Druva expands identity resilience with ransomware detection

Druva has announced new capabilities for Druva Identity Resilience alongside the launch of Ransomware Detection, a new feature fueled by a proprietary AI threat pipeline. Powered by Dru MetaGraph, the new offerings use behavioral intelligence and built-in validation to turn suspicious behavior into actionable evidence, definitively confirm impact, and accelerate precise containment and clean recovery.

AI is making it harder for security teams to distinguish real compromise from normal behaviors and activity. Attackers are using AI to test more paths, shift tactics faster, and hide malicious behavior inside legitimate activity, while stolen credentials and constantly evolving ransomware make traditional signals less conclusive.

Druva gives customers evidence-based cyber recovery by unlocking behavioral intelligence from backup data. The new identity resilience capabilities use Dru MetaGraph to analyze suspicious identity behavior and visualize the blast radius, while the proprietary AI threat pipeline powering Ransomware Detection analyzes backup data to validate ransomware behavior. They move teams from signals to evidence, accelerating investigation, confirming impact, and guiding precise containment and recovery back to clean, trustworthy states.

“Security teams know they can’t stop every attack. The challenge is knowing exactly what happens when a threat breaks through,” said Yogesh Badwe, Chief Security Officer at Druva. “AI makes that uncertainty more dangerous. Before you recover, you need evidence of what changed, how far the compromise spread, and what can still be trusted. Druva has years of backup telemetry we use to validate threat signals and turn them into evidence, giving customers a trusted basis for recovery instead of an assumption.”

Identity Resilience reconstructs attack paths for faster, trusted recovery

Building on the unified identity protection introduced earlier this year, new Druva Identity Resilience capabilities bring Dru MetaGraph’s connected intelligence directly to customers. This capability provides an interactive view of human and non-human identities (NHIs) activities and relationships across Microsoft Entra ID, Active Directory, and Okta.

Dru MetaGraph contextualizes change across identities, permissions, applications, policies, and time to show how suspicious activity propagated through an environment and cut investigation time from days to hours. With these new capabilities, customers can:

• Understand attacker behavior and blast radius: See where an attacker gained access, escalated privileges, established persistence, or moved laterally through the environment, with mapping to the relevant MITRE ATT&CK TTPs.
• Establish a trusted pre-attack state: Use historical changes and snapshots to identify the environment before compromise and determine what needs to be restored.
• Turn behavioral evidence into precise containment and recovery: Generate a tailored, pre-validated recovery plan that identifies each impacted object, recommends the action to take, and pinpoints the clean snapshot to restore.

“Finding suspicious activity is only the beginning. Security teams still have to determine the legitimacy of the threat and how it may impact the business, as well as knowing what can be safely recovered,” said Jennifer Glenn, Research Director for Information and Data Security at IDC. “AI is driving greater attack volume and complexity, making it difficult to answer those questions quickly and confidently. Evidence-based cyber recovery gives organizations a clearer path to get from threat signals to trusted recovery.”

Druva Ransomware Detection confirms ransomware impact for evidence-based recovery

The announcement also marks the launch of Ransomware Detection, powered by a proprietary AI threat pipeline that detects known and unknown ransomware behavior, confirms impact through built-in validation, and pinpoints clean recovery points.

Traditional anomaly detection can flag unusual file activity but leaves teams sorting through noise to determine what is truly malicious. Ransomware Detection replaces that guesswork with multi-stage behavioral analysis and forensic validation that filters out false signals and delivers confirmed evidence teams can act on. With these new capabilities, customers can:

• Identify ransomware behavior across snapshots: Evaluate data against high-risk patterns such as ransom notes, suspicious & known extensions, mass file renaming, and other indicators across backup snapshots using purpose-built AI and machine learning models.
• Validate high-risk findings: Confirm the presence of ransomware and reduce false positives by applying in-platform forensics, such as structural verification, entropy, Multipurpose Internet Mail Extensions (MIME) type analysis, file integrity, and data analysis.
• Turn evidence into recovery action: Surface explainable findings in Recovery Insights, distinguish impacted data from clean snapshots, and validate recovery points before restore.