Commvault has announced enhancements to its Cloud Threat Scan capabilities, aiming to bolster threat hunting functions for better identification and recovery processes. These improvements are designed to aid enterprises in quickly pinpointing risks within backup systems, ensuring the restoration of unaffected data and minimizing potential reinfection and extended downtimes.
Recent statistics highlight a critical issue: the average timeframe for discovering a breach not initially identified by attackers is 24 days. This window allows adversaries to discreetly plant harmful code across networks. While many security teams have access to intelligence on specific compromise indicators, applying this knowledge to backup data before commencing restoration is crucial. Absent clear insights into backup integrity, organizations risk reintroducing threats, prolonging outages, and exacerbating business disruptions.
Enhanced Threat Detection Modes
To counter these challenges, Commvault introduces dual scanning functionalities within its Cloud Threat Scan tool:
- Hyper Threat Hunting: This mode provides extensive searches across backup data utilizing threat hunting tools like hashes and YARA rules, enabling large-scale detection of known compromise indicators. Fast, index-driven hash-based hunting allows rapid detection, while YARA-based analysis facilitates more nuanced pattern matching for intricate investigations.
- Deep Inspection: Offering a detailed file-level assessment, this mode employs malware signatures, machine learning, heuristic analysis, and AI for encryption detection, efficiently uncovering known threats, potential variants, and ransomware activities that may bypass straightforward indicator matches.
Response and Recovery Coordination
This system supports scheduled scans for ongoing surveillance in active response situations
These detection mechanisms foster enhanced cooperation between incident response and recovery units, allowing for precise data isolation and informed restoration determinations. This system supports scheduled scans for ongoing surveillance or focused searches in active response situations, delivering adaptability for continuous protection and urgent responses.
Dr. Erika Voss, Chief Security Officer at Blue Yonder, emphasized the importance of proactive threat measures: “In an era where attacks adapt faster than defenses, our priority is to get ahead of every threat. Being able to validate recovery data against current threat indicators is one way to stay ahead of it — ensuring we have more control in an unpredictable landscape.”
Integrated Detection and Recovery
Commvault has integrated these detection capabilities with its innovative Synthetic Recovery technology, merging detection with recovery tasks. Upon threat identification, the AI-fueled Synthetic Recovery tool aids in excising compromised datasets during recovery, while ensuring clean data is reinstated to active systems. This approach maximizes data retention while maintaining data integrity.
According to Fernando Montenegro, VP and Practice Lead Cybersecurity at The Futurum Group, “We’re seeing a fundamental shift in how organizations approach recovery operations. The market is demanding integrated solutions that combine threat detection with recovery workflows.” This reflects Commvault’s progression toward the ResOps model, bridging gaps across IT and security sectors.
Proprietary Signal Correlation
Pranay Ahlawat, Chief Technology and AI Officer at Commvault, points out the importance of unified operations: “Security and IT teams need to operate from the same playbook during an incident. Threat intelligence at scale is increasingly table stakes — what sets us apart is what happens next. By layering our proprietary signal correlation and AI-enabled algorithms on top of targeted threat hunting, and connecting that directly to verified recovery, we give organizations something powerful: not just the ability to find threats fast, but the confidence that what they restore is clean.”
Availability and Demonstrations
The advanced capabilities of Threat Scan are globally available, offered as an independent product or as part of Commvault’s cyber resilience suite. Current Threat Scan users will receive these new features at no added expense. Commvault’s offerings will be showcased at the upcoming RSA Conference in San Francisco, where participants can experience live demos and sessions on ransomware recovery and clean recovery methods.
Commvault, a pioneer in unified resilience at enterprise scale, announces expanded threat hunting capabilities within Commvault Cloud Threat Scan. The enhancements help organizations rapidly identify risks within backup environments and recover validated clean data, reducing reinfection risks and prolonged downtime.
According to recent reports, the median dwell time for a non-actor disclosed breach is 24 days,1 giving attackers ample opportunity to silently embed malicious code across systems. While security operations teams often possess intelligence tied to specific indicators of compromise (IOCs) or indicators of attack (IOAs), that intelligence must also be applied across backup data before restoration begins. Without clear visibility into backup integrity, organizations risk reintroducing threats, extending outages, and compounding business disruption.
YARA-based analysis
To address this challenge, Commvault now delivers two complementary scanning modes within Commvault Cloud Threat Scan:
- Hyper Threat Hunting enables targeted searches across backup data using threat hunting artifacts such as hashes and YARA rules to identify known indicators of compromise at scale. Hash-based hunting provides fast, index-based detection, while YARA-based analysis supports more targeted pattern matching for deeper investigation.
- Deep Inspection provides layered file-level analysis using malware signatures, machine learning, heuristic analysis, and AI-enabled encryption detection to uncover known threats, suspicious variants, and ransomware related activity that may evade exact-match indicators alone.
Time-sensitive response
Together, these detection modes allow close collaboration across incident response and recovery teams to isolate affected data and make informed recovery decisions. They can schedule recurring scans for continuous monitoring or conduct targeted searches during active incident response scenarios, providing flexibility for both ongoing protection and time-sensitive response.
“In an era where attacks adapt faster than defences, our priority is to get ahead of every threat,” said Dr. Erika Voss, Chief Security Officer at Blue Yonder. “Being able to validate recovery data against current threat indicators is one way to stay ahead of it — ensuring we have more control in an unpredictable landscape.”
Achieving data cleanliness
Commvault integrates these threat detection capabilities with its patent-pending Synthetic Recovery technology – unifying detection and recovery workflows. Once risks are identified, Commvault’s AI-enabled Synthetic Recovery offering can help surgically remove compromised datasets during recovery while restoring clean data to production systems. With Synthetic Recovery, organizations can maximize data preservation while simultaneously achieving data cleanliness.
“We’re seeing a fundamental shift in how organizations approach recovery operations. The market is demanding integrated solutions that combine threat detection with recovery workflows, and Commvault’s layered approach to verified clean recoveries represents where the industry is heading,” said Fernando Montenegro, VP and Practice Lead Cybersecurity at The Futurum Group. This announcement continues to demonstrate how Commvault is advancing the ResOps operating model. Instead of operating in silos across IT and security, ResOps connects people, processes, and technology, so organizations can manage resilience as a continuous enterprise-wide discipline.
Proprietary signal correlation
“Security and IT teams need to operate from the same playbook during an incident. Threat intelligence at scale is increasingly table stakes — what sets us apart is what happens next,” said Pranay Ahlawat, Chief Technology and AI Officer at Commvault.
“By layering our proprietary signal correlation and AI-enabled algorithms on top of targeted threat hunting, and connecting that directly to verified recovery, we give organizations something powerful: not just the ability to find threats fast, but the confidence that what they restore is clean.”
Cyber resilience bundle
Threat Scan is available globally and is sold as a standalone offering as well as part of Commvault’s cyber resilience bundle. The new threat hunting capabilities are generally available and will be provided at no additional cost to existing Threat Scan customers.
Commvault’s latest Threat Scan offerings take centre stage at this year’s RSA Conference (Booth #S-0634) from March 23-26 in San Francisco. Show attendees can grab a ringside seat for the ResOps Rumble where resilience and operations join forces to deliver unified cyber recovery, identity resilience, and data security. Register today for ransomware recovery demos and sessions, expert insights on identity resilience and clean recovery, and the ultimate prize – unified resilience for your organization
