In March 2026, NetApp, the vendor with the loudest claim to storage-native ransomware detection, announced alliances with Commvault and Elastio, two companies that work on the copies: backups and snapshots. That is the storage industry quietly answering the obvious buyer question: if the array can detect ransomware, is detection still needed anywhere else? The answer, from the vendor that sells the array-level engine, is yes.
This brief lays out what NetApp’s ARP/AI actually catches, what SafeMode from Everpure (formerly Pure Storage) does instead, why the two approaches are not interchangeable, and how the Commvault and Elastio deals settle the detection-versus-immutability argument. If you are budgeting a ransomware line item for FY27, this is the framing to take into the meeting.
What changed
Three things moved this from a feature-checklist debate to a strategy question. First, in June 2024 SE Labs tested NetApp’s Autonomous Ransomware Protection with AI (ARP/AI) on a technical-preview build of ONTAP 9.15.1 and gave it a AAA award, reporting 99% detection accuracy, 100% legitimate accuracy and a 0% false-positive rate. Second, NetApp backs its snapshot protection with a Ransomware Recovery Guarantee that offers “compensation if we cannot recover your protected Snapshot data,” with strings attached: eligible systems and a paid NetApp ransomware service subscription. Third, and most telling: on March 24, 2026 NetApp announced partnerships with Commvault and with Elastio, embedding Elastio’s Deep File Inspection of snapshots into its Ransomware Resilience Service and pairing ONTAP’s detection signals with Commvault’s recovery workflow.
The takeaway a VP can repeat: the vendor with a published third-party detection result just added two more layers around it. Read that as an admission of scope.
Why it matters
Ransomware economics turn on two clocks: time to detect and time to recover clean. Endpoint and network tooling owns the first clock until the attacker reaches your data. Once encryption starts hitting primary storage, the array is the last observer with a real-time view, and the first place a fast response can shrink the blast radius. NetApp says ARP/AI “detects the spread of most ransomware attacks after only a small number of files are encrypted” and creates a snapshot when it sees early signs of an attack. A detection that fires early, paired with a clean snapshot, is the difference between restoring a volume and rebuilding a data center.
Array detection has edges, though. It started as a file-workload story, and while NetApp’s documentation now says ARP/AI “supports both NAS (ONTAP 9.16.1 and later) and SAN (ONTAP 9.17.1 and later) volumes,” SAN volumes start with an evaluation period. Attackers who exfiltrate quietly, encrypt inside application-level containers, or go after your backups first may never trip that wire. That is why the immutability camp, where Everpure’s SafeMode sits, argues that guaranteed-clean copies matter more than clever alarms. Both camps are half right, which is exactly what the March deals confirm.
NetApp’s bet: detect at the array
ARP/AI runs on-box in ONTAP, using a pre-trained machine-learning model. On NAS FlexVol volumes it provides “immediate active protection with no learning period required,” a genuine improvement over the original ARP, which needed a 30-day learning mode for NAS FlexVol volumes. SAN is different. NetApp’s documentation is explicit: “A two- to four-week evaluation period is performed to determine baseline encryption behavior while ARP/AI provides immediate active protection for SAN volumes during the evaluation period.” When ARP/AI sees early signs of an attack it creates a locked snapshot and raises an alert, and from ONTAP 9.17.1 it also takes snapshots at fixed 4-hour intervals, so your recovery point lands close to the incident rather than at last night’s backup. The SE Labs result (AAA, 99% detection accuracy, 0% false positives on the ONTAP 9.15.1 preview build) is a published independent test of on-box detection, and NetApp cites the 99% figure on its AFF product page.
Where it is weaker: SAN coverage is recent, arrives with that evaluation period, and NetApp itself says “No ransomware detection system can guarantee complete safety.” A lab result on a defined sample set is not a guarantee against a patient adversary who throttles encryption below detection thresholds. The Recovery Guarantee is real money but reads like an insurance policy: eligible systems, a paid NetApp service subscription, NetApp-configured protection, or no payout. NetApp fits shops that are already ONTAP-centric with large unstructured estates, and it is the obvious pick when file-share ransomware is your top tabletop scenario. For the broader platform question, see the full Everpure (Pure Storage) vs. NetApp comparison.
Everpure’s bet: snapshots nobody can delete
Everpure, the company named Pure Storage until February 23, 2026, takes the opposite position: assume detection fails, and make the copies indestructible. Everpure says SafeMode-secured snapshots “cannot be deleted, encrypted, or modified even if admin credentials are compromised,” and that SafeMode is available on FlashArray and FlashBlade. On FlashArray, SafeMode blocks eradication for a configurable timer; Everpure’s FlashArray technical brief says the timer “can be extended up to 30 days.” Changing it means working through Everpure support with pre-registered contacts and PINs; permanent eradication takes a call with support and two authorized contacts. The same brief calls SafeMode “an easy, no-extra-cost feature,” which procurement will notice.
The honest critique runs the other way: SafeMode is containment, not detection. It tells you nothing while the attack is happening. Everpure does sell detection around it. Its Pure1 platform lists “anomaly detection” among its data protection tools, and Everpure’s threat detection page describes analyzing “storage I/O patterns to identify ransomware behavior” and feeding storage telemetry to SIEM, XDR and SOAR tools. Everpure also offers an Evergreen//One ransomware recovery SLA that provides “a guaranteed clean recovery environment.” But NetApp’s SE Labs report is the published third-party detection test in this comparison. The 30-day FlashArray ceiling also matters: if an attacker dwells longer than your timer, a locked snapshot of already-encrypted data is a very safe copy of garbage. Everpure fits block-heavy and mixed estates that want a guaranteed recovery floor with low operational overhead, and teams honest enough to admit they will not tune an alerting pipeline.
Detection vs. immutability, side by side
The verdict up front: NetApp leads on detection, Everpure leads on simplicity of containment, and neither closes the case alone.
| NetApp ARP/AI | Everpure SafeMode | |
|---|---|---|
| Core mechanism | On-box machine-learning detection of encryption behavior on NAS volumes (ONTAP 9.16.1 and later) and SAN volumes (ONTAP 9.17.1 and later) | Snapshots that cannot be deleted, encrypted, or modified even with compromised admin credentials |
| Third-party validation | SE Labs AAA award: 99% detection accuracy, 0% false positives (June 2024 test, ONTAP 9.15.1 technical preview) | Not a detection feature; protection comes from the lock design |
| Blast-radius effect | Shrinks it: snapshot when early signs of an attack are detected | Caps it: guarantees a floor to recover from |
| Coverage gap | SAN volumes start with a two- to four-week evaluation period; slow, throttled encryption | No alert from SafeMode itself; FlashArray eradication timer tops out at 30 days |
| Operational lift | Low to moderate: alerts need an owner and a runbook | Low: set the policy, size the snapshot capacity |
| Good fit | ONTAP shops, large NAS and unstructured estates | Block-heavy or mixed estates wanting a guaranteed recovery floor |
One cost note both sides underplay: aggressive snapshot policies consume real capacity, and SafeMode’s lock means a mis-sized policy cannot be walked back quickly. Everpure’s own SafeMode guidance for Epic customers says that if an array is 80% full or more, “it’s critical to discuss a capacity upgrade before turning on SafeMode.” Neither feature needs a separately priced add-on for most buyers: ARP support is included with NetApp’s ONTAP One license (other licenses apply without it), and Everpure calls SafeMode a no-extra-cost feature. The capacity to feed them is not free.
Does array detection replace backup scanning?
No, and the March 2026 announcements are the proof. NetApp’s Elastio deal embeds Elastio’s Provable Recovery Control into the NetApp Ransomware Resilience Service as “Powered by Elastio,” adding Deep File Inspection of ONTAP snapshots: actually opening and validating the data, not just watching write patterns, to “continuously identify the last known clean recovery points.” As of the March 24, 2026 announcement, the combined service was “planned for availability in the near future.” Elastio’s pitch is that a snapshot is not a recovery point until something has proven it clean, and NetApp just endorsed that pitch by building it into its own service. Ask about availability dates, vendor viability and the support path in diligence, but the capability itself is the missing piece between “we have snapshots” and “we can restore with confidence.”
The Commvault alliance answers the other half: recovery orchestration. NetApp describes “a closed-loop recovery architecture that combines early ransomware detection signals with an automated, validated recovery workflow at scale,” pairing ARP on primary storage with Commvault’s threat-aware backup and Synthetic Recovery. Commvault brings coverage across on-premises and cloud environments; the trade-off is another platform with its own operational footprint. The pattern to internalize: array detection shrinks the blast radius, immutable copies cap it, and backup-layer inspection proves your way out. Three layers, three different failure modes. The immutable backup storage comparison covers the second layer across vendors in detail.
What to do about it
- If you run ONTAP 9.16.1 or later with meaningful NAS estates, turn ARP/AI on now: it has a published independent test result and needs no learning period on NAS FlexVol volumes. On SAN volumes (ONTAP 9.17.1 and later), plan for the evaluation period. Assign an alert owner before you enable it, not after.
- If you run Everpure arrays, enable SafeMode this quarter, but size the eradication timer against your realistic incident-response timeline. Everpure’s FlashArray brief says most customers settle on 14 days, and the timer goes up to 30.
- Whichever array you own, do not cut backup-layer scanning from the budget. Array detection is a tripwire; it is not verification. If you cannot prove a recovery point is clean, treat it as unproven.
- If your board is asking about worst-case recovery, evaluate an isolated recovery environment as the fourth layer. The cyber recovery vault comparison breaks down who does that well.
Frequently asked questions
Can a storage array detect ransomware?
Yes. NetApp’s ARP/AI detects encryption behavior in real time on NAS volumes (ONTAP 9.16.1 and later) and SAN volumes (ONTAP 9.17.1 and later, which start with an evaluation period), and takes locked snapshots when it fires. Slow, throttled encryption and attacks that start with your backups remain hard for any array-level engine to see, which is why array detection is a layer, not a strategy.
Is NetApp ARP/AI better than Everpure (Pure Storage) SafeMode?
They solve different problems. ARP/AI is real-time detection with a published third-party test; SafeMode is deletion-proof containment with little operational overhead. A NAS-heavy ONTAP shop gets more from ARP/AI; a block-heavy estate gets more from SafeMode. Mature programs want both capabilities, from whichever vendors they run.
Is backup ransomware scanning still needed if the array has detection?
Yes. Array detection watches write behavior; backup-layer tools like Commvault and Elastio inspect the data itself and prove recovery points are clean. NetApp’s own 2026 partnerships with both companies signal that even strong array-level detection is one layer in a defense-in-depth design.
How accurate is storage-level ransomware detection?
The published independent number is SE Labs’ June 2024 test of NetApp ARP/AI on a technical-preview build of ONTAP 9.15.1: 99% detection accuracy (3,585 of 3,635 attacks detected) with zero false positives, earning a AAA award. Treat lab numbers as an upper bound: real estates include workloads and attacker behaviors no test set covers.
Enterprise Techie sends vendor-honest analysis like this once a week. Get the brief by email, free.
Buying? Start from RFPhub’s free Immutable Backup and Cyber Recovery Vault RFP template.