RSAC 2026: Cohesity Enhances Cyber Resilience with Next-Generation Malware Scanning Powered by Sophos

Key Takeaways

• Sophos engine integrated directly into Cohesity Data Cloud.
• Detects zero‑day, polymorphic, fileless malware in backups.
• Incremental scanning runs during backups, pre‑restore, and IOC triggers.
• No extra Sophos license required for Enterprise Edition.
• Scan results feed into SIEM and SOAR platforms.

Summary

Cohesity announced native integration of Sophos next‑generation malware scanning into its Data Cloud platform. The feature, included with the Enterprise Edition, detects zero‑day, polymorphic and fileless threats hidden in backup data without requiring a separate Sophos license. Scans run incrementally during backups, on demand before restores, and when IOCs or YARA matches appear, providing continuous validation of recovery points. The integration also pushes results to SIEM and SOAR tools for coordinated response.

Pulse Analysis

Ransomware attacks have evolved from encrypting live data to compromising backup repositories, turning what was once a safety net into a liability. Organizations now face the paradox of needing to restore data quickly while ensuring that the restored copies are free of hidden malware. By embedding Sophos’s next‑generation antivirus directly into the Cohesity Data Cloud, the company addresses this dilemma, offering a unified platform where backup and security converge, eliminating the need for separate scanning solutions.

The Sophos engine leverages a blend of signature databases, heuristic analysis, and AI‑driven behavioral modeling to spot threats that evade traditional defenses. Its incremental scanning architecture inspects newly ingested data in near‑real time, minimizing performance impact, while pre‑restore scans verify the integrity of recovery points before they are used. Integration with IOC and YARA triggers ensures that any emerging indicators automatically prompt deeper inspection, creating a continuous feedback loop that keeps detection capabilities current without manual intervention.

From a business perspective, this integration differentiates Cohesity in a crowded data protection market. Customers gain confidence that their disaster‑recovery processes won’t become a vector for reinfection, reducing downtime and potential compliance penalties. Moreover, the automatic forwarding of scan results to SIEM and SOAR platforms streamlines security operations, enabling faster containment and remediation. As enterprises increasingly adopt hybrid and multi‑cloud strategies, having a single pane of glass for backup integrity and threat intelligence will be a decisive factor in vendor selection.