Which board body oversees cybersecurity at Commvault?

Commvault's fiscal 2026 Form 10-K places oversight of cybersecurity risk with the Audit Committee.

What does Commvault sell?

Commvault sells Commvault Cloud Unity, Commvault Cloud Threat Scan, Commvault AirGap, Commvault Geo Shield, Commvault Cloud Compliance and Backup & Recovery for Databases. Commvault Cloud Unity: A cloud-native platform for data security, identity resilience and cyber recovery. Commvault Cloud Threat Scan: Scans backup files for malware and quarantines infected files. Commvault AirGap: A fully managed cloud storage target with air-gapped, immutable copies. Commvault Geo Shield: A unified platform to protect sovereign data.

Who does Commvault fit?

From its own pages, Commvault sells mainly to organizations running hybrid and multi-cloud workloads that want protection and clean recovery under one control plane. Commvault addresses regulated organizations through Dedicated Instance. Commvault addresses organizations with data sovereignty needs, aligned with regional and regulatory expectations. Teams responsible for Active Directory and Entra ID in hybrid environments are a further audience for its identity recovery offering. Commvault customer stories describe a healthcare organization facing compliance and patient privacy demands and an events business that cannot afford downtime.

How does CISO Tribune file Commvault?

CISO Tribune files Commvault under Backup and cyber recovery, with Directory backup and recovery as a secondary category.

Where is Commvault headquartered?

Commvault is headquartered in Tinton Falls, United States.

Commvault is publicly listed on NASDAQ under the ticker CVLT.

Company record · security vendor

Who leads security at Commvault

CISO Tribune company record: Commvault, current seat holder not yet confirmed

The most recent move CISO Tribune has on record at Commvault was announced on March 31, 2025: too long ago to say who holds the seat today. The history below stands; the current holder is not yet confirmed.

What Commvault tells the SEC

Its fiscal 2026 Form 10-K, filed May 11, 2026, carries an Item 1C cybersecurity disclosure that describes a Chief Security Officer, with oversight by the Audit Committee. Read the section verbatim or the filing on sec.gov. A filing describes governance as of its date, not today's seat.

Tracked by the Wire since March 31, 2025 · 1 recorded move · every claim links to a sourced record · Updated November 10, 2026

Where Commvault appears on the record (20)

Every page on CISO Tribune and its network that carries this company, 20 in all.

On the Wire: Bill O'Connell named Chief Security Officer (CSO) at Commvault · 2025-03-31
SEC filing: Form 10-K cybersecurity disclosure, fiscal 2026 · Item 1C, filed May 11, 2026
Compared with (16): vs Acronis, vs Cayosoft, vs Cohesity, vs Druva, vs Freeit Data Solutions, vs Halcyon, vs Hornetsecurity, vs HYCU, vs Keepit, vs Object First, vs Rubrik, vs Semperis, vs Spin.AI, vs Telia, vs Veeam, vs Xobee Networks
In the vendor directory (2): Backup and cyber recovery vendors · primary category
Directory backup and recovery vendors · category

About Commvault

CISO Tribune's Leadership Bench files Commvault under Cybersecurity Vendors and North America. The SEC classifies it under standard industrial classification 7372, Services-prepackaged software, and EDGAR lists its ticker as CVLT. The Wire has one security-leadership move at Commvault on record, announced on March 31, 2025.

What Commvault's 10-K says about security governance

Commvault's fiscal 2026 Form 10-K, filed May 11, 2026, describes its cybersecurity governance in Item 1C. The lines below are that filing's own statements, each with the sentence it comes from.

Top security role, as the filing names it: Chief Security Officer.
Board oversight: the Audit Committee.
“The Audit Committee receives quarterly briefings from the CSO on the cybersecurity program, material cybersecurity threats and incidents, and related mitigation and response activities.”
How often the board or committee hears about it: quarterly.
“The Audit Committee receives quarterly briefings from the CSO on the cybersecurity program, material cybersecurity threats and incidents, and related mitigation and response activities.”
Frameworks and standards the filing names: NIST Cybersecurity Framework, ISO/IEC 27001, SOC 2 and PCI DSS.
Experience of the security leadership, as the filing states it:
“The current CSO holds a Bachelor of Science and Master of Business Administration from the University of Maryland, holds industry certifications including CISSP, PMP, CIPP/E, CIPP/US and CISA, is affiliated with various industry working groups focused on threat intelligence and privacy, and has over twenty years of experience in cybersecurity leading technical, operational, and strategic programs to protect critical data and infrastructure.”
Material incidents: the filing states none.
“To date, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Commvault, including its business strategy, results of operations or financial condition.”

Plain-English reading and full text of the filing · the filing on sec.gov

Security leadership timeline

2025-03-31

Bill O'Connell named Chief Security Officer (CSO) at Commvault

Commvault announced the appointment of Bill O'Connell as its Chief Security Officer on March 31, 2025.

Security leaders of Commvault on our record

Bill O'Connell: named Chief Security Officer (CSO), announced on March 31, 2025 record

Security chiefs at other Cybersecurity Vendors organizations

Other organizations CISO Tribune files under Cybersecurity Vendors with a named security chief on record: those in North America first, in alphabetical order from Commvault onward.

Concentric AI: Lane Sullivan, Chief Information Security and Strategy Officer.
Cyberhaven: Aman Sirohi, Chief Information Security Officer.
Cylerity: Drew McCombs, Chief Technology Officer and Chief Information Security Officer.
DefenseStorm: William Wetherill, Chief Information Security Officer.
EigenQ: Alexander Truskovsky, Chief Information Security Officer.
Fable Security: Jacob Berry, Chief Information Security Officer.
Flock Safety: Chris Castaldo, Chief Information Security Officer (CISO).
Forcepoint: Guy Shamilov, Chief Information Security Officer.

The full Cybersecurity Vendors bench

What the company sells

Commvault sells Commvault Cloud, a platform that unifies data security, identity resilience and cyber recovery at enterprise scale. Commvault says Commvault Cloud transforms resilience from a passive backup plan into an active operating model that helps enable the AI-driven enterprise. Commvault describes ResOps as the new way to help secure, govern, and restore all your data, all the time. Commvault Cloud Unity is built on Metallic AI, which Commvault describes as an automation engine. Commvault names MCP Server and Commvault Data Activate as capabilities that extend resilience into an AI ecosystem.

Commvault Cloud finds and classifies sensitive data across data, apps and identities. Commvault Cloud applies consistent policies for access, encryption and retention. AI-powered detection in Commvault Cloud identifies unusual activity across data and identity systems. Commvault says Commvault Cloud protects every workload that keeps a business running, from SaaS apps to AI stacks. Commvault Cloud covers SaaS platforms such as Microsoft 365, Google Workspace and Salesforce.

On the backup side, Commvault Cloud unifies governed backup and cyber recovery with cleanroom testing, runbooks and audit-supporting evidence. Commvault says its unified control plane sets policy, access and visibility once across hybrid and multi-cloud. Commvault says immutable, air-gapped patterns help protect recovery points from tampering and credential abuse. Commvault describes runbooks as a way to coordinate multi-system sequencing under pressure and to recover critical services first. For hybrid estates, Commvault says a unified policy engine governs protection across cloud-native, multi-cloud, on-premises, and edge workloads. Commvault unifies protection policies across cloud-native, hybrid and multi-cloud workloads from the Command Center. Cloud Backup & Recovery for Databases is designed to protect enterprise and cloud native databases from ransomware and other threats. Commvault Cloud Compliance helps companies address their legal, regulatory, and compliance requirements, and it supports eDiscovery. Dedicated Instance combines full environment isolation with SaaS agility and is managed through a single unified control plane.

For cyber recovery, Commvault defines a Cleanpoint as a backup from a point-in-time that has been scanned for threats and none have been found. Commvault tests data integrity in an isolated Cleanroom and scans data for malware before recovering it into the customer environment. Synthetic Recovery creates a curated recovery point that combines the most recent clean version of files across all backups into a single recovery point. Synthetic Recovery is integrated with Cleanroom Recovery, so a clean recovery point can be restored into a Cleanroom for observability and validation. Commvault Cloud Threat Scan automatically scans backup files for malware, detects data anomalies and enables fast, clean recovery. Threat Scan automatically quarantines infected files from the backup content and skips them during recovery. Threat Scan uses more than 100 million threat intelligence indicators to identify new threats. Threat Scan can send alerts to Splunk, Palo Alto Networks XSOAR or Microsoft Sentinel.

For identity, Commvault offers recovery of Active Directory and Entra ID environments from ransomware, operational mistakes and insider threats. Commvault automates and accelerates recovery of the AD forest to a pre-attack state. Commvault provides granular recovery of missing, damaged or misconfigured objects and attributes, including users, groups, app registrations and roles. Commvault interactive comparisons identify all changes in the domain between two points in time and allow recovery of deleted objects or rollback of overwritten attributes from the report. Commvault restores compromised forests onto a new, trusted operating system to help prevent the reintroduction of malware.

Commvault AirGap is a fully managed cloud storage target. Commvault AirGap offers Frequent, Infrequent Access and Archive storage tiers. Commvault AirGap isolates data copies in an air-gapped, immutable security domain. Commvault Data Access Governance delivers real-time, policy-based controls across hybrid environments to reduce exposure without slowing innovation or breaking workflows. Satori helps enforce who can access data, what they can see and what they can do. Satori can mask or redact fields without changing the underlying data or breaking applications. Commvault Geo Shield is designed for real-world regulation, enabling configurable controls across data while adapting to evolving customer sovereign needs in modern hybrid cloud environments. Commvault partners with STACKIT Sovereign Cloud to deliver cyber resilience for organizations across Germany and Austria. Commvault integrates with CrowdStrike’s Falcon XDR platform to detect indicators of compromise quickly and identify clean data for recovery.

Commvault lists SOC 2 Type II Certified, ISO/IEC 27001 Certified and FedRAMP High Authorized status. Commvault delivered data protection for UNC Health with encryption, RBAC, immutable backups, and integrated auditing to meet HIPAA and internal governance requirements. Bilthoven Biologicals recovered from ransomware using Commvault and restored operations within days. Wealthsimple moved to a need-to-know access model for highly sensitive financial and PII data. Gong controls access to sensitive customer data across multiple platforms. Pragya Systems adopted Commvault Cloud Rewind to protect GCP environments. Commvault says customers can get started directly through the cloud provider’s marketplace.^{[2][4][6][7][8][9][10][11][12][13][15]}

Categories: Backup and cyber recovery (primary category)
Directory backup and recovery
Compare Commvault with companies in the same category
Headquarters: Tinton Falls, United States^[3]
Founded: Not established from our sources
Ownership: Public (NASDAQ: CVLT)^{[1][5][14][17]}
CISO on record: Not yet on our record. Send a verified source
Website: commvault.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

Commvault Cloud Unity^[6]
A cloud-native platform for data security, identity resilience and cyber recovery.
Commvault Cloud Unity is described as a cloud-native platform that unifies data security, identity resilience and cyber recovery at enterprise scale. It is built on Metallic AI, which Commvault describes as an automation engine.
Commvault Cloud Threat Scan
Scans backup files for malware and quarantines infected files.
Commvault Cloud Threat Scan automatically scans backup files for malware, detects data anomalies and enables fast, clean recovery. Infected files are automatically quarantined from the backup content and skipped during recovery.
Commvault AirGap^[11]
A fully managed cloud storage target with air-gapped, immutable copies.
Commvault AirGap is a fully managed cloud storage target. It offers Frequent, Infrequent Access and Archive storage tiers. Data copies are isolated in an air-gapped, immutable security domain.
Commvault Geo Shield^[14]
A unified platform to protect sovereign data.
Commvault Geo Shield is a single platform across private cloud, multi-cloud and on-premises, designed to protect sovereign data wherever it resides. It enables configurable controls across data.
Commvault Cloud Compliance^[8]
Risk governance capabilities for eDiscovery and compliance.
Commvault Cloud Compliance helps deliver risk governance capabilities for eDiscovery purposes. It provides a means to quickly collect electronically stored information (ESI).
Backup & Recovery for Databases^[8]
Protects enterprise and cloud native databases.
Cloud Backup & Recovery for Databases is designed to protect both enterprise and cloud native databases from ransomware and other threats. It delivers SaaS resilience and recovery capabilities for multi-cloud environments.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Commvault's categories, then alphabetical. A list from the record, never a ranking.

On backup and cyber recovery, Commvault competes with Rubrik, Acronis, Cohesity, Druva, HYCU, Keepit, Object First, Veeam, Freeit Data Solutions, Halcyon and 4 more.
On directory backup and recovery, Commvault competes with Cayosoft, Rubrik and Semperis.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

G2 · 4.6 out of 5^[5]seen November 5, 2026
Gartner Peer Insights · 4.4 out of 5^[17]seen November 5, 2026

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

[1]About usCommvault Systems, Inc. · commvault.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
[2]Active Directory and Entra ID | CommvaultCommvault Systems, Inc. · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
[3]Contact usCommvault Systems, Inc. · commvault.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
[4]AI Recovery for AI Vulnerability | CommvaultCommvault · undated page, accessed October 24, 2026 · Tier A: the company, a regulator or a filing
[5]Commvault Cloud Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 24, 2026 · Tier C
[6]Commvault Cloud Unity | Platform | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[7]Backup & Disaster Recovery Software | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[8]Unified Data Protection for Hybrid and Multi-Cloud Workloads | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[9]Cleanpoint Identification with AI-Enabled Cyber Recovery | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[10]Threat Scan | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[11]Commvault AirGap - Immutable Storage & Recovery | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[12]Data Access Governance for Cloud and AI | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[13]Satori Cyber | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[14]Commvault Geo Shield | Commvault Unified ResilienceCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[15]Integrations | CommvaultCommvault · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
[16]Commvault Announces Fourth Quarter Fiscal 2026 Financial Results | NewsCommvault · published April 28, 2026 · Tier A: the company, a regulator or a filing
[17]Commvault Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed November 5, 2026 · Tier C

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 5, 2026 from the references above.

Work for Commvault? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.

Questions CISOs ask about Commvault

Who are the security chiefs at other Cybersecurity Vendors organizations?: On CISO Tribune's record they include Lane Sullivan at Concentric AI, Aman Sirohi at Cyberhaven, Drew McCombs at Cylerity and William Wetherill at DefenseStorm.
Which board body oversees cybersecurity at Commvault?: Commvault's fiscal 2026 Form 10-K places oversight of cybersecurity risk with the Audit Committee.
What does Commvault sell?: Commvault sells Commvault Cloud Unity, Commvault Cloud Threat Scan, Commvault AirGap, Commvault Geo Shield, Commvault Cloud Compliance and Backup & Recovery for Databases. Commvault Cloud Unity: A cloud-native platform for data security, identity resilience and cyber recovery. Commvault Cloud Threat Scan: Scans backup files for malware and quarantines infected files. Commvault AirGap: A fully managed cloud storage target with air-gapped, immutable copies. Commvault Geo Shield: A unified platform to protect sovereign data.
Who does Commvault fit?: From its own pages, Commvault sells mainly to organizations running hybrid and multi-cloud workloads that want protection and clean recovery under one control plane. Commvault addresses regulated organizations through Dedicated Instance. Commvault addresses organizations with data sovereignty needs, aligned with regional and regulatory expectations. Teams responsible for Active Directory and Entra ID in hybrid environments are a further audience for its identity recovery offering. Commvault customer stories describe a healthcare organization facing compliance and patient privacy demands and an events business that cannot afford downtime.
How does CISO Tribune file Commvault?: CISO Tribune files Commvault under Backup and cyber recovery, with Directory backup and recovery as a secondary category.
Where is Commvault headquartered?: Commvault is headquartered in Tinton Falls, United States.
Who owns Commvault?: Commvault is publicly listed on NASDAQ under the ticker CVLT.

Related guides

CISO Reporting Structure, the Five Models and What the Filings Show
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
CISO News: Tracking Every Appointment and Departure in the Top Security Seat
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.