2026 Tech Ascension Awards Winner Spotlight: Rubrik’s Dev Rishi on Securing the Agentic Enterprise

We sat down with Dev Rishi, General Manager of AI at Rubrik, to discuss the company’s recognition as the Best AI / ML Powered Solution in the 2026 Tech Ascension Awards and how Rubrik is helping enterprises securely adopt autonomous AI systems. In this interview, Dev explores why traditional, human-speed defenses are no longer enough, how agent identity and real-time governance can contain risky actions, and why instant recovery must become a core component of enterprise AI security.

Agentic AI is reshaping both offense and defense. How is Rubrik building security for — and with — autonomous AI systems, and what risks are you most concerned enterprises are underestimating right now?

Frontier AI models now chain vulnerabilities rapidly, collapsing the time between intrusion and breach and rendering traditional human-speed defenses obsolete. Passive detection and logging can't stop an autonomous agent once it turns destructive. Organizations need agentic cyber resilience.

At Rubrik, we secure and accelerate the world’s AI transformation by making security an enabler of agentic AI adoption rather than a bottleneck. 

That’s why we built Rubrik Agent Cloud (RAC). Powered by our Semantic AI Governance Engine (SAGE), RAC empowers organizations with all four pillars of agentic cyber resilience:

• Agent Observability: monitor every agent and MCP at runtime.

• Agent Identity: control access per tool call at speed and scale using fine-tuned AI.

• Agent Runtime Security: SAGE intent-driven governance to enforce policies, and detect agent errors in real time.

• Agent Rewind: the industry’s first undo button for AI which allows enterprises to roll back destructive agentic actions and restore clean system states

  
  

RAC enforces real-time guardrails across Microsoft, AWS, Google Cloud, OpenAI, Anthropic, and more based on policy intent, not rigid text filters.  

Agentic capabilities are built directly into our own platform through Rubrik AI, which adapts to each organization’s context and security threats and autonomously acts across Rubrik’s product portfolio. Rubrik AI performs the heavy lifting autonomously, keeping humans in the loop strictly for final judgment calls, rather than time-consuming multi-step investigation workflows. 

You recently announced a new product feature, can you give more details about it?

RAC Agent Identity is a new product expansion to solve enterprise AI's biggest identity bottleneck. AI agents are no longer just summarizing text, but taking actions on behalf of employees across SaaS applications, databases, and APIs. But static credentials and traditional access models were never designed for autonomous machine actors, creating an unmonitored shadow workforce in the organization. 

Rubrik Agent Identity stops giving AI models permanent keys to company systems. Instead, a smart security layer double-checks what the AI is trying to do in real time and hands out a temporary, single-use pass right before any risky action takes place. 

Identity has become the new perimeter — and attackers know it. How has your approach to identity security, authentication, or access management evolved, and what are organizations still getting dangerously wrong?

Rubrik Zero Labs research reveals that 86% of IT and security leaders expect AI agents to outpace their security guardrails within the next year, yet only 23% report having full visibility into the agents operating in their environment. The perimeter has shifted from human identities to autonomous machine actors. In today's organizations, non-human agent identities drastically outnumber human users, creating a massive, unmonitored digital workforce capable of executing complex workflows across SaaS apps, databases, and APIs at an unblinking pace. 

If you treat an autonomous agent like a human employee with permanent API keys, you hand an attacker master access. With Rubrik Agent Identity, we are redefining how autonomous actors are authenticated and authorized. 

• Zero Standing Permissions: Ditches permanent access keys for single-use, temporary passes generated only when a tool is called.

• Intent-Aware Checkpoints: Analyzes an agent's true motives before high-risk commands are allowed to run.

• Seamless IAM Integration: Hooks directly into existing setups like Okta and Microsoft Entra ID without rebuilding your identity stack.

• Instant Rewind: Pairs live access blocking with Agent Rewind, the industry’s first undo button to immediately reverse rogue actions or AI hallucinations.

  
  

Security teams are being asked to do more with tighter budgets and leaner headcounts. How does your solution help security leaders justify ROI and actually reduce operational burden rather than add to it?

Real AI ROI isn't about immediate headcount cuts. It’s a force multiplier that accelerates business outcomes without expanding operational teams. Requiring security staff to manually review and approve every routine AI action creates an unsustainable bottleneck that destroys the efficiency AI promises. By leveraging RAC, security leaders can shift from a slow block and review model to an automated inform and audit posture.

Non-engineering teams, such as Legal, can safely build self-service AI agents with the governance model RAC provides. 

Instead of focusing on misleading stats like "amount of code AI generated," RAC’s strategy drives actual business results, delivering new products months faster and fixing customer problems much quicker. It also eliminates hidden AI waste by giving leaders full visibility into tool usage, stopping long chat sessions that quietly run up massive bills, and automatically matching simple tasks to cheaper AI models. 

By pairing built-in safety guardrails with smart spending controls, security leaders can protect corporate budgets and lighten their team's daily workload as AI adoption grows.

What should be sitting at the very top of every security leader's priority list in the second half of 2026?

The top priority for every security leader right now must be a strategic pivot to agentic cyber resilience. Organizations must accept that traditional prevention and detection strategies are no longer sufficient on their own. Rubrik recently announced its founding partnership of CSAI Foundation’s AI Resilience Center of Excellence, a commitment to equip risk leaders with the resilience needed to confidently adopt and govern AI.

Other key priorities include:

• Shift from Prevention to Instant Recovery: When breaches happen in milliseconds, stopping every attack is impossible. Rebounding instantly is what matters.

• Embed Security into Daily Ops: Treat cyber risk as a core business muscle, not an isolated IT issue.

• Intercept Rogue AI in Real Time: Use dynamic controls to check an agent’s motives before it executes a destructive move.

• Fight AI with AI: Let autonomous defenses handle split-second threats so humans only step in for high-stakes calls.

How Tech Ascension’s Best Application Security Solution Winner Mend.io Is Rethinking Application Security for the AI Era

We sat down with Azi Cohen, Co-Founder and CEO of Mend.io, to discuss the company’s 2026 Tech Ascension Award for Best Application Security Solution and how Mend.io is helping organizations secure software as development becomes faster, more distributed and increasingly AI-driven. In this interview, Azi discusses how AI is changing the application security landscape, why visibility and risk prioritization have become critical, and how organizations can keep pace with development without compromising security.

Mend.io was named Best Application Security Solution in the 2026 Tech Ascension Awards. What do you believe sets Mend AppSec apart in today’s market?

The application security landscape has fundamentally changed. Organizations are no longer securing just proprietary code and open-source dependencies; they are also securing AI-generated code, large language models, AI agents, retrieval-augmented generation pipelines, system prompts and other AI components.

Mend AppSec was built for this reality, bringing application security, software supply chain security and AI security together in a unified platform. It gives organizations visibility across the code and AI layers of modern applications while integrating into the developer workflows they already use.

Just as importantly, Mend.io is focused on helping teams act on risk, not simply generate more findings. By combining contextual risk prioritization, reachability analysis and AI-powered remediation, Mend AppSec helps security teams focus their limited resources on the vulnerabilities that present the greatest business risk.

How is AI changing the application security challenges organizations face today?

AI is accelerating both software development and the complexity of what organizations need to secure. AI coding assistants are increasing the volume of code developers produce, while applications are incorporating new components such as models, agents and prompts.

That creates new security challenges. Teams need to understand not only whether traditional code and dependencies contain vulnerabilities, but also what AI components exist in their environment, how they are configured and how they could behave when exposed to adversarial inputs.

The challenge is that security teams have not received more people or more time to manage this growing risk. They need security processes that can operate at the same speed as development, with continuous visibility, automated testing, intelligent prioritization and faster remediation.

Why is visibility such an important starting point for securing AI-powered applications?

You can’t secure what you can’t see. One of the biggest challenges organizations face is that they often have far more AI embedded across their applications and environments than they realize.

AI can enter an organization through developer tools, third-party services, models, agents and APIs, making it difficult to track manually. Before organizations can assess the security of these components, they first need to understand where AI exists, how it is being used and how it connects to the broader environment.

That makes discovery the foundation of an effective AI security strategy. Organizations need a continuously updated view of their AI footprint that enables them to identify risks, apply the right controls and continuously test and secure AI systems as they evolve.

Why has risk prioritization become so important for security teams?

Finding vulnerabilities has never been the only challenge. The harder—and increasingly important—task is determining which vulnerabilities represent meaningful risk and where security teams should focus their attention first.

Not every vulnerability is equally exploitable or impactful. A flaw in a critical, internet-facing application may demand immediate attention, while a higher-severity vulnerability in an isolated environment may pose far less risk.

Mend AppSec uses contextual signals and reachability analysis to help teams distinguish between these scenarios and prioritize the vulnerabilities that matter most. This becomes even more critical as AI accelerates software development and increases the volume and velocity of code and security findings.

When teams treat every finding as equally urgent, AI-driven development can quickly overwhelm security teams and developers alike. Effective risk prioritization helps organizations focus on the vulnerabilities that pose the greatest real-world risk and allow security programs to scale with development without overwhelming the teams responsible for fixing the issues.

How does Mend AppSec help organizations secure traditional and AI-powered applications without adding complexity?

Security cannot become another bottleneck for development. Organizations need to protect applications throughout the software development lifecycle while allowing developers to move quickly.

Mend AppSec brings security for proprietary code, open-source dependencies, containers and AI components into a unified platform and integrates directly into developer environments, repositories and CI/CD pipelines.

Mend.io also extends application security practices into the AI layer, giving organizations capabilities to discover AI components, identify AI-specific weaknesses, harden system prompts, assess agent configurations and protect AI applications at runtime.

The result is a more connected approach to security that reflects how modern applications are actually built and operated.

What measurable impact can organizations achieve with this approach?

The goal is to reduce the time and effort required to identify, prioritize and remediate meaningful vulnerabilities.

According to Mend.io’s Open Source Risk Report, organizations that implemented Mend repository integration and remediation best practices reduced average remediation time from 271 days to 70 days – a 75% improvement – while increasing remediation rates from 13% to 40%.

We have also seen significant results at the customer level. Global advisory firm WTW reduced both developer remediation time and mean time to remediate vulnerabilities by at least 80% after implementing Mend.io.

These results demonstrate the value of integrating security into development workflows. When teams can prioritize risk and give developers actionable remediation guidance within the tools they already use, they can improve security outcomes without sacrificing development velocity.

What comes next for Mend.io and the application security market?

Application security and AI security will increasingly become part of the same conversation. AI is becoming embedded in how software is built, deployed, and operated, and security needs to evolve alongside it.

For Mend.io, that means continuing to expand visibility across the AI attack surface, strengthen risk prioritization and remediation and help organizations protect AI-enabled applications throughout their lifecycle from development and testing to production.

The goal isn’t to give organizations another endless list of vulnerabilities. It’s to help security teams understand what matters, prioritize the risks that matter most, fix them faster and continuously protect the applications they’re building.

AI is accelerating the pace of software development. Security needs to accelerate with it.

Filigran CTO on Building an Award-Winning, AI-Native Threat Management Platform

Filigran was recently recognized with the Most Innovative Security Solution award for its eXtended Threat Management (XTM) Platform, an open, AI-native ecosystem that unifies threat intelligence, adversarial exposure validation, and risk governance. We sat down with Julien Richard, CTO and Co-Founder of Filigran, to talk about the company's mission and how the XTM Platform is helping security teams move from reactive alert-chasing to continuous, threat-informed defense.

For readers who may not be familiar with Filigran, can you introduce the company and what it does? 

A: Filigran is a European company, founded in 2022 by our CEO, Samuel Hassine, and me. We started the company because we saw the same gap everywhere: security teams had more tools and more data than ever, but no real way to turn that into fast, confident action. Our mission is to empower defense teams to be proactive through open-source solutions that uncover threats and drive action. We began with OpenCTI, a platform to centralize and structure threat intelligence, and have since expanded into OpenAEV for continuous exposure validation, with OpenGRC (risk governance and quantification) coming next. Together, these form our XTM Platform. At its center is XTM One, an agentic AI layer that connects intelligence, validation, and response into one workflow. Everything we build starts as open source. We're backed by a global community of more than 6,500 practitioners who build alongside us. 

What's the biggest challenge you see security teams facing today? 

A: It isn't a lack of data. Organizations have more visibility into their environments than ever. The real challenge is separating signal from noise. A large security team can receive thousands of alerts a day, but only a small fraction of them represent a genuine, exploitable threat. Our State of Threat Management report found that security teams spend an average of 42% of their time investigating risks that later prove low priority or non-exploitable. In a 40-hour week, that's about 17 hours per analyst. That's not just an efficiency problem. It's a retention problem, and it hits some of the most skilled people in the industry. 

How does the XTM Platform help organizations address that problem? 

A: We help organizations move from reactive to proactive security, following what the industry calls CTEM: Continuous Threat Exposure Management. Instead of a point-in-time assessment, it's a continuous cycle: understand the threat landscape, prioritize the exposures that actually matter to you, validate whether your defenses hold up against realistic attacks, and act on what you find. Then repeat. That's exactly what our platform is built to deliver. Being secure today doesn't mean you're secure tomorrow. Threats evolve, and systems change, so defenses need to be tested continuously, not once a year during an audit.

What role does AI play in Filigran's approach? 

A: AI helps teams keep pace with the volume and speed of modern threats, but the goal isn't to replace the analyst. It's to remove the low-value work that keeps analysts from focusing on what matters. Through XTM One, teams can ask direct questions of their own data, automate repetitive investigation steps, and get straight to the context they need, while humans stay in control of the decisions that count. The point of AI here isn't automation for its own sake. It's giving skilled people back the time to do the work only they can do. 

Why is open source such a core part of Filigran's model? 

A: Cybersecurity is built on trust, and trust requires transparency. When your security stack is open source, you can see exactly how it works, adapt it to your environment, and keep control of your own data. That matters enormously for organizations handling sensitive information, and increasingly for anyone thinking about digital sovereignty and long-term control of their systems. It also means we build alongside our community of practitioners and contributors instead of behind closed doors. That community is a big part of why our products keep improving as fast as the threat landscape does. 

What's next for Filigran, and what excites you most right now? 

A: We're focused on closing the gap between knowing about a risk and acting on it in time. That means connecting threat intelligence, exposure validation, and, risk governance and quantification. The goal is for security and business leaders to finally work from the same picture instead of several disconnected ones. What excites me most is that this isn't just a technology shift. It's a mindset shift, from managing alerts to managing outcomes. The organizations that make that shift are the ones that will actually get ahead of attackers, instead of constantly chasing them.