Points clés à retenir

• Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
• The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
• Une reprise sans risque nécessite des processus de restauration validés et isolés afin de réduire le risque de réinfection et de rétablir les opérations en toute confiance.
• Le déclenchement des actions de Backup and Recovery directement à partir des outils de sécurité permet de préserver rapidement les données critiques et de raccourcir les délais de Recovery.
• La résilience unifiée associe sécurité et Recovery, ce qui contribue à réduire les frictions entre les environnements de détection et de réponse étendues (XDR) et d’orchestration, d’automatisation et de réponse en matière de sécurité (SOAR), tout en améliorant la rapidité et la fiabilité des interventions.

If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.

That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR and Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.

Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.

And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to « viabilité minimale »? That’s the gap we’re closing, bringing recovery actions into the de réponse aux incidents flow, where decisions are already being made.

This is where “clean recovery” stops being a talking point and becomes the new standard.

Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.

According to Sophos’ 2026 Active Adversary Report, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”

That kind of speed forces de réponse aux incidents to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.

With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.

If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Cleanroom Recovery, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.

The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.

A Commitment to Unified Resilience

Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.

Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.

So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.

The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:

• Read the perspective behind clean recovery and why data integrity matters: Préserver l’intégrité des données pour des Recovery proactives et fiables
• See how Commvault integrates with Splunk SOAR for response automation: Enhanced threat detection and response with Commvault and Splunk SOAR

Oucontactez-moi sur LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.

FAQs

Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.

Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.

Q: How does the Cisco XDR and Commvault integration improve de réponse aux incidents?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.

Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.

Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.

Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.

Michael Fasulois Senior Director, Portfolio Marketing, at Commvault.

Related BlogsLes innovations en matière de Cleanroom Recovery ouvrent une nouvelle ère en matière de cyber-résilience

Commvault inaugure une nouvelle ère de résilience d’entreprise unifiée

La prochaine évolution dans la protection Cloud

Les 5 étapes essentielles d’une guérison propre

Votre manuel de jeu moderne pour une réponse rapide et une récupération propre

There’s a lot of talk about modernization – Cloud, AI, automation, security transformation. But what does modernization actually look like when you’re responsible for keeping systems running, data protected, and recovery viable under pressure?

In this episode of STRIVE, I had the pleasure of sitting down with Gilman Treantos – a 25-year IT veteran whose career spans everything from mainframes to modern cyber resilience architecture. This conversation provides a practitioner’s view of what modernization really means when outages, ransomware, and operational risk are part of the daily equation.

Watch the épisode.

Key Takeaways: What Modern Cyber Readiness Actually Requires

• Modernization isn’t about new tools – it’s about resilient architecture. Technology evolves, but recovery discipline, testing, and cross-team coordination are what separate reactive organizations from resilient ones.
• Cyber readiness demands collaboration between security and infrastructure. Silos create blind spots. Unified visibility and shared responsibility can create speed in recovery.
• Backup tools are more powerful than most teams realize. When used creatively, they can support large-scale migrations, isolated recovery, and transitions designed to minimize data loss.
• Testing is non-negotiable. A recovery plan that hasn’t been rehearsed is a liability, not a strategy.
• Career resilience mirrors technical resilience. Proactivity, curiosity, and willingness to solve hard problems are as critical as any platform.

From Blockbuster to Cyber Resilience

Gilman’s journey didn’t start in a war room or a security operations center. It started at Blockbuster.

Without formal IT training, he leaned into troubleshooting. That curiosity became mainframe work. That work became distributed systems. That evolved into data protection and cyber resilience leadership.

What stands out isn’t the career arc – it’s the mindset. He built a reputation by taking on the problems no one else wanted. Fixing fragile systems. Supporting overlooked initiatives. Solving issues that crossed organizational boundaries.

That mentality translates directly to modernization, because modern cyber readiness is built by people willing to dig into uncomfortable complexity.

Sneak Peek: The Modernization Playbook

In this segment, Gilman explains why modern cyber recovery requires more than traditional malware detection — and how anomaly detection, ThreatScan, and isolated recovery environments can help strengthen enterprise resilience.

Modernization Under Pressure

One of the most compelling parts of the episode is a real-world example: evacuating a remote data center in a single night. No data loss. No prolonged downtime. No operational chaos.

By leveraging Commvault LiveSync in a creative way, Gilman and his team were able to migrate infrastructure quickly and cost-effectively – using capabilities that weren’t originally designed for that exact scenario.

That’s modernization in practice.

The House of Cards Problem

As organizations scale, permissions sprawl. Backup systems grow complex. Security tools layer on top of infrastructure without full alignment. Over time, environments become fragile.

Gilman describes this dynamic as something many teams underestimate: a slow accumulation of technical and operational debt. Modernization, in his view, isn’t just upgrading platforms. It’s simplifying architecture, improving visibility, and breaking silos between cybersecurity and infrastructure teams.

Cyber readiness means:

• Security and backup teams share telemetry.
• Recovery environments are isolated and tested.
• Malware detection extends beyond primary workflows.
• Infrastructure decisions consider recovery speed.

This is where modernization and resilience intersect.

Threats Are Evolving. So Must Recovery.

Ransomware isn’t slowing down. Threat actors are more sophisticated. Malware hides inside legitimate workflows. Gilman’s perspective is blunt: Preparation must be proactive.

He advocates for:

• Regular disaster recovery testing
• Isolated recovery environments ready to activate
• Anomaly detection tools layered into backup processes
• Cross-team drills that simulate real-world disruption

Watch the Full Episode

Check out our full STRIVE conversation to learn:

• How Gilman evolved his approach to data protection over 25 years.
• The details behind migration designed to minimize data loss.
• Why collaboration between security and infrastructure is essential.
• Practical advice for resilience professionals.
• What modernization really demands in today’s threat landscape.

Regardez-le dès maintenant.

If you care about resilience, recovery, or leading IT through uncertainty, this is 20 minutes well spent.

FAQs

Q: What does “modernization” mean in the context of cyber readiness?

A: It means building resilient, testable, and collaborative systems that can recover quickly under real-world pressure – not just upgrading to newer platforms.

Q: Why is collaboration between security and infrastructure teams so important?

A: Because recovery depends on shared visibility. Security detects threats, but infrastructure enables restoration. Without alignment, response slows and risk increases.

Q: How can backup tools support modernization beyond recovery?

A: When used creatively, they can enable data center migrations, isolated recovery environments, anomaly detection, and large-scale operational shifts.

Q: How often should disaster recovery environments be tested?

A: Regular testing – ideally quarterly or aligned with major infrastructure changes – builds confidence and reveals gaps before an actual incident.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

Related BlogsComment la SMMPA a renforcé sa cyber-résilience grâce à Cleanroom Recovery

Readiness à la cybersécurité dans un contexte de tensions géopolitiques : conseils à l’intention de nos clients, partenaires et de notre communauté

Pourquoi l’IA compromet votre stratégie de résilience (et comment y remédier)

Physique contre marketing : accélérer la Recovery tout en respectant les lois de la physique

Moderniser la cybersécurité financière : De la réactivité à la résilience

Points clés à retenir

• Les stratégies de résilience traditionnelles s’effondrent face à l’ampleur,à la rapidité et à l’autonomie des systèmes basés sur l’IA.
• Les ransomwares industrialisés et les attaques basées sur l’IA ciblent désormais les systèmes de sauvegarde,sapant ainsi les fondements mêmes de la Recovery.
• Les organisations doivent passer d’une organisation en silos des équipes chargées de la sécurité et de la Recovery à un modèle unifié et continu appelé « opérations de résilience ».
• La résilience basée sur l’IA nécessite une visibilité des données en temps réel,une détection continue des menaces et une Recovery intelligente et propre à grande échelle.
• Les plateformes modernes permettent une Recovery rapide et vérifiée,aidant ainsi les entreprises à éviter le compromis entre une restauration rapide et une restauration sécurisée.

Alors que les entreprises se précipitent pour adopter l’IA,les RSSI et les DSI prennent conscience d’une réalité brutale : les stratégies de résilience qui fonctionnaient pour les infrastructures traditionnelles ne tiennent plus la route. Des systèmes qui pouvaient se remettre d’une attaque en quelques heures peuvent désormais mettre plusieurs jours. Les approches de sauvegarde conçues pour des données centralisées peuvent rencontrer des difficultés face à des charges de travail réparties entre les clouds et les plateformes d’IA. Parallèlement,les menaces et les vulnérabilités potentielles ne cessent de croître de jour en jour.Lors d’un récent webinaire,Tim Zonca,vice-président du marketing de portefeuille chez Commvault,a abordé une question urgente à laquelle sont confrontés les responsables de la sécurité : comment maintenir la résilience alors que l’IA bouleverse fondamentalement les règles du jeu ?

What Industrialized Ransomware and AI Mean for Resilience

CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.

As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.

Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.

Making Resilience Operational

As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:

• Sécuriser en permanence les données à la source et surveiller les anomalies.
• Contrôler les identités des personnes,des entités non humaines et des appareils qui accèdent aux données et les utilisent de manière autonome.
• Assurer une Recovery prévisible des données à très grande échelle,sans compromission ni corruption.

Traditionnellement,la sécurité des données,la résilience des identités et la cyber-Recovery fonctionnaient comme des disciplines indépendantes,chacune disposant de sa propre équipe,de ses propres outils,de ses propres politiques et de ses propres exigences. Ces silos laissent des failles que les attaquants peuvent exploiter et ralentissent la récupération en cas de défaillance des systèmes d’IA. Pour combler ces lacunes,les organisations doivent unifier ces capacités au sein d’une boucle continue et automatisée. Nous appelons cette approcheles « opérations de résilience » (ResOps).

Les ResOps englobent trois exigences essentielles pour la résilience de l’IA :

• Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
• Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
• Intelligent recovery: Automated,comprehensive restoration for entire cloud-native applications and their dependencies. To prevent re-infection,teams must validate data integrity and conduct forensic analysis in an isolated cleanroom before moving trusted data back to production.

Enabling ResOps in practice

To help companies make the move to ResOps,Commvault has introducedCommvault Cloud Unity,la version la plus importante de notre plateforme à ce jour. Elle est conçue pour réunir les trois dimensions de la résilience :

• Réunirla sécurité des données,résilience des identités,and cyber-récupérationau sein d’un modèle opérationnel unique.
• Protecting all workloads,from both today’s production systems to tomorrow’s emerging AI stacks.
• Safeguarding data regardless of location,whether in clouds,regions,data centers,or edge locations.

A next-generation architecture brings AI automation to all facets of data protection,la sécurité des données,résilience des identités,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.

As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.

With Commvault Cloud,la surveillance continue des menaces and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.

See ResOps in action

Regardez l’intégralité du webinaire à la demande to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.

FAQs

 Q: What is Resilience Operations (Res Ops)?

A: ResOps is an operating model that unifies la sécurité des données,résilience des identités,and cyber-récupération into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.

Q: Why can’t traditional backup and recovery handle AI workloads?

A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.

When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.

Q: What does “unified resilience” mean in practice?

A: Unified resilience means bringing la sécurité des données,identity management,and cyber-récupération together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.

In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.

Q: What’s the difference between cyber resilience and AI resilience?

A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.

Q: How does ransomware target backup systems?

A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.

Q: What is the clean vs. complete recovery dilemma?

A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through la surveillance continue des menaces and verified recovery points.

Q: What is a cleanroom in cyber-récupération?

A: A cleanroom in cyber-récupération is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.

Sam Curcuruto is Director of Product Marketing at Commvault.

Related BlogsRepenser la résilience à l’ère de l’IA

A CIO’s Perspective: Strengthening Business Resilience in the AI Era

Résilience face à la machine IA

Les innovations en matière de Cleanroom Recovery ouvrent une nouvelle ère en matière de cyber-résilience

Points clés à retenir

• “Instant restore” claims often break down at scale due to real-world I/O operations per second (IOPS), rehydration, and infrastructure constraints.
• Mass live mounts on deduplicated backup storage can cause performance collapse, forcing slow rehydration back to primary storage.
• Cleanrooms help enables parallel forensic investigation and business recovery instead of serial, delay-driven downtime.
• Identity compromise expands the blast radius, making isolated recovery and Active Directory (AD) restoration critical to secure operations.
• Automated cleanroom runbooks and repeatable testing help organizations validate real recovery metrics before a crisis occurs.

Let’s start with a quick story about a “ransomware‑proof” environment that took 72 hours to recover, way beyond the organization’s expectations for recovery time objective. It is exactly the kind of situation where Commvault’s Cleanroom could have helped turn a painful, three‑day outage into a faster, more controlled recovery with less risk.

War Story: Physics vs. Marketing

On Reddit, a user shared how the financial services firm they work for was hit by a breach. They assumed they had a “dream stack” for quick recovery (but can you really have a “dream stack” without Cleanroom?): immutable backups, secure storage snapshots, and a modern hypervisor. The datasheets promised “instant mass restore,” yet the business sat offline for three days while everyone tried to drag their environment back to life.

The root cause was not that backups failed, but that the real‑world physics of rehydration, forensics, and identity were never tested at scale. The original poster mentioned that having access to a cleanroom environment would have sped up the process. Let’s dig into this further and address why.

Commvault’s Cleanroom is designed to address exactly these weak points: It helps automate clean, isolated recovery into the cloud, validates data, and orchestrates recovery in a way that aligns with how incidents actually unfold, not just how diagrams look on slides.

Problem 1: The Rehydration Trap

In the story, “live mounting” a handful of virtual machines (VMs) worked fine, but trying to live mount hundreds crushed the backup appliance. The random I/O running directly on deduplicated, compressed backup storage collapsed the IOPS, forcing the team to rehydrate everything back to primary Non-Volatile Memory Express at about 3 TB/hour for roughly 100 TB of data.

Commvault Cleanroom helps recover workloads into an isolated Azure‑based cleanroom built on scalable cloud compute and storage instead of trying to run production at scale off a backup appliance.

This allows you to restore critical VMs into a purpose‑built recovery environment, use cloud elasticity to absorb I/O, and automate the recovery sequence so the right systems (identity, core apps, critical data) come up first without bottlenecking on a single backup target.

Problem 2: The Forensic Drag

In the audit, the tech stack was ready in about four hours, but legal delayed touching anything for 72 hours because they had no pre‑provisioned cleanroom. Without an isolated environment with zero routes back to production, the forensics team could not safely investigate while the business recovered, so everyone waited for the all-clear before starting any real restore.

Cleanroom provides an on-demand, isolated recovery environment explicitly built for simultaneous recovery and forensic analysis. You can spin up a fenced cleanroom in Azure in hours, recover systems into it, and let security and legal teams perform read‑only forensics and threat scanning while operations validates applications and prepares for cutover – dramatically shrinking “forensic drag” as a contributor to downtime.

Problem 3: Identity Blast Radius

The environment in the story had a single admin account with access to both the hypervisor and backup console, which meant if attackers pivoted that far, immutability could become just another setting they flipped off. Identity, not just data, was the real blast radius problem.

Cleanroom is designed to help reduce dependency on the compromised production identity plane during recovery, allowing isolated access and planned support for AD restoration in the cleanroom.

By recovering identity services into an isolated cleanroom and using separate, least‑privilege access paths, you can help validate AD, help enforce proper authorizations, and help protect backup control planes from being trivially compromised by the same credentials that were used in production.

How Cleanroom Would Change This Story

If this customer had used Cleanroom, their recovery story could have been very different.

• Faster, physics‑aware recovery: They could have helped orchestrate recovery into a cloud cleanroom with scalable storage and compute, avoiding the IOPS collapse of mass live mounts and pushing toward the recovery velocity they actually needed.
• Parallel forensics and business recovery: A pre‑defined cleanroom RTO of under four hours would have helped them spin up a fenced environment for both forensic work and application validationinstead of waiting 72 hours in a holding pattern.
• Reduced reinfection and identity risk: Cleanroom isolation, threat scanning, and a separate control plane would have helped limit identity blast radius, helped confirm data was malware‑free before returning to production, and helped give auditors and insurers a clean, verifiable recovery trail.
• Automated, repeatable playbooks:Automated runbooks orchestrating clean point detection, workload sequencing, and test failovers could have helped them regularly rehearse this scenario and know their real‑world metrics before an attack – not learned them during a crisis.

For organizations that already invest in “ransomware‑proof” stacks, the missing piece is often not more features but a cleanroom strategy that respects physics, identity, and legal reality. Commvault Cleanroom is designed to close that gap and help turn recovery from a three‑day war story into a controlled, provable, and much faster operation.

FAQ

Q: Why did the “instant mass restore” approach fail in the ransomware scenario?
A: While live mounting a few VMs worked, scaling to hundreds overwhelmed the backup appliance due to I/O constraints. Deduplicated and compressed backup storage is not designed to handle full production workloads at scale, leading to performance collapse and delayed recovery.

Q: What is the “rehydration trap” in disaster recovery?
A: The rehydration trap occurs when organizations must restore large volumes of compressed backup data back to primary storage before systems can operate normally. This process is limited by throughput rates, which can dramatically extend recovery times when dealing with tens or hundreds of terabytes.

Q: How does a cleanroom help reduce forensic-related downtime?
A: A cleanroom provides an isolated environment where forensic teams can safely investigate while IT simultaneously restores systems. This parallel approach helps eliminate long waiting periods for legal or security approval before beginning recovery efforts.

Q: Why is identity such a critical factor in ransomware recovery?
A: If attackers compromise administrative credentials tied to both production and backup systems, immutability controls may no longer provide protection. Isolated identity recovery and least-privilege access can help limit blast radius and support a safer restoration process.

Q: How does Cleanroom help improve recovery orchestration?
A: Cleanroom helps automates workload sequencing, cleanpoint validation, and cloud-based recovery infrastructure provisioning. This structured approach aligns recovery with how incidents actually unfold, helping organizations regain control faster and with greater confidence.

Q: What is the strategic lesson for organizations with “ransomware-proof” stacks?
A: Advanced features alone do not guarantee fast recovery. A cleanroom strategy that accounts for infrastructure physics, identity isolation, and legal realities helps enable organizations to turn theoretical resilience into measurable, repeatable recovery performance.

Nico Guerrera is Senior Solutions Marketing Manager at Commvault.

Blogs connexes

Récupération de la forêt Active Directory : Pourquoi les méthodes manuelles ne sont plus viables

Tests de récupération : La pièce manquante dans la plupart des programmes de cyber-résilience

Votre manuel de jeu moderne pour une réponse rapide et une récupération propre

Débloquer la cyber-résilience : Le pouvoir des salles blanches

Why Cleanroom and Cyber Testing are Critical for Cyber Resilience

Key Takeaways

• Commvault Cloud Backup & Recovery for DevOps now includes support for Atlassian Jira,extending enterprise-grade data protection to mission-critical project workflows.
• Des sauvegardes automatisées,basées sur des règles,ainsi que des options de restauration granulaire aident les équipes à restaurer rapidement les espaces Jira,les tâches et les configurations.
• Des fonctionnalités intégrées de cyber-résilience,telles que les sauvegardes immuables et le stockage cloud isolé,contribuent à protéger les données Jira contre les ransomwares et les modifications non autorisées.
• Une protection unifiée couvrant Jira,Azure DevOps,GitHub et GitLab réduit la prolifération des outils et simplifie la résilience des données DevOps.
• La protection de Jira est disponible via l’accès « Early Adopter »,la disponibilité générale étant prévue pour mars 2026.

Nous sommes ravis d’annoncer l’extension deCommvault® Cloud Backup & Recovery for DevOpsafin d’inclure la prise en charge d’Atlassian Jira. Cette mise à jour apporte à Jiraune protection,une Recovery et une cyber-résilience de niveau entrepriseto Jira,helping organizations safeguard mission-critical project data against data loss and cyber incidents.

With this release,teams now have a unified way to protect critical sprint plans,work items,and configurations alongside their code,pipelines,and repositories in Azure DevOps,GitHub,or GitLab,all with a single solution.

Why Protecting Jira Data Matters

Jira has become a cornerstone for many organizations,supporting everything from agile software development and product releases to IT service management. It houses the plans,workflows,and task data that teams depend on to help execute mission-critical work.

Despite its importance,Jira is not immune to data loss. Accidental deletions,misconfiguration,and malicious activity can quickly erase valuable project history and disrupt active work.

When Jira data is lost or becomes unavailable,teams lose visibility,sprints stall,releases are delayed,service commitments are missed,and productivity suffers as teams attempt to recreate lost information.

A reliable backup and recovery strategy for Jira is critical to help maintain continuous business and help minimize the risk of downtime,operational disruption,and potential failure to meet data retention or regulatory compliance requirements.

Enterprise-Grade Protection for Jira Commvault Clouddelivers enterprise-scale protection and recovery for Jira,helping organizations safeguard mission-critical Jira data against cyber incidents,disasters,and operational mistakes.

Key features:

• Automated,policy-based backups of Jira spaces,work items,and configurations,including attachments,custom fields,and board settings.
• Granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time.
• Simplified compliance through centralized control,audit logging,and extended retention to help support regulatory and internal requirements.
• Cyber resilience withde sauvegardes immuables,un stockage cloud isolé,and une architecture « zero-trust »pour protéger les données contre les ransomwares et les modifications non autorisées.
• Unified protection for Jira,Azure DevOps,GitHub,GitLab,and other enterprise workloads from a single platform.

Unifying DevOps Data Resilience with Commvault

By unifying Jira protection with other DevOps platforms in Commvault Cloud Backup & Recovery for DevOps,enterprises can gain a holistic approach to data resilience across the full DevOps lifecycle – from planning and issue tracking to code and delivery. The result is fewer tools,reduced complexity,and confidence that sprint plans and backlog items are rapidly recoverable when it matters most.

Early Availability

Atlassian Jira protection is now available through Early Adopter access with general availability planned for March 2026.

Learn more about Commvault’s support for Atlassian Jira,ici.

To learn more about how to get access to getting access to Jira protection or schedule a demo,contact your Commvault account team.

FAQs

Q: Why is backing up Atlassian Jira important?
A: Jira houses critical sprint plans,workflows,and issue data that many teams rely on to deliver projects and services. Data loss from accidental deletion,misconfiguration,or malicious activity can disrupt releases and impact productivity,making a reliable backup and recovery strategy essential.

Q: What Jira data can Commvault Cloud protect?
A: Commvault Cloud helps protect Jira spaces,work items,configurations,attachments,custom fields,and board settings. This comprehensive coverage helps organizations maintain full visibility and recover both detailed items and entire sites when needed.

Q: How does recovery work with Commvault Cloud for Jira?
A: The solution helps support granular recovery of individual spaces or work items,as well as full-site recovery to a specific point in time. This flexibility enables teams to restore exactly what they need without unnecessary disruption.

Q: How does this solution support compliance and cyber resilience?
A: Centralized control,audit logging,and extended retention help organizations meet regulatory and internal requirements. Immutable backups,un stockage cloud isolé,and a une architecture « zero-trust » help strengthen protection against ransomware and unauthorized changes.

Q: Can Jira protection be managed alongside other DevOps platforms?
A: Yes. Commvault Cloud unifies protection for Jira with Azure DevOps,GitHub,GitLab,and other enterprise workloads within a single platform,helping reduce complexity and enable a holistic approach to DevOps data resilience.

Q: When will Jira protection be generally available?
A: Atlassian Jira protection is currently available through Early Adopter access,with general availability planned for March 2026. Organizations can contact their Commvault account team to learn more or schedule a demo.

Katharine Colucci is a Product Marketing Manager at Commvault.