Skip to content

The second edition ofThe State of Data Readiness in Asiareport, a comprehensive report from Tech Research Asia commissioned by Commvault, offers a stark look into the challenges and realities faced by organisations across the continent.
Based on a survey of 1,218 companies across Indonesia, Hong Kong, Korea, Malaysia, Philippines, Singapore, Thailand, and Vietnam, the report uncovers critical trends in data growth, regulatory pressures, AI adoption, and cyber resilience.
Here are some of the key highlights that demand the attention of business and IT leaders:

Unprecedented Data Growth and Infrastructure Complexity

Data estates are expanding at an accelerated rate.

  • The average organisationin Asia saw its data grow by 40% in the last 12 months, a significant jump from the 31% reported the previous year.
  • This explosion of data, 66% of which is unstructured, resides in increasingly complex environments.
  • A majority of companies (63%) now operate in multi-cloud or hybrid cloud environments, creating a sprawling and interdependent ecosystem that is difficult to manage and secure.
  • This complexity is taking a toll, with 38% of organisations admitting they lack confidence in their ability to restore business oeprations after a breach.

 

The AI Paradox: High Adoption Despite High Risk

AI is being enthusiastically adopted, with 74% of Asian organizations currently using business-focused AI solutions. However,there is a clear-eyed view of the risks involved.

  • This complexity is taking a toll, with 38% of organisations admitting they lack confidence in their ability to restore business oeprations after a breach.
  • A staggering 73% of these organisations believe that deploying AI increases the likelihood of a cybersecurity breach.
  • Despite this awareness, due diligence is lagging. A concerning 58% of organisations have not performed thorough security audits on their AI tools before deployment, and less than half (46%) have comprehensive policies to protect AI-generated data.

The Tangled Web of Regulations

The regulatory landscape across Asia is becoming increasingly intricate and, at times, contradictory.

  • Conflicting demands: Fifty-three percent of organisations report facing conflicting regulatory requirements for their data across different geographies.
  • Regulatory burden: Fifty-two percent of companies must comply with at least four major regulatory acts.
  • AI compliance: The challenge is compounded by AI-specific regulations, with almost 60% of companies now subject to them and another 27% expecting to be within the next year.

The Sobering Reality of Cyberattacks and Recovery

There remains a significant disconnect between the expectations of business leaders and the reality of IT recovery after a cyber incident. While 72% of business leaders expect to be back in business within five days of an incident, the reality is that 70% of businesses take more than a week to recover.
The report also sheds light on the direct impacts of attacks:

  • Of the companies that were breached, 83% experienced data exfiltration.
  • Less than half (41%) managed to recover 100% of their data.
  • While 57% of companies have a policy against paying ransoms, 34% of those with such a policy paid the ransom when attacked.

Learning the Hard Way

Interestingly, organisations that have experienced a breach demonstrate a more mature and realistic understanding of their capabilities. They are more likely to have comprehensive incident response plans and a clearer grasp of the complexities involved in recovery. For instance, breached companies are almost twice as likely to view their internal AI tools as a high cybersecurity risk compared to those that have not been breached.
To gain a deeper understanding of these findings and benchmark your organisation against your peers, download the full State of Data Readiness in Asiareport. The complete report provides detailed analysis, country-specific data, and actionable insights to help you enhance your data management, recovery, and cyber resilience strategies for continuous business operations.

More related posts

Cyber Resilience

Read more

Cyber Security

Read more

In conversations with three Chief Medical Information Officers across different healthcare systems, each was asked about their most recent cybersecurity incident. The answer was unanimous and telling: None had experienced a direct attack on their own systems. Instead, all three were grappling with the aftermath of third-party vendor breaches that cascaded through their operations.

This isn’t coincidence – it’s the new reality of healthcare cybersecurity.

The Vendor’s Vendor Problem

“We are big enough to have these experts on staff that are our experts to protect us,” one CMIO explained. “Sometimes I feel that that can be a barrier to agility because of how strict we are and how thorough we are in those evaluations. But I think that we can’t ensure that our partners do the same.”

Here’s the challenge: Healthcare organizations have become incredibly sophisticated at vetting direct vendors. The contracting process is rigorous, security assessments are thorough, and compliance requirements are non-negotiable.

But what happens when your vendor makes a deal with another vendor? Suddenly, you’re exposed to risks you never evaluated, from companies you’ve never heard of, through relationships you don’t control.

One security leader illustrated this perfectly: “I’m going to make a deal to use Vendor X to do something for me here. But Vendor X may make a deal with Vendor Y that lets them do their job. So if there’s a problem with Vendor Y who I’m not technically contracted with, but my vendor needs them to function, I can’t control that.”

When the Ecosystem Fails

La fase deChange Healthcare incident provides a stark example. When its systems went down due to a cyberattack, it wasn’t just Change Healthcare that suffered – it was every healthcare organization that relied on its prescription processing services.

One CMIO described the impact: “We had a lot of issues sending prescriptions, receiving them, having issues being unclear of what went through, what didn’t go through, and who didn’t have their medications.”
La fase dedownstream clinical impact was immediate and severe. Patients couldn’t get medications, providers couldn’t verify prescription statuses, and healthcare teams scrambled to identify which patients might be affected. This was a direct patient safety issue caused by a vendor incident completely outside the control of healthcare providers.

But the clinical impact was just the beginning. The compliance implications were equally severe, highlighting a fundamental challenge in healthcare’s regulatory landscape.

The Compliance Trap: When Vendor Failures Become Your Regulatory Problem

Healthcare organizations face a harsh regulatory reality: Vendor incidents don’t absolve them of compliance responsibilities. In fact, they often amplify them.

HIPAA requires covered entities to establish Business Associate Agreements with vendors handling protected health information. While these agreements theoretically transfer some liability, the practical reality is different. When a vendor suffers a breach, the healthcare provider still faces potential penalties, regulatory scrutiny, and mandatory reporting requirements.
La fase dereporting burden alone creates significant operational strain. HIPAA’s proposed 72-hour reporting mandates, similar to regulations like EU NIS2 and DORA for cross-border institutions, require healthcare providers to disclose incidents quickly, regardless of whether the breach originated from their own systems or a vendor’s.

As one CMIO noted: “We actually have to communicate to the state, to the Centers for Medicaid and Medicare Services: ‘This is what’s going on. This is where we are with our recovery.’”

This means that during an active incident – when clinical teams are scrambling to maintain patient care and IT teams are coordinating recovery efforts – compliance teams must simultaneously investigate, document, and report on incidents they didn’t cause and may have limited visibility into.
La fase dedata sovereignty challenge adds complexity. Vendors storing healthcare data outside approved regions can trigger compliance violations that organizations may not even know exist until an incident forces a comprehensive audit of their vendor ecosystem.

“We require [vendors] to give us anything and everything we asked for to review,” explained one security leader who’s experienced a vendor ransomware attack. “So, there was actually no limitations on what we could ask.”

But this level of oversight is typically only possible with the largest vendor relationships, leaving many smaller but still critical vendor dependencies in compliance blind spots.

The CrowdStrike Wake-Up Call

La fase deCrowdStrike incident drove home another reality: When critical infrastructure providers fail, the entire healthcare ecosystem fails simultaneously.

“We did [tabletop exercises] with the assumption that it would be a ransomware attack… a very kind of localized event,” one leader reflected. “And this was affecting the entire ecosystem. And that’s where we [learned] that we needed to have more resiliency practices that would incorporate where the ecosystem itself would be widely affected.”
La fase dechallenge wasn’t just technical – it was operational and regulatory. When everyone is down at once, the usual backup plans (like calling vendors for support or switching to alternate providers) simply don’t work.

Healthcare organizations faced not only interrupted patient care and massive downtime costs but also complex compliance reporting requirements for an incident that originated entirely outside their control.

Beyond Traditional Risk Assessment

Healthcare organizations are discovering that their traditional approach to vendor risk management isn’t enough. The standard process – sending questionnaires, reviewing documentation, checking compliance certifications – only covers direct relationships.

But post-incident, the conversation is changing. Instead of just asking “Do you do this? Do you do that?” organizations are demanding to see exactly how vendors execute security and recovery plans. They’re asking for evidence of testing, requiring contractual rights to review sub-vendor relationships, and building in financial protections.

The New Vendor Relationship Model

Forward-thinking healthcare organizations are taking several concrete steps to address ecosystem risk:

  • Data sovereignty: “We want to start taking more ownership over the data… so that we have something we can rebuild or even switch over to another third party if possible,” one leader said.
    Rather than letting vendors hold all the data, organizations are requiring regular data exports and maintaining their own copies of critical information. This approach helps address data residency requirements and enables compliance continuity even when vendors fail.
  • Enhanced contractual evolution: Post-incident contract negotiations now address compliance obligations explicitly. Organizations are demanding notification timelines that meet regulatory requirements, recovery guarantees that minimize downtime costs, and financial compensation for both direct losses and compliance penalties resulting from vendor-caused outages.
  • Compliance-aware update management: The CrowdStrike incident highlighted how vendor updates can create both operational and compliance risks. Many organizations have implemented “two versions behind” policies for critical security updates, balancing the risk of delayed patches against the risk of compliance violations from untested updates that could cause widespread outages.
  • Regulatory integration in vendor management: Organizations are building compliance considerations directly into vendor evaluation and ongoing oversight. This includes knowing vendors can meet the same 72-hour reporting requirements, maintain appropriate data residency, and provide the documentation needed for regulatory reporting.

The Insurance Industry’s Perspective

Perhaps most telling is how the insurance industry views these risks. As one security leader shared from a colleague in insurance risk modeling: “The number one risk that we have is the kind of outage like CrowdStrike, where we’re so dependent upon these technology platforms that when we’re out, there’s massive disruptions in services and in operations. She says that’s the number one risk in our risk model. It’s not ransomware attacks.”

This shift in risk assessment reflects a fundamental change. Traditional cybersecurity focused on preventing bad actors from getting in. Modern cybersecurity also must address the reality that critical vendors – with the best of intentions and strong security practices – still can bring down entire ecosystems through operational failures.

The Minimum Viability Challenge in an Ecosystem World

Traditional recovery planning often assumes you can restore everything systematically, but when entire ecosystems fail simultaneously, organizations must focus on minimum viable recovery (MVR).
La fase deconcept of minimum viability becomes critical when your vendors, their vendors, and potentially your backup vendors are all affected. As we’ve explored in our analysis of healthcare cyber threats and MVR, the question isn’t just “How do we recover everything?” but “What are the bare essentials we need to keep patient care running while the ecosystem rebuilds itself?”

This ecosystem reality makes organizational recovery readiness more complex than ever. When you can’t rely on your usual vendors or backup providers, your MVR plan must account for true independence from the broader ecosystem – at least temporarily.

Moving Forward

Organizations can’t just secure their own perimeter; they need to understand and plan for the interconnected web of dependencies that modern healthcare relies on. This means fundamentally rethinking business continuity planning to account for simultaneous ecosystem failures. It means maintaining data sovereignty even when using SaaS providers. And it means accepting that some risks simply can’t be eliminated – only managed and planned for.
La fase dehealthcare leaders we spoke with weren’t pessimistic about these challenges; they were pragmatic. They understand that the benefits of interconnected, cloud-based healthcare systems far outweigh the risks.

Test Your Ecosystem Resilience

Understanding the risks is just the first step. The next is honestly assessing whether your organization is prepared for the new reality of interconnected failures. How confident are you that your MVR plan would work when your usual vendors and backup systems also are compromised?

Healthcare organizations serious about ecosystem resilience should evaluate their readiness across three critical areas: business-critical prioritization, measurable technical response, and organizational recovery readiness. Commvault’s Minimum Viability Healthcare Assessment helps evaluate your current capabilities and offers actionable recommendations for closing any gaps.

Don’t wait for the next ecosystem-wide incident to discover whether your recovery plans account for the reality of interconnected healthcare IT. Take the assessment today and build true resilience for tomorrow’s challenges.

Blogs relacionados:

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

A powerful go-to-market strategy is what separates leaders from the pack in the competitive cyber resilience market. At Commvault, we’re dedicated to providing our partners with the strategic resources needed to help grow revenue, build customer trust,ysolidify your reputation as a market leader with Commvault.
That’s why we are excited to announce two game-changing resources designed to elevate your salesymarketing efforts: a reimagined Commvault Campaigns Huband the newAt-A-Glance Partner Sales Playbooks.

Streamline Your Marketing with the Campaigns Hub

Based on partner feedback, our newly imagined Campaigns Hub is your destination for ready-to-use, results-driven marketing. The Campaigns Hub is a powerful, intuitive platform that simplifies the creation of targeted campaigns, helping you build awareness, generate leads,yupsell Commvault’s suite of solutions. And now our platform integrates seamlessly with your existing strategies, enabling cohesive brand messagingymaximum impact.
With the Campaigns Hub, you’ll find:

  • Targeted campaigns you can launch in minutes. Choose from a library of pre-built multi-language campaigns – from “Securing Continuity for Minimum Viable Business” to “Microsoft Active Directory Protection” –ycustomize the content to fit your audience’s unique needs.
  • A new, powerful webcast program. Leverage Commvault’s best speakersycontent directly from the Campaigns Hub using our on-demand webcasts along with the promotional materials to drive leadsyawareness.
  • A new, co-branded assessment tool. Contact our Marketing Conciergeyrequest a co-branded minimum viability assessment tool that provides benchmarks to your customers in minutesyputs leads directly in your inbox.  
  • High-value customer assets to use on your platform or the hub. You can now access key Commvault customer contentypromotional campaigns through the Campaigns Hubyintegrate these valuable assets into your broader marketing initiatives on the hub, or downloadyuse on your platform.
  • Our complimentary Marketing Concierge service that makes campaigns even easier. You don’t need to use MDF or pay for our Marketing Concierge service to help you customizeyrun the latest Commvault campaigns to grow your business. Try out the service with a 1:1 Campaign Activation Session.

Boost Sales Success with At-A-Glance Playbooks

To complement your marketing efforts, Commvault also has launched our new At-A-Glance Partner Sales Playbooks. We’ve condensed our most popular Partner Sales Playbooks into a concise, easy-to-use one-page format, packed with the essential tools you need to articulate valueyenhance customer engagement.
Each playbook includes:

  • Concise call scripts: Confidently articulate the unique value propositions of Commvault’s productsysolutions.
  • Objection handling: Turn potential roadblocks into opportunities with prepared responses to common customer challenges.
  • Customer-ready materials: Accelerate sales cycles by sharing curated whitepapers, solution briefs, case studies, eBooks,ymore.

By combining the power of the Commvault Campaigns Hub with the strategic guidance of the At-A-Glance Sales Playbooks, you can create impactful, end-to-end campaigns that drive customer engagementyachieve greater sales success.

Unlock Your Potential with Commvault

Ready to transform your go-to-market strategyymaximize the value of Commvault’s offerings? Explore the Commvault Campaigns HubyPartner Sales Playbooksin the Partner Portal. Dive in on your own, or schedule a1:1 Campaign Activation Sessionwith our complimentary Marketing Concierge for guided support.

More related posts

Cyber Resilience

Read more

Cuando los ciberatacantes atacan, la rapidez no lo es todo. Restaurar rápidamente los datos comprometidos solo reintroduce la amenaza, creando un círculo vicioso de infección y reinfección.

Recientemente, escribí un informe técnico junto con mis colegas dede Kyndryltitulado«Redefiniendo Cyber Recovery: Presentamos el tiempo medio de recuperación limpia (MTCR) where we introduced a fundamental shift: measuring how fast you can restore from clean, verified data rather than just any available backup.

Here are the five critical steps that determine your organization’s MTCR:

 

  1. Establece un entorno limpio en el que recuperarte.

The problem: Recovery to an infected infrastructure will simply reinfect your restored systems.

The solution: Isolated Recovery Environments (IREs) or cleanrooms – compute and storage infrastructure physically or virtually separated from production environments where attackers never had access.

Reality check: Without an IRE, modern forensic teams need 24 to 72 hours to certify complex hybrid environments as “clean.” Your MTCR automatically becomes measured in days, not hours.

 

  1. Busca datos limpios para recuperar.

The hidden threat: Modern attackers operate in stealth for weeks before launching attacks, seeding malicious payloads throughout your environment – including backup systems.

The breakthrough: Automated scanning for Indicators of Compromise can help identify clean backup sets without the trial-and-error cycle of testing each backup until you find one that works.

Collaboration required: This step demands tight integration between SysOps teams (who manage backups) and SecOps teams (who understand current threats). Forensic analysis reveals attack signatures that must be fed into the scanning process.

 

  1. Recuperar los datos en un tiempo aceptable.

The uncomfortable truth: Enterprise backup solutions often deliver “10+ hours per terabyte” recovery performance. Scale this to typical enterprise services requiring hundreds of terabytes, and you’re looking at weeks of recovery time.

The reality: Most backup infrastructure was designed for nightly incremental backups (5% data change), not full-scale business restoration (100% recovery).

The solution: Purpose-built cyber resilience platforms with high-performance recovery capabilities, combined with minimum viable company (MVC) prioritization – focusing on the critical 20% of services that enable 80% of business function.

 

  1. Mantener la integridad de los datos en toda la platform.

The challenge: Enterprise systems don’t exist in isolation. During recovery, systems restored from backups taken at different times create data integrity nightmares.

Example scenario:

  • Base de datos de clientes: backup los martes a las 3 a. m.
  • Sistema de facturación: backup del lunes a las 11 p. m.
  • Sistema de inventario: backup los miércoles a las 6 a. m.

Result: Orders for customers who don’t exist, invoices for products not in inventory.

The Process: Restoration sequencing based on dependencies, data reconciliation across integrated systems, and comprehensive consistency checks before production return.

 

  1. Prueba antes de la devolución de producción.

The rush trap: Under pressure, IT teams often rush systems back online without comprehensive testing, leading to partially functional systems or reintroduction of attack remnants.

 

Validación exhaustiva:
  • Pruebas funcionales de los procesos empresariales básicos
  • Validación de seguridad mediante análisis de vulnerabilidades
  • Verificación de la integridad de los datos en todas las plataformas
  • Validación de procesos de negocio por parte de los equipos de aplicaciones

Critical success factor: Pre-define your MVC acceptance criteria – the specific functionality that must work before you’re truly “recovered.”

 

El reto de la integración

These aren’t sequential steps – they’re interconnected capabilities that must work together. Your MTCR is only as fast as your slowest step and only as reliable as your weakest validation point.

The investment reality: Clean recovery requires purpose-built cyber resilience platforms, isolated recovery environments, automated scanning tools, and dedicated recovery networks. But the cost of prolonged downtime and reinfection is far greater.

 

Próximos pasos:
  1. Evalúa cuánto tiempo llevaría cada paso en tu entorno actual.
  2. Identifica tu mayor deficiencia.
  3. Calcula el coste del tiempo de inactividad prolongado frente a la inversión en infraestructura.
  4. Comienza por los servicios empresariales más importantes.

The era of “backup and pray” is over. Organizations that master these five steps don’t just recover faster – they recover once, cleanly, and with confidence.

 

Saber Más

Mira cómo hablo sobre esta nueva métrica en el seminario web«La métrica que falta para Cyber Recovery». Lee el informe técnico completo,Redefiniendo la recuperación cibernética: Presentación del tiempo medio hasta la recuperación completa», para obtener más información sobre esta métrica fundamental.Darren Thomson is a Field CTO at Commvault. Be sure to catch him in the podcast series, STRIVE.

More related posts

CleanroomRecovery_Thumbnail_888x500

Commvault Cleanroom

Read more

The fifth edition of theState of Data Readiness in ANZ report, a Tech Research Asia Insights Report commissioned by Commvault, offers a critical look into the current landscape of data management, cybersecurity, and regulatory pressures faced by organisations in Australia and New Zealand (ANZ).Based on research from 408 companies across the region, the report uncovers key trends and stark realities about how businesses are coping with an increasingly complex digital environment. Given we often look at research findings on a global scale, it is particularly valuable to have a local perspective on data readiness.While data growth rates have seen a slight easing, the challenges surrounding data management, security, and recovery have intensified. Here are some of the standout insights from the report.

The Data and Regulatory Environment: A Tangled Web

Organisations are grappling withsprawling data estates and a tightening web of regulations.

  • Slowing growth, persistent sprawl: The annual data growth rate in ANZ has marginally slowed from 28% last year to 27% this year. A majority, 62%, continue to operate in blended (multi- or hybrid cloud) data environments, and this is projected to increase to 71% by 2026.
  • Confidence gap: A concerning number of organisations lack confidence in their ability to restore business operations after a breach, with 54% of Australian and 63% of New Zealand businesses feeling unprepared.
  • Regulatory complexity: The regulatory landscape is becoming more difficult to navigate. Fifty-five percent of Australian and 53% of New Zealand companies are now required to maintain data copies in separate cloud environments for resiliency. Furthermore, more than a third of organisations face conflicting data regulations across different geographies.
  • The rise of AI regulation: AI-specific compliance is a growing concern, with 28% of companies already subject to such regulations and another 40% expecting to be within the next year.

The AI Paradox: High Adoption Despite High Risk

Enthusiasm for AI is strong,yet it’s coupled with significant security concerns.

  • Risk vs. reward: While 73% of ANZ organisations are using business-focused AI solutions, 68% of them believe this adoption increases the likelihood of a cybersecurity breach.
  • Lack of due diligence: A significant 63% of organisations admitted to not conducting thorough and extensive security audits of their AI tools before deployment.
  • Policy deficit: Only 29% of companies have comprehensive policies in place to protect the data and content generated by AI solutions.

Recovery: A Disconnect Between Expectation and Reality

The gap between business leaders’ recovery expectations and the on-the-ground reality for IT teams remains a major issue.

  • The expectation-reality gap: Eighty percent of business leaders expect to recover from a cybersecurity incident within five days. However, the stark reality is that it takes an average of four weeks to restore a minimal level of business operation.
  • Ransomware’s reach: Seventy percent of ANZ organisations have received a ransomware demand, and of those, 20% admitted to paying it. Interestingly, of the companies with a stated “no payment” policy, 15% still ended up paying the ransom when faced with an actual attack.
  • The power of experience: The report reveals a fascinating insight: Experience is a harsh but effective teacher. Companies that have been breached are 1.5 times more likely to conduct thorough reviews of AI tools and twice as likely to test all mission-critical workloads as part of their incident response plans. Conversely, companies that have not been attacked are 1.5 times more likely to believe they can recover within a single day.

The 2025 State of Data Readiness report underscores a challenging environment for ANZ organisations. From regulatory hurdles to the double-edged sword of AI and the persistent disconnect in recovery expectations, the path to true cyber resilience is complex.To gain a deeper understanding of these findings, download the full report.

 

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

I’m thrilled to share that we were just announced as a winner in Udemy’s 2025 Learning Excellence Awardsin the Leading With Learning Science category. In this awards program, Udemy recognized organizations that have successfully achieved impactful results in learning and development through AI-supported upskilling.

As one of the winners in the Leading With Learning Science category, Commvault was recognized for prioritizing the integration of learning into the workflow, engaging learners through micro-learning, and crafting personalized learning experiences.

We are honored to be included on a list of visionary leaders that are transforming learning at scale and equipping their employees to thrive in an AI-forward future.

La inversión en vuestra gente es importante

Over the past year, we’ve expanded on our investment in learning and development by implementing an all-new, comprehensive learning platform, Pathfinder, to provide our Vaulters with the tools, resources, and opportunities they need to enhance their skills and advance their careers.

Our new platform has a wealth of learning modules, ranging from live instructor led sessions to on-demand and self-paced learning modules, including Udemy Business’ 30,000+ expert-led courses covering topics across technology, business, leadership, productivity, cybersecurity, and GenAI. Udemy Business isn’t just another online training tool – it’s a strategic driver of capability building within Commvault, and we’re delighted to offer our global Vaulter community access to Udemy Business.

We’ve also developed curated learning paths tailored for our teams, with a focus on the power of AI. The development of our Vaulters is key to Commvault’s success, and with Udemy Business, we’re giving them the tools to build their future growth, all while harnessing the potential of AI.

To learn more about what it’s like to work at Commvault, haz clic aquí.

 

 

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

El cambio global hacia arquitecturas cloud ha redefinido lo que significa lograr seguridad y resiliencia. Cloud son dinámicos por diseño; los recursos se actualizan, añaden o eliminan con frecuencia; las aplicaciones se extienden por regiones y multinubes; y la infraestructura evoluciona más rápido de lo que pueden seguir la mayoría de las herramientas de recuperación. backup tradicionales, creados para sistemas estáticos, tienen dificultades para seguir este ritmo y esta complejidad.Commvault Cloud Rewind™ is built from the ground up to handle this new reality. With an architecture purpose-built for cloud-scale recovery, Cloud Rewind helps you restore entire cloud environments, including applications and their dependencies, with ease.

This becomes essential in modern environments where applications are composed of microservices, containers, and serverless components that are often ephemeral and spread across multiple platforms.

Resources may change daily, and ownership is often decentralized across teams. Configuration drift, inconsistent change management, and the growing use of third-party services all make recovery harder. Even when manual backups are available, critical infrastructure metadata is often missing, making restorations unreliable or incomplete.

In this ecosystem, Cloud Rewind brings order to the chaos. By leveraging ongoing discovery, orchestration, and cloud-native operations, it provides fast and consistent recoverability. Whether you’re dealing with a simple misconfiguration or a full-blown cyberattack, Cloud Rewind helps restore critical resources in minutes.

A Deep Dive Into the Design: The Cloud Rewind Architecture 

En el núcleo de Cloud Rewind principios arquitectónicos clave que dan prioridad a la automatización, la escalabilidad y la precisión de la recuperación. A partir de esa base, permite un enfoque integrado para ayudar a descubrir, proteger, recuperar y reconstruir aplicaciones y datos dentro de cloud . Cloud Rewind potentes capacidades para reforzar la resiliencia cibernética y simplificar la recuperación en cloud . Cada función desempeña un papel fundamental a la hora de mejorar la confianza en las operaciones diarias y la respuesta ante crisis.

  • Cloud discovery and dependency mapping: Cloud Rewind automatically discovers all relevant cloud resources and captures the metadata needed for accurate and repeatable recovery. This includes complete configuration settings, dependencies, and infrastructure details.
  • Drift analysis: Cloud environments change rapidly. Cloud Rewind tracks these changes with regular drift analysis, comparing current configurations to known protected states. This keeps security teams informed about any deviations from expected configurations, helping maintain crucial alignment.
  • Automated daily cloud rebuilds: Reverting to a safe state is not enough; it has to be done quickly and without errors. Cloud Rewind helps enable this with automated recovery testing. You can rebuild entire cloud infrastructures, applications, and data using on-demand environments. These temporary environments can later be deleted to help reduce testing costs.
  • Integrated cyber recovery: Cloud Rewind works with Commvault’s broader data resilience platform, effectively combining backup, recovery, and threat intelligence. This unified approach provides better control and coordination during security incidents, helping teams move from detection to full recovery with speed and clarity.

Superando a la competencia: dóndeRewind Cloud Rewind

Con una gran cantidad de funciones avanzadas diseñadas para las organizaciones modernas cloud, Cloud Rewind una recuperación eficaz y simplificada. Aunque varias soluciones del sector ofrecen una recuperación ante desastres sencilla para cloud , estas capacidades ayudan a Cloud Rewind . Cloud Rewind la capacidad de recuperación a un nuevo nivel con:

  • Ampliacloud , con compatibilidad nativa con AWS, Azure y GCP.
  • Cobertura completa de recursos, incluyendo computación, almacenamiento, redes, IAM, DNS, contenedores y servicios sin servidor.
  • Protección detallada de los metadatos de infraestructura, mediante una máquina del tiempo con doble bóveda.
  • Gráficos explícitos de dependencia de aplicaciones, no solo reconocimiento a nivel de recursos.
  • Recuperación como código, para una recuperación orquestada y basada en código.
  • Validación continua, mediante reconstrucciones automáticas periódicas en cloud aislados cloud .
  • Baja carga operativa y alta transparencia gracias al modelo SaaS .

Cloud Rewind protección, inteligencia y automatización para permitir una recuperación rápida y fiable en cloud complejos. Esto ayuda a Cloud Rewind en un campo competitivo y a mantenerse a la vanguardia.

Cloud para una recuperación completa de Cloud

Commvault Cloud Rewind is built for full-stack cloud resilience, offering protection for modern, cloud-native workloads. Instead of simply backing up isolated resources, capturing and recovering entire cloud applications, referred to as Cloud Assemblies.

Cloud Rewind supports a wide range of cloud-native services, including virtual machines, disks, gateways, security groups, VPCs, DBaaS platforms, and containerized workloads. Once a cloud connection is established, Cloud Rewind performs automated identification of all resources in an environment. At scale, this can be highly significant. For one Commvault customer, 94,237 resources were discovered, with 7,811 protected resources organized into 19 distinct assemblies.

For complete protection, customers can begin with the definition of policies tailored to their Cloud Assemblies. These policies govern snapshot frequency, retention rules, and replication preferences. Snapshots can be taken as frequently as every 15 minutes or as infrequently as annually, depending on the workload’s recovery objectives. These snapshots can be used for rapid, point-in-time backups and fast rehydration.

With its sophisticated use of only cloud snapshots, Cloud Rewind offers protection at a fraction of the cost of expensive traditional high-availability or read‑replica architectures. As dedicated standby infrastructure isn’t required, customers pay only for snapshot storage and temporary compute during recovery operations. This flexibility allows customers to effectively fine-tune protection schedules to balance RPO requirements against storage costs.

Finally, Cloud Rewind provides cloud data resilience by performing recovery at the Cloud Assembly level. When it’s time to restore, Cloud Rewind can recreate the complete application, including the resource configurations, network settings, and dependencies, exactly as it existed at any point in time. Recovery also can target the original region for a quick rollback or be redirected to a different region, subscription, or project to support disaster recovery use cases.

By centering recovery around customer applications, Cloud Rewind replaces traditional complexity with invaluable clarity. With automated discovery, flexible policies, and cost‑effective snapshot-based protection, Cloud Rewind can help customers meet stringent recovery objectives while minimizing infrastructure overhead.

Una nueva era de resiliencia: ventajas clave de Cloud Rewind

Cloud Rewind introduces a new standard for resilience in the cloud, shifting away from legacy disaster recovery models toward an approach designed for dynamic, modern environments. By focusing on full application recovery instead of isolated resources, it helps avoid downtime, reduce operational risks, and support rapid, coordinated recovery and restoration across cloud platforms.

One of its core innovations is the patented dual-vault cloud time machine. This unique approach protects  immutable vaults in different hyperscale clouds for rapid application recoveries. This design not only defends against failures and cyber threats but also enables precise, point-in-time recovery of entire application environments.

With a myriad of powerful capabilities that support the growth of modern businesses, Cloud Rewind makes an impact:

  • Las entidades de servicios financierosaprovechan Cloud Rewind ayudarte a cumplir con los estrictos requisitos normativos y minimizar el tiempo de inactividad de los sistemas financieros en tiempo real.
  • Las organizaciones sanitariasutilizan Cloud Rewind ayudarte a recuperar rápidamente los registros médicos electrónicos y otras aplicaciones críticas durante incidentes cibernéticos, evitando así la interrupción de la atención al paciente.
  • En elsector educativo, Cloud Rewind una red de seguridad que permite proteger contra la pérdida de material didáctico, datos de los alumnos y otros recursos.
  • Las empresas minoristas y manufactureras aprovechan Cloud Rewind recuperarse rápidamente de interrupciones del servicio o ciberataques, lo que permite minimizar la pérdida de ingresos y continuar con los calendarios de producción.
  • SaaS de tecnología y SaaS utilizan Cloud Rewind ayudarte a proteger las plataformas cloud y ofrecer un servicio continuo a los clientes.

En todos los sectores, Cloud Rewind ofreciendo resultados cuantificables. Por eso, rápidamente han surgido casos destacados en el mundo real de organizaciones que se benefician de esta innovadora solución. SaaS deSistemas Pragya’ SaaS resiliency increased by a staggering 300% with Cloud Rewind. Similarly, backed by the powerful capabilities of Cloud Rewind, an líder en eDiscoveryse recuperó de un grave ataque de ransomware.

En el sector de los servicios financieros, unaimportante entidad hipotecaria decreased cloud application resilience cost by 85% with Cloud Rewind. Finally, leveraging Cloud Rewinds’ app-centric BCDR approach, a global cloud solutions provider achieved a 99.9% cloud app resilience SLA.

Cloud como nunca antes

Commvault Cloud Rewind un punto de inflexión en la forma en que las organizaciones abordan la resiliencia. En lugar de depender de herramientas fragmentadas o procesos de recuperación rígidos, Cloud Rewind una arquitectura cloud que se adapta al ritmo de los cambios. Con una automatización profunda, una recuperación centrada en las aplicaciones y resultados probados en todos los sectores, permite a las organizaciones proteger lo que importa, recuperarse más rápidamente y operar con confianza.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

La mayoría de los sitios web de documentación empresarial que incluyen bloques de código utilizan estilos que indican marcadores de posición. Se supone que la intención debe quedar clara y que los lectores deben saber qué deben modificar,pero la experiencia deja que desear.Estos mismos estilos también se utilizan para resaltar texto,etiquetas de la interfaz de usuario o sintaxis en otras partes de la documentación. Entre los marcadores de posición más comunes que utilizan los equipos de redacción técnica para identificar bloques de código —y que se emplean como otros estilos— se incluyen:

  • Italics
  • {Acordeones}
  • Bold
  • ejemplo_nombre_##
  • MAYÚSCULAS
  • Alguna combinación de lo anterior.
  • Algo completamente diferente

This overlap makes placeholder tracking and management more complex than it should be. On a small scale,this can feel like a nuisance. But as documentation libraries grow and spread across teams and years,it creates problems for both authors and readers. What is meant to simplify placeholder management instead complicates it,because the same styling is reused elsewaquí.

The result can put you in a familiar position: You must figure out the placeholder convention and attempt to update them all if you want to succeed. If you miss one placeholder,the command may not work as expected. Other issues can appear,such as errors,unexpected configurations,or even settings you didn’t know could be changed.

Other code block approaches only go so far:

  • Static blocks (with or without syntax highlighting) are essential when you already know the values. They are fast and copy-to-run ready. These are best when you don’t need to modify anything.
  • Inline editors go to the other extreme and enable you to update text directly within the code block,but often at the expense of context – undo becomes unreliable and small mistakes erase the structure you need.
  • Developer API editors let you try out requests in real time,and they’re a great fit when the main audience is developers working directly with APIs. But enterprise documentation serves broader roles and use cases,and that style of interactivity is often missing waquí it would still add value.

Reducir la brecha con bloques de código interactivos

Nuestros bloques de código interactivos cierran esta brecha al convertir una parte históricamente frágil de la documentación (el marcador de posición) en algo claro,editable y escalable.

You get the same command as before with the same formatting and structure,only now the placeholders have become editable fields. Each one has a clear label (like before) so you don’t have to interpret symbols or rely on guesswork.

You update the values right inside the block,with the surrounding context still visible. That means you see the example,the rest of the page’s contents,and your inputs all in one place. It can help you shape a more relevant snippet before you click Copy.

You can change those values before copying them or leave them as-is and edit them later in another editor. Either way,the structure stays the same and what you copy reflects exactly what you see in the block.

Placeholders in a code block that have the same name become linked. When you change the value of a placeholder field above the code block,all linked fields can update at the same time so that you can more consistently edit fields that have the same placeholder value. This helps reduce potential find and replace mistakes when working in a text editor.

El cambio de experiencia

Este cambio resuelve dos problemas a la vez. Para los lectores,reduce las conjeturas y evita errores. Ya no hay que descifrar llaves ni corchetes angulares. Para los autores,separa la semántica del estilo,lo que permite realizar un seguimiento,auditar y actualizar los marcadores de posición mediante programación. Esto permite el control de versiones,las reglas de validación y la coaquíncia en todos los entornos. Las inconsistencias aquídadas se corrigen sobre la marcha,lo que facilita el mantenimiento general de la biblioteca.

Los bloques de código interactivos convierten una de las partes más difíciles de la documentación —los marcadores de posición basados en el estilo— en algo preciso,fácil de mantener y rápido de usar. La experiencia se percibe como intencionada,en lugar de improvisada. Y,por primera vez,la gestión de ejemplos de código a gran escala genera oportunidades de mejora en lugar de obstáculos.

Ahora en directo en Software,SaaS y más

This experience is already live across our documentation site for Software (versions11.42,11.40,11.36,and 11.32),SaaS,and other related sites on https://documentation.commvault.com/.

Try it out the next time you browse and run across a code block – edit a few fields,click “Copy,” and see how much easier it is to get started after you bring it into your editor.

Notas:
  • Carefully review any code before you run it,whether it’s from an interactive or static code block.
  • When you refresh a page after changing placeholders in an interactive code block,all changed placeholders revert to their default values.

Más información sobre el uso de bloques de códigoaquí.

 

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

En la carrera por implementar la IA, las organizaciones están realizando importantes inversiones en la seguridad de la infraestructura tradicional. Los equipos de ciberseguridad están implementando sistemas avanzados de detección de amenazas para los terminales y desplegando arquitecturas de «confianza cero» para entornos en la nube. Sin embargo, muchos están prestando menos atención a un componente crítico de los sistemas modernos de IA: la capa de orquestación que conecta los modelos de IA con las fuentes de datos y las aplicaciones empresariales.

Esta capa intermedia incluye la infraestructura que hace que la IA funcione en entornos empresariales: bases de datos vectoriales que almacenan representaciones, repositorios de modelos, canalizaciones de datos que procesan cargas de trabajo de IA, marcos de coordinación de agentes y plataformas de orquestación como el Model Context Protocol (MCP). A diferencia de las aplicaciones empresariales tradicionales, muchos de estos sistemas carecen de marcos de seguridad y buenas prácticas consolidados.

El nuevo reto: las brechas de seguridad en la infraestructura de IA

Traditional security models were designed for databases, web servers, and file systems with well-understood attack vectors. AI infrastructure introduces new components that don’t always fit neatly into existing security frameworks. Vector databases store high-dimensional embeddings, model registries house trained algorithms, and orchestration platforms coordinate between AI agents and external systems.

Take MCP as an example. While MCP itself incorporates security considerations, the broader ecosystem of AI orchestration frameworks often operates with different security assumptions than traditional enterprise applications.

Research from organizations like NIST has highlighted that AI systems frequently require elevated privileges to access diverse data sources, communicate across network boundaries for model inference, and integrate with legacy systems not designed for AI workloads.

This creates an expanded attack surface. According to recent security research, compromise of AI orchestration layers can enable attackers to manipulate model outputs, corrupt training processes, or gain access to the valuable datasets and custom models that represent significant organizational investment.

La consolidación de datos genera nuevas concentraciones de riesgo

AI adoption has accelerated data centralization initiatives across industries. Organizations are aggregating diverse datasets into centralized repositories to enable machine learning workflows. While platforms like Databricks and Snowflake have built robust security features, the challenge lies in the volume and variety of data being consolidated.

These repositories often contain some of the most sensitive organizational data: customer behavioral patterns, proprietary research datasets, financial transaction records, and competitive intelligence. The security challenge isn’t necessarily inadequate access controls, but rather the concentration of high-value data in systems optimized for analytics rather than security.

A particular concern is training data integrity. Security researchers have demonstrated that subtle corruption of training datasets can introduce persistent vulnerabilities into AI models. For instance, researchers at universities have shown how poisoned datasets can cause fraud detection models to systematically miss specific attack patterns, or cause recommendation systems to exhibit subtle biases that may not be detected for months.

Entre los ejemplos del mundo real se incluyen:

La magnitud de los conjuntos de datos de entrenamiento de la IA moderna agrava estos riesgos. Cuando las organizaciones procesan petabytes de datos de entrenamiento, las medidas de seguridad tradicionales puntuales, como la gestión exhaustiva de claves de cifrado y el registro detallado de accesos, se vuelven operativamente complejas. Las organizaciones necesitan enfoques de seguridad diseñados para la escala y la velocidad del procesamiento de datos de IA.

Los modelos de IA, como activos de gran valor, requieren una protección especializada

Trained AI models represent significant organizational investment – often millions of dollars in development costs and months of training time using expensive computational resources. More importantly, they embody institutional knowledge and competitive advantages developed over years.

However, many organizations apply traditional data security approaches to AI models without accounting for their unique characteristics. Unlike conventional intellectual property, AI models face specific threat vectors:

Model extraction attacks: Researchers have demonstrated techniques where attackers can query a model repeatedly to reverse-engineer its functionality or training data. Google’s research team has published studies showing how this can be accomplished against various types of production models.

Adversarial attacks: These cause models to make specific mistakes or reveal information about their training data. The field of adversarial machine learning has documented numerous examples across different model types and use cases.

Model stealing: Beyond intellectual property theft, stolen models can reveal insights about business processes, customer patterns, and strategic approaches. For example, a compromised fraud detection model provides information about an organization’s risk assessment methodologies and customer transaction patterns.

Entre los casos documentados se incluyen:

  • Investigaciones que muestran ataques de extracción contra las API comerciales de los principales proveedores de servicios en la nube.
  • Estudios demonstrating how recommendation model theft reveals user behavior patterns.

Las organizaciones están empezando a implementar medidas de seguridad especializadas para los modelos de IA, incluidos sistemas de control de versiones de modelos que detectan modificaciones no autorizadas, arquitecturas de servicio seguras que limitan la exposición de los modelos y procedimientos de respuesta a incidentes diseñados específicamente para situaciones de compromiso de la IA.

Creación de una seguridad adecuada para la infraestructura de IA

El reto de la seguridad de la infraestructura de IA supone un cambio en las prioridades de seguridad de las empresas. La seguridad tradicional del perímetro y de los terminales sigue siendo importante, pero las organizaciones también deben proteger los sistemas en los que existen activos valiosos en forma de algoritmos, en los que los procesos autónomos operan con privilegios elevados y en los que los procedimientos de entrenamiento consumen enormes recursos computacionales en sistemas distribuidos.

Las organizaciones líderes están desarrollando marcos de seguridad específicos para la IA que abordan estas características únicas. Esto incluye la implementación del seguimiento del linaje de datos para los flujos de trabajo de entrenamiento de la IA, el establecimiento de procesos seguros de desarrollo y despliegue de modelos, y la creación de sistemas de supervisión diseñados para detectar patrones de ataque específicos de la IA.

La comunidad de seguridad está desarrollando activamente soluciones para estos retos. Organizaciones como el NIST están publicando marcos de seguridad para la IA, los proveedores de servicios en la nube están incorporando funciones de seguridad específicas para la IA a sus plataformas y los proveedores de seguridad están desarrollando herramientas diseñadas para la protección de la infraestructura de IA.

El camino a seguir implica:

  • Implementar controles de seguridad diseñados para los riesgos y vectores de ataque específicos de la IA
  • Desarrollar procedimientos de respuesta ante incidentes que tengan en cuenta las características de los sistemas de IA
  • Crear capacidades de supervisión y detección de amenazas específicas de la IA
  • Establecer marcos de gobernanza para la gestión de datos y modelos de IA

Las organizaciones que aborden de forma proactiva la seguridad de la infraestructura de IA estarán mejor posicionadas para aprovechar las ventajas de la IA y gestionar al mismo tiempo los riesgos asociados. A medida que los sistemas de IA adquieren un papel cada vez más central en las operaciones empresariales, las estrategias de seguridad deben evolucionar para proteger estos nuevos activos y procesos de forma eficaz.Regístrate ahoraen nuestro evento virtual SHIFT para obtener más información sobre nuestras innovaciones de producto y estrategias de resiliencia para tu organización.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

How do you take 40 minutes of viewpoints from a panel of leading experts and condense it into a 5-minute read designed to provide you with actionable advice you can immediately use? That’s the challenge I posed to myself as I prepared to write this blog, so let me know if I delivered.

The panel: Nathan McAfee, Lead Economic Validation Analyst at Enterprise Strategy Group; Jaimie Fox, Azure Technology Strategist at Microsoft; and Chris DiRado, Principal Technologist at Commvault.

Their goal: Unpack the key findings from this crucial research (Enterprise Strategy Group Economic Validation), providing a clear-eyed view of how organizations can prepare for, and recover from, the inevitable.

The High Stakes of Slow Recovery

A cyberattack’s impact isn’t just about the initial breach; it’s the prolonged downtime that cripples operations, erodes customer trust, and racks up exorbitant costs. As Nathan explained, the study aimed to quantify the real-world difference a modern, integrated recovery solution could make.

The findings highlight a stark contrast between traditional approaches and a prepared strategy. Without an effective plan, organizations face extended outages; significant data loss; long-lasting brand damage; and a painful, manual recovery process that can take weeks or even months.

The Solution: A Unified Defense with Commvault and Azure

The study focuses on the economic benefits of the joint solution from Commvault and Microsoft Azure. This isn’t just about backup; it’s about a holistic cyber resilience platform. Jaimie emphasized the power of the integration, which provides a secure, scalable, and intelligent foundation for data protection: “The power of the Commvault solution is in the simplicity and the thoroughness. How easy it is to do these recoveries … and in the automation of the rebuild process using Azure AI and on-demand Azure tenants.”

Breakthrough Findings: Customer Reported Results

The study provided hard numbers to back up the solution’s value. Organizations using the joint Commvault and Azure solution achieve:

  • 99% faster recovery: The most dramatic finding: where organizations previously required 8.7 hours on average (with some taking 24 days for full recovery), the joint solution between Commvault and Azure enabled one customer recovery in under an hour. Nathan noted: “The 99% faster recovery – I could put decimals on that because we had so many stories of scenarios that took months to do, and now we did it in hours.”
  • 30x more frequent testing: Organizations moved from annual tests of single systems requiring 40 FTE hours, to comprehensive monthly testing of entire ecosystems completed in 30 minutes. One customer shared: “It used to take 24 to 36 hours to recover a single server instance. We can now restore everything in less than an hour.”
  • Zero reported non-recoverable events: Every customer interviewed reported zero non-recoverable events since implementing the solution. “Every person that I interviewed told me that since they’ve gone to this solution, they haven’t had a single non-recoverable event,” Nathan emphasized.
  • 94% faster rebuild: The study documented 94% faster rebuild times through Cloud Rewind technology, enabling rapid restoration of entire application environments and infrastructure.
  • Dramatic cost reduction: Average testing costs dropped from $141,864 annually to under $11,000, even while testing frequency increased to daily in some cases.

The Mindset Transformation: From Hope to Certainty

The most powerful insight from the research wasn’t about technology – it was about mindset. Nathan repeatedly emphasized organizations moving from hoping their recovery plans would work to knowing they will.

“We were comparing hope vs. certainty,” he explained. “Certainty is a word you hear me say a lot because that really came out in the customer stories.”

As one global infrastructure director put it: “I wake up every day, check my Cleanroom Recovery report about the previous night’s restore, and know we are protected and can recover. We have eliminated downtime by always being able to recover from cyber events.”

The certainty shines through in being able to test recoverability of more than just one component. Nathan shared, “I went into this thinking about data recovery without thinking about ecosystem recovery. They’re now testing the recoverability of their entire ecosystem.”

Study participants also discussed testing in true chaotic environments. “So much of testing is done in a very calm environment. While any type of true restore is done in a chaotic environment. I heard quite a few stories about how Commvault specifically helped simulate the chaotic environment. So, in the time when it did happen, it wasn’t the first time you went through a high stress recovery,” Nathan shared.

Bonus Insights: AI Acceleration Through Confidence

Nathan shared additional findings from the research that are not called out in the report, including how organizations feel confident to accelerate their AI initiatives because they know they’re protected.

“AI comes with rapid change,” he explained, adding that the customers he interviewed “called out the assurance that no matter what happens, I can get to my minimum viable company somewhat quickly. It gave organizations more confidence in going through the rapid change that AI is injecting into their company.”

This confidence proves critical as organizations grapple with AI governance challenges. Jaimie highlighted: “One of the biggest concerns that most of my customers have with implementing AI now is how are we going to keep it safe, from an ethical standpoint, as well as from outages and a business continuity standpoint. With Commvault integrated with the Microsoft solution, the most complex and extremely large AI workloads are resilient and recoverable. Customers now have the confidence that their data is protected and recoverable with the resilience they need.”

Begin Your Transformation Today

The transformation from hope to certainty in cyber recovery isn’t just possible – it’s happening right now. The only question is: When will your organization make the leap?  Download the complete ESG Economic Validationreport and watch the webinar,Descifrando el código: Recupérate un 99% más rápido de los ciberataques, to hear from our expert panel. Use these as your blueprint to begin your organization’s transformation.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

The modern, tech-dependent businesses of today may not run entirely on Windows – but nearly every organization relies on it somewaquí. Whether through business applications, identity management, or the countless tools that keep operations moving, Windows remains a critical touchpoint across industries.

This widespread adoption brings with it a unique challenge: It makes Windows solutions the natural target for cyberattackers. The more common the technology, the more determined adversaries are to find vulnerabilities. Especially in an era waquí cyberattacks are growing in complexity and sophistication, this poses a monumental threat to digital businesses.

In an anterior del blog, analizamos la necesidad de pasar de una defensa reactiva a una proactiva. Sabemos que la visibilidad y la rapidez son fundamentales para el éxito de la Recovery. Ahora, con Threatwise v8.2, damos un paso más allá.

Al introducir sensores de amenazas preconfigurados para Windows Server 2022 y 2025, esta versión se basa en los cimientos que hemos sentado. Le ayuda a restaurar el sistema más rápidamente al comprender fácilmente el alcance del ataque y proporciona a los equipos de TI un sistema de alerta temprana más sólido para evitar que los ataques se propaguen.

Tecnología de engaño: ¿qué es y por qué es importante?

Commvault Threatwise leverages cyber deception technology to help redirect attacks and uncover threats. Deception technology plants digital lookalikes across your environment. These decoys mirror true company assets and network activity, yet they serve a very different purpose: to lure attackers into revealing themselves.

Threatwise extends this approach with decoys that are quick to deploy and simple to scale. These lookalikes trick criminals into believing they have gained access to an enterprise’s most critical systems, when in reality, they have pulled the virtual fire alarm.

While invisible to everyday users, the moment a bad actor interacts with a sensor, security teams receive a high-fidelity signal of compromise. Such early alerts help defenders prepare a response before damage escalates.

With v8.2, organizations gain access to preconfigured sensor templates for the latest Windows Server editions. This allows you to help protect your system with faster setups, broader coverage, and greater resilience.

Minimizar el radio de impacto

Every cyberattack carries a blast radius. When it comes to cybersecurity, the blast radius refers to the potential spread and impact of a single security breach or system failure.

For backup administrators, the blast radius translates into the scale of data corruption, downtime, and recovery complexity. The larger the impact, the longer and more expensive the recovery. What’s more, beyond the operational disruption and economic losses, these attacks also can damage company reputation and trust, potentially undoing years of dedicated service.

In our proactive detection series, we discussed how reducing the blast radius requires early detection, rapid isolation, and clean recovery environments. Deception technology aligns with this model. Triggering alerts early in the attack lifecycle can help defenders contain an attack before it cascades across production systems. This early visibility can give responders the needed head start, providing valuable time to preserve clean data and maintain operational continuity.

Superar las adversidades: por qué los administradores de copias de seguridad necesitan Threatwise

In our highly competitive business ecosystem waquí speed is non-negotiable, backup administrators face a unique set of challenges. Recovery windows are shrinking, applications with exponentially larger data sets, and more and more complex infrastructure, often spanning across hybrid or multi-cloud environments.

In this environment, Commvault’s deception technology can help data administrators thrive in the face of adversity in several ways:

  • The How: Preconfigured decoys mimic application hosts, allowing admins to quickly create lookalikes and multiply them across blanked instances. With Threatwise v8.2, sensor templates for Windows Server 2022 and 2025 deliver coverage for the latest systems.
  • The What: Based on organizational SLAs, Threatwise can highlight which systems to prioritize and help to keep critical company crown jewels safeguarded.
  • The Why: Early high-fidelity signals can reduce uncertainty during an incident with critical threat insights. Backup admins can pinpoint infected applications that require restoration. Further, they can effectively prepare cleanroom environments to validate restore data and processes.

Estas capacidades ayudan a los administradores a tener claridad y confianza, incluso en los momentos de mayor presión de una emergencia de Recovery.

Juntos somos más fuertes: colaboración y sinergia entre TI y seguridad

Threatwise proporciona a las empresas las herramientas necesarias para proteger sus activos frente a las ciberamenazas modernas y el ransomware. Sin embargo, la detección solo es tan eficaz como la respuesta que le sigue.

Threatwise, como parte de Commvault Cloud, se integra con las principales soluciones SIEM y SOC, lo que permite que las alertas fluyan entre las operaciones de TI y de seguridad. Esta colaboración facilita una coordinación más rápida, una comunicación interfuncional, una conciencia organizativa compartida y un plan unificado de respuesta ante incidentes.

Además, la verdadera oportunidad radica en cómo las operaciones de copia de seguridad pueden dar forma a la estrategia de seguridad más amplia al asumir el papel de innovadoras. Al asumir este papel y alinearse con el equipo de seguridad, los administradores de copias de seguridad contribuyen a pasar de una defensa reactiva a una resiliencia proactiva. Las pruebas rutinarias de los manuales de respuesta y las iniciativas de Recovery refuerzan esta sinergia y generan confianza en el poder de un enfoque proactivo.

Qué significa esto para el futuro de la ciberresiliencia

Threatwise v8.2 helps make deception technology simpler to deploy and more effective against ever-evolving threats. By extending coverage to the latest Windows Server editions, it helps organizations stay a step ahead of attackers who seek to exploit vulnerabilities of the most widely used enterprise systems.

Early warning signals are not a luxury for a cyber resilient organization; they are vital for building business continuity by creating rapid recovery options. With deception in place, powered by Threatwise, organizations can face tomorrow’s threats with confidence.

Learn more about Threatwise aquí.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

AI and analytics are driving competitive advantage across every industry. At the heart of this transformation are data lakehouses built on Apache Iceberg, now one of the fastest-growing standards for structured data on object storage such as Amazon S3. From retail and healthcare to finance and tech, Iceberg is powering the pipelines that fuel AI-driven insights.

But while adoption is surging, resilience has not kept pace. Native Iceberg tools weren’t built for long-term protection. They fall short when it comes to compliance, ransomware resilience, and rapid recovery. For businesses, that gap means more than data loss – it can result in regulatory fines, flawed AI models, and costly downtime that undermines innovation.

When Native Tools Fail: A Financial Firm’s Story

Consider a global financial services firm processing billions of trades every day. Every few minutes, trades are written into Iceberg tables. Regulations require this firm to keep a full history of transactions for seven-plus years.

With native Iceberg snapshots, this can quickly become unmanageable. Too many snapshots can create performance bottlenecks, and recovering to an event from just five months ago requires a slow, manual process. In finance, where downtime equals millions of dollars in losses, that’s simply unreasonable.

And the challenge isn’t limited to finance. Any industry running AI and analytics on Iceberg may face the same risks: limited retention, fragile recovery, and exposure to ransomware.

Why Generic S3 Backups Aren’t Enough

Some organizations turn to standard S3 backup tools as a workaround. While these can be air-gapped, they copy data files but don’t preserve the relationships that define an Iceberg table.

That means recovery isn’t a simple restore – it’s a complex, manual “rewiring” process to rebuild the entire table structure. For a financial firm with billions of trades, that translates into extended downtime, higher costs, and potential data loss.

Clumio can eliminate this problem by natively understanding Iceberg, enabling recovery that is fast, accurate, and transactionally consistent.

Un camino inteligente hacia el futuro: Clumio para Apache Iceberg

Commvault is closing this gap with the industry’s first and only solution to deliver Iceberg-aware, air-gapped cyber resilience: Clumio for Apache Iceberg on AWS.

Here’s what makes it different:

  • Unlimited retention without performance hits – adhere to long-term compliance requirements without slowing down production environments.
  • Air-gapped, immutable protection – designed to defend against ransomware, account compromise, and accidental deletions.
  • Fast, Iceberg-aware recovery – ability to restore to any point in time or named snapshot with full table integrity.
  • Cross-region and cross-account recovery – extend resilience across AWS environments for verifiable disaster recovery.
  • Cost-efficient, incremental backups – enables capturing only changes to minimize costs while scaling with massive workloads.

Lee el anuncioen nuestro comunicado de prensa para obtener más detalles.

Instantáneas nativas frente a copias de seguridad genéricas de S3 frente a Clumio para Apache Iceberg

Capability Native Iceberg Snapshots Generic S3 Backups Clumio for Apache Iceberg
Retention Limitada; puede provocar cuellos de botella en el rendimiento si se crean demasiadas instantáneas Posible a largo plazo, pero solo a nivel de archivo Ilimitada, rentable y diseñada para garantizar el cumplimiento normativo
Air-gapped protection ✘ Lives in same AWS account (lost if table deleted) ✓Can be air-gapped, but not Iceberg-aware ✓Air-gapped, immutable vault for ransomware resilience
Recovery process Manual, especialmente para instantáneas antiguas Manual “rewiring” of table metadata and manifests Recovery rápida, automatizada y compatible con Iceberg
Data integrity Consistencia transaccional, pero responsabilidad en materia de gobernanza y cumplimiento normativo Desconocimiento de los metadatos de Iceberg; restauraciones inconsistentes Restauraciones con fidelidad total y coherencia transaccional
Enterprise scale Poco práctico para la retención a largo plazo; altos costes de almacenamiento Inestable y propenso a errores a gran escala Probado a escala de petabytes con miles de millones de objetos

 

Por qué es importante para su empresa

Clumio doesn’t just protect files – it can safeguard your AI and analytics investments so they can deliver results. This new capability helps enterprises:

  • Accelerate AI innovation with confidence by protecting the data fueling critical pipelines.
  • Avoid compliance penalties with unlimited, cost-effective snapshot retention.
  • Recover in minutes, not days, thanks to Iceberg-aware automation that is designed to eliminate brittle, manual processes.
  • Strengthen cyber resilience with actual air-gapped protection against ransomware and insider threats.

Construir resiliencia de cara al futuro

As data lakehouses become the backbone of digital business, resilience shouldn’t be an afterthought. With Clumio for Apache Iceberg on AWS, enterprises finally have a solution that matches the scale, speed, and criticality of their AI and analytics workloads.

Because in the end, it’s not just about protecting data. It’s about protecting your business.

Descubre cómo proteger las tablas de Icebergadministradas por AWS Glue y las tablas de Amazon S3 con resiliencia compatible con Iceberg. ¿Te interesa saber más?Solicita una demostracióny regístrate hoy mismo para obtener unaprueba gratuita en AWS Marketplace today.

 

 

 

More related posts

Clumio

Read more

Ransomware attacks have become inevitable in today’s threat landscape, emerging as a major concern for all businesses. In fact, ransomware incidents have surged dramatically in the first half of 2025, resulting in a 49% increase compared to the same period in 2024.

Now, as organizations face even more sophisticated threats designed to encrypt data, paralyze operations, and exploit recovery processes, these numbers show no signs of slowing down.

The stakes are rising, and it’s increasingly evident that when disaster strikes, simply having backup isn’t enough. Organizations can’t adopt a reactive security posture and hope to function successfully. You need immutable data, intelligent detection of threats, clean recovery and testing of recovery plans, and 24/7 protection.

Commvault delivers a deeply integrated, multi-layered ransomware defense framework that prioritizes security, speed, and confidence. By combining state-of-the-art threat detection, isolation, and recovery mechanisms with partner intelligence, Commvault helps enable cyber resilience.

This article explores four components of Commvault’s ransomware defense strategy: data immutability, real-time threat scanning, validated recovery, and intelligent recovery automation. Together, these capabilities form a complete and dependable response to one of the most persistent challenges plaguing modern IT teams.

Data Immutability: The First Line of Defense

Data immutability is integral to any successful ransomware defense strategy. In a world waquí ransomware increasingly targets not just production systems but backup infrastructure itself, immutability is a critical safeguard. Commvault leverages data immutability with an array of capabilities designed to help keep your data tamper-proof. This is achieved through immutable storage, layered access controls, and enforced authorization protocols.

Here’s a closer look at Commvault’s data immutabilitycapabilities:

  • Immutable storage: Commvault implements a multi-layered approach to immutability. It combines its own software-level controls with hardware-enforced and cloud-based WORM (write-once, read-many) technologies. Retention Lock (formerly WORM Copy) prevents premature deletion or aging of backups, even by administrators, and protects against actions like removing storage policies or deleting storage libraries. This is a significant form of defense against rogue administrators or malicious attackers.
    Similarly, for hardware-enforced immutability, Commvault integrates with storage platforms that support the industry-standard S3 Object Lock API. S3 Object Lock operates in two primary modes: governance and compliance. While governance mode helps protect against accidental deletions and retains administrative flexibility, it is primarily suited for internal controls. The stricter compliance mode, on the other hand, enforces unbreakable retention periods and is designed to meet stringent regulatory requirements such as SEC Rule 17a-4, FINRA, and HIPAA 12.
    When Commvault writes backup data to an Object Lock–enabled target, such as an AWS S3 bucket or Zadara object store, it sets the Object-Lock-Retain-Until-Date metadata timestamp. Any API call to modify or delete the object before that date is rejected by the storage system, regardless of user permissions. Commvault also adds a default 7-day grace period to the WORM lock retention period configured in the software.
    Finally, on HyperScale X, Commvault’s scale-out integrated appliance, Commvault delivers immutability end-to-end using Retention Lock, a hardened OS, and an immutable file system. This integrated stack is certified for SEC 17a compliance, making it a powerful all-in-one solution for immutable storage.
  • Air Gap Protect: Air-gapped protection is delivered through a Commvault-managed, logically isolated backup environment that encrypts data, separates it from the production network, and eliminates egress charges. This feature is enabled for Commvault SaaS customers by default, helping data stay protected even if production systems become compromised.
  • Zero-trust enforcement: Commvault applies strict zero-trust principles to backup infrastructure through role-based access control, multi-factor authentication, and privileged access management. These layers limit exposure and enforce least-privilege access, reducing the impact of compromised credentials.
  • Multi-Person Authorization: To prevent malicious or accidental changes to protection policies, Commvault enforces quorum-based approvals for sensitive operations. This helps prevent a single administrator from disabling or deleting protected data without oversight.

Real-Time Threat Intelligence: Proactive Detection and Containment

Commvault’s Threat Scan suite is a cornerstone of its ransomware defense. Malicious files and programs can make their way into backups and stay hidden, waiting for the perfect opportunity to strike. So, Commvault’s real-time threat intelligence is designed to identify threats at every stage: during backup, after backup, and before restore.

Commvault is also the only cyber resilience vendor with built-in deception capabilities such as Threatwise sensors and canary files. These tools can trigger alerts while a threat actor is performing reconnaissance and before ransomware even reaches backup data.

Real-time threat detection is brought to life with these powerful features:

  • Inline, pre-, and post-backup scanning: While Threat Scan is a post-backup activity, Commvault actively monitors for ransomware indicators during inline and pre-backup stages. This includes looking for changes in attributes such as MIME type, backup size, and specific extension growth that mirror ransomware activity.
    With this comprehensive approach, whether data is in transit, newly stored, or being restored, it is continuously inspected for hidden or dormant threats. This allows early detection and helps eliminate blind spots.
  • Signature-based and AI/ML detection: Commvault leverages Avira’s anti-malware SDK, a trusted OEM engine used widely across the industry, to massively enhance its defensive capabilities. This engine includes several detection layers that combine to provide a comprehensive security approach.
    Signature-based scanning compares file hashes against Avira’s vast malware signature database. Updates occur every 24 hours to keep the engine current with emerging threats. This database is automatically updated every 24 hours via a secure connection to Avira’s update servers, providing protection against the latest cataloged threats.
    Similarly, for malware that is not yet in the signature database, the Avira engine uses heuristics to analyze the code structure, behavior, and characteristics of a file. This allows it to identify variants of known malware families and other suspicious code, even without an exact signature match.
    Finally, Machine Learning (MicroVision™), Avira’s local ML model, evaluates a broad set of code attributes and anomalies to identify previously unseen threats. It is especially effective against zero-day malware that lacks a known signature but shows signs of malicious behavior.
  • Entropy and MIME Mismatch Analysis: Commvault uses encryption detection models, consisting of multiple statistical features, to identify encrypted or disguised files. One such feature is entropy, which measures the level of randomness in data at the binary level. High entropy can indicate ransomware encryption, but it is just one of several properties used in Commvault’s encryption detection model.
    In parallel, MIME mismatch detection flags files waquí the content does not match the expected file type, such as a script disguised as a PDF. These techniques help uncover dormant threats that might otherwise go unnoticed.
  • Anomaly detection: Commvault continuously monitors for behavioral deviations. Unusual spikes in backup volume or changes in data patterns are treated as warning signs. Once these anomalies are encountered, they can be promptly investigated, helping lead to early containment.

Comprehensive Recovery: Isolated, Validated, and Automated

As ransomware grows in complexity and speed, clean recovery is imperative. With ransomware, restoring the wrong version can cause re-infection, operational downtime, or compliance failures. And it can be detrimental to company trust, confidence, and long-term success. Commvault addresses these risks with a set of validated recovery options that not only help restore clean data but also help verify its safety before it ever touches production systems.

Commvault’s Cleanroom creates a secure, isolated recovery environment for testing and validating backup data before reintroduction. This setup is ideal for running malware scans without risking spread to production. What’s more, cleanrooms are provisioned on-demand in the cloud, avoiding the need for dedicated infrastructure.

Within the cleanroom, Commvault supports a wide range of workloads, including virtual machines, file systems, and Active Directory. This flexibility allows teams to simulate live environments and fully verify operational readiness.

Cleanroom enhances Commvault’s ransomware defense:

  • Automated recovery workflows: Commvault automates the entire recovery lifecycle, from identifying clean points to final workload restoration. These workflows help reduce manual effort, provide consistency, and help teams meet aggressive recovery objectives.
  • Pave and Repave: For systems compromised at the OS level, Commvault supports pave and repave capabilities. This approach restores machines using clean operating system images, then overlays customer data from backup. It results in a fully rebuilt system free from OS-level malware or tampering.
  • Bad file indexing: During scanning, Commvault marks any infected or suspicious file versions as “bad.” These tags are automatically referenced during recovery, enabling the platform to select clean restore points without manual review.

Auto Recovery and Operational Intelligence: Fast, Orchestrated, and Scalable

Recovering clean may be the most essential aspect, but recovering fast is also a priority. Commvault’s auto recovery capabilities allow organizations to restore systems at scale with speed, confidence, and minimal manual effort. These capabilities combine intelligent orchestration, integrated scanning, and real-time visibility to drive recovery resilience.

Here’s a deeper analysis of Commvault’s automated operational intelligence solutions:

  • Auto recovery orchestration: Commvault automatically detects the most recent clean recovery point and initiates restore workflows based on pre-defined policies. These orchestrated processes eliminate guesswork and help reduce the time it takes to bring systems back online after an attack. The full Commvault auto recovery process involves automated steps detailed aquí.
  • Threat Scan integration: Recovered workloads are scanned as part of the recovery workflow before they return to production. This process enhances the confidence of restored data by helping keep it free from hidden malware or residual threats.
  • Recovery validation reports: Every recovery operation produces a detailed report that outlines scan outcomes, flagged anomalies, and any corrective actions taken. These reports give security teams invaluable visibility into what was recovered and why.
  • Security IQ dashboard: The Security IQ dashboard provides real-time insight into ransomware risk, data exposure, and overall recovery readiness. It helps administrators identify critical weak spots, track improvements, and act on changes as needed.

Ransomware Resilience When It Matters Most

Commvault’s ransomware defense architecture is an intelligent, multi-layered ecosystem. From the moment data is backed up to the second it’s restored, every layer is protected, validated, and recoverable. With a comprehensive design that encompasses every aspect of ransomware defense, Commvault gives your businesses confidence, trust, and resilience.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

La resiliencia es la esencia de todo lo que hacemos aquí en Commvault.Tal y como ya comentamos earlier this year, we are proud to partner with Warrior Canine Connection (WCC) in its mission to create resilience and strength within the veteran community.

This is a cause close to our hearts and foundational to our VALOR Employee Group’s mission to honor our veterans and increase veteran recruitment and retention, while bolstering our community outreach and building a military-friendly culture that is inclusive of all.

Over the past couple of months, we’ve been thrilled to have members of WCC, including some furry friends, join us at customer and partner events across the United States. Heidi Pius on our Sales Engineering team has witnessed the pawsitive effect these service animals have had on everyone they encounter.

“Commvault’s partnership with WCC highlights the powerful combination of innovation and resilience in supporting veterans,” Heidi said. “This partnership helps both of us further veteran resilience through the healing power of service animals.”

Here are some highlights from our events throughout the summer:

Commvault’s Annual Public Sector Partner Day – Stone Tower Winery in Leesburg, Virgina.

WCC were the capstone presenter at our Annual Public Sector Partner Day and showcased how the organization furthers veteran resilience and helps military heroes reconnect with life, their families, and their communities through the healing power of service animals.

 

AWS Summit – Washington DC

WCC added a special touch to our booth at the AWS Summit in Washington, D.C. When the service dogs weren’t present in the booth, we had people asking about them and when they would return to the booth – we even ran out of mission cards during the event.

Having WCC as part of our booth experience is not only a great marketing tool but makes the booth experience relatable on another level – adding a human element that makes it real. The handlers were excellent in telling the story of resilience from both sides.

Having an impact is fundamental to our values and our culture. We’re committed to our partnership with WCC to raise awareness and help veterans receive the support and care they deserve.

To learn more about what it’s like to work at Commvault, visit our página de empleo.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

It’s no surprise that identity infrastructure, particularly Active Directory (AD), is a primary target for attackers. According to Gartner’s Market Guide for Identity Governance and Administration, more than 90% of Global 2000 organizations rely on AD for core identity and access management.

Yet, despite its critical role as the central nervous system of enterprise IT, AD security is often neglected, leaving it vulnerable to sophisticated attacks that can bring an entire organization to its knees.

The consequences of a compromised AD can be catastrophic, including widespread operational disruption, significant data loss, and a complete loss of trust. When attackers gain control of AD, they hold the keys to the kingdom – and they are able to move laterally, escalate privileges, and deploy ransomware with devastating efficiency.

Best Practices for Future-Proof AD Resilience

Achieving true AD resilience requires a strategic blend of proactive defence, meticulous planning, and robust recovery capabilities. This is not merely about having backups; it’s about cultivating a resilience-first mindset and implementing a multi-faceted strategy.

1. AD forest recovery: Planning for the worst-case scenario

A complete forest recovery remains the ultimate test of AD resilience. This involves the ability to restore the entire AD environment to a known-good state after catastrophic corruption or compromise.

  • Maintain regular, offline backups of all domain controllers.
  • Document and periodically validate the forest recovery process through tabletop exercises and simulations.
  • Leverage tools like Microsoft’s AD Forest Recovery Guide or third-party automated solutions that reduce recovery time.
  • Recovery images should remain secure, offline, and immutable.

Without these preparations, organizations risk prolonged outages, as recovering AD manually without a plan can be highly complex, error-prone, and time-consuming.

2. Entra ID recovery: Protecting and recovering break-glass accounts

Beyond restoring the forest, organizations should build resilience through Entra ID recovery – protecting and rapidly recovering break-glass accounts used in emergencies.

  • Maintain dedicated, highly secure and monitored administrative accounts that are disconnected from regular directory services (Tier-0 accounts).
  • Store credentials for these accounts in secure vaults (e.g., CyberArk, Azure Key Vault) with strict access controls.
  • Regularly rotate credentials and audit access logs.
  • Simulate account lockout or compromise scenarios to validate the recovery process.
  • Entra IDs have to be excluded from regular AD sync processes with cloud environments to reduce exposure.

These accounts should be protected as crown jewels since their compromise could derail recovery efforts entirely.

3. Proactive hardening and monitoring

This forms the bedrock of any effective AD security program. Organizations should implement a tiered access model to enforce the principle of least privilege, so that users and administrators only have access to the resources absolutely necessary for their roles.

Regularly auditing for misconfigurations, such as weak password policies or excessive permissions, is crucial. Furthermore, deploying advanced threat detection and response solutions provides real-time visibility into suspicious activities, helping enable security teams to identify and neutralize threats before they can escalate.

4. Immutable backup and recovery readiness

Backups should be stored in an immutable, air-gapped location to protect against encryption or deletion by ransomware. This provides a clean recovery point.

Recovery readiness goes a step further by regularly validating the integrity and recoverability of these backups. By automatically testing the recovery process in an isolated environment, organizations can confirm that their backups are not only safe but also fully functional, reducing the risk of a failed recovery during a real crisis.

A Unified Front: The HCLTech and Commvault Joint Solution

HCLTech and Commvault have forged a powerful partnership to deliver a comprehensive, end-to-end identity resilience solution that automates forest-level recovery for AD, helping reduce downtime from days or weeks to hours. With Commvault and HCLTech, customers can expect:

  • Knowledge and strategic guidance from the experts at HCLTech to design, implement, and sustain a resilient AD environment aligned with zero-trust principles.
  • Proactive hardening, regular testing, and continuous monitoring.
  • A comprehensive, tailored recovery plan that includes automated forest-level recovery enabled by the industry-leading capabilities of Commvault Cloud.
  • Unified protection of hybrid identity systems (AD + Entra ID) that simplifies operations and reduces tool sprawl, enabling consistent security across environments.

Together, HCLTech and Commvault provide a truly holistic approach to identity security and business continuity. By combining Commvault’s rapid, automated recovery technology with HCLTech’s strategic, security-first services, organizations are equipped not just to survive an AD-related disaster, but to emerge stronger.

This unified front helps keep your most critical identity infrastructure ready for the worst-case scenario, delivering a rapid, clean, and reliable recovery when it matters most. Don’t wait for a crisis to test your defenses. The time to act is now. Take the first step toward true AD resilience and help your organization prepare for any eventuality.

To learn more and demo the solution, visit the página de la solución de Active Directory.

 

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

At Commvault, we believe that the well-being of our employees is fundamental to our success as a company. That’s why we’re committed to providing a comprehensive approach to wellness that addresses the various aspects of our Vaulters’ total wellbeing.

Recognizing that wellness encompasses more than just physical health, we’ve developed a multi-faceted approach that includes medical, financial, and physical wellness initiatives.

Presentamos una plataforma integral de bienestar

We’re thrilled to have recently launched our new wellness platform, CommWell. This innovative platform consolidates various wellness-related benefits into a single, user-friendly interface, making it easier for our employees to access the resources they need to maintain and improve their health. The platform offers a range of features, including:

  • Evaluaciones sanitarias para identificar áreas de mejora.
  • Planes de bienestar personalizados adaptados a las necesidades individuales.
  • Herramientas interactivas para seguir los progresos y fomentar hábitos saludables.

Al simplificar la gestión de las prestaciones de bienestar, nos esforzamos por dar a nuestros empleados, independientemente de su ubicación, acceso al apoyo que necesitan.

Apoyo a la salud mental con Spring Health

We understand that mental health is just as important as physical health. That’s why we’ve partnered with Spring Health, a global provider of mental health support services. Its comprehensive platform offers more than just traditional EAP services, providing:

  • 6 sesiones de asesoramiento para abordar problemas específicos de salud mental.
  • 6 sesiones de coaching para apoyar el crecimiento personal y profesional.
  • Acceso a un centro de cursos y recursos para el desarrollo continuo.

Fomentar el bienestar financiero con Origin

El estrés financiero puede tener un impacto significativo en el bienestar general. Para ayudar a aliviar esta carga, ofrecemos los servicios financieros de Origin, que proporcionan a los empleados acceso gratuito a asesores financieros y planificadores financieros certificados. La plataforma de Origin ofrece orientación especializada sobre una amplia gama de temas, entre los que se incluyen:

  • Estrategias y planificación fiscales.
  • Premios en acciones y optimización de los beneficios empresariales.
  • Presupuestos y gestión de tesorería.
  • Selección de inversiones y planificación de la jubilación.
  • Análisis de riesgos y planificación de seguros.

Additionally, Origin’s AI Budget Builder (currently available in the U.S. and soon to be expanded globally) provides a cutting-edge tool for managing finances.

Fomentar el bienestar físico con Wellhub

El ejercicio regular, la nutrición saludable y la atención plena son componentes esenciales del bienestar general. Para apoyar estos aspectos, ofrecemos acceso a Wellhub, una aplicación digital que proporciona una serie de recursos de fitness, nutrición y atención plena. En determinadas sedes, los empleados también pueden inscribirse en gimnasios por niveles, lo que facilita la incorporación de la actividad física a su rutina diaria.

Una cultura de atención y apoyo

At Commvault, we’re committed to creating a culture that prioritizes employee wellness and encourages our employees to value their wellbeing. By providing a comprehensive range of wellness initiatives, we’re empowering our teams to deliver for themselves first, which in turn allows them to thrive both personally and professionally.

To learn more about what it’s like to work at Commvault, click aquí.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

The Australian Security of Critical Infrastructure Act 2018 (SOCI) is the cornerstone of the government’s strategy to manage risks to critical infrastructure. Its objectives are to confirm operators of essential infrastructure assets take appropriate security measures and to give government the information and powers to respond to threats.

Originally targeting just four sectors (electricity, gas, water, and ports), SOCI has since been expanded to cover 11 sectors across the economy. The act aims to keep critical infrastructure assets and services across these 11 sectors protected and resilient against disruptions to Australia’s security, economy, and society.

To achieve this, the Act imposes obligations on critical-asset owners, via the form of Positive Security Obligations (PSOs), Enhanced Cyber Security Obligations (ECSOs), and Government Assistance Measures.

For example, responsible entities must register asset details and maybe required to report cyber incidents to the Australian Cyber Security Centre (ACSC) and maintain a formal risk management program known as a Critical Infrastructure Risk Management Program (CIRMP). Assets deemedSystems of National Significance could face even stricter requirements, including, for example, mandatory incident response plans, cyber exercises, and vulnerability assessments. SOCI essentially codifies what was once considered industry best practice into enforceable law.

Dos campos de impacto: sectores heredados frente a nuevos competidores

Es probable que los sectores originalmente regulados vean SOCI como una extensión de los marcos existentes. Durante décadas, la energía y los servicios públicos han operado bajo rigurosas normas de fiabilidad y seguridad (como los códigos NEM o las leyes de seguridad del agua), por lo que la formalización de estas prácticas dentro de SOCI puede parecer una continuación de la gobernanza existente.

Por el contrario, las organizaciones de los sectores incorporados más recientemente, como las comunicaciones, el almacenamiento y el tratamiento de datos, la sanidad, la educación superior y el transporte, se enfrentan a un nuevo panorama normativo. Estos sectores suelen carecer de un historial de regulación en materia de infraestructuras, lo que significa que el cumplimiento de la normativa SOCI requiere crear muchos procesos desde cero. Esto incluye la creación de registros de activos, la elaboración de planes CIRMP, la implantación de controles y la formación de los equipos en los procedimientos de notificación de incidentes.

Por ejemplo, una red universitaria u hospitalaria puede verse ahora clasificada como operador de infraestructuras críticas, lo que le obliga a identificar los activos cubiertos, evaluar las dependencias e implantar un CIRMP conforme.

This often involves building formal security governance from the ground up – aligning to frameworks such as the ASD Essential Eight, ISO 27001, or the NIST Cybersecurity Framework – and establishing mechanisms for timely incident detection, response, and reporting to the ACSC.

By contrast, operators in traditionally regulated sectors may already have mature risk programs in place and can adapt existing controls to meet SOCI’s requirements. Regardless of sector, all organisations must now integrate cyber risk management into core business processes, not treat it as a parallel or isolated activity.

OT y el reto de la convergencia de TI

A significant challenge presented by SOCI lies in securing Operational Technology (OT) environments: the industrial control systems that underpin many critical assets. OT brings its own set of risks.

Muchos dispositivos nunca se diseñaron pensando en la ciberseguridad. A menudo ejecutan sistemas operativos o firmware obsoletos que no pueden parchearse fácilmente y utilizan protocolos propietarios o heredados, como Modbus, DNP3 o Profibus, que carecen de autenticación y cifrado básicos.

Al mismo tiempo, la convergencia de las redes de TI y OT ha ampliado la superficie de ataque. Entornos antes aislados están cada vez más conectados a los sistemas informáticos de la empresa y a Internet para permitir la supervisión remota, el análisis y la automatización. Esto crea nuevas vías para que los atacantes se muevan lateralmente entre entornos e introduce el riesgo de interrupción operativa por ciberataques.

Los operadores industriales deben encontrar un equilibrio entre la disponibilidad de los sistemas y la ciberprotección. Desconectar los sistemas para actualizarlos o segmentarlos puede interferir en las operaciones, pero dejarlos expuestos aumenta el riesgo.

SOCI anima a las organizaciones a adoptar estrategias específicas de OT. Estas pueden incluir una segmentación estricta de la red, acceso con mínimos privilegios, supervisión fuera de banda y diseños a prueba de fallos para proteger estos entornos.

Proveedores de servicios de datos y obligaciones de notificación

One of the lesser-discussed but critically important elements of SOCI is the responsibility to notify data service providers. If a third party stores or processes business-critical data related to your regulated asset, you are obligated to inform them that SOCI applies. This verifies that your service providers understand their role in protecting critical data and are prepared to support you during an incident or audit.

In addition, incident notification is a central requirement of SOCI. A cyber security incident that has a significant or relevant impact on your essential services must be reported to the ACSC within strict timeframes. If the impact is significant, notification must occur within 12 hours. For relevant but lower-severity incidents, notification is required within 72 hours.

No se trata de una actividad voluntaria o de máximo esfuerzo. Es una obligación legal. La notificación oportuna proporciona a la ACSC visibilidad sobre las amenazas a los sistemas nacionales, lo que le permite coordinar respuestas oportunas y eficaces. También refuerza el principio de que la protección de las infraestructuras críticas es una responsabilidad compartida entre la industria y el gobierno.

Más allá de la prevención: el verdadero significado de la resiliencia

Many organisations still interpret resilience as the ability to block or prevent threats. But true resilience goes beyond prevention. It is the ability to absorb shocks, recover quickly and continue operating, even under adverse conditions. SOCI pushes organisations to embrace this broader definition.

Resiliencia significa disponer de planes de recuperación probados, copias de seguridad offline fiables, sistemas redundantes y un manual para volver al servicio durante o después de un incidente. También implica una mejora continua, aprender de cada incidente, adaptar las defensas y solucionar las lagunas antes del próximo ataque.

Esto es especialmente importante dadas las tendencias recientes.Los informes de la Dirección Australiana de Señales(ASD) y otros organismos gubernamentales muestran que están aumentando los incidentes cibernéticos que afectan a sectores como el agua, la energía y el transporte.

Incluso los sucesos relativamente menores pueden causar efectos dominó en sistemas interdependientes, afectando a las cadenas de suministro, la seguridad pública y los servicios esenciales. Estas tendencias ponen de relieve la urgencia de un enfoque centrado en la recuperación.

Los CISO deben liderar la iniciativa para que la ciberresiliencia sea algo más que una casilla de verificación. Esto significa tratar la resiliencia como una capacidad dinámica e integral que implica que las personas, los procesos y la tecnología trabajen conjuntamente.

Un cambio normativo con ventajas estratégicas

SOCI has represented a significant shift in Australia’s approach to cyber regulation. It moves beyond fragmented, voluntary approaches and creates a cohesive national framework for protecting critical infrastructure. While it certainly has introduced new complexity, reporting burdens, and compliance costs, it also provides an opportunity for organisations to elevate their security maturity and embed resilience at the core of their operations.

Rather than viewing SOCI as merely a compliance task, forward-thinking CISOs can treat it as a strategic catalyst. It provides board-level backing for investment, formalises risk practices, and improves alignment between business and security. The inclusion of government assistance measures and threat-sharing mechanisms further positions SOCI as a collaborative tool, not just a mandate.

As threats evolve and digital infrastructure becomes more embedded in national life, resilience must be the priority. SOCI sets the stage. Now it’s up to us to act.

Más información sobre sus obligaciones enGuía de la Ley SOCI.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more

The Security Standard That’s Reshaping Business Strategy

While most organizations view FedRAMP High as a compliance hurdle – a necessary evil for selling to federal agencies – forward-thinking enterprises are discovering something remarkable: This rigorous security framework isn’t just about meeting government requirements.

FedRAMP High serves as a smart security blueprint for the private sector, and we’re seeing this translate into something even more powerful – a strategic foundation for building the kind of cyber resilience that transforms businesses from the inside out.

The bottom line: Organizations implementing FedRAMP High controls alongside enterprise data resilience strategies aren’t just checking compliance boxes – they’re gaining massive operational efficiencies, cost savings, and competitive advantages that extend far beyond government contracts.

Por qué FedRAMP High y Zero Trust son inseparables

Here’s what’s resonating across the federal sector and bleeding into commercial enterprises: FedRAMP High controls and zero-trust architecture aren’t separate initiatives– they’re interdependent foundations that enable cyber resilience.

Think about it: How can any organization – federal agency or Fortune 500 company – achieve genuine zero trust without the stringent controls that FedRAMP High demands? FedRAMP High requires cloud providers to meet over 400 security controls, creating the robust foundation that zero-trust principles require to function effectively.

El gobierno federal ha reconocido esta interdependencia, y las soluciones de confianza cero ya han obtenido la autorización FedRAMP High, lo que demuestra que estos marcos funcionan mejor cuando se aplican conjuntamente, no como prioridades contrapuestas.

La ventaja de la resiliencia de los datos: más allá de la seguridad, hacia el valor empresarial

When organizations implement FedRAMP High controls with an enterprise approach to data resilience – encompassing both protection and management – something powerful happens: They simultaneously enable cyber resilience for their organization’s most critical asset – data.

Este enfoque aporta un valor transformador en tres dimensiones fundamentales:

1. People: Consolidation and Cost Efficiency

En lugar de gestionar múltiples soluciones puntuales y formar al personal en sistemas dispares, las organizaciones se consolidan en una única plataforma global de gestión de datos. ¿El resultado? Una reducción de los costes de personal y una simplificación de las operaciones, ya que los equipos pueden centrarse en iniciativas estratégicas en lugar de gestionar conjuntos de herramientas complejos y fragmentados.

2. Process: Automation and AI-Driven Viability

FedRAMP High’s rigorous controls, when paired with modern data resilience platforms, enable organizations to automate critical processes and integrate AI capabilities from a position of strength. This automation helps maintain minimum viable operations during disruptions and maintain the highest security standards.

3. Technology: The Foundation for Modernization

High-security compliance using the right architecture and technology doesn’t just help build cyber resilience – it creates enormous operational efficiencies that become the basis for modernization and competitive advantage.

Impacto en el mundo real: eficiencia gubernamental en acción

This isn’t theoretical – organizations are already seeing these benefits. Government agencies are recognizing solutions that meet FedRAMP High requirements while delivering the cost efficiency of SaaS, with enterprise approaches eliminating redundant legacy software tools and enabling significant operational savings.

This isn’t just a government success story. It’s a preview of what commercial enterprises can achieve when they stop viewing FedRAMP High as a burden and start seeing it as a strategic advantage.

El despertar del sector privado

Private sector organizations are increasingly recognizing that FedRAMP compliance offers high trust and oversight, enhances security, and provides a competitive edge. Companies in highly regulated industries – finance, healthcare, insurance, and defense contractors – are discovering that FedRAMP-compliant vendors often carry over lessons learned in their FedRAMP environments to their commercial environments, resulting in improved security postures, streamlined compliance efforts, and enhanced operational efficiency.

The smart money isn’t waiting for regulatory mandates. Many companies intentionally seek out FedRAMP Authorized cloud providers for their services even when they aren’t governmental agencies, specifically because they’re aware that FedRAMP is a high standard and that any cloud service provider willing to go through the work to adhere to it takes security seriously.

Tres imperativos estratégicos para las empresas modernas

1. Treat FedRAMP High as a business accelerator, not a compliance tax.

Organizations that view FedRAMP High controls as the foundation for a comprehensive data resilience strategy gain operational efficiencies that more than offset implementation costs. The framework’s rigorous requirements force organizations to eliminate redundancies, consolidate systems, and optimize processes.

2. Implement data resilience and zero trust as integrated systems.

La arquitectura de confianza cero verifica el contexto disponible en el momento del acceso, incluyendo tanto la información estática del usuario como la información dinámica, así como la geolocalización y las credenciales, la sensibilidad de los datos y el recurso, las anomalías de acceso y si la solicitud está permitida en función de las reglas de negocio. Cuando este enfoque se aplica a la resiliencia de los datos empresariales, las organizaciones ganan visibilidad y control sobre sus activos más valiosos.

3. Choose technology partners with proven FedRAMP High capabilities.

La selección de un proveedor de SaaS que cumpla con FedRAMP puede agilizar considerablemente el proceso de contratación pública, ya que ofrece una lista de proveedores previamente evaluados que ya cumplen con estrictos estándares de seguridad, lo que permite ahorrar tiempo, reducir el riesgo y simplificar el proceso de toma de decisiones.

La realidad competitiva: la seguridad como ventaja estratégica

The most successful organizations of the next decade won’t be those that treat security as a cost center or compliance checkbox. They’ll be those that recognize FedRAMP High controls as the foundation for building truly resilient, efficient, and competitive operations.

The security and regulatory compliance of cloud services are paramount. Organizations that master this intersection of security, compliance, and operational efficiency aren’t just protecting themselves – they’re positioning themselves to win in an increasingly complex and dangerous digital landscape.

El camino a seguir: del cumplimiento a la ventaja competitiva

Las organizaciones que implementan hoy estrategias de resiliencia de datos empresariales con controles FedRAMP High están descubriendo algo notable: los mismos marcos que ayudan a proteger contra las amenazas cibernéticas también impulsan la excelencia operativa, la rentabilidad y la diferenciación competitiva. Tu organización puede elegir entre implementar los estándares FedRAMP High estratégicamente para obtener el máximo valor empresarial, o reactivamente como una ocurrencia tardía de cumplimiento.

The epiphany is clear: FedRAMP High isn’t just a security program – it’s a blueprint for building the kind of resilient, efficient, and competitive organization that thrives in our digital-first world.

Ready to transform your data resilience strategy? Learn how Commvault’s enterprise approach to data protection and management can help your organization achieve de FedRAMP Highmientras impulsa la excelencia operativa y la ventaja competitiva.

More related posts

Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more
Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more