Elastio

An off-the-record conversation about securing AI — and recovering when it is the way in.

We’re at the 5th Annual Operational & Organisational Resilience Financial Services Conference today. If you’re here, come say hello. And after the conference, join us and Airwalk Reply for drinks and a conversation about operational resilience, recovery readiness, and proving your backup data is clean before you need it. Register for the happy hour: https://lnkd.in/eNG-NWrf

A billing company on AWS ran successful backups for 11 days. Every one contained encrypted data. The attacker had bypassed EDR and stayed undetected for 30+ days. When the decryption key was removed, the company lost 10 days of data and was offline for six days. Christopher Sauer and Dean Lawrence break down how Amazon Web Services (AWS) Security Incident Response and Elastio found the last clean recovery point. Watch on demand: https://lnkd.in/g5mGuEA9 #Cybersecurity #Ransomware #EDR

Your DR test passed. The report is green. The RTO was met. Here's what that report doesn't prove: that the recovery point you'd actually reach for during a ransomware attack is clean today. An annual DR test validates one restore path on one date you picked in advance. Ransomware doesn't wait for the test window. Attackers often sit inside an environment for weeks before detonating, which means every backup written during that dwell time already contains the compromise. A passing test that quarter tells you nothing about it. We break down the three assumptions every annual test bakes in, why NIST and DORA point toward ongoing validation instead of a once a year checkbox, and what continuous inspection of recovery points changes about finding a clean starting point during a real incident. Full breakdown, including the three assumptions and the dwell time scenario a passing test hides: https://lnkd.in/e2K3JuGt #CyberRecovery #Ransomware #DisasterRecovery #CyberResilience #BackupAndRecovery

Venture Guides portfolio companies are heading to Black Hat this weekend. Swing by to see what they're building! SpartanX.ai Ray Security Memcyco Assail Elastio

Way to go Team!

Elastio has been named a Representative Vendor in the Gartner Hype Cycle for Backup and Data Protection Technologies, 2026, appearing in two profiles: Recovery Posture Assessment and Cyberattack Detection in Backup, authored by Gartner analysts Mike Hoeck and Jason Donham. See where your recovery stands: https://lnkd.in/gpkTJqxx #CyberRecovery #Ransomware #DataResilience #BackupAndRecovery

Elastio's CEO Najaf Husain and Chief of Cyber Intelligence Srinidhi Varadarajan will be hosting private briefings in our suite at Black Hat USA 2026 (Aug 5–6, Las Vegas). Limited slots. Reserve yours: https://lnkd.in/eaEuDpwU The topic: a new agentic detection capability, currently in front of design partners, built to catch attacks in the window where endpoint tools go blind.

Your backup dashboard says the job succeeded. Your storage is immutable. Neither one tells you whether the data inside that recovery point was clean when it was written. That gap is why boards keep asking the same question: not "do we have backups?" but "how do you know we can actually recover?" A recovery attestation answers it. It is dated, asset-level proof that a specific recovery point passed content-integrity inspection and was confirmed restorable in isolation. A green job status is a fact about the copy. An attestation is a verdict on the data. The post breaks down the six fields a defensible attestation needs, and how it maps to NIST 800-184, DORA, NYDFS 500.17, SEC Item 106, and HIPAA. Full framework, plus the four numbers that turn it into a board pack, in the article: https://lnkd.in/eRbRsaHv #CyberRecovery #Ransomware #CyberResilience #CISO #DataProtection

Ransomware crews aren't just encrypting data anymore. They're switching off the tools meant to catch them first. The Gentlemen gang's GentleKiller framework now ships in 8 or more variants, targets 48 security products, and terminates 400 or more processes. It runs at the kernel level using a bring-your-own-vulnerable-driver technique to blind EDR before encryption ever begins. A quiet security console can mean the environment is clean, or it can mean the sensor was silenced before it could report. Any backup taken in that window captures a compromised system that still looks clean, because no alert was ever raised. That is why backups need their own detection. Elastio inspects every recovery point independently, off the production host and outside the compromised trust path, so ransomware, malware, and encryption surface in your backups even when the EDR that should have caught them is already disabled. The full post breaks down how GentleKiller blinds EDR and what independent recovery-point inspection checks for: https://lnkd.in/eSG9CfKT #Ransomware #CyberRecovery #DataResilience #Cybersecurity #BackupAndRecovery