{"slug": "commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed", "title": "Commvault looking to identify identity attack risks and get them fixed", "summary": "Commvault is expanding its IDRecover portfolio from identity attack recovery to continuous risk detection and AI-guided remediation across overlapping identity providers, including Active Directory, Entra ID and Okta, the company announced. Commvault CTO and AI Officer Pranay Ahlawat said attackers \"just need to compromise the identities that control them,\" and that the risk grows as AI agents and non-human identities proliferate. The offering adds cross-provider change detection, identification of most-privileged \"Tier 0\" identity assets and who controls them, and rollback of unwanted changes, as competitors Cohesity, Druva, Rubrik, Veeam and HYCU add similar proactive identity risk management.", "body_md": "DATA PROTECTION\n\n# Commvault looking to identify identity attack risks and get them fixed\n\n[Commvault](https://www.blocksandfiles.com/ai-ml/2026/10/02/commvault-looking-after-claude-agent-configs/5300884https://www.blocksandfiles.com/ai-ml/2026/10/02/commvault-looking-after-claude-agent-configs/5300884) is moving beyond identity attack recovery to detecting risks and holes in overlapping identity control systems and getting them fixed with an IDRecover product portfolio.\n\nIt says many organizations have more than one identity management system, such as Active Directory (ob-prem), Entra ID (Azure SaaS) and Okta (IDaaS) and, as well as needing identity recovery plans, they should track changes to identities, permissions, and access configurations across these identity providers, identify their most privileged “Tier 0” identity assets and know who has control over them. Then they should use AI-guided recommendations to remediate risky access, reverse unwanted changes, and recover trusted identity configurations. Commvault is shifting from pure recovery tooling toward continuous risk discovery and guided remediation within IDRecover.\n\nIts CTO and AI Officer, Pranay Ahlawat, said: “Attackers don't need to compromise every system. They just need to compromise the identities that control them. As AI agents and non-human identities proliferate, this risk is only growing. Our goal is simple: help customers understand who controls their most critical identity infrastructure, identify dangerous changes, and restore trusted access when things go wrong.”\n\nThe AI agent identity area presents a whole new set of risks with spun-up AI Agents, possibly in their thousands, needing identities and permissions, which could be compromised and changed to allow rogue agents unfettered access to enterprise data. Tracking human and agent IDs and permission changes across multiple, overlapping ID providers can indicate critical information access windows are opening up before an attack happens, and then these holes can be filled in.\n\nCommvault aims to provide:\n\n- Continuously change detection across identity providers: Cross-provider identity auditing will give administrators visibility into a broad range of changes affecting identities, permissions and the configurations that govern access across Active Directory, Entra ID, and Okta environments.\n- Reveal Tier 0 exposures: Identity attack intelligence capabilities will identify an organisation’s most privileged identity assets and reveal who has control over them, thus uncovering hidden risks that could give attackers control of critical identity systems.\n- Guiding remediation and recovery: AI-guided recommendations help sysadmins understand why exposure exists and how to address risky access, and support rollback of unwanted changes and recovery of trusted identity configurations.\n\n##### Competing identity protection alternatives\n\nAll five major data protection/cyber resilience suppliers are offering identity system recovery and moving to add proactive ID system risk management, meaning Cohesity, Commvault, Druva, Rubrik and Veeam. HYCU is also adding AI agent mapping, risk assessment and recommended actions with its [aiR Graph](https://www.blocksandfiles.com/data-protection/2026/10/09/hycus-air-graph-maps-ai-agents/5302225 ) technology.\n\nVendors generally progressed from AD/Entra forest and object recovery, critical because identity must come back first, to multi-IdP (Identity Provider) coverage, including Okta, to continuous monitoring and risk discovery and on to guided or automated remediation. Think rollback, Roll Forward, or AI-assisted plans. The market has moved beyond “can you restore AD?” to “can you continuously see risk, cleanly recover across IdPs, and remediate without losing legitimate changes.” Capabilities continue to evolve rapidly, with many advanced features still in early access or recently released.\n\n##### Cohesity\n\n[Cohesity](https://www.blocksandfiles.com/security/2026/09/16/cohesity-extends-resilience-to-ai-agents-plans-to-automate-cyber-resilience/5296754) developed identity resilience primarily through its Semperis partnership, integrating specialized AD expertise into the Helios platform. The core offering covers automated AD Forest Recovery (orchestrated, parallel domain-controller recovery, clean OS provisioning), granular object restores, and protection for Entra ID and Okta.\n\n[Cohesity Identity Resilience](https://blocksandfiles.com/2025/09/18/cohesity-is-protecting-identities-and-active-directory/) for on-prem Active Directory (AD) protection, plus Entra ID in the cloud, was announced in September last year. Cohesity [fortified](https://www.blocksandfiles.com/security/2026/01/21/cohesity-fortifies-identity-resilience-for-active-directory-and-entra-id/4090459) its Identity Resilience functionality to better protect Microsoft's Active Directory and Entra ID in January this year with - h  - [ITDR](https://www.blocksandfiles.com/security/2026/01/21/cohesity-fortifies-identity-resilience-for-active-directory-and-entra-id/4090459) (Identity Threat Detection and Response) capabilities powered by Semperis. This adds continuous posture inspection (200+ indicators of exposure/compromise), tamper-resistant change tracking (works even if native logs are disabled), automated real-time rollback of malicious or high-risk changes, vulnerability assessment (including dormant/over-privileged service accounts), and natural-language forensics for post-incident investigation.\n\n##### Druva\n\n[Druva](https://www.blocksandfiles.com/data-protection/2026/07/21/druva-spreading-ai-agent-cyber-resilience-wings-with-claude-and-copilot-co-operation/5275619) built identity resilience as a SaaS-native extension of its fully managed Resilience Cloud. Its approach prioritizes SaaS simplicity, graph-driven context, and evidence-based guided recovery across hybrid Identity Providers (IdPs).\n\n- March 2026: Launched Druva Identity Resilience with unified protection for Okta, Active Directory, and Entra ID. Emphasis on air-gapped/immutable backups, dependency-aware recovery, surgical rollbacks, and guided forest-level recovery, all managed from one SaaS console. It’s powered by Dru MetaGraph, a tenant-specific graph that connects human and non-human identities (NHIs), privileges, activity, configurations, and data to model identity as a continuously evolving state rather than static objects.\n- September 2026: Generally available Identity Behavioral Insights and Guided Recovery. These use [MetaGraph](https://www.blocksandfiles.com/security/2026/09/17/druva-reacts-to-ai-ransomware-raids-with-ai-responses/5297101) for blast-radius visualization, activity timelines mapped to MITRE ATT&CK TTPs, investigation of privilege escalation or lateral movement, and pre-validated plans that combine containment recommendations (e.g., token/session revocation outside the platform) with granular object-level restores inside Druva.\n\n##### Rubrik\n\n[Rubrik](https://www.blocksandfiles.com/security/2026/09/16/rubrik-gives-customer-ai-agents-access-to-its-protection-and-resilience-data/5296738) has developed a dedicated Identity Resilience platform through native development, integrations, and acquisition. It emphasizes clean and current recovery plus proactive posture management on a unified platform.\n\n- Continuous posture monitoring across AD, Entra ID, and Okta (dormant accounts, privilege escalations, risky configs); policy-driven risk detection mapped to frameworks; tamper-resistant activity logging independent of Windows event logs.\n- Identity-First Recovery (IFR): Decouples the AD database (ntds.dit) and SYSVOL from the OS for cleaner, faster recovery into a fresh Windows instance.\n- Identity Intelligence Fabric correlates signals from ITDR (CrowdStrike, Microsoft Defender), IGA (SailPoint), and HRIS (Workday).\n- Identity Roll Forward: Restores to a clean baseline then surgically reapplies only legitimate subsequent changes (classifying them as safe/harmful/unclassified).\n- June 2026: Acquisition of [Strata.io](https://www.rubrik.com/company/newsroom/press-releases/26/rubrik-advances-identity-resilience-through-strata-acquisition-and-identity-roll-forward-innovation) brought Identity Continuity and strengthened Roll Forward capabilities. Okta protection has been deepened (including Lifecycle Management configurations and cross-tenant recovery).\n\n##### Veeam\n\n[Veeam](https://www.blocksandfiles.com/security/2026/10/14/veeam-stars-in-inaugural-gartner-privacy-user-experience-mq/5302991) has expanded identity capabilities more gradually within its Data Platform, focusing on recovery automation and general threat tools. Its path has been more recovery-centric and platform-integrated than specialized continuous identity ITDR/posture management\n\n- Entra ID backup/recovery support added in Data Platform v12.3 (late 2024 timeframe), with granular object recovery, preserved relationships, organization contacts, device objects, and BitLocker keys.\n- July 2026 (v13.1): Automated Active Directory Forest Recovery wizard that collects forest metadata during backup and collapses the traditional 40+ manual steps into a guided process (supports single- and multi-domain forests).\n- Complementary threat features include Recon Scanner (Coveware-powered proactive TTP assessment, primarily on the backup infrastructure), Threat Hunter, IoC Tools Scanner, and malware detection to identify clean restore points. Clean-room recovery options are available.\n- Okta recovery is not a major native focus; capabilities are stronger on Microsoft identity systems.\n\n##### **Availability**\n\n \n\nIdentity attack intelligence and cross-provider identity auditing are planned for early access in the coming quarters and will be offered as part of Commvault IDRecover.", "url": "https://wpnews.pro/news/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed", "canonical_source": "https://www.blocksandfiles.com/data-protection/2026/11/04/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed/5307501", "published_at": "2026-11-04 13:56:52+00:00", "updated_at": "2026-11-04 14:26:41.931277+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Commvault", "IDRecover", "Pranay Ahlawat", "Active Directory", "Entra ID", "Okta", "Cohesity", "HYCU"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed", "markdown": "https://wpnews.pro/news/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed.md", "text": "https://wpnews.pro/news/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed.txt", "jsonld": "https://wpnews.pro/news/commvault-looking-to-identify-identity-attack-risks-and-get-them-fixed.jsonld"}}