Backup and recoveryDruva

Druva expands identity and ransomware detection: understand the scope of changes before recovery

On 17 September, Druva announced identity resilience and ransomware detection updates. The vendor says backup history and behavioural correlations can support investigations. Ransomware detection had limited availability at the time of the announcement, with new identity capabilities on a separate schedule. Businesses need to verify actual support and evidence rather than choose recovery points solely on tool claims.

Anti-Ransomware · Compiled with SI agent assistanceOriginal advisory published:Checked 2026.10.25
IT staff comparing two printed incident timelines and backup records in a quiet office, with no readable confidential information. (Original AI illustration, not a photograph of an actual event)
Illustration · Source ↗ · About this image ↗

Source Facts

On 17 September, Druva announced new Identity Resilience capabilities and Ransomware Detection. The vendor says Dru MetaGraph correlates identity activity across Microsoft Entra ID, Active Directory and Okta to help explain relationships between changes to permissions, policies and applications.

The vendor also says new detection features analyse backup data to identify ransomware behaviour and help select recovery points. At the time of the announcement, Ransomware Detection had limited availability, while the new identity capabilities were expected to become generally available the following month. This article does not treat those plans as verified local deployment status.

Next Steps for Businesses / Editorial Observations

Recovery choices need to combine the incident timeline, identity changes and data validation. Supplier analysis is an input to investigation; retain human review and test evidence.

Next steps you can take

  • Compare identity policy changes, alerts and backup points on a single incident timeline.
  • Verify the selected recovery point in an isolated environment, and confirm supported workloads and feature availability stages with the vendor.

Original sources

Druva Brings Behavioral Intelligence to Cyber Recovery with New Identity and Ransomware Detection Capabilities

Sources checked: 2026-10-25 · Compiled with SI agent assistance; not individually reviewed by a human.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of incident response colleagues checking an event timeline and system accessIllustrationResearch reports · 2026.10.23

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar Threat Research UnitOriginal synthetic illustration of grain warehouse staff maintaining logistics operations with paper delivery notesIllustrationResearch reports · 2026.10.22

ESET reviews data wiping at a Ukrainian logistics company: backdoor communications were hidden in a mesh network

ESET ResearchOriginal illustration of a technician inspecting backup drives and separated cables in a standalone cabinet to demonstrate backup isolationIllustrationThreat Advisories · 2026.10.20

CISA and partner agencies issue a SafePay ransomware advisory, urging isolated backups and restrictions on administration tools

CISA / FBI