Embedding Google Threat Intelligence reduces response time and operational friction for backup security, a critical need as ransomware targets immutable data stores. The move strengthens Cohesity’s competitive stance in the enterprise data protection market.
The convergence of data protection and threat intelligence is reshaping how enterprises safeguard backup environments. By weaving Google Cloud Threat Intelligence into the Cohesity Data Cloud interface, the vendor eliminates the need for separate security tools, delivering a unified view of malicious artifacts directly where backups are managed. This approach mirrors a broader industry shift toward consolidating observability and response capabilities, allowing IT teams to prioritize remediation over tool‑hopping.
Google Private Scanning adds a privacy‑first sandbox layer that detonates suspicious files without exposing raw data to external analysis engines. The service hashes and tokenizes content, then matches it against Google’s constantly refreshed indicator database, returning risk scores while preserving confidentiality. For organizations bound by strict data‑sovereignty rules, this method offers compliance‑friendly threat hunting, reducing the attack surface of restored systems that might otherwise re‑introduce hidden malware.
Cohesity’s rollout arrives as competitors Rubrik and Commvault have already integrated Google feeds, intensifying the race for differentiated security value. The inclusion of FortKnox on Google Cloud further deepens Cohesity’s multi‑cloud strategy, appealing to enterprises seeking a single pane of glass across AWS, Azure, and Google environments. As ransomware evolves toward low‑and‑slow tactics, the ability to instantly contextualize threats within backup data will likely become a decisive factor in vendor selection, driving further innovation in integrated security‑first data management solutions.
Cohesity adds Google Cloud Threat Intelligence to Data Cloud UI and integrates Private Scanning for secure malware detonation

Cohesity is adding Google Cloud’s Threat Intelligence feature to the user interface of the Cohesity Data Cloud, and using Google Private Scanning in its sandbox function to securely detonate malware.
The Cohesity Data Cloud software includes products/services such as DataProtect, FortKnox, DataHawk, SmartFiles, SiteContinuity, and NetBackup, accessible through a single interface and running on Red Hat Linux. It’s available either as a Cohesity‑managed service, self‑managed on certified platforms, or partner‑managed service. Certified platforms include VMware, Nutanix and Windows Hyper‑V. The FortKnox managed cybervault is now available on Google Cloud.
Cohesity has progressively strengthened its Google Cloud relationship, expanding its data protection portfolio, widening its AI capabilities, and adding new data sovereignty and cybersecurity features last December. Earlier, in April that year it integrated its Gaia GenAI search assistant with Google’s Gemini models and Agentspace, started using Google Threat Intelligence, and worked with Google‑owned Mandiant on incident response and cloud‑based recovery. Now it is adding another layer of integration.

Vasu Murthy.
Cohesity Chief Product Officer Vasu Murthy said:
“Undetected malware hidden in backup data can both reinfect restored systems and, when properly scanned, reveal low‑and‑slow attacks that evade traditional detection.
By integrating Google Threat Intelligence, including Google Private Scanning, directly into the interface of Cohesity Data Cloud, we’re giving customers exceptional visibility and context into potential threats and powerful new ways to assess and eliminate risk—without fragmenting workflows or introducing operational complexity.”
Google’s Private Scanning allows users to analyze files and URLs with Google Threat Intelligence in a privacy‑preserving fashion. Cohesity says that, by embedding Google Threat Intelligence access directly into Cohesity Data Cloud and using Private Scanning, it’s enabling real‑time threat intelligence and secure malware detonation through a central management system, streamlining workflows between IT and security teams and enabling faster, more confident responses.
The teams can “rapidly assess suspicious files using the latest indicators of compromise (IOCs), reputation data, and threat details without switching tools or relying on manual handoffs.”
Competitors Commvault and Rubrik also have integrations with Google Threat Intelligence. Rubrik receives daily feed updates from Google Threat Intelligence for scanning backups/snapshots for IOCs, anomaly detection, and proactive threat identification. This Rubrik‑Google partnership includes clean‑room recovery on Google Cloud.
The embedded Google Threat Intelligence and secure sandbox analysis capabilities are now generally available in Cohesity Data Cloud. Check out this blog for more information.
Comments
Want to join the conversation?
Loading comments...