Name: Your Collaboration Apps Are Down. What Comes Back First?
Uploaded: 2026-10-01T18:01:12.962Z
Duration: 45 min 8 s
Description: Your Collaboration Apps Are Down. What Comes Back First?

Transcript for "Your Collaboration Apps Are Down. What Comes Back First?": Hey, everyone. Welcome to our conversation about when your collaboration apps are down, what comes back first? We're going to dive into an inside look at how to recover your minimum viable company with rubrik.ai. I'm joined by my distinguished colleague, Mohammed Akram, who leads product, for Microsoft three six five. Akram, why don't you introduce yourself? Hey, everyone. I am Mohammed Akram. I am a part of the product team, and I lead our Microsoft three sixty five, data protection portfolio. Super excited to be a part of this webinar today with you, Varun. Awesome. And my name is Varun Grover. I lead product marketing for AI and SaaS. And without further ado, let's dive into our conversation for today. Throughout this conversation, if you have any questions, feel free to drop them into the chat or the q and a, in your webinar window. With that, let's dive in. So, Akram, let's start with what actually happens on a bad day. What does it look like when, your customer is hit with... By an attack? So what on... Let's say it's 2AM. Right? Ransomware lands. Your exchange, your OneDrive, SharePoint teams. Let's swap that in for for Gmail, g drive. It's the same story. All get down at once. Your core communication, your core collaboration lines are down. Right? The workforce can't even coordinate a response because the tool that they would use to coordinate, they're... They got this down. So everyone at this point is just sitting in silence. Yeah. And it's not just enough to just think that is your data safe anymore. 100%. Right. Having backups or saying that I have some safe data in store, that's not enough for today. That's only one half of the puzzle that we've seen. So organizations, they don't understand all of this complex data. Right? Because this data is of your users, your end users. It's the whole SaaS mesh. The files, emails, chats, all of these spread across your sites, your team's channels. So even when you know that you have a safe backup, you're just staring at an entire tenant with this complex mesh of data. And one thing that we constantly hear from our customer is I don't understand this data. Right? And the solution is I'm gonna go and restore the full backup. Now the problem with that approach is you can't just blast to restore for the entire tenant and expect everything to just come back up, and be, like, work... Your work to get be restored in emergency. And Microsoft or even Google for that matter, they rate limit us in terms of what you... How much you can restore in a day. So that doesn't help either. So whether you want it, whether you like it or you're not, you are forced to make trade offs about sequencing, what data comes back first. Whether you've planned for it or not, you get forced into doing... Taking that decision. So you mentioned trade offs, and that's a very critical part of the life of all of, the customers that we deal with. So what... Walk me through what actually matters and, how they should be thinking about, prioritizing beyond the outage itself. Great question. So let's say every hour that you are not back up is an hour of paused work. Right? So you're just sitting in silence. It's an hour you are not working. There is lots of revenue. No collaboration is happening. And your time to recovery keeps slamming up. Right? And IT is just sitting there in paralysis. But you also read in the so first report of twenty twenty six, eighty five percent or eighty four percent of ransomware victims take more than a day to recover. And I want to ask you that question. Right? Or the organization said to ask this question to himself. How much does days of of not working cost you? Right? And even within that, a day of paralysis for one department is completely different from another department. It could be a lot more expensive for one department to be nonoperational versus another department, that that could could maybe stand a a day of not working. If you haven't decided in advance who has to be online first and you're deciding it live during the incident, that's not how we... That's how your recovery is gonna take weeks, and it's gonna turn into a disaster at that point. The ground truth is that you cannot recover everything or for everyone all at once. So it matters for you to be prepared with who you want to recover, the most critical piece of data for these people to recover, and have an effective response strategy to to an outage or an attack. That's a great point. And, Akram, for you, this is not hypothetical. Right? You're constantly talking to customers. A recent customer who shared their wisdom with us was Simpson Strong Tie. What did you hear from them? Yeah. Again, this is not something that is hypothetical. This is some... Simpson Strong Tie is one that stuck with us, but that's a pattern underneath that we have seen conversation after conversation, customer after customer. So most of these customers are not telling us that they didn't have a backup. Right? They had a backup. What they didn't have was a plan of execution on these backups. Right? Plan for what comes back first. Nobody could tell them with confidence, like, which people, which workflows would lead to business continuity, and what would help them bring that business back up and find that core business without which the company would generally not be able to operate. So the coverage was never actually the gap. Right? Yeah. Never. The gap was that nobody had defined these critical users in an organization. Coverage had never been a gap. So when the incident hit, the teams were trying to improvise the recovery in real time. Right? Restoring things roughly in what they remembered, asking people what files do you want, what documents would you like. So there's always the plan that was the missing piece. And just figuring out, right, what we've heard from a lot of these customers are just figuring out what to even recover, that takes some monumental amount of time in practice than the actual recovery. So that has been the biggest, missing piece that we've seen till now. I want to pull on that thread a little bit more because, effectively, what you're saying is backup while being important is only one half of the equation. It's the recovery that is perhaps far more important than and especially prioritizing that and thinking about what matters most. So if backup was never really the question, then what is the actual question here? Yeah. That's that's a good point. So it's it's not do you have a copy of everything. Right? It's what is the minimum this company needs to be functional, and can you bring that specific part back up on purpose, not by accident. Right? And that's a business question, not a backup question. And that's what we build through our autonomous business recovery offering that would help answer what is that is needed for that minimum company to be functional. Autonomous business recovery sounds like a really powerful capability. How would you explain it to someone who is a business leader and actually thinking about how this helps them get their business back up and running? Yeah. So autonomous business recovery or how we call it ABR is is a recovery offering that we have. So instead of restoring every mailbox or a file with equal priority, we built a solution that helps customers identify their critical operations group. So this is the critical group of people who are the most crucial people in an organization. And then with the... For these people, that helps them identify what's the most crucial data which they can't operate without. And then we bring this this data back first in one click with surgical precision. So while full restoration, we'll take its time and we'll continue in the background. Your critical operational group is back to functioning with their critical data in minimal time. And do we have any proof points to demonstrate the impact? Oh, yeah. So we we have had these simulations with customers and even the data that we've seen. Recovery, which with the traditional approach is I'm going to recover everything, that used to take almost seven to ten days for you to... Users to have the data with which they could be operational. And now all of that is landing under three hours. So we've tried to move this needle from ten days or weeks to back just three hours and and getting them operational in that duration. That's phenomenal. And you talked about simulations. Do we have any real world examples of this in action? Yeah. So let's let's run this in practice. Right? Nobody can triage a tenant's worth of mailboxes, files, permissions, all of these dead data and metadata within your tenant, by manually looking at it by hand fast enough to hit that number. Right? You do not need an email from six months ago for you to be operational right now and and acting right now. Right? You don't need a file that you created maybe two years back. What you need is is the most recent email. What you need is a file that you've been working on recently. What what you need is an intelligent system that understand all of this data, handles the analysis, and and present some meaningful execution strategy of this data for for you, for the organizations, for the customers. That's the honest reason Rubrik AI is in this story because you need that intelligent system that could help do all of this analysis for your most crucial users. And it's... It brings back, an execution strategy for all of these, crucial data and crucial people and their data. And Rubrik AI is the only way we could... We wanted to present this in a manner that was helpful for customers. It's the only way business first sequencing happens at machine speed, and that's what you would need in that war room recovering from an attack. LubricAI sounds like a very critical capability for our customers, and, I want to definitely dig deeper into that. But before we do that, let's get into the brass stack. So if I'm an admin, walk me through what I actually need to do to get ABR to be functional and to deliver the results that I want. Perfect. So let's let's look at the mechanics of this one. As an admin, you first start from a critical operations group. Right? Let's call it a critical group. This group, you could reuse your existing on Friday groups that you have created in your organization, or you could create your own customized group on our Rubik's security cloud using AI or or naturally, or you could create a mix of multiple groups and users. Basically, we provide you the flexibility to use your pre existing groups or create a custom group group on our, Rubik's security cloud. Now once this group is created, we allow you to execute autonomous business recovery for this group. And this group will be the core people that that would make your organization functional. Now Rubrik dot AI goes and understands the activity, the data, the metadata signals for all of these users. So looking at all the files that were... Which users are accessing which files, which files have been recently collaborated on, what are the most recent emails, looking at metadata signals that you have in terms of importance, sensitivity, and things like those, and takes in all of these signals and comes back with a recovery plan. So we are not looking at the whole tenant's footprint. We're only looking at this critical operations growth. We look at all the documents that they recently collaborated on, and they might have, like, open, created, and, and collaborated on their most recent teams, even OneDrive, documents that they they would have worked on there. And we create a comprehensive recovery plan that is surgical to the exact data assets all across your m threes... All across the m three six environment for these customers, that they would need to be operational immediately. And, again, the full recovery keeps continuing in the background. But with this precision, we're able to get the most minimum data that you need to be operational and working right now. I'm sure our customers will be very excited to hear about this comprehensive recovery plan. What visibility do customers get before they execute that plan? Yeah. That's a good question. Right? Because you have this intelligent system that is analyzing all of this data, and you can't expect... Or we can't expect our admins to just press a single button and be like, everything is gonna, be operational and perfect. Right? So we knew this concern. So before you execute anything, we give you a comprehensive preview. Right? And this comprehensive preview gives you what is the total volume of data that is expected to be recovered with this plan and what will be the total recovery time objective or the total time that will take for you to recover this volume of data that you see. Now we obviously show you at a group level the total volume of data across Exchange, OneDrive, Shiny, Planet Teams, or you can also see a user level breakdown. So as you can see in the slide, for each individual user, you can see what volume of data will be recovered for their Exchange, OneDrive, SharePoint, and Teams so that the admins and the organization is aware that every user is covered. There is data that is being restored for each, individual user and how much volume of data is coming back so that they they at least have that confidence that, Rubrik AI system has comprehensively analyzed every user and bring... Is bringing back the right set of, data for each of them. Awesome. And we are not taking a one size fits all approach here, and the standard plan might not work for all the customers. How can we ensure that each customer has surgical precision for their recoveries? Yeah. That's, that's a great question. And we know, like, the breadth of industry that we deal with today, we're talking about certain organizations that deal with their m three sixty environment in one way versus, let's say, an industrial engineering company versus a health care company. All of them have different ways of collaboration. And we didn't realize that a single size does not fit all. Right? Our goal is to make sure that each customer has the power to tailor their recovery plans to suit their needs. Right? So we gave a plan which is a baseline to help organizations start so they don't have to start from scratch. Then we also introduce the capability to tailor your recovery plans using natural language. And we know that's the way we've been doing business these days. Right? Use natural language to to achieve your objectives and just making things easy. So let's say... Let me tell you how that would work in action. So let's say an organization here only cares about emails with attachments. Right? We're looking at hundreds and thousands of users, millions of emails maybe. So I just want to even reduce my time to recovery. I'm just gonna go down. So I would use Rubrik dot AI, as you can see here, to run a prompt like only recover emails with attachments. So so Rubrik dot AI will go back and scope all the emails without attachments, remove them from the recovery plan. Again, they will be recovered when everything gets recovered. But for this specific recovery to get you back super fast, you'll only scope it back to emails with, with attachments. Or let's say in the first pass, in the first wave of recoveries, the admin only wants... They want a much shorter audio. Right? So they only want to recover files which are smaller than 50 MB. You can use your natural language and and just put a prompt, do not recover files over 50 MB. And we allow these customers to run these prompts. And each prompts that they run, they're able to see in real time the total volume of data that went down. They're also able to see what has been the impact on the estimated time to recovery. Sometimes you could even increase that or decrease depending on the prompts that you're trying to run. So what is happening here is customer has the power to tailor their RTOs, to tailor their... How much time they want to recover their data in. And underneath all of it is an execution that that is tailored to suit either Microsoft or Google, all of their API throttling. Instead of, like, fighting it, we're trying to build a system that would work with that and help customers achieve their RTOs. And it's the same pattern. You could use it in our n three sixty five environment. You could use it in the Google Workspace environment. It's the same pattern, same experience, and the customers are in the driving seat to build their recovery plans the way that suits them and then execute it to suit their, their RTOs. Awesome. And so, Akram, you and I both know the power of AI in this solution, and, we live and breathe this every day. But to a customer, they're getting bombarded with all kinds of noise. Right? They hear prioritized recovery from different vendors. They hear staged resource. How is what we do different and better than, your standard prioritized recovery or staged restore? Yeah. We we do hear these things. Right? Like, a staged recovery or staged restore or or what do you call it? A plan of recovery. I have my plan that's sitting in my book. The problem is, like, staged recoveries to restore is in a fixed sequence. You know? Somebody wrote that sequence down. Maybe that is part of their six month planning or even if you do a quarterly planning, it doesn't matter. You wrote down a sequence once that never got updated and that nobody's looking at on a day to day basis. And thus, you can still doesn't know how collaboration is moving. Right? Every single day collaboration moves in an organization and in different stages and phases. Ours is not staged. It's not partial. Every restore, which comes from a clean snapshot, it is sequencing itself using generated AI and what's actually critical right now. So if there is a solution that would build that stage recovery plan with every minute of the day, then that would be competitive to what what an AI would work at. But nobody else anchors their recovery on critical users the way we do, and nobody else uses AI to identify this critical data at machine speed. Right? It's that actual competitive gap that that we've seen. It's not something a team can stay... Like, staff their way around all of this. You have to... You could build the best runbooks, but, again, you have to fight here at machine speed, and you have to use AI to find that data and then bring that data back up for your most crucial users. Absolutely. And we talked about how this is not just any standard recovery approach. It is, your critical business that is getting back up and running. And anytime I think about the critical business, I think about CISOs. So why should this matter to a CISO or to a board member specifically? So right now, I think the question that should matter to a CEO, a CISO, pretty much everybody from top to the to the last employee who wants to be operational and be back to business. But let me ask you specifically for CISO or a board member. Right? The question that board members and CISO are asking daily has changed. Historically, it used to be about RPOs, which is mostly a technical metric that nobody outside of your IT department cared about. So that question is not being asked anymore. Now it's about how fast are we actually back in business? How fast can we get the business up and running? And second, can you prove that to me? So that's what we wanted to answer for our CISOs and board members, which is ABR, which gives an automated sequence execution. It's not like a stale runbook that used to run-in the past. It is a number that we could actually prove... That we actually bring to a CISO which we act... Which we could actually bring to a board member, And that is something that you can also take to your insurers and prove it as well that we have the capability to recover the business back up in in the shortest amount of time. Awesome. Well, thank you so much for your time today, Akram. Is there anything you would like to leave the audience with? Yeah. So today was just the origin story. We will be doing more webinars that we would talk much depth about. But before all of that, let me give this group a sneak peek into what such an experience would look like, and I would like to show that to you right now. When I click in, I see rubrik.ai asking me about my business. Who are my most critical users? What workloads can we absolutely not afford to lose? Rubrik.ai and I go back and forth. I provide the necessary context about the PurePoint business, who my most important users are, what are my most critical m three sixty five workloads. And once I provide that, Rubrik dot ai takes that in and uses its intelligence to come back with a recommendation. It analyzes my most critical users and assets and identifies specific users at SharePoint sites it's flagging as part of my minimal viable company recovery plan. That phrase minimal viable company is key. This is the most critical users needed to restore to keep PurePoint operating. After I go ahead and save that, based on the context that I previously provided, Rubik AI starts building a recovery plan. The recovery plan goes ahead and identifies with click and actually start building that recovery plan. So rubrik.ai starts building that recovery plan and it analyzes my critical data. And it starts identifying my most critical data across Exchange, OneDrive, SharePoint, and Teams. So look over there. It identifies all my critical data, provides the required filters that I had initially previously suggested, and here's the part I wanna call out. It even gives me an estimated recovery time. The estimated recovery time here is one hour. I look at the number validated against my RTO. One hour works for PurePoint. Now think about what just happened. Before rubrik.ai, getting to this point meant weeks of workshops, multiple stakeholders in a room trying to document a recovery runbook. We just did this in a few minutes. So now I go ahead and save the plan. The last thing I need to do is agree on when this recovery plan actually gets triggered and what Rubrik dot ai is authorized to do on its own versus when does it need my approval. This part is critical. I'm not just setting up a policy. I'm pre authorizing a set of autonomous actions so that if... In... If an incident does hit in the middle of the night, it doesn't have to wait for me to give it the green light. The plan is ready to go. So let's fast forward a couple of weeks. Much to my dismay and much to my horror, in the middle of the night, the worst does happen. An insider event takes place, and my data is exfiltrated and deleted from my m three sixty five tenant. Luckily, and the only silver lining, is the recovery plan that I've set up with Rubrik a couple of weeks ago. While I'm asleep, Rubik AI is already responding and taking action. I wake up to this notification and candidly multiple emails from my security teams informing me about this event. While I was asleep, Rubik AI was already executing on the autonomous actions we had pre authorized. I'm not scrambling to figure out what happened. I'm being informed. So I jump into my Rubik dashboard there, and I look at details of what happened. I see how sessions... Once I click in, I see how sessions were quarantined. Snapshots were frozen. Configurations were rolled back, and I immediately wanna see what data was exfiltrated. Was there any sensitive data that was exfiltrated in there? I click into my sensitive data scan, and I see the impact and get the necessary reports to share with legal and compliance. So it's not in three days after a manual investigation and multiple meetings. I can share it right now. I then click in to view my MBV recovery plan. And remember, this was the recovery plan we had just set up a couple of weeks ago. And when I look at it, review it, see the estimated recovery time is one hour, which looks great and works for me, I then kick off this recovery plan. With a couple of clicks, PurePoint is back online within hour... Within an hour. My critical users have access, SharePoint sites are restored, and the business is running again. What used to take me days of manual investigation and recovery work is now a guided automated process. Business impact minimized, recovery time compressed. And I have a complete audit trail ready to share with whoever needs it. Rubrik.ai today doesn't just protect your data. It makes sure your business can get back up and running, honestly, even when you're not in the room. Awesome. Thank you so much for sharing that sneak peek, Akram. And one of the things that we talked a lot about today in addition to SaaS was the bridge to identity and AI. And if you want to go deeper on identity and AI as the foundation, we have the AI and identity summit. You won't want to miss that. Awesome. Thank you, everybody. Thank you for the time today. Thanks, everyone.