Month: September 2026

Today, IBM has released Storage Defender version 2.2.2. The headline news in this significant product update is the powerful integration between IBM Data Resiliency Service (DRS) and Predatar’s Recovery Assurance CleanRoom. This collaboration brings totally unique capabilities that will supercharge operational resilience for IBM Storage customers.

This short article explains what the new integration means and why it matters.

Let’s start with why.

For any organization, downtime hurts. Whether it’s caused by a cyberattack, a system failure, human error, or something else – there’s no shortage of real-world stories where businesses have taken months to get back to BAU following an unexpected operational outage. In fact, there’s no shortage of stories where businesses simply didn’t survive the fallout in the weeks and months that followed one.

When an outage occurs – and the services that your organization runs on stop working – the first hours are crucial. But all too often IT teams find themselves facing into these incidents having never actually recovered these complex applications and digital services before.

Sure – they’ll have a recovery plan to follow. But the chances are, it’s never actually been tested. There’s a lot that can go wrong – and it often does.

Corrupted, encrypted or infected data will derail your recovery – while complex interdependencies can mean if servers aren’t restored in the correct sequence – applications will repeatedly fail to come back. Would you want to be figuring all of this out in the middle of a high-pressure, high-stakes situation?

What organizations really need is proof. They need proof that their most important services can be recovered quickly, cleanly, and completely. Importantly, they need to have that proof before they find themselves in a crisis.

This is the challenge that IBM and Predatar are solving together. This is what the Storage Defender 2.2.2 release is all about.

Proof. Not Promises.

Proving your business is resilient isn’t just a good idea; it’s quickly becoming a necessity for many regulated organizations – particularly in the financial services sector and those that operate critical infrastructure.

Regulatory bodies are increasingly demanding evidence of the efficacy of the resilience plans and controls that have been put in place.

Previously, documents like recovery plans, recovery guarantees, and SLAs (Service Level Agreements) which specified Recovery Time Objectives and Recovery Point Objectives were considered enough to demonstrate that an organization was taking resilience seriously.

Now regulators have recognized that these documents are meaningless unless the claims they make have been put to the test.

Insurance providers are catching on too – and big changes are coming in the cyber insurance market. Organizations that can’t demonstrate their resilience may find themselves exposed – hit with bigger premiums, or even discovering that they are unable to claim against some types of cyber incident.

---

---

Proof. Done properly.

Lots of technology vendors are racing to solve these important challenges. But buyers beware – not all proof is equal. There’s three important things to know when assessing potential solutions:

Restore is not recovery.
Testing individual servers or file systems proves very little. Your important business services are built from multiple servers, databases and storage volumes often spread across fragmented platforms – and they only come back if every component is restored in the right order.

Real proof means actually completing end-to-end recovery of services, within a measured recovery time – even if its components reside across platform technologies.

Clean is not always recoverable.
Malware scanning tells you a backup or snapshot is safe. It doesn’t tell you if it is incomplete, corrupted, or incapable of booting.

The only way to be sure is to actually recover it and power it up.

Yesterday’s pass is not today’s proof.
Patches, upgrades and day-to-day operations mean that your IT environment is changing every day. An annual or quarterly DR test that was completed yesterday is already out of date.

Proof has to be continuous.


These are the challenges that IBM’s Data Resiliency Service and Predatar are uniquely placed to solve.

Introducing the Proof Engine.

No one technology vendor has solved this complex problem end-to-end. That’s why IBM and Predatar joined forces.

While the project to integrate Predatar with DRS started almost a year ago, and some of the foundational development work shipped earlier this year in the Storage Defender 2.1.2 release – today’s release is what really makes the vision a reality for DRS customers.

By integrating Predatar’s unique Recovery Assurance CleanRoom technology with DRS, IBM has created a Proof Engine – an AI-powered capability at the heart of your Operational Resilience that will quietly and continuously recover your most important digital services into an isolated validation environment – 24/7.

DRS users will now see the Predatar CleanRoom as a first-class source type in the DRS interface. They can schedule automated recovery testing and malware scanning of the backups that make up the recovery groups that DRS has defined.

Every recovery runs in Predatar’s isolated CleanRoom. The results get logged as evidence against the business applications they support. It works across Storage Protect and Defender Data Protect, with support for some non-IBM backup platforms too.

DRS already detected threats, mapped dependencies and provided a powerful governance platform. What Predatar brings is proof of recovery. With Storage Defender 2.2.2, DRS can show that recovery works, continuously, with no engineering effort once the schedule is set.

Start your journey to proven resilience

To learn more about proving recovery in your business with IBM Data Resiliency Service – Powered by Predatar, speak to your IBM storage rep, your Authorized IBM Business Partner, or contact Predatar.

Read the release notes for IBM Storage Defender version 2.2.2

Change is imminent in the cyber insurance market. Businesses with cyber insurance policies need to know what’s coming down the tracks – or risk finding themselves exposed.

For years, the proposition for cyber insurance has been relatively straightforward: demonstrate sensible security controls, complete an annual questionnaire, pay the premium and transfer part of your cyber risk to an insurer.

That model is beginning to break down.

AI is creating risks faster than insurers can model them. And one compromised supplier, cloud platform or software component can affect thousands of organisations simultaneously.

Insurers are responding by becoming more selective about the risks they accept, more precise about what their policies cover and more demanding about the evidence organisations must provide. The message for business leaders is blunt:

Cyber insurance will not compensate for weak operational resilience.

Increasingly, organisations will need to prove that they can contain disruption, recover critical services and return to business safely.

From risk transfer to risk reduction

Cyber insurance was once primarily a financial instrument. Its purpose was to soften the economic impact of an attack by covering costs such as incident response, legal support, data restoration and business interruption.

Those protections remain important. But insurers now understand that the quality of an organisation’s resilience directly affects the size of a loss.

Two similar businesses can suffer the same ransomware attack and experience radically different outcomes. One restores critical services within hours. The other discovers that its backups are compromised, its recovery plan is outdated and nobody knows which systems to restore first. One has an incident. The other has a crisis.

This is why insurers increasingly want more than evidence of preventative controls such as multi factor authentication and endpoint protection. They want to know whether an organisation can continue operating – and recover – when those controls fail.

A Forbes Technology Council analysis describes this as a shift from pure risk transfer towards active risk reduction. It anticipates more continuous risk scoring, closer collaboration with cybersecurity providers and policies that respond to changes in an organisation’s risk posture.

That direction makes sense. A questionnaire records what an organisation believes is true on renewal day. Continuous testing shows what is actually true throughout the year.

AI will make vague coverage harder to sustain

AI is increasing the urgency of this transition. It is lowering the cost of sophisticated attacks, accelerating reconnaissance and helping criminals operate at greater scale. Businesses are also embedding AI into workflows and products that insurers have limited historical data with which to assess.

The insurance industry will not simply absorb that uncertainty.

The Financial Times reports that insurers including QBE and Beazley have been developing policy language to limit certain AI-related losses. Approaches include specific sub-limits and tighter wording, rather than necessarily excluding every incident involving AI.

The direction of travel is therefore not towards a universal “AI attack exclusion.” It is towards greater precision.

Insurers will separate risks they understand from those they do not. They will define limits more carefully, ask more detailed questions and expect policyholders to demonstrate control. That same logic will apply to recovery. If a business claims it can restore critical services within a certain timeframe, an insurer may reasonably ask:

When was that last proven?

Business interruption is the real loss

Cyber risk is often described in technical language: vulnerabilities, malware, identities and threat actors.

Boards and insurers experience it in business terms.

Can the company take orders? Can a hospital access clinical systems? Can a manufacturer restart production? How long will customers tolerate disruption?

According to Munich Re’s Cyber Insurance: Risks and Trends 2026, business interruption remains one of the principal drivers of cyber-insurance reimbursements. This is why Recovery Assurance matters.

The financial consequences of an attack are not determined solely by whether an attacker gets in. They are shaped by the organisation’s ability to identify clean recovery points, restore the right systems in the right order and return them to production without reintroducing the threat.

A backup is not a recovery.
A recovery plan is not a tested recovery.
A contractual recovery target is not proof that it can be achieved during a crisis.

The recovery gap is becoming an insurance issue

Many organisations have invested heavily in backup and storage. Fewer can independently demonstrate that their critical services are recoverable at the speed the business expects.

Backups may contain dormant malware. Recovery dependencies may be incomplete. Procedures may rely on unavailable people or infrastructure. Testing may cover individual systems rather than complete business services.

Traditional disaster-recovery exercises provide only a snapshot. Modern environments change constantly: applications are updated, dependencies move, data grows and threats evolve.

Resilience cannot be established once a year and assumed to persist. It must be continuously verified.

Proven resilience changes the conversation

Recovery Assurance gives leaders something more valuable than another plan. It provides evidence.

It enables an organisation to demonstrate that critical backups and snapshots have been tested, hidden threats investigated, and workloads restored and validated in an isolated environment before returning to production.

For insurers, that supports a more accurate view of risk. For boards, it strengthens confidence in recovery objectives. For operational-resilience teams, it exposes weaknesses before an emergency does.

This evidence does not guarantee lower premiums or the acceptance of a claim. Those decisions depend on the insurer, policy wording and complete risk profile.

But it changes the conversation. Instead of asserting that recovery should work, the organisation can show what was tested, when it was tested and what happened.

Five questions leaders should ask

Business leaders should not wait for the next insurance renewal to investigate recovery readiness:

1. Which business services must be restored first?
2. Can we prove that their recovery data is clean?
3. When did we last recover them successfully?
4. Did the test include the complete service and its dependencies?
5. Can we present the evidence clearly to boards, regulators and insurers?

If the answers are unclear, the organisation has found more than an insurance problem. It has found a business-resilience problem.

Insurance is the backstop. Recovery is the strategy.

Cyber insurance remains essential. It can provide financial protection, specialist support and access to expertise when an organisation is under pressure.

But insurance cannot reopen a factory, restore a customer platform or prove that yesterday’s backup is free from malware. A payout cannot return the time lost during a prolonged recovery.

As cyber risks become faster and harder to model, insurers will increasingly reward clarity and contain uncertainty. Expect tighter wording, deeper underwriting questions and greater demand for credible evidence.

The organisations best prepared for this future will not be those with the longest recovery plans or the most optimistic targets. They will be the ones that can prove – continuously and independently– that their critical services will come back.

The future of cyber insurance will be shaped by evidence. The future of resilience must be proven.

---

Discover how Predatar makes continuous recovery testing and governance a reality with AI and automation.

Visit Predatar.com

---