HPE Storage Presents at Security Field Day 16

HPE Storage Securing Data for the Quantum Era

Watch on YouTube
Watch on Vimeo

Quantum risk is not only about predicting when a cryptographically relevant quantum computer will arrive. Delegates will learn how to identify long-lived data and cryptographic exposure, prioritize migration decisions, build crypto agility, and create a phased post-quantum readiness roadmap that can begin today. Anthony Dutra, a technical marketing engineer at HPE, presented this session for HPE Storage at Security Field Day 16. He framed the threat around attackers harvesting encrypted data now so they can decrypt it once quantum computing becomes usable.

Dutra cited a readiness gap in which 87% of organizations are planning for post-quantum cryptography (PQC) but only 7% have acted. He separated PQC-capable products, which can support the new algorithms, from PQC-enabled ones, which have the capability turned on. His timeline began with NIST’s 2024 standards, set 2027 as the target for migration readiness, and put Q-Day around 2030. HPE’s recommended process is to discover sensitive data and how long it must stay confidential, prioritize by exposure lifetime and business impact, modernize through hybrid classical and post-quantum crypto agility, and validate everything. The inventory should cover data at rest, backups, archives, IAM, firmware, and software. When delegates asked about discovery tooling, Dutra said HPE currently uses only an internal readiness questionnaire and has no discovery tool on the roadmap. Delegates noted that customers often do not know where encryption lives in their environments.

On HPE’s own portfolio, Dutra said the Silicon Root of Trust in ProLiant servers already uses PQC-ready firmware signing. HPE is working with Brocade and Emulex HBAs across its SAN switches and arrays, and engineering is preparing Zerto as well. Storage remains PQC capable rather than enabled, because HPE has not yet validated the new algorithms on the data side. Dutra advised starting with the data that must be protected longest, migrating in phases that follow product roadmaps, and keeping trusted recovery copies throughout the transition. One delegate asked about data already stored under classical encryption. Dutra acknowledged that converting it would likely require migrating to a new array, a practical cost organizations should factor into their 2027 to 2030 planning.

Personnel: Anthony Dutra

HPE Storage Operational Resilience in the AI Era

Watch on YouTube
Watch on Vimeo

As AI increases the value of data, expands operational dependencies, and accelerates cyber threats, organizations need resilience that goes beyond traditional backup. Delegates will learn how an operational resilience strategy can protect hybrid cloud workloads, detect threats earlier, recover applications and data in minutes, and validate readiness to keep the business running through disruption. David Paquette, a product marketing manager at HPE, presented this session for HPE Storage at Security Field Day 16. He described operational resilience as the umbrella over data, application, cyber, and storage resilience.

Paquette organized his talk around workload, cyber, and AI resilience. He noted that AI adds new infrastructure to protect, speeds up attacks, and raises expectations of constant availability. Corrupt or missing data can also lead AI to return wrong answers and waste tokens. HPE Zerto Software groups virtual machines into virtual protection groups with defined startup orders, and the recovery plans released this year allow runbook-style testing across multiple groups. Zerto can also create sandbox environments on designated test networks for validating patches and migrations. Delegates pressed on several points. Paquette explained that IP conflicts are avoided by recovering into an isolated network and that Active Directory must already exist in the recovery environment. He added that HPE dropped Zerto for Kubernetes because most containers are stateless, though it is still studying that space. Zerto supports APIs and MCP and runs on VMware, Hyper-V, HPE Morpheus, AWS, and Azure. Its real-time replication detects ransomware encryption within seconds and tags recovery points, and it can create immutable copies from its journal.

At the storage layer, the HPE Alletra Storage MP B10000 also checks for encryption anomalies at the block level, so attacks can be detected at two layers. It includes immutable snapshots and a 100% data availability guarantee. The X10000 handles file and object data, and HPE StoreOnce provides hardened backup storage. As a last line of defense, the HPE Cyber Resilience Vault combines Alletra, Aruba networking, ProLiant compute, and Zerto. The vault has no network paths in and includes an isolated recovery environment. Paquette argued that recovery now has to be measured in minutes rather than hours. He also noted that resilience must cover rogue AI agents as well as attacks and outages. HPE’s position is that it already covers the stack from the virtualization layer down to storage across both on-premises and cloud environments.

Personnel: David Paquette

HPE Storage Securing the Agentic Workforce

Watch on YouTube
Watch on Vimeo

As AI agents take on more business-critical work, organizations need a strategy for recovering when automated actions disrupt applications, data, or supporting services. Delegates will learn how operational resilience, agent-aware recovery context, and protected backup copies can work as independent but complementary layers to keep AI services productive and recovery options open. Anthony Dutra of HPE presented this session for HPE Storage at Security Field Day 16, with David Paquette joining for delegate questions.

Dutra argued that rogue agents rarely cause traditional crashes. Instead, they make fast, invisible changes while everything appears to run normally, so the blast radius is hard to identify and rollback becomes all or nothing. HPE’s answer pairs two layers. HPE Zerto Software provides continuous, VM-level protection with a recovery journal. HPE StoreOnce adds policy-based, deduplicated backup that is immutable, independent of Zerto’s 30-day journal limit, and compatible with Commvault, Cohesity, and Veeam. The newest piece is a recently released Zerto plugin that reads OpenClaw and NemoClaw logs through the Zerto API, not MCP. When an agent acts on a protected VM, the plugin tags the corresponding journal checkpoint with that agent’s name. Checkpoints arrive every five to ten seconds, so an administrator can roll a virtual protection group or individual files back to just before the agent’s change. Rollback is triggered manually from the dashboard or through a script against the API. An online delegate asked how HPE prevents poisoned data from being replicated. Paquette acknowledged that it does not. HPE instead relies on fine-grained checkpoints tagged by its own encryption detection, by agent activity, and by partner integrations such as CrowdStrike, Microsoft Defender, and SentinelOne.

Dutra’s recommended response to an agent incident is to stop and contain the agent, look for a suitable Zerto checkpoint, and fall back to StoreOnce copies when the damage predates the journal window. Tom Hollingsworth of The Futurum Group returned to the earlier post-quantum discussion and suggested a service that would ingest data at rest, re-encrypt it with PQC algorithms, and write it back in place like a scheduled job. Dutra said such a mechanism is likely still in the roadmap phase. Paquette added that Zerto supports recovery between most hypervisors and to AWS and Azure. HPE Morpheus’s HVM is currently limited to moving workloads to and from VMware, with broader support planned.

Personnel: Anthony Dutra