Exclusive: Commvault on cyber resilience as the new battleground for enterprise data

Cyber resilience has become the defining issue of modern enterprise IT.

For Pranay Ahlawat, Chief Technology and AI Officer at Commvault, it is not only a technological concern but "a structural and strategic one."

In an era where data is distributed, attacks are increasingly sophisticated, and regulations are tightening, recovery readiness is more critical than ever.

In Ahlawat's view, the era of traditional backup has passed.

"The paradigm of data protection has shifted," he explained during a recent interview.

"Nine times out of ten, when customers use backup and recovery products, it's in the context of cyber recovery." That shift has changed the very DNA of Commvault's product focus. "Our job now is to help companies become more resilient against both operational and cyber risks."

The threat landscape has grown "dramatically", according to Ahlawat.

"There was a 100% increase in attacks from 2023 to 2024, and a 75% increase again from 2024 to 2025," he said. "These are not small numbers. And every cyberattack now costs companies around $5 million and takes roughly 24 days to recover from."

But perhaps more alarming is what enterprises do not know. "Many companies are already compromised and have no idea. Attackers often lurk in systems for weeks, quietly moving across networks, disabling backups, and stealing credentials before launching ransomware," Ahlawat explained. "It's not a question of if you will be attacked. It's a question of when."

AI has played a role in accelerating both sides of this arms race. While it enables faster innovation and smarter systems, it also empowers threat actors to be more creative and adaptive. "Attackers are poisoning supply chains, inserting data poison, going after AI inference models."

"Prompt injection and adversarial attacks on AI are becoming more common," he said.

Still, the most common point of entry remains surprisingly low-tech. "Identity is still the number one vector," Ahlawat said. "Nine out of ten attacks go after Active Directory. Stolen identities and compromised access are where most breaches begin."

He also made it clear that attackers are not necessarily seeking specific datasets. "It's not about any particular type of data," he explained.

"They are just looking for the path of least resistance and the opportunity to do maximum damage."

Enterprises are increasingly expected to defend against this while also managing a mounting compliance burden.

"Regulations are well intended," Ahlawat said. "They do force companies to put guardrails in place. But they are also reactive, and they introduce a tremendous amount of complexity."

The cost of that complexity is staggering. "A recent report said the cost of regulations to enterprises globally is around $1.9 trillion," he said. "And I wish I could say that led to a drop in cyberattacks, but it hasn't."

Ahlawat argued that while regulations might improve governance, they are not necessarily effective at deterring attackers.

"Bad actors are staying one step ahead," he said. "Regulations help with structure, but they don't always help with actual resilience."

In some cases, he admitted, regulations can be a net benefit for companies like Commvault. "If you are a financial institution in Europe, for example, regulations like DORA require you to back up data with multiple cloud vendors. That's where we come in. But it's still a heavy lift for these companies."

Despite stronger compliance frameworks, many businesses remain underprepared. "Some are proactive, some are stuck in planning, and some are laggards who need a lot more education," he said. "Technology is only part of the solution. Process transformation, change management, and regular testing are just as important."

He stressed the importance of rehearsed incident response and what Commvault refers to as "clean room" testing - recovering systems in a quarantined environment to prevent reinfection. "Companies that fare better have well-defined playbooks and test their recovery plans regularly," he said. "You cannot afford to figure it out in the middle of an attack."

Looking ahead, Commvault is focusing heavily on identity and cloud-native protection.

"Our Active Directory recovery product is gaining a lot of traction because recovering an entire forest is often extremely manual and error-prone," Ahlawat said. "And with 85% of new workloads going to the cloud, our investments there are really resonating with customers."

He concluded with a warning to enterprises hoping to maintain continuity in today's environment. "There is no such thing as a perfectly secure system," he said. "You have to assume something will go wrong - and plan your recovery accordingly. The cost of not doing so is just too high."