Clumio Cloud Recover Capability
Threat and Ransomware Detection
One verdict on every backup, with a report behind it.
See it work
Clumio CloudRecover Reporting Demo
See a backup scored, the signals behind the score, and the report an auditor can read.
Why it matters
Capability Benefits
Enable the ability to identify which copy is clean before you restore, without sifting through multiple alerts.
One verdict, not multiple alerts
Multiple signals correlate into a single answer per backup.
Enable the ability to identify which copy is clean before you restore
Every restore point carries a risk score and a confidence level, so you choose with validated information.
Reports an auditor can read
Each verdict lists its contributing signals and exports as a report to support compliance and incident response.
Baselines per asset, not global thresholds
Anomalies are measured against each asset’s own history, which helps reduce false alarms on busy workloads
Nothing to deploy on production
Detection runs inside the backup pipeline, agentless, and is designed to minimize impact on production systems.
Alerts where you already look
Email and alerts-API notifications, with every reported event on the asset’s Threats view and metrics.
Analyst recognition
Gartner® Magic Quadrant™
Commvault named a Leader in the Gartner® Magic Quadrant™ for Backup and Data Protection Platforms for the 15th consecutive time and ranked #1 in 5 of 6 Use Cases in the Critical Capabilities.
Behavioral baselines
Each asset builds its own history; every backup is measured against it, not a generic rule.
Multi-signal correlation
Looks for mass encryption, encrypted replacements, destructive deletion and ransom notes, together.
Explainable verdict reports
What happened, the score, recommended actions and detection details, downloadable per backup.
Related to this capability
ai recovery Solution
Clumio CloudRecover
Recovery built for the cloud. Validated at scale. Ready for AI.
Cloud Scale Rollback
Return billions of objects to a point in time, in place, with no extra copies.
Learn more
Air-gapped, immutable protection
Every copy isolated, immutable, and outside your account’s reach.
Learn more
Our Reach
Supporting more than 100,000 companies
Built for teams for whom clean recovery is critical
“Clumio solves a really important problem for us – providing the peace of mind that if we had a catastrophic failure or ransomware event, we will be able to get back up and running. ”
“When dealing with auditors, Clumio makes it easy to gather all the needed artifacts and information almost instantly, in a format that the auditors like. The time I need for this task has reduced from several hours to about 15 minutes. ”
Frequently Asked Questions
How do I know if there may be threats in a backup?
Every backup gets a verdict before you restore. Threat detection runs inside the backup pipeline, compares each backup against that asset’s own history, and correlates multiple signals before deciding, which minimizes the chance of anomalies triggering a false alarm. Each backup carries a risk score, a confidence level and a downloadable report showing which restore points appear clean.
Which workloads does threat detection cover?
Threat detection is available today for Amazon EBS volumes and EC2 instances, with Amazon S3 in early access. Coverage extends to Amazon S3 and Google Cloud Storage in December 2026, with further workloads expected to follow.
Does it scan my production systems?
No. Detection runs inside the backup pipeline on the data already being protected. There is nothing to install on workloads and it is designed to minimize impact on production performance; every backup cycle becomes a detection opportunity.
What happens when a backup scores high risk?
A Possible Threat Detected alert is raised, the event appears on the asset’s Threats view with a downloadable verdict summary report, and later restores from that point show a warning. The warning is informational and does not block the restore; you choose a clean point to restore from.
How is this different from the anomaly alerts other tools raise?
Most tools fire on single thresholds and leave the correlation to an analyst, which is how legitimate migrations can become false alarms. Threat detection compares each asset to its own history, requires several signals to agree, and returns one verdict per backup rather than a stream of alerts.
Data Risk Assessment
Are your cloud workloads at risk?
CloudRecover helps you find data vulnerabilities before attackers could exploit them. Get a CloudRecover Data Risk Assessment to help uncover risks in your cloud environment and gain a roadmap to stronger resilience.
