A reference architecture for cyber resilience: Cohesity and AWS

Can your organization recover safely from destructive cyberattacks and validate that restored workloads are trustworthy before reconnecting them to production? Dormant malware, hidden persistence mechanisms, vulnerabilities, and compromised service accounts can all survive inside what an admin considers to be a “clean” environment. This rush to recovery often results in a “doom loop,” where reinfection occurs after each attempted restoration.

Closing this gap requires a cyber resilience approach and architecture that integrates secure data protection, anomaly detection, workload validation, operational isolation, and scalable recovery in a coordinated strategy. For organizations with data in the public cloud, that can mean a purpose-built platform. That's exactly what Cohesity Data Cloud on AWS is designed to deliver. The combination of Cohesity Data Cloud and AWS changes the operational model for mature cyber resilience practices. Organizations can provision isolated recovery infrastructure dynamically without maintaining permanently active recovery environments. Recovery accounts can operate independently from production identity systems while using isolated networking constructs and tightly scoped administrative permissions. This isolation becomes especially important during ransomware recovery operations.

The elasticity of AWS also allows organizations to scale recovery infrastructure based on the severity and scope of the incident instead of maintaining oversized standby infrastructure continuously.

Solution overview

The following architecture demonstrates how organizations can use Cohesity Data Cloud atop AWS to build a modern cyber resilience platform that supports immutable backup storage, an isolated cyber vault, isolated recovery environments, controlled restoration workflows, and cloud-scale recovery operations.

Cohesity Data Cloud protects production workloads with immutable backups and monitors them for signs of compromise. Critical data replicates to an air-gapped vault and to an isolated AWS recovery environment. During an attack, you restore workloads into a clean room, validate them, scan for threats, and return only verified data to production. Let’s proceed through the major components of this architecture. 

Architecture walkthrough

The architecture consists of five primary operational layers.

1. Production workload protection: The first layer protects customer workloads running across datacenter and cloud environments. Cohesity Data Cloud protects virtual machines, databases, file shares, physical servers, containers, SaaS applications, and cloud-native workloads. Immutable backup policies help ensure recovery copies cannot be altered or deleted during ransomware incidents. Cohesity also provides centralized management capabilities that simplify backup operations across hybrid and multi-cloud environments.

2. Threat detection and anomaly monitoring: Cohesity continuously analyzes backup activity and metadata patterns to identify unexpected encryption activity, sudden data change spikes, suspicious deletion behavior, abnormal backup operations, and other potential indicators of compromise. This operational visibility helps organizations identify threats that have evaded front-line defenses.

3. Cyber vault: A cyber vault adds a hardened last line of defense on top of primary backups. Rather than sitting in the same operational path as day-to-day backup and restore traffic, a vault holds an immutable, air-gapped copy of an organization's most critical data under its own identity and access domain, with limited, scheduled connectivity to the rest of the environment. Because the vault is logically and operationally separate, a compromise of production, backup infrastructure, or even the primary recovery environment does not automatically put the vaulted copy at risk. Vaulting solutions such as Cohesity FortKnox extend this pattern by pairing vaulted, immutable storage with automated recovery testing, so vaulted copies are verified as recoverable rather than simply stored.

4. Clean room recovery environment on AWS: The Cohesity Clean Room provides an isolated recovery environment that enables organizations to investigate cyberattacks, validate recovered workloads, and restore trusted operations without risking reinfection of production systems.

Built on AWS using dedicated accounts, isolated Amazon VPCs, security groups, network segmentation, least-privilege IAM policies, AWS KMS encryption, and centralized logging and monitoring, the environment establishes a secure recovery zone separate from potentially compromised infrastructure.

Rather than restoring workloads directly into production, organizations can recover applications, databases, and file systems into the Cohesity Clean Room for threat analysis, malware investigation, application testing, and integrity verification. This allows security and operations teams to identify clean recovery points, understand the scope of the attack, and validate that recovered systems are trusted before reintroducing them into production. The Cohesity Clean Room helps establish a Minimum Viable Recovery Environment (MVRE) to support cyber response and recovery efforts.

Amazon EC2 provides elastic compute resources to support recovery operations, while Amazon S3 delivers scalable storage for backup and recovery data. Because the infrastructure can be provisioned dynamically, organizations gain a cost-effective cyber recovery capability without maintaining a permanently active secondary datacenter.

5. Recovery validation pipelines: Many organizations focus heavily on immutable storage and backup retention while overlooking the operational processes required after restoration occurs. Modern cyber resilience architectures increasingly rely on recovery validation pipelines that allow organizations to inspect, validate, monitor, and test workloads before reconnecting them to production infrastructure.

Within an isolated AWS recovery environment, restored workloads can move through staged validation workflows that include:

• Malware and threat analysis
• File integrity verification
• Identity and access review
• Network behavior monitoring
• Application functionality testing
• Compliance and governance validation

This operational separation helps organizations reduce the risk of reinfection while improving confidence in recovered systems. AWS services such as Amazon Inspector, AWS CloudTrail, Amazon CloudWatch, VPC Flow Logs, and AWS KMS can support these validation workflows by providing visibility into workload behavior, encryption boundaries, operational activity, and recovery governance.

By treating restored workloads as untrusted until validation completes, organizations can significantly improve recovery confidence during cyber incidents.

Observability and audit during recovery

Validation is only as trustworthy as the telemetry behind it. A restored workload cannot be declared clean without evidence that its behavior is normal, so observability becomes the evidence layer that makes validated recovery provable. Within the isolated AWS recovery environment, AWS observability and audit services provide the visibility needed to confirm that restored systems behave as expected before rehydration.

Amazon CloudWatch collects metrics, logs, and alarms from restored workloads, helping teams detect abnormal behavior before reconnecting systems to production. CloudWatch Logs and CloudWatch Logs Insights centralize and analyze log data from restored systems in the isolated VPC.

AWS CloudTrail records every API action taken within the recovery account, providing an audit trail of who did what during recovery—essential for forensics and governance.

VPC Flow Logs support the network behavior monitoring step by confirming that restored workloads are not beaconing to command-and-control infrastructure or communicating in unexpected ways.

AWS Config continuously monitors configuration and compliance state during the validation window, and services such as Amazon OpenSearch Service or Amazon Security Lake can aggregate logs and findings for deeper threat hunting across the recovery environment.

Together, these observability signals turn workload validation from a checklist into a measurable, auditable process—directly reinforcing the principle that restored workloads remain untrusted until their behavior is proven safe.

Extending the architecture with additional AWS services  

While the architecture above references core AWS building blocks, the same design can be extended with a broader set of AWS services that map directly to each of the five operational layers. The following additions strengthen protection, detection, isolation, and validation without changing the overall recovery model.

Production workload protection: AWS Backup can provide native, policy-based backup of AWS workloads alongside Cohesity, while AWS Storage Gateway supports hybrid on-premises-to-cloud data movement and Amazon EBS snapshots protect EC2-based workloads.

Threat detection and anomaly monitoring: Amazon GuardDuty adds intelligent threat detection (including malware and Amazon S3 anomaly detection), AWS Security Hub aggregates security findings and posture management across accounts, and Amazon Macie discovers and classifies sensitive data stored in Amazon S3. 

Cyber vault: Amazon S3 Object Lock enforces write-once-read-many (WORM) immutability, Amazon S3 Glacier provides a low-cost, air-gapped cold tier, and AWS Backup Vault Lock protects backup vaults. Vault accounts can be governed independently using AWS Organizations service control policies (SCPs).

Clean room recovery: AWS Control Tower establishes a governed landing zone with guardrails, AWS Network Firewall together with security groups and network ACLs enforces segmentation, and AWS PrivateLink and AWS Transit Gateway provide private, controlled connectivity for replication and recovery traffic.

Recovery validation pipelines: GuardDuty Malware Protection can perform agentless scans of restored Amazon EBS volumes, Amazon Detective supports incident investigation, AWS Config validates configuration and compliance, and AWS Step Functions with AWS Lambda orchestrate the staged validation workflow. AWS Systems Manager supports patching and inventory of restored hosts before rehydration.

Resilience means restoring trust, not just data  

By combining the scalable recovery capabilities of AWS with modern data protection and threat-aware recovery capabilities from Cohesity, organizations can build architectures designed not only to preserve data, but also to restore business operations securely after a cyber event.

In today's threat landscape, resilience is no longer defined solely by the existence of backups or the ability to restore infrastructure. It is defined by the ability to restore trusted business operations safely, predictably, and at scale after a cyber event. Modern cyber resilience architectures must combine immutable protection, isolated recovery, operational validation, governance, and controlled rehydration into a coordinated recovery strategy designed for adversarial environments.