ControlMonkey expands backup to security platforms

ControlMonkey has expanded its configuration backup and recovery service to cover security platforms including CrowdStrike, Zscaler, Fortinet and Palo Alto Networks, extending its disaster recovery coverage into the security stack.

The addition allows organisations to discover and snapshot configurations across those platforms, keep versioned recovery points and restore previous settings when incidents affect policies, rules or integrations.

Security teams rely on a growing mix of tools to manage access, monitor threats and enforce controls across cloud environments. Those systems are updated through management consoles, application interfaces, automation scripts and, increasingly, AI-driven tools, creating a steady flow of configuration changes that can be hard to track and reverse.

ControlMonkey is positioning the new coverage around a gap in conventional backup practices. Traditional backup products usually focus on data and workloads, but configuration settings in security products can still be lost, corrupted or altered, leaving teams to rebuild them manually if no recovery record exists.

Recovery gap

The latest expansion adds the security layer to a broader platform that already covers cloud infrastructure, identity, networking, observability, SaaS and other third-party systems. In practice, the company is aiming to bring together recovery for operational settings that sit outside standard data protection processes.

Users can connect supported platforms, let the service discover relevant configurations, create continuous snapshots and recover a previous version when needed. According to ControlMonkey, this creates a record of changes over time and gives teams a known recovery point instead of forcing them to rely on scripts or internal knowledge.

Native backup features from individual security vendors can offer some protection, but those functions are usually limited to each supplier's own environment and policy framework. ControlMonkey aims to provide a centralised recovery layer across multiple vendors, with one place to review changes and restore historical configurations.

The issue has become more important as cloud estates have spread across multiple providers and software services. In those environments, security settings often determine whether applications can be accessed, traffic can be routed, monitoring can continue and controls remain in place during a disruption.

Aharon Twizer, Chief Executive Officer and Co-Founder of ControlMonkey, said the company sees security configurations as part of the wider resilience challenge facing businesses.

"CISOs spend enormous effort making sure the organization has a recovery strategy, but the security tools responsible for protecting the business are often missing from that strategy," said Aharon Twizer, Chief Executive Officer and Co-Founder of ControlMonkey.

"If a critical security policy or platform configuration is changed or lost, teams should not have to rebuild it manually under pressure. Security configuration needs to be recoverable too," Twizer said.

Broader market

The company's argument reflects a wider debate in cyber resilience over what should be included in disaster recovery planning. Restoring files and applications may not be enough if the policies and settings that govern identity systems, network controls, observability tools and security software are unavailable or incorrect after an incident.

That has pushed more suppliers to focus on the operational state of cloud and SaaS environments rather than only the underlying data. Configuration drift, unauthorised changes and accidental deletions can all affect recovery times, particularly when businesses are trying to re-establish services quickly after a cyber attack or outage.

ControlMonkey says its service is designed to identify resilience gaps across security platforms as well as the broader cloud environment. Support for additional security platforms is due to follow, broadening the number of systems it can cover under the same recovery framework.

For customers using several security vendors, the appeal of a shared recovery process will depend on how deeply the product can map and restore the specific settings that matter in each environment. The initial list of supported vendors gives it coverage across endpoint security, secure access and network security products widely used in large organisations.

The expansion also underlines how configuration management is becoming a larger part of business continuity planning. As more core operations depend on cloud-delivered tools and interconnected security controls, restoring a known-good configuration can matter as much as restoring the data those systems protect.

ControlMonkey says its platform is intended to help organisations discover, back up, compare and recover critical configurations across cloud and SaaS environments, with the latest release extending that scope to security tools.