How We Measure. What We Claim.

Distinct ransomware artifacts detected by the Hunt Engine across all customer environments, calendar year 2025. A detection is logged when any model in the ensemble exceeds the confidence threshold.

The same artifact found across multiple snapshots of the same source asset. Deduplication key: source asset + artifact hash. One payload across 30 snapshots counts as one detection.

'Stopped' means detected before recovery was attempted from that data. The threat was identified and the recovery point flagged before it could be restored into a production environment.

Distinct non-ransomware malware artifacts found inside backup data, cloud storage, and replicated volumes. Includes trojans, backdoors, rootkits, and cryptominers. Reported separately because detection outcomes differ from ransomware.

Ransomware artifacts, which are counted above. Duplicates across snapshots of the same source asset.

These artifacts were undetected by endpoint protection and backup vendor scanning. They had survived replication cycles and backup rotations. Without detection at the data layer, they would have been restored into a production environment during recovery.

Direct operational record from customer engagements and IR support. In every ransomware event where Elastio was running, the Hunt Engine had already identified the last known clean recovery point before detonation.

A claim that Elastio customers were never targeted. Several were. This records recovery outcome only.

Elastio provides IR support as part of every subscription. Records are maintained for every incident where Elastio data was used in a recovery decision. This number will be updated immediately if it ceases to be true.