Puntos Clave

• Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
• The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
• Una recuperación limpia requiere procesos de restauración validados y aislados que ayuden a reducir el riesgo de reinfección y a restablecer las operaciones con confianza.
• Activar las acciones de Backup and Recovery directamente desde las herramientas de seguridad ayuda a preservar los datos críticos de forma temprana y a acortar los plazos de Recovery.
• La resiliencia unificada aúna seguridad y Recovery, lo que ayuda a reducir las fricciones entre los entornos de Detección y Respuesta Extendidas (XDR) y de Orquestación, Automatización y Respuesta de Seguridad (SOAR), al tiempo que mejora la velocidad y la confianza en la respuesta.

If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.

That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR and Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.

Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.

And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to viabilidad mínima? That’s the gap we’re closing, bringing recovery actions into the de respuesta ante incidentes flow, where decisions are already being made.

This is where “clean recovery” stops being a talking point and becomes the new standard.

Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.

According to Sophos’ el Informe sobre adversarios activos de 2026, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”

That kind of speed forces de respuesta ante incidentes to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.

With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.

If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Cleanroom Recovery, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.

The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.

A Commitment to Unified Resilience

Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.

Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.

So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.

The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:

• Read the perspective behind clean recovery and why data integrity matters: Mantener la integridad de los datos para Recoverys proactivas y fiables
• See how Commvault integrates with Splunk SOAR for response automation: Resumen de la solución

Oponte en contacto conmigo en LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.

FAQs

Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.

Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.

Q: How does the Cisco XDR and Commvault integration improve de respuesta ante incidentes?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.

Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.

Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.

Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.

Michael Fasulois Senior Director, Portfolio Marketing, at Commvault.

Related BlogsLas innovaciones en materia de Cleanroom Recovery marcan el inicio de una nueva era en la ciberresiliencia

Commvault inaugura una nueva era de resiliencia empresarial unificada

La próxima evolución en la protección Cloud

Los 5 Pasos Críticos para una Recuperación Limpia

Tu libro de jugadas moderno para una respuesta rápida y una recuperación limpia

There’s a lot of talk about modernization – Cloud, AI, automation, security transformation. But what does modernization actually look like when you’re responsible for keeping systems running, data protected, and recovery viable under pressure?

In this episode of STRIVE, I had the pleasure of sitting down with Gilman Treantos – a 25-year IT veteran whose career spans everything from mainframes to modern cyber resilience architecture. This conversation provides a practitioner’s view of what modernization really means when outages, ransomware, and operational risk are part of the daily equation.

Watch the episodio completo.

Key Takeaways: What Modern Cyber Readiness Actually Requires

• Modernization isn’t about new tools – it’s about resilient architecture. Technology evolves, but recovery discipline, testing, and cross-team coordination are what separate reactive organizations from resilient ones.
• Cyber readiness demands collaboration between security and infrastructure. Silos create blind spots. Unified visibility and shared responsibility can create speed in recovery.
• Backup tools are more powerful than most teams realize. When used creatively, they can support large-scale migrations, isolated recovery, and transitions designed to minimize data loss.
• Testing is non-negotiable. A recovery plan that hasn’t been rehearsed is a liability, not a strategy.
• Career resilience mirrors technical resilience. Proactivity, curiosity, and willingness to solve hard problems are as critical as any platform.

From Blockbuster to Cyber Resilience

Gilman’s journey didn’t start in a war room or a security operations center. It started at Blockbuster.

Without formal IT training, he leaned into troubleshooting. That curiosity became mainframe work. That work became distributed systems. That evolved into data protection and cyber resilience leadership.

What stands out isn’t the career arc – it’s the mindset. He built a reputation by taking on the problems no one else wanted. Fixing fragile systems. Supporting overlooked initiatives. Solving issues that crossed organizational boundaries.

That mentality translates directly to modernization, because modern cyber readiness is built by people willing to dig into uncomfortable complexity.

Sneak Peek: The Modernization Playbook

In this segment, Gilman explains why modern cyber recovery requires more than traditional malware detection — and how anomaly detection, ThreatScan, and isolated recovery environments can help strengthen enterprise resilience.

Modernization Under Pressure

One of the most compelling parts of the episode is a real-world example: evacuating a remote data center in a single night. No data loss. No prolonged downtime. No operational chaos.

By leveraging Commvault LiveSync in a creative way, Gilman and his team were able to migrate infrastructure quickly and cost-effectively – using capabilities that weren’t originally designed for that exact scenario.

That’s modernization in practice.

The House of Cards Problem

As organizations scale, permissions sprawl. Backup systems grow complex. Security tools layer on top of infrastructure without full alignment. Over time, environments become fragile.

Gilman describes this dynamic as something many teams underestimate: a slow accumulation of technical and operational debt. Modernization, in his view, isn’t just upgrading platforms. It’s simplifying architecture, improving visibility, and breaking silos between cybersecurity and infrastructure teams.

Cyber readiness means:

• Que los equipos de seguridad y de copias de seguridad compartan datos de telemetría.
• Los entornos de Recovery están aislados y se someten a pruebas.
• La detección de malware se extiende más allá de los flujos de trabajo principales.
• Las decisiones sobre infraestructura tienen en cuenta la velocidad de Recovery.

This is where modernization and resilience intersect.

Threats Are Evolving. So Must Recovery.

Ransomware isn’t slowing down. Threat actors are more sophisticated. Malware hides inside legitimate workflows. Gilman’s perspective is blunt: Preparation must be proactive.

He advocates for:

• Pruebas periódicas de recuperación ante desastres
• Entornos de recuperación aislados y listos para activarse
• Herramientas de detección de anomalías integradas en los procesos de copia de seguridad
• Simulacros entre equipos que reproduzcan interrupciones reales

Watch the Full Episode

Check out our full STRIVE conversation to learn:

• Cómo ha evolucionado Gilman en su enfoque de la protección de datos a lo largo de 25 años.
• Los detalles que hay detrás de una migración diseñada para minimizar la pérdida de datos.
• Por qué es esencial la colaboración entre los equipos de seguridad y de infraestructura.
• Consejos prácticos para los profesionales de la resiliencia.
• What modernization really demands in today’s threat landscape.

Ver ahora.

If you care about resilience, recovery, or leading IT through uncertainty, this is 20 minutes well spent.

FAQs

Q: What does “modernization” mean in the context of cyber readiness?

A: It means building resilient, testable, and collaborative systems that can recover quickly under real-world pressure – not just upgrading to newer platforms.

Q: Why is collaboration between security and infrastructure teams so important?

A: Because recovery depends on shared visibility. Security detects threats, but infrastructure enables restoration. Without alignment, response slows and risk increases.

Q: How can backup tools support modernization beyond recovery?

A: When used creatively, they can enable data center migrations, isolated recovery environments, anomaly detection, and large-scale operational shifts.

Q: How often should disaster recovery environments be tested?

A: Regular testing – ideally quarterly or aligned with major infrastructure changes – builds confidence and reveals gaps before an actual incident.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Related BlogsCómo la SMMPA reforzó la resiliencia cibernética con Cleanroom Recovery

Readiness cibernética en medio de tensiones geopolíticas: orientación para nuestros clientes, socios y comunidad

Por qué la IA está echando por tierra tu estrategia de resiliencia (y qué hacer al respecto)

Física frente a marketing: acelerar la recuperación sin dejar de respetar las leyes de la física

Modernizar la ciberseguridad financiera: De reactiva a resistente

Puntos Clave

• Las estrategias tradicionales de resiliencia están fallando ante la escala,la velocidad y la autonomía de los sistemas basados en IA.
• El ransomware industrializado y los ataques impulsados por la IA ahora se dirigen a los sistemas de copia de seguridad,lo que socava los cimientos de la recuperación.
• Las organizaciones deben pasar de contar con equipos de seguridad y Recovery aislados entre sí a adoptar un modelo unificado y continuo denominado «operaciones de resiliencia».
• La resiliencia basada en la IA requiere visibilidad de los datos en tiempo real,detección continua de amenazas y una Recovery inteligente y limpia a gran escala.
• Las plataformas modernas permiten una Recovery rápida y verificada,lo que ayuda a las organizaciones a evitar el dilema entre restaurar rápidamente y restaurar de forma segura.

A medida que las organizaciones se apresuran a adoptar la IA,los CISO y los CIO se están dando cuenta de una cruda realidad: las estrategias de resiliencia que funcionaban para la infraestructura tradicional están fallando. Los sistemas que antes podían recuperarse de los ataques en cuestión de horas ahora pueden tardar días. Los enfoques de copia de seguridad diseñados para datos centralizados pueden tener dificultades con cargas de trabajo distribuidas entre nubes y plataformas de IA. Mientras tanto,las amenazas y las posibles vulnerabilidades aumentan día a día.En un seminario web reciente,Tim Zonca,vicepresidente de marketing de cartera de Commvault,abordó una cuestión urgente a la que se enfrentan los responsables de seguridad: ¿cómo se mantiene la resiliencia cuando la IA cambia radicalmente las reglas del juego?

What Industrialized Ransomware and AI Mean for Resilience

CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.

As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.

Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.

Making Resilience Operational

As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:

• Proteger continuamente los datos en su origen y supervisar la presencia de anomalías.
• Controlar las identidades de las personas,las identidades no humanas y los dispositivos que acceden a los datos y los utilizan de forma autónoma.
• Lograr una recuperación predecible de los datos a gran escala sin comprometer su integridad ni corromperlos.

Tradicionalmente,la seguridad de los datos,la resiliencia de las identidades y la recuperación cibernética han funcionado como disciplinas independientes,cada una con su propio equipo,herramientas,políticas y requisitos. Estos silos dejan vulnerabilidades que los atacantes pueden aprovechar y ralentizan la recuperación cuando fallan los sistemas de IA. Para cerrar esas brechas,las organizaciones deben unificar estas capacidades en un ciclo continuo y automatizado. A este enfoque lo denominamoslas operaciones de resiliencia (ResOps).

ResOps abarca tres requisitos esenciales para la resiliencia de la IA:

• Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
• Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
• Intelligent recovery: Automated,comprehensive restoration for entire cloud-native applications and their dependencies. To prevent re-infection,teams must validate data integrity and conduct forensic analysis in an isolated cleanroom before moving trusted data back to production.

Enabling ResOps in practice

To help companies make the move to ResOps,Commvault has introducedCommvault Cloud Unity,el lanzamiento de plataforma más importante de nuestra historia. Está diseñado para aunar las tres dimensiones de la resiliencia:

• Aunarla seguridad de los datos,la resiliencia de la identidad,and la Recovery cibernéticaen un único modelo operativo.
• Protecting all workloads,from both today’s production systems to tomorrow’s emerging AI stacks.
• Safeguarding data regardless of location,whether in clouds,regions,data centers,or edge locations.

A next-generation architecture brings AI automation to all facets of data protection,la seguridad de los datos,la resiliencia de la identidad,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.

As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.

With Commvault Cloud,la supervisión continua de amenazas and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.

See ResOps in action

Vea el seminario web completo bajo demanda to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.

FAQs

 Q: What is Resilience Operations (Res Ops)?

A: ResOps is an operating model that unifies la seguridad de los datos,la resiliencia de la identidad,and la Recovery cibernética into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.

Q: Why can’t traditional backup and recovery handle AI workloads?

A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.

When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.

Q: What does “unified resilience” mean in practice?

A: Unified resilience means bringing la seguridad de los datos,identity management,and la Recovery cibernética together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.

In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.

Q: What’s the difference between cyber resilience and AI resilience?

A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.

Q: How does ransomware target backup systems?

A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.

Q: What is the clean vs. complete recovery dilemma?

A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through la supervisión continua de amenazas and verified recovery points.

Q: What is a cleanroom in la Recovery cibernética?

A: A cleanroom in la Recovery cibernética is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.

Sam Curcuruto is Director of Product Marketing at Commvault.

Related BlogsReplanteamiento de la resiliencia para la era de la IA

A CIO’s Perspective: Strengthening Business Resilience in the AI Era

Resistente contra la máquina de IA

Las innovaciones en materia de Cleanroom Recovery marcan el inicio de una nueva era en la ciberresiliencia

Puntos Clave

• “Instant restore” claims often break down at scale due to real-world I/O operations per second (IOPS), rehydration, and infrastructure constraints.
• Mass live mounts on deduplicated backup storage can cause performance collapse, forcing slow rehydration back to primary storage.
• Cleanrooms help enables parallel forensic investigation and business recovery instead of serial, delay-driven downtime.
• Identity compromise expands the blast radius, making isolated recovery and Active Directory (AD) restoration critical to secure operations.
• Automated cleanroom runbooks and repeatable testing help organizations validate real recovery metrics before a crisis occurs.

Let’s start with a quick story about a “ransomware‑proof” environment that took 72 hours to recover, way beyond the organization’s expectations for recovery time objective. It is exactly the kind of situation where Commvault’s Cleanroom could have helped turn a painful, three‑day outage into a faster, more controlled recovery with less risk.

War Story: Physics vs. Marketing

On Reddit, a user shared how the financial services firm they work for was hit by a breach. They assumed they had a “dream stack” for quick recovery (but can you really have a “dream stack” without Cleanroom?): immutable backups, secure storage snapshots, and a modern hypervisor. The datasheets promised “instant mass restore,” yet the business sat offline for three days while everyone tried to drag their environment back to life.

The root cause was not that backups failed, but that the real‑world physics of rehydration, forensics, and identity were never tested at scale. The original poster mentioned that having access to a cleanroom environment would have sped up the process. Let’s dig into this further and address why.

Commvault’s Cleanroom is designed to address exactly these weak points: It helps automate clean, isolated recovery into the cloud, validates data, and orchestrates recovery in a way that aligns with how incidents actually unfold, not just how diagrams look on slides.

Problem 1: The Rehydration Trap

In the story, “live mounting” a handful of virtual machines (VMs) worked fine, but trying to live mount hundreds crushed the backup appliance. The random I/O running directly on deduplicated, compressed backup storage collapsed the IOPS, forcing the team to rehydrate everything back to primary Non-Volatile Memory Express at about 3 TB/hour for roughly 100 TB of data.

Commvault Cleanroom helps recover workloads into an isolated Azure‑based cleanroom built on scalable cloud compute and storage instead of trying to run production at scale off a backup appliance.

This allows you to restore critical VMs into a purpose‑built recovery environment, use cloud elasticity to absorb I/O, and automate the recovery sequence so the right systems (identity, core apps, critical data) come up first without bottlenecking on a single backup target.

Problem 2: The Forensic Drag

In the audit, the tech stack was ready in about four hours, but legal delayed touching anything for 72 hours because they had no pre‑provisioned cleanroom. Without an isolated environment with zero routes back to production, the forensics team could not safely investigate while the business recovered, so everyone waited for the all-clear before starting any real restore.

Cleanroom provides an on-demand, isolated recovery environment explicitly built for simultaneous recovery and forensic analysis. You can spin up a fenced cleanroom in Azure in hours, recover systems into it, and let security and legal teams perform read‑only forensics and threat scanning while operations validates applications and prepares for cutover – dramatically shrinking “forensic drag” as a contributor to downtime.

Problem 3: Identity Blast Radius

The environment in the story had a single admin account with access to both the hypervisor and backup console, which meant if attackers pivoted that far, immutability could become just another setting they flipped off. Identity, not just data, was the real blast radius problem.

Cleanroom is designed to help reduce dependency on the compromised production identity plane during recovery, allowing isolated access and planned support for AD restoration in the cleanroom.

By recovering identity services into an isolated cleanroom and using separate, least‑privilege access paths, you can help validate AD, help enforce proper authorizations, and help protect backup control planes from being trivially compromised by the same credentials that were used in production.

How Cleanroom Would Change This Story

If this customer had used Cleanroom, their recovery story could have been very different.

• Faster, physics‑aware recovery: They could have helped orchestrate recovery into a cloud cleanroom with scalable storage and compute, avoiding the IOPS collapse of mass live mounts and pushing toward the recovery velocity they actually needed.
• Parallel forensics and business recovery: A pre‑defined cleanroom RTO of under four hours would have helped them spin up a fenced environment for both forensic work and application validationinstead of waiting 72 hours in a holding pattern.
• Reduced reinfection and identity risk: Cleanroom isolation, threat scanning, and a separate control plane would have helped limit identity blast radius, helped confirm data was malware‑free before returning to production, and helped give auditors and insurers a clean, verifiable recovery trail.
• Automated, repeatable playbooks:Automated runbooks orchestrating clean point detection, workload sequencing, and test failovers could have helped them regularly rehearse this scenario and know their real‑world metrics before an attack – not learned them during a crisis.

For organizations that already invest in “ransomware‑proof” stacks, the missing piece is often not more features but a cleanroom strategy that respects physics, identity, and legal reality. Commvault Cleanroom is designed to close that gap and help turn recovery from a three‑day war story into a controlled, provable, and much faster operation.

Preguntas frecuentes

Q: Why did the “instant mass restore” approach fail in the ransomware scenario?
A: While live mounting a few VMs worked, scaling to hundreds overwhelmed the backup appliance due to I/O constraints. Deduplicated and compressed backup storage is not designed to handle full production workloads at scale, leading to performance collapse and delayed recovery.

Q: What is the “rehydration trap” in disaster recovery?
A: The rehydration trap occurs when organizations must restore large volumes of compressed backup data back to primary storage before systems can operate normally. This process is limited by throughput rates, which can dramatically extend recovery times when dealing with tens or hundreds of terabytes.

Q: How does a cleanroom help reduce forensic-related downtime?
A: A cleanroom provides an isolated environment where forensic teams can safely investigate while IT simultaneously restores systems. This parallel approach helps eliminate long waiting periods for legal or security approval before beginning recovery efforts.

Q: Why is identity such a critical factor in ransomware recovery?
A: If attackers compromise administrative credentials tied to both production and backup systems, immutability controls may no longer provide protection. Isolated identity recovery and least-privilege access can help limit blast radius and support a safer restoration process.

Q: How does Cleanroom help improve recovery orchestration?
A: Cleanroom helps automates workload sequencing, cleanpoint validation, and cloud-based recovery infrastructure provisioning. This structured approach aligns recovery with how incidents actually unfold, helping organizations regain control faster and with greater confidence.

Q: What is the strategic lesson for organizations with “ransomware-proof” stacks?
A: Advanced features alone do not guarantee fast recovery. A cleanroom strategy that accounts for infrastructure physics, identity isolation, and legal realities helps enable organizations to turn theoretical resilience into measurable, repeatable recovery performance.

Nico Guerrera is Senior Solutions Marketing Manager at Commvault.

Blogs relacionados

Recuperación de bosques de Active Directory: Por qué los métodos manuales ya no son viables

Pruebas de Recuperación: La pieza que falta en la mayoría de los programas de ciberresiliencia

Tu libro de jugadas moderno para una respuesta rápida y una recuperación limpia

Desbloquear la ciberresiliencia: El poder de las salas blancas

Why Cleanroom and Cyber Testing are Critical for Cyber Resilience

Key Takeaways

• Commvault Cloud Backup & Recovery for DevOps now includes support for Atlassian Jira,extending enterprise-grade data protection to mission-critical project workflows.
• Las copias de seguridad automatizadas y basadas en políticas,junto con las opciones de recuperación granular,ayudan a los equipos a restaurar rápidamente los espacios,las tareas y las configuraciones de Jira.
• Las características integradas de ciberresiliencia,como las copias de seguridad inmutables y el almacenamiento aislado en la nube,ayudan a proteger los datos de Jira frente al ransomware y a los cambios no autorizados.
• La protección unificada en Jira,Azure DevOps,GitHub y GitLab reduce la proliferación de herramientas y simplifica la resiliencia de los datos de DevOps.
• La protección de Jira está disponible a través del acceso para usuarios pioneros,y su disponibilidad general está prevista para marzo de 2026.

Nos complace anunciar la ampliación deCommvault® Cloud Backup & Recovery for DevOpspara incluir compatibilidad con Atlassian Jira. Esta actualización aporta a Jiraprotección,Recovery y ciberresiliencia de nivel empresarialto Jira,helping organizations safeguard mission-critical project data against data loss and cyber incidents.

With this release,teams now have a unified way to protect critical sprint plans,work items,and configurations alongside their code,pipelines,and repositories in Azure DevOps,GitHub,or GitLab,all with a single solution.

Why Protecting Jira Data Matters

Jira has become a cornerstone for many organizations,supporting everything from agile software development and product releases to IT service management. It houses the plans,workflows,and task data that teams depend on to help execute mission-critical work.

Despite its importance,Jira is not immune to data loss. Accidental deletions,misconfiguration,and malicious activity can quickly erase valuable project history and disrupt active work.

When Jira data is lost or becomes unavailable,teams lose visibility,sprints stall,releases are delayed,service commitments are missed,and productivity suffers as teams attempt to recreate lost information.

A reliable backup and recovery strategy for Jira is critical to help maintain continuous business and help minimize the risk of downtime,operational disruption,and potential failure to meet data retention or regulatory compliance requirements.

Enterprise-Grade Protection for Jira Commvault Clouddelivers enterprise-scale protection and recovery for Jira,helping organizations safeguard mission-critical Jira data against cyber incidents,disasters,and operational mistakes.

Key features:

• Automated,policy-based backups of Jira spaces,work items,and configurations,including attachments,custom fields,and board settings.
• Granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time.
• Simplified compliance through centralized control,audit logging,and extended retention to help support regulatory and internal requirements.
• Cyber resilience withcopias de seguridad inmutables,almacenamiento en la nube aislado,and diseño de confianza ceropara ayudar a proteger los datos frente al ransomware y los cambios no autorizados.
• Unified protection for Jira,Azure DevOps,GitHub,GitLab,and other enterprise workloads from a single platform.

Unifying DevOps Data Resilience with Commvault

By unifying Jira protection with other DevOps platforms in Commvault Cloud Backup & Recovery for DevOps,enterprises can gain a holistic approach to data resilience across the full DevOps lifecycle – from planning and issue tracking to code and delivery. The result is fewer tools,reduced complexity,and confidence that sprint plans and backlog items are rapidly recoverable when it matters most.

Early Availability

Atlassian Jira protection is now available through Early Adopter access with general availability planned for March 2026.

Learn more about Commvault’s support for Atlassian Jira,aquí.

To learn more about how to get access to getting access to Jira protection or schedule a demo,contact your Commvault account team.

FAQs

Q: Why is backing up Atlassian Jira important?
A: Jira houses critical sprint plans,workflows,and issue data that many teams rely on to deliver projects and services. Data loss from accidental deletion,misconfiguration,or malicious activity can disrupt releases and impact productivity,making a reliable backup and recovery strategy essential.

Q: What Jira data can Commvault Cloud protect?
A: Commvault Cloud helps protect Jira spaces,work items,configurations,attachments,custom fields,and board settings. This comprehensive coverage helps organizations maintain full visibility and recover both detailed items and entire sites when needed.

Q: How does recovery work with Commvault Cloud for Jira?
A: The solution helps support granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time. This flexibility enables teams to restore exactly what they need without unnecessary disruption.

Q: How does this solution support compliance and cyber resilience?
A: Centralized control,audit logging,and extended retention help organizations meet regulatory and internal requirements. Immutable backups,almacenamiento en la nube aislado,and a diseño de confianza cero help strengthen protection against ransomware and unauthorized changes.

Q: Can Jira protection be managed alongside other DevOps platforms?
A: Yes. Commvault Cloud unifies protection for Jira with Azure DevOps,GitHub,GitLab,and other enterprise workloads within a single platform,helping reduce complexity and enable a holistic approach to DevOps data resilience.

Q: When will Jira protection be generally available?
A: Atlassian Jira protection is currently available through Early Adopter access,with general availability planned for March 2026. Organizations can contact their Commvault account team to learn more or schedule a demo.

Katharine Colucci is a Product Marketing Manager at Commvault.