IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives
IBM FlashSystem 5600, 7600, and 9600 arrays built on the fifth-generation IBM FlashCore Module now detect data exfiltration inside the drive, next to the ransomware encryption detection the modules already run. IBM says the module learns each volume’s normal read pattern, flags reads that break from it, and confirms a suspected event over a 30-minute confidence window with a validated false-positive rate below 1%. The capability is available starting in October 2026 on eligible configurations running firmware 9.1.2 or later.
The case IBM makes is that recovery answers the wrong question…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.