NetApp Ransomware Resilience is designed to help you detect, protect, and recover from ransomware attacks directly at the storage layer, where your data ultimately lives.

Key elements include:

• AI-driven detection – Built-in AI and machine learning monitor user and workload behavior on NetApp ONTAP for both NAS and SAN. The system looks for anomalous activity and early indicators of compromise, such as unusual access patterns that may signal a ransomware or data exfiltration attempt.
• Workload-centric protection – Ransomware Resilience orchestrates protection across file and block storage using a single control plane. This helps you manage ransomware defense consistently across hybrid environments.
• Fast recovery with NetApp Snapshot copies – When an attack is detected, the solution uses NetApp Snapshot technology to restore affected workloads, often within minutes, helping you avoid extended downtime and business disruption.

The goal is to help you avoid data loss, limit downtime, and reduce the risk of lost revenue and business disruption—without requiring your team to be deep security experts. It acts as an additional layer of defense alongside your existing security tools, focusing on the storage system as both the last and an important early line of defense.

Note: No ransomware detection or prevention system can completely guarantee safety, but NetApp’s research indicates a high degree of detection for certain file-encryption-based ransomware attacks.

The new data breach detection capability in NetApp Ransomware Resilience is designed to help you spot and respond to data exfiltration attempts early—especially in the context of double extortion ransomware attacks.

In a typical double extortion scenario:

• An attacker gains read access to critical data.
• They exfiltrate a copy of that data.
• They then encrypt the data in your storage and delete unencrypted copies.
• They try to extort you twice: once for the decryption key, and again to prevent public release of the stolen data.

NetApp’s data breach detection capability helps you intervene earlier in this chain:

• AI-driven anomaly detection – It continuously analyzes user behavior to identify suspicious or anomalous access patterns that may indicate an exfiltration attempt.
• Early indicators of compromise – By focusing on early signals (for example, unusual read activity on sensitive datasets), it aims to catch attackers before they move data out of your network and start encrypting it.
• Automated alerts and forensics – When suspicious behavior is detected, the system automatically alerts your team and your SIEM, and provides forensic details to help you quickly identify and block the user or account involved.

This capability is intended to help you reduce the risk of data exfiltration and limit the impact of double extortion attacks by using AI to reimagine how storage participates in your broader security strategy.

Availability: The data breach detection capability is currently available in preview.

The isolated recovery environment is a new capability in NetApp Ransomware Resilience that focuses on helping you restore workloads quickly and cleanly after a ransomware incident.

Here’s how it works:

1. Initialize an isolated environment
   Ransomware Resilience creates a separate, controlled environment that is isolated from your production systems. This helps ensure that recovery operations are not exposed to active malware or ongoing attacks.
2. AI-powered deep scan
   Within this environment, an AI-driven scan is run to:
   • Precisely identify encrypted data.
   • Scan for and remove malware that could cause reinfection.
3. Assess recovery points
   The system evaluates your available recovery points (for example, Snapshot copies) and helps you choose the one that best aligns with your business needs—balancing data freshness with confidence in data integrity.
4. Guided restoration
   Ransomware Resilience then guides you through the restoration process so you can bring workloads back online fast and in a malware-free state.

This approach is meant to help you:

• Recover quickly from an attack without extended downtime.
• Reduce the risk of reinfection by validating and cleaning data before it returns to production.
• Protect business operations and reputation by restoring services safely and efficiently.

Availability: The isolated recovery environment is currently available in private preview.