Pontos principais

• Os ataques de vishing aumentaram drasticamente, com grupos organizados industrializando a engenharia social para obter acesso inicial por meio de centrais de atendimento.
• Os invasores passam rapidamente de contas humanas comprometidas para identidades de máquina persistentes, como tokens OAuth e contas de serviço.
• A maioria das organizações carece de governança e visibilidade sobre identidades não humanas (NHI), criando um grande ponto cego de segurança.
• Readiness eficaz depende da correlação de sinais de identidade e do tratamento das identidades de máquinas como ativos de alto risco.
• A verdadeira resiliência requer a capacidade de detectar e reverter alterações não autorizadas de privilégios antes que os invasores estabeleçam persistência.

Your help desk staff just got a phone call. The caller knew the employee’s name, their manager, and the last four digits of their badge number. They asked for a password reset. Standard procedure. The IT rep complied.

That call was a fraud. And the attacker is now inside.

Voice phishing – vishing – jumped 449% em 2025. Grupos de adversários transformaram a engenharia social em uma operação escalável: recrutando operadores, escrevendo roteiros epagando de US$ 500 a US$ 1.000 per successful help desk impersonation. They’re not looking for your data. They’re looking for a foothold.

Once inside, attackers don’t linger on the human account. They move laterally – stealing OAuth tokens, creating new administrative service accounts, embedding access in machine-layer credentials that nobody watches. Unlike human passwords, those credentials are rarely rotated. They don’t trigger login alerts. They can survive a full remediation of the original compromised user.

By the time your security team closes the ticket on the help desk incident, the attacker may have been quietly persistent in your environment for weeks. The governance gap makes it worse.

Menos de 25% of organizations have formal policies for creating or decommissioning NHIs – the service accounts, API keys, and OAuth tokens that now outnumber human users by 144 para 1. Nearly all of them carry permissions far beyond what their function requires.

Most organizations have almost no confidence in their ability to detect an attack targeting this layer. That’s not a prevention failure. It’s a recovery planning failure.

Como se apresenta a Readiness

Prevention at the help desk matters – training, callback verification, out-of-band confirmation. But it isn’t enough on its own. Attackers are industrializing faster than awareness programs can keep pace.

Readiness means correlating the signals: A help desk interaction followed immediately by a multi-factor authentication (MFA) reset or a new token creation is a high-probability indicator of compromise.

It means treating machine identities as Tier 0 assets – governing their creation, scoping their permissions, and monitoring for unauthorized escalation. And it means having the ability to detect and roll back malicious privilege changes quickly, before they become the new normal.

Explore how a resiliência de identidade da Commvaultoferece suporte à detecção rápida, reversão e Recovery do seu ambiente de identidade.

Perguntas frequentes

Q: What is a vishing attack in the context of enterprise security?

A: Vishing (voice phishing) uses phone calls to impersonate employees and manipulate IT help desks into granting access – typically through password or MFA resets. It’s increasingly industrialized, with organized groups recruiting callers and using pre-written scripts to maximize success rates.

Q: Why do attackers pivot to machine identities after a vishing entry?

A: Human accounts get remediated. NHIs – OAuth tokens, service accounts, API keys – are more persistent and rarely rotated, often invisible to traditional monitoring. Migrating access to the machine layer allows attackers to maintain that persistence long after the original human credential breach is detected and closed.

Q: What does “identity resilience” mean in practice?

A: It means your organization can help detect unauthorized privilege changes in near real time and help restore the identity environment to a trusted state quickly. Detection alone isn’t sufficient – the ability to roll back malicious activity and verify that machine identities haven’t been tampered with (or if tampered with, to be rolled back to a prior good point in time) is what separates readiness from exposure.

Vidya Shankaran is Field CTO at Commvault.

Pontos principais

• Help desk social engineering is now a primary entry point, with vishing (voice phishing) attacks rapidly increasing and leading to credential compromise.
• Identidades não humanas, como contas de serviço e tokens, constituem um grande ponto cego de segurança, muitas vezes não gerenciadas e amplamente exploradas para movimentação lateral.
• Active Directory (AD) is a high-value target because of its centralized control and potential misconfigurations.
• Prevention alone is insufficient; organizations need strong detection and rapid recovery capabilities to limit damage.
• Immediate operational actions – like auditing accounts and correlating help desk activity with identity changes – can significantly reduce risk.

AD remains a primary target for attackers because it sits at the center of enterprise identity.Recent research shows that67% of incidents now involve identity-related compromise, with attackers going after critical systems like AD within hours of initial access.Once compromised, recovery can take days or weeks – causing significant business disruption.
The question worth asking isn’t whether AD is a target.It’s how attackers get tSaiba mais no SHIFT 2025 – and why the path is so much shorter than security teams might expect.

3 Steps to Full Compromise

Adversary groups like ShinyHunters and Scattered Spider have turned social engineering into a production operation.Voice phishing – vishing – jumped 449% in 2025.Callers are recruited, scripted, andpaid up to $1,000 depending on success and hit rate.
That means, it’s possible to start an attack with one step: Get a password reset or multi-factor authentication (MFA) change.That’s it.
From that single credential, the attacker moves laterally into cloud and virtualized environments.They harvest OAuth tokens, create new administrative service accounts, and embed access in machine-layer credentials.These non-human identities – service accounts, API keys, tokens – now outnumber human users 144 to 1.Sprawl and operational overhead makes rotation and audit difficult.
That lateral movement has a destination: Active Directory.

AD Is the Target

AD is the central nervous system of enterprise identity.Control it and you control everything – user accounts, group policies, and access to every domain-joined system in the network.The reason it’s so attractive to attackers – and so difficult to defend – is structural.Any authenticated user can read the entire directory.Every domain-joined system inherits trust from it.
Group Policy Objects linked at the domain head can be weaponized to disable security controls outright.Legacy protocols left enabled for application compatibility provide straightforward access.Microsoft’s own documentation says that “most identity attacks utilize common misconfigurations in Active Directory.”

When an attacker reaches the AD, they don’t need to force entry.The door is usually open.

Prevention Is Necessary but Not Sufficient

The standard security stack – MFA, endpoint detection, email filtering – is built around human behavior.It wasn’t designed to govern the machine identity layer or to detect the kind of slow, legitimate-looking privilege escalation that characterizes modern AD attacks.An attacker that moves from a compromised human account to a service account to a domain administrator over 72 hours may never trigger a single alert.
This is why the conversation must shift from prevention-first to recovery-first.
Prevention still matters.Least-privilege access, auditing AD changes, hardening default configurations, disabling inactive accounts – these can help reduce the attack surface.But given that half of organizations have already experienced an AD attack, designing only for prevention means designing to fail.
True identity resilience requires the ability to detect unauthorized privilege escalations in near real time, roll back malicious changes before they propagate, and restore the identity environment to a known-trusted state quickly – not in days or weeks, but fast enough to contain the blast radius.That means treating AD and the non-human identity layer as Tier 0 assets, with the same governance and recovery investment you’d apply to any other mission-critical system.

What To Do Right Now for Identity Resilience

The gap between wSaiba mais no SHIFT 2025 most organizations are and wSaiba mais no SHIFT 2025 they need to be on identity resilience is real.But it’s closeable.The immediate priorities are unglamorous and operational:

1. Audit what’s in your AD.
2. Find the accounts that shouldn’t still exist.
3. Rotate the credentials that haven’t been touched in years.
4. Correlate help desk activity against token- and account-creation events.

A help desk interaction followed by an MFA reset followed by a new service account is a high-confidence attack signal – and it’s detectable if you’re looking for it.
The longer-term work is architectural: Build recovery capability into your identity program so that when an attack succeeds – and it’s usually when, not if – you can contain it, reverse it, and try to restore trust faster than the attacker can consolidate their position.
Attackers are counting on your AD being ungoverned, your machine identities being invisible, and your recovery plan being theoretical.Close one of those gaps this quarter.Close all three and you’ve fundamentally changed the math. 

Learn how Commvault Cloud delivers comprehensive AD protection – from vulnerability assessment to one-click rollback and full forest recovery.
I recently joined Vidya Shankaran on the STRIVE podcast to talk about the governance gap for non-human identities.Check out our episode Saiba mais no SHIFT 2025.And be sure to read Vidya’s blog, O ponto cego da identidade das máquinas é agora uma superfície de ataque primária.

Perguntas frequentes

Q: Why are help desks becoming a major security risk?

A: Help desks are often trusted to reset passwords and modify MFA settings, making them attractive targets for social engineering.Attackers exploit this trust to gain initial access with minimal resistance.
Q: What role do non-human identities play in attacks?

A: Sprawl and operational overhead make rotation and audit of non-human identities, such as service accounts and API keys, difficult.Attackers use them to maintain persistence and move undetected across systems.
Q: Why is AD such a critical target?

A: AD controls authentication and access across the network.Gaining control of it allows attackers to manage users, policies, and systems at scale.
Q: Isn’t MFA and endpoint security enough to stop these attacks?

A: These tools focus on human behavior and may not detect slow, legitimate-looking privilege escalation.Attackers can operate within normal patterns and avoid triggering alerts.
Q: What does a recovery-first security approach mean?

A: It means preparing for the reality that breaches will happen and prioritizing the ability to detect, contain, and reverse them quickly.This approach helps reduce downtime and can help limit overall impact.
Q: What are the most important steps to take immediately?

A: Start by auditing your AD, removing unnecessary accounts, rotating old credentials, and monitoring for suspicious sequences of help desk and identity-related activities.
Dan Conrad is Principal Technologist and Field CTO at Commvault.

Pontos principais

• A migração de máquinas virtuais para o Red Hat OpenShift Virtualization é um processo gradual que exige proteção consistente em ambientes híbridos.
• Uma platform unificada de proteção de dados nativa do Kubernetes platform reduzir a complexidade e platform eliminar a necessidade de ferramentas ou processos separados.
• Reliable resilience – including immutable backups and threat detection – is critical during migration, when risks are highest.
• As opções flexíveis de recuperação permitem que as organizações se adaptem rapidamente caso as etapas da migração falhem ou os prazos sejam alterados.
• A consolidação da proteção para máquinas virtuais e contêineres ajuda a reduzir a proliferação de ferramentas e a manter uma governança consistente.

If you’re an IT leader today, chances are your virtualization strategy is under active review.

Rising costs, licensing uncertainty, and long-term vendor lock-in have many organizations reassessing their reliance on traditional hypervisors. At the same time, Kubernetes has matured into the operational foundation for modern applications.

These two realities are converging – and for many enterprises, Red Hat OpenShift Virtualization is emerging as a preferred destination for running virtual machines within a Kubernetes-native operating model.

This transition is accelerating across industries. As organizations modernize infrastructure on their own terms, Red Hat OpenShift Virtualization is increasingly viewed as a way to modernize the platform without the need for application refactoring. With that momentum comes a critical question:

How do you migrate virtual machines while maintaining consistent protection, resilience, and recoverability throughout the process?

To answer it, you need to examine how most enterprise migrations actually unfold – and where protection and resilience become critical.

A migração é uma jornada, não um evento pontual

Seasoned IT leaders know that infrastructure transitions rarely happen all at once.

For enterprises opting to move from hypervisors like VMware to Red Hat OpenShift Virtualization, the transition typically unfolds in phases. During this time, organizations inevitably operate in a mixed state:

• As máquinas virtuais baseadas em VMware continuam a dar suporte às principais operações comerciais.
• Máquinas virtuais que passaram a ser executadas recentemente no Red Hat OpenShift Virtualization.
• Aplicativos em contêineres que compartilham os mesmos clusters do Red Hat OpenShift.

This coexistence period introduces complexity and risk. Data is in motion, environments are changing, and protection gaps can appear if tooling and processes don’t evolve alongside workloads.

É essencial manter uma proteção confiável

A Commvault oferece, há muito tempo, proteção e recuperação de dados tanto para ambientes VMware quanto para cargas de trabalho do Kubernetes em execução no Red Hat OpenShift. Esse mesmo modelo de proteção nativo do Kubernetes e orientado por políticas agora se estende às máquinas virtuais em execução no Red Hat OpenShift Virtualization. O que realmente chama a atenção dos clientes é a consistência:

• Uma única platform proteção e recuperação.
• Operações baseadas em políticas aplicadas de maneira uniforme em todas as cargas de trabalho.
• Projetado para funcionar com suas ferramentas e processos atuais, à medida que os ambientes evoluem.

VMs running on Red Hat OpenShift Virtualization are protected using the same workflows and governance constructs as containerized applications. This unified approach is being embraced by organizations standardizing on Red Hat OpenShift that want a simpler, more consistent way to manage data across environments.

This capability is available today.A Commvault Cloudoferece suporte à proteção de ambientes de virtualização do Red Hat OpenShift alinhados com a versão de suporte de longo prazo 11.40 e a versão de inovação 11.42, o que significa que os clientes já podem colocar esses recursos em produção.

You Shouldn’t Need to Manage Protection Differently

Once VMs move to Red Hat OpenShift Virtualization, they shouldn’t require special handling from a protection standpoint.

A Commvault Cloud discovers and protects Red Hat OpenShift Virtualization VMs alongside containerized applications, helping give teams centralized visibility, consistent policy enforcement, and simplified recovery operations. Virtualized and containerized workloads are managed together – without introducing operational silos.

For organizations managing diverse application portfolios, this treatment of VMs inside Kubernetes helps reduce operational friction while maintaining enterprise-grade controls.

A resiliência cibernética é fundamental quando a migração aumenta o risco.

Migration periods represent a uniquely vulnerable window. Change creates complexity, and complexity increases exposure to data loss and ransomware.

A Commvault Cloud helps maintain resilience throughout this phase with:

• Backups isolados e imutáveis para cargas de trabalho do Red Hat OpenShift Virtualization.
• Dados de backup que apoiam a detecção de ameaças e a análise forense, ajudando as equipes a validar a prontidão para a recuperação antes de restaurar as cargas de trabalho.
• Advanced recovery capabilities designed to help organizations minimize operational disruption.

Independentemente de as cargas de trabalho estarem na fase pré-migração, em transição ou já em pleno funcionamento no Red Hat OpenShift Virtualization, o nível de resiliência permanece inalterado.

A flexibilidade na recuperação traz confiança

Every modernization initiative needs room for adjustment.

Commvault supports both in-place and out-of-place recovery for Red Hat OpenShift Virtualization virtual machines, including full VM context and configuration. If a migration step doesn’t go as planned – or timelines need to shift – teams may recover quickly and move forward without compromising availability or data integrity.

Proteção nativa do Kubernetes além das VMs

For many enterprises, virtualization is only one piece of a broader application modernization strategy.

A Commvault Cloud also provides application-centric, Kubernetes-native protection for containerized workloads, including persistent volumes and application metadata, across all CNCF-certified Kubernetes distributions. This enables mobility and recovery for cloud-native applications while helping maintain operational consistency across environments.

Reduzindo a proliferação de ferramentas à medida que a infraestrutura evolui

Platform transitions often introduce new tools, new processes – and new complexity.

By using A Commvault Cloud as a unified protection platform for:

• Máquinas virtuais VMware.
• Máquinas virtuais do Red Hat OpenShift Virtualization.
• Aplicativos em contêineres.

As organizações podem ajudar a reduzir a proliferação de ferramentas, simplificar a administração e manter uma governança consistente, mesmo à medida que as estratégias de infraestrutura evoluem.

Como tudo se encaixa

During any migration, it helps to understand how the pieces work together. Red Hat’s Migration Toolkit for Virtualization takes care of moving VMs from VMware into Red Hat OpenShift Virtualization.

A Commvault Cloud helps provide the protection and resilience that stays with your workloads throughout the process, so data can remain protected before, during, and after migration. This can help keep recoverability from falling behind as workloads move.

Continuing the Conversation at Red Hat Summit

We’re already working with customers that are actively moving virtual machines onto OpenShift Virtualization – and we’re continuing these discussions at Red Hat Summit, May 11–14 in Atlanta.

At the Commvault booth, we’ll be:

• Conversando com líderes de TI sobre os desafios reais da resiliência.
• Compartilhando orientações práticas para realizar a migração com confiança.
• Demonstrating A Commvault Cloud protection for Red Hat OpenShift Virtualization.

If maintaining resilience and recoverability throughout your virtualization strategy is a priority, we’d welcome the opportunity to connect.

Seguindo em frente com confiança

Red Hat OpenShift Virtualization is becoming a foundational component of modern enterprise infrastructure. But you can’t rush migration at any cost; you must build protection, resilience, and recovery into the process from the beginning.

With A Commvault Cloud, protecting Red Hat OpenShift Virtualization workloads isn’t a future aspiration. It’s something customers already are doing – using a unified platform to modernize confidently while staying resilient and recoverable.

“Red Hat OpenShift Virtualization delivers a reliable, consistent foundation for organizations to support their entire virtualized estate,” says Steve Gordon, Senior Director, Product Management, Hybrid Cloud Platforms, at Red Hat. “By leveraging an optimized integration like A Commvault Cloud with Red Hat OpenShift Virtualization, our customers can move forward with greater confidence, knowing their workloads are protected consistently before, during, and after migration.”

Perguntas frequentes

Q: Why is VM migration considered a multi-phase process?

A: Most enterprises cannot migrate all workloads at once, so they operate in a hybrid state with legacy and new environments running simultaneously. This phased approach introduces complexity, making consistent protection and visibility essential throughout the transition.

Q: What role does resilience play during VM migration?

A: Resilience enables organizations to maintain data protection, recover quickly from failures, and defend against threats like ransomware. During migration, when systems are in flux, strong resilience measures can help prevent data loss and operational disruption.

Q: How does A Commvault Cloud simplify protection across environments?

A: A Commvault Cloud provides a single platform with policy-driven protection for VMware VMs, OpenShift Virtualization VMs, and containerized applications. This unified approach enables consistent operations without introducing new tools or workflows.

Q: What makes Kubernetes-native protection important?

A: Kubernetes-native protection aligns with how modern applications are deployed and managed, covering both containers and virtual machines. It enables simple data management, mobility, and recovery within cloud-native environments.

Q: How does recovery flexibility improve migration confidence?

A: Flexible recovery options, such as in-place and out-of-place restores, can help teams quickly recover workloads if something goes wrong. This adaptability helps reduce downtime and enables organizations to adjust migration plans without risking data integrity.

Q: How can organizations reduce complexity during infrastructure transitions?

A: By adopting a unified data protection platform, organizations can manage all workloads – virtualized and containerized – through a single interface. This approach helps reduce tool sprawl, simplify administration, and maintain consistent governance across evolving environments.

Jason Gizaé gerente sênior de Marketing de Parcerias de Conteúdo Global na Commvault.

Pontos principais

• A Readiverse Academy lançou um caminho de certificação estruturado e em níveis, que vai desde conhecimentos básicos até especialização avançada cloud .
• As certificações estão alinhadas às funções profissionais reais, ajudando os alunos a desenvolver habilidades relevantes para suas responsabilidades em Cloud Commvault Cloud .
• The program includes four tiers – Practitioner, Specialist, Professional, and Expert – each increasing in depth and operational capability.
• A aprendizagem se baseia em três pilares fundamentais: platform , resiliência cibernética e conhecimento especializado em cargas de trabalho.
• Opções flexíveis de aprendizagem, incluindo formatos individualizados e ministrados por instrutor, permitem que os profissionais avancem de acordo com seus horários e objetivos.

The environments you protect with Commvault® Cloud are increasingly complex, and the expectations on your teams that run them are higher than ever. It’s no longer just about knowing the platform. It’s about being able to operate, protect, and recover, often under pressure.

If you’ve already started your learning journey in the Readiverse Academy, welcome back. And if you’re new here, you’re joining at the right time.

Today, we’re introducing a structured, tiered certification approach that gives learners a clear, skill‑based path from foundational platform knowledge to advanced cloud engineering expertise.

Criamos conteúdo para você

Cloud da Commvault Cloud exigem conhecimento especializado em diversas áreas de responsabilidade, muitas vezes dentro da mesma função. Administradores, especialistas em segurança, cloud e responsáveis por cargas de trabalho precisam de conhecimentos com diferentes níveis de profundidade e abrangência. E nem todos precisam aprender as mesmas coisas, na mesma ordem, para serem eficazes.

Os novos níveis de certificação da Readiverse Academy refletem essa realidade. Os alunos avançam por níveis claramente definidos que se complementam, de modo que sua certificação se alinhe ao que você realmente faz e valide essas competências perante as equipes com as quais você trabalha.

• Commvault Cloud Practitioner – foundational platform and resilience knowledge.
• Commvault Cloud Specialist – expanded operational and security depth.
• Commvault Cloud Professional – advanced recovery and workload expertise.
• Commvault Cloud Expert – full cloud engineering and resilience leadership.

Each tier is earned through a combination of coursework, hands‑on lab activities, and validated assessments. As learners progress, the scope and depth of operational capability demonstrated increases accordingly.

Um caminho claro: de iniciante a especialista

O programa de certificação está estruturado em torno de três pilares de competências essenciais que permeiam todos os níveis:

• platform básicas platform
• Conceitos de resiliência cibernética
• Carga de trabalho e especialização em funcionalidades

Cada nível acrescenta requisitos específicos relacionados a esses pilares. Os alunos podem concluir cursos individuais ou combinar requisitos específicos para atingir as metas de certificação.

Já faz parte da Readiverse Academy? O que isso significa para você.

With a new structure like this, the most important question is what it means for the progress you’ve already made. If you’ve already completed courses or earned certifications in the Readiverse Academy, congratulations! Your investment matters, and we want to be clear about what happens next.

Those certifications represent your history and accomplishments with Commvault. The new program is aligned to our expanded portfolio of cyber resilience features for Commvault Software, Commvault SaaS, and hybrid environments. As your needs grow to require more from Commvault, these courses and certifications will help you configure, manage, and optimize Commvault to meet your organization’s unique needs.

There is no direct progression from the previous certification tracks to the new program, but your existing certifications validate your expertise on the former product releases. As those releases are retired, those certifications will reach end of life as well. Learners who are already invested in the Readiverse Academy are well positioned to progress quickly.

Quem deve fazer os cursos e as certificações da Readiverse Academy

As certificações da Readiverse Academy são destinadas a profissionais que atuam em ambientes Commvault SaaS, Commvault Software e ambientes híbridos.

• Platform administrators managing day‑to‑day operations.
• Especialistas em segurança dedicados à proteção de dados e ao fortalecimento de ambientes.
• Cloud responsáveis pela configuração do plano de controle e pela resiliência avançada.
• Responsáveis por cargas de trabalho que precisam de proficiência em domínios específicos de dados.

All training is available for self‑paced learning, with select courses also offered in instructor‑led formats, so learners can progress in a way that fits their role and schedule.

Como começar ou dar continuidade à sua jornada de aprendizado

Whether you’re starting fresh or continuing your journey, the next step is simple and designed to meet you where you are.

• Faça login ou cadastre-se no sitecommvault.com.
• É novo na Commvault? Comece com o curso “Commvault Cloud ”.
• Responsável pelo apoio à gestão da carga de trabalho? Confira nosso catálogo de cursos, que abrange praticamente tudo.
• Procurando estratégias para apoiar a recuperação após um ataque cibernético? O curso sobre Resiliência Cibernética é o seu primeiro passo.

O que vem a seguir

Our goal is to make advancement predictable, transparent, and aligned to real‑world roles to help learners know what’s next and how to prepare for it.

We are committed to giving every Commvault Cloud user the knowledge to operate, protect, and recover their environment with confidence. Because when it matters most, certification isn’t about credentials. It’s about being resilient and ready to recover.

Perguntas frequentes

Q: What is the purpose of the Readiverse Academy certification program?

A: The program provides a structured, skill-based learning path that helps professionals progress from basic platform knowledge to advanced cloud engineering expertise. It aligns training with real-world responsibilities to enable learners to apply their knowledge effectively in complex environments.

Q: What are the different certification tiers available?

A: There are four tiers: Commvault Cloud Practitioner, Specialist, Professional, and Expert. Each level builds on the previous one, increasing in technical depth, operational scope, and leadership capability.

Q: Who should enroll in Readiverse Academy courses?

A: The courses are designed for platform administrators, security specialists, cloud engineers, and workload owners working across SaaS, software, and hybrid environments. Each role can follow a tailored learning path based on their responsibilities.

Q: How are the certifications earned?

A: Certifications are achieved through a combination of coursework, hands-on labs, and validated assessments. As learners progress, they demonstrate increasing levels of expertise across platform, security, and workload domains.

Q: What happens to existing Readiverse Academy certifications?

A: Existing certifications remain valid as proof of past expertise but are tied to earlier product releases. As those releases are retired, the certifications will reach end of life, encouraging learners to transition to the new program.

Q: How can someone get started with the new program?

A: New learners can begin with the Commvault Cloud Administrator course, while existing users can log in to continue their progress. Additional courses are available based on specific goals, such as workload management or cyber resilience strategies.

Suzanne Klausner is Director, Customer Enablement Strategy, at Commvault.

Pontos principais

• A maioria dos exercícios simulados serve para avaliar o desempenho, em vez de revelar lacunas reais na resposta a incidentes.
• Para que os exercícios sejam eficazes, eles devem introduzir atrito, ambiguidade e pressão, a fim de refletir situações reais.
• Limitar o escopo do exercício a alguns cenários críticos e definir o sucesso como a identificação de problemas, em vez de apenas causar boa impressão, pode levar a insights mais significativos e práticos.
• A participação de diversas áreas, e não apenas das equipes técnicas, é essencial para avaliar com precisão a resposta da organização.
• A verdadeira resiliência é comprovada por meio de testes reais de recuperação, e não apenas por cenários baseados em discussões.

There is a moment most security leaders recognize, even if they do not say it out loud. The tabletop just wrapped. The team is filing out. Everyone looks reasonably satisfied. And somewhere in the back of your mind, a quiet question surfaces: Did we actually learn anything?

If you are honest, the answer is often no.
That is not because tabletop exercises are a bad idea. They are one of the most valuable tools a security leader has. The problem is how most organizations run them – and what they are actually measuring when they do.

A Armadilha do Desempenho

The most common mistake in tabletop exercises has nothing to do with the scenario. It has to do with the goal. Most teams, consciously or not, build exercises designed to demonstrate competence rather than discover gaps.
The scenario generally follows a clean arc. Information arrives in a logical sequence. The right people say the right things. Everyone feels prepared. And that feeling – confident, well-rehearsed, almost collegial – is exactly the problem.
Real incidents do not run on clean arcs. They arrive with incomplete information, conflicting signals, unavailable people, and a business demanding answers faster than the facts support. If your tabletop does not create that kind of friction, you have not tested incident response. You have practiced a conversation.
When the exercise is designed to validate rather than stress-test, a second problem follows: People stop being honest. Nobody says, “I don’t know who owns that decision” or “we have never actually tested that recovery path.” They say what sounds right. And the gaps that should surface in a controlled environment stay hidden until they surface in a real one.

O que um bom exercício realmente avalia

Before you build a scenario, you need to answer a simpler question: What do you actually want to learn? Not 20 things. Three or four.
Can your team make a shutdown decision fast enough, and does everyone know who has the authority to make it? When security, IT, legal, and communications are all in the room with conflicting priorities, can they actually reach decisions together? Can you explain the business impact of an incident clearly enough for leadership to act – not just understand? And if you had to restore a critical system in the next four hours, could you really do it?

Once you know what you are testing, build a scenario with real friction. Make a key person unavailable mid-exercise. Introduce a customer escalation. Have a regulator ask a question the team cannot answer from the runbook.
Give people incomplete information and see how they make decisions anyway. The value is not in watching people succeed under pressure. It is in finding the places where the process breaks down while the stakes are still low enough to fix it.

Diga isso em voz alta logo no início: hoje em dia, sucesso significa identificar problemas, e não causar boa impressão. Essa única frase muda o que as pessoas estão dispostas a dizer na sala.

O Problema das Pessoas

Uma simulação que envolva apenas segurança e TI é uma discussão técnica, não um exercício de resposta a incidentes. Se o departamento jurídico não estiver presente, se o departamento de comunicação não estiver presente, se os responsáveis pelas áreas de negócios e a alta liderança estiverem ausentes, você não estará testando como sua organização realmente responde a uma crise. Você estará testando como um grupo de pessoas inteligentes discute uma situação hipotética. Incidentes reais são tratados em toda a empresa. O exercício deve refletir isso.

Conversar sobre o assunto não é suficiente

This is where most organizations stop short. A paper exercise is important – but it is not confidence.
Talking through a recovery scenario tells you something. Actually restoring a system tells you something different. Can you bring identity back to a clean point in time? Can you validate that what you are recovering is trustworthy? Can you restore a Tier 1 application and confirm it comes back cleanly, without carrying the infection with it?

Those are not questions you can answer in a conference room. At some point, the plan has to meet the environment – and you need to know whether they match.

Após o término do exercício

The debrief tells you whether the exercise mattered. If the hot wash is quiet, vague, or full of “good reminders,” the exercise did not push hard enough. A well-run tabletop should leave you with a short list of real findings, clear owners, and deadlines. If you cannot answer what broke, who is fixing it, and by when, you ran an event, not an exercise.
The goal was never to pass the exercise. It was to learn something important while the cost of being wrong was still just time.
Watch our recent episode of the STRIVE podcast, where I join my colleague Chris Mierzwa, Senior Director, Portfolio Marketing, for sobre exercícios simulados.

Perguntas frequentes

Q: Why do most tabletop exercises fail to deliver real value?

A: Many exercises are designed to make teams look prepared rather than uncover weaknesses. This leads to scripted discussions that miss the unpredictability and pressure of real incidents.

Q: What should a tabletop exercise aim to achieve?

A: It should focus on answering a small number of critical questions, such as decision-making speed, ownership clarity, and recovery capability. This focus helps teams uncover meaningful gaps instead of surface-level insights.

Q: How can organizations make exercises more realistic?

A: Introduce uncertainty, missing information, and unexpected disruptions during the scenario. These elements force teams to think critically and act under pressure, closer to real incident conditions.

Q: Who should be involved in a tabletop exercise?

A: Beyond security and IT, teams like legal and communications, business leaders, and executives should participate. This enables the exercise to reflect how real incidents are managed across the organization.

Q: Why is talking through recovery not enough?

A: Discussion can highlight plans, but only real testing proves whether systems actually can be restored cleanly and quickly. Practical validation is necessary to confirm recovery readiness.

Q: What defines a successful tabletop exercise outcome?

A: A strong exercise results in clear findings, assigned owners, and defined timelines for remediation. If these are missing, the exercise likely did not challenge the team enough.

Chris Bevil is Principal, Global Cyber Resilience & AI, at Commvault.

Every organization that has ever failed a recovery – and there are more than anyone publicly acknowledges – had one thing in common: They believed they could recover before they tried.

The belief came from somewhere. A completed tabletop exercise. A backup system that showed green. An annual disaster recovery test that passed. All of it documented. All of it, at some point, accurate. None of it current when the incident actually hit.

This is the confidence gap. And it is the gap that continuous recovery validation is designed to close.

What ‘Testing’ Actually Means in Most Organizations

Ask most security or IT leaders how often they test their recovery capability, and the answer is typically annual, sometimes biannual. The test involves restoring a subset of systems from backup into a test environment, confirming they come up, and filing a report. Sometimes a tabletop exercise is conducted alongside it.

What this kind of testing does not do: validate that backup data is free of malware. Confirm that recovery sequencing works for interdependent services. Test identity recovery, which is essential when compromised credentials are what enabled the attack. Confirm that the team that would actually run the recovery knows the current runbooks. Or produce evidence meaningful enough to satisfy a regulator, an auditor, or a board that recovery capability is real and current.

In short, it validates a point in time. Resilience operations (ResOps) requires validation as a continuous state.

The Continuous Validation Model

Continuous recovery validation is not a single test run more frequently. It is a set of integrated practices that produce ongoing, evidence-based proof of recoverability across critical services.

Automated backup integrity scanning. Every backup, continuously evaluated for anomalies, encryption patterns, and malware signatures. Not at restore time – before restore time. The goal is to know whether your recovery points are clean before you need them, not during an incident.

Scheduled Cleanroom Recovery drills. Bi-annual at minimum, restoring from immutable backup points into an isolated Cleanroom Recovery environment – not production, not a production-adjacent test environment, but a genuinely isolated space where forensic analysis can happen without risk of reinfection. These drills produce documented evidence of recoverability against defined impact tolerances.

Identity recovery validation. With credential abuse the most common breach vector, Active Directory and Entra ID recovery must be tested alongside data recovery. Organizations that restore systems without restoring a verified-clean identity layer may find attackers re-enter through the same door.

Service Resilience Indicator (SRI) dashboards. SRIs – continuous signals drawn from backup telemetry, dependency mapping, and test results – that give CISOs, CIOs, and boards a live view of recoverability posture. Not a point-in-time report. An ongoing operational signal.

Each of these practices feeds what Deloitte and Commvault call the resilience backlog: a continuously updated, prioritized list of gaps identified through testing and tracked to resolution. It is the mechanism by which validation drives improvement rather than just producing reports.

What Mean Time to Clean Recovery Changes

Traditional recovery metrics – recovery time objective (RTO) and recovery point objective (RPO) – measure speed and data recency. They say nothing about whether the data being restored can be trusted. Mean Time to Clean Recovery (MTCR) fills that gap: It measures the time required to restore data that is verifiably clean, not just technically available.

MTCR matters because in a ransomware incident, the adversary’s goal is often to corrupt recovery options, not just encrypt production systems. An organization that restores quickly but restores from a compromised backup has not recovered. It has re-infected itself.

Building MTCR into your resilience measurement framework, alongside RTO and RPO, changes what you optimize for and what you report to the board. Speed plus recency plus integrity: that is the complete picture of recovery readiness.

Resilience You Can Prove

The organizations that navigate cyber disruptions with the least damage share one characteristic: They treat recovery capability as something to be continuously demonstrated, not periodically asserted. They know their MTCR. Their SRIs are current. Their cleanroom recovery has been tested in the last 90 days.

That posture is not the result of better technology alone. It is the result of an operating discipline – ResOps – that makes resilience continuous, measurable, and governable. Commvault’s platform provides the technical foundation: clean recovery, automated validation, and the unified visibility across data, identity, and services that ResOps requires at scale.

For the organizational side of that equation – how to define impact tolerances, align executive leadership, and build the governance structure that sustains the discipline – see the Deloitte companion blog, The Resilience Conversation Your Board Isn’t Having Yet. And for the complete ResOps framework, including the six ResOps domains and the measurement model that ties technical recoverability to board-level accountability, read the joint whitepaper:From Minimum Viability to Operational Resilience: ResOps in Practice.Bill O’Connell is Chief Security Officer at Commvault.

Pontos principais:

• Os ataques cibernéticos têm como alvo, cada vez mais, tanto os ambientes de produção quanto os de backup, tornando essencial uma recuperação limpa e verificável.
• A detecção integrada de anomalias e ameaças reforça a resiliência cibernética ao identificar dados comprometidos, validar pontos de recuperação confiáveis e acelerar a restauração.
• Quando integradas aos fluxos de trabalho de proteção de dados, as funcionalidades de detecção de anomalias e ameaças podem ajudar a fornecer as evidências necessárias para uma recuperação rápida, segura e confiável.

Por que a resiliência cibernética depende da detecção integrada de anomalias e ameaças

Anomaly detection identifies unusual behavior in backup data that may indicate compromise. Threat detection identifies known malicious activity using signatures, heuristic analysis, and scanning techniques. Together, they help validate recovery points and enable clean data recovery.

For years, security leaders focused on preventing breaches. In today’s era of persistent attacks and AI-driven threats, organizations increasingly assume compromise and design systems that can withstand disruption and recover safely when it occurs.

Modern adversaries don’t always hide their presence – they reveal it when it serves their objective. Attackers try to infiltrate environments quietly, observe systems over time, and position themselves inside critical infrastructure. The moment an attack becomes visible is rarely the moment it begins; it is the moment the attacker chooses to act.

By then, compromised data may already be woven into backup copies. Integrated anomaly and threat detection can help organizations identify compromised backup data, validate clean recovery points, and assist recovery after a cyberattack.

For security and IT teams, the challenge is no longer simply detecting an attack but predicting and managing an attacker’s possible impact. Understanding what was affected, what remains trustworthy, and how the organization can recover safely without escalating business disruption is the solution.

This is why cyber resilience benefits tremendously from integrated anomaly and threat detection. When detection capabilities are embedded into data protection and recovery workflows, they help provide the shared intelligence that teams need to identify compromised data, validate trusted recovery points, and guide response decisions with evidence rather than guesswork.

This approach aligns with the emerging ResOps™ operating modelemergente, no qual as equipes de segurança, TI e recuperação trabalham com base em uma visão compartilhada e em caminhos de recuperação validados para responderem em conjunto aos incidentes.

A nova realidade: a recuperação exige provas, não suposições

Traditional threat detection tools focus on spotting threats along the perimeter. But once attackers are inside, visibility can become fragmented and determining which systems and data have been affected becomes a challenge.

Further, attackers increasingly target backup environments specifically to undermine recovery. And the moment organizations cannot confidently prove that backups remain untouched, suspicion becomes unavoidable. The result is uncertainty. Restore quickly and risk reinfection? Or delay recovery while investigating which copies remain trustworthy? IT teams are forced to guess which data is safe while downtime accumulates.

By building intelligence directly into data protection workflows, anomaly and threat detection helps transform recovery from a reactive guess into a disciplined, evidence-driven process. These capabilities can help organizations pinpoint tampered copies, validate data cleanliness, and assemble the most recent uncompromised recovery points – helping you accelerate cyber recovery and reduce operational impact.

Detecção de anomalias: seu sinal precoce do desconhecido

Anomaly detection acts as a sentinel, guarding your protected data integrity. It establishes a baseline of normal behavior – file sizes, growth patterns, deduplication changes, access attempts – and alerts teams when something deviates from that norm. These deviations can surface signs of silent tampering long before malware signatures do. In an era of novel and polymorphic threats, anomaly detection helps offer what static tools can’t: visibility into the unexpected.

Detecção de ameaças: defesa direcionada contra atividades maliciosas conhecidas

While anomalies reveal what’s unusual, threat detection exposes what is malicious. By scanning protected data directly for ransomware, malware signatures, encryption patterns, and custom indicators of compromise (IoCs), threat detection helps validate that the data you protect is not already compromised.

Por que uma abordagem combinada é importante

Nem a detecção de anomalias nem a detecção de ameaças, por si só, oferecem uma visão completa. Juntas, elas proporcionam uma estratégia de defesa em profundidade: a detecção de anomalias pode identificar sinais suspeitos, enquanto a detecção de ameaças pode investigar mais a fundo para verificar se há intenção maliciosa. Essa combinação ajuda as organizações a distinguir anomalias inofensivas de verdadeiros ataques e a manter dados confiáveis e validados para uma recuperação rápida.

Meeting Today’s Challenges with Commvault® Cloud

Os invasores têm como alvo cada vez mais os ambientes de backup, e o malware oculto nos dados de backup pode aumentar o risco de reinfecção durante a recuperação. As organizações precisam de uma validação baseada em dados para garantir uma recuperação segura e confiável.A Commvault Cloud addresses this by combining data protection workflows with anomaly detection, threat intelligence, AI-enabled analytics, and isolated clean instances. With anomaly and threat insights applied before, during, and after backup operations, Commvault can help empower organizations to recover faster, cleaner, and confidently.

Read the full white paper, “Can You Prove You’re Recoverable Right Now?”para obter mais informações.

Perguntas frequentes

Q: What is anomaly detection in data protection?

A: Anomaly detection identifies unusual behaviors – such as unexpected backup size changes or abnormal file activity – that may signal tampering, ransomware, or emerging threats within protected data.

Q: Why do CISOs need threat detection in their backup workflows?

A: Backup environments are now prime attacker targets. Threat detection helps prevent organizations from storing or restoring compromised data, which helps reduce reinfection risk and improve chances for clean recovery.

Q: How does Commvault help enable clean data recovery?

A: Commvault uses AI-assisted threat scanning, encryption detection, custom IoC matching, and cyber deception to help validate backup integrity and assemble the most recent uncompromised data for rapid recovery.

Q: Why combine anomaly and threat detection?

A: Anomalies identify the unknown; threat detection validates the known. Together, they provide comprehensive visibility into suspicious activity, helping enable faster investigation and more confident data recovery.

Lista de Paulineé gerente de marketing de produto na Commvault

Pontos principais

• Rising operational disruption makes scalable resilience essential, but organizations commonly fall into traps like seeking “silver bullet” technology or relying on “hero worship” of individual experts.
• O ResOps oferece uma estrutura escalável que integra pessoas, processos e tecnologia nas áreas de ITOps, SecOps e DevOps.
• O apoio da alta direção, por parte do CEO, ajuda a promover a responsabilização e a priorizar a resiliência como uma disciplina estratégica.

Cyberattacks, cloud complexity, and AI-enabled threats are creating constant operational challenges for enterprises. To help meet business requirements in this increasingly disruptive environment, organizations need to move beyond separate recovery tools, teams, and plans to resilience as an integrated operating model.

In a recent webinar, Phil Goodwin, research vice president for IDC’s worldwide infrastructure programs, joined me for a fireside chat to explore how organizations can move beyond fragmented approaches to build resilience that scales.

Por que as organizações precisam de uma nova estrutura de resiliência

As organizations engage in daily firefighting while keeping up with new technologies and addressing new initiatives, they rarely have time to step back and reassess whether their approaches still meet requirements. But as isolated incidents become systemic disruption, this conversation has become essential.

In a simpler era, organizations focused primarily on backup and recovery. Large-scale disruptions such as Hurricane Sandy brought disaster recovery onto the agenda. Intensifying cyberthreats like ransomware added cyber resilience and business continuity to the list. Each evolution brought new capabilities, but many organizations simply bolted new approaches onto what they were already doing rather than addressing these expanding requirements holistically.

When separate teams manage different pieces with different tools and policies, gaps may emerge that can slow recovery. Despite years of investment in cybersecurity, organizations are still struggling with recovery.

More recently, AI has accelerated the urgency for a more integrated approach by reshaping both threats and defenses. Despite increasing AI investments, many businesses are delaying AI rollouts due to ongoing concerns about governance and security vulnerabilities.

On the other side of the cyber front, bad actors are using AI to create deepfakes, target users with more sophisticated and convincing phishing, and exploit vulnerabilities at scale.

Resilience operations – ResOps – treats resilience as a continuous operating discipline rather than a collection of separate tools and teams. By bringing together ITOps, SecOps, and DevOps under a unified framework, ResOps helps transform resilience to keep pace with systemic disruption.

Como evitar erros comuns no planejamento de resiliência

Even organizations that recognize the need for change often fall into traps. One is the “silver bullet” problem, which focuses on technology as the solution. Leaders want to believe that buying the right tools will solve everything, but technology alone can’t deliver positive business outcomes without proper integration and process.

“Hero worship” is another common pitfall – relying on talented staff members with expertise residing in their heads rather than in documented processes. Heroism can’t scale, and reliance on specific individuals creates vulnerability when people leave or responsibilities shift.

To move past these traps, you have to think differently about your operating model. Instead of focusing primarily on technology and people, consider the team you’ll need to build, including executive sponsorship, IT operations and security leadership, and senior leaders from the business side.

The team’s charter should focus on defining business outcomes first: What does resilience need to achieve for the organization? What KPIs, SLAs, and processes should be established to meet these requirements?

Desenvolvendo operações de resiliência de cima para baixo

Como prioridade do conselho administrativo, a resiliência requer apoio dos mais altos escalões. A ResOps ganha maior força quando o CEO se envolve, ajudando a definir as prioridades de recursos e promovendo a responsabilização em toda a organização. Com o apoio da alta direção, os líderes seniores — incluindo o CIO, o CTO, o CISO e os gerentes gerais — podem encarregar suas equipes da implementação.

Essa abordagem pode ser adaptada a organizações de todos os tamanhos. Mesmo as pequenas e médias empresas podem reunir equipes multifuncionais que incluam partes interessadas do negócio, equipes de TI e profissionais responsáveis pela segurança de dados e de rede. À medida que crescem, essa estrutura pode acompanhar esse crescimento, aumentando o quadro de pessoal em disciplinas específicas de resiliência, ao mesmo tempo em que mantém uma abordagem integrada em toda a cadeia de operações de resiliência. O ResOps reflete as formas como as equipes de operações de TI, SecOps e DevOps precisam trabalhar juntas dentro das organizações. Recovery e a segurança de dados tornaram-se tão intimamente alinhadas que, na IDC, pesquisadores dessas disciplinas agora colaboram frequentemente em projetos com clientes. Atualmente, as aplicações precisam ser projetadas tendo em mente os agentes maliciosos, incorporando arquiteturas de confiança zero e partindo do princípio de que algo dará errado. O ResOps oferece a estrutura necessária para essa convergência, reunindo ferramentas de segurança e operações em um modelo unificado para lidar com ameaças e interrupções de todos os tipos.

ResOps como uma estrutura compartilhada do setor

ResOps is an operating model, not a product, and can benefit companies regardless of the specific tools they use. As Phil observed during our chat, “It really requires that community involvement where people pitch in from different perspectives, different vendors, different organizations, and different teams, just like DevOps or SecOps.”

For organizations struggling with constant disruption and the growing complexity of AI-enabled threats and defenses, ResOps offers a path beyond fragmented resilience approaches. By bringing together people, processes, and technology in a unified operating model, ResOps turns fragmented recovery efforts into enterprise-wide readiness.

Watch my conversa informal completa com o Philpara ver como o ResOps pode ajudar você a desenvolver uma resiliência empresarial que se adapta à sua escala.

Perguntas frequentes

Q: What is resilience operations (ResOps)?

A: ResOps is an operating model that integrates IT operations, security operations, and DevOps into a continuous discipline. Rather than treating disaster recovery, cyber resilience, and business continuity as separate capabilities, ResOps brings people, processes, and technology together under a unified framework to help create scalable enterprise resilience.

Q: Why is executive sponsorship important for cyber resilience?

A: Executive sponsorship – ideally at the CEO level – helps drive accountability and priority for resilience initiatives across the organization. This top-down support is essential for organizations trying to move beyond fragmented approaches to integrated resilience operations.

Q: Can small and midsized organizations implement ResOps?

A: Yes. ResOps applies across organization sizes. The framework scales in complexity as organizations grow, making it accessible to mid-market firms while remaining effective for large enterprises.

Q: Why do IT and security teams need to work together for resilience?

A: When IT operations, security operations, and DevOps teams collaborate rather than work in silos, organizations can help build more resilient infrastructure to address evolving threats.

Q: How should organizations get started with resilience operations?

A: Start at the top by securing executive sponsorship at the CEO level. Next, form a cross-functional team including IT operations, SecOps, and business stakeholders, and have them define the business outcomes resilience needs to deliver for your business. Conduct a threat assessment to understand the risks you need to address. Only after these foundational steps should organizations focus on selecting technologies and developing detailed processes.

Chris Mierzwa is Senior Director, Portfolio Marketing, at Commvault.