Data resilience: the new opportunity for the IT channel

For years, talking about backups meant talking about a formality: a task that was done, scheduled and forgotten until something failed. That approach has fallen short. According to Kinda Baydoun, senior director of Channel and alliances at Veeam in EMEA, customers no longer ask only to protect their data, but to have the certainty that they will be able to recover it quickly and keep operating after a cyberattack or an outage. That difference, seemingly subtle, completely changes the board for SMEs and for the IT teams that support them.

From one-off backup to a comprehensive strategy

The most immediate consequence is that backup stops being a product and becomes a component within a broader strategy. Baydoun describes it as a shift from one-off solutions toward comprehensive resilience strategies that combine protection and recovery, cybersecurity, governance, regulatory compliance and managed services. For an SME, this means that buying "the backup software" and forgetting about it is no longer a defensible decision in the face of a real incident.

At ForgeNEX we see it every day: many companies have backups, but have never tested a full restore. Others discover, when the problem arrives, that their backups were in the same compromised environment. Resilience is not having a copy: it is being able to demonstrate that the copy works and that the business stays standing within a reasonable timeframe.

BaaS and DRaaS: recurring revenue, also for SMEs

Baydoun notes that the models gaining the most weight are Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS), along with the protection of hybrid, multicloud and SaaS environments. For providers, this means recurring revenue and more stable relationships; for SMEs, a way to access capabilities they could hardly maintain internally without driving up costs.

Here it is worth making a practical reading. An SME does not need to set up its own recovery center, but it does need to know which applications are critical, how long each one can be down and which data it cannot lose under any circumstances. Without that prior exercise, contracting BaaS or DRaaS is buying an umbrella without looking at the forecast.

What we recommend before contracting anything

• Real inventory of applications and data: what you use, where it lives and who needs it. Many SMEs discover dependencies they had not documented.
• Define RTO and RPO: how much downtime and how much data loss is acceptable for each system. Not all of them deserve the same protection.
• Test restores: an unverified backup is a promise, not a guarantee.
• Review access: credentials, MFA and segmentation. If the attacker gets in with a privileged user, backups are of little use if they are exposed.

Agentic AI changes the rules of the game

The original article focuses on a phenomenon that is worth understanding well: agentic AI. Compared with an AI that limits itself to analyzing or generating information, agents can access data and execute actions autonomously. That expands capabilities, but also risks. Baydoun sums it up clearly: the opportunity for the channel is not only to help adopt AI, but to do so safely and reliably.

For an SME, this translates into very specific questions. What data can an agent touch? Who authorizes its actions? Is there a record of what it does? Can we revert an unwanted modification? If the answer to any of these questions is "we don't know", there is work to do before deploying any AI automation.

«The opportunity for the channel is no longer only to help customers adopt AI, but to make a safe and reliable adoption possible» — Kinda Baydoun

This approach connects with what we have already discussed on other occasions about how companies are limiting the use of AI tools due to a lack of controls, such as the case of Goldman Sachs and Claude Code. The lesson repeats itself: governance is not a brake, it is what allows scaling without scares.

A framework to know where you stand

Veeam proposes its Data & AI Trust Maturity Model, a framework that evaluates an organization's maturity across four pillars: understanding the data environment, protecting it, recovering from outages and scaling AI safely. Beyond the specific tool, the idea is useful as a checklist: many SMEs are strong in protection and very weak in recovery or in AI governance.

In our experience, the fourth pillar is the most neglected. An AI tool is deployed because the team asks for it, without reviewing what data is sent, where it is processed or how it is audited. That shortcut usually turns out expensive when an audit or an incident arrives.

Sectors and regulation: pressure comes from above

Baydoun notes that the financial sector is among the most advanced, driven to a large extent by DORA, and that there are also opportunities in public administration, healthcare, energy, telecommunications and transport. Regulations such as NIS2, the GDPR and the EU AI Act are pushing data resilience out of the exclusively technical terrain and toward risk management and business priorities.

For an SME that is not in those regulated sectors, the reading is different but equally valid: its large customers will be, and the supply chain ends up passing requirements along. If your company provides services to a financial institution or a public administration, it is a matter of time before you are asked for evidence of continuity and data protection.

The role of the partner: from provider to advisor

The article stresses that partners that combine knowledge of infrastructure, security, data and business processes will be better positioned. It also mentions the role of distributors and integrators as facilitators. For an SME, the practical implication is to choose well who you buy from: not only the product matters, but whether that provider is capable of helping you assess your situation, prioritize and support you in the implementation.

At ForgeNEX we defend that figure of the provider who sits down to understand the business before proposing a solution. It is not about selling more licenses, but about preventing the SME from discovering its shortcomings on the day of the incident. Data resilience, well planned, is an investment in operational peace of mind; poorly planned, it is an expense that is not tested until it is already too late.

If you are reviewing your backup, recovery or AI governance strategy, start with the basics: inventory, priorities and a real restore test. The rest is built on that base.

Source: Computerworld. Analysis and adaptation: ForgeNEX.