Die wichtigsten Erkenntnisse

• Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
• The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
• Clean recovery requires validated, isolated restoration processes to help reduce reinfection risk and restore operations with confidence.
• Triggering backup and recovery actions directly from security tools helps preserve critical data early and shorten recovery timelines.
• Unified resilience brings security and recovery together, helping reduce friction across Extended Detection and Response (XDR) and Security Orchestration, Automation, and Response (SOAR) environments while improving response speed and confidence.

If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.

That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR and Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.

Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.

And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to „Minimum Viability“? That’s the gap we’re closing, bringing recovery actions into the zur Reaktion auf flow, where decisions are already being made.

This is where “clean recovery” stops being a talking point and becomes the new standard.

Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.

According to Sophos’ 2026 Active Adversary Report, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”

That kind of speed forces zur Reaktion auf to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.

With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.

If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Cleanroom Recovery, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.

The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.

A Commitment to Unified Resilience

Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.

Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.

So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.

The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:

• Read the perspective behind clean recovery and why data integrity matters: Maintaining Data Integrity for Proactive and Confident Recoveries
• See how Commvault integrates with Splunk SOAR for response automation: Enhanced threat detection and response with Commvault and Splunk SOAR

Orhit me up on LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.

FAQs

Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.

Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.

Q: How does the Cisco XDR and Commvault integration improve zur Reaktion auf?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.

Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.

Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.

Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.

Michael Fasulois Senior Director, Portfolio Marketing, at Commvault.

Related BlogsCleanroom Recovery läuten eine neue Ära der Cyber-Resilienz ein

Commvault Ushers in a New Era of Unified Enterprise Resilience

Die nächste Evolutionsstufe im Bereich Cloud

The 5 Critical Steps to Clean Recovery

Ihr modernes Spielbuch für schnelle Reaktion und saubere Wiederherstellung

There’s a lot of talk about modernization – Cloud, AI, automation, security transformation. But what does modernization actually look like when you’re responsible for keeping systems running, data protected, and recovery viable under pressure?

In this episode of STRIVE, I had the pleasure of sitting down with Gilman Treantos – a 25-year IT veteran whose career spans everything from mainframes to modern cyber resilience architecture. This conversation provides a practitioner’s view of what modernization really means when outages, ransomware, and operational risk are part of the daily equation.

Watch the gesamte Folge.

Key Takeaways: What Modern Cyber Readiness Actually Requires

• Modernization isn’t about new tools – it’s about resilient architecture. Technology evolves, but recovery discipline, testing, and cross-team coordination are what separate reactive organizations from resilient ones.
• Cyber readiness demands collaboration between security and infrastructure. Silos create blind spots. Unified visibility and shared responsibility can create speed in recovery.
• Backup tools are more powerful than most teams realize. When used creatively, they can support large-scale migrations, isolated recovery, and transitions designed to minimize data loss.
• Testing is non-negotiable. A recovery plan that hasn’t been rehearsed is a liability, not a strategy.
• Career resilience mirrors technical resilience. Proactivity, curiosity, and willingness to solve hard problems are as critical as any platform.

From Blockbuster to Cyber Resilience

Gilman’s journey didn’t start in a war room or a security operations center. It started at Blockbuster.

Without formal IT training, he leaned into troubleshooting. That curiosity became mainframe work. That work became distributed systems. That evolved into data protection and cyber resilience leadership.

What stands out isn’t the career arc – it’s the mindset. He built a reputation by taking on the problems no one else wanted. Fixing fragile systems. Supporting overlooked initiatives. Solving issues that crossed organizational boundaries.

That mentality translates directly to modernization, because modern cyber readiness is built by people willing to dig into uncomfortable complexity.

Sneak Peek: The Modernization Playbook

In this segment, Gilman explains why modern cyber recovery requires more than traditional malware detection — and how anomaly detection, ThreatScan, and isolated recovery environments can help strengthen enterprise resilience.

Modernization Under Pressure

One of the most compelling parts of the episode is a real-world example: evacuating a remote data center in a single night. No data loss. No prolonged downtime. No operational chaos.

By leveraging Commvault LiveSync in a creative way, Gilman and his team were able to migrate infrastructure quickly and cost-effectively – using capabilities that weren’t originally designed for that exact scenario.

That’s modernization in practice.

The House of Cards Problem

As organizations scale, permissions sprawl. Backup systems grow complex. Security tools layer on top of infrastructure without full alignment. Over time, environments become fragile.

Gilman describes this dynamic as something many teams underestimate: a slow accumulation of technical and operational debt. Modernization, in his view, isn’t just upgrading platforms. It’s simplifying architecture, improving visibility, and breaking silos between cybersecurity and infrastructure teams.

Cyber readiness means:

• Die Sicherheits- und Backup-Teams tauschen Telemetriedaten aus.
• Wiederherstellungsumgebungen werden isoliert und getestet.
• Die Erkennung von Malware geht über die primären Arbeitsabläufe hinaus.
• Bei Infrastrukturentscheidungen wird die Wiederherstellungsgeschwindigkeit berücksichtigt.

This is where modernization and resilience intersect.

Threats Are Evolving. So Must Recovery.

Ransomware isn’t slowing down. Threat actors are more sophisticated. Malware hides inside legitimate workflows. Gilman’s perspective is blunt: Preparation must be proactive.

He advocates for:

• Regelmäßige Tests der Notfallwiederherstellung
• Isolierte Wiederherstellungsumgebungen, die zur Aktivierung bereitstehen
• In Backup-Prozesse integrierte Tools zur Erkennung von Anomalien
• Teamübergreifende Übungen, die reale Störungen simulieren

Watch the Full Episode

Check out our full STRIVE conversation to learn:

• Wie Gilman seinen Ansatz zum Datenschutz im Laufe von 25 Jahren weiterentwickelt hat.
• Die Details einer Migration, die darauf ausgelegt ist, Datenverluste zu minimieren.
• Warum die Zusammenarbeit zwischen Sicherheit und Infrastruktur unerlässlich ist.
• Praktische Tipps für Resilienz-Experten.
• What modernization really demands in today’s threat landscape.

Jetzt anschauen.

If you care about resilience, recovery, or leading IT through uncertainty, this is 20 minutes well spent.

FAQs

Q: What does “modernization” mean in the context of cyber readiness?

A: It means building resilient, testable, and collaborative systems that can recover quickly under real-world pressure – not just upgrading to newer platforms.

Q: Why is collaboration between security and infrastructure teams so important?

A: Because recovery depends on shared visibility. Security detects threats, but infrastructure enables restoration. Without alignment, response slows and risk increases.

Q: How can backup tools support modernization beyond recovery?

A: When used creatively, they can enable data center migrations, isolated recovery environments, anomaly detection, and large-scale operational shifts.

Q: How often should disaster recovery environments be tested?

A: Regular testing – ideally quarterly or aligned with major infrastructure changes – builds confidence and reveals gaps before an actual incident.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Related BlogsWie die SMMPA die Cyber-Resilienz durch Cleanroom Recovery gestärkt hat

Cyber-Sicherheit in Zeiten geopolitischer Spannungen: Leitlinien für unsere Kunden, Partner und die Community

Warum KI Ihre Resilienzstrategie untergräbt (und was Sie dagegen tun können)

Physik vs. Marketing: Die Erholung beschleunigen und dabei die Gesetze der Physik beachten

Modernisierung der Cybersicherheit im Finanzbereich: Von reaktiv zu widerstandsfähig

Die wichtigsten Erkenntnisse

• Herkömmliche Strategien zur Ausfallsicherheit scheitern angesichts des Ausmaßes,der Geschwindigkeit und der Autonomie KI-gestützter Systeme.
• Industriell gefertigte Ransomware und KI-gestützte Angriffe zielen mittlerweile auf Backup-Systeme ab und untergraben damit die Grundlage der Recovery.
• Unternehmen müssen von isoliert arbeitenden Sicherheits- und Recovery-Teams zu einem einheitlichen,kontinuierlichen Modell übergehen,das als „Resilience Operations“ bezeichnet wird.
• KI-gestützte Resilienz erfordert Echtzeit-Datentransparenz,kontinuierliche Bedrohungserkennung und eine intelligente,fehlerfreie Recovery in großem Maßstab.
• Moderne Plattformen ermöglichen eine schnelle und verifizierte Recovery-Prozedur und helfen Unternehmen dabei,den Kompromiss zwischen schneller und sicherer Recovery-Prozedur zu vermeiden.

Während Unternehmen um die Einführung von KI wetteifern,kommen CISOs und CIOs zu einer ernüchternden Erkenntnis: Die Resilienzstrategien,die bei traditioneller Infrastruktur funktioniert haben,versagen. Systeme,die sich früher innerhalb von Stunden von Angriffen erholen konnten,benötigen nun möglicherweise Tage. Backup-Ansätze,die für zentralisierte Daten konzipiert wurden,haben möglicherweise Schwierigkeiten mit Workloads,die über Clouds und KI-Plattformen verteilt sind. Unterdessen nehmen Bedrohungen und potenzielle Schwachstellen von Tag zu Tag zu.In einem kürzlich abgehaltenen Webinarging Tim Zonca,Vice President of Portfolio Marketing bei Commvault,auf eine dringende Frage ein,mit der Sicherheitsverantwortliche konfrontiert sind: Wie lässt sich die Ausfallsicherheit aufrechterhalten,wenn KI die Spielregeln grundlegend verändert?

What Industrialized Ransomware and AI Mean for Resilience

CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.

As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.

Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.

Making Resilience Operational

As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:

• Kontinuierliche Sicherung der Daten an der Quelle und Überwachung auf Anomalien.
• Kontrolle der Identitäten von Personen,nicht-menschlichen Identitäten und Geräten,die autonom auf Daten zugreifen und diese nutzen.
• Erreichen einer vorhersehbaren Recovery von Daten in großem Maßstab ohne Kompromittierung oder Beschädigung.

Traditionell wurden Datensicherheit,Identitätsresilienz und Cyber-Recovery als eigenständige Disziplinen behandelt,jede mit eigenem Team,eigenen Tools,Richtlinien und Anforderungen. Diese Silos lassen Schwachstellen offen,die Angreifer ausnutzen können,und verlangsamen die Recovery,wenn KI-Systeme ausfallen. Um diese Lücken zu schließen,müssen Unternehmen diese Fähigkeiten in einem kontinuierlichen,automatisierten Kreislauf vereinen. Wir bezeichnen diesen Ansatz alsresilience operations (ResOps).

ResOps umfasst drei wesentliche Anforderungen für KI-Resilienz:

• Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
• Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
• Intelligent recovery: Automated,comprehensive restoration for entire cloud-native applications and their dependencies. To prevent re-infection,teams must validate data integrity and conduct forensic analysis in an isolated cleanroom before moving trusted data back to production.

Enabling ResOps in practice

To help companies make the move to ResOps,Commvault has introducedCommvault Cloud Unityeingeführt – die bedeutendste Plattformveröffentlichung in unserer Geschichte. Sie wurde entwickelt,um alle drei Dimensionen der Ausfallsicherheit zu vereinen:

• Die Zusammenführung vonDatensicherheit,identity resilience,and Cyber-Recovery-Workflowsunter einem einzigen Betriebsmodell.
• Protecting all workloads,from both today’s production systems to tomorrow’s emerging AI stacks.
• Safeguarding data regardless of location,whether in clouds,regions,data centers,or edge locations.

A next-generation architecture brings AI automation to all facets of data protection,Datensicherheit,identity resilience,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.

As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.

With Commvault Cloud,eine kontinuierliche Bedrohungsüberwachung and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.

See ResOps in action

Sehen Sie sich das vollständige Webinar auf Abruf an to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.

FAQs

 Q: What is Resilience Operations (Res Ops)?

A: ResOps is an operating model that unifies Datensicherheit,identity resilience,and Cyber-Recovery-Workflows into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.

Q: Why can’t traditional backup and recovery handle AI workloads?

A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.

When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.

Q: What does “unified resilience” mean in practice?

A: Unified resilience means bringing Datensicherheit,identity management,and Cyber-Recovery-Workflows together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.

In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.

Q: What’s the difference between cyber resilience and AI resilience?

A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.

Q: How does ransomware target backup systems?

A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.

Q: What is the clean vs. complete recovery dilemma?

A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through eine kontinuierliche Bedrohungsüberwachung and verified recovery points.

Q: What is a cleanroom in Cyber-Recovery-Workflows?

A: A cleanroom in Cyber-Recovery-Workflows is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.

Sam Curcuruto is Director of Product Marketing at Commvault.

Related BlogsResilienz für das Zeitalter der KI neu denken

A CIO’s Perspective: Strengthening Business Resilience in the AI Era

Widerstandsfähig gegen die KI-Maschine

Cleanroom Recovery läuten eine neue Ära der Cyber-Resilienz ein

Die wichtigsten Erkenntnisse

• “Instant restore” claims often break down at scale due to real-world I/O operations per second (IOPS), rehydration, and infrastructure constraints.
• Mass live mounts on deduplicated backup storage can cause performance collapse, forcing slow rehydration back to primary storage.
• Cleanrooms help enables parallel forensic investigation and business recovery instead of serial, delay-driven downtime.
• Identity compromise expands the blast radius, making isolated recovery and Active Directory (AD) restoration critical to secure operations.
• Automated cleanroom runbooks and repeatable testing help organizations validate real recovery metrics before a crisis occurs.

Let’s start with a quick story about a “ransomware‑proof” environment that took 72 hours to recover, way beyond the organization’s expectations for recovery time objective. It is exactly the kind of situation where Commvault’s Cleanroom Recovery could have helped turn a painful, three‑day outage into a faster, more controlled recovery with less risk.

War Story: Physics vs. Marketing

On Reddit, a user shared how the financial services firm they work for was hit by a breach. They assumed they had a “dream stack” for quick recovery (but can you really have a “dream stack” without Cleanroom Recovery?): immutable backups, secure storage snapshots, and a modern hypervisor. The datasheets promised “instant mass restore,” yet the business sat offline for three days while everyone tried to drag their environment back to life.

The root cause was not that backups failed, but that the real‑world physics of rehydration, forensics, and identity were never tested at scale. The original poster mentioned that having access to a cleanroom environment would have sped up the process. Let’s dig into this further and address why.

Commvault’s Cleanroom Recovery is designed to address exactly these weak points: It helps automate clean, isolated recovery into the cloud, validates data, and orchestrates recovery in a way that aligns with how incidents actually unfold, not just how diagrams look on slides.

Problem 1: The Rehydration Trap

In the story, “live mounting” a handful of virtual machines (VMs) worked fine, but trying to live mount hundreds crushed the backup appliance. The random I/O running directly on deduplicated, compressed backup storage collapsed the IOPS, forcing the team to rehydrate everything back to primary Non-Volatile Memory Express at about 3 TB/hour for roughly 100 TB of data.

Commvault Cleanroom Recovery helps recover workloads into an isolated Azure‑based cleanroom built on scalable cloud compute and storage instead of trying to run production at scale off a backup appliance.

This allows you to restore critical VMs into a purpose‑built recovery environment, use cloud elasticity to absorb I/O, and automate the recovery sequence so the right systems (identity, core apps, critical data) come up first without bottlenecking on a single backup target.

Problem 2: The Forensic Drag

In the audit, the tech stack was ready in about four hours, but legal delayed touching anything for 72 hours because they had no pre‑provisioned cleanroom. Without an isolated environment with zero routes back to production, the forensics team could not safely investigate while the business recovered, so everyone waited for the all-clear before starting any real restore.

Cleanroom Recovery provides an on-demand, isolated recovery environment explicitly built for simultaneous recovery and forensic analysis. You can spin up a fenced cleanroom in Azure in hours, recover systems into it, and let security and legal teams perform read‑only forensics and threat scanning while operations validates applications and prepares for cutover – dramatically shrinking “forensic drag” as a contributor to downtime.

Problem 3: Identity Blast Radius

The environment in the story had a single admin account with access to both the hypervisor and backup console, which meant if attackers pivoted that far, immutability could become just another setting they flipped off. Identity, not just data, was the real blast radius problem.

Cleanroom Recovery is designed to help reduce dependency on the compromised production identity plane during recovery, allowing isolated access and planned support for AD restoration in the cleanroom.

By recovering identity services into an isolated cleanroom and using separate, least‑privilege access paths, you can help validate AD, help enforce proper authorizations, and help protect backup control planes from being trivially compromised by the same credentials that were used in production.

How Cleanroom Recovery Would Change This Story

If this customer had used Cleanroom Recovery, their recovery story could have been very different.

• Faster, physics‑aware recovery: They could have helped orchestrate recovery into a cloud cleanroom with scalable storage and compute, avoiding the IOPS collapse of mass live mounts and pushing toward the recovery velocity they actually needed.
• Parallel forensics and business recovery: A pre‑defined cleanroom RTO of under four hours would have helped them spin up a fenced environment for both forensic work and application validationinstead of waiting 72 hours in a holding pattern.
• Reduced reinfection and identity risk: Cleanroom isolation, threat scanning, and a separate control plane would have helped limit identity blast radius, helped confirm data was malware‑free before returning to production, and helped give auditors and insurers a clean, verifiable recovery trail.
• Automated, repeatable playbooks:Automated runbooks orchestrating clean point detection, workload sequencing, and test failovers could have helped them regularly rehearse this scenario and know their real‑world metrics before an attack – not learned them during a crisis.

For organizations that already invest in “ransomware‑proof” stacks, the missing piece is often not more features but a cleanroom strategy that respects physics, identity, and legal reality. Commvault Cleanroom Recovery is designed to close that gap and help turn recovery from a three‑day war story into a controlled, provable, and much faster operation.

FAQs

Q: Why did the “instant mass restore” approach fail in the ransomware scenario?
A: While live mounting a few VMs worked, scaling to hundreds overwhelmed the backup appliance due to I/O constraints. Deduplicated and compressed backup storage is not designed to handle full production workloads at scale, leading to performance collapse and delayed recovery.

Q: What is the “rehydration trap” in disaster recovery?
A: The rehydration trap occurs when organizations must restore large volumes of compressed backup data back to primary storage before systems can operate normally. This process is limited by throughput rates, which can dramatically extend recovery times when dealing with tens or hundreds of terabytes.

Q: How does a cleanroom help reduce forensic-related downtime?
A: A cleanroom provides an isolated environment where forensic teams can safely investigate while IT simultaneously restores systems. This parallel approach helps eliminate long waiting periods for legal or security approval before beginning recovery efforts.

Q: Why is identity such a critical factor in ransomware recovery?
A: If attackers compromise administrative credentials tied to both production and backup systems, immutability controls may no longer provide protection. Isolated identity recovery and least-privilege access can help limit blast radius and support a safer restoration process.

Q: How does Cleanroom Recovery help improve recovery orchestration?
A: Cleanroom Recovery helps automates workload sequencing, cleanpoint validation, and cloud-based recovery infrastructure provisioning. This structured approach aligns recovery with how incidents actually unfold, helping organizations regain control faster and with greater confidence.

Q: What is the strategic lesson for organizations with “ransomware-proof” stacks?
A: Advanced features alone do not guarantee fast recovery. A cleanroom strategy that accounts for infrastructure physics, identity isolation, and legal realities helps enable organizations to turn theoretical resilience into measurable, repeatable recovery performance.

Nico Guerrera is Senior Solutions Marketing Manager at Commvault.

Verwandte Blogs

Active Directory-Wiederherstellung: Warum manuelle Methoden nicht mehr praktikabel sind

Wiederherstellungstests: Das fehlende Element in den meisten Cyber-Resilience-Programmen

Ihr modernes Spielbuch für schnelle Reaktion und saubere Wiederherstellung

Cyber-Resilienz freisetzen: Die Macht der Reinräume

Warum die Wiederherstellung von Reinräumen und Cyber-Tests entscheidend für die Widerstandsfähigkeit im Cyber-Bereich sind

Key Takeaways

• Cloud Backup & Recovery for DevOps now includes support for Atlassian Jira,extending enterprise-grade data protection to mission-critical project workflows.
• Automatisierte,richtlinienbasierte Backups und granulare Recovery-Optionen helfen Teams dabei,Jira-Bereiche,Arbeitselemente und Konfigurationen schnell wiederherzustellen.
• Integrierte Features zur Cyber-Resilienz wie unveränderliche Backups und isolierter Cloud-Speicher tragen dazu bei,Jira-Daten vor Ransomware und unbefugten Änderungen zu schützen.
• Ein einheitlicher Schutz für Jira,Azure DevOps,GitHub und GitLab reduziert die Tool-Flut und vereinfacht die Datenresilienz im DevOps-Umfeld.
• Der Schutz für Jira ist im Rahmen des Early-Adopter-Zugangs verfügbar; die allgemeine Verfügbarkeit ist für März 2026 geplant.

Wir freuen uns,die Erweiterung vonCommvault® Cloud Backup & Recovery for DevOpsum die Unterstützung für Atlassian Jira bekannt zu geben. Dieses Update bietetSchutz,Recovery und Cyber-Resilienz auf Unternehmensniveauto Jira,helping organizations safeguard mission-critical project data against data loss and cyber incidents.

With this release,teams now have a unified way to protect critical sprint plans,work items,and configurations alongside their code,pipelines,and repositories in Azure DevOps,GitHub,or GitLab,all with a single solution.

Why Protecting Jira Data Matters

Jira has become a cornerstone for many organizations,supporting everything from agile software development and product releases to IT service management. It houses the plans,workflows,and task data that teams depend on to help execute mission-critical work.

Despite its importance,Jira is not immune to data loss. Accidental deletions,misconfiguration,and malicious activity can quickly erase valuable project history and disrupt active work.

When Jira data is lost or becomes unavailable,teams lose visibility,sprints stall,releases are delayed,service commitments are missed,and productivity suffers as teams attempt to recreate lost information.

A reliable backup and recovery strategy for Jira is critical to help maintain continuous business and help minimize the risk of downtime,operational disruption,and potential failure to meet data retention or regulatory compliance requirements.

Enterprise-Grade Protection for Jira Clouddelivers enterprise-scale protection and recovery for Jira,helping organizations safeguard mission-critical Jira data against cyber incidents,disasters,and operational mistakes.

Key features:

• Automated,policy-based backups of Jira spaces,work items,and configurations,including attachments,custom fields,and board settings.
• Granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time.
• Simplified compliance through centralized control,audit logging,and extended retention to help support regulatory and internal requirements.
• Cyber resilience withunveränderliche Backups,isolierten Cloud-Speicher,and ein Zero-Trust-Designzum Schutz der Daten vor Ransomware und unbefugten Änderungen.
• Unified protection for Jira,Azure DevOps,GitHub,GitLab,and other enterprise workloads from a single platform.

Unifying DevOps Data Resilience with Commvault

By unifying Jira protection with other DevOps platforms in Cloud Backup & Recovery for DevOps,enterprises can gain a holistic approach to data resilience across the full DevOps lifecycle – from planning and issue tracking to code and delivery. The result is fewer tools,reduced complexity,and confidence that sprint plans and backlog items are rapidly recoverable when it matters most.

Early Availability

Atlassian Jira protection is now available through Early Adopter access with general availability planned for March 2026.

Learn more about Commvault’s support for Atlassian Jira,hier.

To learn more about how to get access to getting access to Jira protection or schedule a demo,contact your Commvault account team.

FAQs

Q: Why is backing up Atlassian Jira important?
A: Jira houses critical sprint plans,workflows,and issue data that many teams rely on to deliver projects and services. Data loss from accidental deletion,misconfiguration,or malicious activity can disrupt releases and impact productivity,making a reliable backup and recovery strategy essential.

Q: What Jira data can Cloud protect?
A: Cloud helps protect Jira spaces,work items,configurations,attachments,custom fields,and board settings. This comprehensive coverage helps organizations maintain full visibility and recover both detailed items and entire sites when needed.

Q: How does recovery work with Cloud for Jira?
A: The solution helps support granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time. This flexibility enables teams to restore exactly what they need without unnecessary disruption.

Q: How does this solution support compliance and cyber resilience?
A: Centralized control,audit logging,and extended retention help organizations meet regulatory and internal requirements. Immutable backups,isolierten Cloud-Speicher,and a ein Zero-Trust-Design help strengthen protection against ransomware and unauthorized changes.

Q: Can Jira protection be managed alongside other DevOps platforms?
A: Yes. Cloud unifies protection for Jira with Azure DevOps,GitHub,GitLab,and other enterprise workloads within a single platform,helping reduce complexity and enable a holistic approach to DevOps data resilience.

Q: When will Jira protection be generally available?
A: Atlassian Jira protection is currently available through Early Adopter access,with general availability planned for March 2026. Organizations can contact their Commvault account team to learn more or schedule a demo.

Katharine Colucci is a Product Marketing Manager at Commvault.