Senior Technical Support Engineer

Alation named a Leader in the 2026 IDC MarketScape for Worldwide Data Intelligence Platform Software. Recognition highlights Alation's strengths in agentic AI embedded across the data intelligence life cycle, and governed, AI ready data products on an open, federated architecture. September 04, 2026 09:00 ET | Source: Alation, Inc. REDWOOD CITY, Calif., Sept. 04, 2026 (GLOBE NEWSWIRE) - Alation Inc., the creators of the intelligence operating system, today announced that it has been named a Leader in the IDC MarketScape: Worldwide Data Intelligence Platform Software 2026 Vendor Assessment (doc #US54118226, August 2026). The IDC MarketScape assessed 15 vendors in the worldwide data intelligence platform software market, evaluating each supplier's capabilities and strategy against a common framework of current and future market success factors. The assessment considered each vendor's current capabilities and ability to meet customers' future data intelligence needs. "The defining question is whether organizations can trust AI to make decisions and take action. Moving AI into production isn't about any single app, it's about ensuring you have the right governance, observability, and feedback," said Satyen Sangani, CEO and co-founder of Alation. "Enterprises need governed agents, data, business context, and policies that agents can use to operate precisely and transparently. Being named a Leader in the IDC MarketScape reflects the work we've done with our customers to build that foundation." Alation's positioning reflects a broader shift in this market: governance and context must travel with data across open, federated architectures so both people and AI agents can act with confidence," said Stewart Bond, research vice president, Data Intelligence and Integration at IDC. "By bringing agentic AI, governed data products, and enterprise context together across the data intelligence lifecycle, Alation is addressing what organizations need to move AI from experimentation to trusted, scaled use." To operationalize AI, enterprises need trusted data and business context that can be consistently applied across people, applications, and agents. Alation recently introduced the Alation Intelligence Operating System (AIOS(TM), an open, governed architecture that brings data, context, agents, and governance together as one system, with self-improving feedback loops that continuously strengthen the system through use. The IDC MarketScape highlighted Alation's strengths in behavioral, active metadata at the core of the catalog, "Agentic AI embedded across the data intelligence life cycle" and "Governed, AI-ready data products on an open, federated architecture." These capabilities are central to AIOS, which brings trusted data, business context, governance, and agents together across the enterprise. That architecture builds on Alation's established data intelligence foundation: a catalog that captures business meaning across platforms, lineage that traces impact through data transformation, quality monitoring that continuously validates what agents consume, and governance that applies policy across the data lifecycle. Governed data products and business context give agents the semantics they need to reason the way the enterprise does. And because AIOS is designed to be self-improving, using feedback from people and agents to make enterprise context more accurate and useful over time. Openness is also central to the architecture. Alation works across existing data platforms such as Databricks, Snowflake, Salesforce, SAP, and BI tools, semantic layers, orchestration frameworks, and models without requiring customers to centralize their environment or lock into a single technology stack. Alation supports open standards, including Apache Ossie, the Open Data Product Specification, and Model Context Protocol, and distributes governed context through open interfaces so enterprises can build agents wherever they already work. About IDC MarketScape IDC MarketScape vendor assessment model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market. The research methodology employs a rigorous scoring system based on both qualitative and quantitative criteria, resulting in a single graphical illustration of each vendor's position within a given market. IDC MarketScape provides a clear framework in which the product and service offerings, capabilities and strategies, and current and future market success factors of IT and telecommunications vendors can be meaningfully compared. The framework also provides technology buyers with a 360-degree assessment of the strengths and weaknesses of current and prospective vendors. About Alation Alation is the creator of AIOS(TM), the open, governed, self-improving intelligence operating system for enterprises that cannot afford to get AI wrong. Having pioneered the data catalog market, Alation helps organizations establish trust in the agents, data, and context that power AI-driven decisions. The result is AI organizations can trust - enabling them to navigate regulatory complexity, maintain data fidelity, accelerate operational outcomes, and transform AI ambition into trusted business impact. Alation partners with the world's leading organizations to leverage better data to solve their most critical challenges. To learn more, visit https://www.alation.com.

Why a Data Catalog breach is Different - and why you can't just rotate your way out of it. By Dan Moore, Sr. Director, CIAM Strategy & Identity Standards, FusionAuth [ Join Cybersecurity Insiders] September 2, 2026 Alation, a data catalog provider, recently disclosed a breach - and it's worth being precise about what that means. While the scope of the Alation incident hasn't yet been disclosed, a data catalog breach gives attackers a guided tour of how an organization "thinks" and where the valuables are hidden. After a breach like this, the bad guys now know how you classify what's sensitive, who can access it, and how it all connects. This stolen knowledge remains valuable for years because of data gravity and enterprise architecture persistence. It's difficult to remediate, because you can't simply change passwords or rotate tokens. What a Data Catalog Actually Stores A data catalog is basically an inventory of your data assets - tables, schemas, pipelines, APIs - with enough metadata attached that someone can find what exists and understand what it means without hunting down the person who built it three years ago. Companies build things that reflect their organization, so a catalog doesn't just reveal system structures, it reveals organizational and employment ones too. A data catalog is like a reconnaissance gift for hackers. Schema metadata tells attackers where the sensitive fields (ssn, phone number, api_key) are before they touch a database. Lineage graphs map how data moves between systems, giving attackers clues about potential lateral movement paths, and access control docs, if available, tell them which service accounts to target. Catalogs are usually less access-controlled than the data they describe, because discoverability is the whole point - that's a design constraint, not a misconfiguration. With catalog metadata in hand, an attacker turns a random walk into a directed search. They already know what's valuable and where it lives - now they just have to solve for the path. Practically speaking, this means they can target the named service accounts, probe tables with stale quality checks nobody's watching, and use lineage to find weaker upstream systems feeding the same sensitive data with fewer controls. Why "Data Gravity" Makes This Different Data gravity is why the architectural knowledge exposed in a data catalog remains valuable for years. At enterprise scale, data is difficult to move, and applications, integrations, pipelines, and business processes accumulate around it. Over time that makes the architecture surrounding the data difficult to change too. That persistence is what matters after a breach. You can change a password or revoke a token in minutes, but you can't simply redesign your data architecture because an attacker learned how it works. Moving critical data, restructuring pipelines, and changing the applications and processes that depend on it can take months or years. The result is that much of what an attacker learns from a data catalog can remain useful long after the initial breach. Why Remediation Looks Nothing Like a Typical Breach Response The damage is informational, not transactional - you can rotate credentials after a database breach, but you can't un-expose your architecture. The knowledge persists in the attacker's head, and the attack it enables is future-dated, possibly months out. There's no clean remediation process, mostly damage limitation: audit catalog access logs, rotate exposed credentials, and tighten ACLs immediately; add monitoring and review service-account permissions over the following weeks; then spend months deciding what metadata actually needs to be in the catalog versus what's just convenient. You're raising the cost of the attacker's next step, not undoing the recon. Part of the problem is that organizations don't guard catalogs the way they guard production databases. MFA is inconsistent, reads often aren't logged at all, and metadata rarely gets the same least-privilege controls as the sensitive data it describes. The catalog gets treated as internal tooling rather than a sensitive system in its own right - even though security investment should follow data sensitivity, not the label on the system. The Worst-Case, Compound Attack The worst-case version of this is a stolen catalog combined with a separate access breach down the line. This attack becomes compounded with catalog knowledge sitting dormant until an attacker gets a credential through phishing or a leak. Instead of wandering and tripping alarms, they go straight to the highest-value tables, via the least-monitored path, timed to when they know monitoring runs. That precision and speed is what makes it dangerous. An attacker with catalog knowledge looks like a legitimate user who knows exactly what they're doing. Detection tools flag unusual behavior, but if hackers know the architecture, their behavior is less likely to be unusual. What CISOs Should Do Now The one non-negotiable control before a catalog goes into production is audit logging on reads. You need to know who accessed catalog metadata, what they accessed, and when. Without that forensic trail, you can't determine what an attacker learned or which systems, identities, and data they may target next. You're flying blind. That visibility also tells security teams where additional controls are needed, including MFA, tighter ACLs, and stronger monitoring. Read logging is available in many catalog platforms, so organizations should ensure it's actually enabled. If your company is an Alation customer, contact your support team for guidance now. For more on attackers using information repositories like data catalogs, see MITRE ATT&CK technique T1213. Dan Moore is the senior director of CIAM strategy and identity standards at FusionAuth, where he drives B2C product direction and serves as a primary spokesperson on authentication, developer identity, and the emerging challenge of securing AI agents. With over 25 years of software engineering experience - including stints as a CTO, AWS certification instructor, and engineering manager - he is a regular speaker at identity and security conferences and a sought-after podcast guest on authentication and developer security. He is the author of Letters to a New Developer (Apress) and a contributor to 97 Things Every Cloud Engineer Should Know (O'Reilly).