Who Controls Your Data in a Sovereign AI World With NetApp

[00:00:00] Your agentic AI might not be secure even with real-time data and proper guardrails. But Denodo makes sure your business has every avenue covered. By placing all your data platforms under one AI data layer, your business can reach semantic consistency safely and securely. So get your agents on the same page by visiting denodo.com and you can learn more about how to

[00:00:29] start trusting your agents to make business decisions. But now, back to today's guest. Where is your organisation's data? Who controls it? Who can access it? How quickly could you recover it after an attack? These sound like technical questions, but today's guest will argue that they

[00:00:53] belong in every single boardroom. His name's Adam Gale. He's the CTO for Cybersecurity and Artificial Intelligence at NetApp. And he joins me today to explain why digital sovereignty has become a business decision shaped by geopolitics, geopolitics, regulation, cyber risk, and the growing value

[00:01:17] of enterprise data. So we're going to discuss the US Cloud Act, Europe's sovereignty agenda, sovereign AI, and why knowing exactly where your data resides can impact insurance, acquisitions, and recovery planning. And we'll also talk about behaviour analytics and storage level protection, and how these things can help organisations spot unusual activity and preserve trusted copies.

[00:01:46] And best of all, he's someone with so much passion and excitement for this industry, he makes regulation entertaining, which could be the rarest technical achievement of all. But trust me when I say he pulls it off effortlessly. So enough from me. Let me introduce you to Adam right now. So thank you for joining me on the show today. Can you tell everyone listening a little about who you

[00:02:11] are and what you do? Sure. So my name is Adam Gill. I'm a field CTO for Cybersecurity and Artificial Intelligence. A lot of people often ask me, what does that actually mean? And I think the truth is that I wasn't intelligent enough to be a systems engineer and not talented enough to be sales. So I am a field CTO. What that means is I'm very good at making PowerPoints. I give it about three years before AI takes over that. But in all seriousness, I advise companies on their cybersecurity

[00:02:37] strategy, their artificial intelligence strategy, generally encompassing data. And I have a very personal interest in regulation, which makes me incredibly boring at parties, but quite useful. I've got to ask before we go any further, that personal interest in regulation, where did that come from? Is there a story there or? Oh, there is actually, yeah. My daughter was born a few years ago. I say a few, she's seven now. And she was quite into Dora the Explorer. So she asked me to tell her

[00:03:04] a story. So I Googled Dora on the iPad and Digital Operational Resiliency Act came up and I thought to punish my then three-year-old daughter for being incredibly fussy, I would read this to her. And it turns out she fell asleep in seconds. So from there on every night, she got to hear a little bit about Europe's digital resiliency play in the financial sector. I became an expert. She went to sleep on time. Oh, brilliant. What an absolutely brilliant story. One of the things I try and do on this podcast

[00:03:33] every day is maybe demystify or talk in a little bit more openly about a big topic out there at the moment. And especially in Europe, data sovereignty has become one of the biggest topics in enterprise IT over the last 18 months. So beyond compliance, though, why are boardrooms now asking three simple questions like, where is our data? Who controls it? And how quickly can we recover it? What's happening here?

[00:03:59] You see, those three simple questions are actually really quite pertinent. And I would say this is in my top three sort of subjects that I get asked about when it comes to AI and cybersecurity in general. So you can sum this up for me in one word, value. And there is immense value in being able to answer those three questions because there is immense value in data. There is so much value in data.

[00:04:26] The finance industry is busy writing and discussing how we can quantify that to put it on our balance sheet because data is valuable. So how do we put it on our balance sheets? Then where do we go from there? Because if I say the data I hoard is worth a million pound, do I invest two, five, 10% of that in protecting it? Because surely I should. It then becomes a business decision. And then you start asking

[00:04:53] questions about data sovereignty. Where should I store it if it's that valuable? And everybody in the world is vivying for your data. They're all after it. You have cyber criminals, you have nation states, companies, regulators, all of them want control over your data because it has that value. So those questions for me are quite pertinent and they all come down to the value of data. And this ultimately ends up being a business decision, which loops back to sovereignty and control.

[00:05:24] And if we're scrolling down our LinkedIn news feed or just reading our emails, we hear terms like sovereign cloud, sovereign AI, and digital sovereignty almost daily now. So for tech leaders listening, how should they separate genuine business requirements from just more marketing terminology? I think there is definitely the idea that you could take those as just marketing terms. And they sound like marketing terms, but in my opinion, they have very solid definitions.

[00:05:52] And if any customer asks me that, I always point them towards the sovereign framework, the European sovereign framework, which always opens their eyes because they then begin to realize that sovereignty is a massive discussion. It isn't just about where is your data stored? It's about where are your parts manufactured? Where is your labor sourced? Where is the software coded? It's huge. It's a really big subject. And being that, it then starts to become a scale.

[00:06:18] Where are you on the sovereignty scale? But going back to the original question, is it a marketing term? Is it business? It's real. I do believe in these things. And we can start by looking at Airbus, which is a fantastic example. The world's leading aviation companies are one of two. There's Airbus and Boeing with its roots firmly in Europe. And they have publicly stated their critical workloads will run, or not run, sorry, not run on US cloud providers, major US cloud providers. They will look to run them on sovereign internal platforms.

[00:06:48] Now, the aviation industry being a critical industry, Covenant and IS2, there's regulation again, and having its own specific aviation regulations go along with it, is definitely a critical industry. So therefore, sovereignty applies. And we go back to that scale. Where is it for them? Do they want it completely in-house, with the ability to burst into the cloud? Or do they want it in-prem, completely? Maybe on a dark site,

[00:07:18] where very few people can access it. And do they want it on open source software? Or do they want it on a US provider software? Or a European wall? All of these things play a part. And they are very real, and they are business decisions. So for me, they're not marketing terms. They're real things. And regulations, as I know you love this topic, so we've got to go there. But the big regulations, US Cloud Act and the emerging European sovereignty frameworks, they're changing the conversation now.

[00:07:46] So how are you seeing organizations balancing the benefits of global cloud services with those increasing demands for local control? Is it a big topic? Is that message hitting home yet? What are people saying? It's a huge topic. You touched on the US Cloud Act there, which seems to be the one that most people reference. But there are other countries out there that have similar sort of laws or regulation as well that allow you to do that.

[00:08:13] And just for anyone listening, the US Cloud Act allows the US to reach into any US company around the world and request data, whether it be my data, your data, operated in a foreign country. I think they're referred to as extraterritorial laws. But this has sent ripples around the world, although it's been in place for quite some time, I should say. And if you look to Microsoft, they did stand up in French court and admit to handing European data to the US government.

[00:08:40] Now, because of this, we have had this and other geopolitical tensions, I may add, this little bit of a backlash where sovereignty has now become more of a discussed topic and there is more of a push to it, particularly in Europe. So it's definitely a real thing. But I should also add, though, that it's been there for a very long time.

[00:09:00] If you look to the defence industry, it's a classic example of very good sovereign architecture and sovereign solutions where they need to build, maintain, operate their own hardware and own software completely independently. Now, some countries don't do that. Some do. France is very good at this. They build their own jets and have their own platforms. So this isn't new to us. It's something we've done before. Another bit I'm just going to mix in here is artificial intelligence, because I feel like you can't discuss these things.

[00:09:29] And I'm legally obliged to mention artificial intelligence five times because I work in the tech industry. If I don't, they come and arrest me. But this is part of it as well, because AI absolutely supercharges this. Let's take that as a marketing boardwalk. A lot of people think that it's just buzz. Sovereign AI, for example, it's buzz, but it's not.

[00:09:49] But you will see that in things like the European Union's AI Act, which points to sovereign or secure data because they're very worried. In black and white, they say, don't let your data get poisoned because what could happen? We've got some really funny examples of this where models have been trained on Reddit, which is that online chat forum. And people have queried Gemini and it said, what's the recipe for a cheese pizza?

[00:10:16] And it spat out dough, tomatoes, motor oil, glue, cheese. Did you hear what I said? It said motor oil and cheese. And that's because it was trained on dirty data. And the AI didn't know any different. But what it was actually reading was a thread about how marketeers get that really stretchy cheese and that glistening cheese on pizza. And it thought that was how you made a cheese pizza. Now, someone like me would absolutely build that and go out and get motor oil out of the garage. But this is all very funny.

[00:10:46] But if you take this as given, the next logical step is people will start poisoning artificial intelligence on purpose to make it do things down the road. And the Cornell report, which was based off Algin-Colmural University, proved this. They managed to poison a model with a few documents and then prove that you could do it. So it's absolutely real. And because of that, we are now pushing down sovereign AI implementations. Companies are doing it. Nations are doing it.

[00:11:13] They're all looking at it because I believe they do fear this and they recognize that it's important to have their own instances. I was recently talking to a consultancy company, a very large, popular one. And, you know, they're a bit worried. Their IP is out on the open market, which could be ingested by LLMs and put into online free models and such. So they're building their own sovereign AI internally where IP is protected.

[00:11:41] It's run on their hardware, their platforms, because they're also worried about people taking their IP. So you have businesses and you have nations seriously considering sovereign AI, where it's tracked, maintained, logged and made immutable and to stop people from basically breaking it or messing with it.

[00:12:01] And when I was doing a little research on you guys before you came on, I was reading how poor visibility into enterprise data is something that you've described as a financial risk rather than simply another IT problem. So what are the real business consequences for listeners when their organizations don't know where their critical data resides?

[00:12:23] I think that's a really good question, though, a good point you're making, that not knowing your data is an incredible issue, not just from a regulatory standpoint, but from a monetary standpoint, too. And I like it to this. Knowing where your data is is one of the pillars of the foundations of your house. If you don't have a solid foundation, you don't have a solid house. And this leaks into everything. So knowing where your data is, you can then secure it. You can then place it on the right platform. You can then track access to it.

[00:12:53] All these things are absolutely important. And as you've already pointed out, I think a regulatory cost of burden, for example, getting fined. And a lot of people do kind of hand wave that away. They're like, well, we're not going to get fined. But if you just Google GDPR fines and have a look through their database, which is publicly available, you'll see millions of pounds levied. I believe Spain is the leader. There is something like 6 billion euros in total GDPR fines passed out.

[00:13:21] So these laws of regulations are really enforced. So it's very important that you know where your data is and that you secure it properly. There is also a strategic cost. So I was involved with a company which was merging with another company recently or actually was technically being bought out. And one of the questions was, where is all your data? Because it's important to IP. It's important to their strategy.

[00:13:46] And they had to scramble to access that and to tell them where everything was. And without knowing that, without building that foundation of their house, it ultimately was lowering the cost of the sale of that business. So knowing it was incredibly important. Ultimately, they did, in this story, get to a very good position and were able to report on exactly where everything was. But in doing so, they were able to secure a better deal for themselves.

[00:14:13] But also, on the cybersecurity side, knowing where your data is and being able to secure it properly lowers your insurance premiums in some cases. Because the insurance brokers will now ask you, they'll say, how are you securing your data? How are you improving cyber resiliency? Which is all part of that data visibility and financial risk. And we'll have to bring it back to AI as a tech podcast. I too will get arrested if I don't talk about AI enough.

[00:14:41] So AI is helping organizations become more productive. I think we can all accept that. But it is also helping attackers scale their operations too. So how should businesses be using AI to strengthen their cyber resilience rather than simply adding more security tools into the mix? Anything promising you're seeing here or any advice around that? Wait, this is a fantastic subject. I'm glad you bring it up because it's personally one of my favorites because it's positive.

[00:15:07] I often think that we come from a position of negativity when we talk about cyber resiliency. The threat is always looming. We're always going to be breached. But this one allows me to go positive and I'm a naturally positive person. So here we go. I think we are in a golden age of cyber resiliency because we have artificial intelligence on our side right now. We have it. We have one of the greatest tools we've had in a very long time. And that's the ability to use it to scan and identify and automate responses for anomalies within our environments.

[00:15:36] I'll give you an example. We had a customer, a university, which was using a complexity of software, a customer very similar to what we do, which looks at your environment, looks for anomalies. It trains on what the users are doing every day. And students were coming and going. And as you know, they're always coming in one semester, leaving another. They're up at weird times because they tend to operate at two in the morning. I'm not going to cast any aspersions here, but I was a student too.

[00:16:04] I would hazard a guess some of them were slightly inebriated. But that's really difficult to tell you what's abnormal or normal. But with the power of AI, when we put our tools in place, we built up a model of their environment and we're able to spot bad actors. Now, students take it as a personal mission to break anything you install. They love it. I know I was one of them. And we were able to defend, point out which people were trying to do bad things and no one was able to break it.

[00:16:34] All with the power of this or the power of AI powered ARPs, anti-ransomware protection. So for me, I think we're in an enormous advantage zone here. We should be taking as much as we can right now to protect and secure our systems with this. Yeah, I agree with you. It is an exciting time. And traditional cybersecurity has relied heavily on identifying known threats.

[00:17:01] But I'm hearing more and more about behavioral analysis stepping up, becoming far more important as AI generated attacks continue to evolve. For people listening, maybe fairly new to behavioral analysis, tell me more about that and why that is so important now in this AI age. You're absolutely right there. And it's only really possible with artificial intelligence because you ought to do it really well because you have to employ so many people.

[00:17:27] And if you look on LinkedIn, there are many roles open for cybersecurity, true cybersecurity professionals. We can't hire enough. We can't train enough. And all of the modern regulations, such as DORA, which I mentioned earlier, calls for using the latest, greatest tools in this area because we know we can't get enough people. We have to use what we've got in the tool bag. And this is one of them. This is the analysis.

[00:17:50] And the problem we used to have with traditional signature-based approaches is that it's always looking backwards, matching against threats that have already been catalogued. This is looking forward or as it happens on the spot. It's almost, you know, some millisecond response times. I'll give you an example here, which is me. I create presentations. I do go-to-market analysis, that sort of stuff.

[00:18:14] If I then stepped out of my normal day behavior and I started doing something within my system, like deleting financial records or multiplying HR records, that would be completely different for my behavior. And the system spots it. But what happens then is the cool bit. It's the automated response, reducing the blast area. Because once we've spotted the threat, you are now judged on how you react to it. Reaction is more important here because we're always going to see a threat. It's always going to happen.

[00:18:42] A long enough timeline, you're probably going to get breached. But that resiliency is what matters. And you can kick off through a scene partner or something, an automated streaming backup. You can lock the user out. You can flag it to somebody, a human, to check. The possibilities are endless. But it's all powered by artificial intelligence. And you get to some really cool states here, some very cool states, which is air-gapped, cyber-vaulted rooms, fully autonomous,

[00:19:09] where you see a threat, you isolate, kick off a backup, stick it into an air-vault somewhere, use the latest tools to look at it to make sure it's not been infected before you unpack it and put it back into production. Because we have seen people here restoring threats back into production. Again, all this powered by AI and behavior analytics. And another unsung hero is storage.

[00:19:33] Traditionally, it was often treated as an infrastructure that sits quietly in the background, maybe take for granted. But how has this become one of the most important layers in helping organizations detect attacks, recover trusted data, and maintain business continuity? I think it's something we don't talk about enough sometimes. Sure. It's interesting because sometimes when I tell people, you know, I'm a party, I work in storage, and I like regulation. That's it. I'm gone. No one wants to talk to me.

[00:20:01] But it is actually becoming more of an interesting subject. It really is. And it's elevated itself right to the boardroom. And people are knocking on our door. Board members are saying, tell me. Tell me what you do. Tell me how it works. Because it's become a critical part of the sovereignty message, the cyber resiliency message. And I'll tell you the reason why it's happening. It's because storage is the final. It's the keep in the castle. It's where the crown jewels are.

[00:20:28] If I go back to earlier when I said that your data is valuable and its value is being placed on it by everybody trying to take it from you or change it, protecting it at its source right there is the most important thing. So this is where we bring out the big guns. We bring out, if you imagine the castle sticking with that metaphor, we have the dragons, we have the cannons protecting it. And we bring all the latest, greatest stuff. Because once they get in there and they've got it, that's your crown jewels.

[00:20:57] So we do things like look for encryption attacks, which is where these are fun ones to talk about, actually. Because encryption attacks, everyone assumes it's going to be this great big bang where they encrypt your entire environment. When actually what they're doing is slowly creeping around it. Generally, I think it's months before someone is caught in your environment. About which time they've generally creeped around, encrypted a bunch of stuff, and maybe even exfiltrated it too. And taken it somewhere else to hit you with that double threat and ransomware you again afterwards.

[00:21:26] Now you need a system that looks for this. Because there is encryption in every system. Oracle databases are traditionally encrypted. So you have to be able to discern between what's encrypted, allowed to be encrypted, and what's not. And what constitutes a threat and what doesn't. Again, using the AI and autonomous ransomware protection, you can do that. But that's only baked in at the storage level. So you need it right there.

[00:21:48] All of these modern platforms and safeguards then adopt an immutable storage platform, which is where you take a copy of your data and you say it can't be deleted. It can't be. No one can touch it. No one can change it. No one can do anything with it. And this is important, particularly if we relate back to AI too. Because if AI is in our environment and we're employing it in business critical solutions, we're employing it in our critical infrastructure, which we absolutely are looking at doing. We're putting it in our railways. We're going to put it in our energy platforms.

[00:22:17] If it makes a decision and it's a bad one, we need a log of it and we need it to be made immutable so no one can alter it and we can trace it back to what went wrong. That is what you do at the storage level. And that is why I'm sitting in front of boards, explaining them to what we do, and all of a sudden this has become a very exciting subject to talk about. So I love doing what I do, as you can tell. Yeah, so many important points there. I can almost feel light bulb moments going off around the world as people listen today.

[00:22:45] And if you were advising a board that is reviewing its cyber resilience strategy today, what questions should directors be asking to ensure that they are prepared for an increasingly complex world of AI, cyber threats and digital sovereignty? They're just a few of the things we've talked about today. But what questions should listeners be asking? I think one of the first questions I asked, and I've done this and it always doesn't go across brilliantly, I'll be honest with you, it's quite a combative question. It's who is responsible?

[00:23:15] Who is ultimately responsible in your business? Now, the reason I ask this is because going back to that regulation, it's increasingly found in regulation that management have ultimate ownership for this legally too. And they can't shirk responsibility. They can't delegate. They can't overlook. And they can't say that I don't understand cybersecurity. If I pick on Dora again, there is an element in it that says they need to be annually trained on the latest cybersecurity techniques and threats. So they're adequately in a position to make a decision on cyber resiliency.

[00:23:44] So I would say who is ultimately responsible? And then once you get to that person, you can then have some ownership and start making good decisions. And then I'd be asking them about their critical data or where it is. I'd start from that ground up, those pillars. I'd say, where is all your data? Let's draw a map of it. Because when we know where it is, we can then start making those decisions. And I'd say two key things. Control and security.

[00:24:11] You must control your data and your environment. You must secure your data and your environment. Then you have sovereignty. If you lose either of these two, you lose sovereignty. That's a real critical bit I try and get across. Because those two words apply to everything. So let's go out, map your environment, look for security of it, look for control, map those as well. And then we can start taking those sovereignty requirements head on. Because again, it's a scale.

[00:24:42] You don't necessarily need to be a nuclear power plant operating a dark site where no one's allowed on site. And everything is completely cut off from the world. And you don't necessarily need to be a full hypercloud, everything born in the cloud. You're probably going to be somewhere in the middle where you have elements of data or workloads which need to be secured strategically in a sovereign manner. And others that you don't care about, they're cat pictures or office party pictures. You can store them wherever you feel like it. So that was how I would approach a board.

[00:25:12] Oh, it doesn't always work out well for me. Well, powerful moment to end on, I think. And for anyone listening wanting to explore anything that we talked about today, has covered some big topics there. Connect with you. Learn more about NetApp and the work you're doing there. Where would you like me to point everyone? Obviously, point them to our website, which is NetApp. We're N-A-T-A-P-P. I almost couldn't spell our own company there. That's a fireable moment.

[00:25:38] You can find me on LinkedIn or approach me directly or approach any of your NetApp representatives. I'm Adam Gale. Again, you can find me on LinkedIn. I'm happy to respond to any questions. And I know you are incredibly active online. Before you came on today, I was reading a great article that you wrote called Why Defending Against AI-Powered Cyber Attacks Requires an AI-Powered Defense. I will also include a link to that. I encourage people listening to check all the links that we post on the blog post associated with this.

[00:26:06] But more than anything, thank you for joining me today, sharing your story in a real powerful way. Really appreciate your time. Thank you very much for having me. It's an absolute pleasure. I'd love to come back sometime. I think Adam leaves us with a boardroom test that is simple enough to remember and demanding enough to expose weak assumptions. First, establish who is responsible. Then map the data. Decide who must remain under tighter control.

[00:26:33] And then match each workload with the right level of sovereignty. And this approach avoids treating every file like a state secret. While also protecting the information that carries financial, operational or national importance. And I was also struck particularly by Adam's point today that recovery begins long before an incident.

[00:26:55] Organizations need visibility, immutable records and trusted copies before they can respond with confidence. So a big thank you to Adam from NetApp today for bringing much needed clarity and a touch of humor to a subject that can easily become buried under legal and technical language. But over to you. Where does responsibility for data sovereignty, where does that currently sit in your organization?

[00:27:25] And is the board asking the right questions? As always, let me know. Techtalksnetwork.com Send me a message over there. I'm going to be back again tomorrow with another episode. But love to hear your thoughts on this one. Thanks for listening, everyone. Bye for now. Bye for now. Bye for now.