Druva adds behavioral intelligence for identity and Ransomware Detection. ET By Editorial Team September 17, 2026 Druva, the resilience foundation for the AI enterprise, announced new capabilities for Druva Identity Resilience alongside the launch of Ransomware Detection, a new feature fueled by a proprietary AI threat pipeline. Powered by Dru MetaGraph, the new offerings use behavioral intelligence and built-in validation to turn suspicious behavior into actionable evidence, definitively confirm impact, and accelerate precise containment and clean recovery. AI is making it harder for security teams to distinguish real compromise from normal behaviors and activity. Attackers are using AI to test more paths, shift tactics faster, and hide malicious behavior inside legitimate activity, while stolen credentials and constantly evolving ransomware make traditional signals less conclusive. Druva gives customers evidence-based cyber recovery by unlocking behavioral intelligence from backup data. The new identity resilience capabilities use Dru MetaGraph to analyze suspicious identity behavior and visualize the blast radius, while the proprietary AI threat pipeline powering Ransomware Detection analyzes backup data to validate ransomware behavior. Together, they move teams from signals to evidence, accelerating investigation, confirming impact, and guiding precise containment and recovery back to clean, trustworthy states. "Security teams know they can't stop every attack. The challenge is knowing exactly what happens when a threat breaks through," said Yogesh Badwe, Chief Security Officer at Druva. "AI makes that uncertainty more dangerous. Before you recover, you need evidence of what changed, how far the compromise spread, and what can still be trusted. Druva has years of backup telemetry we use to validate threat signals and turn them into evidence, giving customers a trusted basis for recovery instead of an assumption." Identity Resilience reconstructs attack paths for faster, trusted recovery. Building on the unified identity protection introduced earlier this year, new Druva Identity Resilience capabilities bring Dru MetaGraph's connected intelligence directly to customers. This capability provides an interactive view of human and non-human identities (NHIs), activities, and relationships across Microsoft Entra ID, Active Directory, and Okta. Dru MetaGraph contextualizes changes across identities, permissions, applications, policies, and time to show how suspicious activity propagated through an environment and cut investigation time from days to hours. With these new capabilities, customers can: * Understand attacker behavior and blast radius: See where an attacker gained access, escalated privileges, established persistence, or moved laterally through the environment, with mapping to the relevant MITRE ATT&CK TTPs. * Establish a trusted pre-attack state: Use historical changes and snapshots to identify the environment before compromise and determine what needs to be restored. * Turn behavioral evidence into precise containment and recovery: Generate a tailored, pre-validated recovery plan that identifies each impacted object, recommends the action to take, and pinpoints the clean snapshot to restore. "Finding suspicious activity is only the beginning. Security teams still have to determine the legitimacy of the threat and how it may impact the business, as well as knowing what can be safely recovered," said Jennifer Glenn, Research Director for Information and Data Security at IDC. "AI is driving greater attack volume and complexity, making it difficult to answer those questions quickly and confidently. Evidence-based cyber recovery gives organizations a clearer path to get from threat signals to trusted recovery." Druva Ransomware Detection confirms ransomware impact for evidence-based recovery. The announcement also marks the launch of Ransomware Detection, powered by a proprietary AI threat pipeline that detects known and unknown ransomware behavior, confirms impact through built-in validation, and pinpoints clean recovery points. Traditional anomaly detection can flag unusual file activity but leaves teams sorting through noise to determine what is truly malicious. Ransomware Detection replaces that guesswork with multi-stage behavioral analysis and forensic validation that filters out false signals and delivers confirmed evidence teams can act on. With these new capabilities, customers can: * Identify ransomware behavior across snapshots: Evaluate data against high-risk patterns such as ransom notes, suspicious and known extensions, mass file renaming, and other indicators across backup snapshots using purpose-built AI and machine learning models. * Validate high-risk findings: Confirm the presence of ransomware and reduce false positives by applying in-platform forensics, such as structural verification, entropy, Multipurpose Internet Mail Extensions (MIME) type analysis, file integrity, and data analysis. * Turn evidence into recovery action: Surface explainable findings in Recovery Insights, distinguish impacted data from clean snapshots, and validate recovery points before restore.

Mind The Blindspots: Netpluz and Druva unite to tackle cybersecurity's hidden risks at exclusive Makati event. Netpluz, in partnership with Druva and RAIR Technologies Inc., brought together IT and business leaders for Mind The Blindspots, a networking event held at The Blind Pig, Makati, spotlighting the security gaps organizations often overlook and what it takes to close them. Though framed as a casual evening of conversation and cocktails, the event carried a clear message: in cybersecurity, what you can't see can hurt you most. Setting the stage: A track record worth trusting. Opening the evening, Netpluz Country Sales Manager Diana Yabut made the case for why the company has earned its reputation as a trusted managed cybersecurity partner across Southeast Asia, pointing to ISO 27001 certification, CREST accreditation, Certified D-TAP status, and recognition on multiple Top 250 MSSP lists as proof points. From there, Yabut turned to the specifics of what "closing the blind spots" looks like in practice. She detailed Netpluz's Managed Security Monitoring service: a 24x7x365 operation where analysts work around the clock to understand each client's environment, apply standard detection rules and playbooks for firewall logs, and customise those playbooks for businesses that need a more tailored defence. Clients also receive monthly analysis reports and a default three-month log retention window, giving them continuous visibility rather than a one-time check-up. Druva weighs in: resilience beyond the firewall. Representing Druva, Phanindre Santosh Baguant took the floor to expand the conversation beyond monitoring and into resilience. His message: true security today means simplifying multi-cloud operations, strengthening cyber and identity resilience by design, and cutting costs through consumption-based pricing that avoids heavy upfront investment. Between the two talks, a clear thread emerged: the biggest security blind spots aren't always about what's attacking you, but about what you can't yet see, monitor, or recover from fast enough. A growing partnership across the region. Mind The Blindspots is the latest example of Netpluz deepening its ecosystem of trusted partners across Southeast Asia, joining forces with Druva and RAIR Technologiesto bring a more complete cybersecurity story to businesses navigating an increasingly complex threat landscape. Netpluz extends its thanks to everyone who joined the evening, and to RAIR Technologies and Druva for helping make it a night of sharp insight and genuine connection. Stay tuned for more updates on upcoming Netpluz events.