Commvault introduces AI-guided remediation for identity security risks

Commvault has announced new identity resilience capabilities designed to help organisations detect changes across identity systems, identify risks associated with privileged accounts and recover trusted configurations following a security incident.

The capabilities will cover Microsoft Active Directory, Microsoft Entra ID and Okta, enabling IT and security teams to monitor changes to identities, permissions and access configurations across multiple identity providers.

Identity systems are increasingly targeted by attackers because they can provide access to critical enterprise resources. According to Commvault, 80% of large enterprises use multiple identity providers, adding complexity to the management of human and non-human identities, permissions and security policies.

Detecting changes across identity providers

The new cross-provider identity auditing capability will provide visibility into changes affecting identities, permissions and configurations across Active Directory, Entra ID and Okta environments.

The aim is to help administrators identify potentially risky changes across different identity systems and improve their ability to detect issues before attackers exploit them.

Identifying risks to privileged identities

Commvault is also introducing identity attack intelligence capabilities to identify highly privileged identity assets and determine who has control over them.

The system will provide a Tier 0 inventory, highlighting critical identity assets that could give attackers control over key identity infrastructure if compromised. This visibility is intended to help security teams identify exposures that might otherwise remain undetected.

AI-guided remediation and recovery

The new capabilities will also provide AI-guided recommendations to help teams understand why identity risks exist and how to address unsafe access configurations.

In addition to identifying and remediating risks, the capabilities will support the rollback of unwanted changes and the recovery of trusted identity configurations. This addresses a key challenge in identity security: revoking an attacker’s access may not automatically reverse changes made to permissions, group memberships, policies or trust relationships during a breach.

Pranay Ahlawat, chief technology and AI officer at Commvault, said attackers often focus on identities that control access to critical systems. He added that the growing use of AI agents and non-human identities is increasing the risks associated with identity management.

Identity recovery gains importance

Emanuel Figueroa, senior research analyst for identity and access management security at IDC, said identity threat detection and response remain major priorities for organisations, while identity recovery is gaining importance.

According to Figueroa, only 47% of organisations have a completed identity recovery plan. He noted that security teams must address changes to permissions, group memberships, policies and trust relationships that may persist even after an attacker’s access has been revoked.

Commvault’s expansion of recovery capabilities across Active Directory, Entra ID and Okta reflects a broader focus on restoring identity systems to a verified and trusted state after a compromise.

Early access planned for coming quarters

Commvault said identity attack intelligence and cross-provider identity auditing are planned for early access in the coming quarters.

The capabilities will be offered through Commvault IDRecover, a portfolio focused on helping organisations identify identity risks, monitor suspicious changes and restore trusted access when identity systems are compromised. The company has not specified an exact release date.