Key Takeaways
- Traditional resilience strategies are breaking down under the scale, speed, and autonomy of AI-enabled systems.
- Industrialized ransomware and AI-powered attacks now target backup systems, undermining the foundation of recovery.
- Organizations must shift from siloed security and recovery teams to a unified, continuous model called resilience operations.
- AI resilience requires real-time data visibility, continuous threat detection, and intelligent, clean recovery at scale.
- Modern platforms enable fast and verified recovery, helping organizations avoid the tradeoff between restoring quickly and restoring safely.
As organizations race to adopt AI, CISOs and CIOs are coming to a stark realization: The resilience strategies that worked for traditional infrastructure are breaking down. Systems that could recover from attacks in hours may now take days. Backup approaches designed for centralized data may struggle with workloads distributed across clouds and AI platforms. Meanwhile, threats and potential vulnerabilities grow by the day.
In a recent webinar, Tim Zonca, vice president of portfolio marketing at Commvault, addressed an urgent question facing security leaders: How do you maintain resilience when AI fundamentally changes the rules?
What Industrialized Ransomware and AI Mean for Resilience
CISOs and CIOs are under pressure. In spite of billions spent on cyber defense, nation-states and professional crime rings continue to reap ever larger payoffs from their victims. Ransomware-as-a-service has become widespread, and advanced AI automation is accelerating the industrialization of malware. By including backup systems in their attacks, adversaries are undermining the very foundation of resilience.
As attacks become more sophisticated, targets are becoming more vulnerable. AI is scaling faster than organizations can secure, with exponential data growth, fragmentation across environments, more complex supply chains, and autonomous systems operating with minimal oversight. AI agents and non-human identities now outnumber humans 80 to 1. When these systems make mistakes or expose vulnerabilities, the impact can cascade across interconnected business processes.
Breaches and failures are now almost inevitable; the only question is whether you can recover fast enough to keep your business running. For organizations using legacy systems that assume human-controlled systems, centralized data, and isolated failures, the answer may well be no.
Making Resilience Operational
As AI agents make decisions across the environment, including a significant number of errors, it’s no longer enough to focus on protecting infrastructure. Security leaders must now broaden their operational focus across three critical areas:
- Continuously securing data at the source and monitoring for anomalies.
- Controlling the identities of individuals, non-human identities, and devices that access and use data autonomously.
- Achieving predictable recovery of data at massive scale without compromise or corruption.
Traditionally, data security, identity resilience, and cyber recovery have functioned as independent disciplines, each with its own team, tools, policies, and requirements. These silos leave vulnerabilities for attackers to exploit and slow recovery when AI systems fail. To close those gaps, organizations must unify these capabilities into a continuous, automated loop. We call this approach resilience operations (ResOps).
ResOps encompasses three essential requirements for AI resilience:
- Understanding your data landscape: Knowing where data lives, its sensitivity, who’s accessing it (including AI agents and non-human identities), and what policies govern that access in real time. For AI workloads, this extends to protections like LLM prompt governance to control how models access data.
- Continuous threat detection: Automated systems that constantly monitor for anomalies, compromised identities, and data corruption. When AI systems are making thousands of autonomous decisions, you can’t wait for periodic security reviews.
- Intelligent recovery: Automated, comprehensive restoration for entire cloud-native applications and their dependencies. To prevent re-infection, teams must validate data integrity and conduct forensic analysis in an isolated cleanroom before moving trusted data back to production.
Enabling ResOps in practice
To help companies make the move to ResOps, Commvault has introduced Commvault Cloud Unity, the most significant platform release in our history. It is designed to bring together all three dimensions of resilience:
- Bringing together data security, identity resilience, and cyber recovery under one operational model.
- Protecting all workloads, from both today’s production systems to tomorrow’s emerging AI stacks.
- Safeguarding data regardless of location, whether in clouds, regions, data centers, or edge locations.
A next-generation architecture brings AI automation to all facets of data protection, data security, identity resilience, and recovery. For security and IT teams, the platform provides simplicity at scale with one experience, one policy engine, and one interface designed to protect data, predict threats, and accelerate clean recoveries.
As security leaders know all too well, recovering from the most recent backup minimizes data loss but risks restoring compromised data. Rolling back to a verified clean state may eliminate threats but means losing hours or days of business-critical transactions or AI model training.
With Commvault Cloud, continuous threat monitoring and verified clean recovery points help eliminate this forced choice. The platform architecture automatically maps dependencies across distributed systems, helps maintain immutable backups, and helps enable one-click restoration of entire environments. Recovery can be both fast and clean, helping minimize loss as well as risk.
See ResOps in action
Watch the full webinar on-demand to learn more about ResOps, explore the architecture and services of Commvault Cloud, and rethink your resilience strategy for the AI age.
FAQs
Q: What is Resilience Operations (Res Ops)?
A: ResOps is an operating model that unifies data security, identity resilience, and cyber recovery into a continuous, automated discipline rather than treating them as separate IT functions. ResOps transforms resilience from a reactive response to incidents into an active practice that continuously understands data access patterns, helps detect threats and anomalies, and enables fast, intelligent recovery at scale.
Q: Why can’t traditional backup and recovery handle AI workloads?
A: Traditional backup tools were designed for centralized, human-controlled systems with isolated failures. AI workloads involve autonomous agents accessing distributed data across clouds and complex dependencies between microservices and containers, and they operate at a scale that manual processes can’t match.
When AI systems fail or are attacked, you need to recover not just data but entire application infrastructures with all their configurations, policies, and relationships – capabilities traditional backup tools lack.
Q: What does “unified resilience” mean in practice?
A: Unified resilience means bringing data security, identity management, and cyber recovery together under a single platform, policy engine, and operational model rather than managing them as separate functions with different teams and tools.
In practice, this provides a consistent approach to protect all workloads and data locations, automatically correlate security events with access patterns, and orchestrate comprehensive recovery that restores both data and the complete application infrastructure needed to use it.
Q: What’s the difference between cyber resilience and AI resilience?
A: Cyber resilience focuses on protecting infrastructure and recovering from security incidents, treating resilience as an operational state for confronting threats. AI resilience expands this to address challenges unique to AI-driven systems: autonomous agents making decisions with minimal oversight, exponential growth of data and non-human identities across environments, and cascading failures where problems in interconnected AI systems impact entire business operations rather than staying isolated.
Q: How does ransomware target backup systems?
A: Ransomware increasingly targets backup systems by exploiting compromised credentials with privileged access, moving laterally from production systems to connected backup repositories, or exploiting vulnerabilities in backup software itself. Modern ransomware families specifically hunt for backup infrastructure to encrypt or delete recovery points, preventing organizations from restoring clean data and maximizing pressure to pay ransom. This makes offline, immutable, or air-gapped backups essential for resilience.
Q: What is the clean vs. complete recovery dilemma?
A: The clean vs. complete recovery dilemma is the forced choice organizations face during incident response. You can recover from the most recent backup to minimize data loss but risk restoring compromised or corrupted data; or you can roll back to a verified clean state before the incident to eliminate threats but lose significant business-critical data. Traditional backup tools make organizations choose between completeness and safety, while modern resilience platforms aim to provide both simultaneously through continuous threat monitoring and verified recovery points.
Q: What is a cleanroom in cyber recovery?
A: A cleanroom in cyber recovery is an isolated, secure environment completely separated from production systems to help organizations safely test, validate, and analyze recovered data before restoring it to active use. Cleanrooms help enable forensic investigation of compromised systems, testing of recovery procedures, and verification that restored data is free from malware or corruption – all without risking reinfection of production environments or exposing sensitive data during analysis.
Sam Curcuruto is Director of Product Marketing at Commvault.
Related Blogs
Re-envisioning Resilience for the Age of AI
A CIO’s Perspective: Strengthening Business Resilience in the AI Era
Resilient Against the AI Machine
Cleanroom Recovery Innovations Enable a New Era in Cyber Resilience
