When an AI agent changes the wrong business records, stopping it is only part of the job. IT teams also need to understand what changed and what they can restore.
Commvault and Zscaler announced a strategic partnership on Nov. 10 aimed at bringing together Zscaler’s AI security controls and Commvault’s data protection and recovery technology. The goal is to help enterprises monitor AI activity, control what autonomous agents can access and restore affected systems when something goes wrong.
The announcement comes as businesses move AI agents beyond testing and give them access to corporate applications, data and infrastructure. The partnership brings two different parts of enterprise security together.
The planned collaboration would pair Zscaler’s AI visibility and policy controls with Commvault’s capabilities for recovering data, applications and identities.
Their planned collaboration covers three areas:
- Shadow AI discovery: Identify AI applications, models and tools operating across enterprise environments, including unsanctioned usage.
- Runtime governance: Establish security policies that flag unauthorized AI activity and help prevent sensitive information from being exposed.
- Agent detection and recovery: Protect autonomous agent operations and support recovery when an agent performs a harmful or unintended action.
The announcement outlines planned collaboration areas but does not specify a joint-product launch date.
AgentRecover adds another layer to Commvault’s strategy
Commvault’s separate AgentRecover announcement offers a closer look at how it intends to handle AI-related incidents. The technology is designed to audit agent activity, identify connected resources and restore agents alongside affected data and systems. Its support roadmap includes Amazon Bedrock AgentCore and Microsoft Foundry.
AgentRecover is designed to map the data, applications, identities and infrastructure that agents interact with. This helps IT teams understand what an agent changed and prioritize the resources that need restoration. Commvault is targeting early access for Microsoft Foundry later this month and Amazon Bedrock AgentCore in December. These timelines apply to AgentRecover, not the Zscaler partnership.
Why this partnership matters for MSPs and enterprise IT
Incident response tools help teams investigate and respond to security incidents. AI agents introduce another problem: they can perform legitimate actions that produce unintended consequences.
An agent with permission to update business records, modify configurations or interact with multiple applications could create problems before security teams understand what happened. This makes recovery an increasingly important part of AI governance.
For managed service providers and channel partners, the collaboration could support services covering AI discovery, usage policies and recovery planning. Partners can begin by identifying which agents customers use, what those agents can change and whether existing recovery plans cover the connected systems.
Before building an offering around the planned collaboration, partners should ask:
- Coverage: Which agent platforms, applications and identities will be supported?
- Recovery scope: What can be restored, and which actions would require manual remediation?
- Service delivery: How will alerts, investigation and recovery fit into the partner’s existing workflows?
- Commercial terms: What licensing, training and support requirements will apply?
A practical next step is to test an agent-related failure in a controlled environment, document the affected resources and confirm who authorizes recovery. That gives customers evidence of what their recovery plan can handle while partners evaluate the proposed integration.
Why recovery planning still starts with permissions
For employees and developers, the immediate impact is not a new AI application or feature. Instead, the partnership targets the security infrastructure surrounding the AI tools they already use. Organizations could gain better visibility into which applications handle corporate information, restrict risky agent activities and improve their ability to reverse unwanted changes.
That matters particularly for businesses handling sensitive customer records, financial information and regulated data. Still, visibility and recovery cannot replace careful permission management. Restoring damaged information after an AI agent makes a mistake is valuable, but preventing unnecessary access in the first place remains essential.
Commvault directs customers to its SHIFT Virtual event on Nov. 18 to learn more about the collaboration.
Read more: Turn AI readiness and governance work into a broader customer offering with practical ways MSPs can identify use cases, measure results and support ongoing AI adoption.