Enterprises spent years optimizing for availability. The question was always the same: can we get back online? Agentic AI has quietly replaced that question with a harder one — can we trust the data, models, and pipelines we’re bringing back?

At AI Infrastructure Field Day 5, Commvault made the case that most organizations can’t answer that second question, and that the gap between “recovered” and “trustworthy” is where the next generation of enterprise risk lives. Their presentation reframed three decades of backup expertise around a single, more demanding discipline: AI resilience.

The Gap Nobody Drew an Org Chart Around

AI infrastructure doesn’t belong to IT anymore. It belongs to everyone — security teams, finance, specialized AI groups, and increasingly, autonomous agents operating across the same data estate that backup systems were designed to protect. That diffusion of ownership creates an accountability gap that traditional governance frameworks were never designed to close.

The data path itself has changed in ways that compound the problem. What used to move in predictable, linear flows now routes through vector databases, embedding pipelines, model checkpoints, and metadata dependencies that form a web of recovery interdependencies. A single component falling out of sync — a model version, a metadata tag, an embedding schema — can corrupt the trustworthiness of an entire AI application without triggering any of the alerts that a traditional incident response playbook would catch. And layered on top of all of this is the shadow AI problem: rogue agents and unauthorized model deployments that mutate data and bypass controls at a pace that leaves CISOs managing consequences rather than preventing them.

The velocity of AI development is machine-speed. The governance frameworks inherited from the previous infrastructure era are not.

How Commvault Rebuilt for the AI Reality

Commvault’s answer is a resilience methodology built on people, process, and tools — and centered on a governance control plane, largely powered by the Satori acquisition, that sits between users and data sources whether those users are human or agentic. The platform isn’t positioned as a backup product with AI features bolted on. It’s a rearchitected approach to what recovery means when the thing you’re recovering is an AI application stack with cascading dependencies.

Four capabilities carry the weight of that claim:

• The LLM Gateway functions as a proxy layer that intercepts requests to external models — OpenAI, Claude, and others — and redacts sensitive information in real time before it reaches the model. PII, Social Security numbers, and other regulated data categories never enter the AI pipeline in the first place. For enterprises running RAG applications over internal data estates, this closes an exposure vector that most security teams haven’t finished mapping yet.
• Clean Room Recovery addresses the “when, not if” posture that serious incident response requires. Commvault provisions isolated, ephemeral cloud environments — on Azure, AWS, or GCP — where teams can test recovery processes, verify data integrity, and confirm that restored identities haven’t been compromised before anything returns to production. The distinction matters: a recovery process that hasn’t been tested under realistic conditions isn’t a recovery process — it’s an aspiration.
• Coherent Application Recovery via Runbooks moves beyond the traditional “put the database back” model and restores the entire application stack: substrate, pipelines, version dependencies, and all. For AI applications where a mismatched embedding version or a stale model checkpoint can make a fully recovered system functionally untrustworthy, this kind of dependency-aware restoration isn’t a premium feature. It’s the minimum viable capability for AI resilience.
• Arlie and ResOps represent Commvault’s push to make resilience a board-level discipline rather than an IT operations function. Arlie is an AI-powered assistant that surfaces root cause analysis and guides recovery decisions, reducing the operational friction that turns manageable incidents into prolonged outages. ResOps — resilience operations — is the broader framework: a structured approach to answering the question of how quickly an organization can return to being a minimum viable company after an incident. That framing belongs in front of executives, not buried in runbook documentation.

Governance That Agents Can’t Route Around

Proxy-based architectures earn skepticism on latency grounds, and Commvault addressed it directly: their Kubernetes-native, local gateway architecture keeps latency from becoming a deployment blocker. The more substantive architectural decision is how to prevent agents from bypassing governance controls entirely — and Commvault’s answer is network-layer integration, where the control plane becomes the only path to the database. Agents don’t get an alternative route because no alternative route exists.

For organizations operating under GDPR or other data residency requirements, Commvault offers customer-hosted deployments where the data access controller runs locally. Sensitive data stays within its required boundary; only policies and audit logs move to the cloud-based control plane. That separation lets enterprises extend AI governance across jurisdictions without forcing architectural compromises that regulators would reject.

Why This Matters

The table stakes for enterprise recovery have changed, and most organizations are still playing by the old rules. Recovering a single workload made sense when workloads were discrete and isolated. AI applications aren’t either of those things — they’re dependency chains, and a breach or rogue agent that compromises training data or model checkpoints can invalidate a recovery that looks complete by every traditional metric.

Commvault’s AIIFD5 presentation established a clear framework for infrastructure architects navigating that reality: governance at the data access layer, isolation for recovery testing, dependency-aware restoration, and an operational discipline — ResOps — that elevates resilience from an IT function to a strategic capability. The enterprises that treat AI resilience as a first-order infrastructure requirement, rather than a backup problem to solve later, are the ones that will be able to answer the harder question when it matters most.

Restored and trusted are not the same thing. The gap between them is where the risk lives.