Security does not end at the edge of an organization’s own systems. Modern businesses connect a growing web of third-party applications to their core platforms to support sales, service, and collaboration. Each of these connections adds value. Each one also introduces exposure the organization does not fully control.That risk is not hypothetical. In June 2026, a threat actor compromised OAuth tokens tied to Klue, a competitive intelligence platform used to sync sales and marketing data with Salesforce. The attacker used those tokens to reach the Salesforce environments of the many organizations that had authorized the integration, including Commvault’s.As soon as we were notified of potential impact, our Security team activated our incident response process to determine what had occurred, contain the exposure, and assess whether customer information or Commvault services were affected.Our investigation found that the activity was limited to certain business relationship and sales information maintained within our Salesforce environment. The investigation found no indication that any customer backup data, product data, product metadata, operational logs, or Commvault services were impacted.

Acting Quickly When It Matters

Our response followed established security incident response procedures built to contain risk quickly while supporting a thorough investigation. Once we were notified of the incident, we disabled the Klue integration, revoked the associated access, and worked with the appropriate parties to conduct a full assessment of what happened.Throughout the investigation, our teams worked to determine what information had been accessed, validate the integrity of our environment, and confirm the incident stayed within the scope we had already contained.

A Pattern Worth Noting

This incident is one recent example of a pattern security teams have watched grow for several years: attackers targeting third-party applications connected to core business systems rather than attacking those systems directly. A single compromised integration can offer a trusted path into the environments of many downstream organizations at once, often with less resistance than a direct attack on any one of them.This shifts where an organization’s defense actually has to live. Strong internal controls remain necessary, but they are no longer sufficient by themselves. They have to be paired with active oversight of every application an organization connects, and a response capability that is ready before an incident, not built during one.

Building Resilience Beyond Our Own Environment

At Commvault, our security program includes ongoing assessment of the third-party applications connected to our environment. We review connected applications on a regular basis, evaluate the access each one holds, monitor for emerging risk, and reassess those integrations as business needs and the threat landscape change. When circumstances warrant, we act to reduce exposure and strengthen our posture, including disconnecting integrations that no longer meet our standards.

Our Commitment to Transparency

Trust is built through openness and accountability. When an event affects our stakeholders, we believe it is important to communicate what we know, explain how we responded, and share the outcome of our investigation, even when the event originated outside our own systems.We will continue to evaluate our security controls, refine our incident response processes, and strengthen our approach to third-party risk as part of our broader commitment to protecting our customers and partners.For the official details of this incident, including the scope of the investigation and customer guidance, please refer to ourTrust Center Updates.Will Galway is Deputy CISO at Commvault.

For years,post-quantum cryptography (PQC) sat comfortably in the category of “important, but not urgent.”

Security leaders knew it was coming. Researchers talked about it. Standards bodies worked on it. Most organizations acknowledged that it would eventually require attention. But I would argue that the time to start preparing is now.
In this episode of STRIVE, I sat down with Sr. Director of Portfolio Marketing Michael Fasulo to discuss why the conversation around PQC is changing so quickly – and why the organizations that wait for certainty may find themselves running out of time.
Watch the episodio.

Punti di forza

• Harvest Now, Decrypt Later attacks mean sensitive data is already at risk, even if quantum capabilities aren’t stable or commercially viable yet.
• Most organizations do not have a complete view of their cryptographic inventory, making discovery the first major hurdle.
• PQC is just as much a technology challenge to solve for and as much as it is about risk prioritization.
• The organizations that start preparing now will have more options to course correct on prioritizations than those forced to react later.

The Problem Isn’t the Technology

Most discussions about post-quantum cryptography start with technology.

• How quickly is quantum computing advancing?
• When will cryptographically-relevant quantum systems become practical?
• Which algorithms are likely to survive long term?

Those are important questions. But they’re not the questions I would prioritize asking. Michael wrote a blog last year about PQC and we discussed today how several things have changed since then.
Over the past several years, estimates have consistently moved in one direction: what once felt distant now feels increasingly close. At the same time, standards are evolving; regulatory expectations are increasing, and organizations are beginning to recognize how much cryptographic debt they’ve accumulated over the decades.
The exact date of Q-Day may remain uncertain. The direction of travel is not.

The Risk Is Here And Now

One reason this conversation has become more urgent is the growing attention around Harvest Now, Decrypt Later attacks. The concept is straightforward: An adversary gains access to encrypted information today, stores it, and waits for future capabilities to make that information readable.
What’s important here is that the risk doesn’t begin when quantum computing arrives. The risk begins when even encrypted data is exfiltrated and stored.
For organizations protecting intellectual property, healthcare records, government information, or other sensitive long term retention data, that distinction changes everything.
Organizations need to know whether data being retained today will still matter when that future arrives.
For many,esp. the highly regulated industries and critical infrastructure, the answer is yes.

Sneak Peek: Why Crypto Agility Matters

Embed clip here: https://www.youtube.com/watch?v=A3YWU5rlmGA

In this clip, Michael explains why PQC isn’t a one-time fix or switch. The real goal is crypto agility – building the flexibility to adapt cryptographic algorithms as standards, and threats evolve. Because in cybersecurity, the challenge isn’t just preparing for what’s next. It’s being ready for what comes after that.

Discovery Is the Real Project

One misconception about PQC is that it’s primarily an encryption upgrade. In reality, most organizations haven’t reached the stage where replacement is the biggest concern.
They’re still trying to understand the scope of the problem. Cryptography exists everywhere.

• Applicazioni
• Certificates
• Cloud services
• APIs
• Code signing
• Third-party platforms

Many organizations struggle with the creation of the cryptographic inventory or its scope. That makes discovery one of the most important – and often underestimated – parts of the journey.
And for many enterprises, that’s a much larger endeavor than expected.

The Supply Chain Challenge

Another reason PQC has become a priority is that no organization will navigate this transition alone. Modern enterprises depend on vendors, cloud providers, software partners, and countless third parties, all of whom use cryptography.
That means quantum readiness extends beyond internal systems. It becomes a question of ecosystem readiness.

• Are suppliers preparing?
• Are critical vendors planning migrations?
• Are third-party platforms aligned with emerging standards?

These questions will increasingly become part of risk conversations, procurement discussions, and long-term technology planning. Because cryptography doesn’t stop at organizational boundaries. Neither does risk.

Why This Conversation Matters

The most important takeaway from this discussion is that post-quantum cryptography is no longer a future technology challenge.
It’s becoming a present-day resilience conversation.
Organizations don’t need to panic and they don’t need to overhaul every system overnight. But they do need to begin, to make the best use of the time at their disposal for prepartion.
The organizations that navigate this transition successfully won’t necessarily be the ones with the most sophisticated cryptography. They’ll be the ones that started building understanding before certainty arrived.
And that’s often how resilience works.

Watch the Full Episode

There is plenty more that Michael and I explore in the episode that I didn’t capture above. Be sure to Guardalo subitofor insights to:

• The biggest challenges organizations face when starting their PQC journey.
• What leaders should prioritize today including some best practices.
• Understanding MLKEM algorithms and crypto agility.
• Infrastructure considerations for PQC.
• How Commvault is preparing for this future.

FAQs

Q: What is post-quantum cryptography (PQC)?
A: PQC refers to cryptographic algorithms designed to help remain secure against attacks from future quantum computers.
Q: What is Harvest Now, Decrypt Later?
A: It’s a strategy where attackers collect encrypted data today with the intention of decrypting it later when more advanced computing capabilities become available.
Q: Why are organizations focusing on PQC now?
A: Because preparation takes years, and sensitive data collected today may still be valuable when quantum threats become practical.
Q: What is the biggest challenge organizations face?
A: Discovery. Most organizations do not have complete visibility into where cryptography is used across their environments.
Q: Do organizations need to replace all cryptography immediately?
A: No. Most experts recommend starting with inventory, discovery, and prioritization before planning broader migrations.
Q: What should leaders do first?
A: Identify long-lived sensitive data, understand cryptographic dependencies, and begin building a roadmap for future transition.
 

Vidya Shankaran is Field CTO at Commvault.

To address mandates governing where their data is stored and used,many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography,that no foreign-jurisdiction personnel accessed it,and that they can recover it within 24 hours under incident conditions.

In a recent webinar,I joined Commvault GM Alex Zinin,who leads our digital sovereignty task force,along with Jakub Lewandowski,our associate general counsel for EMEA,and Pranay Ahlawat,our chief technology and AI officer,to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.

See the full webinarand get the fullLa sovranità digitale spiegatareadiness report and implementation framework.

Punti di forza

• The EU Cloud Sovereignty Framework defines eight sovereignty objectives,only one of which concerns data location.
• Selecting a sovereign cloud region addresses where data lives,but not who can access it,under what legal authority,or whether you can recover it under real conditions.
• A complete sovereignty posture spans four interdependent pillars: data locality,technological sovereignty,operational sovereignty,and jurisdictional sovereignty.
• Sovereignty programs that treat recovery architecture separately from primary data governance carry an unexamined risk that can surface during incidents.
• Rather than a policy of maximum sovereignty at any cost,organizations should design their strategy around minimum viable sovereignty: the right controls,consistently enforced,calibrated to actual obligations.

Digital Sovereignty Becomes an Enterprise Requirement

Over the past decade,the toughest digital and data sovereignty rules have mainly applied to government,defense,and other national‑security workloads. Outside of highly regulated sectors,many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.

That’s now changing. GDPRenforcement has matured beyond guidance into substantial fines for operational failures,and newer regimes like“DORA,NIS2,Germany’s KRITIS rules,and the EU Data Act have tightened expectations around jurisdictional control and operational resilience.

Sovereignty questions are now surfacing in RFPs,M&A due diligence,and board‑level risk reviews as well.

The EU Cloud Sovereignty Framework,published in October 2025,clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives,only one addresses where data resides. The other seven cover access control,operational dependencies,jurisdictional exposure,and recovery.

For enterprises,this structure is now the lens through which vendor capabilities must be evaluated.

Sneak Peek: Rethinking Sovereignty and Resilience

In this moment from the webinar,Jakub discusses how sovereignty is a risk posture,rather than a single product. Organizations need a holistic strategy that combines architecture,operations,governance,auditability,and recovery planning to address it.

Data Residency Does Not Equal Sovereignty

Data residency only answers questions about where. Sovereignty regulations also require being able to explainwho,how,and under what conditions.

In practical terms,a complete sovereignty posture encompasses four interdependent pillars.

1. Data Locality

This pillar covers not just where data is stored,but where it travels. Control-plane artifacts,metadata,and telemetry can cross geographic boundaries even when primary data stays in-region.

2. Technological Sovereignty

This pillar addresses whether the organization controls the mechanisms that protect data:

• How access is granted.
• How data is encrypted.
• Whether encryption key custody is retained under all conditions.

A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK),where an organization’s own encryption keys are managed within the provider’s platform,and Hold Your Own Key (HYOK),where the organization retains independent custody of keys entirely outside the provider’s environment.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.

3. Operational Sovereignty

This covers who operates the environment and from where,including whether support personnel or third-party vendors are subject to foreign jurisdiction.

4. Jurisdictional Sovereignty

This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access,such as the cross-border situations discussed in the U.S. CLOUD Act.

Each of these pillars is essential to maintain compliance. A strong data locality posture with weak operational controls can allow unexamined risk.

Where Digital Sovereignty Programs Break Down

My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation,it gets too narrow,too quickly. Workshops zoom in on where data lives,teams get to work on that one question,and then they move on,leaving the other three pillars largely unexamined.

Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal,technical,and operational stakeholders,not as an IT project that gets checked off as complete.

Organizations can also be led astray by a few myths. One,as we’ve discussed,is the impression that sovereignty equals residency.

Then there’s the myth of absolute sovereignty,the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice,sovereignty always involves tradeoffs between control,cost,technological velocity,and the ability to innovate.

The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy,but a risk posture built from architecture,operations,contracts,certifications,and continuous auditability.

Resilience Belongs Inside the Sovereignty Boundary

Operational sovereignty is thehardest pillar to audit and the one most commonly underestimated. If your environment needed access for routine maintenance tonight,who would perform it,from which country,and under which legal jurisdiction?

Most organizations,when they work through that question for the first time,find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure,restoration sequencing,and recovery point management under a separate – and often weaker – set of controls. When an incident occurs,recovery personnel may not meet jurisdictional requirements,and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.

Commvault’s resilience operations model,ResOps™,addresses this need directly by framing recovery as an ongoing operational discipline that needs to be designed,tested,and validated inside the same sovereignty boundary as the data it protects.

Minimum Viable Sovereignty: The Right Level of Control,Not the Maximum

An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.

A payroll system,a customer transaction database,and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.

Minimum viable sovereignty sets a more practical target: the right controls,consistently enforced and continuously demonstrated,calibrated to what each workload actually requires across all four pillars.

Organizations have a broad range of options for how sovereign controls are delivered across their environment,each providing different controls.

How Commvault Is Addressing the Digital Sovereignty Issue

Commvault’s Geo Shield framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU,Geo Shield maps to the full spectrum of deployment models:

• Regional sovereign cloud services delivered as SaaS
• Hyperscaler sovereign-launch partnerships
• Partner-operated national sovereign offerings built with local service providers
• Fully customer-controlled private sovereign environments qualifying under frameworks likeFedRAMP High.

In this way,organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.

Watch the Full Webinar and Get the Readiness Report

In the full webinar,available on demand,you’ll discover:

• Why digital sovereignty is more than a technology solution.
• The role of architecture and operations in sovereignty strategy.
• How governance,contracts,and auditability impact resilience.
• Why sovereignty must hold up during cyber incidents and outages.
• The importance of a holistic,risk-based approach to sovereignty.

Guarda il webinar su “and get the fullLa sovranità digitale spiegatareadiness report and companion framework.

Domande frequenti

Q: What is the difference between data residency and digital sovereignty?

A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data,under what legal authority,through which operational pathways,and whether it can be recovered cleanly under real conditions.

An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel,vendor access agreements,or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.

Q: What is the EU Cloud Sovereignty Framework,and why does it matter?

A: TheEU Cloud Sovereignty Frameworkis a structured assessment tool developed by the European Commission to evaluate cloud and technology providers against sovereignty criteria during procurement processes.

It defines eight sovereignty objectives,with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls,key custody,jurisdictional exposure,and recovery.

The framework represents the most comprehensive public framework for evaluating sovereignty posture and is increasingly being used as a reference by other regions and procurement bodies beyond the EU.

Q: What is the difference between BYOK and HYOK,and why does it matter for sovereignty?

A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys,but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment,including under crisis conditions or legal compulsion.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The U.S. CLOUD Act,for example,can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.

HYOK addresses that exposure directly,though it may require a higher platform tier in SaaS deployments.

Q: Why do most sovereignty strategies overlook operational sovereignty?

A: Operational sovereignty,covering who operates the environment and from where,is the hardest pillar to audit because it requires inventorying support contracts,vendor access agreements,and third-party dependencies across the full operational chain.

Most organizations start sovereignty programs focused on data location and encryption,which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.

As a first step to evaluate operational sovereignty,you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.

Q: How should organizations think about recovery in the context of sovereignty?

A: Recovery architecture needs to meet the same sovereignty requirements as primary data environments,but it often doesn’t. In most organizations,backup infrastructure,restoration sequencing,and recovery point management are frequently governed by a separate set of controls,or none at all.

During an incident,the personnel authorized to execute recovery may not meet jurisdictional requirements,recovery points may not have been validated as clean and uncompromised,and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.

Q: What does minimum viable sovereignty mean in practice?

A: Minimum viable sovereignty means identifying the right level of control for each workload,calibrated to actual regulatory obligations,risk tolerance,and operational constraints,rather than applying maximum controls uniformly.

Maximum sovereignty comes with real tradeoffs: technological complexity,operational burden,service limitations,and cost. Organizations that define requirements by workload across the four pillars,map those requirements to deployment models,and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.

Q: What role do certifications like C5,SecNumCloud,and ISO 27001 play in a sovereignty strategy?

A: Certifications help provide auditable evidence that controls have been independently verified,an important part of any defensible sovereignty posture. C5 in Germany,SecNumCloud in France,and ISO/IEC 27001each establish baseline requirements that providers must demonstrate through independent audits.

The strongest sovereignty postures treat these certifications as a floor,providing necessary evidence that controls exist,but not a substitute for operational testing under realistic conditions.

Darren Thomson is Vice President and Chief Technology Officer,EMEA,at Commvault. Be sure to catch him in the podcast series, STRIVE.

Punti di forza

• L’utilizzo di più strumenti di backup spesso crea dipendenze operative da un numero ristretto di specialisti, aumentando il rischio organizzativo.
• La gestione della protezione attraverso console, politiche e sistemi di reportistica separati rende più difficile mantenere la visibilità e rispondere rapidamente ai problemi.
• Il consolidamento non deve necessariamente comportare un progetto dirompente di sostituzione totale; molte organizzazioni possono modernizzarsi gradualmente, mantenendo al contempo gli investimenti nell’infrastruttura esistente.
• Un piano di controllo unificato può aiutare a semplificare la gestione delle politiche, il monitoraggio, l’audit e le operazioni di Recovery in ambienti ibridi.
• Le organizzazioni che semplificano il backup spesso ottengono significativi risparmi sui costi, contribuendo al contempo a migliorare l’efficienza operativa e la resilienza.

You didn’t build a messy environment. You built a functional one.

Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.

The stack isn’t the problem. It’s the operational model that comes with it.

Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.

And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.

That’s not resilience. That’s dependency masquerading as expertise.

La parete delle dashboard

Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”

If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.

Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.

The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.

And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.

Cosa significa davvero il consolidamento per i team di infrastruttura

The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.

But that’s not what consolidation has to look like.

The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.

What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.

The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.

I numeri parlano da soli

Fortune Brands consolidated its backup environment with Commvault® Cloud and ha risparmiato 22,7 milioni di dollari – a 73% reduction in total cost. NTT-Netmagic ha ridotto i costi di 300.000 dollari all’anno and cut storage overhead by 35%.

Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.

Real Resilience Doesn’t Need a War Room

If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.

Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.

Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.

That’s the case for consolidation. Not a better product. A better way to run what you’ve built.

Want the full picture? Download “Il costo nascosto di sette strumenti – a field guide for data center teams who built something worth protecting.

Domande frequenti

Q: Why is managing multiple backup platforms a problem if they’re all working?

A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.

Q: What is one of the biggest risks created by a fragmented backup environment?

A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.

Q: Does consolidation mean replacing all existing infrastructure?

A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.

Q: How can consolidation improve resilience?

A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.

Q: What about vendor lock-in when consolidating to a single platform?

A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.

Q: How do organizations measure the value of consolidation?

A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.

Michael Thelander is Senior Director, Product Marketing, at Commvault.

Punti di forza

• La pressione normativa, le aspettative del consiglio di amministrazione e i conflitti nel mondo reale stanno accelerando il passaggio da una spesa incentrata sulla prevenzione a risultati in termini di resilienza.
• L’architettura della resilienza è diventata significativamente più complessa, soprattutto perché i sistemi di intelligenza artificiale introducono nuove sfide relative alla tracciabilità dei dati e a Recovery.
• La resilienza informatica deve superare il tradizionale concetto di Recovery di emergenza e considerare le interruzioni come una condizione operativa continua piuttosto che come un evento eccezionale.
• Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
• La parte più difficile della transizione verso ResOps è di natura organizzativa. La frammentazione delle responsabilità e le priorità disallineate rimangono le cause di fallimento più comuni.

Disruptions have become business as usual. Over the past year alone, we’ve seen:

• Attacchi con droni ai data center negli Emirati Arabi Uniti e in Bahreinhanno causato problemi a cascata nelle organizzazioni che vi archiviavano dati e carichi di lavoro.
• Unha interrotto l’accesso a Internet per milioni di utenti statunitensi.Un
• Unper decine di migliaia di utenti di una delle principali piattaforme di social media per un’intera giornata. for tens of thousands of a top social media platform’s users for an entire day.

In un recente webinar, David Nowak, responsabile del Cyber Risk Service di Deloitte; Kent Meyer, amministratore delegato di Deloitte; e Shilpi Handa, vicedirettrice della ricerca di IDC per la sicurezza informatica nella regione META, si sono uniti a me per discutere di ciò che la resilienza operativa richiede effettivamente in termini di strategia, architettura e operazioni quotidiane., David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the METUnregion, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.

Sneak Peek: It’s No Longer a Matter of If, but When

In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.

Why Disaster Recovery Isn’t Enough

Per NIST’s definition, , partendo dal presupposto che le violazioni avverranno e concentrandosi sulla sopravvivenza e sul rapido Recovery, non solo sulla prevenzione. Questo approccio basato sul presupposto della violazione fa parte da anni del modello “zero trust”, ma quante organizzazioni ne stanno effettivamente mettendo in pratica le implicazioni?

Stiamo assistendo al diffondersi di questa mentalità in tutti i settori, guidata da una combinazione di pressioni normative e aspettative a livello di consiglio di amministrazione. by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?

Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?

We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.

• In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
• I requisiti di segnalazione delle violazioni della Securities and Exchange Commission (SEC) hanno posto l’accento non solo sulla divulgazione, ma anche su ciò che le organizzazioni stanno facendo per ripristinare la situazione.
• I consigli di amministrazione ora considerano qualsiasi interruzione come un evento dannoso per l’azienda, e l’aspettativa si è spostata verso la dimostrazione non solo che il Recovery è possibile, ma che può avvenire rapidamente e con un elevato grado di affidabilità.
  Una ricerca IDC condotta da Handa illustra come le operazioni di Recovery tradizionali possano rivelarsi insufficienti. A seguito dello scoppio della guerra in Medio Oriente, ha riscontrato che i CIO e i CISO hanno dovuto affrontare difficoltà nel garantire la continuità non solo della tecnologia, ma anche delle persone e dei processi, poiché il personale è stato trasferito dall’oggi al domani e gli uffici sono diventati inaccessibili, senza lasciare nessuno in grado di eseguire il failover manuale.

  E questo è solo uno degli innumerevoli scenari imprevedibili di cui le organizzazioni devono tenere conto.

Costruire l’architettura della resilienza

Una strategia di resilienza comprende sia ciò che si protegge sia la capacità di ripristinarlo. Per quanto riguarda il primo aspetto, l’ambito di ciò che deve essere protetto si è ampliato costantemente, includendo sistemi di identità, piattaforme di comunicazione, carichi di lavoro, strumenti di produttività, pipeline CI/CD e dati strutturati e non strutturati.
Il secondo punto – «la capacità di ripristinarli» – crea nuovi requisiti per tale strategia. Non è sufficiente acquisire istantanee puntuali e definire obiettivi di ripristino tradizionali. Poiché gli avversari prendono di mira l’infrastruttura di backup, le organizzazioni devono ora esaminare i dati recuperati e confermare che non siano stati compromessi prima di rimetterli online. Ambienti di ripristino isolati, protezione air-gap per i servizi critici e funzionalità «Cleanroom Recovery» sono diventati componenti essenziali dell’architettura di resilienza.
L’intelligenza artificiale introduce un nuovo livello di difficoltà. Per ripristinare un modello di IA, non è sufficiente un backup del file del modello stesso, ma occorre tutto ciò che è servito per crearlo. Ciò include i set di dati, gli iperparametri, le versioni del framework, l’ingegneria delle caratteristiche e le configurazioni dell’infrastruttura, oltre a una mappa completa delle dipendenze che mostri come tutto si integri.
Meyer definisce le soluzioni di resilienza informatica come un modo per democratizzare il disaster recovery. Mentre il disaster recovery tradizionale era confinato all’interno del reparto IT e accessibile solo agli specialisti, le piattaforme più recenti possono fornire ai team delle operazioni di sicurezza, ai titolari delle aziende e al personale operativo la visibilità di cui hanno bisogno per partecipare attivamente.

Questo è importante per le organizzazioni con risorse limitate e cambia ciò che è possibile fare in termini di passaggio dalle esercitazioni teoriche a ripristini reali e dimostrabili.

Unresilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.
The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.
AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.
Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.
That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.

ResOps considera la resilienza come una funzione continua, non solo come qualcosa che avviene in risposta a un incidente.

In termini semplici, si tratta di rendere operativa la resilienza quando le normali ipotesi operative non sono più valide. Invece di dare per scontato che i backup saranno disponibili, integri e ripristinabili quando si verifica un disastro, con ResOps si individua continuamente dove risiedono i dati, li si protegge e li si acquisisce sia in ambienti on-premise che nel cloud, si rilevano le anomalie, si ripristina uno stato affidabile e si ripristinano i carichi di lavoro che sono stati completamente convalidati. In questo modo, si è sempre più preparati ad affrontare un’interruzione e più sicuri di riuscire a superarla con successo.
Nowak propone una frase che coglie l’essenza di ResOps: “resiliente fin dalla progettazione”. È il successore del principio “securo fin dalla progettazione” che ha plasmato l’ultima generazione di architetture di sicurezza. Oltre a realizzare sistemi in grado di resistere alle violazioni, ora stiamo realizzando sistemi che possano continuare a funzionare anche quando si verifica una violazione.

ResOps treats resilience as a continuous function, not just something that happens in response to an incident.
In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.
Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.

L’adozione del ResOps riguarda le persone e i processi almeno tanto quanto la tecnologia. Come osserva Handa, le organizzazioni in genere non falliscono perché mancano degli strumenti giusti; falliscono perché la responsabilità è frammentata tra troppi ruoli, senza un ritmo operativo condiviso e senza chiari poteri decisionali quando le cose vanno male.

Il ResOps costringe le organizzazioni a rispondere a domande che molte non hanno ancora affrontato, come ad esempio:

Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.
ResOps forces organizations to answer questions many haven’t yet worked through, such as:

• Come dovrebbero essere strutturate le procedure operative per l’esecuzione remota?
• Come funzionerà il failover interregionale quando non potrà fare affidamento su un’unica sede?
• How will cross-regional failover work when it can’t depend on a single location?

In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.
To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.
The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.

Commvault aiuta le organizzazioni a mettere in pratica il ResOps, dall’individuazione e protezione dei dati negli ambienti on-premise e cloud, al rilevamento delle anomalie, al ripristino a uno stato pulito e al ripristino dei carichi di lavoro convalidati. Per le organizzazioni che stanno cercando di passare dalle esercitazioni teoriche a ripristini dimostrabili, queste sono le funzionalità che contribuiscono a rendere operativa la resilienza in tempi incerti.
Le risorse della sessione, tra cui la ricerca di IDC sulla Readiness dei CIO e i materiali di Deloitte sul Recovery basato su prove concrete, sono disponibili nella

paginaon-demand.

Domande frequenti

Q: What is cyber resilience and how is it different from disaster recovery?

A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.

Q: What’s driving organizations to prioritize resilience over prevention?

A: Regulatory frameworks like DORUnand evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.

Q: What makes AI systems harder to back up and recover than traditional data?

A: Backing up an AI model means capturing more than the model file itself. Unmodel is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.

Q: What is ResOps, and how does it differ from a traditional resilience program?

A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.

Q: What are the biggest obstacles to adopting ResOps at scale?

A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.

Michael Thelander is Senior Director, Product Marketing at Commvault.

Punti di forza

• Commvault AirGap è immutabile per definizione e offre funzionalità di blocco WORM per le organizzazioni soggette a ulteriori requisiti normativi e di conformità.
• Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
• Lo storage abilitato per WORM comporta un sovraccarico in tutto il settore, ma Commvault contribuisce a ridurre al minimo tale impatto attraverso una gestione efficiente dei dati e un’architettura cloud-native.
• Il costo dello storage di backup va oltre il consumo di capacità e dovrebbe includere le spese relative all’infrastruttura, alla potenza di calcolo e alle operazioni.
• Le organizzazioni dovrebbero verificare la resilienza dei backup attraverso test sul campo, anziché affidarsi alle affermazioni di marketing dei fornitori.

Potreste aver recentemente riscontrato affermazioni da parte di un concorrente secondo cuiCommvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.
Let us address this directly: These claims are inaccurate.

Supporto dell’immutabilità e del blocco WORM in AirGap

AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.
For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across  supported cloud storage targets, including:

• Amazon S3 Object Lock
• Microsoft Azure Blob immutability policies

These features are documented, rigorously tested, and actively used by customers in production environments today.
In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.

Efficienza dello storage: comprendere il quadro completo

Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.
What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.
However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.
By contrast, modern, cloud-native approaches prioritize:

• Una gestione efficiente dei dati.
• Modelli di implementazione flessibili.
• L’eliminazione delle dipendenze infrastrutturali persistenti.

These design principles can result in more predictable, scalable, and sustainable long-term costs.
Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.

Una tendenza in crescita tra i clienti

Stiamo osservando un chiaro andamento: le organizzazioni stanno passando sempre più spesso a Commvault dopo aver deciso di non rinnovare il contratto con i propri fornitori precedenti. Tra i motivi più comuni figurano:

• Limitazioni impreviste man mano che gli ambienti si espandono.
• Limiti prestazionali legati alle architetture basate su Appliance.
• Aumento dei costi infrastrutturali e operativi.
• Prezzi di rinnovo significativamente più alti rispetto alle condizioni di acquisto iniziali.

These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.

Andare oltre le apparenze

In a market often shaped by aggressive claims and unclear comparisons, objective validation can be  critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.
Through this program, you can:

• Simulare scenari reali di attacchi informatici.
• Testare le capacità di Recovery utilizzando i propri dati e il proprio ambiente.
• Evaluate performance without vendor bias or staged demonstrations.

The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.

Domande frequenti

Q: Is Commvault AirGap truly immutable?

A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.

Q: Does AirGap support WORM lock protection?

A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.

Q: Does enabling WORM lock significantly increase storage costs?

A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.

Q: Why is total cost of ownership more important than storage overhead alone?

A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.

Q: Why are some organizations moving away from appliance-based backup architectures?

A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.

Q: How can organizations validate their cyber resilience strategy?

A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.

Kash Ansari is Chief Customer Officer Americas at Commvault.

Punti di forza

• La resilienza informatica dipende sia dalla tecnologia che dalle competenze dei professionisti incaricati di proteggere e ripristinare i sistemi critici.
• La formazione continua aiuta i team dei partner a rimanere al passo con l’evoluzione delle minacce, gli ambienti ibridi e le migliori pratiche in materia di resilienza.
• La Commvault la la Readiverse Academy offre corsi di formazione specifici per ruolo, esercitazioni pratiche e certificazioni pensate per sviluppare cyber resilience concrete in materia di cyber resilience .
• I clienti apprezzano sempre di più i partner in grado di fornire una consulenza affidabile, accelerare la preparazione al ripristino e massimizzare i risultati in termini di resilienza.
• Investire nella formazione continua contribuisce a rafforzare le competenze dei partner, a consolidare la fiducia dei clienti e a sostenere la crescita aziendale a lungo termine.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Rafforzare cyber resilience .
• Acquisire sicurezza nelle conversazioni con i clienti.
• Rimanete al passo con l’evoluzione delle tecnologie e delle migliori pratiche.
• Preparati ad assumere nuovi ruoli e a cogliere nuove opportunità.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why la la Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault la la Readiverse Academyoffre:

• Percorsi di apprendimento basati sui ruoli.
• Apprendimento flessibile e personalizzato.
• Esercitazioni pratiche basate su scenari.
• Certificazioni che attestano la preparazione al mondo del lavoro.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through la la Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Accelerare le implementazioni.
• Adattare le soluzioni alle esigenze in continua evoluzione.
• Migliorare la prontezza operativa.
• Rafforzare la preparazione alle operazioni di recupero.
• Affrontare sfide complesse in materia di resilienza.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault la la Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

Domande frequenti

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault la la Readiverse Academy?
A: la la Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.