NetApp Ransomware Resilience is designed to help you detect, protect, and recover from ransomware attacks across your NetApp ONTAP file and block workloads, without requiring deep security expertise.

Key ways it supports your ransomware strategy:

• AI-driven detection: Built-in AI analyzes user and data access behavior to spot early indicators of compromise, such as unusual read or access patterns that may signal an attack in progress.
• Storage as a security control: Instead of treating storage as just a passive repository, NetApp uses the storage layer as both a last line of defense (protecting the data that attackers ultimately target) and an early line of defense (spotting suspicious activity before data is exfiltrated or encrypted).
• End-to-end workflow from one control plane: You can orchestrate ransomware defense across NAS and SAN workloads—from detection through recovery—using a single control plane, which helps reduce complexity and response time.
• Fast recovery with NetApp Snapshot copies: Ransomware Resilience automates the use of NetApp Snapshot technology to restore affected workloads within minutes, helping you avoid data loss, limit downtime, and reduce the risk of lost revenue and business disruption.

All of this is delivered as part of NetApp’s broader Intelligent Data Infrastructure, which spans hybrid cloud and supports a flexible, subscription-based model. While no solution can guarantee complete protection, NetApp’s research indicates a high degree of detection for certain file encryption–based ransomware attacks, making it a meaningful additional layer in your overall security stack.

The new data breach detection capability in NetApp Ransomware Resilience is designed to help you address a growing risk: double extortion ransomware, where attackers both encrypt your data and steal sensitive information to extort you twice.

Here’s how it works and why it matters:

• Focus on exfiltration, not just encryption: In a typical double extortion scenario, attackers first gain read access, copy critical data out of your environment, and only then encrypt or delete the unencrypted data. NetApp’s data breach detection is aimed at catching that early read-and-copy phase.
• AI-driven anomaly detection: The feature uses AI to detect anomalous user behaviors—for example, unusual access patterns or volumes that act as early indicators of compromise and potential data exfiltration.
• Early alerts and forensic context: As soon as suspicious behavior is detected, Ransomware Resilience automatically alerts your team and your SIEM, and provides detailed forensic data so you can quickly identify and block the user or account involved.
• Risk reduction before damage occurs: By intervening at the start of the attack chain, the system aims to significantly reduce the risk that attackers can move your data out of the network and then encrypt it.

This capability is currently available in preview. It’s intended to complement your existing security tools by using the storage layer itself as an intelligent sensor and control point against data theft and double extortion tactics.

The isolated recovery environment is a new capability in NetApp Ransomware Resilience that focuses on helping you recover quickly and safely after an attack, while reducing the risk of reinfection.

It adds several important steps to the recovery process:

• Creation of an isolated environment: Ransomware Resilience first initializes a separate, isolated environment where recovery operations can be performed away from your production systems.
• AI-powered deep scan: Within this environment, an AI-driven scan precisely identifies encrypted data and searches for malware. The goal is to remove malicious components before anything is brought back into production.
• Recovery point assessment: The system evaluates your available recovery points (for example, Snapshot copies) and helps you choose the option that best aligns with your business and data integrity needs.
• Guided, malware-free restoration: You’re guided through the restoration process so you can bring workloads back online quickly, with a focus on malware-free recovery and minimizing downtime.

This isolated recovery environment is currently available in private preview. Combined with AI-powered detection built directly into ONTAP for both NAS and SAN, it helps you reimagine storage not just as a place to keep data, but as an active participant in your ransomware response and business continuity strategy.