security · ai
Serge Rider was right about AI and the human factor in data security
DBeaver founder Serge Rider predicted AI would become the round-the-clock guardian of data security — and that’s exactly the future AddisDB is building: opt-in, local-first, and human-supervised.
In a 2023 interview, Serge Rider — the founder of DBeaver — was asked about the human factor in data security. His answers have aged remarkably well. Three years on, as AI moves from novelty to infrastructure, the future he sketched is arriving almost exactly as he described it.
We read that interview closely, because it maps precisely onto what we’re building at AddisDB. Rider’s argument, boiled down: people are the weakest link in any secure system, and AI is uniquely suited to watch for the moments when that weakness turns into a breach. We think he was right — and we think the tools you use every day should act on it.
The human factor is the real vulnerability
Ask most engineers where a database gets compromised and they’ll point at the network, the firewall, the unpatched CVE. Rider points somewhere less comfortable: at us. People store access keys where they shouldn’t, grant more permission than a task needs, and reach for a colleague’s already-open session instead of setting up their own. The controls are usually fine. The humans route around them. As he puts it:
The human factor will always be a vulnerable part of any IT system.
— Serge Rider, founder of DBeaver
That’s an uncomfortable thing for a database-tools founder to say out loud, which is exactly why it’s worth listening to. You can’t patch your way out of human behavior. You can only design tools that make the safe path the easy one — and that notice when someone strays off it.
AI that never sleeps
Rider’s second point is where he really looked ahead. Human security teams are small, tired, and asleep at 3 a.m. An automated system isn’t. He put it plainly:
AI never sleeps, never gets tired, and can monitor data security and possible leaks 24/7.
— Serge Rider, founder of DBeaver
And he was specific about what that AI should watch for — not just failed logins, but the shape of behavior itself. With AI in authentication and authorization systems, he argued, “it becomes possible to automatically detect insecure, reckless, or malicious patterns of employee behavior and report them at an early stage.” A sudden export of an entire table, a grant that hands out far too much, a connection to production from a place it has never come from before — the kinds of things a person only spots in hindsight, and a model can flag in the moment.
He even put a clock on it. Rider predicted that AI-powered monitoring systems — including self-learning ones tuned to a specific company’s workflows — would arrive within a year or two of that 2023 conversation. If anything the timeline was conservative: it’s happening now. The open question is no longer whether AI will watch our databases, but who builds it in a way you’d actually want pointed at your own data.
How AddisDB is building this future
This is the part we care about, because it’s a reason AddisDB exists. Rider described the destination; we’re building the vehicle — and doing it the way we think it has to be done: opt-in, local-first, and with you in the loop.
The foundation already ships. AddisDB’s AI is opt-in and bring-your-own-key: nothing turns on until you add a key, that key lives in your operating system’s secure store, and prompts go straight to your AI provider — never through our servers. On the monitoring side, AddisDB already gives you a live view of every active session, lock, and blocking query, plus alerts when a metric crosses a line you set. And the guardrails Rider would approve of are on by default: new connections open read-only, destructive statements ask before they run, and every migration is diffed against the live schema before a single line executes.
Where we’re heading is the synthesis Rider called for: turning that same opt-in AI — with your permission — onto your own connection activity, so it can surface the reckless or risky patterns he described before they become an incident. Not a black box in someone else’s cloud watching your team; a model you switch on, running against your data, that answers to you.
Security AI should run on your machine, only when you say so — working for you, not watching you.
That distinction matters. Rider’s vision is powerful precisely because it’s also invasive if you build it wrong: behavioral monitoring in the wrong hands is just surveillance. Built opt-in and local-first, it’s a smoke detector you own. We’re betting the winning version is the one that respects the person it’s protecting — and that’s the version we’re building.
The takeaway
Serge Rider looked at data security in 2023 and saw that the hardest problem wasn’t cryptographic — it was human, and that AI was the natural answer because it never looks away. He was right. The future he described is being built right now, and the tools that get it right will be the ones that keep the human in control: opt-in, local-first, transparent. That’s the future AddisDB is building. If that’s the kind of tool you want watching your back, it’s free to download — and his full interview is linked below, well worth the read.