Do you ever hear something and then just keep repeating it in your head?
That happened to me at VeeamON this year. Anand, Veeam’s CEO, said something that really stuck with me:
“The control point is the data itself.” ( https://www.youtube.com/shorts/mmZHsnvRdMc)
And the funny part is… it sounded obvious. Almost too obvious. But at the same time, I realized I hadn’t actually been thinking about it that way before.
I kept going back to it. Read a bit more on the topic. Looked at how people talk about similar ideas — data-centric architectures, data-driven security and you start to notice a pattern. The industry is already moving in that direction.
And once you see it, you can’t really unsee it.
For a long time, when we talked about “control” in IT, we tied it to infrastructure. First the data center. Then virtualization. Then cloud became the new center of gravity. Each step felt like this is it — more control, more flexibility, better outcomes.
And if you think about it, that made sense.
Control usually sat in the systems people depended on the most — the ones where work actually happened, where decisions were made, where everything came together. The tools you live in every day tend to become your control point. But in reality, something else has been shifting underneath all of that.
It’s not the platform anymore. It’s the data. And that’s where it gets interesting.
Because if you look at data protection specifically, we’ve actually been doing a pretty good job, just not necessarily on the right problem. For the last 20–30 years, the data protection industry has made massive progress in backup and recovery.
And to be fair, we’ve gotten really good at it. Jobs are faster. Coverage is broader. Recovery that used to take days now happens in hours — sometimes minutes. All of that is real progress.
But there’s a question sitting underneath it that we haven’t consistently answered as an industry:
Do we actually know what we’re protecting? Not whether it’s backed up. But whether we understand it. What’s critical, sensitive, regulated and what is noise. Here is a great article from Rehan , Veeam’s President, Products & Technology: https://www.veeam.com/blog/veeam-intelligent-resops-microsoft-365-backup.html?utm_source=chatgpt.com
Because without that context, you’re protecting data but you’re not really in control of it. You’re not actually resilient.
And if you go back to that original idea — the control point is the data itself — it starts to expose that gap pretty quickly.
If control really sits at the data layer, then treating everything the same doesn’t give you control. It just means you’re good at storing copies.
In practice, a lot of environments still end up doing exactly that. Critical financial data and years of duplicate files often sit under the same policies, same retention, same assumptions. Not because anyone designed it that way, but because there isn’t enough context to do it differently.
For a long time, that was acceptable. Now it’s not. AI is basically forcing the issue. When AI agents start interacting with your data at scale — reading it, changing it, acting on it — the cost of not understanding that data goes up very quickly. It’s no longer just about recovering when something breaks. It’s about knowing what actually happened, changed, mattered.
And that’s a different problem.
Which is why that statement lands differently now. It’s not just a shift in architecture. It’s a shift in how we think about resilience. It’s no longer just about being able to recover. It’s about being confident in that recovery. Knowing what you have and what matters. And being able to act on it — precisely.
What are your thoughts on this matter?
