59:13 Webinar
Beyond Awareness: Awareness Won't Save You, Recovery Will
Rick Orloff, CISO, and Chris Brandt, Consulting Field Solutions Architect, show why resilience, not awareness, decides survival, and how to build the active-defender architecture that closes the gap.
This webinar first aired on October 15, 2026
The first 5 minute(s) of our recorded Webinars are open; however, if you are enjoying them, we’ll ask for a little information to finish watching.
Click to View Transcript
Good morning, everybody, and happy Thursday to you all, and welcome to another episode of Everpure's Tech Talk series. And today, to celebrate Cyber Awareness Month, it's hard to believe it's already October, let alone the middle of October, we're gonna be talking about awareness won't save you, recovery will.
And we've got two fantastic speakers joining me today for this topic. Our very own C- CISO, Rick Orloff. Hopefully I'm saying Orloff correctly. And then we've got Chris Brandt, who's one of our consulting field architects, which is a mouthful in itself.
But these guys are, like, w- my go-to assets when I have questions around what customers are doing, what f- the people are seeing. That way I don't kind of live in this tower of, of Babel. I want actual, factual, it from the field details. So Rick, I know I said you're our CISO, but why don't you start us off?
Give us, give everybody a little bit quick intro of who you are and kinda why, why you're here today. Thank you for the, inviting me to the show. Yeah. Thank you for coming. Rick Orloff, CISO at Everpure. My background involves everything from startups to Fortune 5 to,
three-lettered agencies. I'm still a licensed private investigator in the state of California. Oh. Been at, Pure now for a couple years and having a great time. Wow. I'm just gonna start calling you Magnum PI, I guess. You're da- you're dating yourself.
I am dating myself, but- But, but, but I'm with you. But I'm with you there that is definitely a job description I have yet to ever hear anybody say the PI side, so I might have to pick your brain on that one a little later. So, Chris, that's a tough act to follow, but why don't you- It is. It is tell us a little about yourself? Chris Brandt.
I'm the consulting field solutions architect for cybersecurity and resilience, which is a mouthful, like you said, and it keeps getting longer all the time. I- Yeah you know, so it gets harder. I- I- I've got a background in, you know, various forms of security operations and things like that. I, you know, had CXO roles in the past.
I've, you know, built high security facilities. I even built a high security facility 225 feet underground beneath a mountain- Mm-hmm that was EMP shielded. So- Wow you know, had, had a lot of fun doing weird things in my career. Wow, that's awesome. I mean, yeah, we should I mean,
I definitely wanna get some beers with you guys. I- I, yeah. I'd love to talk to you all about EMP. Well, thank you guys for both you for joining. Just a little quick of housecleaning before we get started. I wanna call for the folks online in the chat, you know,
if you have questions during this presentation or this kind of, podcast kind of scenario we've got, please throw 'em in the Q&A panel in the chat. I will definitely do my best to ensure we can get those answered either by Chris or Rick, or maybe we take them offline. Obviously we have two very unique a- and smart individuals on here that probably have
a vast knowledge of, you know, security and what other companies are doing or how to build these types of things. So don't be shy. I think this is a great chance for those kind of resources. Especially when I think about, you know, I'm an infrastructure guy. I don't have your guys' hardcore security background, and I just think about,
you know, when I first got into s- quote, unquote, "security," I mean, it was always firewalls, it was perimeter stuff, and I'm going back and, you know Rick, I keep dating myself. You know, I'm talking about early 2000s. It's like, protect the edge or maybe you've, you know, you've got some end user stuff. So I feel like it's even more important now, obviously, with everything that's going on.
So let me transition to our kind of our first set of questions to why this matters now. And I'm gonna start with you, Rick. Like, what I mean, you were at Black Hat this year. Let's kinda just get a foundation. Like, what, what's actually going on?
Like, what, what's the security community talking about, and, like, what's really top of mind kind of at a broad level as we kinda drill down into these topics throughout the show today? Not surprisingly, AI was front and center at Black Hat this year, and they were approaching it from many, many angles.
Everything from the creation to technical controls. The underlying common denominator I would or I would describe as the focus and importance is due to time compression with AI risk. So it used to be like you, you talk about firewalls and, and, you know, I'll look at that as defense in layers,
for example. And it used to be you had defense in layers, and at each layer you could do something and detect something and respond to something. With a- AI risk, that time compression could be down to seconds. So it's no longer sufficient to sit back and, and just watch for these detections. Right. You have to have a strategy and controls that
allow near real-time machine speed response. Yeah, I mean, it's I mean, you know, the boogeyman these days for a lot of reasons is, is AI. I mean, we, you know, I can't seem to go a day without hearing about AI and this sort of thing, and just how fast everything is moving.
And to your point, you know, when I again, when I think about my infrastructure days, it was about detection and like, okay, but how do you react to all that and- Right that and this. But what are you seeing, Chris, when you talk to, you know, customers? When you're out in the field, I know you do workshops and you're just ob- you know,
you're building EMP bunkers and stuff like that. So like Yeah, no, I, I mean, I, I had a similar experience when I was at R- RSA. I mean, like, A- AI was, was the, the central topic, and I think, you know, I've been on other panels talking to people and, you know- AI has really changed the nature of what's going on.
And, you know, cyber extortion events have always been a big problem. And, right now we're in, you know, the, the perfect storm of things, right? Because AI is both increasing the attack surface because, folks are using it internally, and one of the things that I kept hearing from people is that, you know, people are building skills, they're building agents- Mm-hmm
but the challenge is they're, they're embedding their permissions in those, and then giving them out to the organization. Oh, geez. So, so you s- you have a lot of these situations where people are just building, you know, these things that they, they feel are rather inconsequential- Yeah handing them out to other people,
and all of a sudden they're giving them access to all kinds of data that they shouldn't have access to. In addition, you have all these agentic attacks that are They're coming, they're multimodal. You know, you have, you know, an agent that's doing, social engineering attacks both on, on humans and agents.
Y- you know, you're seeing a, a much broader attack surface, and the, the pace and the nature of the attacks is just exponentially growing, because th- you know, they don't sleep, they don't eat. Yeah. You know, they don't have to take a bathroom break.
They don't get tired, you know. They just keep coming at you, and that's, you know, I think what the, you know, a lot of the security vendors are, are, you know, faced with is their, you know, models being upended because, you know, these are non-deterministic types of attacks, and they're really difficult to defend against. They're coming in volume, they're coming,
en masse, and, it, it's, it's really asymmetric warfare right now. Yeah. It- And geez, Rick, I'm gonna For, just for you, I'm gonna keep dating myself. It's like, did we not learn anything from not, like, hard coding usernames and passwords and scripts and INI files- in the early 2000s and 2010s? Yeah.
Like, I wouldn't think people would be doing that in their bots, Chris. Like, I honestly Like, that just kind of shocks me a little bit. It's a surprisingly easy thing to do. Yeah. But the other thing, like I'm curious 'cause, like, you guys both mentioned, and one thing with the AI thing is it's also
And I'm curious, you know, from Black Hat or from your guys' experience, like, you know, this stuff, these tools are just out there. Like, the ability for somebody You know, we always used to talk about script kiddies or whatever, but, like, the ability to get access to these tools is probably a huge magnitude greater than it was again, you know, even five, 10 years ago, right?
Like, you could just go There's probably websites where you can go buy these tools. Or, I mean, does that play into it as well? It's not just, you know, to your point, Chris, the things they don't You know, they don't sleep, they don't eat, whatever. But it's like, if I'm a nefarious actor, I probably have just such easy access
to these tools these days. Yeah. I mean, I think, it, it, it's You know, w- when we all kind of heard about Mythos coming out and they withheld it, and there was a lot of drama around that, I think there's two things. One, you know, it was finding a lot of vulnerabilities, which it's very good at.
But I don't think that was the really interesting thing about Mythos. I think the thing that was the step change that everybody talked about with Mythos was the fact that it can take zero-day vulnerabilities, turn them into an attack framework, and autonomously launch those attacks. At the time Mythos came out, we were thinking, we were kinda like s- you know,
the rest of the, the world was, like, six months behind it. It was probably more about two months. But now, you know, these capabilities are in open source models, open weight models, and, you know, they're, they're really available to anyone. So you can I'm sure go and buy them as a service- Yeah if you would like, but you,
you probably don't even have to do that. Right. Yeah, you were like, "What? I can get it for free," right? "Why am I..." Right. " why am I paying for it?" I mean, R- Rick, from your view and your angle from what everything Chris said, like, as somebody that's kind of, you know, at the top layer,
right? Is, is, is in the C-suite from it, like, how do, how What do you think of that? How do you process that? Like, you know, does that keep you up at night? Like, you know, as somebody that's Yeah. You, you raise a really good point.
Yeah, you mentioned script kiddies, right? We used to worry about script kiddies getting their hands on stuff and then, and running, and then we would look at that, you know, kind of the back of the defense and layer strategy. With these frontier models, that not only will, exploit the vulnerability, but chain together, medium-low level vulnerabilities
into an exploit, the barrier to entry for somebody to go engage in that is very low, and you don't have to be a coder, to go do that. And it's good. And they're, they're, they're effective. It's very Yeah. Yeah. Yeah. It I think that's the, that's the ultimate answer right there, Chris,
is that at the end of the day, it's effective. Yeah. How they got there doesn't really matter. What we need to know is that it's effective, and we have to respond to that. Sure. Yeah. That's, it You know, maybe let's not advertise that, Chris, that there Like, I mean Hey, you know,
people wouldn't be doing it if it didn't pay. No, I know. I, you know, a little bit of me was like, you know, ignorance is bliss a little bit. Yeah. But obviously we're, you know, we're here to speak the truth, so but when you think about everything we said, like, again, at the high level,
like, how would You know, Rick, how do you break that down into, like, more manageable chunks? Like, I'm a guy that likes to work some, you know, in threes and fours and go from there. Like, so do, do you see, like, three areas of threat, three attack surfaces? Like, how would you kinda We take that higher umbrella and we kinda boil it
down a little more. A couple of things. You know, we s- we started talking about RSA, and I think the point that Chris and I are making right now, what I saw at RSA this year is they're answering the so what question. Okay, this is happening. We're, we're not gonna stop it.
So what? What are we going to do about it? And there's lots of opportunity in how, how to do things, what to do, how to action that, how to detect it. I think RSA, this year was really focused on that so what, response. When I start thinking about this, you know, from an AI perspective, there's,
there's a couple of verticals I think about. One's malicious, right? It's malicious AI, whether it's self-generated or somebody has targeted, that AI, at our infrastructure or pr- systems and services. Then there's rogue AI, which we have seen in, in the news, you know,
so I don't have to elaborate on that. You know, that- example there is, you know, o- one company's AI went and attacked another company's environment to go get an answer to a question that was asked. Yeah. But what was interesting about that is that AI also went after the attack and tried to delete log files.
So it was trying to cover its tracks- Yeah which is, you know, pretty interesting. And then I think the third piece is identity and identity drift. Companies that are still dealing with tech debt and identity, pro- this is not in your favor. So we really need to focus, as a core component to all your controls
is gonna be identity, not only of individuals, but each agent should have a unique identity, and that identity should be based on principle of least privilege and RBAC or ABAC or, you know, something along those lines. And if, if that is in place, then you can also write detection engineering against those identities, looking and detecting drift.
Yeah, I mean, the It's funny. Again, I go back to, it's kind of, it's like, it's like the, the things that we learned the last couple of decades in this, you know, internet world or whatever, even just the IT space in the '90s, it's like I feel like we're forgetting this.
Like least privilege, don't put passwords and usernames into things. Like it's I don't know, maybe just people are just so excited about AI and they're just kind of forgetting some common, common sense. Yeah. 'Cause I, I hear that, and I, I That's what I c- I, I know I keep saying, I keep going back to it. It's like these are things that we've talked
about for a very long time, you know, role-based access control and least privileges and stuff like that. Chris, on the field, like when you're talking to customers every day, I mean, does that kinda ring true as well? As like are you, are we kind of going back to it's like, "Hey, let's..."
We're talking about these things, it's like, but we gotta remember these, like learn from the past a little bit. I know this stuff is new, but you know, some of the same rules still apply. Yeah, I mean, I, I, I think it's a little bit trickier than that. I mean, one of the problems is that AI's still maturing, you know? Yeah.
It We, we haven't figured out all the nuances to it yet. And, and I do, I, you know, I just saw an announcement from Google yesterday that, their auth tokens, in their new MCP server that's coming out for their suite is going to require specific auths for AI separate from your own. So you know, you, you're starting to see that motion- Mm-hmm motion happen.
You know, i- and, and the identity piece of it is, is really tricky. You know, identity and, and, and, ex- you know, s- supply chain exploits have, have, you know, unpatched software vulnerabilities and things like that have historically been a big, big thing. But you know, now, AI's smart enough to take advantage of the tools that already exist.
A lot of these attacks that we're seeing all of a sudden are not vulnerabilities. They're just exploiting, you know, policies and procedures. They're exploiting, you know, just the regular tools- Mm-hmm and, and getting in. So it's, it's, it's, Li- like when I said, the attack surface is, is really complicated right now, and it's, it's large, and it's getting larger every day.
And, and, and some of the vulnerabilities that we're introducing into our environments, you know, I don't think people really even understand what, what, what they're doing. And, and so I think, you know, we are in a really interesting inflection point in, the industry, you know, much like when we first added high availability or we, you know, started, you know, backing up systems or we got a DR site.
I, you know, one thing I, I talk to customers a lot, about a lot is this is fundamentally a different type of, situation than DR is designed to- Right to prevent. You have to, you have to architect your environments towards, and, your policies and procedures as well, towards, this new cyber extortion, attack. And you know,
so that requires a different architectural approach and different, you know, procedures. So i- it, it's, it's getting complicated out there, and I think, you know, that's why we start seeing a lot of conversations about isolated re- recovery environments- and that sort of thing. Yeah, it's, you know, the ideas of DR sites, you know, that was I mean, yeah,
you Over the years, we've stretched that of like what we consider a disaster, right? Like, but you know, usually people are planning for like power outage, n- you know, a natural disaster. My, you know, the data center went completely offline here, so I need to- Smoking hole bring up my business.
You know, I'm in Seattle. It's like, so Seattle has a problem, my DR site's in Spokane. It's on the other side of the state. You know, it's not for It wasn't originally kinda designed for this more of a real time attack DR where it's like y- you, you didn't lose your building, you didn't lose power,
you didn't lose any of these things. It's just like you got hacked. Like AI just- Yeah got in and beat your system. So what kind of pulling on that thread, you know, with a little bit of the narrative shift between, you know, backup and recovery, like how does You know,
we're in cyber awareness month, right? Like, that's why you guys are here. We're celebrating it, not just because it's Halloween and this is a spooky topic, but you know, how, how are companies or how are folks, or how are we helping folks, Rick, even as that way think about resiliency in their architecture when it comes to,
you know It's not just DR. It's not just you've replicated, you know, a set of data from site A to s- to site B. The resiliency piece to technology now is probably at that critical juncture. At the board level, it used to be security would talk about, backup and recovery,
and it would be somewhat of a checkbo- checkbox, conversation. And the questions would be, "Here's my critical data, here's my critical environments. Do you have it backed up? Yes or no?" Yeah. If yes, everybody was happy and we went on to the next topic.
Today, boards are far more sophisticated, and they're asking a very different question. Not whether or not your data is backed up, but whether or not you're resilient and you can bounce back from an attack and start to run your, your functions and the business again. And if so, how long does that take?
And so being able to have an infrastructure with snapshots, resiliency, and data where I, you know, I consider data as king. You know, we, we talk about data primacy. Being able to pull all that together in a resilient, recovery model is the new measuring stick.
It's not whether or not your data is simply backed up. Yeah, and you So you guys might not know this, or people in the audience if they've joined. Like, I actually started my IT career i- doing backups oddly enough. I was the backup guy. Like, I was the guy that went in and I worked for a entertainment company that's run
by a mouse, and I backed up thousands of servers, right? So I, I remember those days, Rick, where we're like, "Hey, I took the backup-" Yeah. " you know, and I got the audit form," of like, "I didn't test the restore." Tape, tape and Iron Mountain. Yeah, I remember. Yeah, right. I off-sited hundreds of tapes to Iron- Yeah
to Iron Mountain. I don't know if I should- Yeah be bitchitting- I remember bitchitting folks. But, like, when it comes to that idea, how are, how are fo- Are, are you having those conversations? Because I know you do talk to customers as well about, "Hey," C-level suite or, you know,
VP director like, "What do you need to keep running your business?" Like, what's the, you know, what's the MVP, the minimal viable product to run your business as opposed to like, you know, when they're thinking about these things. I mean, the, my in my experience, a lot of customers didn't really know what they needed to be running to, to stay in business.
Yeah. We do get into those conversations, and what I'm finding is people that are really using our tech, for example, are exercising, the ability to recover. You know, in traditional BC/DR conversations, everybody had a plan. The plan wasn't necessarily tested.
And if they- Yeah did test that plan, one of the, common findings was, everyone pointed to a couple of people that they thought were gonna be an available resource. If I use you, Jason, as an example, you were the tape backup guy. So 15 different organizations with backup and recovery plans all had you on their list
as somebody to do something. Yeah. And you weren't available for 15 organizations. So if you're not solving the problem with technology now, you're, you're gonna really have a problem. And so what we really see now are people that are exercising the BC/DR
and actually recovering and, and working through snapshots and bringing things forward. And there needs to be a clear understanding what systems, services, and dependencies are needed for my minimal viable operations. And if you set those based on priority, at, at least in EverPeer's view, the priority is customer first.
I need to make sure that I'm supporting all of my customers with all of our services. I'll worry about running the backend side of my business- Mm-hmm as a secondary issue. Yeah, and it's And I think about, you know, everything you just talked about, it's like, and it's not one thing to buy. You know what I mean? Like, that's You're,
we're talking about a collection of things. There's not a, there's not a line item that I can go buy and say, "Protect my entire business," or we you know? Yeah, this is- I mean, if, if there was, I wish you could tell us what it is this is not, this is not a SKU that, that you go buy, right? Right.
Right. This, this is, this is a process supported with technology. Right. Yeah, it's I mean, I, you know, again, I used to do a lot of DR stuff and go in and run those DR workshops with folks. Like, okay- Right you know, where are your databases?
What apps were using the databases? What web front ends use those app? You know what I mean? And just trying to like w- run those workshops. And of course, I'd always have various teams, and they'd be like, "I don't know." You know?
And what, and what credentials are needed? Yeah. If you're gonna do a, a restore, or you're gonna move, to a different data center, what are the system services and credentials that are needed to make all that work? Yeah. So Chris, I'm gonna flip to you,
kind of the same, same question, same idea, but like, again, you're, you're all, you're, you're definitely meeting with customers. I know, Rick, you- Yeah you've got a different day job. I mean, I know you meet with folks all the time. But Chris, you're definitely, you're out there in the field, like,
and you're having these resilience conversations with folks. Again, it's like we just kind of kid about like it's not You know, I just don't go buy one thing and then I'm protected. So like- No, no this is an architecture conversation. This is, this is definitely an architecture conversation.
And one thing I will, will say, and I, I think Rick's, Rick's an example of this, is that Gartner, end of last year, they came out with a position piece that said that, you know, looking at the threats going forward, CISOs' remit needs to be around recovery, right? You know, previously the CISO organization had focused largely on detection and prevention.
Mm-hmm. But the reality is the, the ti- the nature of these attacks is, is, is going to continue to be asymmetric and, and stopping them is going to be increasingly difficult. So, you know, you, we need to take some of that budget that we were using to buy a lot of tools to, you know, detect and prevent, and, and shift that into the recovery
bucket now. And so what I'm, I'm seeing from a lot of customers is that everybody's talking about building out an isolated recovery environment. And you know, the, the, the challenge with a DR site is whatever happens on your primary site gets automatically replicated to your- Right DR site.
So everything's compromised, right? So you know, an isolated recovery environment's a place where you can have a- Safe bunker for your data where you don't have, you have a s- a separate identity and an access management system in there so that if yours gets compromised, this doesn't get touched.
You, you have it isolated from your, your, your production network, so anything that's going on is not impacting in that environment, and absolutely using immutable snapshots as, as, as a primary form of, recovery. Because at the end of the day, so many of these attacks are really denial of service attacks, right? And, and the goal is to get these,
get your business in a minimum viable business up and running- as quickly as you can. And that usually, the guidance around that right now is to recover from an immutable snapshots the moment before the event happened, whether that's wiper-ware or, you know, encryption or, or whatever it is. Bring that back online in an, in a secure environment,
look for indicators of compromise, patch all those indicators of compromise, clean up all the destroyed data, and then promote that back into production. Now, that assumes you have somewhere to do that kind of work, in those isolated recovery environments. And one of the things that we see happen a lot for folks- is,
they don't have equipment to actually do the recovery in. I, I worked with a customer who, it took a week before the FBI cleared their staff to even go in- Sure and work on their problem, right? You know- And they're doing some sort of forensics or whatever, right? That are like- Yeah, well, they, they, they, they didn't know if they were the perpetrators
of the attack, so the FBI came in and investigated. You know, there's a week gone, you know, already- Yeah and you haven't even started anything. But when they went to recover things, every piece of equipment in their environment had been compromised or confiscated, right? So they didn't have anything to, to do that work on,
so they went out to Best Buy and they bought SSD drives, thumb drives- Wow Netgear switches, you know? And, and that's, when you talk about these extended outages, that's what's happening usually, you know? You know, everybody has a backup plan, you know?
It's just that backup plan can be quick or it can take a really long time, right? Yeah. And, and realistically, if you want to recover in a quick fashion to a minimum viable business, it's gotta have to be from some sort of immutable snapshots. Yeah. I mean, Rick, I mean, how many folks, or even for us, like, how would you deal with a recovery time objective of a week?
Like, like I don't think most people are planning for that, you know? That, that is, that would not be a good situation, uh- No to be in. You know, a- and when we You know, we, we were talking about defense in layers earlier, right? And if somebody makes it through your firewalls, your applications down to the endpoint and,
and your stack is compromised, like, you know, Chris was alluding to, and then you're still not really sure where the compromise is and so that's gonna y- take you a WEKA and have to, you know, run to the store to start buying hardware, that's an undesirable circumstance. At the end of the day though, what is it that the business needs to be able to rely on?
And that's gonna be your data. You, you know, if you think of data as a, as a control plane or data as a, as a layer, having confidence that your data is protected and that you can recover data in near real time or dynamically, is far more confidence-building for the business or the board or the C-suite to say, "Yes, we're good.
Let's go turn it on. Let's go run the business. We can deal with all the other stuff and investigate later, even forensically, while still standing up my business." so at the end of the day, you know, we need to run the business, the customer-facing, support and services, and we can figure out, you know, the, the back end later with those other snapshots,
even the corrupted snapshots. We can carve those out and go run forensics on that separately. Yeah. It's, You guys have both touched on something that, you know, I, I You, you think about, like, if you got a ransomware attack or, you know, or something like that, you know, obviously the first thing they wanna do Well,
not the f- maybe the second. First thing is they wanna get in. Second is they wanna, you know, cripple your ability to recover, right? So Chris, that's where, you know, the immutability of the snapshots meaning for those that, you know, we have this, switch called SafeMode which means you can't It
takes two actors to delete a snapshot. We can go, you know, we can go further into that, but I mean, it's basically two keys to, to get rid of it, so you're protected that way. Because earlier on, Rick, you pointed to something scary. It's like when you talk about the, I think it was you, Rick, with the AI attack where they,
they went in and they knew to start cleaning up their logs, right? Like, they're doing- Correct it was acting like a regular attacker. It's like, "I got in here, now I gotta make it look like I wasn't here." Correct. Or B, I need to also make it so you can't recover what I've attacked, right? Like, you know, whether again, I deleted your backups, I deleted your snapshots, whatever.
You don't have a way to easily recover and then, you know, I, I sit back and I collect my Bitcoin or whatever way, whatever way I'm asking you, asking you to pay me. So it's, it's funny how it alway- you know, when you think of security and resiliency, you, when you kind of think about your data, most people think of the DR, the backups.
Like, I've taken a backup, I've replicated it here, but you know, there's so much more to it than that when it, when it's at that layer. I mean, obviously firewalls are still important, all these other things, but the actual data is just as important nowadays 'cause that's really what they're after. They're not trying to get your firewalls.
They're just trying to get through your firewalls or through your security. Yeah. That, that, that's correct. And I, I don't wanna lose sight, you know, Chris made a really important point, and that was last known good. So it, it's, it's one thing to, you know, have your, your data compromised,
a- and you're gonna recover. It, it's another, it's another issue to decide where to recover to. And being able to have control, and make those decisions is a huge, huge capability. Yeah. Yeah, it's, you know, it's an old j- I always just say, "You can take the backup,
but can you recover the backup?" And I know that's not exactly what we're talking about, but again, it's like just 'cause you can do one- Well, that, but that used to be like with, with tape and Iron Mountain, right? That was the issue. Yeah. Right. I have my tapes, now,
now how am I going to build bare metal all, all the way up that stack- Yeah with all the dependencies to make it work? Yeah. Now it's like- Yeah I have snapshots, but are they protected? Are they not corrupted?
Are they not deleted? So, but with that kind of idea, Chris, like, you know, this is the kind of like sh- I, I wanna say show, but we're not really showing, so tell me, you know, like what does good look like? That with all these things that we've talked about, like what does that kind of resiliency architecture look like?
We've talked about all these points, but like if I was to go to somebody and say, "Hey look, here's a baseline of things that you should be thinking about," like, you know, which I'm sure you talk to customers about all the time, like kind of walk us through that a little bit. Sure. You know, well, one thing I would,
I just wanna point out too is that when you, these attacks hit you, and I will say one other trend that we're seeing right now too is an increase from nation state, uh- Sure actors. This used to be more financially motivated people, but now we're seeing a lot of nation state ac- actors getting in, in on, on this as well.
But your entire, access system's going to be compromised. When they come in, they're going to get into your active directory or whatever it is you're using. They're going to have the highest level privileges in your organization. So when you think about that, they're going to be storage admins. Mm-hmm.
They're going to be backup admins. They're going to have as much access as anybody in your organization in going through this, and that's why the mutability is such an important piece of it because it's, it's, it's, it's a, it, it's a multi-person authentication as well. So like for our, our, our SafeMode SafeMode Snapshots, you have to have two people who,
who agree to any action. Yeah. And then you have a third-party authentication piece too. So it's not anybody in the organization that can do it. You have to have the credential to even initiate it, and then you have a third party vetting all that too.
And, and that's, that's a really important piece because, you know, identity and access is, is gonna be a challenge. But what good looks like, I would say, is, organizations building out an isolated recovery environment. So an isolated recovery environment is going to have your,
your backup snapshots sitting in that, that protected environment, and that's going to be isolated from your production network. And you're going to have the capabilities to restore from that. You're gonna have the capabilities to do the forensic work that you need in that environment.
And you're, you're gonna have the tools and possibly the gear to bring that back to production, right? Mm-hmm. I, where, where I, I see most companies struggling on the isolated recovery front is really not an equipment challenge. It's not a tool challenge.
It's, it's in a, in some ways not even an architectural challenge, but it's a people and process problem. You know, we, we talked about minimum viable business, and, what I see in so many organizations right now is that that becomes the, the task of IT. But IT is not prepared to answer that question, right?
You know, 'cause when IT goes in and around, they're like, "Do we need to, do we need to have this available?" You know, everybody's gonna go, "Yeah, my, my app's the most important app in the whole place," right? Right. Everybody's- Yeah app or whatever is the most important, right? So Yeah. Yeah. But,
but you really Because if you try to recover everything, you're gonna recover nothing. If everything's a priority, nothing's a priority, and that's the biggest mistake I see so many organizations making is not being able to adequately bring the people to the table to determine what is that minimum viable business.
And that's, that's, you know, people from finance. That's executive sponsorship. That's, you know, people in the line of business. That's IT. That's risk and management. It really takes everyone to, to really identify what it
is that's gonna be minimum viable business for folks. So that's a really hard conversation to have, and sometimes you need a third party to, to you know, navigate that process. Yeah. I'd say the other challenge that people have is in, in the air gapping side of it because, you know,
obviously working with a true air gap is nearly impossible. You can do it. We offer dark site options for that as well. But, you know, most organizations have things out on the internet, and they have to have access to, you know, they have SaaS apps. They're hybrid organizations.
So it's, it's never as neat and tidy a picture as, as we want it to be. And so that's, that's where I think, you know, most organizations struggle is, you know, figuring, figuring those things out. Yeah, and you've mentioned an IRE or insul- isolated recovery environment a couple times and- Yeah just, you know, I'll-- I'm familiar with it, but I got, you know,
some basic questions to it. But, you know, 'cause when I'm thinking about architecture, you know, again, I'm thinking about data centers again, so I'll use like I've got a data center in Seattle, maybe my DR site's in Spokane. You know, where does that IRE need to live?
Does You know, again, 'cause the way we're talking about the attack surface or whatever, like it, you know, can that still be in my Seattle data center in my example, or would I want it in a third site, say, I don't know, somewhere in the Midwest, like in my example where my DR site is, you know, in the same state but across the mountains. Like kind of like what does that look
like for a customer when we say, "You should have an IRE"? So typically, the recommendation is to have the IRE in proximity to your production workload because you need to be able to run a production workload- Okay when you're done, right? And remember, this isn't a smoking hole like in a DR scenario where, you know- Right the,
the data center burned down or something, right? Yeah. So you have a functional- facility, you just, you know, gotta get it backup online, right? And that's one of the reasons why it's, it's so challenging in that regard. And so what I, you know, and, and like I said, most organizations have a hybrid environment.
And what I would s- suggest to people is that, you know, the, the, the pr- you know, like anything that's on-prem, you should have an IRE for your on-prem workloads. Because remember, you're moving, you know, PiB of data potentially. Yeah. You know, and, and, and data has gravity, right? You know, it's, it's data gravity and it's, it's, you can't, you know,
you can't beat physics. But you know, you, you're probably gonna have stuff in the cloud too, and you may need to have some sort of IRE for your cloud assets as well, because you don't wanna be shipping that stuff over the wire. Yeah. 'Cause y- you, you know,
we're trying to get this up as quickly as possible, and if you're, if you're doing that, you're gonna be pushing a lot of data and you're gonna be waiting a long time. I know for some people in the cloud, you don't wanna be pulling it down from the cloud either, right? Because that's just gonna be- It, it, it's hard slow and expensive.
Yeah, and you need, you need performance to do a lot of these analytics. Yeah. You know, you have to have that, the ability to do those fast. I mean, 'cause, you know, we, we talk about like active directory recovery is just torturous to do.
You know, like databases are a great example. You know, you, you, you, you, you know, recover a database, you bring it up, you attach everything, you rerun logs. You know, that, that all takes a lot of time and effort. And then you get through it and you start analyzing it and it's like, "Oh, this,
this database is corrupt. Okay, well, let's tear that down and start over." Yeah. So the slower your environment is to respond to those kinds of things, the, the longer it's gonna be for you to You know, that's what turns days into weeks into months, is those kinds of things.
Yeah. Iterating over them a- again and again. Yeah. So I'm gonna kinda come to you on that one, Rick, because again, you know, all this stuff costs money, right? Let's, you know, there's IT budgets and, you know. So if, you know, as a CISO or if somebody's coming to you, like how do you, how, you know,
how do you make that business case? Like sometimes just even getting a, a regular DR site is hard enough- Right you know, for organizations. Now it's like, "Hey, not only do I need a DR site potentially, we'd like this other isolated environment." Like talk, walk me through like, you know, what's that, what's that conversation like at,
at your level? Like- Yeah, the good part is we get a discount on the storage, I would imagine. Right. But I mean, like Chris is like, he's like, you know, it's, you know, one level, Chris, and I'm not, hopefully I'm not painting you too far in a corner, but it's like, you know,
we're talking about architecture and the decisions and the stuff and like, but you also gotta go to the bus- the business within the business, Rick, and be like- 100%, 100% "We need this." 100%, yeah. You know? So. And I, I'll Chris, I'll use your, discount code on my next order.
Right, yeah. Thank you for that, appreciate it. I, I, I wanna just emphasize something that, that Chris said. Anyone that's ever been in a recovery scenario, understands the pain of waiting for that data to download. Mm-hmm. This is not something, you know, plug it,
plug it in, wait five minutes, you know, for an app to download. While it's downloading, you're losing all kinds of time, right? Where, where's your recovery objective? You're burning all of this time, and even then it's not a huge confidence level that it's gonna work, right?
So there's all kinds of what-ifs, right, that you're still waiting to answer, you know, to the board and to the C-suite. Mm-hmm. So when I, y- you know, approach this, you know, we start with situation awareness first. You have to have line of sight, situation awareness. You need to establish what needs to be recovered in what order.
And from there, you know, we go from the situare- situation awareness to now the resiliency exercise. What am I gonna recover? How am I gonna recover it? What is my confidence in each of the technical layers?
If I have confidence in the data side, usually the data piece is the, the biggest barrier, the biggest question mark. Can I get it up and running? How long? And will it be any good? And so from a resiliency standpoint, depending how well you're able to answer that question,
for example, if somebody was still using tape today, I would argue that their confidence level, if they said to the board, "My confidence level is 90%," I would question that i- if you're still using tape. Not, not that a lot of folks are using tape. Right. But, you know, you know, for an illustration though, you want to be able to answer
those questions with, people, process, and technology in a way that you can say, "I have high confidence in each of these layers." Yeah. What's funny, and this is probably not a great word, but what one thing it's like it's hygiene. It's kinda like your business hygiene of like how everything- It, it, it is, and actually,
we, I do call it that, right? Okay. It, it, I- I was like, is that wrong to say it? No, no, no, I- Yeah, that's it I do, I call it corporate rigor, right? Okay. It's process rigor and good hygiene. Yeah. Which also kinda leads into the fundamentals.
As it relates to a lot of these things, it's about understanding and executing the fundamentals before you have an issue. Before you're in a recovery scenario, you wanna know that your snapshots and all your recovery processes have actually been tested and work. A- as an example, you know, if, if, if you had recovery capabilities
and you're building a new data center, why not use that new data center to test your recovery capabilities? Yeah. Go pull your backup and go recover at the new data center. It's a free exercise. Yeah. Yeah, break out the run book or whatever,
you know, and- Yeah, it's a free exercise. Move the data that way. Yeah. Yeah. And I, I Rick is a- absolutely spot on. I mean, you, it's, it's not just a we built it and checked a box kind of thing. Yeah. You have to live in this environment and work with it every day, maintain it,
make sure it's, it's, it's, it's working properly, make sure that your policies and procedures are gonna work. Because you know- I see so many times o- organizations, they'll like, "Well, I recovered the one app and it only took me 15 minutes." It's like, yeah, well try that again- when you've got 500 of them to do- Yeah and your network's down.
Right. You know? It, it- A- a- and to your point, if you didn't build a resiliency program, everyone that wants to recover, it thinks that they're the priority. Yeah. Yeah. There, there needs to be a, a sequencing that's already lined up. Yeah. I've got, I've got scars from my,
my customer days or my production days of being in the war room when something's down. Yeah. And to your point, like when I tested it, it came up in 15 minutes or whatever, to your point, Chris. Yeah. But now that I'm on there with 10 other managers and directors going, "Langer, this way, what's taking..." I'm like,
"I'm trying to do this," and you're like Right you're wanting an update every two minutes while I'm trying to do it. Yeah. So Yeah. I can, I can still feel the hot breath of the executive on the back of my neck as they look over my shoulder and ask me, "When is it gonna be up?" Right.
Yeah. So- Yeah you know, if there's only three Y- y- you know, if, if, if you're a $100 billion company and there's only three backup people, in the organization, and every department listed those three people as part of their recovery plan- somebody should have caught that, in the design.
Yeah. Yeah. The joke I remember from some of my cohorts back in the day was like, if there, if there was a DR event, my resume was already going up. Like, they were just like Y- you know, I, I You joke about that, but that's, that's real. I've, I've talked to folks- It is real who've been in some really bad incidents,
and they're still working at these companies. They said, you know, it's a, it's between what would you do, you know, when, when if this had, would happen again, and it's between like, well, I'd First conversation would be negotiating my salary. Yeah. You know? But the s- the, the other option is like I,
I wouldn't do it again. Yeah. So- You know, 'cause I, I, it's, it's a lot. I, I d- I do wanna drive that point home though, 'cause I, I think we all have the battle scars, you know, in common. Yeah. But I do wanna drive that point home.
One way to address that, you know, we talked about people, process, and technology, is on the technology piece. Having that self-service snapshot recovery, I can make the decision based on what I know and where I wanna recover to and start running my function. That means from a resiliency plan, I can have my five, six, or 10,
critical core functions all in a recovery process independently without having to cross over on I need the same three people, you know, for all 15 processes. Yeah. And people take vacations. Right. You know?
You know, it's the- And, and invariably- What if they got hit by a bus scenario, right? Or, you know- Well, and, and in some cases, if they know you're gonna be out, you know, key people are gonna be out of town, if there's a conference or something, that's, that's a key point to launch an attack. I mean, they do a lot of research on these things sometimes.
Yeah. You know, Chris, that's a brilliant point, 'cause you think about if they get in, they get access, you know, maybe they Maybe my title says disaster recovery expert or something, right? And they, they see me in the gal, and they're like- Yeah "Well, let me go look at Langer's calendar." He's like, "Oh, the, the re- D- DR guy is out,
you know, the week of October 20th. Like, that's when we should attack because they're gonna, you know, potentially be down the person that, you know, knows how to recover from it or can help them." So that, I mean, that's- Absolutely it's a, it's a brilliant point. So I'm just looking at the clock and I So I got, wanna speed up a little bit
just to be mindful of people's time. You know, since I do have you on the call, Rick, or we have you on the show, no offense, Chris, you know, C-suite, CSO. No, he's, he's got that officer title. Yeah. He's got the officer in the title.
You know, if y- if I could get every security leader on a call with you, you know, what, what would be like, I don't know, five things? Like, what would be the things like I need I think you guys should be thinking about this or looking into this, but like what Or what would be the questions you would ask them or things that you would kinda like tell them to go look
into or be sure you're prepared for? Like, the f- the five words- I- from Rick or five things from Rick, I guess, at this point. I would probably bucket this into maybe two, two large verticals. The first vertical is operationally, how well are you structured? Do you have visibility, across the entire enterprise, across the entire infrastructure?
'Cause that kinda comes to that defensive layers, right? We, we still want to protect what's the most important, and that's gonna be data, right? Yeah. Data, you know, we're, we're a primacy layer. You know, I think of data as a control plane. I need to protect that control plane.
That's gonna be my defensive layers. So how well are you doing that? And then those questions start to get into visibility, process rigor, how well are you doing fundamentals, identity, you know, hugely important. And then the next vertical gets down to, okay, if something did make it
through that particular vertical and now I'm dealing with data, how well have we structured or understood our data layer or the data control plane? If we can answer the question, here's the, here's the chunks of data that I need to run my business, and I'm resilient and I can recover, that's the posture that we wanna be in.
Okay. And then I'm gonna kind of flip it a little bit to you, Chris. So, you know, our audience, you know, could be a mixture of existing Everpure customers, right? So they might already be FlashArray or FlashBlade customers, so they might already know some of this goodness that you've talked
about. But of course, there might not be I mean, we've got people that come on that are, you know, maybe researching a storage move or whatever. So with kinda that framing that up, like both buckets, like how w- how can we help customers today? Like, thinking of folks that are m- might be on our platform now or might be looking
to move to our platform or, you know, im- implement it in some way or form in their, their environment. Yeah, I mean, I, I think there's a lot of things that we, we can bring to this equation, right? I mean, we've, we've got interesting new data intelligence tools, Everpure data intelligence, so we can identify where things go 'cause there's One
of the problems you have after an attack is you have to identify who was compromised and where, you know, what, what was compromised, right? And a lot of times, you know, you'll see a developer like, "Well, I just need some data to, you know, do this, so I'm gonna build it over here on this system," and all of a sudden your data's leaked. Yeah.
You know, it wasn't, wasn't in the, the, the groups that were being protected. You know, so having that, that kind of visibility into that, you know, immutability is the central component to, you know, recovery, so I, I would, I would say that. But th- this is a very complex thing and, you know, as much as you wanna plan for it, there's gonna be things that happen
in a cyber event that, you know, are outside of your control, you know? Yeah. You know, when you talk C- T- you know, RTO, RPO and things like that, you know, that, that, you know, is, is, is challenging. FBI locking you up for a week- Yeah or locking you out, not up. Yeah. Sorry. Little things like that. But, but so,
one of the things that I do a lot of is it, I ha- I do a workshop o- on this, where we talk through, we, we take the na- you know, like the full breadth of an attack, and we talk through points and say like, you know, "What would you do if you encountered this type of scenario? What would you do if you do this type of scenario?" And I think, you know,
a lot of folks don't, realize how, how vulnerable they are and how long it would take to identify and correct, you know, some of these challenges. You know, even to the point where, like, you know, I, I talked to one, one company and, you know, the I'm like, "If your network's down, your, you know, your Microsoft Teams for your phones and stuff like that, so all your phones are down,
you know, like, how would you contact each other?" "Well, well, you know, well, we get our, list of cell phone numbers out and we just start calling each other up on, on our cell phones." I say, "Okay. Where do you store that list?" "Oh, we store it in SharePoint." Yeah. Right? You know, so there, there's just a lot of,
a lot of things that- Yeah that go into it. And, you know, communication's one of the, the early big problems that you gotta address. So I think walking through those kinds of scenarios really is eye-opening for, for most, most folks. The I'll give you one tip too, that I, I learned from a customer. They did something that I thought
was really interesting, so I, I'd like to share it. They identified in the event of an, a, a, a, a, an exploit or, you know, an event, a cyber event, they identified the 30 most important people to help work on that and remediate that. Oh. And they got everybody a break-in-case-of-emergency laptop and cell
phone. Completely different authentication systems, all that stuff, but already has all the tools and data that they need to do the recovery, and ha- the phone is already programmed with all the right phone numbers to access everybody on their, you know, break-in-case-of-emergency phone. And I, you know, I think that's just a really cheap way to, you know,
like help you shortcut a lot of those- Yeah those- For sure you know, ph- you know, 'cause a laptop and a cell phone isn't that expensive in the big scheme of things. Not anymore, for sure, right? Not anymore. I mean, especially if- I mean, well- you need it to get, like, on the internet or do whatever, right?
Like- It's more expensive lately, but you know- Well, yeah in general, not anymore. RAM, like we won't talk about, but Yeah, we won't talk about that. Well, for that one, Chris, I'ma put you a little bit on the spot. If I'm an existing customer or I'm looking, like how would If somebody wanted to do that workshop, like how do they- Yeah, I mean- How do they get in touch with you
or Pure in general? Like- Yeah, it's a- reach out to the account team or maybe reach out to their VAR who they might be buying Pure through or from. Yeah, it, it's, it, it's free workshop that we do. A- and it's, it's not particularly salesy.
It's really focused on, you know, helping educate around the issues. But I would talk to your account exec or your account team, and they can, they can arrange that. And what I would, what I would say is this workshop is really designed for, a broader group of people. Okay. It's, it's most beneficial if you bring in
somebody maybe from, you know, an executive sponsor, or you bring in somebody from the security team, if you bring in somebody from the operations team- Sure if you bring somebody from line of business even. I had one time when I did it for 50, room full of 50 people, and it was, you know, executives, it was line of business, it was risk and compliance, it was IT.
You know, they had everybody in the room, which I thought was phenomenal. But that's how you solve this problem. It, it takes- Yeah, I mean, it can't just be the IT guys- It takes a big crowd or folks- Yeah gals. 100%. Yeah. 100%. Yeah. Okay. All right.
With that, I'm looking at the clock. We have a few minutes. We have a couple questions. I'm just gonna throw them out there. I don't You know, based off our conversation, they might be better answered by you, Rick, or Chris. I'll let you guys decide.
I'm gonna give it dealer's choice here on who answers it. One thing, so we talked about, like alerts and stuff like that, so they kinda asked a question around SIEM/SOAR, and I'll just read it straight out. It says, you know, "If the storage is feeding threat signals into our SIEM/SOAR, you know, does that mean more alerts landing on the storage team's plate,
or does it actually reduce our workload?" I can, I can jump on that if you want me to. Yeah, go for it. What I would say is that we're sharing data, in both directions. So if, you know, like say your CrowdStrike i- implementation is managed by your security team, we are sending telemetry to that device, and we're interacting with these devices
so that we can, you know, snapshot things, identify, you know, points of compromise, things like that. So i- i- it's, it, it works both ways, I guess is- Yeah is the conversation. But, you know, when we talk about defense in depth, you know, having more eyes on, on the situation and also, you know, having, you know, the,
the storage team being able to identify a, a problem is really valuable to them because they're not waiting for, you know, security to come to them. They're already on top of something that they're working in every, every single day. So teamwork makes the dream work, right? Right. Yeah. Yeah, I would just add to that, you know,
from that SOC/SIEM perspective, it's, it's the telemetry that's going both ways- Yeah and what the team should really be driving towards is to establish the data correlation that's gonna surface the actionable things, right? Not to get lost in the noise, but, be very focused on what signal is actionable and write your correlations around that.
Yeah, yeah. And I know, Chris, you were tongue in cheek, you know, the teamwork, dreamwork thing. You know, just because the storage is faster and you're processing these alerts, it's like those alerts are still coming up on a SIEM SOAR dashboard. So I mean, you To your point, Rick, like people are still working together.
I wouldn't view it as, "Hey, I'm, I'm able to process and read logs faster on my storage, so that means that I'm doing- No more work compared to the other folks." So, it's just, you know, it's peanut butter and chocolate. It's- You know, just those four things together. Well, and it's, it's more eyes on the problem.
Right. Yeah. So- Think of that data flow as an opportunity to have more telemetry with- Yeah better correlation. Yeah. Yeah. I mean, you, you're giving security, you know, data that they didn't have before in their- Yeah analysis, so. Yeah. Yeah. And I will And actually, I will say,
I'm gonna, gonna give a plug. Producer Laura will be happy, is we are doing a expert-led demo, I believe, next Tuesday. I think Laura can put the link in the chat. Please, Miss Laura. Where we're doing a demo with us in CrowdStrike. So w- the folk- Yeah,
definitely check it out folks that, yeah, that are cons w- curious about the SIEM SOAR question, you know, you can actually see it in action and, you know, maybe ask, ask our experts over there a little bit more, about that. We've got probably time for one more, so I'm gonna put you guys on the clock 'cause we've got about five minutes.
We've talked about this a lot. I think it kind of It's a longer answer, but it says you've talked about minimal viable business, you know. How do you figure out, you know, who gets priority once everything is down? And I know, Rick, you've touched on We, we've all touched on that,
but maybe let's just give another quick nut on that within, you know, 30 seconds or less. Yeah, you bet. My recommendation is you break things down into three buckets: tier zero infrastructure, tier one applications, and third, mission-critical, business processes and, and services. And then based on that, you should be able to sequence what needs to recover first.
And then you lay those things out, and ultimately, you end up with a, a handful of swim lanes in your sequencing, and you're, you're off and running to the races. Perfect. Anything to add to that, Chris, or...? Yeah, I mean, I, I, I think Rick had a great point earlier when he said, you know,
you gotta look at the things that are, you know, customer from the perspective of the customer, right? Yeah. I, I think, you know, businesses that are successful, they kind of look at it like, "If I was gonna open my business today, brand new, you know, like, what would I need the What would I need to get up and running," you know?
And, you know, that's a, that's not a bad approach to, to think, like, "I, I need to take a my first customer. What, what do I need to do that?" Yeah. Kind of philosophy. My business brain would just look at business people and go, "Think revenue," and then and then everything else will You say customers,
I think revenue. So yeah, I think- Yeah good stuff falls in line with that. So, I am mindful of time. I do wanna thank Chris and Rick for being here today. Thank you to both of you for being here.
I had a great time. Hopefully, you guys enjoyed yourself as well. We are running some road shows for the audience, so if you're in Dallas, Chicago, or Boston, we're bringing our experts to these cities. You know, scan the QR code to register. And I don't have the specific dates, so the dates will be in there as well.
But, you know, maybe Chris, you're at some of these. I don't know, but maybe Chris' counterparts will be there, so you can talk to our folks about security, you know, performance, whatever you might have, stuff we talked about today, or just Everpure stuff in general. Those are all-day events.
They're You know, we're making resources available to you, so go check that out if it's in a town or city near you. One thing, I always have to give a plug to our digital community. This is a great resource for folks, whether you're an existing customer, maybe you're looking at becoming a customer.
Ask questions, find out research. You know, maybe Chris or Rick, I don't know if you guys post here. I'm posting and you're answering customer questions all the time. But this is another great way to interact with Everpure's experts on databases, AI, Cyber Recovery. Like, whatever, you know,
whatever topics you've got that we can help you with, it's in there. I do say this every time, do not treat this as a support website. So if you're having a production issue, not the place to go for those answers. If you want it resolved quickly, please, you know, follow your regular, support phone number.
But still a great resource for what's new, what other people are doing, best practices, so on and so forth. But with that, again, thank you for joining us. Rick, Chris, again, I had a great time. I hope you guys had fun too.
And to everybody that's still online, I hope you guys enjoy the rest of your day, and have a great rest of your week. Thanks, everybody. Thanks. Thanks for having me.
Rick Orloff
Chief Information Security Officer, Everpure
Chris Brandt
Consulting Field Solutions Architect, Everpure
Jason Langer
Senior Technical Evangelist, Everpure
AI has compressed breakout times to minutes, exposing the gap between knowing you're at risk and recovering from it. Rick Orloff, CISO, and Chris Brandt, Consulting Field Solutions Architect, show why resilience, not awareness, decides survival, and how to build the active-defender architecture that closes the gap.
We’ll cover:
- Worse than expected — how the AI threat has grown dramatically in 2026.
- Backup vs. cyber recovery, and why you need a tested "minimum viable business" plan.
- How storage becomes an active defender: built-in security, connected detection, dynamic recovery.
- A real Fortune 100 recovery story showing resilience in action when prevention fails.
We Also Recommend...
Personalize for Me
My Updates
No updates at this time.