Security Posture at Machine Speed With Barracuda

What happens when attackers can discover and exploit a weakness faster than your organization can patch it? Recorded at Barracuda TechSummit 2026 in Alpbach, Austria, this conversation features Arve Kjoelen, CISO at Barracuda. Arve is responsible for protecting Barracuda's systems, environment, and code, which makes him the person answering the familiar question of who checks the checker. Our conversation begins with the collapse in response time. Security teams once had hours or days to investigate suspicious activity. Arve explains why they may now have minutes or seconds, while vulnerabilities can move from disclosure to exploitation within days. Traditional weekly scans and handoffs to patching teams struggle when attackers operate at machine speed. Arve offers a useful framework for understanding security posture through threats, exposures, assets, and controls. Technology changes constantly, but these categories give leaders a way to assess risk without chasing every new term. He also explains why reducing attack surface can begin with basic questions. Does a system need to be accessible from the internet? Does a web server also need remote management exposed? Does a midsize business benefit from spreading its workloads across every major cloud provider? We examine the difficult balance surrounding AI adoption. Blocking every new tool can prevent employees from benefiting from useful technology, but allowing unrestricted adoption creates new exposure. Arve argues for deliberate choices and guidance that reduce risk without stopping progress. The conversation also addresses AI-guided remediation. Barracuda uses AI internally to identify vulnerabilities, but Arve is cautious about fully automated fixes. An AI system may identify a problem and suggest a solution, while a human remains responsible for judging whether the proposed action could damage a production environment. Faster decisions are valuable only when organizations understand the consequences. Arve also considers how entry-level technology roles may change as AI performs more coding and analysis. His view is that people will need to understand how to work with AI, evaluate its output, and carry an idea from design through secure implementation. The role changes, but the demand for human judgment remains. We finish with model sovereignty, data trust, and provider dependency. If a security capability relies on one AI model, leaders need to know whether they can move to an alternative if access, performance, pricing, or policy changes. Arve also explains why Barracuda is preparing to support both open and closed models while the market develops. Where should your organization use AI to accelerate defense, and which security decisions should remain firmly under human control? Listen to the full conversation and share your thoughts with me.

What if every market research project could continue contributing to business decisions after its original question had been answered? In this episode of Tech Talks Daily, I'm joined by Phil Ahad, Managing Director of Data at Cint, to discuss why he believes companies should move away from disposable research. For decades, the familiar model has been straightforward. A business asks a question, commissions a study, receives the answer and begins again when the next question appears. Phil argues that this process wastes useful information and repeatedly asks people for details that may already be available. His alternative is an always-on human data engine that allows new studies to build on previous research. Existing responses can be combined with first-party information, third-party sources, transactional records and behavioral signals. Phil says this can help organizations answer new questions faster while reducing the burden placed on respondents. That burden matters because survey fatigue is often misunderstood. Phil does not believe people have stopped wanting to share opinions. The problem is the experience. Customers are repeatedly asked long batteries of familiar questions, often after everyday transactions, because the structure of data collection has changed remarkably little since paper surveys. If researchers already know much of the background, they can ask fewer questions and focus on the reasons behind a person's decision. We also examine synthetic data, a term Phil openly dislikes, and the growing use of AI personas or digital twins. At one end of the spectrum, a model might add 200 modeled responses to an 800-person study so researchers can work with a sample of 1,000. Phil says this extends an existing data set rather than creating genuinely new insight. At the other end, a company may create a digital representation of a person from survey responses, purchasing patterns, mobile activity and other signals, then ask that representation new questions. The opportunity is faster research with less repeated questioning. The risk is believing the model knows a person better than the evidence allows. Phil says the industry must test how much information is required to predict an answer with an acceptable level of confidence. He expects progress to come from repeated comparison and validation rather than a single certification method or technical shortcut. For business leaders, this makes transparency as important as speed. Before relying on AI-augmented research for a major decision, they need to understand where the original data came from, how modeled responses were created, how performance was tested and where human judgment remains involved. Phil also notes that strong decisions rarely rely on a single input. Companies bring together research, customer records, benchmarks and other sources before deciding what to do. Cint's ambition, as Phil describes it, is to turn recurring tracking studies into a continuing source of insight. He says roughly one million people pass through the company's ecosystem each day, giving Cint an asset that can be combined with increasingly accessible technology. The larger challenge is making useful sense of growing data volumes at business speed. Could continuous research help your organization ask people fewer, better questions, or would AI-generated responses introduce uncertainty that outweighs the speed gained? Listen to the episode and share your thoughts with me.

Why do increasingly capable AI models struggle to produce reliable answers inside large organizations? In this episode of Tech Talks Daily, I speak with Misti Vogt, SVP of Engagement at Orange Logic. Her career spans military intelligence, data science, and enterprise content technology, and she also teaches in the DAM and AI program at Rutgers University. That combination gives her an unusually practical perspective on how machines interpret information and why business meaning cannot be assumed. Misti argues that enterprise AI reliability depends on the context surrounding company data. A model may be technically impressive, but it needs to understand relationships, rules, metadata, rights, and intent. Without that layer, it reasons over information originally organized for people rather than machines. The result may sound convincing while remaining disconnected from the way the business defines accuracy, trust, and permitted use. We discuss three forms of context. Static context reflects accumulated knowledge. Transactional context develops through projects and outside information. Semantic context helps systems interpret meaning and relationships across large collections of information. Misti compares this with human conversation. When an answer misses the point, we add information until the other person understands what we mean. Digital asset management sits at the center of this discussion because DAM platforms already organize master data, metadata, transactional data, governance, relationships, and usage rights. Misti believes those structures can give AI applications a stronger business foundation. She also argues that content should become self-aware, carrying information about when it was created, how it was produced, its intended audience, where it has appeared, and how it has performed. Natural language search provides a useful example of why this matters. An employee might ask for creative assets suited to a campaign and welcome a broad set of suggestions. The same employee may then ask for assets licensed for the United Kingdom and United States, with print and web rights for the next 12 months and no use in another campaign during the previous six months. That second request carries business consequences, so the system needs deterministic rules alongside creative choice. Misti also shares an Orange Logic customer example involving a conglomerate with several brands. The company consolidated seven platforms, including three DAM deployments and local storage. Orange Logic then supported shared governance across the group while preserving autonomy for individual brands. Misti says the early results include time savings, improved efficiency, richer metadata collection, and lower costs, although no quantified figures were provided in the recording. The wider question is whether businesses are spending enough time on the information surrounding their content before expanding AI use. Could better metadata, rights management, and business logic produce greater value than another round of model upgrades? Listen to the conversation and share your thoughts with me.  

What happens when employees begin using AI before their organization has prepared the data, training, controls and measurement required to support them? In this episode of Tech Talks Daily, returning guest Denis O'Shea, CEO of Mobile Mentor, joins me to discuss the 2026 Endpoint Ecosystem Study. The research surveyed 2,500 workers across the United States, United Kingdom, New Zealand and Australia to understand how employees experience their devices, applications, sign-in processes, support systems and workplace AI. The findings show a gap between access and useful adoption. According to the study figures discussed in our conversation, only 29 percent of employees say AI provides regular or indispensable value in their work, while 48 percent report receiving no AI training or do not know whether training exists. Denis says the differences become sharper by sector. Finance has made greater progress with company-wide and role-specific training, while half of the healthcare and government employees surveyed reported receiving no AI training. The generational picture is equally complicated. Denis says Gen Z workers are adopting AI faster than other age groups, but they are also the group most likely to work around company policies when approved tools create friction. If employees cannot complete a task through the sanctioned route, some will use personal accounts and upload company information to public models. The same workers may also need greater support during onboarding, challenging the assumption that digital familiarity automatically means workplace technology fluency. Denis also shares Mobile Mentor's own mistakes. The company deployed Microsoft Copilot to roughly two-thirds of its workforce, ran competitions and encouraged experimentation. When the board asked whether the investment was working, Denis realized he had no dependable answer. The team had not defined use cases, assigned licenses according to the work being done or established a reliable way to measure returns. A subsequent scan found 33,000 sensitive data assets that Denis says were overexposed or shared too widely. Those lessons became what Denis calls the five foundations of AI success. Organizations should define each use case, secure the relevant data, provide training for that use case, build agents around the work and measure the outcome repeatedly. He recommends treating deployments as experiments. If a use case cannot demonstrate a return within three months, the licenses can be reassigned and tested elsewhere. We also discuss passwordless access, the cost of AI tokens and services, and the operational work required to govern growing numbers of agents. Denis believes data, agents and spending will become three immediate management challenges. Each agent will need an identity, appropriate permissions, an owner and a retirement process, while finance and technology leaders will need a clear view of licenses, tokens, API calls and platform consumption. One final lesson reaches beyond AI. Denis says organizations that automated password resets, patching and device provisioning have released technology staff to address newer priorities.  Businesses still handling those tasks manually may struggle to find the time needed for data preparation and agent governance. Does your AI strategy begin with another license purchase, or with a defined problem, prepared data and a measurable result? Listen to the episode and share your thoughts with me.

Can security teams defend an organization when attackers are using AI to research targets, personalize messages, identify weaknesses, and launch campaigns at a scale no human team can match? I returned to Alpbach, Austria, for Barracuda TechSummit 26 and caught up with Neal Bradbury one year after our conversation about being secure today and ready tomorrow. A lot has happened since then. Agentic AI has become a boardroom subject, employee AI use has spread across businesses, and attackers have gained access to tools that lower the cost and expertise required to launch sophisticated campaigns. Neal explains why Barracuda has continued with the unified platform strategy introduced at last year's event. In his view, AI creates additional exposure across identities, applications, email, and data, but it does not make every existing security control obsolete. The immediate requirement is to connect information across these areas and accelerate how quickly security teams can interpret and act upon it. We discuss Barracuda ONE, its Barracuda IQ intelligence engine, the Bailey assistant, Integrated Email Protection, and the recently announced Barracuda AI Data Security offering. Neal also explains why the acquisition of Evo Security adds identity protection at a time when businesses must secure human users, service accounts, and AI agents. One customer example shows why connected telemetry matters. According to Neal, Barracuda's team investigated an attempted wire fraud worth almost a quarter of a million dollars. No single product could see the complete attack. Information from email, network activity, and identity systems had to be combined before the team could understand what was happening. The conversation also examines shadow AI. Employees are already placing workplace information into chatbots and using tools outside approved systems. Neal argues that attempting to ban every tool will send that behavior further out of view. Organizations first need to understand which services are being used, educate employees about the information they can share, and guide them toward approved options. Attackers may have gained the early advantage from AI, but Neal says defenders are catching up through automation. Work that previously took around 45 minutes can now be completed in under a minute inside Barracuda's agentic SOC. The aim is to correlate signals, remove repetitive analyst work, and present fewer alerts with better context. Human judgment remains part of the process when accountability and empathy matter. Do you agree that AI favors the side that automates most, or could excessive automation create another security weakness? Share your thoughts.

What does a security operations center need when attacks are arriving at a speed and volume that human analysts cannot manage alone? I recorded this episode with Adam Khan, VP of Global Security Operations and AI Security at Barracuda, during the 20th anniversary of the Barracuda Tech Summit in Alpbach, Austria. Adam has spent over 25 years in technology and security. When we last spoke at the event, he used Home Alone and soccer to make complex security topics easier to understand. This year, expectations were high, and he arrived with Formula One. The comparison begins with what spectators see. Attention naturally falls on the car and driver. Behind them sits a much larger operation involving engineers, strategists, mechanics, simulations, telemetry, and rapid decisions. Adam believes modern security works in a similar way. Customers want to run their businesses, while a largely unseen combination of analysts, threat intelligence, automation, and AI works behind them. That operating model has developed into what Barracuda calls the Agentic SOC. AI agents follow the same playbooks analysts use when examining endpoints, malware connections, artifacts, threat intelligence, identity behavior, and other signals. They can complete repeatable investigative work quickly and consistently across volumes that have grown from hundreds of alerts to thousands or millions. Adam says Barracuda now has hundreds of agents with hundreds of individual skills. These agents can support the process from triage and intelligence gathering through correlation and response. When the system has high confidence that an ordinary user account has been compromised, it may disable that account. If the incident involves an administrative account capable of locking down an entire customer environment, a person must confirm the action. This matters because an AI system can misclassify an event or reach a conclusion that requires additional context. Adam describes feedback mechanisms through which people review decisions, identify mistakes, and feed those findings back into the system. Barracuda also records an audit trail of the actions and queries performed by its agents. One of the most surprising details concerns employment. While headlines frequently associate AI with reducing headcount, Adam says his team has doubled since adopting it. Analysts previously occupied with repetitive investigation have moved into threat hunting, model development, prompt engineering, and attack and defense exercises. The team is also attacking its own systems so that its agents can learn from emerging techniques before a genuine incident occurs. The audience saw this operating model during Adam's keynote. Attendees used their phones to launch controlled business email compromise, QR-code phishing, and ransomware scenarios against Barracuda's attack and defense environment. The platform then analyzed and blocked the activity while the audience watched. Adam says approximately 395 attacks were initiated during the demonstration and all were successfully blocked. That result comes from a controlled Barracuda demonstration rather than an independent test, but it gave attendees a rare view of the speed required during an active incident. We also discuss how Barracuda Managed XDR uses behavior and telemetry across email, endpoints, cloud services, identities, networks, and other technology. An employee traveling with a familiar laptop and phone should not create the same response as an unknown device attempting an unusual login. Historical patterns, device identifiers, signatures, and location data can help reduce unnecessary alerts while highlighting activity that deserves attention. For Adam, the purpose of AI is to increase the speed and reach of security experts rather than remove them. People determine strategy, examine high-consequence decisions, test systems, and remain accountable for customer outcomes. Could the Agentic SOC give security teams the speed they need without surrendering the judgment and accountability customers expect? Listen to the episode and share your thoughts.

How should security leaders respond when AI-powered attacks compress detection and response windows from minutes to seconds? At Barracuda TechSummit 26 in Alpbach, Austria, I spoke with Rohit Ghai, Chief Executive Officer at Barracuda. The conversation took place exactly one year after Rohit joined the company, giving us an opportunity to discuss what brought him to Barracuda, what he inherited, and how his first year has influenced his plans for the business. Rohit explains that Barracuda's focus on smaller and resource-constrained organizations was an important reason he accepted the role. A cyber incident can threaten the survival of a smaller company, particularly when it has a lean IT team and limited access to specialist security knowledge. For these businesses, Rohit argues that AI-supported and increasingly autonomous security is a practical requirement. We discuss Barracuda's platform strategy and why genuine integration must extend beyond a shared interface. Rohit compares loosely connected product portfolios to supermarkets. Customers may find it easier to purchase several products from one supplier, but that commercial convenience does not mean the products share data or produce a coordinated response. Traditional tool sprawl forced analysts to interpret information across several screens. Agent sprawl could introduce systems that act independently, disagree with one another, or take conflicting actions. Rohit believes security platforms must connect information across email, identity, applications, data, and infrastructure so they can reason across the complete attack sequence. Identity is another major part of the discussion. Barracuda's acquisition of Evo Security addresses privileged access for managed service providers and smaller businesses. Rohit expects machine and non-human identities to greatly outnumber human users, raising questions about excessive privileges and how organizations grant temporary access to autonomous agents. We also discuss the economics behind AI security. Rohit explains how Barracuda is adapting its value reports to account for token consumption as well as staffing, software, and security outcomes. Barracuda absorbs the direct token costs associated with its own AI capabilities and selects different models according to the task, an approach intended to keep its products affordable for smaller customers and MSPs. Rohit is cautious about calls for the AI industry to slow development. Coordinating a worldwide slowdown between companies and countries would be extremely difficult. He also argues that cyber defenders cannot pause while attackers continue using widely available models to improve their campaigns. The conversation ends with a wider leadership question. Rohit believes intelligence will become widely available, making empathy and trust more valuable. AI can generate an answer, but customers, partners, and security professionals must decide whether they trust the organization acting upon it. Will connected AI security platforms reduce complexity, or could autonomous agents introduce a new form of operational risk?  Share your thoughts.

What happens when enterprises spend trillions of dollars on AI but the systems underneath it still cannot provide the context those models need to make reliable decisions? In this episode of Tech Talks Daily, I reconnect with Christian Monberg, CTO at Zeta Global, to examine what separates AI experimentation from production systems that organizations can actually trust. Our previous conversation focused on how businesses could use AI to scale marketing without losing the human connection with customers. This time, we move deeper into the technology underneath those experiences. Christian explains why disconnected tools and fragmented data remain barriers to AI adoption, and why Zeta rebuilt its data architecture using Palantir Foundry. We discuss the role of context graphs in connecting customer identity, business objectives, previous decisions, campaign history and outcomes so AI systems can understand more than isolated pieces of information. We also examine one of the biggest questions surrounding agentic AI: when should businesses allow an AI agent to take action? Christian shares what enterprises need around explainability, permissions, observability and learning loops before AI systems can safely move from recommendation to execution. With global AI spending expected to reach $2.59 trillion in 2026, the conversation ultimately comes back to a simple question: how can technology leaders prove that their AI investments are producing measurable business value?

Why is employee AI use rising so quickly while measurable business value remains difficult for many organizations to find? In this episode of Tech Talks Daily, I speak with David Martin, Senior Partner and Global Leader of People and Organization at BCG, about the firm's fourth annual AI and workforce report. The research surveyed 11,749 employees across 14 countries and points to a growing divide between companies that distribute AI tools and companies that give people a clear plan for changing how work gets done. BCG reports that 74 percent of frontline and nonmanagerial employees now use AI regularly, an increase of 23 percentage points from the previous year. Adoption, however, is only part of the story. The report says 71 percent of employees receive little or no guidance about what to do with the time AI frees, while over half are not redirecting that capacity into strategic work. David describes one of the research findings that best captures the problem. Companies where employees understand the strategic direction but rate their AI tools poorly can realize greater value than organizations with strong tools and limited strategic clarity. Better technology helps, but its impact remains small when employees do not understand which business problem they are solving or how the operating model should change. The report connects clearer strategy with a roughly 25 percentage point increase in measurable business impact when companies redesign workflows from end to end or create new business models. BCG says strong tools without that clarity produce an improvement of roughly five percentage points. Companies that redesign workflows also outperform tool-only adopters by 23 percentage points on measurable business impact, 22 points on time saved, and 20 points on job satisfaction. David explains what redesign looks like in practice. Giving software engineers stronger coding tools may improve part of a development task, but keeping the overall product lifecycle unchanged limits the result. A deeper redesign considers how research, product management, engineering, and decision-making operate together, then changes roles and processes around the capability of AI. The objective is a better business outcome rather than a faster version of the same work. This distinction also explains why promising pilots fail when companies attempt to expand them. A pilot can prove that a model works inside a controlled environment. Wider deployment tests whether the organization surrounding that model works. David cites BCG research indicating that 70 percent of the factors determining whether AI scales with a return relate to people, organization, and process. Talent, operating models, cross-functional teamwork, incentives, learning, and leadership all become part of the result. Measurement must also move beyond adoption. David argues that the final metrics remain familiar business outcomes such as conversion, competitive win rate, price realization, cycle time, and inventory performance. A pilot can use controlled comparison to test whether AI changes one of those outcomes. The missing management step is often accountability. If several executives share ownership but nobody is responsible for the return, the investment can continue without a clear test of success. There is a case for broad experimentation because it can build familiarity and surface ideas. David warns that hundreds of isolated use cases can also fragment investment, increase risk, and save small amounts of individual time without producing company-level value. His preferred balance combines focused governance with structured opportunities such as hackathons, where employees contribute ideas but the organization selects which ones receive investment. The workforce findings add an important human dimension. BCG says 67 percent of regular AI users report higher job satisfaction, while 41 percent also report higher cognitive load. David connects that tension with the effort required to assign work to agents, evaluate quality, and keep those agents operating. He refers to separate BCG research called AI Brain Fry, which found productivity rising as employees managed additional agents until a limiting point. In that research, productivity fell when workers moved beyond managing three agents. Training remains another stubborn problem. The report says 72 percent of employees believe AI has changed skill expectations, and nearly half say their role is moving toward directing and managing AI. Only 36 percent feel they have received enough training, a figure David says has not improved despite new learning programs. His recommendation is in-context training that brings AI into daily work, followed by peer discussion about what worked, what failed, and how behavior should change. The purpose of recovered time may be the most revealing management question of all. David says employees report saving an average of around eight hours a week, but many use that time to perform additional versions of the same tasks. That can become demoralizing if greater output benefits the company without giving employees room for learning, infrastructure improvement, experimentation, or new product work. Leaders need to explain where the capacity should go and why. Clear communication also reduces fear. Automation targets introduced without an explanation of strategy can leave employees assuming that efficiency is a code word for job loss. When leaders explain whether AI is intended to improve customer experience, create growth, reduce cost, or change the business model, employees have a better basis for understanding what is expected of them. If strategic clarity is producing greater value than better tools, should the next AI investment begin with another platform or with a decision about how the work itself must change? Listen to the episode and share your thoughts.   Useful Links AI at Work: Strategy Matters More Than Tools When Using AI Leads to "Brain Fry" When Everyone Uses AI, Companies Risk Losing Critical Skills LinkedIn – BCG on the CHRO Agenda    

What will customers remember about a business when the voice answering their questions becomes the main expression of its identity? In this episode of Tech Talks Daily, I speak with Ruth Zive, who leads marketing at Voices, about the business and human questions surrounding AI voice. Voices is an enterprise marketplace and platform where companies can find professional voice actors, license AI voices with consent, and source custom voice data for training models. The company says its global talent network includes millions of performers and has served brands including Microsoft, Shopify, and Cisco. For years, much of the AI voice debate focused on whether synthetic speech could sound convincingly human. Ruth believes the commercial conversation has moved toward provenance, brand integrity, permission, and usage rights. A voice can sound polished while exposing a company to reputational damage if the performer did not understand the use, the license is unclear, or the same generic voice appears in a competitor's customer experience. Voices research cited during the interview found that 79 percent of business leaders believe inauthentic AI voices could damage brand perception. Ruth also says almost half of enterprise decision makers regard tone and emotional expression as the most important vocal factor in authenticity. That matters when a customer is frustrated, confused, or asking for help. A voice that sounds human but responds without suitable emotion can weaken trust at the exact moment a company needs to earn it. Ruth describes responsible licensing through three ideas: compensation, control, and consent. The performer should understand how the voice will be used, retain an agreed degree of control, and receive payment that reflects the commercial use. Those decisions need to appear in the contracting, licensing, and entitlements before a model is trained or placed in front of customers. We also consider the economic effect on professional performers. AI voice can change existing work, but Ruth argues that it can also create additional assignments when licenses are written carefully. An actor might provide the voice for an in-car assistant while continuing to record commercials in unrelated categories. Other opportunities include contact center experiences and the creation of specialized voice data used to train models. The positive case depends on clear boundaries and fair commercial terms rather than unlimited reuse. The brand question may become even larger as customers move from websites and typed interfaces toward spoken conversations. Ruth points to BMW's careful selection of voices based on customer profile, tone, language, accent, and how each performer sounded inside the vehicle cabin. Her advice is to treat a voice as a long-term brand asset, test it in the setting where customers will hear it, and confirm that the company has the required rights before deployment. Voice AI offers companies a more natural customer experience and gives performers access to new forms of paid work. It also raises difficult questions about disclosure, ownership, exclusivity, and trust. Should every company now have a formal policy for choosing, licensing, and governing the voice that speaks on its behalf? Listen to the conversation and share your thoughts with me.