Clean rooms, identity auditing and a “minimum viable company”: Christian Kubik explains how Commvault wants to shorten recovery after attacks, and what that means for DACH companies and partners.
Backup alone no longer answers the question that decides the aftermath of a ransomware attack: how quickly can a company work again? Commvault is responding by repositioning itself as a cyber resilience provider, with identities now at the centre of its roadmap. In an interview, Christian Kubik, Director Sales Engineering DACH @ Commvault, explained at it-sa trade fair in Nuremberg/Germany where the vendor sees the biggest gaps in DACH companies.
Resilience as a permanent cycle
AI-supported attacks do not have to hit an entire organisation to do damage, Kubik argues. Commvault therefore talks about “resilience operations” (ResOps) and a “minimum viable company”: the core of processes that must be restored first. Which parts belong to it, every company has to decide for itself. Resilience, he says, is a permanent cycle, because IT keeps changing and a one-off exercise does not work. Even a migration to Microsoft 365 alters recovery requirements.
Prevention helps only to a limited extent, according to Kubik. Attackers can buy access, use AI-generated phishing or log in after drive-by downloads. At the same time, identities are multiplying: he put the ratio of AI-agent identities to human ones at 144 to 1. In the classic case, data leaves a company in under a minute. Backup software cannot prevent that, but it can help analyse what happened.
Identities move into focus
Commvault is therefore broadening its platform. Auditing for Active Directory is generally available, Kubik says, with Entra ID, Okta and AI-supported insights to follow. The press release of 2 November spells out three building blocks: continuous detection of changes to identities, permissions and configurations across Active Directory, Entra ID and Okta; a “Tier 0” inventory that identifies the most privileged identity assets and shows who controls them; and AI-guided recommendations that explain why exposure exists, roll back unwanted changes and restore trusted identity configurations. Cross-provider auditing and identity attack intelligence are planned for early access in the coming quarters as part of Commvault IDRecover.
Pranay Ahlawat, Chief Technology & AI Officer, says attackers do not need to compromise every system; compromising the identities that control them is enough, and AI agents and non-human identities increase that risk. Commvault cites a Strata survey, according to which 80 percent of large enterprises use several identity providers. IDC analyst Emanuel Figueroa notes that only 47 percent of organisations have a completed identity recovery plan. Breaking the kill chain ends an attack but not its aftermath, he says: changed permissions, group memberships, policies and trust relationships can persist after access is revoked. Recovery is therefore becoming a distinct buying criterion.
Clean room with air gap
Commvault describes itself as the first vendor with a clean room offering. The initial focus was the cloud; with European demand for sovereignty, on-premises options with an air gap followed. Kubik names a firmware attack as the worst case. In Commvault Flex, data is pulled by replication from the untrusted network into the isolated environment and scanned for malware. Threat intelligence is integrated, as are tools from CrowdStrike, Palo Alto Networks, Microsoft Defender and Cisco; documented APIs are available for other security vendors.
Practice matters because complex landscapes cannot be restored by hand. Commvault assumes that large enterprises face 40 or more recoveries, with an average of 28 days, Kubik says. Applications often have to be rebuilt, not just restored, and dependencies between cloud and on-premises systems have to be resolved in the right order. Runbook-based automation for applications such as SAP, cloud workloads and on-premises dependencies, including coordinated DNS recovery, is meant to shorten this. Cyber insurance alone is not enough, he adds, pointing to a large UK carmaker whose supply chain was disrupted for months.
Regulation, sovereignty and channel
Commvault says it has many customers under DORA, which requires every recovery step to be documented. Reporting has been part of the product for 20 years, with custom reports and links to external systems; anomaly detection and threat scans feed a security dashboard. According to Kubik, end-to-end automation allows NIS2 and DORA requirements to be met, but testing remains necessary. A 50-terabyte file server, he notes, is a challenge amid the current storage price crisis, which makes efficient recovery planning a cost question as well.
On sovereignty, definitions differ, he says. Data sovereignty can be achieved in a company’s own data centre or a European cloud; process sovereignty is harder, as many internet processes run outside the EU. For many customers, a partnership with AWS or STACKIT and a local operator is sufficient. Commvault remains a US company.
In DACH, the vendor sells only through partners: the distributors ADN, TIM and Arrow, and partners such as SVA and Bechtle. SaaS is also available via cloud marketplaces. Partners build their own services, run projects with Commvault or have the vendor deliver end to end on request.
The numbers underline the direction. For the quarter ended 30 September, Commvault reports subscription revenue of 269 million US dollars, up 21 percent, of which SaaS accounts for 106 million dollars (plus 33 percent). Subscription ARR reached 1,104 million dollars, up 20 percent, and free cash flow was 71 million dollars. The company also points to a new Active Directory Pre Recover capability that is meant to cut clean recovery of the directory from hours to minutes. All figures are company statements.
Kubik likens the market to an arms race, like the Cold War: attackers and defenders keep escalating, and a single measure will not settle it. More will follow at Commvault SHIFT in Nashville/USA on 10 November.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de
My specific situation involves legacy systems that make rapid recovery impossible. A stricter security policy is necessary for those environments.