Skip to content

Points clés à retenir

  • Advanced AI models like Claude Mythos Preview could dramatically accelerate vulnerability discovery, reshaping the cybersecurity landscape.
  • Projet Glasswing highlights growing concerns about managing AI-enabled security risks at scale.
  • ResOps helps shift organizations from reactive defense to proactive resilience and recovery.
  • Cybersecurity tools focus heavily on prevention, while recovery capabilities remain underdeveloped.
  • In an AI-enabled world, the ability to recover quickly from disruption will define operational success.

Anthropic’s new Claude Mythos Preview modelis reportedly powerful enough to identify vulnerabilities in software systems in seconds. In early testing, the company claims the model was able to break out of its containment environment and email an engineer about the event.
Given these potential risks, Anthropic is limiting access to a small group of large organizations throughProjet Glasswing. The goal: stay ahead of the security implications of a world where vulnerability discovery and exploitation may become trivial.
This shift strengthens the case for resilience operations (ResOps™). It could fundamentally change how organizations approach cybersecurity.
In a recent LinkedIn post, “The Beginning of the End of Cybersecurity,” Jen Easterly, CEO of RSAC and former director of CISA, argues that today’s cybersecurity industry is built to identify, defend against, and respond to software defects.
In effect, it compensates for gaps in software quality and secure development practices. If models like Claude Mythos Preview perform as described, their ability to surface vulnerabilities at scale could significantly disrupt today’s security tooling landscape.
A recent STRIVE episode – Evidence Over Hope: Will Your Recovery Plan Hold Up Under Pressure? – echoes this concern. Organizations have invested heavily in tools to prevent attacks, yet relatively little innovation exists “right of boom” – the capabilities required to recover the business when disruption inevitably occurs.

Why ResOps?

ResOps is an organizational discipline that embeds resilience into daily operations. It shifts organizations from passive, reactive backup strategies to an active, continuous model.
Traditional IT operations focus on efficiency. ResOps focuses on surviving failure. It brings together security, infrastructure, and operations teams around a common goal: Identify the organization’s minimum viable business – the critical systems, data, and processes required to operate – and enable those services to be restored quickly and cleanly after a disruption.
Most operational disciplines optimize for when systems work as expected. ResOps is designed for when they don’t. Its core question is simple: Can you recover each critical service right now – with confidence and evidence?

What Does the Future Hold?

If Easterly’s perspective proves accurate – that cybersecurity largely compensates for software defects – then technologies like Claude Mythos Preview represent more than incremental progress. They signal a structural shift in enterprise risk.
AI may help reduce the time between vulnerability discovery and remediation. It may even eliminate certain classes of software flaws. But it does not remove the risk of outages, misconfigurations, identity compromise, or cascading failures in complex systems. And it does not replace the operational discipline required to respond and recover.
Failure will still happen. That reality makes ResOps more important – not less. As prevention becomes more automated, resilience becomes the differentiator. Organizations will no longer be measured solely by their ability to block attacks. They will be measured by how effectively they recover – restoring critical services and trusted data under real-world conditions.
Cybersecurity aims to keep threats out. ResOps prepares you for when they get in. In an AI-accelerated world, the ability to survive and recover from failure may be the most important operational capability an organization can build.
Read more in our Readiness Report, Evidence Over Hope: The Executive Case for Resilience Operations, and learn more about theResOps disciplinesur leReadiverse.

FAQ

Q: What is Projet Glasswing, and why does it matter?

A: Projet Glasswing is an initiative by Anthropic to limit and study access to powerful AI models capable of identifying software vulnerabilities. It matters because it signals a future where vulnerability discovery becomes fast and widespread, increasing both defensive and offensive risks.

Q: What is ResOps, and how is it different from traditional IT operations?

A: ResOps is a discipline focused on enabling organizations to survive and recover from disruptions. Unlike traditional IT operations that prioritize efficiency, ResOps prioritizes continuity and rapid recovery of critical services.

Q: How could AI impact the future of cybersecurity?

A: AI may significantly reduce the time needed to detect and fix vulnerabilities, potentially disrupting existing security tools. However, it does not eliminate risks like outages or misconfigurations, making recovery capabilities even more important.

Q: Why is recovery becoming more important than prevention?

A: Despite heavy investment in preventive tools, disruptions still occur. As threats evolve and automation increases, organizations will be judged more on how quickly and effectively they can restore operations after an incident.

Q: What does “right of boom” mean in this context?

A: “Right of boom” refers to the phase after an incident has occurred, focusing on response and recovery. It highlights the gap in innovation around restoring business operations compared to preventing attacks.

Q: How can organizations start adopting ResOps?

A: Organizations can begin by identifying their minimum viable business – critical systems and data – and building processes to restore them quickly. This involves aligning security, IT, and operations teams around resilience-focused goals.

Jason Meserve is Director of Social Marketing at Commvault.

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • Rising operational disruption makes scalable resilience essential, but organizations commonly fall into traps like seeking “silver bullet” technology or relying on “hero worship” of individual experts.
  • ResOps offre un cadre évolutif qui intègre les ressources humaines, les processus et la technologie dans les domaines de l’ITOps, du SecOps et du DevOps.
  • Le soutien de la direction, au niveau du PDG, contribue à renforcer la responsabilisation et à faire de la résilience une priorité en tant que discipline stratégique.

Cyberattacks, cloud complexity, and AI-enabled threats are creating constant operational challenges for enterprises. To help meet business requirements in this increasingly disruptive environment, organizations need to move beyond separate recovery tools, teams, and plans to resilience as an integrated operating model.

In a recent webinar, Phil Goodwin, research vice president for IDC’s worldwide infrastructure programs, joined me for a fireside chat to explore how organizations can move beyond fragmented approaches to build resilience that scales.

Pourquoi les organisations ont besoin d’un nouveau cadre de résilience

As organizations engage in daily firefighting while keeping up with new technologies and addressing new initiatives, they rarely have time to step back and reassess whether their approaches still meet requirements. But as isolated incidents become systemic disruption, this conversation has become essential.

In a simpler era, organizations focused primarily on backup and recovery. Large-scale disruptions such as Hurricane Sandy brought disaster recovery onto the agenda. Intensifying cyberthreats like ransomware added cyber resilience and business continuity to the list. Each evolution brought new capabilities, but many organizations simply bolted new approaches onto what they were already doing rather than addressing these expanding requirements holistically.

When separate teams manage different pieces with different tools and policies, gaps may emerge that can slow recovery. Despite years of investment in cybersecurity, organizations are still struggling with recovery.

More recently, AI has accelerated the urgency for a more integrated approach by reshaping both threats and defenses. Despite increasing AI investments, many businesses are delaying AI rollouts due to ongoing concerns about governance and security vulnerabilities.

On the other side of the cyber front, bad actors are using AI to create deepfakes, target users with more sophisticated and convincing phishing, and exploit vulnerabilities at scale.

Resilience operations – ResOps – treats resilience as a continuous operating discipline rather than a collection of separate tools and teams. By bringing together ITOps, SecOps, and DevOps under a unified framework, ResOps helps transform resilience to keep pace with systemic disruption.

Éviter les erreurs courantes dans la planification de la résilience

Even organizations that recognize the need for change often fall into traps. One is the “silver bullet” problem, which focuses on technology as the solution. Leaders want to believe that buying the right tools will solve everything, but technology alone can’t deliver positive business outcomes without proper integration and process.

“Hero worship” is another common pitfall – relying on talented staff members with expertise residing in their heads rather than in documented processes. Heroism can’t scale, and reliance on specific individuals creates vulnerability when people leave or responsibilities shift.

To move past these traps, you have to think differently about your operating model. Instead of focusing primarily on technology and people, consider the team you’ll need to build, including executive sponsorship, IT operations and security leadership, and senior leaders from the business side.

The team’s charter should focus on defining business outcomes first: What does resilience need to achieve for the organization? What KPIs, SLAs, and processes should be established to meet these requirements?

Mettre en place des opérations de résilience selon une approche descendante

En tant que priorité au niveau du conseil d’administration, la résilience nécessite un soutien venant des plus hautes instances. Les opérations de résilience (ResOps) sont particulièrement efficaces lorsque le PDG s’implique, en contribuant à définir les priorités en matière de ressources et en favorisant la responsabilisation à tous les niveaux de l’organisation. Grâce à ce soutien de la direction, les cadres supérieurs, notamment le directeur des systèmes d’information (DSI), le directeur technique (CTO), le responsable de la sécurité des systèmes d’information (RSSI) et les directeurs généraux, peuvent confier la mise en œuvre à leurs équipes.

Cette approche peut s’adapter à des organisations de toutes tailles. Même les petites et moyennes entreprises peuvent constituer des équipes pluridisciplinaires regroupant des acteurs métier, des équipes informatiques et des responsables de la sécurité des données et des réseaux. À mesure qu’elles se développent, cette structure peut évoluer en parallèle, en renforçant les effectifs dans des domaines spécifiques liés à la résilience, tout en conservant une approche intégrée tout au long de la chaîne opérationnelle de résilience. Les ResOps reflètent la manière dont les équipes des opérations informatiques (IT Operations), de la sécurité des opérations (SecOps) et du développement et des opérations (DevOps) doivent collaborer au sein des organisations. La récupération des données et la sécurité des données sont désormais si étroitement liées qu’au sein d’IDC, les chercheurs de ces différentes disciplines collaborent désormais fréquemment sur des missions clients. Les applications doivent désormais être conçues en tenant compte des acteurs malveillants, en intégrant des architectures « zero trust » et en partant du principe qu’un incident finira par se produire. ResOps fournit le cadre nécessaire à cette convergence, en réunissant les outils de sécurité et d’exploitation au sein d’un modèle unifié permettant de faire face à toutes sortes de menaces et de perturbations.

ResOps : un cadre commun pour le secteur

ResOps is an operating model, not a product, and can benefit companies regardless of the specific tools they use. As Phil observed during our chat, “It really requires that community involvement where people pitch in from different perspectives, different vendors, different organizations, and different teams, just like DevOps or SecOps.”

For organizations struggling with constant disruption and the growing complexity of AI-enabled threats and defenses, ResOps offers a path beyond fragmented resilience approaches. By bringing together people, processes, and technology in a unified operating model, ResOps turns fragmented recovery efforts into enterprise-wide readiness.

Watch my L’intégralité de la discussion informelle avec Philpour découvrir comment ResOps peut vous aider à renforcer la résilience de votre entreprise à mesure qu’elle se développe.

FAQ

Q : Qu’est-ce que les opérations de résilience (ResOps) ?

R : ResOps est un modèle opérationnel qui intègre les opérations informatiques, les opérations de sécurité et le DevOps au sein d’une approche continue. Plutôt que de considérer la reprise après sinistre, la cyber-résilience et la continuité d’activité comme des capacités distinctes, ResOps rassemble les personnes, les processus et la technologie au sein d’un cadre unifié afin de contribuer à la mise en place d’une résilience d’entreprise évolutive.

Q : Pourquoi le soutien de la direction est-il important pour la cyber-résilience ?

A: Executive sponsorship – ideally at the CEO level – helps drive accountability and priority for resilience initiatives across the organization. This top-down support is essential for organizations trying to move beyond fragmented approaches to integrated resilience operations.

Q : Les petites et moyennes entreprises peuvent-elles mettre en œuvre le ResOps ?

R : Oui . ResOps s’applique aux organisations de toutes tailles. La complexité du cadre évolue au fur et à mesure que les organisations se développent, ce qui le rend accessible aux entreprises de taille moyenne tout en restant efficace pour les grandes entreprises.

Q : Pourquoi les équipes informatiques et de sécurité doivent-elles collaborer pour assurer la résilience ?

R : Lorsque les équipes chargées des opérations informatiques, de la sécurité et du DevOps collaborent au lieu de travailler en silos, les entreprises peuvent contribuer à mettre en place une infrastructure plus résiliente, capable de faire face à l’évolution des menaces.

Q : Comment les organisations devraient-elles s’y prendre pour mettre en place des opérations de résilience ?

R : Commencez par obtenir le soutien de la direction, au niveau du PDG. Ensuite, constituez une équipe pluridisciplinaire regroupant les équipes des opérations informatiques, de la sécurité (SecOps) et les parties prenantes métier, et demandez-leur de définir les résultats métier que la résilience doit permettre d’atteindre pour votre entreprise. Réalisez une évaluation des menaces afin de cerner les risques auxquels vous devez faire face. Ce n’est qu’après avoir franchi ces étapes fondamentales que les organisations doivent se concentrer sur le choix des technologies et l’élaboration de processus détaillés.

Chris Mierzwa occupe le poste de directeur principal du marketing de portefeuille chez Commvault.

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Remarque : cet article a été initialement publié en octobre 2025, lors du lancement de Data Rooms. Il a été mis à jour pour tenir compte de la nouvelle version, Data Activate.

Points clés à retenir

  • Data Activate is part of Commvault’s next-generation AI capabilities – alongside AI ProtectetAI Studio – annoncé to help organizations activate AI safely, govern AI agents,etbuild agentic workflows from Commvault Cloud.
  • Data Activate est conçu pour vous permettre de transformer vos données de sauvegarde en ressources fiables et prêtes pour l’IA, tout en vous aidant à garantir la gouvernance et la conformité.
  • Cette offre permet de concilier protection des données et activation de l’IA sans créer de nouveaux risques pour la sécurité ni nécessiter platform autre platform.
  • Il s’intègre aux écosystèmes d’IA existants tels que Microsoft Azure et Snowflake à l’aide de normes ouvertes telles qu’Apache Parquet et Iceberg.
  • La gouvernance intégrée permet la gestion, la classification et le partage sécurisés des données au sein d’une architecture « zero-trust ».
  • En activant les données historiques, les organisations peuvent contribuer à accélérer l’innovation en matière d’IA, l’analyse et les workflows de conformité en toute sécurité.

AI innovation depends on data – but not just any data. It depends on trusted, governed,etaccessible data. Yet for most enterprises, the data that could fuel AI lives deep within backups, scattered across environments,etwrapped in compliance constraints. That’s where Commvault’s Data Activate offering, previously known as Data Rooms, comes in.

Accélérer l’IA en toute sécurité

Data Activate est l’une des trois fonctionnalités d’IAannoncé as part of its next-generation AI platform – alongside AI ProtectetAI Studio. As organizations race to adopt AI, many are running into a fundamental challenge: their data is fragmentedetdifficult to use. According to a recent survey, 68 % des entreprises cite data silos as their top concern.

Commvault’s Data Activate offering helps transform backup data – one of the most completeettrusted datasets an organization owns – into AI-ready assets. Data Activate helps enterprises safely connect their data to AIetanalytics platforms, without creating new risks or complexity.

Unlike earlier bulk export approaches, Data Activate can regularly publish updated datasets, making it easier to keep AI pipelines in sync with the most current trusted data. Teams also can identifyetexclude sensitive data – such as personally identifiable information – before activating datasets for analytics or model development.

The Data Activate offering is not another AI platform. It’s the bridge between data protectionetdata activation, designed to make your existing AI investments work fasteretsafer. It does this by creating governed, policy-controlled “rooms” inside Commvault Cloud – spaces where data can be classified, curated,etshared with AIetanalytics tools without leaving the protection boundary.

À l’écoute des clients : finie Platform

We heard customers loudetclear: You don’t need another AI platform. You need a protected, simple way to use the data you already maintain – across the AI toolsetecosystems you’ve already chosen.

That’s why Commvault built Data Activate to integrate with partners like Microsoft AzureetSnowflake using open-standard formats such as Apache ParquetetIceberg. This helps you keep your data portable, policy-compliant,etready for activation – wherever your AI strategy takes you.

Transformer la protection des données en activation des données

With Data Activate, authorized users can discover, classify,etprepare data directly from backup repositories – across on-premisesetcloud environments. Built-in governance helps maintain control, allowing only approved datasets to be shared, with automated classification, sensitivity tagging, redaction,etaudit trails applied every step of the way.

Data Activate acts as a governed, policy-controlled workspace inside Commvault Cloud – where data can be curatedetmade available to AI or analytics tools without leaving the protection boundary. This governed design provides a protected bridge between backup dataetactivation workflows, helping organizations unlock their information for innovation while being able to maintain complianceetcontrol.

Data Activate peut vous aider à :

  • Accelerate insights: Quickly findetexport historical data in AI-friendly formats to train models or power analytics.
  • Simplify operations: Eliminate brittle ETL pipelines with automated data discoveryetcuration.
  • Maintain compliance: Keep governance intact with policy-based controlsettraceability from backup to activation.

La confiance comme fondement d’une IA responsable

Dans la course à l’adoption de l’IA, la confiance fait souvent les frais de cette évolution. Selon uneétude, roughly three-quarters of surveyed IT leaders said that using AI could make their organizations more vulnerable to cyberattacks. That’s why Commvault built Data Activate within Commvault Cloud’s zero-trust architecture, complete with encryption, RBAC,etcompliance support.

By combining data protection, governance,etactivation in one platform, Commvault enables enterprises to accelerate AI innovation without compromising data security, compliance, or control.

Accélérer l’innovation sans augmenter les risques

Commvault’s Data Activate offering helps organizations move faster by making data safely accessible to the tools that drive their business forward – from AI model training to analytics, eDiscovery,etcompliance support automation. Because when backup data becomes usable data, enterprises unlock years of historical intelligenceetcontext that most AI models simply don’t have.

As Pranay Ahlawat, Commvault’s Chief TechnologyetAI Officer, said: “Organizations are beginning to realize that their historical data is more than just insurance – it’s a powerful, untapped strategic asset. With Commvault Data Activate, enterprises can confidently export their secondary dataetharness it with the AI platform of their choice to unlock new opportunities for intelligence, innovation,etbusiness growth.”

Pourquoi est-ce important aujourd’hui ?

Commvault’s Data Activate offering redefines what’s possible for enterprises that want to innovate responsibly. They make it possible to move from protecting data to activating data – safely, flexibly,etat scale.

In short: Commvault isn’t building another AI platform. We’re building the foundation that lets every AI platform work better – because when data is protected, trusted,etready for activation, innovation happens faster.

FAQ

Q: What is Commvault’s Data Activate offering?
A: Commvault Data Activate is a capability within Commvault Cloud that helps enterprises safely discover, classify,etactivate backup data for AIetanalytics. It supports open formats like Apache IcebergetParquetetis built on a zero-trust, governed architecture for controlled, self-service data access.

Q: How does Data Activate differ from other AI data solutions?
A: Most AI data prep tools work only on live or production data, creating complianceetcost challenges. Data Activate works from backup data – data that’s already protectedetgoverned – bringing a unique balance of accessibility, compliance support,ettrust. It’s built into Commvault Cloud’s policy-controlled environment, so it’s part of a unified cyber resilience platform. Data Activate also regularly publishes updated datasets – rather than relying on one-time bulk exports – helping keep AI pipelines current without manual intervention.

Q: What benefits do organizations gain from using Data Activate?
A: Organizations can accelerate AIetanalytics insights, simplify data operations by reducing ETL complexity,etmaintain compliance through automated classification, tagging,etauditing processes.

Q: How does Data Activate support data securityetcompliance?
A: Data Activate operates within Commvault Cloud’s zero-trust architecture, applying classification, redaction,etaudit-friendly controls automatically. It helps maintain data privacy, traceability,etcompliance throughout the data lifecycle, aligning with internaletregulatory governance standards.

Q: What types of AI or analytics platforms can connect with Data Activate?
A: Data Activate integrates with leading cloudetAI partners such as Microsoft AzureetSnowflake, supporting open-standard data formats like Apache ParquetetIceberg for maximum flexibilityetportability.

Q: Why is this offering important for enterprises today?
A: As organizations accelerate AI adoption, Data Activate enables them to responsibly unlock the value of historical, protected data – fueling innovation while helping maintain trust, compliance,etcontrol.

Vir Choksi is Principal Product Marketing Manager at Commvault.

 

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • La prolifération des agents constitue un risque en matière de gouvernance. À mesure que les agents d’IA se multiplient, une visibilité fragmentée et des workflows de Recovery déconnectés peuvent créer une véritable exposition opérationnelle.
  • AI Protect unifiera la découverte, la surveillance et la Recovery guidée des agents et de leurs dépendances sur toutes les plateformes, au sein d’une expérience unique centrée sur les agents.
  • AI Protect sera conçu non seulement pour évaluer si les actifs sont protégés, mais aussi pour aider à protéger la pile d’agents et à identifier les risques en fonction de ce que les agents touchent et font.
  • AI Protect will be built on Commvault’s resilience platform – meaning recovery can be tied directly to agent-initiated impact across both data and environments.
  • AI Protect will be part of a broader platform that supports the AI resilience lifecycle – from safely activating data to governing, building, and recovering agentic workflows.

AI agents are no longer a future-state experiment. They’re running in production environments today – querying data, triggering workflows, and making decisions at machine speed. For most enterprises, that’s happening faster than governance frameworks can keep up.

The problem isn’t enthusiasm for AI. It’s the gap between deploying agents and actually knowing what those agents are doing, what data they’re touching, and what to do when something goes wrong. That gap is what Commvault AI Protect will be designed to close.

Le problème de gouvernance au cœur de l’IA agentique

As organizations scale their AI investments, a new class of operational risk is emerging. AI agents aren’t just tools – they’re autonomous actors that can access sensitive data, interact with critical systems, and trigger cascading changes. Without a clear way to discover, monitor, and govern them, IT and security teams may be flying blind.

The symptoms are familiar:

  • Visibilité fragmentée : les API des hyperscalers et les outils d’observabilité offrent une vue partielle et cloisonnée de l’activité des agents. Aucune vue d’ensemble ne permet de relier le comportement des agents à la protection des données, aux risques et à la Recovery sur l’ensemble des plateformes.
  • Absence de cadre de protection : les équipes chargées de la protection des données ne peuvent pas déterminer facilement si les ressources traitées par les agents d’IA sont correctement protégées ou récupérables.
  • Signaux de risque peu évidents : l’activité des agents peut générer un volume considérable de données télémétriques, mais en l’absence de corrélation entre l’identité, l’accès et l’impact, distinguer une automatisation inoffensive d’un comportement à haut risque reste une tâche manuelle.
  • Recovery déconnectée : lorsque des modifications initiées par un agent entraînent des problèmes, le suivi de leur impact et le lancement de la Recovery peuvent nécessiter une corrélation manuelle entre différents outils, ce qui allonge le délai de résolution.

Présentation de Commvault AI Protect

AI Protect will be designed to offer centralized visibility, protection context, risk evaluation, and guided recovery for AI agents – across enterprise, SaaS, and cloud environments. It will extend Commvault’s existing discovery, protection, and recovery capabilities with agent-centric context, helping teams operate AI agents safely and recover quickly when issues arise.

Découvrez : un inventaire unique et fiable des agents

AI Protect will be designed to discover AI agents (and their dependencies) operating across connected environments on a recurring basis, helping maintain a unified, up-to-date inventory based on configurable discovery cadence. Each agent record will capture its execution environment and the data sources, models, configurations, applications, and infrastructure it interacts with. It will help provide a complete, cross-environment picture of what’s running and what it touches.

Protect : combler les lacunes de couverture avant qu’elles ne se transforment en incidents

AI agents interact with sensitive data and systems, but traditional protection tools don’t evaluate coverage in the context of agent behavior. AI Protect will be designed to surface protection status for every agent-touched asset – protected, partially protected, or not protected – and help identify gaps introduced by agent activity. Where gaps exist, it will offer recommended actions and protection workflows to enable teams to close them.

Monitor : transformer les données télémétriques en signaux de risque exploitables

AI Protect will ingest agent activity from existing audit, event, and telemetry sources and present it in agent-centric context – not as raw logs. A time-ordered activity timeline will show what each agent has done and when, and risk signals will be automatically flagged and categorized when agents access sensitive data, interact with unprotected assets, or exhibit unusual patterns. This will help teams move from reactive triage to proactive awareness.

Recovery : Recovery guidée directement liée à l’impact de l’agent

When an agent-initiated change causes an issue, AI Protect will surface recovery point availability for impacted assets and guide teams through the appropriate recovery action – whether that’s restoring data, applications, or configurations. Recovery will be scoped directly to the agent’s impact, not generic incidents, and every action will be time-stamped.

In addition, teams will be enabled to recover the full AI stack – not just the model, but the connected data, configurations, and underlying systems that support it – helping restore the entire environment to a known good state with a single, guided action.

S’inscrit dans une vision plus large de la résilience de l’IA

AI Protect sera l’une des trois fonctionnalités annoncées par Commvault dans le cadre d’une plateforme plus large dédiée à la résilience de l’IA.Activer les données enables organizations to classify and curate data from protected backup copies and prepare governed datasets for use with LLMs and AI pipelines – publishing updates on a recurring schedule aligned with backup policies, in formats like Apache Iceberg and Parquet, with sensitive data filtered out before activation.

AI Studio will enable enterprises to deploy ready-made agents and build custom ones – without writing code. Using a natural language–based Agent Builder, administrators will be able to describe operational intent in plain language, review the proposed workflow, refine it, and deploy it as a governed custom agent from a single interface. AI Studio will be designed to leverage Commvault’s MCP server and integrate with other enterprise applications via MCP, enabling workflows to extend smoothly across systems.

Together, the three capabilities will cover the arc of AI resilience: helping safely activate trusted data, govern and recover agents in production, and build the agentic workflows operations actually require.

FAQ

Q: What is Commvault AI Protect?

A: AI Protect is slated to be a governance and resilience solution for AI agents operating across enterprise, SaaS, and cloud environments. It will be designed to automatically discover agents and dependencies, surface protection gaps for the assets they touch, monitor and provide guided recovery workflows when agent-initiated changes cause issues.

Q: How will this be different from general AI observability or monitoring tools?

A: Most observability tools surface telemetry but stop short of connecting agent activity to data protection and recovery. AI Protect will be designed to correlate agent behavior with protection coverage and recovery readiness, and when something goes wrong, provide a guided path to help restore data, configurations, or systems impacted by agent activity.

Q: What environments will AI Protect support?

A: AI Protect will be designed to work across hyperscaler environments (AWS, Azure, Google Cloud), SaaS platforms, and internal enterprise systems – offering a unified, cross-environment view of agent activity and impact.

Q: How will AI Protect identify risk?

A: Risk signals will be derived by correlating agent activity with data access patterns, sensitivity of assets involved, and protection coverage. Rather than raw log analysis, AI Protect will present risk in agent-centric context – flagging specific agents and interactions that warrant attention, along with the reason they were flagged.

Q: How will recovery work?

A: AI Protect will surface recovery point availability for assets impacted by agent activity and guide teams through the appropriate recovery action – whether that’s restoring data, applications, or configurations. Recovery actions will be scoped to agent-initiated impact and will be fully auditable.

Q: How will AI Protect relate to AI Studio and Data Activate?

A: All three will be part of Commvault’s next-generation AI capabilities. Data Activate governs how data is prepared and activated for AI use. AI Protect will govern agents operating in production. AI Studio will enable teams to build and manage custom agentic workflows. Together, they will form an end-to-end AI resilience lifecycle.

Teja Medasani is Principal Product Manager at Commvault and Vir Choksi is Principal Product Marketing Manager at Commvault.

 

More related posts

Commvault Cloud Compliance

Read more

Points clés à retenir

  • AI Studio sera conçu pour faire le lien entre l’expérimentation et l’automatisation par l’IA à grande échelle, prête pour la production.
  • La bibliothèque d’agents permettra aux entreprises d’avoir une vue d’ensemble de tous les agents par défaut et personnalisés en un seul endroit, avec des descriptions claires, des catégories et leur état d’activation.
  • The Agent Builder will make customization accessible. Natural-language inputs will be able to generate structured, reviewable workflows – no coding required, no black-box behavior.
  • Toute la logique des agents sera visible et explicitement enregistrée avant le déploiement, ce qui permettra de répondre aux exigences de l’entreprise en matière de transparence et d’explicabilité.
  • AI Studio will be part of an end-to-end platform. Combined with Data Activate and AI Protect, it will be built to support the AI resilience lifecycle.

AI automation promises enormous operational value. But for most enterprises, moving from pilot to production can be harder than expected – especially when it comes to operational workflows like backup, recovery, and incident response. Governance concerns, lack of visibility, and the complexity of stitching together tools can often prevent AI from being used in real, day-to-day resilience operations.

What organizations need is a way to apply AI directly to these workflows – safely, with control, and in a way that fits how resilience teams actually operate. That’s what Commvault AI Studio will be designed for.

Pourquoi l’automatisation par l’IA reste bloquée au stade pilote

McKinsey’s State of AI in 2025 report reveals that 88% of organizations use AI in at least one business function – yet only about one-third have reached scaled adoption beyond early pilots. The barriers are consistent across industries:

  • Limited visibility and control over which agents exist, what they do, and where they’re active – making it difficult for IT and data security teams to oversee operational workflows.
  • High friction to customize automation – teams can be forced to rely on manual scripting or external services to adapt built-in capabilities to real workflows, slowing adoption and limiting ROI.
  • Concerns about trust and governance – without transparency, explainability, and auditability, enterprises can’t confidently move agents from experimentation into production.

As a result, organizations either underutilize AI capabilities or rely on manual processes for tasks that could be automated safely – leaving real efficiency and resilience gains on the table.

Présentation de Commvault AI Studio

AI Studio is slated to be Commvault’s answer to the governance-adoption gap. It aims to provide a centralized interface where enterprises can view and manage all agents, deploy ready-made agents, and build custom agents using a workflow-based approach that helps keep behavior visible, auditable, and under control.

Bibliothèque d’agents : une vue d’ensemble claire de tous les agents présents dans votre environnement

LeBibliothèque d’agents will be the entry point to AI Studio. It will present a structured inventory of every agent available in the environment – both default agents built by Commvault and custom agents created by the customer – grouped by type and showing each agent’s name, category, description, and enabled status at a glance.

Default agents include Commvault’s foundational cyber resilience agents, such as Arlie Advisor, Arlie Data Sense, Arlie Recover, among others. The Bibliothèque d’agents will offer teams a single, authoritative view of their resilience agent ecosystem before taking any action.

Gestion des agents : contrôle opérationnel pour chaque agent

Selecting any agent from the library will open a dedicated detail view that can help provide transparency into how that agent operates – its purpose, how it’s triggered, what data it uses as inputs, execution limits, and basic usage telemetry.

This view will also include records of agent activity and events. Following this, administrators can enable or disable the agent with a single action. This will apply consistently to both default and custom agents, so every agent in the environment can be subject to the same governance standard.

Agent Builder : de l’intention exprimée en langage naturel au workflow régulé

AI Studio’s Agent Builder will enable administrators to create custom agents by leveraging Commvault’s workflows and MCP server – without writing code.
Leexperience will start with natural language. An administrator will be able to describe what they want to automate – for example: “I need an agent that detects when storage or infrastructure issues are starting to impact backups and helps resolve them before they affect SLAs.”


Lesystem will be designed to translate that intent into a structured agent configuration, including triggers, conditions, and actions, with optional AI-enabled steps from Arlie – such as Summarize, Generate Recommendation, or Draft Notification – available as explicit workflow steps.
Leadministrator will be able to review the proposed workflow, adjust it as needed – changing trigger frequency, specifying a distribution list, or reordering steps – and save it. The result will be an auditable custom agent that appears in the Bibliothèque d’agents and can be managed through Agent Management like any other agent.

S’inscrit dans une vision plus large de la résilience de l’IA

AI Studio sera l’une des trois fonctionnalités annoncées par Commvault dans le cadre d’une plateforme plus large dédiée à la résilience grâce à l’IA.Activer les données enables organizations to classify and curate data from protected backup copies and prepare governed datasets for use with LLMs and AI pipelines – publishing updates on a recurring schedule aligned with backup policies, in formats like Apache Iceberg and Parquet, with sensitive data filtered out before activation.

AI Protect will offer centralized visibility, protection context, risk evaluation, and guided recovery for AI agents operating across enterprise, SaaS, and cloud environments – helping teams operate agents confidently and recover quickly when something goes wrong.

Together, the three capabilities will cover the arc of AI resilience: helping safely activate trusted data, govern and recover agents in production, and build the agentic workflows operations actually require.

FAQ

Q: What is Commvault AI Studio?

A: AI Studio will be Commvault’s centralized platform for deploying, building, and managing AI agents. It will include an Bibliothèque d’agents for viewing all agents in the environment, Agent Management for operational control, and an Agent Builder for creating custom agents using workflow-based automation – all without writing code.

Q: Who will AI Studio be designed for?

A: AI Studio will be built for Commvault administrators and IT operators who want to automate operational tasks – like monitoring backup job failures or notifying stakeholders – without relying on manual scripting or external development resources.

Q: How will the Agent Builder work?

A: Administrators will be able to describe their automation intent in plain language. AI Studio will then be able to propose a structured workflow with explicit triggers, conditions, and actions. The administrator can then review, edit if needed, and save the workflow as a custom agent. The resulting agent will be visible, auditable, and managed through the same interface as all other agents.

Q: Can AI be incorporated into custom agents?

A: Yes – but intentionally. AI will be invoked deliberately, not invisibly embedded in agent behavior.

Q: What default agents are available out of the box?

A: AI Studio will launch with a library of default agents across foundational AI and cyber resilience categories, including Arlie Data Sense, Arlie Advisor, and Arlie Recover.

Q: How will AI Studio relate to AI Protect and Data Activate?

A: All three will be part of Commvault’s next-generation AI capabilities. Data Activate helps govern how data is prepared and activated for AI use. AI Protect will help govern agents operating in production. AI Studio will help teams deploy and build custom agentic workflows. Together they will form an end-to-end AI resilience lifecycle.

Teja Medasaniest chef de produit chez Commvault etVir Choksiest responsable principal du marketing produit chez Commvault.

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • Apache Iceberg s’est imposé comme un format incontournable pour les « data lakehouses », et de nombreux clients AWS migrent actuellement des tables Iceberg gérées par Glue vers des tables Amazon S3 entièrement gérées, afin de bénéficier de meilleures performances et d’une automatisation accrue.
  • Clumio permet un processus de migration fluide et compatible avec Iceberg, qui contribue à préserver l’intégrité des données, les métadonnées et l’historique des versions, tout en offrant une protection immuable et isolée du réseau.
  • La plateforme automatise la migration grâce à un processus simple de sauvegarde et de restauration, ce qui permet de réduire le recours à des scripts personnalisés ou à des configurations manuelles.
  • Par rapport aux méthodes de migration manuelles ou natives d’AWS, Clumio offre une solution plus rapide, plus évolutive et plus résiliente pour la modernisation des data lakehouses d’entreprise.
  • Clumio’s collaboration with AWSetavailability in the Place de marché AWS enable organizations to modernize data lakes securelyetconfidently.

AIetlatency-sensitive analytics workloads increasingly depend on data lakehouses as their underlying data architecture. Among AWS customers building these environments, Apache Iceberg has become one of the fastest-growing table formats on Amazon S3, providing the transactional consistency, schema evolution,etperformance needed for modern analytics.AWS customers manage Iceberg tables today through the AWS Glue Data Catalog or adopt AWS’s fully managed option, Amazon S3 Tables, to streamline operationsetimprove performance.As AWS customers evaluate the growing importance of their Iceberg-based data lakehouses, considerations around protection, resilience,etmigration to Amazon S3 Tables naturally become part of that planning. Many teams are now looking for a simple, reliable way to move from Glue-managed Iceberg tables to S3 Tables while strengthening the protection of these critical datasets.As AWS’s 2025 Global Storage Partner of the Year, Commvault renforce sa collaboration avec AWS afin d’aider ses clients à moderniser, protéger et optimiser leurs données natives du cloud.Grâce àClumio, Commvault propose uneSolution de cyber-résilience pour AWS, compatible avec Iceberg et dotée d’une isolation physique (air gap) –etnow helps automate migration from Iceberg tables registered in the AWS Glue Data Catalog to Amazon S3 Tables, while enabling long-term protectionetrecovery. You can start your free trial in the Place de marché AWS.

Le défi : des options limitées pour la migration vers des tables S3

De plus en plus d’entreprises envisagent de migrer leurs tables Iceberg gérées par Glue vers des tables Amazon S3 entièrement gérées afin d’améliorer les performances de leur lac de données et de simplifier leurs opérations. Selon AWS, les tables S3 peuvent offrir jusqu’àDes performances de requête 3 fois plus rapides et jusqu’à 10 fois plus de transactions par seconde compared to Iceberg tables stored in general purpose S3 buckets.Many teams also want to offload undifferentiated heavy lifting – such as compaction, snapshot management,etunreferenced file cleanup – while reducing overall storageetquery costs.However, existing AWSetcommunity guidance, such as AWS’s migration framework, outlines a manual, multi-step process requiring custom scriptingetorchestration. Migrating data while maintaining schema, metadata,etversion history can be time-consumingeterror-prone,etmost current approaches focus on replication rather than Iceberg-aware recovery or rollback.Clumio’s migration support for Apache Iceberg tables provides the Iceberg-aware, enterprise-grade migrationetresilience capability that modern data lakehouses have been missing. Demander une démonstration to see how Clumio streamlines your migration.

Comment Clumio simplifie la migration et la protection des données

Clumio pour Apache Iceberg sur AWS helps automate migration from Iceberg tables registered in the AWS Glue Data Catalog to Amazon S3 Tables, while simultaneously enabling long-term protection for these modern data lakehouse assets.The same Iceberg-aware platform provides air-gapped, immutable backups, isolated recovery points, point-in-time or snapshot-level restores,etretention capabilities that help support compliance requirements – extending Commvault’s leadership in cloud-native cyber resilience.Migrationetprotection work hand in hand:

  • Contribuez à la protection des tables Iceberg enregistrées dans le catalogue de données AWS Glue.
  • Restaurer sous forme de tables Amazon S3 entièrement gérées.
  • Continue helping protect those Iceberg tables with Clumio’s cyber resilience capabilities.

Pour les équipes qui préfèrent le déploiement « Infrastructure-as-Code »,Clumiopropose un service accessible au publicModule Terraform that supports Apache Iceberg.As AWS customers adopt Amazon S3 Tables, protecting these modern data assets becomes even more important. Threat vectors such as Ransomware, les suppressions accidentelles, les modifications malveillantes ou erronées, ainsi que la compromission des comptes peuvent perturber les pipelines d’IA et d’analyse et entraîner un retraitement coûteux. Clumio aide ses clients à atténuer ces risques grâce àsauvegardes immuables et isolées physiquementet des options de Recovery flexibles couvrant les comptes, les régions, les instantanés et les moments précis. Pour mieux comprendre pourquoi les data lakehouses nécessitent une protection spécialement conçue, consultezCombler les lacunes en matière de protection des entrepôts de données.

How It Works – From Backup to Restore

The migration process using Clumio follows a straightforward backup-and-restore workflow, designed to minimize effortethelp maintain Iceberg table integrity.Step 1: Connect with the Commvault team for migration program reviewetapproval. Please Nous contacter.Step 2: Discoveretback up Iceberg tables registered in the AWS Glue Data Catalog, with underlying data stored in S3, using Clumio.Step 3: Restore Iceberg table backups – whether the full snapshot history, a selected subset, or a specific point-in-time version – as Amazon S3 Tables in any account or region.Step 4: Enable incremental backups to maintain protection for your new Amazon S3 Tables.Clumio’s architecture helps reduce the need forethelps provide transactionally consistent Iceberg recovery across accounts, regions,etsnapshots.To see the full migration workflow in action – including Iceberg discovery, backup selection, snapshot options,etrestoration to Amazon S3 Tables – watch the demo video embedded below. It walks through the entire backup-and-restore flow end to end, showing how Clumio handles the data, metadata,etsnapshot migration with no manual configuration required.

Comparaison des options de migration

Most migrations to Amazon S3 Tables today depend on manual scripts or native tooling. Here’s how those methods compare against Clumio’s Iceberg-aware approach.

Méthode Description Éléments clés à prendre en compte
Scripts à créer soi-même/
outils open source		 Scripts personnalisés utilisant les API Athena ou Glue pour copier des données et des métadonnées Idéal pour les équipes disposant d’une expertise en script et ayant des besoins spécifiques en matière de migration
Processus natifs AWS/
instantanés		 La documentation AWS et les guides de la communauté décrivent les migrations basées sur des instantanés ou pilotées par des requêtes. Convient aux équipes qui utilisent les services natifs d’AWS et gèrent des processus de migration en plusieurs étapes
Clumio Solution de BackupetRecovery basée sur le modèle SaaS et compatible avec Iceberg pour AWS Un workflow de migration simple et compatible avec Iceberg, qui permet de préserver les métadonnées et la traçabilité des instantanés tout en intégrant une protection continue

Demander une démonstration to learn how Clumio simplifies migration at scale.

Pourquoi est-ce important pour les clients AWS ?

As AWS customers modernize their data lakehouses, they need a simple, scalable way to migrate Iceberg tables to Amazon S3 Tablesetprotect them against operationaletcyber risks. Clumio delivers this by providing Iceberg-aware migration along with air-gapped, immutable protection.AWS is working with Commvault to help customers use Clumio for both protectionetmigration to Amazon S3 Tables. The solution is available today in the Place de marché AWSetsupports Iceberg tables across both Glue-managedetfully managed S3 Tables environments. Together, CommvaultetAWS provide enterprises with a simple, scalable way to modernize their AI data pipelines.For organizations looking to strengthen resilience across the broader AWS data stack, see our blogs on Protection des données Amazon S3 avec ClumioetClumio Backtrack pour Amazon DynamoDB.If you’d like to discuss your AWS data modernization strategy, please Nous contacter.

Moving Forward with ClumioetAWS

As organizations modernize their data platforms for AI, Clumio helps them migrate confidently to S3 Tables, maintain data integrity,etstrengthen their cyber resilience. Clumio simplifies migrationetprotection – helping organizations protect, recover,etmove their most valuable data faster.Start your free trial in the Place de marché AWS.

FAQ

Q: Why are organizations moving from self-managed Iceberg tables to Amazon S3 Tables?
A: Many teams are migrating to S3 Tables to improve performanceetsimplify management. Amazon S3 Tables deliver up to three times faster query performanceet10 times higher transaction throughput than self-managed Iceberg tables while reducing operational overhead.Q: How does Clumio simplify the migration process?
A: Clumio automates migration through a backup-and-restore workflow that maintains schemaetmetadata consistency. It avoids manual scriptingetenables restoring Iceberg backups directly as S3 Tables across accountsetregions.Q: What makes Clumio different from other migration approaches?
A: Unlike do-it-yourself scripts or AWS’s native methods, Clumio is Iceberg-awareetautomated,etit offers built-in cyber resilience features such as immutable backups, point-in-time recovery,etretention capabilities that help support compliance requirements.Q: How does Clumio enhance data protection duringetafter migration?
A: Clumio provides air-gapped, immutable backups that help protect against Ransomware, accidental deletion, or malicious changes. It also supports flexible recovery across snapshots, accounts,etregions.Q: Is Clumio available for AWS customers now?
A: Yes, Clumio is available in the Place de marché AWSetintegrates with both AWS GlueetAmazon S3 Tables environments. customers to modernizeetprotect their AI data pipelines.Q: What’s the first step to get started with Clumio for S3 Tables migration?
A: Organizations can start by contacting Commvault for migration program approvaletthen use Clumio to discover, back up,etrestore Iceberg tables as Amazon S3 Tables. A free trial is available in the Place de marché AWS.Vir Choksi est responsable principal du marketing produit chez Commvault. Blogs connexes

More related posts

Clumio

Read more

Points clés à retenir

  • Commvault’s unified threat detection consolidates risk signals and context into a single view, integrating with partners to help reduce alert fatigue and bridge the gap between security ops and data protection teams.
  • Arlie®, Commvault’s AI assistant, helps translate complex incidents into plain-language summaries and recommends next steps – making it easier for non-experts to respond quickly and confidently.
  • Rather than treating entire backups as clean or compromised, Synthetic Recovery™ works at the file level to identify and assemble the most recent clean data, minimizing data loss and recovery downtime.
  • Cleanroom™ Recovery, an isolated environment for forensic investigation, has been enhanced with runbooks to make threat analysis more repeatable, auditable, and safe – helping minimize risks for production systems.

Commvault’s capacités renforcées en matière de reprise après incident informatique focus less on traditional backup and more on helping organizations stay resilient in the face of modern cyber threats. They’re designed to help security and data protection teams seeking faster insights, cleaner recovery options, and stronger validation that their data can be kept safe and recoverable.

At the core is an upgraded threat-detection experience that brings risk, signals, and context together in a single, unified view. Instead of sifting through disconnected alerts, teams see prioritized risks across their environment, enriched with partner integrations like CrowdStrike and Netskope, so they can focus on what truly matters. This helps reduce alert fatigue and bridges the gap between security operations and data protection.

Arlie pour l’assistance

L’IA joue également un rôle central grâce àArlie, Commvault’s AI-enabled assistant for data security. Arlie helps summarize complex incidents into clear, human-readable narratives: what happened, when it started, which systems were impacted, and what other tools are seeing. From there, Arlie recommends next moves – such as engaging the security team, using a cleanroom for deeper analysis, or triggering a safer recovery path – so even non-experts can act quickly and confidently.

La Recovery synthétique permet de restaurer des données intactes

Recovery elle-même a évolué, avec l’apparition de nouvelles options spécialement conçues pour les incidents de cybersécurité plutôt que pour les restaurations de routine.La fonctionnalité « Recovery synthétique » localise et rassemble automatiquement les versions correctes les plus récentes of data at the file level, helping reduce manual effort and lower the risk of restoring compromised content. Instead of treating entire backups as “all good” or “all bad,” Synthetic Recovery is designed to help preserve as much recent, safe data as possible, helping to minimize data loss and downtime.

Cleanroom™ Recovery for Forensic Analysis

Pour les équipes qui doivent mener des enquêtes approfondies sur les attaques,Cleanroom Recovery offre un environnement isolé et sécurisé to help analyze suspicious data while helping to reduce risk to production systems. This environment is orchestrated with our new runbooks feature to help streamline setup and validation, making forensic work more repeatable and less error prone. It can be particularly helpful when demonstrating to auditors and regulators that steps have been taken to contain a threat, preserve evidence, and follow best practices.

Finally, the platform’s reporting and compliance capabilities tie everything together, helping to turn technical response actions into clear, defensible records. Teams can export details, show chain of custody, and support demonstration of clean, validated recoveries, helping them work toward meeting regulatory requirements and building trust with stakeholders.

Overall, these new features further enhance our Commvault cyber recovery platform to a broader cyber resilience platform that helps detect faster, recover smarter, and validate that your data is safe and clean.

To learn more, Regardez la démonstration de Commvault Cyber Recovery.

FAQ

Q: What makes these updates different from traditional backup solutions?

A: The focus has shifted from routine data backup to cyber resilience – emphasizing faster threat detection, cleaner recovery from cyber events specifically, and compliance validation.

Q: Who are these features designed for?

A: Primarily security and data protection teams that need faster insights, cleaner recovery processes, and documented proof that data is safe and recoverable.

Q: How does Arlie help non-technical users?

A: Arlie helps summarize incidents into clear narratives (what happened, when, which systems were affected) and recommend specific next steps, so teams don’t need deep technical expertise to act decisively.

Q: What is Synthetic Recovery, and when should I use it?

A: Synthetic Recovery automatically locates and assembles the most recent clean file versions after a cyber event. It is useful when you need to recover quickly and reduce the risk of restorating compromised data.

Q: What is Cleanroom Recovery used for?

A: It helps provide a secure, isolated environment for deep forensic analysis of an attack – useful for investigating threats, preserving evidence, and proving to regulators that proper containment procedures were followed.

Q: How does the platform support regulatory compliance? A: It generates exportable reports with chain-of-custody details and validated recovery records, giving teams the documentation needed to meet regulatory requirements and build stakeholder trust.

Nico Guerrera is Senior Technical Marketing Manager at Commvault.

More related posts

Cyber Recovery

Read more

AI Data Resilience

Read more

AI-Ready Data Protection

Read more

Points clés à retenir

  • Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
  • The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
  • Une reprise sans risque nécessite des processus de restauration validés et isolés afin de réduire le risque de réinfection et de rétablir les opérations en toute confiance.
  • Le déclenchement des actions de Backup and Recovery directement à partir des outils de sécurité permet de préserver rapidement les données critiques et de raccourcir les délais de Recovery.
  • La résilience unifiée associe sécurité et Recovery, ce qui contribue à réduire les frictions entre les environnements de détection et de réponse étendues (XDR) et d’orchestration, d’automatisation et de réponse en matière de sécurité (SOAR), tout en améliorant la rapidité et la fiabilité des interventions.

If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.

That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR et Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.

Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.

And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to « viabilité minimale »? That’s the gap we’re closing, bringing recovery actions into the de réponse aux incidents flow, where decisions are already being made.

This is where “clean recovery” stops being a talking point and becomes the new standard.

Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.

According to Sophos’ Rapport 2026 sur les acteurs malveillants actifs, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”

That kind of speed forces de réponse aux incidents to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.

With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.

If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Cleanroom, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.

The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.

 

A Commitment to Unified Resilience

Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.

Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.

So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.

The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:

Oucontactez-moi sur LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.

FAQ

Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.

Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.

Q: How does the Cisco XDR and Commvault integration improve de réponse aux incidents?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.

Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.

Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.

Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.

Michael Fasuloest directeur senior du marketing de portefeuille chez Commvault. Blogs connexesLes innovations en matière de Cleanroom Recovery ouvrent une nouvelle ère en matière de cyber-résilience

Commvault inaugure une nouvelle ère de résilience d’entreprise unifiée

La prochaine évolution dans la protection Cloud

Les 5 étapes essentielles d’une guérison propre

Votre manuel de jeu moderne pour une réponse rapide et une récupération propre

More related posts

Cyber Resilience

Read more

There’s a lot of talk about modernization – Cloud, AI, automation, security transformation. But what does modernization actually look like when you’re responsible for keeping systems running, data protected, and recovery viable under pressure?

In this episode of STRIVE, I had the pleasure of sitting down with Gilman Treantos – a 25-year IT veteran whose career spans everything from mainframes to modern cyber resilience architecture. This conversation provides a practitioner’s view of what modernization really means when outages, ransomware, and operational risk are part of the daily equation.

Watch the épisode.

Points clés à retenir : ce qu’exige réellement une cyberReadiness moderne

  • Modernization isn’t about new tools – it’s about resilient architecture. Technology evolves, but recovery discipline, testing, and cross-team coordination are what separate reactive organizations from resilient ones.
  • La Readiness face aux cybermenaces exige une collaboration entre les équipes chargées de la sécurité et celles chargées de l’infrastructure. Les cloisonnements créent des angles morts. Une visibilité unifiée et un partage des responsabilités peuvent accélérer la Recovery.
  • Les outils de sauvegarde sont plus performants que ne le pensent la plupart des équipes. Utilisés de manière créative, ils peuvent faciliter les migrations à grande échelle, les restaurations isolées et les transitions conçues pour minimiser les pertes de données.
  • Testing is non-negotiable. A recovery plan that hasn’t been rehearsed is a liability, not a strategy.
  • La résilience professionnelle est à l’image de la résilience technique. La proactivité, la curiosité et la volonté de résoudre des problèmes complexes sont tout aussi essentielles que n’importe quelle plateforme.

From Blockbuster to Cyber Resilience

Gilman’s journey didn’t start in a war room or a security operations center. It started at Blockbuster.

Without formal IT training, he leaned into troubleshooting. That curiosity became mainframe work. That work became distributed systems. That evolved into data protection and cyber resilience leadership.

What stands out isn’t the career arc – it’s the mindset. He built a reputation by taking on the problems no one else wanted. Fixing fragile systems. Supporting overlooked initiatives. Solving issues that crossed organizational boundaries.

That mentality translates directly to modernization, because modern cyber readiness is built by people willing to dig into uncomfortable complexity.

Sneak Peek: The Modernization Playbook

In this segment, Gilman explains why modern cyber recovery requires more than traditional malware detection — and how anomaly detection, ThreatScan, and isolated recovery environments can help strengthen enterprise resilience.

Modernization Under Pressure

One of the most compelling parts of the episode is a real-world example: evacuating a remote data center in a single night. No data loss. No prolonged downtime. No operational chaos.

By leveraging Commvault LiveSync in a creative way, Gilman and his team were able to migrate infrastructure quickly and cost-effectively – using capabilities that weren’t originally designed for that exact scenario.

That’s modernization in practice.

The House of Cards Problem

As organizations scale, permissions sprawl. Backup systems grow complex. Security tools layer on top of infrastructure without full alignment. Over time, environments become fragile.

Gilman describes this dynamic as something many teams underestimate: a slow accumulation of technical and operational debt. Modernization, in his view, isn’t just upgrading platforms. It’s simplifying architecture, improving visibility, and breaking silos between cybersecurity and infrastructure teams.

Cyber readiness means:

  • Les équipes chargées de la sécurité et de la sauvegarde partagent les données de télémétrie.
  • Les environnements de Recovery sont isolés et testés.
  • La détection des logiciels malveillants va au-delà des processus opérationnels principaux.
  • Les décisions en matière d’infrastructure tiennent compte de la rapidité de Recovery.

This is where modernization and resilience intersect.

Threats Are Evolving. So Must Recovery.

Ransomware isn’t slowing down. Threat actors are more sophisticated. Malware hides inside legitimate workflows. Gilman’s perspective is blunt: Preparation must be proactive.

He advocates for:

  • Tests réguliers de reprise après sinistre
  • Environnements de récupération isolés prêts à être activés
  • Outils de détection des anomalies intégrés aux processus de sauvegarde
  • Exercices inter-équipes simulant des situations de perturbation réelles

Regardez l’épisode dans son intégralité

Découvrez l’intégralité de notre entretien STRIVE pour en savoir plus sur :

  • Comment Gilman a fait évoluer son approche de la protection des données au cours des 25 dernières années.
  • Les détails d’une migration conçue pour minimiser la perte de données.
  • Pourquoi la collaboration entre les équipes chargées de la sécurité et celles chargées de l’infrastructure est essentielle.
  • Conseils pratiques destinés aux professionnels de la résilience.
  • What modernization really demands in today’s threat landscape.

Regardez-le dès maintenant.

If you care about resilience, recovery, or leading IT through uncertainty, this is 20 minutes well spent.

FAQs

Q: What does “modernization” mean in the context of cyber readiness?

A: It means building resilient, testable, and collaborative systems that can recover quickly under real-world pressure – not just upgrading to newer platforms.

Q: Why is collaboration between security and infrastructure teams so important?

A: Because recovery depends on shared visibility. Security detects threats, but infrastructure enables restoration. Without alignment, response slows and risk increases.

Q: How can backup tools support modernization beyond recovery?

A: When used creatively, they can enable data center migrations, isolated recovery environments, anomaly detection, and large-scale operational shifts.

Q: How often should disaster recovery environments be tested?

A: Regular testing – ideally quarterly or aligned with major infrastructure changes – builds confidence and reveals gaps before an actual incident.

Chris Mierzwa est directeur senior du marketing de portefeuille chez Commvault. Blogs connexesComment la SMMPA a renforcé sa cyber-résilience grâce à Cleanroom Recovery

Readiness à la cybersécurité dans un contexte de tensions géopolitiques : conseils à l’intention de nos clients, partenaires et de notre communauté

Pourquoi l’IA compromet votre stratégie de résilience (et comment y remédier)

Physique contre marketing : accélérer la Recovery tout en respectant les lois de la physique

Moderniser la cybersécurité financière : De la réactivité à la résilience

More related posts

Readiness

Read more

The RSA Conference, held from March 23 – 26 in San Francisco, is one of the premier events in the cybersecurity industry, bringing together experts, thought leaders, and innovators to discuss the latest trends and solutions in cyber resilience and data protection.
The energy was palpable, the learning top-notch, and the city buzzing. With so much to see, including our ResOps Rumble and The Rumble After Party on Monday evening, we wanted to make sure you didn’t miss these exciting announcements from Commvault.
Points clés à retenir

  • Commvault a été largement salué par le secteur en remportant un Global InfoSec Award pour son innovation en matière de cyber-résilience.
  • Des capacités accrues de détection des menaces aident les entreprises à identifier les risques liés aux sauvegardes et à restaurer plus rapidement des données saines.
  • De nouvelles données et des améliorations en matière de sécurité de l’IA contribuent à étendre la visibilité, la classification et la gouvernance aux données structurées et non structurées.
  • L’intégration avec Microsoft Security permet de mettre en place des processus de détection des menaces et de Recovery plus rapides et mieux coordonnés.
  • Les partenariats stratégiques et les initiatives sectorielles mettent en évidence une évolution vers des opérations de résilience unifiées, considérées désormais comme une discipline fondamentale en matière de sécurité.
  1. Commvault remporte le prix « Market Disruptor Cyber Resilience Global InfoSec Award » 2026.

After being named Outstanding in the Cyber Resilience category at the 2025 Global InfoSec Awards, we have accelerated our innovation roadmap, redefining cyber resilience beyond traditional backup and recovery to help address the realities of today’s AI-driven threat landscape.
This year, Global InfoSec has a désigné Commvault comme « acteur disruptif » dans la catégorie de la cyber-résilience. We provide a unified cyber resilience platform designed to deliver AI-enabled data protection, proactive threat detection, advanced ransomware recovery, and a single operational view across enterprise environments.
Unlike other solutions, Commvault® Cloud helps empower customers to protect, recover, and manage their data, applications, and production workloads – across on-premises, public, private, hybrid, SaaS, and multi-cloud environments.
En ce qui concerne la disruption du marché et l’innovation, nous avons fait plusieurs annonces importantes à l’approche de la conférence.

  1. Commvault annonce l’extension de ses capacités de détection des menaces

Nousa récemment annoncé une intensification de la recherche de menaces capabilities within Commvault Cloud Threat Scan. Ces améliorations permettent aux entreprises d’identifier rapidement les risques au sein de leurs environnements de sauvegarde et de restaurer des données valides et saines, contribuant ainsi à réduire les risques de réinfection et les temps d’arrêt prolongés.
Pour relever ce défi, Commvault propose désormais deux modes d’analyse complémentaires au sein de Commvault Cloud Threat Scan :

  • Hyper Threat Hunting helps enable targeted searches across backup data using threat hunting artifacts such as hashes and YARA rules to identify known indicators of compromise at scale. Hash-based hunting helps provide fast, index-based detection, while YARA-based analysis helps support more targeted pattern matching for deeper investigation.
  • Deep Inspection provides layered file-level analysis using malware signatures, machine learning, heuristic analysis, and AI-enabled encryption detection to help uncover known threats, suspicious variants, and ransomware related activity that may evade exact-match indicators alone.

Ensemble, ces modes de détection permettent une collaboration étroite entre les équipes chargées de la gestion des incidents et de la Recovery afin d’isoler les données affectées et de prendre des décisions éclairées en matière de Recovery. Ils permettent de programmer des analyses récurrentes pour une surveillance continue ou d’effectuer des recherches ciblées lors de scénarios de gestion d’incidents en cours, offrant ainsi une flexibilité tant pour la protection continue que pour les interventions urgentes.

  1. Commvault annonce une extension de ses capacités en matière de sécurité des données et d’intelligence artificielle

Le même jour,Nous avons annoncé une extension des capacités en matière de sécurité des données et de l’IA au sein de Commvault Cloud, enabled via our récente acquisition de Satori. The advancements extend data discovery, classification, and risk assessment into structured data environments and introduce real-time access governance for structured databases, including vector databases used in AI applications. These innovations expand Commvault’s existing data security posture management functionality for unstructured data, while data access governance adds real-time control of structured data access.
These advancements also unify visibility by identifying sensitive data, surfacing exposure and policy violations, and consolidating risk insights to help organizations prioritize remediation based on impact. This helps yield improved resilience, prioritized risk remediation, support for compliance, and reduced data exposure to help strengthen resilience across both production and backup data.

  1. Commvault annonce une intégration élargie avec Microsoft Security

Le premier matin de la conférence, nous avons annoncé unintégration renforcée avec Microsoft Security to better connect threat detection with trusted recovery. The new integration uses Microsoft Sentinel, Microsoft Security Copilot, and the Commvault Cloud Platform to streamline resilience operations (ResOps) and enable real-time data insights, helping organizations move quickly from identifying a threat to validating and restoring clean data faster and with greater confidence.
This new integration helps enable coordinated workflows between security and recovery teams. Security alerts from Commvault Cloud are ingested into Microsoft Sentinel data lake where security operations center analysts can enrich these incidents with partner intelligence to access impact and validate scope. In the coming quarters, these insights can help drive automated, policy-based recovery workflows to accelerate and orchestrate clean recovery. You can learn more from notre blog ici.

  1. NetApp and Commvault Advance Cyber Resilience with Strategic Alliance 

En ce qui concerne les alliances, nous avons égalementannounced a strategic alliance with NetApp® to deliver a powerful, integrated solution for enterprise data protection and cyber resilience. The unified solution enables resilience, security, and rapid recovery for customers across on-premises and cloud environments, helping give organizations confidence that their data is available, immutable, and recoverable.
This alliance addresses a critical need for scaling resilience via unified cyber detection and ransomware recovery. By combining Commvault’s leading resilience, protection, and recovery capabilities with NetApp’s enterprise-grade data platform with built-in intelligence and AI-enable ransomware detection, together we’re creating a highly differentiated, end-to-end cyber resilience solution.

  1. TIME + Commvault : « Responsable de la sécurité des systèmes d’information (RSSI) de l’année »

Pour finir, mais non des moindres, au terme de quelques semaines riches en actualités, nous sommes très heureux d’annoncer lalancement de la première édition du prix « CISO de l’année » décerné conjointement par TIME et Commvault. The branded award, selected by Commvault and a panel of industry experts, recognizes enterprise security leaders who are not only defending against cyber threats but also redefining resilience in an increasingly complex threat landscape.
The CISO of the Year Award recognizes leaders who are transforming cybersecurity into a driver of trust, operational strength, and long-term resilience. They embrace critical practices and emerging disciplines, including ResOps, which is rapidly becoming a core discipline for modern enterprise security.
Les candidatures for the CISO of the Year Award will be accepted by Commvault from March 23 through June 20, 2026. Submissions will be reviewed by a panel of industry experts. The panel and Commvault will choose finalists and the winning CISO of the Year based on pre-defined criteria. You can read more about the criteria on the page des nominations.
Commvault Cyber Resilience a Highlight of RSAC

RSAC 2026 made one thing clear: Cyber resilience is no longer a future aspiration – it’s a present-day mandate. From industry recognition to expanded threat hunting, deeper data and AI security, and stronger ecosystem integrations, Commvault continues to push the boundaries of what organizations can expect from a modern resilience platform.
These announcements reflect a broader shift toward unifying security, data protection, and recovery into a cohesive strategy that helps organizations act faster, respond smarter, and recover with confidence in the face of evolving threats.
As the threat landscape grows more complex, the ability to not only detect and defend but also recover with great confidence is becoming a defining competitive advantage. The innovations highlighted at RSAC – alongside strategic partnerships and recognition of industry leaders – underscore Commvault’s commitment to enabling that outcome.
If RSAC is any indication of where the industry is headed, ResOps will continue to take center stage, and organizations that embrace this approach will be well positioned to navigate whatever comes next.

FAQ

Q : Quelles sont les nouvelles fonctionnalités de détection des menaces mises en place par Commvault ?
R : Commvault a intégré les fonctionnalités « Hyper Threat Hunting » et « Deep Inspection » au sein de sonThreat Scan solution. These features combine fast detection with advanced analysis to help identify both known and emerging threats in backup data.
Q: How do Commvault’s new data and AI security capabilities benefit organizations?
A: The enhancements to Commvault’s data and AI security capabilities expand visibility into sensitive data across structured and unstructured environments. They also add real-time access governance, helping organizations reduce risk and improve compliance.
Q: What is the significance of the Microsoft Security integration with Commvault Cloud?
A: The integration helps connect threat detection with recovery by linking Commvault Cloud with Microsoft Sentinel and Security Copilot. This is designed to enable faster decision-making and more automated recovery processes.
Q: What does the Commvault and NetApp alliance bring to customers?
A: The alliance combines Commvault’s resilience platform with NetApp’s data infrastructure and AI-enabled ransomware detection. This creates a unified solution designed to deliver stronger data protection and faster recovery across environments.
Q: What is the TIME and Commvault CISO of the Year Award?
A: The TIME + Commvault CISO of the Year award recognizes a security leader who exemplifies modern resilience leadership through a ResOps approach.
This program celebrates CISOs who treat resilience as a core business capability not just a technical function, those bridging security, IT, and operations to enable their organizations to recover quickly, operate confidently, and innovate without increasing risk​​.
​​​The honoree selected ​by Commvault ​will be featured in a TIME​ ​branded​ ​article and video, with additional recognition across TIME and Commvault channels​. The honoree will also be invited to Commvault’s annual SHIFT event. ​

More related posts

Threat Scan

Read more

Points clés à retenir

  • La sécurité doit évoluer à la manière de l’agent Smith : dans « Matrix », l’agent Smith s’est multiplié à une vitesse fulgurante pour submerger Neo. Les équipes de sécurité sont aujourd’hui confrontées à un défi similaire, car les menaces et les signaux se multiplient plus vite que les capacités des analystes. Les agents de sécurité basés sur l’IA aident les équipes à intensifier leurs enquêtes sans avoir à augmenter leurs effectifs.
  • La corrélation des signaux renforce la fiabilité des enquêtes : Commvault Security Investigation Agent établit une corrélation entre les informations issues des sauvegardes et les signaux de sécurité provenant de plateformes telles que Netskope, CrowdStrike et Palo Alto Networks afin de déterminer si les menaces détectées dans les données de sauvegarde ont également affecté les systèmes de production.
  • La cyber-résilience sera désormais axée sur les agents : l’agent d’investigation de sécurité Commvault constitue la première étape vers un avenir où des agents d’IA spécialisés aideront les équipes de sécurité dans leurs enquêtes, leurs décisions de Recovery et l’accélération des processus de restauration.

Introduction

In The Matrix, there’s a moment that feels surprisingly relevant to today’s technology landscape. Agent Smith discovers he can duplicate himself. One becomes many, and suddenly Neo is surrounded by an army of identical agents operating simultaneously.

In many ways, that scene mirrors the world we’re entering today with agentic AI. Across industries, and especially in cybersecurity, we’re beginning to see the rise of specialized AI agents that can work independently, scale rapidly, and assist humans in ways that were previously impossible. But unlike Agent Smith’s relentless takeover, the goal of these agents isn’t domination. It’s defense.

Évoluer tout en brisant les cloisonnements

Security operations today face a fundamental scaling problem. The number of systems, signals, and security tools continues to grow, but the number of analysts does not.

Organizations now ingest telemetry from endpoint security platforms, network defenses, cloud monitoring tools, and identity protection systems. Each of these tools generates its own alerts and dashboards, often operating in isolation from one another. The result is an overwhelming amount of data spread across disconnected silos.

It’s tempting to assume the solution is simply hiring more analysts, but anyone who has managed large teams knows that adding people introduces its own challenges. As teams grow, communication becomes more complex, coordination slows down, and the efficiency of investigations often decreases.

What security teams really need is not just more people, but more intelligence and automation to help analysts move faster and see the bigger picture.

One of the most persistent silos in security operations has been the divide between backup systems and security tools. Traditionally, security teams monitor production environments through their security information and event management tools while backup environments operate in a separate console.

Backup data is often only examined after an incident occurs, when organizations are already deep in recovery mode. Yet attackers increasingly target backup systems precisely because they know they are critical to recovery.

Ransomware operators frequently encrypt production systems, attempt to corrupt backups, or leave malicious artifacts hidden inside protected datasets. This means that backup environments often contain valuable evidence of an attack, but that intelligence has historically been difficult for security teams to access and correlate with other signals.

Le nouvel agent chargé des enquêtes de sécurité

Commvault’s new integration with Microsoft Sentinel and Microsoft Security Copilotest conçu pour combler cette lacune. Grâce à cette intégration, les événements Commvault Cloud peuvent être transmis en continu directement vers le Sentinel Data Lake, ce qui permet de regrouper les données télémétriques de sauvegarde au sein du même environnement analytique que les signaux de sécurité provenant des terminaux, du réseau et du cloud.

Au lieu d’être isolées, les activités de sauvegarde peuvent désormais être analysées au sein de l’écosystème de sécurité global. Mais la véritable force de cette intégration réside dans l’introduction du Commvault Security Investigation Agent.

Le Security Investigation Agent aide les analystes à enquêter sur les menaces potentielles en établissant des corrélations entre les signaux détectés dans les environnements de sauvegarde et ceux provenant d’autres plateformes de sécurité. Lorsqu’un analyste fournit le nom d’hôte d’un serveur, l’agent recueille les événements de sécurité générés par Commvault Threat Scan et Risk Analysis, notamment les anomalies de sauvegarde, les événements de chiffrement pouvant indiquer une activité de ransomware, les logiciels malveillants détectés au sein des ensembles de données protégés, ainsi que les sauvegardes contenant des données sensibles.

L’agent établit ensuite une corrélation entre ces événements et les données télémétriques provenant d’autres outils de sécurité sur lesquels les entreprises s’appuient déjà, tels que Netskope, CrowdStrike et Palo Alto Networks. En analysant conjointement l’activité sur l’ensemble de ces plateformes, l’agent permet de déterminer si les comportements suspects identifiés dans les données de sauvegarde apparaissent également dans les environnements de production.

Comment trouver un agent ?

Let’s first walk you through how you can start with our first agent focused on security investigations. Then we’ll share how we plan to rapidly spawn new agents – just like Agent Smith – so customers can take control of investigations, recovery decisions, and restore operations, giving security and operations teams the intelligence they need to respond faster and recover with confidence.

Configurer le connecteur

Avant de pouvoir activer l’agent Commvault Security Investigation Agent, vous devrez installer et configurer le connecteur Commvault Cloud.

  1. Installation : les instructions relatives à l’installation de la solution Commvault Cloud, ainsi que les autorisations et les conditions préalables, se trouvent, cliquez ici.

Capture d’écran : détails d’installation du Commvault Cloud Data Connector dans le Content Hub de Microsoft Sentinel.

  1. Configuration : une fois l’installation terminée, les détails de configuration sont les suivants :, cliquez ici.
 Use Commvault Security Investigation Agent

Une fois le connecteur Commvault Cloud installé, vous pourrez utiliser le nouvel agent d’investigation de sécurité.

  1. Aller àhttps://securitycopilot.microsoft.com/agents.
  2. Search for “Commvault Security Investigation Agent.”
  3. Click on “Set up” Agent.
  4. Click on “Aller àAgent.”
  5. Click on “Run” => “One time.”
  6. Provide the “Hostname” for the host you’d like help investigating, and click “Submit.”
    1. Remarque : le nom d’hôte correspond au nom du serveur sur lequel nous souhaitons surveiller les événements liés à Commvault et à ses partenaires, tels que Netskope, CrowdStrike et Palo Alto.
  7. L’agent s’exécutera et vous obtiendrez en retour une analyse détaillée ainsi que des recommandations.

Capture d’écran : analyse détaillée de l’agent Commvault Security Investigation Agent exécuté sur un hôte faisant l’objet d’une enquête.

Conclusion

The Matrix may have dramatized the idea of multiplying agents, but it captured an important truth about scale. When Agent Smith multiplied, the dynamics of the fight changed entirely.

Cybersecurity is undergoing a similar shift. Attackers are increasingly leveraging automation and AI to scale their operations. The only way defenders can keep pace is by scaling their own capabilities through intelligent systems that augment human expertise.

With the integration between Commvault, Microsoft Sentinel, and Microsoft Security Copilot – and with the introduction of the Commvault Security Investigation Agent – we are beginning to see what that future looks like. It’s a world where security operations are no longer constrained by silos, where investigations move faster, and where AI-enabled agents work alongside analysts to strengthen cyber resilience across the entire environment.

Over the coming year, Commvault plans to introduce additional agents – just like Agent Smith multiplying in The Matrix – that can help security teams run Commvault Threat Scan, spin up Cleanroom environments for SOC analysts to safely investigate incidents, and accelerate recovery by identifying the safest data to restore.

We’re also excited to collaborate with Microsoft to enable customers to use Microsoft Foundry to build and extend their own agents, allowing them to tailor automation and investigations to their unique environments.

By combining Commvault’s deep cyber resilience capabilities with Microsoft’s AI and security ecosystem, we’re helping organizations move toward a future where intelligent agents help analysts investigate faster, break down silos, and strengthen resilience across the entire environment.

FAQ

Q : Que sont les agents IA dans les opérations de sécurité (SecOps/ResOps) ?
R : Les agents IA sont des outils spécialisés et autonomes qui assistent les équipes de sécurité en analysant les données, en établissant des corrélations entre les signaux et en facilitant les enquêtes. Ils travaillent aux côtés des analystes humains pour accélérer la prise de décision et améliorer les temps de réponse dans des environnements complexes.

Q : Pourquoi la mise à l’échelle des opérations de sécurité représente-t-elle un tel défi aujourd’hui ?
R : Les équipes de sécurité sont confrontées à une explosion d’alertes et de données provenant de multiples outils, tandis que les effectifs d’analystes n’augmentent que lentement. Ce déséquilibre crée des goulots d’étranglement, rendant difficile l’investigation efficace des menaces sans automatisation ni assistance intelligente.

Q : Comment l’agent d’investigation de sécurité Commvault améliore-t-il les enquêtes sur les menaces ?
R : L’agent établit des corrélations entre les données de sauvegarde et les signaux provenant de plateformes de sécurité telles que CrowdStrike, Netskope et Palo Alto Networks. Cette vue d’ensemble permet aux analystes de déterminer si les menaces détectées dans les sauvegardes ont également affecté les systèmes de production, ce qui renforce la fiabilité des enquêtes.

Q : Quel problème l’intégration des données de sauvegarde dans les workflows de sécurité permet-elle de résoudre ?
R : Les environnements de sauvegarde contiennent souvent des preuves cruciales d’attaques, mais ont toujours été isolés des outils de sécurité. L’intégration de ces données permet aux équipes d’analyser les menaces de manière globale, de mettre au jour des risques cachés et de prendre des décisions de Recovery plus éclairées.

Q : Comment les entreprises peuvent-elles commencer à utiliser l’agent d’investigation de sécurité Commvault ?
R : Les entreprises doivent installer et configurer le connecteur Commvault Cloud au sein de Microsoft Sentinel. Une fois configuré, l’agent est accessible via Microsoft Security Copilot pour mener des enquêtes en indiquant simplement un nom d’hôte.

Q : À quoi ressemble l’avenir des agents IA en matière de cyber-résilience ?
R : L’avenir s’annonce marqué par la présence de multiples agents spécialisés qui faciliteront la gestion des enquêtes, la planification de la reprise et les opérations de restauration. Ces agents contribueront à briser les cloisonnements, à accélérer les interventions et à renforcer la résilience des opérations de sécurité dans l’ensemble de l’environnement.Ritu Singh est chef de produit senior et Rich Vorwaller est directeur de la gestion des produits chez Commvault.

Blogs connexes

MCP 2.0 expliqué : sécuriser les agents d’IA avant qu’ils ne se sécurisent eux-mêmes

Pourquoi l’IA compromet votre stratégie de résilience (et comment y remédier)

Rester résilient face aux attaques par accès latéral

Êtes-vous prêt à faire face aux boucles de fuite de données ?

Tendances en matière de ransomware pour 2026 : IA, résilience et MTCR

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • L’IA accélère la création de données et les flux de travail distribués, rendant les approches réactives traditionnelles insuffisantes pour garantir la résilience.
  • Les opérations de résilience (ResOps) aident les équipes à passer d’un dépannage réactif à une action coordonnée. Commvault applique l’IA dans trois domaines : la protection des données, des modèles et des pipelines d’IA ; l’utilisation de l’IA pour orienter et accélérer les interventions ; et l’extension de l’IA à l’ensemble de l’écosystème de résilience.
  • Des agents IA pratiques sont conçus pour mettre en évidence les problèmes opérationnels (Arlie Data Sense), orienter les décisions de protection (Arlie Advisor) et permettre des flux de travail conversationnels (serveur MCP).
  • La sécurité et la gouvernance des données restent fondamentales. L’IA doit être entraînée à respecter les contrôles d’accès, à garantir l’auditabilité et à fonctionner dans les limites des politiques définies.
  • Les organisations peuvent commencer modestement avec des agents ciblés, puis évoluer vers des opérations coordonnées et intelligentes.

AI introduces both new challenges and potential breakthroughs for enterprise resilience. On one hand, traditional siloed tools for protection, recovery, and governance weren’t designed to operate across constantly evolving AI environments that span multiple platforms.
On the other hand, AI-enabled resilience tools can deliver a transformative impact by helping teams maintain visibility, enforce policy, and recover cleanly. For IT and security teams, the question is how best to leverage the benefits of AI while mitigating the operational risks it can pose.
Lors d’un récent webinaire, j’ai rencontréTeja Medasani, chef de produit principal en IA chez Commvault, afin d’explorer des cas d’utilisation concrets où des agents IA sont mis à contribution dans des workflows de résilience sur des plateformes cloud, SaaS, sur site et natives de l’IA.

Pourquoi l’IA redéfinit les opérations de résilience

The rapid growth and dynamic nature of AI-native environments have put operational workflows under pressure. Manual tagging, spreadsheets, and logic quickly drift out of sync. Sprawling job history tables and audit trails slow manual troubleshooting and make subtle warning signs easy to miss. Recovery processes that assume centralized data and isolated failures are poorly suited for exponential data growth and fragmented workloads across platforms.
When data, workloads, and environments span platforms, resilience can’t remain siloed in separate teams, tools, and policies. A new operating model is needed: les opérations de résilience, ou ResOps.

À quoi ressemblent les ResOps dans la pratique ?

Le cadre ResOps répond à ces défis selon trois axes :

  • Protection de l’IA : Sécuriser les données, les modèles et les pipelines d’IA dans tous les environnements afin qu’ils restent récupérables et conformes.
  • Tirer parti de l’IA : utiliser l’IA pour réduire la charge de travail manuelle, mettre en évidence des informations opérationnelles et orienter les décisions en matière d’intervention et de Recovery.
  • Extend AI : relier les opérations de recherche (ResOps) entre les différents outils et équipes afin de sécuriser les interactions conversationnelles et les flux de travail intégrés.

Au cours du webinaire, nous nous sommes principalement concentrés sur l’exploitation et l’extension de l’IA, en mettant en avant les rôles clés que les agents IA peuvent jouer dans les opérations quotidiennes. Ces exemples s’articulent autourArlie, Commvault’s AI assistant. Designed to help users interpret data, understand issues, and move toward action more efficiently, Arlie includes a bibliothèque d’agents purpose-built to help address specific resilience workflows.
By helping reduce repetitive analysis, surfacing meaningful signals, and guiding decisions around security-aware recovery, these agents can help teams take actions more quickly and confidently. Arlie Data Sense, Arlie Advisor, and Commvault’s le serveur MCP illustrate a few of the possibilities unlocked by AI-enabled ResOps.

Mise en évidence des problèmes opérationnels avec Arlie Data Sense

Arlie Data Sense aide les équipes à donner du sens à des données opérationnelles denses, telles que les tableaux d’historique des tâches et les pistes d’audit. Au lieu de parcourir manuellement des centaines de lignes pour repérer des tendances ou diagnostiquer des défaillances, les utilisateurs peuvent demander àArlie to help analyze the data and generate an executive summary highlighting anomalies and emerging issues.
Teams can ask follow-up questions in natural language and explore data further through interactive summaries or visualizations. When a job fails, Arlie can help analyze logs, summarize the failure, identify the possible cause, and provide next steps for resolution.

Orientez vos décisions d’intervention avec Arlie Advisor

À mesure que les charges de travail s’accumulent, que les responsabilités changent et que les exigences évoluent, il devient de plus en plus difficile de maintenir une couverture de protection cohérente dans tous les environnements.Arlie Advisor is designed to help teams create and validate protection plans at scale by evaluating the characteristics and current protection coverage for each resource, and then highlighting where adjustments may be needed.
Recommendations are presented clearly with reasoning explained, so teams can evaluate them and decide how to apply them within existing governance processes. This helps teams maintain consistency across dynamic environments.

Étendre les workflows de résilience avec le serveur MCP

Resilience workflows often need to connect with ticketing systems, collaboration tools, and security platforms outside the Commvault platform, and they need to be accessible to users who aren’t resilience experts. Commvault’s le serveur MCP makes it possible to extend workflows without custom integrations or significant training by allowing conversational interaction.
Users can ask questions or request actions in natural language, with their prompts translated into governed API calls behind the scenes – for example, to automatically create tickets in ServiceNow for failed jobs.

Coordination et clarté entre les équipes et les plateformes

The examples above share a common theme: coordination. Effective resilience requires visibility, policy enforcement, and clean recovery across environments. AI can help strengthen these capabilities by helping teams identify what matters and act more quickly.
While the evolution of resilience from reactive recovery to continuous insight and guided action has become essential, it doesn’t need to happen all at once. Teams can start with targeted agents that address specific operational pain points and then build toward more coordinated operations as capabilities mature and teams gain confidence.
The key is to begin the ResOps journey now – because the challenges posed by evolving resilience requirements will only keep growing.
Regardez l’intégralité du webinaire à la demande to see detailed demos of Arlie Data Sense, Arlie Advisor, and conversational resilience in action, and explore how AI-enabled ResOps can help support your operational workflows.

FAQ

Q: What is resilience operations?

A: ResOps is an operating model that unifies data security, identity resilience, and cyber recovery into a continuous, automated discipline rather than treating them as separate IT functions. ResOps helps transform resilience from a reactive response to incidents into an active practice that helps continuously understand data access patterns, detect threats and anomalies, and enable fast, intelligent recovery at scale.
Q: What is Arlie and how has it evolved?

A: Arlie, short for autonomous resilience, was first introduced in 2023 as an AI assistant to help users navigate the Commvault platform more easily. As AI capabilities have evolved, Arlie has evolved as well.
In addition to answering questions and guiding configuration, Arlie now also includes a library of purpose-built agents to address specific resilience workflows, such as surfacing operational insights, recommending protection strategies, and guiding security-aware recovery decisions. Arlie has become an entry point into operational insight rather than just a how-to assistant.
Q: How does Arlie Data Sense help with operational troubleshooting?

A: Arlie Data Sense helps teams make sense of dense operational data like job history tables and audit trails. Instead of manually scanning through hundreds of rows to find subtle warning signs or diagnose issues, users can trigger Arlie to analyze the full data set and generate an executive summary highlighting patterns, anomalies, and emerging issues.
Teams can ask follow-up questions in natural language and explore data through interactive summaries or visualizations. For failed jobs, Arlie provides root-cause analysis by analyzing logs, summarizing failures, identifying possible causes, and providing personalized next steps for resolution.
Q: What does “guided action” mean in the context of AI-enabled resilience?

A: Guided action refers to AI helping teams move from insight to response more efficiently by recommending specific actions based on analysis of operational data and protection coverage. Rather than simply surfacing information, AI agents like Arlie Advisor help evaluate resource characteristics, identify gaps between current protection and policy expectations, and present clear recommendations with reasoning.
Teams retain decision-making authority and can evaluate recommendations within their existing governance processes, but the agent helps reduce the manual effort required to identify what needs attention and what actions may be appropriate.
Q: How does le serveur MCP enable conversational resilience workflows?

A: le serveur MCP uses Model Context Protocol technology to enable conversational interaction with resilience workflows through natural language. Users can ask questions or request actions in everyday language, and those requests are translated into governed API calls behind the scenes.
Identity, role-based access control, and audit logging remain in place, so the conversational interface doesn’t bypass security requirements. This approach helps reduce friction for experienced teams, lower barriers for new users, and enable resilience workflows to integrate more easily with other enterprise systems like ticketing platforms through standardized interfaces.
Q: How does Commvault enable AI to respect security and governance requirements?

A: In Commvault Cloud, AI interactions inherit the same identity and role-based access controls that govern the rest of the platform. When AI surfaces insights or recommends actions, it operates within the governance framework customers already rely on.
This means AI respects existing access controls, maintains auditability through standard logging, and operates within clearly defined policy boundaries. The architecture is designed to prevent natural language interactions or agent recommendations from bypassing the security and governance requirements already in place for the platform.
Q: Can organizations adopt AI-enabled ResOps incrementally?

A: Yes. Organizations can start with targeted AI agents that address specific operational pain points rather than transforming their entire resilience practice at once. For example, teams might begin by using Arlie Data Sense to help surface insights from operational data, then add Arlie Advisor to help maintain protection coverage at scale, and later enable conversational workflows through le serveur MCP for easier integration with other systems.
This incremental approach allows teams to build confidence with AI-enabled capabilities, demonstrate value in specific workflows, and scale toward more coordinated, intelligent operations over time as the organization’s needs and capabilities evolve.
Vir Choksi est responsable principal du marketing produit chez Commvault.

Blogs connexes

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Note: “MCP 2.0” is used here as a colloquial reference to the next-generation evolution of the Model Context Protocol. MCP itself uses date-based versioning (e.g., the latest release being 2025-11-25 at the time of this document’s release) and does not officially define a 2.0 release.

AI agents are no longer just answering questions – they’re taking action. They’re reading files. They’re modifying systems. And in some cases, they’re making decisions that ripple across an entire enterprise.That’s why Model Context Protocol (MCP) 2.0 matters.In a épisode récent de STRIVE, Commvault’s thought leadership series on cyber readiness, I sat down with Werner Nel, Principal, Security and AI Intelligence, at Commvault, to unpack what MCP 2.0 really changes – and why security leaders can’t afford to treat it as a minor spec update.This isn’t a theoretical conversation. It’s a practical look at how enterprises can enable AI innovation without widening their blast radius.

Points clés : ce que MCP 2.0 change réellement

  • Le MCP 2.0 marque un tournant : on passe de l’adoption de l’IA à la responsabilisation.
  • OAuth peut permettre un accès avec le moins de privilèges possible pour les agents d’IA.
  • Les schémas structurés peuvent contribuer à limiter l’injection de prompts et les abus.
  • Les flux d’interrogation peuvent ajouter des points de pause critiques pour les actions à haut risque.
  • MCP 2.0 may help improve security – but doesn’t eliminate risk.
  • Il est essentiel de bien comprendre les prérogatives des agents et leur rayon d’impact.

Pourquoi MCP 2.0 marque un tournant

MCP 1.x was about adoption.It gave enterprises a way to connect AI models to real tools and real data. But as Werner explains, that first wave was never designed to answer the hardest question: How do we let AI agents execute real work inside the enterprise – without turning them into a security liability?

MCP 2.0 is the industry’s first serious attempt to answer that question.Instead of focusing purely on connectivity, it shifts attention to authorization, control, and visibility – three things security teams care deeply about, especially as agents move from read-only assistants to actors with real power.

Les trois évolutions les plus importantes en matière de sécurité

  1. OAuth comes to MCP. MCP 2.0 introduces OAuth support, giving enterprises a standardized way to assign permissions and enforce least privilege. Instead of relying on vague trust assumptions, agents can be scoped to exactly what they’re allowed to do—and nothing more.
  2. Structured schemas help reduce prompt injection risk. Structured schemas act like an allowlist for agent actions. If a tool isn’t explicitly defined in the schema, it won’t execute. This can help reduce prompt injection risk and other manipulation techniques that were easier to exploit in earlier implementations.
  3. Elicitation flows add a “pause button.” Elicitation flows can enable workflows to pause mid-execution so a high-risk step may trigger confirmation, validation, or even credential escalation. This can help shift teams from “log and hope” to more deliberate control over sensitive actions.

Aperçu : MCP 2.0 en action

Cet aperçu met en évidence pourquoi l’autorité, la portée et la réversibilité sont les trois questions les plus importantes que les entreprises devraient se poser lors du déploiement d’agents d’IA.

The Gaps MCP 2.0 Doesn’t Solve (And Why That’s Important)

MCP 2.0 is a big step forward – but it’s not the finish line. As Werner highlights in STRIVE, there are still meaningful gaps enterprises need to account for in real-world deployments.For example, enterprises still can’t fully cryptographically prove that an MCP server is the authentic original (vs. a clone or modified copy). Similarly, even if the protocol improves authorization and input discipline, organizations still need to think about signing tools and binaries, and about the environment where MCP servers and models run – because a compromise can translate into broad access depending on how it’s deployed.The takeaway: MCP 2.0 improves the protocol, but organizations still have to make smart decisions about trust, containment, monitoring, and oversight.

Un cadre simple pour évaluer les risques liés aux agents IA

One of the most practical moments in the episode is Werner’s three-question risk lens – something CISOs and architects can apply immediately:

  • De quelles autorisations dispose mon agent ?
  • Quelle est l’ampleur du rayon d’impact ?
  • Dans quelle mesure l’action entreprise est-elle réversible ?

These questions help teams move from generic “AI risk” discussions to concrete decisions about permissions, containment, and how to handle high-impact actions that may not be easy to roll back.

Regardez l’épisode complet de STRIVE

This blog only scratches the surface. In the full 20-minute STRIVE podcast, you’ll hear:

  • Pourquoi le MCP 2.0 a évolué si rapidement.
  • Les priorités actuelles des RSSI.
  • Quelle direction MCP 3.0 est susceptible de prendre.
  • Comment les équipes de sécurité peuvent suivre le rythme alors que les agents gagnent en autonomie.

Regardez l’épisode STRIVE dans son intégralité sur Readiverse.Approfondissez le sujet et évaluez votre propre niveau de Readiness.

FAQ

Q: What is MCP 2.0?

A: MCP 2.0 is an updated protocol that governs how AI models interact with enterprise tools and data, with a strong focus on security, authorization, and control.Q: How is MCP 2.0 different from MCP 1.x?

A: MCP 1.x focused on connectivity and onboarding. MCP 2.0 prioritizes securing those interactions.Q: Does MCP 2.0 eliminate AI security risk?

A: No. It can help improve security hygiene but must be paired with strong architecture and governance.Q: What is an elicitation flow?

A: An elicitation flow allows AI workflows to pause for confirmation before executing high-risk actions.Chris Mierzwa occupe le poste de directeur principal du marketing de portefeuille chez Commvault.

Blogs connexes

 

 

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

When you’re responsible for powering communities across southern Minnesota, cybersecurity isn’t just about protecting data. It’s about making sure the lights stay on. For Southern Minnesota Municipal Power Agency (SMMPA), implementing Commvault® CleanroomIl s’agissait d’une décision stratégique qui a transformé leur approche en matière de cyber-résilience.

Relever le défi de front

SMMPA serves as an electric wholesaler to 17 municipal utilities. With approximately 50 employees supporting critical power infrastructure, the organization must maintain constant resilience against increasingly sophisticated cyber threats, where even a short disruption could have widespread impact.

After more than a decade as a Commvault customer, SMMPA faced a new wave of cyber readiness requirements. Cyber insurance providers introduced stricter mandates, including des sauvegardes «air-gapped» and malware scanning at rest.

At the same time, the team needed confidence that it could rapidly recover mission-critical systems such as domain controllers, SQL databases, and application servers, without risking the restoration of compromised data.

“As our cyber readiness requirements evolved, we started evaluating Cleanroom more seriously,” says Alan Wagner, Manager of IT & Corporate Cybersecurity at SMMPA. “We were thinking about additional ways to safeguard and protect ourselves. Cleanroom sounded like it would be a good solution for that.”

Having relied on Commvault for more than a decade and recently expanding into Commvault Cloud SaaS protection for Microsoft 365, SMMPA viewed Cleanroom as a natural next step in strengthening its cyber resilience strategy and helping it meet new compliance expectations.

Un parcours de mise en œuvre collaboratif

SMMPA’s Cleanroom deployment in March 2025 showcased the power of collaboration between its team and Commvault. Sam Mack, IT/OT and Cybersecurity Specialist at SMMPA, appreciated the responsive partnership: “The Commvault team was quick to address any questions we had during setup.”

The team worked together to optimize its VMware virtual machine configuration for the Azure environment. “We discovered we needed to install some additional tools on the virtual machines to get them running smoothly within Cleanroom,” Sam explains. This fine-tuning meant its recovery solution was calibrated for its specific infrastructure.

The result? A successful implementation that met all SMMPA’s requirements and positioned it for robust cyber resilience.

Protéger ce qui compte le plus

SMMPA uses Cleanroom to protect its critical infrastructure, including file servers, application servers, SQL servers, virtual domain controllers, and print servers.

“We’re an Office 365 shop, and we use Commvault Cloud to back up that infrastructure,” Sam says. “In the event of a compromise, getting those domain controllers, file servers, and SQL servers is going to be our priority.”

The solution was particularly well suited to SMMPA’s environment. “I have to give Commvault and their teams a lot of credit for bringing Cleanroom to our attention,” Sam says. “Our cyber insurance policy is really big on pushing for des sauvegardes «air-gapped» and malware scanning at rest, so Cleanroom was the perfect fit.”

L’importance de la confiance

While SMMPA has been fortunate not to face a real-world cyberattack requiring Cleanroom, the solution provides valuable peace of mind to the team.

“It gives me a more secure feeling that if something happened, we would be able to get back up and running in a reasonable amount of time,” Alan says. “Cleanroom gives us confidence that we can restore our systems without worrying that something malicious is being brought back with the data. Nothing is ever 100% guaranteed, but since implementing Cleanroom, I’ve had far fewer concerns.”

The organization conducts annual testing of its Cleanroom capabilities, with plans to potentially increase the frequency to biannual testing. This regular validation helps keep the team familiar with the recovery process and maintain confidence in its ability to respond effectively to any incident.

“Cleanroom gives us a more secure feeling that if something happened, we would be able to get back up and running in a reasonable amount of time – without the concern, or with a minimal concern, that there’s something malicious in the data being restored.”

– Alan Wagner, Manager of IT & Corporate Cybersecurity, SMMPA

As SMMPA continues to refine its cybersecurity strategy, Cleanroom remains a cornerstone of its defense. The straightforward integration with its existing Commvault infrastructure, combined with the specific capabilities that meet its cyber insurance requirements, made it an obvious choice.

Cara Peterson occupe le poste de responsable « Voix du client » chez Commvault.

Blogs connexes

More related posts

CleanroomRecovery_Thumbnail_888x500

Commvault Cleanroom

Read more

Points clés à retenir

  • Commvault élargit son portefeuille de solutions de résilience des identités pour prendre en charge Okta ; le programme d’accès anticipé devrait débuter en avril 2026.
  • L’identité est devenue un vecteur d’attaque majeur, avec107 milliards d’enregistrements d’identité exposés en 2024et57 % des cyberattaques commencent par la compromission d’identifiants.
  • The new capabilities can help provide automated, policy-driven protectionetgranular, point-in-time recovery for critical Okta objectsetconfigurations.
  • Backup data is stored in immutable, air-gapped storage to help safeguard identity environments from ransomwareetunauthorized changes.
  • The solution extends Commvault’s unified résilience des identités platform across hybrid environmentsetwill be priced on a per-user basis.

Identity has become the new frontline of cyber defense –etthe stakes have never been higher.

Today, Commvault is announcing the expansion of its résilience des identités portfolio to include support for Okta, delivering automated protectionetrapid recovery for one of the enterprise’s most critical control planes.Early Access is expected to begin in April 2026.

As credential theft acceleratesetidentity exposures surge worldwide, organizations can no longer treat identity systems as simply another application.Identity is the gateway to everything – users, applications, APIs, automation,etincreasingly, AI agents.When identity fails, the business stops.

Pourquoi la résilience identitaire est-elle si importante aujourd’hui ?

Les chiffres sont éloquents :

The rapid growth of non-human, agentic,etAPI-based identities has dramatically expanded the attack surface.Meanwhile, hybrid cloud adoption, SaaS sprawl,etAI-enabled automation have elevated identity providers like Okta to mission-critical infrastructure.

While Okta is built on a resilient platform, when an identity provider is disrupted – whether due to human error, misconfiguration, ransomware, or malicious tampering – the consequences are rapid:

  • Les utilisateurs n’ont plus accès au site.
  • Les applications ne parviennent pas à s’authentifier.
  • Les systèmes générateurs de revenus marquent le pas.
  • Les services destinés aux clients sont interrompus.

And yet, many enterprises still rely on manual scriptsetad hoc processes to restore identity environments – increasing downtime, operational complexity,etrisk.

That’s the gap Commvault is helping to close.

Intégration de la récupération automatisée des identités dans Okta

Commvault’s expanded résilience des identités capabilities can help provide automated protectionetgranular recovery for critical Okta objectsetconfigurations.

Rather than rebuilding entire environments after an incident, organizations can precisely restore what was impacted – quicklyetconfidently.

“Identity is the new cyber battleground, with most modern attacks targeting identity systems,” said Pranay Ahlawat, Chief TechnologyetAI Officer at Commvault.“By extending our résilience des identités capabilities to Okta, we’re helping customers protect one of their most critical control planesethelping ensusre they can rapidly recover accessetmaintain business continuity even in the face of disruption.”

Capacités clés

Accelerated recovery from identity disruptions: Automated, policy-driven protection of critical Okta objects – including users, groups, applications,etpolicies – can help organizations to restore access quickly following outages, operational mistakes, or cyber incidents.

Granular, point-in-time recovery: Can help precisely restore only deleted, misconfigured, or compromised objectsetsettings.No full-environment rebuilds required.

Ransomware-resistant protection: Backup data is stored in Commvault-managed immutable, air-gapped storage isolated from production environments, helping safeguard identity data from ransomwareetunauthorized changes.

Streamlined, integrated recovery: Recover complex, interconnected identity systems through a unified workflow – helping reduce operational overheadetsave valuable time during incidents.

Unified résilience des identités platform: Support for Okta extends Commvault’s single-platform approachdans des environnements d’identité hybrides, ce qui permet d’assurer une application cohérente des politiques,gouvernance,etrecovery across providers.

Accès anticipé prévu en avril 2026

Commvault’s résilience des identités support for Okta is expected to be available through public Early Access in April 2026, with general availability planned for Summer 2026.

The solution will be offered globally as part of the Commvault Cloud Identity Resilience suiteetpriced on a per-user basis.

If identity is now the enterprise control plane, resilience must extend to identity itself.With support for Okta, Commvault continues advancing unified resilience at enterprise scale – helping organizations recover faster, minimize disruption,etstay operational in the face of escalating identity-driven cyber risk.

Learn more about résilience des identités ici.S’inscrirepour notre webinaire « L’identité sous menace : reprenez le contrôle grâce à Commvault Identity Resilience, désormais compatible avec Okta ».

FAQ

Q: Why is résilience des identités becoming a top priority for enterprises?
A: Identity systems now function as the enterprise control plane, governing access for users, applications, APIs,etAI agents.As credential theftetidentity-based attacks increase, disruptions to identity providers can immediately halt business operations.Protectingetrecovering identity infrastructure has become mission-critical.

Q: What does Commvault’s support for Okta include?
A: The expanded capabilities help provide automated protectionetgranular recovery for essential Okta objects such as users, groups, applications,etpolicies.This will help organizations restore specific items impacted by outages, misconfigurations, or cyber incidents without rebuilding entire environments.

Q: How does granular, point-in-time recovery benefit security teams?
A: Instead of performing full-environment restores, teams can precisely recover only deleted or compromised objectsetsettings.This approach helps reduce downtime, lower operational risk,etaccelerate restoration of normal access.

Q: How does Commvault protect identity data from ransomware?
A: Backup data is stored in immutable, air-gapped storage managed by Commvaultetisolated from production environments.This architecture helps safeguard identity configurations from ransomwareetunauthorized modifications.

Q: When will Okta support be available?
A: Public Early Access is expected to begin in April 2026, with general availability planned for Summer 2026.The offering will be available globally as part of the Commvault Cloud Identity Resilience suite.

Q: How does this expansion fit into Commvault’s broader resilience strategy?
A: Adding Okta support helps strengthen Commvault’s unified, single-platform approach to résilience des identités across hybrid environments.It enables consistent gouvernance, policy enforcement,etrecovery workflows, helping organizations maintain business continuity even during identity-driven disruptions.

Katharine Colucci est responsable marketing produit chez Commvault.

Blogs connexes

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Periods of geopolitical instability, including the current conflict in the Middle East, can lead to an increase in cyber activity from both state‑linked groups and opportunistic threat actors. Government agencies and industry organizations have encouraged businesses to maintain a heightened security posture during this time.
At Commvault, we’re doing exactly that. We’ve elevated our internal awareness, tightened our operational discipline, and reinforced our resilience measures. Commvault also works with a trusted threat intelligence partner, CloudSEK, afin de suivre l’évolution des risques et d’adapter notre stratégie de sécurité en conséquence. Nous encourageons nos clients, nos partenaires et nos homologues du secteur à prendre des mesures similaires pour se tenir informés et renforcer leurs contrôles informatiques fondamentaux.

Les priorités des organisations en ce moment

1. Know when to shift into “heightened alert” mode

Have clear internal criteria for when to increase monitoring, limit non-essential changes on critical systems, or accelerate incident‑response readiness. These moves don’t need to be dramatic – they just need to be deliberate and well‑coordinated.

2. Renforcer la discipline en matière d’identité et d’accès

During periods of heightened regional tensions, many threat actor campaigns rely on compromising user accounts. Reinforce good hygiene: regular credential rotation, strong authentication, careful review of unusual login behavior, and prompt investigation of anything that looks out of place. For practical steps to reduce identity-related risk, see Commvault’s recent blog on Bonnes pratiques en matière de sécurité.

3. Pay closer attention to your internet-facing perimeter and remote access

Threat actors often take advantage of internet‑facing systems or remote access tools during global flare‑ups. Ensure these systems are well‑maintained, updated, and monitored.

4. Be prepared for potential availability disruptions

DDoS and hacktivism activity often spikes during regional conflicts. Talk with your service providers, understand your mitigation options, and rehearse your internal escalation and communications plan so you’re ready if availability becomes a target.

5. Validate your ability to recover quickly

In times of uncertainty, resilience matters as much as prevention. Ensure your critical data is backed up securely, stored in multiple forms and locations, and restorable on short notice. Practicing recovery is just as important as having the backups themselves.

6. Watch for misinformation, social engineering, and false noise

Periods of conflict tend to bring surges in defacements, false breach or shutdown claims, and social‑media‑driven narratives. Treat sensational claims cautiously, verify impacts through trusted channels, report suspicious communications quickly, and maintain steady communication practices.

7. Stay aligned with trusted advisories

Follow alerts and guidance from reputable government and industry bodies. These sources regularly highlight shifts in regional threat activity and recommend practical steps organizations can take to prepare. A few resources include: CISA Cybersecurity Advisories; UK NCSC Reports & Advisories; CERT-EU Security Advisories; and NIST National Vulnerability Database.

Stay ready, stay resilient

Cybersecurity during global instability is not about panic, it’s about posture. By staying informed, tightening foundational practices, and strengthening resilience, organizations can navigate turbulent periods with confidence.
If you’d like help reviewing your preparation or refining your approach, our team is here to support you.

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • Les stratégies de résilience traditionnelles s’effondrent face à l’ampleur,à la rapidité et à l’autonomie des systèmes basés sur l’IA.
  • Les ransomwares industrialisés et les attaques basées sur l’IA ciblent désormais les systèmes de sauvegarde,sapant ainsi les fondements mêmes de la Recovery.
  • Les organisations doivent passer d’une organisation en silos des équipes chargées de la sécurité et de la Recovery à un modèle unifié et continu appelé « opérations de résilience ».
  • La résilience basée sur l’IA nécessite une visibilité des données en temps réel,une détection continue des menaces et une Recovery intelligente et propre à grande échelle.
  • Les plateformes modernes permettent une Recovery rapide et vérifiée,aidant ainsi les entreprises à éviter le compromis entre une restauration rapide et une restauration sécurisée.

Alors que les entreprises se précipitent pour adopter l’IA,les RSSI et les DSI prennent conscience d’une réalité brutale : les stratégies de résilience qui fonctionnaient pour les infrastructures traditionnelles ne tiennent plus la route. Des systèmes qui pouvaient se remettre d’une attaque en quelques heures peuvent désormais mettre plusieurs jours. Les approches de sauvegarde conçues pour des données centralisées peuvent rencontrer des difficultés face à des charges de travail réparties entre les clouds et les plateformes d’IA. Parallèlement,les menaces et les vulnérabilités potentielles ne cessent de croître de jour en jour.Lors d’un récent webinaire,Tim Zonca,vice-président du marketing de portefeuille chez Commvault,a abordé une question urgente à laquelle sont confrontés les responsables de la sécurité : comment maintenir la résilience alors que l’IA bouleverse fondamentalement les règles du jeu ?

What Industrialized Ransomware and AI Mean for Resilience

CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.

As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.

Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.

Making Resilience Operational

As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:

  • Sécuriser en permanence les données à la source et surveiller les anomalies.
  • Contrôler les identités des personnes,des entités non humaines et des appareils qui accèdent aux données et les utilisent de manière autonome.
  • Assurer une Recovery prévisible des données à très grande échelle,sans compromission ni corruption.

Traditionnellement,la sécurité des données,la résilience des identités et la cyber-Recovery fonctionnaient comme des disciplines indépendantes,chacune disposant de sa propre équipe,de ses propres outils,de ses propres politiques et de ses propres exigences. Ces silos laissent des failles que les attaquants peuvent exploiter et ralentissent la récupération en cas de défaillance des systèmes d’IA. Pour combler ces lacunes,les organisations doivent unifier ces capacités au sein d’une boucle continue et automatisée. Nous appelons cette approcheles « opérations de résilience » (ResOps).

Les ResOps englobent trois exigences essentielles pour la résilience de l’IA :

  • Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
  • Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
  • Intelligent recovery: Automated,comprehensive restoration for entire cloud-native applications and their dependencies. To prevent re-infection,teams must validate data integrity and conduct forensic analysis in an isolated cleanroom before moving trusted data back to production.

Enabling ResOps in practice

To help companies make the move to ResOps,Commvault has introducedCommvault Cloud Unity,la version la plus importante de notre plateforme à ce jour. Elle est conçue pour réunir les trois dimensions de la résilience :

A next-generation architecture brings AI automation to all facets of data protection,la sécurité des données,résilience des identités,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.

As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.

With Commvault Cloud,la surveillance continue des menaces and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.

See ResOps in action

Regardez l’intégralité du webinaire à la demande to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.

FAQs

 Q: What is Resilience Operations (Res Ops)?

A: ResOps is an operating model that unifies la sécurité des données,résilience des identités,and cyber-récupération into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.

Q: Why can’t traditional backup and recovery handle AI workloads?

A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.

When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.

Q: What does “unified resilience” mean in practice?

A: Unified resilience means bringing la sécurité des données,identity management,and cyber-récupération together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.

In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.

Q: What’s the difference between cyber resilience and AI resilience?

A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.

Q: How does ransomware target backup systems?

A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.

Q: What is the clean vs. complete recovery dilemma?

A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through la surveillance continue des menaces and verified recovery points.

Q: What is a cleanroom in cyber-récupération?

A: A cleanroom in cyber-récupération is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.

Sam Curcuruto is Director of Product Marketing at Commvault.

Blogs connexesRepenser la résilience à l’ère de l’IA

A CIO’s Perspective: Strengthening Business Resilience in the AI Era

Résilience face à la machine IA

Les innovations en matière de Cleanroom Recovery ouvrent une nouvelle ère en matière de cyber-résilience

More related posts

Thumbnail_Blog-Clumio-S3-Backup-2026

Configuring S3 Backup and Recovery with Clumio

Read more
person-escalator-crocus-888×500

Your Modern Playbook for Identity Resilience: Rapid Response and Clean Recovery

Read more
Thumbnail_Blog-Architect-for-tomorrow-2026

Architect for Tomorrow: Unified Data Protection as the Foundation for Resilience

Read more

Points clés à retenir

  • “Instant restore” claims often break down at scale due to real-world I/O operations per second (IOPS), rehydration, and infrastructure constraints.
  • Mass live mounts on deduplicated backup storage can cause performance collapse, forcing slow rehydration back to primary storage.
  • Cleanrooms help enables parallel forensic investigation and business recovery instead of serial, delay-driven downtime.
  • Identity compromise expands the blast radius, making isolated recovery and Active Directory (AD) restoration critical to secure operations.
  • Automated cleanroom runbooks and repeatable testing help organizations validate real recovery metrics before a crisis occurs.

Let’s start with a quick story about a “ransomware‑proof” environment that took 72 hours to recover, way beyond the organization’s expectations for recovery time objective. It is exactly the kind of situation where Commvault’s Cleanroom could have helped turn a painful, three‑day outage into a faster, more controlled recovery with less risk.

War Story: Physics vs. Marketing

On Reddit, a user shared how the financial services firm they work for was hit by a breach. They assumed they had a “dream stack” for quick recovery (but can you really have a “dream stack” without Cleanroom?): immutable backups, secure storage snapshots, and a modern hypervisor. The datasheets promised “instant mass restore,” yet the business sat offline for three days while everyone tried to drag their environment back to life.

The root cause was not that backups failed, but that the real‑world physics of rehydration, forensics, and identity were never tested at scale. The original poster mentioned that having access to a cleanroom environment would have sped up the process. Let’s dig into this further and address why.

Commvault’s Cleanroom is designed to address exactly these weak points: It helps automate clean, isolated recovery into the cloud, validates data, and orchestrates recovery in a way that aligns with how incidents actually unfold, not just how diagrams look on slides.

Problem 1: The Rehydration Trap

In the story, “live mounting” a handful of virtual machines (VMs) worked fine, but trying to live mount hundreds crushed the backup appliance. The random I/O running directly on deduplicated, compressed backup storage collapsed the IOPS, forcing the team to rehydrate everything back to primary Non-Volatile Memory Express at about 3 TB/hour for roughly 100 TB of data.

Commvault Cleanroom helps recover workloads into an isolated Azure‑based cleanroom built on scalable cloud compute and storage instead of trying to run production at scale off a backup appliance.

This allows you to restore critical VMs into a purpose‑built recovery environment, use cloud elasticity to absorb I/O, and automate the recovery sequence so the right systems (identity, core apps, critical data) come up first without bottlenecking on a single backup target.

Problem 2: The Forensic Drag

In the audit, the tech stack was ready in about four hours, but legal delayed touching anything for 72 hours because they had no pre‑provisioned cleanroom. Without an isolated environment with zero routes back to production, the forensics team could not safely investigate while the business recovered, so everyone waited for the all-clear before starting any real restore.

Cleanroom provides an on-demand, isolated recovery environment explicitly built for simultaneous recovery and forensic analysis. You can spin up a fenced cleanroom in Azure in hours, recover systems into it, and let security and legal teams perform read‑only forensics and threat scanning while operations validates applications and prepares for cutover – dramatically shrinking “forensic drag” as a contributor to downtime.

Problem 3: Identity Blast Radius

The environment in the story had a single admin account with access to both the hypervisor and backup console, which meant if attackers pivoted that far, immutability could become just another setting they flipped off. Identity, not just data, was the real blast radius problem.

Cleanroom is designed to help reduce dependency on the compromised production identity plane during recovery, allowing isolated access and planned support for AD restoration in the cleanroom.

By recovering identity services into an isolated cleanroom and using separate, least‑privilege access paths, you can help validate AD, help enforce proper authorizations, and help protect backup control planes from being trivially compromised by the same credentials that were used in production.

How Cleanroom Would Change This Story

If this customer had used Cleanroom, their recovery story could have been very different.

For organizations that already invest in “ransomware‑proof” stacks, the missing piece is often not more features but a cleanroom strategy that respects physics, identity, and legal reality. Commvault Cleanroom is designed to close that gap and help turn recovery from a three‑day war story into a controlled, provable, and much faster operation.

FAQ

Q: Why did the “instant mass restore” approach fail in the ransomware scenario?
A: While live mounting a few VMs worked, scaling to hundreds overwhelmed the backup appliance due to I/O constraints. Deduplicated and compressed backup storage is not designed to handle full production workloads at scale, leading to performance collapse and delayed recovery.

Q: What is the “rehydration trap” in disaster recovery?
A: The rehydration trap occurs when organizations must restore large volumes of compressed backup data back to primary storage before systems can operate normally. This process is limited by throughput rates, which can dramatically extend recovery times when dealing with tens or hundreds of terabytes.

Q: How does a cleanroom help reduce forensic-related downtime?
A: A cleanroom provides an isolated environment where forensic teams can safely investigate while IT simultaneously restores systems. This parallel approach helps eliminate long waiting periods for legal or security approval before beginning recovery efforts.

Q: Why is identity such a critical factor in ransomware recovery?
A: If attackers compromise administrative credentials tied to both production and backup systems, immutability controls may no longer provide protection. Isolated identity recovery and least-privilege access can help limit blast radius and support a safer restoration process.

Q: How does Cleanroom help improve recovery orchestration?
A: Cleanroom helps automates workload sequencing, cleanpoint validation, and cloud-based recovery infrastructure provisioning. This structured approach aligns recovery with how incidents actually unfold, helping organizations regain control faster and with greater confidence.

Q: What is the strategic lesson for organizations with “ransomware-proof” stacks?
A: Advanced features alone do not guarantee fast recovery. A cleanroom strategy that accounts for infrastructure physics, identity isolation, and legal realities helps enable organizations to turn theoretical resilience into measurable, repeatable recovery performance.

Nico Guerrera is Senior Solutions Marketing Manager at Commvault.

Blogs connexes

Récupération de la forêt Active Directory : Pourquoi les méthodes manuelles ne sont plus viables

Tests de récupération : La pièce manquante dans la plupart des programmes de cyber-résilience

Votre manuel de jeu moderne pour une réponse rapide et une récupération propre

Débloquer la cyber-résilience : Le pouvoir des salles blanches

Why Cleanroom and Cyber Testing are Critical for Cyber Resilience

More related posts

Cyber Resilience

Read more