Backup and IT management

IT teams already use AI for tasks that include disaster recovery (DR) planning and resource allocation. Some do this by using AI to mine historic data to predict when systems might fail. For others, AI “copilots” carry out simple but time-consuming IT management tasks such as updating inventories and mapping how data is used across networks and applications.

Storage optimisation, monitoring backups – especially for evidence of malware – and compiling risk assessments for DR are all tasks that lend themselves to AI.

When it comes to backup tools, most use AI in three ways. These include helping users with setup and configuration, optimising the backup process – including storage optimisation and tiering – and anomaly detection. Suppliers and chief information officers see anomaly detection as an increasingly important feature of any backup tool.

The growth in ransomware and ransomware gangs’ increasing proficiency at targeting backup has forced IT teams to look again at how they secure backup volumes.

Backup software should ideally detect and remove any malware at source before data is copied. This is also known as in-line malware scanning.

As an additional protection, software should scan volumes for anomalies or indicators of compromise. Most, but not all, suppliers now offer this. Anomaly detection should also help IT teams find the last clean backup, and so prevent organisations from reinfecting systems from a compromised file.

IT teams can also use AI-driven anomaly detection to find other issues, such as data corruption or accidental deletion. These might not be due to ransomware, but they could cause data recovery to fail.

The focus on ransomware detection and remediation, however, is part of a wider trend for backup and recovery suppliers to reposition themselves as security companies, rather than simply IT administration tools.

“Backup is increasingly a feature of broader data protection solutions, which includes security and threat detection,” says Jon Collins, field chief technology officer at analyst GigaOm. “The AI we’ve looked at tends to cover this aspect more. Beyond user incompetence, or, ‘Honey, I deleted the data warehouse’, the biggest threat for which backup is a response, is ransomware. So, this makes sense.”

However, suppliers also offer extensive and various capabilities away from ransomware that can make backup and recovery more efficient and effective.

Here, we look at some key backup product AI features.

Acronis

According to Acronis, it has used AI since 2017, when it started work on stack trace analysis for Windows OS, followed by an AI static file analyser to detect variations of malware samples, and behaviour engine log detection. Acronis also uses AI to check backups restore correctly and will boot.

Acronis’s tools can predict hard disk and SSD failures, and uses AI-based monitoring to look for anomalies. The supplier has its own chatbot, Acronis Copilot, and “conversational” AI to support incident response.

The supplier also states that using AI to carry out behaviour analysis is more effective than older, pattern-matching approaches to ensure backups are free from malware.

Cohesity

Cohesity uses AI across a range of its tools. It has AI-powered ransomware detection and remediation in Cohesity Turing, with AI and ML used for discovery, detection and reporting. Cohesity DataHawk provides ransomware protection through AI-based threat detection, “cyber vaulting” and a machine learning-powered data classification tool.

Cohesity’s Gaia tool offers conversational search that allows IT teams to work more easily with backup data through use of natural language. Cohesity also uses AI for capacity planning. That’s not specific to backup and recovery, but has the potential to cut the costs of data protection.

Commvault

Commvault’s Metallic AI uses AI, ML and natural language processing (NLP) for data protection and recovery. This includes AI-assisted anomaly detection, and “AI-enabled bursting” to allow organisations to recover data more quickly. Commvault also provides AI-based data classification, to enable organisations to prioritise backups as well as to improve compliance.

Commvault uses AI for on-premise workloads and Commvault Cloud. It states that AI and ML are used for threat detection and recovery, as well as risk management.

Druva

Druva has two primary AI-based tools: Dru, its copilot; and Dru Investigate. The supplier launched Dru in 2023, and positions it as a way for IT teams to improve productivity and make better decisions. Dru uses a conversational interface to simplify administration and improve reporting.

Dru Investigate aims to help organisations secure their backups and reduce security threats, including by showing data that is at risk and speeding up investigations. Dru Investigates uses large language models and a private retrieval-augmented generation tool to reduce security team workload when it comes to monitoring their backup environments.

Rubrik

Ruby is Rubrik’s AI assistant, which the supplier says helps organisations with cyber response and recovery. This includes AI-powered anomaly detection, as well as guidance on how to isolate and remove infected data.

Rubrik says it uses machine learning to analyse deletions, modifications and encryption of customer data, as well as to provide alerts on any threats hidden in backup data. Rubrik is able to identify the most recent clean backups, across files as well as snapshots. It also helps IT teams create clean VMware instances for recovery.

Veeam

Veeam has AI-based analysis that covers backup performance monitoring, predictive analysis to find potential risks, and ML-based ransomware and threat detection. Its AI scans backups for anomalies on a continuous basis.

The supplier also uses AI for data management and data classification. It says that can enable “smarter” decisions about storage. And, although it is not a feature of backup per se, Veeam supports the Model Context Protocol. This open standard, developed by Anthropic, allows AI models to access enterprise data stored in Veeam repositories in a secure way, for tasks such as model training.