Veeam

And today we have with us Bill Gemza.

He's the Deputy CISO and VP of Cybersecurity and Threat Management at Veeam.

Bill, welcome and thanks so much for being here.

Hey, Brian.

Yeah, absolutely.

So there's a study that I'm going to ground this in.

And Veeam does a data trust and resilience report every year.

And they have a U.S. federal edition.

absolutely just thinking exactly that.

I used to have a lot of on-prem servers and we used Veeam as a product.

And it was really, really good at backing up Virtual Infrastructure.

Then they added 17,000 features to it and it became a schmuzzle.

However, when it adds not extra complexity, but extra functionality, it takes away from the channel.

So it can be a double-edged sword.

And so the other aspect of backup, for example, to your point, you used to have to get Veeam and hardware and whatever.

But also I could argue, if you've got a credit card and a Dropbox account, instant backup, right? And so there's not much that channels add into that piece.

The goal is to keep pace with adversaries who are rapidly adopting these technologies to increase the scale and precision of their attacks.

Let's turn to a pair of critical vulnerabilities in Veeam products, which are widely used for backup and replication in enterprise environments.

The first is a flaw in Veeam backup and replication That exposes guest operating system credentials in clear text within logs.

This creates a significant risk of credential theft and lateral movement as attackers who gain access to these logs can harvest credentials and pivot across the network.

Organizations using Veeam should urgently review their configurations, apply available patches and audit logs for any evidence of sensitive data exposure.

This incident reinforces the importance of secure logging practices and privilege access management.

It's a reminder that even trusted infrastructure tools can become a liability if not properly secured and monitored.

The second Veeam-related issue is a critical vulnerability in Veeam one, which allows unauthenticated attackers to coerce SMB authentication from service accounts.

But when you shift to a buying groups motion, when your fuzzy matching connects all the dots and you actively prospect into the entire committee, the economics change dramatically.

The Veeam case study in the Lee and Data Source proved this.

Right.

By moving away from individuals and adopting a buying groups motion, Veeam increased their average opportunity size by 40%.

Why? Because they were no longer selling a small license to one siloed department.

They were uncovering the needs of the entire organization and selling a comprehensive enterprise solution.

So many times, like, we ta- think about disaster recovery or, you know, disaster resilience or whatever else, and a- again, you think about, like, hybrid cloud computing.

And, uh, like, there's Veeam.

Veeam is a great product.

But anyway, so you have your virtualized infrastructure that's local, and the idea is that if your local infrastructure gets wiped out, all of your instances would auto-migrate up to the cloud, and then they would run on the cloud until you can get your local infrastructure back up and running.

Well, here's an interesting thing, right? In twenty twenty-six, what, what would happen if your cloud infrastructure gets taken out? Have you thought about the possibility of the cloud infrastructure failing and you having to bring that in-house again? I don't know.

What are your pricing? What's it going to cost per terabyte? Can I put it on my storage? Because guess what? If I can't put it on my storage, meaning cheap cloud storage, it doesn't work when you're doing 120 terabytes.

Here's one, Veeam, right? You like Veeam for backup?

I'll be honest.

I've heard of Veeam.

I know about Veeam.

I've evaluated them.

I, again, don't use them.