Security programs have put years of work into deciding who can reach a system and who can open a file. Once someone gets through, whether a person or an AI agent, the data on the other side is usually readable in full. As operational technology connects to analytics and AI, that gap now reaches environments where a bad decision can move something physical.
Bennett Indart is Senior Vice President of Product Incubation at NTT Research, where he leads Scale Academy, the incubator that takes technologies from NTT's research labs and prepares them for market. He has worked in technology for three decades, twenty years of it at NTT, building products from inception to scale in North America and for NTT's Tokyo headquarters. Scale Academy's first product is SaltGrain, a data security suite built on attribute-based encryption.
This is the full conversation behind an issue of InfoSec Leadership, the newsletter from InfoSec Relations. Hosted by Samarpita Pattnaik, a volunteer host at InfoSec Relations.
Watch the full conversation below or read the interview.
The transcript below has been lightly edited for clarity.
Tell us a little about yourself and the work you're doing at NTT Research.
Indart: Thank you for having me, Samarpita. It's been wonderful to be on this podcast. My background is thirty years in technology. I spent the last twenty years with NTT, a large Japanese telecom and ICT company. My roles have been pretty much taking products and services from inception and the idea phase to a level of scale, from large practices to small tools, within different roles in the company, both where I sit today in North America and for our Tokyo headquarters. Most recently, I've spent a little bit of time in a new role, which takes all of that learning over the past many years and focuses it on taking products to market. Not many people probably know this, but NTT is one of the old guards in terms of basic R&D spending. We spend somewhere in the middle of three point five billion dollars a year on basic research. These are big thoughts, things that won't come to market for ten years or so, but they're essential to continue to get the next breakthrough out there.
We're working a lot on photonics and the next generation of the internet and compute. We're working in medical systems, to help map the human heart, for example, into a digital twin so that it helps doctors diagnose and treat patients a lot faster. We have probably the premier cryptography lab in the world, out of our Sunnyvale labs at NTT Research. And timely enough, we started a lab last year that looks at how AI operates. Not producing AI systems, but actually getting inside the black box and understanding how it thinks, and we call that the physics of AI, which is appropriately named.
So I basically lead an incubator to take all of those things and sift through them, pull out the ones that are ready to go to market or have a market that's really starting to converge, and do our best to prepare them for a commercial life beyond research. That's my role. It's a really interesting and fun role, and I get to see a lot of different technologies across all of those different domains I just mentioned.
When an enterprise security team first takes responsibility for an OT environment, what do they typically misunderstand about the way data actually moves through it?
Indart: I'm not sure they misunderstand it. I think they're operating on a paradigm of years and years of systems and applications running at five nines and having to run for long periods of time. You talk about things like the water supply and the grid, the things that are critical, but also factory floors that need to have operational efficiency for a long period of time.
Some of the things that I see, at least from a data perspective, which is really my background, is that in the IT space, when you have new releases of software and new patches, they come out, and now with the age of SaaS, they come out pretty quickly. In the OT space, that's not so much true. A lot of these systems are old. They're legacy. They may not even be supported. And when they are supported, because they're so critical and they can't go offline, and offline time costs a lot of money, there are very structured paths to take them down to patch or to upgrade these systems, sometimes annually.
So when we start looking at today's environment and the impact that AI is having on accelerating the threat landscape, and on being able to find vulnerabilities very, very quickly, that whole paradigm of patch management and updates to systems in the OT space is going to undergo a completely different strategy. It has to. There are things like segmentation and micro-segmentation to be able to isolate issues. That's a good reactive path. In the IT space, there's zero trust, and zero trust is really a part of the entire network. Those types of things will help. And using AI as an offensive mechanism rather than just a defensive mechanism is also going to help. It's a pretty wild frontier right now in terms of where this market is going, but there are some really smart people working on the mitigations and the ways to make sure that our key and critical systems aren't compromised.
Does that change once organizations start putting more operational data into analytics and AI systems?
Indart: I think it does. Just the fact that AI's on the scene has changed the data landscape tremendously. In the business that we have today, we have coming out of one of our labs an encryption technology. It's been around for twenty years, and it's never been broken. It's called attribute-based encryption, and it helps to mitigate the risks of a data breach, but not in the traditional zero trust way of understanding the vulnerability and then cutting it off or isolating it. It actually focuses on the data, and I think that's one thing that we're missing in today's security landscape. We talk about zero trust, and we talk about making sure the perimeter is safe, and multi-factor authentication and role-based access control. But at the end of the day, if a breach happens and somebody does get through, or an agent does get through, the data is left kind of open in many cases.
So one of the things that our researchers have really tried to tackle is how we make sure that the data is really what we're focusing on, and that the data is secure and safe. With this algorithm I talked about, we've now created a product and a solution around it, and it's called SaltGrain. It's focused on the data, but in a way that is not just looking at a container of data like a document or a database or a spreadsheet. It has the ability to look inside that container and to identify what is PII, what is subject to compliance for the various states and GDPR and California and Australia. Everybody has their own data privacy laws. And then things that are important to the customer, like trade secrets if you're a manufacturer, or other financial information. We can go through a discovery and classification process to identify those things, using AI to help augment that, and then bring that back as a recommendation to the company. Here's your data estate, and here is the sensitivity profile of the data that you have in your company.
Then we take that and pair it up with your identity management systems, separate from what we do. We integrate with those systems and create the policy that then defines how people can see certain pieces of data. That's pretty standard zero trust, but it's at a very fine-grained level. It's not just looking at the title of a document and saying, that's sensitive, and HR or finance can see this document. We actually look inside it and say, this document has PII in it. It also has some financial information on the company, and it has some sensitive discussion in a memo about an upcoming M&A. So there are three different ways to view that, and three different types of people that should be viewing it, and others not.
So what if you could take each of those pieces, for each of those different functions, and encrypt them specific to those functions, and then circulate that document knowing that if somebody from HR with the right credentials opens that document, they see the PII and the things they're authorized to see, but they don't see the trade secrets and they don't see the financial information, on the same digital copy of that document? That's the interesting thing. If you can get to that level of detail, you're identifying the sensitivity profile of your data estate, but then you have to make sure that encryption stays with the data. That's the second thing that we've done. We've attached that encryption to those pieces of data, along with the attributes that say who and what and when you can see this, and so it travels with it. In zero trust, it's all about what's inside the perimeter. But what happens when it goes outside?
We've started talking about SaltGrain as the sovereign data solution. You control it. It makes the data sovereign to you, to your company, and you dictate who sees it, when they see it, and where they see it, because attributes can be anything. It can be a function, like PII in HR. It can be a location, like a region of the company, so geolocation. It can also be time-bound. You can say that between these dates, this role is valid to see this document, and after this date, it's not available.
So what does that do to the threat landscape, and what happens when attackers come in and breach the perimeter, reach the applications, and get their credentials? Before, when they got that data, they could see it and they could exploit it. Now they can't. It's gibberish. It's not usable. It's ciphertext. We believe this is pretty revolutionary, and one of my mandates is to get it out to the market so that these companies can take advantage of it.
Businesses want OT data for analytics, predictive maintenance, digital twins, and increasingly AI. In practice, what connections between IT and OT do security teams tend to underestimate?
Indart: I go back to what we talked about earlier with AI and exploitation. AI doesn't know whether it's IT or OT, first of all. It's crossing the boundaries. So both groups need to work together to understand how they can react, as well as be proactive, in this new AI threat landscape. And I get back to data again, because data is what runs everything, and AI runs on data. It eats data, it understands things, and it makes decisions, or at least outcomes, from that. We see it all the time. But it does it in a much accelerated fashion.
So with what I talked about earlier with OT and patch management, with downtime schedules being quarterly, monthly, six months, or even a year, you have a problem when you bring your line back up and it gets attacked the day after you've patched everything, because some AI bot found a vulnerability, and your next patch is a year from now. That's a big issue. So you need to work with the CISO environments to make sure that your OT and your IT are separate from a physical point of view. You want your corporate environment to be segmented from your operational environment. But that doesn't mean that the practices on each should be different. They are the same, I believe. It all needs to be protected.
Traditionally, IT focuses on privileges and data management, and on operating the corporate side of the business, the sales functions, the marketing functions, the HR functions. And then you have OT, which is really focused on the manufacturing or the operational side of the business, the systems and the robotics, how things get created into product and then out the door. But OT, in finer detail, is about how things react. You have your sense, like a temperature sensor on a plant floor that is looking for temperature in a range. When it goes out of bounds, it senses that, looks at the problem, looks at the history of what had happened, when it happened, and what the different conditions were, and then it acts on that. And now we're automating all of that with AI. So you need to make sure that that AI is not corrupt or infiltrated to do something to a drone or a valve in a water plant. Those are really important things to make sure we're guarding against, an AI attack, because they can be very critical. So I think IT and OT are actually converging in that respect.
Security says reduce connectivity, and the business says it needs the data, and AI raises that pressure. Do we reach a point where securing the connection between IT and OT isn't enough, and we have to secure the data itself, independently of whatever system happens to hold it?
Indart: I think that's a very good question, and as I mentioned, our product today is one way to attack that. With SaltGrain, we make sure that the data that is critical for these operations is only accessible by a trusted automated agent. If a rogue agent comes in, number one, they don't have access to that data. And if they did see it, they wouldn't be able to make any sort of decisions based on it. So that's one way to mitigate that, to your point, to secure the data in a way that segments out the good players from the bad players.
A lot of enterprise security is still all or nothing. You're either authorized to access a document or you're not. What changes when encryption and access policy apply to the content within a document rather than the entire file?
Indart: One thing I would change in the question is that we're not actually challenging today's environment or zero trust. We're complementing it. Zero trust is very, very important in today's security profiles and the way that we address any threats, malware, ransomware, the things that come in and out. I have this diagram, and it's concentric circles. You have the network on the outside, and you have the application layer on the inside, with role-based access controls and all of those things. They're all making sure that the right person gets access to the right systems and the right data. But when they get access through the first two layers, if we're looking at a very basic diagram, network and application, in many cases they have access to all the data. This is where we come in. Once you get to that data layer, we apply this extra layer of security on top of it. And we also allow it to be able to travel outside the organization. You have applications like supply chain, or you have a financial trading partner in a transaction, and you need to share information back and forth. Now you have the ability to do that in a much more granular but still trusted fashion.
One of the capabilities of our system is what we call multi-authority. If you're a pharmaceutical company doing research with multiple different research entities on a drug, or you're doing discovery on a lawsuit where multiple parties have to have access to a data vault, so to speak, that data vault can now be controlled by multiple different authorities. They control the things that they put in it and who can see it, but it allows multiple individuals to be able to make a judgment. Same thing with supply chains and anything where you're handing information back and forth.
And then the third thing that I would say, where we really are complementing and looking toward the future, is that today we have AI. There were a bunch of executive orders that just came out from the US government around post-quantum and making sure that government agencies are ready. So there's now a heightened interest in and acceleration of making sure that our government systems, our critical systems, are post-quantum compliant. It just so happens that we've already done that work for the algorithms that we have within SaltGrain to be post-quantum compliant. So we're looking at today, but also into the future, because it's widely known that hackers today have taken data that has been encrypted, and they're just waiting. They're just holding onto it until a quantum computer or some algorithm can break current encryption, which will happen. So you have to look back and ask how long the life cycle of the data in that breach is. Is it account statements from my bank account, or is it a critical trade secret for a patented technology that is ten years from coming out? We have to make that decision as well, but we're hoping that we can at least provide that trust that whatever you encrypt today with SaltGrain is going to be safe when the quantum environment happens.
So two systems could technically have access to the same document while cryptographically being allowed to learn completely different things from it?
Indart: Yes. One of the examples I like to use is a simple one, but I think everybody can understand it. We're using AI agents today to do tasks that humans would do in the past. Let's say you have a large company, and they have their annual stockholders meeting. Maybe they're a public company, so they're doing it publicly. In the weeks before that, they just get inundated with requests for information for their investor relations department. So the investor relations department says, we're going to create this army of bots, the agents, that are going to help answer the questions and give out the response to the best of their knowledge. The restriction that we're going to put on these agents is that only publicly available information is approved to be disseminated. So your annual reports from the past, your quarterly statements, all of those sorts of things. But what happens if they get access to something that's internal and not publicly available? In our case, if it's encrypted with SaltGrain, based on the attribute rules that we have and the policies that we create for that company, that agent wouldn't be able to use that information. So the input is restricted, and the output is trusted.
If an AI agent only needs three pieces of information from a document containing fifty sensitive fields, why should we expose the other forty-seven at all?
Indart: Exactly. And the other thing that's interesting about that is there's a subsegment of the AI market that is starting to show. There have been AI routers in the past, and there's been a lot of activity around making sure that your request is being serviced by the best model, whether it's high-end or something a little bit more mid-market. And then there's this next class, which I would call orchestrators, or control orchestrators. They're actually there to help control how AI is being used within the company. We would fit into their system processes as a component to ensure that when there is sensitive information, there is an additional amount of scrutiny paid to it, and in many cases encrypting it with our technology will keep it safe.
We know that AI's new and it's getting better, and there are still lots of hallucinations and lots of things to be concerned about. But we want to make sure that if you're using AI, you can use it and trust it. From a data standpoint, it may be trying to do things it's not supposed to, but because we have this extra layer of protection, it's not going to be allowed to see it or make any sort of inference or output regarding it. That, in a way, is our trust model. And I go back to the tagline that we've given SaltGrain, which is sovereign data. Your data is sovereign. If you use SaltGrain in the way that we described it, you will maintain the sovereignty of that information. It is yours.
When AI agents become first-class users of enterprise data, does our existing identity and access model still work, or does security policy need to move down into the data itself?
Indart: There are a couple of things I would bring up there. Our existing way of treating a human user should be applied to agents and non-human users. The only problem with that is that the mechanisms by which we do it will have to change, because there's no interface for AI. There's no facial recognition for AI. There's no multi-factor authentication for AI. So we have to be able to uniquely identify the agent, and then uniquely provide that agent with a profile in our policy that is very similar to what identity management does today when I log in and get my Okta prompt. A mechanism to be able to say, yes, this is the agent, and this is the policy by which they are governed. And if that is true, then our system of encryption is just another layer on top of that, to say that if they do something at this point that's not authorized, then we have a backstop. So there are a lot of modifications to the way that we treat the entry point for the human interaction, because AI doesn't have those traits. There's no interface. But we still need to make sure that we authenticate these agents, and that they are doing the things we ask them to do and not the things we didn't.
So in that model, we move from "I trust this identity, so I give it the document" toward "I don't necessarily trust the environment at all, and the data itself determines what this identity or agent can recover"?
Indart: That's true. Just treat them like any other human. If a human gets in and they are trusted, then they see what they need to see, and we authenticate them through attribute-based encryption to reveal the data that they can see. It should be the same. All I'm saying is I think the system and the interaction model are different.
If the access policy travels with the encrypted data, what security assumptions can an organization stop making? Does it matter less whether the data ends up in the wrong cloud, the wrong application, or outside the network entirely?
Indart: I think it does matter a little bit less. We've talked to some very large companies who use multiple clouds, just like your typical multinational organization. And there's this concept of sovereignty of the information, sovereign cloud. A lot of software companies are now having to create a sovereign cloud to address the needs of their customers, and also the needs of the countries that they are working in. Like I mentioned, Australia has regulations now that require, in certain cases, data not leaving Australia. And the same thing in the privacy space. GDPR has very strict requirements, and penalties if they're not adhered to. So I think it will actually help mitigate the risk. It will also help, hopefully, bring down the cost profile of supporting a lot of these efforts. Not to mention the big one, which is what happens when there's a breach and you're now stuck with multimillion-dollar ransomware. Those are the sort of intangibles that are real dollars, with real implications to an organization. So I do think it'll change the landscape a little.
An AI system supporting a power plant or a manufacturing environment needs enough operational data to make a useful decision, but it shouldn't necessarily see every piece of operational, personal, or commercially sensitive information around that decision. Can fine-grained cryptographic access become a practical control in that kind of environment?
Indart: Certainly. We've had applications that are part of air-gapped solutions, for example. When you talk about critical infrastructure, one of the ways to mitigate risk is to air gap it, power plants in particular. The operational environment is not able to access anything outside, and it's just self-contained. So this certainly could work the same way. The data that is accessible by either humans or non-humans can be regulated by attribute-based encryption.
The usual answer to risk has been to give a system access and then monitor what it does. What you're describing introduces a different option, which is not giving it information it never needed in the first place.
Indart: That is exactly right, but you made a good point, which is that we always have to monitor. I'm not saying don't monitor, and I'm also not saying don't analyze. Let's make sure that it's doing what it's supposed to be doing, and over time we'll get more confident that it's doing what it's supposed to be doing. I think there's a lot of skepticism about AI today, rightly so, so we should continue to monitor it. We should continue to have logging to understand what it's accessing, when it's accessing, and where it's accessing, and do the analytics around that, and we can use AI to help with that, to see the patterns. That's a pretty standard cybersecurity posture, especially on the offensive side, making sure that we're looking at things and understanding where the vulnerabilities are, but taking into consideration the way that things have operated in the past. What's the normal operation? If they start to see something that's outside of that, it immediately raises a flag. That's pretty standard.
PLCs have been making decisions about physical processes for decades. What changes when an AI system can not only act, but dynamically request, interpret, and combine information from across the enterprise?
Indart: That's a good question, because with automation, in certain industries, we've become very comfortable with it. And if there's an attack, or even a silent monitoring attack that's just waiting for the opportunity to show itself, those are real problems and real challenges that security professionals are dealing with every day. If you think about an automotive plant and all the automation that's in making a car today, think about what could happen if a rogue agent, a rogue AI, gets in and starts wreaking havoc with those systems. So I think it's a real issue. We talk about AI in a data sense, but you're bringing up AI taking over systems, in certain cases critical systems that impact the safety of plant workers, and impact livelihoods when the electricity grid goes down or when a water plant can't pump water. There are real issues with those systems today, and I think that's got to be something we focus on as a society.
What has to be true about the model, the data it can access, and the controls around it before an autonomous system can act on physical processes without a person approving that action?
Indart: I think it depends on the criticality of the process, and the impact that process has. A robot making coffee in a vending machine is not a real critical issue. If it doesn't make your coffee, you go find another place to get your coffee. But a critical system in a manufacturing plant that goes down costs money and costs downtime. So that's where we need to really focus, on how we can make sure that the information we're giving these autonomous systems is the right information. Back to the same questions we had earlier. Is it the right information? Is it just enough information? And then there needs to be some exit point where a human gets involved, less and less as the system learns and works within its normal range, measuring temperature or vibration or whatever it's doing.
One of the other things that our lab is building out, and we demonstrated it in April at our annual conference, is a chip that can sit on the edge and actually do inference right there on the edge. It doesn't have to call home. It doesn't have to request information or ask a question of a larger model. It actually can make decisions at the edge, at the endpoint. I think that's interesting in and of itself, because if it's isolated at the edge, then the compromise could be isolated and segmented also. If there's a breach, you can just home in on that one node. That's another thing that I think is coming, the ability to make decisions quickly, as close to the source as possible.
Attribute-based encryption has roots going back more than two decades. What had to change for an idea like that to move from cryptography research into something you believe enterprises can actually deploy?
Indart: Just like with any startup, it's product fit, and whether the market is ready. In this case, we're in a position now where there's a convergence of cybersecurity driven by AI, and a proliferation, a tsunami if you will, of data that's being created because of all of these edge systems, and then the AI that's going through and creating more data on top of that, the inference systems as well. It's kind of like a perfect storm. So for SaltGrain, that's the story. It's been around in the lab, and it's been tested. The algorithm, as I mentioned, hasn't been broken. It actually won a Test of Time Award from the leading cryptography research institute, which is decades in the making. So a lot of those things are there.
But first of all, it took a couple of POCs that we had done through our internal distribution channels, making sure that the technology was sound, because a lot of ideas that come out of labs that have great potential need a little validation. You need to be able to make sure that it can work in the real world. We've done a lot of that over the last couple of years, and it got to the point where we said, we need to act now. So our leadership said, let's look at this. In a sense, if you take the Silicon Valley model, NTT Research is providing that seed funding in this incubator for a company like SaltGrain. At some point, we will launch it to the world, where it will have outside investment, it will have customers, it will have all of those things. And that's rapidly coming to fruition right now. We're in the middle of that stage of growth.
When you take an algorithm out of a research lab and try to make it an enterprise security product, where does the hardest engineering actually happen? In the cryptography itself, or in everything you have to build around it?
Indart: The cryptography, as I mentioned, has been around for quite a while, and the libraries that have built it out are sound. That wasn't the challenge. The challenge was, and is, to create what is essentially a feature, encryption and decryption at a very fine-grained level, and to build other capabilities around it. The example that I always give is that attribute-based encryption works really well if you know what you need to encrypt. Simple as that. I've identified a piece of data in a document that I need to encrypt, and these are the attributes I'm going to give to it, the reason why it's encrypted. So we went to the other side of that spectrum and said, we need to make sure that we have the ability to discover data. That's kind of the tip of the spear, using AI and automation to help with that. My hypothesis is that most companies know where their PII sits, and they probably have a good idea of where all their financial information sits, but in the entire data estate of a corporation, that's probably twenty to thirty percent of their data. There's a lot of other data that sits around in OneDrive or in different systems that could be, or should be, considered sensitive, and we want to help them with that. So, discovery.
And then once you discover, you do a classification round. We have a classification engine that we've built around this kernel of ABE. Once we've identified the data that we believe is sensitive, it gives a recommendation to whoever's governing that in the company's leadership, the governance team. Then we go and classify it. We get input from the company and look at the type of data that we discovered, and we classify that. Then we marry it up with the policy. Here's the sensitive data, and here is the identity management system, like Okta or Microsoft, that is helping to make sure that zero trust is being enforced. And there's a policy that then happens. Identify the person, what their profile is, and what attributes they have access to. All of those things happen there. And then the last piece is encrypt and decrypt.
So to answer your question, we built a whole bunch of systems and software around this kernel of attribute-based encryption to allow it to become a product that was ready for the market, rather than a research paper or a research algorithm that's just sitting there waiting for somebody to look at it and play with it. That's the short story. There's a lot that came in the last year and a half that we had to build around it to get it ready for market.
For a security leader looking at AI agents today, what should they be asking about data access that they probably aren't asking yet?
Indart: Are they paying attention to the data? As I said earlier, we use zero trust as our launching pad, but there's a whole ecosystem of vendors out there that just focus on securing the perimeter of a company. I think a lot of CISOs would agree that they're not doing enough today to actually secure the data. There are mechanisms to secure information in transit, through email and AES encryption and things like that, which are sufficient. But again, with this new threat of AI, the breaches and the attacks are only going to increase. The attack surface has now become infinite because of AI's ability to accelerate and assimilate. It learns quickly and then moves on. We saw it with some of the news around Anthropic being able to identify vulnerabilities just three or four months ago. With that kind of a landscape, I think spending more time thinking about the data, and the data profile of my corporate data estate, would be worthwhile.
If you could add one question to every CISO's AI security review, what would it be?
Indart: I think I just answered it. How are you securing your data? How are you securing your data not just when it's inside the corporate system, but when it's outside?
What is something you believed about protecting enterprise data earlier in your career that you no longer believe?
Indart: That's a really interesting question. I hate to say it, but I come back to this. I believed that data was secure at a certain level. I'm not a very deeply technical person when it comes to understanding the innards of how it's done. But when I started talking to some of the cryptography folks and learning about what they do and how they do it, it was just fascinating. So I think that's probably the one learning I have. I get back to it again. Are we sufficiently protecting the data from hackers, both human and non-human? And then the other side of it is the trust model. AI's here to stay. How do we make sure that it's trusted, and that we enable it to do things that are productive and keep it from doing things that aren't? To me, it all goes down to the data and the usage of the data, whether you're sitting here talking about ChatGPT and sending your personal information in a prompt that's going to be on the internet. Corporations can't do that.
Read the full issue drawn from this conversation in the InfoSec Leadership newsletter by InfoSec Relations.