To address mandates governing where their data is stored and used, many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography, that no foreign-jurisdiction personnel accessed it, and that they can recover it within 24 hours under incident conditions.

In a recent webinar, I joined Commvault GM Alex Zinin, who leads our digital sovereignty task force, along with Jakub Lewandowski, our associate general counsel for EMEA, and Pranay Ahlawat, our chief technology and AI officer, to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.

See the full webinar and get the full Digital Sovereignty Decoded readiness report and implementation framework.

Key Takeaways

• The EU Cloud Sovereignty Framework defines eight sovereignty objectives, only one of which concerns data location.
• Selecting a sovereign cloud region addresses where data lives, but not who can access it, under what legal authority, or whether you can recover it under real conditions.
• A complete sovereignty posture spans four interdependent pillars: data locality, technological sovereignty, operational sovereignty, and jurisdictional sovereignty.
• Sovereignty programs that treat recovery architecture separately from primary data governance carry an unexamined risk that can surface during incidents.
• Rather than a policy of maximum sovereignty at any cost, organizations should design their strategy around minimum viable sovereignty: the right controls, consistently enforced, calibrated to actual obligations.

Digital Sovereignty Becomes an Enterprise Requirement

Over the past decade, the toughest digital and data sovereignty rules have mainly applied to government, defense, and other national‑security workloads. Outside of highly regulated sectors, many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.

That’s now changing. GDPR enforcement has matured beyond guidance into substantial fines for operational failures, and newer regimes like DORA, NIS2, Germany’s KRITIS rules, and the EU Data Act have tightened expectations around jurisdictional control and operational resilience.

Sovereignty questions are now surfacing in RFPs, M&A due diligence, and board‑level risk reviews as well.

The EU Cloud Sovereignty Framework, published in October 2025, clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives, only one addresses where data resides. The other seven cover access control, operational dependencies, jurisdictional exposure, and recovery.

For enterprises, this structure is now the lens through which vendor capabilities must be evaluated.

Sneak Peek: Rethinking Sovereignty and Resilience

In this moment from the webinar, Jakub discusses how sovereignty is a risk posture, rather than a single product. Organizations need a holistic strategy that combines architecture, operations, governance, auditability, and recovery planning to address it.

Data Residency Does Not Equal Sovereignty

Data residency only answers questions about where. Sovereignty regulations also require being able to explain who, how, and under what conditions.

In practical terms, a complete sovereignty posture encompasses four interdependent pillars.

1. Data Locality

This pillar covers not just where data is stored, but where it travels. Control-plane artifacts, metadata, and telemetry can cross geographic boundaries even when primary data stays in-region.

2. Technological Sovereignty

This pillar addresses whether the organization controls the mechanisms that protect data:

• How access is granted.
• How data is encrypted.
• Whether encryption key custody is retained under all conditions.

A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK), where an organization’s own encryption keys are managed within the provider’s platform, and Hold Your Own Key (HYOK), where the organization retains independent custody of keys entirely outside the provider’s environment.

For regulated organizations with strict sovereignty requirements, BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.

3. Operational Sovereignty

This covers who operates the environment and from where, including whether support personnel or third-party vendors are subject to foreign jurisdiction.

4. Jurisdictional Sovereignty

This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access, such as the cross-border situations discussed in the U.S. CLOUD Act.

Each of these pillars is essential to maintain compliance. A strong data locality posture with weak operational controls can allow unexamined risk.

Where Digital Sovereignty Programs Break Down

My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation, it gets too narrow, too quickly. Workshops zoom in on where data lives, teams get to work on that one question, and then they move on, leaving the other three pillars largely unexamined.

Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal, technical, and operational stakeholders, not as an IT project that gets checked off as complete.

Organizations can also be led astray by a few myths. One, as we’ve discussed, is the impression that sovereignty equals residency.

Then there’s the myth of absolute sovereignty, the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice, sovereignty always involves tradeoffs between control, cost, technological velocity, and the ability to innovate.

The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy, but a risk posture built from architecture, operations, contracts, certifications, and continuous auditability.

Resilience Belongs Inside the Sovereignty Boundary

Operational sovereignty is the hardest pillar to audit and the one most commonly underestimated. If your environment needed access for routine maintenance tonight, who would perform it, from which country, and under which legal jurisdiction?

Most organizations, when they work through that question for the first time, find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure, restoration sequencing, and recovery point management under a separate – and often weaker – set of controls. When an incident occurs, recovery personnel may not meet jurisdictional requirements, and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.

Commvault’s resilience operations model, ResOps™, addresses this need directly by framing recovery as an ongoing operational discipline that needs to be designed, tested, and validated inside the same sovereignty boundary as the data it protects.

Minimum Viable Sovereignty: The Right Level of Control, Not the Maximum

An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.

A payroll system, a customer transaction database, and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.

Minimum viable sovereignty sets a more practical target: the right controls, consistently enforced and continuously demonstrated, calibrated to what each workload actually requires across all four pillars.

Organizations have a broad range of options for how sovereign controls are delivered across their environment, each providing different controls.

How Commvault Is Addressing the Digital Sovereignty Issue

Commvault’s Geo Shield framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU, Geo Shield maps to the full spectrum of deployment models:

• Regional sovereign cloud services delivered as SaaS
• Hyperscaler sovereign-launch partnerships
• Partner-operated national sovereign offerings built with local service providers
• Fully customer-controlled private sovereign environments qualifying under frameworks like FedRAMP High.

In this way, organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.

Watch the Full Webinar and Get the Readiness Report

In the full webinar, available on demand, you’ll discover:

• Why digital sovereignty is more than a technology solution.
• The role of architecture and operations in sovereignty strategy.
• How governance, contracts, and auditability impact resilience.
• Why sovereignty must hold up during cyber incidents and outages.
• The importance of a holistic, risk-based approach to sovereignty.

Watch the webinar and get the full Digital Sovereignty Decoded readiness report and companion framework.

FAQs

Q: What is the difference between data residency and digital sovereignty?

A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data, under what legal authority, through which operational pathways, and whether it can be recovered cleanly under real conditions.

An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel, vendor access agreements, or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.

Q: What is the EU Cloud Sovereignty Framework, and why does it matter?

A: The EU Cloud Sovereignty Framework is a structured assessment tool developed by the European Commission to evaluate cloud and technology providers against sovereignty criteria during procurement processes.

It defines eight sovereignty objectives, with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls, key custody, jurisdictional exposure, and recovery.

The framework represents the most comprehensive public framework for evaluating sovereignty posture and is increasingly being used as a reference by other regions and procurement bodies beyond the EU.

Q: What is the difference between BYOK and HYOK, and why does it matter for sovereignty?

A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys, but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment, including under crisis conditions or legal compulsion.

For regulated organizations with strict sovereignty requirements, BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The U.S. CLOUD Act, for example, can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.

HYOK addresses that exposure directly, though it may require a higher platform tier in SaaS deployments.

Q: Why do most sovereignty strategies overlook operational sovereignty?

A: Operational sovereignty, covering who operates the environment and from where, is the hardest pillar to audit because it requires inventorying support contracts, vendor access agreements, and third-party dependencies across the full operational chain.

Most organizations start sovereignty programs focused on data location and encryption, which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.

As a first step to evaluate operational sovereignty, you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.

Q: How should organizations think about recovery in the context of sovereignty?

A: Recovery architecture needs to meet the same sovereignty requirements as primary data environments, but it often doesn’t. In most organizations, backup infrastructure, restoration sequencing, and recovery point management are frequently governed by a separate set of controls, or none at all.

During an incident, the personnel authorized to execute recovery may not meet jurisdictional requirements, recovery points may not have been validated as clean and uncompromised, and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.

Q: What does minimum viable sovereignty mean in practice?

A: Minimum viable sovereignty means identifying the right level of control for each workload, calibrated to actual regulatory obligations, risk tolerance, and operational constraints, rather than applying maximum controls uniformly.

Maximum sovereignty comes with real tradeoffs: technological complexity, operational burden, service limitations, and cost. Organizations that define requirements by workload across the four pillars, map those requirements to deployment models, and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.

Q: What role do certifications like C5, SecNumCloud, and ISO 27001 play in a sovereignty strategy?

A: Certifications help provide auditable evidence that controls have been independently verified, an important part of any defensible sovereignty posture. C5 in Germany, SecNumCloud in France, and ISO/IEC 27001 each establish baseline requirements that providers must demonstrate through independent audits.

The strongest sovereignty postures treat these certifications as a floor, providing necessary evidence that controls exist, but not a substitute for operational testing under realistic conditions.

Darren Thomson is Vice President and Chief Technology Officer, EMEA, at Commvault. Be sure to catch him in the podcast series, STRIVE.

Key Takeaways

• Multiple backup tools often create operational dependencies on a small number of specialists, increasing organizational risk.
• Managing protection across separate consoles, policies, and reporting systems makes it harder to maintain visibility and respond quickly to issues.
• Consolidation does not have to mean a disruptive rip-and-replace project; many organizations can modernize gradually while retaining existing infrastructure investments.
• A unified control plane can help simplify policy management, monitoring, auditing, and recovery operations across hybrid environments.
• Organizations that simplify backup often realize significant cost savings while helping improve operational efficiency and resilience.

You didn’t build a messy environment. You built a functional one.

Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.

The stack isn’t the problem. It’s the operational model that comes with it.

Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.

And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.

That’s not resilience. That’s dependency masquerading as expertise.

The Dashboard Wall

Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”

If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.

Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.

The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.

And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.

What Consolidation Really Means for Infrastructure Teams

The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.

But that’s not what consolidation has to look like.

The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.

What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.

The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.

The Proof Is in the Number

Fortune Brands consolidated its backup environment with Commvault® Cloud and saved $22.7M – a 73% reduction in total cost. NTT-Netmagic reduced costs by $300K annually and cut storage overhead by 35%.

Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.

Real Resilience Doesn’t Need a War Room

If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.

Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.

Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.

That’s the case for consolidation. Not a better product. A better way to run what you’ve built.

Want the full picture? Download The Hidden Cost of Seven Tools – a field guide for data center teams who built something worth protecting.

FAQs

Q: Why is managing multiple backup platforms a problem if they’re all working?

A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.

Q: What is one of the biggest risks created by a fragmented backup environment?

A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.

Q: Does consolidation mean replacing all existing infrastructure?

A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.

Q: How can consolidation improve resilience?

A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.

Q: What about vendor lock-in when consolidating to a single platform?

A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.

Q: How do organizations measure the value of consolidation?

A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.

Michael Thelander is Senior Director, Product Marketing, at Commvault.

Key Takeaways

• Regulatory pressure, board expectations, and real-world conflict are accelerating the shift from prevention-focused spending to resilience outcomes.
• The architecture of resilience has grown significantly more complex, especially as AI systems introduce new data lineage and recovery challenges.
• Cyber resilience must eclipse traditional disaster recovery and treat disruption as a continuous operating condition rather than an exceptional event.
• Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
• The hardest part of the transition to ResOps is organizational. Fragmented ownership and misaligned priorities remain the most common failure modes.

Disruptions have become business as usual. Over the past year alone, we’ve seen:

• Drone strikes on data centers in the UAE and Bahrain caused cascading problems across the organizations storing data and workloads there.
• A DNS misconfiguration by a hyperscaler knocked out internet access for millions of US users.
• A fire at a data center caused intermittent failures for tens of thousands of a top social media platform’s users for an entire day.

When the operating environment is inherently uncertain, CISOs and CIOs need to rethink their approach to business continuity.

In a recent webinar, David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the META region, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.

Sneak Peek: It’s No Longer a Matter of If, but When

In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.

Why Disaster Recovery Isn’t Enough

Per NIST’s definition, cyber resilience goes beyond traditional security by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?

Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?

We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.

• In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
• The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection regulations are undergoing a resilience lens as well.
• Securities and Exchange Commission (SEC) breach reporting requirements have put a spotlight not just on disclosure but on what organizations are doing to recover.

Boards now treat any outage as a business harm event, and the expectation has shifted to demonstrating not just that recovery is possible, but that it can happen quickly, with high confidence.

IDC research by Handa illustrates the way traditional recovery operations can fall short. Following the outbreak of war in the Middle East, she found CIOs and CISOs struggling with the continuity not only of technology, but also of people and processes as staff relocate overnight and offices become inaccessible, leaving no one to run manual failover.

And this is just one of the countless unpredictable scenarios organizations need to account for.

Building the Architecture of Resilience

A resilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.

The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.

AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.

Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.

That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.

ResOps: The Operating Model for Sustainable Resilience

ResOps treats resilience as a continuous function, not just something that happens in response to an incident.

In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.

Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.

The Human Side of ResOps

Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.

ResOps forces organizations to answer questions many haven’t yet worked through, such as:

• Who has the authority to restore services if the primary team is unavailable?
• How should remote execution playbooks be structured?
• How will cross-regional failover work when it can’t depend on a single location?

In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.

To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.

The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.

Putting It All Into Practice

Commvault helps organizations put ResOps into practice, from discovering and protecting data across on-premises and cloud environments, to detecting anomalies, recovering to a clean state, and restoring validated workloads. For organizations working to move from tabletop exercises to demonstrable restores, these are the capabilities that help make resilience operational in uncertain times.

Resources from the session, including IDC research on CIO readiness and Deloitte materials on evidence-based recovery, are available through the on-demand page.

FAQs

Q: What is cyber resilience and how is it different from disaster recovery?

A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.

Q: What’s driving organizations to prioritize resilience over prevention?

A: Regulatory frameworks like DORA and evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.

Q: What makes AI systems harder to back up and recover than traditional data?

A: Backing up an AI model means capturing more than the model file itself. A model is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.

Q: What is ResOps, and how does it differ from a traditional resilience program?

A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.

Q: What are the biggest obstacles to adopting ResOps at scale?

A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.

Michael Thelander is Senior Director, Product Marketing at Commvault.

Key Takeaways

• Commvault AirGap is immutable by design, and WORM lock capabilities are available for organizations with additional compliance and regulatory requirements.
• Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
• WORM-enabled storage introduces overhead across the industry, but Commvault helps minimize that impact through efficient data management and cloud-native architecture.
• The cost of backup storage extends beyond capacity consumption and should include infrastructure, compute, and operational expenses.
• Organizations should help validate backup resilience through real-world testing rather than relying on vendor marketing claims.

You may have recently encountered claims from a competitor suggesting that Commvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.

Let us address this directly: These claims are inaccurate.

Immutable and WORM Lock Support in AirGap

AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.

For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across  supported cloud storage targets, including:

• Amazon S3 Object Lock
• Microsoft Azure Blob immutability policies

These features are documented, rigorously tested, and actively used by customers in production environments today.

In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.

Storage Efficiency: Understanding the Full Picture

Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.

What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.

However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.

By contrast, modern, cloud-native approaches prioritize:

• Efficient data management.
• Flexible deployment models.
• Elimination of persistent infrastructure dependencies.

These design principles can result in more predictable, scalable, and sustainable long-term costs.

Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.

A Growing Trend Among Customers

We are seeing a clear pattern: Organizations are increasingly transitioning to Commvault after choosing not to renew with their previous providers. Common reasons may include:

• Unexpected limitations as environments scale.
• Performance constraints tied to appliance-based architectures.
• Rising infrastructure and operational costs.
• Renewal pricing significantly higher than initial purchase terms.

These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.

Cutting Through the Noise

In a market often shaped by aggressive claims and unclear comparisons, objective validation can be  critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.

Through this program, you can:

• Simulate real-world cyberattack scenarios.
• Test recovery capabilities using your own data and environment.
• Evaluate performance without vendor bias or staged demonstrations.

The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.

FAQs

Q: Is Commvault AirGap truly immutable?

A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.

Q: Does AirGap support WORM lock protection?

A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.

Q: Does enabling WORM lock significantly increase storage costs?

A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.

Q: Why is total cost of ownership more important than storage overhead alone?

A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.

Q: Why are some organizations moving away from appliance-based backup architectures?

A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.

Q: How can organizations validate their cyber resilience strategy?

A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.

Kash Ansari is Chief Customer Officer Americas at Commvault.

Key Takeaways

• Cyber resilience depends on both technology and the expertise of the professionals responsible for protecting and recovering critical systems.
• Continuous learning helps partner teams stay current with evolving threats, hybrid environments, and resilience best practices.
• Commvault Readiverse Academy provides role-based training, hands-on labs, and certifications designed to build real-world cyber resilience skills.
• Customers increasingly value partners who can help deliver trusted guidance, accelerate recovery readiness, and maximize resilience outcomes.
• Investing in ongoing education helps strengthen partner capabilities, builds customer trust, and supports long-term business growth.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Strengthen cyber resilience expertise.
• Build confidence in customer conversations.
• Stay aligned with evolving technologies and best practices.
• Prepare for new roles and opportunities.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault Readiverse Academy delivers:

• Role-based learning journeys.
• Self-paced, flexible learning.
• Hands-on, scenario-based labs.
• Certifications that validate real-world readiness.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Accelerate deployments.
• Align solutions to evolving needs.
• Improve operational readiness.
• Strengthen recovery preparedness.
• Navigate complex resilience challenges.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

FAQs

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault Readiverse Academy?
A: Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.

There are a lot of conversations happening right now about cyber resilience. Most focus on technology: Detection speed. Recovery architecture. AI-enabled security operations.

All of those things matter. But after sitting down with Dr. Erika Voss, SVP, Global Chief Security & Data Officer at Blue Yonder, and Sam Archey, VP of Trust at Blue Yonder, I kept coming back to something much more fundamental: Trust.

Not trust as a slogan or marketing message, but trust as something operational. Something built deliberately over time and tested in the moments when organizations are under the most pressure.

That distinction can matter because resilience today isn’t just about recovering systems. It’s also about how organizations communicate, how they lead, and how they maintain confidence while uncertainty is still unfolding.

And for a company like Blue Yonder – operating at the center of global supply chains – that challenge becomes even more visible.

Watch the full episode.

Key Takeaways: What Modern Cyber Trust Actually Requires

• Trust is built through consistency, not perfection. Customers don’t typically expect immediate answers, but they do expect transparency and follow-through.
• Resilience is operational, not theoretical. Communication, coordination, and decision-making processes can matter as much as technical controls.
• Strong relationships built before an incident can determine how effectively teams respond during one.
• Supply chain resilience can raise the stakes because disruptions ripple across interconnected ecosystems.
• Organizations are increasingly judged not on whether incidents happen – but on how they respond when they do.

Resilience and Trust

One thing became clear very early in this discussion: Erika and Sam don’t think about resilience as a standalone security function. They think about it as a trust function.

Most organizations still separate these ideas:

• Security handles the technical response.
• Communications manages messaging.
• Leadership steps in when escalation is required.

But what Blue Yonder has built is much more integrated than that. Their approach recognizes that customer trust is shaped in real time by operational behavior – not just technical outcomes.

And in a supply chain environment, where countless organizations are interconnected, that operational behavior can become incredibly visible. When something breaks inside that ecosystem, the impact rarely stays isolated. 

The Moment Trust Is Actually Tested

One of the strongest themes throughout the conversation was how quickly trust can be lost – and how intentional organizations must be to preserve it.

Erika put it bluntly: Customers are no longer evaluating whether companies experience incidents. That’s become table stakes in the modern threat landscape. What they are evaluating is something much more specific: Did they hear it from you first?

That distinction changes how organizations should think about incident response.

For years, the instinct during cyber events was often to hold communication until every detail was verified. But the reality today is that silence can create uncertainty faster than almost anything else.

Customers don’t typically expect complete answers in the first hour. They want acknowledgment. They want presence. They want to know that someone is actively working on the problem and willing to communicate transparently while things are still unfolding.

That’s where operational trust is built. And according to Erika and Sam, those first 60 minutes can matter more than most organizations realize.

Sneak Peek: Trust Is Critical in a Crisis

In this moment from the STRIVE conversation, we discuss how the first 60 minutes of response can determine customer confidence, reduce propagation delays, and shape long-term business relationships.

Building Trust Before You Need It

The trust Blue Yonder has built with customers wasn’t created during a single crisis. It was built through repeated interactions over time – through transparency, responsiveness, and operational discipline long before pressure entered the equation.

The same applies internally.

One thing both Erika and Sam emphasize is the importance of relationships between teams before incidents occur. Security, communications, engineering, operations, and leadership need to know how to work together ahead of time. Otherwise, the first real test of collaboration happens during a crisis, which can be the worst possible moment to establish operational alignment.

That’s why they spend so much time focusing on process maturity, stakeholder engagement, and tabletop exercises.

Not because those activities are theoretical. Because they create familiarity.

And familiarity helps reduce friction when pressure rises. 

Why Tabletop Exercises Matter More Than Most Organizations Think

There was a particularly practical section of the conversation around tabletop exercises that I think a lot of organizations need to hear.

Too often, tabletops become compliance activities. Something organizations run once or twice a year to satisfy requirements and move on from. But the way Blue Yonder approaches them is much more operational.

For them, tabletops are rehearsals for coordination.

• Who makes decisions?
• How does escalation happen?
• Which external partners need to be involved?
• How do legal, communications, and engineering interact?

Those questions become incredibly important during live incidents. And if teams haven’t worked through them ahead of time, response can slow down immediately.

Sam described how teams begin to understand what it may actually feel like to be pulled into an incident under pressure. That experience matters because it helps build muscle memory – not just for technical teams, but for leadership and operational stakeholders as well.

The organizations that recover most effectively are rarely improvising everything in real time. They’ve practiced.

The Human Side of Resilience

What I appreciated most about this conversation was how grounded it was in the human reality of resilience work.

Cyber resilience often gets framed entirely through technology. But people often still determine outcomes.

• How leaders communicate.
• How teams collaborate.
• How organizations behave when information is incomplete.

Those factors help shape customer trust just as much as recovery timelines or technical controls do.

And perhaps the most important lesson from Erika and Sam is that trust isn’t earned during easy moments. It’s earned during uncertainty. During ambiguity. During the moments when organizations have to choose transparency over silence and consistency over perfection.

Watch the Full Episode

In this discussion, you’ll discover:

• How Blue Yonder operationalizes customer trust.
• Why consistency can matter more than immediate perfection.
• The role of communication during cyber incidents.
• How tabletop exercises strengthen resilience.
• Why supply chain environments can change the stakes for cyber recovery.

Watch now.

FAQs

Q: Why is trust so important in cyber resilience?

A: Because customers increasingly evaluate organizations based on how they respond during incidents, not simply whether incidents occur.

Q: What does “trust as an operating model” mean?

A: It means trust is continuously reinforced through operational behavior, communication consistency, and transparency – not just during crises.

Q: Why do the first 60 minutes of response matter so much?

A: Early communication can shape customer perception, help reduce uncertainty, and help establish credibility during rapidly evolving situations.

Q: How do tabletop exercises improve resilience?

A: They help teams rehearse coordination, escalation, and communication processes before real incidents occur.

Q: What is the biggest lesson from this discussion?

A: That resilience is typically deeply tied to operational trust, and organizations should build that trust before they need it most.

Q: How can organizations help improve customer trust during incidents?

A: By communicating consistently, prioritizing transparency, and building strong internal coordination long before a crisis begins.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Key Takeaways

• Cyber resilience in MEDITECH environments goes beyond backup and recovery; it focuses on maintaining care delivery and operational continuity during disruptions.
• Healthcare organizations face significant ransomware risk, making rapid, reliable recovery essential for clinical operations.
• Traditional data protection approaches often fail to address the complex dependencies between clinical systems, applications, and workflows.
• Effective recovery strategies must coordinate the restoration of interconnected systems to minimize downtime and operational impact.
• Commvault’s MEDITECH-focused approach helps combine snapshot-based protection, automated recovery workflows, and recovery visibility to strengthen resilience and preparedness.

When ransomware or operational disruption impacts clinical systems, the effects can ripple quickly across the organization, disrupting workflows, slowing staff productivity, and putting timely care delivery at risk. In these moments, the ability to recover quickly and confidently becomes just as important as preventing the disruption in the first place.

That is why Commvault’s approach to protecting MEDITECH environments is centered on recoverability, resilience, and operational readiness, not just data preservation.

Healthcare remains one of the sectors most heavily targeted by ransomware. In a MEDITECH environment, downtime can interrupt medication workflows, delay access to diagnostic information, and force staff into manual workarounds that increase both risk and complexity. In this context, a strategy that looks good on paper is not enough. Health systems need confidence that recovery will perform under real-world pressure.

That is where Commvault can make a meaningful difference.

Why Traditional Data Protection Is Not Enough for MEDITECH

Many organizations still rely on data protection approaches built for general IT environments rather than the operational realities of healthcare. MEDITECH recovery requires an understanding of application interdependencies, restoration order, validation checkpoints, and the need to bring clinical systems back online with minimal disruption.

A successful recovery strategy must account for more than simply restoring data. It must support the coordinated recovery of critical systems, applications, and workflows that clinicians depend on every day. Commvault helps organizations navigate that complexity with resilient architecture, streamlined recovery workflows, and greater visibility into recovery readiness.

How Commvault Helps Protect MEDITECH in Practice

Commvault’s approach to MEDITECH protection is designed to align with the operational realities of these environments. Rather than relying on a one-size-fits-all backup model, the solution helps organizations capture application-consistent protection points for critical MEDITECH workloads while helping minimize disruption to production operations.

This architecture provides healthcare organizations with a practical path to faster, more confident recovery. Snapshot-based protection can support rapid restoration for operational resilience, while longer-term backup retention strengthens options for audit, compliance, and broader cyber preparedness. The result is a model that supports both day-to-day recoverability and resilience planning for more severe disruption.

What Cyber Resilience Can Look Like in Practice

When Ransomware Strikes Overnight

Consider a regional hospital facing encryption activity overnight. In that scenario, the ability to recover from immutable backup copies and execute a structured restoration plan can be the difference between prolonged downtime and a controlled recovery. Commvault helps organizations reduce that risk with secure recovery options designed to restore critical systems quickly and cleanly.

When Backup Infrastructure Is Targeted

Attackers increasingly attempt to compromise backup infrastructure before launching ransomware. That makes architectural resilience essential. With immutable protection and isolated recovery options, Commvault helps enable clean recovery points to remain available even when adversaries gain access to production systems.

When Proof of Recovery Is Required

Cyber insurers, auditors, and compliance stakeholders increasingly want proof that recovery capabilities are tested, documented, and operationally sound. Commvault supports that readiness with validation workflows, reporting, and evidence that can help healthcare organizations demonstrate resilience before an incident occurs.

How Commvault Supports MEDITECH Resilience

Commvault helps organizations protect MEDITECH database volumes with application-consistent recovery points, providing a stronger foundation for restoration when clinical systems are impacted.

Recovery Designed Around MEDITECH Dependencies

MEDITECH recovery often involves complex relationships between systems and databases. Commvault’s approach helps support coordinated protection of critical workloads and a recovery model designed to help bring systems back online in the appropriate sequence.

Validated Recovery with Flexible Retention

By combining rapid recovery options with longer-term backup retention, Commvault helps healthcare teams strengthen resilience beyond the initial snapshot window and build a more complete strategy for recovery testing, validation, and preparedness.

Greater Visibility into Recovery Readiness

A strong MEDITECH resilience strategy depends on operational clarity. Commvault helps teams centralize protection workflows, improve visibility into recovery readiness, and simplify the management of critical data protection tasks.

Regulatory and Insurance Readiness

From documented recovery workflows to retention strategies that support audit and compliance discussions, Commvault helps healthcare organizations strengthen compliance documentation and demonstrate a more mature resilience posture.

Why Implementation Matters

Successful resilience in a MEDITECH environment depends on more than selecting the right platform. It also requires alignment with validated deployment requirements, infrastructure compatibility, and a protection design that reflects how MEDITECH systems operate in the real world.

For healthcare organizations, that implementation discipline can be just as important as the recovery technology itself. A well-designed resilience strategy helps enable teams to execute recovery processes as expected when they are needed most.

Why Now

Ransomware threats continue to evolve, and attackers increasingly target backup infrastructure before deploying encryption. At the same time, cyber insurers and compliance stakeholders are asking for evidence of tested recovery capabilities, not just installed tools.

For healthcare organizations running MEDITECH, the need to build resilience before an incident occurs has never been more urgent. Investing in recovery readiness today can help organizations better protect operations, accelerate recovery, and reduce the impact of disruption when it matters most.

In healthcare, recovery readiness ultimately comes down to trust: trust that critical data is protected, trust that systems can be restored in the right order, and trust that resilience has been tested before a crisis occurs.

That is the standard Commvault helps organizations pursue in MEDITECH environments, and the foundation for a stronger, more confident approach to cyber resilience.

Organizations can further strengthen that foundation by working with a Commvault Managed Service Provider that specializes in healthcare. In addition to the technology itself, healthcare teams gain access to expertise that can help align protection strategies to MEDITECH requirements, support implementation with greater confidence, and improve ongoing operational readiness.

For healthcare organizations navigating the complexity of MEDITECH, that combination of resilient technology and healthcare-focused expertise can help accelerate preparedness and improve recovery outcomes when they matter most.

Final Thoughts

Recovery in a MEDITECH environment is about more than restoring systems. It is about restoring the clinical workflows that caregivers rely on to deliver patient care.

As ransomware threats continue to evolve and healthcare organizations face increasing pressure to demonstrate operational resilience, recovery readiness can no longer be treated as a compliance exercise or a backup strategy alone. Organizations that prioritize recoverability, validation, and cyber resilience before an incident occurs are better positioned to reduce disruption, protect patient care, and recover with confidence when it matters most.

Learn how Commvault helps healthcare organizations strengthen MEDITECH resilience, accelerate recovery, and build greater confidence in their ability to withstand cyber disruption. Visit our MEDITECH documentation site for more information.

FAQs

Q: Why is cyber resilience especially important for MEDITECH environments?

A: MEDITECH environments support critical clinical and operational workflows that directly impact patient care. Cyber resilience helps healthcare organizations recover quickly from disruptions while maintaining essential services and minimizing care delivery interruptions.

Q: How does cyber resilience differ from traditional backup and recovery?

A: Traditional backup and recovery focus primarily on restoring data after an incident. Cyber resilience expands that focus to include operational continuity, rapid recovery, and proactive measures that help reduce the impact of disruptions.

Q: Why are traditional data protection solutions often insufficient for healthcare organizations?

A: Many traditional solutions are designed for general IT environments and may not account for the complex interdependencies between healthcare applications, systems, and workflows. As a result, recovery can be slower and more disruptive.

Q: What challenges do ransomware attacks create for healthcare providers?

A: Ransomware can disrupt access to clinical information, delay care delivery, and increase operational complexity. Healthcare organizations need recovery solutions that enable fast restoration and confidence in recovery outcomes.

Q: How does Commvault support MEDITECH protection and recovery?

A: Commvault’s approach is designed around healthcare operational requirements, providing application-consistent protection, automated recovery processes, and visibility into recovery readiness to help reduce downtime.

Q: What benefits do snapshot-based protection and automated recovery provide?

A: Snapshot-based protection can support faster restoration of critical systems, while automated recovery workflows help streamline recovery efforts. Together, they improve operational resilience and strengthen preparedness for future disruptions.

Chris DiRado is Principal, Product Experience, at Commvault.

When we talk about cyber resilience, the conversation usually centers on technology: tools, platforms, automation. All of that matters. But when something goes wrong, those aren’t the things that determine how well an organization responds.

People are.

In this episode of STRIVE, I sat down with Dr. Jessica Barker, co-CEO of Cygenta and a leading expert on the human and psychological aspects of cybersecurity. I asked her to discuss a part of resilience that doesn’t always get enough attention – the human side.

What happens when pressure rises, when decisions have to be made quickly, and when teams are forced to work together in ways they may not be used to?

Watch the full episode to find out what she had to say.

Key Takeaways: What the Human Side Reveals

• Technology doesn’t fail alone – people and processes are always part of the outcome.
• Confidence under pressure comes from preparation, not instinct.
• Clear decision ownership helps reduce hesitation during incidents.
• Trust between teams helps accelerate response and recovery.
• Culture plays a measurable role in resilience – it’s not just tools or architecture.

When the Plan Meets Reality

Every organization has a plan. It’s documented, reviewed, and often approved at the highest levels. But the real test isn’t how that plan reads – it’s how it holds up when people are under pressure.

Because that’s when things change. Decisions don’t always follow the script. Communication isn’t always clean. Priorities shift in real time. And in those moments, resilience becomes less about process and more about behavior.

Sneak Peek: Cyber Resilience as a Cultural Norm

In this moment from the episode, Dr. Barker highlights the importance of aligning cybersecurity with organizational values. Rather than positioning security as a blocker, resilient organizations embed it into culture – as an enabler of productivity, positivity, and business growth.

The Role of Confidence

One of the most consistent themes in this conversation is confidence. Not confidence in the tools – confidence in the people using them.

Teams that perform well during incidents aren’t guessing. They’ve seen similar scenarios before. They’ve practiced. They understand how to respond, even when conditions aren’t ideal.

That confidence shows up in small ways with potentially faster decisions, clearer communication, and less second-guessing. And over time, those small differences can add up to a significantly stronger response. 

Decision-Making Under Pressure

When something goes wrong, speed matters – but clarity matters more.

• Who can make decisions?
• What authority do they have?
• When should they escalate?

If those answers aren’t clear, teams hesitate. And hesitation creates gaps. One of the most important parts of resilience isn’t just defining processes – it’s defining decision ownership. When people know where they stand, they tend to act faster and with more confidence.

Trust Is the Multiplier

Technology can help enable better and faster responses, but trust can accelerate them. In most organizations, teams operate in their own lanes. Security focuses on threats, infrastructure focuses on systems, and operations focuses on recovery.

That separation works – until an incident forces everyone together. That’s where trust becomes critical. Teams that trust each other:

• Share information more freely.
• Collaborate more effectively.
• Focus on outcomes instead of ownership.

Without that trust, even well-designed processes can break down.

Why Preparation Still Matters

It’s easy to assume that strong individuals can carry a response. But even experienced teams rely on preparation, such as tabletop exercises, simulations, cross-team drills, and so on. They’re what build the muscle memory that teams rely on when real incidents occur. Without that preparation, even the most capable teams are forced to improvise.

Watch the Full Episode

In this episode of STRIVE, we explore:

• How human behavior impacts incident response.
• Why decision clarity matters under pressure.
• What separates confident teams from reactive ones.
• How culture influences recovery outcomes.
• Where organizations should focus to strengthen resilience.

Watch now.

If you’re thinking about resilience beyond technology, this is a conversation worth your time.

FAQs

Q: Why is the human side of resilience important?

A: Because technology alone doesn’t determine outcomes – people do. Their decisions, communications, and executions under pressure are the keys to success.

Q: What role does preparation play in resilience?

A: Preparation helps build confidence and muscle memory, allowing teams to respond more effectively in real scenarios.

Q: How does trust impact incident response?

A: Trust helps enable faster collaboration, clearer communication, and more efficient decision-making across teams.

Q: Why is decision ownership critical?

A: Without clear ownership, teams hesitate, which can slow response and increase risk.

Q: Can strong tools compensate for weak processes?

A: No. Tools support resilience, but without strong processes and alignment, they can’t deliver effective outcomes.

Q: Where should organizations start improving?

A: Focus on cross-team alignment, clear decision-making structures, and regular scenario-based testing.

Darren Thomson is Vice President and Chief Technology Officer, EMEA, at Commvault.

For years, recovery planning followed a familiar pattern. Build the plan, document the steps, and assume it will work when needed. For a long time, that approach held up. Hardware failures, isolated outages, even natural disasters – these were scenarios organizations could anticipate and plan for with some level of confidence.

But the equation has changed.

In this episode of STRIVE, I sat down with Commvault’s Jason Cray, Principal Product Experience, to explore a reality we continue to see across organizations of all sizes: Most don’t fail because they lack a recovery plan. They fail because they’ve never proven that plan will hold up under real pressure.

Watch the full episode.

Key Takeaways: Why Recovery Plans Break Down

• A documented plan isn’t the same as a proven one. If it hasn’t been tested in realistic conditions, it’s still an assumption.
• Recovery is a team sport. Security, infrastructure, and operations must align – or recovery slows down.
• Most investment still happens “left of boom.” Prevention matters, but recovery readiness often gets overlooked.
• Testing exposes gaps and builds confidence. Without it, organizations default to hope.
• Resilience is an operational discipline. It requires iteration, communication, and continuous improvement.

The Problem With ‘It Should Work’

On paper, recovery looks straightforward. You define when to recover to, what needs to come back, and where it should be restored. The process appears logical, structured, and manageable.

But as Jason points out, that simplicity rarely survives real-world conditions.

Plans are written in controlled environments, but they’re executed in chaos. When an incident hits, teams aren’t calmly stepping through documentation – they’re reacting, troubleshooting, and trying to align in real time. That’s where the gap emerges. Not between tools and technology, but between expectation and execution.

Sneak Peek: Why Plans Fail Under Pressure

In this moment from the conversation, Jason and I break down why having a plan isn’t enough – and what it actually takes to know a plan will work when it matters.

We’ve Seen This Before

What’s interesting is that this isn’t a new problem; it’s a familiar one, just in a different context.

If you go back to the early days of disaster recovery, organizations followed a similar pattern. Plans existed, but testing was inconsistent at best. Jason shared an example of spending an entire night helping a client pass a disaster recovery test they thought they were ready for. The plan looked solid. The execution told a different story.

Over time, organizations adapted. They tested more frequently, introduced failover exercises and, in some cases even ran production from secondary environments to prove readiness. That shift from assumption to validation is exactly what cyber resilience now requires.

The First Breakdown: Communication

If there’s one issue that consistently surfaces, it’s communication.

In many organizations, responsibilities are clearly defined – security handles prevention, infrastructure manages systems, and operations owns recovery. Individually, each team may be doing exactly what they’re supposed to do.

But recovery doesn’t happen in isolation. It depends on how well those teams work together when something goes wrong.

As Jason describes, too often it becomes a handoff model: “We’ve done our part, now it’s someone else’s turn.” That approach introduces delays, confusion, and ultimately risk. During a cyber event, coordination matters more than ownership.

The ‘Left of Boom’ Problem

Another pattern we continue to see is the imbalance in where organizations focus their efforts.

There’s significant investment in prevention – security tools, detection platforms, and defensive strategies designed to stop an attack before it happens. That investment is necessary, and it plays a critical role.

But far less attention is given to what happens after the event.

The assumption is that if enough effort is spent on prevention, recovery becomes a secondary concern. In reality, the opposite is true. At some point, something gets through. And when it does, recovery becomes the defining factor in how an organization responds.

From Hope to Evidence

This is where the mindset needs to shift.

It’s not about adding more tools or rewriting documentation. It’s about moving from a model based on hope to one grounded in evidence.

Jason highlights a key observation: The organizations that handle disruption well aren’t the ones that avoid incidents – they’re the ones that experience less impact when those incidents occur. They’ve tested their processes. They’ve validated their assumptions. They understand where their gaps are.

Most importantly, they’ve built confidence – not by believing the plan will work, but by proving it.

Start Small, Build Momentum

For many teams, the challenge isn’t understanding the problem – it’s knowing where to begin.

The answer isn’t to overhaul everything at once. It’s to start small and build from there.

Focus on one or two critical services. Understand what’s required to recover them. Bring together the teams responsible for those systems and test the process end-to-end. From there, expand the scope and continue refining.

This approach does more than improve recovery – it builds alignment, reinforces communication, and creates the foundation for broader resilience.

The Reality: No Plan Survives First Contact

One of the most honest moments in our discussion was this: Even the best plan won’t work exactly as written.

That’s not a failure – it’s expected.

Jason puts it simply: If you don’t have a plan, you will fail. But even if you do have one, it won’t unfold perfectly in the moment.

What matters is how prepared to adapt your teams are. Testing creates that adaptability. It builds the muscle memory needed to respond effectively when conditions don’t match expectations.

Watch the Full Episode

There’s much more we cover in this STRIVE conversation, including:

• Why recovery plans often fail despite being well-documented.
• What differentiates organizations that recover effectively.
• How communication gaps impact execution.
• Where to start when improving recovery readiness.
• Why testing is the foundation of resilience.

Watch now.

If you’ve ever questioned whether your recovery plan would actually work, this is a conversation worth your time.

FAQs

Q: Why isn’t having a recovery plan enough?

A: Because most plans are never validated under real-world conditions. Without testing, they remain assumptions rather than proven strategies.

Q: What causes recovery plans to fail?

A: The most common issues in recovery plans are lack of testing, poor cross-team communication, and gaps between documented processes and real execution.

Q: What does “left of boom” mean?

A: Left of boom refers to the focus on preventing incidents before they occur. Many organizations invest heavily here but underinvest in recovery capabilities.

Q: How often should recovery plans be tested?

A: Recovery plans should be tested regularly and under varied conditions. Testing should simulate realistic scenarios, not just controlled exercises.

Q: Where should organizations start?

A: Start with a small set of critical services, align the responsible teams, and test recovery end-to-end before expanding.

Q: What is the key mindset shift?

A: Moving from hope-based planning to evidence-based validation.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

We’ve spent years focusing on identity security in the context of people – who have access, what they can do, and how to control it. That model made sense when most activity in the environment was driven by human users.

But that’s no longer the case.

Machine identities – applications, services, APIs, and automated workloads – now play a central role in how modern systems operate. They authenticate, communicate, and execute tasks, often without direct oversight. And in many environments, they already outnumber human identities by a wide margin.

In this episode of STRIVE, I sit down with Dan Conrad, Principal Technologist and a fellow Field CTO at Commvault. We take a closer look at what that shift means – not just from a security perspective, but also from a governance standpoint. And we explore why so many organizations are still treating this as a secondary concern.

Watch the full episode.

Key Takeaways: Where the Risk Is Shifting

• Machine identities are growing faster than human identities, often by orders of magnitude.
• Governance models haven’t kept pace, creating blind spots in access and control.
• Visibility is the core challenge. Many teams don’t fully understand how machine identities behave.
• Privilege sprawl extends beyond users, with machine identities often holding persistent access.
• Resilience depends on understanding and managing the remit of these machine identities before they become a problem.

The Identity Model Has Changed

For a long time, identity management was relatively straightforward. You could map users to roles, define access policies, and build controls around predictable behavior. Even with complexity, the model was still anchored in human activity.

Machine identities have broken that model.

They’re created dynamically, often as part of development or deployment processes. They interact across systems in ways that aren’t always visible or well-documented or audited. And unlike human users, they don’t follow a clean lifecycle – they aren’t onboarded and offboarded in the same structured way.

That creates a different kind of challenge. It’s not just about controlling access anymore. It’s about understanding how that access is being used, how it evolves, and how it connects across the environment.

Sneak Peek: You Can’t Phish a Non-Human Identity

In this moment from the STRIVE discussion, Dan describes how attackers aren’t targeting non-human identities directly through phishing – they’re malicious actors using compromised human accounts through social engineering, as a steppingstone to escalate privileges and impersonate powerful machine identities. Once inside, techniques like pass-the-hash and overprivileged service accounts allow attackers to move laterally and vertically, even after passwords are reset.

The Governance Gap

The real issue isn’t that machine identities exist , it’s how they’re governed.

In most organizations, there’s a clear process for managing human access:

• Requests are approved.
• Permissions are reviewed.
• Changes are tracked.

There’s a level of discipline that comes from years of focus on user identity. However, machine identities often fall outside of that structure. They’re created quickly to support applications or automation. They’re granted the permissions needed to function, sometimes more than necessary. And over time, those permissions persist. These overprovisioned accesses are rarely audited, reviewed, and more importantly rarely reduced.

That’s where the gap forms.

It becomes difficult to answer basic questions about access. Not because the information doesn’t exist, but because it hasn’t been organized or managed in a way that makes it usable.

Visibility Before Control

When organizations start to address this problem, the instinct is often to tighten controls.

• Limit permissions
• Restrict access
• Apply new policies

But control without visibility doesn’t solve much.

If you don’t understand how identities are being used, the business context of it in terms of  where they connect, what they interact with, and how they move across systems, then any attempt to restrict them becomes reactive and could result in slowing down business operations.

That’s why visibility needs to come first.

Once you can see how machine identities behave, patterns start to emerge. You can begin to understand where access is excessive, where dependencies exist, and where risk is concentrated. From there, governance can become more precise and more effective.

A Different Kind of Privilege Problem

Privilege sprawl isn’t new. Most organizations have spent years trying to manage excessive access among human users.

Machine identities introduce a similar issue, but with a different dynamic. Their access is often embedded into systems. It’s persistent, automated, and rarely questioned once it’s in place. That makes it harder to detect and easier to overlook.

And when something goes wrong, those identities can become a pathway for malicious actors to exploit

Where to Begin

For most organizations, the challenge isn’t awareness, it’s knowing where to start.

The first step isn’t a major transformation. It’s building clarity. Understanding how many machine identities exist. Where they’re being created. What permissions they have. How they’re used. And most importantly, confirming that a human user is mapped to a collection of non-human identities for the purposes of auditability and accountability.

Those questions sound simple, but they’re often difficult to answer. And that’s exactly why they matter. Because once you can answer them, you’re no longer operating in the dark.

Watch the Full Episode

In this installment of STRIVE, we go deeper into how machine identities are changing the way organizations should think about access, governance, and resilience. It’s a practical conversation about what’s happening now – and what needs to change moving forward.

Watch now.

Resource

If you’re interested in learning more about this topic, check out this e-book on non-human identities.

FAQs

Q: What is a machine identity?

A: A machine identity is a non-human identity used by applications, services, or systems to authenticate and interact with other resources.

Q: Why are machine identities becoming a bigger risk?

A: Because they are increasing in number, often have persistent access, and are not always governed as strictly as human users.

Q: How are they different from user identities?

A: They operate continuously, are embedded in automated workflows, and often lack structured lifecycle management.

Q: What is the biggest challenge organizations face in governing non-human identities?

A: Visibility. Many teams don’t have a clear understanding of how many machine identities are created, used, or interconnected.

Q: How does this impact resilience?

A: If compromised, machine identities can enable a malicious actor’s rapid movement across systems, making incidents harder to contain and recover from.

Q: Where should organizations start?

A: By identifying machine identities, understanding their permissions, and building governance practices that match their scale and complexity. And most importantly, confirming that a human user is mapped to a collection of non-human identities for the purposes of auditability and accountability

Vidya Shankaran is Field CTO at Commvault.

For decades, IT operations focused on uptime:

• Keep the infrastructure running.
• Hit your recovery time objective (RTO).
• Meet your recovery point objective (RPO).

But modern cyber threats don’t respect infrastructure boundaries – and recovery isn’t just about restoring systems anymore. It’s about restoring clean, trusted data – across teams, under pressure.

In this episode of STRIVE, I sat down with Stephen Foskett, founder and president of the Futurum Group’s Tech Field Day, to discuss an emerging discipline: resilience operations – or ResOps.

And it’s more than a buzzword. It’s a shift in how organizations think about recovery intelligence.

Watch the full episode.

Key Takeaways: What ResOps Changes

• ResOps moves recovery from infrastructure-focused to business-focused. It’s not just about bringing systems back online – it’s about restoring trusted, usable data.
• Traditional RTO and RPO metrics aren’t enough anymore. Mean Time to Clean Recovery (MTCR) is emerging as a more meaningful way to measure resilience.
• Breaking down silos is foundational to cyber readiness. Security, infrastructure, and DevOps must operate in sync – not in parallel.
• Resilience is an operational discipline, not a tool. Culture, communication, and coordination matter as much as technology.
• Recovery intelligence is becoming a competitive differentiator. Organizations that recover cleanly and quickly protect revenue, reputation, and trust. 

From IT Ops to ResOps: What’s Changed?

Stephen reflects on an earlier era of IT where teams often supported systems without fully understanding the business applications they powered. Recovery meant restoring infrastructure. Today, that model falls short. Modern environments are:

• Distributed
• Cloud-based
• DevOps-driven
• Security-sensitive
• Deeply integrated with revenue streams

ResOps acknowledges that recovery is no longer an isolated IT function. It’s a cross-functional discipline that helps connect infrastructure, software development, and security with real business outcomes.

Why Traditional Metrics Don’t Tell the Whole Story

RTO. RPO. These metrics have guided disaster recovery planning for years. But as Stephen explains, restoring quickly isn’t enough if the data you restore isn’t clean.

Enter a more meaningful metric: MTCR. It’s not just how fast you recover; it’s how fast you can recover to a verified, trusted state.

In a ransomware event, that difference matters enormously. Restoring compromised data can restart an attack cycle. ResOps focuses on restoring operational integrity – not just functionality.

Sneak Peek: Why Clean Recovery Matters

In this moment from STRIVE, Stephen explains why traditional recovery metrics miss the mark – and why recovery is a cross-functional discipline.

The Real Barrier: Organizational Silos

Technology isn’t usually the biggest blocker to resilience. Structure is. Security teams often report to one executive. Infrastructure teams to another. Application teams to yet another. Each with different priorities, different incentives, and different definitions of success.

ResOps challenges that fragmentation.

Stephen discusses how collaborative workshops and cross-functional alignment are helping break down those silos. Because during a cyber event, organizational misalignment slows recovery more than tooling gaps ever will.

Why Commvault Is Leaning Into This Conversation

STRIVE isn’t about product features. It’s about how recovery thinking is evolving. ResOps aligns closely with what we see in the field:

• Customers struggling with coordination during incidents.
• Organizations restoring infrastructure but questioning data integrity.
• Leadership asking for metrics that reflect real business impact.

The concept of MTCR reframes recovery intelligence around business trust – and that’s where the industry is heading. Recovery is no longer a back-office process. It’s an executive concern.

The Future of Recovery Intelligence

Looking ahead, ResOps is likely to mature rapidly. Over the next 12–18 months, organizations are expected to:

• Integrate security and recovery workflows more tightly.
• Adopt new recovery-focused metrics.
• Operationalize resilience earlier in application lifecycles.
• Invest in intelligence that distinguishes clean data from compromised data.

Cyber threats are accelerating. Recovery strategies must evolve at the same pace. ResOps helps provide a framework for doing that.

Watch the Full Episode

In this episode, we discuss:

• How ResOps differs from traditional IT operations.
• Why MTCR is helping to reshape recovery metrics.
• What organizational alignment looks like in practice.
• How DevOps culture influences resilience.
• Where recovery intelligence is expected to head next.

Watch now.

If you’re responsible for cyber readiness, continuity, or recovery strategy, this is a must-watch discussion.

FAQs

Q: What is ResOps?

A: ResOps (Resilience Operations) is an emerging discipline that integrates IT operations, security, DevOps, and business stakeholders to help improve recovery intelligence and organizational resilience.

Q: How is ResOps different from traditional IT operations?

A: Traditional IT ops focuses primarily on infrastructure uptime. ResOps expands that focus to include clean data recovery, cross-functional coordination, and business alignment.

Q: What is Mean Time to Clean Recovery (MTCR)?

A: MTCR measures how quickly an organization can restore verified, clean data and resume safe operations after a cyber event – not just how quickly systems are brought back online.

Q: Why are metrics like RTO and RPO insufficient in modern environments?

A: They measure speed and data currency, but not data integrity. In ransomware scenarios, restoring compromised data can extend disruption.

Q: How can organizations start implementing ResOps?

A: Begin by:

• • Aligning security, infrastructure, and DevOps teams.
  • Evaluating recovery metrics beyond RTO/RPO.
  • Testing clean recovery processes.
  • Breaking down operational silos.
  • Incorporating resilience thinking earlier in system design.

Q: Why is recovery intelligence becoming more important?

A: As cyber threats grow more sophisticated, the ability to recover cleanly, quickly, and confidently directly impacts revenue, customer trust, and regulatory posture.

Darren Thomson is a Field CTO at Commvault.