Druva advances backup reliability with AI-driven operational intelligence

As a provider of data security solutions, Druva helps organizations protect critical data across hybrid and multi-cloud environments and strengthen cyber resilience through its cloud-based SaaS platform. Across the Druva Resilience Cloud platform, operational state changes, backup telemetry, file metadata, and identity records provide valuable information about customers’ backup environments. However, that information was spread across databases, custom APIs, file system logs, and backup storage.

When an operational issue surfaced through an observability alert, administrators could receive an error code and supporting information but still had to investigate the cause and determine what to do next. Druva wanted to bring the relevant context together so it could move beyond flagging issues and provide customers with actionable recommendations.

“Customers would receive an observability alert and then have to work out what to do next,” says Anand Apte, distinguished engineer at Druva. “We wanted to connect that context and give customers actionable recommendations.”

Doing this at Druva’s scale added another challenge. The company manages hundreds of petabytes of storage data and tens of millions of backups worldwide, while the underlying operational and security data changes continuously. Druva needed a way to consolidate that information into a fresh, queryable context layer for AI reasoning without adding significant operational complexity.

After reviewing multiple AWS and third-party options, the team chose a streaming lakehouse architecture that could unify data normalization and cataloging, simplify management with fully managed Apache Iceberg storage, and integrate security, governance, and AI services. Druva also drew on its long-standing relationship with AWS and access to specialists as it evaluated deployment models and architecture choices. “We’ve been early adopters of AWS technology for about a decade,” says Apte. “AWS specialists help us choose the right tools, right-size the architecture, and move faster.”

Druva selected Apache Flink Change Data Capture (CDC) on Amazon EMR to capture changes from its Amazon Aurora and Amazon Relational Database Service (Amazon RDS) for MySQL databases across multiple AWS Regions, some of which handle thousands of writes per second. The team needed to ingest these changes without affecting production workloads. Apache Flink CDC filters and deduplicates data during ingestion before writing the required changes to Amazon Simple Storage Service (Amazon S3) Tables, avoiding the need to send every mutation through an intermediate message queue or staging layer. “We wanted an approach with lower operational overhead that fit our use case, and Flink stood out,” says Shubham Deshmukh, senior principal engineer at Druva.

In Amazon S3 Tables, Druva uses Apache Iceberg to create version-aware schemas across historical customer restore points and graph-style identity schemas for querying. The managed service also reduces table-management tasks such as compaction and tuning. For non-database telemetry, Druva uses AWS Glue to normalize schemas, build materialized views, and register datasets in the AWS Glue Data Catalog for consistent metadata.

The connected data layer powers the Dru SRE Agent, Druva’s customer-facing site reliability engineering (SRE) agent designed to improve backup reliability by identifying issues, explaining root causes, and recommending corrective actions. The agent uses Trino, a distributed SQL query engine, to retrieve relevant data from the lakehouse and Amazon Bedrock to reason over that context, providing administrators with step-by-step resolution guidance.

The architecture changes how administrators investigate operational issues. Instead of piecing together information from alerts, error codes, and documentation, administrators can use the Dru SRE Agent with connected operational context to investigate what happened and determine the next step. Incident investigation time has fallen from hours to minutes, while data refresh frequency has increased eightfold, from once every eight hours to once an hour.

Druva has also identified opportunities to potentially reduce infrastructure costs by 30–50 percent. However, Apte says the most important outcome is the reliability of the new data pipeline. Its leaner architecture gives Druva confidence that the data and analysis powering the Dru SRE Agent will be available whenever customers need access to operational intelligence.

“The stability of AWS ensures that whenever customers come to the console, whatever the reason, operational intelligence is ready and waiting for them,” says Apte.

The connected data layer also gives Druva a foundation to expand operational intelligence into a broader set of security and recovery use cases. As the platform evolves, Druva plans to apply the same context to help customers identify risks earlier and respond more effectively. “With this connected context on AWS, we can go beyond operational troubleshooting to detect cyber incidents earlier, prepare an investigation report before a customer logs in, and guide administrators through recovery,” says Deshmukh.