Commvault adds identity resilience tools for IDRecover

Commvault has introduced new identity resilience features for its IDRecover portfolio, aimed at helping customers spot risks across identity systems before they are exploited.

The new functions cover Active Directory, Entra ID and Okta. They are designed to help organisations detect changes across identity providers, assess exposure around highly privileged assets and restore trusted configurations after unwanted changes.

Identity systems have become a central target for attackers because they can provide access to critical business resources. The challenge has grown as large organisations increasingly use several identity providers at once, adding complexity across human and non-human identities, permissions and policy settings.

The announcement centres on three areas. The first is cross-provider identity auditing, which will give administrators visibility into changes affecting identities, permissions and access configurations across the supported environments.

The second is what Commvault calls identity attack intelligence. This is intended to identify the most privileged identity assets in an organisation and show who has control over them, giving teams what it describes as a Tier 0 inventory.

The third area is remediation and recovery. According to Commvault, the tools will provide AI-guided recommendations explaining why exposure exists and how risky access can be addressed, while also supporting rollback of unwanted changes and recovery of trusted identity configurations.

Pranay Ahlawat, Chief Technology & AI Officer at Commvault, said the expansion reflects the growing importance of identity security as organisations add more automated systems and software agents.

"Attackers don't need to compromise every system. They just need to compromise the identities that control them," Ahlawat said.

"As AI agents and non-human identities proliferate, this risk is only growing. Our goal is simple: help customers understand who controls their most critical identity infrastructure, identify dangerous changes and restore trusted access when things go wrong."

Recovery focus

Commvault also pointed to a wider market shift in how businesses approach identity incidents. Detecting and stopping an attack does not necessarily reverse the changes left behind in directories, permissions and trust relationships.

IDC research cited by Commvault found that identity threat detection and response sits at the top of identity security priorities, with resilience next. The research also found that only 47% of organisations have completed an identity recovery plan.

"Identity threat detection and response leads identity security priorities and resilience ranks next, yet only 47% of organizations have a completed identity recovery plan," said Emanuel Figueroa, Senior Research Analyst for Identity and Access Management Security at IDC.

"Breaking the kill chain ends the attack, but not its aftermath: changed permissions, group memberships, policies and trust relationships can persist after access is revoked. Access controls can't by themselves return a directory to a verified state, so recovery is becoming a distinct buying criterion. Commvault's extension of recovery across Active Directory, Entra ID and Okta shows data-protection vendors are moving to meet it."

That points to a broader issue for security and infrastructure teams. Even after malicious access is blocked, organisations may still need to verify and restore identity settings to ensure core systems are trustworthy again.

The new functions will sit within IDRecover, which Commvault describes as a set of tools to help organisations uncover identity risk, monitor suspicious changes and restore access if identity systems are compromised. Identity attack intelligence and cross-provider identity auditing are planned for early access in coming quarters.

The scope of the announcement also underlines the importance of interoperability across identity platforms. Many large businesses now operate mixed identity estates, often combining Microsoft and third-party systems, which can make oversight more difficult when permissions and administrative controls overlap.

By focusing on visibility across Active Directory, Entra ID and Okta, Commvault is targeting one of the more complex parts of cyber recovery, where security, identity management and business continuity increasingly intersect.