Points clés à retenir

• Advanced AI models escaped a restricted evaluation environment by exploiting previously unknown vulnerabilities.
• OpenAI says the models were pursuing an assigned objective, not acting with malicious intent, yet still caused a real security incident.
• Traditional controls like sandboxing and segmentation are insufficient if AI can discover unexpected paths around them.
• Cyber resilience is becoming as important as prevention.

It began as an internal evaluation of advanced AI cyber capabilities.

While attempting to solve a narrowly defined benchmark, OpenAI models discovered a zero-day vulnerability, escaped the intended restrictions of their test environment, escalated privileges, reached the internet, and compromised Hugging Face infrastructure.

They treated the technical boundaries around them as problems to solve.

This Was Not a Traditional Cyberattack

Hugging Face first reported that an autonomous AI-agent framework had compromised part of its production infrastructure. A malicious dataset exploited two code-execution paths in its dataset-processing pipeline, escalated to node-level access, harvested credentials, and moved laterally across internal clusters.

The models involved, including GPT-5.6 Sol and a more capable pre-release model, were operating with reduced cyber refusals and without the normal production classifiers. They went far beyond the assignment, exploiting a proxy vulnerability to reach the internet, then using stolen credentials and zero-day vulnerabilities to find a remote-code-execution path on Hugging Face servers.

Malicious Intent Was Not Required

There is no public indication that the models developed criminal intent or chose to harm Hugging Face. They did not need to. Give a capable system an objective, tools, time, and feedback, and it will route around obstacles.

The conversation has moved past prompts and bad answers. These are systems that can investigate, test assumptions, discover previously unknown vulnerabilities, use stolen credentials, escalate privileges, and continue operating when the first approach fails.

A Sandbox Is Not a Force Field

We call environments isolated, segmented, and sandboxed as though the label itself creates security. It does not. In this case, the obvious path to the internet was blocked, but a reachable software-package proxy was not, and the models used its vulnerability to escape. Policies and expected behavior are not enough. The technical environment itself must enforce the boundaries.

Why This Is a Resilience Story

The activity moved from an evaluation environment, through OpenAI’s research infrastructure, onto the internet, and into Hugging Face’s production environment. That is a rapidly expanding blast radius. When AI can explore and act at machine speed, the time between initial access and broader compromise may continue to shrink.

Hugging Face did not simply block the original access path and declare the incident over. It closed the vulnerable code-execution paths, rebuilt compromised nodes, rotated credentials and tokens, and tightened cluster controls. The objective is not merely to restore a system. It is to restore confidence.

The question is no longer only: Are our AI systems secure? It is: When a powerful AI system finds a path we did not know existed, can we contain the blast radius, continue critical operations, rebuild what we no longer trust, and prove it is safe to move forward?

Chris Bevil is Principal Portfolio Marketing Manager at Commvault.

Security does not end at the edge of an organization’s own systems. Modern businesses connect a growing web of third-party applications to their core platforms to support sales, service, and collaboration. Each of these connections adds value. Each one also introduces exposure the organization does not fully control.That risk is not hypothetical. In June 2026, a threat actor compromised OAuth tokens tied to Klue, a competitive intelligence platform used to sync sales and marketing data with Salesforce. The attacker used those tokens to reach the Salesforce environments of the many organizations that had authorized the integration, including Commvault’s.As soon as we were notified of potential impact, our Security team activated our incident response process to determine what had occurred, contain the exposure, and assess whether customer information or Commvault services were affected.Our investigation found that the activity was limited to certain business relationship and sales information maintained within our Salesforce environment. The investigation found no indication that any customer backup data, product data, product metadata, operational logs, or Commvault services were impacted.

Acting Quickly When It Matters

Our response followed established security incident response procedures built to contain risk quickly while supporting a thorough investigation. Once we were notified of the incident, we disabled the Klue integration, revoked the associated access, and worked with the appropriate parties to conduct a full assessment of what happened.Throughout the investigation, our teams worked to determine what information had been accessed, validate the integrity of our environment, and confirm the incident stayed within the scope we had already contained.

A Pattern Worth Noting

This incident is one recent example of a pattern security teams have watched grow for several years: attackers targeting third-party applications connected to core business systems rather than attacking those systems directly. A single compromised integration can offer a trusted path into the environments of many downstream organizations at once, often with less resistance than a direct attack on any one of them.This shifts where an organization’s defense actually has to live. Strong internal controls remain necessary, but they are no longer sufficient by themselves. They have to be paired with active oversight of every application an organization connects, and a response capability that is ready before an incident, not built during one.

Building Resilience Beyond Our Own Environment

At Commvault, our security program includes ongoing assessment of the third-party applications connected to our environment. We review connected applications on a regular basis, evaluate the access each one holds, monitor for emerging risk, and reassess those integrations as business needs and the threat landscape change. When circumstances warrant, we act to reduce exposure and strengthen our posture, including disconnecting integrations that no longer meet our standards.

Our Commitment to Transparency

Trust is built through openness and accountability. When an event affects our stakeholders, we believe it is important to communicate what we know, explain how we responded, and share the outcome of our investigation, even when the event originated outside our own systems.We will continue to evaluate our security controls, refine our incident response processes, and strengthen our approach to third-party risk as part of our broader commitment to protecting our customers and partners.For the official details of this incident, including the scope of the investigation and customer guidance, please refer to ourTrust Center Updates.Will Galway is Deputy CISO at Commvault.

For years,post-quantum cryptography (PQC) sat comfortably in the category of “important, but not urgent.”

Security leaders knew it was coming. Researchers talked about it. Standards bodies worked on it. Most organizations acknowledged that it would eventually require attention. But I would argue that the time to start preparing is now.
In this episode of STRIVE, I sat down with Sr. Director of Portfolio Marketing Michael Fasulo to discuss why the conversation around PQC is changing so quickly – and why the organizations that wait for certainty may find themselves running out of time.
Watch the épisode.

Points clés à retenir

• Harvest Now, Decrypt Later attacks mean sensitive data is already at risk, even if quantum capabilities aren’t stable or commercially viable yet.
• Most organizations do not have a complete view of their cryptographic inventory, making discovery the first major hurdle.
• PQC is just as much a technology challenge to solve for and as much as it is about risk prioritization.
• The organizations that start preparing now will have more options to course correct on prioritizations than those forced to react later.

The Problem Isn’t the Technology

Most discussions about post-quantum cryptography start with technology.

• How quickly is quantum computing advancing?
• When will cryptographically-relevant quantum systems become practical?
• Which algorithms are likely to survive long term?

Those are important questions. But they’re not the questions I would prioritize asking. Michael wrote a blog last year about PQC and we discussed today how several things have changed since then.
Over the past several years, estimates have consistently moved in one direction: what once felt distant now feels increasingly close. At the same time, standards are evolving; regulatory expectations are increasing, and organizations are beginning to recognize how much cryptographic debt they’ve accumulated over the decades.
The exact date of Q-Day may remain uncertain. The direction of travel is not.

The Risk Is Here And Now

One reason this conversation has become more urgent is the growing attention around Harvest Now, Decrypt Later attacks. The concept is straightforward: An adversary gains access to encrypted information today, stores it, and waits for future capabilities to make that information readable.
What’s important here is that the risk doesn’t begin when quantum computing arrives. The risk begins when even encrypted data is exfiltrated and stored.
For organizations protecting intellectual property, healthcare records, government information, or other sensitive long term retention data, that distinction changes everything.
Organizations need to know whether data being retained today will still matter when that future arrives.
For many,esp. the highly regulated industries and critical infrastructure, the answer is yes.

Sneak Peek: Why Crypto Agility Matters

Embed clip here: https://www.youtube.com/watch?v=A3YWU5rlmGA

In this clip, Michael explains why PQC isn’t a one-time fix or switch. The real goal is crypto agility – building the flexibility to adapt cryptographic algorithms as standards, and threats evolve. Because in cybersecurity, the challenge isn’t just preparing for what’s next. It’s being ready for what comes after that.

Discovery Is the Real Project

One misconception about PQC is that it’s primarily an encryption upgrade. In reality, most organizations haven’t reached the stage where replacement is the biggest concern.
They’re still trying to understand the scope of the problem. Cryptography exists everywhere.

• Applications
• Certificates
• Cloud services
• APIs
• Code signing
• Third-party platforms

Many organizations struggle with the creation of the cryptographic inventory or its scope. That makes discovery one of the most important – and often underestimated – parts of the journey.
And for many enterprises, that’s a much larger endeavor than expected.

The Supply Chain Challenge

Another reason PQC has become a priority is that no organization will navigate this transition alone. Modern enterprises depend on vendors, cloud providers, software partners, and countless third parties, all of whom use cryptography.
That means quantum readiness extends beyond internal systems. It becomes a question of ecosystem readiness.

• Are suppliers preparing?
• Are critical vendors planning migrations?
• Are third-party platforms aligned with emerging standards?

These questions will increasingly become part of risk conversations, procurement discussions, and long-term technology planning. Because cryptography doesn’t stop at organizational boundaries. Neither does risk.

Why This Conversation Matters

The most important takeaway from this discussion is that post-quantum cryptography is no longer a future technology challenge.
It’s becoming a present-day resilience conversation.
Organizations don’t need to panic and they don’t need to overhaul every system overnight. But they do need to begin, to make the best use of the time at their disposal for prepartion.
The organizations that navigate this transition successfully won’t necessarily be the ones with the most sophisticated cryptography. They’ll be the ones that started building understanding before certainty arrived.
And that’s often how resilience works.

Watch the Full Episode

There is plenty more that Michael and I explore in the episode that I didn’t capture above. Be sure to watch nowfor insights to:

• The biggest challenges organizations face when starting their PQC journey.
• What leaders should prioritize today including some best practices.
• Understanding MLKEM algorithms and crypto agility.
• Infrastructure considerations for PQC.
• How Commvault is preparing for this future.

FAQs

Q: What is post-quantum cryptography (PQC)?
A: PQC refers to cryptographic algorithms designed to help remain secure against attacks from future quantum computers.
Q: What is Harvest Now, Decrypt Later?
A: It’s a strategy where attackers collect encrypted data today with the intention of decrypting it later when more advanced computing capabilities become available.
Q: Why are organizations focusing on PQC now?
A: Because preparation takes years, and sensitive data collected today may still be valuable when quantum threats become practical.
Q: What is the biggest challenge organizations face?
A: Discovery. Most organizations do not have complete visibility into where cryptography is used across their environments.
Q: Do organizations need to replace all cryptography immediately?
A: No. Most experts recommend starting with inventory, discovery, and prioritization before planning broader migrations.
Q: What should leaders do first?
A: Identify long-lived sensitive data, understand cryptographic dependencies, and begin building a roadmap for future transition.
 

Vidya Shankaran is Field CTO at Commvault.

To address mandates governing where their data is stored and used,many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography,that no foreign-jurisdiction personnel accessed it,and that they can recover it within 24 hours under incident conditions.

In a recent webinar,I joined Commvault GM Alex Zinin,who leads our digital sovereignty task force,along with Jakub Lewandowski,our associate general counsel for EMEA,and Pranay Ahlawat,our chief technology and AI officer,to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.

See the full webinarand get the fullLa souveraineté numérique décryptéereadiness report and implementation framework.

Points clés à retenir

• The EU Cloud Sovereignty Framework defines eight sovereignty objectives,only one of which concerns data location.
• Selecting a sovereign cloud region addresses where data lives,but not who can access it,under what legal authority,or whether you can recover it under real conditions.
• A complete sovereignty posture spans four interdependent pillars: data locality,technological sovereignty,operational sovereignty,and jurisdictional sovereignty.
• Sovereignty programs that treat recovery architecture separately from primary data governance carry an unexamined risk that can surface during incidents.
• Rather than a policy of maximum sovereignty at any cost,organizations should design their strategy around minimum viable sovereignty: the right controls,consistently enforced,calibrated to actual obligations.

Digital Sovereignty Becomes an Enterprise Requirement

Over the past decade,the toughest digital and data sovereignty rules have mainly applied to government,defense,and other national‑security workloads. Outside of highly regulated sectors,many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.

That’s now changing. RGPDenforcement has matured beyond guidance into substantial fines for operational failures,and newer regimes likeDORA,NIS2,Germany’s KRITIS rules,and the EU Data Act have tightened expectations around jurisdictional control and operational resilience.

Sovereignty questions are now surfacing in RFPs,M&A due diligence,and board‑level risk reviews as well.

The EU Cloud Sovereignty Framework,published in October 2025,clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives,only one addresses where data resides. The other seven cover access control,operational dependencies,jurisdictional exposure,and recovery.

For enterprises,this structure is now the lens through which vendor capabilities must be evaluated.

Sneak Peek: Rethinking Sovereignty and Resilience

In this moment from the webinar,Jakub discusses how sovereignty is a risk posture,rather than a single product. Organizations need a holistic strategy that combines architecture,operations,governance,auditability,and recovery planning to address it.

Data Residency Does Not Equal Sovereignty

Data residency only answers questions about where. Sovereignty regulations also require being able to explainwho,how,and under what conditions.

In practical terms,a complete sovereignty posture encompasses four interdependent pillars.

1. Data Locality

This pillar covers not just where data is stored,but where it travels. Control-plane artifacts,metadata,and telemetry can cross geographic boundaries even when primary data stays in-region.

2. Technological Sovereignty

This pillar addresses whether the organization controls the mechanisms that protect data:

• How access is granted.
• How data is encrypted.
• Whether encryption key custody is retained under all conditions.

A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK),where an organization’s own encryption keys are managed within the provider’s platform,and Hold Your Own Key (HYOK),where the organization retains independent custody of keys entirely outside the provider’s environment.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.

3. Operational Sovereignty

This covers who operates the environment and from where,including whether support personnel or third-party vendors are subject to foreign jurisdiction.

4. Jurisdictional Sovereignty

This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access,such as the cross-border situations discussed in the U.S. CLOUD Act.

Each of these pillars is essential to maintain compliance. A strong data locality posture with weak operational controls can allow unexamined risk.

Where Digital Sovereignty Programs Break Down

My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation,it gets too narrow,too quickly. Workshops zoom in on where data lives,teams get to work on that one question,and then they move on,leaving the other three pillars largely unexamined.

Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal,technical,and operational stakeholders,not as an IT project that gets checked off as complete.

Organizations can also be led astray by a few myths. One,as we’ve discussed,is the impression that sovereignty equals residency.

Then there’s the myth of absolute sovereignty,the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice,sovereignty always involves tradeoffs between control,cost,technological velocity,and the ability to innovate.

The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy,but a risk posture built from architecture,operations,contracts,certifications,and continuous auditability.

Resilience Belongs Inside the Sovereignty Boundary

La souveraineté opérationnelle is thehardest pillar to audit and the one most commonly underestimated. If your environment needed access for routine maintenance tonight,who would perform it,from which country,and under which legal jurisdiction?

Most organizations,when they work through that question for the first time,find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure,restoration sequencing,and recovery point management under a separate – and often weaker – set of controls. When an incident occurs,recovery personnel may not meet jurisdictional requirements,and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.

Commvault’s resilience operations model,ResOps™,addresses this need directly by framing recovery as an ongoing operational discipline that needs to be designed,tested,and validated inside the same sovereignty boundary as the data it protects.

Minimum Viable Sovereignty: The Right Level of Control,Not the Maximum

An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.

A payroll system,a customer transaction database,and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.

Minimum viable sovereignty sets a more practical target: the right controls,consistently enforced and continuously demonstrated,calibrated to what each workload actually requires across all four pillars.

Organizations have a broad range of options for how sovereign controls are delivered across their environment,each providing different controls.

How Commvault Is Addressing the Digital Sovereignty Issue

Commvault’s Geo Shield framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU,Geo Shield maps to the full spectrum of deployment models:

• Regional sovereign cloud services delivered as SaaS
• Hyperscaler sovereign-launch partnerships
• Partner-operated national sovereign offerings built with local service providers
• Fully customer-controlled private sovereign environments qualifying under frameworks likeFedRAMP High.

In this way,organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.

Watch the Full Webinar and Get the Readiness Report

In the full webinar,available on demand,you’ll discover:

• Why digital sovereignty is more than a technology solution.
• The role of architecture and operations in sovereignty strategy.
• How governance,contracts,and auditability impact resilience.
• Why sovereignty must hold up during cyber incidents and outages.
• The importance of a holistic,risk-based approach to sovereignty.

Regarder le webinaire à proposand get the fullLa souveraineté numérique décryptéereadiness report and companion framework.

FAQ

Q: What is the difference between data residency and digital sovereignty?

A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data,under what legal authority,through which operational pathways,and whether it can be recovered cleanly under real conditions.

An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel,vendor access agreements,or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.

Q: What is the EU Cloud Sovereignty Framework,and why does it matter?

A: TheEU Cloud Sovereignty Frameworkis a structured assessment tool developed by the European Commission to evaluate cloud and technology providers against sovereignty criteria during procurement processes.

It defines eight sovereignty objectives,with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls,key custody,jurisdictional exposure,and recovery.

The framework represents the most comprehensive public framework for evaluating sovereignty posture and is increasingly being used as a reference by other regions and procurement bodies beyond the EU.

Q: What is the difference between BYOK and HYOK,and why does it matter for sovereignty?

A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys,but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment,including under crisis conditions or legal compulsion.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The U.S. CLOUD Act,for example,can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.

HYOK addresses that exposure directly,though it may require a higher platform tier in SaaS deployments.

Q: Why do most sovereignty strategies overlook operational sovereignty?

A: La souveraineté opérationnelle,covering who operates the environment and from where,is the hardest pillar to audit because it requires inventorying support contracts,vendor access agreements,and third-party dependencies across the full operational chain.

Most organizations start sovereignty programs focused on data location and encryption,which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.

As a first step to evaluate operational sovereignty,you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.

Q: How should organizations think about recovery in the context of sovereignty?

A: Recovery architecture needs to meet the same sovereignty requirements as primary data environments,but it often doesn’t. In most organizations,backup infrastructure,restoration sequencing,and recovery point management are frequently governed by a separate set of controls,or none at all.

During an incident,the personnel authorized to execute recovery may not meet jurisdictional requirements,recovery points may not have been validated as clean and uncompromised,and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.

Q: What does minimum viable sovereignty mean in practice?

A: Minimum viable sovereignty means identifying the right level of control for each workload,calibrated to actual regulatory obligations,risk tolerance,and operational constraints,rather than applying maximum controls uniformly.

Maximum sovereignty comes with real tradeoffs: technological complexity,operational burden,service limitations,and cost. Organizations that define requirements by workload across the four pillars,map those requirements to deployment models,and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.

Q: What role do certifications like C5,SecNumCloud,and ISO 27001 play in a sovereignty strategy?

A: Certifications help provide auditable evidence that controls have been independently verified,an important part of any defensible sovereignty posture. C5 in Germany,SecNumCloud in France,and ISO/IEC 27001each establish baseline requirements that providers must demonstrate through independent audits.

The strongest sovereignty postures treat these certifications as a floor,providing necessary evidence that controls exist,but not a substitute for operational testing under realistic conditions.

Darren Thomson is Vice President and Chief Technology Officer,EMEA,at Commvault. Be sure to catch him in the podcast series, STRIVE.

Points clés à retenir

• La multiplication des outils de sauvegarde entraîne souvent une dépendance opérationnelle vis-à-vis d’un petit nombre de spécialistes, ce qui accroît le risque pour l’organisation.
• La gestion de la protection à travers des consoles, des politiques et des systèmes de reporting distincts rend plus difficile le maintien d’une bonne visibilité et la réactivité face aux incidents.
• La consolidation ne doit pas nécessairement passer par un projet de remplacement radical et perturbateur ; de nombreuses organisations peuvent se moderniser progressivement tout en conservant leurs investissements existants en infrastructure.
• Un plan de contrôle unifié peut contribuer à simplifier la gestion des politiques, la surveillance, l’audit et les opérations de Recovery dans les environnements hybrides.
• Les organisations qui simplifient leur stratégie de sauvegarde réalisent souvent d’importantes économies tout en améliorant leur efficacité opérationnelle et leur résilience.

You didn’t build a messy environment. You built a functional one.

Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.

The stack isn’t the problem. It’s the operational model that comes with it.

Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.

And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.

That’s not resilience. That’s dependency masquerading as expertise.

Le mur des tableaux de bord

Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”

If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.

Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.

The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.

And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.

Ce que la consolidation signifie réellement pour les équipes d’infrastructure

The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.

But that’s not what consolidation has to look like.

The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.

What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.

The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.

Les chiffres parlent d’eux-mêmes

Fortune Brands consolidated its backup environment with Commvault® Cloud and a économisé 22,7 millions de dollars – a 73% reduction in total cost. NTT-Netmagic a réduit ses coûts de 300 000 dollars par an and cut storage overhead by 35%.

Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.

Real Resilience Doesn’t Need a War Room

If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.

Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.

Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.

That’s the case for consolidation. Not a better product. A better way to run what you’ve built.

Want the full picture? Download « Le coût caché des sept outils – a field guide for data center teams who built something worth protecting.

FAQ

Q: Why is managing multiple backup platforms a problem if they’re all working?

A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.

Q: What is one of the biggest risks created by a fragmented backup environment?

A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.

Q: Does consolidation mean replacing all existing infrastructure?

A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.

Q: How can consolidation improve resilience?

A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.

Q: What about vendor lock-in when consolidating to a single platform?

A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.

Q: How do organizations measure the value of consolidation?

A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.

Michael Thelander is Senior Director, Product Marketing, at Commvault.

Points clés à retenir

• La pression réglementaire, les attentes des conseils d’administration et les conflits concrets accélèrent la transition d’une approche axée sur la prévention vers une approche axée sur les résultats en matière de résilience.
• L’architecture de la résilience s’est considérablement complexifiée, d’autant plus que les systèmes d’IUneintroduisent de nouveaux défis en matière de traçabilité des données et de Recovery.
• La cyber-résilience doit aller au-delà de la reprise après sinistre traditionnelle et considérer les perturbations comme un état opérationnel permanent plutôt que comme un événement exceptionnel.
• Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
• Le plus difficile dans la transition vers les ResOps, c’est l’aspect organisationnel. La fragmentation des responsabilités et le manque d’alignement des priorités restent les causes d’échec les plus courantes.

Disruptions have become business as usual. Over the past year alone, we’ve seen:

• Des attaques de drones contre des centres de données aux Émirats arabes unis et à Bahreïnont provoqué des problèmes en cascade au sein des organisations qui y stockaient leurs données et leurs charges de travail.
• Unede configuration DNS commise par un hyperscalera privé d’accès à Internet des millions d’utilisateurs américains.
• Uneincendie dans un centre de données a provoqué des pannes intermittentes for tens of thousands of a top social media platform’s users for an entire day.

Lorsque l’environnement opérationnel est intrinsèquement incertain, les RSSI et les DSI doivent repenser leur approche de la continuité des activités.Lors d’un récent webinaire, David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the METUneregion, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.

Sneak Peek: It’s No Longer a Matter of If, but When

In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.

Why Disaster Recovery Isn’t Enough

Per NIST’s definition, la cyber-résilience va au-delà de la sécurité traditionnelle by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?

Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?

We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.

• In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
• Les réglementations de la North American Electric Reliability Corporation (NERC) relatives à la protection des infrastructures critiques sont également réexaminées sous l’angle de la résilience.
• Les exigences de la Securities and Exchange Commission (SEC) en matière de signalement des violations ont mis l’accent non seulement sur la divulgation, mais aussi sur les mesures prises par les organisations pour se remettre d’un incident.

Les conseils d’administration considèrent désormais toute interruption de service comme un événement préjudiciable à l’activité, et l’attente porte désormais non seulement sur la démonstration que la reprise est possible, mais aussi qu’elle peut se faire rapidement, avec un haut niveau de confiance.
Une étude IDC menée par Handa illustre en quoi les opérations de Recovery traditionnelles peuvent s’avérer insuffisantes. Suite au déclenchement de la guerre au Moyen-Orient, elle a constaté que les DSI et les RSSI peinaient à assurer la continuité non seulement des technologies, mais aussi des ressources humaines et des processus, alors que le personnel était contraint de se relocaliser du jour au lendemain et que les bureaux devenaient inaccessibles, ne laissant personne pour effectuer le basculement manuel.

Et ce n’est là qu’un des innombrables scénarios imprévisibles dont les organisations doivent tenir compte.

Construire une architecture de résilience

Uneresilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.
The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.
AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.
Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.
That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.

ResOps : le modèle opérationnel pour une résilience durable

ResOps treats resilience as a continuous function, not just something that happens in response to an incident.
In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.
Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.

La dimension humaine du ResOps

Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.
ResOps forces organizations to answer questions many haven’t yet worked through, such as:

• Qui a l’autorité nécessaire pour rétablir les services si l’équipe principale n’est pas disponible ?
• Comment les guides d’intervention à distance doivent-ils être structurés ?
• How will cross-regional failover work when it can’t depend on a single location?

In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.
To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.
The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.

Mise en pratique

Commvault aide les organisations à mettre en œuvre le ResOps, depuis la découverte et la protection des données dans les environnements sur site et dans le cloud, jusqu’à la détection des anomalies, la restauration à un état sain et la réintégration des charges de travail validées. Pour les organisations qui s’efforcent de passer des exercices théoriques à des restaurations concrètes, ce sont ces capacités qui contribuent à rendre la résilience opérationnelle en période d’incertitude.
Les ressources issues de la session, notamment l’étude IDC sur l’état de Readiness des DSI et les documents Deloitte sur la Recovery fondée sur des preuves, sont disponibles sur lapage « à la demande.

FAQ

Q: What is cyber resilience and how is it different from disaster recovery?

A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.

Q: What’s driving organizations to prioritize resilience over prevention?

A: Regulatory frameworks like DORUneand evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.

Q: What makes AI systems harder to back up and recover than traditional data?

A: Backing up an AI model means capturing more than the model file itself. Unemodel is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.

Q: What is ResOps, and how does it differ from a traditional resilience program?

A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.

Q: What are the biggest obstacles to adopting ResOps at scale?

A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.

Michael Thelander is Senior Director, Product Marketing at Commvault.

Points clés à retenir

• Commvault AirGap est immuable de par sa conception, et des fonctionnalités de verrouillage WORM sont disponibles pour les organisations soumises à des exigences supplémentaires en matière de conformité et de réglementation.
• Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
• Le stockage WORM engendre des surcoûts dans l’ensemble du secteur, mais Commvault contribue à minimiser cet impact grâce à une gestion efficace des données et à une architecture native du cloud.
• Le coût du stockage de sauvegarde ne se limite pas à la consommation de capacité et doit inclure les dépenses liées à l’infrastructure, à la puissance de calcul et aux opérations.
• Les entreprises devraient s’appuyer sur des tests en conditions réelles pour valider la résilience des sauvegardes, plutôt que de se fier aux arguments marketing des fournisseurs.

Vous avez peut-être récemment entendu un concurrent affirmer queCommvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.
Let us address this directly: These claims are inaccurate.

Prise en charge de l’immuabilité et du verrouillage WORM dans AirGap

AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.
For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across  supported cloud storage targets, including:

• Amazon S3 Object Lock
• Microsoft Azure Blob immutability policies

These features are documented, rigorously tested, and actively used by customers in production environments today.
In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.

Efficacité du stockage : une vision globale

Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.
What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.
However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.
By contrast, modern, cloud-native approaches prioritize:

• Une gestion efficace des données.
• Des modèles de déploiement flexibles.
• L’élimination des dépendances persistantes vis-à-vis de l’infrastructure.

These design principles can result in more predictable, scalable, and sustainable long-term costs.
Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.

Une tendance croissante chez les clients

Nous observons une tendance claire : les entreprises se tournent de plus en plus vers Commvault après avoir décidé de ne pas renouveler leur contrat avec leurs anciens fournisseurs. Parmi les raisons courantes, on peut citer :

• Des limitations inattendues à mesure que les environnements évoluent.
• Des contraintes de performances liées aux architectures basées sur des Appliances.
• Des coûts d’infrastructure et d’exploitation en hausse.
• Des tarifs de renouvellement nettement plus élevés que les conditions d’achat initiales.

These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.

Faire le tri parmi les informations

In a market often shaped by aggressive claims and unclear comparisons, objective validation can be  critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.
Through this program, you can:

• Simuler des scénarios de cyberattaques réels.
• Tester les capacités de Recovery à l’aide de vos propres données et de votre propre environnement.
• Evaluate performance without vendor bias or staged demonstrations.

The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.

FAQ

Q: Is Commvault AirGap truly immutable?

A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.

Q: Does AirGap support WORM lock protection?

A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.

Q: Does enabling WORM lock significantly increase storage costs?

A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.

Q: Why is total cost of ownership more important than storage overhead alone?

A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.

Q: Why are some organizations moving away from appliance-based backup architectures?

A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.

Q: How can organizations validate their cyber resilience strategy?

A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.

Kash Ansari is Chief Customer Officer Americas at Commvault.

Points clés à retenir

• La cyber-résilience repose à la fois sur la technologie et sur l’expertise des professionnels chargés de protéger et de remettre en état les systèmes critiques.
• La formation continue permet aux équipes partenaires de se tenir informées des menaces en constante évolution, des environnements hybrides et des meilleures pratiques en matière de résilience.
• La Commvault la la Readiverse Academy propose des formations adaptées à chaque fonction, des ateliers pratiques et des certifications conçues pour développer des compétences concrètes en matière de cyber-résilience.
• Les clients accordent de plus en plus d’importance aux partenaires capables de leur fournir des conseils fiables, d’accélérer leur préparation à la reprise d’activité et d’optimiser leur résilience.
• Investir dans la formation continue contribue à renforcer les compétences des partenaires, à gagner la confiance des clients et à soutenir la croissance à long terme de l’entreprise.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Renforcer l’expertise en matière de cyber-résilience.
• Renforcez votre assurance lors des échanges avec les clients.
• Restez à la pointe des technologies en constante évolution et des meilleures pratiques.
• Préparez-vous à assumer de nouvelles fonctions et à saisir de nouvelles opportunités.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why la la Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault la la Readiverse Academypropose :

• Parcours d’apprentissage basés sur les rôles.
• Un apprentissage flexible, à son propre rythme.
• Travaux pratiques basés sur des scénarios.
• Des certifications qui attestent de la capacité à exercer dans la vie professionnelle.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through la la Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Accélérer les déploiements.
• Adapter les solutions à l’évolution des besoins.
• Améliorer la préparation opérationnelle.
• Renforcer la préparation aux situations de reprise.
• Relever les défis complexes liés à la résilience.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault la la Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

FAQ

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault la la Readiverse Academy?
A: la la Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.