Ransomware auto-heal · Built for IT teams & MSPs

Ransomware hits. VaulTrust heals in seconds.

Detect ransomware-like encryption across VMware, Hyper-V, and SAN snapshots — verify with ML anomaly scoring — then auto-heal the workload from an immutable WORM snapshot. No operator all-hands meeting required.

Talk to salesSee how it works
Why VaulTrust

Four outcomes your on-call rotation feels in the first incident

Detection, isolation, restoration, and proof — the four promises each incident review asks the platform to keep.

Detect in seconds
Heuristic rules watch in-guest write-rate and entropy, and an ML anomaly score confirms the burst before the human notices the encryption job running.

Trips before backup jobs do

Auto-quarantine the VM
Native vSphere isolation kicks the affected workload offline before the encryption spreads laterally — no operator all-hands meeting required.

VMware-native isolation

Restore from WORM snapshot
An M-of-N quorum of distinct approver kinds signs the revert; the orchestrator mounts the last clean immutable snapshot in seconds.

Last clean state, replayable

Audit-trail every transition
Every detection, quarantine, and restore is a RestoreLog row the operator can replay later for compliance — no silent auto-magic.

Replayable for the auditor

How it works

Detect → Verify → Auto-heal from WORM snapshots

Three auditable steps. Each one writes a row the operator can review later. No silent auto-magic — every transition is a recoverable decision.

  1. Step 1 · Detect
    Heuristic rules spot ransomware-like writes
    In-guest telemetry streams write-rate, entropy, and file-type churn to a static-rule engine. A burst of encrypted writes against production data crosses the threshold before the human notices.

    src/components/custom/integrity-feed.tsx

  2. Step 2 · Verify
    ML anomaly score confirms it is ransomware, not a backup job
    Each candidate is scored against a baseline learned on your own workloads. The status dashboard surfaces a per-target anomaly score so the operator never has to second-guess a rule trip.

    src/components/custom/integrity-anomaly-panel.tsx

  3. Step 3 · Auto-heal
    Mount the immutable WORM snapshot. You are done.
    An M-of-N quorum of distinct approver kinds signs off; the orchestrator restores the workload from the last clean WORM snapshot in seconds. The RestoreLog row records every transition for audit.

    prisma/schema/restore-log.prisma

Coverage

Built for the platforms your IT team already runs

VaulTrust talks native protocols to the snapshot providers beneath every VMware and Hyper-V estate, then scores each candidate against an ML baseline learned on your own workloads.

SAN snapshots

NetApp, Pure, Dell — every commit lands on WORM-locked media

jobs/integrity-scan.js

VMware vSphere

Native REST client + soft-quarantine via the vSphere API

prisma/schema/quarantine.prisma

Microsoft Hyper-V

WMI probe scans every VM; RestoreLog records the revert

prisma/schema/detection.prisma

ML anomaly scoring

Per-target baseline learned in production; scored in seconds

src/components/custom/integrity-anomaly-panel.tsx

Talk to sales

Tell us about the workloads you can’t lose

Whether you’re a regulated enterprise, an MSP managing workloads across multiple customers, or a small IT team that just wants their VMware estate to self-heal — we’ll scope a quote that fits.

  • Purposes built for IT teams + MSPs — no shopper-cart flow
  • Reply within one business day from a named sales engineer
  • Custom SLAs, data residency, and procurement (MSA / BAA / FedRAMP) on request

Prefer email? Reach us directly at vaultrust-usa@polsia.app.

Send us a note
We’ll reply within one business day with next steps.

Looking for the deeper Enterprise FAQ & procurement forms? Visit the full contact page →