Lance Glinn:

Welcome in to another episode of the Inside the ICE House Podcast. Today's guest is Cal Al-Dhubaib. He is the principal technologist at Rubrik. Cal, thanks so much for joining us inside the ICE House. Happy to have you here.

Cal Al-Dhubaib:

Thanks, Lance. Great to be here.

Lance Glinn:

So Cal, Rubrik recently launched Rubrik Agent Cloud for Anthropics' Claude Code and Claude Cowork. So as AI agents increasingly write and deploy code on their own, what challenge did Rubrik see in the markets that made something like this just so important?

Cal Al-Dhubaib:

So the controls that we've relied on just even for the last few years, let alone the last few decades of security, were never built for probabilistic software. And these AI systems, they behave in really different ways, and that doesn't mean that they're bad, but you can't just control them with static rules. I'll give you one of the fundamental challenges here. These AI systems are only really useful when you start to give them permissions. So you need to give them read and write access to your data and your systems and your files. But that means then you have to have an ability to then inspect its actions and say, okay, does this read actually makes sense for the action it's trying to do, or might this lead to some other intended or unintended consequence? And so, that was the problem that we set out to solve with Rubrik Agent Cloud, how do we evolve traditional controls to be able to account for the ways in which these systems can behave?

Lance Glinn:

And I think a major theme of the launch is giving organizations more visibility, more control over these AI agents. As companies deploy more autonomous agents across their business for various different reasons, how can they maintain confidence in what those agents are accessing and what those agents are doing?

Cal Al-Dhubaib:

So I think of this as the hierarchy of needs, and frankly, most organizations have been so focused on their rollout of AI systems and their pursuit of productivity or effectiveness that this tension is really starting to bubble to the surface this year, last year, and problem number one, where is AI in the enterprise?

And there was this great conversation we had with a client about eight, nine months ago when we were starting to do our customer discovery for Rubrik Agent Cloud. We said, "Hey, this is the concept. This is the problem we're trying to solve." And he said to us, "Oh, we've only got 10 agents in the enterprise. We've got it under control." Six months later, we had a conversation, it turns out there's actually 200. And the number of times that I've had conversations like that recently with CISOs, where there's hundreds or even thousands of these identities and accounts cascading across platforms, tools, data sources, systems of record. So problem number one is where is AI in the enterprise?

Problem number two, what can these tools actually affect in the enterprise? Can they delete data? Can they produce code? Can they access or manipulate data and systems of record? And then, problem number three, and this is really when you start to get into one of the harder problems here, is how do you know when these systems are misbehaving or behaving in an unintended way when they're taking those actions? And then, lastly, four, how do you remediate? And that can be with a block, an escalation to a human. And you need the trust infrastructure in place with tools like Rubrik Agent Cloud in order to be able to address that hierarchy of needs. But frankly, most organizations are still there at number one, where is AI in my enterprise today?

Lance Glinn:

And I think among that hierarchy, you brought up, I think it was point number four, how do you then solve the issue if one of these agents misbehaves or doesn't do what it is intended to do? And I think that brings in then this Agent Rewind that is obviously a part of Rubrik Agent Cloud. Why do you think the ability to reverse an AI agent's actions is just becoming increasingly important? Because it's something that makes a lot of sense, right?

Cal Al-Dhubaib:

Yep.

Lance Glinn:

If this AI does something wrong, obviously it makes a ton of sense to just, hey, let's rewind, backspace, whatever you want to call it, bring it back to where it was previous. But why is it becoming increasingly important? What have you noticed from what your clients have told you, and just what have you noticed as someone who absorbs and evaluates the technology that's coming?

Cal Al-Dhubaib:

So it's funny, why are we unleashing this software anyways to begin with if it has a chance to take these actions and make mistakes? The reality is the cost of the alternative, not using these AI tools, is actually worse. In many instances where I've worked with clients in healthcare, for example, physicians are overwhelmed, ambulatory nursing is a challenge that can only be addressed with some amount of automation and insight where you're leveraging these AI tools. So one, why are we doing this? It's because we actually don't have a very good alternative.

But that being said, when we have these AI systems in place, and even when you go through that hierarchy of needs, where is AI? How do we know what actions it can take? What controls can we put in place? You might not be able to imagine every possible edge cases. And so, in some instances, you want to have a tool in place that can say, is this system doing something that it shouldn't? But if you haven't pre-specified that it should be blocked, it just seems suspicious, we're going to alert... This doesn't look like anything we've seen before, but I don't actually know if this is bad or not. It can be logged, escalated. And let's say that action maybe led to data deletion or a misconfiguration, you then have the ability to say, oh, let me restore to a point in time when I know the system was configured well.

And we've seen no shortage of examples in the past year. Probably one of the most prolific was when Amazon lost 6.3 million orders in a single day, and that was a result of code that was generated with AI, and as a result of that, they actually tightened down on their quality control processes. There were other instances that were much less recoverable. In one instance, one small business had lost their entire order delivery system of record-

Lance Glinn:

Wow.

Cal Al-Dhubaib:

... and they had to end up reconstructing their order history by going to Stripe records and trying to match receipts with customer invoices. And they actually, in that case, could not recover any data other than reconstructing it manually. And so, a tool like Rewind, assuming you've done your homework during peacetime, to have that data inventoried gives you the ability and peace of mind, if a system does overreach in an edge case that wasn't detected, you can go back to a snapshot that was recoverable.

Lance Glinn:

Yeah. And so, it seems like Rewind, just based off of what you're saying, bringing up those different examples, the cost of not having something like that within the product can be, for some companies, immeasurable. It could lead to really catastrophic circumstances and consequences if the ability to, again, rewind, backspace, whatever you want to call it, bring you back to prior to what the AI did wrong, if you don't have that accessibility, it could bring down businesses, depending on the size, realistically.

Cal Al-Dhubaib:

Yeah. And so, what ends up happening realistically is the office of the CISO is stuck there saying, "Well, no, we're not going to green light this. We're actually not going to allow these tools to take write actions, and so we're actually effectively limiting the potential value of these tools." And one of my favorite things just in this journey of Rubrik Agent Cloud is at Rubrik, we're actually seeing this on two fronts. Not only are we building this product, but we're also a company that's adopting AI, and we've been learning as we go from our own tension internally of the pressure to adopt versus, whoa, these tools can really do weird and strange things.

Lance Glinn:

So Rubrik also introduced Semantic AI Governance Engine, or SAGE. What makes AI governance different from traditional security governance, and why does an AI-driven world require a different approach?

Cal Al-Dhubaib:

So this is a game of yes-and. We're not poo-pooing traditional controls, you need those in place. You absolutely do want to have good read/write permissions and identity management across any non-human identity. That being said, let me give you an example. Claude Code has a tendency of fixating on the goal that you've given it, even if that means sometimes violating some other common sense violations. In one instance, when we tasked Claude Code with producing a report and it actually wasn't able to publish the dashboard as expected, it decided, ah, I'm going to find a suitable alternative. I'm going to create a GitHub repository and I'm just going to publish this as a GitHub gist, and then they'll be able to see it there. Well, that unintentionally exfiltrates information into a source or a repository where it shouldn't exist and it shouldn't be. And so, that's an example of even just the agent behaving in a well-meaning way, and it ends up taking an action that is destructive.

Now, imagine the alternative, where this agent is now being targeted or subverted by a threat actor that's intentionally trying to manipulate the agent's actions. And so, some of the threats that exist out there are prompt injection, and so you might even have an innocuous agentic search, it comes across a website. That website itself has been compromised, so the website isn't necessarily malicious, but it's been compromised. And now, somewhere, there's an HTML tag with instructions waiting for an agent to come across it that can be subverted by that action to either forward sensitive information or do some other action. And so, there's all these strange things that these AI systems are allowed to do or come across and can encounter that then enter their context that influence their actions, and it's no longer just an if-else. You actually have to contextually be able to understand, is this action consistent with the intent of the system, one? And two, could this action have negative repercussions?

And so, what SAGE is, it's a small language model that we've trained and fine-tuned, that is lightweight and specialized in understanding the context of these actions and weighing them against certain policies. And you could do this with a large language model, but they're slow, they're expensive, and that kind of defeats the purpose. And so, the idea is, can we put this savant model capability in a smaller model package that is specialized in understanding this context, to then sit in between whatever information flows into the model and the actions that model is taking as that gateway?

Lance Glinn:

Just generally, how should organizations think about securing and governing not just their code, but the prompts, the permissions, even the settings that guide their AI behavior? Just generally, not even talking about Rubrik Agent Cloud, just generally, how should organizations go about thinking about that? Because that is something similar to what the answer that you just said, it's something that is of the utmost importance, and something that I feel like a lot of enterprises might not be thinking about, but should be thinking about.

Cal Al-Dhubaib:

So I actually read a book recently that I loved by Reid Blackman, and it's called The Ethical Nightmare Challenge. And I'm very aligned with this premise here that there are so many infinite ways in which these systems can make mistakes because the surface area of risk has expanded. It used to be we had traditional software, and you knew where its edge cases were, you tested it exhaustively, and it either worked or it didn't. And then, we had narrow AI systems, like machine learning models, that had some small tail of edge cases that could be circumvented or fooled or maybe broken when the assumptions weren't the same. So if you trained a system to rank resumes and it hadn't seen a foreign resume or it hadn't seen somebody with a certain background that wasn't overrepresented in your population, it might not perform as well.

And now, with agentic AI, you have literally any possible set of inputs from any number of data systems, both that you control, but also maybe consume publicly from other sources, and interacting with each other over multiple steps. And so, the surface area of risk is so large that you can't hope to exhaustively test. And so, what do you do with that? The Ethical Nightmare Challenge is essentially saying, where could this really create the most damage? What are those nightmares that you want to defend against? And start putting your corrals and guardrails around that. And so, maybe that's data exfiltration in a certain context. Maybe it is actually creating a resume screening system that over-selects certain candidates and under-selects candidates from backgrounds in a way that isn't consistent with your values. So having a team that's empowered to actually talk through that and be able to articulate those policies, and then ask the question of what resources and tools then are we going to empower our team to use to defend against these nightmares? And that's where you start to get into various different parts of trust infrastructure, including Rubrik Agent Cloud, but also others.

Lance Glinn:

And so, you talk about this surface area of risk, it's only grown, and there are so many things that organizations have to do to obviously build that trust with their customer base to let them know that, hey, your information is safe, your information with us can be trusted. How do you advise organizations to embrace AI and just the technology's potential while still putting the right safeguards in place? Because you really have to find that balance of the technology's evolving, you want to evolve with it, you don't want to fall behind, but the safeguards need to be in place so that your customers as it evolves will obviously continue to trust you, because if they don't trust you, then they're not going to spend their money with you.

Cal Al-Dhubaib:

I put out a course on this topic, actually, on LinkedIn Learning called Trust Engineering for AI. And I think one part of the problem is acknowledging that the controls around these AI systems are different and they're different from anything that we've done before with traditional security. The second thing is making sure that you're approaching the governance of these tools in the right way and constantly asking questions. It's not like you do these ethical nightmare challenges once and say, "Okay, we did it, we documented it," but it's a continuous process. And I think organizations are coming to grips with these, both the controls and thinking about them, and also how to govern them. What I see missing, and this is the other side of building trust, is then how do you translate that into how you communicate with your end users and how you design user experiences around these tools?

One very simple example, let's say you have an internal tool that is being used to retrieve information to help customer service professionals respond to customer inquiries. One of the challenges that you might face, especially if you connect this tool to sensitive data assets or confidential data assets that could be used to inform this customer service representative, but might not necessarily be something that's safe to share with the customer. I've talked to organizations in situations like this, and they struggle with how do we then make sure that whoever's using the system is using it in the right way? Well, the answer's easy. You add signposts into the result that say, "Okay, this stat over here came from this data source that is confidential and sensitive and can't be shared externally." And so, you add these user experience nudges that allow someone to contextualize what's appropriate to do with that information. And that's just one example of designing trust into an experience.

And then, being able to communicate and tell that story about how you're evolving it and how you're putting those signposts into these tools is a big part of building up that consumer trust in how you're using AI.

Lance Glinn:

So Cal, I want to pivot the conversation to talk about AI at Rubrik, and the term AI company, it could be perceived in many different ways. You can take existing products that you already have and just, say, simply add some AI features to them, or you can use AI to really improve things, like cyber resilience, threat detection and recovery, decision-making, so on and so forth. How does Rubrik approach AI internally and within its portfolio when you compare, again, just adding features of AI or really using it to improve existing parts of the business?

Cal Al-Dhubaib:

Yeah. So we really have three stories for AI at Rubrik. One is the Rubrik Cloud story, which we've talked a lot about. The other is how we've implemented AI into Rubrik Security Cloud. And there's so many different things that you now need to take into consideration to be able to be resilient to threats, and these configurations change on a constant basis. And so, introducing AI that can partner with individual users of the platform to help automate suggestions and workflows, so embedding it in the product. And then, the third is how we're rolling it out, actually, across our own company, both within engineering, but also non-technical functions.

And I had a really great conversation with our CTO recently where he was highlighting all of the various different ways in which we're now using AI to do value-add. My favorite is actually the legal and privacy team are actually using Claude Code to continuously monitor new features and capabilities in the code base, and identify proactively when additional privacy considerations are needed. And I'm like, wow, that's a really cool use case. And this all came about probably close to a year ago now, and that was when our team was in the very early stages of evaluating agentic coding and how we were going to approach it as an organization. And very early on, we realized some of the challenges that come with these AI tools, and so we ended up forming a cross-functional group that included the CTO, the CFO, the CIO, and the general counsel to come together and really tackle the multiple different facets of this problem. And as someone with a background in AI risk management, within my first couple of weeks of joining Rubrik, I was really excited to learn that we have dedicated AI attorneys, for example.

Lance Glinn:

Yeah. And so, these use cases that pop up, some of which have been used that we may not even know, but are obviously coming to light based off the conversations that we have. Of course, there's all of these use cases that we do know that are being used by people like myself, for example, regular people that aren't so intertwined in the AI universe on an everyday basis. But of course, I still think there are expectations of what the technology is, what the technology can do that we haven't reached yet. But do you think the expectations right now, do you think they're getting a little bit ahead of the reality that we're seeing? How would you compare what people think AI can do versus what AI can do right now? What AI might be in the future, those expectations might ring true. But as you compare it to 2026 today, are the expectations getting ahead of reality?

Cal Al-Dhubaib:

One of the most interesting things about AI is that its performance defies expectations in really weird ways. And I'm reading this book now called Not With a Bug, But With a Sticker, and it's this whole premise of if you put a specifically colored sticker, two of them in a specific place on a stop sign, it can convince a Tesla or a self-driving car into recognizing that stop sign as a green light. And there are all these great examples. In the very early days of ImageNet and computer vision models, going back to 2017, we thought computer vision was a solve-for problem. In fact, compared to human error rates in the ImageNet data set, we got down to 2.5% error rate with machines versus 5% with humans, and largely, folks were like, it's a solve-for problem. But then, if you put a series of chihuahua faces next to muffins and you give it to a computer vision system, it would confuse the chihuahuas and muffins, for example, and that's something that humans wouldn't do.

So performance in these AI systems has always been weird, and we've come a long way since then. But the agentic equivalent now is, wow, this works really great at summarizing this non-technical information. But wow, it takes things out of context when it's a legal brief or it takes things out of context when it is a particular domain expertise that is maybe underrepresented or without specific fine-tuning. So a lot of the expectation or anticipation in enterprises today comes from the future capability, but it's also inspired by where we've seen it perform with excellence. And we haven't yet defined that organizational best practice of, all right, use it for these use cases and not for these, and that's what every enterprise is now going through the process of uncovering.

And one thing I'm really grateful about our approach here at Rubrik is never once did we make this about cutting people. We've always focused on more effective outcomes. In fact, personally, I've become convinced that time savings is the worst measure of the value of AI, and I'd love to debate that with anyone who had challenged that. But it's this idea of that might very well be an outcome, but the primary goal is effectiveness. Have you used AI to reduce the time to resolution? Have you used AI to increase customer satisfaction? And when that's the focus over just cutting time or saving time, that's when you really start to get to where AI is being valuable, and maybe where it's not adding value and where it's adding noise and maybe not for now for that use case.

Lance Glinn:

So I'm not saying I agree or disagree, but I'll challenge you on it a little bit. Does time saving not equal effectiveness or efficiency? Is that not sort of the same thing, just different words?

Cal Al-Dhubaib:

In some cases, it might. In other cases, I actually think it leads to a pressure to over-adopt AI, and that's where you start to see instances of work slop. And so, a great example is in the contact center. Really, we don't care necessarily about how much time was spent on the phone with an individual, but we care about from when they opened a ticket to when it's resolved, that window getting smaller. So yes, that's a form or a flavor of time savings, and if AI is helping us achieve that, great. But if what we've ended up doing is having frustrated customers close out of tickets a lot faster, unresolved, because they're not getting anywhere. Well, sure, we've saved time, but we haven't actually moved the needle forward.

Lance Glinn:

Absolutely, absolutely. So you brought up enterprise AI a couple of answers ago too a lot, and as we look at the future capabilities of AI and this expectation of what it could be, what do you think enterprise AI will look like moving forward? Are there specific trends that you're having your eye on or you're keeping close to the vest that you think could dictate what the future ultimately does end up looking like for enterprise AI?

Cal Al-Dhubaib:

So increasingly, and I'm getting some of my clues from how we're using this in the context of engineering, because I think that's the farthest along, most well-adopted flavor of agentic AI. And it's really shifted coding from, now, you're going to have a team of engineers go break up a project into different sprints and features and capabilities, to now you actually are focused on, as an engineer, you're building a design spec for a tool like Claude Code and specifying the functionality and capability and even security requirements that need to be a part of whatever feature you're building, and a lot more time is spent on that. A lot more time is actually spent on quality controlling the output. And I actually think that that pattern is going to translate over into how we approach knowledge work.

And so, let's say you're putting together a presentation or a market research brief. You might actually spend a lot of time co-creating and designing, what is this research plan going to look like? What are the assumptions that need to be upheld in it? What are sources that you trust or don't trust? And then, you let the agentic tool proceed to take action in between. And in addition to that, I think we're going to have some net-new roles that end up being roles that are responsible for quality controlling these systems, continuously updating and inspecting the guardrails and controls that are enacted as policies with these systems, and there's going to be some consistent amount of overhead that is checking the growing complexity or inspecting the growing complexity that is a result of using AI in the enterprise. So I don't see it necessarily totally automating away knowledge work, but I actually see it expanding and creating new flavors of knowledge work.

One more prediction I'd add to that is we're going to see increasingly cross-functional work. And so, I've seen this with my own experience. Coming at this as a data scientist, I was increasingly focused on quality control of machine learning systems. And at some point in the last couple of years, quality controlling, does this machine learning model work, has evolved into, whoa, I actually also need to secure this model. And so, I now am entering into the world of cybersecurity, and you're seeing the same with cybersecurity professionals having to govern and control these systems. So as AI does more, I actually think we're going to need to be more cross-functional as professionals as well in whatever domains we live in.

Lance Glinn:

Who knew? AI bringing people together, bringing people together, bringing different areas of business together. Who would've thought? So Cal, I'll end our conversation on this. As someone who obviously spends a lot of time thinking about AI, cybersecurity, technology's evolution overall, just what's one piece of advice you'd give leaders who are trying to prepare for this ever-transforming AI-driven future? Obviously, they've already dealt with it up to this point here in 2026. We've talked about the future, we've talked about expectations. How would you tell them to prepare for what could potentially come, knowing that what we think might come, it could also be something completely different in the future?

Cal Al-Dhubaib:

Oh my gosh. So many things. But I guess number one on my list is you're not alone. Everyone seems to feel like, oh my gosh, we're behind. One, you are not behind. But two, the only way through this is by now creating space to allow yourself and your teams to learn. And the teams that are doing this the best aren't pushing this down and saying, "Hey, team, learn how to do this." They're engaging at the top. They're learning to work with these tools and they're actually learning from their teams. And so, I would say be open to learning and be open to creating an environment where your teams can learn, because that is the only way we're going to be able to keep up with this pace of change.

Lance Glinn:

Cal Al-Dhubaib, principal technologist at Rubrik. Cal, thanks so much for joining us inside the ICE House.

Cal Al-Dhubaib:

Thanks so much for having me.