Ransomware auto-heal · Built for IT teams & MSPs

Ransomware hits. VaulTrust heals in seconds.

Detect ransomware-like encryption across VMware, Hyper-V, and SAN snapshots — verify with ML anomaly scoring — then auto-heal the workload from an immutable WORM snapshot. No operator all-hands meeting required.

Request a technical evaluationExplore Detect → Verify → Recover
Why VaulTrust

Four outcomes your on-call rotation feels in the first incident

Detection, isolation, restoration, and proof — the four promises each incident review asks the platform to keep.

Detect in seconds
Heuristic rules watch in-guest write-rate and entropy, and an ML anomaly score confirms the burst before the human notices the encryption job running.

Trips before backup jobs do

Auto-quarantine the VM
Native vSphere isolation kicks the affected workload offline before the encryption spreads laterally — no operator all-hands meeting required.

VMware-native isolation

Restore from WORM snapshot
An M-of-N quorum of distinct approver kinds signs the revert; the orchestrator mounts the last clean immutable snapshot in seconds.

Last clean state, replayable

Audit-trail every transition
Every detection, quarantine, and restore is a RestoreLog row the operator can replay later for compliance — no silent auto-magic.

Replayable for the auditor

How it works

Detect → Verify → Auto-heal from WORM snapshots

Three auditable steps. Each one writes a row the operator can review later. No silent auto-magic — every transition is a recoverable decision.

  1. Step 1 · Detect
    Heuristic rules spot ransomware-like writes
    In-guest telemetry streams write-rate, entropy, and file-type churn to a static-rule engine. A burst of encrypted writes against production data crosses the threshold before the human notices.

    src/components/custom/integrity-feed.tsx

  2. Step 2 · Verify
    ML anomaly score confirms it is ransomware, not a backup job
    Each candidate is scored against a baseline learned on your own workloads. The status dashboard surfaces a per-target anomaly score so the operator never has to second-guess a rule trip.

    src/components/custom/integrity-anomaly-panel.tsx

  3. Step 3 · Auto-heal
    Mount the immutable WORM snapshot. You are done.
    An M-of-N quorum of distinct approver kinds signs off; the orchestrator restores the workload from the last clean WORM snapshot in seconds. The RestoreLog row records every transition for audit.

    prisma/schema/restore-log.prisma

Coverage

Built for the platforms your IT team already runs

VaulTrust talks native protocols to the snapshot providers beneath every VMware and Hyper-V estate, then scores each candidate against an ML baseline learned on your own workloads.

SAN snapshots

NetApp, Pure, Dell — every commit lands on WORM-locked media

jobs/integrity-scan.js

VMware vSphere

Native REST client + soft-quarantine via the vSphere API

prisma/schema/quarantine.prisma

Microsoft Hyper-V

WMI probe scans every VM; RestoreLog records the revert

prisma/schema/detection.prisma

ML anomaly scoring

Per-target baseline learned in production; scored in seconds

src/components/custom/integrity-anomaly-panel.tsx

For backup engineers

Evaluate your recovery workflow with VaulTrust

Ask a focused technical question about recovery testing, restore validation, or ransomware response. Share your environment and a backup engineer will follow up with practical next steps.

  • No account or signup required to start the conversation
  • Share the environment you want to evaluate and the recovery question behind it
  • Follow-up by email with a clear path for the next technical discussion

Prefer email? Reach us directly at vaultrust-usa@polsia.app.

Request a technical evaluation
Tell us what you run and what you need to prove.

Need an Enterprise quote or procurement help instead? Visit the full contact page →