Measure the finding. Understand the scope.
Research results, production detections, model tests, and recovery outcomes answer different questions. Keep the population, time window, and definition attached to each claim.
Research / Measurement
Artifacts are not incidents.
Elastio’s published 2025 figures record 48,000+ distinct ransomware artifacts and 4,000+ non-ransomware malware artifacts. The stated deduplication key is source asset plus artifact hash, so the same artifact across snapshots of one asset is counted once.
These are artifact counts. They do not establish how many attacks were prevented, how many customers were breached, or which files would otherwise have been restored.
Read performance in the context of the test.
Detection efficacy
The share of malicious samples detected in the defined test set. An unseen-family test needs a stated training/test separation and held-out sample count.
Precision
True positives divided by all positive findings: TP / (TP + FP). This requires both true-positive and false-positive counts.
False-positive rate
False positives divided by all benign samples: FP / (FP + TN). This is a different measure from precision.
Request the Hunt benchmark protocol with the model version, sample counts, exclusions, and test period. Hunt performance figures do not measure Pursuit investigation accuracy.
42 of 500 examined images.
The 2026 public-machine-image study identified malicious persistence in 42 of the 500 images analyzed. The result describes that research set; it is not a claim about every marketplace or about customer incidents.
Evaluate the engagement, not a universal promise.
A recovery outcome depends on the available copies, analysis scope, response actions, and application validation. Review a documented engagement to understand what was found, which decision followed, and what the customer recovered.
No analysis guarantees detection of every threat or the availability of a suitable recovery copy. Pursuit can investigate images before deployment and copies during operation; Hunt analyzes data and recovery candidates alongside existing controls.