{"id":134200,"date":"2025-10-22T06:00:00","date_gmt":"2025-10-22T05:00:00","guid":{"rendered":"https:\/\/www.intelligentcio.com\/me\/?p=134200"},"modified":"2025-12-04T10:04:33","modified_gmt":"2025-12-04T10:04:33","slug":"after-the-perimeter-defending-at-scale-with-anomalis-ceo-ahmed-rubaie","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2025\/10\/22\/after-the-perimeter-defending-at-scale-with-anomalis-ceo-ahmed-rubaie\/","title":{"rendered":"After the perimeter \u2013 defending at scale with Anomali\u2019s CEO Ahmed Rubaie"},"content":{"rendered":"\n

Ahmed Rubaie learned to read systems on a factory floor long before he ran a cyber company. As a student he paid tuition at a ladder plant and found himself watching the line. \u201cAfter two days at the machine I had run out of things to think about, so I watched the work,\u201d he said. \u201cPlenty of jobs wanted a clear process \u2013 some wanted a robot. That is how I still explain AI. It is the same mechanisation instinct, only for white-collar work.\u201d The idea stuck: process first, technology as the scaler. \u201cIf you get the process right, tech makes it effective \u2013 and it stays effective as you grow.\u201d<\/p>\n\n\n\n

His first Silicon Valley tour was at Ariba when \u201cthe cloud\u201d sounded like heresy. \u201cPeople thought we were mad,\u201d he said. \u201cIt was never only about technology \u2013 it was about shifting risk. Instead of owning infrastructure and headcount you pay as you go.\u201d The software looked like procurement yet the value ran through finance. \u201cIn reality we were helping CFOs save money,\u201d he said. \u201cThat is where my affection for technology comes from \u2013 enabling the business.\u201d The lesson would become a habit: follow the money, then design the machine that moves it faster and with less risk.<\/p>\n\n\n\n

Security as management<\/strong><\/p>\n\n\n\n

Rubaie resists the habit of boxing security as a product list. \u201cI think of security and IT as one bucket,\u201d he said. \u201cAs digitisation expands data grows and the attack surface shifts, so security becomes a business discipline. It is risk management, like cameras in a hotel lobby.\u201d He entered the field first as an investor.<\/p>\n\n\n

\n
\"\"
Dr Ahmed Rubaie, CEO, Anomali<\/figcaption><\/figure><\/div>\n\n\n

Operating a security company turned curiosity into mission. \u201cEnterprise data volumes are daunting,\u201d he said. \u201cOur job is to give customers context so they can protect their environment.\u201d Context, in his telling, is the difference between a dashboard and a decision.<\/p>\n\n\n\n

Remote work dissolved neat perimeters and gave attackers room to evolve. The answer, Rubaie argues, is not chase but context. \u201cBy the time you read about an incident it did not happen yesterday,\u201d he said. \u201cArtefacts can sit in a network for years. Most tools only keep ninety days.\u201d Anomali\u2019s cloud architecture splits compute from storage so teams can hold and query long histories.<\/p>\n\n\n\n

\u201cWe run retroactive forensic searches at scale and correlate them with billions of live events,\u201d he said. \u201cDone well you move from reaction to prediction \u2013 you study behaviour and spot deviations before they bite.\u201d The point is to make time an ally. Keep the record. Use it.<\/p>\n\n\n\n

Polishing the Chevy \u2013 or swapping it<\/strong><\/p>\n\n\n\n

Legacy stacks need not be ripped out on day one. \u201cThink of us as an optimisation layer,\u201d he said. \u201cWe improve ingestion, filtering and correlation so teams can find the needle.\u201d Where culture and appetite allow he goes further. \u201cIn one large global financial institution we replaced a sprawl of seven or eight tools,\u201d he said. \u201cWe added an agentic-AI layer for analysts, trimmed and normalised data, enriched with intelligence and focused people on what mattered across petabytes.\u201d The result was stark. \u201cThey cut budget by more than half \u2013 and detections rose on the order of ninety percent year on year,\u201d he said. \u201cThat is disruptive architecture delivering more for less.\u201d<\/p>\n\n\n\n

For cautious shops the route is gradual. \u201cWe \u2018polish the Chevy\u2019 first \u2013 tune pipelines, clean data, prove value \u2013 then step forward when they are ready,\u201d he said. The test is practical: does the analyst\u2019s next hour change. \u201cIf a tool does not change what an analyst does in the next hour it is ornamental.\u201d<\/p>\n\n\n\n

AI with guardrails<\/strong><\/p>\n\n\n\n

Anxiety about autonomy is real. Rubaie argues for governance over panic. \u201cAI must be done the right way \u2013 with ethics and guardrails,\u201d he said. There will be job shifts just as there were on factory floors. \u201cHuman beings find new paths.\u201d He applies the rule personally. \u201cAs a CEO I use several AI tools in parallel,\u201d he said.<\/p>\n\n\n\n

\u201cI am not asking them to think for me \u2013 I am asking them to sharpen my thinking.\u201d The insistence is almost domestic. He tells his family \u2013 a surgeon, a financier, a future dentist \u2013 to look for the gains now, not wait for a policy to tell them what is allowed.<\/p>\n\n\n\n

When asked for a forecast he returns to the data plane. \u201cExpect convergence of IT and security,\u201d he said. \u201cRunning thirty tools on one side and twenty-five on the other to solve the same problems is waste.\u201d SaaS already won the argument. The arc, in his view, runs from systems of record to systems of intelligence to systems of action.<\/p>\n\n\n\n

\u201cThose of us who build in the valley should be judged by the actions we enable, not by the gloss of a dashboard.\u201d Action, in this frame, is the morning queue that is shorter and sharper, the retro hunt that runs across years rather than weeks, the board deck that shows risk and spend in plain figures not counts.<\/p>\n\n\n\n

Rubaie\u2019s factory tale endures because it shrinks the noise to craft. Define the work, wire the steps, let machines carry the load while people decide. \u201cTreat it as a data problem,\u201d he said. \u201cGet the process right and technology will scale it.\u201d The line has changed since the ladder plant, but the habit has not \u2013 watch the flow, tighten what is loose, and keep your tools honest.<\/p>\n","protected":false},"excerpt":{"rendered":"

Ahmed Rubaie learned to read systems on a factory floor long before he ran a cyber company. As a student he paid tuition at a ladder plant and found himself watching the line. \u201cAfter two days at the machine I had run out of things to think about, so I watched the work,\u201d he said. […]<\/p>\n","protected":false},"author":4338,"featured_media":115607,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[18762,14804,20272],"tags":[1530,908,562,184],"class_list":["post-134200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","category-cybersecurity","category-technology","tag-cybersecurity","tag-digital-transformation","tag-middle-east","tag-uae"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/4338"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=134200"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134200\/revisions"}],"predecessor-version":[{"id":134204,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/134200\/revisions\/134204"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/115607"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=134200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=134200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=134200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}