Security does not end at the edge of an organization’s own systems. Modern businesses connect a growing web of third-party applications to their core platforms to support sales, service, and collaboration. Each of these connections adds value. Each one also introduces exposure the organization does not fully control.That risk is not hypothetical. In June 2026, a threat actor compromised OAuth tokens tied to Klue, a competitive intelligence platform used to sync sales and marketing data with Salesforce. The attacker used those tokens to reach the Salesforce environments of the many organizations that had authorized the integration, including Commvault’s.As soon as we were notified of potential impact, our Security team activated our incident response process to determine what had occurred, contain the exposure, and assess whether customer information or Commvault services were affected.Our investigation found that the activity was limited to certain business relationship and sales information maintained within our Salesforce environment. The investigation found no indication that any customer backup data, product data, product metadata, operational logs, or Commvault services were impacted.

Acting Quickly When It Matters

Our response followed established security incident response procedures built to contain risk quickly while supporting a thorough investigation. Once we were notified of the incident, we disabled the Klue integration, revoked the associated access, and worked with the appropriate parties to conduct a full assessment of what happened.Throughout the investigation, our teams worked to determine what information had been accessed, validate the integrity of our environment, and confirm the incident stayed within the scope we had already contained.

A Pattern Worth Noting

This incident is one recent example of a pattern security teams have watched grow for several years: attackers targeting third-party applications connected to core business systems rather than attacking those systems directly. A single compromised integration can offer a trusted path into the environments of many downstream organizations at once, often with less resistance than a direct attack on any one of them.This shifts where an organization’s defense actually has to live. Strong internal controls remain necessary, but they are no longer sufficient by themselves. They have to be paired with active oversight of every application an organization connects, and a response capability that is ready before an incident, not built during one.

Building Resilience Beyond Our Own Environment

At Commvault, our security program includes ongoing assessment of the third-party applications connected to our environment. We review connected applications on a regular basis, evaluate the access each one holds, monitor for emerging risk, and reassess those integrations as business needs and the threat landscape change. When circumstances warrant, we act to reduce exposure and strengthen our posture, including disconnecting integrations that no longer meet our standards.

Our Commitment to Transparency

Trust is built through openness and accountability. When an event affects our stakeholders, we believe it is important to communicate what we know, explain how we responded, and share the outcome of our investigation, even when the event originated outside our own systems.We will continue to evaluate our security controls, refine our incident response processes, and strengthen our approach to third-party risk as part of our broader commitment to protecting our customers and partners.For the official details of this incident, including the scope of the investigation and customer guidance, please refer to ourTrust Center Updates.Will Galway is Deputy CISO at Commvault.

Durante anos,a criptografia pós-quântica (PQC) sat comfortably in the category of “important, but not urgent.”

Security leaders knew it was coming. Researchers talked about it. Standards bodies worked on it. Most organizations acknowledged that it would eventually require attention. But I would argue that the time to start preparing is now.
In this episode of STRIVE, I sat down with Sr. Director of Portfolio Marketing Michael Fasulo to discuss why the conversation around PQC is changing so quickly – and why the organizations that wait for certainty may find themselves running out of time.
Watch the episódio completo.

Pontos principais

• Harvest Now, Decrypt Later attacks mean sensitive data is already at risk, even if quantum capabilities aren’t stable or commercially viable yet.
• A maioria das organizações não tem uma visão completa de seu inventário criptográfico, o que torna a identificação desses dados o primeiro grande obstáculo.
• A PQC é tanto um desafio tecnológico a ser resolvido quanto uma questão de priorização de riscos.
• As organizações que começarem a se preparar agora terão mais opções para ajustar suas prioridades do que aquelas que forem forçadas a reagir mais tarde.

The Problem Isn’t the Technology

Most discussions about a criptografia pós-quântica start with technology.

• Com que rapidez a computação quântica está avançando?
• Quando os sistemas quânticos relevantes para a criptografia se tornarão viáveis?
• Quais algoritmos provavelmente sobreviverão a longo prazo?

Those are important questions. But they’re not the questions I would prioritize asking. Michael wrote a post no ano passado about PQC and we discussed today how several things have changed since then.
Over the past several years, estimates have consistently moved in one direction: what once felt distant now feels increasingly close. At the same time, standards are evolving; regulatory expectations are increasing, and organizations are beginning to recognize how much cryptographic debt they’ve accumulated over the decades.
The exact date of Q-Day may remain uncertain. The direction of travel is not.

The Risk está aqui e agora

One reason this conversation has become more urgent is the growing attention around Harvest Now, Decrypt Later attacks. The concept is straightforward: An adversary gains access to encrypted information today, stores it, and waits for future capabilities to make that information readable.
What’s important here is that the risk doesn’t begin when quantum computing arrives. The risk begins when even encrypted data is exfiltrated and stored.
For organizations protecting intellectual property, healthcare records, government information, or other sensitive long term retention data, that distinction changes everything.
Organizations need to know whether data being retained today will still matter when that future arrives.
For many,esp. the highly regulated industries and critical infrastructure, the answer is yes.

Prévia: Por que a agilidade em criptografia é importante

Embed clip here: https://www.youtube.com/watch?v=A3YWU5rlmGA

In this clip, Michael explains why PQC isn’t a one-time fix or switch. The real goal is crypto agility – building the flexibility to adapt cryptographic algorithms as standards, and threats evolve. Because in cybersecurity, the challenge isn’t just preparing for what’s next. It’s being ready for what comes after that.

A descoberta é o verdadeiro projeto

One misconception about PQC is that it’s primarily an encryption upgrade. In reality, most organizations haven’t reached the stage where replacement is the biggest concern.
They’re still trying to understand the scope of the problem. Cryptography exists everywhere.

• Aplicações
• Certificados
• Serviços em nuvem
• APIs
• Assinatura de código
• Plataformas de terceiros

Many organizations struggle with the creation of the cryptographic inventory or its scope. That makes discovery one of the most important – and often underestimated – parts of the journey.
And for many enterprises, that’s a much larger endeavor than expected.

O desafio da cadeia de suprimentos

Another reason PQC has become a priority is that no organization will navigate this transition alone. Modern enterprises depend on vendors, cloud providers, software partners, and countless third parties, all of whom use cryptography.
That means quantum readiness extends beyond internal systems. It becomes a question of ecosystem readiness.

• Os fornecedores estão se preparando?
• Os fornecedores essenciais estão planejando migrações?
• As plataformas de terceiros estão alinhadas com os padrões emergentes?

These questions will increasingly become part of risk conversations, procurement discussions, and long-term technology planning. Because cryptography doesn’t stop at organizational boundaries. Neither does risk.

Por que essa conversa é importante

The most important takeaway from this discussion is that a criptografia pós-quântica is no longer a future technology challenge.
It’s becoming a present-day resilience conversation.
Organizations don’t need to panic and they don’t need to overhaul every system overnight. But they do need to begin, to make the best use of the time at their disposal for prepartion.
The organizations that navigate this transition successfully won’t necessarily be the ones with the most sophisticated cryptography. They’ll be the ones that started building understanding before certainty arrived.
And that’s often how resilience works.

Watch the Full Episode

There is plenty more that Michael and I explore in the episode that I didn’t capture above. Be sure to Assista agorapara obter insights sobre:

• Os maiores desafios que as organizações enfrentam ao iniciar sua jornada em PQC.
• O que os líderes devem priorizar hoje, incluindo algumas práticas recomendadas.
• A compreensão dos algoritmos MLKEM e da agilidade criptográfica.
• Considerações sobre infraestrutura para PQC.
• Como a Commvault está se preparando para esse futuro.

FAQs

Q: What is a criptografia pós-quântica (PQC)?
A: PQC refers to cryptographic algorithms designed to help remain secure against attacks from future quantum computers.
Q: What is Harvest Now, Decrypt Later?
A: It’s a strategy where attackers collect encrypted data today with the intention of decrypting it later when more advanced computing capabilities become available.
Q: Why are organizations focusing on PQC now?
A: Because preparation takes years, and sensitive data collected today may still be valuable when quantum threats become practical.
Q: What is the biggest challenge organizations face?
A: Discovery. Most organizations do not have complete visibility into where cryptography is used across their environments.
Q: Do organizations need to replace all cryptography immediately?
A: No. Most experts recommend starting with inventory, discovery, and prioritization before planning broader migrations.
Q: What should leaders do first?
A: Identify long-lived sensitive data, understand cryptographic dependencies, and begin building a roadmap for future transition.
 

Vidya Shankaran is Field CTO at Commvault.

To address mandates governing where their data is stored and used,many organizations think they can buy a sovereign cloud SKU from a hyperscaler and check the box. But this falls far short of what’s actually required – something they might discover only when a regulator asks them to demonstrate that a dataset never left a defined geography,that no foreign-jurisdiction personnel accessed it,and that they can recover it within 24 hours under incident conditions.

In a recent webinar,I joined Commvault GM Alex Zinin,who leads our digital sovereignty task force,along with Jakub Lewandowski,our associate general counsel for EMEA,and Pranay Ahlawat,our chief technology and AI officer,to examine what a complete approach to digital sovereignty needs to include and where most programs fall short.

See the full webinarand get the fullA soberania digital decifradareadiness report and implementation framework.

Pontos principais

• The EU Cloud Sovereignty Framework defines eight sovereignty objectives,only one of which concerns data location.
• Selecting a sovereign cloud region addresses where data lives,but not who can access it,under what legal authority,or whether you can recover it under real conditions.
• A complete sovereignty posture spans four interdependent pillars: data locality,technological sovereignty,operational sovereignty,and jurisdictional sovereignty.
• Sovereignty programs that treat recovery architecture separately from primary data governance carry an unexamined risk that can surface during incidents.
• Rather than a policy of maximum sovereignty at any cost,organizations should design their strategy around minimum viable sovereignty: the right controls,consistently enforced,calibrated to actual obligations.

Digital Sovereignty Becomes an Enterprise Requirement

Over the past decade,the toughest digital and data sovereignty rules have mainly applied to government,defense,and other national‑security workloads. Outside of highly regulated sectors,many enterprises treated sovereignty principles as design guidance rather than a hard architectural constraint.

That’s now changing. GDPRenforcement has matured beyond guidance into substantial fines for operational failures,and newer regimes like“DORA,NIS2,Germany’s KRITIS rules,and the EU Data Act have tightened expectations around jurisdictional control and operational resilience.

Sovereignty questions are now surfacing in RFPs,M&A due diligence,and board‑level risk reviews as well.

The EU Cloud Sovereignty Framework,published in October 2025,clarifies what this scrutiny actually evaluates. Of its eight sovereignty objectives,only one addresses where data resides. The other seven cover access control,operational dependencies,jurisdictional exposure,and recovery.

For enterprises,this structure is now the lens through which vendor capabilities must be evaluated.

Sneak Peek: Rethinking Sovereignty and Resilience

In this moment from the webinar,Jakub discusses how sovereignty is a risk posture,rather than a single product. Organizations need a holistic strategy that combines architecture,operations,governance,auditability,and recovery planning to address it.

Data Residency Does Not Equal Sovereignty

Data residency only answers questions about where. Sovereignty regulations also require being able to explainwho,how,and under what conditions.

In practical terms,a complete sovereignty posture encompasses four interdependent pillars.

1. Data Locality

This pillar covers not just where data is stored,but where it travels. Control-plane artifacts,metadata,and telemetry can cross geographic boundaries even when primary data stays in-region.

2. Technological Sovereignty

This pillar addresses whether the organization controls the mechanisms that protect data:

• How access is granted.
• How data is encrypted.
• Whether encryption key custody is retained under all conditions.

A key concept here (pun intended) is the distinction between Bring Your Own Key (BYOK),where an organization’s own encryption keys are managed within the provider’s platform,and Hold Your Own Key (HYOK),where the organization retains independent custody of keys entirely outside the provider’s environment.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access under some circumstances.

3. Operational Sovereignty

This covers who operates the environment and from where,including whether support personnel or third-party vendors are subject to foreign jurisdiction.

4. Jurisdictional Sovereignty

This final pillar establishes the legal framework under which services are delivered and whether there are explicit protections against extraterritorial access,such as the cross-border situations discussed in the U.S. CLOUD Act.

Each of these pillars is essential to maintain compliance. A strong data locality posture with weak operational controls can allow unexamined risk.

Where Digital Sovereignty Programs Break Down

My experiences in the field have revealed a recurring pattern: When sovereignty becomes a technical conversation,it gets too narrow,too quickly. Workshops zoom in on where data lives,teams get to work on that one question,and then they move on,leaving the other three pillars largely unexamined.

Structural problems also come into play. Digital sovereignty needs to be treated as an ongoing program with legal,technical,and operational stakeholders,not as an IT project that gets checked off as complete.

Organizations can also be led astray by a few myths. One,as we’ve discussed,is the impression that sovereignty equals residency.

Then there’s the myth of absolute sovereignty,the idea that you can achieve complete independence from all external jurisdictions and dependencies. In practice,sovereignty always involves tradeoffs between control,cost,technological velocity,and the ability to innovate.

The goal should be to strike the right balance between independence from foreign jurisdictions and the requirements of your business. It’s also important to understand that sovereignty isn’t a product you can buy,but a risk posture built from architecture,operations,contracts,certifications,and continuous auditability.

Resilience Belongs Inside the Sovereignty Boundary

Operational sovereignty is thehardest pillar to audit and the one most commonly underestimated. If your environment needed access for routine maintenance tonight,who would perform it,from which country,and under which legal jurisdiction?

Most organizations,when they work through that question for the first time,find at least one support pathway that crosses a jurisdiction boundary they hadn’t mapped.

This gap becomes most consequential during recovery. Most sovereignty programs govern primary data environments but treat backup infrastructure,restoration sequencing,and recovery point management under a separate – and often weaker – set of controls. When an incident occurs,recovery personnel may not meet jurisdictional requirements,and the sovereign architecture designed to protect data can actively complicate restoration if resilience wasn’t designed in from the start.

Commvault’s resilience operations model,ResOps™,addresses this need directly by framing recovery as an ongoing operational discipline that needs to be designed,tested,and validated inside the same sovereignty boundary as the data it protects.

Minimum Viable Sovereignty: The Right Level of Control,Not the Maximum

An absolutist approach to digital sovereignty can tax resources while unnecessarily restricting a company’s ability to meet its business goals.

A payroll system,a customer transaction database,and an internal HR tool don’t carry the same sovereignty obligations. Taking a binary approach to compliance can lead to either under-investing where it matters or over-investing beyond what’s actually required.

Minimum viable sovereignty sets a more practical target: the right controls,consistently enforced and continuously demonstrated,calibrated to what each workload actually requires across all four pillars.

Organizations have a broad range of options for how sovereign controls are delivered across their environment,each providing different controls.

How Commvault Is Addressing the Digital Sovereignty Issue

Commvault’s Geo Shield framework is designed to help organizations navigate that spectrum. Rather than offering a single sovereign SKU,Geo Shield maps to the full spectrum of deployment models:

• Regional sovereign cloud services delivered as SaaS
• Hyperscaler sovereign-launch partnerships
• Partner-operated national sovereign offerings built with local service providers
• Fully customer-controlled private sovereign environments qualifying under frameworks likeFedRAMP High.

In this way,organizations can achieve a digital sovereignty posture that holds up in real-world conditions – even when an incident occurs.

Watch the Full Webinar and Get the Readiness Report

In the full webinar,available on demand,you’ll discover:

• Why digital sovereignty is more than a technology solution.
• The role of architecture and operations in sovereignty strategy.
• How governance,contracts,and auditability impact resilience.
• Why sovereignty must hold up during cyber incidents and outages.
• The importance of a holistic,risk-based approach to sovereignty.

Assista ao webinarand get the fullA soberania digital decifradareadiness report and companion framework.

Perguntas frequentes

Q: What is the difference between data residency and digital sovereignty?

A: Data residency addresses where data is physically stored. Digital sovereignty is broader: it addresses who can access data,under what legal authority,through which operational pathways,and whether it can be recovered cleanly under real conditions.

An organization can have data residing in the right country while remaining exposed to foreign jurisdiction through its support personnel,vendor access agreements,or backup infrastructure. Residency is the starting condition; sovereignty is the full posture built on top of it.

Q: What is the EU Cloud Sovereignty Framework,and why does it matter?

A: TheEU Cloud Sovereignty Frameworkis a structured assessment tool developed by the European Commission to evaluate cloud and technology providers against sovereignty criteria during procurement processes.

It defines eight sovereignty objectives,with assurance levels ranging from zero to four for each. Only one of the eight objectives addresses data location; the rest cover operational controls,key custody,jurisdictional exposure,and recovery.

The framework represents the most comprehensive public framework for evaluating sovereignty posture and is increasingly being used as a reference by other regions and procurement bodies beyond the EU.

Q: What is the difference between BYOK and HYOK,and why does it matter for sovereignty?

A: Bring Your Own Key (BYOK) allows an organization to supply its own encryption keys,but those keys are typically managed within the provider’s platform. Hold Your Own Key (HYOK) means the organization retains independent custody of keys entirely outside the provider’s environment,including under crisis conditions or legal compulsion.

For regulated organizations with strict sovereignty requirements,BYOK may not provide sufficient protection if a foreign legal authority can compel the provider to surrender key access. The U.S. CLOUD Act,for example,can reach providers operating under U.S. jurisdiction regardless of where data is physically stored.

HYOK addresses that exposure directly,though it may require a higher platform tier in SaaS deployments.

Q: Why do most sovereignty strategies overlook operational sovereignty?

A: Operational sovereignty,covering who operates the environment and from where,is the hardest pillar to audit because it requires inventorying support contracts,vendor access agreements,and third-party dependencies across the full operational chain.

Most organizations start sovereignty programs focused on data location and encryption,which are more visible. Operational dependencies tend to surface only when explicitly audited or when an incident forces the question.

As a first step to evaluate operational sovereignty,you should identify every access pathway into your sovereign environment and the legal jurisdiction of each party with that access.

Q: How should organizations think about recovery in the context of sovereignty?

A: Recovery architecture needs to meet the same sovereignty requirements as primary data environments,but it often doesn’t. In most organizations,backup infrastructure,restoration sequencing,and recovery point management are frequently governed by a separate set of controls,or none at all.

During an incident,the personnel authorized to execute recovery may not meet jurisdictional requirements,recovery points may not have been validated as clean and uncompromised,and the sovereign architecture designed to protect data can actively complicate recovery if resilience wasn’t built into the original design. A sovereignty review should always include recovery planning.

Q: What does minimum viable sovereignty mean in practice?

A: Minimum viable sovereignty means identifying the right level of control for each workload,calibrated to actual regulatory obligations,risk tolerance,and operational constraints,rather than applying maximum controls uniformly.

Maximum sovereignty comes with real tradeoffs: technological complexity,operational burden,service limitations,and cost. Organizations that define requirements by workload across the four pillars,map those requirements to deployment models,and build evidence of consistent enforcement are in a far stronger position than those pursuing all-or-nothing approaches.

Q: What role do certifications like C5,SecNumCloud,and ISO 27001 play in a sovereignty strategy?

A: Certifications help provide auditable evidence that controls have been independently verified,an important part of any defensible sovereignty posture. C5 in Germany,SecNumCloud in France,and ISO/IEC 27001each establish baseline requirements that providers must demonstrate through independent audits.

The strongest sovereignty postures treat these certifications as a floor,providing necessary evidence that controls exist,but not a substitute for operational testing under realistic conditions.

Darren Thomson is Vice President and Chief Technology Officer,EMEA,at Commvault. Be sure to catch him in the podcast series, STRIVE.

Pontos principais

• A utilização de várias ferramentas de backup costuma criar dependências operacionais em relação a um pequeno número de especialistas, aumentando o risco organizacional.
• Gerenciar a proteção por meio de consoles, políticas e sistemas de relatórios distintos dificulta a manutenção da visibilidade e a resposta rápida a problemas.
• A consolidação não precisa necessariamente significar um projeto disruptivo de substituição total; muitas organizações podem se modernizar gradualmente, mantendo os investimentos já realizados em infraestrutura.
• Um plano de controle unificado pode ajudar a simplificar o gerenciamento de políticas, o monitoramento, a auditoria e as operações de recuperação em ambientes híbridos.
• As organizações que simplificam o processo de backup costumam obter economias significativas, ao mesmo tempo em que contribuem para melhorar a eficiência operacional e a resiliência.

You didn’t build a messy environment. You built a functional one.

Each tool in your backup stack solved a real problem when you added it. One handled virtual machines. Another covered cloud workloads. A third came in when the business moved to SaaS. You made smart calls with the budget and the vendors you had. The environment works.

The stack isn’t the problem. It’s the operational model that comes with it.

Today, it’s not uncommon for a data center team managing legacy backup infrastructure to run seven or more separate systems. Seven sets of policies. Seven consoles. Seven renewal cycles.

And, in the background, they also get seven single points of failure: not in the infrastructure, but in the people. Because somewhere in your organization, there are one or two engineers who know how each of these systems behaves. When something breaks at 2 a.m., you know exactly who’s getting the call.

That’s not resilience. That’s dependency masquerading as expertise.

A Parede do Painel

Here’s a question worth sitting with: How long does it take your team to answer a simple question like “Did last night’s backup run clean across all workloads?”

If the answer involves opening more than one console, you already know the problem. Each tool has its own view of the world. Each one reports on what it protects, in its own format, on its own schedule.

Stitching that picture together – across on-premises systems, cloud workloads, and remote locations – takes time your team doesn’t have and creates gaps that only show up when something goes wrong.

The scripts help. Your team probably wrote them. But scripts that bridge what tools don’t natively share are technical debt with a support contract. They work until they don’t, and when they don’t, the fix requires the person who wrote them.

And if you want to do this across AI-dependent workloads using generated data … let’s just say you increased the degree-of-difficulty factor by 100% or more.

O que a consolidação realmente significa para as equipes de infraestrutura

The instinct when you hear “consolidate your backup environment” is to picture a rip-and-replace project with new hardware, new procurement, and a migration that takes six months while landing at the worst possible time.

But that’s not what consolidation has to look like.

The right platform works with the storage already in your rack. It doesn’t require you to throw out contracts you negotiated or hardware you haven’t depreciated. You can start where it makes sense – remote offices, a specific cloud workload, a dataset that’s been a problem – and expand as old contracts run out and budget frees up.

What you get in return is a single control plane. One place to set policy, monitor protection, and answer the auditor’s question. One operating model that works across on-premises, cloud, and hybrid workloads without a script to bridge the gap.

The engineers who were keeping seven dashboards cobbled together through scripts and custom executables start doing something more useful instead.

A prova está nos números

Fortune Brands consolidated its backup environment with Commvault® Cloud and economizou US$ 22,7 milhões – a 73% reduction in total cost. NTT-Netmagic reduziu os custos em US$ 300 mil por ano and cut storage overhead by 35%.

Those aren’t modernization-project numbers. They’re operational-relief numbers. The kind that come from stopping the compounding cost of complexity – not from buying new things.

Real Resilience Doesn’t Need a War Room

If running a recovery drill requires assembling a team of specialists who each know one piece of the environment, that’s not a drill. That’s a liability.

Real resilience means any qualified engineer on your team can execute recovery. It means one set of policies, one control plane, and a recovery process that doesn’t fall apart when the person who built it is on vacation.

Seven dashboards can protect your data. They can’t protect your team from the operational weight of keeping them running.

That’s the case for consolidation. Not a better product. A better way to run what you’ve built.

Want the full picture? Download “O custo oculto das sete ferramentas” – a field guide for data center teams who built something worth protecting.

Perguntas frequentes

Q: Why is managing multiple backup platforms a problem if they’re all working?

A: The challenge isn’t usually whether the tools function individually – it’s the operational burden of managing them together. Multiple consoles, policies, and reporting systems can make visibility, troubleshooting, and recovery more complex than they need to be.

Q: What is one of the biggest risks created by a fragmented backup environment?

A: In many organizations, critical knowledge becomes concentrated in a few individuals who understand how specific systems interact. If those team members are unavailable during an incident, recovery efforts can become slower and more difficult.

Q: Does consolidation mean replacing all existing infrastructure?

A: Not necessarily. Many consolidation initiatives are phased approaches that work alongside existing storage, hardware, and contracts. Teams can modernize gradually based on business priorities, budget cycles, and contract renewals.

Q: How can consolidation improve resilience?

A: A unified platform can help provide consistent policies, centralized visibility, and streamlined recovery processes. This helps enable more team members to confidently execute recovery procedures without relying on specialized knowledge tied to individual tools.

Q: What about vendor lock-in when consolidating to a single platform?

A: Vendor lock-in is a valid consideration. The goal of consolidation should be to help reduce operational complexity while maintaining flexibility through open architectures, broad workload support, and the ability to leverage existing infrastructure investments where possible.

Q: How do organizations measure the value of consolidation?

A: Beyond software costs, organizations often evaluate factors such as administrative overhead, recovery efficiency, storage utilization, training requirements, audit readiness, and the reduction of operational risk. The greatest value frequently comes from simplifying day-to-day operations and improving recovery confidence.

Michael Thelander is Senior Director, Product Marketing, at Commvault.

Pontos principais

• Regulatory pressure, board expectations, and real-world conflict are accelerating the shift from prevention-focused spending to resilience outcomes.
• The architecture of resilience has grown significantly more complex, especially as AI systems introduce new data lineage and recovery challenges.
• Cyber resilience must eclipse traditional disaster recovery and treat disruption as a continuous operating condition rather than an exceptional event.
• Resilience operations (ResOps™) provides an operating model for making resilience continuous, cross-functional, and demonstrable under actual conditions.
• The hardest part of the transition to ResOps is organizational. Fragmented ownership and misaligned priorities remain the most common failure modes.

Disruptions have become business as usual. Over the past year alone, we’ve seen:

• Drone strikes on data centers in the UAE and Bahraincaused cascading problems across the organizations storing data and workloads there.
• UmDNS misconfiguration by a hyperscalerknocked out internet access for millions of US users.
• Umfire at a data center caused intermittent failures for tens of thousands of a top social media platform’s users for an entire day.

When the operating environment is inherently uncertain, CISOs and CIOs need to rethink their approach to business continuity.Em um webinar recente, David Nowak, principal at Deloitte’s Cyber Risk Service; Kent Meyer, managing director at Deloitte; and Shilpi Handa, IDC’s associate research director for cybersecurity in the METUmregion, joined me to discuss what operational resilience actually demands in strategy, in architecture, and in day-to-day operations.

Sneak Peek: It’s No Longer a Matter of If, but When

In this clip from the webinar, you’ll hear why outages are no longer just IT events – they are business events. Boards and regulators are now shifting focus from if an outage occurs to how quickly organizations can recover.

Why Disaster Recovery Isn’t Enough

Per NIST’s definition, cyber resilience goes beyond traditional security by assuming breaches will happen and focusing on survival and rapid recovery, not just prevention. This assume-breach framing has been part of zero trust for years, but how many organizations are actually putting its implications into practice?

Backup operations focus on whether data has been copied, and disaster recovery on whether systems can be restored, but true resilience demands that you answer a much harder question: Can these services be restored end to end, under stress, and continuously?

We’re seeing this mindset take hold across all sectors, driven by a combination of regulatory pressure and board-level expectations.

• In Europe, the EU’s Digital Operational Resilience Act (DORA) now mandates specific resilience outcomes and recovery timelines.
• The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection regulations are undergoing a resilience lens as well.
• Securities and Exchange Commission (SEC) breach reporting requirements have put a spotlight not just on disclosure but on what organizations are doing to recover.

Boards now treat any outage as a business harm event, and the expectation has shifted to demonstrating not just that recovery is possible, but that it can happen quickly, with high confidence.
IDC research by Handa illustrates the way traditional recovery operations can fall short. Following the outbreak of war in the Middle East, she found CIOs and CISOs struggling with the continuity not only of technology, but also of people and processes as staff relocate overnight and offices become inaccessible, leaving no one to run manual failover.
And this is just one of the countless unpredictable scenarios organizations need to account for.

Building the Architecture of Resilience

Umresilience strategy encompasses both what you protect and whether you can recover it. On the former count, the scope of what needs to be protected has expanded steadily, including identity systems, communication platforms, workloads, productivity tools, CI/CD pipelines, and structured and unstructured data.
The latter point – “whether you can recover it” – creates the new requirements for that strategy. It’s not enough to capture point-in-time snapshots and define traditional recovery objectives. As adversaries target backup infrastructure, organizations must now examine recovered data and confirm that it’s free of compromise before bringing it back online. Isolated recovery environments, air-gap protection for critical services, and cleanroom capabilities have become essential components of resilience architecture.
AI introduces a new layer of difficulty. To recover an AI model, you’ll need not just a backup of the model file itself, but everything that went into creating it. This includes its datasets, hyperparameters, framework versions, feature engineering, and infrastructure configurations, as well as a complete dependency map showing how it all fits together.
Meyer frames cyber resilience solutions as a way to democratize disaster recovery. Whereas traditional disaster recovery was siloed inside IT and accessible only to specialists, newer platforms can give security operations teams, business owners, and operations staff the visibility they need to engage.
That matters for organizations with constrained resources, and it changes what’s possible in terms of moving from tabletop exercises to real, demonstrable restores.

ResOps: The Operating Model for Sustainable Resilience

ResOps treats resilience as a continuous function, not just something that happens in response to an incident.
In simple terms, it’s about operationalizing resilience when normal operating assumptions no longer hold. Instead of taking for granted that your backups will be available, clean, and restorable when disaster strikes, with ResOps you’re continually discovering where data lives, protecting and capturing it across on-premises and cloud environments, detecting anomalies, recovering to a trusted state, and restoring workloads that have been fully validated. That way, you’re increasingly ready for a disruption, and more confident that you’ll be able to get through it successfully.
Nowak offers a phrase that captures the essence of ResOps: resilient by design. It’s the successor to the secure-by-design principle that shaped the last generation of security architecture. Beyond building systems that resist compromise, we’re now building systems that can continue functioning when compromise occurs.

The Human Side of ResOps

Adopting ResOps is at least as much about people and process as it is about technology. As Handa notes, organizations don’t typically fail because they lack the right tools; they fail because ownership is fragmented across too many roles, with no shared operating rhythm and no clear decision rights when things go wrong.
ResOps forces organizations to answer questions many haven’t yet worked through, such as:

• Who has the authority to restore services if the primary team is unavailable?
• How should remote execution playbooks be structured?
• How will cross-regional failover work when it can’t depend on a single location?

In that sense, ResOps is less about restoring systems and more about enabling the continuity of decision-making, execution, and accountability under disruption.
To this end, many organizations have created a chief resilience officer title, particularly in state and local government. Whether filled by the CISO, the CIO, or someone new, the emergence of this role reflects broad accountability beyond IT. It requires an owner with the cross-functional authority and communication skills to bring business leaders, security teams, and operations staff into a shared operating rhythm.
The role also includes translating the case for resilience into terms that resonate across stakeholders, including monetary impact for the board, operational continuity for practitioners, and regulatory compliance for GRC teams. The goal is a decision-rights framework that’s been tested in simulations before it’s needed in an incident.

Putting It All Into Practice

Commvault helps organizations put ResOps into practice, from discovering and protecting data across on-premises and cloud environments, to detecting anomalies, recovering to a clean state, and restoring validated workloads. For organizations working to move from tabletop exercises to demonstrable restores, these are the capabilities that help make resilience operational in uncertain times.
Resources from the session, including IDC research on CIO readiness and Deloitte materials on evidence-based recovery, are available through theon-demand page.

Perguntas frequentes

Q: What is cyber resilience and how is it different from disaster recovery?

A: Disaster recovery focuses on restoring systems and data after an incident. Cyber resilience is a broader, more active posture: It assumes disruptions will occur and asks whether services can be restored end to end, under stress, on a regular basis. Many organizations have strong disaster recovery plans that nevertheless leave them exposed when a real incident unfolds under unexpected conditions.

Q: What’s driving organizations to prioritize resilience over prevention?

A: Regulatory frameworks like DORUmand evolving NERC standards now mandate specific resilience outcomes, not just security controls. As a result, boards are focusing on recovery timelines as a business metric.

Q: What makes AI systems harder to back up and recover than traditional data?

A: Backing up an AI model means capturing more than the model file itself. Ummodel is the product of a specific training process involving datasets, hyperparameters, framework versions, and infrastructure configurations. Without that full context, recovery may produce something that can’t be trusted or reproduced.

Q: What is ResOps, and how does it differ from a traditional resilience program?

A: ResOps is an operating model that treats resilience as a continuous, cross-functional discipline rather than a contingency plan. Where traditional programs tend to be siloed in IT and activated after an incident, ResOps brings together security, operations, business owners, and leadership around shared playbooks, clear decision rights, and ongoing validation of recovery readiness.

Q: What are the biggest obstacles to adopting ResOps at scale?

A: The challenges are organizational, including fragmented ownership, misaligned priorities, and the absence of a shared operating rhythm. ResOps requires agreement – before an incident occurs – between security operations teams, business owners, and operations staff on what’s critical, who’s responsible, and how recovery will be validated.

Michael Thelander is Senior Director, Product Marketing at Commvault.

Pontos principais

• O Commvault AirGap é imutável por padrão, e os recursos de bloqueio WORM estão disponíveis para organizações com requisitos adicionais de conformidade e regulamentares.
• Claims that AirGap backups are not truly immutable are inaccurate and do not reflect the platform’s documented capabilities.
• O armazenamento com tecnologia WORM gera sobrecarga em todo o setor, mas a Commvault ajuda a minimizar esse impacto por meio de um gerenciamento eficiente de dados e de uma arquitetura cloud.
• O custo do armazenamento de backup vai além do consumo de capacidade e deve incluir despesas com infraestrutura, recursos de computação e operações.
• As organizações devem ajudar a validar a resiliência dos backups por meio de testes em condições reais, em vez de confiar nas alegações de marketing dos fornecedores.

Talvez você tenha se deparado recentemente com alegações de um concorrente sugerindo queCommvault AirGap (previously called Commvault Air Gap Protect) contains a critical security gap – that backups are not truly immutable, or that enabling WORM (Write Once, Read Many) lock results in two to three times higher storage costs.
Let us address this directly: These claims are inaccurate.

Suporte a bloqueios imutáveis e WORM no AirGap

AirGap is immutable by design, meaning that once data is written, it cannot be altered – a foundational capability that has been part of the platform since its initial release.
For organizations with regulatory or compliance requirements, Commvault also supports WORM lock capabilities in addition to immutability. These protections are available across  supported cloud storage targets, including:

• Amazon S3 Object Lock
• Microsoft Azure Blob immutability policies

These features are documented, rigorously tested, and actively used by customers in production environments today.
In our latest platform release, we further expanded WORM lock support within AirGap. This enhancement extends protection across both cloud and on-premises storage environments, delivering broader and more comprehensive coverage than many competing solutions.

Eficiência de armazenamento: compre o panorama geral

Across the industry, one fact remains consistent: WORM-enabled storage introduces some degree of overhead. Because WORM-locked data cannot be modified after it is written, systems have limited ability to optimize or reduce stored data over time. This is not unique to Commvault – it applies universally across vendors.
What differentiates Commvault is how efficiently this challenge is managed. Our platform helps support native cloud immutability (including S3 Object Lock and Azure immutability policies) and maintain an efficient storage overhead.
However, total cost of ownership (TCO) extends beyond storage overhead alone. Architectures that rely on always-on virtual appliances can introduce ongoing compute costs and operational complexity that compound over time.
By contrast, modern, cloud-native approaches prioritize:

• Gerenciamento eficiente de dados.
• Modelos de implantação flexíveis.
• Eliminação de dependências persistentes de infraestrutura.

These design principles can result in more predictable, scalable, and sustainable long-term costs.
Presenting this as a choice between insecure backups and excessive storage costs is misleading. It is a false dichotomy that should prompt careful evaluation of vendors making such claims.

Uma tendência crescente entre os clientes

Estamos observando um padrão claro: as organizações estão, cada vez mais, migrando para a Commvault após decidirem não renovar seus contratos com seus provedores anteriores. Entre os motivos mais comuns, podem estar:

• Limitações inesperadas à medida que os ambientes crescem.
• Limitações de desempenho associadas a arquiteturas baseadas em dispositivos.
• Aumento dos custos de infraestrutura e operacionais.
• Os preços de renovação são significativamente mais altos do que as condições da compra inicial.

These challenges are not isolated – they reflect a broader trend in the market. Customers are seeking solutions that offer flexibility, transparency, and long-term value, without hidden trade-offs.

Superando o ruído

In a market often shaped by aggressive claims and unclear comparisons, objective validation can be  critical. That is why we created the Get Real Challenge – a structured, no-cost assessment that enables you to evaluate backup and recovery solutions in a meaningful way.
Through this program, you can:

• Simular cenários reais de ataques cibernéticos.
• Teste os recursos de recuperação utilizando seus próprios dados e ambiente.
• Evaluate performance without vendor bias or staged demonstrations.

The result is a clear, evidence-based understanding of your organization’s resilience posture. If you want to determine how your backups would perform under real-world conditions, we would be happy to help you get started. Drop us an email at global-sdr@commvault.com.

Perguntas frequentes

Q: Is Commvault AirGap truly immutable?

A: AirGap is immutable by design, meaning backup data cannot be altered after it is written. This capability has been a core part of the platform since its initial release.

Q: Does AirGap support WORM lock protection?

A: AirGap helps support WORM lock capabilities across supported cloud storage platforms, including Amazon S3 Object Lock and Microsoft Azure Blob immutability policies. Recent enhancements also have helped expand protection across cloud and on-premises environments.

Q: Does enabling WORM lock significantly increase storage costs?

A: WORM-enabled storage creates some level of overhead regardless of the vendor because protected data cannot be modified after it is written. The more important question is how efficiently a platform manages that overhead and its overall impact on long-term costs.

Q: Why is total cost of ownership more important than storage overhead alone?

A: Storage efficiency is only one part of the equation. Organizations also should consider infrastructure requirements, compute costs, operational complexity, and scalability when evaluating the long-term cost of a backup solution.

Q: Why are some organizations moving away from appliance-based backup architectures?

A: As environments grow, organizations often look for solutions that offer greater flexibility, simpler operations, and more predictable costs. Cloud-native approaches can help eliminate dependencies on always-on infrastructure while enabling organizations to scale more efficiently.

Q: How can organizations validate their cyber resilience strategy?

A: The best way is typically through testing. Running realistic recovery exercises and cyberattack simulations enable organizations to understand how their backups will perform under real-world conditions and help identify gaps before an actual incident occurs.

Kash Ansari is Chief Customer Officer Americas at Commvault.

Pontos principais

• A resiliência cibernética depende tanto da tecnologia quanto da expertise dos profissionais responsáveis pela proteção e recuperação de sistemas críticos.
• O aprendizado contínuo ajuda as equipes de parceiros a se manterem atualizadas em relação às ameaças em constante evolução, aos ambientes híbridos e às melhores práticas de resiliência.
• A Commvault Readiverse Academy oferece treinamentos voltados para funções específicas, laboratórios práticos e certificações projetadas para desenvolver habilidades de resiliência cibernética aplicáveis na prática.
• Os clientes valorizam cada vez mais os parceiros capazes de oferecer orientação confiável, acelerar a preparação para a recuperação e maximizar os resultados em termos de resiliência.
• Investir em educação continuada ajuda a fortalecer as capacidades dos parceiros, gera confiança nos clientes e contribui para o crescimento dos negócios a longo prazo.

Organizations are facing increasing pressure to defend against sophisticated and ever-changing threats. But they also need to manage complex hybrid environments, enable rapid recovery, and maintain continuous operations. Technology plays a critical role – but it’s not enough on its own.

True resilience depends on the readiness, experience and ongoing development of the professionals designing, implementing and supporting these environments. As resilience operations continues to mature, trusted expertise has become a critical differentiator.

The Growing Importance of Continuous Learning

Cyber resilience environments are constantly evolving – from expanding hybrid infrastructures to increasingly advanced threats and rising recovery expectations.

For partner professionals across sales, consulting, engineering and support, staying current is no longer optional – it’s essential. Continuous learning helps teams:

• Fortalecer os conhecimentos especializados em resiliência cibernética.
• Desenvolva confiança nas conversas com os clientes.
• Mantenha-se atualizado com as tecnologias em constante evolução e as melhores práticas.
• Prepare-se para novas funções e oportunidades.

Whether supporting ransomware readiness, designing recovery strategies or navigating complex data environments, skilled professionals play a critical role in helping maintain resilience and operational continuity.

Building Expertise Across the Partner Ecosystem

At Commvault, we recognize that different partner roles require different skills and learning paths.

That’s why Readiverse Academy was created – offering role-based learning and outcome-focused certifications across sales, engineering, consulting, architecture and support. Beyond just certification, our courses provide practical expertise that drives real customer outcomes.

The Commvault Readiverse Academyoferece:

• Percursos de aprendizagem baseados em funções.
• Aprendizagem flexível e no seu próprio ritmo.
• Laboratórios práticos baseados em cenários.
• Certificações que comprovam a preparação para o mundo real.

Today, more than 10,000 active learners across the partner ecosystem are building their expertise through Readiverse Academy, reflecting the growing importance of cyber resilience skills across the industry.

Why Expertise Matters to Customers

Customers aren’t just investing in technology – they’re investing in outcomes.

They expect confidence in their ability to protect, manage, and recover systems when disruption occurs. They need trusted experts who can help reduce risk, accelerate recovery, and maximize the value of their investments.

Partners with continuously developing teams are better positioned to help:

• Acelerar as implantações.
• Alinhar as soluções às necessidades em constante evolução.
• Melhorar a prontidão operacional.
• Fortalecer a preparação para a recuperação.
• Enfrentar desafios complexos relacionados à resiliência.

As cyber resilience becomes mission-critical, expertise becomes a key differentiator.

Investing in the Future of Cyber Resilience

The cyber resilience landscape will continue to evolve – and so will customer expectations.

For partner professionals, continuous learning helps drive long-term growth, credibility, and readiness. For partners, it helps strengthen delivery and build trust. For customers, it helps enable better outcomes.

Explore the Commvault Readiverse Academy, and start building the expertise that sets your team apart – with role-based learning, hands-on training, and certifications designed for real-world impact.

Perguntas frequentes

Q: Why is technology alone not enough to achieve cyber resilience?
A: Technology provides the tools needed to protect and recover data, but successful cyber resilience also depends on the people using those tools. Skilled professionals are essential for helping design effective strategies, respond to threats, and enable rapid recovery when disruptions occur.

Q: What role does continuous learning play in cyber resilience?
A: Continuous learning helps professionals stay current with evolving cyber threats, changing technologies, and emerging best practices. It also helps build confidence in customer engagements and prepare teams to address increasingly complex resilience challenges.

Q: What is the Commvault Readiverse Academy?
A: Readiverse Academy is Commvault’s learning platform that offers role-based training, hands-on labs, flexible learning paths, and certifications. Its programs are designed to help sales, engineering, consulting, architecture, and support professionals develop practical cyber resilience expertise.

Q: How do customers benefit from working with highly trained partners?
A: Customers gain access to trusted experts who can help reduce risk, improve operational readiness, accelerate deployments, and strengthen recovery preparedness. This expertise helps organizations achieve better outcomes from their cyber resilience investments.

Q: Why are certifications important in the cyber resilience field?
A: Certifications help validate real-world knowledge and readiness, giving both partners and customers confidence in a professional’s capabilities. They also support career development and demonstrate a commitment to maintaining current expertise.

Q: How can partners prepare for the future of cyber resilience?
A: Partners can prepare by investing in ongoing education, developing role-specific expertise, and staying aligned with evolving resilience requirements. Building a culture of continuous learning helps teams remain effective as customer expectations and threat landscapes continue to evolve.

Thomas Kestner is Global Director Partner Solutions & Services Enablement, WW Education Services, at Commvault.