Commvault launches AI cyber resilience recovery test

Commvault has launched Minutes to Recovery, a cyber resilience simulation focused on AI-driven attacks. The programme lets participants test attack, defence and recovery responses in a single exercise.

The new offering is a two-hour session in which security and IT teams move through three stages of a cyber incident. Participants first take the role of an attacker using what Commvault describes as frontier AI tools, then switch to a defender role and finally to a recovery specialist tasked with restoring systems and data to a verified clean state.

Commvault is positioning the exercise around the shrinking time between the discovery of a vulnerability and its exploitation. It says that window has fallen to 29 minutes in 2025, 65% faster than the previous year.

That shift has increased pressure on organisations to test whether recovery plans can hold up during a live incident, rather than only on paper. Minutes to Recovery is intended to expose technical and operational weaknesses, particularly where coordination between teams breaks down under pressure.

Three-stage exercise

In the first stage, participants build and experience an AI-driven attack designed to mirror methods now used by adversaries. The exercise is meant to show how quickly such attacks move, how phishing can be personalised, and how rapidly backup infrastructure may be targeted.

In the second stage, participants must make detection and defence decisions in real time with limited information and competing priorities. In the final stage, they must recover systems and data without reintroducing the threat into the environment.

The exercise is available globally as an onsite event and can be delivered in six languages. It also produces a Mean Time to Clean Recaovery benchmark, or MTCR, which Commvault says measures recovery readiness based on performance during the simulation.

Anna Griffin, Chief Market Officer at Commvault, said the launch reflects a broader change in how cyber resilience is assessed.

"The question organizations need to answer is no longer, 'Do we have a recovery plan?' Instead, they should be asking, 'Can we prove it will work under pressure?'" said Anna Griffin, Chief Market Officer at Commvault.

"As AI compresses the time between compromise and impact, resilience becomes a measurable business capability. Minutes to Recovery helps organizations move beyond assumptions and demonstrate their ability to recover cleanly, quickly and with confidence," Griffin added.

Partner channel

Commvault also plans to make the simulation available through its global partner network. This would allow partners to run the exercise with customers as part of cyber resilience discussions and testing.

Kyndryl is among the partners backing the approach, linking the exercise to customer demand for practical validation of incident response and recovery readiness as attacks become harder to predict.

"Most organizations believe they are prepared for a cyberattack until they are forced to respond to one in real time," said Allen Downs, Vice President of Security and Resiliency at Kyndryl.

"As cyberattacks become faster, more sophisticated and increasingly unpredictable, recovery strategies must evolve to meet this new reality. By leveraging this experience, Kyndryl can help customers strengthen their readiness, validate their resilience and improve their ability to recover from disruption. Ultimately, resilience is not defined by the plans organizations create, but by the scenarios they have rigorously tested," Downs said.

The launch reflects a wider trend in the cybersecurity market towards hands-on simulations that bring together offensive testing, defensive decision-making and restoration planning. For vendors and service providers, the emphasis is shifting from the existence of a response plan to whether teams can execute it quickly enough when attack timelines are measured in minutes rather than hours or days.

For Commvault, the new simulation extends its push into cyber recovery and resilience at a time when backup systems are increasingly part of the target set during attacks. By requiring users to think like attackers before defending and recovering, the exercise is designed to show where assumptions fail when decisions must be made under pressure.

The resulting MTCR score is intended to give organisations a factual benchmark tied to performance during the session rather than to a theoretical recovery objective.