The checkmark lied.

A resilience check can say "success" and still be lying to you.

Here's a fun fact nobody puts on a t-shirt: attackers don't actually care how they get in. Not the platform, not the provider, not the front door you thought was locked. They just want a way in, and lately, they don't even need malware to find one.

But here's the part that should really get your attention. Getting in isn't the finish line for them. It's the starting gun. The second they're inside, they go looking for whatever's supposed to bring you back, and they're patient about it. We spent 17 months proving exactly how, using 53 live ransomware strains and zero assumptions.

So this week is about the whole chain. The door they walked through. What they went hunting for once they were inside. And why none of it matters if the data underneath your next big AI move can't hold up under pressure.

They don't care which door you left open. They just want a door.

Picture this. You've locked down Active Directory. You've got Entra ID buttoned up. Every identity provider you run deserves that same level of attention, Okta included.

Attackers have already noticed the gap when one exists. 82% of attacks detected last year didn't even bother with malware. Why hack in when you can just log in? Steal a credential, walk through like you own the place, and nobody blinks.

We weren't going to let any door go uncovered.

• Field-level rollback, so when someone fat-fingers a policy at 4pm on a Friday, you fix that one thing instead of rebuilding the whole tenant
• Threat detection that goes looking for trouble, catching weak admin MFA and sketchy session settings before an attacker does
• Recovery in minutes, not a war room

Every identity provider deserves the same lock. Now they all get one.

Say they get in anyway. Here's what happens next, and it's not what you think.

They're not going for your files first. They're going for whatever's supposed to save you.

We spent 17 months proving it. Cohesity REDLab detonated 53 live ransomware strains against real infrastructure and mapped every single move. Same playbook, every time. Find the recovery layer. Grab the credentials. Kill the tools meant to bring you back. Then, and only then, go after the data.

We're calling it the Anti-Backup Kill Chain, and once you see it, you can't unsee it.

Here's the twist that should genuinely unsettle you. A recovery job can run, finish, report success, and still be sitting on encrypted files the whole time. We watched it happen. Green checkmark. Total lie.

• Zero out of 53. Not one strain touched an immutable snapshot. Not one.
• The checkmark can lie, but the data can't. Anomaly detection caught the drift in file counts and entropy before anyone hit restore
• 18 seconds. That's how long it took to sweep 11 production-scale clusters for threats hiding in plain sight

A job finishing isn't the same as a job you can trust. Scan first, or you're just archiving the ransomware for later.

None of this matters if the data underneath your AI can't be trusted, and that's the part everyone's skipping.

Here's the thing about AI nobody wants to say out loud. It's only as good as the data you hand it. Feed it corrupted, exposed, or missing data, and you don't just get a bad answer. You get an agent making the wrong call with real consequences.

So we're not sitting this one out. We joined the Open Secure AI Alliance and the Open Weights and American AI Leadership initiative, right alongside NVIDIA and Microsoft . Open models are exciting. They still need somewhere solid to stand.

• The same research protecting your recovery layer protects your AI pipelines too. REDLab's intelligence doesn't stay in one lane
• Open doesn't mean unguarded. Identity controls and tested recovery don't take a vacation just because the model is open-weight
• Our Enterprise AI Resilience strategy means you get to move fast on AI without losing the ability to bounce back if it goes sideways

Everyone's racing to build with AI. We're making sure there's solid ground to build on.

Upcoming events

• August 4-6: Black Hat Booth #4543
• August 10-14: [In-Person Classroom Training] Dublin, Ireland NetBackup IT Analytics 11.2: Administrationopens in a new tab
• August 20: [In-Person Classroom Training] Pune, India Cohesity Data Protection Operations
• August 31-September 3: Crowstrike Fal.Con 2026
• September 16-17: Cohesity Catalyst

Thanks for reading! Find all issues of the Security Spotlight on LinkedIn here. Hit "Subscribe" so you never miss another update.

Why Cohesity? Cohesity protects, secures, and provides insights into the world's data. As the leader in AI-powered data security, Cohesity helps organizations strengthen resilience, accelerate recovery, and reduce IT costs. With Zero Trust security and advanced AI/ML, Cohesity Data Cloud is trusted by customers in more than 140 countries, including 70% of the Global 500. Cohesity is also backed by industry leaders such as NVIDIA, Amazon, Google, IBM, Cisco, and HPE. Cohesity is certified as a Great Place to Work in multiple countries.