Not long ago, the IT team at The Coca-Cola Bottling Company of Saudi Arabia received a request that, a year earlier, it could not have met. The business needed data from the account of an employee who had left the company 13 months before. Under the company’s old arrangement, that account would have been gone, since Microsoft 365 data was kept for only 45 days. This time, the team restored it.
The recovery is a small episode in a larger change. The company, which makes and distributes the full Coca-Cola portfolio across the Kingdom and supplies more than 100,000 customers, has stopped relying on Microsoft’s built-in safeguards to recover the data behind its operations. It has moved protection of its Microsoft 365 environment onto Veeam Data Cloud and says data that once took four hours or more to restore now comes back in under half an hour.
Syed Kareemuddin, the bottler’s IT Infrastructure and Cybersecurity Manager, said the decision was about more than faster restores. “With the geopolitical situation changing so fast in the Middle East, we decided to strengthen our technology strategy by becoming less dependent on individual vendors,” he said.
A supply chain that cannot stop
The bottler’s business runs on volume and timing. Established in 1993, it is the authorised local bottler and distributor of Coca-Cola products in Saudi Arabia, and its job is to keep plants producing and trucks moving to retailers and partners across a very large country.
“We are the authorized local bottler and distributor of all Coca-Cola products in the country and have built a world-class manufacturing and distribution network,” Kareemuddin said. “Our mission is to strengthen our position by driving sustainable growth, operational excellence, customer satisfaction, and digital transformation, while supporting the ambitions of Saudi Vision 2030.”
Much of the coordination behind that network happens in Microsoft 365, through email, Teams, SharePoint and OneDrive. When that data is lost, corrupted or slow to recover, the effect does not stay inside the IT department. Interruptions can spread to bottling and distribution, which is what the company set out to prevent when it began moving to what it describes as a more proactive resilience model.
Its Microsoft 365 protection had not kept pace with how much the business depended on the platform. “Microsoft 365 powers the collaboration, communication, productivity, and secure information management our business depends on,” Kareemuddin said, “so we wanted something more than the built-in 45-day retention limit with basic recovery.”
Like other software-as-a-service providers, Microsoft keeps its platform running, but recovering lost or deleted data over the longer term largely falls to the customer. For a company operating at the bottler’s scale, a 45-day window left a gap, and so did recovery times measured in hours.
Veeam has been making the same argument to enterprises across the Gulf. Mena Migally, Regional Vice President for EMEA East at Veeam, has said organisations in the Middle East and Africa face mounting cyber risk, rapid multicloud adoption and growing regulatory pressure on data sovereignty, and that resilience “must be measurable, intelligent, and proactive.”
Choosing a managed service
The bottler did not want another system to run in-house. It chose Veeam Data Cloud for Microsoft 365, part of Veeam’s software-as-a-service resilience platform, which is delivered as a managed service.
Kareemuddin was not new to the vendor. He said he has used Veeam since it first launched in Saudi Arabia, across several roles before joining the bottler.
The reasons he gives for the choice are practical. “We chose Veeam Data Cloud because it gives us unlimited storage in an all-in-one cloud service,” he said. “It allows us to leverage powerful data protection and security technology without the burden of managing and maintaining it ourselves.”
The rollout was not without difficulty. The company worked with Veeam to fine-tune the installation, and Kareemuddin said there were teething problems soon after implementation. Veeam’s answer was to relocate the data. “They moved our data from the Veeam datacenter in Amsterdam to UAE to cut down on latency and enable rapid data recovery,” he said.
The bottler now protects more than 100 TB of Microsoft 365 data and keeps it for months rather than weeks. “Data that used to take us four hours or more to recover can now be restored with Veeam in less than 30 minutes,” Kareemuddin said.
Backups that also defend
The change has also given the company a new layer of protection. Ransomware groups increasingly go after backup copies before they encrypt production systems, knowing that a company with no clean backups has little choice but to negotiate. The bottler’s Microsoft 365 backups are now immutable at the service level, which means they cannot be altered or deleted once written.
The company also scans its backups for malware, and that has already produced a result. “We also use Veeam to scan our backups for malware, which identified an infection and allowed us to clear it with antivirus software before it had any impact,” Kareemuddin said.
That changes how the bottler treats backup data. Rather than an archive that sits untouched until something goes wrong, the backups have become a place where threats can be caught before they reach the business.
Bringing Azure and AWS under one roof
Having settled Microsoft 365, the bottler is now looking at the rest of its cloud estate. It plans to bring its Azure and AWS workloads under Veeam and will begin testing soon, with the aim of managing data resilience across its entire IT environment from a single point of control.
It means a company that set out to reduce its dependence on individual vendors will be relying more heavily on one. Kareemuddin sees it differently. In his view, a backup layer that sits above the cloud providers gives the business independence from them, and ends a period in which recovering its own data depended on others.
“In the past, we felt we had to rely on other vendors to help us recover our data,” he said. “In contrast, Veeam gives us control of data recovery while taking care of the underlying hardware, security updates, and so on.”
The bottler is one of several Saudi organisations Veeam has signed in the past year. The company named it among its regional customer wins at GITEX GLOBAL 2025, alongside Batterjee Medical College and KPMG Lower Gulf, and has since established a legal entity in the Kingdom. Commenting on Batterjee Medical College’s deployment, Migally called it “a powerful example of how data resilience can fuel innovation and expansion.”
Whether consolidating on one recovery platform delivers the independence the bottler is after will become clearer once its Azure and AWS workloads move across. For now, the measure Kareemuddin points to is operational: fewer interruptions to the bottling and distribution lines that keep its products on shelves across the Kingdom.
The bottler’s reasoning reflects a wider shift among Saudi enterprises. IBM’s regional leadership in the Kingdom has argued that digital sovereignty is no longer only a question of where data is stored, but of who controls infrastructure, operations and digital supply chains when conditions change. IBM’s Saudi market findings show 90% of executives believe AI sovereignty should form part of their business strategy in 2026.
Veeam, headquartered in Seattle, says it protects more than 550,000 customers worldwide, including 82% of the Fortune 500. Details of the deployment are drawn from a customer case study published by Veeam in June 2026.
