Cohesity Advanced Threat Protection

Strengthen your cyber resilience with intelligent threat defense

Attackers deliberately target your backups — the one copy you reach for when everything else fails. Without regular scanning, there is no way to prove your recovery point is free from malware. That raises risk and prolongs downtime. Cohesity puts threat detection where recovery lives: inside your backups.

Threat protection should not be an afterthought

Ransomware, zero-day exploits, and data-theft extortion remain the fastest-growing business risks. Traditional perimeter controls alone can't keep pace.

How Cohesity threat protection helps

One unified platform combines backup, threat detection, and clean-point recovery, eliminating tool sprawl and hand-offs.
IOC scanning on immutable snapshots surfaces dormant malware and zero-days that primary defenses miss, without touching production.
Google Threat Intelligence, and Sophos and custom YARA rules give you real-time feeds and tailored threat hunts in one place. A secure sandbox detonates a potentially dangerous file in secure, isolated environment, so you can assess risk.
Accelerated Incident Response quickly identifies infection free copies and orchestrates large-scale restores, slashing downtime and preventing reinfection.

How we do it better

Scan everything. Every file type, extension, and size, across Windows and Linux. Rivals scan only certain types and sizes, and partial visibility is partial protection.
Run unlimited threat scans. No quotas, no rationing, no caps that force a choice between safety and cost.
Scan on your terms. On-demand, scheduled, or triggered, against intelligence feeds refreshed every day.
Perform at scale. Routine checks or exabyte-scale forensic scans run without slowing backup or recovery.

Key benefits

Detect zero-day vulnerabilities: Continuously refreshed threat feeds from Google Threat Intelligence, and Sophos expose zero-day exploits that may slip past the primary security tools.
Snapshot analysis on a timeline: Hunt specific ransomware strains across multiple historical snapshots to trace the infection path and pinpoint the root cause.
One-click threat hunting: Trigger on-demand ad-hoc scans to accelerate investigations. Search hundreds of millions of files by SHA-256 hash in under a minute.
Unified security and recovery operations: A single dashboard plus SIEM/SOAR integrations consolidates alerts, posture metrics, and forensic evidence. Integrate threat scanning with response and recovery workflows. Reduce tool sprawl and mean time to respond.
Catch the attacks before they detonate: Entropy-based anomaly detection flags partial, header-only, and same-extension encryption as early as the first incremental backup.
Scan everywhere: Cover Microsoft 365, Microsoft Azure VMware Solution, Google Cloud VMs, and self-managed, air-gapped deployments — every file type and size, Windows and Linux.

What’s New

Persistent threat tags on every snapshot, so a match travels with the data and flows into your SIEM and SOAR.
Entropy-based anomaly detection that catches partial, header-only, and same-extension encryption at the first incremental backup, not 15 backups and days later.
Incremental threat scanning for Microsoft 365.
Rapid threat hunting for self-managed and air-gapped deployments, searching hundreds of millions of files by SHA-256 hash in under a minute.
Threat scanning for Microsoft Azure VMware Solution and Google Cloud VMs.
Secure sandbox analysis and Sophos scanning, layered on Google Threat Intelligence and integration with CrowdStrike.

Cohesity Data Cloud Enterprise Edition includes threat protection, the recommended version that hardens cyber-resilience, trims response times, and turns every snapshot into a security asset, not a liability. With unified detection, response, and rapid recovery in one platform, Cohesity Data Cloud adds a data-centric defense layer that continuously inspects your backups so you can spot threats sooner, contain them faster, and recover with certainty.

3000173-002