Skip to content

Points clés à retenir

  • L’ingénierie sociale visant les services d’assistance est désormais l’un des principaux points d’entrée, les attaques de « vishing » (hameçonnage vocal) se multipliant rapidement et entraînant la compromission des identifiants.
  • Les identités non humaines, telles que les comptes de service et les jetons, constituent un angle mort majeur en matière de sécurité ; elles sont souvent laissées sans surveillance et largement exploitées à des fins de déplacement latéral.
  • Active Directory (AD) constitue une cible de choix en raison de son contrôle centralisé et des risques de mauvaise configuration.
  • La prévention à elle seule ne suffit pas ; les organisations doivent disposer de solides capacités de détection et de reprise rapide afin de limiter les dégâts.
  • Immediate operational actions – like auditing accounts and correlating help desk activity with identity changes – can significantly reduce risk.

Active Directory (AD) reste une cible privilégiée des pirates, car il est au cœur de la gestion des identités en entreprise.Des études récentes montrent que67 % des incidents impliquent désormais une compromission liée aux identités, with attackers going after critical systems like AD within hours of initial access.Once compromised, recovery can take days or weeks – causing significant business disruption.
The question worth asking isn’t whether AD is a target.It’s how attackers get tici – and why the path is so much shorter than security teams might expect.

3 étapes pour parvenir à un compromis global

Des groupes malveillants tels que ShinyHunters et Scattered Spider ont fait de l’ingénierie sociale une opération à grande échelle.Voice phishing – vishing – jumped 449% in 2025.Les appelants sont recrutés, reçoivent un script à suivre etsont rémunérés jusqu’à 1 000 dollars depending on success and hit rate.
That means, it’s possible to start an attack with one step: Get a password reset or multi-factor authentication (MFA) change.That’s it.
From that single credential, the attacker moves laterally into cloud and virtualized environments.They harvest OAuth tokens, create new administrative service accounts, and embed access in machine-layer credentials.These non-human identities – service accounts, API keys, tokens – now outnumber human users 144 to 1.La prolifération et la charge opérationnelle rendent la rotation des identifiants et les audits difficiles. Ce déplacement latéral a une destination : Active Directory.

La publicité est la cible

AD is the central nervous system of enterprise identity.Control it and you control everything – user accounts, group policies, and access to every domain-joined system in the network.The reason it’s so attractive to attackers – and so difficult to defend – is structural.Any authenticated user can read the entire directory.Every domain-joined system inherits trust from it.
Group Policy Objects linked at the domain head can be weaponized to disable security controls outright.Legacy protocols left enabled for application compatibility provide straightforward access.Microsoft’s own documentation says that “most identity attacks utilize common misconfigurations in Active Directory.”

When an attacker reaches the AD, they don’t need to force entry.The door is usually open.

La prévention est nécessaire, mais pas suffisante

The standard security stack – MFA, endpoint detection, email filtering – is built around human behavior.It wasn’t designed to govern the machine identity layer or to detect the kind of slow, legitimate-looking privilege escalation that characterizes modern AD attacks.An attacker that moves from a compromised human account to a service account to a domain administrator over 72 hours may never trigger a single alert.
This is why the conversation must shift from prevention-first to recovery-first.
Prevention still matters.Least-privilege access, auditing AD changes, hardening default configurations, disabling inactive accounts – these can help reduce the attack surface.But given that half of organizations have already experienced an AD attack, designing only for prevention means designing to fail.
True identity resilience requires the ability to detect unauthorized privilege escalations in near real time, roll back malicious changes before they propagate, and restore the identity environment to a known-trusted state quickly – not in days or weeks, but fast enough to contain the blast radius.That means treating AD and the non-human identity layer as Tier 0 assets, with the same governance and recovery investment you’d apply to any other mission-critical system.

Que faire dès maintenant pour renforcer la résilience identitaire ?

The gap between wici most organizations are and wici they need to be on identity resilience is real.But it’s closeable.The immediate priorities are unglamorous and operational:

  1. Audit what’s in your AD.
  2. Find the accounts that shouldn’t still exist.
  3. Rotate the credentials that haven’t been touched in years.
  4. Établir une corrélation entre l’activité du service d’assistance et les événements liés à la création de jetons et de comptes.

A help desk interaction followed by an MFA reset followed by a new service account is a high-confidence attack signal – and it’s detectable if you’re looking for it.
The longer-term work is architectural: Build recovery capability into your identity program so that when an attack succeeds – and it’s usually when, not if – you can contain it, reverse it, and try to restore trust faster than the attacker can consolidate their position.
Attackers are counting on your AD being ungoverned, your machine identities being invisible, and your recovery plan being theoretical.Close one of those gaps this quarter.Close all three and you’ve fundamentally changed the math. 

Découvrez comment Commvault Cloud une protection complète de l’Active Directory – from vulnerability assessment to one-click rollback and full forest recovery.
I recently joined Vidya Shankaran on the STRIVE podcast to talk about the governance gap for non-human identities.Check out our episode ici.And be sure to read Vidya’s blog, Le « point aveugle » lié à l’identité des machines constitue désormais une surface d’attaque majeure.

FAQ

Q: Why are help desks becoming a major security risk?

A: Help desks are often trusted to reset passwords and modify MFA settings, making them attractive targets for social engineering.Attackers exploit this trust to gain initial access with minimal resistance.
Q: What role do non-human identities play in attacks?

A: Sprawl and operational overhead make rotation and audit of non-human identities, such as service accounts and API keys, difficult.Attackers use them to maintain persistence and move undetected across systems.
Q: Why is AD such a critical target?

A: AD controls authentication and access across the network.Gaining control of it allows attackers to manage users, policies, and systems at scale.
Q: Isn’t MFA and endpoint security enough to stop these attacks?

A: These tools focus on human behavior and may not detect slow, legitimate-looking privilege escalation.Attackers can operate within normal patterns and avoid triggering alerts.
Q: What does a recovery-first security approach mean?

A: It means preparing for the reality that breaches will happen and prioritizing the ability to detect, contain, and reverse them quickly.This approach helps reduce downtime and can help limit overall impact.
Q: What are the most important steps to take immediately?

A: Start by auditing your AD, removing unnecessary accounts, rotating old credentials, and monitoring for suspicious sequences of help desk and identity-related activities.
Dan Conrad is Principal Technologist and Field CTO at Commvault.

More related posts

Thumbnail_Blog-Okta-Early-Access-2026

Commvault® Extends Identity Resilience to Okta

Read more
Thumbnail_Blog-Lateral-Access-2026

Staying Resilient Against Lateral Access Exploits

Read more
Thumbnail_3_AD_Blogs_2025

Active Directory Forest Recovery: Why Manual Methods Are No Longer Viable

Read more
Thumbnail_6_AD_Blogs_2025

AD Recovery Testing: How to Know Your Recovery Plan Will Actually Work

Read more

Points clés à retenir

  • Les identités non humaines (NHI) sont désormais bien plus nombreuses que les utilisateurs humains et leur nombre augmente à un rythme bien plus rapide, ce qui crée une surface d’attaque importante et insuffisamment contrôlée.
  • Attackers increasingly use social engineering, like voice phishing (vishing), to bypass human defenses and gain access to machine-layer credentials.
  • Most NHIs operate with excessive permissions and lack proper lifecycle management, contributing to accumulated “identity debt.”
  • Traditional security tools fail to detect threats in the machine layer because NHIs behave differently from human users.
  • Organizations must shift from prevention-first strategies to recovery-first approaches, prioritizing rapid detection and rollback of identity-based attacks.

For the past decade, enterprise security investment has followed the human. Better authentication. Stronger multi-factor authentication (MFA). Phishing simulation. Identity-centric architecture. These investments were the right response to the threat landscape at the time.

The threat landscape has moved.

Today’s most sophisticated adversaries aren’t trying to defeat your MFA. They’re using it as a door. A convincing phone call to your IT help desk, an MFA reset, and a compromised human account – that’s the entry. What they’re actually after is what’s behind it: the sprawling, under-governed layer of NHIs that connects every system in your environment.

The Scale of the Problem Is Staggering

Service accounts, API keys, OAuth tokens, AI agents – NHIs now outnumber human users by a ratio of 144 to 1, and they’re growing 4 to 10 times fasterthan human accounts. Yetfewer than 25% of organizations have formal policies governing their creation or decommissioning. Nearly all of them carry excessive permissions – rights that far exceed what their function requires.

This isn’t a new risk that suddenly appeared. It’s accumulated identity debt: years of provisioning without governance, automation without accountability, cloud expansion without visibility. And adversaries have noticed.

Vishing Is the Entry Point

Groups like ShinyHunters and Scattered Spider – operating under what researchers call the Scattered LAPSUS$ Hunters (SLH) cluster – have industrialized social engineering to exploit exactly this gap. Voice phishing rose 449% in 2025. These aren’t opportunistic calls. They’re coordinated operations: purpose-built scripts, recruited callers, financial incentives of up to $1,000 per successful help desk impersonation.

The call isn’t the attack. The call is the credential reset that gets an attacker past the human perimeter. The attack begins when they migrate to the machine layer – stealing OAuth tokens, creating administrative service accounts, embedding access into credentials that are rarely monitored and almost never rotated.

The human account gets remediated. The machine-layer access persists. The attacker has already moved on.

Three Vulnerabilities that Traditional Controls Can’t See

Standard security tools are designed around human behavior. They flag anomalous logins, unusual geolocation, suspicious email traffic. NHIs operate differently, and that difference is the blind spot.

OAuth abuse, for instance, looks like normal API traffic – even after a password reset. Thousands of undocumented service accounts operate in large enterprises with administrative privileges, often long after the projects that created them ended. Long-lived API keys embedded in DevOps pipelines carry broad access with no device context and no login alert.

MFA doesn’t cover them. Endpoint detection doesn’t see them. Email filtering is irrelevant to them.

The Framework Shift: From Prevention-First to Recovery-First

The logical response to a threat that often evades traditional detection is to stop assuming you can prevent every intrusion and start designing for rapid recovery from the ones that succeed.

That means treating NHIs as Tier 0 assets – with the same governance controls applied to domain administrators or cloud control planes managed with human identities. It means replacing static secrets with short-lived tokens and automatic rotation.

It also means correlating cross-domain signals: A help desk interaction followed by an MFA reset followed by a new token creation is a high-confidence indicator of compromise, and catching it early is the difference between containment and a prolonged breach. It means mapping NHIs to human identities for accountability.

Most importantly, it means having the capability to detect unauthorized privilege escalations and roll back malicious identity changes in real time – returning the environment to a known-trusted state before the damage extends.

Prevention still matters. But given the governance gap many organizations are carrying, recovery speed is becoming a primary resilience metric. Organizations should build identity programs designed for the attacks that are already happening, not the ones that were common five years ago.

Visit the Readiverseand check out our eBookLa crise d’identité non humaine, which explores the full scope of the machine attack surface and the framework for identity resilience.

FAQ

Q1: What are non-human identities (NHIs)?

A: NHIs include service accounts, API keys, OAuth tokens, and AI agents that allow systems and applications to interact. Unlike human users, they often operate automatically and at scale, making them harder to monitor and control.

Q2: Why are NHIs considered a security risk?

A: NHIs often have excessive permissions and lack proper governance, making them attractive targets for attackers. Because they are rarely monitored or rotated, compromised credentials can persist undetected for long periods.

Q3: How do attackers exploit NHIs?

A: Attackers typically gain initial access through social engineering, such as voice phishing, then pivot to the machine layer. They steal tokens, create new service accounts, or embed persistent access in credentials that are not closely monitored.

Q4: Why don’t traditional security tools detect these threats?

A: Most security tools are designed to track human behavior, such as login anomalies or phishing attempts. NHIs generate normal-looking system traffic, which allows malicious activity to blend in with legitimate operations.

Q5: What is meant by a “recovery-first” security approach?

A: A recovery-first approach focuses on quickly detecting breaches and restoring systems to a trusted state rather than assuming all attacks can be prevented. This includes identifying unauthorized changes and rolling them back in real time.

Q6: How can organizations improve NHI security?

A: Organizations can treat NHIs as critical assets, implement strict governance policies, replace static credentials with short-lived tokens, and correlate signals across systems. Mapping NHIs to human owners also improves accountability and oversight.

Vidya Shankaran is Field CTO at Commvault.

More related posts

Thumbnail_Blog-SHIFT-Identity-Resilience-2026-Linkedin

Your Identity Infrastructure Is a Target. Here’s What Commvault Is Doing About It.

Read more
Thumbnail_Blog-Rise-of-AI-Agents-in-Resops-2026

Commvault and Microsoft: The Rise of AI Agents in ResOps

Read more
Thumbnail_Blog-Unified-Resilience-2026

Why AI Is Breaking Your Resilience Strategy (And What to Do About It)

Read more
Thumbnail_Blog_Resilient-Against-the-AI-Machine

Resilient Against the AI Machine

Read more

Organizations today are building applications faster, automating workflows at scale, and turning data into insights, powered by platforms like Microsoft Power Platform. What started as a low-code productivity layer has quickly become mission-critical, embedded in the processes that support revenue generation, day-to-day operations, and strategic decision-making.

But as the reliance on these business intelligence assets grows, so does the associated risk. The same platform accelerating innovation can also amplify the impact of operational errors, misconfigurations, and malicious actions.

A misconfigured workflow, a deleted report, or a broken application can disrupt business processes, compromise decision-making, and erode trust in the systems the business relies on. And when something goes wrong, recovery is rarely straightforward.

Commvault is helping address these challenges with enterprise-grade data protection and recovery for Microsoft Power Platform, starting with Power BI – allowing organizations to help keep the insights, workflows, and apps they build protected and rapidly recoverable. 

Power BI: The Gap Between Insight and Recovery

At the center of many Power Platform deployments is Microsoft Power BI, providing analytics and business intelligence, transforming data into reporting, forecasting, and operational visibility.

When Power BI assets are lost or compromised teams can quickly lose access to trusted insights, interrupting reporting cycles, and delaying business decision-making.

In practice, however, protection strategies lag behind the importance of these assets. Many organizations rely on manual file exports or limited native capabilities that weren’t designed for comprehensive recovery. When something breaks, teams are often forced to rebuild manually with no ability to restore exactly what’s needed. This makes recovery slow, error-prone, and difficult to scale.

Commvault Cloud Backup & Recovery for Microsoft Power Platform

Now generally available, Commvault Cloud Backup & Recovery for Microsoft Power Platform helps organizations protect and recover their business-critical assets, such as reports, from accidental deletion, corruption, and malicious activity.

  • Automated, policy-based protection: Apply policy-driven backups across Power BI workspace assets, enabling consistent, scalable coverage without manual intervention.
  • Rapid, granular recovery: Restore individual reports, folders to a specific point in time, avoiding manual rebuilds and helping minimize downtime and disruption.
  • Isolated, immutable backups: Help protect data from ransomware and unauthorized changes with backups designed to prevent unauthorized modification or deletion.
  • Simplified compliance: Maintain long-term retention (up to 10 years), centralized audit logs, and reporting to support regulatory and internal requirements.

Unified Platform for Resilience

Commvault Cloud offers a unified platform to protect SaaS, cloud, and on-premises workloads, including Microsoft 365, Dynamics 365, Salesforce, VMs, databases, and endpoints. With Microsoft Power Platform support, customers can streamline protection, recovery, and resilience for more workloads, helping reduce tool sprawl and simplify operations.

How to Get Started

Commvault Cloud Backup & Recovery for Power Platform is delivered as a SaaS solution, designed for fast deployment and minimal operational overhead. Organizations can connect their Power BI environment, apply policy-based protection, and begin backing up critical data in a matter of steps.

Automated discovery protects new reports and folders are included as environments evolve, while centralized management provides a single place to monitor, manage, and recover data at scale.

What’s Next: Expanding Across Power Platform

We intend to expand protection and resilience across Microsoft Power Platform to include Power Apps and Power Automate, extending coverage to the applications and workflows that power your business. Plans, timelines, and features are subject to change and should not be relied upon in making purchasing decisions.

Protect What Powers Your Business

As reliance on Microsoft Power Platform grows, so does the need for resilient, enterprise-grade protection. With Commvault Cloud, you can:

  • Protect critical assets against deletion, corruption, and attack
  • Rapidly recover exactly what you need – without rebuilding everything
  • Maintain trust in data, decisions, and automation
Ready to make your Microsoft Power BI investment resilient?

Learn more and see Commvault Cloud in action atcommvault.com/platform/power-platform.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Points clés à retenir

  • La migration des machines virtuelles vers Red Hat OpenShift Virtualization est un processus par étapes qui nécessite une protection cohérente dans tous les environnements hybrides.
  • platform de protection des données unifiée et native de Kubernetes platform réduire la complexité et d’éviter d’avoir recours à des outils ou des processus distincts.
  • Reliable resilience – including immutable backups and threat detection – is critical during migration, when risks are highest.
  • Des options de reprise flexibles permettent aux organisations de s’adapter rapidement en cas d’échec des étapes de migration ou de modification des délais.
  • La consolidation de la protection des machines virtuelles et des conteneurs permet de réduire la prolifération des outils et d’assurer une gouvernance cohérente.

If you’re an IT leader today, chances are your virtualization strategy is under active review.

Rising costs, licensing uncertainty, and long-term vendor lock-in have many organizations reassessing their reliance on traditional hypervisors. At the same time, Kubernetes has matured into the operational foundation for modern applications.

These two realities are converging – and for many enterprises, Red Hat OpenShift Virtualization is emerging as a preferred destination for running virtual machines within a Kubernetes-native operating model.

This transition is accelerating across industries. As organizations modernize infrastructure on their own terms, Red Hat OpenShift Virtualization is increasingly viewed as a way to modernize the platform without the need for application refactoring. With that momentum comes a critical question:

How do you migrate virtual machines while maintaining consistent protection, resilience, and recoverability throughout the process?

To answer it, you need to examine how most enterprise migrations actually unfold – and where protection and resilience become critical.

La migration est un parcours, pas un événement ponctuel

Seasoned IT leaders know that infrastructure transitions rarely happen all at once.

For enterprises opting to move from hypervisors like VMware to Red Hat OpenShift Virtualization, the transition typically unfolds in phases. During this time, organizations inevitably operate in a mixed state:

  • Les machines virtuelles basées sur VMware continuent de soutenir les activités principales de l’entreprise.
  • Les machines virtuelles qui fonctionnent désormais sur Red Hat OpenShift Virtualization.
  • Applications conteneurisées partageant les mêmes clusters Red Hat OpenShift.

This coexistence period introduces complexity and risk. Data is in motion, environments are changing, and protection gaps can appear if tooling and processes don’t evolve alongside workloads.

Il est essentiel de garantir une protection fiable

Commvault propose depuis longtemps des solutions de protection et de restauration des données tant pour les environnements VMware que pour les charges de travail Kubernetes exécutées sur Red Hat OpenShift. Ce même modèle de protection natif de Kubernetes et basé sur des règles s’étend désormais aux machines virtuelles exécutées sur Red Hat OpenShift Virtualization. Ce qui touche vraiment les clients, c’est la cohérence :

  • Une platform unique platform la protection et la restauration.
  • Des opérations basées sur des règles appliquées de manière uniforme à l’ensemble des charges de travail.
  • Conçu pour s’adapter à vos outils et processus existants à mesure que les environnements évoluent.

VMs running on Red Hat OpenShift Virtualization are protected using the same workflows and governance constructs as containerized applications. This unified approach is being embraced by organizations standardizing on Red Hat OpenShift that want a simpler, more consistent way to manage data across environments.

This capability is available today.Commvault Cloudprend en charge la protection des environnements Red Hat OpenShift Virtualization conformes à la version 11.40 (support à long terme) et à la version 11.42 (Innovation), ce qui signifie que les clients peuvent dès à présent mettre ces fonctionnalités en production.

You Shouldn’t Need to Manage Protection Differently

Once VMs move to Red Hat OpenShift Virtualization, they shouldn’t require special handling from a protection standpoint.

Commvault Cloud discovers and protects Red Hat OpenShift Virtualization VMs alongside containerized applications, helping give teams centralized visibility, consistent policy enforcement, and simplified recovery operations. Virtualized and containerized workloads are managed together – without introducing operational silos.

For organizations managing diverse application portfolios, this treatment of VMs inside Kubernetes helps reduce operational friction while maintaining enterprise-grade controls.

La cyber-résilience est essentielle lorsque la migration accroît les risques.

Les périodes de migration constituent une phase particulièrement vulnérable. Le changement engendre de la complexité, et cette complexité accroît le risque de perte de données et ransomware. Commvault Cloud maintenir la résilience tout au long de cette phase grâce à :

  • Sauvegardes isolées physiquement et immuables pour les charges de travail Red Hat OpenShift Virtualization.
  • Des données de sauvegarde qui facilitent la recherche de menaces et l’analyse forensic, aidant ainsi les équipes à vérifier que tout est prêt pour la restauration avant de rétablir les charges de travail.
  • Advanced recovery capabilities designed to help organizations minimize operational disruption.

Que les charges de travail soient en phase de pré-migration, en cours de transition ou pleinement opérationnelles sur Red Hat OpenShift Virtualization, leur résilience reste intacte.

La flexibilité en matière de reprise inspire confiance

Every modernization initiative needs room for adjustment.

Commvault supports both in-place and out-of-place recovery for Red Hat OpenShift Virtualization virtual machines, including full VM context and configuration. If a migration step doesn’t go as planned – or timelines need to shift – teams may recover quickly and move forward without compromising availability or data integrity.

Une protection native de Kubernetes allant au-delà des machines virtuelles

Pour de nombreuses entreprises, la virtualisation ne constitue qu’un élément parmi d’autres d’une stratégie plus large de modernisation des applications. Commvault Cloud offre Cloud une protection centrée sur les applications et native à Kubernetes pour les charges de travail conteneurisées, y compris les volumes persistants et les métadonnées des applications, sur l’ensemble des distributions Kubernetes certifiées par la CNCF. Cela permet d’assurer la mobilité et la reprise des applications cloud, tout en contribuant à maintenir la cohérence opérationnelle entre les différents environnements.

Réduire la prolifération des outils à mesure que l’infrastructure évolue

Platform transitions often introduce new tools, new processes – and new complexity.

By using Commvault Cloud as a unified protection platform for:

  • Machines virtuelles VMware.
  • Machines virtuelles Red Hat OpenShift Virtualization.
  • Applications en conteneurs.

Les organisations peuvent contribuer à réduire la prolifération des outils, à simplifier la gestion et à maintenir une gouvernance cohérente, même à mesure que les stratégies d’infrastructure évoluent.

Comment tout cela s’articule

During any migration, it helps to understand how the pieces work together. Red Hat’s Migration Toolkit for Virtualization takes care of moving VMs from VMware into Red Hat OpenShift Virtualization.

Commvault Cloud helps provide the protection and resilience that stays with your workloads throughout the process, so data can remain protected before, during, and after migration. This can help keep recoverability from falling behind as workloads move.

Continuing the Conversation at Red Hat Summit

We’re already working with customers that are actively moving virtual machines onto OpenShift Virtualization – and we’re continuing these discussions at Red Hat Summit, May 11–14 in Atlanta.

At the Commvault booth, we’ll be:

  • Entretiens avec des responsables informatiques sur les défis concrets en matière de résilience.
  • Partager des conseils pratiques pour migrer en toute confiance.
  • Présentation de la solution Commvault Cloud pour Red Hat OpenShift Virtualization.

If maintaining resilience and recoverability throughout your virtualization strategy is a priority, we’d welcome the opportunity to connect.

Aller de l’avant en toute confiance

Red Hat OpenShift Virtualization is becoming a foundational component of modern enterprise infrastructure. But you can’t rush migration at any cost; you must build protection, resilience, and recovery into the process from the beginning.

With Commvault Cloud, protecting Red Hat OpenShift Virtualization workloads isn’t a future aspiration. It’s something customers already are doing – using a unified platform to modernize confidently while staying resilient and recoverable.

“Red Hat OpenShift Virtualization delivers a reliable, consistent foundation for organizations to support their entire virtualized estate,” says Steve Gordon, Senior Director, Product Management, Hybrid Cloud Platforms, at Red Hat. “By leveraging an optimized integration like Commvault Cloud with Red Hat OpenShift Virtualization, our customers can move forward with greater confidence, knowing their workloads are protected consistently before, during, and after migration.”

FAQ

Q: Why is VM migration considered a multi-phase process?

A: Most enterprises cannot migrate all workloads at once, so they operate in a hybrid state with legacy and new environments running simultaneously. This phased approach introduces complexity, making consistent protection and visibility essential throughout the transition.

Q: What role does resilience play during VM migration?

A: Resilience enables organizations to maintain data protection, recover quickly from failures, and defend against threats like ransomware. During migration, when systems are in flux, strong resilience measures can help prevent data loss and operational disruption.

Q: How does Commvault Cloud simplify protection across environments?

A: Commvault Cloud provides a single platform with policy-driven protection for VMware VMs, OpenShift Virtualization VMs, and containerized applications. This unified approach enables consistent operations without introducing new tools or workflows.

Q: What makes Kubernetes-native protection important?

A: Kubernetes-native protection aligns with how modern applications are deployed and managed, covering both containers and virtual machines. It enables simple data management, mobility, and recovery within cloud-native environments.

Q: How does recovery flexibility improve migration confidence?

A: Flexible recovery options, such as in-place and out-of-place restores, can help teams quickly recover workloads if something goes wrong. This adaptability helps reduce downtime and enables organizations to adjust migration plans without risking data integrity.

Q: How can organizations reduce complexity during infrastructure transitions?

A: By adopting a unified data protection platform, organizations can manage all workloads – virtualized and containerized – through a single interface. This approach helps reduce tool sprawl, simplify administration, and maintain consistent governance across evolving environments.

Jason Gizaest responsable senior du marketing des partenaires de contenu à l’international chez Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Points clés à retenir

  • La la Readiverse Academy a mis en place un parcours de certification structuré et à plusieurs niveaux, allant des connaissances de base à l’expertise avancée cloud .
  • Les certifications sont adaptées aux postes réels, ce qui permet aux apprenants d’acquérir des compétences en adéquation avec leurs responsabilités au sein Cloud Commvault Cloud .
  • The program includes four tiers – Practitioner, Specialist, Professional, and Expert – each increasing in depth and operational capability.
  • L’apprentissage repose sur trois piliers fondamentaux : platform , la cyber-résilience et l’expertise en matière de charges de travail.
  • Des options de formation flexibles, comprenant notamment des formats en autoformation et animés par un formateur, permettent aux professionnels de progresser en fonction de leur emploi du temps et de leurs objectifs.

The environments you protect with Commvault® Cloud are increasingly complex, and the expectations on your teams that run them are higher than ever. It’s no longer just about knowing the platform. It’s about being able to operate, protect, and recover, often under pressure.

If you’ve already started your learning journey in the la Readiverse Academy, welcome back. And if you’re new here, you’re joining at the right time.

Today, we’re introducing a structured, tiered certification approach that gives learners a clear, skill‑based path from foundational platform knowledge to advanced cloud engineering expertise.

Nous créons du contenu pour vous

Commvault Cloud environments demand expertise across multiple responsibilities, often within the same role. Administrators, security specialists, cloud engineers, and workload owners require different depths and breadths of knowledge. And not everyone needs to learn the same things, in the same order, to be effective.

The new la Readiverse Academy certification tiers reflect that reality. Learners progress through clearly defined levels that build on one another so that your certification aligns to what you actually do and validates those capabilities to the teams you work with.

  • Commvault Cloud Practitioner – foundational platform and resilience knowledge.
  • Commvault Cloud Specialist – expanded operational and security depth.
  • Commvault Cloud Professional – advanced recovery and workload expertise.
  • Commvault Cloud Expert – full cloud engineering and resilience leadership.

Each tier is earned through a combination of coursework, hands‑on lab activities, and validated assessments. As learners progress, the scope and depth of operational capability demonstrated increases accordingly.

Un parcours clair : de la pratique à l’expertise

Le programme de certification s’articule autour de trois piliers de compétences fondamentales qui se retrouvent à tous les niveaux :

  • platform fondamentales platform
  • Concepts de cyber-résilience
  • Charge de travail et expertise fonctionnelle

Chaque niveau ajoute des exigences spécifiques à ces axes. Les apprenants peuvent suivre des cours individuels ou combiner certaines exigences pour atteindre leurs objectifs de certification.

Already in la Readiverse Academy? What this Means for You.

With a new structure like this, the most important question is what it means for the progress you’ve already made. If you’ve already completed courses or earned certifications in the la Readiverse Academy, congratulations! Your investment matters, and we want to be clear about what happens next.

Those certifications represent your history and accomplishments with Commvault. The new program is aligned to our expanded portfolio of cyber resilience features for Commvault Software, Commvault SaaS, and hybrid environments. As your needs grow to require more from Commvault, these courses and certifications will help you configure, manage, and optimize Commvault to meet your organization’s unique needs.

There is no direct progression from the previous certification tracks to the new program, but your existing certifications validate your expertise on the former product releases. As those releases are retired, those certifications will reach end of life as well. Learners who are already invested in the la Readiverse Academy are well positioned to progress quickly.

Who Should Take la Readiverse Academy Courses and Certifications

la Readiverse Academy certifications are designed for professionals working across Commvault SaaS, Commvault Software, and hybrid environments.

  • Platform administrators managing day‑to‑day operations.
  • Des spécialistes de la sécurité chargés de protéger les données et de renforcer la sécurité des environnements.
  • Cloud chargés de la configuration du plan de contrôle et de la résilience avancée.
  • Les responsables de charges de travail qui doivent maîtriser des domaines de données spécifiques.

All training is available for self‑paced learning, with select courses also offered in instructor‑led formats, so learners can progress in a way that fits their role and schedule.

Comment se lancer ou poursuivre son parcours d’apprentissage

Whether you’re starting fresh or continuing your journey, the next step is simple and designed to meet you where you are.

  • Connectez-vous ou inscrivez-vous surcommvault.com.
  • Vous découvrez Commvault ? Commencez par suivre la formation « Commvault Cloud ».
  • Vous êtes chargé de la gestion de la charge de travail ? Découvrez notre catalogue de formations qui couvre pratiquement tous les domaines.
  • Vous cherchez des stratégies pour faciliter la reprise après une cyberattaque ? La formation « Cyber-résilience » est le point de départ idéal.

Ce qui va suivre

Our goal is to make advancement predictable, transparent, and aligned to real‑world roles to help learners know what’s next and how to prepare for it.

We are committed to giving every Commvault Cloud user the knowledge to operate, protect, and recover their environment with confidence. Because when it matters most, certification isn’t about credentials. It’s about being resilient and ready to recover.

FAQ

Q: What is the purpose of the la Readiverse Academy certification program?

A: The program provides a structured, skill-based learning path that helps professionals progress from basic platform knowledge to advanced cloud engineering expertise. It aligns training with real-world responsibilities to enable learners to apply their knowledge effectively in complex environments.

Q: What are the different certification tiers available?

A: There are four tiers: Commvault Cloud Practitioner, Specialist, Professional, and Expert. Each level builds on the previous one, increasing in technical depth, operational scope, and leadership capability.

Q: Who should enroll in la Readiverse Academy courses?

A: The courses are designed for platform administrators, security specialists, cloud engineers, and workload owners working across SaaS, software, and hybrid environments. Each role can follow a tailored learning path based on their responsibilities.

Q: How are the certifications earned?

A: Certifications are achieved through a combination of coursework, hands-on labs, and validated assessments. As learners progress, they demonstrate increasing levels of expertise across platform, security, and workload domains.

Q: What happens to existing la Readiverse Academy certifications?

A: Existing certifications remain valid as proof of past expertise but are tied to earlier product releases. As those releases are retired, the certifications will reach end of life, encouraging learners to transition to the new program.

Q: How can someone get started with the new program?

A: New learners can begin with the Commvault Cloud Administrator course, while existing users can log in to continue their progress. Additional courses are available based on specific goals, such as workload management or cyber resilience strategies.

Suzanne Klausner is Director, Customer Enablement Strategy, at Commvault.

More related posts

Thumbnail_Blog-Ready-or-Not-2026

Why Every CIO Needs a ‘Ready. Or Not.’ Mindset

Read more
Thumbnail_Blog_Readiness-Update-2024

Boost Your Cyber Resilience and Readiness

Read more
Social_Readiverse_Blog_LinkedIn-1

The Readiverse: Your Go-To Learning Resource for Cyber Resilience and Readiness

Read more

Points clés à retenir

  • Les workflows de restauration traditionnels peuvent entraîner un décalage de l’infrastructure dans les environnements gérés par Terraform, en provisionnant de nouvelles ressources en dehors de l’état.
  • Clumio Backtrack est conçu pour restaurer les données directement dans les buckets S3 et les tables DynamoDB existants, ce qui permet de préserver l’identité des ressources.
  • La restauration sur site permet de réduire le recours aux importations manuelles de Terraform, à la reconfiguration des points de terminaison et au rapprochement des états en cas d’incident.
  • L’alignement des processus de reprise sur les principes de l’« Infrastructure as Code » (IaC) permet de préserver l’intégrité de la configuration et la prévisibilité opérationnelle.
  • La conception de la restauration est tout aussi cruciale que celle de la sauvegarde pour les équipes qui gèrent des environnements de production via Terraform.

IaC brings consistency, repeatability, and version control to cloud environments. Terraform becomes the source of truth for what exists, how it is configured, and how it should behave. Recovery introduces a new challenge.

Traditional restore operations often create new resources – new S3 buckets, new DynamoDB tables, new endpoints. From Terraform’s perspective, those resources were not defined in code. They do not exist in state.

That creates drift. In routine operations, drift is manageable. During an incident, it compounds. This is where recovery design matters as much as backup design.

Le problème de la dérive de l’IaC

Dans un modèle de restauration classique :

  • Une ressource protégée est restaurée en tant que nouvelle ressource.
  • La ressource d’origine reste dans un état corrompu, écrasé ou défaillant.
  • L’état Terraform ne reconnaît pas la nouvelle ressource.
  • Les équipes doivent importer manuellement les ressources dans State.
  • Il se peut que les configurations des applications doivent être mises à jour.

For platform teams managing production infrastructure through Terraform, this introduces friction at exactly the wrong moment. The challenge isn’t backup reliability itself, but how restore workflows integrate with infrastructure-as-code practices.

Présentation de la restauration sur site avec Clumio Backtrack

Clumio Backtrack est une fonctionnalité de restauration qui permet de restaurer des données directement dans des ressources AWS existantes, sans avoir à provisionner une infrastructure de remplacement. Lorsqu’elle est configurée via le fournisseur Clumio Terraform, Backtrack permet de mettre en place des workflows de restauration conformes à l’infrastructure définie par code.

Clumio Backtrack prend en charge à la fois Amazon S3 et Amazon DynamoDB. Pour une analyse technique plus approfondie des workflows de restauration spécifiques à DynamoDB, consultez notre article de blog consacré àClumio Backtrack pour DynamoDB.

Au lieu de mettre en place des ressources de remplacement, Backtrack facilite la restauration :

  • Les objets S3 sont stockés directement dans le compartiment d’origine.
  • Les données DynamoDB directement dans la table d’origine.

From Terraform’s perspective, the infrastructure is intended to remain unchanged, with defined resources continuing to match the declared configuration. This helps reduce the need for manual resource imports, temporary restore tables, endpoint rewiring, and state reconciliation under pressure.

Un exemple concret

Imaginons un environnement de production entièrement géré via Terraform. Une table DynamoDB gère les stocks ; un compartiment S3 stocke les ressources de l’application ; les rôles et les politiques de gestion des identités et des accès sont codifiés ; et les politiques de protection sont définies via Terraform. Si une corruption survient avant un pic de trafic important, les méthodes de restauration traditionnelles peuvent créer de nouvelles ressources qui devront être réintégrées dans Terraform.

Avec Backtrack, la restauration est conçue pour s’effectuer dans les limites des ressources existantes, ce qui permet de préserver l’intégrité de l’infrastructure définie et de conserver l’identité des ressources. Cette approche vise à éviter d’avoir à mettre à jour Terraform pour prendre en charge un bucket ou une table nouvellement créé(e), en considérant la restauration comme une opération au niveau de la couche de données plutôt que comme un processus de remplacement de l’infrastructure.

Pourquoi est-ce important pour Platform ?

Pour les équipes qui ont adopté l’IaC, les workflows de reprise doivent préserver l’identité des ressources, l’alignement des états, l’intégrité de la configuration et la prévisibilité opérationnelle. La restauration sur place contribue à la réalisation de ces objectifs en limitant les modifications apportées à l’infrastructure lors des opérations de reprise.

Récupération à Cloud

Backtrack is designed to operate at cloud scale – whether restoring a small number of objects or large datasets. Recovery performance varies based on workload size and environment configuration, but the architectural objective remains consistent: restore data without introducing new infrastructure drift.

For Terraform-driven environments, that distinction matters.

Dans quel contexte cette approche s’inscrit-elle ?

La restauration sur site est particulièrement indiquée dans les cas suivants :

  • Charges de travail DynamoDB à haut débit
  • Compartiments S3 contenant un grand nombre d’objets
  • Systèmes de production entièrement gérés via Terraform
  • dans des environnements complexes où il est difficile de rediriger les dépendances des applications vers de nouvelles ressources

Lorsque l’infrastructure est définie de manière déclarative, les processus de reprise doivent s’aligner sur cette même approche.

Pour commencer

Pour découvrir Clumio Backtrack et son intégration avec Terraform :

Définir la protection sous forme de code n’est qu’une partie du processus. La conception de workflows de reprise qui préservent l’intégrité de l’infrastructure vient compléter ce modèle.

FAQ

Q: What problem do traditional restores create in Terraform-managed environments?

A: Traditional restores often create new resources, such as replacement S3 buckets or DynamoDB tables, that are not defined in Terraform state. This can lead to infrastructure drift and force teams to manually import resources and reconcile configurations during high-pressure incidents.

Q: How does Clumio Backtrack differ from standard restore approaches?

A: Instead of provisioning new infrastructure, Clumio Backtrack is designed to restore data directly into the existing AWS resource. This approach helps preserve resource identity and keep Terraform state aligned with the declared configuration.

Q: Which AWS services are supported by Clumio Backtrack?

A: Clumio Backtrack supports Amazon S3 and Amazon DynamoDB. It is designed to restore S3 objects into the original bucket and DynamoDB data into the original table, helping maintain consistency with infrastructure defined in code.

Q: Why is in-place recovery important for platform teams?

A: Platform teams rely on infrastructure as code for consistency and control. In-place recovery helps maintain state alignment, configuration integrity, and operational predictability without introducing additional infrastructure changes during recovery events.

Q: When is in-place recovery particularly valuable?

A: It is especially useful for high-throughput DynamoDB workloads, Compartiments S3 contenant un grand nombre d’objets, and production systems fully managed through Terraform. It also can be beneficial in environments where redirecting application dependencies to newly created resources would be complex or risky.

Q: How can teams get started with Clumio Backtrack and Terraform integration?

A: Teams can review thedocumentation relative au fournisseur Clumio Terraform, explorer lecode source du fournisseur sur GitHub, and watch the vidéo de démonstration de Backtrack referenced in the blog to understand implementation and workflow details.

Lawrence Chang is Chief Engineering Officer of Clumio and Vir Choksiis Principal Product Marketing Manager at Commvault.

More related posts

Thumbnail_Blog-AWS-Data-Protection-Terraform-Clumio-2026

Automating AWS Data Protection with Terraform and Clumio

Read more
Thumbnail_Blog_Clumio-Tech-2025

Restore only what matters: Clumio Backtrack for DynamoDB

Read more
Thumbnail_Blog-GoogleWorkspace-2026

How the Move to Clumio Delivered 66.7% Savings on AWS Backups

Read more
Thumbnail_Blog_AWS-Marketplace-AI

Commvault Featured in New AI Agent Solutions in AWS Marketplace

Read more
Man-and-woman-working-on-laptops-profile-Crocus-Thumbnail

Protecting Your Amazon S3 Data with Clumio: A Comprehensive Solution

Read more

Clumio

Read more

Points clés à retenir

  • La plupart des exercices sur table servent à valider les performances plutôt qu’à mettre en évidence les véritables lacunes dans la gestion des incidents.
  • Pour que les exercices soient efficaces, ils doivent intégrer des éléments de friction, d’ambiguïté et de pression afin de refléter des situations réelles.
  • Limiter la portée de l’exercice à quelques scénarios critiques et considérer que le succès consiste à identifier des problèmes plutôt qu’à faire bonne figure peut permettre d’obtenir des enseignements plus pertinents et plus exploitables.
  • La participation de différents services, et pas seulement celle des équipes techniques, est essentielle pour évaluer avec précision la capacité de réaction de l’organisation.
  • C’est par des tests de reprise réels, et non par de simples scénarios théoriques, que l’on peut démontrer une véritable résilience.

There is a moment most security leaders recognize, even if they do not say it out loud. The tabletop just wrapped. The team is filing out. Everyone looks reasonably satisfied. And somewhere in the back of your mind, a quiet question surfaces: Did we actually learn anything?

If you are honest, the answer is often no.
That is not because tabletop exercises are a bad idea. They are one of the most valuable tools a security leader has. The problem is how most organizations run them – and what they are actually measuring when they do.

Le piège de la performance

The most common mistake in tabletop exercises has nothing to do with the scenario. It has to do with the goal. Most teams, consciously or not, build exercises designed to demonstrate competence rather than discover gaps.
The scenario generally follows a clean arc. Information arrives in a logical sequence. The right people say the right things. Everyone feels prepared. And that feeling – confident, well-rehearsed, almost collegial – is exactly the problem.
Real incidents do not run on clean arcs. They arrive with incomplete information, conflicting signals, unavailable people, and a business demanding answers faster than the facts support. If your tabletop does not create that kind of friction, you have not tested incident response. You have practiced a conversation.
When the exercise is designed to validate rather than stress-test, a second problem follows: People stop being honest. Nobody says, “I don’t know who owns that decision” or “we have never actually tested that recovery path.” They say what sounds right. And the gaps that should surface in a controlled environment stay hidden until they surface in a real one.

Ce qu’un bon exercice permet réellement d’évaluer

Before you build a scenario, you need to answer a simpler question: What do you actually want to learn? Not 20 things. Three or four.
Can your team make a shutdown decision fast enough, and does everyone know who has the authority to make it? When security, IT, legal, and communications are all in the room with conflicting priorities, can they actually reach decisions together? Can you explain the business impact of an incident clearly enough for leadership to act – not just understand? And if you had to restore a critical system in the next four hours, could you really do it?

Once you know what you are testing, build a scenario with real friction. Make a key person unavailable mid-exercise. Introduce a customer escalation. Have a regulator ask a question the team cannot answer from the runbook.
Give people incomplete information and see how they make decisions anyway. The value is not in watching people succeed under pressure. It is in finding the places where the process breaks down while the stakes are still low enough to fix it.

Dites ceci à voix haute dès le début : « Aujourd’hui, réussir, c’est identifier les problèmes, pas faire bonne impression. » Cette simple phrase change la façon dont les gens s’expriment dans la salle.

Le problème des personnes

Une simulation qui se limite aux services de sécurité et informatiques relève d’une discussion technique, et non d’un exercice de gestion d’incident. Si le service juridique n’est pas présent, si le service de communication n’est pas présent, si les responsables métier et la direction générale sont absents, vous ne testez pas la manière dont votre organisation réagit réellement à une crise. Vous testez simplement la façon dont un groupe de personnes compétentes analyse un scénario hypothétique. Les incidents réels sont gérés à tous les niveaux de l’entreprise. L’exercice doit refléter cette réalité.

Il ne suffit pas d’en parler

This is where most organizations stop short. A paper exercise is important – but it is not confidence.
Talking through a recovery scenario tells you something. Actually restoring a system tells you something different. Can you bring identity back to a clean point in time? Can you validate that what you are recovering is trustworthy? Can you restore a Tier 1 application and confirm it comes back cleanly, without carrying the infection with it?

Those are not questions you can answer in a conference room. At some point, the plan has to meet the environment – and you need to know whether they match.

Une fois l’exercice terminé

The debrief tells you whether the exercise mattered. If the hot wash is quiet, vague, or full of “good reminders,” the exercise did not push hard enough. A well-run tabletop should leave you with a short list of real findings, clear owners, and deadlines. If you cannot answer what broke, who is fixing it, and by when, you ran an event, not an exercise.
The goal was never to pass the exercise. It was to learn something important while the cost of being wrong was still just time.
Watch our recent episode of the STRIVE podcast, where I join my colleague Chris Mierzwa, Senior Director, Portfolio Marketing, for une discussion approfondie sur les exercices sur table.

FAQ

Q: Why do most tabletop exercises fail to deliver real value?

A: Many exercises are designed to make teams look prepared rather than uncover weaknesses. This leads to scripted discussions that miss the unpredictability and pressure of real incidents.

Q: What should a tabletop exercise aim to achieve?

A: It should focus on answering a small number of critical questions, such as decision-making speed, ownership clarity, and recovery capability. This focus helps teams uncover meaningful gaps instead of surface-level insights.

Q: How can organizations make exercises more realistic?

A: Introduce uncertainty, missing information, and unexpected disruptions during the scenario. These elements force teams to think critically and act under pressure, closer to real incident conditions.

Q: Who should be involved in a tabletop exercise?

A: Beyond security and IT, teams like legal and communications, business leaders, and executives should participate. This enables the exercise to reflect how real incidents are managed across the organization.

Q: Why is talking through recovery not enough?

A: Discussion can highlight plans, but only real testing proves whether systems actually can be restored cleanly and quickly. Practical validation is necessary to confirm recovery readiness.

Q: What defines a successful tabletop exercise outcome?

A: A strong exercise results in clear findings, assigned owners, and defined timelines for remediation. If these are missing, the exercise likely did not challenge the team enough.

Chris Bevil is Principal, Global Cyber Resilience & AI, at Commvault.

More related posts

Readiverse-Featured-Image-888-x-500

Ready Is Good. Resilient Is Better.

Read more
Thumbnail_5_MV_Blogs_2025

Recovery Testing: The Missing Piece in Most Cyber Resilience Programs

Read more
Urgent-Need-for-Cyber-Resilience

The Urgent Need for Cyber Resilience

Read more
Thumbnail_Blog_Modern-Playbook-2025

Your Modern Playbook for Rapid Response and Clean Recovery

Read more

Points clés à retenir

  • Commvault’s data access governance, powered by Satori, unifies visibility, access control, and auditability across structured data, unstructured files, SaaS apps, and AI workloads.
  • A single, consistent access policy can govern both human users and AI models, helping reduce silos and limit overexposure of sensitive data.
  • Continuous discovery, classification, and risk scoring help provide prioritized insight into where sensitive data resides and where exposure risk is highest.
  • Policy-driven dynamic masking and redaction help enforce least-privilege access, allowing authorized use of data while helping protect sensitive fields.
  • Centralized, near-real-time audit trails deliver comprehensive visibility into user queries, AI prompts, and governed access events to help support compliance and accountability.

With AI now embedded in every workflow, from copilots and chat assistants to analytics tools, all these endpoints have become ravenous for data to ingest. Commvault’s data access governance capabilities, powered by Satori, are designed to make that data-hungry AI more by unifying visibility, access control, and auditability across your data landscape.

A Unified Foundation for AI-Era Data Governance

Commvault’s data access governance features bring structured databases, unstructured files in SaaS apps, and AI workloads under one governance model, instead of treating them as separate silos. Organizations now can apply a single access policy to both human users and AI models, so that the same rules determine who or what can see sensitive information, regardless of where it lives.

By integrating Satori into the Commvault Command Center, these capabilities extend Commvault’s traditional protection into live data and AI usage, not just backups and snapshots. This helps security and data protection teams move from reactive incident response to proactive control over how data is discovered, accessed, and used in real time.

Continuous Discovery, Classification, and Risk Scoring

A core pillar of our data governance capabilities isunified discovery and classificationof data across clouds and SaaS platforms. As organizations connect to environments such as AWS, Azure, Google Cloud, Snowflake, Databricks, and others, Commvault automatically maps data stores and continuously classifies them, whether the data is structured or unstructured.Each asset is assigned a risk score, giving teams a prioritized view of where sensitive information resides and where exposure is most likely. Instead of relying on periodic scans, the platform keeps pace with data movement, new stores, and classification changes, helping teams spot issues earlier and focus on the highest-risk areas first.

Least-Privilege Access with Dynamic Masking and Redaction

Traditional data protection often stops at knowing where sensitive data is; Commvault’s capabilities emphasize controlling how that data is revealed. Using policy-driven masking and redaction, organizations can enforce least-privilege access so that users, services, and AI models only see the specific information they are authorized to see, with sensitive fields anonymized or hidden as needed.

Because the same masking and redaction policies apply across all connected environments, organizations can consistently safeguard access instead of fragmented, application-by-application rules. This helps reduce the risk of data overexposure, where too many people or systems have access to more data than they legitimately need.

Security and Safe Prompt Handling

A standout capability is policy-driven AI security that operates at the prompt and response level. Before data is ever sent to an AI model, Commvault, powered by Satori, can intercept the interaction, detect sensitive fields (such as regulated personal details), and apply inline masking or redaction according to existing data access policies.

Unlike solutions that simply block entire prompts or rely solely on downstream data loss prevention (making security someone else’s concern), this approach allows employees to keep using AI assistants productively while keeping sensitive data under governance. Because redaction occurs before the model processes the data, it also helps prevent sensitive information from influencing or contaminating AI training datasets, protecting both the users and the broader AI environment.

Centralized Audit Trails Aids in Compliance

The final piece of our data access governance capabilities iscomprehensive, centralized audit logging. Every interaction – whether a user query, an AI prompt, or a governed access event – is captured with details such as who accessed what, which policy was applied, and what redactions occurred, in near–real time.

This unified audit visibility spans live data, AI prompts, and access governance events, giving security, IT, and compliance leaders a single authoritative record rather than disparate logs from point tools. For CISOs and CIOs, this means faster compliance reviews and clear proof that governance is not just documented on paper but actively enforced across the environment.

Helping Organizations Adopt AI Securely

Taken together, these new features give organizations a cohesive way to govern data in an AI-enabled world: unified visibility across clouds, SaaS, and AI; one policy for users and models; dynamic masking and redaction for least-privilege access; and policy-aware AI prompt protection backed by complete audit trails. The result is a shift from reactive controls to proactive, AI-ready data access governance, helping teams embrace AI innovation while maintaining control of their most sensitive information.

FAQ

Q: What makes Commvault’s approach to AI data governance different from traditional data protection?

A: Traditional data protection often focuses on backups and incident response after exposure occurs. Commvault extends governance into live environments and AI interactions, helping enable proactive control over how data is discovered, accessed, and used in real time. This shift helps organizations manage risk before it becomes a breach.

Q: How does unified discovery and classification improve security?

A: Continuous discovery and classification automatically map and label structured and unstructured data across clouds and SaaS platforms. By assigning risk scores to each asset, teams gain a prioritized view of sensitive data exposure. This helps enable faster identification of high-risk areas and more focused remediation efforts.

Q: What is dynamic masking, and why is it important for AI workloads?

A: Dynamic masking and redaction limit what users, services, and AI models can see based on predefined policies. Sensitive fields can be anonymized or hidden while still allowing legitimate access to relevant data. This approach supports productivity while helping reduce the risk of overexposure.

Q: How does policy-aware AI prompt protection work?

A: Policy-aware AI security intercepts prompts and responses before data reaches the AI model. It helps detect sensitive information and apply inline masking or redaction according to existing policies. This helps employees continue using AI tools while helping keep regulated data under governance and out of training datasets.

Q: How do centralized audit trails support compliance efforts?

A: Comprehensive audit logging captures details about who accessed what data, which policies were applied, and what redactions occurred. This unified visibility spans live data and AI interactions, helping give security and compliance leaders a clear, authoritative record. It helps enable faster reviews and demonstrate that governance controls are actively enforced.

Q: How do these capabilities help organizations adopt AI safely?

A: By combining unified visibility, consistent policy enforcement, dynamic masking, and complete audit trails, Commvault’s data governance capabilities help give organizations a cohesive framework for governing AI-era data. These controls help enable innovation while helping maintain control over sensitive information. The result is a more confident and safe path to AI adoption.

Nico Guerrera is Senior Technical Marketing Manager at Commvault.

More related posts

Social_Blog_Satori_GigaOm_Leader_2026_Linkedin

Satori Named Leader in GigaOm’s Data Access Governance Radar Report

Read more
Thumbnail_Blog-Conversational-Resilience-2025-Linkedin

Conversational Resilience: The New Way to Manage and Protect Enterprise Data

Read more
Thumbnail_Blog_Satori-Acquisition-2025

Commvault Closes Acquisition of Satori, Strengthening Data and AI Security Platform

Read more
Thumbnail_Blog-Data-Rooms-2025-Linkedin

Data Activate: Unlocking the Power of Trusted Data for AI Innovation

Read more

Points clés à retenir

  • L’infrastructure d’identité constitue une surface d’attaque majeure qui, si elle venait à être compromise, pourrait paralyser les activités de l’entreprise.
  • Commvault’s vulnerability assessment helps highlight misconfigurations and risky settings through clear exposure indicators and remediation guidance.
  • Real-time auditing helps enable teams to detect subtle malicious changes as they happen and trace attacker activity in real time.
  • One-click rollback can aid in rapid reversal of unauthorized changes, helping minimize downtime and limit attack spread.

Cybersecurity and the Importance of Identity

When most people think about cybersecurity, they picture stolen files or encrypted databases. But there’s a layer underneath all of that which, if compromised, makes everything else irrelevant – your identity infrastructure.​

Identity management systems like Active Directory(AD),Entra IDetOkta are the systems that decide who gets to log in, what they can accessetwhether your business can function at all. When attackers get in there, users can’t authenticate, applications go darketoperations grind to a halt. It’s not a data problem at that point, it’s a control problem.​

Automated forest recovery with clean OS rebuilds helps enable organizations to restore identity systems securely without reintroducing threats. Here’s how.

Know What You’re Vulnerable to Before the Attackers Do

Commvault’s vulnerability assessment gives your AD environment a posture score.  Think of it like a health grade for your directory. Most environments have more exposure than people realizeetthis makes that visible.​

Our tool helps surface indicators of exposure (IOEs), which are specific misconfigurations or risky settings that could be exploited. One common example is accounts with passwords set to never expire. Stale, non-rotating credentials are one of the most common ways attackers maintain long-term access to an environment.

Commvault doesn’t just flag the issue, it helps identify which accounts are affected, walks through remediation stepsetlets you export the list to help simplify scripting the fix.

Catch It While It’s Happening

Knowing your weaknesses is step one. Seeing when someone is actively exploiting them is step two.

Commvault’s identity management auditing helps capture a real-time feed of every change made to identity systems like Active Directory and Entra ID – details like who made the change, when, from whereetwhat the values looked like before and after.

Attackers don’t usually blow the doors off; they make subtle, targeted changes. A compromised account might create a backdoor user, quietly add it to domain admins, then link a malicious Group Policy Object (GPO) designed to deploy ransomwareetevery one of those steps shows up in the audit feed.​

Once you spot a suspicious account, filtering can help you instantly pull up every change that account ever made, helping give you the full picture of what the attacker touched.​

Undo the Damage Fast

Detection only matters if you can act on it. From the same auditing view, you can roll back a malicious change with a single click, helping restore the environment to its last known good state without jumping between tools or writing a custom script. The aim is to help minimize downtime and limit how far the attack spreads before it is caught.​

When the Worst Happens: Forest Recovery

Sometimes an attack gets throughetyou need to rebuild from scratch. AD forest recovery, rebuilding your entire directory environment after a ransomware hit, is notoriously complex, often involving 50 to 100+ individual steps, depending on how many domains and domain controllers you have.​

Commvault helps automate this with orchestrated runbooks that sequence every step: Rebuilding domain controllers in the right order based on their flexible single master operation (FSMO) roles, restoring SYSVOL, verifying metadataetre-establishing trust between domains. A topology view of the entire AD forest helps make it visually clear which domain controllers should come back online first.​

The standout piece here is what Commvault calls Clean OS Recovery. Instead of restoring potentially compromised virtual machines, it rebuilds domain controllers on brand-new VMs. Restoring an infected machine risks bringing the malware right back with it. Recovering onto fresh infrastructure means you’re not just getting your data back; you’re actually starting clean.​

One Dashboard for On-Premises and Cloud

Most organizations today aren’t running purely on-premises or purely in the cloud, they’re hybrid, with AD handling legacy access and Entra ID handling modern cloud-based identities. Commvault’s unified control plane can help cover both from a single console: assessments, auditing, detectionetrecovery across both platforms.​

The value is straightforward: fewer tools, less complexityeta cleaner story to tell leadership when they ask how identity infrastructure is being protected end to end.​

Identity resilience deserves its own dedicated conversation, separate from making backups and separate from protecting endpoints. The combination of proactive vulnerability scanning, real-time change auditing, fast rollbacketclean forest recovery helps your organization treat your directory infrastructure as a security priority in its own right.

FAQ

Q: Why is identity infrastructure such a critical security focus?

A: Identity systems control authentication and access across an organization. If compromised, attackers can disrupt operations entirely, making other security measures irrelevant.

Q: What are indicators of exposure (IOEs)?

A: IOEs are specific misconfigurations or risky settings in identity environments that attackers can exploit. Discovering them can provide visibility into weaknesses and help guide teams on how to fix them.

Q: How does real-time auditing help stop attacks?

A: Real-time auditing helps track every change in identity systems, including who made it and what changed. This visibility helps security teams detect suspicious behavior early and investigate the full scope of an attack.

Q: Can malicious changes really be undone quickly?

A: Yes, Commvault can help enable direct rollback of unauthorized changes from the same interface. This helps reduce response time and restore systems to a safe state without complex scripting.

Q: What makes AD forest recovery so challenging?

A: Rebuilding an AD forest involves many interdependent steps, including restoring domain controllers and reestablishing trust relationships. The complexity increases with the size of the environment.

Q: What is Commvault’s Clean OS Recoveryetwhy does it matter?

A: Clean OS Recovery helps rebuild domain controllers on new, uncompromised systems instead of restoring infected machines. This approach helps eliminate lingering malware and can help enable a secure recovery.

Nico Guerrera is Senior Technical Marketing Manager at Commvault.

More related posts

Thumbnail_Blog-Okta-Early-Access-2026

Commvault® Extends Identity Resilience to Okta

Read more
Thumbnail_Blog-Lateral-Access-2026

Staying Resilient Against Lateral Access Exploits

Read more
Thumbnail_Blog-Linkedin 1

Security Best Practices

Read more

Points clés à retenir

  • Managing backup and recovery as Infrastructure as Code (IaC) helps reduce configuration drift and align data protection with modern cloud deployment practices.
  • The Clumio Terraform provider helps enable AWS accounts, policies, and protection rules to be defined declaratively and version-controlled.
  • Tag-based protection is designed to automatically protect existing and future resources, helping reduce manual intervention and scale efficiently across environments.
  • Defining backup policies in Terraform helps improve visibility, reproducibility, and governance through standard pull request workflows.
  • This approach can be especially valuable for multi-account AWS environments and organizations already standardized on Terraform.

Cloud infrastructure is increasingly defined as code. EC2 instances, identity and access management (IAM) roles, virtual private clouds, and databases now live in version-controlled repositories and are deployed predictably through IaC.However, backup and recovery policies often are still configured manually in web consoles. That gap creates risk. When infrastructure is declarative but data protection is not, teams risk:

  • Configuration drift.
  • Inconsistent protection across accounts.
  • Manual errors.
  • Limited visibility into what is actually protected.

For organizations already using Terraform, backup and recovery should be managed the same way as the rest of the stack – through code.Clumio’s Terraform provider enables AWS data protection to be defined declaratively alongside infrastructure. You can explore the provider and its documentation here: https://registry.terraform.io/providers/clumio-code/clumio/latest/docs/guides/getting_started.In this post, we’ll walk through how to automate AWS workload protection using Terraform and Clumio par Commvault – and why that approach scales more effectively for modern cloud teams.

The Problem with Console-Based Backup Configuration

In a traditional setup, protecting AWS resources requires:

  • Connecting AWS accounts.
  • Configuring protection separately across multiple AWS services.
  • Creating backup policies.
  • Defining protection rules.
  • Manually assigning resources.
  • Repeating that process for each account or environment.

Even in well-run environments, this creates:

  • Repetitive manual configuration.
  • Inconsistent policy application.
  • Delayed protection for newly created resources.
  • Limited version control.

Terraform already helps solve this problem for infrastructure. The Clumio Terraform provider extends that model to data protection.

From Zero to Protected – Using Four Files

Protecting multiple AWS services can be defined using a small set of Terraform files rather than a sequence of manual UI steps.

The configuration follows a straightforward structure.

  1. Define Providers (AWS + Clumio)

The first step is declaring the providers.Terraform needs to know:

  • You’re using AWS.
  • You’re using the Clumio provider.

This connects Terraform to both platforms.The official provider documentation walks through this setup in detail in thePour commencer guide.

  1. Connect AWS Accounts to Clumio

Next, the Clumio module establishes the connection between AWS and Clumio. This abstracts away the IAM role configuration required for data protection. Instead of manually configuring roles and permissions, the module handles the integration in a repeatable way.The provider source code is publicly availableon GitHub.This means your integration is defined in code, version-controlled and reproducible across environments.

  1. Define Backup Policies as Code

Backup policy definition is where IaC shines. In a Terraform-based configuration:

  • Different recovery point objectives can be set for different resource types.
  • Multiple retention tiers can be defined within the same policy (for example, short-term and long-term retention).
  • The same policy can apply automatically based on defined conditions.

Instead of navigating multiple consoles, a single Terraform configuration defines frequency, retention, and resource scope. That policy is reusable and reviewable like any other infrastructure configuration.

  1. Tag-Based Automatic Protection

One of the most scalable elements of the approach is tag-based protection. A protection rule can be configured to automatically protect any resource tagged with a specific key/value pair. For example:

created_by = demo_script

This means:

  • Existing resources matching the tag are protected.
  • Future resources with that tag are automatically included.
  • No manual intervention is required.

For S3 specifically, protection groups also use tags to manage hundreds of buckets as a single logical unit, allowing centralized policy changes at scale. This helps reduce configuration drift.

Applying the Configuration

Once defined, Terraform initializes the working directory, previews planned changes, and applies the configuration. Terraform is designed to respect dependencies between resources, creating them in the correct order.The configuration helps connect AWS accounts, activate policies, enforce protection rules, and protect tagged resources. And critically – the entire protection strategy exists in version-controlled code.

Why This Matters for Cloud Architects

For teams operating with IaC principles, backup configuration should follow the same discipline as infrastructure provisioning.Defining backup in Terraform provides several practical benefits:

  • Version control: Backup policies are defined in code and can be reviewed, versioned, and approved through standard pull request workflows.
  • Reproducibility: The same configuration can be deployed consistently across development, staging, and production accounts.
  • Reduced drift: Terraform configurations can be re-applied to enforce the declared state, helping bring manual or out-of-band changes back in line with the intended configuration.
  • Clear visibility: Protection logic is visible in code rather than buried in UI configuration.
  • Separation of configuration and interface: Backup posture is defined declaratively, not dependent on console state.

When This Approach Makes Sense

Automating backup with Terraform is particularly useful for:

  • Multi-account AWS environments.
  • Regulated industries requiring auditable configuration.
  • Platform teams managing shared infrastructure.
  • Organizations already standardized on Terraform.

If your infrastructure is defined as code, your data protection strategy should be too.

Pour commencer

To explore this approach further:

You also can evaluate Clumio through theAWS Marketplace.

FAQ

Q: Why should backup policies be managed as code?

A: When infrastructure is defined as code but backup policies are configured manually, gaps and inconsistencies can emerge. Managing backup as code helps align protection with deployment workflows, reduce manual errors, and provide version-controlled visibility into your data protection strategy.

Q: What does the Clumio Terraform provider enable?

A: The Clumio Terraform provider allows AWS data protection resources – such as account connections, backup policies, and protection rules – to be defined declaratively. This helps enable teams to manage backup configurations alongside infrastructure in the same Terraform workflow.

Q: How does tag-based protection improve scalability?

A: Tag-based protection is designed to automatically apply policies to any resource that matches a specified key/value pair. This helps protect existing and future resources without manual assignment, helping make it easier to manage protection at scale across accounts and services.

Q: How does Terraform help reduce configuration drift in backup environments?

A: Terraform maintains a declared state for infrastructure and protection policies. Reapplying configurations helps bring manual or out-of-band changes back in line with the intended state, helping improve consistency across environments.

Q: In what scenarios does automating backup with Terraform make the most sense?

A: This approach is particularly beneficial in multi-account AWS environments, regulated industries requiring auditable configurations, platform teams managing shared services, and organizations already using Terraform as a standard for IaC.

Q: How can teams get started with Terraform-based AWS data protection?

A: Teams can begin by reviewing thedocumentation relative au fournisseur Clumio Terraform, exploring theprovider’s GitHub source code, and watching the Quick Start demo. Evaluating Clumio through theAWS Marketplaceis also a practical next step.

Lawrence Chang is Chief Engineering Officer of Clumio and Vir Choksiis Principal Product Marketing Manager at Commvault.

More related posts

Thumbnail_Blog-GoogleWorkspace-2026

How the Move to Clumio Delivered 66.7% Savings on AWS Backups

Read more
Thumbnail_Blog_AWS-Marketplace-AI

Commvault Featured in New AI Agent Solutions in AWS Marketplace

Read more
Man-and-woman-working-on-laptops-profile-Crocus-Thumbnail

Protecting Your Amazon S3 Data with Clumio: A Comprehensive Solution

Read more
Zz05MThhZTc3NmU0MTQxMWVmYTYwZWJlYTg2ZTllNjQ5Yw

A Blueprint for Effective Cloud Recovery

Read more

Clumio

Read more

Every organization that has ever failed a recovery – and there are more than anyone publicly acknowledges – had one thing in common: They believed they could recover before they tried.

The belief came from somewhere. A completed tabletop exercise. A backup system that showed green. An annual disaster recovery test that passed. All of it documented. All of it, at some point, accurate. None of it current when the incident actually hit.

This is the confidence gap. And it is the gap that continuous recovery validation is designed to close.

What ‘Testing’ Actually Means in Most Organizations

Ask most security or IT leaders how often they test their recovery capability, and the answer is typically annual, sometimes biannual. The test involves restoring a subset of systems from backup into a test environment, confirming they come up, and filing a report. Sometimes a tabletop exercise is conducted alongside it.

What this kind of testing does not do: validate that backup data is free of malware. Confirm that recovery sequencing works for interdependent services. Test identity recovery, which is essential when compromised credentials are what enabled the attack. Confirm that the team that would actually run the recovery knows the current runbooks. Or produce evidence meaningful enough to satisfy a regulator, an auditor, or a board that recovery capability is real and current.

In short, it validates a point in time. Resilience operations (ResOps) requires validation as a continuous state.

The Continuous Validation Model

Continuous recovery validation is not a single test run more frequently. It is a set of integrated practices that produce ongoing, evidence-based proof of recoverability across critical services.

Automated backup integrity scanning. Every backup, continuously evaluated for anomalies, encryption patterns, and malware signatures. Not at restore time – before restore time. The goal is to know whether your recovery points are clean before you need them, not during an incident.

Scheduled Cleanroom Recovery drills. Bi-annual at minimum, restoring from immutable backup points into an isolated Cleanroom Recovery environment – not production, not a production-adjacent test environment, but a genuinely isolated space where forensic analysis can happen without risk of reinfection. These drills produce documented evidence of recoverability against defined impact tolerances.

Identity recovery validation. With credential abuse the most common breach vector, Active Directory and Entra ID recovery must be tested alongside data recovery. Organizations that restore systems without restoring a verified-clean identity layer may find attackers re-enter through the same door.

Service Resilience Indicator (SRI) dashboards. SRIs – continuous signals drawn from backup telemetry, dependency mapping, and test results – that give CISOs, CIOs, and boards a live view of recoverability posture. Not a point-in-time report. An ongoing operational signal.

Each of these practices feeds what Deloitte and Commvault call the resilience backlog: a continuously updated, prioritized list of gaps identified through testing and tracked to resolution. It is the mechanism by which validation drives improvement rather than just producing reports.

What Mean Time to Clean Recovery Changes

Traditional recovery metrics – recovery time objective (RTO) and recovery point objective (RPO) – measure speed and data recency. They say nothing about whether the data being restored can be trusted. Mean Time to Clean Recovery (MTCR) fills that gap: It measures the time required to restore data that is verifiably clean, not just technically available.

MTCR matters because in a ransomware incident, the adversary’s goal is often to corrupt recovery options, not just encrypt production systems. An organization that restores quickly but restores from a compromised backup has not recovered. It has re-infected itself.

Building MTCR into your resilience measurement framework, alongside RTO and RPO, changes what you optimize for and what you report to the board. Speed plus recency plus integrity: that is the complete picture of recovery readiness.

Resilience You Can Prove

The organizations that navigate cyber disruptions with the least damage share one characteristic: They treat recovery capability as something to be continuously demonstrated, not periodically asserted. They know their MTCR. Their SRIs are current. Their cleanroom recovery has been tested in the last 90 days.

That posture is not the result of better technology alone. It is the result of an operating discipline – ResOps – that makes resilience continuous, measurable, and governable. Commvault’s platform provides the technical foundation: clean recovery, automated validation, and the unified visibility across data, identity, and services that ResOps requires at scale.

For the organizational side of that equation – how to define impact tolerances, align executive leadership, and build the governance structure that sustains the discipline – see the Deloitte companion blog, The Resilience Conversation Your Board Isn’t Having Yet. And for the complete ResOps framework, including the six ResOps domains and the measurement model that ties technical recoverability to board-level accountability, read the joint whitepaper:From Minimum Viability to Operational Resilience: ResOps in Practice.Bill O’Connell is Chief Security Officer at Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Multi-cloud was supposed to give us flexibility, along with:

  • Best-of-breed services.
  • Cloud-native innovation.
  • Freedom from vendor lock-in.

But when a cyber incident hits, that flexibility often becomes complexity.
In this episode of STRIVE, I sat down with Senior Director of Product Management Akshay Joshi – whose career spans IBM, AWS, Microsoft, Clumio, and now Commvault – to unpack one uncomfortable truth: Most organizations think they’re ready for multi-cloud recovery.
Until they’re not. Watch the épisode.

Key Takeaways: What Multi-Cloud Recovery Really Demands

  • Backup at the service level doesn’t equal recovery at the application level. Protecting individual data sources is not the same as restoring a synchronized application ecosystem.
  • Recovery complexity multiplies across clouds. Different recovery points, different accounts, different admin teams – each adds friction when time matters most.
  • Native hyperscaler tools are necessary – but not sufficient. They protect within their own cloud but don’t orchestrate across clouds.
  • Isolation is the first domino in a cyber event. The larger the environment’s aperture, the harder it is to contain impact.
  • Resilience must be designed in – not retrofitted later. Dependency mapping and recovery planning should begin at application design, not after deployment.
  • AI-enabled automation adds power – and new risk. Agentic workflows require tight permission controls and governance discipline.

The Gap Between “On Paper” and Reality

On paper, recovery seems simple: When do you recover to? What do you recover? Where do you recover it?

But, as Akshay explains, each of those questions fractures in a multi-cloud world. Different services may have different recovery points. Some microservices may be impacted while others aren’t. Recovery may require re-architecting if restored cross-regionally or cross-account.
What looks straightforward in documentation becomes deeply complex in execution. And when ransomware hits, teams don’t calmly reference playbooks – they scramble.

The First Domino: Isolation

Each threat vector expands proportionally with environmental complexity. Multi-cloud doesn’t just diversify infrastructure – it expands operational aperture.

Service-Level Backup vs. Application-Level Recovery

Here’s where most organizations get caught.
They back up:

  • Azure data with Azure Backup
  • AWS data with AWS Backup
  • Google Cloud data with a separate tool

Individually, each service may be protected. Collectively, the application may not be recoverable in a synchronized state.
Native tools don’t communicate across clouds. They aren’t inherently multi-cloud in orchestration. They aren’t tuned to optimize recovery time objective (RTO) or recovery point objective (RPO) at scale for cross-cloud architectures.
And when recovery depends on aligning multiple data sources across hyperscalers, orchestration becomes the difference between hours and days. This is exactly why unified recovery strategies exist – not to replace hyperscalers, but to coordinate them.

Dependency Mapping Isn’t Optional Anymore

We’ve been talking about application dependency mapping for more than a decade. But in a multi-cloud world, it’s no longer a “nice to have.” Applications now span multiple hyperscalers, multiple DevOps teams, multiple admin domains, and multiple vendor backup tools.
Fragmented ownership slows recovery. Vendor fragmentation complicates orchestration. Operational silos create delays at the worst possible time. Resilience must be operationalized from the beginning – not bolted on after deployment.

Sneak Peek: Why Multi-Cloud Recovery Fails Without Dependency Mapping

In this moment from the STRIVE conversation, Akshay explains why operationalizing resilience at the architecture stage is critical for surviving real-world cyber events.

Designing for Recovery – Not Just Protection

One of the most powerful points in this episode: Modern applications should be designed not only around performance and scale – but around recoverability. That means:

  • Thinking about RTO as much as RPO.
  • Architecting with cross-cloud orchestration in mind.
  • Consolidating visibility where possible.
  • Reducing vendor and admin fragmentation.
  • Testing recovery across environments.

Recovery speed impacts revenue. Recovery clarity impacts reputation. Downtime impacts customer trust. Multi-cloud innovation must be matched by multi-cloud recovery discipline.

The AI and Automation Layer

No discussion is complete without addressing AI. Agentic workflows are increasingly embedded in enterprise SaaS platforms. But automation introduces new considerations:

  • What permissions do agents have?
  • How frequently are backups being triggered?
  • What cost implications arise from automation decisions?
  • Are agents treated as identities with governed access?

AI can accelerate resilience – but without guardrails, it also can amplify risk. The key is controlled delegation.

Why We Had This Conversation on STRIVE

STRIVE isn’t about repeating what everyone already knows. It’s about confronting the gaps that surface during real-world cyber events. Multi-cloud adoption isn’t slowing down. But unless recovery strategies evolve alongside architecture, complexity will outpace preparedness.
That’s why this discussion matters. And that’s why we brought Akshay in – someone who’s operated across hyperscalers and understands both their power and their limitations.

Regardez l’épisode dans son intégralité

In the full STRIVE episode, you’ll discover:

  • The real gap between service-level backup and application-level recovery.
  • Why isolation is the first domino in ransomware events.
  • How vendor fragmentation complicates orchestration.
  • What CISOs and DevOps leaders must align on.
  • How AI changes the resilience equation.

Regardez-le dès maintenant.
If you operate across AWS, Azure, or Google Cloud – this conversation is essential.

FAQ

Q: Why isn’t native hyperscaler backup enough?

A: Native tools protect data within a specific cloud but don’t orchestrate recovery across clouds. Multi-cloud applications require coordinated restoration across services and providers.

Q: What is the biggest gap in multi-cloud recovery?

A: The disconnect between how backups are made (service-by-service) and how recovery must happen (application-wide).

Q: What does “environmental aperture” mean?

A: It refers to the breadth of accounts, clouds, identities, and services in an environment. As aperture expands, risk and complexity increase proportionally.

Q: Why is dependency mapping critical?

A: Applications now span multiple clouds and teams. Without mapping service dependencies, recovery sequencing becomes guesswork.

Q: How does AI impact disaster recovery?

A: AI-enabled workflows can help automate backup and recovery decisions but require strong access controls, cost governance, and oversight.

Q: Where should organizations start improving multi-cloud recovery?

A: Begin by evaluating:

    • Application-level recovery alignment.
    • Vendor consolidation opportunities.
    • Cross-team synchronization.
    • Isolation strategy during incidents.
    • Cross-cloud testing frequency.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Points clés à retenir

  • Commvault Edge Docking for SaaS transformer le déploiement en périphérie en un processus centralisé, cloud et géré depuis une console unique. Commvault Edge était auparavant connu sous le nom d’HyperScale Edge.
  • La configuration automatisée et le provisionnement via API permettent de réduire le temps de déploiement à quelques minutes sur l’ensemble des sites répartis.
  • Les flux de travail standardisés contribuent à améliorer la cohérence, la sécurité des données et l’évolutivité dans les environnements périphériques.
  • La connectivité SaaS permanente permet d’assurer des mises à jour, une maintenance et une optimisation continues sans intervention manuelle.
  • Les fonctionnalités de sécurité intégrées, telles que les sauvegardes immuables et l’architecture « zero-trust », contribuent à renforcer la protection contre les menaces en constante évolution.

Le déploiement de la protection des données en périphérie ne devrait pas nécessiter de configuration manuelle sur chaque site. AvecCommvault Edge Docking for SaaS, Commvault transforme le déploiement en périphérie en une expérience rationalisée et pilotée par le cloud. Cette solution combine la puissance de Commvault Edge avec le contrôle centralisé du plan de gestion SaaS.

Réduire la complexité liée au déploiement en périphérie

Les environnements « edge » connaissent une croissance fulgurante.IDC prévoit que les dépenses informatiques liées à l’« edge » atteindront 380 milliards de dollars d’ici 2028. Organizations are pushing compute closer to data – retail stores, branch offices, manufacturing plants, healthcare facilities – each generating and storing critical information that must be protected.

The current edge-setup process is resource-intensive, requiring physical access and time-consuming configuration steps. This extends deployment timelines and increases operational costs when scaling to multiple sites. What should take minutes can stretch into an extended period of time and potential complexity. And while organizations struggle with deployment logistics, critical edge data remains unprotected or inconsistently backed up across distributed locations.

The threat landscape doesn’t wait. Verizon’s documents a surge in breaches exploiting edge devices – and every unprotected site represents a potential entry point for ransomware, data theft, and business disruption.

SaaS pour Commvault Edge

Commvault contribue à transformer le déploiement en périphérie grâce àl’intégration SaaS pour Commvault Edge (formerly HyperScale Edge) – a capability that brings cloud-native speed and simplicity to on-premises protection. From the Command Center, IT teams can configure, deploy, and manage every Commvault Edge system through a single SaaS console. It’s a single pane of glass that helps manage hybrid and cloud-native workloads across every site, device, and workload.

New systems follow a guided, standardized setup workflow that enables protected and consistent configuration from day one. Once powered on, each system automatically connects to Commvault SaaS, validates its configuration, registers with the platform, and begins installation. This helps minimize on-device setup and reduce the operational effort required to deploy at scale.

For larger rollouts, Commvault API-driven automation helps enable rapid onboarding of multiple systems simultaneously, supporting repeatable deployment across sites and regions.

Once systems are deployed, the global Command Center provides unified management across all locations. Each Commvault Edge system remains connected to Commvault SaaS for regular updates, maintenance, and optimization. From this single platform, you can deploy, patch, scale, and maintain every system with confidence. Deploy faster. Manage smarter. Protect data everywhere.

Conçu pour s’adapter à la croissance, pensé pour la simplicité

Commvault Edge Docking for SaaS is designed to deliver measurable operational advantages for IT and security leaders:

Accelerated time to value: Deploy new edge systems faster without manual, site-by-site provisioning.

Centralized visibility and governance: Manage configuration, monitor health, deploy updates, and scale infrastructure from a single SaaS management plane.

Reduced operational overhead: Limit the need for on-device configuration and streamline rollout processes, helping free IT resources for higher-value initiatives.

Consistent, rapid deployment: Standardized workflows help reduce configuration drift, deliver consistent data security posture and policy enforcement, and improve reliability across distributed environments.

Data security by design: Every system runs on , Commvault’s hardened Linux-native foundation. It’s a system that helps enable recovery that’s not just fast, but safe, with immutable local backups, multi-layer ransomware protection, and zero-trust architecture.

Pourquoi est-ce important ?

Traditional edge deployments stretch across weeks or months when deploying at scale. Commvault Edge Docking for SaaS reinforces our commitment to delivering hybrid data protection with the speed and simplicity of SaaS, helping reduce operational costs, eliminate deployment bottlenecks, and achieve faster time to value.

But speed isn’t the only benefit. Consistency also matters. When every site deploys with the same protected baseline, compliance becomes more manageable. Automatic rollout of updates helps security posture stays current. And when recovery workflows are designed to work the same way everywhere, teams can respond confidently under pressure.

This is what unified resilience looks like at scale on the edge: Protection that deploys fast, is simple to manage, and helps provide reliable recovery across hundreds or thousands of distributed sites.

Découvrez-le en action

Prêt à moderniser votre stratégie de déploiement en périphérie ? Pour en savoir plus, rendez-vous sur notre pageCommvault Edgeet prenez rendez-vous pour une démonstration afin de découvrir Commvault Edge Docking for SaaS action, ou contactez votre représentant Commvault pour découvrir comment SaaS peut transformer votre stratégie de résilience en périphérie.

FAQ

Q: What is Commvault Edge Docking for SaaS?

A: It is a Commvault capability that helps enable organizations to deploy and manage Commvault Edge systems through a centralized SaaS management plane. This approach helps simplify configuration, deployment, and ongoing operations across distributed environments.

Q: How does this solution reduce deployment complexity?

A: It helps eliminate the need for manual, site-by-site configuration by using automated workflows and centralized control. Systems can self-configure and connect to the SaaS platform, helping reduce setup time and effort.

Q: Can it scale across multiple locations?

A: Yes, API-driven automation helps enable rapid onboarding of multiple systems simultaneously. This makes it ideal for organizations managing hundreds or thousands of edge sites.

Q: What security features are included?

A: The solution runs on VaultOS™, which includes immutable backups, multi-layer ransomware protection, and a zero-trust architecture. These features help provide stronger, more resilient data protection at the edge.

Q: How does centralized management benefit IT teams?

A: IT teams gain a single pane of glass to monitor, update, and manage all edge systems. This helps improve visibility, reduce operational overhead, and maintain consistent policies across environments.

Q: Why is this important for modern edge environments?

A: As edge computing grows, traditional deployment methods become too slow and resource-intensive. This solution helps enable fast deployment, consistent data security, and reliable recovery, aiding organizations in keeping pace with scale and risk.

Justin Wolf is Senior Product Manager and Chad Bersche is Principal Product Manager at Commvault.

Blogs connexes

More related posts

Thumbnail_Blog_HPE-Active-Peer-Persistence-2024-_1_

A Powerful Partnership for the Future of Data Resilience

Read more
Thumbnail_Blog_Commvault-Cloud-2025-Linkedin

Elevate Your Cyber Resilience with Commvault Cloud Enhancements

Read more

Artificial intelligence is redefining what’s possible for modern enterprises: accelerating innovation, sharpening decision-making, and unlocking new efficiencies at scale. Behind every AI-driven insight lies a physical reality—one powered by energy, infrastructure, and data.

As AI adoption grows, so does the need to efficiently manage and protect data at scale.

The future of AI will not be defined by intelligence alone, but by how responsibly that intelligence is built and sustained.

Les trois principaux leviers de l’impact environnemental

The environmental impact of AI is rooted in the compute infrastructure that powers it. Training and running AI models requires high-performance systems that consume electricity. But compute intensity is only part of the story.

AI depends on vast amounts of data—stored, moved, and processed across systems, each contributing to resource use.

All of this is supported by data centers, where servers must be powered and cooled. Cooling systems can represent a meaningful portion of energy use, making data infrastructure design a critical factor in AI sustainability.

Finally, the environmental impact of AI is influenced by how electricity is generated: the same workload can result in very different carbon emissions depending on the energy source.

Lutter contre l’inefficacité, pas contre l’innovation

AI is scaling rapidly as organizations deploy it across functions, generate more data, and expand infrastructure to keep pace. A key inefficiency often goes unnoticed: half of enterprise data is never accessed after being stored.1Companies pay to store it without realizing value from it. This is where the environmental footprint of AI can expand—not through innovation, but through inefficiency.

Addressing this starts with better visibility and control over data.

Des données plus intelligentes : un levier puissant pour le développement durable

L’IA s’appuyant sur de vastes ensembles de données, les entreprises peuvent contribuer à réduire leur impact environnemental en remédiant aux pratiques inefficaces en matière de gestion des données qui génèrent des charges de travail superflues. Les solutions Commvault offrent plusieurs fonctionnalités qui aident les entreprises à gérer et à exploiter efficacement leurs données :

  • Deduplication to remove redundant data
  • Tiering to align storage and processing with access needs
  • Compression to reduce storage requirements

Une gestion réfléchie des données contribue à améliorer l’efficacité et à réduire la consommation de ressources.

Durabilité et résilience : les deux facettes d’une même stratégie

Data environments filled with redundant and unorganized data are not only energy-intensive, they are also harder to secure, govern, and recover. Complexity increases risk and complicates business continuity plans.

By helping organizations manage, protect, and leverage their data, Commvault supports systems that are both resilient and sustainable. Smarter data management can help reduce waste, improve efficiency, and strengthen cyber resilience.

La voie à suivre

L’avenir de l’IA dépendra des choix que feront aujourd’hui les organisations. Les acteurs de premier plan dans ce domaine :

  • Treat data as a strategic asset—not just a growing volume
  • Concevoir des systèmes d’IA en tenant compte de l’efficacité et de la gestion du cycle de vie
  • Intégrer la résilience à tous les niveaux de leurs activités

With smarter data management, optimized infrastructure, and responsible design, organizations can reduce the environmental impact of AI—while unlocking its full potential.

Less waste. More resilience.

1L’état des « données obscures »

Aakanksha Kashyap is ESG Specialist at Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Key Takeaways:

  • Cyberattacks increasingly target both production and backup environments, making clean, verifiable recovery essential.
  • Integrated anomaly and threat detection strengthen cyber resilience by identifying compromised data, validating trusted recovery points, and accelerating restoration.
  • When embedded into data-protection workflows, anomaly and threat detection capabilities can help provide the evidence needed to recover quickly, safely, and confidently.

Why Cyber Resilience Hinges on Integrated Anomaly and Threat Detection

Anomaly detection identifies unusual behavior in backup data that may indicate compromise. Threat detection identifies known malicious activity using signatures, heuristic analysis, and scanning techniques. Together, they help validate recovery points and enable clean data recovery.

For years, security leaders focused on preventing breaches. In today’s era of persistent attacks and AI-driven threats, organizations increasingly assume compromise and design systems that can withstand disruption and recover safely when it occurs.

Modern adversaries don’t always hide their presence – they reveal it when it serves their objective. Attackers try to infiltrate environments quietly, observe systems over time, and position themselves inside critical infrastructure. The moment an attack becomes visible is rarely the moment it begins; it is the moment the attacker chooses to act.

By then, compromised data may already be woven into backup copies. Integrated anomaly and threat detection can help organizations identify compromised backup data, validate clean recovery points, and assist recovery after a cyberattack.

For security and IT teams, the challenge is no longer simply detecting an attack but predicting and managing an attacker’s possible impact. Understanding what was affected, what remains trustworthy, and how the organization can recover safely without escalating business disruption is the solution.

This is why cyber resilience benefits tremendously from integrated anomaly and threat detection. When detection capabilities are embedded into data protection and recovery workflows, they help provide the shared intelligence that teams need to identify compromised data, validate trusted recovery points, and guide response decisions with evidence rather than guesswork.

This approach aligns with the emerging ResOps™ operating model, where security, IT, and recovery teams work from shared visibility and validated recovery paths to respond to incidents together.

The New Reality: Recovery Requires Proof, Not Assumptions

Traditional threat detection tools focus on spotting threats along the perimeter. But once attackers are inside, visibility can become fragmented and determining which systems and data have been affected becomes a challenge.

Further, attackers increasingly target backup environments specifically to undermine recovery. And the moment organizations cannot confidently prove that backups remain untouched, suspicion becomes unavoidable. The result is uncertainty. Restore quickly and risk reinfection? Or delay recovery while investigating which copies remain trustworthy? IT teams are forced to guess which data is safe while downtime accumulates.

By building intelligence directly into data protection workflows, anomaly and threat detection helps transform recovery from a reactive guess into a disciplined, evidence-driven process. These capabilities can help organizations pinpoint tampered copies, validate data cleanliness, and assemble the most recent uncompromised recovery points – helping you accelerate cyber recovery and reduce operational impact.

Anomaly Detection: Your Early Signal of the Unknown

Anomaly detection acts as a sentinel, guarding your protected data integrity. It establishes a baseline of normal behavior – file sizes, growth patterns, deduplication changes, access attempts – and alerts teams when something deviates from that norm. These deviations can surface signs of silent tampering long before malware signatures do. In an era of novel and polymorphic threats, anomaly detection helps offer what static tools can’t: visibility into the unexpected.

Threat Detection: Targeted Defense Against Known Malicious Activity

While anomalies reveal what’s unusual, threat detection exposes what is malicious. By scanning protected data directly for ransomware, malware signatures, encryption patterns, and custom indicators of compromise (IoCs), threat detection helps validate that the data you protect is not already compromised.

Why a Combined Approach Matters

Neither anomaly nor threat detection alone provides the full picture. Together, they deliver a defense-in-depth strategy: Anomaly detection can highlight suspicious signals while threat detection can probe deeper to verify malicious intent. This combination helps organizations distinguish harmless anomalies from true compromises and maintain reliable, validated data for rapid recovery.

Meeting Today’s Challenges with Commvault® Cloud

Attackers increasingly target backup environments, and hidden malware within backup data can increase the risk of reinfection during recovery. Organizations need data-driven validation for their clean recovery with certainty.Commvault Cloud addresses this by combining data protection workflows with anomaly detection, threat intelligence, AI-enabled analytics, and isolated clean instances. With anomaly and threat insights applied before, during, and after backup operations, Commvault can help empower organizations to recover faster, cleaner, and confidently.

Read the full white paper, “Can You Prove You’re Recoverable Right Now?”pour plus d’informations.

FAQ

Q: What is anomaly detection in data protection?

A: Anomaly detection identifies unusual behaviors – such as unexpected backup size changes or abnormal file activity – that may signal tampering, ransomware, or emerging threats within protected data.

Q: Why do CISOs need threat detection in their backup workflows?

A: Backup environments are now prime attacker targets. Threat detection helps prevent organizations from storing or restoring compromised data, which helps reduce reinfection risk and improve chances for clean recovery.

Q: How does Commvault help enable clean data recovery?

A: Commvault uses AI-assisted threat scanning, encryption detection, custom IoC matching, and cyber deception to help validate backup integrity and assemble the most recent uncompromised data for rapid recovery.

Q: Why combine anomaly and threat detection?

A: Anomalies identify the unknown; threat detection validates the known. Together, they provide comprehensive visibility into suspicious activity, helping enable faster investigation and more confident data recovery.

Liste de Paulineis Product Marketing Manager at Commvault

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Points clés à retenir

  • Advanced AI models like Claude Mythos Preview could dramatically accelerate vulnerability discovery, reshaping the cybersecurity landscape.
  • Project Glasswing highlights growing concerns about managing AI-enabled security risks at scale.
  • ResOps helps shift organizations from reactive defense to proactive resilience and recovery.
  • Cybersecurity tools focus heavily on prevention, while recovery capabilities remain underdeveloped.
  • In an AI-enabled world, the ability to recover quickly from disruption will define operational success.

Anthropic’s new Claude Mythos Preview modelis reportedly powerful enough to identify vulnerabilities in software systems in seconds. In early testing, the company claims the model was able to break out of its containment environment and email an engineer about the event.
Given these potential risks, Anthropic is limiting access to a small group of large organizations throughProject Glasswing. The goal: stay ahead of the security implications of a world where vulnerability discovery and exploitation may become trivial.
This shift strengthens the case for resilience operations (ResOps™). It could fundamentally change how organizations approach cybersecurity.
In a recent LinkedIn post, “The Beginning of the End of Cybersecurity,” Jen Easterly, CEO of RSAC and former director of CISA, argues that today’s cybersecurity industry is built to identify, defend against, and respond to software defects.
In effect, it compensates for gaps in software quality and secure development practices. If models like Claude Mythos Preview perform as described, their ability to surface vulnerabilities at scale could significantly disrupt today’s security tooling landscape.
A recent STRIVE episode – Evidence Over Hope: Will Your Recovery Plan Hold Up Under Pressure? – echoes this concern. Organizations have invested heavily in tools to prevent attacks, yet relatively little innovation exists “right of boom” – the capabilities required to recover the business when disruption inevitably occurs.

Why ResOps?

ResOps is an organizational discipline that embeds resilience into daily operations. It shifts organizations from passive, reactive backup strategies to an active, continuous model.
Traditional IT operations focus on efficiency. ResOps focuses on surviving failure. It brings together security, infrastructure, and operations teams around a common goal: Identify the organization’s minimum viable business – the critical systems, data, and processes required to operate – and enable those services to be restored quickly and cleanly after a disruption.
Most operational disciplines optimize for when systems work as expected. ResOps is designed for when they don’t. Its core question is simple: Can you recover each critical service right now – with confidence and evidence?

What Does the Future Hold?

If Easterly’s perspective proves accurate – that cybersecurity largely compensates for software defects – then technologies like Claude Mythos Preview represent more than incremental progress. They signal a structural shift in enterprise risk.
AI may help reduce the time between vulnerability discovery and remediation. It may even eliminate certain classes of software flaws. But it does not remove the risk of outages, misconfigurations, identity compromise, or cascading failures in complex systems. And it does not replace the operational discipline required to respond and recover.
Failure will still happen. That reality makes ResOps more important – not less. As prevention becomes more automated, resilience becomes the differentiator. Organizations will no longer be measured solely by their ability to block attacks. They will be measured by how effectively they recover – restoring critical services and trusted data under real-world conditions.
Cybersecurity aims to keep threats out. ResOps prepares you for when they get in. In an AI-accelerated world, the ability to survive and recover from failure may be the most important operational capability an organization can build.
Read more in our Readiness Report, Evidence Over Hope: The Executive Case for Resilience Operations, and learn more about theResOps disciplineon theReadiverse.

FAQ

Q: What is Project Glasswing, and why does it matter?

A: Project Glasswing is an initiative by Anthropic to limit and study access to powerful AI models capable of identifying software vulnerabilities. It matters because it signals a future where vulnerability discovery becomes fast and widespread, increasing both defensive and offensive risks.

Q: What is ResOps, and how is it different from traditional IT operations?

A: ResOps is a discipline focused on enabling organizations to survive and recover from disruptions. Unlike traditional IT operations that prioritize efficiency, ResOps prioritizes continuity and rapid recovery of critical services.

Q: How could AI impact the future of cybersecurity?

A: AI may significantly reduce the time needed to detect and fix vulnerabilities, potentially disrupting existing security tools. However, it does not eliminate risks like outages or misconfigurations, making recovery capabilities even more important.

Q: Why is recovery becoming more important than prevention?

A: Despite heavy investment in preventive tools, disruptions still occur. As threats evolve and automation increases, organizations will be judged more on how quickly and effectively they can restore operations after an incident.

Q: What does “right of boom” mean in this context?

A: “Right of boom” refers to the phase after an incident has occurred, focusing on response and recovery. It highlights the gap in innovation around restoring business operations compared to preventing attacks.

Q: How can organizations start adopting ResOps?

A: Organizations can begin by identifying their minimum viable business – critical systems and data – and building processes to restore them quickly. This involves aligning security, IT, and operations teams around resilience-focused goals.

Jason Meserve is Director of Social Marketing at Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Points clés à retenir

  • Rising operational disruption makes scalable resilience essential, but organizations commonly fall into traps like seeking “silver bullet” technology or relying on “hero worship” of individual experts.
  • ResOps provides a scalable framework that integrates people, processes, and technology across ITOps, SecOps, and DevOps.
  • Executive sponsorship at the CEO level helps drive accountability and prioritize resilience as a strategic discipline.

Cyberattacks, cloud complexity, and AI-enabled threats are creating constant operational challenges for enterprises. To help meet business requirements in this increasingly disruptive environment, organizations need to move beyond separate recovery tools, teams, and plans to resilience as an integrated operating model.

In a recent webinar, Phil Goodwin, research vice president for IDC’s worldwide infrastructure programs, joined me for a fireside chat to explore how organizations can move beyond fragmented approaches to build resilience that scales.

Why Organizations Need a New Resilience Framework

As organizations engage in daily firefighting while keeping up with new technologies and addressing new initiatives, they rarely have time to step back and reassess whether their approaches still meet requirements. But as isolated incidents become systemic disruption, this conversation has become essential.

In a simpler era, organizations focused primarily on backup and recovery. Large-scale disruptions such as Hurricane Sandy brought disaster recovery onto the agenda. Intensifying cyberthreats like ransomware added cyber resilience and business continuity to the list. Each evolution brought new capabilities, but many organizations simply bolted new approaches onto what they were already doing rather than addressing these expanding requirements holistically.

When separate teams manage different pieces with different tools and policies, gaps may emerge that can slow recovery. Despite years of investment in cybersecurity, organizations are still struggling with recovery.

More recently, AI has accelerated the urgency for a more integrated approach by reshaping both threats and defenses. Despite increasing AI investments, many businesses are delaying AI rollouts due to ongoing concerns about governance and security vulnerabilities.

On the other side of the cyber front, bad actors are using AI to create deepfakes, target users with more sophisticated and convincing phishing, and exploit vulnerabilities at scale.

Resilience operations – ResOps – treats resilience as a continuous operating discipline rather than a collection of separate tools and teams. By bringing together ITOps, SecOps, and DevOps under a unified framework, ResOps helps transform resilience to keep pace with systemic disruption.

Avoiding Common Mistakes in Resilience Planning

Even organizations that recognize the need for change often fall into traps. One is the “silver bullet” problem, which focuses on technology as the solution. Leaders want to believe that buying the right tools will solve everything, but technology alone can’t deliver positive business outcomes without proper integration and process.

“Hero worship” is another common pitfall – relying on talented staff members with expertise residing in their heads rather than in documented processes. Heroism can’t scale, and reliance on specific individuals creates vulnerability when people leave or responsibilities shift.

To move past these traps, you have to think differently about your operating model. Instead of focusing primarily on technology and people, consider the team you’ll need to build, including executive sponsorship, IT operations and security leadership, and senior leaders from the business side.

The team’s charter should focus on defining business outcomes first: What does resilience need to achieve for the organization? What KPIs, SLAs, and processes should be established to meet these requirements?

Building Resilience Operations from the Top Down

As a board-level priority, resilience requires support from the highest levels. ResOps gains the most traction when the CEO is involved, helping set resource priorities and driving accountability across the organization. With executive sponsorship in place, senior leaders including the CIO, CTO, CISO, and general managers can task their staff with implementation.

This approach can scale across organizations of all sizes. Even small to midsize companies can bring together cross-functional teams that include business stakeholders, IT teams, and people tasked with data security and network security. As they grow, this structure can scale with them, adding headcount within specific resilience disciplines while maintaining an integrated approach across the resilience operations chain.

ResOps reflects the ways teams across IT operations, SecOps, and DevOps need to work together within organizations. Data recovery and data security have become so closely aligned that within IDC, researchers across these disciplines now collaborate frequently on client engagements.

Applications now need to be designed with threat actors in mind, incorporating zero trust architectures and assuming that something will go wrong. ResOps provides the framework for this convergence, bringing security and operations tools together into a unified model to address threats and disruptions of all kinds.

ResOps as a Shared Industry Framework

ResOps is an operating model, not a product, and can benefit companies regardless of the specific tools they use. As Phil observed during our chat, “It really requires that community involvement where people pitch in from different perspectives, different vendors, different organizations, and different teams, just like DevOps or SecOps.”

For organizations struggling with constant disruption and the growing complexity of AI-enabled threats and defenses, ResOps offers a path beyond fragmented resilience approaches. By bringing together people, processes, and technology in a unified operating model, ResOps turns fragmented recovery efforts into enterprise-wide readiness.

Watch my full fireside chat with Philto see how ResOps can help you build enterprise resilience that scales.

FAQ

Q: What is resilience operations (ResOps)?

A: ResOps is an operating model that integrates IT operations, security operations, and DevOps into a continuous discipline. Rather than treating disaster recovery, cyber resilience, and business continuity as separate capabilities, ResOps brings people, processes, and technology together under a unified framework to help create scalable enterprise resilience.

Q: Why is executive sponsorship important for cyber resilience?

A: Executive sponsorship – ideally at the CEO level – helps drive accountability and priority for resilience initiatives across the organization. This top-down support is essential for organizations trying to move beyond fragmented approaches to integrated resilience operations.

Q: Can small and midsized organizations implement ResOps?

A: Yes. ResOps applies across organization sizes. The framework scales in complexity as organizations grow, making it accessible to mid-market firms while remaining effective for large enterprises.

Q: Why do IT and security teams need to work together for resilience?

A: When IT operations, security operations, and DevOps teams collaborate rather than work in silos, organizations can help build more resilient infrastructure to address evolving threats.

Q: How should organizations get started with resilience operations?

A: Start at the top by securing executive sponsorship at the CEO level. Next, form a cross-functional team including IT operations, SecOps, and business stakeholders, and have them define the business outcomes resilience needs to deliver for your business. Conduct a threat assessment to understand the risks you need to address. Only after these foundational steps should organizations focus on selecting technologies and developing detailed processes.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more

Note: This blog was originally published in October 2025 when Data Rooms was introduced. It has been updated to reflect the next evolution, Data Activate.

Points clés à retenir

  • Data Activate is part of Commvault’s next-generation AI capabilities – alongside AI ProtectetAI Studio – annoncé to help organizations activate AI safely, govern AI agents,etbuild agentic workflows from Commvault Cloud.
  • Data Activate est conçu pour vous permettre de transformer vos données de sauvegarde en ressources fiables et prêtes pour l’IA, tout en vous aidant à garantir la gouvernance et la conformité.
  • Cette offre permet de concilier protection des données et activation de l’IA sans créer de nouveaux risques pour la sécurité ni nécessiter platform autre platform.
  • Il s’intègre aux écosystèmes d’IA existants tels que Microsoft Azure et Snowflake à l’aide de normes ouvertes telles qu’Apache Parquet et Iceberg.
  • La gouvernance intégrée permet la gestion, la classification et le partage sécurisés des données au sein d’une architecture « zero-trust ».
  • En activant les données historiques, les organisations peuvent contribuer à accélérer l’innovation en matière d’IA, l’analyse et les workflows de conformité en toute sécurité.

AI innovation depends on data – but not just any data. It depends on trusted, governed,etaccessible data. Yet for most enterprises, the data that could fuel AI lives deep within backups, scattered across environments,etwrapped in compliance constraints. That’s where Commvault’s Data Activate offering, previously known as Data Rooms, comes in.

Accélérer l’IA en toute sécurité

Data Activate est l’une des trois fonctionnalités d’IAannoncé as part of its next-generation AI platform – alongside AI ProtectetAI Studio. As organizations race to adopt AI, many are running into a fundamental challenge: their data is fragmentedetdifficult to use. According to a recent survey, 68 % des entreprises cite data silos as their top concern.

Commvault’s Data Activate offering helps transform backup data – one of the most completeettrusted datasets an organization owns – into AI-ready assets. Data Activate helps enterprises safely connect their data to AIetanalytics platforms, without creating new risks or complexity.

Unlike earlier bulk export approaches, Data Activate can regularly publish updated datasets, making it easier to keep AI pipelines in sync with the most current trusted data. Teams also can identifyetexclude sensitive data – such as personally identifiable information – before activating datasets for analytics or model development.

The Data Activate offering is not another AI platform. It’s the bridge between data protectionetdata activation, designed to make your existing AI investments work fasteretsafer. It does this by creating governed, policy-controlled “rooms” inside Commvault Cloud – spaces where data can be classified, curated,etshared with AIetanalytics tools without leaving the protection boundary.

À l’écoute des clients : finie Platform

We heard customers loudetclear: You don’t need another AI platform. You need a protected, simple way to use the data you already maintain – across the AI toolsetecosystems you’ve already chosen.

That’s why Commvault built Data Activate to integrate with partners like Microsoft AzureetSnowflake using open-standard formats such as Apache ParquetetIceberg. This helps you keep your data portable, policy-compliant,etready for activation – wherever your AI strategy takes you.

Transformer la protection des données en activation des données

With Data Activate, authorized users can discover, classify,etprepare data directly from backup repositories – across on-premisesetcloud environments. Built-in governance helps maintain control, allowing only approved datasets to be shared, with automated classification, sensitivity tagging, redaction,etaudit trails applied every step of the way.

Data Activate acts as a governed, policy-controlled workspace inside Commvault Cloud – where data can be curatedetmade available to AI or analytics tools without leaving the protection boundary. This governed design provides a protected bridge between backup dataetactivation workflows, helping organizations unlock their information for innovation while being able to maintain complianceetcontrol.

Data Activate peut vous aider à :

  • Accelerate insights: Quickly findetexport historical data in AI-friendly formats to train models or power analytics.
  • Simplify operations: Eliminate brittle ETL pipelines with automated data discoveryetcuration.
  • Maintain compliance: Keep governance intact with policy-based controlsettraceability from backup to activation.

La confiance comme fondement d’une IA responsable

Dans la course à l’adoption de l’IA, la confiance fait souvent les frais de cette évolution. Selon uneétude, roughly three-quarters of surveyed IT leaders said that using AI could make their organizations more vulnerable to cyberattacks. That’s why Commvault built Data Activate within Commvault Cloud’s zero-trust architecture, complete with encryption, RBAC,etcompliance support.

By combining data protection, governance,etactivation in one platform, Commvault enables enterprises to accelerate AI innovation without compromising data security, compliance, or control.

Accélérer l’innovation sans augmenter les risques

Commvault’s Data Activate offering helps organizations move faster by making data safely accessible to the tools that drive their business forward – from AI model training to analytics, eDiscovery,etcompliance support automation. Because when backup data becomes usable data, enterprises unlock years of historical intelligenceetcontext that most AI models simply don’t have.

As Pranay Ahlawat, Commvault’s Chief TechnologyetAI Officer, said: “Organizations are beginning to realize that their historical data is more than just insurance – it’s a powerful, untapped strategic asset. With Commvault Data Activate, enterprises can confidently export their secondary dataetharness it with the AI platform of their choice to unlock new opportunities for intelligence, innovation,etbusiness growth.”

Pourquoi est-ce important aujourd’hui ?

Commvault’s Data Activate offering redefines what’s possible for enterprises that want to innovate responsibly. They make it possible to move from protecting data to activating data – safely, flexibly,etat scale.

In short: Commvault isn’t building another AI platform. We’re building the foundation that lets every AI platform work better – because when data is protected, trusted,etready for activation, innovation happens faster.

FAQs

Q: What is Commvault’s Data Activate offering?
A: Commvault Data Activate is a capability within Commvault Cloud that helps enterprises safely discover, classify,etactivate backup data for AIetanalytics. It supports open formats like Apache IcebergetParquetetis built on a zero-trust, governed architecture for controlled, self-service data access.

Q: How does Data Activate differ from other AI data solutions?
A: Most AI data prep tools work only on live or production data, creating complianceetcost challenges. Data Activate works from backup data – data that’s already protectedetgoverned – bringing a unique balance of accessibility, compliance support,ettrust. It’s built into Commvault Cloud’s policy-controlled environment, so it’s part of a unified cyber resilience platform. Data Activate also regularly publishes updated datasets – rather than relying on one-time bulk exports – helping keep AI pipelines current without manual intervention.

Q: What benefits do organizations gain from using Data Activate?
A: Organizations can accelerate AIetanalytics insights, simplify data operations by reducing ETL complexity,etmaintain compliance through automated classification, tagging,etauditing processes.

Q: How does Data Activate support data securityetcompliance?
A: Data Activate operates within Commvault Cloud’s zero-trust architecture, applying classification, redaction,etaudit-friendly controls automatically. It helps maintain data privacy, traceability,etcompliance throughout the data lifecycle, aligning with internaletregulatory governance standards.

Q: What types of AI or analytics platforms can connect with Data Activate?
A: Data Activate integrates with leading cloudetAI partners such as Microsoft AzureetSnowflake, supporting open-standard data formats like Apache ParquetetIceberg for maximum flexibilityetportability.

Q: Why is this offering important for enterprises today?
A: As organizations accelerate AI adoption, Data Activate enables them to responsibly unlock the value of historical, protected data – fueling innovation while helping maintain trust, compliance,etcontrol.

Vir Choksi is Principal Product Marketing Manager at Commvault.

 

More related posts

Thumbnail_Blog-Dangerous-Silos-IDC-Resops-2026 (1)

The Importance of Recovery Point Objective (RPO) in Your Business Continuity Plan

Read more
Thumbnail_Blog-IDC-Resops-2026

Business Continuity Planning for the Cloud-Native Era

Read more
Thumbnail_Blog-Bringing-Trust-to-CVE-2026

Demystifying SOC 2 Data Protection Requirements

Read more