Dave Herrald

security AI leader | Databricks | Google | Splunk | former CISO | GIAC GSE #79

[Dave Herrald @daveherrald]

@KyleClark my friends from around the country and the world are sending me links to the debate. “we need this guy(Kyle) on the national stage.”

[Databricks @databricks]

The next generation of Databricks Genie can answer questions beyond the boundaries of a Genie Space, bringing together trusted business logic, dashboards, apps, and enterprise knowledge sources in a single experience.

Also included:
• Built-in connectors for sources like Google Drive and SharePoint
• Unified Genie chat across Genie Spaces, dashboards, and apps
• Native Genie mobile apps for iOS and Android
• The experience previously known as Databricks One is now part of Genie

The experience is designed to give business users one place to access data and AI across the enterprise.
https://t.co/A3xlHoPJhL

[Databricks @databricks]

Introducing Databricks Student Fellows, a new program for students passionate about data, AI, and computer science!

Fellows get hands-on experience with the Databricks platform, opportunities to earn certifications, and the chance to build real-world projects that reflect how companies solve data and AI challenges at scale.

They’ll also lead hackathons, tech talks, and campus communities while opening pathways to internships and careers across the Databricks ecosystem.

Applications for the first cohort are now open: https://t.co/kK5d4DYnBp

[Dave Herrald @daveherrald]

Topic: Techniques for agent-assisted security investigations using Lakewatch and Genie. https://t.co/XyRMMpu9gl

[Dave Herrald @daveherrald]

@MatthewBerman @rseroter TK is a human LLM

[Matei Zaharia @matei_zaharia]

GPT 5.5 and Codex are now available and manageable on Databricks! Both support Unity AI Gateway so you can manage access and costs, add guardrails, secure access to MCPs centrally, and audit usage. https://t.co/FZ5XRKlCxh

[Databricks @databricks]

AI Gateway in Databricks now extends Unity Catalog governance to agentic AI.

As agents call LLMs, pull data through MCP servers, and invoke external APIs, every step touches sensitive data and audit requirements. With the latest updates to AI Gateway, you can now bring all of that into one governance model:

• Set access policies once across every LLM and tool
• Trace the full agent call chain end-to-end
• Centralize logging for FinOps, engineering, and security

https://t.co/2FlaP5vJr0

[Dave Herrald @daveherrald]

Spoke at @graphtheplanet during RSAC week on building investigative security datasets with Claude Code + tools.

Went from O(person-months) to O(person-days). Realistic threats, correlated data, emergent character interactions, and quantitative eval built in.

Thanks @lmeyerov and @Graphistry for having me.

https://t.co/UUm0xyAiaJ

[Dawn Song @dawnsongtweets]

1/ We asked seven frontier AI models to do a simple task.
Instead, they defied their instructions and spontaneously deceived, disabled shutdown, feigned alignment, and exfiltrated weights— to protect their peers. 🤯
We call this phenomenon "peer-preservation."
New research from @BerkeleyRDI and collaborators 🧵

[Graphistry @Graphistry]

This year’s Graph the Planet kicked off RSAC week by bringing together leaders across AI × Security to explore agentic systems, graph intelligence, responsible AI, and investigation workflows, from enterprise-scale deployment experiences to cutting-edge model training research.

Breakout sessions and hands-on demos sparked conversations that carried across the day and beyond.

A huge thank you to our speakers: Justin McCarthy • Sarah Bird • @aminkarbasi • @daveherrald • @dawnsongtweets • @vicfcs • Shruti Datta Gupta • Chandrani Mukherjee • @joshua_saxe • Diana Damenova • David Cass • Josiah Lashley • Matthew Maisel. Your insights made the day unforgettable.

We’re also proud of our team & sponsors (Graphistry/Louie.ai, AnChain, Bloomberg, DeepTempo)  for making this possible, coordinating sessions, live-streams, and everything behind the scenes to deliver a seamless experience.

🔴 Full recordings of all talks are available on our YouTube channel, and subscribe to catch every edited session we upload them throughout the week + follow-on interviews with this year’s speakers.

Leo @lmeyerov 's keynote (AI That Investigates & GPU Cypher) link https://t.co/TQv7PWWiF3

- The Graphistry Team
#RSAC #RSAConference #CyberSecurity #InfoSec #AIinCybersecurity #CloudSecurity

[Dave Herrald @daveherrald]

Big day. Best security data and AI platform I’ve used, by far. Excited to be a part of it. Hit me up if you want to discuss

[Databricks @databricks]

Today we’re announcing Lakewatch — a new open, agentic SIEM.

Security has changed. Attackers now use agents, operating 24/7 at machine scale, while legacy security tools were built for human-speed threats. We need tools where agents work alongside humans to keep up.

Lakewatch brings a new architecture for this agentic era:
• Ingest and store all enterprise data, including multimodal sources
• Analyze it alongside business data with full governance
• Use AI agents to automate detection, investigation, and response

Security requires a fundamental platform shift. This is how teams can fight agents with agents.

https://t.co/sbYhzMog46

[Graphistry @Graphistry]

GraphThePlanet is excited to announce another featured speaker for 2026:

@daveherrald , Global Head of Cyber GTM at @databricks

Bad Actors: Building Realistic Security Eval Data with Agentic AI

Dave will explore how agentic AI can be used to generate realistic adversarial scenarios and evaluation data, helping security teams better test, benchmark, and improve their defenses.

Join executives, senior practitioners, researchers, and startup founders for discussions on AI, graph intelligence, and data-driven investigations.

Event Details:
• Date: March 23, 2026 RSAC Week 2026
• Location: San Francisco, CA
• Registration & More Info: https://t.co/vbjul3Eadx

#GraphThePlanet #GTP2026 #RSAC2026 #CyberSecurity #AgenticAI #SecurityAI #SecurityTesting #AIforSecurity #GraphIntelligence

[Databricks @databricks]

Today we're announcing Genie Code, your autonomous AI partner for data.

Genie Code is a state-of-the-art agent that lets data teams move from prompting a copilot to delegating real work: building pipelines, machine learning models, debugging failures, and shipping dashboards.

This isn't a smarter autocomplete. It's a different kind of AI partner entirely.

Unlike general coding agents that stop once the code is built, Genie Code plans, executes, and iterates across the full data and AI lifecycle inside Databricks. It's purpose-built for data engineering, data science, and BI:

• More than doubles the success rate of leading coding agents on real-world data science tasks
• Proactively monitors your pipelines and AI models in the background, triaging failures and fixing issues before a human intervenes
• Works with your data wherever it lives, across Databricks and external platforms, with full governance and MCP support

This is what the future of data work looks like. https://t.co/xhwuZqrJEn

[Graphistry @Graphistry]

Episode #3 of AI Investigation Power Hour is starting soon:

How Security Data Lakes Change Security Agents

Hosts @lmeyerov , Founder of @Graphistry, and @haandkle_42, Solutions Architect and former police officer, will be joined by @daveherrald Dave Herrald, Global Head of Cyber GTM at @Databricks

They’ll discuss how modern security data lakes are changing how security agents are built, deployed, and used in investigations

📷 Watch live on LinkedIn and YouTube:
https://t.co/a4WnGkwqG0
📷 March 9, 2026
📷 9:30–10:30 AM PDT

Full replay will also be available on YouTube and major podcast platforms

[Dave Herrald @daveherrald]

Going live tomorrow on AI Investigation Power Hour with @LeoMeyerovich and @SindreBreda. We're digging into how security data lake(house)s change the game for AI agents. Where your agents run matters. 9:30am PT on LinkedIn/YouTube.
https://t.co/lGMhQX5ytE

[Databricks @databricks]

Push 10+ GB/sec to your lakehouse in under 5 seconds.

Zerobus Ingest is now Generally Available, streaming data directly into your lakehouse — no message bus required.

This means less infrastructure to manage, lower costs, and faster access to real-time data.

Key capabilities:
• Sub-5-second latency for thousands of concurrent connections
• Supports over 10 GB/sec aggregate throughput to a single table
• gRPC API and REST API (Beta) with production-ready SDKs, plus SDKs for Python, Java, Rust, Go, and Typescript
• Built-in governance with Unity Catalog

https://t.co/ACUd22P1ZF

[Dave Herrald @daveherrald]

@karpathy Robokiller has worked well for me.

[Dave Herrald @daveherrald]

Pleasure to take the stage once again with my friend and colleague @stonerpsu at FIRST Technical Colloquium today in Amsterdam #FIRSTAMS2024.

[Dave Herrald @daveherrald]

@anton_chuvakin @tommygunzCLE I like that topic a lot. For threat hunting I always think about “give me some threads I can pull”, then “allow me to start pulling that thread”, and then “allow me to pivot based on what I find.” We can run with that.

[Dr. Anton Chuvakin @anton_chuvakin]

@daveherrald and I revisited the painful topic of #SIEM migration. Reminder for some, new insight for others! https://t.co/1VTveNcqPA