Commvault’s CTO Puts Data Resilience at the Center of AI Strategy as Breaches Become the Baseline

The views and opinions expressed are those of Pranay Ahlawat and do not represent the official policy or position of any organization.

Enterprises are spending at record levels on security, and the breaches keep coming anyway. That arithmetic is changing the starting assumption in the boardroom, where leaders have stopped planning only to keep attackers out and started planning for the moment one gets in, asking how confident they are that they can bring the business back. AI sharpens the question on both ends, handing attackers faster and cheaper ways in while multiplying the data that has to survive the day something breaks. The speed a company wants from AI, it turns out, is capped by how fast it can recover.

That shift from prevention to recovery is where Pranay Ahlawat starts. As Chief Technology and AI Officer at Commvault, and before that a Partner at BCG leading enterprise software and cloud strategy, Ahlawat spends his days where data protection, security, and AI strategy run together. Most organizations, he argues, are carrying far more risk than they can see.

The instinct in most shops is to file data protection under infrastructure, a utility humming somewhere beneath the AI work that gets all the attention. Ahlawat moves it up the stack. "Your data resilience needs to be a fundamental pillar of your cybersecurity and resiliency strategy," he says. "It has to be. Without it, you're taking on much more risk than you realize." He frames the case as deductive rather than promotional. Once an organization accepts that a breach is coming, the ability to restore clean data on demand, with provable recovery, stops being a line item and becomes the hinge the whole AI program swings on.

Spending up, breached anyway

Defensive investment has never been higher while the attacks keep multiplying, and part of what's changed is the attacker's math. AI has made intrusions faster and cheaper to run, which pulls more of them into reach. Part of it is self-inflicted. "As you start to use AI, it actually increases your surface area of attack," says Ahlawat. Each new opening brings risks that are already catalogued, like data poisoning, alongside a longer list nobody has named yet. "You can plan for the knowns, but you can't plan for the unknowns."

He's sharper on the perimeter. Walls still matter, but Ahlawat treats them as insufficient on their own. "Traditional perimeter-based security investments, even though they're well intentioned, are not going to be enough. You will still get breached." The leaders he rates most highly have already moved beyond the perimeter and started hardening the things that decide what happens after the wall is down: immutability, air gapping, and the ability to recover at all. What he sees across the market is a wide readiness gap. "It's unbelievable how unprepared companies are," he says, with a handful of organizations well drilled and most of the field exposed.

The new shape of recovery

Accepting breach as a given changes what recovery itself has to look like. The old picture, Ahlawat says, was deterministic, "with administrators sitting at a screen recovering workload by workload." That doesn't survive contact with AI-era data volumes, which have jumped from manageable to petabyte and sometimes exabyte scale. The old reflex of replicating data and standing it back up on its own carries a trap. "The data that you're bringing back might be infected itself." Modern recovery has to scan what it restores before it goes live, and treat the restore as something to test, not trust.

Underneath the recovery problem sits a visibility problem Ahlawat thinks most companies underrate. "A lot of companies have basic visibility problems. They don't know what's sitting on every single employee's laptop. They don't know what has been emailed." Mapping where sensitive data lives, what type it is, and whether it meets local and sovereign rules now takes automated discovery and classification rather than periodic audit, because the data keeps outrunning the controls. The tooling meant to help is itself fragmented, split across cloud and on-premise, structured and unstructured, with endpoints on their own patch. "It's a patchwork of processes and tools," he says, "and companies carry more risk than they think they do."

The economics add a second kind of pressure. With the cost of storage climbing as AI demand strains supply, the petabyte-scale resilience Ahlawat describes becomes a portfolio decision as much as an architectural one, forcing fresh calls on what to keep hot, what to move, and what to build versus buy.

The confidence to move faster

For all the talk of risk, Ahlawat's core argument is optimistic. "A good car will always have good brakes. You cannot build a good car without investing in good brakes," he says. "Confidence that your car will stop enables you to move much faster." Resilience, in that telling, is what issues the permission slip to deploy AI aggressively in the first place. "You're making investments in AI to move faster, but the confidence with which you can move is a function of how resilient you are as a company."

That confidence has a human dimension he thinks gets too little attention. Employees everywhere are already feeding corporate data into tools that were never sanctioned, and the rise of shadow AI has an invisible cousin in AI personal assistants that plug straight into email and move data outside the security perimeter without anyone noticing. "Your corporate data, your trade secrets, are getting uploaded to AI platforms that maybe you haven't sanctioned," he says. His fix is the same discipline security teams already apply elsewhere. "Just like we all go through phishing simulations, we need to invest in our people so employees understand safe and responsible use of AI."

The same instinct toward control is reshaping architecture. Ahlawat points to the pull toward sovereign environments where models and data stay inside an organization's own boundaries, a direction the largest infrastructure players are now building toward. Where he lands is a warning about tempo. The models driving all of this, he says, will keep improving severalfold every year, and most organizations are planning as if the pace were linear. "Humans are not very good at thinking in exponential improvements." His advice to the people reading is to close that gap on purpose. "Think three steps ahead," he says, "and start to make the investments today so that you are safe tomorrow."