Blog

Point releases have a reputation: Bug fixes, a few quality-of-life tweaks, and maybe a new checkbox.

In this case, don’t let the 0.1 fool you.

More than 70 new features ship in v13.1, including automated Active Directory forest recovery, threat detection extended to more workloads, post-quantum cryptography, and Veeam Intelligence that evolves from an assistant that answers questions into an agent that investigates and acts.

Most vendors would call this a major version, but for Veeam it’s simply a point release.

With so many new features, there’s far too much to cover in a single blog post (that’s what the What’s New document is for).

Instead, let’s focus on three topics that are coming up in nearly every conversation I’m having right now with organizations: Identity, cyber resilience, and AI.

Identity Resilience

Coveware by Veeam’s frontline incident data shows identity is now the primary intrusion surface. Attackers are not breaking in anymore. They are logging in via compromised credentials, OAuth consent, and help desk social engineering.

The result leads to an uncomfortable truth most organizations have not stress-tested: Active Directory forest recovery is one of the most feared incidents in IT and cybersecurity, and almost nobody has practiced it. Microsoft documents the manual process in over 40 steps. That process typically requires outside experts and happens under the worst conditions imaginable. Every hour identity is down, nobody logs in, no application authenticates, and the business is effectively offline.

V13.1 automates Active Directory forest recovery by collecting and preserving the forest metadata needed for a successful rebuild during the backup process.  The intelligence required for recovery is captured before an incident, not pieced together during one. This helps restore identity services far faster than most teams could achieve manually, while reducing the risk of human error.

Most enterprises now run hybrid identity, which means Active Directory is just part of the story. That is why we also added additional coverage to Microsoft Entra ID with protection for organization contacts, device objects, and BitLocker recovery keys. Every protected object can also be exported to JSON with its full properties and relationships intact. This provides an audit and recovery path while preserving original object IDs so relationships between users, groups, and applications don’t break.

Cyber Resilience

The attack path is well known and documented at this point. If a threat actor successfully compromises identity, then their next stop is backup. Some 89% of organizations report their backup repositories were targeted. And it’s possible the other 11% were just unaware or fat-fingered during the survey.

The good news is that Coveware by Veeam data shows ransom payment rates hit a record low of roughly 20%, largely because organizations can restore operations without a decryption key thanks to the entire data resilience industry stepping up its game with immutable backups, orchestrated recovery, and more. Unfortunately, that trend cuts both ways.

Coveware expects threat actors to shift back toward their encryption roots as data exfiltration becomes less fruitful. This raises the stakes for organizations to detect threats earlier, verify clean restore points, and recover with confidence while avoiding reinfection of production environments.

This is why Veeam already provides sophisticated malware detection before, during, and after backup.

• Before backup is to sniff out suspicious behaviors on the Veeam components themselves. If we know threat actors target backups, then why not actively monitor the backup environment specifically for unfamiliar IPs attempting remote access or compromised accounts trying to brute force their way in?
• During backup, Veeam provides an additional defense-in-depth layer to help identify threats that may have been missed by EDR, or to provide visibility if EDR has been evaded or disabled. This includes detecting suspicious activity such as mass file renames or deletions, identifying the presence or use of tools commonly abused by threat actors (such as RDP, FileZilla, and Nmap) and applying entropy analysis to detect anomalous spikes based on how a workload typically behaves.
• After backup when dealing with zero-day attacks. Unfortunately, no one process or technology can guarantee ransomware prevention, which means we need to identify clean and recover our minimum viable business as quickly as possible. This is where Veeam Threat Hunter comes into play, adding signature-based detection and support for YARA rules to search for custom malware artifacts. These capabilities help validate recovery points before restore, which reduces the risk of reinfecting production during recovery operations.

Going one step further, V13.1 extends these capabilities to unstructured data, Azure VMs, Sangfor aSV, Citrix XenServer, XCP-ng, Platform9, VergeOS, Veeam Agent for AIX, and Veeam Agent for Solaris. You might be thinking, “… AIX and Solaris?” Yes, but those Unix systems often run the most critical and least monitored workloads in the enterprise.

But wait, there’s more! Post-quantum cryptography. The main threat here is called harvest now, decrypt later. Adversaries capture encrypted traffic today and wait for quantum computing to break it. Backup traffic is a prime harvest target since the data stays valuable for years. V13.1 introduces post-quantum algorithms aligned with NIST FIPS 203, 204, and 205 for handshake and key exchange, while retaining FIPS-certified AES for data encryption.

AI for Day 2 Operations

Did I just make it five minutes without mentioning AI? Could be a new record.

In all seriousness though, attackers are adopting AI to compress the window between known vulnerability and working exploit from weeks to hours, a shift my colleague, Bill Siegel, CEO of Coveware by Veeam, calls “the asymmetry of speed.” Meanwhile most operations teams still run at human speed: Reading logs one at a time, filing tickets, and waiting on callbacks.

You cannot defend a machine-speed problem with a human-speed process.

Typically, I am skeptical of most AI features. Too many are just chatbots bolted onto a product. But the Veeam Intelligence updates in v13.1 clear a higher bar by addressing a real Day 2 operational burden: Troubleshooting.

That’s why Backup Admin Agent investigates problems the way a Veeam support engineer would. Point it at a failed session, or ask it a question in natural language, and it analyzes the job and session logs, working through the same information a support engineer would review. You can launch it directly from a failed session in the Web UI. And, when an issue does require support, the agent can review existing cases, add comments, and proactively offer to attach relevant diagnostic data. Anyone who has spent an afternoon collecting logs for a ticket understands what that is worth.

The bigger step is action. Veeam Intelligence can now execute approved operational tasks: Job control, repository management, configuration backups, malware scanning, and selected recovery operations. Note the word “approved.”

Every action runs through workflow-based approval controls, so administrators stay in the loop of anything that touches the environment. An AI agent with unsupervised write access to your backup infrastructure is a new attack surface. This is what Day 2 operations improvement looks like:

Other Noteworthy Features

As mentioned earlier, I won’t cover all 70-plus features, but five more deserve a callout:

Hypervisor support keeps expanding. Worrying about whether your data protection vendor supports the hypervisor, cloud, or platform you’re migrating to, or where you’re spinning up net-new workloads, should not be another item on your to-do list. Veeam continues to expand its broad hypervisor and cloud support by welcoming Sangfor aSV, Citrix XenServer, XCP-ng, Platform9, and VergeOS to the family. Each gains native support with CBT-based backups, cross-platform recovery, and malware detection out of the box. In addition, Veeam is introducing a standardized KubeVirt backend to support the next wave of Kubernetes-based virtualization platforms. So wherever your migration lands, your protection layer is already waiting.

Proxmox VE. VM replication comes to Proxmox, covering direct host-to-host replication for broader disaster recovery (DR) strategies. In addition, you’ll also get Instant VM Recovery and full Web UI coverage. This makes Proxmox a platform you can build a real DR strategy both for customers and service providers. It’s important to clarify what “replication” means here. With Veeam, replication operates at the compute and hypervisor layer, giving Proxmox workloads a ready-to-run recovery option rather than just another copy of backup data. That distinction is what enables extremely fast RTOs when failover speed is the priority.

Unstructured data goes directly to archive. NAS backups can now write directly to archive-class storage, including Veeam Data Cloud Vault Archive, Azure Archive, and AWS S3 Glacier, as the primary target. Same source, proxy, and workflow, so only the destination changes. For organizations that rely on snapshot replication for day-to-day recovery and just need a cost-efficient, long-term copy, this eliminates paying hot storage prices for cold data.  The tradeoff is recovery speed: Archive restores require retrieval time, so this should be matched to the right recovery tier and SLA.

Veeam Data Cloud Vault supports AWS. Connect Veeam Vault directly into Veeam Backup for AWS appliances. This provides immutable backup storage by default for your EC2, RDS, and other AWS services, at a fraction of the cost compared to DIY S3 storage. Fundamentally, this reduces risk by taking out room for human error in setting up immutable and encrypted backup storage, while also providing predictable and economical per TB storage forecasting to the business.

Epic EHR protection at 100-plus TB scale. The new Veeam Snap Scale backup engine is purpose-built for EPIC running on InterSystems IRIS. This integration automates the underlying processes required in protecting an EPIC system. Underlying storage is automatically snapshotted, the IRIS instance is frozen only for the moment the snapshot is taken, and data is read across multiple proxies in high parallelization. Protecting and recovering the underlying .dat files to an EPIC database provide the fast RPOs and RTOs healthcare organizations require without specialized scripting.

Real-Life Guidance

Threats are evolving faster than I can cover all these new features, so let’s take a quick breather to talk about some other proactive protection optimizations you can make to stay one step ahead as we enter the back half of 2026.

• Identity breach tabletop exercise. Schedule a recovery drill in an isolated environment. Test real world scenarios. Be honest and see where you stack up. Document on how to improve and implement changes. A capability you have never rehearsed is a capability you do not have.
• Restore point selection is still a security decision. The security team owns the forensic timeline that determines which restore point range to use. Veeam Threat Hunter and YARA help pinpoint the exact restore point to leverage. Have that conversation before the incident.
• Decide your cryptographic posture deliberately. When PQC is enabled, FIPS compliance is disabled. That is not a bug, it is compliance reality: PQC algorithms are not FIPS-approved until they sit inside a CMVP-validated module boundary, and that certification cycle takes time. If you are in a regulated industry, decide which posture wins before you upgrade.
• Check your edition. Confirm the edition you have to ensure you can take advantage of these advanced features in the Veeam Data Platform.

Conclusion

Identity is the perimeter. Detection must go where attackers hide. And the scarcest resource in every IT organization is the time of the people running it.

V13.1 answers all three in a single release, with the details that separate a platform from a product: Metadata collected before the crisis, approval gates on AI actions, and cryptography ready for a threat that has not fully arrived yet.

The organizations that recover fastest treat resilience as an engineering discipline. This release hands you the tooling. The discipline is up to you.

The post Veeam Data Platform v13.1: Identity Resilience, Cyber Resilience, and AI That Improves Day 2 Operations appeared first on Veeam Software Official Blog.

from Veeam Software Official Blog https://ift.tt/kXFAP4p