Coder Legion - Recent posts tagged datagovernance

No Single Key Opens the Boundary: An Offline Dual-Control Gate for Sensitive Artifact Export

Thu, 02 Jul 2026 11:12:52 +0000

In short: PYRHELIX is an offline dual-control release gate for sensitive BIO/PII artifacts. It does not replace perimeter security, compliance review, or clinical judgment. It closes one specific gap: no single actor, key, or approval should be able to move a high-consequence artifact across the release boundary alone.

By BIO/PII export, we mean high-consequence data bundles such as genomic files, clinical exports, research packets, identity-linked health records, and derived AI-ready datasets leaving a controlled environment.

The gap between what BIO/PII data is worth and how it's protected

The BIO and health-data economy is enormous, and it's getting more automated every year as AI pipelines touch more of it. The security incidents in this space are not rare, and they are not small.

23andMe (2023): attackers used credential stuffing, feeding passwords stolen from unrelated breaches into 23andMe's login page until roughly 14,000 accounts matched. Because of the platform's DNA-relative matching feature, that cascaded into exposure of genetic and ancestry data tied to an estimated 6.9 million users, including a disproportionate concentration of Ashkenazi Jewish and ethnically Chinese users who were then targeted with hateful, ancestry-specific harassment. (HIPAA Journal, Wikipedia)
Change Healthcare / UnitedHealth (2024): a single server without multi-factor authentication was the entry point for a ransomware group. Change Healthcare clears roughly 1 in 3 U.S. patient records. The final confirmed count was 192.7 million people affected, the largest healthcare breach ever reported to HHS, disrupting billing and payment processing across thousands of hospitals and clinics nationwide. Response cost: $3.1 billion in 2024 alone. (BleepingComputer, Cybersecurity Dive)
Vastaamo (Finland, 2020): a psychotherapy clinic stored ~36,000 patients' therapy notes unencrypted, on a system whose root account had no password. When extortion of the company failed, the attacker emailed roughly 30,000 patients directly, demanding ransom to avoid publishing their session notes. The clinic went bankrupt within months. (Wikipedia, CNN)

None of these three were release-boundary failures. They were perimeter and infrastructure failures: credential stuffing, a missing MFA setting, unencrypted storage with no root password. A signing protocol does not fix a server with no root password, and we are not going to claim otherwise.

What they show, together, is a pattern. BIO and health data carries some of the highest-consequence blast radius of any data category, and the organizations holding it are frequently operating below the security maturity that scale would justify. Compliance frameworks like HIPAA and GDPR mandate access logging and encryption at rest.

They say much less about what happens at the moment a sensitive artifact is about to leave a controlled environment. In practice, that moment is still often gated by one signature, one approval click, one export button.

That narrower gap, not "BIO security" broadly but specifically the release and export decision, is what we're building PYRHELIX to close. It is not a fix for this industry. It is one piece of it, and we want to find out if it actually holds up.

Why the release step specifically stays weak

A few structural reasons this keeps happening, independent of any one company's competence:

Compliance is not the same discipline as security engineering. Passing a HIPAA audit checks access logs and encryption settings. It rarely asks whether one compromised or coerced person can push sensitive data out the door alone.
Security engineering talent concentrates in tech and finance, not biotech. Research organizations hire for domain science, not for building dual-control release infrastructure in-house.
Consolidation creates concentration risk. Change Healthcare touching a third of U.S. patient records through one platform is the extreme case. The same pattern, one vendor, one pipeline, one signer, repeats at smaller scale everywhere.
Release is usually the last, least-engineered step in an otherwise carefully built research or clinical pipeline. By the time data is ready to ship, the hard technical work already happened, and the actual export is often just an email or a shared drive.

What PYRHELIX is

PYRHELIX enforces that a sensitive bundle cannot be released by one actor acting alone. The workflow has two independent steps.

Producer (Strand A): the party that generated the artifact seals its content hash and attests to what was produced. This alone is not enough to release anything.
Authority (Strand B): an independent reviewer, using a different signing key and a different role, attests approval. That attestation is cryptographically bound to the exact same bundle closure Strand A produced.

The release boundary only opens when both strands are present, use distinct keys, and bind to the same closure. Every step is recorded in a signed, hash-chained governance journal, so a separate offline verifier, potentially running on a machine that never touched the original data, can independently replay the whole decision trail: what was produced, who approved it, with which keys, in what order.

Why "Strand A / Strand B", and where the metaphor stops

Worth getting right rather than sounding clever: a real DNA double helix does not have strands named "A" and "B." The correct terms are sense strand (coding strand) and antisense strand (template strand), and neither one alone is the functional, stable molecule; the helix only exists once both are bound together.

"Strand A" (producer) and "Strand B" (authority) are protocol role labels that borrow that single idea, not a claim to real molecular-biology nomenclature.

PYRHELIX's separate, internal bit-level integrity subsystem does use the correct sense/antisense terms for an unrelated purpose (parity diagnostics on hashed symbol streams). The governance mechanism described here is plain Ed25519 dual-signature binding over a shared closure hash.

Two pieces of the actual code

Real source, not simplified for effect.

Role separation can't be satisfied by accident. In strict mode, the verifier checks that Strand A and Strand B didn't reuse the same signing key, the same role, or the same underlying public key. Any one of those three silently fails the whole bundle:

# pyrhelix/governance/verifier_enforcement.py
if strand_a_key_id and strand_a_key_id == strand_b_key_id:
    errors.append(error("KEY_ID_REUSE", "authenticity",
        "Strand A and Strand B reused the same key_id in strict mode."))
    attestation.strand_b_authenticity_verified = False
    attestation.cross_strand_binding_verified = False

if strand_a_role and strand_a_role == strand_b_role:
    errors.append(error("ROLE_REUSE", "authenticity",
        "Strand A and Strand B reused the same role in strict mode."))
    attestation.strand_b_authenticity_verified = False
    attestation.cross_strand_binding_verified = False

There's no "trust me, these are different people" flag anywhere in this path. If the same key produced both attestations, the bundle fails.

Every journal entry is chained into the one before it, not just hashed on its own. The entry hash is computed over prev_entry_hash + canonical_bytes, so tampering with entry N breaks the hash of every entry after it, not just the one you touched:

# pyrhelix/governance/chronicle_io.py
canonical_bytes = canonical_chronicle_bytes(payload)
payload["entry_hash"] = sha256_hex_bytes(
    (prev_entry_hash + canonical_bytes.decode("utf-8")).encode("utf-8")
)
payload["event_signature_b64"] = base64.b64encode(
    signing_key.sign(canonical_bytes).signature
).decode("ascii")

Splice out or edit one line of the journal and every subsequent entry fails replay. That is exactly what the adversarial CI gate checks for (journal_tail_truncation, manifest_closure_tamper, and several others) on every commit.

Built on standards, not custom cryptography

Layer	Standard
Content hashing	SHA-256 (FIPS 180-4)
Canonical JSON for hashing/signing	RFC 8785 (JCS)
Signatures	Ed25519 (RFC 8032, FIPS 186-5)

For supply-chain security readers: PYRHELIX is not yet an in-toto or SLSA-compatible attestation format. That compatibility layer is the next evaluated integration path, not a claim we are making today.

What it actually rejects

An adversarial CI gate exercises these cases on every change, not just the happy path:

Two strands signed with the same key or role
A revoked or retired signing key reused for a new decision
Journal tampering, sequence gaps, or tail truncation
Replay of a superseded governance session
Authority key rotation without a signed rotation event
A bundle declaring "no raw payload" while raw sensitive content is actually present in the bundle directory

Running it offline

python tools/governance_ci_gate.py

It bootstraps local producer/authority keys, emits a provisional bundle (Strand A), finalizes it (Strand B), verifies the finalized bundle, and independently verifies the signed journal, all without a network call. It exits non-zero on any failure, which is also how it runs in CI on every commit.

The repository is currently private while we validate this against a real BIO/PII workflow before opening it more broadly.

What this is not

Not a runtime AI firewall. Tools like LlamaFirewall or NeMo Guardrails intercept model calls in real time and inspect prompts or outputs as they happen. PYRHELIX operates downstream of that. It gates the moment content leaves the organization, after inference is already done.
Not a fix for the kind of breaches described above. Those were perimeter and credential failures, not release-gate failures.
Not a compliance scoring product. Tools that score content against frameworks like GDPR or HIPAA evaluate what's inside a bundle. PYRHELIX only verifies cryptographically that two independent signatures exist. It doesn't replace that evaluation. It gates release after it.
Not yet interoperable with in-toto/SLSA attestation formats. We're sequencing that compatibility layer after real-world validation, not blocked on it technically.
Not externally audited yet. Internal verification today means an automated test suite plus the adversarial CI gate above.

Where we need input

If BIO/PII export is part of your work, three questions:

Is release approval today genuinely single-approver, or do you already run a dual-control process?
Does verification need to work fully offline, or is a networked service acceptable?
What would have to be true for you to say "this doesn't solve my problem"?

If any of these land for you, we'd like to run a real scenario together: Emails are not allowede

Why Giving AI Agents Your Access Badge Is "Dangerous as Hell"

Wed, 17 Jun 2026 22:35:00 +0000

Here's a problem most enterprises haven't fully grappled with yet: when an AI agent acts on your behalf, what should it actually be allowed to see?

The easy answer is to give the agent the same access you have. Angad Narang, VP of Product at Everpure, doesn't think that's the right answer. "It's dangerous as hell," he said during a conversation at Pure Accelerate 2026.

The problem is straightforward once you say it out loud. A person in HR shouldn't have access to finance data. But an AI agent trying to surface useful insights often needs to look across HR, finance, and CRM data simultaneously to find patterns a human working through each system manually would never catch. If you just hand that agent the same role-based permissions the HR person has, you've either locked the agent out of the data it needs to be useful, or — more dangerously — you've quietly expanded what that HR person can effectively see, because the agent is acting with their identity.

Conventional role-based access control wasn't built for this. It assumes a person operating within one system at a time. Agentic AI breaks that assumption by design.

A Multi-Layered Answer

Narang's answer isn't a single fix — it's layered. Role-based access control still has a place at the system and application level. But on top of that, Everpure Data Intelligence (formerly 1touch.io) can tag and selectively obfuscate specific data, hiding personally identifiable information while still allowing an agent to surface trends and patterns from that same underlying dataset.

In practice, that means an agent can analyze finance and HR data together to identify a meaningful business trend, without ever exposing the actual PII to the person who requested the analysis — and without that person needing standing access to either system. The agent gets enough context to be useful. The human gets the insight without the liability of direct access they were never supposed to have.

It's a genuinely difficult problem, and Narang was candid that Everpure doesn't have it fully solved. "We're going to develop as we go along, as we integrate. Very, very early days," he said. "Next year this time, we'll have a much better and integrated offering."

That timeline lines up with data from IDC's June 2026 survey of more than 1,300 organizations, commissioned by Everpure: 41% of respondents cite security as their top challenge to agentic AI deployment, and 39% cite a lack of real-time data access as the second biggest. Those numbers can look contradictory — more access means more risk, but agents need broad access to be useful. Narang's view is that the resolution isn't choosing one over the other. It's building a system precise enough to grant useful context without granting blanket access.

Early Days, Literally

That "early days" framing isn't just cautionary talk. Everpure completed its acquisition of 1touch.io on May 8, 2026 — barely five weeks before this conference. The product that's now central to Everpure's entire data-primacy pitch is still in its first quarter as part of the company.

That context matters for how to read everything else Narang said. The fleet telemetry data that Everpure has collected from its storage systems for years, and the semantic intelligence layer that 1touch (now Data Intelligence) provides, remain separate from these systems. Narang confirmed Prakash Darji's comment from a separate interview that the two are expected to converge within the next year — but as Narang put it, "that hasn't yet completely been integrated into where we are as a company."

The two systems come from different engineering teams with different histories. Getting them to operate on a unified roadmap, Narang said, will take deliberate, sustained coordination — not a quick technical merge.

Building for Now and for Three Years Out

Asked how Everpure decides what to build given how early most customers are in their AI readiness journey, Narang described a split timeline: product vision is set 24 to 36 months out, while near-term engineering work focuses on what customers need today.

That's a fairly standard product leadership answer, but it's grounded in something Narang was unusually direct about: nobody — including Everpure — actually knows what enterprise AI infrastructure needs will look like in three years, because the pace of change makes any confident prediction a guess. The discipline isn't in correctly predicting the future. It's in building toward a long-term direction while staying flexible enough to adjust as that direction becomes clearer.

That tension shows up concretely in the adoption gap Darji flagged in a separate conversation: 80-90% of customers still don't fully understand semantic data management. Narang agreed and was specific about why. Before you can explain why a shared semantic layer matters, you have to first explain what semantics even means in this context — that data carries inherent meaning, and that meaning needs to be understood consistently across applications for AI to use it well. Most enterprise IT conversations are still happening at that first, foundational layer.

The connection to a concept familiar to anyone who uses AI coding tools daily is direct: this is context engineering, applied at the enterprise data layer rather than the prompt layer. The same discipline that separates effective AI tool usage from frustrated AI tool usage — understanding and structuring context rather than just writing better prompts — is what Everpure is trying to build into the infrastructure itself.

The Hardest Engineering Problem

Asked which stage of the data pipeline — ingest, curate, classify, embed, index, retrieve, generate — is hardest to get right, Narang pointed to building the knowledge graph itself: figuring out how different pieces of data, sitting in entirely different systems, actually relate to one another. Everpure has been doing a version of this for years, at both the storage and application levels. The acquisition of 1touch is meant to extend that capability significantly further, building the connective layer across applications rather than within Everpure's own platform alone.

Why Working with Data Where It Lives Matters

Ashish Gupta, GM of Data Management at Everpure, made the case earlier in the week that competing vendors generally want customers to copy their data into a new system. Narang's response to that framing, from a product perspective, was almost dismissive of the difficulty: Everpure has been building toward a unified data plane for years, so working with data wherever it already lives isn't a new challenge to solve — it's the architecture the company has been building toward all along.

His broader point connects directly to something every engineer who has worked with Databricks, Snowflake, or SAP integrations will recognize. Those platforms are powerful, but customers consistently describe them as hard to work with. Narang's argument is that simplicity isn't just a nicer customer experience — it's a security advantage. Complexity creates friction, and friction creates workarounds. Workarounds create the exact security gaps that well-architected, simple systems are designed to avoid.

What's Actually Contested Internally

Asked what product decision is likely to generate the most internal disagreement over the next year, Narang pointed to resource allocation among three priorities: continuing to build faster, more capable storage hardware; investing further in Data Stream's AI pipeline capabilities; or pushing harder to make enterprise data AI-ready through Data Intelligence. There's no obviously correct split, and reasonable people on his team will weigh those trade-offs differently.

It's a candid acknowledgment that Everpure's rebrand and broader platform ambitions create real internal tension over where engineering investment should go — not just a messaging challenge to manage externally.

What Actually Matters to Developers

Asked what he thought developers, engineers, and architects most want to know that hadn't already come up, Narang's answer was simple: they want to know how this makes their lives easier.

That's consistent with what Everpure has been arguing all week, just stated more plainly than the product slides do. Narang described the kind of task that used to take him months — pulling information from Salesforce and connecting it to order management data to understand a full year of business activity — and said that with the context already established by tools like Data Intelligence, the same task could realistically take an hour.

The bigger shift he pointed to isn't really about engineers at all. It's about extending that same capability to business users with no technical background by building a semantic context that lets AI surface insights they'd otherwise need a data team to produce. Engineers are already living this shift directly — many are now writing the majority of their code with AI assistance rather than from scratch, a point Narang didn't dispute. The same underlying capability, applied to enterprise data, is what Everpure is betting will extend that kind of leverage to everyone else in the business.

Whether Everpure executes on that vision faster than the access control, governance, and integration challenges it just openly admitted to still working through remains the real story to watch over the next year.

Everpure (NYSE: P) provided press access to Pure Accelerate 2026. The IDC research cited in this article was commissioned by Everpure.

Inside Everpure's Data Intelligence: A Conversation with Prakash Darji

Wed, 17 Jun 2026 22:14:14 +0000

When ransomware hits, the standard playbook is to roll back the entire environment to the last known clean snapshot. It works, but it's blunt. You lose every legitimate change made since that snapshot, not just the malicious ones.

Prakash Darji, General Manager of Digital Experience at Everpure, described a more targeted approach during a conversation at Pure Accelerate 2026. Instead of rolling back everything, Data Intelligence can identify exactly which files were affected by an attack and execute a micro-rollback — restoring only the compromised data while leaving everything else untouched.

It's a small example with a big implication: once you actually understand what your data is and how it connects to everything else, you can act on it with precision instead of brute force.

That's the premise behind Everpure Data Intelligence, the product formerly known as 1touch.io, and the centerpiece of what Everpure is calling data primacy — a fundamental shift in how enterprise data architecture should work in the AI era.

How the Semantic Layer Actually Works

It's easy to talk about "semantic knowledge graphs" in the abstract. Darji walked through what it actually looks like in practice, using a purchase order as an example.

A PO might start as a file sitting in a file share. That file lives inside a database, which follows a particular schema, which contains specific fields. A content classifier identifies what those fields actually represent — this field is a vendor name, that one is a dollar amount. All of that gets mapped into a knowledge graph that captures the relationships: this purchase order connects to a specific entry in Oracle, which connects to a specific transaction in the billing system.

That's seven layers of context — file share, database, schema, field, content classifier, knowledge graph, relationships — built around a single piece of data that, in a traditional application-centric architecture, would just be an opaque record sitting in a silo.

The payoff is that once that semantic structure exists, AI agents can actually reason across systems instead of guessing. An agent looking at a purchase order can understand not just what the document says, but how it fits into the broader business process around it — without a developer manually writing integration logic to connect Oracle to the billing system every time someone needs that context.

Two Systems, Converging

One detail worth flagging for anyone tracking Everpure's roadmap: the fleet telemetry data Everpure has collected from its storage systems for years, and the semantic layer that Data Intelligence provides, are currently separate systems. According to Darji, they're expected to converge within the next year.

That's not a small integration. Everpure's storage telemetry operates at the infrastructure level — looking at volumes, file systems, and performance data. Data Intelligence operates at a higher level — understanding what the data means and how it relates across applications. Bringing those together means an AI agent could eventually reason about both what a piece of data represents and how the infrastructure underneath it is actually performing, in a single context.

It's a useful reminder that data primacy isn't a single product launch. It's an integration project that will play out over the next several quarters, built on a still-recent acquisition.

Small Models, Better Data

One of the more counterintuitive points Darji made — echoed elsewhere at the conference — is that small language models with focused, relevant data are outperforming large language models fed raw, fragmented data. That cuts against the assumption that bigger models always win.

The logic follows directly from the semantic layer argument: if an AI system has to wade through unstructured, poorly contextualized data to find what's relevant, it needs a much bigger model and a much bigger context window to compensate. If the data is already classified, contextualized, and connected through a knowledge graph, a smaller, more efficient model can get better results with a fraction of the token cost.

For engineering teams evaluating AI infrastructure investment, that's a meaningful trade-off to understand. The instinct to solve data fragmentation by throwing a bigger model at the problem may be solving the wrong layer entirely.

The Adoption Gap

Darji was candid about where most customers actually stand. By his estimate, 80 to 90% of customers still don't fully understand semantic data management — what it means, why it matters, or how it changes the way they should think about their data architecture.

That's a notable admission from a product leader at a company betting heavily on this direction. It also explains why so much of the messaging at this conference, from the keynote through every press conference session, spent as much time explaining the concept of data primacy as it did describing the products that implement it. Everpure is still in the education phase of this transition, not just the deployment phase.

Why Bet Horizontal

Darji was direct about Everpure's competitive logic: Data Intelligence works across any storage, not just Everpure's own platform. That's a deliberate choice, not an oversight. Everpure isn't using Data Intelligence as a wedge to sell more hardware — it's positioning the product as a horizontal semantic governance layer that adds value whether or not a customer runs Everpure storage underneath it.

He compared it directly to the company's earlier bet on all-flash storage. There were plenty of competitors in that race too, and Everpure backed the bet anyway because it believed the architecture was right, not because the path was uncontested. The same logic applies here: data primacy is a horizontal architectural bet, and Everpure is betting that being right about the architecture matters more than controlling every layer of the stack.

From Application GUIs to Persona-Based Workflows

The most forward-looking part of the conversation was Darji's prediction about how enterprise software itself changes once a shared semantic layer exists.

Today, most enterprise software is organized around applications — you log into your CRM to do CRM things, your ERP to do ERP things, and switching between them means manually carrying context in your own head. Darji's prediction is that this shifts toward persona-based workflows: instead of organizing around which application owns which task, software organizes around what a specific role actually needs to accomplish, pulling from a shared semantic schema regardless of which system the underlying data lives in.

In that world, the work shifts for engineers too. Less time goes into building one-off integrations between specific applications, and more time goes into managing schema consistency — making sure the shared semantic layer accurately represents what the business actually means by its data, so that every persona-based workflow built on top of it stays trustworthy.

It's a meaningful shift in what application development looks like, and it's a direct extension of the data primacy argument Everpure has been making all week: once data carries its own context, the application stops being the thing organizing the work.

The Pragmatic Reality of Migration

None of this means existing enterprise systems disappear overnight. Darji's view here is pragmatic, echoing a line he attributed to a former PeopleSoft CEO: nobody builds the world in seven days when there's already an install base to deal with.

Nobody is ripping out SAP. The realistic path is that new workloads get built data-first from the start, while legacy complexity gradually thins out over time as the economics and the use cases shift. Migration is a multi-year process, not a single cutover — a point Charlie Giancarlo also made directly when discussing Everpure's own roughly two-and-a-half-year internal journey toward data primacy.

The Practical Takeaway

For developers, engineers, and architects evaluating where to invest attention, Darji's conversation reinforces a theme that's run through this entire conference: the bottleneck for enterprise AI isn't model capability. It's whether your organization actually understands its own data well enough to feed AI systems something trustworthy.

Data Intelligence is Everpure's bet that solving that problem requires a dedicated semantic layer — not a bigger model, not another data lake, and not another copy of the same fragmented data. Whether that bet pays off depends on execution over the next several quarters, as Everpure works through its own admission that most of the market isn't there yet either.

Everpure (NYSE: P) provided press access to Pure Accelerate 2026.

Why Enterprise AI Keeps Failing — And What Everpure Is Doing About It

Wed, 17 Jun 2026 14:00:00 +0000

For decades, enterprise IT built everything around applications. SAP owned finance. Salesforce owned customer relationships. ServiceNow owned IT operations. Each application came with its own data, its own definitions, and its own version of what words like "customer" or "asset" actually meant.

That model worked well enough — until AI showed up.

AI doesn't work the way applications do. It doesn't care which system owns which data. It needs to reason across everything at once, in real time, with consistent context. And when it tries to do that inside a fragmented, application-centric architecture, it fails. According to a June 2026 IDC survey commissioned by Everpure, 54% of AI proof-of-concept projects never reach production. That's a majority of AI budgets generating zero return on investment.

The root cause, according to IDC's research of more than 1,300 organizations, isn't compute. It isn't talent. It's data. Ninety-four percent of respondents said data quality is important or very important to AI project success. The top contributors to poor data quality are redundant data, multiple storage silos, and obsolete data.

At Pure Accelerate 2026 in Las Vegas, Everpure is making a direct argument that this is an architectural problem — and that fixing it requires inverting 50 years of enterprise IT assumptions.

The Problem with App-Centric Architecture

Charles Giancarlo, Chairman and CEO of Everpure, laid out the historical case in a keynote essay released alongside this week's announcements.

The original vision for large-scale ERP systems was a single semantic framework — one shared definition of "customer," "order," and "asset" across the entire enterprise. That vision never survived contact with real-world IT. A best-of-breed era arrived instead, with specialized applications for every business domain. Each brought its own definitions, its own data copies, and its own ETL pipelines to communicate with everything else.

SaaS accelerated the problem. Every new application brought more fragmentation, more copies, more integration work. The typical enterprise today has hundreds or even thousands of applications, each with its own data set, requiring costly transformation before the data can be used elsewhere.

In the AI era, this isn't just inefficient. As Giancarlo puts it, it's unsustainable.

"Customer" in a CRM means something different than "customer" in a billing system. "Asset" in an ERP is not the same object as "asset" in a supply chain platform. Multiply that across hundreds of applications, and you have a system in which cross-domain meaning must be reconstructed every time it's needed. AI fed on that fragmented, inconsistent data produces inconsistent results. In business, accounting, and R&D, 95% accuracy isn't good enough.

The Data Primacy Model

Everpure's response is what Giancarlo calls data primacy — a fundamental inversion of the hierarchy between applications and data.

In the data primacy model, data becomes the system of record. Applications read from and write to shared data, but they don't own it. Context and semantics travel with the data itself, not embedded inside the application that created it. Governance is enforced at the data layer rather than policed by external software.

This rests on three principles Giancarlo articulated this week:

Semantics must travel with the data. Operational data must carry meaning that can be understood outside the system that created it. This requires building semantic descriptions alongside data relationships that define how a piece of data connects to everything else in the enterprise. Raw data becomes self-describing, contextually rich, and ready for AI to reason over accurately.

Data must be conserved, not copied. Enterprises have been conditioned to duplicate data for every new application, analytics environment, and AI use case. Data primacy inverts that. A single authoritative source of real-time data, governed and semantically described, serves all applications and all agents. One version. One truth.

Governance must be embedded at the data layer. In an app-centric world, access is managed through role-based controls tied to individual applications. In a data primacy world, AI agents operate across multiple systems simultaneously. Access must be contextual and dynamic — driven by the attributes of the data itself, the identity of the requesting agent, and the purpose of the action. Conventional role-based access control simply wasn't designed for that.

What Everpure Announced

To deliver on data primacy, Everpure announced three platform innovations at Pure Accelerate 2026, organized around what the company calls the Enterprise Data Cloud.

Universal Data Intelligence

The centerpiece announcement is Everpure Data Intelligence, formerly known as 1touch.io. It's a data intelligence layer that discovers, classifies, and contextualizes enterprise data at its source — across Everpure storage, public clouds, SaaS applications, third-party storage, and legacy environments, including mainframes.

Data Intelligence delivers three core capabilities. Universal Discovery provides visibility into both structured and unstructured data, regardless of storage format, covering major databases, including SQL Server and Oracle. Automated Governance automatically scans the environment to identify sensitive data — PII, PHI — and tracks lineage to maintain a complete map of the data landscape. AI-Ready Context maps raw data to its real-world business definitions, building a semantics knowledge graph that enables AI agents to understand, query, and act on information across the entire enterprise.

For enterprises deploying AI agents, the knowledge graph matters for a specific reason: accurate, contextually relevant data maximizes response accuracy while dramatically reducing context window sizes and token costs. Small language models fed focused, relevant data are outperforming large language models given raw, fragmented data — a practical reality that flips the assumption that bigger models always win.

Ashish Gupta, GM of Data Management and former CEO of 1touch, shared a concrete customer example during the press conference. A large credit card company was spending 21 person-hours per data subject access request (DSAR), with more than 7,000 requests per day. After implementing Data Intelligence, response time dropped to 30 seconds. Implementation for a mid-sized customer takes roughly a month — setup in week one, ML-based classification in weeks two and three, and knowledge graph development from week four onward.

Data Intelligence is also explicitly designed to work on data you don't store on Everpure. Gupta was direct about the competitive differentiation: most vendors in this space ask you to copy your data into their system. Everpure's approach works with data where it already lives — with more than 175 connectors spanning structured and unstructured data, SaaS, on-premises, cloud, and mainframe environments.

Unified Data Plane

The Unified Data Plane is Everpure's shared storage foundation spanning cloud, core, and edge across every workload type — from data archives and enterprise file to real-time applications, containerized workloads, and large AI factories.

Three new developments expand the Data Plane this week.

FlashArray//XL 190 with Purity Turbo Mode consolidates mission-critical workloads onto a single array with more performance and SLA headroom. Everpure Cloud Azure Native Virtual Machines — generally available in July — decouples storage from compute for storage-heavy workloads in Azure, enabling lift-and-shift migration without refactoring and management through the Azure portal as a first-party service.

Evergreen//One Overdrive, available in Q3 2026, lets organizations burst 25% above their SLA for both performance and capacity, paying only for what they actually use. It addresses a practical operational problem: AI workloads are unpredictable. Permanent capacity upgrades are expensive. Overdrive lets organizations absorb traffic spikes without permanent subscription increases.

Intelligent Control Plane

The Intelligent Control Plane is Everpure's fleet-wide operating model for governing data and automating actions across the entire environment. It turns manual, reactive storage administration into a self-optimizing system.

New and enhanced capabilities announced this week include Open Telemetry support, Fusion Fleet Topology, and two MCP servers — Pure1 MCP Server for intelligent queries and Fusion MCP Server for taking action across the global infrastructure estate.

The most compelling new addition is an agentic performance triage workflow. When high latency is detected, the system automatically creates a ServiceNow ticket, notifies via Slack, assigns a triage agent, validates the root cause against vSphere, and hands off to a human when remediation requires authorization. It's a clean, real-world example of human-in-the-loop agentic operations — automation handles detection and diagnosis, while humans retain control over action.

Also notable: Compliance Monitoring and Remediation, available in preview, automatically detects hardware and software configuration drift and enforces global corporate governance policies. Fusion Compliance and Agentic Triage (available Q4 2026) extends this by using agentic AI to suggest root causes for immediate technical remediation.

EDC Success Blueprint

To help organizations move from vision to practice, Everpure introduced the EDC Success Blueprint — a step-by-step methodology across 10 operational pillars for building and scaling an Enterprise Data Cloud. It starts with a readiness assessment to identify immediate infrastructure and security risks, then maps a clear path toward highly automated, efficient architecture.

Options Technology, a global capital markets infrastructure provider, offers an early proof point. After standardizing on Everpure FlashArray, FlashBlade, Evergreen//One, Pure1, Fusion, and Portworx Enterprise, Options achieved roughly an 80% reduction in storage management workload through Fusion and Pure1 automations, along with up to an 80% performance boost for key workloads.

Where Most Enterprises Actually Are

IDC's research is honest about the gap between where organizations need to be and where they are. Sixty percent of survey respondents said their storage infrastructure requires significant improvements or a total refresh to support AI workloads. Thirty-four percent report that their data scientists spend more than half their time waiting on IT — waiting for datasets to be provisioned, GPU time to be allocated, requests to be fulfilled — rather than building models.

IDC identifies four maturity tiers in its AI Readiness Index: Experimenting, Practitioners, Competent, and Masters. Most enterprises are currently sitting somewhere between Experimenting and Practitioner — AI projects are beginning to reach production, but storage and data access bottlenecks are still hampering GPU utilization and slowing project timelines.

The path to Competent and eventually Master status runs through exactly what Everpure announced this week: structured data governance, purpose-built AI storage infrastructure, and the elimination of data silos through intelligent platforms.

Everpure is making a bet that the storage layer is where this transformation has to happen — not inside any individual application, not inside a data lake that's already out of date, but at the data layer itself, where context and governance can travel with the data wherever it goes.

For enterprise IT teams trying to figure out why their AI pilots keep failing, that argument is worth paying attention to.

Everpure (NYSE: P) provided press access to Pure Accelerate 2026. The IDC research cited in this article was commissioned by Everpure.

Komprise transforms unstructured data management for AI, delivering security, governance, and 70% storage cost savings.

Sun, 11 May 2025 21:55:46 +0000

Komprise: Building the Intelligent Data Engine for Enterprise AI

Introduction

In an era where unstructured data growth continues to explode and AI adoption accelerates, organizations face significant challenges managing their data estate. Komprise has evolved from a pure storage optimization company to a comprehensive data management platform that serves as the critical intelligence layer between storage infrastructure and AI initiatives. Growing at 40% year-over-year, this Silicon Valley company is helping enterprises not only reduce storage costs but also prepare their data for AI applications while ensuring proper governance and security.

The Unstructured Data Challenge

Unstructured data now represents 90% of enterprise data and continues to grow exponentially. This creates several critical challenges for organizations:

Storage costs spiraling out of control
Data silos preventing comprehensive visibility
Complexity in moving data across environments
Security and governance concerns, especially with AI

As Kumar Goswami, CEO and co-founder explains: "We're changing the way the world manages data - from storage administration to strategic analytics-driven data management, from data locked away to data securely available when and where it's needed."

Technical Architecture

Komprise's distributed architecture consists of three main components:

Komprise Director
The Director serves as the management console providing unified visibility across storage environments. It offers an intuitive UI for administrators to analyze data, create policies, and initiate workflows.

Komprise Observer
These virtual machines are deployed close to storage resources and handle analysis and data movement. Observers work without agents or stubs and stay out of the hot data path, ensuring no impact on active data access.

Key benefit: Since Observers process data locally, sensitive data never leaves the customer's environment, addressing key security concerns for AI data preparation.

Komprise Cloud
At the heart of the architecture is the cloud-based global file index, which maintains metadata about all managed files across the organization's entire storage footprint. This meta database enables:

Scalable indexing of billions of files
Custom tagging and classification
Policy engine for automation
Data lineage tracking
Granular search capabilities

The AI Data Management Imperative

Recent Gartner research indicates that while only 5% of enterprises will train their own AI models, 95% will use pre-trained models that need enterprise data augmentation. This creates several technical challenges Komprise is addressing:

Data Discovery and Mobilization
Finding relevant data across storage silos and moving it efficiently is critical for AI initiatives. Komprise's platform can search, tag, and move data based on complex criteria without disrupting production workloads.

Sensitive Data Detection
Released in January 2025, this capability enables:
Local scanning for PII and custom patterns using regular expressions

Automated classification and tagging workflows
Policy-based remediation actions
Pre-processing to exclude sensitive data from AI training sets

Tip: Organizations can define custom regex patterns to identify company-specific sensitive data types beyond standard PII elements.

Smart Data Workflow Manager
This tool provides a wizard-driven interface to create end-to-end workflows for AI data preparation:

Search and identify relevant data across silos
Scan for sensitive information
Tag and classify data appropriately
Move data to target locations for AI processing
Maintain audit trails of the entire process

Real-World Impact

The business impact of Komprise's approach is significant across different sectors:

Financial Services
A major financial services firm expanded from an initial 10 petabyte migration project to managing over 100 petabytes with Komprise. Their IT team reported that "Komprise has the most comprehensive migration tool on the market for large-scale global migrations," achieving 27x faster data migrations compared to traditional tools.

Healthcare
A research hospital leveraged Komprise to implement storage-as-a-service with departmental chargeback. This gave research teams direct visibility into their data usage and costs while maintaining centralized governance. When searching for historical medical images, Komprise reduced search time from months to hours, enabling researchers to find 9 specific JFK images among 3 million files in just 1 hour and 53 minutes.

Legal Services
A law firm initially adopted Komprise for Azure migration but expanded to make it a core component of their ransomware protection strategy by reducing their attack surface and securing sensitive client data.

Bridging the Gap Between Storage and AI

What makes Komprise unique is its ability to serve as the data engine for AI initiatives while maintaining its core strength in storage optimization. The platform typically delivers:

70% savings on storage, backup, and cloud costs
27x faster data migrations compared to traditional tools
80% more efficient AI data workflows

Smart Data Ingestion for AI

Komprise recently demonstrated how organizations can safely use corporate data to ground AI models using Retrieval-Augmented Generation (RAG):

Search and identify relevant data across silos
Scan for and exclude sensitive information
Move approved data to cloud containers
Index this data for use with OpenAI and other LLM platforms
Maintain complete audit trails of what data was used

This approach ensures that:

Sensitive data never leaks to public AI models
The organization maintains control over what data is used
The AI benefits from accurate, relevant corporate information
Compliance and governance requirements are met

Conclusion

As organizations continue to grapple with explosive unstructured data growth and the emergence of AI workloads, Komprise's evolution from a data management platform to an AI data engine positions it to address critical enterprise needs. The platform's architecture ensures scalability and performance while maintaining security and governance. For IT and engineering teams, Komprise offers both immediate cost savings through storage optimization and strategic value in preparing data for AI initiatives safely and efficiently. With capabilities like sensitive data detection and smart data workflows, organizations can confidently connect their corporate data to AI systems while maintaining proper governance and security.