Commvault adds Microsoft 365 tools to spot safe backups

Commvault has introduced new data security and threat-hunting tools for Microsoft 365 designed to help customers identify clean recovery points in backed-up data.

The additions cover sensitive data discovery, threat detection across backup data, and the identification of content that is safe to restore after a cyber incident. They apply to protected data from Exchange, OneDrive, SharePoint and Teams.

One feature, Data Posture 360, is designed to map where sensitive information, including personally identifiable information and intellectual property, sits across Microsoft 365 environments. It is intended to highlight exposure risks and help organisations decide where to focus their response.

A second tool, Threat Scan, is designed to find malware, ransomware, encryption activity, data anomalies and other indicators of compromise in Microsoft 365 backup data. Customers will also be able to apply current threat intelligence to historical backup copies held in immutable storage, enabling them to look for threats that were not known or detected when the data was first protected.

The announcement reflects growing attention on the security of software-as-a-service data as businesses rely more heavily on cloud collaboration platforms. Microsoft 365 has more than 450 million paid commercial seats worldwide, making it a major target for attacks involving email, attachments and shared files.

Recovery focus

A central part of the update is the use of threat signals to separate compromised content from material that can be trusted. The goal is to help organisations restore known-good data rather than recover files that could reintroduce malware or other threats into production systems.

"Commvault is bringing three key elements to the resilience equation with Microsoft 365: detection, visibility, and clean recoveries," said Pranay Ahlawat, Chief Technology and AI Officer at Commvault.

"Resilience and compliance depend on identifying threats fast, understanding if sensitive data is exposed, and what's safe to restore," Ahlawat said.

Commvault is positioning the tools around a growing problem for backup users after a breach: not just whether data exists in backup copies, but whether those copies can be trusted. Security teams and IT administrators often need to check whether archived content contains malicious files or signs of compromise before beginning restoration.

Spokane Industries, which uses Commvault for Microsoft 365 data protection, said the issue is significant.

"During a cyber incident, knowing what data can be safely restored is just as important as having a backup," said Matt Pancheri, IT Manager and Systems Administrator at Spokane Industries.

"Commvault gives our team a way to investigate our protected Microsoft 365 data and make more informed recovery decisions, helping limit disruption to the business," Pancheri said.

Market context

Analysts argue that security and recovery are becoming more closely linked as ransomware attacks and other intrusions spread across cloud services as well as on-premise systems. Backup repositories, once viewed mainly as an insurance policy against data loss, are now also being examined as a source of forensic evidence and as a checkpoint for deciding what can be restored.

Jennifer Glenn, Research Director for Information and Data Security at IDC, said the ability to flag compromised content inside Microsoft 365 backups has implications for both security and continuity planning.

"Alerting decision-makers to compromised data within Microsoft 365 backup offers both data security and data protection teams the information they need for improved resilience and continuity," Glenn said.

"This is essential for enterprises to prove operational data is both recoverable and trustworthy," she said.

Threat Scan and Data Posture 360 for Microsoft 365 are planned for early access preview in the coming weeks. General availability is targeted for early 2027. Both products will be sold as paid add-ons to Commvault Backup & Recovery for Microsoft 365, and customers will be able to buy each separately.