Security does not end at the edge of an organization’s own systems. Modern businesses connect a growing web of third-party applications to their core platforms to support sales, service, and collaboration. Each of these connections adds value. Each one also introduces exposure the organization does not fully control.That risk is not hypothetical. In June 2026, a threat actor compromised OAuth tokens tied to Klue, a competitive intelligence platform used to sync sales and marketing data with Salesforce. The attacker used those tokens to reach the Salesforce environments of the many organizations that had authorized the integration, including Commvault’s.As soon as we were notified of potential impact, our Security team activated our incident response process to determine what had occurred, contain the exposure, and assess whether customer information or Commvault services were affected.Our investigation found that the activity was limited to certain business relationship and sales information maintained within our Salesforce environment. The investigation found no indication that any customer backup data, product data, product metadata, operational logs, or Commvault services were impacted.

Acting Quickly When It Matters

Our response followed established security incident response procedures built to contain risk quickly while supporting a thorough investigation. Once we were notified of the incident, we disabled the Klue integration, revoked the associated access, and worked with the appropriate parties to conduct a full assessment of what happened.Throughout the investigation, our teams worked to determine what information had been accessed, validate the integrity of our environment, and confirm the incident stayed within the scope we had already contained.

A Pattern Worth Noting

This incident is one recent example of a pattern security teams have watched grow for several years: attackers targeting third-party applications connected to core business systems rather than attacking those systems directly. A single compromised integration can offer a trusted path into the environments of many downstream organizations at once, often with less resistance than a direct attack on any one of them.This shifts where an organization’s defense actually has to live. Strong internal controls remain necessary, but they are no longer sufficient by themselves. They have to be paired with active oversight of every application an organization connects, and a response capability that is ready before an incident, not built during one.

Building Resilience Beyond Our Own Environment

At Commvault, our security program includes ongoing assessment of the third-party applications connected to our environment. We review connected applications on a regular basis, evaluate the access each one holds, monitor for emerging risk, and reassess those integrations as business needs and the threat landscape change. When circumstances warrant, we act to reduce exposure and strengthen our posture, including disconnecting integrations that no longer meet our standards.

Our Commitment to Transparency

Trust is built through openness and accountability. When an event affects our stakeholders, we believe it is important to communicate what we know, explain how we responded, and share the outcome of our investigation, even when the event originated outside our own systems.We will continue to evaluate our security controls, refine our incident response processes, and strengthen our approach to third-party risk as part of our broader commitment to protecting our customers and partners.For the official details of this incident, including the scope of the investigation and customer guidance, please refer to ourTrust Center Updates.Will Galway is Deputy CISO at Commvault.

Durante años,la criptografía poscuántica (PQC) sat comfortably in the category of “important, but not urgent.”

Security leaders knew it was coming. Researchers talked about it. Standards bodies worked on it. Most organizations acknowledged that it would eventually require attention. But I would argue that the time to start preparing is now.
In this episode of STRIVE, I sat down with Sr. Director of Portfolio Marketing Michael Fasulo to discuss why the conversation around PQC is changing so quickly – and why the organizations that wait for certainty may find themselves running out of time.
Watch the episodio completo.

Puntos Clave

• Harvest Now, Decrypt Later attacks mean sensitive data is already at risk, even if quantum capabilities aren’t stable or commercially viable yet.
• La mayoría de las organizaciones no tienen una visión completa de su inventario criptográfico, lo que convierte la detección en el primer gran obstáculo.
• La PQC supone tanto un reto tecnológico que hay que resolver como una cuestión de priorización de riesgos.
• Las organizaciones que empiecen a prepararse ahora tendrán más opciones para ajustar sus prioridades que aquellas que se vean obligadas a reaccionar más tarde.

The Problem Isn’t the Technology

Most discussions about la criptografía poscuántica start with technology.

• ¿A qué ritmo avanza la computación cuántica?
• ¿Cuándo serán viables los sistemas cuánticos relevantes desde el punto de vista criptográfico?
• ¿Qué algoritmos tienen más probabilidades de sobrevivir a largo plazo?

Those are important questions. But they’re not the questions I would prioritize asking. Michael wrote a el about PQC and we discussed today how several things have changed since then.
Over the past several years, estimates have consistently moved in one direction: what once felt distant now feels increasingly close. At the same time, standards are evolving; regulatory expectations are increasing, and organizations are beginning to recognize how much cryptographic debt they’ve accumulated over the decades.
The exact date of Q-Day may remain uncertain. The direction of travel is not.

sobre la criptografía poscuántica (PQC) y hoy hemos comentado cómo han cambiado varias cosas desde entonces.

En los últimos años, las estimaciones han apuntado sistemáticamente en una misma dirección: lo que antes parecía lejano ahora se percibe cada vez más cercano. Al mismo tiempo, las normas están evolucionando; las expectativas normativas son cada vez mayores y las organizaciones están empezando a reconocer la enorme deuda criptográfica que han acumulado a lo largo de décadas.

La fecha exacta del «Q-Day» puede seguir siendo incierta. La dirección en la que avanzamos, en cambio, no lo es.

One reason this conversation has become more urgent is the growing attention around Harvest Now, Decrypt Later attacks. The concept is straightforward: An adversary gains access to encrypted information today, stores it, and waits for future capabilities to make that information readable.
What’s important here is that the risk doesn’t begin when quantum computing arrives. The risk begins when even encrypted data is exfiltrated and stored.
For organizations protecting intellectual property, healthcare records, government information, or other sensitive long term retention data, that distinction changes everything.
Organizations need to know whether data being retained today will still matter when that future arrives.
For many,esp. the highly regulated industries and critical infrastructure, the answer is yes.

Una de las razones por las que este debate ha cobrado mayor urgencia es la creciente atención que suscitan los ataques del tipo «Harvest Now, Decrypt Later» (Recoger ahora, descifrar más tarde). El concepto es sencillo: un atacante obtiene acceso a información cifrada hoy, la almacena y espera a que surjan capacidades futuras que permitan leerla.

Lo importante aquí es que el riesgo no comienza cuando llega la computación cuántica. El riesgo comienza en el momento en que se extraen y almacenan datos, incluso si están cifrados.

Para las organizaciones que protegen la propiedad intelectual, los historiales médicos, la información gubernamental u otros datos sensibles que deben conservarse a largo plazo, esa distinción lo cambia todo.

Las organizaciones deben saber si los datos que se conservan hoy seguirán siendo relevantes cuando llegue ese futuro.

Para muchas, especialmente en los sectores altamente regulados y las infraestructuras críticas, la respuesta es sí.

Embed clip here: https://www.youtube.com/watch?v=A3YWU5rlmGA

In this clip, Michael explains why PQC isn’t a one-time fix or switch. The real goal is crypto agility – building the flexibility to adapt cryptographic algorithms as standards, and threats evolve. Because in cybersecurity, the challenge isn’t just preparing for what’s next. It’s being ready for what comes after that.

En este vídeo, Michael explica por qué la PQC no es una solución o un cambio puntual. El verdadero objetivo es la agilidad criptográfica: desarrollar la flexibilidad necesaria para adaptar los algoritmos criptográficos a medida que evolucionan los estándares y las amenazas. Porque, en ciberseguridad, el reto no consiste solo en prepararse para lo que viene a continuación, sino en estar preparados para lo que venga después de eso.

One misconception about PQC is that it’s primarily an encryption upgrade. In reality, most organizations haven’t reached the stage where replacement is the biggest concern.
They’re still trying to understand the scope of the problem. Cryptography exists everywhere.

• Aplicaciones
• Aplicaciones
• Certificados
• Servicios cloud
• API
• Firma de código

Many organizations struggle with the creation of the cryptographic inventory or its scope. That makes discovery one of the most important – and often underestimated – parts of the journey.
And for many enterprises, that’s a much larger endeavor than expected.

Muchas organizaciones tienen dificultades para crear el inventario criptográfico o definir su alcance. Eso convierte el descubrimiento en una de las partes más importantes —y a menudo subestimadas— del proceso.

Y para muchas empresas, se trata de una tarea mucho más ardua de lo esperado.

Another reason PQC has become a priority is that no organization will navigate this transition alone. Modern enterprises depend on vendors, cloud providers, software partners, and countless third parties, all of whom use cryptography.
That means quantum readiness extends beyond internal systems. It becomes a question of ecosystem readiness.

• Otra razón por la que la PQC se ha convertido en una prioridad es que ninguna organización afrontará esta transición en solitario. Las empresas modernas dependen de proveedores, proveedores de servicios en la nube, socios de software e innumerables terceros, todos los cuales utilizan criptografía.

  Esto significa que la Readiness para la era cuántica va más allá de los sistemas internos. Se convierte en una cuestión de Readiness del ecosistema.

• ¿Se están preparando los proveedores?
• ¿Están los proveedores críticos planificando las migraciones?

These questions will increasingly become part of risk conversations, procurement discussions, and long-term technology planning. Because cryptography doesn’t stop at organizational boundaries. Neither does risk.

Estas preguntas formarán parte cada vez más de las conversaciones sobre riesgos, los debates sobre adquisiciones y la planificación tecnológica a largo plazo. Porque la criptografía no se detiene en los límites de la organización. Tampoco lo hace el riesgo.

The most important takeaway from this discussion is that la criptografía poscuántica is no longer a future technology challenge.
It’s becoming a present-day resilience conversation.
Organizations don’t need to panic and they don’t need to overhaul every system overnight. But they do need to begin, to make the best use of the time at their disposal for prepartion.
The organizations that navigate this transition successfully won’t necessarily be the ones with the most sophisticated cryptography. They’ll be the ones that started building understanding before certainty arrived.
And that’s often how resilience works.

Watch the Full Episode

There is plenty more that Michael and I explore in the episode that I didn’t capture above. Be sure to Hay mucho más que Michael y yo analizamos en el episodio y que no he mencionado anteriormente. No te lo pierdas para conocer:Los mayores retos a los que se enfrentan las organizaciones al iniciar su camino hacia la PQC.

• Lo que los líderes deberían priorizar hoy en día, incluidas algunas buenas prácticas.
• La comprensión de los algoritmos MLKEM y la agilidad criptográfica.
• Consideraciones sobre la infraestructura para la PQC.
• Cómo se está preparando Commvault para este futuro.
• Preguntas frecuentes

FAQs

Q: What is la criptografía poscuántica (PQC)?
A: PQC refers to cryptographic algorithms designed to help remain secure against attacks from future quantum computers.
Q: What is Harvest Now, Decrypt Later?
A: It’s a strategy where attackers collect encrypted data today with the intention of decrypting it later when more advanced computing capabilities become available.
Q: Why are organizations focusing on PQC now?
A: Because preparation takes years, and sensitive data collected today may still be valuable when quantum threats become practical.
Q: What is the biggest challenge organizations face?
A: Discovery. Most organizations do not have complete visibility into where cryptography is used across their environments.
Q: Do organizations need to replace all cryptography immediately?
A: No. Most experts recommend starting with inventory, discovery, and prioritization before planning broader migrations.
Q: What should leaders do first?
A: Identify long-lived sensitive data, understand cryptographic dependencies, and begin building a roadmap for future transition.
 

Vidya Shankaran is Field CTO at Commvault.

To address mandates governing where their data is stored and used,many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography,that no foreign-jurisdiction personnel accessed it,and that they can recover it within 24 hours under incident conditions.

In a recent webinar,I joined Commvault GM Alex Zinin,who leads our digital sovereignty task force,along with Jakub Lewandowski,our associate general counsel for EMEA,and Pranay Ahlawat,our chief technology and AI officer,to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.

See the full webinarand get the fullLa soberanía digital,al descubiertoreadiness report and implementation framework.

Puntos Clave

• The EU Cloud Sovereignty Framework defines eight sovereignty objectives,only one of which concerns data location.
• Selecting a sovereign cloud region addresses where data lives,but not who can access it,under what legal authority,or whether you can recover it under real conditions.
• A complete sovereignty posture spans four interdependent pillars: data locality,technological sovereignty,operational sovereignty,and jurisdictional sovereignty.
• Sovereignty programs that treat recovery architecture separately from primary data governance carry an unexamined risk that can surface during incidents.
• Rather than a policy of maximum sovereignty at any cost,organizations should design their strategy around minimum viable sovereignty: the right controls,consistently enforced,calibrated to actual obligations.

Digital Sovereignty Becomes an Enterprise Requirement

Over the past decade,the toughest digital and data sovereignty rules have mainly applied to government,defense,and other national‑security workloads. Outside of highly regulated sectors,many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.

That’s now changing. RGPDenforcement has matured beyond guidance into substantial fines for operational failures,and newer regimes likeDORA,NIS2,Germany’s KRITIS rules,and the EU Data Act have tightened expectations around jurisdictional control and operational resilience.

Sovereignty questions are now surfacing in RFPs,M&A due diligence,and board‑level risk reviews as well.

The EU Cloud Sovereignty Framework,published in October 2025,clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives,only one addresses where data resides. The other seven cover access control,operational dependencies,jurisdictional exposure,and recovery.

For enterprises,this structure is now the lens through which vendor capabilities must be evaluated.

Sneak Peek: Rethinking Sovereignty and Resilience

In this moment from the webinar,Jakub discusses how sovereignty is a risk posture,rather than a single product. Organizations need a holistic strategy that combines architecture,operations,governance,auditability,and recovery planning to address it.

Data Residency Does Not Equal Sovereignty

Data residency only answers questions about where. Sovereignty regulations also require being able to explainwho,how,and under what conditions.

In practical terms,a complete sovereignty posture encompasses four interdependent pillars.

1. Data Locality

This pillar covers not just where data is stored,but where it travels. Control-plane artifacts,metadata,and telemetry can cross geographic boundaries even when primary data stays in-region.

2. Technological Sovereignty

This pillar addresses whether the organization controls the mechanisms that protect data:

• How access is granted.
• How data is encrypted.
• Whether encryption key custody is retained under all conditions.

A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK),where an organization’s own encryption keys are managed within the provider’s platform,and Hold Your Own Key (HYOK),where the organization retains independent custody of keys entirely outside the provider’s environment.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.

3. Operational Sovereignty

This covers who operates the environment and from where,including whether support personnel or third-party vendors are subject to foreign jurisdiction.

4. Jurisdictional Sovereignty

This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access,such as the cross-border situations discussed in the U.S. CLOUD Act.

Each of these pillars is essential to maintain compliance. A strong data locality posture with weak operational controls can allow unexamined risk.

Where Digital Sovereignty Programs Break Down

My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation,it gets too narrow,too quickly. Workshops zoom in on where data lives,teams get to work on that one question,and then they move on,leaving the other three pillars largely unexamined.

Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal,technical,and operational stakeholders,not as an IT project that gets checked off as complete.

Organizations can also be led astray by a few myths. One,as we’ve discussed,is the impression that sovereignty equals residency.

Then there’s the myth of absolute sovereignty,the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice,sovereignty always involves tradeoffs between control,cost,technological velocity,and the ability to innovate.

The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy,but a risk posture built from architecture,operations,contracts,certifications,and continuous auditability.

Resilience Belongs Inside the Sovereignty Boundary

Operational sovereignty is thehardest pillar to audit and the one most commonly underestimated. If your environment needed access for routine maintenance tonight,who would perform it,from which country,and under which legal jurisdiction?

Most organizations,when they work through that question for the first time,find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure,restoration sequencing,and recovery point management under a separate – and often weaker – set of controls. When an incident occurs,recovery personnel may not meet jurisdictional requirements,and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.

Commvault’s resilience operations model,ResOps™,addresses this need directly by framing recovery as an ongoing operational discipline that needs to be designed,tested,and validated inside the same sovereignty boundary as the data it protects.

Minimum Viable Sovereignty: The Right Level of Control,Not the Maximum

An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.

A payroll system,a customer transaction database,and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.

Minimum viable sovereignty sets a more practical target: the right controls,consistently enforced and continuously demonstrated,calibrated to what each workload actually requires across all four pillars.

Organizations have a broad range of options for how sovereign controls are delivered across their environment,each providing different controls.

How Commvault Is Addressing the Digital Sovereignty Issue

Commvault’s Geo Shield framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU,Geo Shield maps to the full spectrum of deployment models:

• Regional sovereign cloud services delivered as SaaS
• Hyperscaler sovereign-launch partnerships
• Partner-operated national sovereign offerings built with local service providers
• Fully customer-controlled private sovereign environments qualifying under frameworks likede FedRAMP High.

In this way,organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.

Watch the Full Webinar and Get the Readiness Report

In the full webinar,available on demand,you’ll discover:

• Why digital sovereignty is more than a technology solution.
• The role of architecture and operations in sovereignty strategy.
• How governance,contracts,and auditability impact resilience.
• Why sovereignty must hold up during cyber incidents and outages.
• The importance of a holistic,risk-based approach to sovereignty.

Ver el seminario weband get the fullLa soberanía digital,al descubiertoreadiness report and companion framework.

Preguntas frecuentes

Q: What is the difference between data residency and digital sovereignty?

A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data,under what legal authority,through which operational pathways,and whether it can be recovered cleanly under real conditions.

An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel,vendor access agreements,or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.

Q: What is the EU Cloud Sovereignty Framework,and why does it matter?

A: TheEU Cloud Sovereignty Frameworkis a structured assessment tool developed by the European Commission to evaluate cloud and technology providers against sovereignty criteria during procurement processes.

It defines eight sovereignty objectives,with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls,key custody,jurisdictional exposure,and recovery.

The framework represents the most comprehensive public framework for evaluating sovereignty posture and is increasingly being used as a reference by other regions and procurement bodies beyond the EU.

Q: What is the difference between BYOK and HYOK,and why does it matter for sovereignty?

A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys,but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment,including under crisis conditions or legal compulsion.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The U.S. CLOUD Act,for example,can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.

HYOK addresses that exposure directly,though it may require a higher platform tier in SaaS deployments.

Q: Why do most sovereignty strategies overlook operational sovereignty?

A: Operational sovereignty,covering who operates the environment and from where,is the hardest pillar to audit because it requires inventorying support contracts,vendor access agreements,and third-party dependencies across the full operational chain.

Most organizations start sovereignty programs focused on data location and encryption,which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.

As a first step to evaluate operational sovereignty,you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.

Q: How should organizations think about recovery in the context of sovereignty?

A: Recovery architecture needs to meet the same sovereignty requirements as primary data environments,but it often doesn’t. In most organizations,backup infrastructure,restoration sequencing,and recovery point management are frequently governed by a separate set of controls,or none at all.

During an incident,the personnel authorized to execute recovery may not meet jurisdictional requirements,recovery points may not have been validated as clean and uncompromised,and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.

Q: What does minimum viable sovereignty mean in practice?

A: Minimum viable sovereignty means identifying the right level of control for each workload,calibrated to actual regulatory obligations,risk tolerance,and operational constraints,rather than applying maximum controls uniformly.

Maximum sovereignty comes with real tradeoffs: technological complexity,operational burden,service limitations,and cost. Organizations that define requirements by workload across the four pillars,map those requirements to deployment models,and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.

Q: What role do certifications like C5,SecNumCloud,and ISO 27001 play in a sovereignty strategy?

A: Certifications help provide auditable evidence that controls have been independently verified,an important part of any defensible sovereignty posture. C5 in Germany,SecNumCloud in France,and ISO/IEC 27001each establish baseline requirements that providers must demonstrate through independent audits.

The strongest sovereignty postures treat these certifications as a floor,providing necessary evidence that controls exist,but not a substitute for operational testing under realistic conditions.

Darren Thomson is Vice President and Chief Technology Officer,EMEA,at Commvault. Be sure to catch him in the podcast series, STRIVE.

Puntos Clave

• Multiple backup tools often create operational dependencies on a small number of specialists, increasing organizational risk.
• Managing protection across separate consoles, policies, and reporting systems makes it harder to maintain visibility and respond quickly to issues.
• Consolidation does not have to mean a disruptive rip-and-replace project; many organizations can modernize gradually while retaining existing infrastructure investments.
• A unified control plane can help simplify policy management, monitoring, auditing, and recovery operations across hybrid environments.
• Organizations that simplify backup often realize significant cost savings while helping improve operational efficiency and resilience.

You didn’t build a messy environment. You built a functional one.

Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.

The stack isn’t the problem. It’s the operational model that comes with it.

Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.

And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.

That’s not resilience. That’s dependency masquerading as expertise.

The Dashboard Wall

Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”

If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.

Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.

The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.

And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.

What Consolidation Really Means for Infrastructure Teams

The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.

But that’s not what consolidation has to look like.

The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.

What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.

The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.

The Proof Is in the Number

Fortune Brands consolidated its backup environment with Commvault® Cloud and saved $22.7M – a 73% reduction in total cost. NTT-Netmagic reduced costs by $300K annually and cut storage overhead by 35%.

Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.

Real Resilience Doesn’t Need a War Room

If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.

Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.

Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.

That’s the case for consolidation. Not a better product. A better way to run what you’ve built.

Want the full picture? Download The Hidden Cost of Seven Tools – a field guide for data center teams who built something worth protecting.

Preguntas frecuentes

Q: Why is managing multiple backup platforms a problem if they’re all working?

A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.

Q: What is one of the biggest risks created by a fragmented backup environment?

A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.

Q: Does consolidation mean replacing all existing infrastructure?

A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.

Q: How can consolidation improve resilience?

A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.

Q: What about vendor lock-in when consolidating to a single platform?

A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.

Q: How do organizations measure the value of consolidation?

A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.

Michael Thelander is Senior Director, Product Marketing, at Commvault.

Puntos Clave

• La presión normativa, las expectativas de la junta directiva y los conflictos del día a día están acelerando el cambio de un gasto centrado en la prevención hacia resultados que mejoren la resiliencia.
• La arquitectura de la resiliencia se ha vuelto mucho más compleja, sobre todo ahora que los sistemas de IUnplantean nuevos retos en cuanto al linaje de los datos y su recuperación.
• La ciberresiliencia debe ir más allá de la recuperación ante desastres tradicional y considerar las interrupciones como una situación operativa habitual, en lugar de como un suceso excepcional.
• Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
• Lo más complicado de la transición a ResOps es la parte organizativa. La fragmentación de responsabilidades y las prioridades desalineadas siguen siendo las causas más comunes de fracaso.

Disruptions have become business as usual. Over the past year alone, we’ve seen:

• Los ataques con drones contra centros de datos en los Emiratos Árabes Unidos y Baréinprovocaron una serie de problemas en cadena en las organizaciones que almacenaban datos y cargas de trabajo allí.
• Unerror de configuración del DNS por parte de un hiperescaladordejó sin conexión a Internet a millones de usuarios estadounidenses.
• Unincendio en un centro de datos provocó fallos intermitentes for tens of thousands of a top social media platform’s users for an entire day.

Cuando el entorno operativo es intrínsecamente incierto, los CISO y los CIO tienen que replantearse su enfoque respecto a la continuidad del negocio.En un seminario web reciente, David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the METUnregion, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.

Sneak Peek: It’s No Longer a Matter of If, but When

In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.

Why Disaster Recovery Isn’t Enough

Per NIST’s definition, la ciberresiliencia va más allá de la seguridad tradicional, by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?

Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?

We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.

• In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
• Las normas de la Corporación Norteamericana para la Fiabilidad Eléctrica (NERC) sobre la protección de infraestructuras críticas también se están revisando desde la perspectiva de la resiliencia.
• Los requisitos de notificación de infracciones de la Comisión de Valores y Bolsa (SEC) han puesto el foco no solo en la divulgación de información, sino también en las medidas que están tomando las organizaciones para recuperarse.

Ahora, los consejos de administración consideran cualquier interrupción del servicio como un incidente que perjudica al negocio, y lo que se espera ya no es solo demostrar que la recuperación es posible, sino que se puede llevar a cabo rápidamente y con un alto grado de fiabilidad.
Un estudio de IDC realizado por Handa pone de manifiesto cómo las operaciones de recuperación tradicionales pueden quedarse cortas. Tras el estallido de la guerra en Oriente Medio, descubrió que los CIO y los CISO tenían dificultades para garantizar la continuidad no solo de la tecnología, sino también del personal y los procesos, ya que los empleados se veían obligados a trasladarse de la noche a la mañana y las oficinas quedaban inaccesibles, sin que quedara nadie para llevar a cabo la conmutación manual por fallo. Y este es solo uno de los innumerables escenarios impredecibles que las organizaciones deben tener en cuenta.

Crear una arquitectura de resiliencia

Unresilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.
The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.
AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.
Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.
That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.

ResOps: el modelo operativo para una resiliencia sostenible

ResOps treats resilience as a continuous function, not just something that happens in response to an incident.
In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.
Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.

El lado humano de ResOps

Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.
ResOps forces organizations to answer questions many haven’t yet worked through, such as:

• ¿Quién tiene la autoridad para restablecer los servicios si el equipo principal no está disponible?
• ¿Cómo deberían estructurarse los manuales de ejecución remota?
• How will cross-regional failover work when it can’t depend on a single location?

In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.
To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.
The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.

Ponlo todo en práctica

Commvault ayuda a las organizaciones a poner en práctica las operaciones de resiliencia (ResOps), desde la identificación y protección de datos en cloud locales y cloud , hasta la detección de anomalías, la recuperación a un estado limpio y la restauración de cargas de trabajo validadas. Para las organizaciones que están pasando de los ejercicios teóricos a las restauraciones reales, estas son las capacidades que ayudan a que la resiliencia sea una realidad en tiempos de incertidumbre.
Los recursos de la sesión, como el estudio de IDC sobre la preparación de los directores de sistemas de información y los materiales de Deloitte sobre la recuperación basada en datos, están disponibles en lapágina de contenido bajo demanda.

Preguntas frecuentes

Q: What is cyber resilience and how is it different from disaster recovery?

A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.

Q: What’s driving organizations to prioritize resilience over prevention?

A: Regulatory frameworks like DORUnand evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.

Q: What makes AI systems harder to back up and recover than traditional data?

A: Backing up an AI model means capturing more than the model file itself. Unmodel is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.

Q: What is ResOps, and how does it differ from a traditional resilience program?

A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.

Q: What are the biggest obstacles to adopting ResOps at scale?

A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.

Michael Thelander is Senior Director, Product Marketing at Commvault.

Puntos Clave

• Commvault AirGap es inmutable por diseño, y ofrece funciones de bloqueo WORM para aquellas organizaciones que tengan requisitos normativos y de cumplimiento adicionales.
• Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
• El almacenamiento con tecnología WORM supone una carga adicional para todo el sector, pero Commvault ayuda a minimizar ese impacto gracias a una gestión eficiente de los datos y a una arquitectura cloud.
• El coste del backup va más allá del consumo de capacidad y debería incluir los gastos de infraestructura, recursos informáticos y gastos operativos.
• Las empresas deberían comprobar backup mediante pruebas en condiciones reales, en lugar de fiarse de las afirmaciones de marketing de los proveedores.

Quizá haya visto recientemente algunas afirmaciones de un competidor en las que se sugiere queCommvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.
Let us address this directly: These claims are inaccurate.

Compatibilidad con bloqueos inmutables y WORM en AirGap

AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.
For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across  supported cloud storage targets, including:

• Amazon S3 Object Lock
• Microsoft Azure Blob immutability policies

These features are documented, rigorously tested, and actively used by customers in production environments today.
In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.

Eficiencia en el almacenamiento: cómo ver el panorama completo

Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.
What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.
However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.
By contrast, modern, cloud-native approaches prioritize:

• Gestión eficiente de los datos.
• Modelos de implementación flexibles.
• Eliminación de las dependencias persistentes de infraestructura.

These design principles can result in more predictable, scalable, and sustainable long-term costs.
Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.

Una tendencia al alza entre los clientes

Se observa una tendencia clara: cada vez más organizaciones se pasan a Commvault tras decidir no renovar con sus proveedores anteriores. Entre los motivos más habituales se pueden mencionar:

• Limitaciones inesperadas a medida que los entornos crecen.
• Limitaciones de rendimiento relacionadas con las arquitecturas basadas en dispositivos.
• El aumento de los costes de infraestructura y operativos.
• Las tarifas de renovación son bastante más altas que las de la compra inicial.

These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.

Ir al grano

In a market often shaped by aggressive claims and unclear comparisons, objective validation can be  critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.
Through this program, you can:

• Simula situaciones reales de ciberataques.
• Prueba las capacidades de recuperación utilizando tus propios datos y tu propio entorno.
• Evaluate performance without vendor bias or staged demonstrations.

The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.

Preguntas frecuentes

Q: Is Commvault AirGap truly immutable?

A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.

Q: Does AirGap support WORM lock protection?

A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.

Q: Does enabling WORM lock significantly increase storage costs?

A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.

Q: Why is total cost of ownership more important than storage overhead alone?

A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.

Q: Why are some organizations moving away from appliance-based backup architectures?

A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.

Q: How can organizations validate their cyber resilience strategy?

A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.

Kash Ansari is Chief Customer Officer Americas at Commvault.

Puntos Clave

• La resiliencia cibernética depende tanto de la tecnología como de la experiencia de los profesionales encargados de proteger y recuperar los sistemas críticos.
• El aprendizaje continuo ayuda a los equipos de socios a mantenerse al día con las amenazas en constante evolución, los entornos híbridos y las mejores prácticas en materia de resiliencia.
• La Commvault la la Readiverse Academy ofrece formación específica para cada puesto, talleres prácticos y certificaciones diseñadas para desarrollar habilidades de ciberresiliencia aplicables al mundo real.
• Los clientes valoran cada vez más a los socios que les ayudan a ofrecer asesoramiento de confianza, acelerar la preparación para la recuperación y maximizar los resultados en materia de resiliencia.
• Invertir en formación continua ayuda a reforzar las capacidades de los socios, fomenta la confianza de los clientes y contribuye al crecimiento empresarial a largo plazo.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Reforzar los conocimientos especializados en resiliencia cibernética.
• Gánate la confianza de los clientes en las conversaciones.
• Mantente al día de las tecnologías en constante evolución y de las mejores prácticas.
• Prepárate para nuevos puestos y oportunidades.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why la la Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault la la Readiverse Academyofrece:

• Itinerarios de aprendizaje basados en roles.
• Aprendizaje flexible y a tu propio ritmo.
• Prácticas prácticas basadas en situaciones reales.
• Certificaciones que demuestran que estás preparado para el mundo real.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through la la Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Acelera las implementaciones.
• Adaptar las soluciones a las necesidades cambiantes.
• Mejorar la preparación operativa.
• Reforzar la preparación para la recuperación.
• Afrontar retos complejos en materia de resiliencia.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault la la Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

Preguntas frecuentes

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault la la Readiverse Academy?
A: la la Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.