In this episode of the Vertali Podcast, Ed Nell talks with MainTegrity’s Al Saurette about why static cyber reporting no longer works for modern mainframe security and what a real-time, human-in-the-loop defense looks like. They dig into ransomware’s business model, why milliseconds matter, how to spot reconnaissance early, and the practical mechanics of “freeze first, verify, then resume” so attacks are contained before damage spreads.

Key Takeaways

Static reports can’t keep up: Cybersecurity is a real-time problem; waiting for daily violation printouts assumes humans can react fast enough, which they simply can’t. Action has to begin before a person can even read a dashboard.

Milliseconds matter: Modern hardware can encrypt huge volumes of data in fractions of a second. Detection and containment must happen in milliseconds, not minutes or hours.

Freeze first, then decide: When anomalies appear, pause the activity immediately. If a human later validates it, resume from the exact point without disruption; if not, cancel and remediate.

Spot recon early: Look for reconnaissance signatures, unsanctioned file changes, privilege probing, or sudden spikes in data access, especially from “trusted” network partners where an upstream environment may be compromised.

AI is a force multiplier, not an autopilot: AI can help analyze rich real-time telemetry and accelerate triage, but final authority and recovery decisions should remain with humans, especially for restore actions.

Recovery needs root-cause clarity: Restoring data alone can re-ignite malware. You must identify where malicious changes were introduced, remove them, and restore systems to a trusted state—otherwise you risk a second outage.

Best Moments

“Cybersecurity these days is a real-time event… the criminals are attached to your system more or less when you start.”

“The time frames are milliseconds… who can possibly react in a second?”

“Stop the suspicious activity, then let people decide whether to continue or kill it.”

“There was a US case where the outage went on for nine days… the estimated cost to recovery is $3 billion.”

About Vertali

Vertali is a leading cyber security company specialising in IBM® mainframe infrastructure. With deep expertise, innovative software, and trusted resources, Vertali supports organisations across the UK and globally, particularly in finance, retail, utilities, and government sectors.

100% focused on mainframe systems, Vertali helps organizations secure and optimize their operations. By combining advanced technology with expert insights, Vertali delivers powerful cybersecurity solutions and consulting services that protect against evolving threats. Driven by a proactive approach, Vertali enables businesses to build resilient systems, safeguard sensitive data, and maintain smooth, uninterrupted operations in the face of cyber risks.

Hosted on Acast. See acast.com/privacy for more information.