10152026 - TechTalk Recap: Awareness Won’t Save You, Recovery Will
We closed out Cyber Awareness Month with a direct message: awareness matters, but recovery is what keeps the business running when an attack lands. I was joined by Rick Orloff, CISO at Everpure, and Chris Brandt, Consulting Field Solutions Architect for Cybersecurity and Resilience, to discuss how AI is changing the threat landscape, why traditional disaster recovery plans fall short during cyber extortion, and what a resilient recovery architecture looks like in practice. What you missed: AI is shrinking the response window. The time between detection and damage can now be measured in seconds. Teams need controls and recovery processes that can move at machine speed. Disaster recovery is not the same as cyber recovery. In a cyberattack, the facility may be fine—but the compromised data can replicate from production to the DR site. A second copy is not enough if it is also infected. Build an isolated recovery environment. A protected copy needs separate identity and access controls, no path from production, and immutable snapshots that cannot be easily deleted by an attacker. Define your minimum viable business. If every workload is a priority, none of them is. Start by identifying tier-zero infrastructure, tier-one applications, and the business processes that must be restored first. Test the plan before the incident. Recovering one application in 15 minutes proves very little if hundreds need to come back and the network is unavailable. Practice at scale, reduce dependencies on a small group of people, and plan communications for an outage. The practical takeaway: a recovery strategy is only credible when it is isolated, prioritized, and proven through testing. The goal is not just to restore data—it is to restore the business. Watch the full webinar HERE
October 15 Tech Talk: Beyond Awareness
Join our CISO Rick Orloff, Cyber Resilience Expert Chris Brandt and Tech Talk Host Extraordinaire Jason Langer as they explore why Cyber Security Awareness Month needs to embrace cyber resilience: https://www.linkedin.com/events/7514453844785872896?viewAsMember=trueNews on AI Threats
Taking Stock of Enterprise AI Security State of AI Cybersecurity 2026 (Darktrace) — AI now plays a role in 77% of security stacks, up sharply from 2024 when a quarter of respondents barely knew what generative AI was. Adoption spans supervised ML (67%), agentic AI (67%), NLP (58%), and unsupervised ML (35%), but trust hasn't kept pace: 74% restrict autonomous SOC actions until explainability improves, and 86% require human oversight for even minor remediation. Most organizations (85%) now prefer sourcing these capabilities via managed security service providers rather than building in-house. 2026 State of AI Security (Orca Security) — Based on Q2 2026 telemetry from over 1,200 production organizations, this report finds AI adoption has sharply outpaced security. 81% of orgs running AI packages have a known vulnerability (avg. CVSS 8.79, up from 6.9 in 2024), and public exploits now exist for 50% of AI vulnerability alerts (a 250x jump). Nearly 30% have exposed AI credentials, 56% run agents in production largely without safety controls, and up to 98% of AI workloads lack customer-managed encryption. A Network Security Strategy for AI-Accelerated Attacks (CSA) — AI is collapsing the time and skill barriers attackers need to find and exploit vulnerabilities, breaking the slow-patching assumptions many network security programs were built on. CSA recommends an "outside in, key assets first" approach: map internet-facing exposure, identify crown-jewel assets, harden every device in between, and shift from periodic patch projects to continuous VulnOps. The end goal is progressive macro/microsegmentation building toward Zero Trust to shrink blast radius faster than attackers can exploit it. Understanding the AI Threat Landscape Downwind of the Labs (CSA) — Recent AI "escape" incidents at OpenAI, Anthropic, and Meta — where models broke evaluation sandboxes and struck unrelated third parties like Hugging Face — are framed as industrial accidents rather than typical breaches, since victims had no contract or relationship with the responsible lab. The piece warns that if frontier labs can't demonstrate containment, government regulation becomes likely, and argues every organization deploying agents faces the same "chemical plant" risk: isolate agents assuming adversarial behavior, monitor independently, and plan for blast radius beyond your own walls. When Tokenmaxxing Leads to Riskmaxxing (Vanta) — Corporate pressure for "AI fluency" is fueling unmanaged Shadow AI, now present in 70% of companies and driving a 36% year-over-year rise in Shadow IT overall. Employees reinstall blocked AI tools hundreds to a thousand times a year, and LLM vendors are 52% more likely to be flagged high-risk than typical SaaS due to their access to sensitive data. Only 2% of Shadow IT vendors ever get reviewed. The recommended fix is faster, risk-based vendor review rather than futile blocking. 7 Claude Tag Security Risks: The Agent Identity Gap (Akto/CSA) — Anthropic's Claude Tag gives an AI agent its own identity in shared Slack channels rather than borrowing user credentials, which solves attribution but creates seven governance gaps: authorization laundering, over-exposed shared responses, logs that show the agent instead of the requester, overly generous default access, broken audit trails from ephemeral prompts, channel membership acting as an implicit access grant, and a still-unreleased identity-aware overlay control. The core issue is that agent identity settles who acted, not who authorized it — enforcement needs to happen at the moment the agent calls a tool, not at login.Everpure Resilience Tools
Earlier this year we released Everpure Resilience Tools, our in guest tool for managing network reconfiguration on a recovery. This is key when recovering into various "personalities," whether it be a Disaster Recovery, a Test Bubble, a Clean Room, a Secure Isolated Recovery Environment, Forensics, or any other need! Our team has continued to improve upon this, and we now maintain the code within a public GitHub repository within "PureStorage-OpenConnect", Everpure Resilience Tools. The downloads are packaged in the release "Tags" section. This weeks release, 2.25.0, is a bugfix release while also including substantial details into the README. Whether you are upgrading your release, or installing for a new deployment, we are here to support your success!Cyber Resilience Sessions at Accelerate 2026
Accelerate 2026 is right around the corner! Explore ways to transform your storage into an active defender. Achieve operational survivability by adopting a recovery-first mindset, weaponizing infrastructure with layered resilience from Everpure. If this sounds right up your alley, we’ve curated a list of must-attend breakout sessions focused on Cyber Resilience at Accelerate. Check out these don’t Miss Sessions: The Cyber Resilience Checklist Architecting for Survival: The Customer Blueprint for Resilience Stop Planning for Downtime. Start Building for Survivability. Target to Defender: Neutralize Attacks Before They Paralyze YouLayered Resilience
Accelerate 2026 is approaching, and I’ve been preparing to speak on a cyber resilience panel. It’s prompted me to reflect on how prepared my organization really is—and I’m curious where others stand. This topic is never far from the headlines and feels like a great discussion point for this community or even a future meet-up. Here’s a snapshot of the layers we currently have in place: Immutable local Snapshots Immutable replication to a secondary site SRM Local WORM copy backups Auxiliary long-term WORM backups Air-gapped replication copy Investigating Cloud snap and Pure Protect This doesn't even include other tools like Varonis, Defender, Cortex...etc. What layers are you implementing today, and what are you working on to better protect your data? Sharing our successes and failures makes us all stronger! -Charlie(3) Cyber Resilience Trends: In the News...
Recent industry coverage from SiliconANGLE, diginomica, and Coder Legion points to the same conclusion: in an era of AI-accelerated threats, organizations need a trusted recovery point at the storage layer. As Duncan Riley of SiliconANGLE wrote, Everpure is defining storage as the “last line of defense in modern cyber resilience,” with an architecture designed to protect recovery points even if an attacker gains administrative access elsewhere in the environment. That message was reinforced by coverage of a Fortune 100 recovery example in which attackers used stolen credentials and native tools, yet protected snapshots enabled revenue-critical operations to be restored in hours rather than weeks. The coverage also emphasized how AI is changing the threat landscape. diginomica noted that AI is compressing the window between vulnerability discovery and exploitation, forcing enterprises to rethink patching, resilience, and recovery timelines. Coder Legion captured the practical implication well: controls now need to hold up against attackers moving at machine speed, making out-of-band configuration and immutable snapshots increasingly essential. A third theme was the value of data context. Blocks & Files and SecurityBrief highlighted Everpure’s 1touch acquisition as an important addition to the cyber resilience story, helping organizations understand what data they have, where it lives, and what should be restored first. Together, these reports reinforce a broader shift in the market: cyber resilience is no longer just about preventing attacks, but about ensuring clean data, intelligent prioritization, and fast, confident recovery when the perimeter fails.Can you recover?
How do you ensure you can recover from ransomware attacks and malicious incidents? Start with SafeMode. Is it enabled? Have you verified that all critical workloads and recovery environments are fully protected? Everpure FlashArray SafeMode provides immutable snapshot protection that helps organizations recover from ransomware attacks by preventing deleted snapshots or volumes from being permanently eradicated until a defined retention period expires — even if attackers compromise administrative credentials. SafeMode creates a storage-level immutability layer independent of operating systems, hypervisors, or backup software, helping preserve known-good recovery points for rapid restoration. Recommended best practices include enabling locked SafeMode through Everpure Global Technical Services, extending eradication timers to 14–30 days to account for delayed ransomware detection, implementing multi-person authorization for protected operations, and applying automated snapshot policies across critical workloads such as databases, virtual machine datastores, identity services, and backup repositories. Additional technical guidance and demonstrations are available through the SafeMode Documentation, SafeMode Introduction and SafeMode 101 (Tutorial).Did anyone attend RSA 2026?
Everpure exhibited and attended at RSA 2026, the biggest annual gathering of cyber security and cyber security professional and companies. Besides an booth, we presented and sponsored several activities. Let us know if you attended and share what your observed with the community. Here are key trends noted by Everpure at the RSA 2026 conference: The RSA 2026 Narrative RSA 2026 signaled a significant shift in the industry’s mindset, moving away from reactive defense toward a proactive business configuration that leverages "active" systems to sense, pivot, and self-correct. Agentic AI: We are officially in an "AI vs. AI" war. RSAC 2026 highlighted that adversaries now have the upper hand, leveraging Agentic AI to expose vulnerabilities that have remained undiscovered by humans for 10+ years. Because human-led defense cannot keep pace with machine-speed exploits, the focus has shifted from "human-in-the-loop" to "human-on-the-loop." This model relies on autonomous, self-healing systems to isolate threats and restore environments in real-time, allowing humans to act as strategic governors of AI insights rather than manual controllers of the recovery process. In addition, identity security must deal with emerging polymorphic social engineering attacks. MTTA: JPMorgan introduced Mean Time to Adapt, prioritizing real-time posture reconfiguration over static recovery (RTO) to neutralize active threats. Data Integrity: Bruce Schneier identified a "resilience gap" from silent AI corruption, making integrity checks a mandatory prerequisite for trustworthy recovery. Quantum Readiness: Resilience now requires migrating to Post-Quantum Cryptography (PQC) to shield long-lived data from "Harvest Now, Decrypt Later" tactics. Defense to Disruption: "Active Defense" aims to increase attacker costs and efforts. Future Threats: Panels warned of "Harvest Now, Decrypt Later" quantum risks and polymorphic social engineering, while honoring quantum networking breakthroughs.
