A security team that cannot send its data anywhere has spent years watching AI happen to everyone else. This conversation looks at what changes when the model, the data, and the verdict all stay inside the building.
Crogl arrived at Black Hat USA 2026 with two announcements behind it. The week before the show, the company made a free download of its AI SOC agent generally available. On the morning of this conversation, it went public with a major global partner tied to the U.S. Department of Defense. Monzy Merza, Co-Founder and CEO of Crogl, ties both back to a position the company took three years ago, which is that customers should control their own data and a security product should be secure.
What does sovereignty mean in security operations? Less about geography, more about control and choice. Merza points to the electric utility that wants current AI technology inside an OT environment and historically had one path, which ran through the internet. Crogl is built to run closed off from the internet with its capability intact, which is what critical infrastructure operators, large banks, and defense organizations need to satisfy their own regulators.
There is a second reason, and it lands on intellectual property. A large financial institution holds knowledge about its customers that nobody else holds. If an outside party takes that data and builds derivative work from it, the institution has given away something it never intended to sell.
Can a sovereign deployment still be flexible? Merza makes the case that it can when the architecture is right. Customers bring whatever model they want, including models they build. Crogl creates a semantic layer across data stores without transforming, normalizing, or moving the data, so a field labeled one way in one data lake connects to its counterpart in the next. Federated querying and federated search were base principles from the start, and the company holds a patent on the approach. One customer runs a hundred terabytes a day across six data lakes.
The operational math is where it gets interesting for the business. An analyst who might close ten alerts in a shift can work fifty or sixty when the rest arrive with a verdict and documentation already attached. Risk drops because alerts actually get investigated, audit cycles move faster because the evidence is there when the auditor asks, and cost follows the data rather than the pipeline.
The reaction from practitioners is the part Merza keeps returning to. Rather than worrying about being replaced, the people he talks with are glad to skip the seventeen thousandth phishing email and spend that time on a blast radius question they could not get to before. One person went from a fresh install to a submitted investigation report in under ten minutes and posted about it publicly.
This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight
GUEST
Monzy Merza, Co-Founder and CEO of Crogl | On LinkedIn: https://www.linkedin.com/in/monzymerza/
RESOURCES
Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas
Learn more about Crogl: https://www.crogl.com
Download Crogl: https://www.crogl.com/download
Crogl newsroom: https://www.crogl.com/newsroom
Are you interested in telling your story?
▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full
▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight
▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight
▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings
KEYWORDS
monzy merza, crogl, sean martin, brand story, brand marketing, marketing podcast, brand spotlight, black hat usa 2026, sovereign ai, ai soc, autonomous investigation, threat hunting, air gapped deployment, ot security, federated search, knowledge graph, alert triage, soc analyst workload, audit evidence, data sovereignty
Sovereign AI That Runs Where Your Data Lives | A Brand Spotlight at Black Hat USA 2026 with Monzy Merza, Co-Founder and CEO of Crogl | Hosted by Sean Martin
[00:00:00] Sean Martin: You guys have fun. Have fun. Much fun. You
[00:00:11] Monzy Merza: always
[00:00:11] Sean Martin: have fun. We
[00:00:13] Monzy Merza: always have fun. Yeah.
[00:00:14] Sean Martin: Marco, I have to give you
[00:00:16] Monzy Merza: and good to see you.
[00:00:17] Sean Martin: Ah, so good to see you man. And I love this booth. We'll, we'll do a, a short guy. I took a shot coming down the escalator it, oh, mix that in. I mean, it's a great spot right here. Great to see you guys doing so well.
[00:00:29] Monzy Merza: Thank you.
[00:00:30] Sean Martin: You have some announcements? Yes. You had talk about that. I think first we need to, uh, give Marco a little brief. We're not holding a glass of Brunello.
[00:00:39] Monzy Merza: There's no, there's no Brunello. There's no pizza there.
[00:00:43] Sean Martin: No pizza.
[00:00:44] Monzy Merza: There's no biscotti.
[00:00:45] Sean Martin: No
[00:00:45] Monzy Merza: biscotti. He could have brought a piece of basil. Could it just as a gesture, a little bit of mo, little bit of basil. It would've been nice. I'm not even asking for the Tico. Just, you know,
[00:00:55] Sean Martin: all,
[00:00:55] Monzy Merza: I don't
[00:00:56] Sean Martin: know. Well, tomorrow you and I'll hang out and we'll, we'll have a glass. We'll
[00:00:59] Monzy Merza: figure it out.
[00:01:00] Sean Martin: But, uh, so good to see you. Uh, for folks that don't know, co-founder, founder of Crogl, CEO, uh, what's been going on there?
[00:01:10] Monzy Merza: It's been a great, it's been a great week for us to be here. I mean, we're just barely getting started to be back with the community at Black Hat. We made an announcement last week for the public GA of our free download so that everybody can try out. There's so many companies doing AI SOC work. We were like, you know, let the community speak.
We wanted to do that. Uh, we are getting such good feedback on our stance that we took over three years ago to say, customers should have the choice. They should control their own data. A security product should be secure. So this whole movement towards sovereign AI and the customers recognizing that and that they want to do that, we've built a sovereign product from the get-go.
So the customers can control everything about how AI operates in their environment. We're getting really good feedback and traction from those, from those customers as well. We had a big announcement this morning with a major global partner with the U-S-D-O-D. Now it's public news. Now everybody can find out what, what, what Crogl is doing there.
So things are really going our way and we're really grateful for all the positive feedback from the community and from the customers who support us.
[00:02:16] Sean Martin: So there's a lot when you can do something in the DOD.
[00:02:18] Monzy Merza: Yes,
[00:02:19] Sean Martin: yes. A lot of, a lot of effort goes into making that happen. So very cool on that. And uh, yeah. Encourage folks to look that up. So sovereignty, I feel it's a word that's overused a lot and typically in the context of you don't want to run US stuff in Europe or we, we want to have our own in-country things happening. But there's the, the capabilities that support that you took as a bigger stance early on.
So the ability to have a choice. So tell me about what, what different types of organizations might want to have a choice for? What, what are the reasons?
[00:03:01] Monzy Merza: Yeah, so I think it, the, it first starts with wanting to control and wanting to own your own destiny from the customer's point of view. Customers want to use AI.
Historically, if a large electric utility company, for example, and Crogl has a large electric utility company, customer wanted to deploy a cutting edge AI technology and an operational environment in an OT environment, they couldn't do it. They had no choice. The only way to do it was to connect up to the internet and we wanted, always wanted to serve that.
Critical infrastructure community. So we built the product from the Crogl from the beginning to be operated in a way that it can be closed off from the internet, but has high quality capability. So we wanted to serve it. It comes out of a sense of service, right? And a commitment to service for those kinds of organizations, whether they're a large bank, whether they're electric utility company, whether they are the Department of Defense, all of these organizations have those requirements.
We wanted to serve those requirements, we wanted to serve that community. So it's hard to build a product that way. Right? But the bigger question is, well, why do they want to do that? Well, they want to do that is because they have their own regulatory requirements, but they also don't know what's coming in the future.
So they are better prepared for what's coming in the future when they can validate and they can say that, look. My data is my data,
[00:04:16] Sean Martin: right?
[00:04:17] Monzy Merza: And the second part of that too is if you are, let's say you're a large financial services institution, like one of Crogl's Big 10 bank customers. You have knowledge and data about your customers and about your business that nobody else has.
If you are working with somebody outside and they're going to take that data. Right. And they're going to use that data to create derivative things off of your intellectual property. Well, that's not cool. Yeah. And so we wanted to give that customer that choice again to say, look, you can use Crogl. It is yours.
It's your product. The data is yours, the use cases are yours, but what you do with it is yours. And, and customers appreciate that. And now that the whole sovereign thing, a lot of people started talking about sovereign, right? Then it's like, well, we've been here all along and we appreciated that from the beginning.
[00:05:03] Sean Martin: Yeah. So we, we saw it from the beginning. I think one thing that I'm hearing a lot from folks, CISOs and others that I talk to is the ability to actually deploy something that is flexible, but also stable. I mean, we can't be messing around with our environment, but we need to be able to take this new model or this new language or whatever it is, and.
And new data sets and what have you, and deploy it quickly, but have a nice, stable base. So talk to me about how Crogl kind of helps with
[00:05:34] Monzy Merza: that. Yeah. I, I think one of the misconceptions has been historically is sovereign means static,
[00:05:40] Sean Martin: right?
[00:05:40] Monzy Merza: Sovereign doesn't mean static. If the architecture's right, sovereign can be very flexible and sovereign can adopt.
And, and so we built Crogl in that way. We were one of the very early players in the space that said. Customers should be able to bring whatever model they want to bring to the table because we knew that there's gonna be a better model to model. Customers are gonna build their own models and they're gonna buy new models, and they're gonna use what they see is best for their business.
So it goes back to the same, the same aspect. And so yeah, we, we, we build the architecture in a way that. It doesn't matter what the use case is, whether customers want to do threat hunting, whether they want to do investigations, whether they want to meet compliance requirements. We had a, we had a Fortune 500 customer who's who, who did anti-fraud detection or, and fraud detection using Crogl, even though it's not a fraud product, because the architecture's right, it has a knowledge graph.
And it gives you freedom and choice and models. It's secure as a, as a system, it is able to analyze whatever data you want without having to normalize your data across multiple data lakes simultaneously. Right? I mean, for us, federated querying and federated searching was a base principle from the get-go.
We have a patent on that and so, you know, we appreciate the, the strong. Architecture pieces that sophisticated organizations need. And we rejected this notion that, oh, just because it's gonna be on-prem or just because it's gonna be sovereign doesn't mean it's not gonna be flexible. Right? So it has to be flexible, it has to be sovereign, it has to give customers as many choices as they want to have to run the business.
[00:07:08] Sean Martin: Yeah. We talked a bit about the, um, the fact that data doesn't, doesn't need to be normalized. And it can be in different places, in different shapes and sizes. So let's very quickly remind folks about how you did that and the value of that in a, in a, so,
[00:07:24] Monzy Merza: when you deploy Crogl in an environment and you give it access to your data stores, Crogl builds a semantic layer without transforming the data, without normalizing or moving the data to connect the dots.
It's called source ip. In one data lake, it's called S-O-U-R-C-E-I-P, in another data lake, and it's called basal in another data lake. The labels don't matter, is that, it's the semantics of how that happens. And then Crogl builds that gap and the data stays there and the data stays where the data is.
You can bring new data on. You don't have to go through migration processes, and you can literally keep adding data during the course of an investigation. Without having to go through the months long cycles that everybody's used to. And everybody literally, they just accepted it. Yeah. And that's, I, we believe that that should not be the case as a, as practitioners ourselves.
We just want to use whatever we want to use in the moment that we need it.
[00:08:12] Sean Martin: Exactly. Now I'm gonna bring us to the download. Because you mentioned earlier, nobody else is doing the free download for an AI SOC. Um, why? 'cause there's a lot of setup. Your stuff connects to the things that already exist and, and you give them the ability to connect.
[00:08:31] Monzy Merza: Yes.
[00:08:31] Sean Martin: Configures. So tell us about the. The free download and, and the, the time
[00:08:36] Monzy Merza: to
[00:08:36] Sean Martin: value there,
[00:08:37] Monzy Merza: right? Yeah. Well, the big, the big thing for us was there's a lot of people that talk about using AI and security operations, and there's, it's very difficult to get into a, a meaty conversation to talk about ontologies and architectures and multiple models, and, and I can, I can say a lot of things about what a Crogl customer does, where they.
Automatically connect to things in the middle of an investigation without having to normalize data, and that's what customers are doing. Well, it doesn't have to be a secret. We want everybody to benefit from that, right? And so we, we created the free download approach to just say, just go download it. If you have a need and you have a problem, just go download it and see it for yourself.
We had a LinkedIn post the other day where somebody said they downloaded Crogl and they went from, from not being able to do an investigation. To getting a complete report out on a net new Crogl install from download to report submission in under 10 minutes. Wow. It's not my words, it's just a person that I don't even know out there who just did it.
[00:09:34] Sean Martin: Right.
[00:09:34] Monzy Merza: And, and that's, to us, it's, that's amazing. And that's, that's a community that we want to participate in and that's what we want to build for.
[00:09:41] Sean Martin: I wanna stick on this one more for another moment. So any other early, so that was a random, somebody just saying, this is really cool. You've had, I'm sure direct engagements with folks downloading. What, uh, what do you, what are hearing whatcha seeing? Yeah.
[00:09:56] Monzy Merza: Well, the, the biggest thing that we're seeing are, are the things around the user's ability to connect to any arbitrary data source. Or any arbitrary enrichment source or any arbitrary case management ticketing system just on the fly. 'cause we flipped that model of extension building from, oh, you have to go through this long treadmill of trying to build an extension to, well, you should be able to connect to whatever you want to connect and it should get immediately integrated.
Into your overall workflow. So that's the biggest thing that we're seeing is we did a talk yesterday on a similar topic. Somebody came up to me and said, you know this blast radius thing that you just showed as a in in the talk. Can I do that in my environment? And before we left that conversation, we can demonstrate to that person is like, here it is.
Right? And so I think that's the kind of. That's the kind of reaction that that really enriches us. And I think that's a kind of, I, I wanna say just validation really from the community that people just want to, they just want to see it. Like, let's not talk about it. Let's, let's do it. Yeah.
[00:10:53] Sean Martin: So let's, let's go to. The real value of what you're doing is, I think it's imperative and I, it's, I've seen, I've been in this space for a long time. I've seen where it's really hard to get things deployed, really hard to get them working. You're doing a phenomenal job with all of that. Really only matters if. It does what it's supposed to, right?
Which is protect the business, give the team the ability to, to show an audit that says, here's how we handle something and why. So let's look at the value of Crogl and what it actually does. Listen some stories of. Where different models have been plugged in and
[00:11:34] Monzy Merza: yeah,
[00:11:34] Sean Martin: different use cases come out.
[00:11:35] Monzy Merza: So I'll start with, so two major. So you know, at the end of the day you ask what does Crogl do? But Crogl customers are doing two things. They're investigating alerts either autonomously or interactively, and. They're doing threat hunting also, either autonomously or interactively. And then when they do that work, the biggest pain point for the practitioner is, well, how do I take credit for my work?
Which oftentimes comes in the form of documentation. So those are the three basic pillars of, of what's going on. And so from a use case point of view, the from a value point of view, organizations have thousands and thousands of alerts. A given analyst on a shift can work maybe 10 alerts at a time. 10 in the totality of that shift, right?
So now we're raising the bar. So now you can work 50 60 alerts in a shift because now the only thing that the analyst is seeing as a consequence of using Crogl is the thing that they really need to pay attention to. And the other stuff, they already have the documentation done. They already, Crogl has already created a verdict for them to say, Hey, this should be escalated.
This should be closed with some information and knowledge. So it's reducing, reducing that workload on the analyst. So now an analyst can do more. Then what happens from a, from a business point of view, then you have two significant advantages. One, whatever is happening, you're reducing your risk because you're, you're.
Investigating the alerts, and when the auditor comes in for you and on a reg on the regulated side, you can show that auditor. So your audit cycles go faster. You keep your re your, your regulators happy, and you do that, you do that a lot faster. Second thing that happens is you, because of our ability to analyze data wherever data lives, regardless of its schema.
It creates cost optimization opportunities for the customer. You can leave the data in cheaper batch storage if that's what you want to do. You don't have to move it across egress pipeline somewhere and pay for that egress cost. You can keep your data wherever that data is, and you don't have to use expensive storage if you don't, if you don't want to.
You don't have to have complicated pipelines if you don't want to. So there's a, there's a clear cost benefit for deploying Crogl in these. In these environments. I mean, some of our customers, you know, one of our customers has a hundred terabytes of data per day across six data lakes. Can't go to that customer, say, Hey, just move the data over into one place.
It's not gonna happen. No. And so they're, they're getting the benefit of doing the things that they need to do, regardless of where the data is. And that's real value, reduces complexity, reduces cost for. For that customer.
[00:13:59] Sean Martin: Talk to me as we close here, kind of the impact on SOC teams. Um, I know there's a lot of angst with, is this gonna replace me?
Am I gonna, am I gonna not have a job in the future? Or how, but they also don't want to be burnt out. Yes. So they're one, one sense. They're welcoming the ability to do better things without a lot of the heavy heaviness of it. So talk to me about some of the impacts you're having on.
[00:14:28] Monzy Merza: There is the security community in general. You know, there is a bunch of different facets. Not everybody is the same, so you can't just put a broad brush stroke on people. Right. But the colleagues that I interacted with, they have like a couple different things in common. One, they're very, very curious. Two, they wanna make a difference. So they care and they're curious and, and they are, they wanna work hard for the right reasons.
[00:14:49] Sean Martin: Yeah.
[00:14:49] Monzy Merza: So that's a third scene. Care, curious, committed. Yeah, right. And so with, with Crogl now what we're finding is it's not that they're concerned about it's gonna take my job away, or it's not gonna do something. Now they're saying, great. I didn't want to look at that 17,000th phishing email anyway. Now I can really focus on something that new and something that's more useful and valuable to my environment.
I can exercise my intuition, just like the person who started doing fraud detection using Crogl. I can look at new C, you know, new CSEC cabs. That I wasn't really able to analyze a blast radius for before. Now I can do that. And so these are the kinds of things where people are actually using more of the capability and finding value from that.
This is why we did the hackathon. So people can come and see like how do they exercise their intuition and, and if you, and yeah, for those, let me show you this. This is cool. This, this is, this is the challenge coin.
[00:15:43] Sean Martin: Look at that.
[00:15:44] Monzy Merza: That, that the, that the, that the competitors are the, and the participants at the high. Yes, this is, this is substantial. Right? And because, because we want people to see it. And what we're seeing is people are not saying, this is gonna replace me. They're saying, this is cool.
[00:15:58] Sean Martin: Yeah.
[00:15:58] Monzy Merza: I want to do more. I wanna make a difference.
[00:16:01] Sean Martin: I love it. I always love chatting with you, my friend.
[00:16:03] Monzy Merza: Likewise, Sean. Thank you. It's great to see you.
[00:16:05] Sean Martin: So happy you're doing so well and, uh. So happy you're able to help others do so well.
[00:16:10] Monzy Merza: Yeah, please download it
[00:16:13] Sean Martin: crogl.com/download and uh, I encourage everybody connect with Monzy, super cool guy, team Crogl most rates, grab the download and uh, stay tuned more here on ITSPmagazine.
Awesome.
[00:16:27] Monzy Merza: Thank you.
[00:16:29] Sean Martin: Nice.