonna happen in the first place. And the native tools were just not built to help you recover. And here's what Google Workspace provides you as the native recovery options, none of which which would be actually useful during kind of that tenant wise compromise or mass deletion event. You do have a soft delete function for twenty five days that does have to be configured. And if a bad actor is in your environment and they have escalated credentials, the first thing they're gonna do is delete this or shrink your retention times because they know this is your last line of defense. Also, when you go to search for files that need to actually be recovered, like specific files or users, it's super manual and time consuming and the last thing you wanna be doing during this type of mass event. And since all the data lives inside of your tenant's trust bounds, once compromised, there's no secondary immutable air gap copy. And based on the shared responsibility model, once that data is gone, it's gone for good. So we'll just have to call it like it is. Right? The native tools were not designed for backup and recovery. And it if this happens, they're not gonna help you during this breach event. So I wanna switch real quick to the this part of how we're approaching this problem and helping solve this for our customers. What we're providing is a logically air gapped, immutable copy of your data that sits outside of your trust boundary and strictly adheres to zero trust architecture principles. The data is natively immutable, right, not configurable immutability, which is a key. If you can configure immutability in your backup solutions, then that solution is not truly immutable by definition since a global admin could potentially even turn that off. And every immutable snapshot copy we take is completely isolated from your production tenant and stored in Rubrik's infrastructure. The second thing we're doing is we're leveraging policy driven SLAs, meaning you create a policy by setting retention time and frequency to meet your specific RTO and RPO requirements and apply that to the object level, org level, or OU level, allowing you to automate backup jobs and not miss anything in the future. And lastly is the restore function. When we take a backup, we're not just capturing the data. We're also taking complete stock of the metadata. So this means all your permissions, hierarchies, your labels, structures. And when you go to perform a restore, we can restitch all of the data and metadata back together because we're aware of the context that existed in the original location. So it's bringing it back exactly how you want it to come back. And real quick, some real life scenarios we can walk through. If you think about day to day challenges like an accidental deletion that that happens all the time, right, that's the number one use case when it comes to data loss. With Rubrik, you'll be able to instantly search for specific deleted files or emails and either restore that back to its original location or to a new location. Or you can imagine a user's deleted during, an important m and a, and you're at risk of losing the institutional knowledge associated. At that time, you can actually restore the departed user's entire inbox into a separate user's active, inbox to ensure continuity. Or if you're heavily regulated industry where you have long data retention requirements, you can use the same retention SLA policies we discussed in the previous slide to manage this and meet those compliance needs and your RTO and RPO requirements. And lastly, of course, is that mass deletion event that we've been talking about and that compromised, tenant. We can quickly and intelligently bring back your organization's Google Workspace environment, which can allow you to continue your day to day operations. So I wanna now pass it to Ramya to deep dive into how this actually works and give you a look into how we're approaching AI as well. And, Rami, I believe you're on mute. Thank you for that. Of course. Right. Hello, everyone. I'm Rami Atalasekam. I'm the director of engineering here at Rubrik. My team, you know, develops the cyber resiliency capabilities for the enterprise SaaS application and the, AI application. So in this slide, I'm gonna walk you through how Rubrik hosted Google Workspace Protection works and how we deliver all the solution that Andrew talked about. To start off, we have your Google Workspace production tenant. And within the tenant, we support Drive, Gmail, calendar, contacts, and groups. In the Drive, we also support shared drive. To protect all of these, you simply need to onboard this entire subscription into, Rubrik Security Cloud and authenticate via the domain wide delegation. Once that is done, Rubrik creates a complete set of infrastructure that is hosted and managed within the, Rubrik site. So this allows you, to basically provide because it's managed by Rubrik, you don't have to worry about managing an additional service or the operational, cost of managing an additional, service. The solution uses, Google, APIs. So the Google API makes a call to the production tenant and then gets the data, and it's stored within the Rubrik infrastructure. This gives you the air gapped solution that Andrew talked about because your backup data is now completely isolated from your, primary data storage. And, also, when we are leveraging the Google APIs, we do get the delta changes, which means the data that is stored is always append only providing you with the immutability guarantees. The solution is also built in partnership with Google, using Google APIs and in the Google infrastructure. So you're provided with an application that can automatically scale and is also resilient. So far, you know, we discussed about the operational resiliency, and Andrew talked about, you know, how real world examples also that would help with day to day operations. But let's not forget, the implication when a large scale cyber attack happens. When that happens, you need a system that's robust enough to get your entire app environment up and running. For that, you need to have resource operating at scale. So Rubrik gives you a mass recovery capability in which you could parallelize the resource across all of your, users and drives. You could also select a point in time snapshot during the recovery so your entire organization wakes up at the same point in time. Now just by the nature of the mass recovery, you are recovering all of the data from the beginning, the genesis of your company. But what about your doctor's office and you do want to know appointments for tomorrow or for next week, and you don't wanna wait for all of your data to be recovered at once? Right? That's where the prioritized recovery comes into picture. You can prioritize what workloads to be prioritized, say calendars or, the email. And you can also specify what is the scope of the data that you would want to, restore, be it, seven days or thirty days. So in that way, your most important, data is restored first, ensuring business continuity while the rest of your data is seamlessly restored behind the scenes. While the mass and the prioritized recovery, is about what is important to be record. Right? We also are working on autonomous business recovery, which is about who is important to your business and their data to be recovered first. So the the both mass and the prioritized recovery is already available in production, and it's it's available to use. And the autonomous business recovery is something that we're actively working on. In the autonomous business recovery, we also use the power of AI to automatically come up with the recovery plan that is optimized for the best RTO. I will show you in the next slide, how that looks. So for the autonomous business recovery, you first need to establish a critical user group. So this is a set of users that you would want, to be recovered first and their data to be recovered first. In this case, the Acme executive members is already established as your critical operational group. And once you specify the, you know, the recovery scope, which is seven days, what you're seeing here is a live screen of Rubik AI. And the Rubik AI has went ahead and analyzed what is the most critical data to be recovered first. And that you could also see an RTO, which is three hours is the estimated recovery time for this particular plan. Now key things to note here. Right? As it's being, you know, analyzing the data, you could see the the users in this particular group have data across Drive, Gmail, calendar, and context, and it's, like, 10.5 k items, three fifty items. But what they've actually used in the past seven days that they've actually accessed, and that is important to them, that is categorized by the Rubik AI here, is 200 files and also similarly on the emails. So based on the information that the Rubik AI finds out, it comes up with the the summary. Right? In this case, we it has discovered that the emails, the calendar events, and all the contacts. And it also has include, excluded the archived and the deleted emails to optimize for the RTU. You could also interact with the the Rubik AI in real time and say, you know, do not recover emails without attachments, if you wanna adjust the RTO. And once you're, convinced on the plan that you would want and satisfied with the recovery time, then you can hit, the save recovery plan. So now you have an automated recovery plan that is available to you if anything, but, you know, bad to, were to happen. And you could also test this, on a regular cadence as well. Alright. So the AI resilience is the next frontier for data protection. With MCPs connected across all of your Google Workspace, accidental deletions already which is happening by the users in which you need the operational recovery is going to be accelerated. A simple AI mistake using or an AI hallucination through an MCP can delete a whole bunch of, you know, the, data in your Google Workspace environment. And the traditional operational recovery is not going to be enough. So in that case, what Rubrik is what Rubrik is enabling you to do is a self-service recovery. So the users can log in to their entire in their own environment and recover the data. So your, so your support organization doesn't have to be, burdened with tier zero, support cases. Instead, the users can log in and recover their own data. It's important to note that when the users log in, they would only be able to see their data that they can actually restore. And, also, every action that the users do within RSC is logged. In that sense, the admin has complete visibility into every action that has been taken, by the user. We are also integrating with, the Rubik's agent cloud. When deletions or when the, AI induced, you know, issues happens at mission speed, the recovery also needs to be at mission speed. Right? So that is why we've integrated with the Rubrik Agent Cloud where the goo the Agent Cloud will, will basically track all of the activities, the tool calls within your Google Workspace environment, and also a policy setup that would be governed. And I'll also show you how that looks in the, you know, in the next slide. The Rubrik Agent Cloud also has a single rewind, button, in which case you would be able to recover to a point in time and giving a surgical recovery. I have a quick demo here for you to, show how that looks. So right now, we are in the Google Drive, and we have a file which is Google Drive rewind demo. And with Claude, we will be deleting this file. So you can see the MCP is connected, with Claude and Google Drive, and then we will be deleting the file. And it's important to note that, when a file is deleted with Cloud, it is also deleted from the, the trash, which means it's permanently deleted. So you could see it's deleted in the file. So basically, it's gone here and it's also deleted from the trash. So now this tool called is is registered within the Rubrik agent cloud. And, yes, you can see here, you know, the action has been registered, and it also says that a file ID and then the user is is also logged. Okay. So this is the one click, rewind. So as the tool call is registered and you hit the rewind, you could basically say the Rubik, AI has actually identified what is that specific file and the path. And, you know, you can also hit it also restores it. So a few things to note here. Right? So what actually happened as you hit the rewind button is that the the RoboK was able to actually find which snapshot that specific file is. Right? That is basically the the mission speed that we're talking about. Our snapshots happen every single day, and these are immutable and append only. Instead of searching for the file across multiple snapshots, you are now able to know or leverage AI to basically say a single rewind click that would get your data. Know exactly where the data is in the snapshot and you will be able to, restore the data back. And there you have it. I also have another demo for you on the mass and prioritized recovery. So this is the, RSC, Rubik Security Cloud. And once you've onboarded, Google Drive, this is Google Workspace, this is basically how you would be able to see it, the Google Drive, and then it's also supported by Gmail and Contacts. For the purpose of this demo, we're going to restore the Google Drive. And also, this is how it's delineated between restoring a single user or the drive or the entire OU or the app itself. We're going to restore, the OU or the app here. So going with the entire app. And this is where if you wanna go with the latest snapshot, you have an option to select latest snapshot, or you could do a point in time snapshot. You could also set the recovery scope. And there you have it. It's that simple to recover your entire organization. So we we have event timeline. So this basically tells us, as the resource are happening across your entire environment, you will be able to share see the progress here. So the you would be able to see the object. Here are the users and then the completion time and then the recovery status. There's also a download CSV option for you to get a report on the the status of recovery across your company. Alright. Thank you. I hope, you were able to get an overview on how we have built the, Google Workspace protection and how we're leveraging AI to, enable how we're using AI to protect you, you know, and also provide you with, capabilities, for for your business continuity. Thank you so much. Over to you, Andrew. Awesome. Thank you. Yeah. And just to wrap it up here, everyone, I mean, we saw some really unique things today that I wanna hit on. Right? The way Rubrik is looking at resiliency and recovery is unlike anyone else in the industry. Right? Not ever there's a lot of companies out there that can provide you with a copy of your data and an immutable snapshot, but there's not a lot of companies who are thinking about how to recover your business. Right? So what we're giving is not only a secure, resilient copy of your data, the ability to also allow you to automate things like AD Force recovery, bringing back all of Entre ID and Okta in a single workflow to build back your foundation. But the also, the cool thing is when you go to do that mass recovery, we're thinking about business data and not just all of your data. Right? The the cat picture that was sent to your CEO seven years ago may not be as important as the thing he was working on this month. So we're analyzing what's most important to the your organization and bringing back that data first, then allowing you to prioritize, the additional data, then perform a mass recovery. So those stages are allowing you to get up and have your business operational in sub hour, which no one else is even getting close to in the industry and approaching that. So I just wanna point out how unique that is and the way that we're looking at recovery is so differentiated in the in this industry. And lastly, right, the the fact that I think if you talk to 50 vendors out that they're performing AI readiness, you're gonna hear we do inventory and governance, inventory and governance, and put guardrails up. That's the only thing that everyone is approaching. Right now, we are giving the ability to not only inventory and govern your AI agents and give you that visibility, but the ability to roll back negative changes. So as your competitors are launching AI agents and you're doing the same to keep up, if you have Rubrik, you can now safely adopt AI agents and allow them to go wild in the environment. And if they make any negative changes, you can roll them back, see what was the negative change was, fix it, and roll it back out. The competitive advantage that gives you in this agentic world is massive and should not be understated. And that is the missing piece here is that rollback functionality which we're providing. So I I'm really love the way that Rubrik's approaching data resiliency, the ability to recover the business, getting your your operation up and running, your identities back, as well as allowing you to adopt AI securely. So we really just wanna say thank you so much for joining today. If you, please reach out to any of us or our sales team. Go to the website. You can put in a request. I'm happy to connect as well. I'll put my email in the chat so everyone has it. And always wanna say re please reach out to us with anything you have. And lastly, right, we do have a program for Rubrik Guardians, and this is a really cool program especially for customers. So if you have any interest in in joining this, scan the QR code. And thank you again for joining. I hope everyone has a great rest of your day. Thank you. So we'll be taking questions too. So if you have any, we're gonna stick around. Please let us know if you have any. We're happy to respond. Alright, everyone. Well, we, once again, appreciate your time. It doesn't look like a whole lot of questions came in. It means we did a great job presenting. So that that says it all. No. But but awesome. We, we appreciate your time again, and, please reach out if you have any questions or or wanna talk further. Thank you.