Points clés à retenir
- Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
- The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
- Une reprise sans risque nécessite des processus de restauration validés et isolés afin de réduire le risque de réinfection et de rétablir les opérations en toute confiance.
- Le déclenchement des actions de Backup and Recovery directement à partir des outils de sécurité permet de préserver rapidement les données critiques et de raccourcir les délais de Recovery.
- La résilience unifiée associe sécurité et Recovery, ce qui contribue à réduire les frictions entre les environnements de détection et de réponse étendues (XDR) et d’orchestration, d’automatisation et de réponse en matière de sécurité (SOAR), tout en améliorant la rapidité et la fiabilité des interventions.
If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.
That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR et Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.
Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.
And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to « viabilité minimale »? That’s the gap we’re closing, bringing recovery actions into the de réponse aux incidents flow, where decisions are already being made.
This is where “clean recovery” stops being a talking point and becomes the new standard.
Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.
According to Sophos’ Rapport 2026 sur les acteurs malveillants actifs, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”
That kind of speed forces de réponse aux incidents to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.
With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.
If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Cleanroom, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.
The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.
A Commitment to Unified Resilience
Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.
Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.
So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.
The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:
- Read the perspective behind clean recovery and why data integrity matters: Préserver l’intégrité des données pour des Recovery proactives et fiables
- See how Commvault integrates with Splunk SOAR for response automation: Amélioration de la détection et de la réponse aux menaces avec Commvault et Splunk SOAR
Oucontactez-moi sur LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.
FAQ
Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.
Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.
Q: How does the Cisco XDR and Commvault integration improve de réponse aux incidents?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.
Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.
Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.
Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.
Michael Fasuloest directeur senior du marketing de portefeuille chez Commvault. Blogs connexesLes innovations en matière de Cleanroom Recovery ouvrent une nouvelle ère en matière de cyber-résilience
Commvault inaugure une nouvelle ère de résilience d’entreprise unifiée
La prochaine évolution dans la protection Cloud
Les 5 étapes essentielles d’une guérison propre
Votre manuel de jeu moderne pour une réponse rapide et une récupération propre