Punti di forza

• Rising operational disruption makes scalable resilience essential, but organizations commonly fall into traps like seeking “silver bullet” technology or relying on “hero worship” of individual experts.
• ResOps offre un framework scalabile che integra persone, processi e tecnologia nei settori ITOps, SecOps e DevOps.
• Il sostegno da parte dei vertici aziendali, a livello di amministratore delegato, contribuisce a rafforzare la responsabilità e a dare priorità alla resilienza come disciplina strategica.

Cyberattacks, cloud complexity, and AI-enabled threats are creating constant operational challenges for enterprises. To help meet business requirements in this increasingly disruptive environment, organizations need to move beyond separate recovery tools, teams, and plans to resilience as an integrated operating model.

In a recent webinar, Phil Goodwin, research vice president for IDC’s worldwide infrastructure programs, joined me for a fireside chat to explore how organizations can move beyond fragmented approaches to build resilience that scales.

Perché le organizzazioni hanno bisogno di un nuovo quadro di riferimento per la resilienza

As organizations engage in daily firefighting while keeping up with new technologies and addressing new initiatives, they rarely have time to step back and reassess whether their approaches still meet requirements. But as isolated incidents become systemic disruption, this conversation has become essential.

In a simpler era, organizations focused primarily on backup and recovery. Large-scale disruptions such as Hurricane Sandy brought disaster recovery onto the agenda. Intensifying cyberthreats like ransomware added cyber resilience and business continuity to the list. Each evolution brought new capabilities, but many organizations simply bolted new approaches onto what they were already doing rather than addressing these expanding requirements holistically.

When separate teams manage different pieces with different tools and policies, gaps may emerge that can slow recovery. Despite years of investment in cybersecurity, organizations are still struggling with recovery.

More recently, AI has accelerated the urgency for a more integrated approach by reshaping both threats and defenses. Despite increasing AI investments, many businesses are delaying AI rollouts due to ongoing concerns about governance and security vulnerabilities.

On the other side of the cyber front, bad actors are using AI to create deepfakes, target users with more sophisticated and convincing phishing, and exploit vulnerabilities at scale.

Resilience operations – ResOps – treats resilience as a continuous operating discipline rather than a collection of separate tools and teams. By bringing together ITOps, SecOps, and DevOps under a unified framework, ResOps helps transform resilience to keep pace with systemic disruption.

Come evitare gli errori più comuni nella pianificazione della resilienza

Even organizations that recognize the need for change often fall into traps. One is the “silver bullet” problem, which focuses on technology as the solution. Leaders want to believe that buying the right tools will solve everything, but technology alone can’t deliver positive business outcomes without proper integration and process.

“Hero worship” is another common pitfall – relying on talented staff members with expertise residing in their heads rather than in documented processes. Heroism can’t scale, and reliance on specific individuals creates vulnerability when people leave or responsibilities shift.

To move past these traps, you have to think differently about your operating model. Instead of focusing primarily on technology and people, consider the team you’ll need to build, including executive sponsorship, IT operations and security leadership, and senior leaders from the business side.

The team’s charter should focus on defining business outcomes first: What does resilience need to achieve for the organization? What KPIs, SLAs, and processes should be established to meet these requirements?

Sviluppare la resilienza con un approccio dall’alto verso il basso

Essendo una priorità a livello di consiglio di amministrazione, la resilienza richiede il sostegno dei vertici aziendali. Il programma ResOps ottiene i risultati migliori quando il CEO è coinvolto, contribuendo a definire le priorità in termini di risorse e promuovendo la responsabilizzazione in tutta l’organizzazione. Una volta assicurato il sostegno dei vertici aziendali, i dirigenti senior, tra cui il CIO, il CTO, il CISO e i direttori generali, possono incaricare il proprio personale di occuparsi dell’attuazione.

Questo approccio può essere applicato a organizzazioni di qualsiasi dimensione. Anche le piccole e medie imprese possono costituire team interfunzionali che includano i principali attori aziendali, i team IT e il personale incaricato della sicurezza dei dati e della rete. Man mano che crescono, questa struttura può adattarsi alle loro esigenze, potenziando il personale in specifici settori legati alla resilienza, pur mantenendo un approccio integrato lungo tutta la catena operativa della resilienza. Le ResOps riflettono le modalità con cui i team delle operazioni IT, SecOps e DevOps devono collaborare all’interno delle organizzazioni. Il recupero dei dati e la sicurezza dei dati sono diventati così strettamente correlati che, all’interno di IDC, i ricercatori di queste discipline collaborano ormai frequentemente sui progetti dei clienti. Oggi le applicazioni devono essere progettate tenendo conto degli autori delle minacce, integrando architetture “zero trust” e partendo dal presupposto che qualcosa possa andare storto. ResOps fornisce il quadro di riferimento per questa convergenza, riunendo gli strumenti di sicurezza e operativi in un modello unificato per affrontare minacce e interruzioni di ogni tipo.

ResOps come quadro di riferimento condiviso per il settore

ResOps is an operating model, not a product, and can benefit companies regardless of the specific tools they use. As Phil observed during our chat, “It really requires that community involvement where people pitch in from different perspectives, different vendors, different organizations, and different teams, just like DevOps or SecOps.”

For organizations struggling with constant disruption and the growing complexity of AI-enabled threats and defenses, ResOps offers a path beyond fragmented resilience approaches. By bringing together people, processes, and technology in a unified operating model, ResOps turns fragmented recovery efforts into enterprise-wide readiness.

Watch my chiacchierata informale completa con Phil perscoprire come ResOps può aiutarti a sviluppare una resilienza aziendale scalabile.

Domande frequenti

D: Che cosa sono le operazioni di resilienza (ResOps)?

R: ResOps è un modello operativo che integra le operazioni IT, le operazioni di sicurezza e il DevOps in un unico approccio continuo. Anziché considerare il ripristino di emergenza, cyber resilience e la continuità operativa come funzionalità separate, ResOps riunisce persone, processi e tecnologia in un quadro unificato per contribuire a creare una resilienza aziendale scalabile.

D: Perché il sostegno dei vertici aziendali è importante per cyber resilience?

A: Executive sponsorship – ideally at the CEO level – helps drive accountability and priority for resilience initiatives across the organization. This top-down support is essential for organizations trying to move beyond fragmented approaches to integrated resilience operations.

D: Le piccole e medie imprese possono implementare il ResOps?

R: Sì . ResOps è applicabile a organizzazioni di qualsiasi dimensione. La complessità del modello si adatta alla crescita delle organizzazioni, rendendolo accessibile alle medie imprese pur rimanendo efficace per le grandi aziende.

D: Perché i team IT e di sicurezza devono collaborare per garantire la resilienza?

R: Quando i team responsabili delle operazioni IT, della sicurezza e del DevOps collaborano invece di operare in compartimenti stagni, le organizzazioni possono contribuire a creare un’infrastruttura più resiliente in grado di far fronte alle minacce in continua evoluzione.

D: In che modo le organizzazioni dovrebbero avviare le operazioni di resilienza?

R: Iniziate dall’alto, assicurandovi il sostegno dei vertici aziendali a livello di CEO. Successivamente, costituite un team interfunzionale che includa le operazioni IT, il SecOps e le parti interessate del business, e chiedete loro di definire i risultati aziendali che la resilienza deve garantire alla vostra organizzazione. Effettuate una valutazione delle minacce per comprendere i rischi che dovete affrontare. Solo dopo aver completato questi passaggi fondamentali le organizzazioni dovrebbero concentrarsi sulla selezione delle tecnologie e sullo sviluppo di processi dettagliati.

Chris Mierzwa è direttore senior del reparto Portfolio Marketing presso Commvault.

Punti di forza

• Detection alone is not enough – organizations need integrated, orchestrated recovery to minimize business disruption from ransomware.
• The CISCO XDR and Commvault® Cloud integration connects threat detection directly to clean recovery actions within the same security workflow.
• Un ripristino sicuro richiede procedure di ripristino validate e isolate, volte a ridurre il rischio di reinfezione e a ripristinare le operazioni in tutta sicurezza.
• L’avvio delle operazioni di backup e ripristino direttamente dagli strumenti di sicurezza consente di salvaguardare tempestivamente i dati critici e di ridurre i tempi di ripristino.
• La resilienza unificata coniuga sicurezza e ripristino, contribuendo a ridurre gli attriti tra gli ambienti XDR (Extended Detection and Response) e SOAR (Security Orchestration, Automation, and Response) e migliorando al contempo la velocità e l’affidabilità della risposta.

If there’s one thing I’ve learned from talking with security leaders across industries, it’s this: Detection is only half the job. The other half, the part that determines whether the business keeps moving, is response and recovery. And when ransomware hits, recovery isn’t just about speed. It’s about confidence, it’s about cleanliness, and it’s about speed.

That’s why this announcement matters. We’ve expanded our partnership with Cisco with a new integration between Cisco XDR e Commvault Cloud, built to unite ransomware response and recovery in a single, coordinated workflow.

Too many organizations still live with a painful gap between what security teams see and what IT teams can safely do next. When every second counts, that gap becomes the difference between containing an incident and watching it evolve into business disruption. With this integration, teams can move from detection to decisive recovery actions inside the security operations workflow, helping minimize impact when time is the enemy.

And here’s the truth: In a crisis, the business doesn’t care who owns which “console.” The business cares about outcomes. Can we preserve critical data early? Can we recover cleanly without reinfection? Can we restore the right systems confidently instead of guessing? How fast can we get back to “minima funzionalità”? That’s the gap we’re closing, bringing recovery actions into the di risposta agli incidenti flow, where decisions are already being made.

This is where “clean recovery” stops being a talking point and becomes the new standard.

Recovery has turned into an exercise in trust: trust that your recovery points are safe, trust that your backups aren’t already compromised, and trust that you’re not reintroducing risk while trying to restore operations. The uncomfortable reality is that defenders increasingly have less time to respond.

According to Sophos’ «Active Adversary Report 2026, “the speed with which attackers attempt to go after AD after gaining access to the system sped up by 70% over last year, down to a median of just 3.40 hours.”

That kind of speed forces di risposta agli incidenti to operate in an immediate, orchestrated way across silos, and it raises the bar for recovery. Because fast restores don’t help if they aren’t clean.

With this new integration, security operations teams can trigger Commvault Cloud actions directly from Cisco XDR, helping preserve data early and move toward clean recovery.

If a SOC manager gets notice of a threat detected in Cisco XDR, they can initiate a backup of core infrastructure VMs right away, and then restore impacted systems into Commvault Cloud Recupero in Cleanroom, a secure, isolated cloud environment designed for investigation and validation, before confidently returning systems into production. This brings recovery actions in the same workflow as detection, so teams can respond faster and recover with confidence.

The result is a tighter connection between detection and recovery, so security teams can act decisively at the earliest signs of an attack. By validating recovery in an isolated cleanroom before returning systems to production, organizations reduce reinfection risk, preserve critical data, and shorten recovery timelines, all from tools SOC teams already trust.

A Commitment to Unified Resilience

Zooming out, this integration with Cisco XDR is an important milestone, and it’s also part of a bigger direction we’re committed to: unified resilience, where security and recovery work together instead of operating in separate lanes. And it’s not an “either/or” proposition. It’s a growing ecosystem designed to meet teams where they work.

Another great example of this is our integration with Splunk SOAR, that helps improve threat detection and drive faster, more automated response. Commvault can send threat detection, data security, and backup and recovery intelligence directly into Splunk, enriching security events and helping alert SecOps teams and automated actions in Splunk can reduce response time without bouncing between interfaces.

So, whether a customer’s operational hub is XDR or SOAR, the goal stays the same: reduce friction, speed decisions, and make recovery provable.

The Cisco XDR integration is generally available globally and offered at no additional cost to existing Commvault customers. If you want to dig deeper, here are a few good places to start:

• Read the perspective behind clean recovery and why data integrity matters: garantire l’integrità dei dati per recuperi proattivi e affidabili
• See how Commvault integrates with Splunk SOAR for response automation: Rilevamento e risposta alle minacce migliorati con Commvault e Splunk SOAR

Oppurecontattami su LinkedIn, and I’m happy to talk through what “detection to clean recovery” looks like in the real world.

Domande frequenti

Q: Why is detection only half the battle in ransomware response?
A: Detection identifies threats, but response and recovery determine whether the business can continue operating. Without a coordinated recovery plan, even fast detection can still lead to prolonged downtime and disruption.

Q: What does “clean recovery” mean in practice?
A: Clean recovery involves restoring systems in a secure, isolated environment to validate that backups are uncompromised before returning them to production. This approach helps reduce the risk of reinfection and enable greater confidence in restored systems.

Q: How does the Cisco XDR and Commvault integration improve di risposta agli incidenti?
A: The integration allows security teams to trigger backup and recovery actions directly from Cisco XDR. This unified workflow helps preserve data early, initiate secure restoration, and move from detection to recovery without switching between disconnected tools.

Q: What role does the Cleanroom Recovery environment play?
A: Cleanroom Recovery provides an isolated cloud space for investigation and validation of restored systems. Teams can analyze and confirm system integrity there before confidently bringing workloads back into production.

Q: How does this integration support broader security ecosystems like SOAR?
A: In addition to Cisco XDR, Commvault integrates with platforms like Splunk SOAR to enrich threat intelligence and automate response actions. This ecosystem approach helps security teams reduce friction, accelerate decisions, and make recovery outcomes more predictable.

Q: Is the Cisco XDR integration available to existing customers?
A: Yes, the integration is generally available worldwide and is offered at no additional cost to existing Commvault customers, making it easier to adopt unified detection and recovery workflows.

Michael Fasuloè Senior Director, Portfolio Marketing, presso Commvault. Blog correlatiLe innovazioni per Cleanroom Recovery consentono una nuova era nella resilienza informatica

Commvault inaugura una nuova era di resilienza aziendale unificata

La prossima evoluzione della protezione dei dati Cloud

I 5 passi fondamentali per una riabilitazione efficace

Il vostro manuale moderno per una risposta rapida e un recupero pulito

There’s a lot of talk about modernization – Cloud, AI, automation, security transformation. But what does modernization actually look like when you’re responsible for keeping systems running, data protected, and recovery viable under pressure?

In this episode of STRIVE, I had the pleasure of sitting down with Gilman Treantos – a 25-year IT veteran whose career spans everything from mainframes to modern cyber resilience architecture. This conversation provides a practitioner’s view of what modernization really means when outages, ransomware, and operational risk are part of the daily equation.

Watch the episodio. Punti chiave: cosa richiede realmente la preparazione informatica moderna

• Modernization isn’t about new tools – it’s about resilient architecture. Technology evolves, but recovery discipline, testing, and cross-team coordination are what separate reactive organizations from resilient ones.
• La Readiness informatica richiede una collaborazione tra i reparti di sicurezza e quelli che gestiscono l’infrastruttura. I compartimenti stagni creano punti ciechi. Una visibilità unificata e una responsabilità condivisa possono accelerare il processo di Recovery.
• Gli strumenti di backup sono più potenti di quanto la maggior parte dei team creda. Se utilizzati in modo creativo, possono supportare migrazioni su larga scala, ripristini isolati e transizioni pensate per ridurre al minimo la perdita di dati.
• Testing is non-negotiable. A recovery plan that hasn’t been rehearsed is a liability, not a strategy.
• La resilienza professionale rispecchia quella tecnica. La proattività, la curiosità e la volontà di risolvere problemi complessi sono fondamentali quanto qualsiasi platform.

From Blockbuster to Cyber Resilience

Gilman’s journey didn’t start in a war room or a security operations center. It started at Blockbuster.

Without formal IT training, he leaned into troubleshooting. That curiosity became mainframe work. That work became distributed systems. That evolved into data protection and cyber resilience leadership.

What stands out isn’t the career arc – it’s the mindset. He built a reputation by taking on the problems no one else wanted. Fixing fragile systems. Supporting overlooked initiatives. Solving issues that crossed organizational boundaries.

That mentality translates directly to modernization, because modern cyber readiness is built by people willing to dig into uncomfortable complexity.

Sneak Peek: The Modernization Playbook

In this segment, Gilman explains why modern cyber recovery requires more than traditional malware detection — and how anomaly detection, ThreatScan, and isolated recovery environments can help strengthen enterprise resilience.

Modernization Under Pressure

One of the most compelling parts of the episode is a real-world example: evacuating a remote data center in a single night. No data loss. No prolonged downtime. No operational chaos.

By leveraging Commvault LiveSync in a creative way, Gilman and his team were able to migrate infrastructure quickly and cost-effectively – using capabilities that weren’t originally designed for that exact scenario.

That’s modernization in practice.

The House of Cards Problem

As organizations scale, permissions sprawl. Backup systems grow complex. Security tools layer on top of infrastructure without full alignment. Over time, environments become fragile.

Gilman describes this dynamic as something many teams underestimate: a slow accumulation of technical and operational debt. Modernization, in his view, isn’t just upgrading platforms. It’s simplifying architecture, improving visibility, and breaking silos between cybersecurity and infrastructure teams.

Cyber readiness means:

• I team addetti alla sicurezza e al backup condividono i dati di telemetria.
• Gli ambienti di ripristino vengono isolati e testati.
• Il rilevamento del malware va oltre i flussi di lavoro principali.
• Le decisioni relative alle infrastrutture tengono conto della velocità di ripristino.

This is where modernization and resilience intersect.

Threats Are Evolving. So Must Recovery.

Ransomware isn’t slowing down. Threat actors are more sophisticated. Malware hides inside legitimate workflows. Gilman’s perspective is blunt: Preparation must be proactive.

He advocates for:

• Test periodici di ripristino di emergenza
• Ambienti di ripristino isolati pronti per l’attivazione
• Strumenti di rilevamento delle anomalie integrati nei processi di backup
• Esercitazioni inter-squadra che simulano situazioni di emergenza reali

Guarda l’episodio completo

Segui la nostra conversazione completa su STRIVE per scoprire:

• Come Gilman ha sviluppato il suo approccio alla protezione dei dati nel corso di 25 anni.
• I dettagli alla base di una migrazione pensata per ridurre al minimo la perdita di dati.
• Perché la collaborazione tra sicurezza e infrastruttura è fondamentale.
• Consigli pratici per i professionisti della resilienza.
• What modernization really demands in today’s threat landscape.

Guardalo subito.

If you care about resilience, recovery, or leading IT through uncertainty, this is 20 minutes well spent.

FAQs

Q: What does “modernization” mean in the context of cyber readiness?

A: It means building resilient, testable, and collaborative systems that can recover quickly under real-world pressure – not just upgrading to newer platforms.

Q: Why is collaboration between security and infrastructure teams so important?

A: Because recovery depends on shared visibility. Security detects threats, but infrastructure enables restoration. Without alignment, response slows and risk increases.

Q: How can backup tools support modernization beyond recovery?

A: When used creatively, they can enable data center migrations, isolated recovery environments, anomaly detection, and large-scale operational shifts.

Q: How often should disaster recovery environments be tested?

A: Regular testing – ideally quarterly or aligned with major infrastructure changes – builds confidence and reveals gaps before an actual incident.

Chris Mierzwa è Senior Director, Portfolio Marketing, presso Commvault. Blog correlatiCome SMMPA ha rafforzato la resilienza informatica con Cleanroom Recovery

Preparazione informatica in un contesto di tensioni geopolitiche: linee guida per i nostri clienti, partner e la nostra comunità

Perché l’intelligenza artificiale sta compromettendo la tua strategia di resilienza (e cosa fare al riguardo)

Fisica contro marketing: accelerare la ripresa pur rispettando le leggi della fisica

Modernizzare la cybersicurezza finanziaria: Dalla reattività alla resilienza

Punti di forza

• Le strategie tradizionali di resilienza stanno cedendo di fronte alla portata,alla velocità e all’autonomia dei sistemi basati sull’intelligenza artificiale.
• Gli attacchi ransomware industrializzati e quelli basati sull’IA prendono ora di mira i sistemi di backup,minando le fondamenta del processo di Recovery.
• Le organizzazioni devono passare da team di sicurezza e Recovery operanti in modo isolato a un modello unificato e continuo denominato “operazioni di resilienza”.
• La resilienza basata sull’IA richiede visibilità dei dati in tempo reale,rilevamento continuo delle minacce e un Recovery intelligente e pulito su larga scala.
• Le piattaforme moderne consentono una Recovery rapida e verificata,aiutando le organizzazioni a evitare il compromesso tra Recovery veloce e Recovery sicura.

Mentre le organizzazioni si affrettano ad adottare l’IA,i CISO e i CIO stanno giungendo a una cruda consapevolezza: le strategie di resilienza che funzionavano per le infrastrutture tradizionali stanno fallendo. Sistemi che prima potevano riprendersi dagli attacchi in poche ore ora potrebbero impiegare giorni. Gli approcci di backup progettati per dati centralizzati potrebbero avere difficoltà con carichi di lavoro distribuiti tra cloud e piattaforme di IA. Nel frattempo,le minacce e le potenziali vulnerabilità crescono di giorno in giorno.,David Nowak,responsabile del Cyber Risk Service di Deloitte; Kent Meyer,amministratore delegato di Deloitte; e Shilpi Handa,vicedirettrice della ricerca di IDC per la sicurezza informatica nella regione META,si sono uniti a me per discutere di ciò che la resilienza operativa richiede effettivamente in termini di strategia,architettura e operazioni quotidiane.,Tim Zonca,vicepresidente del marketing di portafoglio presso Commvault,ha affrontato una questione urgente che i responsabili della sicurezza devono affrontare: come mantenere la resilienza quando l’IA cambia radicalmente le regole?

What Industrialized Ransomware and AI Mean for Resilience

CISOs and CIOs are under pressure. In spite of billions spent on cyber defense,nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread,and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks,adversaries are undermining the very foundation of resilience.

As attacks become more sophisticated,targets are becoming more vulnerable. AI is scaling faster than organizations can secure,with exponential data growth,fragmentation across environments,more complex supply chains,and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities,the impact can cascade across interconnected business processes.

Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems,centralized data,and isolated failures,the answer may well be no.

Making Resilience Operational

As AI agents make decisions across the environment,including a significant number of errors,it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:

• Garantire continuamente la sicurezza dei dati alla fonte e monitorare le anomalie.
• Controllare le identità delle persone,delle entità non umane e dei dispositivi che accedono e utilizzano i dati in modo autonomo.
• Garantire una Recovery prevedibile dei dati su vasta scala senza compromissioni o corruzioni.

Tradizionalmente,la sicurezza dei dati,la resilienza delle identità e il Recovery informatico hanno operato come discipline indipendenti,ciascuna con il proprio team,i propri strumenti,le proprie politiche e i propri requisiti. Questi silos lasciano vulnerabilità che gli aggressori possono sfruttare e rallentano il Recovery in caso di guasto dei sistemi di IA. Per colmare tali lacune,le organizzazioni devono unificare queste capacità in un ciclo continuo e automatizzato. Chiamiamo questo approccio“operazioni di resilienza” (ResOps).

ResOps comprende tre requisiti essenziali per la resilienza dell’IA:

• Understanding your data landscape: Knowing where data lives,its sensitivity,who’s accessing it (including AI agents and non-human identities),and what policies govern that access in real time. For AI workloads,this extends to protections like LLM prompt governance to control how models access data.
• Continuous threat detection: Automated systems that constantly monitor for anomalies,compromised identities,and data corruption. When AI systems are making thousands of autonomous decisions,you can’t wait for periodic security reviews.
• Recovery intelligente: ripristino automatizzato e completo di intere applicazioni cloud-native e delle loro dipendenze. Per prevenire una nuova infezione,i team devono verificare l’integrità dei dati ed effettuare analisi forensi in un ambiente isolato e protetto prima di riportare i dati attendibili in produzione.

Come implementare il ResOps nella pratica

Per aiutare le aziende a passare al ResOps,Commvault ha introdottoCommvault Cloud Unity,la versione della piattaforma più significativa della nostra storia. È progettata per riunire tutte e tre le dimensioni della resilienza:

• Unirela sicurezza dei dati,della resilienza delle identità,and recupero cyberin un unico modello operativo.
• Protecting all workloads,from both today’s production systems to tomorrow’s emerging AI stacks.
• Safeguarding data regardless of location,whether in clouds,regions,data centers,or edge locations.

A next-generation architecture brings AI automation to all facets of data protection,la sicurezza dei dati,della resilienza delle identità,and recovery. For security and IT teams,the platform provides simplicity at scale with one experience,one policy engine,and one interface designed to protect data,predict threats,and accelerate clean recoveries.

As security leaders know all too well,recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.

With Commvault Cloud,il monitoraggio continuo delle minacce and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems,helps maintain immutable backups,and helps enable one-click restoration of entire environments. Recovery can be both fast and clean,helping minimize loss as well as risk.

See ResOps in action

Guarda il webinar completo on-demand to learn more about ResOps,explore the architecture and services of Commvault Cloud,and rethink your resilience strategy for the AI age.

FAQs

 Q: What is Resilience Operations (Res Ops)?

A: ResOps is an operating model that unifies la sicurezza dei dati,della resilienza delle identità,and recupero cyber into a continuous,automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns,helps detect threats and anomalies,and enables fast,intelligent recovery at scale.

Q: Why can’t traditional backup and recovery handle AI workloads?

A: Traditional backup tools were designed for centralized,human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers,and they operate at a scale that manual processes can’t match.

When AI systems fail or are attacked,you need to recover not just data but entire application infrastructures with all their configurations,policies,and relationships – capabilities traditional backup tools lack.

Q: What does “unified resilience” mean in practice?

A: Unified resilience means bringing la sicurezza dei dati,identity management,and recupero cyber together under a single platform,policy engine,and operational model rather than managing them as separate functions with different teams and tools.

In practice,this provides a consistent approach to protect all workloads and data locations,automatically correlate security events with access patterns,and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.

Q: What’s the difference between cyber resilience and AI resilience?

A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents,treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight,exponential growth of data and non-human identities across environments,and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.

Q: How does ransomware target backup systems?

A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access,moving laterally from production systems to connected backup repositories,or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points,preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline,immutable,or air-gapped backups essential for resilience.

Q: What is the clean vs. complete recovery dilemma?

A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety,while modern resilience platforms aim to provide both simultaneously through il monitoraggio continuo delle minacce and verified recovery points.

Q: What is a cleanroom in recupero cyber?

A: A cleanroom in recupero cyber is an isolated,secure environment completely separated from production systems to help organizations safely test,validate,and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems,testing of recovery procedures,and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.

Sam Curcuruto è direttore del marketing di prodotto presso Commvault.

Blog correlatiRivedere la resilienza nell’era dell’IA

A CIO’s Perspective: Strengthening Business Resilience in the AI Era

Resilienza contro la macchina dell’intelligenza artificiale

Le innovazioni per Cleanroom Recovery consentono una nuova era nella resilienza informatica

Punti di forza

• “Instant restore” claims often break down at scale due to real-world I/O operations per second (IOPS), rehydration, and infrastructure constraints.
• Il montaggio in tempo reale di grandi quantità di dati su uno storage di backup deduplicato può causare un crollo delle prestazioni, costringendo a un lento processo di reidratazione verso lo storage primario.
• Le camere bianche consentono di svolgere in parallelo le indagini forensi e il ripristino delle attività aziendali, evitando tempi di inattività in sequenza causati da ritardi.
• La compromissione dell’identità amplia il raggio d’azione dell’attacco, rendendo il Recovery isolato e il Recovery di Active Directory (AD) fondamentali per garantire la sicurezza delle operazioni.
• I manuali operativi automatizzati per le camere bianche e i test ripetibili aiutano le organizzazioni a convalidare metriche di recupero reali prima che si verifichi una crisi.

Let’s start with a quick story about a “ransomware‑proof” environment that took 72 hours to recover, way beyond the organization’s expectations for recovery time objective. It is exactly the kind of situation where Commvault’s Recupero in Cleanroom could have helped turn a painful, three‑day outage into a faster, more controlled recovery with less risk.

Storia di guerra: Fisica contro Marketing

On Reddit, a user shared how the financial services firm they work for was hit by a breach. They assumed they had a “dream stack” for quick recovery (but can you really have a “dream stack” without Recupero in Cleanroom?): immutable backups, secure storage snapshots, and a modern hypervisor. The datasheets promised “instant mass restore,” yet the business sat offline for three days while everyone tried to drag their environment back to life.

The root cause was not that backups failed, but that the real‑world physics of rehydration, forensics, and identity were never tested at scale. The original poster mentioned that having access to a cleanroom environment would have sped up the process. Let’s dig into this further and address why.

Commvault’s Recupero in Cleanroom is designed to address exactly these weak points: It helps automate clean, isolated recovery into the cloud, validates data, and coordina la fase di Recovery in modo da allinearla all’effettivo svolgimento degli incidenti, not just how diagrams look on slides.

Problem 1: The Rehydration Trap

In the story, “live mounting” a handful of virtual machines (VMs) worked fine, but trying to live mount hundreds crushed the backup appliance. The random I/O running directly on deduplicated, compressed backup storage collapsed the IOPS, forcing the team to rehydrate everything back to primary Non-Volatile Memory Express at about 3 TB/hour for roughly 100 TB of data.

Commvault Recupero in Cleanroom helps recover workloads into an isolated Azure‑based cleanroom built on scalable cloud compute and storage instead of trying to run production at scale off a backup appliance.

This allows you to restore critical VMs into a purpose‑built recovery environment, use cloud elasticity to absorb I/O, and automate the recovery sequence so the right systems (identity, core apps, critical data) come up first without bottlenecking on a single backup target.

Problem 2: The Forensic Drag

In the audit, the tech stack was ready in about four hours, but legal delayed touching anything for 72 hours because they had no pre‑provisioned cleanroom. Without an isolated environment with zero routes back to production, the forensics team could not safely investigate while the business recovered, so everyone waited for the all-clear before starting any real restore.

Recupero in Cleanroom provides an on-demand, isolated recovery environment explicitly built for simultaneous recovery and forensic analysis. È possibile creare una camera bianca isolata su Azure in poche ore, recover systems into it, and let security and legal teams perform read‑only forensics and threat scanning while operations validates applications and prepares for cutover – dramatically shrinking “forensic drag” as a contributor to downtime.

Problem 3: Identity Blast Radius

The environment in the story had a single admin account with access to both the hypervisor and backup console, which meant if attackers pivoted that far, immutability could become just another setting they flipped off. Identity, not just data, was the real blast radius problem.

Recupero in Cleanroom is designed to help reduce dependency on the compromised production identity plane during recovery, allowing isolated access and planned support for AD restoration in the cleanroom.

Trasferendo i servizi di identità in una “cleanroom” isolata and using separate, least‑privilege access paths, you can help validate AD, help enforce proper authorizations, and help protect backup control planes from being trivially compromised by the same credentials that were used in production.

How Recupero in Cleanroom Would Change This Story

If this customer had used Recupero in Cleanroom, their recovery story could have been very different.

• Faster, physics‑aware recovery: Avrebbero potuto contribuire a organizzare il Recovery in una “camera bianca” nel cloud, dotata di risorse di archiviazione e di calcolo scalabili, evitando il crollo degli IOPS causato dal montaggio in tempo reale di grandi quantità di dati e puntando alla velocità di Recovery di cui avevano effettivamente bisogno.
• Parallel forensics and business recovery: A pre‑defined cleanroom RTO of under four hours would have helped them spin up un ambiente recintato sia per le attività forensi che per la validazione delle applicazioniinvece di aspettare 72 ore in una situazione di stallo.
• Riduzione del rischio di reinfezione e di identità: Isolamento della camera bianca, Threat Scan e piano di controllo separato would have helped limit identity blast radius, helped confirm data was malware‑free before returning to production, and helped give auditors and insurers a clean, verifiable recovery trail.
• Procedure automatizzate e ripetibili:Runbook automatizzati che coordinano il rilevamento dei punti puliti, la sequenzializzazione dei carichi di lavoro e i failover di test could have helped them regularly rehearse this scenario and know their real‑world metrics before an attack – not learned them during a crisis.

For organizations that already invest in “ransomware‑proof” stacks, the missing piece is often not more features but a strategia per le camere bianche that respects physics, identity, and legal reality. Commvault Recupero in Cleanroom is designed to close that gap and help turn recovery from a three‑day war story into a controlled, provable, and much faster operation.

Domande frequenti

Q: Why did the “instant mass restore” approach fail in the ransomware scenario?
A: While live mounting a few VMs worked, scaling to hundreds overwhelmed the backup appliance due to I/O constraints. Deduplicated and compressed backup storage is not designed to handle full production workloads at scale, leading to performance collapse and delayed recovery.

Q: What is the “rehydration trap” in disaster recovery?
A: The rehydration trap occurs when organizations must restore large volumes of compressed backup data back to primary storage before systems can operate normally. This process is limited by throughput rates, which can dramatically extend recovery times when dealing with tens or hundreds of terabytes.

Q: How does a cleanroom help reduce forensic-related downtime?
A: A cleanroom provides an isolated environment where forensic teams can safely investigate while IT simultaneously restores systems. This parallel approach helps eliminate long waiting periods for legal or security approval before beginning recovery efforts.

Q: Why is identity such a critical factor in ransomware recovery?
A: If attackers compromise administrative credentials tied to both production and backup systems, immutability controls may no longer provide protection. Isolated identity recovery and least-privilege access can help limit blast radius and support a safer restoration process.

Q: How does Recupero in Cleanroom help improve recovery orchestration?
A: Recupero in Cleanroom helps automates workload sequencing, cleanpoint validation, and cloud-based recovery infrastructure provisioning. This structured approach aligns recovery with how incidents actually unfold, helping organizations regain control faster and with greater confidence.

Q: What is the strategic lesson for organizations with “ransomware-proof” stacks?
A: Advanced features alone do not guarantee fast recovery. A strategia per le camere bianche that accounts for infrastructure physics, identity isolation, and legal realities helps enable organizations to turn theoretical resilience into measurable, repeatable recovery performance.

Nico Guerrera è Senior Solutions Marketing Manager presso Commvault.

Blog correlati

Recupero della foresta di Active Directory: Perché i metodi manuali non sono più praticabili

Test di recupero: Il pezzo mancante nella maggior parte dei programmi di resilienza informatica

Il vostro manuale moderno per una risposta rapida e un recupero pulito

Sbloccare la resilienza informatica: Il potere delle camere bianche

Why Recupero in Cleanroom and Cyber Testing are Critical for Cyber Resilience