Veeam made Intelligent ResOps for Microsoft 365 generally available, adding AI agent discovery and file-level undo on top of its backups, with previews of Okta and Veeam Data Platform as well. The launch shows the Securiti AI integration reaching customers and raises a question for every vendor in the space: what agent rollback can and cannot undo.
What Is Covered in This Article:
- Veeam’s iResOps for Microsoft 365 is now generally available, discovering AI agents, mapping their access to sensitive data, and undoing their file changes.
- The launch brings Securiti AI technology to customers as an add-on, with previews of Okta and Veeam Data Platform to follow.
- Agents embedded in existing applications are the near-term exposure, and 54% of surveyed security decision-makers worry vendors are adding them without enough visibility.
- Rollback restores data, not decisions, since overlapping edits and actions outside the data store limit every vendor’s undo.
- With Okta recovery and agent rollback becoming table stakes, competition shifts to the context that decides what to restore.
The News: Veeam announced the general availability of Intelligent ResOps (iResOps) for Microsoft 365 at its VeeamON Global Launch event on October 15, 2026. Sold as an add-on to Veeam Data Cloud for Microsoft 365, it discovers Copilot and other AI agents in the tenant, maps the sensitive data each can reach, and lets teams review and undo agent changes file by file. It also identifies and quarantines redundant, obsolete, and trivial (ROT) data and flags gaps in backup coverage. The offering runs on the DataAI Command Graph, built on technology from Veeam’s acquisition of Securiti AI, which links production data to backup context.
Veeam also opened private previews of iResOps for Veeam Data Platform, tied to the v13.2 release expected later in Q4 2026, and for Okta, with immutable restore points across 29 object types and restores that preserve relationships such as group memberships and app assignments. Previews for GitHub, Azure DevOps, and Google IAM are planned for Q4. Separately, Arctic Wolf announced a partnership that feeds Veeam Data Platform security and operational events into its Aurora Superintelligence Platform.
Veeam Brings AI Agent Undo to Microsoft 365 With Intelligent ResOps
Analyst Take: For close to two decades, the core question in data resilience has been whether an organization can recover. Veeam’s argument with iResOps is that agentic AI changes the question to what changed, who or what changed it, and how to return to a known-good state without throwing away everything else. The company calls this a “recovery map” that sits alongside the familiar recovery point, which we feel is a useful way to put it.
The launch also answers a question we raised when Veeam agreed to acquire Securiti AI in October 2025: how quickly the two platforms would come together. The deal closed in December 2025, iResOps was first shown at VeeamON in May 2026, and the Microsoft 365 offering is now generally available as an add-on that customers connect without migrating data. That is a reasonable pace for an integration of this size, and selling it into the existing Veeam Data Cloud base plays to Veeam’s strengths.
Embedded Agents Are the Near-Term Exposure
Most organizations will not meet agents first as projects they build themselves. They will meet them as features within applications they already use, with Copilot in Microsoft 365 as the obvious example. In the Futurum 1H2026 Cybersecurity Decision-Makers Survey (N=929), 54% of respondents agreed they are concerned that existing software vendors are integrating autonomous AI agents into their products without sufficient visibility or security controls.
Mapping which agents can access which sensitive data is, at its core, the oversharing problem that data security posture management (DSPM) has been working on for years. Doing it from the backup side has a practical advantage, since Veeam already holds an indexed copy of the estate. Our advice to buyers is to treat discovery and oversharing as the first win, ahead of the undo button.
Rollback Restores Data, Not Decisions
Undoing an agent’s file changes works cleanly when the agent is the only one touching the file, and shared documents are rarely like that. If an agent edits a document and a colleague then edits it on top of it, restoring the pre-agent version also discards the colleague’s work. Reverting only the agent’s edits becomes a merge problem, one that Office file formats do not handle the way code repositories do.
Veeam’s Okta materials state that legitimate changes made since a restore point remain intact, which is plausible for structured identity objects. For documents, we would want to see how overlapping edits are handled in practice.
The harder boundary is anything an agent does outside the data store: a record written to another system, an email sent, a ticket another workflow has already acted on. A backup can restore state, but it cannot undo an action; in those cases, compensating steps are needed rather than a restore. That is not specific to Veeam; it applies to every vendor marketing agent rollback.
Precise undo also depends on knowing which agent acted and on whose behalf, which makes it as much an authorization question as a recovery one. In the same survey, 55% agreed that, despite having AI usage policies, they lack the technical ability to detect or contain a compromised AI agent operating at machine speed. Recovery tooling helps after the fact, but it does not replace the authorization record that enables a targeted undo.
Identity Recovery and Agent Rollback Are Becoming Table Stakes
The Okta preview addresses a real need, since Okta itself offers no native way to restore a deleted user or group, or to roll a tenant back to an earlier configuration. Veeam is not alone here, though. Rubrik, Commvault, Cohesity, Druva, Keepit, and HYCU, among others, have already announced Okta backup and recovery, and several have added agent rollback as well. Veeam’s Okta coverage is still in preview, and its GitHub coverage is planned for later this quarter.
To us, that shifts the competitive question away from whether a vendor can restore and toward how much context it provides for deciding what to restore. That is where the Securiti graph becomes Veeam’s central bet. Microsoft’s native Microsoft 365 Backup also sets a floor for basic restore, which pushes every third-party vendor to compete on intelligence rather than on copies.
Who Owns the Recovery Map?
The add-on model keeps the sale inside Veeam’s backup install base and its service provider channel, which should help adoption. The questions iResOps answers about agent access, sensitive data, and oversharing, however, mostly belong to security and AI governance teams rather than backup administrators.
The same-day Arctic Wolf partnership, which sends backup events into a security operations platform, points in the same direction. How well Veeam gets the recovery map in front of those teams is likely to matter as much as the technology itself.
What to Watch:
- How will agent rollback handle overlapping changes? Every vendor offering agent undo faces the same problem when agents and people edit the same content, and buyers should ask how selective reversal works in practice.
- When does coverage reach beyond files? Agent activity in Exchange, Teams messages, and line-of-business applications is where much of the harder undo work sits, and where compensating actions may matter more than restores.
- Who will buy and operate the recovery map? Adoption depends on whether security and AI governance teams use iResOps, not only the backup administrators who already run Veeam.
- How quickly do the previews reach general availability? The Okta and Veeam Data Platform previews compete with identity recovery offerings that several peers already sell, so the timing of general availability will matter.
- Does the Arctic Wolf integration go beyond event feeds? Both companies point to future work on exposure management and automated recovery, which would make backup data a more active part of security operations.
For more information, read the full announcement from Veeam. Read the Arctic Wolf and Veeam partnership announcement.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
Qodo v3.1: Governing AI Code Review Before Noise Kills Adoption
Tieto’s 2025 Annual Report: Governance Meets a $344B SLE Opportunity
Ikusi’s Triple Certification Signals Compliance-Ready Managed Services
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
