Cyber resilience strategy in focus as recovery speed becomes the new business mandate

Cyberattacks are no longer just an information technology problem — they have become a board-level business continuity crisis, forcing enterprises to rethink cyber resilience strategy from the storage layer up.

As cyber resilience strategy evolves from a compliance checkbox into an operational imperative, companies are discovering that immutable backups alone are no longer enough. The real question boardrooms are asking is not whether a backup exists, but how fast the business can recover — and whether recovery has ever actually been tested, according to Leerun Laizerovich (pictured, right), associate vice president of partner technical solutions and design at Commvault Systems Inc.

“In the past, chief security officers and chief financial officers were really asking the questions around, do we have an immutable backup?” Laizerovich said. “How it’s changed now is that it’s become more of a board level discussion. The board is starting to change that landscape and asking, can we recover and how fast can we get there? And so naturally the CSO is becoming the chief recovery officer in tandem.”

Laizerovich and Brandon Willitts (left), director of product management at Everpure Inc., spoke with theCUBE’s Christophe Bertrand and Alison Kosik at Pure Accelerate 2026, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed cyber resilience strategy, how the threat landscape is accelerating, and what enterprise teams must do differently to achieve genuine recoverability. (* Disclosure below.)

Cyber resilience strategy demands active defense at the data layer

Perimeter-first security strategies are proving insufficient as threat actors increasingly move laterally through enterprise environments and target the data layer directly. The Commvault and Everpure partnership is built to address that gap by integrating data protection telemetry, automation and flash-speed recovery into a unified stack — turning storage from a passive witness into an active defender.

“It used to be that perimeter defense was where we invested heavily,” Willitts said. “We didn’t have access to the data layer, but we were seeing the threat actors really moving laterally through our environment going after the data. You want to take storage out of this passive witness role and turn it into an active defender and connect it from all the way end to end, from your network down to your storage layer.”

Willitts described a real-world example of a Fortune 100 company that suffered a wiper attack in which fully authenticated adversaries — who had harvested valid credentials — deleted more than 80,000 devices with no malware and no ransom note. Using layered snapshot capabilities, the joint team trained a customer engineer with no storage background to recover the business in under 30 minutes. IBM research puts mean time from intrusion to containment at 241 days, making validated, fast recovery a non-negotiable baseline, Willitts noted.

“When was the last time they actually did a recovery test?” Laizerovich said. “How long did it take and did it meet those objectives? Because if they haven’t done it, they need to start doing it.”

Recovery testing must happen on a regular cadence rather than as a one-time exercise, since enterprise environments change constantly and threats arrive at any hour, Willitts noted.

“Backups without testing your recovery is just ransomware,” Willitts said. “Having confidence in your recovery — because these threats come at any time of the day — that’s what we want to make sure we can deliver.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Pure Accelerate 2026:

(* Disclosure: TheCUBE is a paid media partner for the Pure Accelerate event. Neither Everpure, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE