Fortgeschrittene KI-Modelle konnten durch Ausnutzung bisher unbekannter Schwachstellen aus einer eingeschränkten Testumgebung entkommen.
OpenAI erklärt, die Modelle hätten ein vorgegebenes Ziel verfolgt und nicht in böswilliger Absicht gehandelt, dennoch hätten sie einen tatsächlichen Sicherheitsvorfall verursacht.
Herkömmliche Kontrollmechanismen wie Sandboxing und Segmentierung reichen nicht aus, wenn KI unerwartete Wege finden kann, diese zu umgehen.
Cyber-Resilienz gewinnt zunehmend an Bedeutung und wird ebenso wichtig wie Prävention.
Es begann als interne Bewertung fortschrittlicher KI-Fähigkeiten im Bereich Cybersicherheit. Beim Versuch, eine eng definierte Benchmark-Aufgabe zu lösen, entdeckten die OpenAI-Modelle eine Zero-Day-Sicherheitslücke, umgingen die vorgesehenen Einschränkungen ihrer Testumgebung, erweiterten ihre Berechtigungen, erlangten Zugriff auf das Internet und kompromittierten die Infrastruktur von Hugging Face. Sie betrachteten die technischen Grenzen, die sie umgaben, als Probleme, die es zu lösen galt.
Die beteiligten Modelle, darunter GPT-5.6 Sol und ein leistungsfähigeres Vorabmodell, arbeiteten mit reduzierten Cyber-Sicherheitsmaßnahmen und ohne die üblichen Produktionsklassifikatoren. Sie gingen weit über den Auftrag hinaus, nutzten eine Proxy-Sicherheitslücke aus, um Zugang zum Internet zu erhalten, und nutzten anschließend gestohlene Anmeldedaten sowie Zero-Day-Schwachstellen, um einen Weg zur Ausführung von Remote-Code auf den Servern von Hugging Face zu finden.
Ein böswilliger Vorsatz war nicht erforderlich
Es gibt keine öffentlichen Hinweise darauf, dass die Modelle kriminelle Absichten entwickelten oder sich dafür entschieden, Hugging Face zu schaden. Das mussten sie auch gar nicht. Gib einem leistungsfähigen System ein Ziel, Werkzeuge, Zeit und Feedback, und es wird Hindernisse umgehen. Die Diskussion geht mittlerweile über einfache Eingabeaufforderungen und falsche Antworten hinaus. Es handelt sich um Systeme, die Nachforschungen anstellen, Annahmen überprüfen, bisher unbekannte Schwachstellen aufdecken, gestohlene Zugangsdaten nutzen, Berechtigungen erweitern und auch dann weiterarbeiten können, wenn der erste Ansatz fehlschlägt.
Eine Sandkiste ist kein Kraftfeld
Wir bezeichnen Umgebungen als isoliert, segmentiert und in einer Sandbox, als ob schon die Bezeichnung allein Sicherheit schaffen würde. Das tut sie nicht. In diesem Fall war der offensichtliche Weg ins Internet blockiert, ein erreichbarer Proxy für Softwarepakete jedoch nicht, und die Modelle nutzten dessen Schwachstelle, um zu entkommen. Richtlinien und erwartetes Verhalten reichen nicht aus. Die technische Umgebung selbst muss die Grenzen durchsetzen.
Warum dies eine Geschichte über Resilienz ist
The activity moved from an evaluation environment, through OpenAI’s research infrastructure, onto the internet, and into Hugging Face’s production environment. That is a rapidly expanding blast radius. When AI can explore and act at machine speed, the time between initial access and broader compromise may continue to shrink.
Hugging Face did not simply block the original access path and declare the incident over. It closed the vulnerable code-execution paths, rebuilt compromised nodes, rotated credentials and tokens, and tightened cluster controls. The objective is not merely to restore a system. It is to restore confidence.
The question is no longer only: Are our AI systems secure? It is: When a powerful AI system finds a path we did not know existed, can we contain the blast radius, continue critical operations, rebuild what we no longer trust, and prove it is safe to move forward?
Chris Bevil is Principal Portfolio Marketing Manager at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
Das rasante Wachstum der Sicherheitslücken und die durch KI ermöglichte Erkennung verkürzen die Zeitspanne zwischen der Offenlegung einer Sicherheitslücke und ihrer aktiven Ausnutzung.
Regelmäßige, disziplinierte Patch-Zyklen tragen dazu bei, das Gesamtrisiko zu verringern und sich auf neue CVEs vorzubereiten.
Die Wiederherstellung ist für die Ausfallsicherheit unerlässlich, muss jedoch mit zeitnahen Patches einhergehen, um Sicherheitslücken zu beheben.
Unternehmen sollten KI einsetzen, um die Erkennung und Behebung von Schwachstellen zu beschleunigen, anstatt zuzulassen, dass sich Probleme im Rückstand anhäufen.
Anbieter, die eine entscheidende Rolle spielen, informieren ihre Kunden schnell und transparent über Sicherheitslücken und geben klare Anleitungen zur Behebung dieser Schwachstellen.
Im vergangenen Jahr ging ausBranchenberichtenhervor, dass das jährliche CVE-Volumen im fünfstelligen Bereich lag; das NIST stellte später ein Rekordwachstum bei den CVEs sowie einenAnstieg der Meldungen um 263 % between 2020 and 2025.
I hear what that does to a security team in real time, because I am on the calls when it happens. The old questions – what is our exposure, and how fast can we close it? – used to have room to breathe. Now they arrive faster than most teams can staff for them.
Most organizations have vulnerability response processes. Fewer have processes designed for this speed.
For years, the industry organized its response around individual vulnerabilities. A CVE would publish, severity scores would follow, enrichment would catch up, and teams would triage with some margin for judgment. That rhythm assumed a human pace of discovery, but that assumption no longer holds.
That volume is already outrunning the infrastructure built to track it. NIST has said the National Vulnerability Database is moving to a risk-based enrichment model because CVE submissions have grown faster than the program can fully process them.
AI is likely compounding pressure by helping threat actors exploit vulnerabilities, and defenders identify and validate vulnerabilities faster than legacy cataloging workflows can absorb. The window between when a vulnerability is discovered and when it is exploited is closing, and working exploit code can appear before a patch is widely deployed.
That breaks the old model. Structured vulnerability management still matters, but many programs are calibrated for a slower era: gather signal, rank risk, assign owners, then remediate. When discovery accelerates this sharply, even disciplined teams fall behind because the operating model cannot absorb the volume fast enough.
So, the unit of work must change. It no longer matters whether you patched a specific vulnerability but whether your organization can apply, verify, and recover at the speed the threat environment now demands.
Aufnäher auf einer Uhr
Beginnen Sie mit der Kadenz. Die widerstandsfähigsten Betriebe, die ich kenne, betrachten das Patchen nicht mehr als Unterbrechung, sondern als routinemäßige Wartungsmaßnahme: wöchentlich geplant, mit klarer Zuständigkeit und wie jede andere betriebliche Verpflichtung messbar. Ein vorhersehbarer Rhythmus trägt dazu bei, das Zeitfenster, in dem das gesamte Netzwerk einem Risiko ausgesetzt ist, zu verkürzen und die durch einzelne Sicherheitsmitteilungen verursachte „Panikprämie“ zu beseitigen. Wenn Patches wöchentlich installiert werden, sind Unternehmen auf CVEs vorbereitet.
„Cadence“ bedeutet nicht, alles gleich zu behandeln. Eine Sicherheitslücke, die aktiv ausgenutzt wird – also eine, die inCISA’s Known Exploited Vulnerabilities Catalogaufgenommen wird –, löst nach wie vor eine sofortige, außerplanmäßige Reaktion aus. Der wöchentliche Zeitplan bewältigt die Flut an Meldungen routinemäßig, sodass echte Notfälle die gebührende Aufmerksamkeit erhalten, anstatt im Rauschen unterzugehen.
Schließt die Sicherheitslücke, nicht nur die Lücke
Hier liegt der Teil, den die Recovery allein nicht beheben kann. Wenn eine Schwachstelle eine Ressource gefährdet, setzt die Recovery dieser Ressource ohne Behebung der Schwachstelle lediglich die Uhr zurück. Die Schwachstelle ist immer noch vorhanden und wartet auf den nächsten Angriff. Die Recovery ist wichtig, aber sie ist kein Ersatz für das Schließen der Lücke, durch die der Angreifer eingedrungen ist.
Das bedeutet, dass die eigentliche Arbeit früher erfolgen muss – nämlich an dem Punkt, an dem Schwachstellen entdeckt und behoben werden. KI verändert diese Gleichung auf beiden Seiten. Dieselben Modelle, die einem Angreifer helfen, eine Ausnutzungsmöglichkeit zu erkennen, können einem Anbieter helfen, sie zuerst zu finden. Die Entwicklungsabteilung von Commvault lässt unsere eigene Codebasis durch KI überprüfen, um Schwachstellen bereits vor der Veröffentlichung aufzuspüren, und wir setzen KI ein, um die gefundenen Probleme zu beheben, anstatt sie in einen Backlog zu verschieben. Eine Schwachstelle, die wochenlang in der Warteschlange steht, weil einem Team die Kapazitäten ausgegangen sind, bleibt dennoch eine Schwachstelle. Eine schnelle Erkennung bedeutet nichts, wenn die Behebung nicht ebenso zügig erfolgt.
Stellen Sie höhere Anforderungen an Ihre Lieferanten
When the window between discovery and exploit is measured in hours, customers cannot afford to learn about a vulnerability in their vendor’s product from a third party.
They need to hear it from the vendor, early, in plain language, with a direct answer to “Am I affected?” and “What do I do first?” Ask every critical vendor how quickly they disclose, how they notify affected customers, what evidence they provide for remediation, and how customers can validate that the exposure is closed. Vulnerability transparency is part of resilience.
The frontier AI era will not be won by whoever ships the fewest vulnerabilities. Every serious software company will disclose more. The advantage goes to whoever treats patching as a standing discipline and treats recovery as the discipline that makes a missed window survivable.
FAQs
Q: Why is the window between vulnerability discovery and exploitation getting shorter? A: AI is likely compounding pressure by helping threat actors exploit vulnerabilities, and defenders identify and validate vulnerabilities faster than legacy cataloging workflows can absorb. As a result, exploit code can become available before many organizations have had time to deploy patches.
Q: Why are weekly patching cycles becoming more important? A: A consistent weekly patching schedule helps reduce the organization’s exposure to known vulnerabilities. It also allows security teams to focus immediate attention on actively exploited threats and prepare new CVEs.
Q: Is disaster recovery enough to protect against cyberattacks? A: No. Recovery helps organizations restore operations after an incident, but restoring systems without addressing the underlying vulnerability leaves them exposed to future attacks. Effective resilience requires both rapid remediation and reliable recovery.
Q: How can AI help improve vulnerability management? A: AI can help identify vulnerabilities earlier, prioritize remediation efforts, and accelerate the resolution process. This helps security and engineering teams respond more quickly instead of allowing vulnerabilities to remain unresolved in lengthy backlogs.
Q: What should organizations ask their software vendors about vulnerability management? A: Organizations should ask how quickly vendors disclose vulnerabilities, how affected customers are notified, what remediation guidance is provided, and how customers can verify that the issue has been fully addressed. Transparent communication is an important part of cyber resilience.
Security does not end at the edge of an organization’s own systems. Modern businesses connect a growing web of third-party applications to their core platforms to support sales, service, and collaboration. Each of these connections adds value. Each one also introduces exposure the organization does not fully control.That risk is not hypothetical. In June 2026, a threat actor compromised OAuth tokens tied to Klue, a competitive intelligence platform used to sync sales and marketing data with Salesforce. The attacker used those tokens to reach the Salesforce environments of the many organizations that had authorized the integration, including Commvault’s.As soon as we were notified of potential impact, our Security team activated our incident response process to determine what had occurred, contain the exposure, and assess whether customer information or Commvault services were affected.Our investigation found that the activity was limited to certain business relationship and sales information maintained within our Salesforce environment. The investigation found no indication that any customer backup data, product data, product metadata, operational logs, or Commvault services were impacted.
Acting Quickly When It Matters
Our response followed established security incident response procedures built to contain risk quickly while supporting a thorough investigation. Once we were notified of the incident, we disabled the Klue integration, revoked the associated access, and worked with the appropriate parties to conduct a full assessment of what happened.Throughout the investigation, our teams worked to determine what information had been accessed, validate the integrity of our environment, and confirm the incident stayed within the scope we had already contained.
A Pattern Worth Noting
This incident is one recent example of a pattern security teams have watched grow for several years: attackers targeting third-party applications connected to core business systems rather than attacking those systems directly. A single compromised integration can offer a trusted path into the environments of many downstream organizations at once, often with less resistance than a direct attack on any one of them.This shifts where an organization’s defense actually has to live. Strong internal controls remain necessary, but they are no longer sufficient by themselves. They have to be paired with active oversight of every application an organization connects, and a response capability that is ready before an incident, not built during one.
Building Resilience Beyond Our Own Environment
At Commvault, our security program includes ongoing assessment of the third-party applications connected to our environment. We review connected applications on a regular basis, evaluate the access each one holds, monitor for emerging risk, and reassess those integrations as business needs and the threat landscape change. When circumstances warrant, we act to reduce exposure and strengthen our posture, including disconnecting integrations that no longer meet our standards.
Our Commitment to Transparency
Trust is built through openness and accountability. When an event affects our stakeholders, we believe it is important to communicate what we know, explain how we responded, and share the outcome of our investigation, even when the event originated outside our own systems.We will continue to evaluate our security controls, refine our incident response processes, and strengthen our approach to third-party risk as part of our broader commitment to protecting our customers and partners.For the official details of this incident, including the scope of the investigation and customer guidance, please refer to ourTrust Center Updates.Will Galway is Deputy CISO at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
So konzipieren Sie einen einheitlichen Datenschutz: Ein „Single- Platform “-Ansatz für moderne Workloads
Unified data protection consolidates security, recovery, governance, and AI automation into a single platform, enabling consistent protection and reliable recovery across hybrid and multi-cloud environments
Der einheitliche Datenschutz vereint Sicherheit, Wiederherstellung, Governance und KI-Automatisierung in einer einzigen Plattform platform und trägt so dazu bei, die Komplexität zu reduzieren und gleichzeitig die Cyber-Resilienz zu stärken.
Ein einheitlicher Datenschutz ersetzt fragmentierte Tools durch eine zentrale Verwaltungsebene, die lokale, hybride und Multi-cloud -Umgebungen umfasst und so die Gesamtbetriebskosten (TCO) optimiert.
Isolierte Schutzstrategien erhöhen die Komplexität des Betriebs, beeinträchtigen die Transparenz und schwächen das Vertrauen in die unternehmensweite Wiederherstellbarkeit.
Ein einheitliches „ platform “ verbindet Datensicherheit, Cyber-Wiederherstellung und Identitätsresilienz, um die allgemeine Cyber-Resilienz zu stärken.
A dedicated instance delivers isolated resources, streamlined compliance and data localization, along with SaaS-driven innovation – helping enable secure, compliant operations without infrastructure management overhead.
Integrierte KI-Funktionen unterstützen die automatisierte Erkennung, die intelligente Durchsetzung von Richtlinien sowie schnellere und sauberere Wiederherstellungsergebnisse.
Most enterprise data protection strategies were designed for a world that no longer exists — before cloud sprawl, AI-generated data growth, and hybrid infrastructure became the norm. Commvault Cloud addresses this architectural gap with a unified platform that connects data security, cyber recovery, identity resilience, and AI-enabled governance across every environment from a single control plane.
Why Do Modern Enterprises Need Unified Data Protection?
von Commvault und Tech Research Asia hat kritische Lücken bei den Maßnahmen zur Cyber-Recovery in Unternehmen im gesamten asiatisch-pazifischen Raum aufgezeigt.IBM’s Cost of a Data Breach Report 2025, the average cost of a data breach stands at a staggering $4.4 million globally, with costs rising significantly when recovery is delayed or incomplete.
At the same time,the World Economic Forumnotes that as organizations confront AI threats, geopolitical volatility, and supply chain vulnerabilities, the need for resilience has never been clearer.
Enterprise data protection is rapidly entering a new period of drastic modernization. Data no longer lives in predictable locations, and it certainly does not remain still. Critical workloads exist across on-premises infrastructures, multiple public clouds, SaaS platforms, containers, and emerging AI pipelines. Each environment brings its own operational model, its own tooling, and its own risks.
For security and IT teams, the pressure is intensifying. Many organizations are now confronting three critical structural challenges simultaneously:
AI is generating exponential volumes of distributed data, which expands the potential attack surface.
Many enterprises still rely on siloed products to secure, protect, manage, and recover data, even though those tools were never designed to operate together.
There is no one-size-fits-all approach. Modern enterprises run across on-premises, cloud, and hybrid environments, and require resilience that spans all of them.
This complexity did not emerge overnight. It developed as cloud adoption accelerated and application teams moved faster than protection strategies could evolve, resulting in fragmented visibility, inconsistent operations, and uncertainty around recovery readiness.
In this landscape, unified data protection has emerged as the architectural response – establishing a single control plane that helps protect workloads consistently across environments, reduce complexity, and strengthen confidence in enterprise-wide recoverability.
Wie beseitigt ein einheitlicher Datenschutz die Fragmentierung?
Eine aktuelle Studie vonIBMund Palo Alto Networks hat ergeben, dass ein durchschnittliches Unternehmen über 83 verschiedene Sicherheitslösungen von 29 Anbietern verfügt. In dieser bedauerlichen neuen Normalität sind 52 % der Führungskräfte der Ansicht, dass die Komplexität das größte Hindernis für den Sicherheitsbetrieb darstellt.
Die Fragmentierung des Schutzes führt zu Ineffizienzen und erhöht gleichzeitig aktiv die Betriebs- und Sicherheitsrisiken. Häufig führt jede neue Workload-Kategorie zur Einführung eines weiteren Schutztools. Cloud-native Backups werden getrennt vom Schutz virtueller Maschinen betrieben. SaaS-Daten befinden sich in einem eigenen Silo. Compliance-Berichte stützen sich auf mehrere voneinander getrennte Systeme. Mit der Zeit vervielfacht sich diese Komplexität, wodurch der Schutz ungleichmäßig und schwer überprüfbar wird.
Der Betriebsaufwand wächst rasant. Teams sind gezwungen, mehrere Konsolen zu verwalten, was die Kosten und technischen Herausforderungen erhöht. Sicherheitsverantwortlichen fehlt ein einheitlicher Überblick über geschützte und ungeschützte Daten. Compliance-Teams verbringen viel Zeit damit, Nachweise abzugleichen. Finanzteams haben Schwierigkeiten, die tatsächlichen Kosten für den Schutz zu ermitteln. Und das größte Hindernis: Das Vertrauen in die Recovery-Fähigkeit schwankt, und Unsicherheit herrscht vor.
Schließlich stellen sich Führungskräfte eine grundlegende Frage: Sind wir wirklich in der Lage, unsere gesamten Daten wiederherzustellen?
Die Überwindung der Fragmentierung ist mittlerweile für den langfristigen Erfolg eines Unternehmens unverzichtbar geworden. Eine einheitliche Datensicherung soll hier Abhilfe schaffen, indem sie dazu beiträgt, Silos abzubauen und ein einheitliches Betriebsmodell über alle Umgebungen hinweg zu etablieren.
Warum benötigen moderne Unternehmen eine einheitliche Neugestaltung ihrer Architektur?
Einheitlicher Datenschutz bedeutet einen Wandel in der Art und Weise, wie Schutzplattformen aufgebaut und betrieben werden. Anstatt einzelne Umgebungen mit zahlreichen Tools zu umgeben, schaffen moderne Architekturen eine einzige Richtlinien- und Analyseebene, die sich über die gesamte Datenlandschaft erstreckt. Bei einheitlichem Schutz geht es darum, eine einheitliche Grundlage für Cyber-Resilienz zu schaffen, die Datensicherheit, Cyber-Wiederherstellung und Identitätsresilienz in einem einzigen Betriebsmodell vereint.
Ein einheitliches „ platform “ unterstützt:
Durchgängiger Schutz über das gesamte Spektrum der Workloads hinweg.
Zentraler Überblick über den Schutzstatus und die Kosten.
Einheitliche Durchsetzung von Richtlinien und Governance-Vorgaben.
Flexible Bereitstellungsmodelle, die den Anforderungen an den Datenstandort Rechnung tragen.
KI-gestützte Automatisierung, die mit dem Datenwachstum mitwächst.
Eine einheitliche Benutzererfahrung für Datensicherung, Wiederherstellung und Mobilität.
How Does Unified Protection Support Regulated and Sovereign Environments?
For heavily regulated industries and critical workloads, unified protectiohn must go beyond visibility and efficiency. It shoudl also help deliver provable isolation, geographic control, and audit readiness. Digital sovereignty requires demonstratable, auditable control over where data resides, who can access and operate the environment, and how recovery is executed. It is not achieved simply by chooisng a cloud region or provider; it depends on how the entire system is architected, governed, and operated.
Commvault „ Geo “ Shieldhelps address these requirements by helping enabling configurable controls across data while adapting to evolving customer sovereign needs in modern hybrid cloud environments. Built for real-world regulation, this solution helps keep data, metadata, and access within your region, limiting extraterritorial exposure.
Similarly,Commvault Cloud Dedicated Instanceprovides a fully isolated SaaS environment designed for organizations with strict compliance, privacy, or data residency mandates. Customers receive their own dedicated compute, storage, and management resources, and this solution is designed so that infrastructure is never shared across unrelated tenants.
Dedicated Private Instance provides several advantages for modern enterprises. It helps:
Simplify audits for frameworks such as HIPAA, FedRAMP, and GDPR.
Support data residency requirements through geographic deployment choice.
Support continuous SaaS innovation velocity while preserving isolation.
Exercise greater control over upgrade timing and feature rollout.
Reduce friction when transitioning regulated workloads to SaaS.
Dedicated Private Instance operates within the same unified platform experience. Organizations are designed to maintain feature parity and innovation speed when choosing a more controlled deployment model.
Wie stärkt KI die einheitliche Cyber-Resilienz?
Künstliche Intelligenz verändert sowohl die Bedrohungslandschaft als auch die Möglichkeiten für einen intelligenteren Schutz. Den größten Nutzen entfalten KI-Funktionen jedoch dann, wenn sie in den gesamten Lebenszyklus der Datensicherung integriert sind und nicht nur als isolierte Funktionen eingesetzt werden.
Im Rahmen der einheitlichen „ platform “ unterstützen KI-gestützte Funktionen Folgendes: Automated data discovery and classification.
Empfehlungen für intelligente Schutzmaßnahmen.
Kontinuierliche Überwachung und Durchsetzung.
Optimierungserkenntnisse, die die Kosten- und Ausfallsicherheit verbessern.
These capabilities are part of Commvault’s broader data security vision, which was strengthened through the acquisition of Satori Cyberweiter gestärkt wurde. Die Übernahme war besonders wichtig in einem Umfeld, in dem das Datenwachstum die herkömmlichen Abwehrmaßnahmen überholt.
Through this acquisition, Commvault Cloud now delivers Commvault Data & AI Security — a cloud-native capability that helps address the needs of modern enterprises adopting AI and managing sensitive data across structured and unstructured environments.
Die einheitliche Plattform „ platform “ fördert zudem die Cyber-Wiederherstellung durch KI-gestützte Workflows wieCommvault integriert diese Funktionen zur Erkennung von Bedrohungen in seine zum Patent angemeldete“, mit deren Hilfe kompromittierte Daten gezielt entfernt und gleichzeitig der reibungslose Geschäftsbetrieb wiederhergestellt werden kann. Gleichzeitig helfen erweiterte Funktionen zur Identitätsresilienz Unternehmen dabei, Bedrohungen zu erkennen, zu überprüfen und darauf zu reagieren, die auf Identitätssysteme wieAktives Verzeichnis.
Welche strategischen Auswirkungen hat ein einheitlicher Datenschutz?
Ein einheitlicher Datenschutz ermöglicht es Unternehmen, ihre Herangehensweise an die Umsetzung von Cyber-Resilienz neu zu überdenken. Durch die Zusammenführung von Datensicherheit, Cyber-Recovery und Identitätsresilienz in einer einzigen Architektur erhalten Unternehmen Zugang zu einem koordinierten Maßnahmenpaket, das in unterschiedlichen Ökosystemen einheitlich funktioniert.
Diese einheitliche Grundlage trägt dazu bei, zusätzliche Vorteile zu bieten:
Einheitlicher Schutz für alle Workloads, Clouds und Standorte, der darauf ausgelegt ist, die Verfügbarkeit vertrauenswürdiger Daten zu verbessern.
Eine einheitliche Verwaltung, die Sicherheits-, Identitäts- und Wiederherstellungsvorgänge miteinander verbindet.
Eine einheitliche Informationsplattform, die Signale aus bisher voneinander getrennten Systemen miteinander verknüpft.
Schnellere und sauberere Wiederherstellung nach Cybervorfällen.
Geringere betriebliche Komplexität auf Unternehmensebene.
Branchenbeobachter haben festgestellt, dass zwar bereits zuvor Anzeichen dieser Konvergenz zu erkennen waren, eine sinnvolle Zusammenführung dieser Disziplinen jedoch bislang nur in begrenztem Umfang stattgefunden hat. Plattformen wie Commvault Cloud treiben diese Vision voran, indem sie die Ausfallsicherheit über den gesamten Datenbestand des Unternehmens hinweg umsetzen.
Fazit: Wie prägt ein einheitlicher Datenschutz die nächste Ära der Cyber-Resilienz?
Der Trend hin zu einem einheitlichen Datenschutz spiegelt eine umfassendere Realität wider. In einer Welt, die von KI-bedingtem Datenwachstum, verteilter Infrastruktur und immer raffinierteren Cyberbedrohungen geprägt ist, können sich Unternehmen fragmentierte Resilienzstrategien nicht mehr leisten.
Mittlerweile werden Architekturen, die Transparenz, Governance, intelligente Funktionen und Wiederherstellung vereinen, zu einer grundlegenden Komponente des IT- und Sicherheitsbetriebs.
Plattformen, die nach diesem Prinzip konzipiert sind, helfen Unternehmen dabei, ihren Sicherheitsansatz zu modernisieren. Durch die Abdeckung eines möglichst breiten Spektrums an Workloads, die Unterstützung flexibler Bereitstellungsmodelle und die Einbindung KI-gestützter Intelligenz über den gesamten Lebenszyklus hinweg ermöglichen solche Plattformen es Unternehmen, die Zuversicht hinsichtlich der Wiederherstellung zu stärken, ohne dabei die Komplexität zu erhöhen.
Für Sicherheits- und IT-Verantwortliche zeichnet sich der Weg in die Zukunft immer deutlicher ab. Die Ausfallsicherheit muss einheitlich, intelligent und anpassungsfähig sein – unabhängig davon, wo sich die Daten befinden.
Häufig gestellte Fragen
Was versteht man unter einheitlichem Datenschutz, und warum ist er gerade jetzt so wichtig?
Einheitlicher Datenschutz ist ein architektonischer Ansatz, bei dem eine einzige Plattform zum Schutz aller Workloads in Hybrid- und Multi-Cloud-Umgebungen eingesetzt wird. Er ist gerade jetzt so wichtig, weil fragmentierte Tools der durch KI bedingten Komplexität, der verteilten Infrastruktur und den ausgeklügelten Cyberbedrohungen auf Unternehmensniveau nicht gewachsen sind. Commvault Cloud wurde entwickelt, um dies über eine einzige Steuerungsebene zu gewährleisten, die Datensicherheit, Cyber-Recovery und Identitätsresilienz umfasst.
Inwiefern erhöht Fragmentierung das Unternehmensrisiko?
Fragmented protection creates visibility gaps, inconsistent policies, and uneven recovery capabilities — making it difficult to verify coverage or confidently recover at scale. Commvault Cloud is designed to address this by replacing siloed tools with a unified control plane that provides consistent visibility, governance, and recovery confidence across on-premises, hybrid, and multi-cloud environments.
Wie unterstützt die Commvault- Cloud -Lösung Multi-cloud -Umgebungen ohne Herstellerabhängigkeit?
Commvault Cloud vereint die Datensicherung in AWS-, Azure-, Google- Cloud- und lokalen Umgebungen über eine einzige Benutzeroberfläche. Dieser Ansatz hilft Unternehmen dabei, Richtlinien zu verwalten, Risiken zu überwachen und Kosten cloudübergreifend zu optimieren, ohne an einen einzelnen Infrastrukturanbieter gebunden zu sein.
Welche Rolle spielen Dedicated Instances in regulierten Branchen?
„Dedicated Instance“ bietet eine vollständig isolierte „ SaaS “-Umgebung mit dedizierten Rechen-, Speicher- und Verwaltungsressourcen. Damit können Unternehmen Compliance-, Datenschutz- und Souveränitätsanforderungen erfüllen und gleichzeitig weiterhin auf dieselben einheitlichen „ platform “-Funktionen zugreifen.
Inwiefern trägt KI zu einem einheitlichen Datenschutz bei?
Commvault Cloud embeds AI-enabled capabilities across the full protection lifecycle — supporting automated data discovery, intelligent classification, policy recommendations, and continuous monitoring. Strengthened through the acquisition of Satori Cyber, these capabilities help reduce exposure windows, optimize protection strategies, and accelerate clean recovery after incidents without adding operational complexity.
Inwiefern verbessert ein einheitlicher Schutz die Ergebnisse bei der Wiederherstellung nach Cyberangriffen?
Commvault Cloud integrates data security, cyber recovery workflows, and identity resilience signals within a single platform — helping organizations detect threats earlier and execute faster, more precise recoveries. Capabilities like Synthetic Recovery and anomaly detection work together to help strengthen resilience and reduce operational disruption during incidents.
Erfahren Sie, wie die Commvault- Cloud , Datensicherheit, Cyber-Recovery und Identitätsresilienz in Hybrid- und Multi-cloud -Umgebungen über eine einzige Steuerungsebene hinweg vereint.
Erfahren Sie, wie Geo Shield Unternehmen dabei unterstützt, ihre Cyber-Resilienz mit souveränitätsbezogenen, regulatorischen und betrieblichen Anforderungen in hybriden und Multi-cloud -Umgebungen in Einklang zu bringen.
Erfahren Sie, wie „Dedicated Private Instance“ Infrastrukturisolierung mit vereinfachten Betriebsabläufen im Stil von „ SaaS “ für Unternehmen kombiniert, die strenge Anforderungen hinsichtlich Compliance, Datenschutz oder Datenstandort erfüllen müssen.
The conversation around AI is changing quickly. That’s why I’m so excited to share our podcast series Ready. Or Not. We’ve paired comedian Nathan Macintosh with expert guests to talk about AI agents, cyber resilience, trust, data management, and more.
In our first episode, Nathan sits down with Dr. Reid Blackman, founder and CEO of Virtue Consultants, to tackle one of the biggest topics in AI today: agentic AI. From ethical challenges to security risks, their conversation explores what happens when AI moves beyond making content to making decisions – and taking action.
One thing is clear: Agentic AI isn’t just another technology trend. It’s changing how we think about decision-making and the role AI will play in our organizations. If you’re wondering what agentic AI means for your business, this podcast is a great place to start.
Most AI failures are caused by unintended consequences, not malicious intent.
Agentic AI can access systems, tools, and data to get work done, making it both incredibly useful and inherently risky.
AI agents can create new security challenges, from prompt attacks to expanded attack surfaces.
Multi-agent systems can increase efficiency, but they can also amplify mistakes when systems are connected.
Organizations need practical frameworks for managing AI risks before they become real-world problems.
First, Do No Harm
One takeaway from the episode is that most AI failures don’t start with bad intentions. Many begin with organizations trying to solve legitimate business problems.
Dr. Blackman uses a failed Amazon AI recruiting tool as an example. The algorithm was trained on past resumes and hiring data to inform future hiring decisions. AI ultimately learned patterns that favored male candidates because those patterns existed in the data.
The result wasn’t what Amazon intended, but that’s exactly the point. AI systems can learn lessons we never meant to teach them.
What happened next was encouraging: Amazon tested the system, identified the issue, tried to correct it, and ultimately discontinued the project when the problem couldn’t be resolved.
We tend to treat AI failures as proof that technology can’t be trusted, but Dr. Blackman makes a different point. Responsible AI isn’t about pretending mistakes won’t happen. It’s about testing, learning, and being willing to stop when something isn’t working the way you intended.
When AI Becomes Your Coworker
The Amazon example also highlights something bigger. AI is capable of delivering value, but it can also produce unintended outcomes when we don’t fully understand how it’s learning or making decisions. Generative AI showed us what AI can create. Agentic AI is showing us what AI can actually do when it’s connected to business systems.
One comparison that stood out to me was that agentic systems are, in some ways, starting to look like employees. To be useful, they need access to the same tools, databases, and software that people use. Give an AI agent access to one system, and it can do one job. Give it access to dozens of systems, and it becomes more powerful.
“More access means more capability, but it also increases risk dramatically.”
– Dr. Reid Blackman
Sneak Peek: Keeping AI in Check
What happens when your AI agent starts interacting with other people’s agents? In this clip, Dr. Blackman explains why monitoring multi-agent systems will become one of our biggest challenges.
A New Kind of Security Challenge
Agentic AI changes more than the way work gets done. It also changes the way we think about security. Instead of following predefined workflows, users interact with AI through natural language. That makes these systems more intuitive – but it also creates new challenges that traditional software doesn’t have.
As Dr. Blackman explained, attackers don’t necessarily have to break into an AI system the way they might traditional software. Instead, they may try to manipulate it through carefully crafted prompts that influence its behavior, bypass safeguards, or expose information it shouldn’t access. It’s a reminder that as AI becomes more capable, security has to evolve right alongside it.
“Do we need AI watching AI?”
– Nathan Macintosh
The Risks of Multi-Agent Systems
If one AI agent can make a mistake, imagine what happens when multiple AI agents start working together. While it may be more efficient for systems to be connected, it also creates more opportunities for failure.
If one agent makes a mistake, it can create a ripple effect. A small issue can become a much larger one if organizations don’t understand how those interactions work. This doesn’t mean multi-agent systems are inherently risky. It simply means they require the same level of planning and oversight that organizations would apply to any complex business process.
“I learned about agentic AI today and I’m already scared. Now you’re telling me AI agents talk to other AI agents?”
– Nathan Macintosh
Do You Know Who Your AI is Talking To?
If managing your own AI agents sounds challenging, consider what happens when they start interacting with someone else’s AI. You may know your own guardrails and policies, but external AI systems may be different. You may not know how they were trained, what they can access, and if they have the same safeguards in place.
Get Ready
Agentic AI is moving quickly, and the technology will keep evolving. The organizations that succeed may not necessarily be the ones that adopt AI first. They’ll be the ones that understand how to govern it, test it, and build trust around it.
One of the goals of Ready. Or Not. is to move beyond the hype and examine what responsible technology adoption actually looks like.
Dr. Blackman’s perspective is a reminder that successful AI adoption isn’t about choosing between innovation and caution. It’s about balancing both. That’s exactly the kind of conversation we’re excited to continue throughout our series.
A: Agentic AI refers to AI systems that can take actions, access tools, interact with applications, and complete multi-step tasks with varying levels of autonomy. Rather than simply generating responses, they can actively perform work across connected systems.
Q: Why does agentic AI introduce new risks?
A: Agentic AI often requires access to multiple systems, applications, and data sources. While that access increases usefulness, it can also expand the potential impact of mistakes, misuse, or security compromises.
Q: What are prompt attacks?
A: Prompt attacks involve using carefully crafted inputs to manipulate an AI system’s behavior, bypass safeguards, or expose information that should remain protected.
Q: Why is monitoring becoming more important?
A: As AI agents become more autonomous and connect to more systems, they are also becoming less predictable. Monitoring helps organizations identify unexpected behavior early and understand how AI systems are interacting with people, data, and other AI agents.
Q: What are multi-agent systems?
A: Multi-agent systems consist of multiple AI agents communicating and collaborating with one another to complete tasks. While they can improve efficiency, they can also introduce additional complexity that organizations must manage carefully.
Q: What’s the biggest takeaway from this episode?
A: AI risk isn’t just about what technology can do. It’s about understanding how systems behave when they interact with people, data, applications, and each other – and putting the right safeguards in place before problems arise.
Katherine Demacopoulos is Senior Director of Global Content Strategy and Programs at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
For years, the working assumption in enterprise security was that a mature prevention stack could hold the line long enough for defenders to respond. Frontier AI is shaking that premise, as the latest models shrink the timeline for discovering and exploiting vulnerabilities from daysoderweeks down to almost real time.
Launched to assess the potential security risks posed by its ownMythos model, Anthropic’s Project Glasswinginitiative has already grown tonearly 200 companiesand surfaced approximately 10,000 criticaloderhigh-severity vulnerabilities. Meanwhile,OpenAI’s GPT-5.5is showing comparable capabilities.
In a recent webinar, Commvault Chief Technology and AI Officer Pranay Ahlawat and Field CTO Vidya Shankaran joined me to explore the new timeline for vulnerability management, the rising importance of recovery validation, and how teams should be thinking about resilience today.Register for the on-demand webinar.
Key takeaways
As frontier AI capability doubles on an accelerating schedule, advanced capabilities that help compress the time between vulnerability discovery and exploitation will reach adversaries within six to nine months.
Recovering an agentic AI system requires synchronizing data sources, agent configurations, and non-human identities simultaneously; restoring any single element in isolation can create gaps that surface only when something downstream breaks.
Backup and recovery solve different problems: Backup confirms that data exists somewhier safe, while recovery confirms that an organization can actually return to a clean, working state.
ResOps™ (resilience operations) frames recovery as a cross-functional discipline. It brings security, operations, and technology teams together around a shared definition of what clean actually means.
A four-step framework – defining a minimum viable company, isolating and testing crown jewel workloads, evaluating recovery for risk, and running full recovery drills – gives organizations a practical starting point.
Frontier AI Changes the Math on Vulnerability Management
The power of frontier AI now doubles approximatelyevery four months, much faster than even a few years ago. Although Mythos-type models have yet to be released publicly, adversaries may soon gain open-source access to Mythos-like capabilities, including:
An effectively unlimited context window.
The ability to construct an attack harness by reverse-compiling code and building containers to find attack vectors.
Vulnerability chaining, which is the linking of individually minor weaknesses into a serious exploit.
This has serious implications. Two out of three organizations currently carry more than 100,000 unpatched vulnerabilities, with an average fix life of approximately 240 days. In the past, security teams have dismissed many vulnerabilities as too difficult for an average adversary to chain together, but automation has rendered that viewpoint nearly obsolete.
At the same time, the use of AI for code creation – roughly 41% of new code is now AI-generated, and GitHub saw a 25% year-over-year increase in commits – is expanding the vulnerability surface faster than remediation can address it. The ability to uncover new zero-day vulnerabilities at scale compounds the problem.
When the time from discovery to exploitation approaches zero, the window for defensive action effectively closes.
Sneak Peek: The Rapidly Changing Future of AI
This clip highlights a critical reality: Advanced AI capabilities rarely remain exclusive for long. As frontier AI innovations diffuse into broader ecosystems, organizations must prepare for a future whier increasingly sophisticated offensive capabilities become more widely available.
The New Metric for Resilience: Mean Time to Clean Recovery
Backup and recovery solve fundamentally different problems. Backup only confirms that data has been copied somewhier safe, but it says nothing about whether the organization can actually return to a working state. And that’s whier things can get complicated.
Two challenges often come between a successful backup and a successful recovery.
Restoring a complex environment means recovering the application, virtual machines, network configuration, Active Directory, and transactional databases that support it, all in the correct sequence.
You have to make sure that the data you’re restoring is free of malwareoderbackdoors – something seven out of 10 organizations recovering from a cyber incident are currently unable to validate.
A recovery that meets its time target while reintroducing an active threat can be worse than no recovery at all.
To get clearer visibility into their resilience, organizations have begun using the mean time to clean recovery (MTCR)metric, which combines recovery time objective (RTO), the time required to validate that recovered data is actually clean, and a final human validation step before systems return to production. The recovery target for MTCR is theminimum viable company: the roughly 30% of an environment, sequenced by dependency, that has to come back online for the organization to keep functioning.
Cleanroom as a Testing Tool
Recovery testing, the final human validation step in MTCR, typically means standing up a separate environment from live production systems – a time-consuming task when every minute counts. While cleanrooms are sometimes seen as an element of backup, a cloud-based cleanroom can also play a proactive role in recovery by providing an isolated environment to orchestrate and test complex recoveries before they are restored to production.
The same isolated environment can also help serve as a forensic tool, letting teams stand up two versions of a backup side-by-side to better understand what changed during an incident. And because it’s cloud-native and consumption-based, organizations can avoid standing up dedicated infrastructure just to test recovery.
Four Steps to Operational Resilience
Commvault’s four-step framework for building measurable operational resilience builds on these ideas.
Step 1: Define the minimum viable company: A business-oriented view of what has to come back, in what sequence, and with what dependencies, for the organization to function again, rather than a flat inventory of databases and virtual machines.
Step 2: Make sure the systems supporting that minimum viable company sit in an air-gapped, immutable, network-segmented environment that can be spun up and down quickly. For crown jewel workloads, this should be tested on a 45-day cadence.
Step 3: Evaluate recovery for risk before declaring it complete, since reintroducing a backdooroderpiece of malware during recovery defeats the purpose of the exercise and leaves little time for a second attempt.
Step 4: Treat recovery as more than a tabletop exercise. Perform recoveries with the same people and processes that would be involved in a real incident, alongside the automation behind them.
When AI Becomes the Recovery Problem
A large share of enterprises are already running AI systems in production, but only about 20% of them have actually tested their recoverability, leaving them vulnerable in the event of an incident. This is especially significant in light of the three ways AI changes resilience architecture.
First, AI expands the surface area that needs protection, from vector databases and model weights to agent configurations and the endpoints, such as Claude CoworkoderGoogle Antigravity, whier employees actually interact with agents.
It also introduces a fan-out problem, whier a single update from an agent can cascade through a mesh of connected systems in ways that are far less predictable than a traditional three-tier application.
Finally, AI makes recovery itself more complex, since restoring an agentic system means synchronizing memory, state, transactional data, and non-human identities (NHIs) – the credentials and permissions assigned to AI agents rather than people – all at once.
The customers furthest along on agentic deployments have already made these systems part of their minimum viable company. At every stage of maturity, the emphasis is on restoring data sources, agent configurations, and supporting elements like weights and biases together, rather than as separate efforts, since misalignment between any of those pieces can introduce risk that a single point of recovery wouldn’t catch.
Taking Action on Post-Mythos Resilience
As a starting point to reduce risk from frontier AI, map your organization’s crown jewel systems and confirm that they sit in an air-gapped environment. With your minimum viable company defined, run cleanroom drills to establish a recoverability and MTCR baseline across tier-one workloads. This should be your anchor, board-level metric for resilience, showing clearly how quickly your business can resume essential operations following an incident.
Testing is critical for surfacing gaps in business, technology, and process understanding. Often, some of the biggest problems are organizational. ResOps™ (resilience operations), can address these.
A framework rather than a product, ResOps brings security, operations, and technology teams together around a shared view of what resilient design and recovery validation should look like. ResOps formalizes the growing industry recognition that cyber recovery is a cross-functional problem that requires stakeholders from across the business who each have a stake in the outcome.
In the post-Mythos era, that coordination is critical to both support ongoing readiness and enable a fast, effective response to an incident. Frontier AI makes a tested, well-defined clean recovery process a baseline requirement.
See the Full Webinar
Watch the full Resilience Over Panic session on demand to explore our four-step framework in more detail, including the requirements for agentic AI recovery.
Register hier for the webinar.
FAQs
Q: What is mean time to clean recovery (MTCR)?
A: Mean time to clean recovery (MTCR) measures how long it takes an organization to return to a verified, clean operating state after an incident. It’s a broader measure than simply how long it takes to restore data. It combines the traditional recovery time objective (RTO) with the additional time needed to confirm recovered data is free of malwareoderbackdoors, plus a final human validation step before systems return to production.
Organizations are increasingly treating MTCR, rather than recovery speed alone, as the board-level metric for resilience, since a fast recovery that reintroduces an active threat can cause more damage than a slower, verified one.
Q: How is MTCR different from RTO?
A: RTO measures how quickly systems and data can be restored after a disruption. MTCR includes RTO as one component, but adds the time needed to confirm that restored data is clean and the time spent on human validation before systems go back into production. In a cyber incident specifically, a system can meet its RTO and still fall short of true resilience if the restored environment is reinfected shortly afterward.
Q: What is a minimum viable company, and how is it different from a full disaster recovery plan?
A: A minimum viable company, sometimes called a minimum viable business, is the smaller, business-prioritized subset of systems, data, and dependencies an organization needs back online to keep functioning after an incident, rather than its entire IT estate.
A full disaster recovery plan typically aims to restore everything, in time; a minimum viable company definition forces an organization to decide in advance what truly has to come back first, and in what sequence, to avoid an operational shutdown.
Q: What’s the difference between a tabletop exercise and a live recovery drill?
A: A tabletop exercise is a paper-based walkthrough of an incident response plan, typically used to test decision-making and communication among stakeholders without actually executing any technical recovery steps.
A live recovery drill goes further by actually performing a recovery, using the real tools, automation, and people involved, to confirm the process works in practice, beyond what a paper exercise can show. Organizations that rely only on tabletop exercises may have a resilience plan that looks sound on review but hasn’t been tested against the operational details that tend to make real incidents take longer than expected.
Q: What are non-human identities (NHIs), and why do they complicate AI recovery?
A: NHIs are the credentials, permissions, and access rights assigned to software components, such as AI agents, rather than to individual people. As organizations deploy more agentic AI, the number of NHIs in an environment grows, and each one needs to be accounted for during a recovery alongside more familiar elements like databases and transactional systems.
Recovering an agentic AI system typically requires synchronizing NHIs with the rest of the AI stack, since restoring dataoderconfigurations without restoring the correct agent permissions can leave gaps that are difficult to detect until something breaks downstream.
Q: How should an organization get started with ResOps™ (resilience operations)?
A: ResOps is a cross-functional framework that brings security, operations, and technology teams together around a shared definition of resilient design, distinct from any single product.
Organizations can begin by identifying a small number of core applications and running an initial recovery test to establish a baseline MTCR, rather than trying to formalize the entire discipline at once. That early baseline gives security, operations, and governance teams a concrete reference point for tracking improvement. It also helps build the cross-team habits that ResOps depends on over time.
Michael Thelander is Senior Director of Product Marketing at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
At Commvault, caring is not just something we say. It is something we act on every day.
Over the years, we have been so proud to have partnered with TeenTech, a UK-based educational charity for students aged 11–19. Teams of up to three students design and build tech products that solve real-world problems, then present them to a panel of industry judges.
We recently had the honor of attending the TeenTech Awards in London, where students from across the UK showcased the kind of creativity and problem-solving that gives us real hope for the future.
What made the day so meaningful was watching our people show up for each other. Vaulters from across the UK have supported TeenTech throughout our partnership – from building educational games and reviewing dozens of student projects, to volunteering their time on the big finals day.
This kind of commitment brings together Vaulters from different parts of our business and creates new connections along the way.
The innovation on display at the TeenTech Awards this year was unmatched. Here are a few of the standout ideas from the finalists:
A path toward treating Parkinson’s disease. One team proposed an approach for supporting patients earlier in the disease’s progression and explained the science behind it with real clarity.
A safer way to get from A to B. Another team rebuilt a navigation app around a “safest route” option, prioritizing personal safety alongside speed and distance.
A smart bandage that watches wounds heal. One finalist team designed a bandage that produces a hydrogel to support recovery and pairs with an app to track healing progress.
A fencing panel built to cut emissions. A fourth team proposed attaching zeolite panels to farm fencing as a simple way to help reduce agricultural emissions.
TeenTech gives young people a runway into STEM careers they might never have considered. Continuing to invest in the next generation of innovators matters, and we’re honored that Commvault gets to play a part in this journey.
For years,post-quantum cryptography (PQC) sat comfortably in the category of “important, but not urgent.”
Security leaders knew it was coming. Researchers talked about it. Standards bodies worked on it. Most organizations acknowledged that it would eventually require attention. But I would argue that the time to start preparing is now.
In this episode of STRIVE, I sat down with Sr. Director of Portfolio Marketing Michael Fasulo to discuss why the conversation around PQC is changing so quickly – and why the organizations that wait for certainty may find themselves running out of time.
Watch the gesamte Folge.
Die wichtigsten Erkenntnisse
Harvest Now, Decrypt Later attacks mean sensitive data is already at risk, even if quantum capabilities aren’t stable or commercially viable yet.
Most organizations do not have a complete view of their cryptographic inventory, making discovery the first major hurdle.
PQC is just as much a technology challenge to solve for and as much as it is about risk prioritization.
The organizations that start preparing now will have more options to course correct on prioritizations than those forced to react later.
The Problem Isn’t the Technology
Most discussions about post-quantum cryptography start with technology.
How quickly is quantum computing advancing?
When will cryptographically-relevant quantum systems become practical?
Which algorithms are likely to survive long term?
Those are important questions. But they’re not the questions I would prioritize asking. Michael wrote a blog last year about PQC and we discussed today how several things have changed since then.
Over the past several years, estimates have consistently moved in one direction: what once felt distant now feels increasingly close. At the same time, standards are evolving; regulatory expectations are increasing, and organizations are beginning to recognize how much cryptographic debt they’ve accumulated over the decades.
The exact date of Q-Day may remain uncertain. The direction of travel is not.
The Risk Is Here And Now
One reason this conversation has become more urgent is the growing attention around Harvest Now, Decrypt Later attacks. The concept is straightforward: An adversary gains access to encrypted information today, stores it, and waits for future capabilities to make that information readable.
What’s important here is that the risk doesn’t begin when quantum computing arrives. The risk begins when even encrypted data is exfiltrated and stored.
For organizations protecting intellectual property, healthcare records, government information, or other sensitive long term retention data, that distinction changes everything.
Organizations need to know whether data being retained today will still matter when that future arrives.
For many,esp. the highly regulated industries and critical infrastructure, the answer is yes.
In this clip, Michael explains why PQC isn’t a one-time fix or switch. The real goal is crypto agility – building the flexibility to adapt cryptographic algorithms as standards, and threats evolve. Because in cybersecurity, the challenge isn’t just preparing for what’s next. It’s being ready for what comes after that.
Discovery Is the Real Project
One misconception about PQC is that it’s primarily an encryption upgrade. In reality, most organizations haven’t reached the stage where replacement is the biggest concern.
They’re still trying to understand the scope of the problem. Cryptography exists everywhere.
Anwendungen
Certificates
Cloud services
APIs
Code signing
Third-party platforms
Many organizations struggle with the creation of the cryptographic inventory or its scope. That makes discovery one of the most important – and often underestimated – parts of the journey.
And for many enterprises, that’s a much larger endeavor than expected.
The Supply Chain Challenge
Another reason PQC has become a priority is that no organization will navigate this transition alone. Modern enterprises depend on vendors, cloud providers, software partners, and countless third parties, all of whom use cryptography.
That means quantum readiness extends beyond internal systems. It becomes a question of ecosystem readiness.
Are suppliers preparing?
Are critical vendors planning migrations?
Are third-party platforms aligned with emerging standards?
These questions will increasingly become part of risk conversations, procurement discussions, and long-term technology planning. Because cryptography doesn’t stop at organizational boundaries. Neither does risk.
Why This Conversation Matters
The most important takeaway from this discussion is that post-quantum cryptography is no longer a future technology challenge.
It’s becoming a present-day resilience conversation.
Organizations don’t need to panic and they don’t need to overhaul every system overnight. But they do need to begin, to make the best use of the time at their disposal for prepartion.
The organizations that navigate this transition successfully won’t necessarily be the ones with the most sophisticated cryptography. They’ll be the ones that started building understanding before certainty arrived.
And that’s often how resilience works.
Watch the Full Episode
There is plenty more that Michael and I explore in the episode that I didn’t capture above. Be sure to watch nowfor insights to:
The biggest challenges organizations face when starting their PQC journey.
What leaders should prioritize today including some best practices.
Understanding MLKEM algorithms and crypto agility.
Infrastructure considerations for PQC.
How Commvault is preparing for this future.
FAQs
Q: What is post-quantum cryptography (PQC)? A: PQC refers to cryptographic algorithms designed to help remain secure against attacks from future quantum computers. Q: What is Harvest Now, Decrypt Later? A: It’s a strategy where attackers collect encrypted data today with the intention of decrypting it later when more advanced computing capabilities become available. Q: Why are organizations focusing on PQC now? A: Because preparation takes years, and sensitive data collected today may still be valuable when quantum threats become practical. Q: What is the biggest challenge organizations face? A: Discovery. Most organizations do not have complete visibility into where cryptography is used across their environments. Q: Do organizations need to replace all cryptography immediately? A: No. Most experts recommend starting with inventory, discovery, and prioritization before planning broader migrations. Q: What should leaders do first? A: Identify long-lived sensitive data, understand cryptographic dependencies, and begin building a roadmap for future transition.
Wie treibt ResOps die nächste Entwicklungsstufe der Unternehmensresilienz voran?
Resilience operations (ResOps) is an operational discipline that unifies security, IT infrastructure, and recovery to give organizations the ability to prove end-to-end recoverability.
ResOps shifts organizations from a reliance on passive tools and assumptions to adoption of a proactive operational discipline that proves recoverability across systems, teams, and processes.
ResOps is a practice and discipline that can be adopted, not a product that can be bought. It is a unified operational model that brings together people, process, and technology to address digital fragility and the existential risk facing modern organizations.
The rapid adoption of AI has accelerated data growth, increased system interdependencies, and introduced new risks across pipelines, identities, and models. This ecosystem needs an overarching model to achieve resilience.
97% of organizations have had a security incident in the past 12 months, according toMicrosoft’s 2026 Secure Access Report — split fairly evenly between malicious attacks and accidental errors.
Traditional metrics such as uptime and recovery time objective (RTO) fail to capture the complexities and risks of cyber recovery, where data integrity and system dependencies play a critical role.
Detection and containment alone are not sufficient: organizations must build recovery processes that helps restore clean, trusted, and fully functional data.
Increasing regulatory pressure has forced organizations to move beyond policy-based compliance toward demonstrable, evidence-based resilience.
Most enterprises have backup, disaster recovery, and security tools in place — yet few can prove the recoverability of critical services. Especially under real-world, active attack conditions. Commvault enables ResOps by connecting protection, detection, and recovery into a continuous operational model, helping organizations move from assumption-based resilience to evidence-based, measurable, and predictable recoverability.
Why do traditional B&R and disaster recovery solutions fall short?
Disruption is a constant threat in today’s hybrid, multi-cloud world. That’s why most businesses already have backup and disaster recovery in place. Many also invest heavily in cybersecurity tools designed to detect and respond to threats. On paper, it looks like organizations have already built a cyber resilience program.
In der Praxis ist dies jedoch selten der Fall.
Die Herausforderung liegt nicht im Mangel an Tools, sondern in der zunehmenden Komplexität der Umgebungen, die sie schützen sollen, kombiniert mit der Aggressivität neuer Angriffe und der Fragmentierung moderner Sicherheitsarchitekturen.
According to Microsoft’s recent Secure Access report, 97% of organizations have had a security incident in the past 12 months. These attacks are happening in enterprises that now operate across fragmented systems spanning clouds, applications, endpoints, and data platforms. At the same time, AI adoption is accelerating this complexity. With88% of organizationsusing AI in at least one function, data is growing exponentially faster, the threats embedded in that data are stealthily increasing, dependencies have become harder to track, and recovery paths are no longer predictable.
Traditional backup and disaster recovery processes start when something breaks. These tools are also designed for stable, static systems: they confirm that data copies exist and recovery plans are documented, but don’t validate whether entire services, including all dependencies, can be restored under real-world conditions.
Dies führt zu einer Lücke in der Ausfallsicherheit, die reale Probleme zur Folge hat:
Daten sind zwar wiederherstellbar, aber nicht nutzbar oder vertrauenswürdig.
Systeme lassen sich zwar wiederherstellen, sind aber möglicherweise nicht voll funktionsfähig.
Recovery-Pläne mögen zwar vorhanden sein, versagen jedoch unter realen Bedingungen.
Resilienz erfordert heute mehr als isolierte Tools. Sie erfordert ein Betriebsmodell, das Schutz, Erkennung und Recovery kontinuierlich miteinander verbindet.
Hier setzt ResOps an und verändert die Gleichung. Es vereint Datensicherung, Erkennung und Recovery effektiv zu einem durchgängigen und validierten Betriebsmodell.
Was ist ResOps und warum ist es wichtig?
ResOps ist ein operativer Ansatz, der sicherstellen soll, dass Recovery umfassend ist und bei Bedarf mit Nachweisen belegt werden kann.
Es vereint Menschen, Prozesse und Technologien aus den Bereichen Sicherheit, IT und Infrastruktur in einem einzigen Betriebsmodell. Durch die gemeinsame Planung und Umsetzung kritischer Dienste, ein widerstandsfähiges Design und kontinuierliche Validierung können Unternehmen Störungen besser standhalten, sich innerhalb definierter Auswirkungstoleranzen erholen und dies anhand von Belegen nachweisen.
The biggest advantage of a high-functioning ResOps practice is that it’s been structured directly to addressing enterprise fragility and existential risk. Some of the model’s key capabilities include:
Operationalizing the “safe recovery” process
Definition messbarer Indikatoren für die Dienstausfallsicherheit (SRIs) und evidenzbasierte Bewertung
Annahme (und Optimierung) von Recovery unter Stressbedingungen
Annahme einer vollständigen Unterbrechung und Validierung von Wiederaufbauwegen
Kontinuierliche Identifizierung und Minderung von Resilienzlücken im Zuge der Weiterentwicklung der Systeme
Stützung auf Erkenntnisse aus realistischen Tests
Das gesamte Unternehmen abdecken
Verwaltung der Grenze zwischen Normalbetrieb und Krisenbetrieb
Der entscheidende Unterschied liegt im Fokus. Traditionelle Ansätze legen den Schwerpunkt auf Fähigkeiten, ResOps hingegen auf Ergebnisse. Dies versetzt Organisationen in die Lage, nachzuweisen, dass kritische Dienste wiederhergestellt werden können – und nicht nur, dass die entsprechenden Werkzeuge vorhanden sind.
Why does cyber resilience demand an operating discipline?
Modern systems are tightly coupled and highly automated. Failures in one area can cascade across services, especially in environments with shared infrastructure and interdependent workloads.
Without a unifying operational model, teams must coordinate across disconnected tools and workflows during incidents – while the salvos are flying and communication is at its worst. This slows response and increases risk. IT teams and engineers are left figuring out a plethora of tools instead of actually focusing on what matters.
ResOps introduces structure and accountability. It defines ownership of recovery outcomes, establishes service-level expectations, and verifies that recovery processes are regularly tested.
Wie sollten Unternehmen heute ihre Cyber-Resilienz messen?
Herkömmliche Kennzahlen wie Verfügbarkeit und RTO spiegeln die Realitäten der Cyber-Recovery nicht wider. Sie gehen davon aus, dass Systeme schnell und einwandfrei wiederhergestellt werden können, was in komplexen, voneinander abhängigen Ökosystemen jedoch selten der Fall ist.
Für einen echten Erfolg bei der Cyber-Recovery ist eine neue Kennzahl erforderlich:Mean Time to Clean Recovery (MTCR) MTCR addresses this need by precisely measuring how long it takes to restore verified, uncompromised and fully usable data. This metric is based on the belief that cyber recovery can only be complete when data integrity and trustworthiness have been restored. “Time to reastore,” without any context for safety or cleanliness or completeness, is wholly insufficient to provide confidence in addresses this by measuring how long it takes to restore verified, uncompromised data. This metric is based on the belief that cyber recovery must be measured by data integrity and trustworthiness. Only considering the restoration time is insufficient for the complete picture.
SRIs stärken dieses Vertrauen, indem sie messen, ob kritische Dienste bei Störungen innerhalb festgelegter Toleranzgrenzen weiterlaufen können. Insgesamt helfen diese Kennzahlen Unternehmen dabei, von Annahmen zu Fakten überzugehen, Lücken in den Recovery-Fähigkeiten zu identifizieren und die Widerstandsfähigkeit auf die Geschäftsziele abzustimmen.
Was übersieht das Zero-Trust-Modell in Bezug auf Recovery?
„Zero Trust“ ist ein Paradigma der Cybersicherheit, das davon ausgeht, dass keinem Benutzer und keinem Gerät von Natur aus Vertrauen entgegengebracht wird, dass erweiterte Berechtigungen streng kontrolliert werden und dass eine Sicherheitsverletzung bereits stattgefunden hat oder unvermeidlich ist.
„Zero Trust“ hat Wunder bewirkt, was die Verbesserung unserer allgemeinen Sicherheitslage in allen Branchensegmenten angeht.
Wo Zero Trust jedoch an seine Grenzen stößt, ist Grundsatz 3: ein tatsächlicher Sicherheitsverstoß oder ein Sicherheitsversagen. Die meisten Organisationen werden dem zustimmen, sind aber operativ nicht auf solche Szenarien vorbereitet.
Unternehmen können Bedrohungen zwar schnell erkennen und isolieren, haben jedoch dennoch Schwierigkeiten, Systeme so wiederherzustellen, dass Kontinuität und Vertrauen gewährleistet sind. Die Erkennung garantiert noch keine Recovery-Fähigkeit. Dadurch entstand eine offensichtliche Lücke zwischen der Reaktion und der tatsächlichen Recovery.
ResOps fills this gap by serving as the operational layer that extends the zero-trust model all the way through its “assume the breach” mandate and fulfilling its original promise. With ResOps enhancing zero trust through a practice of operational resilience, organizations are better prepared to respond to threats and recover from them effectively.
Wie definieren die Regulierungsbehörden die Anforderungen an die Resilienz neu?
Die regulatorischen Erwartungen verlagern sich rasch hin zu nachweisbarer Resilienz, insbesondere bei KI-generierten, nur unzureichend nachverfolgten Daten. Governance-Rahmenwerke fordern nun zunehmend einen strukturierten Schutz und eine strukturierte Überwachung von KI-Systemen und KI-generierten Daten. Aspekte wie Transparenz, Rückverfolgbarkeit, menschliche Aufsicht, Datenqualitätskontrollen und Lebenszyklus-Risikomanagement sind von größter Bedeutung.
Rahmenwerke wie NIS2 und der Digital Operational Resilience Act (DORA) verlangen von Organisationen den Nachweis, dass sie Störungen standhalten und sich davon erholen können.
Dazu gehören:
die Festlegung akzeptabler Störungsniveaus
Regelmäßiges Testen von Recovery-Prozessen
Nachweis der Leistung bei Recovery
Diese Rahmenwerke und Vorschriften betonen, dass die Einhaltung der Vorschriften nicht mehr allein auf Richtlinien basiert. Sie erfordert messbare Ergebnisse.
ResOps unterstützt diesen Wandel, indem es Validierung und Messung in funktionsübergreifende Abläufe integriert und Teams in die Lage versetzt, ihre Ausfallsicherheit durch kontinuierliche Tests und Berichterstattung unter Beweis zu stellen.
Fazit: Wie Unternehmen mit ResOps die Resilienzlücke schließen
The gap between perceived resilience and actual, seamless recoverability from disruptions is prominent. It’s visible in how often organizations struggle to restore operations despite having the right tools in place. As environments grow more complex and AI accelerates the pace of change, this gap can only widen. When resilience is treated as a set of disconnected capabilities rather than a cross-functional discipline, the expected “bad days” can be unrecoverable.
ResOps hilft dabei, diese Lücke zu schließen, indem der Fokus von der Vorbereitung auf den Nachweis verlagert wird. Es trägt dazu bei, Schutz, Erkennung und Recovery in einem kontinuierlichen Betriebszyklus zu vereinen, sodass Recovery nicht nur geplant, sondern unter realen Bedingungen validiert wird.
What’s more, approach transforms resilience from a reactive function into a measurable discipline. It helps teams gain clarity on ownership, visibility into dependencies, and confidence that critical services can be restored when it matters most.
Durch die Einführung von ResOps treten Unternehmen in eine neue Ära der evidenzbasierten Resilienz ein. Sicherheitsverletzungen und Angriffe sind unvermeidlich. Doch ein ResOps-Ansatz kann Organisationen dabei helfen, sich schnell, sicher und vollständig zu erholen.
Häufig gestellte Fragen
Was ist ResOps im Zusammenhang mit Cyber-Resilienz?
ResOps is an operational discipline that unifies security, IT, and recovery teams to continuously validate and prove recoverability. It focuses on measurable outcomes, not just tools. Commvault Cloud supports the ResOps model by connecting anomaly detection, clean recovery, and Cleanroom validation into a single operational platform — enabling businesses to restore critical services reliably under real-world disruption
Warum versagen herkömmliche Backup- und Disaster-Recovery-Modelle?
Traditional backup and disaster recovery focus on data availability and documented plans, but do not validate whether full services and dependencies can be restored — leaving gaps where data exists but systems are not functional or trusted. Commvault products addresses this with evidence-driven recovery capabilities including anomaly detection, Cleanroom Recovery, and Synthetic Recovery that validate clean restore points before production cutover.
Wie verbessert ResOps die Cyber-Resilienz?
ResOps improves resilience by connecting detection, protection, and recovery into a continuous closed-loop model. Commvault Cloud operationalizes this across five integrated functions: automated discovery and protection, continuous detection, clean recovery, continuous validation and improvement, and continuous compliant business — giving teams a single platform to execute the full ResOps discipline.
Mit welchen Kennzahlen lässt sich Cyber-Resilienz effektiv messen?
Metrics like Mean Time to Clean Recovery (MTCR) and Service Resilience Indicators (SRIs) provide better insight than RTO alone — measuring how quickly organizations can restore trusted, fully functional systems. Commvault introduced MTCR as a cyber recovery metric, shifting the measurement conversation from speed to data integrity and verified service continuity.
Wie erweitert ResOps das Zero-Trust-Konzept?
Zero trust focuses on prevention and access control but does not address recovery after a breach. Commvault Cloud fills this gap by connecting threat detection with clean recovery workflows — helping organizations restore trusted systems after compromise and close the gap between detection and operational continuity. In this way, ResOps extends and enables true zero trust by operationalizing restoration.
Warum nimmt der regulatorische Druck hinsichtlich der Resilienz zu?
Regulations such as NIS2 and DORA now require organizations to demonstrate resilience through testing, measurement, and evidence — not just documented policies. Commvault supports this shift through ResOps-aligned capabilities including continuous validation, Cleanroom-based recovery testing, and MTCR measurement — providing the audit-ready evidence of recoverability that modern regulatory frameworks require.
Cloud Datensicherung und -wiederherstellung für Google Cloud jetzt verfügbar.
Clumio for Google Cloud Storage is now generally available – helping to extend immutable backup and rapid recovery to petabyte-scale object storage in Google Cloud.
Die wichtigsten Erkenntnisse
Clumio für Google Cloud Storage ist ab sofort allgemein verfügbar und unterstützt Unternehmen dabei, ihren Cloud-Objektspeicher mit unveränderlichen Backups, schneller Recovery und der Einfachheit von SaaS zu schützen. Clumio für Google Cloud Storage bietet folgende Vorteile:
Schützen Sie Daten in Google Cloud Storage mit unveränderlichen, isolierten Backups, die für die Recovery nach Ransomware-Angriffen und zerstörerischen Löschvorgängen ausgelegt sind.
Einzelne Objekte, Präfixe oder ganze Buckets ab einem ausgewählten Zeitpunkt wiederherzustellen.
Wiederherstellung von Datensätzen im Cloud-Maßstab, die KI, Analysen und geschäftskritische Anwendungen ermöglichen.
Reduzierung der betrieblichen Komplexität durch eine vollständig verwaltete, SaaS-basierte Plattform für Backup and Recovery.
Verringern Sie Betriebsunterbrechungen durch schnellere Recovery-Abläufe.
Unterstützen Sie Compliance- und Governance-Initiativen mit isolierten Backup-Kopien und zentralisierten Schutzrichtlinien.
Clumio für Google Cloud Storage is a cloud-native backup and recovery solution that helps deliver immutable, air-gapped protection for Google Cloud Storage objects, prefixes, and buckets at petabyte scale. It helps enable rapid, granular recovery following ransomware, accidental deletion, lifecycle policy errors, or data corruption – without requiring organizations to manage backup infrastructure.
Unternehmen setzen zunehmend auf Google Cloud Storage als Grundlage für Analyseplattformen, KI-Initiativen, Anwendungsdaten, Archive und cloudnative Dienste.
Zwar bietet Google Cloud Storage einen äußerst dauerhaften Speicher, doch reicht diese Dauerhaftigkeit allein nicht aus, um Ransomware, versehentliche Löschungen, Fehler bei Lebenszyklusrichtlinien, böswillige Aktivitäten oder logische Beschädigungen zu bewältigen. Wenn Cloud-Objektspeicher zum primären Datenspeicher wird, sind Recovery-Funktionen ebenso wichtig wie die Verfügbarkeit des Speichers.
Clumio für Google Cloud Storage is now available, helping extend cloud-native cyber resilience and recovery capabilities to one of the industry’s leading cloud object storage platforms. The solution delivers immutable, air-gapped backups and rapid recovery workflows that help organizations recover data following cyberattacks, operational mistakes, outages, or corruption events.
As organizations continue investing in AI, analytics, and multi-cloud strategies, the ability to recover large-scale datasets becomes a critical business requirement. Clumio für Google Cloud Storage is designed to help organizations support business continuity, reduce operational overhead, and recover with greater confidence at cloud scale.
Warum Google Cloud Storage dedizierte Backup- und Wiederherstellungsfunktionen erfordert
Google Cloud Storage ist zur Datengrundlage moderner Unternehmen geworden. Unternehmen nutzen es, um Trainingsdaten für KI-Modelle zu speichern, Analysepipelines zu unterstützen, Geschäftsunterlagen zu archivieren und Cloud-native Anwendungen zu betreiben.
Mit wachsendem Datenvolumen nehmen auch die potenziellen Auswirkungen einer Störung zu. Ein einziger Fehler in der Lebenszyklusrichtlinie, eine versehentliche Löschung, ein Ransomware-Angriff oder ein Anwendungsfehler kann Millionen von Objekten gleichzeitig betreffen. Die native Speicherdauerhaftigkeit schützt zwar vor Infrastrukturausfällen, bietet jedoch keinen Schutz vor logischen Beschädigungen, böswilligen Aktivitäten oder menschlichem Versagen.
Für Unternehmen, die Petabytes an Daten verwalten, wird die Herausforderung noch größer. Recovery-Maßnahmen erfordern oft manuelle Koordination, benutzerdefinierte Skripte und zeitaufwändige Prozesse, die die Wiederherstellung geschäftskritischer Dienste verzögern.
Aktuelle Untersuchungen shows that 84% of cloud leaders intentionally use multiple cloud environments. This helps support AI initiatives, balance risk, and manage large datasets. As multi-cloud adoption expands, organizations need consistent resilience and recovery capabilities across environments.
Wie Clumio cloud-native Ausfallsicherheit gewährleistet
Clumio für Google Cloud Storage was designed to address these challenges through a cloud-native, SaaS-based approach to protection and recovery. The platform stores backup copies in an immutable, air-gapped environment separate from production data.
Diese Isolierung trägt dazu bei, das Risiko zu verringern, dass Backup-Daten beeinträchtigt werden, falls der Primärspeicher durch Ransomware oder zerstörerische Löschvorgänge kompromittiert wird. Sie ermöglicht es Unternehmen, Daten auf verschiedenen Granularitätsebenen wiederherzustellen, darunter einzelne Objekte, Präfixe und ganze Buckets. Dank dieser Flexibilität können Teams genau die Daten wiederherstellen, die sie benötigen, was dazu beiträgt, Recovery-Zeiten zu verkürzen und Betriebsunterbrechungen zu minimieren.
Die Lösung macht zudem den Einsatz, das Patchen, die Skalierung oder die Wartung einer Backup-Infrastruktur überflüssig. Eine zentralisierte Richtlinienverwaltung und automatisierte Schutz-Workflows vereinfachen den Betrieb und ermöglichen es gleichzeitig, Schutzstrategien entsprechend wachsenden Cloud-Datenumgebungen zu skalieren.
Geschäftliche Vorteile für KI, Analytik und Cloud-Betrieb
For many organizations, downtime is no longer limited to application outages. Disrupted data can halt analytics projects, interrupt AI pipelines, delay customer-facing services, and impact business decision-making. Clumio helps organizations reduce these risks by supporting faster recovery workflows and strengthening cyber resilience. Key business outcomes include:
Faster recovery – Rapid point-in-time recovery helps organizations recover data from selected recovery points following ransomware attacks, accidental deletion, corruption events, or lifecycle policy mistakes.
Reduced operational overhead – A fully managed SaaS platform that helps remove infrastructure management requirements and reduce reliance on manual recovery processes.
Improved cyber resilience – Immutable, air-gapped backups are designed to add an additional layer of resilience against modern cyber threats.
Greater confidence in AI and analytics – Organizations can help protect the datasets that enable AI models, business intelligence platforms, and analytics environments.
Einheitliche Recovery über Multi-Cloud-Umgebungen hinweg
Viele Unternehmen nutzen mittlerweile mehrere Cloud-Umgebungen, darunter AWS und Google Cloud. Die Nutzung der Cloud schafft zwar Flexibilität, kann aber auch zu Komplexität führen, wenn sich die Prozesse von Backup and Recovery zwischen den Umgebungen unterscheiden.
Clumio hilft bei der Bewältigung dieser Herausforderung, indem es ein einheitliches, cloud-natives Schutzkonzept über alle Cloud-Plattformen hinweg bietet. Unternehmen können einheitliche Richtlinien anwenden, Recovery-Abläufe optimieren und operative Reibungsverluste reduzieren, während ihre Cloud-Umgebungen wachsen.
As businesses continue investing in AI-enabled innovation, cloud resilience must evolve alongside the workloads it protects. With the general availability of Clumio für Google Cloud Storage, organizations gain a purpose-built solution for helping protect and recover cloud object storage data at scale while maintaining the operational simplicity that modern enterprises require.
FAQs
Q: What is Clumio für Google Cloud Storage?
A: Clumio für Google Cloud Storage is a cloud-native backup and recovery solution that helps protect Google Cloud Storage data with immutable, air-gapped backups. It helps enable organizations to recover objects, prefixes, and buckets following ransomware, accidental deletion, corruption, or operational mistakes.
Q: Why isn’t Google Cloud Storage durability enough?
A: Google Cloud Storage durability is designed to help safeguard data against infrastructure failures, but it does not address logical corruption, ransomware, malicious deletion, lifecycle policy mistakes, or human error. Independent backup copies help provide an additional recovery layer.
Q: Can Clumio recover individual objects?
A: Yes. Clumio supports granular recovery workflows that allow organizations to recover individual objects, prefixes, or entire buckets depending on the scope of the incident.
Q: How does Clumio help with ransomware recovery?
A: Clumio stores backup copies in immutable, air-gapped environments separate from production storage. These isolated backup copies help organizations recover data following ransomware attacks or destructive deletion events.
Q: Is Clumio designed for large datasets?
A: Yes. Clumio is designed to support cloud-scale environments and can help organizations protect and recover large object storage datasets that enable analytics, AI, and business-critical applications.
Q: How does Clumio simplify operations?
A: As a fully managed SaaS platform, Clumio helps eliminate the need to deploy and maintain backup infrastructure. Centralized policy management and automated workflows help reduce administrative overhead and operational complexity.
Verbunde Ressourcen
PRESS RELEASE
Clumio Extends Recovery to Google Cloud Storage
Brings immutable, SaaS-based protection and resilience to petabyte-scale datasets in Google Cloud Storage that are critical for the agentic AI era
Wie Resilience Operations (ResOps) die Wiederherstellungsfähigkeit von Unternehmen fördert
Enterprise resilience fails not from lack of tools — but because operations, security, and infrastructure teams lack a shared, measurable framework for proving recovery.
Ben Herzberg, Senior Director, Solutions Marketing
ResOps is the operational discipline security, IT, and infrastructure teams use to unify resilience across hybrid, multi-cloud, SaaS, and AI-enabled environments — and validate it with evidence.
ResOps (Resilience Operations) is a cross-functional discipline that brings operations, security, and infrastructure teams together around critical services, defined impact tolerances, and continuously validated recoverability — so organizations can withstand disruption and validate recovery, not just plan for it.
Im Gegensatz zu herkömmlichen Backups (die das Vorhandensein von Kopien bestätigen) oder Disaster Recovery (die das Failover von Rechenzentren validiert) hilft Resilience Operations dabei, die durchgängige Wiederherstellbarkeit kritischer Dienste unter realen Bedingungen zu validieren, einschließlich Systemabhängigkeiten, der Validierung des „Clean-State“ und der Wiederherstellungswege.
ResOps provides measurable evidence – Service Resilience Indicators (SRIs), Mean Time to Clean Recovery (MTCR), and board-ready quarterly resilience reports — rather than documentation of intent. Commvault Cloud provides recovery intelligence and posture visibility to help operationalize these metrics at enterprise scale.
The ResOps framework operates across five integrated domains: Resilience Governance, Recovery Planning, Recovery Architecture, Resilience Assurance, and Resilience Measurement. Together, they form a closed-loop system that helps continuously test, validate, and improve an organization’s ability to withstand disruption.
Modern regulators – including those associated with the EU Cyber Resilience Act (CRA), NIS2, and NIST CSF 2.0 — emphasize demonstrable, evidence-based resilience. ResOps provides an operating model and evidence layer that can help align to these frameworks, moving beyond documentation toward measurable outcomes.
Commvault Cloud enables ResOps with Cleanroom Recovery™ for isolated restoration, AI-enabled anomaly detection, automated recovery testing, immutable recovery points with malware scanning, and unified data protection across enterprise workloads, helping organizations strengthen resilience, reduce risk, and improve recovery confidence.
It’s 2:47 a.m. and your incident bridge has 40 people on it. The ransomware hit a tier-one workload six hours ago. Containment is done. The forensics team has cleared two recovery points. And now everyone is waiting on the one question nobody prepared for: which services do we restore first, in what order, and how do we know the data is actually clean? Your backup admin pulls up the restore job. Your security lead pulls up the threat report. Your infrastructure lead pulls up the runbook – the one last updated eighteen months ago. Nobody has a shared answer. Nobody has practiced this together. This is the gap that Resilience Operations — ResOps — is designed to close. Not after the incident. Before it.
Resilience Operations (ResOps) is an operational discipline that aligns security, infrastructure, and operations teams around critical services, defined impact tolerances, and continuous validation — so organizations can withstand disruption and demonstrate recoverability with evidence. Commvault Cloud supports ResOps with recovery intelligence, posture visibility, Cleanroom Recovery for isolated restoration, AI-enabled anomaly detection, and automated recovery testing across hybrid, multi-cloud, SaaS, and AI-enabled environments.
Weniger als 7 %
Fewer than 7% of organizations can recover from a ransomware attack within 24 hours of detection. For enterprises running tightly coupled, automated environments — where one compromised workload can cascade into a full-scale operational shutdown — this statistic defines the gap that ResOps is built to close.
Was ist ResOps und wie unterscheidet es sich von Backup und DR?
Backup and disaster recovery are infrastructure disciplines — they answer whether data exists and whether a datacenter can fail over. ResOps is an enterprise operating discipline: it answers whether critical business services can be recovered end-to-end, under real-world stress, within defined impact tolerances — and produces evidence to prove it.
Where DR treats recovery as an IT-owned procedure, ResOps embeds it into the operating rhythm of the entire enterprise. A ResOps Council gives cross-functional teams — engineering, security, infrastructure, operations, service delivery — shared ownership and decision rights over resilience outcomes. Recovery is then governed by two measurable targets: Service Resilience Indicators (SRIs), which define how well each critical service must perform under disruption, and Mean Time to Clean Recovery (MTCR), which tracks how quickly it actually gets there. The result is a shift from annual DR tests and static runbooks to continuously measured, board-reportable recoverability.
Critical Services Mapping: ResOps begins by identifying the Minimum Viable Company (MVC) — the smallest set of critical services required to sustain business operations — and defining acceptable impact tolerances for each. This scope definition informs downstream governance and testing priorities.
SRI-Based Performance Targets: Each critical service is assigned a Service Resilience Indicator (SRI) — a specific, testable target for how the service should perform under disruption. SRIs replace vague recovery intentions with more accountable, measurable targets.
MTCR Tracking: Mean Time to Clean Recovery (MTCR) measures the elapsed time from incident declaration to verified restoration of a critical service. Unlike recovery time objective (RTO), which measures uptime restoration, MTCR incorporates validation steps to support recovery confidence.
Cross-functional Decision Rights: ResOps defines who makes recovery decisions, in what order, and under what conditions — using RACI diagrams, backup authority structures, and preapproved runbooks. This helps reduce coordination gaps that can occur when siloed teams respond during an incident.
Continuous Validation Cadence: ResOps replaces annual disaster recovery (DR) tests with an ongoing rhythm of simulations, tabletop exercises, and cleanroom restores — each producing evidence that recovery capabilities remain current and effective.
Das ResOps-Framework: Fünf integrierte Bereiche für die Unternehmensresilienz
The ResOps framework is a closed-loop operational model built around five integrated domains — Resilience Governance, Recovery Planning, Recovery Architecture, Resilience Assurance, and Resilience Measurements —that together help organizations maintain critical services within defined impact tolerances during disruption. Once these domains are established, teams can adopt a posture of continuous improvement, transforming resilience from a one-time project into an ongoing, measurable program.
Each domain plays a specific role in the ResOps closed loop. Resilience Governance establishes the charter, defines the Minimum Viable Company (MVC), and creates cross-functional ownership through a ResOps Council. Recovery Planning and Recovery Architecture translate that governance into testable runbooks, recoverability tiers, separation of control and data planes, immutable recovery points, and air-gapped isolation. Resilience Assurance validates these architectures through continuous testing — such as simulations, cleanroom restores, and tabletop exercises — while Resilience Measurements track SRIs, MTCR, and reporting outputs to support visibility and decision-making.
Resilience Governance: Establishes a ResOps charter, defines impact tolerances for each critical service, aligns resilience outcomes to organizational funding, and creates a cross-functional ResOps Council for shared accountability and decision-making.
Recovery Planning: Defines recoverability tiers by business criticality, including technical runbooks for system restart, RACI diagrams of recovery responsibilities, dependency maps, and testing schedules — so teams have a documented and rehearsed path to recovery.
Recovery Architecture: Defines separation between control planes, data planes, and storage tiers; incorporates air-gapping, immutability, and domain isolation; and is designed to reduce blast radius within the recovery environment to support faster, more controlled restoration.
Resilience Assurance: Embeds continuous validation into the operating rhythm — including cleanroom restores, simulations, and governed tabletop exercises —designed to validate recovery processes and reduce reinfection risk.
Resilience Measurements: Tracks outcome-focused metrics, including impact tolerances, MTCR, SRI attainment, and critical service status, and translates them into quarterly resilience reporting for leadership visibility.
Wie Commvault Cloud ResOps in hybriden Unternehmensumgebungen unterstützt
Commvault Cloud unterstützt ResOps als evidenzbasierte Plattform, die dabei hilft, die Cyber-Resilienz über reine Schutzmaßnahmen hinaus auf ein umfassenderes Betriebsmodell auszuweiten. Während ResOps eher eine Disziplin als ein Produkt ist, bietet Commvault Cloud Funktionen, die Unternehmen dabei unterstützen, die fünf Bereiche von ResOps in hybriden, Multi-Cloud-, SaaS- und KI-gestützten Umgebungen zu operationalisieren.
Commvault Cloud helps address the ResOps evidence gap by combining recovery intelligence, posture visibility, and recovery workflows within a unified platform. Rather than stitching together point tools for backup, disaster recovery (DR), and security operations, Commvault Cloud provides a unified data protection console across enterprise workloads — on-premises, cloud, and SaaS —while integrating with SecOps tools so detection and recovery can operate in a coordinated manner. This approach enables cross-functional teams to define SRIs, measure MTCR, and continuously validate recovery processes in isolated environments — supporting the evidence needs of stakeholders, including leadership and regulators.
Cleanroom Recovery: Commvault’s Cleanroom Recovery capability provisions an isolated, air-gapped environment on demand — separate from the production network— where critical workloads can be restored, analyzed, and scanned prior to returning services to production. (See FAQ Q3 for step-by-step mechanics.)
AI-Enabled Anomaly Detection: Commvault Cloud’s AI-enabled detection helps identify unusual data access patterns and backup anomalies early — helping limit incident impact and reduce the scope of recovery.
Automated Recovery Testing: Instead of relying solely on periodic DR exercises, Commvault Cloud supports ongoing validation of recoverability by running non-disruptive recovery tests and comparing results against SRI targets, helping surface gaps before an incident.
Unified Data Protection Console: A single control plane spans on-premises, cloud, SaaS, and AI-enabled workloads — helping reduce coverage gaps and tool sprawl that can affect recovery confidence in hybrid environments.
Posture Visibility and SRI Reporting: Commvault Cloud provides visibility into resilience posture across protected workloads in a unified view — tracking SRI attainment, MTCR trends, and tolerance gaps—and generating reporting artifacts to support internal and external stakeholders.
Microsoft-Sentinel (SIEM)
Bidirectional integration allows Commvault Cloud to pass recovery telemetry into Microsoft Sentinel for correlation with threat detections — helping inform recovery decisions with current security context.
CrowdStrike Falcon (Sicherheitsplattform)
Integration with CrowdStrike provides threat intelligence that helps inform recovery point selection — so restored environments can be assessed against known indicators of compromise before returning to production.
Splunk (SIEM/SOAR)
Commvault Cloud sendet Daten zu Recovery-Ereignissen an Splunk, um einen einheitlichen Überblick über den gesamten Sicherheitsbetrieb zu bieten und Teams dabei zu unterstützen, Anomalien bei Backups mit umfassenderen Bedrohungsaktivitäten in Zusammenhang zu bringen.
Microsoft Azure / AWS / Google Cloud (Cloud)
Commvault Cloud’s any-to-any workload portability supports recovery across major hyperscalers — helping organizations maintain resilience as dependencies shift across cloud environments.
ServiceNow (ITSM)
Integration with ServiceNow supports automated incident ticket creation and orchestration of recovery workflows — helping connect security detection with IT operations response.
So funktioniert ResOps von Anfang bis Ende: Von der Governance bis zur sauberen Wiederherstelleny
Erkennen
The unified data protection console helps classify enterprise data and map service dependencies — creating a centralized inventory of what constitutes the Minimum Viable Company (MVC) and which workloads align to specific recoverability tiers.
„Schutz“
Policy-driven protection is applied across workloads based on recoverability tiers defined in Wiederherstelleny Planning. This results in recovery points designed with immutability and air-gap principles, reflecting the Wiederherstelleny Architecture approach — such as separation of control planes, data planes, and storage, and considerations for blast-radius reduction.
Entdecken
AI-enabled anomaly detection monitors backup telemetry and data access patterns. When irregularities are identified, alerts can be routed to integrated SecOps platforms — helping security and recovery teams operate from a shared signal and reduce delays in response.
Wiederherstellen
Following incident declaration, orchestrated workflows run against pretested runbooks — reducing the need for ad hoc response. Cleanroom Wiederherstelleny provisions an isolated environment where recovery points can be analyzed and tested before services are returned to production.
Wiederherstellen
Services are promoted to production based on SRI priority. MTCR is captured for each service. The recovery sequence — including timestamps, validation steps, and SRI attainment — can be logged and compiled into reporting artifacts to support internal reviews and stakeholder reporting.
ResOps transforms enterprise resilience from documentation-based planning into a continuously validated, evidence-led operating discipline. Organizations that operationalize ResOps gain a cross-functional framework that unites security, IT, and infrastructure around measurable recoverability — tracked through SRIs, MTCR, and reporting for leadership visibility.
Commvault Cloud unterstützt dieses Modell durch „Cleanroom Recovery“, KI-gestützte Anomalieerkennung, automatisierte Wiederherstellungstests und einheitliche Datensicherung für alle Unternehmens-Workloads.
The result: when disruption occurs — from ransomware, AI-enabled failure, or cascading infrastructure outages — teams are better prepared, recovery processes are validated, and organizations can provide supporting evidence to stakeholders, including regulators.
Häufig gestellte Fragen
Was ist ResOps und wie unterscheidet es sich von herkömmlichen Lösungen für Backup and Recovery?
ResOps addresses a gap backup and DR don’t fully cover: can critical services be recovered end-to-end under real-world conditions within defined impact tolerances — and can we prove it? Backup confirms data copies exist, and DR validates data center failover, but ResOps extends this by accounting for dependencies, clean-state validation, rebuild pathways, and cross-functional execution, with metrics like SRIs and MTCR supported by Commvault Cloud.
Inwiefern unterscheidet sich operative Resilienz von der Geschäftskontinuitätsplanung (BCP)?
Business continuity planning (BCP) defines how an organization intends to respond to disruption, producing documented procedures that are tested periodically. Operational resilience and ResOps focus on continuously testing and improving an organization’s actual ability to withstand disruption within defined tolerances. Commvault Cloud supports this shift by providing the measurement and validation layer — SRI tracking, MTCR reporting, and Cleanroom-based testing — that enables organisations to demonstrate execution rather than simply document intent.
Wie funktioniert die „Cleanroom Recovery“ von Commvault Cloud bei der Reaktion auf Ransomware?
When an incident occurs, Commvault Cloud provisions a Cleanroom environment — an isolated network segment designed to limit exposure to compromised systems. Recovery points are scanned for potential threats before validation activities — such as application startup and dependency checks— help confirm readiness, with the process generating logs and artifacts that can support internal review and regulatory reporting.
Inwiefern unterscheidet sich ResOps von den Angeboten von Rubrik, Cohesity oder Veeam?
Rubrik, Cohesity und Veeam bieten Datensicherungs- und Recovery-Funktionen, während ResOps ein Betriebsmodell einführt, das Sicherheits-, Betriebs- und Infrastrukturteams auf definierte Auswirkungstoleranzen und evidenzbasierte Wiederherstellbarkeit abstimmt. Commvault Cloud unterstützt diesen Ansatz mit Funktionen wie einer einheitlichen Steuerungsebene, „Cleanroom Recovery“, KI-gestützter Anomalieerkennung und der automatisierten Messung von Resilienzmetriken wie SRIs und MTCR.
Welche Compliance-Rahmenwerke verlangen den Nachweis operativer Resilienz, und wie geht ResOps darauf ein?
Frameworks such as NIS2, the EU Cyber Resilience Act, DORA, and NIST CSF 2.0 emphasize resilience, testing, and accountability, though specific requirements vary by regulation and jurisdiction. ResOps can help organizations align to these expectations by providing an operating model and measurable outputs — such as SRI metrics and recovery validation records— supported by Commvault Cloud capabilities.
Wann sollte ein Unternehmen ResOps einführen, anstatt lediglich sein bestehendes DR-Programm zu verbessern?
Organizations may improve DR when addressing specific gaps like recovery time objectives, recovery point objectives, or workload coverage. ResOps becomes relevant when challenges are broader — siloed teams, unclear dependencies, or limited visibility into recovery readiness. Commvault Cloud supports the transition from DR to ResOps by providing a unified control plane, Cleanroom Recovery for validated testing, and SRI-based measurement that makes recovery readiness visible and reportable to leadership and regulators.
Stellen Sie Ihre Ausfallsicherheit mit Commvault Cloud ResOps unter Beweis
Start with critical services, define impact tolerances, and validate clean recovery with evidence — using SRIs, MTCR, and Commvault Cloud.
ResOps: Die Zukunft widerstandsfähiger Unternehmen im Zeitalter der KI
Erfahren Sie, wie KI die Anforderungen an die Unternehmensresilienz neu definiert und warum ein neues Betriebsmodell erforderlich ist, um Störungen in zunehmend komplexen hybriden Umgebungen zu bewältigen.
Understand the ResOps operating model — how it unites data security, identity resilience, and cyber recovery into a continuous discipline for AI-era enterprises.
Erfahren Sie, wie Sie Resilienz in immer komplexeren KI-Umgebungen mit einem neuen funktionsübergreifenden Betriebsansatz auf Basis von Commvault Cloud aktiv steuern können.
To address mandates governing where their data is stored and used,many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography,that no foreign-jurisdiction personnel accessed it,and that they can recover it within 24 hours under incident conditions.
In a recent webinar,I joined Commvault GM Alex Zinin,who leads our digital sovereignty task force,along with Jakub Lewandowski,our associate general counsel for EMEA,and Pranay Ahlawat,our chief technology and AI officer,to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.
Das EU-Rahmenwerk zur Cloud-Souveränität definiert acht Souveränitätsziele,von denen sich nur eines auf den Datenstandort bezieht.
Die Auswahl einer souveränen Cloud-Region regelt zwar,wo sich Daten befinden,aber nicht,wer darauf zugreifen darf,unter welcher rechtlichen Grundlage oder ob Sie diese unter realen Bedingungen wiederherstellen können.
Eine umfassende Souveränitätsstrategie stützt sich auf vier miteinander verknüpfte Säulen: Datenlokalität,technologische Souveränität,operative Souveränität und rechtliche Souveränität.
Souveränitätsprogramme,die die Recovery-Architektur getrennt von der primären Daten-Governance behandeln,bergen ein unberücksichtigtes Risk,das bei Vorfällen zutage treten kann.
Anstelle einer Politik der maximalen Souveränität um jeden Preis sollten Unternehmen ihre Strategie auf eine „Minimum Viable Sovereignty“ ausrichten: die richtigen Kontrollen,konsequent durchgesetzt und auf die tatsächlichen Verpflichtungen abgestimmt.
Digitale Souveränität wird zu einer unternehmerischen Anforderung
Over the past decade,the toughest digital and data sovereignty rules have mainly applied to government,defense,and other national‑security workloads. Outside of highly regulated sectors,many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.
That’s now changing. DSGVOhat sich von bloßen Leitlinien zu erheblichen Geldbußen bei Betriebsausfällen weiterentwickelt,und neuere Regelungen wie„DORA,NIS2,Germany’s KRITIS-Vorschriften rules,and the EU-Datenschutzgesetzentwurf have tightened expectations around jurisdictional control and operational resilience.
Sovereignty questions are now surfacing in RFPs,M&A due diligence,and board‑level risk reviews as well.
The EU-Rahmenwerk zur Cloud-Souveränität,published in October 2025,clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives,only one addresses where data resides. The other seven cover access control,operational dependencies,jurisdictional exposure,and recovery.
For enterprises,this structure is now the lens through which vendor capabilities must be evaluated.
Vorschau: Souveränität und Resilienz neu denken
In this moment from the webinar,Jakub discusses how sovereignty is a risk posture,rather than a single product. Organizations need a holistic strategy that combines architecture,operations,governance,auditability,and recovery planning to address it.
Datenstandort ist nicht gleichbedeutend mit Souveränität
Der Datenstandort beantwortet lediglich die Frage nach dem „Wo“. Vorschriften zur Souveränität erfordern zudem die Fähigkeit, zu erklärenwho,how,and under what conditions.
In practical terms,a complete sovereignty posture encompasses four interdependent pillars.
1. Datenlokalität
This pillar covers not just where data is stored,but where it travels. Control-plane artifacts,metadata,and telemetry can cross geographic boundaries even when primary data stays in-region.
2. Technologische Souveränität
Diese Säule befasst sich mit der Frage, ob die Organisation die Mechanismen zum Schutz der Daten kontrolliert:
Wie der Zugriff gewährt wird.
Wie Daten verschlüsselt werden.
Ob die Verwahrung der Verschlüsselungsschlüssel unter allen Umständen gewährleistet ist.
A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK),where an organization’s own encryption keys are managed within the provider’s platform,and Hold Your Own Key (HYOK),where the organization retains independent custody of keys entirely outside the provider’s environment.
For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.
3. Operative Souveränität
This covers who operates the environment and from where,including whether support personnel or third-party vendors are subject to foreign jurisdiction.
4. Jurisdiktionelle Souveränität
This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access,such as the cross-border situations discussed in the US-amerikanischen CLOUD Actbehandelten grenzüberschreitenden Situationen.
Jede dieser Säulen ist für die Einhaltung der Vorschriften unerlässlich. Eine starke Datenlokalisierungsstrategie bei gleichzeitig schwachen betrieblichen Kontrollen kann ungeprüfte Risiken zulassen.
Wo Programme zur digitalen Souveränität scheitern
My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation,it gets too narrow,too quickly. Workshops zoom in on where data lives,teams get to work on that one question,and then they move on,leaving the other three pillars largely unexamined.
Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal,technical,and operational stakeholders,not as an IT project that gets checked off as complete.
Organizations can also be led astray by a few myths. One,as we’ve discussed,is the impression that sovereignty equals residency.
Then there’s the myth of absolute sovereignty,the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice,sovereignty always involves tradeoffs between control,cost,technological velocity,and the ability to innovate.
The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy,but a risk posture built from architecture,operations,contracts,certifications,and continuous auditability.
Resilienz gehört in den Rahmen der Souveränität
Operative Souveränität ist dieam schwersten zu prüfende Säule and the one most commonly underestimated. If your environment needed access for routine maintenance tonight,who would perform it,from which country,and under which legal jurisdiction?
Most organizations,when they work through that question for the first time,find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.
This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure,restoration sequencing,and recovery point management under a separate – and often weaker – set of controls. When an incident occurs,recovery personnel may not meet jurisdictional requirements,and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.
Minimum Viable Sovereignty: The Right Level of Control,Not the Maximum
An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.
A payroll system,a customer transaction database,and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.
Ein Lohnabrechnungssystem, eine Kundentransaktionsdatenbank und ein internes HR-Tool unterliegen nicht denselben Souveränitätsverpflichtungen. Ein binärer Ansatz bei der Compliance kann dazu führen, dass entweder dort zu wenig investiert wird, wo es darauf ankommt, oder dass über das tatsächlich Erforderliche hinaus investiert wird. sets a more practical target: the right controls,consistently enforced and continuously demonstrated,calibrated to what each workload actually requires across all four pillars.
Organizations have a broad range of options for how sovereign controls are delivered across their environment,each providing different controls.
setzt ein praktischeres Ziel: die richtigen Kontrollen, die konsequent durchgesetzt und kontinuierlich nachgewiesen werden und auf die tatsächlichen Anforderungen der jeweiligen Workloads in allen vier Säulen abgestimmt sind.
Unternehmen verfügen über eine breite Palette von Optionen, wie souveräne Kontrollen in ihrer gesamten Umgebung umgesetzt werden können, wobei jede Option unterschiedliche Kontrollen bietet.
Commvault’s Das „Geo Shield“-Framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU,Geo Shield maps to the full spectrum of deployment models:
Regionale souveräne Cloud-Dienste, die als SaaS bereitgestellt werden
Partnerschaften mit Hyperscalern zur Einführung souveräner Lösungen
Von Partnern betriebene nationale souveräne Angebote, die gemeinsam mit lokalen Dienstleistern aufgebaut wurden
Vollständig vom Kunden kontrollierte private souveräne Umgebungen, die den Anforderungen von Rahmenwerken wieFedRAMP High.
In this way,organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.
Sehen Sie sich das vollständige Webinar an und laden Sie den Readiness-Bericht herunter
In the vollständige Webinar,available on demand,you’ll discover:
Warum digitale Souveränität mehr ist als eine technologische Lösung.
Welche Rolle Architektur und Betrieb in der Souveränitätsstrategie spielen.
How governance,contracts,and auditability impact resilience.
Warum Souveränität auch bei Cybervorfällen und Ausfällen gewahrt bleiben muss.
The importance of a holistic,risk-based approach to sovereignty.
Q: What is the difference between data residency and digital sovereignty?
A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data,under what legal authority,through which operational pathways,and whether it can be recovered cleanly under real conditions.
An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel,vendor access agreements,or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.
Q: What is the EU-Rahmenwerk zur Cloud-Souveränität,and why does it matter?
A: TheEU-Rahmenwerk zur Cloud-Souveränitätist ein von der Europäischen Kommission entwickeltes strukturiertes Bewertungsinstrument, um Cloud- und Technologieanbieter im Rahmen von Beschaffungsprozessen anhand von Souveränitätskriterien zu bewerten.
It defines eight sovereignty objectives,with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls,key custody,jurisdictional exposure,and recovery.
Das Rahmenwerk stellt das umfassendste öffentliche Rahmenwerk zur Bewertung der Souveränitätslage dar und wird zunehmend von anderen Regionen und Beschaffungsstellen außerhalb der EU als Referenz herangezogen.
Q: What is the difference between BYOK and HYOK,and why does it matter for sovereignty?
A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys,but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment,including under crisis conditions or legal compulsion.
For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The US-amerikanischen CLOUD Act,for example,can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.
HYOK addresses that exposure directly,though it may require a higher platform tier in SaaS deployments.
Q: Why do most sovereignty strategies overlook operational sovereignty?
A: Die operative Souveränität,covering who operates the environment and from where,is the am schwersten zu prüfende Säule because it requires inventorying support contracts,vendor access agreements,and third-party dependencies across the full operational chain.
Most organizations start sovereignty programs focused on data location and encryption,which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.
As a first step to evaluate operational sovereignty,you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.
Q: How should organizations think about recovery in the context of sovereignty?
A: Recovery architecture needs to meet the dieselben Souveränitätsanforderungen as primary data environments,but it often doesn’t. In most organizations,backup infrastructure,restoration sequencing,and recovery point management are frequently governed by a separate set of controls,or none at all.
During an incident,the personnel authorized to execute recovery may not meet jurisdictional requirements,recovery points may not have been validated as clean and uncompromised,and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.
Q: What does minimum viable sovereignty mean in practice?
Ein Lohnabrechnungssystem, eine Kundentransaktionsdatenbank und ein internes HR-Tool unterliegen nicht denselben Souveränitätsverpflichtungen. Ein binärer Ansatz bei der Compliance kann dazu führen, dass entweder dort zu wenig investiert wird, wo es darauf ankommt, oder dass über das tatsächlich Erforderliche hinaus investiert wird. means identifying the right level of control for each workload,calibrated to actual regulatory obligations,risk tolerance,and operational constraints,rather than applying maximum controls uniformly.
Maximum sovereignty comes with real tradeoffs: technological complexity,operational burden,service limitations,and cost. Organizations that define requirements by workload across the four pillars,map those requirements to deployment models,and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.
Q: What role do certifications like C5,SecNumCloud,and ISO 27001 play in a sovereignty strategy?
A: Certifications help provide auditable evidence that controls have been independently verified,an important part of any defensible sovereignty posture. C5 in Germany,SecNumCloud in France,and ISO/IEC 27001legen jeweils Mindestanforderungen fest, die Anbieter durch unabhängige Audits nachweisen müssen.
The strongest sovereignty postures treat these certifications as a floor,providing necessary evidence that controls exist,but not a substitute for operational testing under realistic conditions.
Darren Thomsonis Vice President and Chief Technology Officer,EMEA,at Commvault. Be sure to catch him in the podcast series, STRIVE.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
Der Einsatz mehrerer Backup-Tools führt häufig zu operativen Abhängigkeiten von einer kleinen Gruppe von Spezialisten, was das organisatorische Risiko erhöht.
Die Verwaltung von Sicherheitsmaßnahmen über verschiedene Konsolen, Richtlinien und Berichtssysteme hinweg erschwert es, den Überblick zu behalten und schnell auf Probleme zu reagieren.
Konsolidierung muss nicht zwangsläufig ein einschneidendes „Rip-and-Replace“-Projekt bedeuten; viele Unternehmen können schrittweise modernisieren und dabei ihre bestehenden Infrastrukturinvestitionen beibehalten.
Eine einheitliche Steuerungsebene kann dazu beitragen, die Verwaltung von Richtlinien sowie Überwachungs-, Prüf- und Wiederherstellungsvorgänge in hybriden Umgebungen zu vereinfachen.
Unternehmen, die ihre Datensicherung vereinfachen, erzielen oft erhebliche Kosteneinsparungen und tragen gleichzeitig zur Verbesserung der betrieblichen Effizienz und Ausfallsicherheit bei.
You didn’t build a messy environment. You built a functional one.
Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.
The stack isn’t the problem. It’s the operational model that comes with it.
Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.
And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.
That’s not resilience. That’s dependency masquerading as expertise.
Die Dashboard-Wand
Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”
If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.
Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.
The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.
And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.
Was Konsolidierung für Infrastrukturteams wirklich bedeutet
The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.
But that’s not what consolidation has to look like.
The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.
What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.
The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.
Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.
Real Resilience Doesn’t Need a War Room
If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.
Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.
Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.
That’s the case for consolidation. Not a better product. A better way to run what you’ve built.
Q: Why is managing multiple backup platforms a problem if they’re all working?
A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.
Q: What is one of the biggest risks created by a fragmented backup environment?
A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.
Q: Does consolidation mean replacing all existing infrastructure?
A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.
Q: How can consolidation improve resilience?
A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.
Q: What about vendor lock-in when consolidating to a single platform?
A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.
Q: How do organizations measure the value of consolidation?
A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.
Michael Thelander is Senior Director, Product Marketing, at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
From Detection to Recovery: What Does Modern Cyber Resilience Architecture Require?
Modern cyber resilience helps enable organizations to restore trusted operations after compromise using validated recovery, isolated environments, and coordinated response across hybrid infrastructure.
Sam Curcuruto, Director, Product Marketing, Commvault
Moderne Cyber-Resilienz konzentriert sich auf eine vertrauenswürdige Recovery durch Datenvalidierung, Isolierung der Recovery, Koordinierung der Reaktion und die Ermöglichung einer flexiblen Recovery in hybriden Umgebungen.
Moderne Cyber-Resilienz beruht auf einer evidenzbasierten Recovery, bei der vor der Recovery die Datenintegrität überprüft wird – und nicht nur die Verfügbarkeit der Backups.
Traditionelle Disaster-Recovery-Modelle versagen im Falle von Ransomware, da Angreifer Backups ins Visier nehmen, die Verweildauer verlängern und Wiederherstellungspunkte kompromittieren.
Ein Resilience-Operations-Modell (ResOps) bündelt die Kräfte von Sicherheits-, IT- und Datenteams im Hinblick auf kontinuierliche Validierung, saubere Recovery-Abläufe und messbare Readiness.
Cyber Recovery muss in das umfassendere Sicherheitsökosystem integriert werden und Erkennungs-, Reaktions- und Recovery-Systeme miteinander verbinden, um koordinierte Maßnahmen und gemeinsame Transparenz während Vorfällen zu ermöglichen.
Cleanroom Recovery®, Commvault integriert diese Funktionen zur Erkennung von Bedrohungen in seine zum Patent angemeldete™, air-gapped backups, and AI-assisted detection work together to help enable trusted, isolated restoration.
Die Portabilität von Workloads und eine „Minimum Viable Recovery“ helfen Unternehmen dabei, kritische Geschäftsfunktionen zuerst wiederherzustellen und die Recovery über hybride Umgebungen hinweg ohne plattformspezifische Einschränkungen durchzuführen.
Most organizations can detect cyberattacks. Far fewer can recover cleanly, confidently, and at scale across their entire data estate. Commvault addresses this gap through evidence-driven recovery — combining anomaly detection, Cleanroom Recovery, Commvault integriert diese Funktionen zur Erkennung von Bedrohungen in seine zum Patent angemeldete, and the ResOps operating model to help organizations validate, isolate, and restore trusted operations even under active adversarial conditions.
Why Do Traditional Recovery Models Fail Against Modern Cyberattacks?
241 days. That’s how long the average breach lifecycle is, according to IBM’s Cost of a Data Breach Report 2025. Dasreport also showed that 76% of organizations still took more than 100 days to fully recover from a breach, giving attackers ample time to compromise backup systems and recovery points.
Legacy disaster recovery strategies were designed for outages and hardware failures, not adversarial attacks. They assumed backups could be trusted by default – an assumption that no longer holds.
Cyberattacks are no longer isolated security events. They are enterprise-wide disruptions that expose how well teams can respond and recover amid fragmented tools, signals, and decision-making.
Attackers move patiently and deliberately. By the time encryption or destruction occurs, multiple restore points may already be unsafe.
Today’s ransomware and cyberattacks follow a playbook that can look like this:
Extended dwell time: Adversaries may remain in the environment for weeks or months, during which they modify files, insert dormant malware, steal credentials, and corrupt backup repositories.
Backup targeting: Attackers now can actively delete snapshots, disable backup jobs, exfiltrate recovery keys, and alter stored data.
By the time encryption occurs, multiple restore points could be compromised.
These conditions expose systemic gaps. Security and recovery teams often operate independently, creating delays in decision-making. Backup systems lack built-in validation, leaving teams uncertain about what is safe to restore. Recovery environments may not be isolated, increasing the risk of reinfection.
Closing these gaps is fundamental to modern cyber resilience. A unified approach that brings together anomaly and threat detection, data protection, AI-assisted insights, and recovery validation is key.
Warum ist eine evidenzbasierte Cyber-Recovery der Weg in die Zukunft?
The evidence-based recovery replaces the assumption-based recovery with continuous monitoring of data health. Instead of treating backups as fundamentally safe, organizations evaluate signals across the entire data lifecycle to determine which recovery points are trustworthy.
“Can we restore?” is not the right question.
Organizations must ask: “Can we restore clean, validated systems under adversarial conditions?”
Moderne Resilienzplattformen wieCloudführen Überprüfungen in mehreren Phasen durch. Vor der Sicherung helfen Verhaltensanalysen und Bedrohungsinformationen dabei, verdächtige Aktivitäten in Produktions-Workloads zu identifizieren.
Später, während der Backup-Vorgänge, analysiertdie AnomalieerkennungEntropieveränderungen, ungewöhnliche Dateiänderungen und bekannte Bedrohungsindikatoren, um potenzielle Kontaminationen zu identifizieren. Nach der Speicherung der Daten helfen kontinuierliche Scans dabei, schlummernde oder verzögerte Bedrohungen aufzudecken, die andernfalls unbemerkt bleiben könnten.
KI-gestützte Analysen sind in dieser Größenordnung unverzichtbar. Sie helfen dabei, Signale über einen längeren Zeitraum hinweg zu korrelieren, Risiken mit hoher Wahrscheinlichkeit aufzudecken und den Aufwand für manuelle Untersuchungen zu reduzieren. Wichtig ist, dass diese Funktionen vor der Sicherung, während der Sicherung und schließlich während der Recovery zum Einsatz kommen.
Dieser mehrschichtige Ansatz schafft eine Beweiskette, die dazu beiträgt, Recovery-Entscheidungen mit weitaus größerer Präzision zu treffen.
Was versteht man unter ResOps für die Cyber-Recovery?
Da die Cyber-Recovery immer komplexer und sicherheitskritischer wird, reicht es nicht mehr aus, sich lediglich mit Tools auszustatten. Unternehmen benötigen eine wiederholbare Betriebsdisziplin, die Sicherheits-, IT- und Datenschutzteams auf ein gemeinsames Ziel ausrichtet.
Dies ist die Grundlage vonresilience operations (ResOps). ResOps betrachtet Recovery als eine kontinuierliche, messbare operative Fähigkeit und nicht als einmaliges Ereignis. Im Mittelpunkt stehen gemeinsame Erkenntnisse, validierte Recovery-Pfade und bewährte Readiness. Zu den wichtigsten Funktionen gehören unter anderem:
Kontinuierliche Transparenz durch Anomalieerkennung über den gesamten Datenlebenszyklus hinweg.
KI-gestützte Bedrohungserkennung, Bedrohungsinformationen und auf Täuschungsmaßnahmen basierende Frühwarnung.
Wiederherstellung sauberer Daten.
On-Demand-Umgebungen mit Air-Gap zur Validierung von Recovery-Pfaden.
Wiederholbare Tests und Verbesserungen.
Ein entscheidendes Element von ResOps ist die Integration in das umfassendere Sicherheitsökosystem. Moderne Architekturen sind mit Plattformen für Sicherheitsinformations- und Ereignismanagement (SIEM), Sicherheitsorchestrierung, -automatisierung und -reaktion (SOAR), erweiterte Erkennung und Reaktion (XDR), Endpunkt- sowie Identitätsmanagement verbunden, um eine koordinierte Reaktion zu ermöglichen.
Eine SOAR-gesteuerte Orchestrierung ist besonders während aktiver Vorfälle wichtig. Automatisierte Playbooks tragen zu einer konsistenten Ausführung bei, reduzieren manuelle Fehler und beschleunigen die Entscheidungsfindung teamübergreifend.
Wie ermöglicht eine saubere Validierung eine sichere Recovery?
Das Wiederherstellen von Backups ist nicht so einfach, wie es klingt. Eine übereilte Wiederherstellung kann dazu führen, dass Malware erneut in Produktionsumgebungen eingeschleust wird. Jeder Wiederherstellungspunkt muss als potenziell verdächtig behandelt werden, bis das Gegenteil bewiesen ist.
Cleanroom Recovery helps deliver a fast, on-demand, cloud-based recovery environment for testing, cyber forensics,undrecovery staging. This can be practiced by using automated runbooksundpre-configured systems to safely validate workloads before returning them to production.
Ergänzend dazu sorgtAir Gap Protectfür unveränderliche Backups, die getrennt von der Produktionsumgebung gespeichert werden, wodurch verhindert wird, dass Angreifer kritische Recovery-Daten verändern oder löschen können.
AI-assisted Commvault integriert diese Funktionen zur Erkennung von Bedrohungen in seine zum Patent angemeldete extends this validation. It leverages malwareundencryption detection to create a curated, composite recovery point that combines the most recent clean version of files across all backups into a single recovery point. This helps reduce the amount of data roll-back or the discarding of good data when performing a recovery.
Zusammen tragen diese Mechanismen dazu bei, Recovery von einem „Best-Effort“-Prozess in eine nachweisbare Lösung zu verwandeln.
Warum ist die Portabilität von Workloads für Cyber-Resilienz-Frameworks von entscheidender Bedeutung?
Unternehmensumgebungen umfassen mittlerweile lokale Infrastrukturen, mehrere öffentliche Clouds, Container-Plattformen und SaaS-Ökosysteme. Architekturen zur Cyber-Recovery müssen dieser Realität Rechnung tragen. Starre Recovery-Modelle können Reibungsverluste und Verzögerungen verursachen und so eine reibungslose Recovery sowie die Sicherheit der Sicherungsdaten beeinträchtigen.
„Any-to-any“-Recovery im Unternehmensmaßstab bedeutet, dass Unternehmen die Flexibilität haben,
Workloads über heterogene Infrastrukturen hinweg wiederherzustellen.
bei Bedarf zwischen Cloud-Anbietern zu migrieren.
Szenarien für einen kompletten Neuaufbau zu unterstützen, wenn Umgebungen vollständig kompromittiert sind.
verschiedene Hypervisor-Migrationen und Speicherplattformen zu unterstützen.
Dank dieser Portabilität können Recovery-Entscheidungen eher von geschäftlichen Prioritäten als von Plattformbeschränkungen geleitet werden. Außerdem trägt sie dazu bei, die Bindung an eine bestimmte Infrastruktur bei groß angelegten Vorfällen zu verringern.
How Does Minimum Viable Recovery Guide Business Continuity?
When a major cyber incident occurs, attempting to restore everything at once often creates unnecessary delays and complexity. During such scenarios, beginning with an organization’s minimum viable systemsand working toward full business recovery can be a powerful strategy.
This approach prioritizes the systems and data required to help restore core business operations first. Recovery sequencing aligns with business impact rather than infrastructure topology. Key elements of this practice include high dependency awareness, tiered recovery objectives, automated runbooks, and continuous testing and refinement.
Confident, trusted recovery of the most critical parts of the business.
Much faster return to continuous business operations.
Rapid recovery of identity systems, critical communications applications, and essential data.
Minimum viable recovery helps accelerate time to business continuity. It helps enable organizations to regain operational capability quickly, even if full restoration takes longer. This process also aligns directly with the ResOps philosophy of measurable readiness.
Conclusion: Bringing Together Every Aspect of Cyber Resilience
Present-day cyber resilience is not defined by an organization’s capability to create backups. It is defined by how confidently it can restore trusted operations under real adversarial pressure. It demands an architecture that helps continuously connect detection, validation, isolation, and orchestration.
In a mature architecture, these capabilities reinforce each other in real time. Detection signals help informCleanpoint™ confidence. Validation workflows continuously test recoverability. Cleanroom environments help provide a controlled proving ground before production cutover. Orchestrated runbooks help align technical recovery with business priorities. When these elements operate together under a ResOps model, they help provide organizations measurable confidence in their ability to recover.
As cyber threats continue to evolve, the defining advantage will not be how quickly systems can be restored, but how reliably clean, trusted operations can be reestablished at scale.
Häufig gestellte Fragen
Warum reichen herkömmliche Backup-Strategien für die Cyber-Resilienz nicht mehr aus?
Herkömmliche Disaster-Recovery-Lösungen wurden für Ausfälle und Hardwarefehler konzipiert, nicht für böswillige Angriffe. Moderne Ransomware zielt auf Backup-Repositorys ab, beschädigt Wiederherstellungspunkte und deaktiviert Schutzsysteme. Commvault begegnet diesem Problem durch die Kombination von Air Gap Protect, Anomalieerkennung und Cleanroom Recovery, um Wiederherstellungspunkte zu validieren und zu isolieren, bevor Daten wieder in die Produktion zurückgeführt werden.
Was ist evidenzbasierte Recovery und warum ist sie wichtig?
Evidence-driven recovery uses anomaly detection, threat intelligence, and validation workflows to confirm restore points are clean before deployment. Commvault Cloud implements this through continuous inspection before, during, and after backup — helping surface contamination early and enabling faster, more confident restoration under adversarial conditions.
Was ist „ResOps“ und wie verbessert es die Cyber-Recovery?
ResOps ist ein Betriebsmodell, das Recovery als kontinuierliche, messbare Disziplin und nicht als einmaliges Ereignis betrachtet. Commvault unterstützt ResOps, indem es Anomalieerkennung, validierte Wiederherstellungspfade und Cleanroom-basierte Tests zu einem gemeinsamen Workflow verbindet, der Sicherheits-, IT- und Datenschutzteams auf eine messbare Readiness ausrichtet.
Wie unterstützen „Cleanroom Recovery“ und „Synthetic Recovery“ eine sichere Wiederherstellung?
„Cleanroom Recovery“ bietet eine isolierte Umgebung, in der Workloads getestet und validiert werden können, bevor sie wieder in die Produktion zurückkehren. „Synthetic Recovery“ nutzt KI-gestützte Erkennung, um die aktuellsten fehlerfreien Versionen von Dateien zu einem verifizierten Wiederherstellungspunkt zusammenzufügen. Gemeinsam tragen sie dazu bei, die erneute Einschleusung von Malware während der Wiederherstellung zu verhindern.
Warum ist die Portabilität von Workloads bei einem Cybervorfall wichtig?
In hybrid and multi-cloud environments, organizations need the flexibility to restore workloads across different platforms. Commvault’s any-to-any portability capability allows recovery across heterogeneous infrastructure, cloud migration between providers, and rebuild-from-scratch scenarios — helping ensure recovery decisions are driven by business priorities rather than platform constraints.
Was ist „Minimum Viable Recovery“ und wie unterstützt sie die Geschäftskontinuität?
Minimum viable recovery prioritizes restoring the most critical systems required to resume core business operations. Commvault supports this through tiered recovery sequencing aligned to business impact — using automated runbooks and continuous testing to help organizations restore identity systems, critical applications, and essential data before completing a full rebuild.
Minimale lebensfähige Erholung: Die Verwertungslücke schließen
Explore the analyst framework for prioritizing critical systems recovery first — and what it means for business continuity under real adversarial conditions.
Erfahren Sie, wie die bedarfsgesteuerte, isolierte Cloud-Recovery-Umgebung von Commvault nach einem Cyberangriff sichere Workload-Tests, forensische Untersuchungen und Produktionsvalidierungen ermöglicht.
Ein „Leader“ im IDC MarketScape für weltweite Cyber-Recovery
Commvault wurde aufgrund der Breite seines Angebots im Bereich Cyber-Recovery, der Integration in das Ökosystem sowie seiner speziellen Schulungsangebote zur Cyber-Resilienz als Marktführer anerkannt.
Regulatory pressure, board expectations, and real-world conflict are accelerating the shift from prevention-focused spending to resilience outcomes.
The architecture of resilience has grown significantly more complex, especially as AI systems introduce new data lineage and recovery challenges.
Cyber resilience must eclipse traditional disaster recovery and treat disruption as a continuous operating condition rather than an exceptional event.
Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
The hardest part of the transition to ResOps is organizational. Fragmented ownership and misaligned priorities remain the most common failure modes.
Disruptions have become business as usual. Over the past year alone, we’ve seen:
When the operating environment is inherently uncertain, CISOs and CIOs need to rethink their approach to business continuity.In einem kürzlich abgehaltenen Webinar, David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the METAregion, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.
Sneak Peek: It’s No Longer a Matter of If, but When
In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.
Why Disaster Recovery Isn’t Enough
Per NIST’s definition, cyber resilience goes beyond traditional security by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?
Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?
We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.
In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection regulations are undergoing a resilience lens as well.
Securities and Exchange Commission (SEC) breach reporting requirements have put a spotlight not just on disclosure but on what organizations are doing to recover.
Boards now treat any outage as a business harm event, and the expectation has shifted to demonstrating not just that recovery is possible, but that it can happen quickly, with high confidence.
IDC research by Handa illustrates the way traditional recovery operations can fall short. Following the outbreak of war in the Middle East, she found CIOs and CISOs struggling with the continuity not only of technology, but also of people and processes as staff relocate overnight and offices become inaccessible, leaving no one to run manual failover.
And this is just one of the countless unpredictable scenarios organizations need to account for.
Building the Architecture of Resilience
Aresilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.
The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.
AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.
Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.
That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.
ResOps: The Operating Model for Sustainable Resilience
ResOps treats resilience as a continuous function, not just something that happens in response to an incident.
In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.
Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.
The Human Side of ResOps
Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.
ResOps forces organizations to answer questions many haven’t yet worked through, such as:
Who has the authority to restore services if the primary team is unavailable?
How should remote execution playbooks be structured?
How will cross-regional failover work when it can’t depend on a single location?
In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.
To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.
The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.
Putting It All Into Practice
Commvault helps organizations put ResOps into practice, from discovering and protecting data across on-premises and cloud environments, to detecting anomalies, recovering to a clean state, and restoring validated workloads. For organizations working to move from tabletop exercises to demonstrable restores, these are the capabilities that help make resilience operational in uncertain times.
Resources from the session, including IDC research on CIO readiness and Deloitte materials on evidence-based recovery, are available through theon-demand page.
FAQs
Q: What is cyber resilience and how is it different from disaster recovery?
A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.
Q: What’s driving organizations to prioritize resilience over prevention?
A: Regulatory frameworks like DORAand evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.
Q: What makes AI systems harder to back up and recover than traditional data?
A: Backing up an AI model means capturing more than the model file itself. Amodel is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.
Q: What is ResOps, and how does it differ from a traditional resilience program?
A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.
Q: What are the biggest obstacles to adopting ResOps at scale?
A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.
Michael Thelander is Senior Director, Product Marketing at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
Commvault AirGap ist von Grund auf unveränderlich, und für Unternehmen mit zusätzlichen Compliance- und regulatorischen Anforderungen stehen WORM-Sperrfunktionen zur Verfügung.
Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
WORM-fähige Speicherlösungen verursachen branchenweit einen gewissen Mehraufwand, doch Commvault trägt durch effizientes Datenmanagement und eine cloud Architektur dazu bei, diese Auswirkungen zu minimieren.
Die Kosten für Backup-Speicher gehen über den Kapazitätsverbrauch hinaus und sollten auch Infrastruktur-, Rechen- und Betriebskosten umfassen.
Unternehmen sollten die Ausfallsicherheit ihrer Backups durch Tests unter realen Bedingungen überprüfen, anstatt sich auf die Marketingversprechen der Anbieter zu verlassen.
Möglicherweise sind Ihnen kürzlich Behauptungen eines Mitbewerbers begegnet, wonachCommvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.
Let us address this directly: These claims are inaccurate.
Unterstützung für unveränderliche Daten und WORM-Sperren in AirGap
AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.
For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across supported cloud storage targets, including:
Amazon S3 Object Lock
Microsoft Azure Blob immutability policies
These features are documented, rigorously tested, and actively used by customers in production environments today.
In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.
Speichereffizienz: Das Gesamtbild verstehen
Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.
What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.
However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.
By contrast, modern, cloud-native approaches prioritize:
These design principles can result in more predictable, scalable, and sustainable long-term costs.
Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.
Ein wachsender Trend bei den Kunden
Wir beobachten ein deutliches Muster: Unternehmen wechseln zunehmend zu Commvault, nachdem sie sich entschieden haben, die Verträge mit ihren bisherigen Anbietern nicht zu verlängern. Häufige Gründe hierfür sind unter anderem:
Unerwartete Einschränkungen bei der Skalierung von Umgebungen.
Leistungsbeschränkungen im Zusammenhang mit appliancebasierten Architekturen.
Steigende Infrastruktur- und Betriebskosten.
Die Preise für die Verlängerung liegen deutlich über den Konditionen des ursprünglichen Kaufs.
These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.
Den Durchblick behalten
In a market often shaped by aggressive claims and unclear comparisons, objective validation can be critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.
Through this program, you can:
Simulieren Sie realistische Szenarien von Cyberangriffen.
Testen Sie die Wiederherstellungsfunktionen anhand Ihrer eigenen Daten und in Ihrer eigenen Umgebung.
Evaluate performance without vendor bias or staged demonstrations.
The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.
FAQs
Q: Is Commvault AirGap truly immutable?
A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.
Q: Does AirGap support WORM lock protection?
A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.
Q: Does enabling WORM lock significantly increase storage costs?
A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.
Q: Why is total cost of ownership more important than storage overhead alone?
A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.
Q: Why are some organizations moving away from appliance-based backup architectures?
A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.
Q: How can organizations validate their cyber resilience strategy?
A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.
Kash Ansari is Chief Customer Officer Americas at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
Over the past few years, I’ve had more conversations about AI than I can count.
Some are focused on potential. Some are focused on risk. Very few are grounded in how AI actually shows up in day-to-day operations.
That’s why I’m writing about an episode of STRIVE I recorded with Ravit Jain, founder and host of “The Ravit Show.”
We didn’t spend time on hype. We didn’t speculate about the future. We focused on what’s happening right now – and what changes when conversational AI is layered on top of unified resilience.
Watch the gesamte Folge.
Das Wichtigste auf einen Blick: Was dieser Wandel wirklich bedeutet
Conversational AI helps lower the barrier to cyber intelligence. Leaders can ask complex questions in plain language and get actionable answers.
Unified resilience helps reduce fragmentation. Bringing recovery, security, and governance together can change how quickly organizations respond.
Trust is the deciding factor in AI adoption. Without transparency and control, AI doesn’t move beyond experimentation.
Clean data matters more than speed alone. Recovery isn’t just about getting systems back – it’s about getting back to a trusted state.
AI doesn’t replace expertise. It amplifies it by helping to remove friction and accelerate understanding.
Von Dashboards zum Dialog
For years, cybersecurity platforms have relied on dashboards, charts, alerts, and reports. And for technical teams, those tools work. But most leaders don’t think in dashboards. They think in questions:
Sind wir gefährdet?
Wie lange wird die Genesung dauern?
What’s the impact if something happens right now?
Ravit and I talked about how conversational AI changes that dynamic. Instead of navigating layers of tooling, teams can interact directly with their environment using natural language. That fundamentally changes who can engage with cyber resilience – and how quickly decisions can be made.
Vorschau: Cyber-Resilienz im Gespräch
Catch a sneak peek of the gesamte Folge where we explore how conversational AI shifts cybersecurity from something you interpret to something with which you can directly interact.
Vertrauen verändert alles
One theme kept coming up throughout our discussion: trust. It’s easy to build an interface that answers questions. It’s much harder to build one that leaders trust in a real incident.
Trust comes down to a few things:
Datenintegrität
Zugriffskontrolle
Transparenz
Führung
Beständigkeit im Laufe der Zeit
If an executive asks a question about recovery posture, the answer has to be right. It has to be explainable. And it has to be grounded in data that hasn’t been compromised. Without that foundation, conversational AI is interesting, but not operational. With it, it becomes something teams rely on.
Warum die Wiedervereinigung wichtig ist
Ein weiterer Punkt, der in unserem Gespräch besonders hervorstach, war, wie komplex die meisten Umgebungen nach wie vor sind:
Verschiedene Tools für die Datensicherung.
Verschiedene Sicherheitssysteme.
Unterschiedliche Verfahren der Unternehmensführung.
Alle arbeiten unabhängig voneinander.
That fragmentation slows everything down – especially during an incident.
Unified resilience helps change that by bringing those pieces together into a single operational layer. When conversational AI sits on top of that layer, you’re not querying isolated systems anymore. You’re interacting with a connected view of your entire environment. That’s where things can start to move faster and clarity improves. And that’s where recovery decisions become more confident.
This Isn’t About Replacing People
There’s always a question that comes up when AI enters the conversation: What happens to the teams?
Ravit addressed this directly. AI isn’t replacing expertise – it’s extending it. Security teams still define policy. Recovery teams still validate outcomes. And leaders still make decisions.
What changes is how quickly they can get to the information they need – and how clearly they can understand it. Because when you’re in the middle of a cyber event, that clarity matters.
Ein Wandel in der Arbeitsweise von Organisationen
There’s also a cultural shift happening when conversational AI becomes part of the workflow:
Diskussionen zum Thema Sicherheit lassen sich leichter verfolgen.
Es können sich mehr Interessengruppen beteiligen.
Entscheidungen können schneller getroffen werden.
Silos können allmählich zerfallen.
Instead of cybersecurity being confined to a handful of specialists, it becomes something the broader organization can engage with. To be clear – that doesn’t make it simpler. But it does make it more accessible.
Die ganze Folge ansehen
In the full STRIVE episode, you’ll discover:
Wie dialogorientierte KI tatsächlich im Bereich der Cybersicherheit eingesetzt wird.
Was nötig ist, um Vertrauen in KI-gestützte Systeme aufzubauen.
Warum einheitliche Plattformen dazu beitragen, die Ergebnisse der Genesung zu verbessern.
Wie Unternehmen beginnen können, über diesen Wandel nachzudenken.
Jetzt anschauen.
If you’re thinking about how AI fits into your resilience strategy, it’s worth the time.
FAQs
Q: What is conversational AI in cybersecurity?
A: Conversational AI allows users to interact with security and recovery systems using natural language, making it easier to access insights without navigating complex tools.
Q: How does conversational AI help improve resilience?
A: Conversational AI helps reduce friction in understanding data, can speed up decision-making, and allows more stakeholders to engage in recovery and security discussions.
Q: Why is trust so important for AI adoption?
A: If teams don’t trust the data, the controls, or the outputs, they won’t rely on AI during critical moments.
Q: What does unified resilience mean?
A: Unified resilience refers to bringing together data protection, security, governance, and recovery into a single, integrated approach, rather than managing them separately.
Q: Does conversational AI replace security teams?
A: No. Conversational AI can help teams work more efficiently by making information easier to access and understand.
Q: Where should organizations start?
A: Focus on data integrity, governance, and unifying visibility across systems before layering in conversational capabilities.
Darren ThomsonisVice President and Chief Technology Officer, EMEA, at Commvault
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
Die Cyber-Resilienz hängt sowohl von der Technologie als auch vom Fachwissen der Experten ab, die für den Schutz und die Wiederherstellung kritischer Systeme verantwortlich sind.
Durch kontinuierliches Lernen bleiben die Partnerteams über sich ständig weiterentwickelnde Bedrohungen, hybride Umgebungen und bewährte Verfahren zur Gewährleistung der Ausfallsicherheit auf dem Laufenden.
Die Commvault Readiverse Academy bietet rollenbasierte Schulungen, praktische Übungen und Zertifizierungen an, die darauf ausgerichtet sind, praxisnahe Kompetenzen im Bereich der Cyber-Resilienz zu vermitteln.
Kunden legen zunehmend Wert auf Partner, die ihnen zuverlässige Beratung bieten, die Wiederherstellungsbereitschaft beschleunigen und die Widerstandsfähigkeit maximieren können.
Investitionen in die Weiterbildung tragen dazu bei, die Kompetenzen der Partner zu stärken, das Vertrauen der Kunden zu festigen und das langfristige Unternehmenswachstum zu fördern.
Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.
True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.
The Growing Importance of Continuous Learning
Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.
For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:
Das Fachwissen im Bereich Cyber-Resilienz ausbauen.
Schaffen Sie Vertrauen in Kundengesprächen.
Halten Sie Schritt mit den sich weiterentwickelnden Technologien und bewährten Verfahren.
Bereiten Sie sich auf neue Aufgaben und Chancen vor.
Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.
Building Expertise Across the Partner Ecosystem
At Commvault, we recognize that different partner roles require different skills and learning paths.
That’s why Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.
Zertifizierungen, die die Praxistauglichkeit bestätigen.
Today, more than 10,000 active learners across the partner ecosystem are building their expertise through Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.
Why Expertise Matters to Customers
Customers aren’t just investing in technology – they’re investing in outcomes.
They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.
Partners with continuously developing teams are better positioned to help:
Bereitstellungen beschleunigen.
Lösungen an sich wandelnde Anforderungen anpassen.
Die Einsatzbereitschaft verbessern.
Die Vorsorge für den Wiederaufbau stärken.
Komplexe Herausforderungen im Bereich der Resilienz meistern.
As cyber resilience becomes mission-critical, expertise becomes a key differentiator.
Investing in the Future of Cyber Resilience
The cyber resilience landscape will continue to evolve – and so will customer expectations.
For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.
Explore the Commvault Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.
FAQs
Q: Why is technology alone not enough to achieve cyber resilience? A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.
Q: What role does continuous learning play in cyber resilience? A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.
Q: What is the Commvault Readiverse Academy? A: Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.
Q: How do customers benefit from working with highly trained partners? A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.
Q: Why are certifications important in the cyber resilience field? A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.
Q: How can partners prepare for the future of cyber resilience? A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.
Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.
More related posts
Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience
