Name: Foundations of Cyber Resilience with Rubrik
Uploaded: 2026-02-11T11:16:07.707Z
Duration: 1 h 12 s
Description: Foundations of Cyber Resilience with Rubrik

Transcript for "Foundations of Cyber Resilience with Rubrik": Hi, everyone, and thank you all for being with us today. I'm Nicholas Gruel. I'm one of the the senior CTO for EMEA at Rubrik. And today, the goal is to actually talk a bit about cyber recovery, about our idea of resilience, or what does it mean today with, unfortunately, would say, lot of the changes that we've seen in past years. And we've continued for the past four or five years to actually spend a lot of money in actually trying to prevent cyber attacks. And I would say that the newspaper will not actually tell me otherwise. It is still a very big thing. We've seen that starting very much in 2020 with Covid. That's where really we've seen a big rise in the amount of cyber attacks. Unfortunately, despite the amount of money that we are actually injecting into the business, ransomware are still very much here. And I mean, they've been switching, I would say sometimes from targets. We've seen a lot of public sector type customers or hospitals being attacked in 2020, 2021. But we can see now that really every part, every vertical are actually affected. And that's really in the news and for the meantime, every day. And that's, we think, because a lot of focus has been put on preventing things from happening and unfortunately not to be ready to actually, well, recover or like, make something out of that cyber attack and be ready back in business as quickly as possible. And that teacher may not actually say much to you. That that person is the CEO of a company called Colonial Pipeline, which is an actual gas oil and gas pipeline on the East Side Of The US. And that person, well, his company was a victim of a cyber attack. They had to shut down oil and gas, pipelining, I don't actually know what is the actual word for that in English, but they had to stop that for several days because of that cyber attack. And while bringing the whole thing back, it still had to go in front of the US Senate to testify on what actually happened, what did they do to actually solve it, recover from it, and what did they put in place to actually prevent it from happening. Because this is also the main goal. How can you make sure that you are ready? And that is really, I think, a key mindset change. How can you be ready? How can you anticipate those to make sure that even in the case it happens, unfortunately, we've seen that it probably will, how do you actually recover from it, both in terms of the company, but also the actual company's image and reputation and all that, because that's the kind of thing that will be affected. And, I mean, we have lots of examples, I would say in the past couple of months. We talked about Mark and Spencer, we talked about other actual retail in The UK, but we have examples in Germany, we have examples in France, we have examples pretty much in every single country. And it really goes down to, are you actually ready to, well, recover from that kind of attack? And that's really where that idea of RTO, recovery time objective that we know for decades, I would say, in RTO, really evolves in a certain way because it won't be the same thing. For years, we talked about the RTO, about the fact that, oh, yeah, we have a fire in the data center, and we can just, like, shut down everything, go out into our second data center, and just bring back the entire thing. And we've we've been prepping for that. I'm I'm in IT for twenty four years, unfortunately, I think. And and I've been doing that forever. I was, I think, twenty three years ago doing complete disaster recovery from one site to another for an oil and gas company in France. That is per default type situation that everybody has been trained on. But cyber recovery is completely different in the sense that you won't face the same issue. You may not have something to recover to. And that's where the big issue is, because the confirmation may be everywhere because it would spread out in the entire environment, in multiple data centers. It could even spread out to the cloud if you have an hybrid environment. I'm pretty sure some of you that. And that's really it. If you don't have a cyber recovery time objective to the opposite of an actual RTO, well, maybe you're missing out on something. And it's really something that we're seeing a lot of companies investing into and going after an idea of cyber resilience. If actual malware comes in, how can I make sure I will survive? How can I make sure the company will be there and will be able to survive that thing? Or at least go back as quickly as possible. And it's really that idea of time that I want to stress out once again, because it will be vastly different from what what you've been seeing and what you've been experiencing for the past years. Because and for for a lot of you, I guess, it has always been, well, something happened. Let's restore from our backup. We have the backup. That's what they are exactly made for. And it has always been an entire copy of your data center's data, of your production data into a separate storage waiting for production to break. Production breaks, you restore from the backup, and voila. Unfortunately, with a malware, that will be vastly different in the sense that the first thing you will need to know what's in fact. And that's the kind of, well, investigation that takes time in the sense that you may know very quickly what is that, what is encrypted. Machines are encrypted, how many? Then the whole idea is what do you do with them? In the sense that most of the time, the machines which are encrypted, not responding, not being able to do anything, but you may have a lot of them. So what do you do? What do you recover first? Because that's really the kind of idea where, well, can we recover everything? If you have 400 VMs, yeah, probably. Yeah, recover the VMs, recover the databases, be done with it. Or not. We'll see that afterwards. But if you have 4,000 or 40,000 VMs, 70,000 VMs, like some of our customers, can you really recover everything? Yeah. Should you? That's the next question. What's the priority? And that's the kind of thing that in a cyber resiliency plan, need to think through first. There's really a big part of productivity that needs to come in place to understand what you should be doing. Because you'll need to find out what was impacted, find how many of those machines or databases are not good anymore. And then identify when the malware may have got in, but also where it may still be, because that's the big issue. Most of the time, the hackers will encrypt themselves. They will also encrypt the actual machine they use for the inception, for the encryption of all the others. And so you have a machine who hosts the malware and you have machines which are just side things where they actually got encrypted because they were there, but they don't host the malware. And that would make a big difference because if you restore one of those machines with host malware, well, after it reboots, it will probably restart encrypting the whole thing again, which means you're going back now. You'll also need to do things, and that's like front and center, that idea of what is the impact on the sensitive data. That's actually something in those type of prizes that you may want to do quicker than being right front and center in the page. Because, and talking a lot about Europe, and specifically about Mainland Europe and all the countries which are subject to GDPR, for example, you actually need to go back to the regulator, so to the EU within twenty four hours with the type of data and the amount of data that may have actually been excitrated. Twenty four hours, depending on the size of your environment, may not be the easiest thing to do. So better to store that as quickly as possible. And once you've found the malware, once you've found which machine actually holds the malware that are encrypted, then you can quarantine them and start recording. And unfortunately, it won't be as fast as me saying, this will take time. And I'm not talking hours or days. We've said it with Mark and Spencer, and I'm I'm gonna use that word a bit, unfortunately, because that had actually just happened. And it's very fresh, at least info wise, we have a lot of information about what's happening. But yeah, it's really something that will take time, and we're going to see that afterwards. But we actually decided to do things a bit differently in the sense that and I've been working in IT and data protection, as I was saying, for twenty four years I've been very well aware of the idea of the other DACA software and how they're running. But we've decided to do things in a complete different way. Because eleven years ago, when Rubrik was created, the whole idea of our founders was, can we actually change the paradigm? The paradigm, as I was just saying before, is that your backup is a complete copy of your production waiting for it to break. Well, it's 2025. We have all that data sitting in very expensive hardware doing nothing for most of the day. Can we actually use it? Can we try to make sense out of it? Can we actually get value out of that data sitting there doing nothing for most part of the day and give that value back to our customers. And that's really where we started getting into what we could be doing and bring value back. The whole idea at the beginning was to actually get the fastest recoveries possible so that you could actually use that data with what we call LiveMount. But very quickly, we built that idea of native threat engine so that with all the data that we were backing up, all the data that we were indexing, because we're going to be indexing all that data, why not actually looking into that data for known threats? Why not actually looking into that data and find out what type of data it actually contains? Maybe it's PII, maybe it's PCI data, like personal information or banking information or very specific things from the company that you care about. The own PI from the company needs to be protected. That's the value, that's the asset of the company, we need to protect that. And that's really that idea of combining the data that we back up, the metadata that we create from it, and run that through our native threat engine to get you value out. And that is keeping on evolving. We will talk about AI integration afterwards, but it is really one of the fundamentals of Rubrik that the zero cross architecture, and I could spend hours talking about how it is secure, how it is actually made immutable, but how you can actually use it to get some value out of all those data. And as I was saying earlier, unfortunately, the big difference will be in the time. And we've seen it again with Morgan and Spencer. They went back on track after several weeks because they had to go through all of what you actually can see on screen now. Like having all of those tests, finding out where you are, finding out what you need to do, finding out which actual data is safe to recover. And that is, I think, the most critical part. Signing out what data is safe to recover and actually going through the whole thing. And unfortunately, as I was saying earlier, most of it is somewhat something proactive that you have to do. And we've seen a lot of companies actually going into that idea of what's my minimum viable company? What are the actual applications that I care the most about? What are the applications that I need to recover first? What are the applications that will make sure that money still comes in the company and that I can still pay my employees? Because that's also part of the issue. And that is really something that the regulators are also starting to push, which is interesting because it is really going into the sense of what we were doing. But this is really where we can make a huge difference. And I would explain afterwards how technically we get there. But really, the idea is to find out from yourself or your company what are the, what we call MDCs, minimum viable company, minimum viable applications, what needs to be that and ensure that you can bring them back as quickly as possible in a complete automated fashion. And that in the sole goal of reducing those weeks of potential recovery from a ransomware to a few days. Maybe less if you're lucky and everything is established, everything is ready to actually run and you can automate the whole thing and on the click of a button recover the entire set. We, on Rubrik, I would go through a bit on the, I would say, the technical features of the whole thing, but it's not only that zero trust architecture that we bring. It's also other things like the Rubrik Zerolabs. We have our own threat intelligence business unit, which is doing research, which is creating threat intel, Lendiar roles and all that, and actually publishing it directly onto all the whistleblowing sites and all that. We have partnership with a lot of other companies for that, and I will talk about that later on. But they're also grabbing their own sources from our ransomware response team, which is a team in Rubrik support, which is solely dedicated to that very purpose, help our customer to recover in case of a ransomware attack. And that is a service that we give for free as far as possible. All our customers are eligible and, well, they will be with you from, I would say, A to Z, really helping you out in that ransomware recovery, making sure that everything is set up, giving you some best practices and helping you out the best they can. And all that comes with ransomware warranty of 10,000,000. We're so sure that the platform cannot be breached, that we're actually putting money where our mouth is. And that is, I think, another big testament of what we want to bring to our customers. Talking a bit about technology and what we're doing, I won't go into too much details into what you can protect, what you can actually backup and where you can do that, because we won't have enough time in that webinar. But feel free to reach out or send questions if you want through the chat, and we can talk about that later on. But really, the idea is to make sure that we can back up the data wherever it is, from the data centers to the cloud, being SaaS or PaaS, but also everything identity related because, unfortunately, and we've seen it, again, Mark and Spencer, but others as well, that identity is the prime target of hackers, if not the actual way of entries for them. And unfortunately, that is one of the key parts that needs to be protected, you need to ensure that this is spot on. But as I was mentioning earlier, one of the key ideas of Rubrik is really to bring value out of those backup. And that is really what we do on the right side of your screen. The first thing, and I think there's really that idea. I mentioned that already, but that idea of productivity of things that needs to be done before, even before talking about the reactivity. I mean, in the end, we have the backup, we will be there to recover all of those. How is actually a big thing. Productivity wise, we have, I would say, various links, but the whole idea is really within that data security posture that you have in the middle of the screen, which is really helping you out identifying that sensitive data in the sense of telling you where is located your PII data, PCI type of data. Also, anything which is specific to the company that can be regressed. We will be able to find it out just to make sure, and that's actually one of the key elements, that you know where data is. Because unfortunately, that's what we see a lot in a lot of those attacks. Customers get data exfiltrated without even knowing that some data were there. And that's one of the key and fundamental problem. If you don't know what data you have, if you don't know where data is, well, how can you even know what is your applications doing or what is the entire set of applications that you have moving data and moving pieces everywhere actually doing? And that is a key thing. So we will be going through that, but also going through that idea of the user access, user analysis in the sense that we will be looking up for how many users have access to specific type of data and if there is any changes in what they're doing. Maybe you have users with access to too many files. Maybe you have phones which are completely open to everyone. We actually had a customer with that not so far ago where I got to a meeting with them and they were having lots of files on the NAS, like 7,000 files on NAS being spotted in red with no permissions, no ACLs, completely open to everyone. And through the product, we managed to identify the list of files and the customer was, Guys, there's no way that all adds up. And I was like, Well, it may be a false positive. Can we connect to that mass force and double check? And false urgency, we were correct and those funds were completely open. Only thing I could think of, because that was very old file, but that was a period of like five years, they were completely open. And the only thing I could think of was really like a bad GPO, something that just reset the main part thing. And that was it. And that's really the kind of thing that if you don't know about it, those files will be there with arm protection potentially forever until they get deleted. And I'm French, trust me, we don't delete much data in them. And that's really about enabling you to track potential violations as well. I mean, we are backing up your active directory. We will be checking on the users. We will be able to tell you if there is anything which is out of the ordinary users with too many access users with access changing. And maybe, I mean, you were working in IT for long and you can see that all your colleagues have a certain set of privileges and suddenly one of the people from HR gets access to, well, all the files that you have access to. And it may be novel that maybe that person evolves in the company and got into IT, or maybe suddenly her privileges or his privileges were bumped up because he was or his or her account got hacked. Unfortunately, that happens more than once. And that is really what we need to track down proactively is what is happening, who has access to what, what is the type of data, what makes that minimum viable company as well, and make sure that you can start creating those cyber recovery plans in that orchestrated recovery on your bottom right, Because those will actually be application blueprints of your entire tier zero, tier one, tier two type environmental applications to make sure that you can actually recover out from it. Creating those plans of what needs to be recovered, how does it need to be recovered, where, and potentially make an actual bubble and go through the entire thing. And that's another idea of it that I will talk about in a minute. And unfortunately, despite all your efforts, something happens. You get hacked. Your data and your machines gets encrypted. That's where Rubrik will actually kick in automatically. By default, every backup is indexed. We will check through our Menyens integration. We have a partnership with Menyens, which lends us IOC database, those indicators of confirmations, where we will actually look out and find out which machines are actually encrypted, but also by what. We will bring that up so that you can quickly identify which machines are compromised, what you need to do, but also let you know since when, which backup actually started showing up those things. And it could be that it went completely silent because it's a zero day attack of something that was created specifically for your company, which unfortunately is something that we see a lot. But if that happens, your sub team would be all over it. You'll probably get help from some other companies that will create those IOCs. You'll be able to pass them into Rubrik, into our threat hunting module, to actually go down, identify which machine is actually infected, which machine is infected, and since when, so that you can identify the best recovery point the day or the hour before it actually got impacted, and then you'll be able to recover the entire thing in, well, recover clean data. But unfortunately, it may not be the case in the sense that, let's say you have 2,000 VMs that are encrypted. You run through all the things and you end up finding out that you have 10 VMs, which actually host the malware. Those 10 VMs, well, I would say they cannot be recovered or maybe you need to in the sense that those 10VMs maybe, I don't know, web servers. Well, Comcast said that IAS said that fine. Kill it, make anew. The good thing, if you think about it, is that you have 10 machines which are known to be infected. That also means that you have a 990 machines which are okay. You can start recovering them or patch recover those a 990 machines and then focus specifically on those tags. And as I mentioned, Tomcat server did it. Big SQL server, most important thing in the company, what do you do? You need to recover it. And you don't need to recover it to the, I would say, cleanest copy, which may have been a month ago. Because, unfortunately, hackers, they tend to stay quite long in the environment before striking. Can you actually recover back a month ago on your biggest SQL database? Probably not. So what do you do? Then you use Orchestrated Recovery feature, as I was talking about, and recover that in isolation. Recover that into your, what we call, IRE, isolated recovery environment, and get you in access to that isolated environment so that they can clean it up. Bring them the actual latest known backup that you have so that they can clean it up and you can bring that whole thing back into production. The other idea, which is I think interesting with this, is that you can use that isolated recovery testing in peacetime as well, when everything's fine. And that will give you an idea if your actual recovery plan will work. You'll be able to test out, run some scripts, insert data from a web server to the database and verify that once recovered, everything will be fine. Or actually test the recovery time. Test your actual, not cyber, but test your actual proper RTO. Because a lot of times when you're doing RTO or when you're doing disaster recovery, you're doing unitary testing, you're recovering one server or you're recovering one database. Does it prove much? Not really proves that you can do it, but does it prove that the application would be back up and running? Not quite. Recovering the entire application will give you a view on the actual time, will give you the ability potentially to go back to the regulator to prove that you actually are able to recover and that you know how long it will take. But also potentially help you follow what is happening. Because that's another issue that we see a lot. If you're doing those disaster recovery tests or drill tests once every six months, well, the database or the application may have grown quite a bit. You may have like 50% decrease in six months. And so your RTO will be completely different. And I mean, I have a customer that reached out the other day. They're recovering their entire set, their entire application, like a 60 terabyte Oracle database. They recovered that in three hours, 58. They were pretty happy with it. And I was like, but isn't your RTO four hours? Yeah. What do you do in two minutes? It's just too close. And that's where they started an actual reflection, an actual thinking on what to do with that whole thing. And that's also the kind of thing that Rubrik can bring. Really try to rethink your environment, not for the actual backup, but for the actual recovery, because that's what matters. But enough of that, Let's talk about the actual tools integration because that's also a big part of it. Everything in Rubrik is an API goal, and you can use the API to do everything. We have a full set of those into our developer.rubric.com. You can look it up. We have a lot of SDKs also available so that you can quickly integrate Rubrik with your VARs tools, but you already have native tooling integrations with security tools, but also others. I mean, we're integrating with the like of Zscaler, CrowdStrike for the EDR or DLP capabilities. We're integrating with SIEM, with SOAR, so that when something happens, we can send out directly the notification and things can start moving and you can act on top of that notification. Oh, we detected some hardware. Okay, well, directly bring those VMs into an isolated environment so that they cannot detonate or they cannot do anything with it. And that is really the kind of things that we can do, but also integrate with other tools like ServiceNow, for example, ticketing systems like Revety and all those. And the last part I was mentioning about a bit earlier is really about the future and what we just bring with that AI integration with our tool called Anapul now. The whole idea is and that's, I think, very valid for us in Europe AI is a big thing everywhere. AI needs data. But we cannot, because of European laws, absolutely use personal information into the data used to train AI, which is fair enough. But how do you actually get those out? Well, think about it. We have access to all the data of your environment, as I said before. We can identify the sensitive data in it. So why not combining that? Why not actually giving you access or giving your LLMs access directly to all your data without the actual personal information or without the PI information of your company. So you make sure you're not actually filling the LLM with anything that you don't want to, but still enabling your internal people or enabling developers to actually code out with the latest information and make sure that you Rags or LNs have access to the actual data that you care about. There's a lot of things coming with the AI Act, for example, that actually asks you to track what you're training your LLM with. Well, if you're training it from the backup, you already know what you have into the backup, so that's just what you need to keep. Plenty of food pop out, I think, into that, and that's a subject that we are very happy to talk about if you're interested. Why not doing a quick demo just so that I can show you up? So here's the Rubrik UI. You can see on the left what I was talking about, about the ability to back up everything and lots of goodness here with the ability to actually define, I would say, the simplest protection product policies that you can find and really that idea of really simplifying the whole thing, really trying to be as quick and as fragile as possible. But on the other side, on the right side of the screen, you can see the various features I've been talking about. The data security posture, allowing you to actually view directly where are files. Here, for example, open access, as I was mentioning earlier, files with sensitive data on it may not be the best thing. And really getting you to a global view of where you are, what are the type of data, do you have any specific violations right now? You can see here I have a violation with publicly accessible sensitive data. I may have data into an S3 bucket, which is completely open to everyone. And you can see that you have data which is misconfigured, you can see data which is overexposed, you can also see data which is obsolete. That's another big thing, I think, where we are storing too much data for our own good, especially in Europe. I'm not talking French, are we? But I've seen that a lot in other countries where retentions that we have are completely out of the mind of the right people. I mean, do you really need to store all that data? Why do you have it on your action production? You actually archive that data out somewhere? Again, some proof of thought on the things that we could be doing. But let's jump into that idea of data threat analytics and really giving you a view of what's happening into the environment. And you can see here that, unfortunately, we have one threat that has been detected. And you can see that here, we're having some objects which have been flagged with five sixty one fines, which is actually mapping today an active violation. And we can see that the threat here is fake, but it's ACAR, which which is a European thing, if you don't know about it, movie.acar.com, which is there just to serve that very purpose. You can see each file, when was it detected. But also, you can see here first MAD snapshot, meaning that's the day it actually got in. That's the day the malware actually got or infected your environment. So that's potentially the latest known clean data, the latest known clean backup. So that's potentially where you would need to recover. And that's the automated way. That's what we call threat monitoring, which will actually monitor for all the actual threats that we have. And currently, we are running with 1.5 millions known IOCs, both from Mandiant but also from our own threat intel. And the test, and supposedly, the hackers, as I was saying earlier, are using something tied to your company. They will probably not be using any known hashes, any known Yara rules. And so you may have to actually create one specifically for a used stop team. We'll actually investigate the malware, we'll find out what it is, and will actually give you that. And you'll be going through Rubrik, run the whole thing, and you can see we will be actually going through the entire set of data. You can see here we've done one with actually 20,000 backups. So we've been looking for that specific hash into 20,000 backup, and that took three minutes and fifty seven seconds, which is I think not bad. So we identify that we actually have that half impacting here 75 objects. Those 75 objects are here looking at the whole thing, and you can see what is the snapshot that matched the earliest, what is the actual snapshot that latest match the whole thing. So you can see that, well, apparently it got in, looks like it got in first in June, oh no, in May. So it went through that machine in May 1 and then started to turn in June here, starting to populate. So you can actually follow Prisma what it did. So you can potentially not find patient zero because it probably came in from a user's laptop or from a OneDrive or from something else. But you can pinpoint where it may have entered into the whole thing. And you can see here, we do have an actual and it looks to be where they entered from April 22, it entered from an actual OneDrive. Always the user somewhere in photography. So it is really a very helpful tool. And the whole idea is what I was mentioning earlier, really to go through that idea of orchestrated recovery. Create your recovery plans and actually create recovery plans for all your applications and then be able to run out the whole thing. Run those recoveries, actually find out how long it's going to take, find out what has been done the way it has been done, but also here download an actual document, a PDF file, actually telling you exactly what happened, how long it did, but also going back 12 times, so potentially twelve months of actual recovery testing, showing you a graph of how it evolves during the time, so that you can follow what is the actual size twelve months ago, what is the actual size now, what's the growth in terms of data volume, but also what's the actual growth in terms of recovery time, because that's what will matter in case something happens. Lots of things to say on Rubrik, lots of things to say on that UI, and we would be happy to spend some more time on that with you. So yeah, just feel free to reach out. Now that you've seen Rubrik in action quickly, we can just circle back and talk a bit about the benefits. We are engaging ourselves to ensure that you will be able to recover. That is really, as I said, one of the rubrics' mantra: we're putting the money where our mouth is with that 10,000,000 warranty. That's how sure we are that you will be able to recover your data. We want it to be simple. We want it to be fast. We want to actually provide you with the right information and we want to be able to provide you value out of your data. If you have one thing to remember about this webinar, it is really That is the goal. Improving that idea of cyber posture, making sure that you know where your data is, making sure that you know who has access to it, and if there is just too many too many or files, too many people having access to things, decreasing the risks, in fact, of exposure or exfiltration, because that's what the hackers are after getting your data out of your environment. And really ensuring that you will be able to be ready for that cyber recovery, having really that idea of cyber RTO. If anything happens, how long would it actually take me to be able to recover? Do I know? Can I plan for it? Can I test for it? Can I report for it? Because that is something that we can see more and more regulators pushing for. And in the end, really also trying to consolidate the multiple tools that you may have in the environment to potentially drive cost saving as well, but also and maybe to simplify life of the administrator and to simplify life, potentially your life in your business. Any questions, please feel free to shoot. I've seen that there is already some questions in the chat. Let me actually take a look at those. You mentioned the regulators. How does Rubrik help with the likes of DORA? That is a fair question, it's effectively one of the things we see a lot in Europe, to be fair. DORA also needs to do AI app that I was mentioning about, which comes actually on top of GDPR. That's all things that actually converge to one idea, which is that idea of being able to prove that you can recover. And that is really interesting, as wrapping DORA in these two, that idea of you need to be able to know what your applications or critical applications are. That is a key point in the DORA regulations. Being able to, well, threat for the actual recovery tests, being able to test your recovery and being able to prove that you've done And that is, I think, a key thing between the two regulations. And that is something that and I was just mentioning, maybe you haven't seen it, but I was just mentioning that reporting that you can get out of the orchestrated recovery, that's something that can be completely automated. We have some customers actually automating the whole thing, tests every month for their critical infrastructure, for their tier zero, let's say, applications, Active Directory, DNS and all those things, and actually testing the recovery and sending those PDFs out directly to the regulator just to prove out of the goodwill what actually happened. I hope it answers that question. We have another one. What about hybrid environments? Oh, okay. Entra Active Directory and Entra IDE hybrid environment. That's actually fairly common those days, especially with the amount of customers or large enterprise that actually are using clouds or multiple clouds and data centers. And it's something that we I think we have some webinars on plan in the coming future, but it's really the idea of being able to recover both the Active Directory and the Entra IDPs at the same time, because there is a correlation between the two, but Entra ID on its own may be completely useless if you already have an active directory on premises. Some things will be replicated, but not all, etcetera, etcetera. And you you won't be able to actually just recover Entry ID and not bring back your active directory. Entry ID cannot work on its own if you have AV on premises. So you need to work that out, and we are actually working that out for you. We will automate the recovery of the Active Directory on premises or in the cloud, depending where your VMs are. We will then recover all the necessary things to connect to Entra, and we will then recover the Entra ID users, groups, policies, and all that so that we can make the entire thing. And if the question was on the actual forest recovery, that's also something that we automate and lots of steps that we actually bring down to four zero five to make sure that you can recover an Active Directory for us as quickly as possible. I think we have another question. What about integrations with CMDB? That's a very fair one. It's something that we do have for some thinking, for example, with ServiceNow CMDB, but we could actually integrate with every CNDV that you may have just because of the richness of our API integration. You could actually interrogate directly Rubrik, push the data to your CMDB. Or from the opposite way around, from the CMDB, actually creates automatically things into Rubrik's to make sure that everything is in sync. And that's, I think that is very interesting. That is a key question. And that goes back to what I was saying, how do you actually know that you're protecting everything if you don't know where your data are? And that actually goes back to that the CMDB should be the source of truth of the environment. So the link should exist between the CMDB and Rubrik and your actual backup and recovery software that needs to be really intricated if you want it to work and if you want to be able to plan for that cyber recovery. Again, if you don't know what you're protecting, you probably won't be recovering the right place. And that's it. Thank you again for taking the time watching this webinar. And if you want to go forward and listen a bit more on what Rubrik has to offer, we have another webinar which is, I would say, very interesting right now, talking about sovereignty and how you can actually achieve that. This will be led by Jen Suits, which is our own VP of Solution Engineering, and Emily Armstrong Smith, which is the Microsoft Chief Security Advisor and Board Member, which I think could be interesting. She's a NATO advisor and also an advisor to the UK Department of Defense, so I think she would have some very, very interesting thoughts to share about what's happening now and what needs to be done in, well, I would say in every kind of companies, really, not only the public ones. And if you want to go further as well, you can quickly click on the link below to assess your current cyber resilience maturity. It's a quiz that will go through various things and will actually give you some key thoughts on what to do next and be sure that you can be cyber resilient. Thank you again for taking the time and any questions, please shop.