Name: Securing AI & LLMs: How Superna and VAST Protect the Data That Powers Innovation
Uploaded: 2025-06-03T19:26:05.341Z
Duration: 58 min 48 s
Description: Securing AI & LLMs: How Superna and VAST Protect the Data That Powers Innovation

Transcript for "Securing AI & LLMs: How Superna and VAST Protect the Data That Powers Innovation": And we're live. Hi, everyone. My name is Jonas Roslin, and welcome to yet another Cosmos community webinar. Today, we have the pleasure of having Derek Manning with us here. He is the vice president of global presales at Superna. He has been with Superna for fourteen years. And if you don't know Superna, Superna and VAST Data has had a strategic partnership since, 2024. And the topic of today is around securing AI and LLM workflows. So this is a really, really interesting topic. We're gonna have some polls, throughout the presentation. And if you have any questions, please put them in the the q and a section here on the webinar. And we'd love to answer them as they come in or at the end of the presentation. So, Derek. Ready to go. Alright. Nice to meet you all. Derek Manning, vice president of, global presales here at Superna. And we'll just start off this talk, on securing AI and LLM models, and workflow workflows with a with a quick question. And it is, it is around a concept or term called data driven intelligence. And, the the question is, have you heard of data driven intelligence? It's the first poll here that we'd like to ask. So just wait for a couple of clicks and, we'll we'll move ahead with the presentation. Let me know when you've got a couple in, Jonathan. We'll Okay. No problem. So let's talk about data driven intelligence. It's essentially, using data to guide decision making and that involves collecting, analyzing, data pattern, data to identify patterns and trends and insights that can inform business strategies or decisions. It's a big thing in many fields like research, healthcare, tech, and marketing where data can often offer valuable insights. So the first step in the process involves gathering all of the data all of the existing classical information from within an enterprise. All the years of emails and sales results and CRM information and more. All this classical information both known and unknown that an enterprise has built up over over its lifespan. Next the data is enriched and refined by combining it with licensable and scraped external data. Also other internal data sources it's cross referenced with having and then having advanced processing algorithms review the data and look for patterns or trends and insights that at speeds and rates that are unmatched by you know normal biological intelligence. And then the result is enriched business intelligence that produces better and far more accurate information faster. So things like faster medical diagnosis is in the healthcare industry or shorter research cycles in research. And for many this provides a lot of answers but for scientists this and this is the best part it actually provides more questions. So today this is seen as providing a competitive advantage but soon it will be seen as a competitive necessity. A key requirement here is powerful processors but very critical and and relevant to our discussion here is high speed access to, fast data capabilities. So, just another quick poll question. Have have any any of you, started your data driven, intelligence journeys? Alright. So we'll we'll move on here and we'll we'll talk a little bit more. Okay. Excellent. So, a little bit about, the reliance and dependency, on data driven intelligence. Right now about 99% so just about every single one of the Fortune 500 companies rely on data driven intelligence to remain competitive. And like I said before, this started off as a way of getting an advantage over competition, but now it really is just a way to stay relevant and competitive. 82 of all companies globally polled worldwide are exploring some sorts of, AI or or data driven intelligence to help them with their their business. Statistics, show that, there's a 23, you're 23 times more likely, to, acquire a customer. So customer acquisitions are extremely high because you've got better and more marketing, campaigns, improved customer experiences, and better decisions that help you with higher acquisition rates. And then you're getting your decisions five x faster. So 400% faster decisions come out of, higher, more enriched, data intelligence that can be generated from your historical, information. So data driven intelligence can be broken out into a few phases, and this is all this AI and MML, LLM, sorry, model, learning. But during the clean phase, data, is, basically, analyzed and you make sure that, for compliance and and and privacy requirements are met. You're looking at doing things, like sense anonymizing sensitive data in your models that are gonna be contributing to your models and to protect individual privacy. It's a fundamental part of the process to ensure that the data used for decision making is reliable and ethical. That's the first part. But then, pooling is a key step. So you're gonna collect all of that information from all of your other systems within your environment, and you're gonna put that into a centralized location. This is done before analysis. It's often consolidated into a report a repository like a data warehouse or a data lake. This makes it a lot easier to clean, integrate, and enrich the data, before the AI steps, in to analyze it. Performance and capacity of the data lake is critical, as it serves as an analysis, processing. It serves as the analysis processing engine's gateway to information. So, again, VAST Data really excels here. Structured data like CSV or SQL tables, semi structured, data like JSON and Parquet, and even unstructured data, they all kind of mix here on this platform and are pooled in together. Next, we've got an integration phase. This is where, the process of different components, whether it be system technologies, or workflows, this is where they're combined combined to form and function cohesively. In an AI model development it typically refers to merging trained AI models into existing infrastructure, ensuring compatibility, optimizing performance, and validating outcomes. The integration phase is followed by an enrichment phase which means refining the raw data sets, bringing external information in, cleaning out inconsistencies, just making insights more actionable. Data enrichment might involve merging customer information into with behavioral analytics to create a more tailored marketing strategies. In AI and data science, enrichment typically means refining the raw datasets and bringing external information and again cleaning out those inconsistencies. Mining data patterns or system insights to identify trends. This is all done in in the, data analysis phase. This is where the models are refined and we find data and and detect data anomalies and improve and improve, the predictions. In business, analysis can be applied to financial performance, customer behaviors or even operational efficiency to optimize strategies. Whether so whether it's statistical or predictive or qualitative analysis, this phase plays a crucial role, in in in the phase. So each of each of these, phases are are critical to turning, raw data, into, actionable insights. So what does it look like in in, in an enterprise? Well, you're looking at collecting, data from diverse sources. So you've got data scattered without your enterprise, structured data like CSV and emails and SQL databases, semi structured JSON and XML files like semi structured in those documents. And then unstructured documents like videos and images and Word documents and whatnot. They're all cleaned in place. So very important to have a secure environment to perform that cleansing. The structured semi structured and then unstructured data would be load loaded and pooled into something like a VAST Data array where, the pooling enrichment and analysis can take place. So the gear at the top represents, processing, and the processing needs the CPU and RAM needs very rapid fast access to this data and it's very convenient to have it all consolidated, in a single place. And then the result, of course, is refined output, better informations and better decisions for an enterprise. We can look at an example of a situation where security was was was not really tended to at a very high level. This is, there are numerous privately and unreported incidents of AI model training data pollution. But one that was publicly reported recently and a lot of people can can associate with is one that came out back in October of twenty twenty four. There was an incident with an intern at at ByteDance who allegedly tampered with, AI model training data. Now, ByteDance is actually the owner of the the mega social media platform TikTok. So the reports reached back to an incident that happened in August of twenty twenty four where an intern was fired after committing what they call serious disciplinary violations relating to an AI model. Reports came in that, the ByteDance intern actually planted malicious data or code, within a training pool, and that polluted their data that was sent off from model creation. Now we don't know how long the, polluted data was trained for, but the assumptions are that this occurred for some time. And either the training cycle, was was either, broken or there was a discovery, after inception of of the, the inference model or it was uncovered during, private inference testing. But, potentially, this caused damage into the $10,000,000 range. But ByteDance did say that these figures were over exaggerated. However, we can assume what the cost of impact would be in a situation like this. So what are the things that that happen really? Well, there's disruption in time, you've got inaccurate outputs, GPU rentals cost a lot of money, they consume a lot of power, so there's a lot of money that was lost there. There was assumedly a remediation phase where forensics had to be poured over to figure out exactly what happened. Data had to be resanitized. And the overall impact was a general loss of revenue. This could be because of the, you know, the time spent but also, not only because of the time and resources spent on the initial training, but the opportunity cost of of delayed projects. Whoever they're working on got delayed significantly by this. So you you also have other situations where, when when you get into these, other impairments, not all of these are undesired. All of the, these actions are are are malicious in nature. But sometimes there's things like, accidental, data corruption. Somebody's loaded the wrong dataset. Somebody's actually deleted files that were critical to the dataset. These are all things that have to be considered, when you're training AI models. And therefore, chain of custody and protection of your training data is absolutely essential to this. Top of mind right now for AI research CSAIL right now is data chain of custody. So figuring out and having an audit record on who did what and when to the data so that when they go on to, go and start launching, an AI training model, the, CSAIL can actually answer the question. And that is, is this data actually safe to train in AI? So, you know, the the the the concerns that the CISO has right now is, like, being able to look into the board of directors and tell them that no unauthorized people have touched or accessed the data. That level of confidence is is is certainly missing. And when C sales were surveyed, we've got a list of different categories of things that were surveyed. The top two things that they were worried about were number one securing the data, but then number two the ability to report on security incidents and these rated at a 3.6 out of a possible five rating but these are definitely the the highest two concerns on on the CISL's mind right now. So, I've I've given you a lot about the research, but I haven't really properly introduced our company at all in Superna and what we do here. So, Superna is trusted by industry leaders to to protect their own structured data around the world. We've got over 3,800 customers globally, operating in over a hundred countries. Our organization, is staffed with over 150 employees and we've got 24 by seven support around the globe for all of our solutions that we provide operating out of six different countries. Gartner has recently assigned us the leader in a brand new emerging category named cyber storage. We're going to talk a little bit about that in the slides that are coming up. And we've been developing and working on and enhancing our ransomware defense and cyber storage solutions since about 2016. But in the twelve plus years of the company I've been here for fourteen but in the last twelve or so years, we were really known for doing something called failover orchestration and that is coordinating the failover from a primary cluster to a disaster recovery cluster, orchestrating that and helping storage administrators with the peace of mind and reliability of failing over from one cluster to another. So in those years, we've we've probably conducted close to a million failovers but certainly in the order of hundreds of thousands of them for our customers around the world. So we've talked as the agenda, we've talked a little bit about Superna and data driven intelligence but now we're going to get into a brand new category that's been introduced by Gartner with regards to securing data on unstructured platforms. It's called cyber storage and the genesis of cyber storage actually comes from ransomware and sorry, Gartner analysts looking at the increases in ransomware frequency, disruption, data loss, manipulation, business impairments, etcetera. But then, cross referencing the increases in these, these events with the increase in CISO spend and things didn't really seem to make sense. You would think that if more money was spent on security that the ransomware frequency would actually drop. And they came to the conclusion that, while there are many traditional security domains out there, things that we are all pretty much familiar with when we think about security, things like network security or endpoint security, and threat intelligence, there seem to be something missing. And the reason for that is, what happens is, the bad actors, once they break into an organization, the first thing that they do is they sidestep all of the other security layers that exist within the organization, and they head right to the storage. And, the storage is largely seen as being unprotected in nature. So if you can sidestep everything else, you get direct access to large scale out storage clusters, and no one is even gonna know what you're doing. So what cyber storage is, it's a brand new category. It's a brand new category in the security domains. It's an act it's a way of actively defending storage systems against cyber attacks through means of early detection, blocking of the attacks. So, we'll talk about a little bit what we do with those, being a cyber storage leader, and then aiding in the recovery from these attacks, but also alerting security teams of any sort of, attacks that are in progress. This is a more simplified, you know, view, of of the the previous slide where we see, a bad actor working their way through the network layer and the endpoint layer and then the application layer and then finding your way down to the storage layer which was previously undetected, but that's changed now with the advent of cyber storage and what Superna does to protect scale out unstructured storage platforms. We know the numbers on global ransomware. They're continuing to rise. They're projected to be a quarter of a trillion dollars by 2031 which is just an astronomical figure and you can see the growth there. These bad actors operate largely without borders. I know that state actors are often seen as being the drivers behind some of these attacks but the reality is that these these, bad actors are actually operating outside of borders. And you see it a lot. We do a lot of research, have a lot of consultants come in and speak with us. And, you know, there there is a conflict going on in in, in in between, Russia and The Ukraine right now. But we do see that there are bad actors working on both sides of those borders collaborating and actually extorting companies together. So they don't really have borders or or any sort of alignment there, but they're working independently. And the only color that seems to matter, to these guys is is the color green, for for money. This slide here is going to draw out a timeline, of what a cyber attack looks like and what it what it does to the data that it's impacting. So we got two lines on this graph here which represent data and this and and disparity. The blue line being data actually degrades as an attack starts and then the disparity leads into damage as the attack continues. The intersection of those two lines on the timeline we're gonna we're gonna act call we're gonna call it the boom and that's when a cyber attack actually is launched. So there is a left side and a right side to this boom, and we'll we'll get into those steps, in just a few seconds. These are typical phases of of a cyber attack where, some sort of a bad actor actor has penetrated an organization. And then they, go in and they, understand backup schedules. They understand, where all the, trip wires are, all of the endpoint protection that's being used, network IPS and IDS firewalls. They interrogate and query that, and they understand exactly what's going on. Now at this point, one would think, the attack continues immediately. But the reality is these bad actors that actually perform the first phase are not even really affiliated to a ransomware gang. They're just known as loose affiliates. There are hundreds of thou hundreds or even thousands of these loose affiliates that go in, and their primary purpose is just break into companies. And once they do break into companies, what they'll typically do is they'll contact one of the larger ransomware organizations. And I'll try to refrain from calling them gangs because they are quite organized in their structure. What'll happen is the, affiliate will then contact the ransomware gang and they'll, they'll purchase or lease out or license, what they're calling ransomware as a service. And what that is is a software that was contracted out by the ransomware organizations that's available for lease to these affiliates. The affiliate will then report on the company name, their website, and actual the actual revenue of the company. They'll understand the the files that, that are that exist within the company. They'll understand where the services are. And then when they go to launch the ransomware attack, they'll connect it back to a c and c command and and control, site, and they'll send in the launch parameters to the ransomware and then the ransomware will go out and do its thing. At this point in time, the affiliate is basically disconnected from the process, and the ransomware organization takes over from there. Once the ransomware is collected from an organization, the affiliate is compensated after. The ransomware organizations have things like help desks so that when, users find files that are encrypted, and there are ransom notes, they'll click on a link and it'll actually take them to a a a a tour based chat, a secure chat where the victim will interact with the ransomware help desk. And the ransomware help desk will actually coach them how to get their files back. And, I did mention the revenue of the company being stated and and the, the company, industry vertical. They actually collect that information into that ransomware launch script so they know exactly how much to charge for ransom. So it's not one price fits all. It's basically sized, you know, price is right model to the to the revenue of the organization. But then, once this, these these initial left of the boom phases are completed, the traditional attack starts right in the middle. And then we see that now the data, integrity is is is falling off and the damage is is actually increasing the longer that this attack runs. Now traditional detection happens, over here on the right side of the boom. And and this is a real problem for, for CSOs, because, it it's the worst possible way to be notified. And that is, a user calls up and says, I was in my folder, and I noticed a bunch of files that were there before, and now they all got all of these encrypted names. Help me out. The help desk then calls the contacts the security team, and then the security team is alerted. Or a database administrator, will get a a call from a team member and they'll say, well, you know, I can't run database queries. The admin will look into the database and they'll find that their MDF files are all encrypted, and then they'll contact the security team. So this is no way for anyone on the security team to be alerted, that something happened. This means it's already too late. You've already been encrypted. You've already been attacked. So we call this right side of boom, technology. Now options on the right side of the boom lead all the way up over here to traditional responses, which are disconnecting things from the network, basically, throwing, you know, a match in gasoline on the on the servers and and and and just purging them and getting them, reinstalled and then recovering data from backup. This is very time, it's very costly time wise, it's very expensive, it's very impactful to the business. At Superna what we do is we focus on the this this, portion right here, very close, to the middle of the boom. Superna's detection and response operates a lot tighter to the boom, because we use a lot of left of the boom technologies. So these are technologies like user behavioral analysis. We're constantly in, analyzing, access to the storage. We're able to learn what normalized behavior looks like on the storage platform versus abnormal behavior. We're able to protect the storage, by using compelling event based snapshots, and we're able to alert security teams much faster than traditional methods. So instead of the security team learning through a help desk call from a user that's found a ransom note, we actually report on the encryption as as it's happening. So this is very important, to to to kind of set us apart from and Superna, but as well cyber storage apart from traditional backup and recovery methods. So when we go back to that this data driven intelligence workflow, we can identify areas that are vulnerable to attacks. Superna, plays a critical role in protecting number one, the data during the cleansing phase. So, and and even before cleaning, we're we think it's important that on these diverse date, data platforms and the diverse data sources that the, the data is actually free and clear from encryption, not only for AI modeling, but for just day to day operations. Then, the cooling of data. So on on the VAST Data platform, we work very closely with the VAST Data platform, so that when the data is pooled, what we can do is provide complete chain of custody and audit history to who's touched the data and when before the data is actually, sent off for for training. And we can also protect it while it's in place against ransomware attacks. Then, of course, also protecting the results. So you paid for those results. You've you've gone through a whole training cycle. It's also critical and important to protect the data, at that phase as well. So, we'll skip ahead a couple of slides here and we'll move into our cyber storage offerings for, for for VAST data. We offer a data security edition, which offers complete ransomware protection, file auditing, cyber recovery manager and then the ability to alert security teams. We also have an air gap solution that's planned for VAST Data which allows enterprises to have a third copy of their data placed inside of a an isolated vault or an offline clean room. We have, with this technology the ability to open and close the the vault access from within the vault itself so that no external access is actually required to operate the vault. It works fully autonomously. We also offer disaster recovery orchestration. So I did mention that was our bread and butter solution that helps storage administrators and storage administration teams fail over in the event of a planned or an unplanned outage on the storage platforms. And then over at the far right we've got a new product that's just been recently launched it's our data assessment and security module that can cross reference, NESA scans and security audit scans with devices that actually access the data itself to help provide enriched information and prioritize security and patch data management and remediation. So we've got a quite a quite a few solutions available for the VAST Data platform. The next slide is a build out slide that shows you know some of our capabilities, users accessing data on a production cluster. So the failover orchestration, the ability to failover from one site to another in the event of a planned or an unplanned requirement. We have the ability to detect ransomware like activity and provide audit for data security and forensics and compliance use cases on the VAST Data platform. We also offer, a zero trust API that can alert, security orchestration layers, within organizations. So the SOC team can be notified on any sort of data security events themselves. So we offer all of that. And then, of course, as I mentioned already, the intelligent air gap. All of our solutions are built on a cyber storage framework. We use the, NIST framework that has five key tenants, identifying, detecting, protecting, responding to, and then recovering from cyber events. I've got a build out slide that's coming up that shows exactly, how we do all of that, with our with our data security edition. That's the one we're gonna focus on primarily. And I'll just kind of move ahead here and this is this is the the build out slide that I was talking about and it's going to show you know how we we protect data. So you can imagine here the bubble in the the upper left corner are users and applications in your environment. Now these are users and applications on any subnet anywhere in your environment. They're accessing data on the VAST Data platform via a protocol. Of course that protocol is going to be SMB, NFS or S3. We deploy our solution here on the right side of the diagram. It deploys in two parts. The first part is a core agent appliance. These are virtual machines that deploy into an on prem hypervisor. The core agent is a management virtual machine where storage and security teams can log in and manage policies and and and manage the the scalable cluster agents which are additional VMs down at the bottom, right of the diagram. Those machines are headless in nature so they're not, managed manually. They're all managed from the core agent appliance appliance above. We can send down detection rules, audit requests, etcetera, down to the scalable cluster agents and those workers will perform the tasks that we we, we've sent down to them. And then on detection, those workers will actually send security events up to the core agent appliance itself. Once we do deploy and configure, the first thing that we do is we establish an API based relationship with the the vast data platform that's, that's on-site. With this API based relationship, we can do things like query inventory. We can we can also send down commands to create immutable snapshots based on compelling events, or we can do things like lock users out. So this is an API path that we use for communication and collaboration with the VAST Data platform, and it helps us with our, our detection and and and defense of the platform so that we can autonomously protect the platform without, any intervention from any any third parties at all. We can just kinda do that. The next thing we do is we establish a relationship via an MFS stream. We'll enable protocol auditing on the VAST Data platform, and then we'll mount the, the audit log files, on the VAST Data platform. And within these audit log files, we get all kinds of information about all of the users accessing data. We get the user identifier, we get their source IP address, date and time, the file, directory or action that a user or application has accessed along this path. It shows up in the audit stream and the block offset. And all of this gets ingested by our solution over here to the right, and is analyzed and processed in real time. These are containers over here. So some of them are responsible for doing things like detecting events in real time. Other containers are assigned with, storing information into, an offline database for historical and forensic audit use cases. But this solution is also capable of managing multiple clusters in an environment by itself. Now the methods that we use to detect ransomware like activity are user behavioral analysis. So this is the, I'll go over an example of that in a second. But this is the ability to learn what normalized behavior is within an environment, but then filter out abnormal behavior from the normalized behavior and then determine if that is a malicious event happening within an environment or not. We also deploy a honeypot tripwire. What this is is a non production share with non production data in it And if any user or application or process goes out and accesses that of course these shares are mapped into file system paths and we see the file system path access through the audit stream so we can raise an alert for that sort of out of bounds access. I mentioned ransom notes earlier. We have ransom note detection so these are the files that are left behind by the the affiliates and ransomware software that's running during a security event or during a breach. These files are often left early in the ransom attack. They're critical to the ransomware organizations being compensated so they leave them early. We've got a, like, a dynamic list of, right now over 6,000 different types of ransom notes. We continuously update that with with what's going on right now, in in the world. And then, we're also capable of detecting suspicious multi user behavior. So this is two or more users or applications have been compromised. This acts as a multiplier for our sensitivity, in ransomware detection. So we're analyzing this audit stream and we're able to filter out events and as I mentioned before we're actually able to do this on multiple clusters simultaneously through a single pane of glass and single interface. So all of your policy and detection rules can be applied across multiple clusters and they can all be centrally managed and monitored from from a single place. Now this this next example here that we'll go through is a ransomware event. Now during a ransomware event as I mentioned an affiliate will gain access to network and then they'll compromise one of the workstations and then they'll deploy the payload for for ransomware. The ransomware doesn't run it doesn't run on the storage platform at all it actually runs up in user space on the compromised machine and it actually assumes the persona of the application or the user or the machine that it's running on. So the rest of the network environment and all of the other pieces of security that are in place are kind of unaware of what's going on at this point in time. They've already been compromised and now ransomware has kind of a clear path in normalized, unprotected, environments, to be compromised, this way. But because in this example, a Superna is is actually, in place and the cyber storage solution is running, We're seeing the ransomware read files sequentially as an example. Maybe the ransomware is updating the files, modifying them, rewriting the files and then changing the file extension names. As we're seeing this pattern going on we're noticing that that behavior is not normal from this particular workstation. We see it in the event stream and then we're able to do the following. The first thing that we do of course is we raise an alert on our dashboard, We fire out syslog messages and email alerts to team members. We know that nobody's probably like, generally speaking, nobody's, like, looking at this dashboard 24 by seven. So it's very important that we also are able to take some sort of automated response to, let's agree that this is an automated attack, going on. So the best defense for an automated attack is an automated response. And what we do in this case is we send a command down using this API based relationship to the VAST Data platform that, creates a what we call a compelling event based snapshot. Now what that snapshot is, it's is it's stored on the VAST data platform itself, but it's very different from the normalized snapshots that occur, that storage administrators and security teams have running on a chronological or cron based schedule. Those snapshots run daily or weekly or hourly or whatever it is. Our snapshot is different, but complementary to those snapshots because it's it's strictly based on a compelling event that we've detected. So it's very unique. And and why that's important is because it gives, storage and security team members the ideal point of recovery to back out of if this is indeed a security event. Now, optionally, one thing that we can do is we can actually lock out a user as well. This is an optional action that we can take, on the on the platform itself. We do this in cases where we'd like to have the user isolated and allow the rest of the users to continue working. And we do this once again by sending in an API based command down to the platform and then we update the views on the, VAST Data platform to exclusively, restrict the suspected user from access, meanwhile, allowing the rest of the users to continue their work throughout the day. The important thing that we've added to our portfolio now is this zero trust API relationship, up to the upper right here. And what this allows us to do is, we can actually bundle up all of the event information into a webhook based message, and we can publish that message into many of the top security top meeting security providers out there. And as an example with ServiceNow, we can go in and create an incident in ServiceNow that automatically gets assigned to the security storage and and desktop support teams. Now they're all aware of an actual security event on the actual platform itself without somebody calling from the help desk to tell them. So they're already ahead of the game and we tell them that we've created a snapshot, they've got a recovery point and the user's been locked out. Now that team can go and investigate the event, tidy up and remediate the issue, And then, and then close the the ServiceNow incident. And then once that's done, they can send a command in to our cyber recovery manager. And the cyber recovery manager, what it does is it it understands all the files that were, impacted as a as a result of the event. It understands that there is an associated compelling event based snapshot to that event. So then it goes in and it recovers the files in place from that compelling event based snapshot, and it stores the files that were impacted in a quarantine. So the security team can now investigate further if they want to. They've got all the files quarantined. The user's been unlocked. The use the files that the user has touched have been restored to last known good, which was, associated with compelling event. So we have a very now a very lightweight recovery method that is leaps and bounds better than going, and trying to figure out, from backups, you know, when the the attack happened, how far back we should go from, from a backup point of view or a snapshot point of view. We have a complete chain of custody of all the files that were touched, and we can surgically recover and repair the files that were manipulated during the security event. So it's a much more compelling, and cost effective recovery method than traditional historical methods, resulting in much less downtime, quicker recovery, and and, and higher higher speeds of, of services service recovery. So, you know, this is this is just, you know, a slide with our workflow. I'm just about ready ready to wrap up. But, you know all of the data that exists on the VAST Data platform, Superna is tied into the real time audit stream. We're able to detect lockout restore recover and failover from through our processing engine the VAST Data platform at exabyte scales. And we're also able to integrate with all the top leading security providers that are out there today. An important question is does it work? So yeah we we what we do on an annual basis is we send this out to an independent third party. This year we sent it out to a company in Austria called AB comparatives. AV Comparatives, they're kind of like gray hat guys who go in and they find ransomware strains and we let them black box test our solution. And they've created a report on exit that demonstrates exactly what we do, how quickly we do it and we've been certified by them in 2024 and we'll be going back to another independent third party in 2025 to retest and recertify. The NASCAR wall of all of the the security vendors that that we we've worked with and created integrations with. We've done over I worked with over 20 vendors as of as of recently and create over 51 integrations out there. In closing, there are a couple of papers that are really good for additional reading. These are Gartner reports that help further define what cyber storage is. That's done in the hype cycle for storage technologies in 2024. And then for the first time in the magic quadrant for file an object, ransomware defense and cyber storage is actually being listed as you know cautionary for platforms that don't support it or as a value add for platforms that do. So there's the praising and the cautioning column for every storage vendor and Superna is the worldwide leader in cyber storage listed out there. So hopefully this helps describe what we do Superna. We do some other things as well on the VAST data platform as I had mentioned. For those who are, you know, using NFS and NFS exports, we got a really amazing feature that was just released. It's called hitless NFS failover. With hitless NFS failover, previously, if you're failing over from one cluster to another, on an NFS system, you had to, stop your client application, unmount, the NFS, clients, and then remount them. That's no longer a requirement. And this is a unique capability that we offer only on the VAST Data platform. That's because VAST Data maintains the FSID and the actual file system blocks together which when combined create the file handles. So now file handles are not reset during our failover orchestration which is which is pretty amazing and very compelling to to those who are using NFS as a feature on the VAST Data platform. I've got a list of contacts here. So for any any technical information. The easiest way to get a hold of us is that VAST Data at acuprna.net that'll go out to the whole team. But in America we've got Carson Pitcher who is our sales leader in The Americas, and Steve Arlen, who leads sales in in, Europe, Asia, and and, The Middle East. And, globally, I'd be the the point of contact for any kind of technical information you'd like on our solutions. So, once again, thanks for your time, and, we can just kinda open up to any, q and a, periods at this point in time. Fantastic. Thank you so much, Derek. This is an amazing presentation. I learned so much here. I wrote down a bunch of questions. And as you were, doing your presentation here, going through the slides and everything, you answered many of them. Yeah. So one that I, that I really want to dig into that you presented really well here in the past couple of minutes was how you identify abnormal reads and writes on a per user basis. And you went into very great detail on this. Just a fantastic walk through on how you identify things, look at the audit stream, audit stream, look at the different methods that you're using here. Just stellar. And I love the integration that you have with, VAST Data as well. You mentioned that you can, automatically update a view for a specific user when you notice abnormal behavior, and then also integrate with tools such as ServiceNow to create a ticket, make sure that that's already there, all automated. It's just amazing. This is so so good. But I do have a few questions that I would love for you to answer though. Yeah. Sure thing. So the the first one, because you you talked about this in the beginning here. You mentioned cleaning of data. Yeah. So when you clean your data for for it to actually be transformed into information, that you can take action on and and, actually make decisions on. What are some of the most common challenges that you see? Yeah. I mean, the the biggest one is, you know, personally identifying information. I think when it goes to taking data from from source and considering loading it up into an AI model for ethical and compliance and and purposes and privacy protection. Getting into that data and ensuring that it's free and clear from any personally identifying information is critical to an organization who's going to be loading data into, into, an AI model. So, that that's probably the biggest one that's, that's critical. Of course, there are things like, that you're doing, also just to make sure that formatting basic formatting is is good and complete. But, the biggest one I I think, is for, compliance and privacy requirements. So when you do, the the cleaning portion of your data here, What kind of tools and what kind of methods do you see, you being used mostly, at companies that you worked with? Yeah. Several tools, that that can go in and scour, files on a file by file basis and report on, the actual data that's inside. Things that can identify license plates and credit card numbers and health care, IDs, phone numbers, email addresses, and the likes are quite quite quite useful and powerful. We have a number of libraries in our solution. We're investigating and going out and and providing kind of kind of like a moving up the the services stack into adding more value in the cleansing phase as well. It's something that we had dabbled in in past products so we've got a lot of intellectual property built up around there. But there are there are a number of tools that that can go out and do that. And then there are other ones around things like medical images where, x rays and and ultrasounds have, the, the actual patient names embedded in there. There are depersonalization libraries, numerous ones that we've come across that will go in and and look at, those sorts of medical images and and, and pull out, that that sort of information as well. And then finally, there are other ones that even further that, that use TensorFlow and and other, libraries that can go in and and anonymize things like faces and and and other and other parts as well. So number of tools there. Awesome. So as we we talked about this, we talked about training AI and, on the data that we have. How do you, how do you see companies choosing what kind of data or what, well, what kind and what type of data that they train their AI models on to make sure it's correct and informative? Yeah. It it does depend, largely on, on on industry. As, you know, folks like, in in a genomic and in biomedical might look at large scale genetic sequencing datasets, clinical trial results, medical images like MRIs and CT scans. Folks in, you know, satellite remote data sensing might look at climate studies and geospatial research. That's a a lot of the external data. Your internal data that you would use, like things that you've already built up over over times or any of your own clinical trials or, any of the own, you you your own maybe, CRM databases, things like emails are like a gold mine, for, for information and conversations. And large language models can really make light work out of analyzing what conversations mean, the context between, discussion parties, databases, SQL tables, all all kinds of things. Any sorts of charts and reports, that were done in the past, any any, you know, annual reports or financial data, sales data, all kinds of things. I think you really want to get everything and anything that you have in there because there's, there's an unknown to your known datasets. And, you want to try to get as much information in there as possible like videos like audio files, audio recordings, everything possible you wanna get it in there. Mhmm. You were talking, about cyber storage. You you were talking about the the ByteDance case where where they had a disgruntled employee that planted some malicious data. When we look at ransomware, have you seen any, any cases where they have gone in and not encrypted everything, but rather maybe injected incorrect data or encrypted just portions of data, like, one table in a database, for instance? Yeah. We we've worked with, now I haven't seen, personally the, like, a table injection in into an SQL database, but we've worked with, a number of security consultants who had access to, some of, like, the help desk logs and internal conversations of the ransomware organizations that are out there. And we see the desperate pleas of, you know, users, and administrators and, you know, an educational institution, a computer science teacher who was kind of called to help them unencrypt data. In research and and health sciences we've seen data injected in by suspected competitors who have wanted to gain an advantage on their competition by contracting and outsourcing, that sort of that sort of data, those sorts of teams as well. Those cases are kind of under investigation as according to our consultants. But, yeah, we've definitely seen, data pollution by, or or examples of alleged data pollution by by competition, in in in some of our studies. So I think that that must be even harder to catch, because you're you're relying on the data. It's there. It's not a ransomware attack, but all of a sudden you see that the data doesn't make sense. Yeah. That's that's where the chain of custody comes in when we look at, you know, where, where you you should really be focused on protecting your data. You look at all of it's like, you know, very important to look at all of your, your your attack surface and and understand where your attack surface vulnerabilities might exist. These would exist, on the source data itself. But, you know, specifically and this is where, many researchers, they tend to spend as much money as possible on the, on the capacity and performance Mhmm. Layers of not just the the the storage but also the analytics and processing. And they tend to kind of turn security, to the wayside because, they're they're interested in in like these these, you know, research breakthroughs. But when the data is pooled in a centralized location, that's probably when it's most vulnerable because it there's such a massive data here to run an audit after to try to figure out exactly what's happened, can be very very very time consuming. So it's important to have a solution in place prior to pooling that can provide a chain of custody to all the data that's being loaded in but then to to then provide a chain of custody on all of the people who have accessed the data before loading it into a model or starting a training session. That's extremely important. We also recommend the immutability capabilities of the platform so that once the chain of custody is confirmed immutability can be enabled on that on that data pool. And now now there's there's a solid source and you know the CISO can go back to the board and say yeah here's here's the audit record of everybody who's touched it. It's clean. We then immediately enabled immutability and then we'd load it from this purified data set. So those are areas as well. And one area other area that's often overlooked is is actual, inference output. Now, the model is trained up and, you know, exists for a period of time in a training cycle, but then it's it's running an inference. And, I don't know if you've you've used much of, like, Copilot as an example as as an as a as a model. You'll find that it'll it'll provide you an answer. Mhmm. Then it'll ask you a question immediately after. So it's like, oh, you, you know, you just searched on some airline flights planning on going on a trip? Mhmm. And it's like the your response to that question helps confirm the model itself, but then it it results in a in an additional data that gets relearned in the next training process. So the inference output also attacks surface that is critical to, to to protect. You don't want that the results of that being encrypted or or lost, but then you also don't want that, those, those results to be polluted with, with, with, in in, inaccurate responses. Fantastic. Fantastic. I also wanted to just add here that this is the first time I've ever heard of the phrase, ransomware as a service. So that was very enlightening. And, I knew about the the the help desk, sort of thing, but not in details. That was that was really, really good as well. Yeah. But, yeah, folks folks, should understand that, you know, the the the ransomware organizations are there are a few dozen of them but then there are, you know, hundreds if not thousands of of these affiliates and these are unaffiliated or unassociated hackers that go out there and then once they penetrate into an organization they'll go to they'll dial up you know a number of ransomware organizations and try to get the best possible software and the best possible margins for their effort as well. This is this is, it's, it's actually a business that's that's being run and it's it's decentralized and, it's it's, it's quite, you know, it's quite fascinating, the the level of organization that these these guys have have put together. Yeah. Fascinating and scary. Very. Sure. Both. Yeah. Simultaneous. Yeah. I'm I'm super super happy to see, your solution here and and having you on the the Cosmos community webinar here today to talk about, how you're helping to, stave off a bunch of ransomware attacks and and help recover from them if they have already happened as well. So this has been fantastic. Thank you so much, Derek. Do you wanna put up the the, final slide that you had with the contacts again? And then Pull over to that and, there we go. Fantastic. Yeah. So thank you everyone for joining today. We'll put it this up on YouTube as soon as possible so, you can watch it again if you missed anything. And, as always, if you have any questions or any follow-up discussions, we can, we will have those over on the community. So community.bastdata.com. And if you wanna contact Derek, of course, you got the, Derek's email address here as well. Derek, do you have any closing words? No. Just, thanks a lot for having me and, looking forward to, to working with you all and, you know, have yourselves a great day. Fantastic. Thank you, everyone. Have a great day. Bye.