Commvault has launched new identity resilience capabilities designed to help organisations detect risky changes across major identity platforms, understand their exposure to highly privileged accounts, and restore trusted configurations after an attack.
The company said identity systems remain a prime target because compromising a privileged identity can provide attackers with rapid access to critical enterprise resources. It cited research indicating that 80% of large enterprises use multiple identity providers, increasing complexity across human and non-human identities, permissions and access policies.
Cross-platform visibility
The new capabilities are intended to give identity, IT and security teams continuous visibility across heterogeneous identity environments. Cross-provider identity auditing will monitor changes affecting identities, permissions and access-governing configurations across Active Directory, Entra ID and Okta.
Commvault is also introducing identity attack intelligence features to create a Tier 0 inventory: a view of an organisation’s most privileged identity assets and the people or systems that control them. The company said this should help teams identify hidden risks that could otherwise allow attackers to take control of critical identity infrastructure.
For response and recovery, AI-guided recommendations will explain why an exposure exists and suggest how to address risky access. The platform will also supports rollback of unwanted changes and recovery of trusted identity configurations.
Recovery becomes a priority
The launch reflects a broader shift in identity security from preventing initial compromise towards recovering from its consequences. Emanuel Figueroa, senior research analyst for identity and access management security at IDC, says identity threat detection and response now leads identity security priorities, while resilience ranks next.
“Identity threat detection and response leads identity security priorities and resilience ranks next, yet only 47% of organisations have a completed identity recovery plan,” said Figueroa. “Breaking the kill chain ends the attack, but not its aftermath: changed permissions, group memberships, policies, and trust relationships can persist after access is revoked.”
Figueroa added that access controls alone cannot return a directory to a verified state, making recovery an increasingly distinct buying criterion. He adds that Commvault’s extension of recovery across Active Directory, Entra ID and Okta shows data-protection vendors are responding to that demand.
AI expands the attack surface
Commvault framed the development as particularly timely as enterprises deploy more AI agents and non-human identities. These machine identities can hold permissions and access paths that are harder to track than traditional user accounts, increasing the potential blast radius of a single compromised credential or misconfigured policy.
“Attackers don't need to compromise every system. They just need to compromise the identities that control them,” said Pranay Ahlawat, chief technology and AI officer at Commvault. “As AI agents and non-human identities proliferate, this risk is only growing.”
Ahlawat said Commvault’s objective is to help customers understand who controls their most critical identity infrastructure, identify dangerous changes and restore trusted access when things go wrong.
FutureCISO says the announcement underscores a practical challenge: multi-cloud and multi-provider identity estates require not only detection and access governance, but also tested recovery procedures that can reverse unauthorised directory changes before attackers convert initial access into lasting control.
