Cyber recovery planning depends on the ability to restore critical data after an attack. As enterprises adopt agentic AI, the systems and information they need to protect are expanding.

That expansion is reshaping how enterprises approach AI trust and cyber resilience. AI models, agents and the software supporting them create additional targets for attackers, according to Eric Herzog (pictured), chief marketing officer of Infinidat Ltd., a Lenovo company.

“We would argue that … anything to do with AI dramatically expands the attack surface,” Herzog said. “Everything you’re doing — the [large language models], the [small language models], that AI software stack you deploy — the cyber criminals are going to go after all of that. Instead of shrinking the attack surface, you’ve actually increased it.”

Herzog spoke with theCUBE Research’s Christophe Bertrand for the AI Cybersecurity and Resilience Summit, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed cyber recovery planning and why storage belongs in an AI-era cybersecurity strategy. (* Disclosure below.)

Putting storage in cyber recovery planning

Infinidat’s answer is InfiniSafe, a set of cybersecurity capabilities embedded in the company’s InfuzeOS storage operating system. It includes immutable snapshots, logical air-gapping that separates the management plane from the data plane and a fenced forensic environment for examining suspect data. About 90% of the most valuable data at global Fortune 500 companies sits on enterprise storage, which makes that layer a logical place to build defenses, Herzog noted.

“You tell it what you want to do, and the storage then responds to this data center-wide cybersecurity software or the SOC and automatically starts taking action,” Herzog said. “You don’t want to waste a minute if you think you’re having a cyberattack.”

Detection comes next. InfiniSafe Cyber Detection uses AI and machine learning to scan block data, file data and VMware data stores for anomalies, rating each snapshot’s risk as high, medium or low. Some customers scan daily snapshots twice a week, while others use the tool reactively until they reach a known good copy, according to Herzog. Infinidat offers a recovery-time guarantee of one minute or less for immutable snapshots on its InfiniBox platforms.

“That guarantee is an RTO of 1 minute or less no matter how big the dataset size,” Herzog said. “Last July, we did one of our Experts Live events … If you were on that event, you would have seen us recover 9.8 petabytes in 5 seconds.”

Attackers also go after backups and replicas, which is why Infinidat works with data protection companies such as Veeam Software Group GmbH and Commvault Systems Inc., Herzog explained. He pointed to PwC’s latest CEO survey, which ranked cyber as the No. 1 business risk, as a reason to win board-level buy-in.

“What they should do is practically deploy enterprise-wide cyber storage, integrate it with the SOC or the [security incident and event management] or [security orchestration, automation and response] technology so it works together as a team,” Herzog said. “I would argue that from a big enterprise perspective, a cyberattack is a disaster.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the AI Cybersecurity and Resilience Summit:

(* Disclosure: Infinidat sponsored this segment of theCUBE. Neither Infinidat nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE