Cloud resilience news recap: what vendors and regulators announced, March to September 2026

This briefing groups the items on our news page by theme. It covers announcements from March to September 2026, most of them from June onwards. Each item is summarized from the vendor's or regulator's own page and is not verified by this site; the sources are listed at the end.

Which vendors moved into AI agent recovery?

Two ranked vendors announced recovery for AI agent infrastructure on Amazon Bedrock within a month of each other. On 25 August Arpio extended its platform to Amazon Bedrock, including AgentCore, Knowledge Bases and Guardrails. On 16 September Cohesity introduced Agent Resilience, a capability to discover, protect and recover the infrastructure behind AI agents, starting with Amazon Bedrock; it is available to select customers, with general availability targeted for the end of 2026.

On the regulatory side, the Joint Committee of the European Supervisory Authorities issued a statement on 31 July asking financial entities to adjust their ICT risk management for frontier AI models across prevention, detection and management, with accountability at management-body level.

For buyers, the practical point is that agent infrastructure is configuration: knowledge bases, guardrails and permissions. It belongs in the same recovery scope as the rest of the estate. Our lesson on recovering from bad changes and AI agent infrastructure covers the approach.

Which vendors widened what they capture?

• 4 March: Arpio extended automated recovery to Microsoft Azure, covering automated backup and continuous replication for pilot light recovery environments, full-application recovery and enterprise architecture patterns.
• 23 July: Firefly added identity recovery for Okta and Microsoft Entra ID, codifying their configuration as infrastructure as code with versioned, immutable snapshots.
• 31 August: Firefly extended coverage to VMware vSphere, generating Terraform or OpenTofu for unmanaged resources.
• 16 September: Firefly added Databricks workspaces, capturing workspace configuration on a schedule for point-in-time restore.

Firefly accounts for three of these four items. The pattern across vendors is the same: recovery scope is moving beyond compute, storage and networking in AWS, Azure and Google Cloud towards identity providers, private cloud and data platforms. The five layers lesson explains why identity matters as much as data.

What happened on funding and partnerships?

On 3 June Arpio announced a $15 million Series A led by S3 Ventures and Paladin Capital Group, saying the money will deepen AWS and Azure capabilities and extend support to Google Cloud and other AI-native services. On 23 July ControlMonkey announced a Strategic Collaboration Agreement with AWS that pairs its infrastructure configuration recovery with AWS Backup, AWS Resilience Hub and Amazon Application Recovery Controller, with purchasing through AWS Marketplace.

Neither changes a score in this edition. Arpio's Google Cloud support is a stated plan, not a current capability, and our scores only count what is published as available.

What changed for data backup and operations tooling?

On 29 July Veeam launched Data Cloud Vault Archive, an archive-class cloud storage tier for long-term, immutable backup retention that works with Veeam Data Platform v13.1. On 3 September HashiCorp made HCP Terraform metrics generally available on the Standard and Premium tiers, exporting run, agent, VCS connection, workspace and license metrics to Prometheus-compatible tools.

Both are useful to the teams that run them. Neither adds infrastructure rebuild capability, which is what this ranking measures.

What did research and regulators report?

• 3 June: the European Supervisory Authorities' report on 2025, the first full year of DORA incident reporting, counted 3,383 major ICT-related incidents reported by financial entities, with system failures as the leading cause.
• 3 June: Firefly said it was named in Gartner's 2026 Hype Cycle for Site Reliability Engineering in the Continuous Resilience Automation category. This is the vendor's own statement; we have not read the Gartner report.
• 16 September: a Vanson Bourne survey of 3,200 IT and security decision-makers, commissioned by Cohesity, found that 78% of organizations focus cyber recovery on restoring systems rather than keeping business operations running.

The supervisors' figure is the one to note. It is a regulator count, not a vendor survey, and system failures, not attacks, led it. Our briefing on DORA and NIS2 recoverability evidence covers what that means for evidence.

Does any of this change the ranking?

No. The ranking was last reviewed in September 2026 and already reflects capabilities published by then. Plans and targeted release dates are not scored until they are available. The next scheduled review is December 2026.