Commvault Systems, Inc. (Nasdaq: CVLT) plans to add data-posture and threat-hunting capabilities for Microsoft 365 backups, giving enterprise teams a way to investigate protected collaboration data before restoring it after a cyber incident. The development focuses on a recovery problem that can extend an outage: a backup may be available, but teams still need to determine whether the data in it is safe to return to production.
The company said its Data Posture 360 and Threat Scan capabilities will cover protected Exchange, OneDrive, SharePoint and Teams data. Data Posture 360, previously called Risk Analysis, is intended to map where sensitive data such as personally identifiable information and intellectual property resides and surface exposure risks. Threat Scan is intended to look across backup data for malware, ransomware, encryption activity, anomalies and other indicators of compromise.
Recovery Decisions Need Evidence, Not Just Available Backups
The operational value lies in connecting those signals to recovery. Commvault said the capabilities can help teams isolate compromised content and identify clean, trusted recovery points, so a recovery process can target known-good data rather than restore material that could reintroduce an incident. The company also said historical backup copies stored immutably can be examined using current threat intelligence, which could expose threats that were not identified when the data was originally protected.
That workflow matters for organizations using Microsoft 365 (Nasdaq: MSFT) as a business system for email, documents and collaboration. Security teams may investigate an active incident in production systems while recovery teams need to determine which version of a mailbox, document library or shared file set should be restored. The source does not establish that the new functions will automate that judgment; it positions them as additional evidence for the teams making it.
Security and Recovery Teams Gain a Shared Investigation Surface
Commvault is framing the tools as a bridge between data security and recovery operations. In practice, a data-posture view can help establish the sensitivity and location of information at risk, while backup scanning can add historical context about compromised or anomalous material. That combined picture can be useful when an incident affects more than one Microsoft 365 service or when a recovery decision has compliance and business-continuity implications.
The capabilities will be offered as paid add-ons to Commvault Backup & Recovery for Microsoft 365. The company plans an early-access preview in the coming weeks and targets general availability for early 2027. Enterprise buyers should therefore treat the disclosure as a product roadmap with a stated delivery target, not as confirmation that the functions are available for production deployment today.
Teams evaluating the offering will need to test the scope of supported data, scan coverage, alert handling, retention settings and the process for approving a recovery point. They will also need to determine how the threat signals fit into incident-response ownership and whether backup data can be reviewed without delaying time-sensitive restoration. The company did not provide independent performance data, detection rates or recovery-time results.
Why Trusted Recovery Points Change the Resilience Equation
The development reflects a broader shift in cyber resilience from preserving copies of data to establishing confidence in what those copies contain. Legacy backup operations often measure success by completion and recoverability. As ransomware and data exposure investigations become more intertwined with restoration, enterprises need to know whether a usable copy is also a trustworthy one.
Commvault’s approach places that question inside the backup environment, where historical copies can become evidence as well as recovery assets. It does not replace incident-response, data-governance or business validation, but it gives recovery teams a more structured way to avoid treating the newest available backup as automatically safe. That is a material change from legacy recovery workflows that separated backup administration from security investigation.