Wake Up by Veeam

The episode contains a few genuinely useful points - the sovereignty-vs-locality distinction, the XDR detection gap for bring-your-own-encryption-key attacks, and the Lego-model supply chain risk - but large stretches are filler, product promotion, and generic security truisms that any practitioner would already know.

“data sovereignty is confused with uh, data locality or knowing where your data is stored. But data sovereignty is much broader, much more complex than that”

“But then how would you handle, for example, if the malware brings its own encryption key? So they cannot detect that.”

The XDR signed-code detection gap is the episode's one genuinely fresh technical observation; everything else - basics matter, GRC is ongoing, AI fills skills gaps - is standard cybersecurity discourse recycled without a contrarian or first-principles angle.

“the way that they do this is basically they check whether there's an, an external piece of code, unsigned, that is unsigned or is not using a trustworthy certificate that is trying to access one of the local uh, encryption engines or key generation engines”

“we don't have monolithic applications anymore like we used to to have. It's more the Lego model with different blocks possibly hosted on different platforms in different geos”

Jan Declerq is a legitimate 30-year practitioner serving as CTO for Cyber Services at HPE with real customer incident involvement, not a career thought-leader; however, the conversation rarely draws out depth commensurate with that seniority.

“I'm the CT for Cyber Services and I'm also leading one of our sub teams that is focusing on, on integrated cyber services”

“last week I was involved in the evaluation of an XDR solution”

A handful of anecdotes add texture - the customer with only digital playbooks, the monthly-drills customer, the Safe Harbor Act - but there are no named companies, no dollar figures, no failure rates, and no dated metrics; most claims are asserted rather than evidenced.

“they only had a digital copy of their, uh, playbooks and of their SPOCs. So that was a big problem”

“One of our customers is doing monthly um, recovery drills, uh, tabletop exercises, which is very good. We still have customers that, that maybe m do them once a year or even worse than that”

The host asks for one specific example on data locality, which is the episode's best moment, but otherwise leads witnesses, agrees with every claim, and devotes substantial airtime to Veeam product plugs and self-referential anecdotes rather than probing or challenging the guest.

“Can you give me an example? Because I really, really love that I've got m my own perspective, but maybe one specific example where locality isn't the complete story.”

“I totally agree with that. And I look at what veeam's doing in the market and especially the recent acquisition of security AI”