Building Governed AI Across Distributed Data With Starburst

Can an enterprise move quickly with AI when the information it needs remains spread across business units, acquired companies, private data centers, multiple clouds, and systems governed by different privacy rules? In this episode , I speak with Justin Borgman, co-founder and CEO of Starburst, about the data architecture decisions now affecting how quickly businesses can turn AI investment into useful results. The conversation begins with a reality many established companies will recognize. Their technology estate reflects years of applications, acquisitions, regulatory demands, regional choices, and earlier infrastructure programs. Justin argues that this history becomes a constraint when AI teams need governed access to information quickly. A company created within the last year may design its data environment around AI from the beginning. A multinational enterprise rarely has that freedom. It must work with valuable data held across different locations while respecting security, privacy, and sovereignty requirements. The traditional response has been to centralize everything. Justin believes the single source of truth is often an impossible target rather than a finished destination. Drawing on his earlier experience at Teradata, he says even customers using a leading database continued to retain information elsewhere. New applications, company acquisitions, regulations, and changing business demands kept creating additional systems. His preferred approach is to accept that distributed data will remain part of enterprise life and build an architecture that can work across it. A federated data platform can query information where it lives while giving users a common point of access. This can reduce the time spent moving data before an analyst, executive, application, or AI agent can use it. Justin illustrates the problem through a large American bank with many lines of business and inherited data silos. Senior leaders could ask commercially important questions, but answering them required analytics teams to write queries, assemble dashboards, and combine information from several systems. The process could take weeks. He describes how connecting those sources and adding a natural-language interface can reduce that delay. Starburst calls its interface ADA. It allows a user to ask questions in conversational language while drawing on governed enterprise information and its business context. The company presents this as a way to shorten the path from question to insight without forcing every data set into one platform first. Business value remains harder to prove than technical access. Justin recommends connecting data projects with revenue growth, cost reduction, or risk management. He also points to usage evidence within data platforms. If a data product is accessed frequently by leaders or operational teams, and the cost of producing it is known, those signals can help a company evaluate whether the investment is serving a recurring need. Architecture economics also influence where workloads belong. Justin favors S3-compatible object storage and open formats such as Parquet and Apache Iceberg when companies assemble data in a lake architecture. His argument is that open storage can reduce cost while allowing customers to choose among query engines rather than binding the information to one provider. That advice does not mean every workload belongs in one format or location. Some data will remain in warehouses, operational databases, regional systems, and on-premises infrastructure. Federation can provide access across those environments, while open formats create additional choice for the information that can be consolidated economically. The human side of architecture receives equal attention. Justin says ownership, incentives, and internal politics affect data quality because centralized teams may lack the domain knowledge held by the business unit that produced the information. Treating data as a product gives an organization a way to assign responsibility for quality, maintenance, adoption, and feedback. Named ownership changes the conversation. A successful data product can be recognized and improved because people know who created it. A weak product can receive feedback from its internal users. Distributed control can also allow teams closest to the data to apply their knowledge while the wider company accesses it through common governance. Governance becomes especially important when AI agents can query enterprise information directly. Justin says access controls must operate beneath the agent rather than relying on the model to decide what a user should see. Row-level and column-level permissions, data masking, and query auditing can determine which records are available and provide a record of what the system retrieved. Security and economics are also contributing to renewed interest in running some AI workloads on-premises. Justin says businesses may prefer open-weight models on owned hardware when scale improves the economics or when confidential data cannot comfortably leave the corporate firewall. He expects cloud and on-premises capabilities to coexist rather than one replacing the other. For employees, conversational access could change the role of traditional business intelligence. Justin expects standard KPI dashboards to remain useful, but believes many custom reports and one-off dashboards could be replaced by interactive models that answer questions directly. Analysts and engineers may spend less time responding to requests and additional time improving trusted data products and governance. The opportunity is faster access to answers. The risk is allowing speed to outrun security, quality, or accountability. A federated architecture can connect distributed systems, but it still requires companies to know who owns the data, which users can access it, how results are audited, and whether the outcome supports revenue, cost, or risk goals. Should enterprises keep pursuing one central source of truth, or accept distributed data as a permanent condition and build governed AI around it? Listen to the episode and share your thoughts.

How should a business measure AI success when employee adoption tells leaders very little about revenue, savings, risk, or better decisions? In this episode of Tech Talks Daily, I speak with Thomas Robinson, better known as T-Rob, who recently moved from Chief Operating Officer to CEO of Domino Data Lab. After ten years inside the company, he has seen enterprise AI move through several phases, from specialist data science projects to generative AI tools available across the workforce. T-Rob argues that businesses have become too focused on the technology itself. Generative AI has attracted attention because almost anyone can use it, but an individual productivity tool is very different from an AI system making decisions about mortgages, clinical trials, financial markets, or defense operations. As the potential value of a decision rises, so does the financial, regulatory, and operational risk. That is why T-Rob believes governance should be built alongside AI development rather than added after a system has been completed. He compares the process with constructing a building. Engineers do not wait until the work is finished before checking whether it has been designed and assembled correctly. Reviews happen throughout construction. Domino applies the same principle to AI through policy controls, production monitoring, tracing, and continued human oversight. We also discuss why companies should avoid beginning with a fashionable tool and searching for somewhere to use it. T-Rob recommends starting with the company's primary business measures and working backward. A pharmaceutical business may examine the number of promising therapies entering its pipeline, revenue, and risk. The appropriate AI system can then be designed around those outcomes. That system may combine large language models with computer vision, statistical models, rules, and company data. T-Rob believes the assumption that every business problem requires the latest frontier model can waste money and produce weaker results. People remain a major part of the equation. T-Rob has seen companies reduce headcount in anticipation of AI replacing employees before the technology was ready. He argues that domain experts become more valuable because they understand the business history, operating environment, exceptions, and consequences that a model may miss. The conversation also considers model independence and AI sovereignty. Many enterprises became dependent on a single cloud provider by building their own technology on proprietary services. T-Rob believes businesses should avoid repeating that decision with AI models. Open systems can allow companies to replace models as prices, capabilities, regulations, and operational needs change. For organizations handling sensitive intellectual property, sovereignty also raises questions about what information leaves the business when employees prompt external models. T-Rob describes the risk of enterprise knowledge being absorbed into future model development, even when information has been anonymized. Perhaps his strongest argument concerns measurement. He calls consumption and adoption terrible measures of success because they mainly reveal cost. Giving every employee an AI tool does not mean the entire company becomes proportionally more productive. Real return comes from improving the business processes that generate revenue, reduce expense, control risk, or support better decisions. Are businesses ready to stop measuring AI by logins and start measuring what it changes inside the company? Listen to the episode and share your thoughts.

What happens when artificial intelligence moves beyond helping marketers create content and begins making decisions on their behalf? Recorded at Forge 2026 in Las Vegas, I speak with Astha Malik, Chief Business Officer at Braze, about how AI is changing customer engagement and what marketers should retain control over as more operational work is handed to software. Astha explains why the long-standing promise of genuine one-to-one personalization has been so difficult to deliver and why she believes AI can finally help brands move beyond broad segments toward individual decisioning. We discuss Decisioning Studio Go, where AI can optimize content, timing, and frequency for different customers, while marketers continue to define the objectives and brand boundaries within which the system operates. But greater automation creates new questions. If AI can generate more campaigns and messages, does marketing simply become noisier? Astha talks openly about the danger of "AI slop" and why using the same models and tools can make brands increasingly forgettable. We also discuss Agentic Standards and the idea of AI checking the work of other AI systems before campaigns reach customers. Astha argues that organizations need controls around agents in much the same way they already have quality processes around human teams. Our conversation also moves beyond marketing into the changing enterprise software interface. Operator Connect allows Braze capabilities to be accessed through environments such as ChatGPT, Claude, and Microsoft Copilot, raising questions about whether employees will increasingly interact with business systems through AI assistants rather than traditional applications. Finally, we examine how organizations can prove AI is creating measurable value, why some businesses remain trapped in experimentation, and Astha's advice for leaders overwhelmed by the pace of change. Her recommendation is simple: start experimenting rather than waiting for certainty. As AI takes on more decision-making and execution, which parts of marketing should remain firmly in human hands? Listen to the conversation and share your thoughts.

What happens when attackers can discover and exploit a weakness faster than your organization can patch it? Recorded at Barracuda TechSummit 2026 in Alpbach, Austria, this conversation features Arve Kjoelen, CISO at Barracuda. Arve is responsible for protecting Barracuda's systems, environment, and code, which makes him the person answering the familiar question of who checks the checker. Our conversation begins with the collapse in response time. Security teams once had hours or days to investigate suspicious activity. Arve explains why they may now have minutes or seconds, while vulnerabilities can move from disclosure to exploitation within days. Traditional weekly scans and handoffs to patching teams struggle when attackers operate at machine speed. Arve offers a useful framework for understanding security posture through threats, exposures, assets, and controls. Technology changes constantly, but these categories give leaders a way to assess risk without chasing every new term. He also explains why reducing attack surface can begin with basic questions. Does a system need to be accessible from the internet? Does a web server also need remote management exposed? Does a midsize business benefit from spreading its workloads across every major cloud provider? We examine the difficult balance surrounding AI adoption. Blocking every new tool can prevent employees from benefiting from useful technology, but allowing unrestricted adoption creates new exposure. Arve argues for deliberate choices and guidance that reduce risk without stopping progress. The conversation also addresses AI-guided remediation. Barracuda uses AI internally to identify vulnerabilities, but Arve is cautious about fully automated fixes. An AI system may identify a problem and suggest a solution, while a human remains responsible for judging whether the proposed action could damage a production environment. Faster decisions are valuable only when organizations understand the consequences. Arve also considers how entry-level technology roles may change as AI performs more coding and analysis. His view is that people will need to understand how to work with AI, evaluate its output, and carry an idea from design through secure implementation. The role changes, but the demand for human judgment remains. We finish with model sovereignty, data trust, and provider dependency. If a security capability relies on one AI model, leaders need to know whether they can move to an alternative if access, performance, pricing, or policy changes. Arve also explains why Barracuda is preparing to support both open and closed models while the market develops. Where should your organization use AI to accelerate defense, and which security decisions should remain firmly under human control? Listen to the full conversation and share your thoughts with me.

What if every market research project could continue contributing to business decisions after its original question had been answered? In this episode of Tech Talks Daily, I'm joined by Phil Ahad, Managing Director of Data at Cint, to discuss why he believes companies should move away from disposable research. For decades, the familiar model has been straightforward. A business asks a question, commissions a study, receives the answer and begins again when the next question appears. Phil argues that this process wastes useful information and repeatedly asks people for details that may already be available. His alternative is an always-on human data engine that allows new studies to build on previous research. Existing responses can be combined with first-party information, third-party sources, transactional records and behavioral signals. Phil says this can help organizations answer new questions faster while reducing the burden placed on respondents. That burden matters because survey fatigue is often misunderstood. Phil does not believe people have stopped wanting to share opinions. The problem is the experience. Customers are repeatedly asked long batteries of familiar questions, often after everyday transactions, because the structure of data collection has changed remarkably little since paper surveys. If researchers already know much of the background, they can ask fewer questions and focus on the reasons behind a person's decision. We also examine synthetic data, a term Phil openly dislikes, and the growing use of AI personas or digital twins. At one end of the spectrum, a model might add 200 modeled responses to an 800-person study so researchers can work with a sample of 1,000. Phil says this extends an existing data set rather than creating genuinely new insight. At the other end, a company may create a digital representation of a person from survey responses, purchasing patterns, mobile activity and other signals, then ask that representation new questions. The opportunity is faster research with less repeated questioning. The risk is believing the model knows a person better than the evidence allows. Phil says the industry must test how much information is required to predict an answer with an acceptable level of confidence. He expects progress to come from repeated comparison and validation rather than a single certification method or technical shortcut. For business leaders, this makes transparency as important as speed. Before relying on AI-augmented research for a major decision, they need to understand where the original data came from, how modeled responses were created, how performance was tested and where human judgment remains involved. Phil also notes that strong decisions rarely rely on a single input. Companies bring together research, customer records, benchmarks and other sources before deciding what to do. Cint's ambition, as Phil describes it, is to turn recurring tracking studies into a continuing source of insight. He says roughly one million people pass through the company's ecosystem each day, giving Cint an asset that can be combined with increasingly accessible technology. The larger challenge is making useful sense of growing data volumes at business speed. Could continuous research help your organization ask people fewer, better questions, or would AI-generated responses introduce uncertainty that outweighs the speed gained? Listen to the episode and share your thoughts with me.

Why do increasingly capable AI models struggle to produce reliable answers inside large organizations? In this episode of Tech Talks Daily, I speak with Misti Vogt, SVP of Engagement at Orange Logic. Her career spans military intelligence, data science, and enterprise content technology, and she also teaches in the DAM and AI program at Rutgers University. That combination gives her an unusually practical perspective on how machines interpret information and why business meaning cannot be assumed. Misti argues that enterprise AI reliability depends on the context surrounding company data. A model may be technically impressive, but it needs to understand relationships, rules, metadata, rights, and intent. Without that layer, it reasons over information originally organized for people rather than machines. The result may sound convincing while remaining disconnected from the way the business defines accuracy, trust, and permitted use. We discuss three forms of context. Static context reflects accumulated knowledge. Transactional context develops through projects and outside information. Semantic context helps systems interpret meaning and relationships across large collections of information. Misti compares this with human conversation. When an answer misses the point, we add information until the other person understands what we mean. Digital asset management sits at the center of this discussion because DAM platforms already organize master data, metadata, transactional data, governance, relationships, and usage rights. Misti believes those structures can give AI applications a stronger business foundation. She also argues that content should become self-aware, carrying information about when it was created, how it was produced, its intended audience, where it has appeared, and how it has performed. Natural language search provides a useful example of why this matters. An employee might ask for creative assets suited to a campaign and welcome a broad set of suggestions. The same employee may then ask for assets licensed for the United Kingdom and United States, with print and web rights for the next 12 months and no use in another campaign during the previous six months. That second request carries business consequences, so the system needs deterministic rules alongside creative choice. Misti also shares an Orange Logic customer example involving a conglomerate with several brands. The company consolidated seven platforms, including three DAM deployments and local storage. Orange Logic then supported shared governance across the group while preserving autonomy for individual brands. Misti says the early results include time savings, improved efficiency, richer metadata collection, and lower costs, although no quantified figures were provided in the recording. The wider question is whether businesses are spending enough time on the information surrounding their content before expanding AI use. Could better metadata, rights management, and business logic produce greater value than another round of model upgrades? Listen to the conversation and share your thoughts with me.  

What happens when employees begin using AI before their organization has prepared the data, training, controls and measurement required to support them? In this episode of Tech Talks Daily, returning guest Denis O'Shea, CEO of Mobile Mentor, joins me to discuss the 2026 Endpoint Ecosystem Study. The research surveyed 2,500 workers across the United States, United Kingdom, New Zealand and Australia to understand how employees experience their devices, applications, sign-in processes, support systems and workplace AI. The findings show a gap between access and useful adoption. According to the study figures discussed in our conversation, only 29 percent of employees say AI provides regular or indispensable value in their work, while 48 percent report receiving no AI training or do not know whether training exists. Denis says the differences become sharper by sector. Finance has made greater progress with company-wide and role-specific training, while half of the healthcare and government employees surveyed reported receiving no AI training. The generational picture is equally complicated. Denis says Gen Z workers are adopting AI faster than other age groups, but they are also the group most likely to work around company policies when approved tools create friction. If employees cannot complete a task through the sanctioned route, some will use personal accounts and upload company information to public models. The same workers may also need greater support during onboarding, challenging the assumption that digital familiarity automatically means workplace technology fluency. Denis also shares Mobile Mentor's own mistakes. The company deployed Microsoft Copilot to roughly two-thirds of its workforce, ran competitions and encouraged experimentation. When the board asked whether the investment was working, Denis realized he had no dependable answer. The team had not defined use cases, assigned licenses according to the work being done or established a reliable way to measure returns. A subsequent scan found 33,000 sensitive data assets that Denis says were overexposed or shared too widely. Those lessons became what Denis calls the five foundations of AI success. Organizations should define each use case, secure the relevant data, provide training for that use case, build agents around the work and measure the outcome repeatedly. He recommends treating deployments as experiments. If a use case cannot demonstrate a return within three months, the licenses can be reassigned and tested elsewhere. We also discuss passwordless access, the cost of AI tokens and services, and the operational work required to govern growing numbers of agents. Denis believes data, agents and spending will become three immediate management challenges. Each agent will need an identity, appropriate permissions, an owner and a retirement process, while finance and technology leaders will need a clear view of licenses, tokens, API calls and platform consumption. One final lesson reaches beyond AI. Denis says organizations that automated password resets, patching and device provisioning have released technology staff to address newer priorities.  Businesses still handling those tasks manually may struggle to find the time needed for data preparation and agent governance. Does your AI strategy begin with another license purchase, or with a defined problem, prepared data and a measurable result? Listen to the episode and share your thoughts with me.

Can security teams defend an organization when attackers are using AI to research targets, personalize messages, identify weaknesses, and launch campaigns at a scale no human team can match? I returned to Alpbach, Austria, for Barracuda TechSummit 26 and caught up with Neal Bradbury one year after our conversation about being secure today and ready tomorrow. A lot has happened since then. Agentic AI has become a boardroom subject, employee AI use has spread across businesses, and attackers have gained access to tools that lower the cost and expertise required to launch sophisticated campaigns. Neal explains why Barracuda has continued with the unified platform strategy introduced at last year's event. In his view, AI creates additional exposure across identities, applications, email, and data, but it does not make every existing security control obsolete. The immediate requirement is to connect information across these areas and accelerate how quickly security teams can interpret and act upon it. We discuss Barracuda ONE, its Barracuda IQ intelligence engine, the Bailey assistant, Integrated Email Protection, and the recently announced Barracuda AI Data Security offering. Neal also explains why the acquisition of Evo Security adds identity protection at a time when businesses must secure human users, service accounts, and AI agents. One customer example shows why connected telemetry matters. According to Neal, Barracuda's team investigated an attempted wire fraud worth almost a quarter of a million dollars. No single product could see the complete attack. Information from email, network activity, and identity systems had to be combined before the team could understand what was happening. The conversation also examines shadow AI. Employees are already placing workplace information into chatbots and using tools outside approved systems. Neal argues that attempting to ban every tool will send that behavior further out of view. Organizations first need to understand which services are being used, educate employees about the information they can share, and guide them toward approved options. Attackers may have gained the early advantage from AI, but Neal says defenders are catching up through automation. Work that previously took around 45 minutes can now be completed in under a minute inside Barracuda's agentic SOC. The aim is to correlate signals, remove repetitive analyst work, and present fewer alerts with better context. Human judgment remains part of the process when accountability and empathy matter. Do you agree that AI favors the side that automates most, or could excessive automation create another security weakness? Share your thoughts.

What does a security operations center need when attacks are arriving at a speed and volume that human analysts cannot manage alone? I recorded this episode with Adam Khan, VP of Global Security Operations and AI Security at Barracuda, during the 20th anniversary of the Barracuda Tech Summit in Alpbach, Austria. Adam has spent over 25 years in technology and security. When we last spoke at the event, he used Home Alone and soccer to make complex security topics easier to understand. This year, expectations were high, and he arrived with Formula One. The comparison begins with what spectators see. Attention naturally falls on the car and driver. Behind them sits a much larger operation involving engineers, strategists, mechanics, simulations, telemetry, and rapid decisions. Adam believes modern security works in a similar way. Customers want to run their businesses, while a largely unseen combination of analysts, threat intelligence, automation, and AI works behind them. That operating model has developed into what Barracuda calls the Agentic SOC. AI agents follow the same playbooks analysts use when examining endpoints, malware connections, artifacts, threat intelligence, identity behavior, and other signals. They can complete repeatable investigative work quickly and consistently across volumes that have grown from hundreds of alerts to thousands or millions. Adam says Barracuda now has hundreds of agents with hundreds of individual skills. These agents can support the process from triage and intelligence gathering through correlation and response. When the system has high confidence that an ordinary user account has been compromised, it may disable that account. If the incident involves an administrative account capable of locking down an entire customer environment, a person must confirm the action. This matters because an AI system can misclassify an event or reach a conclusion that requires additional context. Adam describes feedback mechanisms through which people review decisions, identify mistakes, and feed those findings back into the system. Barracuda also records an audit trail of the actions and queries performed by its agents. One of the most surprising details concerns employment. While headlines frequently associate AI with reducing headcount, Adam says his team has doubled since adopting it. Analysts previously occupied with repetitive investigation have moved into threat hunting, model development, prompt engineering, and attack and defense exercises. The team is also attacking its own systems so that its agents can learn from emerging techniques before a genuine incident occurs. The audience saw this operating model during Adam's keynote. Attendees used their phones to launch controlled business email compromise, QR-code phishing, and ransomware scenarios against Barracuda's attack and defense environment. The platform then analyzed and blocked the activity while the audience watched. Adam says approximately 395 attacks were initiated during the demonstration and all were successfully blocked. That result comes from a controlled Barracuda demonstration rather than an independent test, but it gave attendees a rare view of the speed required during an active incident. We also discuss how Barracuda Managed XDR uses behavior and telemetry across email, endpoints, cloud services, identities, networks, and other technology. An employee traveling with a familiar laptop and phone should not create the same response as an unknown device attempting an unusual login. Historical patterns, device identifiers, signatures, and location data can help reduce unnecessary alerts while highlighting activity that deserves attention. For Adam, the purpose of AI is to increase the speed and reach of security experts rather than remove them. People determine strategy, examine high-consequence decisions, test systems, and remain accountable for customer outcomes. Could the Agentic SOC give security teams the speed they need without surrendering the judgment and accountability customers expect? Listen to the episode and share your thoughts.

How should security leaders respond when AI-powered attacks compress detection and response windows from minutes to seconds? At Barracuda TechSummit 26 in Alpbach, Austria, I spoke with Rohit Ghai, Chief Executive Officer at Barracuda. The conversation took place exactly one year after Rohit joined the company, giving us an opportunity to discuss what brought him to Barracuda, what he inherited, and how his first year has influenced his plans for the business. Rohit explains that Barracuda's focus on smaller and resource-constrained organizations was an important reason he accepted the role. A cyber incident can threaten the survival of a smaller company, particularly when it has a lean IT team and limited access to specialist security knowledge. For these businesses, Rohit argues that AI-supported and increasingly autonomous security is a practical requirement. We discuss Barracuda's platform strategy and why genuine integration must extend beyond a shared interface. Rohit compares loosely connected product portfolios to supermarkets. Customers may find it easier to purchase several products from one supplier, but that commercial convenience does not mean the products share data or produce a coordinated response. Traditional tool sprawl forced analysts to interpret information across several screens. Agent sprawl could introduce systems that act independently, disagree with one another, or take conflicting actions. Rohit believes security platforms must connect information across email, identity, applications, data, and infrastructure so they can reason across the complete attack sequence. Identity is another major part of the discussion. Barracuda's acquisition of Evo Security addresses privileged access for managed service providers and smaller businesses. Rohit expects machine and non-human identities to greatly outnumber human users, raising questions about excessive privileges and how organizations grant temporary access to autonomous agents. We also discuss the economics behind AI security. Rohit explains how Barracuda is adapting its value reports to account for token consumption as well as staffing, software, and security outcomes. Barracuda absorbs the direct token costs associated with its own AI capabilities and selects different models according to the task, an approach intended to keep its products affordable for smaller customers and MSPs. Rohit is cautious about calls for the AI industry to slow development. Coordinating a worldwide slowdown between companies and countries would be extremely difficult. He also argues that cyber defenders cannot pause while attackers continue using widely available models to improve their campaigns. The conversation ends with a wider leadership question. Rohit believes intelligence will become widely available, making empathy and trust more valuable. AI can generate an answer, but customers, partners, and security professionals must decide whether they trust the organization acting upon it. Will connected AI security platforms reduce complexity, or could autonomous agents introduce a new form of operational risk?  Share your thoughts.