Veeam Resilience – Protect Everything, Recover Anything

Welcome to this Tech Field Day section, the heart of our presentation here at Tech Field Day Extra RSAC 2026. We're going to talk about resilience. I'm Rick Vanover from Veeam.

And I'm Emily Taas from Veeam. All right. So we're on a journey today.

We're walking through the new segments of the Veeam capabilities. But the part that I think is the heart of what we do is resilience, and that's what people have gotten to know Veeam from, but we want to walk you through a few of those things today. So this is that part of the journey.

So we're on our journey, and this is a part of where our products in market have brought Veeam to this conversation. But again, all this work of understanding, securing, and more. Who are you going to call upon should things not go as expected?

So we brought this up earlier, but Emily, you want to give your perspective to the different generations of disasters that are out there? Yeah. So, we've been on this long journey of resilience, right?

And we can say that in the beginning, it started with operational resilience, the fire, flood, and blood days of Mr. Rickatron here, right? There was a disaster.

There was some type of event from an operational standpoint. We knew we had to build recovery plans for this, whether that was disaster recovery or business continuity. We knew that we had to have a plan.

And this was pretty straightforward, right? We knew that we could just recover to the latest or most recent restore point. We knew it had to be at most instant as possible because we wanted to reduce our RPO, essentially, in that data loss perspective.

Preparation time generally took days or weeks. We had to build different playbooks. We had to test those.

Hopefully, we were testing those more than once a year. But I know for some, it was probably being tested every once a year, and the first part of that test was them updating everything that they should have updated throughout the year. And then the probability of that not working was low, right?

And it all related to humans, right? You had a human at the wheel that was driving these orchestrated responses. And there was little to no concern around exfiltration, and there was little to no concern around data sprawl.

But then we entered this world of cyber, and now we had an external factor that was working against us, and it was a targeted cyberattack, whether that was a ransomware incident or just an exfiltration event, some type of cyber threat. Our recovery point became unknown, depending on when that threat actor gained access into the system, depending on the type of infection that they had correlated. There was a lot that we had to do in terms of to understand what is going to be a clean recovery for us to go through.

And this significantly impacted the recovery time. It was longer now because now we had to think about reinfection. If we try to rush to recovery, then all of a sudden, our secondary DR site that was maybe a blind spot to the threat actor is now front and center and stage, and they're going to cripple our operational resilience in order to get a playbook or a ransom.

And your preparation time, for some organizations, it was random. For some, they thought that, "Well, ransomware would never hit us. We're a K through 12 school district.

We don't have any money. " Right? But it happens, right?

Some of those organizations that just didn't think that they would be a high target ended up being one of those. And your probability of this happening to you is very high, medium to high in most cases. And with this new world of AI, we also have identities that can be human, but also non-human identities.

The same AI that's driving some of our internal operations and making us better in terms of overall resiliency is also making those threat actors maybe a little bit better when it comes to building malicious code or doing additional reconnaissance or discovery once they gain access into the environment. And then on top of that, exfiltration becomes very high because we've actually seen this in the own data that we have from Cover by Veeam that works on ransomware incidents cases, where they see more exfiltration events happen versus pure encryption because threat actors, they want a payday. And one of the ways that they can secure a payday is if they threaten you to release information that they've taken.

So your data sprawl concern becomes very high, because if you have data that's being released onto the dark web, well, how do you own that? How do you control that? You don't.

And then we enter this world of AI resilience. You have over-privileged agents. You have people that are not coders or not engineers that are building their own AI agents.

They're giving it access to everything. They're giving it rights to go do certain things. And when they make mistakes, we got to make sure that we're recovering those mistakes very surgically because the last thing we want to do is recover good data from bad things, when that bad thing wasn't an intent or a harm on that pace.

And this has to be fast recovery time. Your preparation time can be random from it, and your probability of this actually happening now is high. I think from some reports, right, we see from a human to AI agent perspective, it's going to be ten to one from some of these different reports that we're seeing.

I know I met with an organization last year. They have over 10,000 AI agents that have already been deployed within their organization. Another one just got Claude code for each one of their employees.

They're like, "We don't care if they're in IT or engineering or if they're in sales. " So we're going to start seeing a lot of this take place, especially here at RSAC. And then from an identity perspective, now you have to think about the AI agents as well as non-human identities, the APIs that they have access to.

What are they doing with those APIs? And then on top of that, your exfiltration becomes a high concern because what are they doing with that data, where are they putting it becomes a big case. So these threats are evolving.

The sad thing is that it's not just because we fixed one, we can go to the other. No, we still from an IT and security team, we need to still be prepared for all three, and maybe for all three to be taking place at once. Bold claim.

I think this far column, we're going maybe ahead of the current state of the challenges. Column one, column two, I think we all agree are real challenges in the market. We're looking ahead to column threeYou know, check my thought here.

Do you see this as an upcoming emerging risk? I've done some AI agent things that luckily, sometimes there's safeguards, sometimes there's not. Right?

And just curious if you think we're ahead of our skis or where the market is, Tom? How would you... And it's going to be a little tongue in cheek example, but how do you deal with the, I don't know, the head of security and risk for your organization unleashing a claw on top- ...

of her email system? Because I think that that's one of the problems that people are having struggles with, is not so much that they know that there are things they need to watch out for, it's that, to quote my good friend Ivan Pepelnjak, automation, in this case AI, allows me to do stupid things faster than I could've ever imagined possible. " I think that that's where people are going to find challenges.

So I think that the struggle that they're going to have with a data protection company is, how quickly can I triage the problem, but then get back to a running state? Because who amongst us has not blown away a mailbox or a server or more? Of course.

But if we know we're working with a safety net, I can get that back. We need tools as fast as the problem. Right.

And that's where we live. And to one of Shala's points earlier, I think that the key there also is detection and information about it. Because sometimes we don't know that that's happening.

" before I get the next text message. " Well, I think that the expectation is that there's a high risk, and then the thought is the people who own the data, chief information security officers, chief data officers, data scientists, and then sideways to directors and management, depends on who the company is. They'll need to, I don't know the right word, but overlord just comes to mind in the sense that they need to oversee all these things because there is really no practical way to know what the organization is doing with the tooling they've been given.

" It's grim, but the way that I've always described with automation before is like, with all this tooling that we've developed, you're giving toddlers dynamite and hoping that they figure it out. Yes, there is a perfect path to that, but there's a lot of ways that things can get really messy. And there have been a few headliners of it going wrong.

Right. The dynamite exploding. We didn't bring those and prepare those examples, but they're out there.

Yeah. And I think we're going to only see more of that. So I guess maybe coming back to that, what does Veeam offer from a controls perspective?

Because obviously we know that your bread and butter is if it got blown away, we can get it back. But I also know that that is a resource question with money and time spent doing a restoration, even as good as you guys are. Yeah.

Shameless plug. But how do I prevent that from happening in the first place so that I don't have to use the other things that you guys have spent so many years working on? Dynamic pivot AC.

Mm-hmm. All right. So what we're going to do is I'm going to show you something that we...

Where's my mouse? I'm going to show you something, Tom, that we didn't have in the script, which was, I want to talk about something called Agent Commander. And this was an announcement a few months ago.

As to Michael's point of 100 some days into the acquisition of these two companies, security AI, the thought is Agent Commander is going to bring in three main pillars, detect, protect, and undo AI. These three primitives will be the first integration of our portfolio, so Data Command Center and the Data Command Graph that Michael was talking about, and the well-known recovery capabilities from Veeam. Okay.

Agent Commander is a marketecture. I'm going to just say it right now, but it is going to have an integration of these two things. Now, marketecture isn't the right word.

They want to call it a solution. But the reality is this will walk organizations through that. No, sorry, I should've closed that one.

But the thought here is this is Agent Commander going to be the one that bridges that gap from the AI agent discovery, permissioning, and more to the undo mistakes with precision thought here. So it's Agent Commander. It was big news at Veeam maybe three weeks ago or so, and it's the first directional integration of our platform.

But the reason why I called it a marketecture or broadly a solution is because it actually works right now with Data Command Center and the recovery capabilities we have. Just by way of analogy, the way that I think about it is I know that spray and wash will get drawn butter out of my shirt. But the solution is to wear a bib when I'm eating.

I've got to prevent- Okay ... the problem before... Because I have a lot of ways to restore it, and I like that, that we're lording over that, to use your terminology.

Yeah. Which is honestly is kind of a good way to look at it- Yeah ... because AI is honestly, it's a bunch of automated interns running around doing things that I really don't want them to do.

Yeah. Well, I think I like the bib part. But I just think there's trade-offs with velocity and innovation.

Oh, well, move fast and break things doesn't work- Yeah ... if the fast is hyper speed. But anything to add to that, Emily?

No. So you're onto kind of the vision, and we're early on in this journey. Make no mistake, these three generations of potential things to go wrong will pivot.

There'll be surprises. The AI space will change and give us new phenomena, and then we'll have to make new connectors, and we'll have to make new discoveries, and we have to make new things backed up, and we have to make new things recovered. We're on a journey.

This right now is a brief look at part of our product portfolio. And the reality is we back up so much, we're more than just virtual machines, kind of to what I started with. There are some things we don't yet, but there will be a time.

We get requests all the time for XYZ service. But the big services that are out there, chances are we protect already. And that's what I really wanted to convey here.

And then I guess we'll stop here for any questions on what we back up. I'd hope that when we think about the core of resilience, backup and recovery, replication and failover, storage snapshots, orchestration or some of the things that Emily spoke about, I would like to call us successful there. But I realize not everybody here or online calls data protection their primary skill.

But do we have any questions on resilience? Yeah, Shaila from Gifted Link. Yeah, it's Shaila.

Shaila. Sorry. You're good.

My name comes from a song, so no one knows how to say it. Oh, I get it. But yeah.

To piggyback off, I guess just to clear up, is there any monitoring of AI agents so that it could be detected if they have overprivileged access? Oh, yeah. That's the heart of the Data Command Graph and the Data Command Center for sure.

And Michael Cade is in the next session. We're going to hit the unleash pillar with AI agents, and so he's going to talk through that for everybody. Mm-hmm.

Yeah. And the only practical way to visualize all of this is with AI, honestly. Mm-hmm.

So that's where this all kind of comes together. But any other questions on core of resilience? A couple zingers I'll throw out.

I joined Veeam 16 years ago. I saw technology that flipped backup and recovery on its head. I don't want to say I'm lazy, but I saw something that let me be lazy, and that was instant recovery.

To take your backup and actually put it to work immediately rather than moving all that data back, so just to run in just moments, it was wild at the time. It imitated, duplicated in the industry plenty of other times. But that changed the game.

It changed the currency. It introduced the data labs. It really changed our portability story.

One thing we didn't talk about is moving off of VMware and stuff like that. We can help with that because of this portability stuff. But anyways, this is the heart of our business.

This is the bulk of our revenue. This is what a lot of people know us for, but it's not really what we're trying to tell now. We're trying to tell this additional story.

And fun fact about that, there's an organization that used Veeam to migrate 8,000 virtual machines- Yeah ... off of VMware into HyperV. Yeah.

Happens every day. I know some people that are using our free conversion technology to take either their clients' or their own infrastructure from one hypervisor and move it to another completely for free with Veeam. And now they're even entertaining going to KubeVirt containerization platforms, such as Red Hat OpenShift or a couple others, Morpheus and more, right?

So it's like Veeam can be part of that conversation, and what's interesting to Emily's example, a lot of times they're like, "We're only going to go there if we can protect it- Mm-hmm ... " So let's talk a little bit about if we remember the middle column of potential problems and cyber resiliency, and specifically ransomware resiliency. A couple questions came up in the earlier segments.

com. But a couple of other segments we asked questions about when can we detect potentially some of the problems. But I'll let Emily walk through this really powerful grid of what we do, but I want to kind of set the scene when it comes to ransomware cyber incident preparedness.

In first quarter of 2023, we acquired a company called Coveware. Coveware previously did in-house incident response of their own, and it had a couple of software toolings that would help build data pipelines and help with recovery. They were really an expert in incident response.

com, incredible visibility into some of their threat actor behavior, some of the modes of entry, some of the TTPs that are in use by threat actors. But anyways, Bill likes to say that we can tell in the first 15 minutes of a conversation how well or how poorly an incident response is going to progress just based on how prepared an organization presents themselves during the initial phone call. That probably checks out, and if you think about the preparation of what do we do when bad things happen to good data, we are in the business of working left of the boom.

And when it comes to ransomware resiliency, I know, Emily, you live in this world here. Mm-hmm. Walk us through the before, the during, the recovery, and some of the zingers that Veeam brings along the way.

Yeah, so this is going back to some of the questions earlier, right, of like, hey, does Veeam have a way that they can discover or be able to provide some additional scanning capabilities outside of what happens with the backups themselves? So before the backup even takes place, right, we have different ways in which we can kind of correlate and contextualize data. So first being that Veeam incident API that Kate spoke about earlier, right?

Well, this is a public API that different types of security platforms can write to. So essentially if they're finding something from an EDR perspective, that endpoint detection response tool, they can go ahead and they could flag that inside of Veeam and say, "Hey, we just identified a potential suspicious activity that's happening within production. We have traced this back to being close to 48 hours old.

There's a good chance that your backups that have taken place within the last 48 hours could potentially include this. " Or let's say we're seeing encryption happening during that time of production machine. So that machine itself is in the process of being encrypted by some type of malicious strain, and that EDR tool sees that.

" So this is, again, before a backup even takes place. Another bit of information that was captured from our Cover acquisition was this recon scanner capability. So recon scanner is what they utilize to help them build and kind of track what has happened within that timeline of the incident.

So it lives off the production machines itself. It captures logs, and then from there, all of the actions and that information is formulated and based through the MITRE ATT&CK framework. So we could see things like brute force attempts, we could see things like changes within credentials.

We could see when tools were installed or downloaded that are living inside of that machine that probably shouldn't be there. So that recon scanner capability is actually showing us these types of techniques or tactics that those threat actors are utilizing and forwarding those over into production so that way we could be more informed to that overall risk mitigation that we could provide before backup, again, takes place. And then during a backup, you have the whole line of different things that Veeam's able to do, right?

Inline detection from a malware perspective, file system activity analysis, meaning we could go and look at the files itself and see if there's any encryption or any changes or anything like that that has happened to the file systems that we could flag as either suspicious or malicious. And then we have those IOC tool scanner, meaning we're seeing remnants that were left behind from a threat actor where they might have tried to perform some type of exfiltration tactic. And then during the recovery response, you have the items like secure restore, meaning let me go ahead and pull this back up, isolate it inside of the sandbox, and do a restore.

But let's go ahead and do some additional checks. Let's run a YARA rule against it. Let's leverage Veeam Threat Hunter, which is Veeam's own AV detection engine that we've formulated specifically to work with Veeam backups that can actually provide a better output for customers.

So they could run Veeam Threat Hunter to do this AV signature-based detection, and then they could also run their own internal AV signature-based detection and get two lines of outcomes sent back to them. So they could see what Veeam pulled up, and then what does their own in-house AV signature look like. And then, of course, that could all be fully orchestrated and set up to work within a clean room.

So we'll support other customers' clean room environments. I have a customer that leverages a separate subscription within Azure, and that is their quarantine network that they will recover to, that they'll test to validate and do some scanning. And then again, at the end of the day, we have this incident response or cyber extortion readiness responsibility that's available via Cover, where number one, if you're doing all these things, hopefully you're not calling, right, to get that incident because that means that there was a failure or there was a breakdown.

But the one beauty of the fact that Cover could do was that they could see when everything had went bad from an organization standpoint, and they formulate that into proactive readiness assessments. So they go in quarterly to different customer environments, and they can show them, "Hey, these are the new techniques that threat actors are utilizing. " And they actually publish this online.

You can actually find it on their quarterly reports. Top 10 threat actors, most used techniques, tactics, procedures that they've utilized to gain access into systems. Did they exfiltrate?

Did they encrypt? Et cetera. So they have all of that information, but they provide that back to organizations so that way they could be proactive.

But then on top of that, they ride alongside that legal perspective and regulation perspective that if you are in an incident, they could help provide some additional information and clarity based off of what is happening. So they'll ride alongside the Mandiants and the Unit 42s that are doing containment and eradication, but they'll just be providing some additional services on top of that. And also intelligence sharing with cybersecurity law enforcement.

Ah, yes. Which is a big, it's actually a critical point of engagement. One thing I'll say about this end-to-end resilience claim, our claim specifically in the data protection industry.

We are claiming, going to analysts, going to customers, that we have the most comprehensive end-to-end resilience, and we're not getting pushback on that. This is a bold claim, and every one of these tiles have their own amazing stories, okay? Mm-hmm.

Customer examples. I'm going to give you one right here. We have probably close to 70 different ways that we can store data immutably on an immutable media.

I'm based in central Ohio. We have over half a million customers. I have been telling this story for a few years now, and it's still true to this day.

If we have our customers' backup data in an immutable target and they have their encryption password, very important and, we don't have a case on record of someone unable to recover data in a ransomware incident. That's really powerful if you think about the sheer volume. Every one of these have a story of saving the customer from potential bad things.

You're in the right place. Veeam's end-to-end resilience is by far the most comprehensive in the market. So it's a bold claim, but the thought here is we innovate and then we have our ecosystem partners that you were talking about.

Yeah. So all of those capabilities that you're seeing there, those all be sent up to the SIEM providers- Yeah ... and SOAR providers.

" Yeah. " So bringing in those security teams and IT ops teams together. And then I have a couple of things I want to go through a little bit different.

I want to myth bust. I think you talk about a lot of established brands in the space. There's a perception, and I even started with that.

And when I set up the Veeam of today, it's a little bit different than what someone may first know about Veeam. Let's start with this one. Veeam is an enterprise.

Doesn't scale. Only a small business. Now I showed you some of the revenue numbers.

Those are big adult numbers, which is great. But my proof point here, and this is something that the audience watching online, you can go to this. I think this is a really bold move because we share designs, like sizing all the different componentry to deliver a solution, no login required.

We don't hide this information at all. One of them is, I'll just say it, it was a large bank. The one that's 10,000 VMs, two data center, that one was a large bank.

The one that was 26,000 VMs was a retail operation. These are field-proven designs and validated by our product management team. Now I don't think any one of us necessarily needs this, but I think it's a proof point that we have this out publicly on the market.

Mm-hmm. Another myth I want to bust is that it's not secure. Veeam's only runs on Windows.

So I want to say it was November of last year, the version 13 went GA with the Veeam software appliance, and I know that some of those in the room here were at the Security Field Day 13. We were in kind of a preview of that. Now since that's gone fully generally available, that really dispels some of the biggest myths that we have.

Oh, absolutely. Yeah, 90% of the code actually was rewritten, so that way it runs on a secure Linux deployment for customers. Yeah.

It's Rocky Linux, so if you all are familiar with that. And what's interesting, another bold claim that Rick drops on Monday mornings is the Veeam software appliance that Veeam offers in version 13, as far as we know, is the only commercial software, especially in the data protection backup space, is the only commercial software prepackaged with a DISA STIG hardening profile applied at no additional cost. That's a big claim.

DISA STIG doesn't play. That is a very serious security profile. And to have that built into the Veeam software appliance, I think that saves a client an incredible amount of time.

And so when we talk about that Veeam software appliance, pre-built, pre-hardened, and predictable operations, that's really the heart of it. I'm going to talk a little bit about the pre-hardened part, but anything you want to add, Emily, to these two other tiles? No.

No? We got- Okay. We got time.

We got time. Yeah. But it is a packaged appliance.

That's a big benefit. It's a consumption model. Now, we still have the Windows environment.

It's hard to be absolutely prescriptive to customers, but we've gotten feedback. We need an appliance. We need not Windows.

Okay, done, sorted. And so the other thought of having it predictable, there's kind of this great day one view or day zero view. Hey, it's pre-built, pre-installed, pre-hardened, and predictable.

But what about day two when we have to do an update? All software needs to take an update. So I've embedded a video here of how the individual componentry, so this is a view of the individual Veeam host management.

So this could be a proxy, it could be a repository, or it could be the Veeam server. It's got quite the long password, trust me on that, and it has OTP, MFA required, and I've put that in. And the thought here, just a quick view of this host management, this is different than the day-to-day backup administration.

This is the actual infrastructure of it. And so things like setting the network time, changing passwords, et cetera, potential remote access for SSH off by default. If you turn it on, it turns off at 24 hours, by the way, or some number of hours.

But what I want to draw your attention to is this notion of updates. And I did this Friday before we came. So Friday was the 22nd, if I remember, or 20th, if I remember right, and we're live here on the 23rd, but look here, updates to install.

Note it says it checked an hour ago, but it says they will be installed automatically. It would've been, I guess, Sunday night- Mm-hmm ... if I didn't do this.

So I personally spin this as a benefit. " And I can just have this done. I can look at the history, and should I want to see specifically what happened when packages were updated, of course, we can accelerate that and take a look.

But the thought here is, I'm going to do these packages, updates. It's pretty straightforward. It downloads, it updates, it goes, and then it's updated.

All right, so I think that that's just a quick example of mandatory... Yeah, Michael? So I was going to say about the up- Well, come on up here.

Yeah. Be on camera. That's the rule.

The rule. Yeah. So I was going to just say, so- Sorry ...

I know Rick alluded to it, all those updates are from the operating system level up, as well as Veeam. Yeah. So we're looking after...

So the Rocky Linux mentioned is actually a Rocky Linux distribution that we've engineered with a partner that is hardened, so it provides that. No one can SSH into a Rocky Linux shell and start installing other packages. It's completely hardened.

It's our Veeam distribution that is used for all of the components that we have. And those automatic updates are from the operating system up to the application. Yeah.

So cool. Thank you for that, Michael. And then the thought here is that the core resilience, we're making it easy to run, to protect, easy to recover as well.

I like to say that nothing in Veeam is more than seven clicks of a wizard. Mm-hmm. I still think even with Data Command Graph, I'd say most things would still be in that rule.

But when it comes to resilience, any questions or comments that we can talk to? Jack Palmer here. I have a quick technical question on the updates.

Do the updates happen in the middle of a backup? So will it stop a backup, update, reboot, continue or does it try to find a window? Because I think it might have a problem finding a window.

Great question, Jack. It's configurable to the window. The default time is not the default time of a backup.

So I would recommend people to explicitly set a time so that they know when it would be. Yeah. Like flip it around to be middle of the day versus middle of the night.

Well, you could schedule it. Yeah. So you could schedule it.

Veeam out of the box, it's 3:00 AM. Mm-hmm. Yeah.

But yeah, it's a manual change, so it's not dynamic. If you've set a backup job at that point as well, remember this is just the control plane, so that can be bounced at any point. Okay.

But the proxies that are lifting and shifting data, yeah, you definitely don't want them updating and rebooting- Yeah ... when they're lifting and shifting data. So- Yeah ...

those guardrails in place, that that won't happen. The backup will take priority to get that over. And if the control plane bounces, the backup will continue.

Yes. Yes. Worst case, retry.

Yeah. And there's visibility on that. It rolls up to consoles, emails, and the like.

And I'll just give you one last example as we wrap. I had one in my lab, many deployments of the Veeam Software Appliance, I forgot about one, but that's okay. It updated automatically.

It was ready to go. All right. So I'm Rick Vanover.

Thanks for watching this segment of Tech Field Day Extra from RSAC 2026 on resilience. Thank you.