elastioRequest a demo

How We Measure. What We Claim.

Elastio publishes two kinds of numbers. Production counts record what the Hunt Engine found across customer environments. Model measurements record how the Hunt detection models perform against a defined test set. This page explains what each number means, how it is counted, and what it does not include.

Claims and methodology

The Numbers

What each number represents

Each entry covers: what counts, what does not count, and what the number does not claim.

48,000+

Ransomware threats detected

What counts
Distinct ransomware artifacts detected by the Hunt Engine across all customer environments, calendar year 2025. A detection is logged when any model in the ensemble exceeds the confidence threshold.
What does not count
The same artifact found across multiple snapshots of the same source asset. Deduplication key: source asset + artifact hash. One payload across 30 snapshots counts as one detection.
Context
Each threat was detected and its recovery point flagged before anyone could restore it into a production environment.
4,000+

Malware artifacts intercepted

What counts
Distinct non-ransomware malware artifacts found inside backup data, cloud storage, and replicated volumes. Includes trojans, backdoors, rootkits, and cryptominers. Reported separately because detection outcomes differ from ransomware.
What does not count
Ransomware artifacts, which are counted above. Duplicates across snapshots of the same source asset.
Context
These artifacts were undetected by endpoint protection and backup vendor detection. They had survived replication cycles and backup rotations. Without detection at the data layer, they would have been restored into a production environment during recovery.
Zero

Ransoms paid

What counts
Direct operational record from customer engagements and IR support. In every ransomware event where Elastio was running, the Hunt Engine had already identified the last known clean recovery point before detonation.
What does not count
A claim that Elastio customers were never targeted. Several were. This records recovery outcome only.
Context
Elastio provides IR support as part of every subscription. Records are maintained for every incident where Elastio data was used in a recovery decision. This number will be updated immediately if it ceases to be true.
The Models

How the Hunt detection models perform

Each entry covers what is measured, the test set, and what the number does not claim.

99.4%

Zero-day ransomware detection efficacy

What is measured
The share of zero-day ransomware samples the zero-day model detects. A zero-day sample is ransomware from a family or variant the model was not trained on.
What it does not claim
It does not claim detection of every new ransomware family. It describes the zero-day model in Elastio Hunt only.
99.9995%

Ransomware detection precision

What it does not claim
It does not describe Elastio Pursuit. No accuracy or precision figure is published for Pursuit.
Fewer than 5

False positives per 10 million files

What is measured
The number of benign files the Hunt detection models flag as ransomware, per 10 million benign files inspected.

Training set

The Hunt detection models are trained on 2,300+ ransomware families and 10,000+ variants. Elastio adds 25 to 40 new samples each week.

Limitations

What these numbers do not claim

Security vendor numbers should be interrogated. Here is where ours stop.

  1. We do not claim 100% detection

    No detection system does. Models are updated continuously as new ransomware families emerge. The ensemble is not static.

  2. We do not claim to prevent ransomware from entering environments

    The Hunt Engine operates on data at rest. Prevention belongs to EDR, firewalls, and identity controls. Elastio’s role begins when those controls fail.

  3. We do not inflate with duplicate detections

    Industry vendors often count the same threat found across multiple locations or time periods as separate incidents. Elastio deduplicates by source asset and artifact hash. These numbers are conservative.

  4. Methodology changes will be disclosed

    Numbers are updated annually. If the methodology changes, Elastio will disclose the change and restate prior numbers under the new methodology.

  5. Model measurements are not production counts

    Model measurements come from a defined test set. Production counts come from customer environments. The two are reported separately and are never combined.

Elastio

See the full 2025 Threat Report

Threat actor profiles, attack trends, and a quarterly incident timeline. Reach us at galigiannis@elastio.com.

2025 Threat Report

All Research