Hi, and welcome to Backup Central's Restored All podcast.

I'm your host, w Curtis Preston, aka Mr.

Backup.

And I have with me my, uh, DIY flooring encourager Prasanna Malaiyandi.

How's it going, Prasanna?

I'm good, Curtis.

I'm good.

Um, how goes the floors.

It, it, it goes well as you see.

And you know, I've been sending you the photos that, you know, there was a, there

was a pause there for a while while my knee injured injury, uh, I don't know,

Well, I, Well, I think it was a knee entry,

but I think it was also like you were, you went to Hawaii, right?

You had other

was not too,

Yeah.

So it wasn't,

hard to do flooring while you're on vacation.

Yeah.

Bluetooth flooring,

It has resumed in earnest and I actually, what's,

once I'm done with the current room, which is the super hard room

where I have to work backwards.

I dunno if any of you ever done, you know, paneling or the luxury vinyl

planking or the laminate flooring.

There's a working for, there's a working backwards.

I am now currently working backwards as I have to in one of the rooms.

It's the hardest, it's the worst I'm doing.

Once I'm done with that, I will be half done with the project.

So I'm super, super excited to get to that.

Uh, and you're the only one who I can send photos and you're like, Good job.

And

you're the only one that like encourages me in my little DIY

Well, I gotta try, you know.

Well, here's the thing.

I live vicariously through your projects, so it feels like I'm working on it.

When you're working on.

I wonder how many of our podcast listeners also live

vicariously through my projects or are going, Gosh, shut up about the

flooring and get to the tech already.

I just wonder,

so if you, if you, Yeah, if you have a viewpoint

on this, please let Curtis know.

On Twitter,

Yes, at WC Preston on Twitter, uh, you know, we love to hear

opinions, you know, and just remember opinions are like, you know, noses.

Everybody has one and I usually pick my own.

Um, alright, so we're gonna bring on our guest today.

He is the CTO of Opti9 Tech, having been there since the late 90.

It could be found on Twitter, @SagiBrody, and LinkedIn as the same name.

It's having a unique name.

You get to go, right?

If you search on my name on LinkedIn, you get like

I think, I think I'm the only Malaiyandi, by the

Yeah.

You, you're definitely yeah, as well.

So welcome to the podcast, Sagi Brody.

Thank you.

It's, it's great to be here.

I could already tell this is gonna be a fun conversation.

Well, it, it'll be something, it'll

be, it'll be lively for sure.

Uh, the two of us talk way too much and we, we invite you to the conversation.

do you do any home DIY projects by chance?

I just finished, um, having a home built, uh, from scratch, but not

myself, a contractor, but, um, What I can tell you is I, I wouldn't do it again.

Um, it,

I hear that from almost everybody that actually has

a home built for them, um, is that it's a pretty stressful project.

But, uh, there, there's basically two groups of people though in this world.

There, there there's people like me who like to do a lot of DIY stuff, and I, I

like to do it partially because I like to process and I like to do it because I, I.

I get more, I can get more stuff done than what I could pay for if I

had to pay somebody else to do it.

And, but a but a friend of mine, uh, he learned from his dad the following

phrase, Do what you do well so you can pay other people to do what they do well.

And he does zero DIY and I can respect that as well.

It's all good, you know.

But, uh, anyway, so let, let's start with.

A summary of what, you know, when I see your company, I see you

talk a lot about hybrid computing.

Uh, what sort of, you know, give us an overview of the company to start with.

Sure.

Um, well, Opti9 is a, a managed cloud provider.

Two very vague terms, manage and cloud, um, talk all day about that.

But yeah, so what we're doing is, you know, we we're managing production

workloads for our customers, either in public clouds like aws.

Or in private environments like virtual private clouds or host of private clouds,

which we host in our data centers, which we have, uh, around the world.

And, um, so there's sort of like the line of business of, of taking

ownership and accountability for customers production environments.

And then we have a, the side of the house where we're providing managed offsite

backups and managed disaster recovery.

. Um, and I would say sort of what's, what's interesting or, or what we

find to be important is not, not so much the what, which is kind of what

I just described, but more of like the how, how do we, how do we integrate

those things within your existing framework of your network or security?

How do we.

Give you the best of both worlds so that you can consume these services

in a, in a way that looks and feels and acts like it's part of your

environment, but it's as a service.

So it, it's definitely a bespoke sort of model.

Um, and we, we get deep and, you know, a lot of people, a lot of organizations

have, uh, technical debt and skeletons in their closets and weird platforms

and you know, like sort of like the higher up the enterprise stack you

go, the more edge cases you encounter.

The less vendors that are out there that have an appetite to service

those, and for whatever reason, that's where we sit and we like it

Yeah, it's interesting cuz when you're talking

initially about Oh yeah, we do hybrid cloud, I was like, why would someone

choose like Opti9 tech, right?

Versus, um, go with like an AWS or someone or like any of the other public.

Cloud companies, but like you were just talking about, right?

It's all those skeletons in the closets, the unique situations that you have

the ability to sort of customize and support for versus like some of

the public clouds, which is like, Hey, just onboard whatever you have.

If it fits into what we have, great.

If not, sorry.

Yeah, it, it.

I would, I would guess what it sounds like is, you know, comparing you to an

aws, you, it is that m it's the m right.

You know, not, not everybody wants to actually manage a cloud environment.

Right.

They'll, they'll, they'll hand it over to you, but, uh, but they don't,

they don't necessarily wanna manage.

It sounds like you manage both the, the cloud side as well as the

on-prem side, and that's, that would

Yeah, well, so we're not actually, we're not

actually manag anything, managing anything at our customers

premises in their, in your office.

Um, but within our, our facilities, um, which are all over the world,

you know, we'll stand up a, you know, wanna call it a legacy environment,

like a private VMware cluster and you know, which, which is analogous to

what they have prem, which we can.

Lift and shift.

Um, but I, I think the overall, our, our tagline is Right cloud,

right workload, right time.

The idea is that, um, we wanna have the workload's best interest at heart.

And you know, years ago you would hear people, you know, saying, I'm going

all in, we're going all in with aws, we're going all in with Azure, We've

picked our cloud, you know, strategy.

And it, it's all gcp.

And now I think the whole market has woken up to hybrid.

And it's very safe to say hybrid because what you're saying is, I'm

not ready to make a commitment.

I might need this tomorrow.

I might need that tomorrow.

And that's what hybrid is.

It's, it's mixing them and.

What we're trying to do is to, to be, you know, sort of like

fiduciary to the workloads and really build a, a reference architecture

from a networking perspective.

Um, for mo, for, for the hybrid.

So if we are doing an audit on our customers environment and, you know, we,

they have some legacy perpetual workloads that are gonna cost a lot less in a

private cloud and be more performant.

We'll put it there.

If they're looking to build a, you know, retool an old I series retail

application and have it be cloud native, we'll put it on aws, it'll actually help

with the modernization of the app too.

So it's hybrid from a platform perspective, but also from

a migration strategies too.

But I would say most importantly, you know, people are already hybrid.

They have stuff in organizations, but kind of, you know, who owns the glue

between those platforms and who's.

You know, figuring out the integration strategies, and so oftentimes

we'll do that, you know, for, for mid-market companies, we'll, we'll,

we'll manage in both environments and we'll do the network integration

back to wherever they need it to go.

So if I'm, so, you know, I'm a customer thinking

about using you, so it sounds like I have to move if I, if I'm, if I'm

fully on-prim at this point, right?

I have to move my workloads, or you help me move my workloads to

either a cloud provider that you support or to your, uh, private

cloud that's in your colo facilities.

Is that, is that a correct summary statement?

If I want you to.

On the production side, but every, almost everything that

we do from a, you know, an, an offsite backup and disaster recovery

perspective is, is, you know, sort of responsive to existing environments.

So, uh, we have tons of customers that are just using us to manage

their local backups, um, and their backups to the cloud.

And when it comes to disaster recovery, and kind of answer your

question, why would somebody use us?

You know, again, there's no right or wrong.

I mean, go using AWS without a managed provider.

That's fine.

Um, using a data protection software and building your own target

environment and building your own DR strategy, that's fine too.

What we really ask people is like, and it's kind of like actually

kind of like the quote that you said from, from your dad before.

Look what is, you know, what do you have an appetite to be

accountable for and responsible for?

Do you wanna be in the business of managing your DR.

Runbooks in perpetuity and nudging to be tested?

And who, who should own fail over?

Who should own fail failback?

Who should own the consumption strategy, which is more important

than just moving bits and bites.

So that's where we, that's where, you know, it's all white glove.

We're getting deep.

We wanna see those network diagrams.

We, we wanna, you know, make suggestions that are, are usable and don't require

them to re IP their entire network.

You know, so it's all about that, you know, it's a, we fit for those

organizations that are looking to shift ownership and just hold

someone accountable to an sla.

Interesting.

Uh, and by the way, uh, before we continue, I'll throughout our usual

disclaimer, uh, I work for Druva, Prasanna works for Zoom, and this is

not a podcast of either company and the opinions that you hear are ours.

Uh, if you'd like to join the conversation, I am available

at WC Preston on Twitter.

Or, uh, you can reach me at w Curtis Preston gmail.

And, um, then, uh, also be sure to rate us, um, I think by the time, I

think by the time this goes live, our current comment special will probably

be over, but, you know, we'll see.

We'll see if we extend it.

Uh, the idea was to get, uh, I think it was like eight new comments by

the end of October, and I would continue to grow my beard and

look, look more like Santa Claus by

Come on, people You want to see Curtis

in a beard in a Santa Claus

beard

I'm, I'm, I'm, um, I've, I've been letting it grow.

I, I, uh, Sagi, I've, I've been trimming it pretty tightly, uh, kinda

like yours, and then I've been letting it grow because Prasanna over here

has a, is it a, is it a three or yet?

Not a three year beard yet, so it's

a two and a half year beard.

You're

So he didn't cut, He basically cut tast, cut his

hair or his beard since, um, Covid and, um, I don't know, it's some

sort of weird protest or something.

But anyway, if you wanna see me grow my beard longer for Christmas and throw

out a few more comments, we'd love to see comments, uh, on, uh, iTunes there.

Um, I I am curious.

So, so now, so the reason, right, so I get that basically you, you manage

on-prem backup environments, but if I'm gonna move my production workloads

to you, how I is, I guess one thing, and, and let's just assume for the

moment that I'm not gonna, I'm not gonna retool, I'm not gonna refactor,

I'm just gonna run, I'm gonna take my, my, my on-prem stuff and I'm gonna.

Your cloud or their cloud I, Is there a cost advantage of one versus the other?

Is yours less expensive than putting it, uh, you know, in

AWS or VMware cloud on aws

Well, almost everything is less expensive than VMware Cloud on aws.

Um, I know we're not, Yeah, it's not about vendors, but I think I can say, say that

as an independent, um, participant, um,

It doesn't excel in, in, um, cost effectiveness

is what you're saying.

I, I think though that, um, VMware Cloud on aws, the fact that

it's been successful is really a good story for folks like Opti9 and others.

There's a lot of companies that are running, you know, private cloud as a

service, and the reason that I think it's successful is, you know, and I'm

sure you guys understand, is people were gonna shut down data centers.

There's a lot of pressure on them to just sort of turn it off and they had

to move their stuff and, you know, EC2 on AWS is, know you can run VMs, but

it's not, the same as running VMware.

Um, you know, it's designed to run, you know, sort of swarms of instances.

There's no inherent per node redundancy, and it, it was

designed for a different use case.

Um, and they, and then you have the whole sort of just operational overhead.

These people are very, very familiar with the VMware interface and, and, you know,

that's what I've heard a lot about.

It's like once you have like a VMware admin trying to go beyond

VMware, they're like, No, no, no, no.

Kicking and screaming.

Yeah.

And so now you have, you know, basically move us to AWS because, you

know, you can't go wrong picking aws.

But, um, you know, so the right thing to do is, if you wanna bring it to EC2

and to AWS in general, is let's, let's, let's retool it to be cloud native.

Let's take advantage of PaaS, um, and SQL as a service and function as a service.

You know, how long is it gonna take to rewrite all these applications and do

we even want to rewrite all of them?

So, so VMC was this really good middle ground where it's like, Hey,

everything stays the same from a, from a technology perspective and interface

and operations and management, and you get to shut down your data center.

Um, and that's great.

I think what's different about companies like, like Opti9 and all the other

iterations that are out there is.

Vmc with vmc, they have to kind of, they have to kind of, it's like the Borg.

They have to assimilate everything into the AWS model.

And you know, that's a scale company.

So, um, you can't run a lot.

Like, for instance, you can't run a lot of the data protection

tools, um, that run on VMware.

They won't run on vmc, um, because you don't get sort of

native root access to esxi.

Um, and also if you try to put it inside your network, like one, one of the things

that I like doing, You know, integrating our cloud services into a customer's

existing MPLS or sdwan network from the closest location from the same metro.

So it looks and feels and acts like it's in just another node.

You, It's hard to do that with vmc and it's a lot of steps to go through.

So I use VMC as an example, you know.

That there is a model for these regional service providers, and if you can do all

the things that they do, they can do, but you have this level of flexibility

and customization and oh, you gotta put a half rack worth of networking

gear in front of it, no problem.

Oh, you have an MSSP that needs to monitor every packet.

No problem.

It's kind of like that, you know?

Um,

A bespoke model a little.

Yeah.

Yeah.

Um, but, but to answer your question on cost, the least expensive

solution is the one that is, it is best sort of tuned for the use case.

So I do think running a, a SaaS platform, a modern day SaaS platform on a private

cloud is probably, it's, it's, it's not gonna be very cost effective at scale

when you start talking about traffic and also to run perpetual VMs like

legacy ERP systems and so on, on EC2.

It's, it's overkill.

And I'd say one of the things that people forget when they move to the cloud is

they've all been sold on virtualization on-prem, years and years ago.

And one of the reasons was, um, based on over subscription.

Hey, you can provision 16 gigs of memory on all your VMs and only

use four or five or whatever.

When you move to public cloud to EC2, to Azure, you're going backwards.

You're paying for provisioned again, um, whether you use it or not.

Hey, that's okay.

If you're using Ansible or Puppet or cloud formations to automatically

deploy and resize VMs, who cares?

But if you're moving a perpetual vm, like you want that over subscription benefit,

so the private cloud retains that part of it for you, which is really interesting.

Mm,

I believe though, with VMC though, it would still hold

that same ability to over provision.

Right.

Just base,

within the VMC world.

Yeah.

Within the VMC world.

Absolutely.

And that's, that's a really big factor that I, I think regardless of where you

go, what you do, people, it just kind of like, just forget about that aspect.

Which is a big thing.

I think a lot of people don't realize, like the entire reason they went

virtualized was to deal with the, Yeah, I don't know the exact size and how

can I overprovision and not waste a bunch of resources and Interesting.

Yeah.

I'd never thought about the fact of, yeah, moving to EC2,

you're losing those benefits

And now instead of, instead of sharing something that you

own, you're now renting something that you don't own and you're paying, you're

paying for the whole thing, right?

I would argue that the better utilization of resources was the

OG reason for virtualization.

But to me, and again, maybe it's because I see things the

way I do, to me backup and DR.

Is like, if you do it right, uh, and, and things like ha and all of that stuff

that you can do with virtualization.

Like you can't do vmotion you know, with, with a, with a physical box.

Right.

It just, it just, well, you can, it just doesn't do anything right.

But, um, things like that, that just simp the idea.

It's just, there were just so many things that we could do from a backup

and DR perspective now that just simply weren't possible in the old days.

Now there was that period and you know, it sounds like Sagi, you've been

in this long enough that you remember that period when, when VMware came out.

and backup just broke, like, like overnight because everybody just kept

running their same old, same old.

Um, you know, And that's what created essentially the market for Veeam in

the first place was all the traditional backup products were just broke.

Um, and, and,

eventually we got there, right?

yeah.

I mean, our, our backup software, you know, was rsync.

That's, uh, what we ran, you know, a very long time ago.

And then VMware, there was nothing.

We, there, there was a script called, uh, Ghetto vcp, which

is what everybody ran, you know?

And, uh, It was called ghetto BCP for a reason, you know?

Um, but, but I agree with you.

I think once you get things, once you get sort of, sort of these, um, objects,

servers, connections, whatever, into, uh, like a virtual construct Yeah.

You can manipulate 'em in so many interesting ways.

Um, I mean, listen, we still do DR.

Today for physical servers and iSeries and P series and NFS and all the skeletons.

Do we like doing it?

No, it's not as easy as doing VMs.

Right.

the RPOs and RTOs are not the same, but you know, when

things are image based, there are so many cool things you can do with it.

I'll give you my favorite example is when people think about DR.

From, and I'm not like an old school networking guy, so from a, from a

connectivity perspective, um, whereas the virtualization might be replicated, you

know, using images in these cool ways, connectivity is still often thought of

in the old school way, where if I have, you know, three private connections

at my production, one's going to Fiserv and one's going Mackenzie, and

one's going to Bloomberg or whatever, and my MPLS, I, I still need to

duplicate all of those at the DR site.

And then I have to pay for double the circuits and I have

to have double the overhead.

And by the way, no one is monitoring those circuits until

I actually have to use them.

And then we find out they've been down for six months and blah, blah.

So one of the really cool things that we've been, we've been using, um, and it's

not something that we even sell, but if you look at these network as a service

platforms, um, the likes of Packet Fabric or Megaport, or even Equinix, uh, Ecx, you

know, if, if you take that cross, connect that transport circuit and you, and you

plug it into their fabric instead, you can fail over and fail back the physical

connectivity from production to DR.

Just like you do your VMs.

Right?

And and to me that's, that's the coolest thing, right?

Cause now I'm saving money and now I'm using that always during production too.

So if it breaks, I know immediately.

And I think it's tangible, you know?

Um, and it reduces the complexity greatly.

So this whole software defined, you know, buzzword.

For me as being someone who has to design DR infrastructure, um, I can

use that and leverage it to simplify and, and, you know, reduce the rto.

Prasanna Malaiyandi:

That's very interesting.

Prasanna Malaiyandi:

I never thought, like, normally when I think about.

Prasanna Malaiyandi:

Doing DR testing, right?

Prasanna Malaiyandi:

It's like, Hey, can I fail over?

Prasanna Malaiyandi:

Can I bring it up?

Prasanna Malaiyandi:

But the networking aspect you just talked about, right?

Prasanna Malaiyandi:

It's like you really have to validate that entire stack top to bottom.

Prasanna Malaiyandi:

Not only of does your VM come up, but does your app come up?

Prasanna Malaiyandi:

Is your networking all good to go?

Prasanna Malaiyandi:

Right?

Prasanna Malaiyandi:

Does all the connectivity services all come up as well that you need

Prasanna Malaiyandi:

in order for it to be operational?

Yeah, I mean, DR.

Uh, networking is like the dirty little secret of DR.

You know, copying data is, is easy.

I mean, you know, companies like Druva and Veeam and, and many others have

done a really good job of, of data replication and data assurance and,

and, and, you know, I mean, they're, they're just amazing at what they do.

Um, But devil's in the details.

And so the first question I usually ask is, how are you gonna consume?

You know, what does consumption look like?

And the answer kind of changes if we're talking about a full failover versus a

partial failover, and so on and so forth.

And then you, you add, you know, we, we, we just

recorded yesterday, we recorded a, an episode where we, we were, we've been

doing a back to basic series and uh, we recorded an episode yesterday that

was just like, why we back up and, you know, all the things that can go wrong.

That backup is backup and DR.

Are meant to fix.

And we, we talked.

A true disaster, right?

We were talking about things like hurricanes and giant floods that take out

regions and one of the real challenges is, okay, how do you do connectivity to your

apps when, um, everybody is now working out of Starbucks and you are running out

of a cloud provider in another region?

Um, you know, there, there's all those things that you have to count on that,

that, that aren't necessarily available.

Um, I, I wanted to go back to there, there was a thought that Prasanna

that you brought up earlier, I think that was you that talked about,

you know, the, the OG reason why we went with, with virtualization.

When I think about the cloud, like, like, like a true IaaS

provider, um, to me that big reason.

Like, it may not be it, it definitely is not the reason most

people go to the cloud today.

I, I think they, they go to the cloud for false reasons, but the

true beauty of, of an IAS vendor is that dynamic allocation of resources.

I need a VM boom.

I need a, I need a PaaS platform.

Boom.

I don't need it anymore.

Boom, , right?

That, that, uh, that, that automatic.

You know, allocation and de allocation of resources and paying

for them only when you use them.

That that's the thing.

Going back to when we talked about virtualization, the stuff that is

possible now that wasn't possible then that's the thing that is possible

only in a public or, you know, cloud environment or I guess private cloud

environment like yours as well.

Where you can just grab a bunch of stuff, use it, and then get rid of it and pay for

it for the three hours that you had it.

That, to me, is the beauty of the public cloud, and if you're not

leveraging that, you're not really, you're not really getting the,

the beauty of the public cloud.

I don't know what, what do you think about that, that thought?

You're absolutely right because, and, and I, I, I talk up, I

talk about that sometimes with people and I tell them, when you're paying for

EC2 instances, you know you're paying for the APIs, you're paying for the

pleasure of being able to do all that.

And if you're, and if you're not actually using it, if your goal is

to deploy 20 windows VMs with 16 gigs of memory and maintain that in

perpetuity, um, you're overpaying you.

Yeah.

So it is true, and I think people that are using, you need to be

using X number of PaaS features, you know, to really sell me on the fact

that you need to be in public cloud.

And you know, I would say in general today, With all of this,

the, the real threat is complexity.

That's the killer and everybody in it, they're part of their goal should

be on sort of watching complexity, sprawl and reigning in complexity.

Um, because, you know, as you're aware, you know, the more complex, the harder

it's to manage, the harder it is to ensure it falls into your resilience, you

know, goals, um, or your compliance goals

Or, Or your security goals.

Right.

Yeah, one of, one of my mantras is complexity equals risk,

Yeah.

Yeah.

And, and even like people that are like, you know, you have, you know,

departments going and, and just running, um, just using SaaS platforms.

I mean, it's great from a functionality, uh, perspective, but, you know,

how does that, how, how does that relate to those different things?

How does it relate to resilience?

And going back to, um, what you were saying before about

sort of DR testing, Right.

One of the interesting scenarios that's popped up with this and DR.

, you know, if you are, if part of your production environment is, you know,

Office 365 and um, Salesforce and Workday, and like you have, you know, critical

data that's sitting there, um, and your, your own applications are speaking to

them and integrated via APIs, can you actually do a DR test on your application?

Like when you bring up your app and DR.

I, if you haven't blocked off your firewall right?

And you start going in the app and making changes and playing with it and meanwhile.

It's connecting to your QuickBooks instance or your Salesforce, and

you're changing production data, like this whole thing around you.

You can actually poison your production environment by doing DR testing.

So, you know, we talk to our customers about that and you

know, how do you account for that?

And, um, it's not, so easy sometimes,

of the major platforms, you know, the say three

or four top platforms like that.

The one that I think gets that right is Salesforce, right?

Because they'll give you that sandbox environment.

There's not, I'm not aware, I don't think there's a sandbox.

Microsoft 365

Maybe you clone your SharePoint site

Yeah.

I mean, the sandbox is nice, but now you have to, you know, um, and we've probably

thought about this way too much, but now you have to, um, Where am I doing, Where

am I doing the, the split to the sandbox?

Is it in my application and I have to go tell all my devs to run two

configs and I hit a button in the app?

Am I doing it at the network layer where I'm proxying the connections

and I'm redirecting it to the sandbox?

And you know, going back to what you said, it's all, it's all either

way, it's all complexity and.

I don't think it's a problem, but I think these are some of the things that

people need to think about at the very beginning, before they go and run and jump

on this SaaS or that SaaS or this or that.

You really have to kind of look at the big picture holistically.

Yeah, if, if your DR test is going to be actually

changing things in SaaS environments.

Yeah, I hadn't even thought about that actually.

But if it is, you absolutely can poison your, your production environment.

I've seen it happen, happen with the hospital where they,

they turned it on and they use a third party, you know, pharmaceutical

service for prescriptions and they put in a test prescription and, you

know, all of a sudden something pops outta the machine for, for John Doe.

And it's not supposed to be there,

Oh

That's not good.

Yeah, I can think of all sorts of things where that happens and yeah.

My, my concern of the SaaS, the modern day SaaS world, as, as much as, you know,

I, I work at a SaaS provider, right?

But my concern of the modern day SaaS world is, well, two concerns.

One is the one you talked about about complexity.

You can have hundreds of SaaS providers that do various little things for you.

And, uh, I remember, uh, Prasanna, you remember when we interviewed that one

person who worked at a, you know, a startup, We asked them how many SaaS

providers they said, and they said 450.

, Holy crap.

Like how do you, how do you, like you said, how do you rein that in?

How do you manage, um, you know, provisioning to that and, and,

and, uh, sso to that and all that.

I mean, I guess that's what Okta's for.

But number two, and real, really this is number one, is, um, how many of

those SaaS apps have data that is critical to your production requirement

that, that your production environment that you're creating in that SaaS.

and then there is no backup of that data.

Right?

And the answer is all of it, right?

99% of SaaS customers don't do squat for backup of their SaaS environment, and

they think that people like you and me that happen to sell services to do that.

We're just being fear mongers when we tell them that Microsoft 365

might delete all their data one day.

It's, it's a very, there's so many bad assumptions in, in the industry.

I mean, not, it's not the industry, it's just the complexity.

You know, like it's, it's a good example.

And, uh, you know, with Office 365, certainly they have multiple

data centers and your data.

Is resilient.

If one of those data centers, you know, goes down or blows

up, you know, you're fine.

But, you know, can you, can you hit the rewind button and

bring back your office 365?

And, you know, as it looked like two weeks ago, you know, like you can do

in a, in a traditional environment.

No, you can't do that.

Absolutely not.

And I, I think there's, there's so many gotchas in the market.

I mean, one that, that we have been looking at recently, we actually

launched a product called Observer to kind of try to mitigate it, and it's

kind of been my baby, um, for the last few months, is we realize that the

backup and the backup and replication software running at the customer's

production environments have now become this sort of new attack surface.

Attackers are going after.

And it makes total sense if you're, if your golden life is to ransomware

companies and get as much money as you can outta them, then of course the

first thing you do when you get . In is you're gonna go look for all those

backups and those replicas and the DR site and try to destroy everything.

It increases your likelihood of getting paid.

And what we realized was that a lot of, a lot of people, you know,

mistakenly are using the same authentication for those tools locally.

And if an attacker gets into.

, Um, they can destroy everything at the, you know, at, at the DR site in seconds.

You know, there's no such thing as immutability when it comes

to disaster recovery for almost all, all the tools I've seen.

Um, and even with backups, there's immutability.

But you know, they can also delete stuff beyond that and they can

also disable your jobs and weight out the immutability timers.

So, and so what we did was we realized we're already connected into our customers

on-prem software, like just to pull whatever data we need to manage it.

And so what we started to do was we ran the, we are running the data through,

um, machine learning and artificial intelligence, and we're looking for,

quote unquote suspicious activity that an attacker might perform.

Um, things like, uh, encryption being disabled, um, on backups

or retention being modified, or, uh, jobs being modified, or

all the backups being deleted.

All these, you know, different things.

And we baseline what's normal for that site and what's not normal.

And then we set out threat alerts and we also, you know, integrate it

with some security tools cuz they don't have access to this landscape.

And then we also did this other cool thing where if and when this happens,

we can automatically air gap the offsite disaster recovery and backups environment.

So I'm really excited about that because within my organization everyone's like,

Oh, we should do more for security, we should do more for security.

And it.

How do we, like, we're not a security company, but this is an

area that we know a lot about.

And if most people are coming to us to buy those services because they're concerned

about security, hey, maybe we can, you know, address it in a more direct way.

It's another line of defense, if you will, right.

That says,

Yeah.

exactly.

I want, I wanna ask you Sagi, um, you

know, you're, you're a Veeam msp.

We, we've talked to Veeam a couple times on the podcast and, you know,

I've often wondered, what does a service provider look like for Veeam?

And you're actually the first one that, that, that we've actually talked to.

I'm, I'm curious to know.

Obviously, you know, the value of security in a data protection environment.

What is your, how, you know, you don't have to give away secret

sauce, but, but how do you think is the proper way to configure Veeam?

That's secure and, and also, If you're gonna do DR.

Right, um, you know, if you're gonna do DR as a service for somebody,

how would you be configuring Veeam.

Um, well, I mean that's, that's, you know,

part of our bread and butter.

Absolutely.

Um, you know, Veeam is, is a software and we're, we're

wrapping our services around it.

Uh, you know, managing.

Monitoring, securing and scaling.

Veeam is not the only data mover that we support.

Um, we support, um, Zerto and, and Itera and a few others.

Again, it's all, you know, what's, what's the use case and what's the best tool

in our, in our tool, tool bag for it.

Um, but you know, there, there's definitely some best

practices technically around it.

What I mentioned before, you know, around, don't tie it into your production AD.

I mean, that's probably the best thing you could do, I would say.

I mean, they support

amu.

man.

Yeah, I mean, they support immutability now.

They support hardened repos.

Um, obviously those are part of best practices.

I would just say like, like I said before, just really acknowledge

what business you want to be in.

If, if, if you are a backups administrator and you want to take

this challenge and own it, then great.

I mean, there's tons of good resources out there.

In fact, I've done webinars about, you know, with, with Veeam around

what, what are the best practices.

. Um, we also are selling this observer tool as a standalone.

You know, you can just, you can just layer it on top of your Veeam infrastructure to,

to alert you of these suspicious actions.

You don't necessarily have to use us for offsite backups or DR.

And so that's a nice middle ground, Right.

Um, especially because we're doing a lot more with aws.

So, you know, we want to be able to provide these managed services

without forcing our customers to use any specific target.

Right with, with Veeam.

So I, you know, I know they supported immutability to like s3 object lock.

If you're gonna do dr, though, you, you want that to be on on block, right?

If you're gonna do DR from it.

Yeah, So Veeam supports immutability with object.

They also support immutability with their local backup servers.

One of the great things and one of the horrible things about Veeam is

that there's so many components.

Um, if you're a, if you're a big shop, it's good because you can

scale those components individually.

Um, if you would just want the easy button, you can run

it all on one server too.

Um, but I think, I think understanding what bucket you fall, fall into

and find, maybe finding the right information with the right time

might not be the easiest thing when there's so many different variations.

Um, but yeah, you can run immutability locally.

Yes.

When we, when we provide disaster recovery as a service and for anyone who's doing it

on their own in house, you're replicating to production ready infrastructure.

And so it's, it's typically an all flash or a hybrid array.

Um, you know, the VMDK is essentially sitting there

registered, ready to be booted up.

And our customers, you know, there's no, there's no sort of,

um, transformation of the data.

It's, it's immediately available.

But that's also what makes it susceptible to, to what I was saying before, is

if the tool is constantly replicating, And somebody gets into the tool.

Um, and this is not just Veeam, it's, it's, it's the same with

Commvault and Rubric, and even Zerto.

Someone gets in that tool, they can hit a button and say, Hey, let's,

let me delete all the data at the remote rep replica, like instantly.

Yeah, it's a concern that I have.

And I'm sure you're aware of the, the news where we've seen of the

ransomware folks directly attacking different, uh, backup vendors.

I guess I'm wondering if there's any way to, to get around that.

Well, I think, I think using a service provider like,

like us is good because now you.

You have the separation of data, data, plane and control plane.

Um, you have this firewall, you know, in a way between the customer's infrastructure

that's tied to their authentication and the recovery environment.

You also, like, as you were saying before, the, the beauty of the cloud is, you know,

all the spin up and spin down if we're doing disaster recovery as a service.

We're not talking to customers about how many, how much CPU of memory they need.

We basically give 'em an SLA that their applications will perform just

as good or better than production.

There's no cost for the CPU or memory.

We manage all that on the back end.

And, um, you know, we're, we're managing the replication, we're

monitoring it, we're owning the failover fail back testing, all that stuff.

So it makes it very simple for them.

And as you know, there's, you know, a gazillion other things.

All these IT folks need to manage these days, especially with security

so they can kind of move on.

But I do really think that when people think about security, they're

missing the whole DR component.

Um, people also need an isolated recovery environment to, to, you

know, like if you look at the Colonial Pipeline hack, um, it's, it's, it's

not that they were down so long cuz they didn't have backups, you know,

they had a full copy of all their data.

The question though is where do they bring that back up from?

Um, and you're not gonna, you don't wanna override your production environment.

You need to do forensics and see how they got in and what happened.

Um, and so a, a true disaster recovery environment, one where you can kind

of boot off multiple snapshots, gives you the ability to have an

isolated recovery environment to bring up the app in a way that it's not

gonna, in fact, back to production.

And also to bring up a recent copy to, to perform forensics.

And a lot of people kind of throw backups and DR.

In the same bucket.

It's the same thing.

And to your point, no.

Two separate services.

Two separate use cases, two separate goals.

When we sell backups, it's landing on cheap and deep storage.

When we provide disaster recovery, it's it's expensive

performance storage, ready to go.

Right, right.

Uh, I, I remember just going back and thinking Curtis

to the talk with Tony Mendoza about Spectralogic and sort of the pain they

went through to recover from ransomware and how, just like identifying the

systems that they can boot from and trying to find like what is a known

good copy they could roll back to Right.

Took 'em days in order to just even figure that.

Yeah, their biggest challenge was just

figuring out what was infected.

Right.

What, what servers were infected.

So they did this, like what one?

I think that's what he said, right?

Where they shut everything down and then they brought everything up like one

server at a time to see if it was infected before they, Before they moved on.

Yeah, and that's a really good point.

That's half the battle, right?

So, and that's part of another reason.

Kind of when we built Observer, we kind of built it to, to give you

that, some of that information and all that, but that's, it's a challenge.

These are the things that people never think about until

unfortunately something bad.

happens

Yep.

That's why we have people like you and Prasanna and me

Sagi, because we just, we just try to get 'em to think about that sort of stuff.

That is the whole purpose.

Of this podcast.

Well, I think it's been a great, great discussion.

Uh, thanks for, thanks for coming on

Thanks for having me.

and, uh, Prasanna, you know, as always, and I'll continue

to keep you updated on my floor progress.

Good.

I wanna see finished pictures soon.

Tomorrow.

Tomorrow.

I'll see what I can do.

I'll see what I can do.

All right, and, uh, thanks again to the listeners.

Remember to subscribe so that you can restore it all.