A backup can preserve the malware used in a ransomware attack. Assured Data Protection has introduced CleanRoom SCAN, a managed service that examines isolated backup data with multiple security engines before an organization restores it.
The service is intended to identify the most recent clean recovery point more quickly, giving recovery teams another layer of protection against reinfecting production systems.
Backups are not automatically safe
Ransomware recovery teams can spend days or weeks working through backup copies to find one that is genuinely clean. Assured identifies this search for the last known-good recovery point as one of the longest and most expensive parts of recovery.
The challenge is that no single security tool catches every threat. Endpoint protection, firewalls, threat detection systems and security operations tools rely on different threat intelligence, detection techniques and update cycles. One may identify a threat that another misses.
That gap can force teams to test multiple recovery points before finding a suitable restoration source. Every additional step adds time to an incident in which downtime can affect operations, finances and reputation.
CleanRoom SCAN is designed to narrow that search. It applies multiple independent security engines to isolated backup data, providing broader threat detection than organizations typically achieve with a single endpoint security platform.
How the managed scanning service works
The service scans replicated backups within Assured’s secure infrastructure, away from production environments. This isolation lets Assured look for malicious files and other indicators of compromise without adding scanning load to production systems.
For supported customers, CleanRoom SCAN independently verifies recovery points on a regular basis. Initial availability covers Rubrik-protected VMware environments.
When the service identifies malware or indicators of compromise that existing controls may have missed, Assured proactively alerts the customer. That notification gives the organization an opportunity to investigate and address the issue before choosing the recovery point to restore.
Its purpose is specific: identify a clean point from which systems can be restored. CleanRoom SCAN does not replace recovery planning or the wider work required to make a restored environment secure. A recovery process still needs to assess whether the attack extended beyond the threats found within the backup data.
Why multiple engines can improve confidence
A multi-engine approach is intended to compensate for blind spots between security products. Different engines use different intelligence, detection methods and update schedules, so applying several to the same backup can reveal threats that a single platform might miss.
That distinction matters during ransomware recovery. Restoring a candidate backup into production and discovering a problem afterward can cost more than testing the recovery data in isolation first. CleanRoom SCAN shifts that inspection away from live systems and provides another source of evidence when teams decide where to restore.
Multiple engines do not turn scanning into an absolute guarantee. The service can strengthen confidence in a recovery point, but customers still need to understand how findings are handled, what alerts mean and how suspected threats affect restoration decisions.
The operational trade-off is coverage. At launch, the service is limited to Rubrik-protected VMware environments. Organizations outside that combination cannot use the initial release, while current users must confirm whether their recovery architecture and procedures fit the supported model.
Who should care
Ransomware recovery and security teams** are the primary audience. The service directly addresses the need to find a clean recovery point without testing every candidate in production.
IT leaders accountable for resilience** should evaluate whether the added verification step can shorten recovery work. The relevant test is not simply whether alerts appear, but whether those alerts help teams rule out unsafe recovery points and act during an incident.
Organizations in Rubrik-protected VMware environments** can assess the service against their current availability, recovery-point and incident-response processes. Its value depends on how well isolated scanning fits with existing restoration procedures.
Critical business continuity organizations** should pay particular attention to the target use cases Assured identifies: financial services, insurance, public sector, gaming, transport and healthcare. These are environments where downtime can have significant operational, financial and reputational consequences.
Organizations outside the initial platform scope** should watch for broader availability before making procurement decisions based on the service.
What to watch next
Coverage is the first issue. Initial support for Rubrik-protected VMware environments will determine how many organizations can use CleanRoom SCAN. Broader support would expand its relevance for businesses with different backup and virtualization estates.
Evidence about performance will also matter. Recovery teams need to know how quickly the service can identify the most recent clean point, how reliably it flags threats missed by existing controls and how useful its alerts are during a time-pressured incident.
Organizations should also test where CleanRoom SCAN sits within their own recovery process. A clean recovery point is one component of a defensible restoration decision, not evidence that the entire attack has been removed. The broader environment still needs to be assessed for attacker access and other indicators of compromise.
CleanRoom SCAN offers a practical way to inspect isolated backup data with multiple security engines. Its central value is straightforward: it adds verification between possessing backups and confidently choosing where to restore.
Key takeaways
- CleanRoom SCAN scans replicated backups in isolation, reducing the risk of restoring malware into production.
- Multiple independent security engines can identify threats that a single existing tool may miss.
- Initial availability covers Rubrik-protected VMware environments.
- Finding a clean recovery point supports, but does not replace, the rest of the organization’s recovery process.
Frequently asked questions
What is CleanRoom SCAN?
It is an Assured Data Protection managed service that scans isolated backup copies with multiple security engines to identify malware and other indicators of compromise before restoration.
Does scanning backups affect production systems?
No. The service examines replicated backups within Assured’s secure infrastructure, without adding scanning load to production systems.
Where is CleanRoom SCAN initially available?
The initial release supports Rubrik-protected VMware environments.
Can CleanRoom SCAN guarantee a safe restoration?
No. It helps identify clean recovery points, but organizations must still complete the wider assessment required before restoring and reopening production systems.
What happens when the service finds a threat?
Assured proactively alerts the customer, allowing investigation and remediation before the affected recovery point is used.