Analyst(s): Krista Case
Publication Date: June 25, 2025
Commvault, Kyndryl, and Pure Storage’s modular offering helps partners deliver audit-ready recovery and streamline compliance across hybrid cloud environments. It is designed to meet the demands of regulated industries facing mounting cyber and operational risks.
What is Covered in this Article:
- Commvault, Kyndryl, and Pure Storage announce a joint offering focused on recovery readiness and regulatory alignment.
- The integrated framework combines software, IT services, and high-speed storage into a layered recovery architecture.
- Specific capabilities include immutable vaults, forensic validation zones, and rapid dataset restoration across cloud and on-premises environments.
- Commvault Cleanroom Recovery supports compliance with DORA, NYDFS, and APRA CPS 230 frameworks.
The News: Commvault, Kyndryl, and Pure Storage have launched a new joint offering aimed at helping enterprises with cyber resilience and recovery and compliance across hybrid cloud infrastructures. The offering combines Commvault’s cyber resilience capabilities, Kyndryl’s service expertise, and Pure Storage’s data infrastructure into one unified system.
The offering is built around a four-layer modular design. It supports ongoing recovery testing and cleanroom validation, meeting standards like DORA, NIS2, and NYDFS. It was announced during the Pure//Accelerate Conference in Las Vegas in June 2025, and it is available across North America, Europe, and APAC.
Can Commvault, Kyndryl, and Pure Storage Help Simplify Recovery and Compliance?
Analyst Take: The collaboration between Commvault, Kyndryl, and Pure Storage brings together a host of technologies and services related to cyber recovery and resilience and compliance. It can be thought of as a toolset for verifiable and regulation-compliant cyber resilience strategies. The heavy emphasis on audit readiness, clean recovery, and data integrity, combined with its modular structure, is a strong play in the growing space for cyber-resilience services.
Layered Architecture Focuses on Practical Recovery
The four-part architecture (Cyber Resilient Vault, Clean Recovery Zone, Production Rapid Restore, and Immutable Snapshot Recovery) provides a structured framework for isolating, validating, and restoring data. Each layer plays an important role in the recovery process, and is designed to be consistent and easy to audit for alignment with standards such as ISO and NIST. IT teams can segregate compromised data from clean backups, reducing the risks of reinfection or corruption. The design makes execution easier while letting teams customize recovery based on what the business needs most.
Validation Tools Bridge IT Operations and Audit
Commvault Cleanroom Recovery introduces real-time testing capabilities often absent in legacy backup systems, enabling organizations to validate recovery processes in line with regulatory expectations. It supports testing in public cloud and Kyndryl-managed on-premises setups, giving teams more flexibility in how they verify their systems. These tools directly support rules under frameworks like DORA Chapters II and IV, letting companies prove they are ready. Built-in anomaly detection helps make sure that compromised data does not make its way back into production. This offering allows for a tested, documented, and important component of business continuity.
Empowering Partners to be Cyber-Resilience and Compliance Enablers
For partners such as MSPs, this offering opens the door to addressing growing demand for compliance and cyber-resilience. It includes tools for data classification, retention rules, and audit-ready reports, so partners can offer full packages that meet both security and regulation needs. Training, sales support, and partner resources from all three companies help partners get up and running faster. This shifts the conversation for MSPs from focusing on infrastructure to addressing crucial issues like managing cyber-risk and policies, which are board-level concerns and garnering growing shares of budgets. For example, in Futurum’s 1H25 Cybersecurity Decision Maker IQ research, nearly three-quarters of respondents indicated that they expect an increase in their cybersecurity budget over the next 12 months.
Designed with Regulated Industries in Mind
The offering clearly targets highly regulated sectors, including the financial services and utilities industries, where optimizing cyber-resilience and incident response is not optional. This is due to the sensitive nature of the data they handle, the criticality of their services, and the need to comply with regulations such as DORA, NYDFS, NYCRR 500, and APRA CPS 230, which require companies to prove they can recover safely and in a timely manner from cyberattacks. The combination of secure backups, staged validation, and rapid recovery provides a solid base to meet those demands, proving that organizations can execute on their recovery plans in accordance with specific recovery objectives. As compliance requirements tighten, structured offerings like this may become the new standard for regulated industries.
What to Watch:
- The extent to which MSPs standardize recovery and compliance services using the joint architecture.
- The degree to which DORA, NYDFS, and APRA CPS 230 enforcement drives demand for structured, audit-ready recovery frameworks.
- How service providers incorporate Cleanroom Recovery and validation tools into offerings positioned for regulated industries.
- Whether other vendors respond with similarly integrated offerings combining recovery, compliance, and audit readiness.
See the complete press release on the partnership between Commvault, Kyndryl, and Pure Storage on the Commvault website.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other insights from Futurum:
Commvault Q4 FY 2025: SaaS Momentum and Subscription Gains Drive Growth
Cyber Resilience Boosted: Commvault & CrowdStrike
Commvault Launches Cyber Recovery Range to Enable Real-World Recovery Practice
Author Information
Krista Case is Research Director, Cybersecurity & Resilience at The Futurum Group. She brings approximately 15 years of experience providing research and advisory services and creating thought leadership content. Her vantage point spans technology and vendor portfolio developments; customer buying behavior trends; and vendor ecosystems, go-to-market positioning, and business models. Her work has appeared in major publications including eWeek, TechTarget and The Register.
Prior to joining The Futurum Group, Krista led the data protection practice for Evaluator Group and the data center practice of analyst firm Technology Business Research. She also created articles, product analyses, and blogs on all things storage and data protection and management for analyst firm Storage Switzerland and led market intelligence initiatives for media company TechTarget.
