Backup Data Becomes a Security Signal
Alan Shimel speaks with Joe Hladik of Rubrik Zero Labs during Techstrong TV’s Black Hat 2026 coverage. Their conversation explores AI threat intelligence and the changing role of backup data in enterprise security. Hladik explains that Rubrik Zero Labs looks at anonymized telemetry and metadata to find patterns that can help defenders understand modern attacks.

Hladik brings more than two decades of experience across security intelligence, red team operations, incident response and architecture. That background shapes the way he views recovery and resilience. In his view, backup and recovery should not sit outside the incident response process. They need to be part of the same operational workflow.
Rubrik Zero Labs Uses AI With Human Tradecraft
The interview also looks at how Rubrik Zero Labs uses AI internally. Hladik says AI can help with logical analysis, malware reverse engineering and large-scale prioritization. The human team then adds the tradecraft. Researchers use experience to decide what is meaningful, what is benign and what deserves deeper review.

That balance matters because AI threat intelligence is not only about automation. It is about giving skilled researchers better ways to sort signal from noise. Rubrik Zero Labs uses that model to study threat actor tactics, tools and techniques across a wide set of security data.
Copilot Research Highlights New AI Risks
Hladik also discusses Rubrik Zero Labs research into Microsoft Copilot. The team examined how AI assistants process files, handle prompts and interact with back-end infrastructure. That research led to a sandbox escape finding that Rubrik responsibly disclosed to Microsoft before public discussion at Black Hat.

The specific issue was patched before the finding became public. Still, Hladik says the broader lesson remains important. AI assistants and agents create new paths for attackers. Security teams need to understand normal AI behavior before they can detect abnormal activity.
Context Matters More Than Basic Visibility
The discussion closes with a practical point for defenders. Many organizations already have logs from AI providers and platforms. The harder problem is context. Teams need baselines that show how AI systems normally behave, so they can spot malicious or unusual activity.

For technology leaders, the message is direct. Recovery, resilience, threat intelligence and AI security are becoming connected disciplines. Rubrik Zero Labs is positioning AI threat intelligence as a way to connect those areas and help enterprises respond faster when threats evolve.