How Best Cloud Security Solution Winner Onebrief Brings Modern, AI-Enabled Command into the Most Secure Networks

We sat down with Grant Demaree, Chief Executive Officer of Onebrief, to discuss the company’s 2026 Tech Ascension Award for Best Cloud Security Solution and how Onebrief is bringing modern, AI-enabled command capabilities into the government’s most sensitive environments. In this interview, Grant explains what it takes to earn authorization for classified networks, why security and performance under contested conditions are essential, and how AI-powered planning can help military leaders make faster, better-informed decisions without compromising operational security.

What does it take for a cloud platform to operate inside the government’s most sensitive environments, and how does Onebrief meet that bar?

The hardest part of defense software is rarely the software. It is getting it live, and proven as secure, on the networks where the real work happens. Most commercial software was not designed for those environments, so we built Onebrief for the hardest networks from the start.

Onebrief operates there. It is a cloud-native command platform authorized at Impact Level 5, Impact Level 6, and Top Secret, the government’s highest bars for sensitive and classified data. Earning that meant independent security testing and formal government authorization, plus building for expeditionary, low-bandwidth conditions, because a real operation does not pause when connectivity gets hard.

You emphasize that Onebrief’s security posture is verified. What does that authorization process actually involve?

It is deliberately hard, and it should be. An independent set of eyes tries to break the software before it is ever trusted with sensitive data. That means authenticated vulnerability scanning, where testers work from inside the system rather than knocking on the front door; static and dynamic testing, which examines both the code and the software as it runs; independent cybersecurity review; and formal authorization, where an accountable government authority signs off.

None of it is self-graded. We do not get to assert that we are secure. Someone outside the company has to agree, at every step. For anyone trusting this software with real operations, that is the standard they should demand.

Onebrief is also built for contested, low-bandwidth, expeditionary conditions. Why does that matter, for security and for the mission?

The environments where this matters most are rarely predictable. Command posts move, bandwidth is limited, and connectivity can be intermittent. If a platform only works under ideal conditions, it is not built for the mission.

So, we design for the hard cases. The platform must hold its security posture and keep a staff working from one shared, live picture even when the network is degraded. Getting that right is a core part of what we build.

Why does this matter, and why now?

It’s about combat power. Better military decisions are the fastest, cheapest way to create more of it, and planning sits upstream of almost every decision. Improve planning and you get decision superiority: commanders making faster, better decisions than the adversary, which lifts everything downstream. But you only get that if the software can run where the decisions are made. A brilliant planning platform that cannot operate on a classified network never matters.

Why now? AI is advancing rapidly, increasing both the advantage of better decisions and the cost of moving too slowly. A year of AI progress now can feel like a decade of change. At the same time, the old barrier, getting software live and authorized on classified networks, is finally coming down. This is the moment the most capable software can reach the most sensitive environments, and we would rather be early and proven than late.

What does this mean for the planners and commanders who use Onebrief?

It means modern, AI-enabled planning in the places they were told they could not have it. Teams using Onebrief have reported a 90% reduction in planning cycle time, a 50% increase in information accuracy, and roughly 20 hours of redundant weekly work removed per planning team. Instead of rebuilding the same plan across disconnected tools, the whole staff works from one live picture, and a change updates everywhere at once.

That is why adoption has spread across major U.S. operational plans and Geographic Combatant Commands. When planners can work faster without sacrificing rigor, securely and on the networks they already use, adoption follows.

Onebrief’s roots are in the military. Are the problems it solves unique to defense, or does it reach further?

It reaches well beyond defense, even though our roots are deeply military. The core problem, turning a flood of information into sound decisions quickly and securely, appears anywhere the stakes are high, and the coordination is complex. The military presents the hardest version of this challenge, which is why we built for it first, but the same platform and the same security discipline carry far beyond it. Solve the hardest version, and the solution tends to travel.

What do you see ahead for Onebrief?

More of the same direction, pushed harder. The goal has always been to make a command superhuman, in speed and in the quality of its plans. As AI improves, we get closer to agentic AI that can generate and pressure-test a plan against a thinking adversary, in simulation, before it is ever real, always with humans making the decisions.

None of that changes the discipline underneath. Every new capability must earn its place on the most secure networks in the same way, through real review and formal authorization. We will keep expanding what the platform can do while holding that line on security. That balance is fundamental to how we build, and we are only getting started.

2026 Tech Ascension Awards Winner Spotlight: Rubrik’s Dev Rishi on Securing the Agentic Enterprise

We sat down with Dev Rishi, General Manager of AI at Rubrik, to discuss the company’s recognition as the Best AI / ML Powered Solution in the 2026 Tech Ascension Awards and how Rubrik is helping enterprises securely adopt autonomous AI systems. In this interview, Dev explores why traditional, human-speed defenses are no longer enough, how agent identity and real-time governance can contain risky actions, and why instant recovery must become a core component of enterprise AI security.

Agentic AI is reshaping both offense and defense. How is Rubrik building security for — and with — autonomous AI systems, and what risks are you most concerned enterprises are underestimating right now?

Frontier AI models now chain vulnerabilities rapidly, collapsing the time between intrusion and breach and rendering traditional human-speed defenses obsolete. Passive detection and logging can't stop an autonomous agent once it turns destructive. Organizations need agentic cyber resilience.

At Rubrik, we secure and accelerate the world’s AI transformation by making security an enabler of agentic AI adoption rather than a bottleneck. 

That’s why we built Rubrik Agent Cloud (RAC). Powered by our Semantic AI Governance Engine (SAGE), RAC empowers organizations with all four pillars of agentic cyber resilience:

• Agent Observability: monitor every agent and MCP at runtime.

• Agent Identity: control access per tool call at speed and scale using fine-tuned AI.

• Agent Runtime Security: SAGE intent-driven governance to enforce policies, and detect agent errors in real time.

• Agent Rewind: the industry’s first undo button for AI which allows enterprises to roll back destructive agentic actions and restore clean system states

  
  

RAC enforces real-time guardrails across Microsoft, AWS, Google Cloud, OpenAI, Anthropic, and more based on policy intent, not rigid text filters.  

Agentic capabilities are built directly into our own platform through Rubrik AI, which adapts to each organization’s context and security threats and autonomously acts across Rubrik’s product portfolio. Rubrik AI performs the heavy lifting autonomously, keeping humans in the loop strictly for final judgment calls, rather than time-consuming multi-step investigation workflows. 

You recently announced a new product feature, can you give more details about it?

RAC Agent Identity is a new product expansion to solve enterprise AI's biggest identity bottleneck. AI agents are no longer just summarizing text, but taking actions on behalf of employees across SaaS applications, databases, and APIs. But static credentials and traditional access models were never designed for autonomous machine actors, creating an unmonitored shadow workforce in the organization. 

Rubrik Agent Identity stops giving AI models permanent keys to company systems. Instead, a smart security layer double-checks what the AI is trying to do in real time and hands out a temporary, single-use pass right before any risky action takes place. 

Identity has become the new perimeter — and attackers know it. How has your approach to identity security, authentication, or access management evolved, and what are organizations still getting dangerously wrong?

Rubrik Zero Labs research reveals that 86% of IT and security leaders expect AI agents to outpace their security guardrails within the next year, yet only 23% report having full visibility into the agents operating in their environment. The perimeter has shifted from human identities to autonomous machine actors. In today's organizations, non-human agent identities drastically outnumber human users, creating a massive, unmonitored digital workforce capable of executing complex workflows across SaaS apps, databases, and APIs at an unblinking pace. 

If you treat an autonomous agent like a human employee with permanent API keys, you hand an attacker master access. With Rubrik Agent Identity, we are redefining how autonomous actors are authenticated and authorized. 

• Zero Standing Permissions: Ditches permanent access keys for single-use, temporary passes generated only when a tool is called.

• Intent-Aware Checkpoints: Analyzes an agent's true motives before high-risk commands are allowed to run.

• Seamless IAM Integration: Hooks directly into existing setups like Okta and Microsoft Entra ID without rebuilding your identity stack.

• Instant Rewind: Pairs live access blocking with Agent Rewind, the industry’s first undo button to immediately reverse rogue actions or AI hallucinations.

  
  

Security teams are being asked to do more with tighter budgets and leaner headcounts. How does your solution help security leaders justify ROI and actually reduce operational burden rather than add to it?

Real AI ROI isn't about immediate headcount cuts. It’s a force multiplier that accelerates business outcomes without expanding operational teams. Requiring security staff to manually review and approve every routine AI action creates an unsustainable bottleneck that destroys the efficiency AI promises. By leveraging RAC, security leaders can shift from a slow block and review model to an automated inform and audit posture.

Non-engineering teams, such as Legal, can safely build self-service AI agents with the governance model RAC provides. 

Instead of focusing on misleading stats like "amount of code AI generated," RAC’s strategy drives actual business results, delivering new products months faster and fixing customer problems much quicker. It also eliminates hidden AI waste by giving leaders full visibility into tool usage, stopping long chat sessions that quietly run up massive bills, and automatically matching simple tasks to cheaper AI models. 

By pairing built-in safety guardrails with smart spending controls, security leaders can protect corporate budgets and lighten their team's daily workload as AI adoption grows.

What should be sitting at the very top of every security leader's priority list in the second half of 2026?

The top priority for every security leader right now must be a strategic pivot to agentic cyber resilience. Organizations must accept that traditional prevention and detection strategies are no longer sufficient on their own. Rubrik recently announced its founding partnership of CSAI Foundation’s AI Resilience Center of Excellence, a commitment to equip risk leaders with the resilience needed to confidently adopt and govern AI.

Other key priorities include:

• Shift from Prevention to Instant Recovery: When breaches happen in milliseconds, stopping every attack is impossible. Rebounding instantly is what matters.

• Embed Security into Daily Ops: Treat cyber risk as a core business muscle, not an isolated IT issue.

• Intercept Rogue AI in Real Time: Use dynamic controls to check an agent’s motives before it executes a destructive move.

• Fight AI with AI: Let autonomous defenses handle split-second threats so humans only step in for high-stakes calls.

How Tech Ascension’s Best Application Security Solution Winner Mend.io Is Rethinking Application Security for the AI Era

We sat down with Azi Cohen, Co-Founder and CEO of Mend.io, to discuss the company’s 2026 Tech Ascension Award for Best Application Security Solution and how Mend.io is helping organizations secure software as development becomes faster, more distributed and increasingly AI-driven. In this interview, Azi discusses how AI is changing the application security landscape, why visibility and risk prioritization have become critical, and how organizations can keep pace with development without compromising security.

Mend.io was named Best Application Security Solution in the 2026 Tech Ascension Awards. What do you believe sets Mend AppSec apart in today’s market?

The application security landscape has fundamentally changed. Organizations are no longer securing just proprietary code and open-source dependencies; they are also securing AI-generated code, large language models, AI agents, retrieval-augmented generation pipelines, system prompts and other AI components.

Mend AppSec was built for this reality, bringing application security, software supply chain security and AI security together in a unified platform. It gives organizations visibility across the code and AI layers of modern applications while integrating into the developer workflows they already use.

Just as importantly, Mend.io is focused on helping teams act on risk, not simply generate more findings. By combining contextual risk prioritization, reachability analysis and AI-powered remediation, Mend AppSec helps security teams focus their limited resources on the vulnerabilities that present the greatest business risk.

How is AI changing the application security challenges organizations face today?

AI is accelerating both software development and the complexity of what organizations need to secure. AI coding assistants are increasing the volume of code developers produce, while applications are incorporating new components such as models, agents and prompts.

That creates new security challenges. Teams need to understand not only whether traditional code and dependencies contain vulnerabilities, but also what AI components exist in their environment, how they are configured and how they could behave when exposed to adversarial inputs.

The challenge is that security teams have not received more people or more time to manage this growing risk. They need security processes that can operate at the same speed as development, with continuous visibility, automated testing, intelligent prioritization and faster remediation.

Why is visibility such an important starting point for securing AI-powered applications?

You can’t secure what you can’t see. One of the biggest challenges organizations face is that they often have far more AI embedded across their applications and environments than they realize.

AI can enter an organization through developer tools, third-party services, models, agents and APIs, making it difficult to track manually. Before organizations can assess the security of these components, they first need to understand where AI exists, how it is being used and how it connects to the broader environment.

That makes discovery the foundation of an effective AI security strategy. Organizations need a continuously updated view of their AI footprint that enables them to identify risks, apply the right controls and continuously test and secure AI systems as they evolve.

Why has risk prioritization become so important for security teams?

Finding vulnerabilities has never been the only challenge. The harder—and increasingly important—task is determining which vulnerabilities represent meaningful risk and where security teams should focus their attention first.

Not every vulnerability is equally exploitable or impactful. A flaw in a critical, internet-facing application may demand immediate attention, while a higher-severity vulnerability in an isolated environment may pose far less risk.

Mend AppSec uses contextual signals and reachability analysis to help teams distinguish between these scenarios and prioritize the vulnerabilities that matter most. This becomes even more critical as AI accelerates software development and increases the volume and velocity of code and security findings.

When teams treat every finding as equally urgent, AI-driven development can quickly overwhelm security teams and developers alike. Effective risk prioritization helps organizations focus on the vulnerabilities that pose the greatest real-world risk and allow security programs to scale with development without overwhelming the teams responsible for fixing the issues.

How does Mend AppSec help organizations secure traditional and AI-powered applications without adding complexity?

Security cannot become another bottleneck for development. Organizations need to protect applications throughout the software development lifecycle while allowing developers to move quickly.

Mend AppSec brings security for proprietary code, open-source dependencies, containers and AI components into a unified platform and integrates directly into developer environments, repositories and CI/CD pipelines.

Mend.io also extends application security practices into the AI layer, giving organizations capabilities to discover AI components, identify AI-specific weaknesses, harden system prompts, assess agent configurations and protect AI applications at runtime.

The result is a more connected approach to security that reflects how modern applications are actually built and operated.

What measurable impact can organizations achieve with this approach?

The goal is to reduce the time and effort required to identify, prioritize and remediate meaningful vulnerabilities.

According to Mend.io’s Open Source Risk Report, organizations that implemented Mend repository integration and remediation best practices reduced average remediation time from 271 days to 70 days – a 75% improvement – while increasing remediation rates from 13% to 40%.

We have also seen significant results at the customer level. Global advisory firm WTW reduced both developer remediation time and mean time to remediate vulnerabilities by at least 80% after implementing Mend.io.

These results demonstrate the value of integrating security into development workflows. When teams can prioritize risk and give developers actionable remediation guidance within the tools they already use, they can improve security outcomes without sacrificing development velocity.

What comes next for Mend.io and the application security market?

Application security and AI security will increasingly become part of the same conversation. AI is becoming embedded in how software is built, deployed, and operated, and security needs to evolve alongside it.

For Mend.io, that means continuing to expand visibility across the AI attack surface, strengthen risk prioritization and remediation and help organizations protect AI-enabled applications throughout their lifecycle from development and testing to production.

The goal isn’t to give organizations another endless list of vulnerabilities. It’s to help security teams understand what matters, prioritize the risks that matter most, fix them faster and continuously protect the applications they’re building.

AI is accelerating the pace of software development. Security needs to accelerate with it.