Agentic AI era forces security and resilience together

Agentic AI is tearing down the fence between security and resilience, merging them into one discipline.

“For two decades, security and data resilience have been neighbors who share a fence but rarely a budget.”

Veeam launches iResOps for Microsoft 365

Veeam announced Veeam Intelligent ResOps, or iResOps, with Microsoft 365 as the first generally available workload.

Agent-driven breaches are harder to fix

An ai agent in a spanish company modified personal data and billing records without detection.

“A company in spain recently told its regulator that an ai agent, acting largely on its own, breached it by finding a flaw in a live application and modifying personal data and billing records.”

The three eras of data security

Security assumes failure, resilience assumes breach, and agentic ai assumes drift.

“Eswaran described three eras: backup and recovery, where the rule was to assume failure; cyber resilience, where the rule was to assume breach; and the agentic era, where the rule is to assume drift.”

Data drift causes real damage

Data drifts too, gets stale, reclassified, and poisoned by agents.

“The data is not temporary, and the data drifts too. It goes stale. It gets reclassified. It gets poisoned.”

Agents are harder to track than data

88% of organizations use or pilot ai agents, but only 7% are truly ai-ready.

“According to veeam’s data trust & resilience report 2026, 88 percent of organizations are using or piloting ai agents, yet only 7 percent qualify as truly ai-ready.”

Recovery point vs recovery map

A recovery point tells what you can restore, while a recovery map shows what to restore first.

“A recovery point tells you what you can restore. A recovery map tells you what to restore first, what changed, and what not to bring back.”

DataAI Command Graph connects data

The DataAI Command Graph connects data, users, permissions, agents, activity and protection status.

“The map he referred to is the dataai command graph, brought over from securiti, which connects data, users, permissions, agents, activity and protection status across live and backup environments.”

iResOps finds and fixes agents

iResOps discovers copilot and other agents, shows sensitive data access, and flags rot.

“Iresops for microsoft 365 is an add-on to veeam data cloud for microsoft 365 that requires no data migration. It discovers copilot and other agents, shows what sensitive data each can access, flags redundant, obsolete and trivial data, or rot, and lets teams undo an agent’s changes, file by file.”

Customers find rot is critical

25 agents on a single tenant, two actively modifying data, rot affects compliance and ai accuracy.

“Veeam said preview customers found that a quarter of a 40-terabyte estate didn’t need to be in production and that there were 25 agents on a single tenant, two of which were actively modifying data.”

Construction Resources needs data clarity

Construction Resources needs to know where data came from and where it’s going.

“Robert davis, director of information technology infrastructure and operations at construction resources, a home depot company, said organizations need to know where data came from and where it’s going before people have a case of copilot gone wild.”

Fidelity sees data recovery as critical

Fidelity requires data recovery and identity revalidation after breaches.

“Steve mcintyre, senior vice president of data protection, analytics and cloud security at fidelity investments, put it plainly: if you have an event, you have to assume that you have to recover the data as well, and identities must be revalidated so we’re not just reopening ourselves to the same attack.”

Merge security and backup playbooks

Create a joint incident playbook for security and backup teams.

“Merge the playbooks. In most companies, security operations and backup teams have their own tools, leaders and tabletop exercises. That worked when incidents moved at human speed and handoffs could happen over a conference bridge. An agent-driven incident doesn’t wait for a handoff.”

Treat rot as a security issue

Redundant, obsolete and trivial data is a security risk in the agentic era.

“Treat rot as a security issue. Redundant, obsolete and trivial data has long been a storage-cost conversation, so it rarely gets prioritized. In the agentic era, it’s a risk conversation.”