Cyber vaults
A cyber vault holds the isolated, immutable copy you restore the business from. It keeps whatever it receives, including the persistence an attacker planted and files ransomware already encrypted. Elastio proves each copy clean before the vault locks it, and flags the ones that are not.
Your vault keeps the copy. Elastio proves what is inside it.Isolation and immutability come from your vault platform. Integrity, proof that a copy was clean when it went in, has to be established before the lock. Once a copy is locked, whatever it carries stays for the full retention period.
The vault sits in its own account or tenancy, behind its own identity boundary. Credentials stolen from production do not reach it.
A retention lock keeps each copy from being altered or deleted until its retention period ends. It protects the copy exactly as it was written.
Each copy is proven free of the attack before it is locked. This is the property Elastio provides: Pursuit analyzes the system copy for an active attack, and Hunt hunts the data for ransomware.
Isolation and immutability decide whether the copy survives an attack. Integrity decides whether restoring it ends the attack or starts it again.
Attackers get in and move undetected before they strike, and your backup plan keeps copying through that window. Every copy made in it enters the vault with the attack inside, and a restore from any of them brings the attack back with the data.
A system copy made after the intrusion carries the persistence the attacker planted: a scheduled task, a service, a WMI subscription, a Run key. Restore it and the attacker returns with the host. Pursuit analyzes the system copy off-host and names the persistence, with the evidence behind it.
Ransomware can encrypt slowly, or a few blocks per file, so each new copy looks like ordinary change. Hunt opens the files with Deep File Inspection, finds ransomware with or without a signature, and names the last recovery point proven clean.
The UK financial sector’s guidance for cloud-hosted vaults sets immutability and network isolation as foundation principles, and places the integrity check ahead of the lock.
“Integrity checks must be done prior to securing the data, doing it post will not ensure recovery of the original data or the service that the data supported.”
A financial services firm moved immutable, encrypted backups into a bunker account, but could not prove the copies were clean before they went in. With Hunt, every backup is hunted before it is copied to the bunker account, and the CIO reports vault integrity with evidence.
Read the case study →Elastio sits upstream of the vault. Your backup platform keeps creating and retaining copies as it does today, and each recovery point is proven clean before it is copied in.
Each recovery point
Your backup plan writes the recovery point to its default vault.
Hunt hunts it for ransomware encryption, corruption, and malware.
A clean recovery point is copied to the cyber vault and joins the set you restore from.
A flagged recovery point goes to a separate quarantine vault, outside the restore and replication path, where your IR team can work it.
Every decision reaches your SIEM with its finding and evidence.
The automated quarantine workflow runs on AWS Backup and AWS Logically Air-Gapped Vaults.
AWS Backup vaults and Logically Air-Gapped Vaults.
Azure Backup and Recovery Services Vaults.
Veeam, Commvault, Rubrik, and Cohesity.
Elastio is not a vault and does not replace yours. It hunts the recovery points your existing tools create and store, with no change to your retention or recovery tooling.
When a new indicator emerges, Hunt re-hunts every copy you already vaulted and tells you whether any of them carry it.
Pursuit finds the attack in the system copy. Hunt proves the data in it is clean. Together they give the vault the one property it cannot provide for itself.
30 minutes. Your environment, no slides.
Request a demo