Cohesity’s new Agent Resilience lets companies roll back AI agents that go wrong

Data security company Cohesity Inc. today introduced Cohesity Agent Resilience at its Catalyst conference.

The new Cohesity Data Cloud capability backs up the memory and configuration of enterprise artificial intelligence agents so they can be rolled back to a trusted state when something goes wrong. Also on the Catalyst agenda was a plan to automate Cohesity’s five-step cyber resilience framework with agentic workflows, and an early piece of that plan is generally available now. A free course on AI agent risk opens the new Cohesity AI Resilience Academy.

Agents inside large companies already query databases and act with privileged credentials, sometimes with nobody reviewing each step. Governance and observability tools can flag unexpected behavior. According to Cohesity, those tools have no way to restore the data or systems an agent has changed, corrupted or deleted.

“Detection can tell you an AI agent went off course,” said Vasu Murthy, Cohesity’s chief product officer. “It cannot undo the changes.”

Most organizations are not protecting agent state today, Cohesity said in a blog post introducing Agent Resilience, and a prompt injection can leave an agent that looks normal on the surface acting on information it should never have trusted. An agent with no clean recovery point may have to be wiped and rebuilt. Memory and configuration are covered at launch, protected by the same immutable backups and clean-room recovery Cohesity already runs for on-premises, cloud and software-as-a-service workloads.

If something does go wrong, an administrator selects a recovery point from before the suspicious behavior started, and only the affected memory or settings are restored. A second function finds the databases, file systems and vector stores an agent works with and protects those as well. Each agent also gets a topology map listing the systems it connects to and the data it can reach. Cohesity says the map is meant to expose protection gaps and recovery dependencies before anything breaks.

For now the service only covers agents built on Amazon Web Services Inc.’s Bedrock, including both Bedrock AgentCore and Bedrock Agents. Support for Microsoft Corp. and Google LLC agent platforms is on the roadmap. Only select customers have access until general availability, which Cohesity expects by the end of the year.

The automation plan Cohesity also laid out at Catalyst is on a longer timeline. Called Autonomous Cyber Resilience, it would keep data discovery and protection running without pause. Resilience plans built on manual triage may not keep pace with attackers using AI to speed up their intrusions, the company said.

Under Autonomous Cyber Resilience, an administrator would give Cohesity Copilot, the company’s natural-language assistant, a goal such as requiring every application the business needs during a cyberattack to meet set recovery time and recovery point objectives. Cohesity Data Cloud would assess those workloads and recommend protection policies, threat scans and recovery rehearsals. Nothing would run without approval.

Once an attack is underway, administrators could launch automated workflows that size up the impact and look for signs of attacker activity. The same workflows would prepare an isolated environment for investigation and recovery.

The approach builds on Cohesity RecoveryAgent, which already orchestrates parts of incident response and recovery. Cohesity Maestro comes next. First shown in June, it will let customers reach Cohesity’s protection and recovery functions from Anthropic PBC’s Claude, OpenAI Group PBC’s ChatGPT and Google’s Gemini, and the company expects to ship it later this year.

Murthy said cyber resilience is “not a onetime assessment” and that agentic workflows can take on more of the routine work of keeping a plan current.

One piece of the plan is shipping now. Customers that run Cohesity Data Cloud Enterprise Edition with Cohesity DSPM, the company’s data security posture management tool, can automatically protect newly discovered sensitive data that has no protection yet.

In a tutorial on its Autonomous Cyber Resilience plans, Cohesity showed administrators building dynamic object groups from the tool’s sensitivity tags, such as everything marked Financial or Restricted, then attaching smart rules that set backup frequency and retention. The tutorial ties the feature to Cohesity Cloud Services deployments. New data joins a group as soon as it is classified, and a simulation step previews which objects a rule would add or drop before anything changes.

Cohesity paired the Catalyst announcements with its fifth annual Global Cyber Resilience Report. Of the more than 3,200 information technology and security decision-makers Vanson Bourne polled across 11 countries for the report, 69% said their organization had been hit by a material cyberattack in the past 12 months. In last year’s report, 54% said the same.

On AI agents, 55% said they were unprepared to detect or contain unintended actions. Recovery planning drew the widest agreement of all, with 81% saying their plans would need moderate or significant changes before they could withstand cyberattacks accelerated by frontier AI models.

Training is the third part of the Catalyst news. Cohesity has added an AI Resilience Academy as a new learning path within Cohesity Academy, starting with a free, self-paced course called Foundations of AI Resilience with Cohesity. The 25- to 30-minute course leaves product configuration aside and starts from the difference between AI assistants that make recommendations and agents that make changes.

Catalyst attendees get about two weeks of exclusive access before it joins the wider catalog. Graduates receive a Credly badge, and Cohesity said it may charge for more advanced courses later.

Chief Executive Sanjay Poonen spoke with theCUBE, SiliconANGLE Media’s livestreaming studio, in July 2025 at the AWS & Ecosystem Leaders Halftime Report event. The interview covered the company’s AWS partnership and its deal for the data protection business of Veritas Technologies LLC. Poonen also walked through the five-step cyber resilience framework that Cohesity now wants to automate.

Image: Cohesity