Cyber Resilience & Ransomware Recovery

As unauthorized access to companies surges, electronics giants offering cyber defense services are receiving a flood of consultations and inquiries. In September, Hitachi launched a service that uses advanced AI models from U.S. firms such as Anthropic and OpenAI to provide end-to-end support spanning risk assessment, monitoring, and recovery. Fujitsu announced its cyber defense strategy in late August, and inquiries from client companies have poured in since then, increasing further in recent days, prompting it to establish a specialized organization of about 100 people effective October 1. NEC began offering a service in late September for financial institutions, manufacturers, and distributors that uses AI to automatically analyze risks and formulate response policies. Each company is strengthening its systems in anticipation of sophisticated AI-driven cyberattacks, and demand appears set to keep expanding.

East Japan Railway Company announced on the 9th that more than 2 million members' information from its ticket reservation and travel support services "Eki-net" and "Otona no Kyujitsu Club" may have been leaked due to unauthorized access to a cloud service operated by a SoftBank subsidiary. Approximately 1.67 million email addresses of Eki-net members may have been compromised, while about 390,000 records from Otona no Kyujitsu Club, including membership numbers and credit card expiration dates, may have been leaked. Names, addresses, phone numbers, and credit card numbers were not included. In addition, email distribution to members of both services has been partially disrupted. IDC Frontier, the SoftBank subsidiary, suffered a ransomware attack on part of the systems of its cloud service "IDCF Cloud," affecting a wide range of contracted companies and local governments.

Core6 announced a partnership with Armis from ServiceNow that integrates its StorageGuard storage security posture management platform with Armis' continuous asset intelligence, extending cyber exposure management to storage and backup systems. The integration correlates Armis' real-time asset intelligence with StorageGuard's authenticated vulnerability and misconfiguration findings for storage and backup systems, closing a gap that has left storage arrays and backup platforms outside exposure management programs. Core6 founder and CEO Gil Hecht said several banks the FSB classifies as globally systemically important harden their storage and backup with StorageGuard. Nadir Izrael, GVP of Cybersecurity and Risk at ServiceNow, said the partnership enables security teams to shift from reactive threat response to autonomous, AI-driven security. The integration is available immediately for existing Armis from ServiceNow and Core6 customers.

Synology Inc. has released the findings of The Synology 2026 Southeast Asia Business AI Transformation Survey, which found that 86% of respondents in Thailand consider AI-ready infrastructure important for business operations and efficiency gains, though only 31.3% view it as very important. Meanwhile, 64.4% cited data security and privacy as the top obstacle to AI adoption, followed by data quality and availability at 47.3% and system deployment costs at 33.7%. On cyber risk, only 9.5% of respondents were highly confident their organisations are ready to handle AI-driven threats, while 38.5% said they are not ready. Although 92% of organisations already use data protection tools, only 21.4% are highly confident they could quickly recover systems from a ransomware attack and keep backup data secure, while 32.5% remain unsure they could restore data after an incident. Anthony Yang, Synology's head of Southeast Asia, said having a backup system alone is not enough and that data must actually be recoverable, and that organisations should separate backup systems from primary operating systems, along with safeguards to prevent backup data from being altered. The survey also found that 34% of Thai organisations still have no controls over employee use of AI, only 26.1% enforce controls through technical means, and 47.1% cannot see how external AI tools handle the data sent to them. At the Synology Press Event 2026, the company also presented the PAS7700, a high-speed storage system for mission-critical enterprise workloads, alongside ActiveProtect for backup and recovery management and the Synology Office Suite, as well as DSM Agent. It also disclosed a case study of Ethos Media Production, which adopted the PAS7700 as its central file storage hub with 70 terabytes of capacity, supporting 15 concurrent users and cutting the upload time for a 100-gigabyte video from about 40 minutes to just 2 minutes.

Samart Telcoms Public Company Limited, or SAMTEL, disclosed that Secure Info Company Limited, or SCI, a subsidiary in which the company holds a 99.99% indirect stake through Samart Comtech Company Limited, signed a purchase and sale contract for the procurement of machinery and equipment for the project to establish a cyber operations center and a data backup center, or Digital Resilience Center, at the SMART PARK Industrial Estate office with the Industrial Estate Authority of Thailand on September 29, 2026. The total project value is 146.20 million baht, including value-added tax, with delivery scheduled for completion by April 27, 2027. Payment terms are divided into five installments based on completed work progress.

IDC Frontier, a SoftBank subsidiary that provides cloud services, announced on the 7th that it suffered unauthorized access by a third party, causing an outage in its IDCF Cloud service for municipalities and businesses. The outage occurred around 3:40 a.m. that day, leaving some services unavailable. The company said it received an external ransomware attack, and the cloud management platform automatically executed a shutdown. The company has not disclosed details of its service customers, but numerous websites, including those of Ibaraki Prefecture, the city of Kodaira in Tokyo, Jiji Press, and Tobu Zoo, became impossible to view or update. To prevent secondary damage and data leaks, the company has cut off its network and is working to identify the detailed intrusion route while rushing to set up an alternative environment.

South Korean President Lee Jae-myung revealed on Tuesday, October 6, 2026, that there are signs artificial intelligence, or AI, may have been used in cyberattacks on several banks in the country, and called on South Korea to speed up development of cybersecurity systems suited to the AI era. Speaking during a cabinet meeting, he said that in some hacking cases traces of AI use have begun to emerge, which has caused considerable public concern, and ordered relevant agencies to swiftly establish the facts clearly, while mobilizing personnel and resources to minimize damage. South Korean police have launched a full-scale investigation after several commercial banks were hit by cyberattacks that led to the leakage of customers' personal data. The Financial Services Commission, or FSC, disclosed that Shinhan Bank and KB Kookmin Bank, as well as other financial institutions, reported being hit by cyberattacks, while Hana Bank and Woori Bank also faced data leakage incidents. The Financial Supervisory Service, or FSS, and the Financial Security Institute passed on information about 28 suspicious IP addresses, as well as some country data linked to the latest cyberattack attempts, to the financial sector for further checks and prevention. However, South Korean authorities have not yet disclosed what type of AI tools the attackers used, and there are still no details about the full scope of damage from the incidents.

Revyz, a Spin.ai company, announced Revyz Command Center for Bitbucket, extending its enterprise data protection platform from Jira and Confluence to source code and pipelines in Bitbucket Cloud, alongside the appointment of Justin Leader as Head of Partnerships, Atlassian Ecosystem. The launch, announced ahead of Atlassian Team '26 Europe in Amsterdam on October 6-8, adds granular recovery of specific repositories, branches, pipelines, or issues, run-to-run diff visibility, and AI code protection. Revyz, acquired by Spin.ai in April 2026, is a Platinum Atlassian Marketplace Partner whose platform is SOC 2 Type II compliant. Justin Leader founded HyperVelocity Consulting in 2014, growing it to $24M in revenue before its acquisition by Isos Technology in 2023, where he served as VP of Product, and brings 15 years of SaaS experience to overseeing global Atlassian ecosystem partner strategy. Revyz Command Center for Bitbucket is available today, with solution partners able to access the app and co-selling support through the updated Revyz Partner Program.

Nvidia CEO Jensen Huang closed out a blockbuster third quarter in which Nvidia's stock rose about 19% and the company announced the largest stock buyback in history at $150 billion, bringing its total buyback program to $235 billion. Huang also joined other tech executives at a White House AI safety gathering, where his signature drew attention on social media, and appeared at a state dinner with the president. On the company's August earnings call, Huang said growth could exceed 100% next year. Separately, Rubrik CEO Bipul Sinha told Yahoo Finance that AI carries 1000 times more opportunities and 1000 times more risk, and warned that much of the Fortune 500 still runs on legacy technology as AI-powered attacks expand the threat surface. Micron and SanDisk were also in focus on Micron's earnings day, with both trading at single-digit forward earnings multiples despite triple-digit revenue growth.

NetApp announced new capabilities that let enterprises activate data in place with zero-copy access to accelerate agentic AI adoption. The heterogeneous metadata capability of NetApp AI Data Engine now extends metadata discovery across the full enterprise data estate, including NetApp ONTAP, StorageGRID, and non-NetApp storage, spanning NFS, SMB, and S3 repositories. NetApp is also previewing upcoming AIDE innovations, including expanded AI-powered data understanding, deeper governance intelligence, open analytics integrations with engines such as Starburst and Onehouse.AI, and new agentic services. An expanded integration with Commvault connects the NetApp Platform to Commvault recovery orchestration, delivering near-real-time threat detection, cleanroom validation, and advanced clean recovery from the Commvault console, enabling joint customers to recover in minutes rather than days or weeks. Asad Khan, Senior Vice President and General Manager of AI at NetApp, said the agentic enterprise will be defined by how quickly and safely organizations turn data into intelligence, while Commvault Chief Technology and AI Officer Pranay Ahlawat said the integration helps customers reduce mean time to clean recover.

Crypto exchange Coinbase revealed by September 22 that it is developing a crypto custody system capable of supporting any post-quantum signature scheme blockchains may adopt in the future, in preparation for the risk of quantum computers cracking encryption. Yehuda Lindell, the company's head of cryptography, explained this in a video interview with the Mara Foundation. The company is upgrading its current custody infrastructure, which uses multi-party computation, so that it can withstand attacks by quantum computers, and is also considering an alternative approach using specialized devices called hardware security modules in case a signature scheme is adopted that multi-party computation cannot handle. According to the Mara Foundation, the company protects roughly 250 billion dollars' worth of digital assets centered on this system. On July 23, Coinbase explained on its official blog that its current key management system, CoreKMS, protects about 99.9 percent of its custodied assets, and that it is also developing a quantum-resistant version, PQ-CoreKMS, with plans to build an automated infrastructure within one year that can securely sign while distributing keys across multiple locations. Over the following two to three years, it aims to develop multi-party computation that does not require generating a complete private key even for quantum-resistant signatures.

Cohesity introduced Cohesity Agent Resilience, a new Cohesity Data Cloud capability that discovers, protects, and recovers the infrastructure behind enterprise AI agents, at its Cohesity Catalyst event. The capability is available now to select customers, with general availability targeted for the end of 2026, and launches with support for Amazon Bedrock AgentCore and Amazon Bedrock Agents, while Microsoft and Google agent platforms are on the roadmap. Cohesity also outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its five-step cyber resilience framework covering protection of data, identity, applications, and agents, recoverability, threat remediation, application recovery practice, and risk posture optimization. The company additionally introduced the Cohesity AI Resilience Academy, beginning with a free, self-paced Foundations of AI Resilience with Cohesity course of 25 to 30 minutes that Catalyst attendees can access early, exclusive to them for approximately two weeks before entering the broader Cohesity Academy catalog. Cohesity cited fifth annual Cohesity Global Cyber Resilience Report findings that 56% of organizations said they were not well prepared to detect or contain unintended actions by AI agents and automated workflows, and 58% were not very confident in verifying the integrity of AI models and related data after a cyberattack.

The National Cyber Security Agency, or NCSA, has unveiled its direction for driving Thailand's cybersecurity, moving to clear out technology debt and elevate organisations toward Cyber Resilience in order to counter threats in the AI era, while setting a goal of bringing government agencies and critical information infrastructure, or CII, to quantum technology readiness, or Quantum-Ready, by 2030. Air Vice Marshal Amorn Chomchoey, Secretary-General of the NCSA, said at an open talk stage hosted by OPEN-TEC, a technology knowledge hub under TCC Technology Group, that over the past 20 years IT systems were adopted rapidly without enough emphasis on security, resulting in Technology Debt, or accumulated vulnerabilities in legacy systems. The NCSA therefore proposed guidelines for raising cybersecurity through key principles, stressing that security must begin on day one of AI development, covering software and data use, model training, and post-deployment operations, alongside building Cyber Resilience that shifts from a prevention-only mindset to the ability to withstand, detect, respond to, and recover critical infrastructure systems such as energy, public health, transport, and financial services, as well as the Zero Trust principle, the Least Privilege principle, and public-private partnership. In addition, the NCSA has begun laying out guidelines to survey Cryptographic Libraries, upgrade Web Servers to support the TLS 1.3 standard, and plan a transition to quantum-resistant encryption systems, with the goal of bringing the public sector and key agencies to Quantum-Ready status by 2030. It is also organising the Thailand Cyber Top Talent activity to address the shortage of cybersecurity personnel and to exchange threat intelligence for early warning.

Commvault Systems has enabled its managed service provider partners to deliver FedRAMP High Authorized Commvault Cloud for Government services to U.S. federal agencies and defense contractors, broadening the company's public sector reach. The move lands on a stock with a 7 day share price return of 10.29% and a 90 day share price gain of 11.67%, though its 1 year total shareholder return is down 23.35% while the 3 year total shareholder return is up 111.68%. The most followed valuation narrative puts fair value at $161.15 against a last close of $145.21, implying roughly 10% upside, and rests on analyst expectations of about 10.6% annual revenue growth, profit margins rising toward 9.8%, and an 8.85% discount rate. That story leans on recurring SaaS economics, including 63% SaaS ARR growth, a 45% increase in multi-product customers, and 125% SaaS net dollar retention. A contrasting read notes the stock trades at a P/E of 88.1x versus 30.5x for the wider US Software group and a fair ratio of 38.7x, signaling valuation risk if sentiment cools.

Hackers have threatened Revolut with a ransom demand, seeking $3 million in Monero within 24 hours or they will expose the company's customer data. The hackers claim to be behind a cyberattack that leaked KYC and personal data of Revolut customers. The incident represents a significant security risk for the crypto company and its users, who must remain vigilant about the leakage of their personal data.

Japan's National Police Agency (NPA) said on September 10 that a total of 123 ransomware attacks were reported in Japan in the first half of this year, the highest half-year figure since record-keeping began in 2020. Of these, 79 targeted small and medium-sized enterprises (SMEs), 31 hit large companies, and 13 targeted other types of organizations. The NPA said more than half of all cases took over a month to recover systems, and 9 cases brought all business operations to a halt. Meanwhile, the number of detected suspicious accesses, often preparations for cyberattacks, rose by more than 4,000 per day per IP address compared with the same period a year earlier, reflecting the growing severity of cyber threats. The NPA has compiled half-year ransomware statistics since the second half of 2020. Ransomware is malware in which attackers demand a ransom in exchange for restoring access to a company's data, which has been encrypted and rendered unusable.

Commvault has introduced Active Directory Pre Recover, a solution that reduces the time to cleanly recover Active Directory from hours to minutes by creating a clean standby copy in an isolated Cleanroom environment. The solution, part of Commvault's Identity Resilience portfolio, uses existing technologies including Cleanroom and Threat Scan to ensure the standby copy is free of malicious content. Organizations can fail over to this clean copy during a cyber incident, maintaining access to critical systems without waiting for a full forest recovery. Commvault's Chief Products Officer, Rajiv Kottomtharayil, highlighted that identity is foundational to enterprise operations, and this innovation extends recovery progress toward near-real-time availability. Active Directory Pre Recover will be available for early access in the coming months, included at no extra cost for all enterprise AD customers, with a lite version of Cleanroom, and will be offered globally through Commvault's partner ecosystem.

Commvault announced on August 31 that its cyber recovery actions can now run as native steps inside CrowdStrike Holdings' Charlotte Agentic SOAR workflows, enabling security teams to trigger data recovery without leaving their incident response tools. This integration, the third leg of a broader CrowdStrike partnership, allows joint customers to restrict access, suspend backup data aging policies, and restore compromised assets into Commvault Cleanroom for forensics. The announcement follows Commvault's fiscal first quarter 2027 results reported on July 28, which showed subscription revenue of $267 million, up 16% year over year, and SaaS revenue crossing $100 million for the first time, up 39%. However, the company's GAAP operating margin was just 8.2% versus a non-GAAP figure of 22.8%, and its second-quarter guidance projects a non-GAAP EBIT margin of approximately 20%, a step down from the 22.8% delivered. Hedge fund ownership fell from 36 to 28 funds quarter over quarter, and short interest stands at 9.07% of float, while the stock trades at a forward P/E of 24.51 as of September 4.

Commvault has tripled the number of Microsoft Azure resource types its Cloud Rewind platform can protect and recover, expanding coverage to 62% of enterprise-relevant Azure resource types. The August 18 update follows fiscal first-quarter 2027 results reported on July 28, when subscription revenue rose 16% year over year to $267 million, subscription annualized recurring revenue reached $1,054 million, up 22%, and SaaS revenue crossed $100 million for the first time, up 39%. Free cash flow jumped 71% to $51 million, and the company struck a multi-year deal with Microsoft to sell its resilience tools as a native Azure service. However, GAAP operating margin was just 8.2% versus a 22.8% non-GAAP margin, and management guided second-quarter subscription revenue to $264–268 million, essentially flat, with full-year non-GAAP EBIT margin around 21%, below the 22.8% just posted. Hedge fund ownership fell from 36 to 28 funds, short interest stands at 9.07% of float, and the stock trades at a forward P/E of 24.51 as of September 4.

Cohesity, the AI and data security leader, has launched a new managed clean room capability within the HCLTech VaultNXT offering, integrating its Clean Room solution and AI-powered data security features to accelerate data recovery, improve regulatory compliance, and strengthen business resilience. The enhancement delivers a fully managed, isolated recovery environment with secure investigation, containment, validation, and recovery capabilities, addressing requirements such as DORA and NIS2. Kit Beall, Cohesity's chief revenue officer, said the partnership brings together market-leading managed clean room services and AI-powered data security to help customers recover trusted data faster and reduce risk. Rampal Singh, senior vice president of HCLTech's Hybrid Cloud Business Unit, noted that VaultNXT reflects the strength of the partnership in turning data protection into a strategic cyber resilience asset in the AI era.

Rubrik reported second-quarter fiscal 2027 results that exceeded all guided metrics, marking its tenth consecutive quarter of outperformance as a public company. Subscription ARR reached $1.66 billion, up 33% year-over-year, with net new subscription ARR of approximately $96 million, accelerating growth. Subscription revenue grew 37% to $407.2 million, and total revenue rose 38% to $427.3 million. The company also reported free cash flow of $65.7 million and raised its full-year subscription ARR guidance to $1.88 billion to $1.885 billion, reflecting about 29% growth. CEO Bipul Sinha highlighted the growing demand for agentic cyber resilience, citing the recent Hugging Face incident and the rise of AI-driven attacks, and noted that Rubrik now has over 15 paying customers for its Rubrik Agent Cloud product. CFO Kiran Choudary confirmed that the Strata Identity acquisition contributed zero ARR in the quarter and is not included in guidance.

Rubrik, Inc. (RBRK) reported strong fiscal second-quarter results and raised its full-year guidance, with subscription ARR reaching $1.66 billion and free cash flow of $65.7 million. The company now expects fiscal 2027 subscription ARR of $1.88 billion to $1.885 billion, up from a prior range of $1.854 billion to $1.862 billion, and free cash flow of $323 million to $333 million, up from $293 million to $303 million. For the third quarter, Rubrik guided revenue of $429 million to $431 million and non-GAAP EPS of $0.07 to $0.09. CEO Bipul Sinha attributed demand to AI-driven security needs, highlighting the company's push into "agentic cyber resilience," while CFO Kiran Choudary noted a $18 million headwind from material rights revenue. Analysts questioned the implied deceleration in net new ARR, but management expressed confidence, noting zero ARR contribution from the Strata acquisition and more than 15 paying customers for Rubrik Agent Cloud.

Commvault Systems shares have risen 11.6% since its fiscal first-quarter earnings report, outperforming the S&P 500. The company reported non-GAAP earnings of $1.42 per share, beating the Zacks Consensus Estimate of $1.18 by 20.3%, while revenues advanced 11.4% to $314.13 million. Subscription annual recurring revenues increased 22% to $1.05 billion, with SaaS revenues surging 39% to $100.55 million, crossing the $100 million quarterly threshold for the first time. Management raised its fiscal 2027 subscription revenue outlook to $1.119-$1.129 billion and increased non-GAAP EBIT margin guidance by 50 basis points to approximately 21%. The company also expanded its partnership with Microsoft, making its cyber-resilience capabilities available as a native independent software vendor service on Microsoft Azure.

Commvault Systems filed a US$449.32 million shelf registration for 3,374,000 common shares related to its employee stock ownership plan and announced a new integration bringing Google Threat Intelligence into its Threat Scan cyber resilience workflows. The company also upgraded inline malware scanning and added AI-enabled Synthetic Recovery enhancements. The shelf filing does not materially change the near-term story, which still hinges on sustaining subscription and SaaS ARR growth while managing margin pressure from the cloud mix. The Google integration deepens Commvault's role in helping customers identify uncompromised recovery points during cyber incidents, potentially supporting higher-value resilience-focused subscriptions but also adding complexity and spend. Commvault's narrative projects $1.6 billion revenue and $161.8 million earnings by 2029, requiring 10.6% yearly revenue growth and a $93.5 million earnings increase from $68.3 million today.

Rubrik is back in focus after partnering with Wipro on Enterprise Resilience as a Service, a new offering built on Rubrik's cyber and data resilience platform to address complex recovery and continuity needs. The stock trades at US$96.73, with a 7 day share price return of 14.05% and a 90 day share price return of 54.03%, while the 1 year total shareholder return is 9.82%. Rubrik's most widely followed narrative pegs fair value at $95.50, just below the recent close, while a discounted cash flow model comes out at $100.80, implying the stock is trading about 4% below that estimate. Bulls argue Rubrik's AI security push and recent share price jump justify a premium, while bears point to ongoing losses and rich expectations.

Commvault announced a new integration with Google Threat Intelligence to help organizations identify clean recovery points faster after cyberattacks. The integration incorporates Google Threat Intelligence data and scanning capabilities into Commvault Threat Scan workflows, enabling customers to analyze protected workloads for malware and pinpoint compromised recovery points. Commvault is also introducing inline scanning that collects file hashes during backup operations, allowing rapid threat intelligence validation and selective deeper analysis. These capabilities strengthen Commvault's Synthetic Recovery, which uses AI to automatically detect and remove threats during recovery. The new features are expected to be available in the coming months.

Catalogic Software has released DPX 4.16, adding agentless Proxmox virtual machine protection and expanded cyber resilience features to its enterprise backup and recovery platform. The update introduces agentless full and incremental backups, scheduling, and node management for Proxmox directly from the web UI, alongside existing support for VMware, Hyper-V, physical servers, and cloud workloads. Cyber resilience is strengthened with extended vStor end-to-end audit logging capturing REST and system-level actions, configurable retention, filtering, and CSV export for compliance and forensics, plus backup and restore of VMware VMs with vTPM encryption. Disaster recovery improvements include automated multi-VM restores when original volume information is unavailable and fully integrated Block Archive and VMware Archive restores in the modern web UI. Operational enhancements cover tape library management in the web UI, a unified ISO image for updates, volume migration with estimated completion time and suspend/resume, and optimized proxy selection for VMware agentless backups.

ControlMonkey has signed a Strategic Collaboration Agreement with Amazon Web Services to bring enhanced disaster recovery readiness and operational continuity to more businesses running cloud infrastructure on AWS. The collaboration will leverage ControlMonkey's cyber resilience platform, which helps organizations recover infrastructure states and SaaS configurations, complementing existing AWS resilience services such as AWS Resilience Hub, Amazon Application Recovery Controller, and AWS Backup. Industry research cited in the announcement estimates that unplanned downtime costs Forbes Global 2000 companies approximately $600 billion annually, with an average cost of $15,000 per minute of downtime. Through joint go-to-market initiatives and field collaboration, the partners aim to operationalize cloud recovery workflows with automated configuration capture, drift-aware recovery processes, and standardized restoration procedures across complex AWS estates.

Synology has revealed that the ISO 27001 standard is shifting from being merely a compliance certificate to a crucial foundation for enterprise risk management, building cyber resilience in an era of intensifying cyber threats. Mr. Rahat Boontanjin, Country Manager for Thailand, stated that 72 percent of organizations worldwide see cyber risk as significantly increasing, and 71 percent of risk executives expect threats to severely impact business operations. He pointed out that the rise of agentic AI is creating new forms of risk, so organizations should use ISO 27001 as a control framework across four key areas: role-based data access permissions, data accuracy governance, rollback systems for AI errors, and continuous security measure improvements. Although a 2025 OpenText survey indicates that 52 percent of global organizations plan to increase investment in backup technology, many still face real-world system recovery failures. Synology has therefore launched the ActiveProtect Appliance, a solution designed to support cyber resilience approaches and the new era of ISO 27001, integrating immutable backup, logical air-gap, and automated backup verification technologies to close recovery gaps and help Thai organizations tackle cyber threats in the AI age.