CommVault - Experts & Thought Leaders

Commvault, delivering continuous recovery for the AI era, announces new identity resilience capabilities that will help organisations discover changes across a wide range of identity environments, understand their Tier 0 exposure, and quickly remediate associated risks. Identity systems are a prime target for attackers because they can offer fast access to critical enterprise resources. With 80% of large enterprises using multiple identity providers, including Active Directory, Entra ID, and Okta, organisations face growing complexity across human and non-human identities, permissions, and policies. Critical identity systems Commvault’s latest capabilities give identity, IT, and security teams more awareness, control, and response capabilities that take identity resilience to the next level, including: Continuously detecting changes across identity providers: Cross-provider identity auditing will give administrators visibility into a broad range of changes affecting identities, permissions and the configurations that govern access across Active Directory, Entra ID, and Okta environments. Uncovering Tier 0 exposures: Identity attack intelligence capabilities will identify an organisation’s most privileged identity assets and reveal who has control over them. By having a complete view – a Tier 0 inventory – teams can uncover hidden risks that otherwise could give attackers control of critical identity systems. Guiding remediation and recovery: AI-guided recommendations help teams understand why exposure exists and how to address risky access, while supporting rollback of unwanted changes and recovery of trusted identity configurations. Critical identity infrastructure “Attackers don't need to compromise every system. They just need to compromise the identities that control them,” said Pranay Ahlawat, Chief Technology & AI Officer, Commvault. “As AI agents and non-human identities proliferate, this risk is only growing. Our goal is simple: help customers understand who controls their most critical identity infrastructure, identify dangerous changes, and restore trusted access when things go wrong.” “Identity threat detection and response leads identity security priorities and resilience ranks next, yet only 47% of organisations have a completed identity recovery plan,” says Emanuel Figueroa, Senior Research Analyst for Identity and Access Management Security, IDC. “Breaking the kill chain ends the attack, but not its aftermath: changed permissions, group memberships, policies, and trust relationships can persist after access is revoked. Access controls can’t by themselves return a directory to a verified state, so recovery is becoming a distinct buying criterion. Commvault’s extension of recovery across Active Directory, Entra ID, and Okta shows data-protection vendors are moving to meet it.” Identity attack intelligence Identity attack intelligence and cross-provider identity auditing are planned for early access in the coming quarters. They will be offered as part of Commvault IDRecover – a portfolio of innovations that help organisations uncover identity risk, monitor and detect suspicious changes, and rapidly restore trusted access when identity systems are compromised. Learn more about this announcement at SHIFT 2026, where attendees will explore the new rules of resilience in the age of AI and learn how recovery, visibility, and cyber resilience can help organisations adopt AI with confidence. SHIFT 2026 will be the boldest event in the company’s history, enabling attendees to explore and immerse themselves in the new rules of resilience – and it all starts with AI. You can register for your place here.

Commvault, a pioneer in unified resilience at enterprise scale, announces new data security and threat hunting capabilities for Microsoft 365. With more than 450 million paid commercial seats worldwide, Microsoft 365 is a popular cloud productivity and collaboration platform. Bad actors often target emails, attachments, and shared files associated with the SaaS application. Historical backup copies Commvault is helping Microsoft 365 customers advance resilience in the following ways: Discover sensitive data: Map where sensitive data, including personally identifiable information (PII) and intellectual property, resides across Microsoft 365 with Commvault Data Posture 360 (previously Risk Analysis) and surface exposure risks to help prioritise response. Hunt for hidden threats: Uncover malware, ransomware, encryption activity, data anomalies, and other indicators of compromise across protected Exchange, OneDrive, SharePoint, and Teams data with Commvault Threat Scan. Know what’s safe to restore: Use threat signals to isolate compromised content and identify clean, trusted recovery points. This helps recover only known-good data, reduce reinfection risk, and accelerate recovery of Microsoft 365 data. Broaden threat discovery: Apply current threat intelligence to historical backup copies in immutable storage to detect threats that may have been unknown or undetected when the data was originally protected. Informed recovery decisions “Commvault is bringing three key elements to the resilience equation with Microsoft 365: detection, visibility, and clean recoveries,” said Pranay Ahlawat, Chief Technology and AI Officer at Commvault. “Resilience and compliance depend on identifying threats fast, understanding if sensitive data is exposed, and what’s safe to restore.” “During a cyber incident, knowing what data can be safely restored is just as important as having a backup,” said Matt Pancheri, IT Manager and Systems Administrator, Spokane Industries. “Commvault gives our team a way to investigate our protected Microsoft 365 data and make more informed recovery decisions, helping limit disruption to the business.” Adopt AI with confidence “Alerting decision-makers to compromised data within Microsoft 365 backup offers both data security and data protection teams the information they need for improved resilience and continuity,” said Jennifer Glenn, Research Director for Information and Data Security, IDC. “This is essential for enterprises to prove operational data is both recoverable and trustworthy.” Threat Scan and Data Posture 360 for Microsoft 365 are both planned for early access preview in the coming weeks, with general availability targeted for early 2027. Both capabilities will be offered as paid add-ons to Commvault Backup & Recovery for Microsoft 365. Customers can purchase either capability independently. Learn more about this announcement at SHIFT 2026, where attendees will explore the new rules of resilience in the age of AI and learn how recovery, visibility, and cyber resilience can help organisations adopt AI with confidence. SHIFT 2026 will be the boldest event in the company’s history, enabling attendees to explore and immerse themselves in the new rules of resilience – and it all starts with AI.

Commvault, a pioneer in unified resilience at enterprise scale, today announced that it’s enabling IT and Security teams to discover, protect, and recover agent configurations and other AI data in Claude Cowork by Anthropic, Claude Code by Anthropic, and OpenClaw (agentic AI tools) that employees are running on their managed Windows and macOS devices. For workers and IT leaders, this can be a game-changing development. When a laptop is lost, damaged, replaced, or otherwise disrupted, organisations and employees – developers, marketers, and others – may not only lose files, but the agent configurations, accumulated AI context, and workflows they rely on to move critical projects forward. This could prove to be a devastating blow for employees and a productivity loss for organisations. AI-generated content Via this new capability, IT teams can identify instances of certain agentic AI tools installed across managed devices, protect agent configurations stored locally, and recover that protected information if a disruption occurs. This also gives employees a recovery path for their valuable work – including AI-generated content, prompt libraries, custom instructions, and tool-specific context. This capability is also useful for Security teams. It gives leaders a centralised view of supported AI tools installed across managed employee devices. If agentic AI tools are installed outside approved IT processes, teams can see where the tool is present and investigate. This gives organisations greater visibility into potential shadow AI. Potential shadow AI This is well-timed. According to IBM, 80% of surveyed U.S. office workers reported using AI in their roles, while only 22% relied exclusively on AI tools provided by their employers. The result is a growing mix of approved AI usage and shadow AI, creating new visibility, protection, and recovery challenges for IT and Security teams. “Most organisations cannot tell you which AI agents are running on their employees’ machines, let alone recover the work inside them,” said Pranay Ahlawat, Chief Technology and AI Officer, Commvault. “We give IT and Security visibility into where these AI tools are installed, and a recovery path for the context employees have built inside them.” Additional AI tools Discovery of OpenAI’s ChatGPT desktop app is available today. Discovery, protection, and recovery for supported local data associated with Claude Cowork, Claude Code, and OpenClaw will be generally available in the coming months. Customers can access these capabilities through Commvault’s existing endpoint protection offerings without a separate SKU or additional purchase. Support for additional AI tools is planned for future releases. This offering is part of AgentRecover, Commvault’s solution for enterprise AI environment recoverability – from AI tools and their data and configurations to the connected systems they rely on. Endpoint protection offerings This announcement underscores the company’s commitment to helping organisations embrace AI while strengthening resilience. At SHIFT 2026, attendees will explore the new rules of resilience in the age of AI and learn how recovery, visibility, and cyber resilience can help organisations adopt AI with confidence. SHIFT 2026 will be boldest in the company’s history, providing attendees with the opportunity to explore and immerse themselves in the new rules of resilience – and it all starts with AI. To attend live, register here.

Every day, millions of people worldwide use their personal credentials to prove their identity and access a range of services, from databases in their workplace to the banking app on their smartphone. But while this ensures only authorised people have access to certain systems, the use of this personal data opens users up to cyber risks, primarily in the form of identity theft. On Identity Management Day, Source Security spoke to seven IT and cybersecurity experts to discuss their experiences and advice on identity management, including James Brodhurst, Principal Consultant at Resistant AI, who reinforces that: “Securing identities is more important than ever, as fraud and identity theft has impacts for businesses as much as for individuals.” Effective identity management He recommends that businesses and other organisations that use consumer identities as an integral part of operations must address the significant challenges of managing identities and recognise that there is no single solution to all possible cyber threats. Effective identity management is only achieved through a broad range of technologies and data. Businesses have a critical role to play in mitigating cyber threats, as does society as a whole" This is an important first step for organisations to know who they are interacting with, and subsequently distinguish between genuine or illicit actions. “Businesses have a critical role to play in mitigating cyber threats, as does society as a whole. Initiatives such as Identity Management Day serve to increase our collective awareness of the issues and threats we’re facing, and also safeguard sensitive data.” External cyber defences “Why is identity theft so common?” ponders Andy Swift, Technical Director of Offensive Security at Six Degrees. “Well, the simple answer is stealing account credentials is big business. There is a massive industry out there of people stealing and selling credentials on the dark web. I don't suggest you venture to the marketplaces through which stolen credentials are sold on the dark web, but if you did you'd find lists of credentials with different attributes – whether they've been tested, whether they have access to financial data – that dictate price.” “Most stolen credentials are sold to people looking to launch phishing and onward phishing attacks, giving them access to compromised mailboxes to send emails from. Secondly, there are hackers who want to launch attacks – ransomware, more than likely – from within a network without having to navigate its external cyber defences while also evading the long wait for brute force attacks, phishing attacks and other noisy activities to pay off.” Access sensitive data Credential stuffing is one of the most common forms of attack and corporate credentials are usually the target" “And thirdly, there are people who want to simply target external administration interfaces they have identified (RDP for example) which they can in turn use to pivot through to internal networks, or even just target the external host directly.” Gregg Mearing, Chief Technology Officer at Node4, adds: “Credential stuffing is one of the most common forms of attack and corporate credentials are usually the target. In 2020 alone there were 193 billion credential stuffing attacks globally. Attacks commonly start with a database of stolen credentials, usually with usernames, emails and passwords – although phishing emails and suspicious websites are also used to steal corporate credentials. Once they have gained entry into the organisation's system, the attacker can move laterally, completely unnoticed, to access sensitive data, remove files or plant malware.” Most common threats “Despite the ubiquity of this style of attack and a wide understanding of the importance of password hygiene, 65% of people still reuse passwords across multiple accounts. There can be no doubt that employees are the first line of defence for an organisation against a cyber attack. If trained properly, they can act as a human firewall. However, poor cyber hygiene, a lack of best practice when it comes to managing credentials, and a limited understanding of the most common threats can make an organisation’s employees its greatest weakness.” Despite the ubiquity of this style of attack and a wide understanding of the importance of password hygiene" Alongside credential stuffing and phishing, Liad Bokovsky, Senior Director of Solutions Engineering at Axway, explains how API attacks are yet another way criminals are executing identity theft: “In fact, last year API attacks increased 348%, and companies affected included some of the largest corporations – Facebook, Instagram, and Microsoft.” Protecting customers’ data “Companies need to do a better job at protecting their customers’ data. In a recent survey, 82% of UK consumers confirmed they would stop doing business with a company if it suffered a data breach that exposed their personal information.” “Thriving and surviving in today’s hyper-connected economy increasingly depends on having sufficient API maturity in place to ensure that anything connecting to an organisation’s servers – devices, apps, customers – is managed appropriately to keep APIs, customer data and the company’s reputation safe. This means having technology and processes in place to make sure that API design, implementation, and management are done properly.” Owning smart devices This needs to change and with the UK no longer required to adhere to EU-GDPR legislation" Michael Queenan, CEO, and Co-Founder of Nephos Technologies, explains how the huge volumes of personal data being created every day are putting consumers at risk: “Whether shopping online, setting up a social media account or simply reading a news article, we are regularly being asked for our identifiable information. With 10% of UK homes now owning smart devices – e.g. an Alexa or a Ring doorbell – our data is constantly being collected, even within our own homes. Should it fall into the wrong hands, it could be used for identity theft or fraud.” “This needs to change and with the UK no longer required to adhere to EU-GDPR legislation, it presents an opportunity to rectify how personal data can be shared. Ultimately, I believe individuals should be responsible for their own data and how it is used.” Ensure data privacy “A possible way of achieving this is through identity-centric blockchain, whereby everyone has a national email address associated with their blockchain identity that permits access to their personal data. This would ensure that only you get to decide who has access – your data, your choice!” This would ensure that only you get to decide who has access – your data, your choice" Steve Young, UKI Sales Engineering Director at Commvault also comments on how identity management is vital for meeting data regulations, thereby supporting data management throughout the business: “In the world of data management, you’d be forgiven for thinking that the focus is all on backups and recovery. But while these are absolutely crucial elements, another key aspect of data management is identity management – only through understanding it will businesses be able to drive their data management to the next level. Identity management is necessary to ensure data privacy.” Latest data regulations “Many people will be most familiar with its function as a way to restrict access of employees to certain files and resources that may hold sensitive or classified information. But what is becoming more important today is how identity management also helps prevent cybercriminals entirely outside an organisation from gaining unauthorised access to a system and initiating a ransomware attack, for example. Because of this, identity management helps businesses be compliant with the latest data regulations, as it ensures that any customer data collected and stored is kept secure.” So, what solutions should IT leaders be prioritising to strengthen their identity management measures? Six Degrees’ Andy Swift recommends multi-factor authentication (MFA): “MFA provides great defence against identify theft, but it's also a reactive technology: for it to be effective, an attacker must already have obtained stolen credentials.” Cyber security training Credential-driven attacks are largely exacerbated by a ‘set it and forget it’ approach to identity management" “That's why comprehensive cyber security training and education on best practices is quite possibly more important than any technology could ever be alone. There's no silver bullet when it comes to achieving strong identity management, but the importance of threat awareness and training cannot be overstated.” “We advocate for the best practices that ensure cyber hygiene and protect personal and professional identities and credentials to prevent credential-based attacks from continuing,” concludes Tyler Farrar, CISO at Exabeam. “Credential-driven attacks are largely exacerbated by a ‘set it and forget it’ approach to identity management, but organisations must build a security stack that is consistently monitoring for potential compromise." "Organisations across industries can invest in data-driven behavioural analytics solutions to help detect malicious activity. These analytics tools can immediately flag when a legitimate user account is exhibiting anomalous behaviour indicative of credential theft, providing greater insights to SOC analysts about both the compromised and the malicious user, which results in a faster response time.”