In an opinion column published on SiliconANGLE, analyst Zeus Kerravala of ZK Research notes that for two decades, information security and data resilience operated as neighboring disciplines that shared a border but rarely shared a budget. While information security was designed to keep hostile actors out of systems, the role of data resilience was to bring the organization back to operational status when those actors managed to get in. Kerravala writes that the era of agentic artificial intelligence (Agentic AI) is tearing down this divider, even though most organizations have not yet noticed.
Kerravala notes that last year, he wrote that Veeam Software Group GmbH’s acquisition of Securiti AI positioned it as the industry’s first AI resiliency company. At the VeeamON Global Launch virtual event, Veeam introduced a new product: Veeam Intelligent ResOps, or iResOps, whose first generally available workload is designed for Microsoft 365. Kerravala notes that when software agents act directly on data at machine speed, an organization cannot secure what it cannot recover, and cannot recover what it does not understand.
Data Modification Instead of Encryption or Theft
Veeam Chief Executive Officer Anand Eswaran presented an example of a company in Spain that reported to its regulator that an AI agent, acting largely on its own, caused a breach after finding a flaw in a live application and modifying personal data and billing records. Eswaran framed the 72-hour regulatory disclosure requirement as an engineering problem, in which a professional is required to answer three precise questions: which records the agent changed, what it changed them to, and what the records were before the change.
Kerravala emphasizes that while ransomware attacks encrypt information and data exfiltration moves it out—events that can be detected using existing playbooks—data modification represents an entirely different challenge. As Eswaran explained, a theft can be disclosed, but an organization cannot resolve data modification through disclosure alone; it must reverse the change and restore the data to its prior state, an action that is possible only when one can identify precisely what changed.
In his remarks, Eswaran described three eras in the field's evolution: the backup and recovery era, where the guiding rule was to assume failure; the cyber resilience era, where the rule was to assume breach; and the agentic era, where the rule is to assume data drift. According to him, all three rules now apply simultaneously. Eswaran stressed that while software agents are often temporary, data itself is not temporary, and it drifts, goes stale, gets reclassified, or gets poisoned. Consequently, a perfectly entitled agent can cause real damage when reasoning over flawed data.
Starting at the Data Rather Than the Agent
Most industry approaches to managing agent risk focus on the agent itself: establishing agent registries, placing runtime guardrails, and defining scoped permissions. However, Eswaran pointed to the limitations of these tools, noting that an organization can govern only the agents it chooses to deploy, but cannot register agents it does not know exist. According to Veeam, the only vantage point that does not require prior knowledge of the actor is the data layer, because every agent ultimately touches the data itself.
According to data from Veeam’s Data Trust & Resilience Report 2026, approximately 88% of organizations are currently using or piloting AI agents, yet only 7% qualify as truly AI-ready, and more than 82% of organizations have unknown agents in their environments. Eswaran added that perfect identity hygiene can only restore who is authorized to act, but does not restore what has already actually changed, which is why security and recovery cannot remain separate disciplines.
The Difference Between a Recovery Point and a Recovery Map
One of the central points presented was the distinction between a recovery point and a recovery map. A recovery point specifies what data can be restored, whereas a recovery map defines what must be restored first, what precisely changed, and what data should be avoided when restoring the system. This distinction is significant because recovery is often an "all or nothing" process, which increases cost and time, both of which are precious commodities in the AI era.
The map referenced by Eswaran is based on the DataAI Command Graph, a technology integrated from the Securiti acquisition that connects data, users, permissions, agents, activity, and protection status across live and backup environments. The iResOps product for Microsoft 365 operates as an add-on to the Veeam Data Cloud for Microsoft 365 cloud service without requiring data migration. The system discovers Copilot and other agents, displays what sensitive data each has access to, flags redundant, obsolete, and trivial (ROT) data, and allows teams to undo changes made by an agent, file by file.
Rehan Jalil, president of products and technology at Veeam and former CEO of Securiti, explained that customers do not want fragmented tools with conflicting sources of truth, but rather demand visibility, control, and resilience in one place. IResOps for Veeam Data Platform and Okta are in private preview, with GitHub, Azure DevOps, and Google IAM previews planned for the fourth quarter. Kerravala notes that Okta is a logical early target because it lacks native point-in-time restore capability.
Findings from Customer Environments
According to Veeam data, preview customers discovered that a quarter of a 40-terabyte data estate was not needed in the production environment, and that 25 agents were operating in a single tenant, two of which were actively modifying data. Robert Davis, IT infrastructure and operations director at Construction Resources, a Home Depot company, noted that organizations need to know where data came from and where it flows, adding that cleaning up ROT data is not merely a maintenance task but an issue of compliance and legal protection that also helps reduce Copilot hallucinations. Steve McIntyre, senior vice president of data protection, analytics, and cloud security at Fidelity Investments, stated that during an incident, one must assume that recovering data and revalidating identities are both required so as not to reopen the system to the same attack.
Recommendations for Technology and Security Leaders
In his article, Kerravala presents five practical recommendations for security and infrastructure professionals:
- Merge Playbooks: While security operations and backup teams previously worked with separate tools and conducted tabletop exercises independently, agent-driven incidents occur at machine speed. Organizations must build a single joint response playbook clearly defining who owns detection, who owns scoping the damage, and who owns recovery, and conduct tabletop exercises together.
- Map Agents from the Data Layer: Agent registries are useful, but they capture only what has been sanctioned; shadow agents, third-party app registrations, and agents built by business users will not appear there. The more reliable approach is to start with your most sensitive data and work backward to every human and nonhuman identity that can access it. Make this a continuous process rather than a quarterly audit, because the number of agents changes far faster than review cycles.
- Treat ROT Data as a Security Issue: Redundant, obsolete, and trivial data was previously viewed solely as a storage cost consideration. Exfiltration-focused attackers target stale sensitive data, and outdated documents are a leading cause of bad AI output.
- Integrate Identity Systems into the Recovery Plan: Identity systems such as Entra ID, Active Directory, and Okta serve as the front door for both agents and users. Restoring clean data into an identity environment where access policies have been altered or excessive permissions configured will prepare the ground for the next attack. Back up identity configurations, compare them against a known-good state, and include them in recovery testing with the same rigor as applications.
- Test for Recovery Precision, Not Just Speed: Many recovery exercises focus on a full encryption incident and measure how quickly systems return to operation. In the agentic era, teams should test a scenario in which an authorized agent modified records over several days, evaluating whether the team can precisely identify which records changed, what they changed to, and what their original state was, without requiring a complete rollback of the entire system.
In conclusion, Kerravala notes that the launch of iResOps reflects a direction Veeam has been pursuing since acquiring Securiti, leveraging its existing customer base of more than 550,000 customers to add data security posture management to the recovery layer. Conversely, customers remain cautious about all-encompassing platforms that attempt to replace all existing tools, and the system's success depends on how well it integrates with existing tools. The central question today is no longer merely whether data can be recovered, but whether the organization can prove precisely what occurred and roll back only the problematic actions.