ANZ data readiness is lagging behind AI and recovery risk

At a glance

What this is: A Commvault-commissioned ANZ survey shows that data readiness is under pressure from AI adoption, multi-cloud sprawl, regulatory complexity, and a major gap between expected and actual recovery.

Why it matters: IAM, NHI, and security teams need to treat AI governance, recovery planning, and data access control as linked problems, because weak audit discipline and unrealistic resilience assumptions widen blast radius across identities and workloads.

By the numbers:

• The annual data growth rate in ANZ has marginally slowed from 28% last year to 27% this year.
• A majority, 62%, continue to operate in blended multi- or hybrid cloud data environments, and this is projected to increase to 71% by 2026.

Context

ANZ data readiness now spans three overlapping pressures: data sprawl, AI adoption, and recovery expectations that do not match operational reality. The report shows that organisations are trying to govern more data across more environments while also absorbing new regulatory requirements and AI-related risk.

For identity and access teams, the issue is not just storage or backup. Data readiness now depends on who and what can access data, how AI tools are reviewed before use, and whether recovery processes can actually be executed across blended environments.

The report is based on 408 companies across Australia and New Zealand, so it reflects a regional operating picture rather than a single-sector anomaly. The pattern is increasingly typical for organisations that run mixed cloud estates and are now being asked to govern AI on top of them.

Key questions

Q: How should security teams govern AI use in developer tooling?

A: Security teams should govern AI use as a data and access problem, not only a productivity feature. Define what information can be sent to models, require human review of generated code, and apply least privilege to connected repositories and tools. Approved use cases should be explicit, monitored, and revisited as model capabilities expand.

Q: Why do recovery targets often fail in blended cloud environments?

A: Recovery targets fail when organisations assume backup presence equals business restoration. In blended cloud environments, restore order, identity dependencies, network paths, and application coupling all have to line up. If those pieces are not tested together, the programme can meet a storage objective while still missing an operational recovery objective.

Q: What are the warning signs that AI governance is lagging in an identity programme?

A: Common warning signs include no formal audit of AI tools before deployment, no policy for generated data, and no clear owner for access to AI outputs. When those gaps exist, the identity programme cannot explain who can create, view, retain, or export AI-generated content.

Q: What should organisations do when executive recovery expectations are too optimistic?

A: They should replace optimistic recovery targets with evidence from full restoration tests. The test should include identity recovery, mission-critical workload sequencing, and a realistic measure of when the business can actually operate, not just when systems come back online.

Technical breakdown

Why blended cloud estates make recovery harder

Blended multi-cloud and hybrid cloud estates increase the number of places where data copies, permissions, and backup dependencies must stay aligned. That complicates restore testing because recovery is no longer a single platform event. It becomes an orchestration problem across storage, identity, policy, and cloud boundaries. When the same organisation also has to keep copies in separate environments for resiliency, the control surface expands again. In practice, recovery depends on whether access paths, retention rules, and restore sequencing have been designed together rather than managed as separate functions.

Practical implication: Treat restore readiness as a cross-environment identity and data coordination exercise, not a backup-only checklist.

What the AI governance gap looks like in practice

The report shows a familiar control gap around AI tooling: adoption moves faster than due diligence. If organisations are deploying business-focused AI without thorough security audits or comprehensive policies for generated data, they are creating governance blind spots around data handling, prompt exposure, output retention, and downstream access. This is not just a model-risk issue. It is also a data-governance and access-governance issue because AI systems can introduce new paths for sensitive content to be created, copied, or retained outside normal controls.

Practical implication: Review AI tools for data handling, retention, and access scope before deployment, not after teams are already using them.

Why recovery expectations diverge from operational reality

The gap between a five-day recovery target and a four-week average to restore minimal business operations shows that many programmes are measuring intent rather than tested capability. Recovery time is constrained by identity recovery, data integrity checks, dependency rebuilding, and workload prioritisation, not just backup availability. Ransomware pressure makes that worse because restoration often competes with containment and investigation. The report’s finding that breached organisations test mission-critical workloads more often suggests that real experience exposes assumptions that tabletop exercises miss.

Practical implication: Test mission-critical workload recovery under realistic identity, data, and ransomware conditions rather than assuming backup success equals business recovery.

Threat narrative

Attacker objective: The attacker aims to exploit weak governance and recovery readiness to disrupt operations, increase leverage through ransomware, or access sensitive data through poorly controlled AI and cloud environments.

1. Entry begins with business-focused AI adoption and complex blended environments that expand the number of access paths, data copies, and governance gaps available for misuse.
2. Escalation occurs when organisations deploy AI tools without extensive security audits or comprehensive policies, leaving sensitive data handling and access boundaries weakly controlled.
3. Impact appears as breach likelihood, ransomware pressure, and recovery failure, with leaders expecting five-day restoration while actual operations take about four weeks to resume minimally.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI readiness without data governance is a control illusion: The report shows that adoption is outpacing the discipline needed to govern data exposure, audit AI tools, and define content protections. When 73% of organisations are using business-focused AI but only 29% have comprehensive policies for AI-generated content, the gap is no longer theoretical. Practitioners should treat AI governance as an access and data-lifecycle problem, not a feature rollout problem.

Recovery expectations are now a governance failure, not a communications issue: A five-day expectation against a four-week restoration reality means resilience programmes are being judged against assumptions they have not validated. That gap spans backup, identity recovery, application dependencies, and restore order across hybrid estates. The operational conclusion is straightforward: if recovery has not been tested end to end, it is only a forecast.

Blended environments turn data readiness into identity readiness: Once 62% of organisations operate across multi- or hybrid cloud data environments, access control and entitlement hygiene become part of resilience. Separate cloud copies, conflicting regulations, and AI tooling all depend on precise control of who can access what, where, and when. The practitioner takeaway is that identity governance now sits inside the data-readiness conversation, not beside it.

Experience is exposing the difference between policy and capability: The report’s observation that breached organisations are more likely to review AI tools and test mission-critical workloads shows that incident experience often reveals blind spots faster than governance programmes do. That is a sign of programme immaturity, not merely increased caution. Security leaders should assume that untested assumptions will fail under pressure and design for evidence, not confidence.

Data readiness is becoming a cross-domain discipline: The report connects AI, cloud sprawl, regulation, and recovery into one operating problem. That means identity, security, compliance, and infrastructure teams can no longer work from separate readiness models. Practitioners should align controls around the actual business failure modes: uncontrolled data movement, weak AI review, and slow restoration.

What this signals

AI readiness now depends on identity control: Once business users can deploy AI tools quickly, the programme that governs access, retention, and output handling becomes the real control plane. If those decisions live outside IAM and data governance, policy will lag usage and auditability will collapse.

Recovery planning is only credible when it has been exercised: The largest gap in the report is not the target itself, but the assumption that a stated target reflects a proven capability. Practitioners should assume that untested recovery paths will expose missing dependencies in identity, cloud, and application layers.

Hybrid data estates require cross-domain coordination: Data copies, regulatory constraints, and cloud boundaries are now intertwined with who can restore, who can approve, and who can verify. That makes data readiness a shared responsibility across security, IAM, and infrastructure teams, not a single-team metric.

For practitioners

• Audit AI tools before deployment Require security review of data handling, access scope, retention, and output reuse before business-focused AI is allowed into production workflows.
• Test recovery against real workloads Validate restoration of mission-critical workloads end to end, including identity dependencies, backup integrity, and sequencing across blended environments.
• Map data copies across cloud environments Inventory where regulated and recovery-critical data copies live, then align entitlement controls and retention rules across each environment.
• Separate resilience from assumption Compare stated recovery targets with measured restore times and use the gap to reset executive expectations and incident response planning.
• Treat AI policy as data governance Define what AI systems may ingest, generate, store, and share, and tie those rules to access controls rather than informal usage guidance.

Key takeaways

• ANZ organisations are facing a compound readiness problem where AI adoption, cloud sprawl, and regulatory pressure are moving faster than governance.
• The report shows a major gap between expected and actual recovery, which means resilience claims need to be validated with full operational testing.
• Security and identity teams should align AI review, data policy, and restore planning so that access control and recovery are managed as one programme.

Key terms

• Data Readiness: Data readiness is the degree to which data is clean, governed, accessible for the right purpose, and traceable back to a known source. For AI programmes, it covers lineage, retention, quality, and access controls, because poor data quality becomes a governance failure at runtime.
• Cloud Data Estate: The full collection of data stores, accounts, services, and locations where an organisation keeps information in cloud environments. It includes structured and unstructured data, and governance depends on knowing where the data lives, who can access it, and how quickly that picture changes.
• Recovery expectation gap: Recovery expectation gap is the distance between the time business leaders believe restoration should take and the time operations can actually deliver. It usually exposes missing dependency mapping, weak restoration testing, and identity or access steps that are not included in incident plans.
• AI Data Governance: AI data governance is the set of rules, ownership decisions, and enforcement mechanisms that determine how data can be used by AI systems. It covers classification, access control, retention, and remediation, and it must account for both human users and autonomous software entities.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.