So good morning in Boston for Boston people.
Yeah, good morning Philip. Hello. I can't see you but I can hear that wonderful voice.
Yeah, very good. Thank you. So welcome for this new session this afternoon and last session of the day with HYCU for very interesting news as we receive very often now with you guys. So I give you the mic to run.
Hi everyone, just to give you a warm welcome to Ljubljana. We are frequent flyers of President as Philip mentioned before, and I'm glad that we always have some exciting news for you and good content that we are proud to share with you and the rest of the industry. So again, welcome to Ljubljana because this is one of the big hubs for HYCU. We have headquarters in Boston, but Ljubljana is also a very important location. So very proud to have you here on our side. I will pass the board to Simon who is the best representative of the company at this point in time. So Simon, please go on. So thank you.
You see, and it's not just because Goran lives there. I mean, that's one of the reasons, but it's not the only reason. Hi everybody. I'm Simon Taylor, the CEO and founder of HYCU. I can't see who's on the channel today, but I hear some new voices, so I'm excited about that. But it's always exciting being a part of it, Philip. I think this is our 11th or 12th go-around with Philip. This team and all of you have been a major part of our journey for many, many years. And so we thank you because I think every major announcement we've ever done here at HYCU sort of starts and stops with Philip and all of you. So it's terrific to be a part of this and I really appreciate it. You know, maybe I can kind of kick things off here. And again, thank you for having us. As Goran rightly pointed out, Ljubljana is an incredibly important part of the HYCU journey. You know, several of my past companies originated in Ljubljana. Goran as my co-founder lives in Ljubljana and we've built what I believe is one of the best data protection teams in the world with the primary engineering hub initiating and originating right in Slovenia. You know, we have about three offices in Slovenia, in Maribor, in Nova Gorica, and also in Ljubljana. And I hope you all enjoy that beautiful city. I'm very jealous. I wish I could be there. It's one of my favorite places, not just to work, but also to eat because they have terrific food and a terrific bevy of restaurants. And I'm sure you'll go to the castle later on. So just to kind of recap, HYCU, you know, today HYCU has about 5,000 customers in 78 countries. We've continued to grow fast and furiously as a major data protection vendor over the last nine years. You know, as Philip and many of you know, HYCU has raised well over $200 million at this point, primarily from Bain Capital, Acrew, with additional add-on investments from Cisco Investments, Okta, and Atlassian. You know, and our origin story is really that we started this company to make data protection simple. We always believed, Goran and I, that the iPhone was the best example of the way data protection should be. You should simply be able to turn on that iCloud backup and easily recover all of your data. And you should be able to do that across applications and databases no matter the size of your organization. And so we got to work about nine years ago solving what we call the equivalency problem, which was how do you provide equivalent levels of data protection support across on-premises, public cloud, and SaaS that worked really well. We, you know, offered about 12 different integrations and that's when we came across this unbelievable statistic that there were actually 30,000 SaaS services in the world and only five of them had any level of protection whatsoever. They weren't backed up. They weren't recoverable and the shared responsibility model was confusing people. They did not understand that it was on them to recover their own data, that the service uptime was on the part of the vendor, but the data was theirs to own. And that's when we realized we had to do better for our customers. About three years ago, we were with all of you when we launched our cloud. R-Cloud stands for Resiliency Cloud, which was really the world's first sort of uber platform for data protection that included a full marketplace. And we said at the time, we're going to get this thing over a hundred integrations. We've now done that and today we have 106 different SaaS and cloud integrations in that marketplace. It's been a really, really exciting journey and I would say one of the capstones, you know, because you never really know when you build something like this. At the time, people were not talking about SaaS data protection the way they are today. Philip will remember this, but you know, years ago many major analysts said we were crazy. They said, you know, SaaS is just not something people care about. They don't need to be protected. And here we are five years later. And the IDC has named HYCU the clear market leader in SaaS data protection. You never want to say mission accomplished. The journey is never done. But I think this is an exemplary example of how far HYCU has come and what we've been able to achieve, you know, as a company with the help of everybody at this table. So that's been HYCU up to date. But today we want to introduce an entirely new era in not just the world of HYCU but in the epics of the world and that is that the human race has moved from a battle against cybersecurity, a battle against ransomware attacks, a battle against what I used to call the SaaS apocalypse before that became a bit of a misnomer in the current market. But today we are in the world of agentic recovery. HYCU and every company on planet Earth are battling the agents. They are working tirelessly to try to identify all the thousands of agents that are being deployed by their employees across every service of record in their company. Whether it's agents, you know, entering through Salesforce, you know, we saw yesterday that Salesforce and Claude announced a massive new partnership or Anthropic announced a massive new partnership. What does that mean for consumers? It means ease of use. It means headless SaaS services for sure, but what about the agentic and data responsibilities that come with that? Well, HYCU has taken massive strides in the world of agentic recovery. In fact, I love to tell this little anecdote. I was at an event recently and a very famous pop star happened to be there and you know, everyone was going around talking to this gentleman who shall remain nameless because of the reporters in the room. But you know, he leaned over after I introduced myself and he said, 'So, your company's doing the real real?' And I said, 'What does that mean?' He said, 'We're all terrified of AI. We all love it and we're all terrified.' And I thought that that quote really sums up how most people feel about AI today. They love using it. They love the experience. They love the value. I know I certainly do. We use it in our products. We use it in our services. But how do you track and keep track of agents that have gone awry and are moving at machine speed? You can't solve the problem with more people because they're moving too fast. You can't see them and you don't know what they're doing. So, HYCU has committed to becoming the number one AI resiliency company in the world. And today, we're going to open up and show you some of the things that we've built and what we are building to change the world and make it a safer place through the lens of AI recovery. So, let me pause there and see if there's any initial questions and then I'm going to pass it over to Andy Fernandez and Amomar. Andy leads our, he's the GM of our AI and cyber program here at HYCU. And is one of our lead architects and development managers and executives. That's a very long title. Amomar is a very important man. But he and Andy are working hand in hand to run the team that is bringing this to life and has brought this to life. I could not be more excited about this next chapter in HYCU's history. And by the way, this is not a pivot. It changes nothing that we've already built. The beauty of Agentic Recovery is what we've realized is that the services of record we all know and love, the Salesforces, the Office 365s, all of them now have thousands of agents, if not millions of agents running across them in every single company. So, we're going to continue to protect the SaaS, but we're also going to enter the era of agentic recovery and offer new platforms and products that make it easier than ever before for a customer to regain control of their agents.
All right. Yes, Philip.
Yeah. So can I make the analogy or tell me if I well understand. So what you did in the past, discovering deployed applications, SaaS services, etc., build the graph. Finally today with AI coming, tsunami, etc., you do similar approach to discover all the deployed agents and all to build a catalog of the graph, everything on this in order to protect and extend what you did before and continue to do. Is it correct to say that?
I would, it's very correct and I would even add to that, Philip, and say that what we are building is the agentic layer of the stack. So I don't want to spoil the surprise here, we're going to show this to you in just a moment, but if you think about this massive catalog of SaaS and cloud integrations. What happens when you build a context engine and a knowledge graph on top of that? What happens when you add natural language? What happens when you allow the customer to all of a sudden do more with their backup and recovery and also view in real time all of the agents that are running across all of those 106 different SaaS integrations. We are going to help you move into the agentic world and we are going to help keep you safe in the agentic world via data protection and AI resiliency.
So yeah, Philip, I think we're going to make that very clear when we get just a few slides up. But with that, Andy Fernandez, if you're in the room, welcome.
Just summarize this because welcome to the agentic jungle.
Absolutely. We might steal that, Simon.
We can hear you fine. Go right ahead, Andy.
All right, everybody. So, one of the things that Simon has tasked us to do is both really start to share all of our customer learnings and also be your tour guides. So, throughout this session, we're going to talk about everything that Simon has discussed. We're going to talk about how agents have changed the entire risk landscape, but we're going to talk about some major landmarks in the Balkans and famous people as well. Who recognizes the first one?
The lake with the church in the middle of the lake with the island.
Perfect. We're going to continue doing this, but as Simon mentioned, one of the key focuses here is we're going to talk about a moment in time where nine years ago, 10 years ago, there was a fundamental shift in the use case and the expectation of data protection in the context of ransomware. And every vendor, including us, had to make sure that customers had what they were equipped to do to make sure that their infrastructure was protected and that they could recover in case of an attack. We're going to talk about how the world's going to change now when you introduce this net new failure mode. The other piece as well, you are all the first ones who are going to see exactly what Philip has alluded to and what Simon mentioned. And we're also going to talk about something that's super important because it's very critical to be able to talk and address agentic visibility and risk, but there's still a lot of work to be done in data protection. And this is, as Simon mentioned, not a pivot, but a reinforcement to make sure that customers, no matter what workload they're using, are able to recover from these failure modes. And we're going to talk about how lightning has struck the backups as well. And of course, Q&A throughout the session. If you have a question, I'll run to you to make sure that the folks on the Zoom can also hear you as well. So as we mentioned, ever since physical machines to virtual machines to cloud infrastructure and SaaS applications, there's kind of a failure mode that dominates the conversation. It dominates the requirements. It dominates what customers are asking for. For the last decade, ransomware has been that very conversation which is what happens when my backups or my workloads are encrypted and I cannot recover. And we've seen a flurry of innovation around this space as well. But we're now entering a completely new landscape that kind of eclipses the scope and the danger of ransomware and sometimes it's your best friend. So we're going to talk about a new failure mode and we're going to use an analogy here. There are certain athletes that come in to different sports and they completely change the dynamic of the sport and folks who just cannot deal with their speed. Goran, how do you pronounce this athlete's name? One of the best cyclists there are here from Slovenia as well. But we're going to talk about the relevance here. Introducing mind-boggling speed and efficiency to your data stack. So let's talk a little bit about what's happening. As Simon mentioned, the misnomer SaaS apocalypse, everyone, you know, three or four years ago was telling you, hey, you're not going to need SaaS. You're going to code your own DocuSign. You're going to code your own CRM. You're going to code your own SAP. We know that that's not true. But what we've seen and the stock market is actually showing you this with ServiceNow, Atlassian, Salesforce, HubSpot, is that these SaaS applications are actually now the most critical backend for agentic workflows. We're having conversations with customers who are essentially saying, 'Hey, GitHub, Salesforce, these applications, they're critical for us. We're going to build our own workflows on top of it.' And it essentially is a backend. But every single SaaS company, their number one job, what VCs are telling them to do or what they're driving is we need to have a co-pilot. We need to have an agent that has read and write permissions in those applications and allowed people to kind of drive cognitive work inside of those agents. What does that actually mean though? Because as Simon mentioned, four or five years ago, he alluded to the SaaS apocalypse. And what the SaaS apocalypse was was, hey, we used to have everything in the castle. Everything we had was self-hosted. We paid for it. It was ours. Nobody could take it away. And I could see it. I could touch it. I had staff. I know. But every single other new application out there started to become as a service. So your repo used to be self-hosted. It's now in the cloud. Your CRM now in the cloud. Even your modern cloud services, even databases are now in the cloud. And as you start to introduce and understand this concept, the number one failure mode, the number one threat vector is the fact that everyone, I mean everyone inside of these SaaS applications can build and deploy their own agent with read and write permissions truly their own. So let's use for example Atlassian Rovo and I'll give you an example. Atlassian, 80% of the Fortune 500 is using Atlassian. 80% of those customers, no matter admin or employee, can build their own agents to do incredible things, but also to be able to have a scope and a reach that's very, very dangerous. So, here is one of the few areas where the danger is actually already inside because you've given it a token. You've consented to it. It's there. It's incredible, but it's also very dangerous if you don't address it in the right way. And so one of the things that I want to do is I want to talk a little bit about how this is already changing in how we develop and how organizations develop software. So Amomar, you hear me?
Yes, I do. Amomar, one of the things that we want to talk about is you've done an incredible amount of work testing and exploring how these agents drift. What are the things that we can accomplish that are incredible, but why don't you kind of talk through the failure modes and kind of this entire new approach to governance that the entire world is learning?
Sure, Andy. You know, the most important part to note when it comes to actually agentic environment is that things happen at a lightning speed. You know, our IT teams and our infrastructure is actually built for human errors. It's still not actually ready for the kind of volume and the speed that the agents can actually really kind of cause issues. There are three things primarily which you've outlined here in this particular slide. The hallucination of these agents is going to be a significant concern in terms of how it actually can alter the state of a system of record at any given point of time. And then the second part is actually a human-induced misinstruction and can actually even put you in a situation where the destruction is actually kind of irreversible, right? And then there are these many things. The most commonly observed stuff is that the standing credentials that are actually injected into a specific instruction and the Postman incident that happened just a couple of months ago with one API token which completely wiped off the access, I mean wiped off the production and also the associated backups of the data itself. Right? And this is a severe and a significant concern for the organizations. There are two ways to look at it. One is about building the right guardrails and to ensure that this does not happen but that we can only try and learn and iterate and evolve over a period of time. But the need of the hour at this point of time is in terms of if that happens, do I have the insurance for us to be able to kind of recover the data back into its original state as it was while I continue to investigate, you know, why the agent behaved in a certain specific pattern and take corrective actions to prevent them from happening.
No, thank you so much for the context too. And one thing to mention is every single system that we have to govern data was built for human speed, right? How you authenticate, you're going to see entire new industries on just authentication. Used to be human to human, then it'll be agent to agent. Even the way that companies collect logs, all of this is meant for speeds that we can comprehend, not machine speed. And I want to give you a quick example of how this is actually happening in real life. So we've all and you've seen this much more than me through the years how there's a new technology and everybody talks about it, everybody puts it on their website and then you know five years later people actually start using it and then it becomes a real thing after it reaches the trough of disillusionment. That's kind of how it's always been. But what we've seen with Agentic implementation, it's the opposite, hyperspeed adoption. Take the legal industry, okay, seven, eight years ago if you had a conversation with a CIO of a law firm and said, 'Hey, are you running in the public cloud?' They would say, 'Absolutely not. Nope. Nope. Read the agreement. Doesn't work for us. We're going to manage our hardware. It's ours. Maybe we'll use it for low-cost storage. Use Glacier here and there, but we run on-prem.' All of a sudden, kind of we saw this Gen AI boom. We started to see billions of dollars in VC money go into legal companies like Harvey, Lora. Every single law firm you go and talk to now has agents inside of their firm. All of them. Why? Because the cost of not doing something because of risk is higher than even an issue happening within those agents. If your competitive law firm can deliver faster, more valuable competitive work, you have to adopt it too. So what we're seeing is people are actually adopting this in production at a rate that is much faster than we saw SaaS, much faster than we saw public cloud as well. And we've been playing around and even made an experiment within our own environment to understand exactly how we're able to do this. And we played around with Atlassian and we're able to immediately wipe out an incredible amount of data. So what I want to kind of discuss here is we're sitting in an incredible amount of risk. Amomar, can you talk through Atlassian and kind of how we've used it and some of the risk factors behind that?
The risk factors of, you know, Rovo primarily taking that into consideration. Anything that Rovo does is completely irreversible. It's an authorized, fully authorized action and this can actually happen in subsecond velocity, right? And that being said, you know, you don't even get to see what exactly happened unless and until you go look at it with a microscopic view of, you know, kind of scrubbing through hundreds of thousands of log lines to figure exactly what happened. But eventually that's the kind of impact that Rovo can have if managed inappropriately or probably not in the right fashion, right? That's a real risky.
Thank you. Any questions in the audience really about the problem statement?
I just want to point out also that it's not just about Rovo. That's a use case and an example, but think about the 30,000 SaaS services out there. Of the top 500, every single one, 100% of them have some kind of agent that's being deployed. So this is a problem that is not only one of speed, it's also one of scale. How do you manage things that, as Amomar said, are at lightning speed and how do you do it when your company has 500 different SaaS services running and maybe 10,000 agents on top of that? It's an almost impossible challenge and it's not a challenge that's coming. It's a challenge that's in our houses, in our rooms, in our offices now. It's already here and the ecosystem has to date not met that challenge and that's what we're here to talk about.
Absolutely, Simon. That reminds me of a quote that I recently read. What gets measured gets managed and what gets automated gets amplified. Right. That's probably a very relevant quote to code here.
Philip has a question. I'm walking over. Yeah. So it means with all the online services as apps we use. Finally during an upgrade we receive some new services implicitly, transparently. We don't control this at all. It's provided by a vendor and you lose control and find you can't destroy everything automation enough. Is it?
Absolutely, I'll give you an example. So everyone in every organization now that has access to generative AI systems essentially becomes a product manager. So somebody in sales or marketing or in operations can say, 'Hey, Philip, we finally can automate the cleanup of Salesforce or we can finally automate the cleanup of our database here or we can finally deliver this service for ourselves. We can use this. It's already part of our plan. Let's be able to use it now.' Incredible because within a weekend, you can achieve value and ROI. But all of a sudden, you now have an agent with the same permissions. It looks like Andy or Amomar is doing it, is actually the one behaving. So whether you write wrong instructions, whether it drifts, it doesn't matter. There's so many ways that we can't even imagine yet in which these agents are able to delete data. But the trick, Philip, is they deliver so much productivity gains already. So you have to do it. So it's not about avoiding it. It's about how do we get the most value of this but we can sleep at night knowing there's not going to be a complete prod wipeout in the morning because I gave something to the wrong person. You know, Philip, I like to give the Robocop example.
You know, this is really about humans because if a human by himself or herself, let's call the human Jim. Jim is an intern at a company and he accidentally deletes all of the Okta configurations. It's probably going to take you six weeks to six months to reset them up if it's not backed up. That's what a human can do. But now you give that human 100 agents that are acting at machine speed. That human may instruct the agent in a manner that will cause that agent, whether it was his fault or the agent's fault, it doesn't really matter, to go out at machine speed and punch a lot harder and take down whole databases, take down whole volumes of data, take down whole businesses, and they can do it in the blink of an eye because it's at machine speed. And so that's the problem. The small extent to which a human used to be able to have an impact by or negative impact on the organization has now been amped up to machine speed and these things are unstoppable unless you have the proper protocols and a HYCU-type product in place and that's what we're here to discuss today.
We have one question from IT Daily. For me, it's quite difficult to comprehend how you map all of this because it's a technology that's evolving at machine speed. So, how can you keep up with everything and to keep that visibility in check? Because when you have something in scope, then you can follow that at machine speed. But if that evolves at machine speed, can you?
That's probably my favorite question of the day because it's the best segue I've ever seen in any meeting ever. So, thank you. Andy, why don't we show him exactly how we do that? I think this is going to provide a much better answer than me talking to it. We're going to show you.
Absolutely. So, new Slovenian landmark unlocked. Postojna Cave Park, cavernous, very cold inside, many things that we have not yet discovered. I would say that you can compare environments and tech stacks the same way today. Four or five years ago when kind of Simon introduced our cloud in this SaaS apocalypse, there was a very basic problem which is to his point, people are adopting new technologies very quickly and organizations said, 'Hey, I've been protecting my VMs for 20 years, my file shares, my physical servers, but all of a sudden these 15 systems of record came out and I think they're protected, I don't know.' And that was a big problem and we came out with Air Graph to really visualize and expose, 'Hey, this is what your application estate looks like. Here's what's protected. Here's what's not protected. Are you sure you don't want to protect the git repo? Are you sure your CRM is okay to not be protected, backed up, and especially in Europe, not under DORA compliance.' So now to your point, people are able to adopt a co-pilot super quickly. People are able to implement a new agent very, very quickly. But there's something that doesn't change, which is what are the applications that are being touched and what's happened to those applications based on what this agent has been able to do. And so what I want to introduce at this point in time is once again refine the problem statement. Right? Before there was already a problem. You didn't know how many SaaS applications you were running and you sure didn't know that they were protected. So now all of a sudden all of those SaaS applications are protected or are not protected and are also accessible by agents all at once. Every application talking to each other. So with that we want to show you for the first time, no one has seen it yet, what Air Graph looks like for the AI resilience. Amomar, do you want to share your screen?
Yep. Can you stop sharing?
Yes.
So as Amomar loads this up, the whole game has changed. As you've already mentioned, people need to understand what is happening in my organization. If everyone can create an agent that can access anything at machine speed, how do I track that? How do I survive? How do I know exactly that today my environment hasn't mutated completely to a different application? So what we're going to show you is what every single organization in the world will have access to for free to be able to understand their data posture, their agentic posture and within HYCU Air. Amomar, let's kick off the onboarding process that every single customer and organization out there will be able to perform. The first thing that you're going to be able to do is to start connecting to different data sources. Your IDPs on day one, you're going to be able to connect to Entra ID. You're going to be able to connect to Okta, to specific applications and we're going to go all the way down to the endpoint and really give you a perspective of what are every single application in use, who is using generative AI within those applications, who's writing agents that are touching those applications, and what are their OAuth scopes. So, every customer will be able to start that discovery, connect immediately, and start to see this visual, this map, this organism build out in their organization. And we're immediately going to flag risk. We're going to show you, hey, a lot of stuff connected to GitHub right now. A lot of stuff connected to your CI/CD pipeline. Are you protecting it? Are you able to recover? Amomar, why don't you show the full dashboard and kick off the demo?
Sure. This is a comprehensive view of just actually kind of taking a few sources that you can connect to. And like we said, the first step before solving any problem is to actually identify it and that problem, the first step in this particular case is actually, you know, having visibility to what I have in my infrastructure, my data estates, and even my AI agents, my non-human identities, etc., and all of that. So we pull this from multiple different sources. We showed you how we connected to Entra ID and Okta. We have other different sources that we connect to. Also fundamentally this is actually kind of broken down into multiple verticals here. First is this to show you the infrastructure and then the discovery of applications. You see that we have probably about 150 different applications that has been discovered and also have layers for you to be able to filter through and say, 'Hey, I want to see only my protected applications, sanctioned versus unsanctioned applications which are probably review and if there is any shadow applications that we see and identify which may be an application, maybe a service principle, you will be able to see all of those.' Right now the beautiful part about this is you can further filter this down, this is still a lot of noise and say for example I am the Entra ID administrator, I can keep that as the only scope of this particular view and say what's within my purview here and there is Azure production account here which is actually connected to Azure OpenAI, Snowflake and there is probably a service integration service principle here and there are two other service accounts that are connected here. This is exactly how we map and actually kind of provide the customer with the level of details of information that they would need for them to see how each of these entities are interconnected and how they are interacting and stuff like that. From here on you should be able to also kind of be able to generate a report. It could be maybe a basic executive summary or only the top risk. What we'll do for this demo is we'll even add the compliance posture and actually kind of generate a report. And here is how the report is going to look like, kind of provide you with perspective of total number of applications that we've detected and how many of it is protected and how many AI tools that we discovered and what are the critical risks and the top five risks are actually kind of provided here and this can be used for multiple different purposes, you know, maybe for an internal audit for the security teams to actually kind of review and this is what you will be able to accomplish today with Air Graph.
Amomar, before we go in through this, is something that every single customer will be able to do in minutes, immediately see a visual of their entire data estate first. And I want to repeat this. We still meet with organizations who are finding out about critical applications that are systems of record that are touching production. All of a sudden your organization is storing all of its architecture in Miro or they're using Asana on a personal note or they built their own thing on top of another application. The point is to this day still customers don't have a stronghold of what their SaaS posture is. And now that very same SaaS posture that they don't have a stronghold of is touching other AI or agents that organizations are creating, getting incredible amount of value but still it's touching applications but it's really important to then understand, okay, so what, there's 300 agents inside of 365 touching it. What does that even mean? What should I be worried about? Amomar, kind of going through the double click aspect here to actually understand what are these agents doing and how customers will be able to discover.
Yeah. The most important part here, I mean the painful aspect for an administrator or even a security analyst sitting inside a company when they are reviewing this, you know, they don't know, they know that there's an agent called sales ops agent that exists. It's a non-human identity. That we know it's an AI agent but what permissions does it have and what can it do and what level of data access does it have, what are the security risks associated with that for a security analyst to be able to accomplish this is going to be like multiple back and forths. One is going to the Entra ID administrator then to the application administrator and you can imagine the number of hops that the security analyst needs to do, go through to be able to kind of fetch the very basic information for him to do any sort of a security analysis. Now, if you look at it this way, right? This is one interface where you're able to discover all of your AI agents. I've actually kind of selected, filtered this to unsanctioned. We know that this is an unsanctioned agent and there are about 612 active users and it actually has a tenant-wide admin consent for mail read and also user read all and no assignment requirement on the service principle. And here is all the security findings in terms of the critical to high to medium level risk scoring which actually significantly reduces the amount of time a security analyst will be spending in reviewing, analyzing, and actually kind of summarizing a specific finding before he even puts together a mitigation plan. We're talking about shrinking days and weeks worth of effort to just minutes to, you know, hours. That's the kind of level of detail that the customers will be able to kind of find out with the Air Graph here, this dashboard.
And one thing to mention too, you're seeing part one of a few more things that we're going to introduce but there's a second aspect to this which is what is happening to my system of record data, what has actually changed. Now you have some agent logs, you have some information but you're going to find throughout this presentation that the backup data itself and you able off-site backups of the very systems of record that these agents are touching are going to become a ledger, are going to become a source of truth as to what has actually changed in my environment and am I able to protect and recover from that as well. So, we're going to continue harping on that question specifically. But Amomar, I'm now going to share my screen, but Simon, any comments on your end? I know this is, you know, something that we're super excited. We want customers to have this available at no cost because we think that one of the biggest dangers today is if I have an agent that touches something within GitHub or within another application and it deletes an incredible amount of data very quickly, can I recover to a point in time where we were safe? Every single organization deserves that, needs to be able to understand that. And that's part of a key commitment for us.
Yeah, I fully agree. Now, if we can just pull up this, that sort of spiderweb at the beginning of HYCU Air. I think this is really important. If you can just pull that up again. You know, I love that question that we received right before the demo. And obviously, Philip and everybody, I know this is a lot of information. So, just to really simplify it, you know, when you log in to HYCU Air and again, as Andy pointed out, everybody in the world is going to have access to this at no cost. But the first thing it's doing here, you remember from our graph where we used to build out that kind of beautiful tree that showed you where all of your different SaaS services were. We recognized that we were going to be outclassed by AI unless we rebuilt this. And so what we did is we've now built Air, AI Resiliency by HYCU, and Air Graph is inside of Air but can also come free of charge as a standalone. And what it's doing here, which I just think is so amazing, is it's showing you where the SaaS services are, but all of those purple dots are fundamentally LLMs or co-pilots or anything to do with AI that's connected to the SaaS service. The lines are showing you the interconnectivity between something like a Rovo by Atlassian and how it's touching Jira and Confluence. So you understand sort of at a very base level you now know what agents are doing what to what applications. That's the first connective link that we help a customer to make so that then they can start to say, 'Okay, well what are the risks of that? I don't even know.' And here we flag those risks loud and proud on the right-hand side. We're telling you in this case you've got GitHub in use, there's co-pilot being used against it, 14 identities, and co-pilot has access to your repo. We're telling you that Jira is in use, is detected, you've got 31 identities and Rovo can read all your projects and issues, right? So, by flagging the top issues and then what we're allowing you to do is then say, 'Okay, what can I do about this?' Well, what you should always do about it, the very first thing you should do is back it up. Make sure that it's recoverable. So, if that agent goes wild, you can recover right back to the moment in time directly before the problem. And so I think that while this is not the prettiest screen in the world and you can see all of the others, I want everyone to understand that this is how you visualize agentic worlds. This is how you visualize the problem statement. Now, if we go to the next screen, Amomar, and you know, the first time I looked at this, I said, 'Guys, this is a lot of data.' And they said, 'Yeah, but there's a lot of data in these environments.' And so, this is where you're really breaking it out. I know Amomar just went through this, but for those of you who haven't seen this before, I want it clear that the whole point here is to provide this beautiful free service to customers and actually anybody in the world so that they can start to draw a map of the agents, the infrastructure they're deploying, the apps they're deploying, and the AI and the agents that are running inside of it. Because until you understand the complexity and where those agents are, if you can't see it, you can't protect it. So this is the first step in that battle, we're giving you live real-time intelligence about all of the AI in your company, in your organization, in your government, and we're allowing you to finally start to get your arms around it, helping you to control all that complexity. And as it continues to sprawl, which we know it will, Air Graph will be right there in your back pocket keeping you secure and keeping you recoverable at all times. So, let me pause there. I'm sure there's some questions on all of this, but I'd love, I didn't see who asked the original question, but I want to make sure that that got to the heart of it.
Hold on. I'm walking up. I would like to go in a bit more detail on the last word that you just said that is recoverable. How does this work in this spider web of possibilities?
So I want you, for those of you who don't know us that well, we started this company by building a catalog of integrations that we called our cloud, Resiliency Cloud. So we've got 106 different SaaS and cloud integrations that we can actually provide full data protection, backup and recovery. All of this integrates directly with those integrations. So once we spot a problem in GitHub, Jira, Salesforce, Snowflake, Notion, Confluence, etc., you can turn on that integration and you can back up that data and recover it. And I think that's the beauty of this is this is the awareness piece. The free visualization tool called Air Graph is to provide awareness of what's happening in your environment. But it's that core data protection, backup and recovery that's going to allow you to actually fix a problem when it happens. Second, as Andy mentioned, the next thing that we're going to talk about is what we call Flight Recorder, which is going to take you even deeper inside that agentic risk and actually allow you to recover right back to the moment in time right before an agent made a mistake. So, this really is taking data protection to a whole new level because what we're doing is we're using the recovery use case of data protection to protect you against error from agents. We're using the visualization element to make sure that you can see it, you can understand it, and you can action that recovery when you need to. Does that make sense?
Perfect. Thank you so much, Simon. One of the key things that we want to continue discussing here though is as Simon mentioned, protection is still the most important part. It's the one part that you can control. It's the one part that you know I have this here in a completely different place that the token can't touch and I'm able to perform that recovery. And you'll see throughout this session additional demos where we're going to show exactly how that works whether it's insider risk or agentic risk. So now Amomar, I'm going to share my presentation. Perfect. We can see that. So one thing that we want to make really clear, that was our first announcement. You are the first people to be able to see this. This is something that we're going to announce to the public later on but you are the first folks who are able to see it. Don at the end we'll provide all of the materials and of course all of the timings as well but this is all available to you all but something that we want to really harp on. So what Simon said, your recovery posture is everything in this era. You can track, you can manage, you can take a look, but if something is deleted very quickly and you don't have the ability to either quickly or granularly recover those items, your organization is in trouble. And that applies to your infrastructure, but it especially applies to your SaaS systems of record. And so one of the key themes that we want to continue discussing here is you want to be able to protect and the speed and the frequency of how much or the data that you protect is more important than ever. You want to be able to stay in business during an incident. You want to be able to ask your backups a question. You want to be able to see the board and have everything in an audible way. But I want to shift into the next discussion point here which is how are agents changing priorities in data protection? Simon, you know this at the top of your heart. Four or five years ago, what was the number one application that people would ask you to back up four or five years ago?
Office 365, Google Workspace, and your on-prem. That's what people were asking. That's what they were asking for. 'Hey, I know because Microsoft told me that I have to back up M365 that I have to do so.' But today in the audience, anybody want to guess maybe the top three applications that organizations are coming to us organically asking us, 'Hey, can I protect this application?' Any guesses?
That one's been there. That's a better one. One more guess and free booties for anyone who points out GitHub. So git repositories, applications like Salesforce because of Agentforce usage, and identities as well. These are the things that organizations even at the RFP level are saying, 'Hey, we know infrastructure, we got to protect it, but can you do this and can you do it in this way?' For two reasons: one, I had an incident that was deleted and we couldn't get to it, or within the EU or multinationals, DORA, the Digital Operations Resilience Act, saying, 'Hey, for everything that runs in your supply chain you need to have a backup, it needs to be offsite, and you need to prove to us in a regulatory board that you can recover.' And we want to talk a little bit more about the git repository and the role in which it's changing. Amomar, you've been in R&D for probably, sorry if I aged you, two decades and you've seen an evolution across the board. How has the use of the repo or the role of the repo changed over time?
Absolutely. After spending two and a half decades being an engineer, version control the way I see it has actually moved through three eras and each one traded control for velocity while pushing the risks to a new boundary. That being said, in the on-prem days, you know, more than a decade and a half ago, git lived in our own hardware behind a physical perimeter and the whole game was about protecting the box.
And if you got past the firewall and the batch reader, you were in. But move into the cloud era with GitHub, GitLab, Bitbucket, you know, you dissolve that particular parameter and our most valuable code moved on to an infrastructure that we do not own, right? And reachable from anywhere. So the boundary then became identity and it came with secret sprawls, supply chain attacks and the reality that the stolen tokens inherits all of its access. And now that's the era that just we came out of and now we are in the agentic era and we use a lot of agentic workforce at HYCU and the agentic era has moved the boundary again to the agent itself. That being said, like you already mentioned, Andy, it's an authenticated, authorized non-human entity that reads the whole code base and can commit at machine speed, which is beautiful. And executives love it because of the velocity that an engineering organization can actually work. And here's the trap there, right? For 20 years, our defenses answered the question about who you are and are you allowed to perform anything that you're doing. But when a cleanup agent deletes a live branch or probably a refactor agent force pushes over a main or a compromised token wipes releases, every one of those actions is authenticated and authorized. So there's nothing that you can really complain about. It completely looks legitimate to GitHub. So there's nothing that GitHub is going to be able to do to prevent it. Now that being said, the question now is about protects. The question that protects you is was this permitted? Or not what it is was this permitted, but was this really correct? Was this normal? Or the last but the final question is can I really undo this? Right? And that's exactly the question the native controls can't answer which is why in a world where machines change our code at a machine speed the defense has to move to where the boundary has moved which is behavior-based detection of what's abnormal and a clean tamper evident record which technically is a backup that lives outside the system under attack in this particular.
Thank you, Omar. And there's a couple key things in this. We were getting requests and organizations really understanding, especially when they deployed our graph at the beginning, and say, "Hey, I didn't realize what happens to GitHub. Is it okay if my devs are just cloning repositories or do I need a full backup that I can restore the entire organization or even a specific repo or asset?" But today, there's kind of two things. One, as Amar mentioned, is every single developer is leveraging AI out there. Every single developer. And that means that you see an employee who's an engineer who's made a ton of changes. Did this employee produce 10,000 lines of code over the weekend? Maybe. But the point is that the output itself, just the volume of output inside of GitHub because of AI has forced organizations to think, hey, we should probably be protecting this because in one weekday, we're releasing the same amount of production lines of code as we would do in a quarter. And that's completely changing the dynamic and how we're wired to think about backup as well. So one of the key things that we want to talk about here and really recap is it's not just GitHub or Bitbucket or GitLab. It's any repository anywhere where you store incredible amount of valuable work and context as to how your organization runs must be protected. It should have been protected already but it definitely should be protected in an agentic world. Why? Because even the damage could look legitimate. It's authenticated. It's authorized. Murphy's law dictates that it will happen and the organization needs to be able to understand how to protect and recover. But especially in Europe considering the Digital Operational Resilience Act, NIS 2 and so much more cutting edge regulation that's coming out there. They understood this problem. They saw that the entire financial supply chain, there's seven or eight applications that everybody has that if those applications go down, there are serious financial repercussions across the EU. And so what they've asked not only the suppliers and ISVs themselves, but the customers and the organizations to be able to say, hey, I've got it protected. I've got it recoverable. I can access it if there's a supply chain compromise. I can access it if something goes down as well. So, this is something that we are starting to see change the dynamic. Now, we're going to move on to another Balkan legend, Novak Djokovic, who has the most grand slams and has really done an incredible job of having longevity and winning the most titles. And we can talk all day about the style of play, but I wanted to bridge the analogy here because for us and to Simon's vision over four or five years ago, there were so many applications that were not protected at all by any organization. Not protected. After our cloud, after the ability to democratize data protection, HYCU sits on over 100 protected workloads. This is kind of our data protection periodic table of elements to be able to showcase everything within your organization that we're able to protect as well. And with that, we wanted to be super excited to share that HYCU is gaining its support for Azure DevOps as well. This means that organizations whether they're using GitHub, whether they're using Bitbucket, whether they're using GitLab, are going to be able to protect their source code, their organization, and their artifacts. Omar, why don't you walk through what kind of organization is using Azure DevOps? What does that mean to them and what does this mean for us and the value that they can get from this application?
