Inline scanning, anomaly detection and an AI assistant: the backup becomes a security sensor — often the first to notice.
The backup reads all the data every night: the perfect position to notice the attack. The Data Platform exploits it: inline entropy analysis (the encryption in progress shows in the patterns), IoC and antimalware scanning on the restore points, SIEM integration and the AI assistant helping to query the platform.
Entropy has false positives (compression, legitimate encryption): the tuning that makes the alert credible.
The Veeam alarm inside our 24/7 process: the ransomware night is already written in the runbooks.
At restart, the scan finds the last healthy point: no restoring the malware along with the data.
The events toward Sentinel/Splunk: the backup among the SOC's sensors.
Security is inside the platform: the inline malware detection analyzes the blocks during the backup (entropy and encryption patterns), the Threat Hunter scans the restore points with signatures, the Incident API receives the alerts from the EDR/SIEM and marks the suspicious points, the Security & Compliance Analyzer verifies VBR's posture against the best practices, the Veeam Threat Center aggregates the state; the recovery thus picks the clean point, not the latest one.
The attack seen from the side the attacker neglects.
The certified restore without guests.
The data's history queryable with YARA.