How TELUS Health Built Cyber Resilience Across a Global Health Platform with Rubrik

TELUS Health had grown through a series of acquisitions, each bringing its own platforms and its own gaps into the fold. The backup infrastructure had grown the same way: tool by tool, workload by workload, with no unifying policy and no tested recovery posture beneath it. The DR audit did not create the problem. It forced a question that Philip Owen, Chief Security Officer, and Jody Kieran, VP of Platform Engineering, needed to answer honestly: if the worst happened, could the company actually recover.

That question carried real weight. Customers place significant trust in TELUS Health with data that is deeply personal to them. Owen recognises that people have a great deal of anxiety around the protection of health data, and that the infrastructure needed to match the promise being made to them. The audit made clear it did not.

The team ran a proof of concept focused specifically on RTO measurement, testing Rubrik against the same DR scenarios the audit had exposed as gaps. Where the existing infrastructure had failed, Rubrik delivered, and the results removed any ambiguity from the decision.

For Jody Kieran, the case was both operational and financial: replacing seven fragmented legacy tools with a single platform that delivered meaningfully more capability at similar or lower cost was not a difficult decision. For Philip Owen, the decision turned on something beyond recovery speed. TELUS Health runs CrowdStrike for managed detection and response and Zscaler for zero trust network access. His view is that reaching machine speed in detection and response requires platforms that share data and enrich each other, not point solutions operating in isolation. Rubrik's ability to scan backup data and feed that context into the broader security stack, giving tools like Zscaler real-world signal they would otherwise be missing, was what made it the right fit for the environment TELUS Health had built.

Seven legacy tools gave way to one. VMware virtual machines, MS SQL and Oracle databases, Exchange on-premises, Windows and Linux filesets, Azure workloads, M365, and Active Directory are all now protected under a single policy framework across four data centres. The Rubrik Cloud Vault provides air-gapped backup and archive tiers in both Azure and AWS, placing backup data outside the reach of any attacker who might gain access to the production environment.

The operational change was immediate. When TELUS Health faced a tight deadline to evidence disaster recovery capabilities to a key customer, the team produced audit-ready results quickly enough to meet it. Contractual commitments around DR testing are now commitments the business can consistently keep, and tasks that once required coordination across multiple teams and tools can now be completed in a fraction of the time.

Identity sits at the next frontier. With identity-based attacks now accounting for the majority of threats across the sector, Owen has been expanding the platform's coverage. Active Directory is now protected under Rubrik Identity Recovery, and the team is actively building out broader identity resilience capabilities as the threat landscape continues to evolve.