Rehearsed recovery and agent rollback led SHIFT 2026, raising a harder question: what recovery means once agents act on the business.
What Is Covered in This Article:
- Recovery Studio and the move to rehearsed, full-stack recovery
- AgentRecover and three meanings of agent recovery
- Identity recovery and the changing resilience buyer
- How Commvault’s breadth compares with other recovery vendors
The Event—Major Themes & Vendor Moves: Commvault held SHIFT 2026 at the Gaylord Opryland in Nashville from November 9 to 12, with about 60 speakers, more than 50 sessions, and a sponsor list headed by Amazon Web Services (AWS) and including Google Cloud, Microsoft, NetApp, HPE, and others.
The throughline was what Commvault calls “AI recovery,” set out by CEO Sanjay Mirchandani in his opening keynote: as AI and agents act on enterprise systems, more will break, and recovery has to cover the whole application (data, cloud, identity, configuration, and the agents themselves). “Instead of insurance, it’s assurance,” as he put it. The company framed the response as “resilience operations,” or ResOps, one platform across operational, disaster, and cyber recovery.
Recovery Studio
The anchor announcement, Commvault Recovery Studio, orchestrates recovery of applications, identities, configurations, infrastructure dependencies, and data in runbooks that bring services back in the right order, with threat scanning built in before anything returns to production. The same runbook drives clean room tests and real recoveries, with approval steps and readiness evidence along the way. Commvault says it will enter early access, with general availability to follow. Its cloud-native unit, Clumio, added AI-assisted recovery in early access and a Model Context Protocol (MCP) server with a library of restore “skills.”
AgentRecover
AgentRecover added support for Microsoft Foundry and Amazon Bedrock AgentCore. According to Commvault, it discovers agents and maps what they touch, audits what they did through agent trace, and recovers both the agent and the data and systems it changed. The company also showed AI Studio, for building agents that work with its platform, alongside an MCP server for its recovery operations.
Identity Recovery
Identity annual recurring revenue (ARR) nearly doubled year over year, according to the company’s most recent earnings call. At SHIFT, Commvault highlighted change auditing across Active Directory, Entra ID, and Okta, attack intelligence that maps the Tier 0 control plane “for people and agents alike” and rolls back risky changes, and a pre-staged Active Directory standby for failover in minutes.
Data and Partners
Commvault introduced Data Posture 360, combining its earlier Risk Analysis product with technology from its Satori acquisition, and Data Access Manager, Satori under a new name, which enforces access policy down to the row and column. Planned work with Databricks and NVIDIA aims to put Commvault-protected data to work for AI while keeping it governed. A strategic partnership with Zscaler covers AI discovery, policy enforcement, and recovery from risky agent activity. On Day 2, speakers from Microsoft and AWS described treating agents as identities to audit and rewinding “the application, the data, and the identity all together.”
Commvault Bets That Recovery Is What Lets Enterprises Say Yes to AI
Analyst Take: A year ago, when we covered SHIFT in New York, Commvault’s agentic story focused heavily on direction, including what we called a forward-looking bet on Satori. Much of that has since become product, and identity recovery has grown into a multi-provider line of business, which is a fair reason to take this year’s early-access news seriously.
The opening keynote deserves credit for naming the problem plainly. More scope, more agency, and more speed mean more will break, and agents now change data, configurations, and access directly. In a few sentences, that captured much of what makes AI hard to adopt safely, and it helps explain why plenty of buyers are still holding back: in Futurum’s 1H2026 Cybersecurity Decision-Makers Survey, 44.3% of respondents agreed they are intentionally delaying internal AI copilots or agents until better security guardrails are in place (N=929). Commvault’s answer is that recovery belongs among those guardrails. The argument is most concrete for systems the organization controls, and it gets harder once an agent’s actions leave them.
Recovery as a Rehearsed Practice
Most organizations we speak with have a recovery plan of some kind, and far fewer have run it end to end against the applications, identities, and configurations a real incident would touch. Recovery Studio aims at that gap: one platform holding runbooks for operational, disaster, and cyber scenarios, each tested in a clean room before it is needed and run the same way in a real recovery, producing evidence an auditor, regulator, or insurer can review. In our view, that evidence may matter as much as the automation, given how often resilience conversations now start with someone outside information technology (IT) asking for proof.
Other vendors are working on similar orchestration, so Commvault’s case rests on breadth inside its runbooks, with identity, cloud configuration, and security controls sequenced alongside the data. Buyer data suggests momentum: in Futurum’s October 2026 spending intent data, Commvault’s Net Score in the storage sector, where backup and recovery spending sits, rose to 22.6 (n=93) from 13.8 a year earlier, and the share of respondents planning to replace it fell from 14.7% to 8.6%.
One suggestion: we would like to see an explicit runbook step that reapplies access policy, through Data Access Manager, once systems come back.
Who Buys Resilience Now?
Backup and recovery has long been an infrastructure purchase, often decided around cost and hardware renewals. At SHIFT, chief information security officers (CISOs) and chief information officers (CIOs) were increasingly in the room without owning the budget, and some customers are forming cross-functional “enterprise resilience teams.” Commvault itself called organizational alignment, more than technology, the main hurdle to ResOps, a partial answer to the question we raised last year.
Identity is where this shows most. It is one of Commvault’s main cross-sell paths, yet the backup administrator who can restore a directory and the identity team that owns it often do not know each other’s recovery status, and it is not always clear who may roll back a directory change in the middle of an incident. Commvault’s newer attack intelligence work, which maps the Tier 0 control plane, speaks more directly to how identity teams think about risk, and it may help bring the two groups onto the same page.
We suspect the next step, for Commvault and its peers alike, is helping customers set up the owners and decision rights that whole-application recovery assumes, since a runbook that crosses five teams only works if those teams have agreed to it ahead of time.
Agent Recovery, From the Infrastructure to the Business
“Agent recovery” did a lot of work at SHIFT, and we think it helps to separate three meanings:
- Recovering the agent itself, meaning its configuration, prompts, tools, and permissions. AgentRecover delivers this on its first supported platforms.
- Recovering from its actions on systems the organization controls, such as changed records or files. Commvault can roll these back at the infrastructure level, while transaction-level rollback remains a harder problem across the industry.
- Recovering business outcomes, such as a purchase order sent to a supplier or an email to a customer. No recovery product can undo these today.
Some of the stage messaging reads as if the first two are one capability and implies the third, and separating them would make Commvault’s progress easier to see.
This maps onto how we think about agent autonomy. Reversible actions, such as a configuration change or database write, belong to recovery tooling, provided the undo is as granular as the action. For actions that land outside the organization, or cannot be reversed at all, the only effective control is a human approval or narrowly scoped mandate beforehand, which is why we argue autonomy belongs to actions, not agents. In the same survey, 35.3% of respondents placed establishing such approval gates among their top three challenges for deploying internal AI (N=897), within a cluster of similarly ranked concerns.
We see that gap as industry-wide, and the path forward likely starts with data context: knowing that an agent touched customer data tied to billing, as opposed to test data, is what tells an organization which actions deserve a gate. Commvault’s knowledge of the data it protects, Satori’s view of who accesses what, agent trace, and partner signals such as Zscaler’s could together inform that gate.
Holding the Breadth Together
Breadth is Commvault’s strongest argument and also its main integration task. Clumio still goes to market under its own brand, its ThreatDetect and the platform’s Threat Scan are separate detection engines, and Data Posture 360 is still bringing Satori and Risk Analysis together. That is normal for a portfolio built partly through acquisitions, and Commvault called convergence a priority, though customers buying “one platform” will expect it to behave that way during an incident.
Peers are expanding along the same road. Rubrik, Cohesity, and Veeam have each announced or offer orchestrated recovery and some form of agent rollback; identity recovery competes with specialists such as Semperis and with Microsoft’s native Entra ID backup; and data security ran through a string of acquisitions (Rubrik with Laminar, Commvault with Satori, Veeam with Securiti AI), while Cohesity partnered with Cyera.
The clearest contrast is with Rubrik, which moved further into data and identity security and now positions itself as a security company. Commvault stays recovery-first, taking signals from partners such as CrowdStrike, Zscaler, Palo Alto Networks, and others. Futurum’s spending intent data reflects the split: in storage, Rubrik’s Net Score was 32.4 (n=108), ahead of Veeam at 23.4, Commvault at 22.6, and Cohesity at 17.6, while in information security Rubrik scored 27.2 against Commvault’s 6.2 (n=161). Buyers spend on Commvault for recovery, and leaning on partners for detection plays to that.
What to Watch:
- How quickly does agent recovery reach production? Watch how fast early adopters move AgentRecover into production, and whether the messaging separates recovering the agent from recovering what it did.
- How far does identity recovery reach? Watch the move from recovery into assessment and prevention, and coverage of non-human identities, including the secrets and keys that agents rely on.
- Do posture and access control come together? Watch how Data Posture 360 and Data Access Manager combine across structured and unstructured data, and how they feed recovery and agent gating.
- Where does the multi-cloud journey go next? Watch Commvault’s continued multi-cloud expansion, whether cloud-native and platform detection converge, and deployment options for sovereign and regulated customers.
For more information, read the full announcement from Commvault here.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
Commvault Moves Identity Resilience From Recovery Toward Exposure
Commvault Q2 FY 2027: Recovery Breadth Carries the Quarter
Cloudsmith Brings Governed Control to the Agent Skills Supply Chain
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
