It started with a question nobody could answer.

“Can we actually recover?”

Every enterprise had backups. Many had made them immutable. But immutability protects a copy from being altered, and nobody could say what was inside the copies. A restore test proves a copy comes back, not that it is clean, and no team can restore-test an estate. The question the board was asking still had no answer.

Proving data clean took years of math.

We started where the question pointed: prove the data is not encrypted. It is a large math problem, and it took years of reverse-engineering ransomware to solve at enterprise scale.

We studied how ransomware actually behaves: how it hides inside data that looks normal from the outside, how it encrypts slowly over weeks to stay under thresholds, how it corrupts selectively to evade entropy checks. That research became detection models built from 2,300+ families and 10,000+ variants, with new samples analyzed every week, and Deep File Inspection that opens the files and renders a verdict with evidence. That work became Hunt.

Customers moved us up the pipeline.

Once they could prove their copies clean, customers asked the next question: prove it before the copy is made. Clean before it is backed up, clean before it is made immutable, clean in the primary storage and the live workloads. The proof moved to the front of the data pipeline and now covers live data, storage, and recovery points.

We moved to the hours before encryption.

While we were proving data clean, the way in changed. Stolen credentials look normal. Zero-days have no signature. Working bypasses for major endpoint tools sell on criminal markets for a few thousand dollars. A capable attacker defeats the tools they can see, and they can see everything that runs in their path.

So we built for the hours after the break-in and before the encryption, from a position the attacker cannot reach. Everything runs off-host, out of the attack path, with nothing on the host to unhook or blind. Then we put AI on it: Pursuit’s agentic analysis investigates a system the way an expert analyst would, finds the active compromise, and proves it, while the incident can still be contained. Finding an active attack reliably from a copy of a system, without noise, is the hardest thing we have built. It is the detection IBM and Qumulo embed in their own products. Pursuit’s analysis approach is patent-pending.