BDRaaS Briefing: Backup Vendors Start Watching the Agents
Three backup vendors spent the week on the same problem. Veeam, Commvault and HYCU each shipped or previewed something that looks at what surrounds the backup: which AI agents can touch the data, what is sensitive, and which restore point is clean. Only Veeam’s is generally available today.
Acronis went a different way and put a number on recoverability. Redcentric has finished turning itself back into a pure MSP, Scaleway’s Milan region now has three zones, and AhsayCBS needs patching again because August’s fix did not hold.
Vendor releases
Veeam makes Intelligent ResOps for Microsoft 365 generally available
Veeam made Intelligent ResOps for Microsoft 365 generally available on 15 October, the first iResOps product to reach GA. It is an add-on to the Foundation and Advanced editions of Veeam Data Cloud for Microsoft 365, and Veeam says it attaches without migrating data. It finds Copilot and other AI agents in the tenant, shows which sensitive data each can reach, and lets an administrator review an agent’s changes and undo them one file at a time. The governance side comes from Securiti AI, which Veeam bought. No pricing was published, StorageReview reports.
The practical bit: It is available through Veeam Cloud & Service Providers, so if you resell Veeam Data Cloud for Microsoft 365 you can quote it now. Ask a client mid-way through a Copilot rollout who currently answers “what did the agent change last night”. If nobody does, that is the conversation, and the file-by-file undo is the thing to demo.
Commvault previews threat scanning for Microsoft 365 backups
Commvault announced two paid add-ons for its Microsoft 365 backup. Threat Scan looks for malware, encryption activity and other indicators of compromise in backup data, including older immutable copies. Data Posture 360 maps where personal data and intellectual property sit across Exchange, OneDrive, SharePoint and Teams. Both enter early access preview in the coming weeks, with general availability targeted for early 2027, according to IT Brief Australia. No prices were given.
The practical bit: Nothing to sell this quarter. It does raise a fair question for whatever Microsoft 365 backup you run now: after a compromise, how do you know the restore point you picked is clean? If the answer is “the newest one before we think it started”, that is a guess, and the runbook should say so.
HYCU’s free aiR Graph maps AI agents against unprotected apps
HYCU has made aiR Graph generally available, IT Europa reports. It connects read-only to Entra ID and Okta, lists each agent’s reach, whether it runs unattended and whether it has an owner, then flags which applications those agents touch have no independent backup. Blocks & Files says it is free to any organisation, customer or not.
The practical bit: A free read-only tool is reasonable to run during a client assessment, with written consent. The output worth having is the list of applications agents can write to that nobody backs up. That is scope you are not currently selling.
As a service
Acronis puts up to $1 million behind recovery from its cloud
Last week Acronis mentioned a recovery warranty without a figure. Its Cloud Storage page now gives one. The warranty covers qualifying endpoint disk, volume and file archives, and eligible customers may be reimbursed up to $1 million in qualifying recovery costs if a covered recovery point cannot be restored, whether the cause is ransomware, human error or a failed backup. The recovery point must sit in Acronis Cloud Storage with two-factor authentication, immutability in Compliance mode, an approved validation method and an active service. Acronis says it is not cyber insurance, and the Warranty Policy governs.
The practical bit: The conditions read as a hardening checklist. In my experience Compliance mode and enforced 2FA are the settings that get left off, because they generate tickets. Count how many of your tenants meet all of them before anyone mentions the warranty in a proposal, and quote the policy, not the blog.
Redcentric is a pure MSP again, and is going after VMware churn
Redcentric has sold its data centre business, built partly on Sungard’s former assets, to Stellanor Datacenters Group for a final £124.9 million, and returned £90 million to shareholders. Revenue for the year to 31 March fell 2.3% to £132 million, partly from customer losses inherited with Sungard. IT Europa reports it is now targeting public sector and regulated customers, and is one of seven UK Pinnacle Partners in Broadcom’s VCSP programme.
The practical bit: If you take colocation or DR space in those facilities, the operator is now Stellanor; reread older contracts for assignment terms. Separately, a newly debt-light UK MSP with Pinnacle status is pitching the same regulated VMware estates you are. Know which of yours renew in the next two quarters.
Scaleway’s Milan region now has three zones
Scaleway has opened two more availability zones in its Italy region, in Basiglio and Milan, alongside the single zone that opened in March. DCD reports it plans three zones in Stockholm and three more in Frankfurt during 2027.
The practical bit: A single-zone region is somewhere to keep a copy. Three zones make Milan a credible in-country recovery target for Italian clients who need residency and failover inside one jurisdiction. If Italian data has been going to Paris or Amsterdam for want of a local option, price the move.
What is being exploited
AhsayCBS patched again after August’s fix fell short
Ahsay has issued new fixes for CVE-2026-105133 and CVE-2026-105134, an authentication bypass and command injection in AhsayCBS that chain into unauthenticated remote code execution. Huntress saw them used to drop web shells and XMRig miners. Ahsay has confirmed the August releases, 9.15.2.59 and 10.3.4.0, did not fully close them. Version 10 servers need hotfix 10.3.4.45 and a reboot, and CISA has added both flaws to its exploited list, The Hacker News reports.
The practical bit: If you run AhsayCBS, the August patch gave you false comfort. Patch, reboot, then look for web shells and unexplained CPU load. A miner is the noisy payload; whatever else came through the same door may be quieter. Off version 10, get the right build from Ahsay’s partner portal, not a forum.
Cohesity’s Q3 count has European victims more than doubling
Cohesity’s Q3 figures, reported by ITPro, put UK attacks up 60% on the quarter. The US share of recorded attacks fell from 51% to 34%, while European victims more than doubled, led by Germany, the UK and Italy. Qilin and The Gentlemen account for 32% of UK attacks between them.
The practical bit: Counts like this are usually built from leak-site postings, so hold the percentages loosely. The direction still matters at renewal: a European client who files ransomware under American problems has less basis for it this quarter.
Regulation and compliance
The ESAs keep DORA oversight of critical ICT providers on the 2027 list
The Joint Committee of the EBA, EIOPA and ESMA published its 2027 work programme on 13 October. Digital operational resilience is a named priority, and the ESAs say they will continue overseeing critical ICT third-party service providers under DORA.
The practical bit: Few MSPs will be designated critical, but financial-services clients’ obligations reach you through contracts, exit plans and testing requests, and supervisors are signalling another year of attention on the supply chain. If you back up a bank, insurer or investment firm, have your DORA contract schedule, exit plan and latest restore evidence ready before they ask.
Also worth knowing
- Acronis has appointed Prakash Panjwani, who led WatchGuard for a decade, as chief executive, succeeding Jan-Jaap Jager (Acronis).
- Proofpoint, owner of Hornetsecurity, has agreed to buy Varonis for $6.3 billion, expected to close in the first half of 2027 (Data Breach Today).
- ExaGrid reported its best third quarter, with over half its business outside the US (Blocks & Files).
- AWS will run its European Sovereign Cloud without the AWS backbone for several hours on 24 October, with brief connectivity disruptions expected at each end. Relevant if you replicate there (AWS).
What to do this week
- If you run AhsayCBS, apply the new hotfix, reboot, and check for web shells and miners today.
- If you resell Veeam Data Cloud for Microsoft 365, show the file-by-file undo to two clients with live Copilot rollouts.
- Audit your Acronis tenants against the warranty conditions before the warranty comes up in a sales conversation.
- For financial-services clients, put your DORA contract schedule, exit plan and latest restore evidence in one place.
