Commvault Cloud: Enterprise Backup Ledger 2026

Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.

Snapshot

Tier: Leader incumbent
Owner: Commvault Systems; no controlling-owner acquisition recorded; Appranix, Clumio and Satori purchases documented.
Licence model: Capacity/client/socket/VM and subscription models; four Cloud bundles and later consumption offers. Self-managed restore survives subscription expiry per January 2026 guide.
Products scored: Commvault self-managed Cloud/Complete Data Protection/HyperScale X; Metallic/Clumio SaaS-only workloads excluded.
Latest release: 11.46.30 (2026-09-17); separate LTS 11.44.20 (2026-09-01)
Next signal: MCP historical spring-2026 commitment: Public deployment/code documented at cutoff; exact GA day and deadline adherence unverified.; AI Protect / Data Activate / AI Studio: April 2026 announced/forthcoming; individual GA timing unresolved.
Archetype: Hybrid recovery orchestration
Evidence grade: A. Overall grade uses all scored history/AI steps and lens criteria: 41 A, 11 B, 13 C of 65; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.

Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.

Scorecard

Dimension	Score	Direction
Capability today	84.4 / 100	higher is better
Momentum since end of 2022	+11.2 points	higher is better
Credibility	16.5 / 25	higher is better
Commercial risk	12.0 / 25	lower is better
Technical lock-in	10.0 / 25	lower is better
Integrator fit	16.5 / 20	higher is better
AI leverage	12.0 / 20	higher is better
Ledger Index	71.0 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	3.5	3.5	4	4.5
Databases and applications (12)	2.5	3.5	4	4.5
Recovery (14)	3	3	4	4.5
Cyber resilience (14)	1	2	3	4.5
Storage efficiency and targets (10)	3.5	4	4	4.5
Long-term retention and tape (6)	3	3.5	3.5	4
Replication and DR (10)	3	3	3.5	4
Security and compliance (8)	2	2.5	3.5	3.0
New-platform support (VMware exit) (8)	1	3	3	3.5
Management at scale and automation (6)	3	3	4	4.5
Total / 100	50.6	61.4	73.2	84.4

Year by year: 2016: 50.6 · 2017: 50.6 · 2018: 50.6 · 2019: 61.4 · 2020: 61.4 · 2021: 68.8 · 2022: 73.2 · 2023: 75.4 · 2024: 75.4 · 2025: 82.6 · 2026: 84.4

What moved the score

Year	Domain	Change	Points	Trigger
2019	Cyber resilience	1 → 2	+2.8	End-2019 checkpoint: SP16: anomalousfile-change/backupsizedemail alerts. NoMLmalwarescan claim. Indexedprimary; directbodyunavailable. Anomaly alerts only, not later cleanrooms. Evidence B. sp16Indexed
2019	Databases and applications	2.5 → 3.5	+2.4	End-2019 checkpoint: SP16: Oracle18c, MySQL8,Cassandra; PostgreSQLapplication-free diskrestore. Indexedprimary; directbodyunavailable. SP16 indexed primary evidence; full matrix incomplete. Evidence B. sp16Indexed
2019	Long-term retention and tape	3 → 3.5	+0.6	End-2019 checkpoint: SP16: VaultTrackerinCommandCenter; exacttape/GFSmatrixpending. Indexedprimary; directbodyunavailable. VaultTracker, not proof of every tape/GFS configuration. Evidence B. sp16Indexed
2019	New-platform support (VMware exit)	1 → 3	+3.2	End-2019 checkpoint: SP16: OpenStackchanged-blockincrementals; AHV→Azureconversion. Indexedprimary; directbodyunavailable. OpenStack CBT; Proxmox not yet credited. Evidence B. sp16Indexed
2019	Security and compliance	2 → 2.5	+0.8	End-2019 checkpoint: SP16: CASSSO, LDAPcontrollers and 3DFSACLs. Indexedprimary; directbodyunavailable. CAS/LDAP; later FIDO2 not backdated. Evidence B. sp16Indexed
2019	Storage efficiency and targets	3.5 → 4	+1.0	End-2019 checkpoint: SP16: StoreOnceCatalystlibrarieswithUNIX/LinuxMediaAgents. Indexedprimary; directbodyunavailable. StoreOnce support; full HCL incomplete. Evidence B. sp16Indexed
2021	Databases and applications	3.5 → 4	+1.2	11.25 (2021-11-15 GA; blog 2021-12-13): Linux CommServe; Hyper-V/Azure Stack Hub V2 indexing; physical-to-Azure Stack Hub VirtualizeMe; VMware-to-GCP replication. Revision-history September entry is a documentation clock. Evidence A. fr25; revisions
2021	Management at scale and automation	3 → 4	+1.2	11.25 (2021-11-15 GA; blog 2021-12-13): Linux CommServe; Hyper-V/Azure Stack Hub V2 indexing; physical-to-Azure Stack Hub VirtualizeMe; VMware-to-GCP replication. Revision-history September entry is a documentation clock. Evidence A. fr25; revisions
2021	Recovery	3 → 4	+2.8	11.25 (2021-11-15 GA; blog 2021-12-13): Linux CommServe; Hyper-V/Azure Stack Hub V2 indexing; physical-to-Azure Stack Hub VirtualizeMe; VMware-to-GCP replication. Revision-history September entry is a documentation clock. Evidence A. fr25; revisions
2021	Replication and DR	3 → 3.5	+1.0	11.25 (2021-11-15 GA; blog 2021-12-13): Linux CommServe; Hyper-V/Azure Stack Hub V2 indexing; physical-to-Azure Stack Hub VirtualizeMe; VMware-to-GCP replication. Revision-history September entry is a documentation clock. Evidence A. fr25; revisions
2021	Virtual and physical servers	3.5 → 4	+1.2	11.25 (2021-11-15 GA; blog 2021-12-13): Linux CommServe; Hyper-V/Azure Stack Hub V2 indexing; physical-to-Azure Stack Hub VirtualizeMe; VMware-to-GCP replication. Revision-history September entry is a documentation clock. Evidence A. fr25; revisions
2022	Cyber resilience	2 → 3	+2.8	11.26 (2022-02-15 GA; architecture revision 2021-12-15): EBS direct-write EC2 replication; FIDO2/CAC authentication; ONTAP 9.8+ SnapDiffv3 cataloguing; Command Center deployment of Linux VMware Access Nodes/FREL. Earlier GCP-guide revision is not GA. Evidence A. fr26; gcp23
2022	Security and compliance	2.5 → 3.5	+1.6	11.26 (2022-02-15 GA; architecture revision 2021-12-15): EBS direct-write EC2 replication; FIDO2/CAC authentication; ONTAP 9.8+ SnapDiffv3 cataloguing; Command Center deployment of Linux VMware Access Nodes/FREL. Earlier GCP-guide revision is not GA. Evidence A. fr26; gcp23
2023	Databases and applications	4 → 4.5	+1.2	Observed by 2026-10-01: 2023E PostgreSQL 15 multistream/nonexclusive physical hot backup; SAP HANA replication region backups and encrypted Oracle automation. May 2026 newsletter adds SQL transaction restore to Azure cleanroom; current full DB certification matrix unresolved. 11.40 newsletter adds encrypted MySQL/PostgreSQL disk-cached logs and DB2 keys/HADR cluster protection; exact first-feature GA and supported engine versions remain separate. 2023E database evidence, with current matrix limits. Evidence A. pdf32; preview; newsletter1140
2023	Storage efficiency and targets	4 → 4.5	+1.0	Observed by 2026-10-01: Shared tape pools across MediaAgents, direct backup and secondary-copy pools; May 2026 consolidated DDB metrics and disk/cloud growth reports. Underlying storage/drive matrices not fully audited. Shared tape and disk/cloud targets; full HCL remains incomplete. Evidence C. tape; preview
2025	Cyber resilience	3 → 4.5	+4.2	11.40 LTS (2025-06-15): Full release newsletter recovered: Linux 1-Touch BMR enabled by default; legacy Avamar/NetWorker filesystem and Veeam filesystem/VM imports; MySQL/PostgreSQL disk-cached log backup; Threat Scan ML encryption detection and Azure restore scans. Newsletter includes inherited features and dated April/May2025 promises; not every feature first shipped June 15. Evidence A. tracks; newsletter1140
2025	New-platform support (VMware exit)	3 → 3.5	+0.8	11.42 rolling newsletter, July to November 2025 (2025-07 to 2025-11 documentation months): July: VMware-to-Proxmox conversion. August: app consistency with QEMU scripts, allocated-block detection. November: Proxmox 9 and thick-LVM snapshots. Allocated-block detection is not established as incremental CBT. Evidence A. preview
2025	Recovery	4 → 4.5	+1.4	11.40 LTS (2025-06-15): Full release newsletter recovered: Linux 1-Touch BMR enabled by default; legacy Avamar/NetWorker filesystem and Veeam filesystem/VM imports; MySQL/PostgreSQL disk-cached log backup; Threat Scan ML encryption detection and Azure restore scans. Newsletter includes inherited features and dated April/May2025 promises; not every feature first shipped June 15. Evidence A. tracks; newsletter1140
2025	Security and compliance	3.5 → 4	+0.8	Observed by 2026-10-01: 2023E tenant SAML, dynamic credentials and 1-Touch/VirtualizeMe two-factor; 11.42.27+ MCP OAuth. FIPS validation and universal destructive-action approval audit pending. Historical 11.26 adds FIDO2/CAC authentication; this does not establish current key/SKU parity. OAuth/FIDO2/RBAC and versioned controls; blanket FIPS validation not proved. Evidence A. pdf32; mcpdocs; fr26
2026	Long-term retention and tape	3.5 → 4	+0.6	Observed by 2026-10-01: 11.44 documentation: shared tape storage, Vault Tracker for offsite media and physical export. Supported library/drive firmware linked separately; full LTO/WORM/legal-hold census pending. 11.40 adds days-based retention without cycle counting. Detailed linked guide returned 404; do not infer a universal migration policy. Evidence A. tape; newsletter1140
2026	Management at scale and automation	4 → 4.5	+0.6	Observed by 2026-10-01: 11.46 July global encryption policies at storage-pool level; elastic AuxCopy/synthetic-full/verification/DDB compute limited to cloud targets. Arlie Recover AzureVM-only with pause/stop and audit logs. Evidence A. newsletter1146
2026	Replication and DR	3.5 → 4	+1.0	Observed by 2026-10-01: 11.46 September newsletter adds Proxmox Auto Recovery replication and orchestrated failover/failback; Hyper-V replicated VM IP/DNS/host changes. Version/topology limits remain feature-specific. Evidence A. newsletter1146
2026	Security and compliance	4 → 3.0	-1.6	Observed by 2026-10-01: 2023E tenant SAML, dynamic credentials and 1-Touch/VirtualizeMe two-factor; 11.42.27+ MCP OAuth. FIPS validation and universal destructive-action approval audit pending. Historical 11.26 adds FIDO2/CAC authentication; this does not establish current key/SKU parity. OAuth/FIDO2/RBAC and versioned controls; blanket FIPS validation not proved. Evidence A. pdf32; mcpdocs; fr26 2026 security-record adjustment: raw capability 4, minus 1.0 for CVE-2025-34028, CVE-2025-3928. KEV entry dates in 2023 to 2026; maximum deduction 1.5. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.
2026	Virtual and physical servers	4 → 4.5	+1.2	Observed by 2026-10-01: 11.36 CU40+ versioned matrix requires VSA on Proxmox cluster nodes (guest-agentless), Proxmox 8.x; 11.42 newsletter adds Proxmox 9 in November 2025. Full physical/other-hypervisor matrix audit pending. Physical coverage carried from 11.25; no full 5 anchor. Evidence A. pve36; preview

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-11	AI Arlie assistant: partial; Documented by 11.38; first GA unresolved. 11.38 changes corroborate metadata analysis/documentation assistance; cannot establish the end 2023 deadline or all originally promised actions.	D7 AI-assisted operations	V
2023-11	AI active insights: pending; unverified. Earliest located promise; feature-specific initial GA not reconstructed.	D10 Scale and automation	C
2023-11	AI code assistance: pending; unverified. Earliest located promise; feature-specific initial GA not reconstructed.	D10 Scale and automation	C
2023-11	AI custom walkthroughs: pending; unverified. Earliest located promise; feature-specific initial GA not reconstructed.	D10 Scale and automation	C
2023-11	AI root-cause remediation: pending; unverified. Earliest located promise; feature-specific initial GA not reconstructed.	D10 Scale and automation	C
2023-11	Unified software/SaaS management: pending; unverified. Earliest located promise; feature-specific initial GA not reconstructed.	D10 Scale and automation	C
2024-04	Active Directory cleanroom restoration: partial; By October 2025 docs; exact GA unresolved. Later clean-VM AD forest recovery documented; identity and target-version equivalence require further checking.	D4 Cyber resilience	C
2024-04	Known-clean infrastructure rebuild / repave: shipped; 2025-04-28 GA assertion. Factory Reset available in vendor announcement; first GA and deadline adherence unresolved.	D10 Scale and automation	C
2024-04	Palo Alto Cortex XSOAR cleanroom integration: pending; unverified. Forward commitment found; exact release-note match still unresolved.	D4 Cyber resilience	C
2025-10	Official MCP: partial; not found. Public implementation/setup now established; historical October preview label does not prove current preview. Exact spring GA unverified.	D11 Ecosystem openness	V
2025-11	Synthetic Recovery: pending; unverified. Core cyber-recovery promise; precise release-note and initial GA match unresolved.	D3 Recovery	C
2025-11	Unity platform staged rollout: partial; Feature-dependent. Cloud-native subannouncement states available now; cannot apply to all Unity functions.	D10 Scale and automation	C
2026-04	AI Data Activate: pending; unverified. Announcement does not give per-offering GA dates.	D10 Scale and automation	C
2026-04	AI Protect: pending; unverified. Announcement does not give per-offering GA dates.	D10 Scale and automation	C
2026-04	AI Studio: pending; unverified. Announcement does not give per-offering GA dates.	D7 AI-assisted operations	V

Centre of gravity: Scale and automation (9), AI-assisted operations (2), Cyber resilience (2)
Driver mix: Vision 20%, Customer need 80%, Market window 0%, Upstream 0%, Portfolio 0%

Credibility: 16.5 / 25

Criterion	Score	Basis
Cadence	4	21 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. Commvault Cloud brand / Arlie (2023-11-08): Announced; rebrand and assistant do not establish software GA Evidence A. cloud
Roadmap transparency	3	Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: not found; Cloud and AI press announcements used. No open-roadmap-tracker reference score is awarded. Commvault Cloud brand / Arlie (2023-11-08): Announced; rebrand and assistant do not establish software GA Evidence A. cloud
Say-do	2.5	Recorded ledger: 29 items; 7 shipped, 9 partial, 0 slipped, 13 pending, 0 dropped. Mature dated prospective cohort: 17; 2 documented within 12 calendar months, 0 later than 12 months, 15 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F.
Velocity	4.5	Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. 11.38 changes (Release-family clock; first GA day unresolved): Arlie job/audit metadata analysis; access-token refresh scopes; archive combined tier forced on with micro-pruning; Web Console retirement. Later 11.38.35/.37 changes are not backdated to initial 11.38. Evidence A. change38
Lifecycle stability	2.5	2.5-year LTS policy coexists with two-month innovation support and platform/control-plane migrations. 2025-06-15 / 2026-06-15: Version-specific end-of-support: 11.28/2022E and 11.20 end 2025-06-15; 11.32/2023E ends 2026-06-15. Other innovation/LTS lines have different endpoints. Control-plane migration, 11.40: Changes table says Windows installation is no longer available for CommServe/Web Server/Command Center. 11.24 clients cannot communicate with 11.40-or-later CommServe; upgrade clients first. V4 dedupe databases must be converted to V5. Existing Windows deployment/upgrade support must follow its separate policy; no forced shutdown date inferred. Evidence A. old; change40

Say-do record, 2023 to 2026: Recorded ledger: 29 items; 7 shipped, 9 partial, 0 slipped, 13 pending, 0 dropped. Mature dated prospective cohort: 17; 2 documented within 12 calendar months, 0 later than 12 months, 15 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.

Commercial risk: 12.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3	Bundle/consumption and metric conversion changes documented; no invented currency price rise. 2023-11-08: Four Commvault Cloud bundles announced; exact public list prices not found 2025-11-12: Cloud-native Unity capabilities and consumption pricing reported generally available in AWS/Azure marketplaces; broader Unity rollout has separate later-2025/early-2026 timing. 2026-01 guide: Expired self-managed licence preserves recovery access while stopping new backup/archive/replication; perpetual use persists at the version available when maintenance expires. SaaS expiry follows separate terms; eDiscovery lacks restore-only mode. Evidence A. cloud; cloud25; unity25; licenseJan26
Purchase constraints	3	Metric non-coexistence and edition/add-on constraints; no forced minimum quantity assumed. 2026-01 guide; historical mixed-metric boundary 2020-10: Per-socket and per-VM metering cannot coexist in one CommCell. Grandfathered pre-October2020 deployments have separate mixed-metric rules. Licence-unit weights are not currency list prices. Evidence A. licenseJan26
Channel and access	2	Partner entry and public documentation access are both considered. Research documentation finding: tracks. Ansible: Vendor-owned ansiblev 2 collection installs as commvault.ansible via Galaxy; CVPySDK dependency. Legacy module requires v11 SP16+ and WebConsole. Live Galaxy download count not exposed in opened shell. Evidence A. ansible; ansibleold; galaxy
Owner stability	0.5	Vendor is the acquirer in these recorded transactions; no merger of Commvault ownership recorded. 2024-10-01: Clumio closed: FY2025 filing reports final cash consideration $44.311 million after closing adjustment 2025-08-28 blog: Satori acquisition reported closed; exact legal completion day not stated by this blog. Data/AI governance acquisition is separate from backup-product GA. Evidence A. filing; satori
Cost of staying supported	3.5	Support/upgrade constraints, distinct from licence-expiry restoration: LTS: annual line, 2.5-year life, monthly maintenance for first two years. Innovation: monthly line, two-month life; request-form distribution.. 2026-05-18 complaint filed: Imbert v. Commvault Systems, Inc., No. 3:26-cv-05654 (D.N.J.), Document 1: proposed securities class action alleges misleading ARR-growth disclosures for purchasers April 29, 2025 to January 26, 2026. Opened filing copy establishes the complaint, not class certification, liability or its outcome at cutoff; live docket remains unverified. Evidence C. securitiesComplaint26

Security record of the product itself: 2026 security-record adjustment: raw capability 4, minus 1.0 for CVE-2025-34028, CVE-2025-3928. KEV entry dates in 2023 to 2026; maximum deduction 1.5. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories. 34028: KEV 2025-05-02, fix 11.38.20+ additional updates; 3928: KEV 2025-04-28, fixes 11.36.46/11.32.89/11.28.141/11.20.217. Full-patch availability and lag unresolved; initial advisories are not substituted for completion.

Technical lock-in: 10.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3.5	2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Export path	1.5	Self-managed recovery remains after expiry; an independent archive reader is still unverified. Documented licence-expiry / conversion rights, January2026: Self-managed recovery remains available with infrastructure online and retained backups; expired subscription stops new jobs/updates. SaaS and eDiscovery exceptions apply. Changing licence metric can require subscription or signed forfeiture; this guide is not the executed customer contract. Evidence A. licenseJan26
Stack coupling	1.5	The documented component/management stack is considered; cross-workload or cross-hypervisor recovery is not inferred from an API. CommServe metadata recovery: MediaExplorer retrieves DR backups from tape/disk; CloudTestTool used for cloud. This recovers product databases, not an open backup-data format. Evidence C. dr
Hardware / cloud coupling	1	Deployment/service dependencies determine this score; missing offline/hardware terms are a provisional estimate. CommServe metadata recovery: MediaExplorer retrieves DR backups from tape/disk; CloudTestTool used for cloud. This recovers product databases, not an open backup-data format. Evidence C. dr
Skills and tooling coupling	2.5	Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Ansible: Vendor-owned ansiblev 2 collection installs as commvault.ansible via Galaxy; CVPySDK dependency. Legacy module requires v11 SP16+ and WebConsole. Live Galaxy download count not exposed in opened shell. Evidence A. ansible; ansibleold; galaxy

Integrator fit: 16.5 / 20

Criterion	Score	Basis
Partner programme openness	4	Published partner routes and entry/tier qualifications earn credit; undisclosed obligations limit the score. Ansible: Vendor-owned ansiblev 2 collection installs as commvault.ansible via Galaxy; CVPySDK dependency. Legacy module requires v11 SP16+ and WebConsole. Live Galaxy download count not exposed in opened shell. Evidence A. ansible; ansibleold; galaxy
Multi-tenancy and self-service	4	Documented tenant/provider isolation and self-service earn credit; reporting or multi-site visibility alone does not prove billing/tenant self-service. Observed by 2026-10-01: 11.46 July global encryption policies at storage-pool level; elastic AuxCopy/synthetic-full/verification/DDB compute limited to cloud targets. Arlie Recover AzureVM-only with pause/stop and audit logs. Evidence C. newsletter1146
API and infrastructure-as-code	4.5	Official Terraform and Ansible plus REST; registry downloads are not unique users or a support SLA. Terraform registry observation 2026-10-01: Commvault/commvault: 138,874 total downloads; current version 1.2.18, published 2026-09-15. Publisher source repository: https://github.com/Commvault/terraform-provider-commvault. Counts are registry requests/downloads, not distinct installations; vendor support obligations are separate. Ansible registry observation 2026-10-01: commvault.ansible:69,810 downloads; latest 1.0.2; deprecated=false. Registry count is not distinct users or a vendor SLA. Evidence A. regapi; galaxyapi
Skills and certification	4	Practitioner/Specialist/Professional/Expert structure launched 2026-05-11. Named certification structure launched 2026-05-11: Commvault Cloud Practitioner, Specialist, Professional and Expert: coursework, hands-on labs and assessments. No direct progression from former tracks; old credentials remain tied to retired product releases. Announcement is the new structure launch, not the first-ever Commvault certification. Evidence A. certLaunch26

AI leverage: 12.0 / 20

Strand	Today	Latest step
AI for protection / protecting AI	3.5	2025: 11.40 release family; first feature GA unresolved; Documented protection ML: Threat Scan uses ML to detect encryption in individual files and reduce false positives, plus Azure VM scans at restore and Azure Cleanroom threat analysis. This is protection AI, distinct from Arlie and from backup of AI workloads. Accuracy is a vendor assertion; no independent efficacy measure provided. Evidence A. newsletter1140
AI platform stack	0.5	2023: 2023-11-08 / 2026-04-13; Announced: Arlie backend Azure OpenAI announced; AI Studio promises custom/built-in agents using MCP. Models, deployment topology and separate inclusion price unresolved. Announced backend; not AI Studio GA. Evidence A. shift23; ai
AI-assisted operations	4.5	2026: 2026-07; Documented available: Arlie Recover runs cyber-recovery plans, AzureVM only. Threat Scan/Cleanroom/AirGap prerequisites, pause/stop and step audit logs. Exact RBAC/action consent and log retention require feature guide. AzureVM-only plans, pause/stop and audit; universal affirmative approval contract incomplete. Evidence A. newsletter1146
Agent openness	3.5	2026: Current observation 2026-10-01; Public implementation documented; precise GA unresolved: Official repo supports job suspend/resume/resubmit/kill and plan/storage/user visibility. OAuth requires 11.42.27+, or access/refresh tokens plus MCP client secret; native secure keyring. Vendor-hosted instructions are separate. Published implementation exceeds an announcement, but explicit first-GA confirmation is incomplete; below GA4. Evidence C. mcprepo; mcpdocs; mcphost

AI say-do sample: 13 recorded announcement rows; 2 GA/shipped matches, 0 preview/early/limited at announcement, 3 partial, 8 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day.

Reading

Commvault is combining hybrid protection with cleanroom recovery and agent interfaces. Versioned notes document Proxmox recovery, threat scans and bounded Arlie actions, while several wider AI promises remain unresolved. Upgrade and licence conversion rules add operational complexity even though self-managed restoration survives expiry.

Open questions and evidence caveats

Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
apps: 2016 baseline is provisional; no frozen checkpoint fact.
platforms: 2016 baseline is provisional; no frozen checkpoint fact.
Raw security 4 becomes 3 after two 2025 KEV entries. Exact feature GA in rolling newsletters is not inferred from the initial release-family date.