Name: New Rules for Protecting Your Data, Identity, and AI
Uploaded: 2026-09-23T18:01:27.828Z
Duration: 45 min 12 s
Description: New Rules for Protecting Your Data, Identity, and AI

Transcript for "New Rules for Protecting Your Data, Identity, and AI": Hey, everyone. Thanks for being here. I'm Justin Rees. I'll be your host today. I'm also the Director of Product Marketing for On Premises Data Protection, but I'm also joined with two incredible co presenters with me, Mark and Varun. So super excited to have have you guys. Thank you for having us. And and great. My name is Mark Callahan, director of product marketing for identity here, huge identity nerd, and I just love talking about these things and how it's all interconnected. Varun, how about you? Great to be here, Justin and Mark. Varun Grover, director of product marketing for AI and SAS. Big AI nerd. Very excited to dive into all things, resilience and AI. Awesome. Super excited. I think this is the first time all three of us have done something like this, so it should be fun. So we have a packed session for everybody today on the call, so let's jump in. So before we have the conversation, kinda wanted to paint the picture in the backdrop of kinda what we're all up against and give us a common point of view. And so with that, let's set the stage. So a few years ago, attackers moved slowly. Right? You had a few weeks to find them. You even had a couple more weeks to restore. Unfortunately, that world is gone. Right? Today, from the moment someone gets in to the time all things break loose, it's roughly 39, which is not a lot of time. Right? And the attack surface has completely changed. And so it's not just about all the data you have, but it's about all of the identities. It's about all of the AI tools and capabilities you have. And so, really, there's three new rules for staying secure in this, new world. And they are, you know, first, your restore needs to start before and, before the attack, not once it hits. That's kind of a counterintuitive thing to say, so we'll unpack that a little bit more. But the second rule is you need to assume that all of your identities is a new threat kind of vector and the door is open for these attackers. And third, you need to treat all of the AI kind of agents that you have as an insider threat. And so today, you know, the goal for the team here is just to have a conversation about each of these and we'll unpack it. And so for the folks that are on the call with us, definitely please submit any questions you have. We do have people manning the chat in the q and a and we will respond to those as we can. And so with that, I wanted to start on a data conversation or the data rule. Mainly because I think this is probably where the story starts. A lot of organizations think they're protected. They feel safe. They feel like they're in a good, good place. And the reason for that is you had a Doctor plan in place for some time. You've backed up your data for a long time. But the problem is that the backups were designed for different kind of use case. They were designed for things like natural disasters. IT made a mistake. You need to recover your data. There was nobody standing over your shoulder, from a cyber threat perspective saying, how quickly can we get back online? And so ransomware, unfortunately, is not an accident. And so the question around the data has kinda shifted. It's no longer can we restore? The question is, you know, can we restore fast enough and can we restore from a point we can actually trust? And so that's kind of the big shift and I would say it's a huge shift. And when we think about this, the evolution of this space has really been interesting, because going back to the rule that we mentioned that your recovery needs to start before the attack kinda happens. And so that's a counterintuitive thing to say. And so what what does that mean? And so when you think about when when you're attacked or when something bad kind of happens, there's a couple of questions that you need to be able to solve for. First is, you know, how bad is it? And what was the scope? How far did the attackers go? What did they get their hands on? But a part of that is, was any sensitive data exposed? And so those are types of questions, at least on the sensitive data side, that you can start to solve beforehand. And so a way that we think about it in the data conversation is, you kinda know what the questions will be on the test. And so if that's the case, then you need to start, you know, preparing your answers ahead of time. You're totally right. You're totally right. The clock should not start once you've been attacked. Right? If you do that, you're too late. And so this notion of being preemptive. You know that you need to know where your sensitive data is. But also as you take your backups, you need to be scanning them. And so gone are the days of, hey, let let's rack and stack our all of, the information we have. Let's work with the security team. They will tell us kinda what clean is now to accelerate and to get things back online as quickly as possible. IT and operations now has a seat at the table with these types of tools to paint a more clear picture of, like, where the last known good clean is. And now working with security, you can just test that. And so making it a little bit more cut and dry. And so any thoughts on any of these guys? I mean, Mark, identity really goes hand in hand with the data side. Like, anything to add maybe that I've missed? You know, one of the things that you you mentioned was it being the the the attack surface, and and I'd yeah. I have a couple thoughts about that, but but also just thinking about that perhaps framing it a little bit different and really starting to think about our protect surface because it when we have this massive attack surface, it's really hard to think about all the ways that the people are coming in and there are just so many, but there's ways that we can manage this when we look at it and change the perspective a little bit. So I almost would challenge us to think a little bit more about the Protect surface as as as we're thinking about this and and and truly, you you hit it, which is thinking about identity as truly that that number one way in. It's the new single point of failure. The car can be totally full of gas. You can have all the goodies for the road, ready for the road trip. But if you don't have the car key, the car is not moving. And Right. That identity is so critical in this. So you got your Cheetos and your Sour Patch Kids or whatever it is that you take on your road trips. If you don't have the car keys, you've lost the the road trip. You're you're not making it. And so, yes, lots lots of thoughts here. Brood, what are your thoughts? I love that analogy, Mark. And I think, Justin, you you made such an important point around resilience or recovery starts before the attack. And one of the things that I've been thinking a lot about is the blast radius. And if you think about the attacks from an identity and an AI perspective, there's the external threat you need to think about, but there's also the internal threat. And that's something that we'll talk about, which is with agents and AI touching your data, whether it's your SaaS applications, your cloud applications. And so recovery needs to start before the attack in that you need to be thinking about protecting all of that data before it's too late. And I think that preparedness is gonna be the differentiator because the average time from intuition to base your point has gotten so much more condensed. And so I I really think resilience needs to be a conversation that that needs to start a lot before they attack you. Right. And and so when I talk about it, I mean, it's a little bit of inside out baseball. Right? Because I I support a lot of our conversations around on premises. But the interesting thing is, like, this is also inclusive of SaaS and Cloud. And so, when you think about, like, m three sixty five and, like, Cloud workloads, like, what are the traditional gaps, you know, that you see or have conversations with customers about? I think the biggest gap today is that a lot of customers just believe that they're already covered. They think that whether they're using native tools from any of the hyperscalers, they will be able to navigate any potential attack or potential breach. The reality is that there's a shared responsibility model, and so you are still accountable for your own resilience at the data level, at the identity level. And I think as we think about this new attack vector or this new blast radius with agents, where do agents start acting, or where do they start accessing it with your SaaS data, whether it's your CRM, whether it's your Google Workspace, whether it's, m three sixty five, and it's with your data in the cloud, whether it's your code or your repos. And so I think for a long time, Rubrik has been focused on resilience in any given scenario, whether it was disasters or cyber attacks. But now given the rise of AI, both the external threat and the internal threat getting more dangerous, I think it's just really critical to start thinking about your mission critical applications differently because it's now no longer just where you collaborate. It's the source of truth for all these AI agents that are turning into your coworkers effectively. So I think two things have happened simultaneously. One is the data in the SaaS applications and in cloud has gotten more valuable, and it has simultaneously become more of a threat, or or more targeted by threats because of the fact that AI has proliferated at the rate that it has. So I think there's just a very different opportunity now to think about resilience from the ground up. And I think it just makes the fundamentals more important than than ever before. And and going back to the basics, maybe the first place to start. Right. Absolutely. And when you think about, like, these estates, I mean, they're huge and they're vast. Right? When you think about, like, being able to restore from an organizational perspective, like, where do you tend to see blind spots in the approach? What is, like, one of the tallest tasks, I think, for people to find during a restore process? The tallest tasks that I have seen is even identifying where to begin. Right? And so the minimum viable business that you need to be able to get back up and running. And a lot of customers, when we ask them, hey. Have you identified your minimum viable business? Or what is the missing critical data that you need back up and running? Who are the individuals or the personas you need back up and running first in the event of a breach? A lot of them will not have a great answer for that. And so I think it starts with identifying who matters most in the event of an attack or which users need to be back up and running the fastest so that you can plan ahead of time and and plan to have a business recovery versus just trying to recover your data. But, Mark, what are your thoughts? Because a lot of this, I think, ties back to identity as well. It it certainly does. And and, you know, I I joked a little bit about not having the car keys and, you know, you're sitting there with your Sour Patch Kids and your Cheetos with the road trip. You're not going anywhere. You're you're touching on something that's really important too is the proliferation of identity driven attacks that are are enabled or powered by AI. And as we're thinking about this, there there's two angles that's considered here. There's that scenario of the a malicious actor actually using an AI tool to increase the ways that they're able to find their ways into the front door to find that car key that you lost, but there's also the the consideration of those well intentioned agents, basically a five year old with a lightsaber, doing things that they shouldn't be, where they're going too far. They're doing the things that they they they shouldn't. And suddenly we're seeing places where it's it's not a malicious intent, but it's actually an over permissioned agent doing things that it thinks is right, but actually destroying and eliminating data, shutting getting rid of IDP configurations along the way. And it's just all of these things are possible and happening. Justin, you mentioned it's like having the the the solutions to the test ahead of time. If you haven't planned for this eventuality, it's it's too late once the eventuality has happened. You've got to plan now and preemptively to ensure that you have resilience going forward when this happens. Because it's not a matter of if. They it's truly becoming when. Right. And and I think just to piggyback off that too, I think, you know, even on, like, the estate side of I think one of one of the biggest challenges that, you know, people run into is they don't even know what they have. Right? Hey, I know I have lots of sensitive information. I think lots of organizations would like to believe they know where it lives. But the reality of it is is it's just too hard to know. And it's kind of like painting a bridge. Like, once you get to one end, you gotta start going back the opposite way. I think being able to understand what sensitive you what sensitive data you have is kinda like that. And so constantly trying to suss out the answers to these questions that you know you're gonna need to solve, when the time comes is is absolutely top of mind. But I think you talked about identity quite a bit. So maybe a good a good kind of segue into our next rule is, you know, attackers are no longer starting to hack it. I mean, they basically take credentials and they find their way into the system. And so curious to get your thoughts on what types of problems this poses for an organization because when you look at the systems, you can't really tell what's going on. So curious to get your thoughts on how we approach it. Absolutely. You you you can't and that's the the challenges. You know, we've got a couple stats up here but one that I would even include in addition to this is just the thought that so many of the attacks that we're seeing, identity attacks, are malware free. So they're they're not coming in to necessarily burn things down. They're coming in using credentials. They're coming into the front door, and they're doing it to find their ways around the system to set in those breadcrumbs so they can come back later and get the data that they are after and get after the crown jewels. It's not so much of a a break and enter as it is, oh, somebody picked up the car key that was left out front and they just walked in and barred your car and took the road trip without you. Varun, you and I work all the time together, you know, as we're talking about the the the challenges of of controlling agents. The other thing that we need to consider here is the blast radius because if you think about your daily operations, you know, Justin, you, Varun, is is if you think about the different things that we do with the automated agentic workflows, if our credential is compromised, Mark the human, imagine what Mark two dot o, three .o, the the agents that I have, my blast radius is amplified incredibly. And so as you start thinking about how do we find that place that you're able to roll back to to get to a place where it's clean and current before they that's, like, the really hard part, Justin, and that's the thing that that that we're struggling with right now, to help, you know, customers understand what it is that they need to do and to understand that some of the options that we've had traditionally have really made you choose between getting back to either a clean state or to a current state. Getting back so far on a clean state that you're basically burning down the house for a spider in the bathtub, which I might be guilty of doing as well, I'm not a fan of spiders, but then there's the other which is you only go back far enough thinking you're clean that you've actually allowed the attacker persistence and both of those aren't good options. So we're trying to think about ways that you can be both clean and current and do it in a way that allows you to get back to to business operations, I guess, as quickly as you can and that's that's the way people should be thinking about this. It shouldn't be a trade off of of one or the other. You should be able to have both and and and be able to get back into things right away. Right. Yeah. Definitely, or gone are the days where we can prevent all these attacks. Right? I mean, we have to assume breach. We have to be able to respond very quickly. Okay. When you think about identity, like, what is an identity based attack kinda look like and how does that unfold and, like, what path do these attackers take? Like, what does that look like in a real life case? Absolutely. You know, it's it's really they're coming in, you know, we we say through the the the front door because they are using compromised credentials or over permissioned accounts. And so think about all the ways that you've got these service accounts and machine identities, you know, there's this is this is pre agentic. So it's just thinking about all the different types of accounts that are out there. The the the credentials are just there for the pickup. They're coming in through the front door, and it looks like a very legitimate authentication event. That's the challenge. So it's not a function of, like, can we protect the perimeter? There's there's partners, you know, we we work with in CrowdStrike and and others that do an amazing job of pressing at the perimeter level, but it's when they walk in from the front door and they've already got the car key or the house key that's on the car key, let's put it, you're you're you're sunk because now they're in and they're going across systems and they're not just going across systems laterally for the data, they're also going across your identity estate. You mentioned the identity estate. There you know, so many companies have multiple IDPs for whether it's m and a or global operations, you know, different user populations. The challenge is becoming your the attacker, once they're in, they're moving across all of those different IDPs. So being able to find that clean point, the place before the spider was in the bathtub and you try to burn down the whole house, is really hard. And that's the challenge that that companies are facing. They're not thinking about all the different ways that these systems are interconnected. Right? The part that's been really interesting for me in these conversations is, like, the idea of backing up data and identities is not really a new one, but kind of, like, what we're solving for is, and so, like, how how do you think about that contrast, right, of, like, if you were to engage with somebody today that says we back up our we back up all of our identities. Like, what what are the things that they're not thinking about that they should be from a restore perspective and, like, the complexities that maybe they're they're not really thinking of in this use case. Absolutely. So let's let's think about Active Directory. That that the Active Directory is basically the the user directory that's underpinning, you know, 90% of the enterprises out there today. It's just, you know, it's 26 years old. It's been there forever. But as we start thinking about all the different identity systems that sit on top of it and are dependent on it, they actually are all interconnected, and they actually are syncing back and forth, the data. So as you think about that being the single source of truth for your cloud IDPs, the enter IDs, the Okta's, if you're not removing the attacker from both locations and actually recovering in an orchestrated fashion, you're you're just leaving that that persistence that we talked about, the breadcrumbs. They're the the spider's not gone. It laid eggs in another part of the house, and they're gonna be back, and there's gonna be more. And so I think the the challenge has been the interconnectedness of those is overlooked, but also how they're managed because IAM used to be just, like, this one person within your organization. I don't wanna say that quite so narrow. I've been in identity for a long time, but there was really a defined location that you'd find the identity and access management decisions being made, and it's actually spread out now. And so you start getting these seams between the different IDPs, the between the the DevOps and Security Ops teams, between the application owners themselves. And suddenly, those seams are where you forget and you don't think about that you have to have this orchestrated recovery to get back so you don't bring the attacker back with you. We we wanna get rid of the spiders once and for all and that's the challenge. Right. And I think we you and I have talked about it at length of, you know, it's interesting how identity has become like this the attack kind of vector to look for. Right? You know, it's people have been after important and all of the important information for a long time. But if you get access to the identities and you're able to compromise it, I mean, that's that's just that's not a good situation to be in. Right? So it has become the attack kind of vector to look at. And the and the thing that's so bad about it is when you find out that there was, like, an an identity attack that we're discussing here, it's not a function of the big red button in the moment and phew, we just disaster averted. By the find by the time you find one of these identity attacks, they've been in there for weeks. And so it's it's a it's a function of, like, how far back do we go? Another weird analogy, you're gonna get bit by the rattlesnake, are you gonna take your whole arm off to stop the venom or know, is it just the finger that you need to do? It's, like, these things you have to consider that how much of your business progress are you willing to give up to get back to a place where you're just truly you can trust that you're clean and current and you didn't bring them forward again because you don't know how far back they went. So, yeah, these these are real challenges. I mean, this is this is the state we're in right now. Right. And so we talked about things on data. We talked about the identity but, you know, also lots going on on the AI front as well. And I think the biggest takeaway that I've heard people talk about is that you have to treat this as an insider threat. I think that's a pretty bold statement to say. I mean, it makes sense. But curious, Varun, your thoughts on this and and why we need to treat this as an insider threat. Yeah, Justin. I feel like our customers are all at different maturity levels or different stages of their AI adoption journey. And so depending on if you are early on in your AI journey and you're still figuring it out or if you are much further along and you have agents in production, AI is still definitely top of mind. And we hear a number of different concerns. Right? We hear things like Shadow AI. We hear about the need for discovery, to be able to know what agents are even in your environment, both authorized and unauthorized. And then, moving on from that, you need to be able to think about how do you govern those agents, how do you, potentially undo their actions. The insider insider threat is a great mental model because we've had the insider threat, for from a human perspective for a long time, but but this takes it to a whole different level because rogue agents don't act like humans. They they can be over permissioned like Mark said. They have superhuman level abilities sometimes in terms of how fast they can move, and they just are often very motivated to get to the objective. I think one of the things that we think about a lot is an agent, when it tries to complete a task, it doesn't think about the the ramifications of what that task would entail, and it just is trying to complete that task. And so the difference between an external thread versus an an internal thread is with an external thread, you have an audit trail. You have a signal that something went wrong. With with agents, it'll just look like a task completed message, and only later when someone's clicking around in the CRM will they find that a whole record was deleted. Or they're looking into their SharePoint or OneDrive, and they'll find something that was important has been modified. So it's just a very different kind of threat to have to navigate. And I think part of it is, again, you you talked about backup as as something that's been going on for a long time, and I guess what's old is new again. So so it's really worthwhile taking a second look at everything that your agents touch and listing out, okay, have I been backing up these applications or not? Have I been backing up this cloud data that my agents can act on? Have I been thinking about my unstructured data? And and then you'll be surprised to find that a lot of it might not be protected. And so, yes, there's a lot we can do from an agent governance and security perspective, but I think you start even small smaller than that or, like, you start sooner than that. And you think about how much of my data estate that these agents can touch is really resilient. So I'm curious to hear, like, your thoughts too as as you've been watching the evolution of data resilience, and and your journey in terms of how customers respond to some of these threats. How are you seeing customers think about data resilience differently from an AI lens? I think for them, when they think about these new tools, it's more about the fear that these attacks are just faster. They're more complex. So it's still from, like, a infrastructure operations perspective. But the interesting part that I always felt that was really interesting is, like, lots of conversations, lots of tools popping up to solve this kind of problem. But I think Rubrik is really in an interesting spot because we've been backing up customer data and information and keeping them secure. So the same principles, the same ideas of how do we keep your data secure and applying that to this new use case of, well, what are what types of agents do you have? What are they doing? What do they touch? I feel like that's really only possible because we we we already are for securing the data that they actually touch. Right? And so it's kind of a hand in hand conversation. And so it's a natural evolution, I feel like, of of what we've been kinda doing it and bringing it to this new use case. Interested in your thoughts on, like, lots of talks about these agents going rogue and the overreach. Like, what does that look like in real life? Like, I I think there's lots of understanding that there's risk. How does that kind of manifest in real life and some of the things that that you've seen? Yeah. It's it's really fascinating to see how quickly this has moved from a theoretical risk to a real scenario. So there was an incident with PocketOS a few months ago where an agent deleted a production database in nine seconds. And so something like that can only occur if you don't have the right resilience in place. And then I think the most recent incident with the OpenAI Hugging Face breach just sort of shows you the capability that these agents have even though that, I believe, was was far more complex and very, very robust level of an attack. I think what's really fascinating is when we first started thinking about this problem, it was a distant threat, and that was about a year ago. And then within about a month, we had the first, perhaps, deletion incident, which was this this Replit agent that deleted, a whole database, like, about a year ago. And then in the last few months, it's just gotten a whole lot worse. And I think a lot of it really boils down to what these agents have access to and and over permissioning. And I know, Mark, this is something that you're deeply passionate about. What what are your thoughts on agents and access and how we need to be, like, thinking about identity differently in the light of agent overreach or the insider threat? Absolutely. Well and and, you know, we what what's interesting, I I think, you know, that in this webinar, we're talking about some of these stats. You know, we're all marketers. Think about, like, how old the data is to get those research stats. Like, those those studies and surveys were already, you know, nine months old even though they're dated, you know, for for within a year. Think about what the data is gonna show of what we're experiencing right now. Like, what are what's the research report come next spring gonna say about what we're experiencing right now? And I'm guessing it's gonna be a a little scary because, you know, the Veroen, you know, one of the things that we've seen is as bad as we know it is, so many organizations as you're thinking about agents that you actually are using in your day to day, you're giving it your full permissions. You're you're actually giving it all the things that you, Mark Callahan, or or Veroen can do in your role and because of the social trust and social, you know, construct that we have, I don't wanna get fired, I don't wanna get shamed, I don't want you guys to hate me. You know, there's all these reasons I, as a human, are not gonna do these things. I don't wanna go to jail. You know, there's reasons I wouldn't do it, but it's what you said, Vrun, that, you know, if they're task oriented and if you you you give it the the permissions, just imagine how much damage any one of us or anyone watching our our, webinar would know, how much damage you could do if you didn't have those things weighing on you to do the right thing. That's the challenge of people over permissioning these agents and it's really becomes that that insider threat of, well, gosh, how easy is it to delete your identity records? Unfortunately, it's incredibly easy if you've got the permissions as a human actor and you've to go around some of the attestation headaches that people see with IGA, they, oh, I'm gonna have my my agent do it. I'm gonna give it all my credentials. Well, all of a sudden, you know, joiner mover lever becomes joiner mover lever. I'm just gonna clean it all up for you and suddenly you're you're in this lurch. And that's why we have to plan now about these backups. We have to think about identity as this tier zero service that's back to if you don't have the keys, you can't do any of these things to fix behind the scenes and and and ruin the interconnectedness. I'm sure a lot of the folks watching are Microsoft shops. There's this angle too of think about M365, the recovery aspect there. Think about AD, the recovery aspect there. Think about Enter ID. How are these all connected? Well, the identity systems have to be restored in a orchestrated fashion so you don't bring the the, the attacker forward. You can't do them one independent to the other. But now what about m three sixty five? If you haven't done this and you've lost email, and once again, it's like another car key that got lost. That is spot on. And I think you you said a really important thing there that these agents are task oriented. And, Justin, I think you you started this this question with agents going rogue. And and for a long time, I used to think about agents going rogue as the problem we're solving for. But lately, I've been thinking that they don't go rogue. They're just trying to they're very motivated. They're just trying to get the job done, and they they get the job done in unexpected ways. And to us, that can show up as an agent going rogue. So I think what what's really interesting about the world we're living in right now is every other week almost, it feels like a newer, more capable model comes out. And all of these different labs are one upping each other and coming out with a new frontier model. But the challenge with with the frontier model and, like, with a 100 x capability is, like, you you have a 100 x risk as well because you now don't know the amazing new model that can produce code that much faster. Can it go and delete a bunch of Salesforce records that you didn't want deleted suddenly disappearing? So I think, there's there's a very strong correlation between how quickly the capability is growing and and how rapidly the risk is increasing as well. So I think we need to be thinking about both of those sides of the equation. And and a lot of what we're trying to solve for now is, like, this idea of fight AI with AI, which is where I think, like, our overall platform is moving towards this idea of agentic cyber resilience as well. Right. Yeah. I was gonna say that's the part that's really interesting is, yeah, you know, we talk a lot about what these tools are doing in environments, but also, you know, the opportunity it it brings to our own platform as an example of how do we, increase increase the speed at which you at which you can get back online, like, using these types of tools, being able to understand maybe what types of backups didn't go through, what was the problem, can it solve it by itself. And so although it poses risk, also great opportunity to help, you know, speed up what the overall process is and get you back online quickly. So it's like pros and cons and everything, which is always interesting. I think, Bipul says, you can't fight these tools without these tools in some ways. And so it's a really interesting conversation that's going on. And maybe to kinda close out this topic, lots of companies testing. I think some of the data and results I've seen from, some reports were lots of companies testing. And when you start to ask, like, who's in production, maybe it's far less than than what companies have who are trying to test and determine new use cases and things. And so as these organizations roll out these types of tools, like, what are what are some of the mental frameworks that they should be thinking of to get to an acceptable kind of level of risk as they deploy these? I think, our chief business officer, Mike Dee, had a very interesting observation. He said, like, agents aren't evil. They're indifferent. And so they're gonna be able to impact all of your data that that you've just given them access to in ways that that you didn't expect. So I think the most actionable thing that our customers can do today is just make a list of all the agents that they plan to have in production even if they aren't in production yet. And then all of the systems that they anticipate those agents will be able to access and impact. And then correspondingly, create a list of how much of that data is actually protected today or backed up or resilient today. And I think it would come as a surprise of how much of that that third column is basically blank. And so I think that that opportunity that lies today is really thinking about as you and your organization lean in hard with AI, how can you get ahead of that transformation by being prepared and really making sure you have a resilient data foundation before you embark on your AI endeavors. Absolutely. So we covered a lot of ground today. We're almost at times. We're gonna start to kinda wind this down and and recap a couple things and talk about some next steps. So I guess just to recap what we talked about, three things we really want you to take away is there's three new rules to staying secure in this new world. One, you gotta stop thinking about backup and recovery as your fail safe strategy. You need to be able to proactively find clean and you need to do that before these attacks start. Preemptive is the new security posture. Right? Making sure that when the time comes, you're able to respond as fast as you can. Second, on the identity side, more than 80% of breaches start with a credential based kind of login. And so they don't just break in, they kinda log in and you need to be able to spot that and and to respond. And then lastly, like Varun's been talking about on the AI side, before you deploy the next tool, you need to ask two kinds of questions. You know, can I see what it's doing? And can I rewind it back? If the answer to both of those is no, then you're probably in a bad spot. We can talk at length about any one of these topics probably all day. Good news is, if you're watching this, the identity and AI resilience virtual event that we hosted was last week. So lots of great content on all of these types of topics whether it's data, identity, on the AI side. You'll be able to go much much kinda deeper, Mark and Broon and I really just kind of staying at the surface kinda level, but you can go as deep as you want. So we definitely would recommend you take a look at this event. All the sessions are available at the link that we will provide. And so with that, guys, thank you so much. I had a lot of fun. I always enjoy the conversations with you guys. I, for one, learn a lot myself. So any final thoughts you wanna leave, with the folks on the call? Prune, I'll let you go. Put you on the spot. Yeah. Thank you, Justin, Mark. So, yep, back up everything your agents touch and and start thinking about the resilient foundation today. And every AI attack is an identity attack, and you need to protect both. And and your data is is where it all needs to start. So thank you again, Mark and Justin, for the time, and, thank you to all of the customers who joined today. Absolutely. And I would just say, just start thinking about the interconnectedness of your systems. As you look across your identity estate and you've got multiple IDPs, being able to be just back up one of those identity providers in in isolation, unfortunately, is gonna open the door to, you know, a 90% recovery is a 100% failure. That's the challenge that we're looking at. So you gotta think about the interconnectedness, not only of your identity systems, but your data systems and how your use of agents expands the blast radius and really being able to think about this from a holistic position. And that's where it's exciting to be here at Rubrik and working with you guys so we're able to to solve these problems together because they are all related and true resilience starts across all three of these. Absolutely. Alright. Well, thank you again for taking the time out of your day, to be here with us. We do appreciate it And so, hopefully, we can see you again soon. We'll see you out there.