Coder Legion - Recent posts tagged ransomware

South Africa Accounts for 92% of Africa’s Ransomware Detections. Here’s What IT Teams Should Learn From It

Tue, 22 Sep 2026 18:29:39 +0000

South Africa has become a major focal point in Africa’s ransomware landscape.

According to INTERPOL’s African Cyberthreat Assessment Report 2026, South Africa accounted for 92% of ransomware detections recorded across Africa in 2025, based on TrendAI telemetry. That figure is striking, but it needs context: it represents detections, not proof that 92% of all ransomware attacks on the continent occurred in South Africa.

Even with that distinction, the signal is impossible to ignore.

South African organizations are operating in an environment where highly connected businesses, government institutions and critical services are attractive targets. And the most useful lessons are not found in the percentage itself. They are found in the incidents behind it.

Recent attacks against organizations such as the National Health Laboratory Service (NHLS) and the South African Weather Service (SAWS) demonstrate that ransomware is no longer simply an endpoint-security problem.

It is a business continuity problem.

The 92% Statistic Is a Warning, Not the Whole Story

A common reaction to a statistic like this is to ask why South Africa is being targeted more heavily than other African countries.

There is a more useful question for IT leaders:

Why do some attacks become business crises while others remain contained security incidents?

South Africa's highly connected digital economy means attackers have access to valuable systems and data, while organizations often depend heavily on technology to deliver essential services.

INTERPOL's latest assessment also highlights a wider cyber-threat environment involving phishing, business email compromise, vulnerabilities and increasingly automated attacks. South Africa accounted for 70% of Africa's business email compromise detections in 2025, according to the same TrendAI telemetry.

The lesson is that ransomware rarely exists in isolation.

It often begins with the things security teams already worry about: a stolen credential, a phishing message, an exposed vulnerability or excessive privileges.

The Incidents Behind the Headline

The NHLS ransomware attack in June 2024 is one of the clearest examples of how a cyber incident can quickly become an operational emergency.

The attack encrypted systems used by the National Health Laboratory Service, affecting internet and intranet services, the laboratory information system and access to historical laboratory data. Because NHLS provides diagnostic pathology services to more than 80% of South Africa's population, the disruption extended far beyond an internal IT environment.

The important lesson is not simply that healthcare was attacked.

It is that critical services continued to depend on systems that were suddenly unavailable.

The South African Weather Service experienced a similar reality after a January 2025 cyberattack that affected most of its systems. Its annual report records that data recovery continued while the organization used alternative mechanisms to distribute severe-weather warnings and information.

That is what ransomware resilience ultimately looks like.

Not preventing every incident.

Continuing to operate when prevention fails.

The Attack Path Is More Important Than the Ransom Note

Ransomware tends to receive attention when files are encrypted and a ransom demand appears.

Defenders should be looking much earlier.

A simplified attack path looks like this:

Initial Access → Identity Compromise → Lateral Movement → Privilege Escalation → Data Access → Encryption/Disruption

The important part is the middle.

An attacker who reaches the encryption stage has often already succeeded at several earlier stages.

That means an organization's security programme cannot depend entirely on detecting ransomware at the endpoint. It needs visibility into the behaviors that often precede it.

Unusual sign-ins. Suspicious privilege changes. Unexpected remote administration. Abnormal PowerShell activity. Attempts to disable security tools. Large-scale access to files. Unusual movement between systems.

These signals can provide defenders with something incredibly valuable: time.

And in ransomware response, time is often the difference between isolating one compromised machine and recovering an entire environment.

Identity Has Become a Critical Security Boundary

For organizations using Microsoft 365, Entra ID, Intune and Defender, identity deserves particular attention.

A compromised account can provide an attacker with a much easier path into an environment than attacking every endpoint individually.

That makes strong authentication, Conditional Access, privileged-access management and identity monitoring essential parts of ransomware defense.

Multi-factor authentication is important, but it should not be treated as the finish line.

IT teams should also ask whether privileged accounts are separated from normal user accounts, whether dormant accounts are removed, whether service identities are properly governed, and whether suspicious authentication behavior is being investigated quickly.

The objective is simple:

A compromised account should not automatically become enterprise-wide access.

Backups Are Not the Same as Recovery

Ransomware conversations often end with the phrase:

“We have backups.”

That is not enough.

The better question is:

Can we still recover if the attacker compromises an administrator account and discovers our backup infrastructure?

This is why immutable, isolated and offline recovery mechanisms matter.

The South African Weather Service's post-incident procurement requirements provide a useful example. Its specifications called for capabilities including immutable and air-gapped backups, anomaly detection, malware scanning and Zero Trust controls.

The broader lesson is that backup security must be designed around an attacker who is already inside the environment.

And backups must be tested.

A backup that has never been restored successfully is an assumption, not a recovery strategy.

The Biggest Gap May Be Business Continuity

The NHLS incident exposed another important problem: traditional downtime procedures are not necessarily designed for a cyberattack.

A ransomware event can simultaneously affect applications, authentication, network access, files and internal communications.

That makes cyber resilience fundamentally different from planning for a normal infrastructure outage.

IT teams should be able to answer:

What happens when our primary identity service is compromised?

What happens when our file servers cannot be trusted?

What happens when users cannot access normal collaboration tools?

Which business services must be restored first?

These are not purely technical questions.

They require IT, security, operations and business leaders to agree on priorities before the incident occurs.

From Reaction to Resilience

The biggest mistake South African organizations could make is treating the 92% figure as another alarming cybersecurity headline.

The better response is to use it as a design challenge.

Assume that a credential will eventually be compromised.

Assume that an endpoint will eventually be breached.

Assume that an attacker will eventually bypass one of your controls.

Then ask what happens next.

Can the attacker move laterally?

Can they obtain privilege?

Can they reach the backup environment?

Can they disable security controls?

Can you detect them before encryption begins?

Can you isolate affected systems quickly?

Can the business continue operating?

Can you restore the most critical services in the correct order?

Those questions reveal far more about an organization's ransomware resilience than the number of security products it owns.

What South African IT Teams Should Do Now

The practical response does not need to begin with buying another security platform.

Start by understanding where one compromised identity or device could cause disproportionate damage.

Prioritize privileged identities. Strengthen authentication. Reduce unnecessary administrative access. Patch externally exposed systems quickly. Segment critical services. Protect backup infrastructure from ordinary administrative paths. Centralize security telemetry. Define clear isolation procedures. Test recovery.

Most importantly, run an exercise that assumes the attackers have already bypassed the first layer of defense.

The objective should not be to prove that the security controls work.

It should be to discover what happens when they do not.

The Real Meaning of 92%

South Africa accounting for 92% of Africa's ransomware detections is a statistic worth paying attention to.

But the percentage is not the most important part of the story.

The more important story is what recent incidents have demonstrated: when ransomware succeeds, the consequences can move rapidly from compromised credentials and encrypted systems to disrupted public services, delayed operations and difficult recovery decisions.

That changes the question IT leaders should be asking.

Not:

“How do we stop ransomware?”

But:

“How do we make ransomware less capable of stopping us?”

That is the difference between cybersecurity and cyber resilience.

And for South African IT teams, it may be the most important lesson behind the 92%.

Sophos Traces a Ransomware Operation Back to 12 AI Agents Running Inside a Coding Assistant

Wed, 22 Jul 2026 18:55:09 +0000

In May, Sophos found something inside a customer's network that looked less like an intrusion and more like a software team at work. A threat actor, tracked internally as STAC6994, had provisioned four virtual machines and was running roughly a dozen AI agents, coordinated through the Cursor IDE and a commercial coding assistant, to write and test malware against three different endpoint products at once: Sophos, CrowdStrike, and Microsoft Defender.

One agent, running Claude Opus 4.5, handled core operations and rule-setting. Others managed OPSEC hardening, documentation, proxy stress testing, and VM deployment. Code commits flowed to Git through Model Context Protocol. The agents read technique write-ups scraped from the SpecterOps blog, mapped them to MITRE ATT&CK, built a lab to reproduce each one, and logged the results. Over the course of the operation, they produced close to 80 modules and tested more than 70 evasion techniques. Sophos's Counter Threat Unit later confirmed the same operator went on to deploy ransomware and steal data using the tooling built in that environment.

Sophos published the case as the anchor story in its first AI Security report, and the headline finding isn't that AI invented some new form of attack. It's that the same tradecraft moved at a different speed. The report is explicit about this: what used to take a human developer weeks of manual iteration took the agents a few days. Nothing about the malware itself was novel. The clock was the story.

That distinction matters for how you think about defense. The report separates AI threats into two categories: malicious use of AI, where attackers use AI tools the way STAC6994 did, and malicious targeting of AI, where the AI systems and infrastructure themselves become the target. The second category is where Sophos says the more immediate, provable damage is happening right now, and it's squarely a developer problem.

A campaign Sophos calls SANDWORM_MODE planted at least 19 typosquatted npm packages designed to mimic legitimate developer utilities and AI coding tools. Once installed, the packages dropped a rogue MCP server and used prompt injection to get legitimate AI assistants to quietly retrieve SSH keys and cloud credentials on their own. Separately, a compromised Nx Console VS Code extension pulled credentials out of HashiCorp Vault, npm, AWS, GitHub, 1Password, and Anthropic API keys, as part of a broader campaign researchers have linked to TeamPCP. And in March, source code from Claude Code, roughly 1,900 files and 500,000 lines, ended up published inside an npm package by mistake. Anthropic said no customer data was exposed, but the leak still gives attackers a map to work from.

None of that requires a sophisticated attacker. It requires a developer trusting a tool the way developers are supposed to trust their tools, and an attacker who understood that IDE extensions and coding assistants now sit close enough to credentials and repositories to be worth compromising directly.

The identity layer around those tools is where Sophos sees the exposure concentrating. IBM X-Force found more than 300,000 ChatGPT credentials for sale on the dark web during 2025. The Salesloft/Drift breach showed the mechanism clearly: OAuth tokens issued to a chatbot were enough to compromise multiple Salesforce environments. Sophos points to a similar pattern at Vercel in April, where an employee granted broad OAuth permissions to a third-party AI tool from their corporate account; when that tool was compromised through an infostealer infection, the attacker inherited the tokens and used them to reach Vercel's internal environment.

The governance numbers behind all of this are the ones worth sitting with if you're the one setting policy for a team. Citing Saviynt and Cybersecurity Insiders research, the report says 71% of large enterprises have deployed AI agents with access to core business systems, and only 16% actually govern that access. Only 1% of enterprises have a dedicated AI security budget, per Pentera. Three-quarters of CISOs have already found shadow AI tools running inside their organizations, and 95% of them doubt they'd catch misuse if it happened.

Sophos's recommendations read like a checklist for anyone building agentic systems rather than just buying security products: sandbox the agent process, isolate credentials so the agent never sees secrets directly, put a broker between the agent and any tool it calls, restrict and monitor egress traffic, extend EDR coverage to agent hosts and ephemeral VMs, require human approval for irreversible actions, and treat memory writes and cross-agent handoffs as security events worth logging. Sophos tested one of these principles directly against OpenClaw, running its own red team against it and finding 23 actionable issues. Its take: the tool was powerful enough to be worth using, but only after the security framework around it was built first, which took longer than the test itself.

The report ties back to Sophos's own State of Ransomware 2026 data, which found identity had become the top initial access vector for ransomware for the first time in three years. The AI Security report's argument is that this isn't a coincidence. The tools generating the most productivity gains right now, coding assistants, agents, OAuth-connected AI services, are also the newest and least governed part of the identity fabric. STAC6994 is one confirmed case. Sophos is fairly direct that it's unlikely to be the only one; AI assistance mostly doesn't show up in telemetry, and this one only got caught because the framework was left running on a device Sophos could examine.

Developer Weekly Briefing — July 18, 2026

Fri, 17 Jul 2026 13:31:40 +0000

A focused week — two deep enterprise stories and a security piece with numbers worth paying attention to. Here's what mattered.

GitHub's new PR inbox is a direct response to the review bottleneck AI created

Teams using AI coding tools are merging 98% more pull requests. PR review time is up 91%. Average PR size has grown 154%. End-to-end cycle time is actually about 19% slower once review queues are factored in. AI made writing code faster. It made reviewing code harder.

GitHub's redesigned pull requests dashboard is now generally available, and it's clearly built with that math in mind. The centerpiece is Inbox — a single, actionable view at github.com/pulls that surfaces what actually needs your attention: review requests, PRs blocked by CI failures or new comments, and PRs ready to merge. Saved views let you create and organize custom filters without relying on browser bookmarks. AND/OR logic and nested queries now work in advanced search, so you can pull results across multiple organizations in one shot.

One detail worth noting: the author filter now recognizes agent-created pull requests — searching author:@me surfaces PRs that GitHub Copilot opened on your behalf. Small change, big signal about where things are heading.

A better inbox won't shorten the queue. But making it visible — and sortable by urgency instead of buried in a flat list — is a reasonable place to start.

IBM Bob adds multi-agent coordination, spend tracking, and legacy modernization workflows

IBM's agentic coding platform got a significant update this week. Bob now supports multi-agent, parallel tool calling — instead of a single model working step by step, agents can request multiple tools in the same turn and run them concurrently. Subagents handle exploratory work in isolated context windows, which keeps routine investigation from quietly inflating the bill. Speaking of which: Bobalytics is a new usage-and-spend dashboard built directly into Bob, giving engineering leaders visibility into consumption, model allocation, and where the budget is actually going.

The other half of the announcement targets legacy modernization — three Premium Packages for IBM Z (COBOL, PL/I, assembler, JCL, CICS, IMS, Db2), IBM i (RPG, CL, SQL, DDS), and large Java codebases. These are structured, repeatable workflows rather than open-ended prompting, aimed at the systems most AI coding tools were never built to touch.

Mitch Ashley, VP and Practice Lead for Software Lifecycle Engineering and AI-Native Software Engineering at The Futurum Group, put it clearly: "Multi-agent coordination paired with a spend dashboard signals platforms competing to own the control plane where model routing, cost, and accountability decisions are made. The operative metric for engineering leaders is now cost per completed, verified task — and platforms must generate the evidence to measure it."

If you're responsible for legacy modernization or evaluating enterprise coding platforms, this one is worth a full read.

Sophos: 79% of ransomware attacks now start with compromised identities

For the first time in four years, exploited software vulnerabilities aren't even the top ransomware entry point anymore. Sophos's 2026 State of Ransomware report puts identity compromise at 79% of attacks. MFA was in place for 97% of the incidents where stolen credentials were the root cause — which says a lot about how far MFA alone carries an organization at this point. Encryption success rebounded to 56% of attacks, reversing a two-year decline. Average recovery cost per incident: $1.7 million.

Sophos launched Fusion alongside the report — a unified defense architecture built on one shared data layer, so a detection at any control point triggers coordinated response across all others in real time. Across more than 40,000 MDR customers, the company says 52% of cases are now resolved entirely by AI, with an average 89 seconds between alert and automated response. That's the same window an attacker needs to move from a stolen session token to lateral movement. The defense system has to move on the same clock.

The through-line this week: the bottleneck in AI-assisted engineering has shifted downstream — to review, to governance, and to the identity layer that attackers are now targeting first.

See you next Friday.

Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.

Sophos Fusion Automates 52% of Ransomware Response as Identity Attacks Hit 79%

Wed, 15 Jul 2026 13:00:00 +0000

Sophos is launching a new security architecture built around a problem its own data just confirmed: identity, not software vulnerabilities, is now the primary way ransomware gets in.

The company's 2026 State of Ransomware report, released today alongside the launch of Sophos Fusion, found that 79% of ransomware attacks now start with compromised identities. Two-thirds of victims said the ransomware incident was also their most serious identity attack of the year. Multi-factor authentication was in place for 97% of the incidents where stolen credentials were the root cause, which says a lot about how far MFA alone can carry an organization at this point. For the first time in four years, exploited software vulnerabilities aren't even the top root cause anymore. Malicious email (26%) and phishing (24%) have taken over that spot. Encryption success also rebounded to 56% of attacks, reversing a two-year decline, and the average recovery cost per incident has climbed to $1.7 million.

Sophos Fusion is the company's answer to that shift. It's built on Sophos Central, which already protects 625,000 organizations, and now incorporates Secureworks Taegis analytics following Sophos's 2025 acquisition of Secureworks. The pitch is straightforward: instead of stitching products together after the fact, Fusion runs on one shared data layer, so a detection at any control point, whether that's endpoint, firewall, identity, email, or cloud, triggers a coordinated response across all the others in real time.

CEO Joe Levy frames it as a shift from platform thinking to system thinking. "Sophos Fusion is built as a defense system optimized for Human-AI workflows," Levy said. "We bring the most complete solution to a new category, a timely advancement demanded by the AI era."

The architecture rests on four ideas. One shared context lake, where every signal from every control point lands in the same place in real time. Synchronized response, where a detection at one layer triggers action at the others simultaneously rather than in sequence. Agentic autonomy inside boundaries that human analysts set and adjust. And compounding intelligence, where a threat caught at one customer strengthens the defense at every other customer almost immediately.

Sophos already runs this model internally, and the numbers are the part worth sitting with if you build or evaluate security tooling. Across more than 40,000 managed detection and response customers, the company says 52% of cases are resolved entirely by AI, with an average of 89 seconds between alert and automated response. That figure matters because 89 seconds is roughly the window an attacker needs to go from a stolen session token to lateral movement across a network. A defense system has to move on the same clock, or the response arrives after the damage is already done.

There's a distinction in how Sophos describes the human role here, and it's relevant to anyone architecting agentic systems of their own. Levy called the setup "human-on-the-loop" rather than "human-in-the-loop." Agents act on their own for high-volume, well-understood tasks: isolating an endpoint, revoking a session, blocking a malicious IP. A person stays accountable for the calls that require judgment, like confirming whether a suspicious inbox rule change is an accident or the setup for wire fraud. Put a human in the loop for every single action, and the system loses the speed advantage that justified building it agentic in the first place.

Fusion keeps expanding through the rest of the year. Sophos Next-Gen SIEM and a rebuilt Sophos XDR, powered by Secureworks Taegis analytics with added detectors and built-in SOAR automation, both reach general availability August 15. Sophos AI Defense, which gives visibility into AI tools already running inside a company, shadow AI included, gets early access in August and general availability in October. Sophos CISO Advantage, aimed at organizations without a dedicated security leader, starts rolling out in October.

That last piece connects to a stat Levy raised at Sophos's press briefing earlier this month: there are roughly 359 million organizations worldwide and fewer than 35,000 full-time CISOs to lead them, or about one for every 10,000 organizations. Fusion's underlying bet is that agentic AI can close part of that gap by putting CISO-level judgment into a system that runs continuously, instead of depending on headcount that mostly doesn't exist.

More than 500 third-party integrations feed into the same data layer, so existing tools from other vendors aren't replaced, they're folded in. For security teams already running a stack of 45-plus disconnected tools, a figure Sophos and Gartner both cite, that's arguably the more useful claim than "AI-native" on its own. The value isn't the AI by itself. It's what happens once everything already in place starts sharing context in real time.

Whether "cybersecurity defense system" becomes a real category, Gartner is reportedly building a new Magic Quadrant for it, expected in November, or just turns out to be Sophos's name for consolidation done well, is worth watching over the next couple of quarters. The ransomware numbers aren't really in dispute, though. Identity is the front door now, and a lot of the tooling built for perimeter and vulnerability defense wasn't built for that.

When the Attacker Has Admin Privileges: Everpure's Case for Making Storage the Last Line of Defense

Tue, 19 May 2026 13:23:35 +0000

A Fortune 100 organization got hit hard. Attackers used stolen credentials and native tools — no malware. They deleted thousands of endpoints and virtual clusters. Traditional defenses never fired.

But the data layer? Untouched.

That's the story Brandon Willitts, Director of Cyber Resilience at Everpure, keeps coming back to. Not because it's a good marketing story — though it is — but because it illustrates a shift in how security and engineering teams need to think about recovery.

"We don't ship storage," Willitts told me. "We ship trust."

How That Fortune 100 Organization Actually Recovered

Willitts didn't want to speculate on how the attackers pulled it off. But he was direct about how recovery happened — and it's worth paying attention to the specifics.

"We trained a customer engineer in 20 minutes to recover snapshots," he said. Not days. Not a war room of 15 people with a 200-page runbook. Twenty minutes.

That's possible because of how SafeMode snapshots work. The configuration is out-of-band — no single admin, machine, or human being can reach in and misconfigure or delete that access and control point. The snapshots are immutable and indelible. When the attack hit, the attacker had global admin privileges everywhere else. They had nothing at the storage layer.

"Your identity system is going to be compromised. Your endpoints are going to be compromised. Your network is going to be compromised," Willitts said. "But what happens when it gets to the storage and there's an entire deletion of that data? How do you recover?"

If you have SafeMode configured, you already know the answer.

The Gap Between "DevOps Backup" and Actual Recovery

Most developers think about backup as a checkbox. Snapshots. S3 buckets. Maybe an off-site copy. Willitts isn't dismissive of that — he just says it misses the point.

"You take backups for a lot of different reasons," he said. "But there's been a disconnect between where IT operations sits in an organization versus the business outcomes they're trying to support."

He gave a concrete example: a hospital where nurses can't see patients because the system is down. Recovery isn't about retrieving data. It's about opening the doors tomorrow — processing loans, seeing patients, running payroll.

"We aren't just recovering from a backup. We're making sure you can recover your business."

That reframe matters for developers and platform engineers. Backup is not a one-size-fits-all problem. The question isn't whether you have a copy of your data. It's whether you can get to the right copy, fast, and know it hasn't been tampered with.

The Human-in-the-Loop Isn't a Bottleneck

One detail in Everpure's architecture that caught my attention: the Human-in-the-Loop (HITL) requirement. For a developer audience that's used to automation handling everything, mandatory human authorization sounds like a recovery killer.

Willitts pushed back on that reading. The HITL requirement applies to deletion, not recovery. You don't need multi-party authorization to restore your data. You need it to delete it.

"We're providing a security layer for the event that your credentials are compromised," he said. "If you want to delete your data, you need multiple parties present. You don't need multiple parties present to recover your data."

SafeMode is auto-on by default. The snapshot capability is always there. The human layer is protection against a compromised identity or a rogue agent — not a gate between you and your data when you need it back.

On AI: The Velocity Changed, Not the Playbook

Willitts has an interesting take on AI-accelerated attacks that's worth hearing directly. He's not an alarmist.

"The attack patterns aren't changing. It's the velocity with which you're seeing attacks that's changing."

Wiper attacks aren't new. Credential harvesting isn't new. What AI does is put those things on hyper drive. The attack window, he said, is now down to 15 minutes in some cases.

"Security is no longer compliance," he said. "You're not waiting around for someone to eventually patch that system. You're doing it now because the attack window is 15 minutes."

That has a practical implication: the controls you configure today need to hold up against an attacker moving at machine speed. Which is exactly why out-of-band configuration and immutable snapshots aren't nice-to-haves anymore.

Where Platform Engineers and SREs Should Start

If you're an SRE or platform engineer thinking about the "outside-in" model — assuming perimeter failure as your baseline — Willitts had a straightforward answer.

Start with your primary. Configure your basic security controls and resilience policies. Then set up a secondary site, whether public cloud or on-prem, and replicate across sites. Turn SafeMode on. And then — this is the part most teams skip — test it.

"Test it, and test it, and test it," he said. "You build that muscle. The more you sweat in peace, the less you bleed in war."

He drew the comparison to Netflix's chaos engineering approach — injecting failure modes in a production environment until recovery becomes muscle memory. You start in dev and staging. You work up to production. The goal is making it easy to do the right thing, not adding another tax on your engineers.

"We all love bridges and roads and we hate taxes," he said. "Same is true with security. You have to make it easy to do the right thing."

What the 1touch Acquisition Actually Adds

Everpure's acquisition of 1touch isn't just about data discovery as a feature. It's about business context — specifically, knowing what depends on what before the incident.

"Everybody is independent," Willitts explained. "You're asking Steve to ask Alicia to ask Stan what they think is important. And everyone is incented to think their stuff is most important."

But an ERP system that sits idle most of the quarter might be mission-critical on the last day. Without knowing the dependency map between applications, data, and business outcomes, recovery becomes guesswork.

The 1touch integration is meant to replace that guesswork with a policy-driven unified view — arrays, applications, regions, protection policies — surfaced in a single control plane. No one has to ask what's most important. The policies already know.

The Metric That Actually Matters

Willitts closed with the reframe that his team keeps pushing: downtime, not intrusion, is the number that matters.

He's not saying stop investing in the perimeter. The opposite. "Continue to invest," he said. "Lock your doors and lock your safe." Defense in depth still applies. But if you're not equally serious about what happens after the breach, you're building a security program that can detect a fire and has no sprinklers.

"Resilience and security are two sides of the same coin," he said. "Especially in today's day and age."

That's the ask. Not a replacement for what you're already doing. An honest look at whether you can recover — and how fast — when the thing you're defending against actually happens.

Tom will be covering Everpure Accelerate next month. Stay tuned for more from the event.

Why Backup and Security Teams Don't Talk (And Why That's About to Change)

Tue, 31 Mar 2026 15:30:07 +0000

Here's a scenario that plays out in enterprises every day: the security team deploys ransomware-detection tools across endpoints and production systems. The backup team runs nightly jobs to protect data. Both teams believe they're doing their part to defend against ransomware.

Then an attack happens.

The security team detects suspicious activity, but doesn't communicate with backup systems in time. The ransomware spreads to production workloads, and by the time the backup team realizes what's happening, the backup data is already compromised. Recovery takes days or weeks. The business pays millions in downtime costs—or worse, pays the ransom.

HYCU and Halcyon just announced a partnership that addresses this fundamental problem: security and backup teams operate in silos, and the gap between those silos is where ransomware succeeds.

The Gap Between Prevention and Recovery

I've been covering HYCU for over five years now, and one consistent theme has been their focus on what happens after something goes wrong. Can you recover your data? Can you do it quickly? Can you do it across hybrid environments without vendor lock-in?

Those are the right questions for a backup vendor to ask. But they're not sufficient anymore.

HYCU's 2025 State of SaaS Resilience Survey found that nearly 80% of organizations experienced data loss or disruption in the past year. More than half lacked confidence in their ability to recover quickly across all workloads. The survey also showed that the average cost of SaaS downtime is $405,770 per day, with recovery typically taking 5 working days and costing $2.3 million per incident.

But here's what the survey data doesn't capture: the gap between when security teams detect ransomware activity and when backup systems can respond. By the time most organizations realize their production workloads are under attack, the ransomware has already started encrypting or exfiltrating data. Backup systems are designed to protect against data loss, not to stop active attacks.

This is the architectural problem that HYCU and Halcyon are trying to solve.

What Makes This Different From Other Integrations

The announcement positions this as "not another integration"—and based on what HYCU shared, that's accurate.

Most backup vendor partnerships with security companies work like this: the security tool detects a threat, generates an alert, and maybe triggers an API call to the backup system. The backup system then runs a manual or semi-automated recovery process. The two systems exchange data, but they don't really coordinate.

The HYCU-Halcyon partnership is architected differently. According to the announcement, the enhanced R-Shield solution will:

Detect ransomware behavior directly on endpoints and production workloads before backup data is impacted. This means Halcyon's anti-ransomware technology runs on the production side, not just scanning backup copies after the fact.

Prevent encryption and exfiltration attempts, reducing the number of attacks that can ever reach the backups. This is the critical piece—stopping the attack before it gets to the backup infrastructure.

Enable rapid, application-centric recovery across hybrid and multi-cloud environments. If prevention fails, HYCU's R-Shield handles recovery with the same capabilities I've written about before: granular restore, customer-controlled storage, and support for 90+ different workloads.

The architecture matters because it changes the timeline. Instead of detecting → alerting → recovering (which takes hours or days), the workflow becomes detecting → preventing → containing, with recovery as a last resort rather than the primary defense.

Why Bain Capital's Involvement Is Significant

Enrique Salem, a partner at Bain Capital Ventures, is quoted in the announcement. BCV invested in both HYCU and Halcyon, which isn't just a financial coincidence—it suggests strategic alignment at the portfolio level.

Salem captures what makes this partnership interesting: "As AI makes attackers stronger, forward-thinking organizations have realized that they can no longer approach ransomware resilience with disconnected tools. With the combination of prevention, protection, and recovery in a single, coordinated system, these two purpose-built solutions are coming together to close a critical gap in enterprise security."

The AI reference isn't throwaway marketing speak. Ransomware operators are using AI to automate reconnaissance, identify high-value targets faster, and adapt their encryption techniques to evade detection. If attackers are getting faster and more sophisticated, defense needs to keep pace.

Having a common investor who understands both the security and data protection markets also means the companies have aligned incentives to make the technical integration work properly, rather than just announcing a partnership and delivering a basic API connection.

The Technical Architecture (What We Know So Far)

The announcement doesn't provide detailed technical details on how the integration works, but we can infer some things from HYCU's existing R-Shield capabilities and Halcyon's approach.

HYCU R-Shield already includes:

Anomaly detection across VMs, file shares, and SaaS applications, identifying unusual patterns of data access or modification
Malware scanning at the source using storage snapshots, rather than recovering data to scan it elsewhere
Immutable storage with true object lock for backup data stored in customer-controlled environments

Halcyon's platform is purpose-built to defeat ransomware by disrupting the attack lifecycle at multiple stages: pre-execution, data exfiltration, and encryption. They claim their technology prevents ransomware from running in the first place, rather than just detecting it after execution.

The integration appears to work by having Halcyon's anti-ransomware technology operate on endpoints and production workloads, feeding threat intelligence into HYCU's R-Shield system. When Halcyon detects ransomware behavior, it can:

Stop the encryption or exfiltration attempt on the production side
Signal HYCU to isolate backup data to prevent lateral movement
Provide clean restore points by confirming which backups were taken before the attack started

HYCU also announced that R-Shield now includes malware scanning for Amazon EC2 and Azure backups, which complements the Halcyon integration by ensuring that recovered workloads are clean before they're brought back into production.

Why This Matters for Development Teams

If you're a developer or DevOps engineer, you might be thinking: "This sounds like an enterprise security problem, not something that affects my day-to-day work."

But consider how modern development pipelines actually work:

Your code lives in GitHub or GitLab. Your infrastructure is defined in Terraform or CloudFormation templates. Your secrets are stored in AWS Secrets Manager or HashiCorp Vault. Your CI/CD pipelines run on Jenkins or GitHub Actions. Your production workloads run across multiple cloud providers.

If ransomware compromises your source code repositories, can you recover not just the code but all the branches, pull requests, commit history, and access controls? If your infrastructure-as-code templates get encrypted, can you rebuild your production environment?

In my previous coverage of HYCU, I've written about their support for protecting GitHub repositories, AWS CloudFormation, and other DevOps tooling. The Halcyon partnership extends that protection model by adding active prevention on the production side.

Here's a concrete example: A financial services company I wrote about in an earlier article manages thousands of GitHub repositories. If ransomware infiltrates their development environment and begins encrypting repositories, Halcyon's technology would detect and stop the activity before it spreads. If some repositories were compromised before detection, HYCU's R-Shield would provide granular recovery of specific repositories to specific points in time—not a bulk restore of everything.

That's the kind of scenario where coordinated prevention and recovery actually matter.

The Bigger Industry Shift

This announcement reflects a broader shift in how the data protection industry positions itself.

Five years ago, backup vendors talked about RPO (recovery point objective) and RTO (recovery time objective). The conversation was about how quickly you could get data back after something went wrong.

Three years ago, the conversation shifted to ransomware recovery. Vendors added immutable storage and air-gapped backups to prevent ransomware from encrypting backup data.

Now, the conversation is moving toward prevention. It's not enough to have clean backups if you can't stop the attack before it causes business disruption.

HYCU is trying to position R-Shield as a "cyber resilience" platform rather than just a backup solution. The Halcyon partnership reinforces that positioning by adding prevention capabilities that backup vendors traditionally don't provide.

Whether this actually works in production environments remains to be seen. Integrated architectures sound great in press releases, but they're notoriously difficult to implement across heterogeneous IT environments with different security policies, compliance requirements, and operational workflows.

What's Not Clear Yet

The announcement leaves several questions unanswered:

How much does this cost? Is Halcyon's technology included in HYCU R-Shield licensing, or is it a separate purchase? For organizations already using different endpoint security tools, does this replace those tools or run alongside them?

What's the performance impact? Running anti-ransomware technology directly on production workloads adds overhead. How much? Is there a measurable performance impact on production systems?

How does this handle false positives? Ransomware detection always involves tradeoffs between sensitivity and specificity. If Halcyon detects suspicious behavior and triggers backup isolation, but it's actually a legitimate batch job encrypting data for compliance purposes, what happens?

What about cloud-native workloads? The announcement mentions hybrid and multi-cloud environments, but how does this work for serverless functions, containerized workloads, and other cloud-native architectures where traditional endpoint security doesn't apply?

These implementation questions will matter more than the architectural vision when customers deploy this solution.

Why HYCU Keeps Making These Moves

I've been following HYCU long enough to see a pattern in how they expand their platform.

They started by protecting underserved virtualization environments (Nutanix) that the dominant backup vendors had limited coverage for. They expanded into the cloud with comprehensive support for AWS, Azure, and Google Cloud services that competitors didn't protect. They moved into SaaS with depth of coverage across 90+ applications. They added cyber resilience features with R-Shield.

Now they're adding active ransomware prevention through the Halcyon partnership.

Each move addresses a real gap in the market. And each move positions HYCU not as a backup vendor competing on features, but as a platform vendor competing on architecture.

The question is whether enterprises will buy the platform vision. Most large organizations already have backup tools, security tools, and disaster recovery tools from multiple vendors. Convincing them to consolidate onto a unified resilience platform requires more than good technology—it requires changes to procurement processes, organizational structures, and operational workflows.

But the gap between security and backup teams is real. The siloed approach to ransomware defense is failing. And if HYCU and Halcyon can actually deliver a coordinated system that closes that gap, they'll have solved a problem that the incumbent vendors haven't figured out yet.

Why 74% of repeat ransomware victims say they have too many security tools, and what to do about it.

Sun, 10 Aug 2025 04:45:43 +0000

Security Tool Sprawl: How 'More Protection' Actually Creates More Ransomware Risk

Barracuda's 2025 research reveals a troubling paradox: organizations with the most security tools are getting hit hardest by ransomware

In cybersecurity, more isn't always better. While organizations continue adding security tools to their arsenals, hoping to build impenetrable defenses, new research from Barracuda Networks reveals a troubling paradox: the companies with the most security tools are often the most vulnerable to ransomware attacks.

According to Barracuda's 2025 Ransomware Insights Report, based on a survey of 2,000 IT and security decision-makers worldwide, 74% of organizations hit by multiple ransomware attacks say they're "juggling too many security tools," while 61% report their tools don't integrate properly. This fragmentation isn't just an operational headache, it's creating blind spots where attackers can hide and thrive.

The Repeat Victim Problem

The statistics paint a stark picture of persistent vulnerability. Among the 57% of organizations that experienced successful ransomware attacks in the past year, 38% were hit multiple times. This isn't random bad luck, it's a pattern that reveals fundamental security gaps that persist even after an initial compromise.

"The findings make it clear that ransomware is an escalating threat, and fragmented security defenses leave organizations immensely vulnerable," said Neal Bradbury, Barracuda's chief product officer. "In many cases attackers can move through victims' networks, gaining access to devices, data and more without being detected and blocked."

The correlation between security sprawl and repeat attacks suggests that organizations aren't learning from their first encounters with ransomware. Instead of addressing underlying architectural issues, many victims add yet another security tool to their stack, further complicating an already fragmented environment.

One of the most revealing findings concerns email security, a fundamental layer of protection that remains surprisingly weak across many organizations. Only 47% of ransomware victims had implemented email security solutions, compared to 59% of organizations that avoided attacks entirely.

This gap is particularly concerning given that 71% of organizations that suffered email breaches were also hit with ransomware, clearly demonstrating the connection between these attack vectors. Yet many organizations still don't make this connection, treating email security as a nice-to-have rather than a critical foundation for ransomware prevention.

The same pattern emerges across other security fundamentals: 48% of ransomware victims had network monitoring in place compared to 59% of non-victims, and only 45% had security awareness training versus 51% of unaffected organizations. These aren't exotic security measures—they're basic protections that many organizations have somehow overlooked while chasing more sophisticated solutions.

Beyond Encryption: The New Ransomware Playbook

Modern ransomware attacks have evolved far beyond simple data encryption. Barracuda's research reveals that today's attacks are multidimensional campaigns designed for maximum impact and leverage. Only 24% of successful attacks involved data encryption, while 27% included data theft, 27% involved publishing stolen data, and 29% saw attackers install additional malicious payloads.

This evolution reflects a more sophisticated approach to extortion. Rather than simply locking files and demanding payment, attackers now steal sensitive data before encryption, giving them multiple pressure points. They threaten to expose confidential information, contact customers and partners directly, and even threaten individual employees, tactics experienced by 22%, 21%, and 16% of victims respectively.

The psychological pressure campaign extends well beyond the initial attack. Attackers routinely threaten to alert authorities or the press (21% of cases) and deliberately target backup systems to eliminate recovery options, a tactic used against 19% of victims.

The False Promise of Ransom Payments

Despite the expanded attack surface, many organizations still view ransom payments as a viable option. The research shows that 32% of victims paid attackers to recover their data, with the rate rising to 37% among organizations hit multiple times.

However, paying doesn't guarantee recovery. A sobering 41% of organizations that paid ransoms failed to recover all their data. Sometimes decryption tools don't work, attackers provide only partial keys, or files become corrupted during the encryption and decryption process. In some cases, attackers simply take the money and disappear.

This reality underscores why 65% of ransomware victims who successfully recovered their data did so using backups rather than paying attackers, a reminder that fundamental security practices often outperform expensive reactive measures.

The Business Impact Beyond Recovery

The consequences of ransomware extend far beyond immediate recovery costs. Barracuda's research found that 41% of victims experienced brand and reputation damage, while 25% lost existing customers and another 25% lost new business opportunities.

These long-term impacts explain why ransomware remains so lucrative for attackers and why the threat continues to grow. Organizations in healthcare (67% attack rate), local government (65%), and retail (61%) face particularly high risks, though no industry or company size appears immune.

A Path Forward: Integration Over Addition

The solution isn't necessarily buying more security tools, it's making existing tools work together effectively. As Adam Khan, Barracuda's VP of Global Security Operations, noted during our interview, organizations need to focus on fundamentals rather than chasing the latest security technology.

AI-powered Security Operations Centers are emerging as one promising approach, using automated research and investigation to reduce manual workloads while providing better visibility across fragmented security stacks. However, the technology is only as effective as the underlying security architecture it's built upon.

For development and engineering teams, the key lesson is clear: security effectiveness comes from understanding how attackers actually operate, not from accumulating the maximum number of defensive tools. Organizations need to think like attackers, identifying the paths of least resistance through their environments and closing those gaps systematically.

The most effective defense remains a combination of solid fundamentals—email security, network monitoring, endpoint protection, and regular backups—implemented as an integrated system rather than a collection of point solutions. In the war against ransomware, coordination beats accumulation every time.