Analyst(s): Fernando Montenegro
Publication Date: November 25, 2025
What is Covered in this Article:
- The definition and strategic intent behind “Resilience Operations” (ResOps) as a bridge between IT and Security.
- An analysis of the Commvault Cloud Unity platform and its ability to unify on-premises and cloud workloads via docking.
- New active defense capabilities, including Identity Resilience for Active Directory and Synthetic Recovery.
- The strategic implications of securing the AI stack and governing data for an agentic future.
The Event – Major Themes & Vendor Moves: At Shift NYC 2025, Commvault anchored its strategy in a new term: “ResOps” (Resilience Operations). Commvault uses this to define an operational model that forces proximity between traditionally siloed IT and teams. CEO Sanjay Mirchandani argued that facing modern threats requires moving beyond reactive “cyber resilience” to a unified, proactive state of “AI resilience.”
The central announcement was the “Unity” release of Commvault Cloud. This release of Commvault’s platform is a key development, specifically designed to bridge the historical divide between on-premises infrastructure and cloud environments. Unity integrates legacy environments through “SaaS docking,” allowing enterprises to manage on-premises Hyperscale appliances and edge workloads directly from the same cloud control plane used for cloud-native apps.
Beyond unification, Commvault outlined a broader strategic approach to securing the AI enterprise. The company argued that resilience now requires protecting the “modern AI data stack” itself, rather than just the infrastructure that holds the data. This strategy focuses on enabling safe data use for model training and preparing for an “agentic future” where autonomous AI agents interact with enterprise data, requiring new layers of governance and “human-in-the-loop” oversight to prevent abuse or data leakage.
Key capabilities supporting this strategy include:
- Identity Resilience: Moving beyond passive backup, the platform treats Active Directory as a live attack surface. It can detect attribute drifts and “roll back” malicious changes (such as privilege escalation) in real-time to secure the “new perimeter.”
- Advanced Recovery: To minimize downtime and data loss, Synthetic Recovery utilizes AI to construct a clean recovery point from the most recent, uncorrupted file versions.
- Unified Risk Visibility: Addressing data sprawl, the platform utilizes AI to automatically discover resources and generate reports on protected versus unprotected workloads, enabling administrators to identify coverage gaps across the hybrid estate.
- Increased Data Protection: The recent addition of Satori Cyber to Commvault provides the company with enhanced reach into data visibility, control, and compliance across a wide range of use cases, particularly for structured data. This complements the platform’s existing Risk Analysis offering, which governs unstructured data and provides “digital scrubbing” to remediate data spillage.
Commvault also detailed significant performance benchmarks for the platform, citing cloud protection rates of 111 terabytes per hour (for S3) and on-premises restoration rates of 40 terabytes per hour via Hyperscale Flex.
Commvault’s Strategic Shift: Redefining Resilience as a Strategic Imperative
Analyst Take – ResOps: A Necessary Evolution, Regardless of the Label
Commvault emphasized “ResOps”. While the industry is already saturated with “Ops” terminologies, ranging from DevOps to SecOps to FinOps and other variations, introducing yet another acronym may risk contributing to buzzword fatigue. However, the intent behind the branding is undeniably appropriate. Commvault is using the term to signal a necessary evolution: recovery can no longer be viewed as a passive insurance policy managed in isolation by IT administrators, disconnected from business imperatives.
Instead, the concept validates the reality that true business continuity now requires a synchronized, cross-functional effort involving cybersecurity and infrastructure teams that are aligned with each other and, importantly, with the business context surrounding the data being protected. By attempting to codify this as a discipline, Commvault is making a strategic effort to elevate the conversation from the data center to the boardroom. Whether or not the specific “ResOps” label endures is secondary; the underlying argument that recovery capability is now a critical metric of organizational health and demands C-level attention is a message that aligns perfectly with the current threat landscape.
A Pragmatic Unification for a Hybrid World
The “Unity” platform represents a necessary reality check: for large enterprises, hybrid infrastructure is a permanent operating model, not a transition phase. By using docking to bridge on-premises appliances with a cloud control plane, Commvault aims to remove the friction of managing bifurcated environments. This consolidation is also an essential defensive moat for Commvault, reducing the operational complexity that might otherwise prompt legacy customers to explore cloud-native point offerings.
More importantly, it strengthens the broader platform play. By unifying the control plane, Commvault creates a more cohesive ecosystem where advanced capabilities can be easily extended across the entire data estate, rather than being sold as isolated add-ons.
This aligns with the broader trend of enterprises favoring vendor consolidation efforts. As we can see from Futurum’s 1H 2025 Cybersecurity Decision Maker survey, respondents indicated a preference for vendor consolidation over vendor expansion in the next 12 months.
Figure 1: Strategic Vendor Consolidation Goals for Security Tools (next 12 months)
Identity as the Foundation of Recovery
The focus on Identity Resilience is welcome and addresses an important element in modern cyber resilience, particularly in larger enterprises: Active Directory (AD) is simply foundational. In a Cleanroom Recovery scenario, countless infrastructure elements and applications may rely on AD for authentication and, in many cases, authorization tied to group memberships; if the identity provider is compromised or unavailable, the rest of the recovery process stalls.
By enabling the detection and rollback of attribute changes, the platform provides a mechanism to revert attacks, such as privilege escalation. This creates a powerful containment strategy: rapidly neutralizing compromised credentials severs lateral movement paths, effectively limiting the blast radius of an active intrusion. However, this capability also illustrates precisely why a “ResOps” model is necessary. Providing a recovery platform with the power to revert identity changes creates potential governance chaos: Does the backup administrator have the authority to override current directory states, or is that the domain of the incident response team or the identity team? Resolving this operational “gray area” is a practical example of the collaboration ResOps demands.
Securing the AI Stack – A Forward-Looking Bet
The company’s focus on securing the “AI stack” represents a forward-looking strategic bet. With Satori Cyber now part of the Commvault portfolio, the vendor is signaling an intention to move beyond protecting data storage to governing the usage of data within AI models. Effectively, they are arguing that the platform holding the enterprise’s data is best positioned to enforce safety and quality before it reaches an AI agent. While this messaging may currently be ahead of the average customer’s maturity curve, given that many are still mastering basic ransomware defense, it establishes a clear roadmap for platform relevance in an AI-driven future.
What to Watch:
- Will organizational design evolve to support the “ResOps” mandate? Commvault is betting on the convergence of SecOps and ITOps. Success depends on whether enterprises are willing to restructure internal silos to treat resilience as a shared operational discipline rather than a series of disconnected handoffs.
- Can a data resilience platform effectively govern the AI stack? With Satori Cyber, Commvault signals it intends to secure the data feeding AI models. The question is whether AI leadership will view a heritage infrastructure player as the natural owner of AI security posture, or prefer specialized, lifecycle-specific tools.
- Will the efficiencies of an integrated platform outweigh the agility of point products? Unity argues that a unified control plane reduces risk. We will be watching to see if the operational simplicity of this consolidated approach persuades enterprises to abandon best-of-breed cloud point products in favor of a single engine.
- Is the market ready for agentic recovery? While the vision of conversational AI for incident response is compelling, real-world recovery is high-pressure. It remains to be seen whether operators will adopt agentic workflows for complex crises or continue to rely on manual “human-in-the-loop” defaults.
You can read the full press release/more at Commvault’s website.
Declaration of Generative AI and AI-assisted Technologies in the Writing Process: While preparing this work, the author used AI capabilities from both Google Gemini and/or Futurum’s Intelligence Platform to summarize source material and assist with general editing. After using these capabilities, the author reviewed and edited the content as needed. The author takes full responsibility for the publication’s content.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other insights from Futurum:
Transforming Cyber Resilience with Commvault
Commvault’s Shift to Cloud-First Resilience: A Strategic Move
Commvault Q2 FY 2026: ARR Tops $1 Billion; Revenue Beats Consensus
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
