Cloudera cautions enterprises – Agentic AI raises stakes for data governance and SOCs

Carolyn Duby, Cloudera’s field CTO and cybersecurity lead, framed cybersecurity as fundamentally a big data problem – enterprises ingest tens of terabytes per day, need real-time decisioning, and must also retain long histories of telemetry to detect “low and slow” threats. That combination, she said, creates complexity and scale challenges that traditional security operations centre (SOC) tooling and point-product analytics struggle to address.

“Real‑time data and data in motion is vulnerable,” Carolyn said, emphasising that without encryption, provenance and the right platform controls, streaming data can be leaked or manipulated. 

She pointed to Cloudera’s in‑platform capabilities – including Apache Ranger for access control, Apache Atlas for metadata and lineage, and a provenance-enabled Cloudera Dataflow (based on Apache NiFi) –  as foundational to tracking how data is modified and moved through pipelines.

Also significant is how Cloudera integrates with existing solution components in a customer environment, for example a number of identity solution providers like Okta, to facilitate threat detection and SOC operations.

Data consolidation and the control plane 

A recurring theme in the conversation was fragmentation – hundreds of security tools produce telemetry in different formats, siloing context and driving high false positive rates. Alerts in one tool can lack the wider context needed to determine which cybersecurity event to prioritise and act upon.

When asked about data lake initiatives that could help to emerge anomaly patterns of under-the-radar “dwelling” threats, she explained that many security vendors are beginning to bolt on data lake foundations to their products. But these often narrowly focus on the vendor’s own telemetry, and do not create a truly open cyber data platform. 

“They don’t have that complete platform which has rigorous data and analytics capability,” she stressed.

Cloudera, for example, works with public sector organisations to build vendor-independent and air-gapped data-lake-style environments that can bring in cyber data from any source and in any format. This helps to avoid the cost and risk of shipping massive volumes of data to third-party SaaS tools.

She advised organisations to prioritise architecture work that consolidates telemetry into analytics‑ready stores or federates queries across systems. “You need a data warehouse that has all of the data that’s ready for analytics,” she said, pointing to technologies such as Apache Trino for zero‑copy or federated queries that let teams run analytics without constantly moving massive datasets.

Add to that, the control plane, combined with data lineage and cataloguing, which is the company’s answer to the governance risks many fear will arise as AI ecosystems are perceived as creating more fragmentation. “The control plane gives you visibility into everything,” Carolyn said, stressing that consistent governance policies across environments are critical to preventing a governance “fragmentation” problem.

Agentic AI – new risks, new protections

Perhaps the most significant message was about agentic AI. Carolyn differentiated dynamic, autonomous “agentic identities” from static non‑human service accounts, describing agents as multi‑tasking actors with the potential to access or move laterally across resources. That raises the need for granular, minimal privileges, compartmentalised agents, and rigorous sandboxing.

Cloudera’s cybersecurity lead said, “Let’s address the agents. You have an agent, they’re accessing data, and it really underscores the need for having that security and governance so that your agent is not going out and doing crazy things, and having observability (of it).”

She also emphasised, “The way that you architect your agents is important as well – you don’t want to have one agent that does everything; you want to have different agents that have more compartmentalised tasks and permissions.”

Carolyn referenced Gartner’s notion of guardian agents which she thought is a great idea. These supervisory agents that have oversight over all other agents were described as an emerging technology area and even though it existed as tools before, agents’ abilities to plan, reason, and take action “with such dexterity” today, is unprecedented.

“So, I think there is definitely going to be new classes of cyber tools and new ways to architect systems, like harnesses, guardian agents, guardrails, and methods to handle agentic identities. And Cloudera is definitely working with our customers to help them understand what’s the safest and most secure way of building agents.”