Fast forward to June – we’re happy to add UK Cyber Essentials to the list of supported standards, and to thank Aimie and Gary for highlighting the gap.

What is UK Cyber Essentials?

UK Cyber Essentials is a government-backed certification scheme overseen by the UK National Cyber Security Centre (NCSC). It defines a baseline set of security controls to help organizations protect against common internet-based attacks.

How StorageGuard helps

StorageGuard automatically gathers configuration data from storage and backup systems and validates it against Cyber Essentials requirements. It provides a clear status view, along with detailed evidence showing how each requirement is (or isn’t) met.

You can generate evidence-backed compliance reports – including the underlying configuration data – and quickly prove compliance. When deviations are found, StorageGuard highlights them with actionable guidance, including recommended steps or commands, surfaced in the UI, via email, or integrated with ITSM workflows.

About Dell and StorageGuard

StorageGuard is part of the Dell Technologies Extended Technologies Complete (ETC) partnership program. It complements the Dell portfolio by providing security posture management – including configuration drift management – across both Dell and non-Dell storage and data protection systems.

Through this ETC program, Dell customers can more easily access and evaluate StorageGuard in the context of their existing environments.

Review a recent joint Dell + Core6 customer story – Dell and Core6 Strengthen Storage Security for Global Insurer

Frequently Asked Questions (FAQs)

What is UK Cyber Essentials?

UK Cyber Essentials is a UK government-backed cybersecurity certification scheme that helps organizations protect against common cyber threats by implementing a baseline set of security controls. It is overseen by the National Cyber Security Centre (NCSC).

How does UK Cyber Essentials apply to storage and backup infrastructure?

While Cyber Essentials does not focus exclusively on storage and backup systems, many of its requirements relate to secure configuration, access control, vulnerability management, and system hardening. Storage and backup platforms play a critical role in meeting these requirements and supporting cyber resilience.

How can organizations assess Cyber Essentials compliance for storage systems?

Organizations can assess compliance by reviewing storage and backup configurations against Cyber Essentials requirements, identifying configuration gaps, documenting evidence, and implementing remediation actions where needed.

What evidence does StorageGuard provide for Cyber Essentials audits?

StorageGuard generates detailed compliance reports that include configuration settings, assessment results, identified deviations, and supporting evidence that can help simplify Cyber Essentials audit preparation and reporting.

The post Adhering to UK Cyber Essentials for Storage & Backup Infrastructure appeared first on Core6.

What started as a conversation about GPUs and infrastructure performance has evolved into something much broader: data growth, cyber resilience, recovery readiness, governance, and entirely new architectural approaches. 

These themes were front and center during a recent Storage Leaders Virtual Panel, which brought together experts from Dell Technologies, NetApp, Hitachi Vantara, IBM, Infinidat (Lenovo), and VAST Data to discuss how AI is changing the way organizations think about storage. 

While the panelists represented different vendors and viewpoints, there was remarkable agreement on one point: Storage is no longer just about storing data. It’s becoming the foundation on which enterprise AI initiatives succeed – or fail. 

Storage Has Moved to the Center of the AI Conversation 

One of the most striking observations of the discussion was how dramatically the storage conversation has changed over the past 18 months. 

According to Itzik Reich, VP Mission Alignment at VAST Data, storage discussions used to be confined to infrastructure teams and procurement departments. Today, CTOs, Chief Data Officers, AI leaders, and even board members are involved because storage has become directly tied to AI outcomes. 

The metric that increasingly matters isn’t IOPS or throughput. It’s GPU utilization. 

Patrick Fay, AI Storage Product Manager at IBM reinforced this shift from another angle. AI is creating unprecedented pressure on infrastructure supply chains. The industry started by worrying about GPU shortages. Then memory became constrained. Now storage is experiencing similar pressures as demand drives up the cost of NAND and HDD capacity. 

AI Doesn’t Create One Storage Problem. It Creates Four 

According to Itzik, every phase of the AI lifecycle stresses storage differently. 

• Training: Metadata often becomes the bottleneck before throughput. 
• Checkpointing: Massive bursts of write activity can leave GPUs idle while waiting for storage. 
• Inference: Latency matters more than average performance. 
• RAG: Storage must simultaneously act as a data lake, database, and vector store. 

Patrick highlighted an additional challenge: organizations are dramatically underestimating how much data AI will generate. Many enterprises are seeing datasets expand several times over through embeddings, metadata, and AI-generated outputs. 

The Biggest Gap Isn’t Technology. It’s Architecture 

Felix Jorge, Field CTO at Hitachi Vantara argued that the biggest challenge isn’t technology. It’s architectural intent. 

Legacy environments were designed around predictable workloads and gradual growth. AI changes those assumptions completely. 

Organizations can no longer rely solely on capacity forecasting and periodic refresh cycles. Instead, they must design architectures that adapt continuously. 

Ransomware Has Moved Beyond Encryption 

Adam Gale, Field CTO – AI & Security at NetApp observed that modern attacks are increasingly becoming three-stage operations: breach and encrypt, exfiltrate data, and corrupt recovery mechanisms. 

Felix expanded on this trend, explaining that attackers are increasingly targeting backup infrastructure, replication paths, recovery environments, privileged accounts, and immutable storage copies. 

The goal is no longer simply disruption. It’s the destruction of confidence in recovery. 

Most Organizations Overestimate Their Recovery Readiness 

Aimie Coole, Field CTO – Europe at Dell Technologies noted that many organizations assume recovery will work when needed. Unfortunately, that assumption is often wrong. 

Common issues include missing incident response plans, untested recovery procedures, outdated runbooks, poor communication processes, end-of-life infrastructure, and insufficient telemetry. 

As Aimie summarized: Most organizations test for backup success, not operational recovery success. 

Eric Herzog, CMO at Infinidat (Lenovo) took this argument further, encouraging organizations to treat cyberattacks as disasters and practice recovery accordingly. 

Storage Still Has a Visibility Problem 

Aimie argued that while storage teams generally have good visibility into capacity, availability, and performance, many have limited visibility into identity risks, privileged account exposure, configuration drift, recovery readiness, and backup security posture. 

Eric reinforced this point, arguing that storage teams are too often excluded from broader cybersecurity initiatives despite managing the vast majority of enterprise data. 

AI Is Both the Threat – And the Defense 

Adam brought an important note of optimism to the discussion. 

His view: We are entering a golden age of cyber resilience. 

For the first time, defenders have access to AI-powered tools capable of identifying anomalies, accelerating investigations, and strengthening security at scales that would previously have required thousands of analysts. 

At the same time, AI introduces new risks, including AI-generated phishing, deepfake impersonation, voice cloning, and data poisoning. 

The Future of Storage 

The session concluded with a discussion about storage refresh cycles. 

Patrick believes AI-focused storage infrastructure may evolve faster than traditional storage environments. Felix argued that organizations should focus less on refresh cycles and more on building architectures that can evolve incrementally over time. 

Final Thoughts 

Storage is no longer simply an infrastructure layer. 

It’s becoming a performance platform for AI, a control point for cyber resilience, a governance and compliance layer, and a business continuity dependency. 

The future of storage will be defined by an organization’s ability to balance performance, protection, and resilience simultaneously. 

Watch the recording of the Storage Leaders Virtual Panel at https://www.core6.com/resources/storage-leaders-virtual-panel-storage-in-the-ai-era-performance-protection-resilience/

Frequently Asked Questions (FAQs)

What is AI-ready storage?

AI-ready storage is storage infrastructure designed to support AI and machine learning workloads, including model training, inference, checkpointing, and retrieval-augmented generation (RAG). It must deliver high performance, low latency, scalability, and cyber resilience.

Why is cyber resilience becoming a storage issue?

Storage and backup systems have become primary targets for ransomware attacks. If attackers compromise storage, backups, or recovery systems, organizations may be unable to restore critical business services after an attack.

What is storage security posture management?

Storage Security Posture Management (SSPM) is the practice of continuously assessing the security configuration of storage and backup systems to identify: exposure to vulnerabilities and security advisories, security misconfigurations, configuration drift, compliance violations, and missing security controls

What should infrastructure leaders prioritize when preparing storage for AI?

Infrastructure leaders should focus on: performance, data management, cyber resilience, recovery readiness, security posture management, governance and compliance, and scalability.

The most successful organizations treat performance, protection, and resilience as equally important requirements.

The post Storage in the AI Era: What Enterprise Leaders Are Learning About Performance, Protection & Resilience  appeared first on Core6.

For years, storage and backup systems have been the most overlooked part of the cybersecurity stack.

When people talk about security, they talk about endpoints, identities, networks, firewalls, AI threats, and whatever acronym people invented this week. Storage? It mostly sits quietly in the corner, doing its job.

Until ransomware hits.

Suddenly everyone remembers that storage and backup systems are the last line of defense between a bad day and a very bad day.

That’s one of the reasons we’re especially excited that Frost & Sullivan named Core6 the recipient of its 2026 Customer Value Leadership Award in the Global Storage Protection Industry.

Wait. Storage Protection Is An Industry Now?

That’s actually one of the biggest takeaways from the report.

For years, organizations assumed their storage and backup infrastructure was secure enough. But attackers have gotten smarter, environments have become more complex, compliance requirements have multiplied, and AI is generating more data than ever.

The result? Storage security has become a real challenge – and one that many traditional security tools simply weren’t designed to address.

As Frost & Sullivan puts it, organizations need continuous visibility into their storage and backup environments, not just occasional assessments or generic security scans.

So Why Did Core6 Win?

According to Frost & Sullivan, it’s because we focus on a problem that many vendors still overlook.

The report highlights StorageGuard’s ability to:

• Continuously identify security and compliance gaps across storage and backup environments
• Improve ransomware resilience
• Simplify compliance reporting
• Deploy quickly without agents or disruption
• Integrate into existing operational workflows
• Support the leading storage and backup platforms enterprises already use (Dell, NetApp, Hitachi Vantara, HPE, Infinidat (Lenovo), IBM, Brocade (Broadcom), Rubrik, Cohesity, Commvault, Veeam, VAST Data, etc.)

In other words: less guesswork, fewer blind spots, and a lot less manual effort.

The Part We’re Especially Proud Of

One thing Frost & Sullivan repeatedly calls out is customer value.

Not marketecture.

Not buzzwords.

Not “the future of synergistic AI-powered digital transformation.”

Actual customer value.

The report notes that organizations can gain visibility into storage security risks quickly, automate many previously manual processes, and reduce the operational burden associated with compliance and security validation.

As marketers, we’re supposed to love phrases like “customer value leadership.”

As humans, we just like hearing that customers can sleep a little better at night.

And Then We Added AI

Because apparently every blog post in 2026 needs an AI section.

But in our case, it’s actually relevant.

Frost & Sullivan highlighted the new StorageGuard AI Platform, which helps organizations interact with their storage security environment using natural language, automate tasks, and accelerate remediation.

The goal isn’t to replace administrators.

It’s to help them spend less time hunting for problems and more time fixing them.

The Bigger Picture

This award isn’t just recognition for Core6.

It’s recognition that storage and backup security matter.

The systems that store your most critical business data shouldn’t be the security team’s blind spot. They deserve the same visibility, governance, and protection as every other part of the environment.

We’re grateful to Frost & Sullivan for the recognition and even more grateful to the customers who have been telling us this was a problem worth solving long before the industry started paying attention.

After all, when ransomware hits, nobody asks whether your storage infrastructure was exciting.

They just hope it was protected.

Download the full report, ‘Frost & Sullivan 2026 Global Storage Protection – Customer Value Leadership’

Frequently Asked Questions (FAQs)

Why are storage and backup systems becoming a cybersecurity priority?

According to Frost & Sullivan, attackers increasingly target storage and backup systems because compromising recovery infrastructure can make ransomware attacks more effective. At the same time, organizations face growing compliance and audit requirements, making continuous validation essential.

What problem does Core6 solve?

StorageGuard – by Core6 – helps organizations identify and remediate security risks, compliance gaps, and misconfigurations across enterprise storage and backup infrastructure – areas that are often overlooked by traditional cybersecurity tools.

Which storage and backup vendors does StorageGuard support?

Frost & Sullivan highlights support for leading platforms including Dell, NetApp, IBM, HPE, Hitachi Vantara, Cisco, VMware, Nutanix, Cohesity, Commvault, Rubrik, VAST Data, Broadcom, and Veeam.

What does Frost & Sullivan mean by “Customer Value Leadership”?

The award recognizes companies that deliver a strong combination of customer outcomes, innovation, operational efficiency, and return on investment. Frost & Sullivan concluded that Core6 delivers significant value through automation, compliance validation, ransomware resilience, and ease of deployment.

The post We Didn’t Expect Storage Security to Be Cool Either. Then Frost & Sullivan Called. appeared first on Core6.

That shift is one of the biggest implications of the current AI wave. Across the industry, security leaders are recognizing that frontier AI models are changing the economics of cyber risk: discovery is faster, validation is faster, and the time defenders have to assess and respond is getting shorter.

Public research and industry discussion continue to show how AI can accelerate security analysis, including vulnerability discovery and validation. For security teams, the practical implication is clear: response windows are getting shorter, and infrastructure controls need to become more continuous.

For organizations running Oracle ZFS Storage Appliance (ZFSSA), this matters for a simple reason:

Storage is no longer just an operational platform. It is part of the attack surface.

Core6 recently expanded StorageGuard support to Oracle ZFS Storage Appliance, enabling organizations to assess Oracle ZFS environments for security misconfigurations, compliance gaps, and exposure to known vulnerabilities.

The goal is straightforward: to help improve visibility, support hardening, and enable more continuous assessment of resilience of an infrastructure layer that many security tools still fail to cover deeply.

That is also the focus of this joint webinar between Oracle and Core6, which centers on hardening and compliance for Oracle ZFSSA with StorageGuard.

The real issue is not just vulnerabilities. It is the shrinking exploit window

Security teams have long operated with an assumption that they would have some time: time to discover a weakness, time to prioritize it, time to patch it, and time to validate the fix.

AI is compressing that timeline.

As both defenders and attackers operate at higher velocity, the window between vulnerability discovery and potential exploitation continues to shrink. This challenges traditional security models built on periodic reviews, and reinforces the need for continuous hardening alongside faster, more responsive remediation.

That does not mean the answer is hype, panic, or treating every storage platform as an emergency.

It means infrastructure and security teams should rethink where they have blind spots – especially in storage and backup systems, which are mission-critical, often under-monitored, and highly consequential if compromised.

Extending security posture management to Oracle ZFS environments

Oracle ZFS environments often sit at an important point in enterprise data infrastructure: close to valuable data, deeply tied to resilience and recovery, and operationally central to the business.

As organizations modernize security operations, extending visibility, configuration assessment, and drift detection to storage infrastructure can help teams manage risk more consistently across critical systems.

In Oracle ZFS environments, StorageGuard enables teams to autonomously validate configurations, detect drift from secure baselines, assess exposure to vulnerabilities, and take guided remediation actions – helping teams identify and prioritize risks before weaknesses can contribute to incidents.

In other words, the answer to AI-accelerated risk is not a single feature. It is a tighter operating model:

• Know what your Oracle ZFS environment looks like now
• Detect when it drifts from a secure baseline
• Identify where vulnerabilities and configuration weaknesses intersect
• Prioritize remediation faster
• Re-validate changes continuously

That becomes even more important in environments where storage supports regulated workloads, recovery operations, or broader cyber resilience programs.

Where AI can help defenders. Safely

There is also a constructive side to this shift.

StorageGuard is not about replacing operational discipline. It is about helping teams move faster within controls.

StorageGuard enables teams to use AI to investigate risks, validate compliance, review and apply hardening recommendations, and generate insights through natural-language interaction.

These capabilities are delivered with built-in guardrails, including role-based access control, scope limitation, no direct system access, and controls designed to help protect sensitive data, within an architecture where customers retain full control over their LLM environment.

That distinction matters.

In a storage environment, speed without guardrails is not helpful. But speed with policy control, scope limits, and auditability can make a real difference – especially when teams need answers quickly:

• Which Oracle ZFS systems have drifted from baseline?
• Which findings matter most right now?
• Where do current settings create resilience or compliance risk?
• What should be fixed first?

Those are exactly the kinds of questions AI can help teams answer faster, provided the underlying data is authoritative and the operating model remains controlled.

A more realistic way to think about AI and storage security

The Mythos conversation has captured attention because it makes the broader trend impossible to ignore:

AI is increasing the pace of both discovery and response.

For Storage and Infrastructure leaders, the takeaway is not that every headline should trigger a strategy rewrite. It is that storage can no longer sit outside modern security operations.

If Oracle ZFS supports critical workloads in your environment, then visibility, hardening, and continuous validation belong on the security agenda – in addition to the storage team’s agenda.

That is why this topic matters now. And that is why the Oracle and Core6 conversation around Oracle ZFS security is timely: it is not about marketing a feature in isolation. It is about helping organizations bring a critical layer of infrastructure into a more modern, continuous security model.

If you’d like to go deeper, join this joint webinar with Oracle and Core6 on Oracle ZFS resilience and compliance, taking place on 24^th June.

Frequently Asked Questions (FAQs)

What does Core6’s support for Oracle ZFS Storage Appliance mean?

Core6’s support for Oracle ZFS Storage Appliance (ZFSSA) extends StorageGuard’s ability to secure, harden, and continuously validate Oracle-based storage environments. It also reflects deeper alignment with Oracle, positioning Core6 within a key enterprise ecosystem and enabling organizations to better protect mission-critical data with continuous security posture management.

What problem does StorageGuard solve for Oracle ZFS environments?

StorageGuard addresses a key gap: storage systems are rarely monitored with the same rigor as servers or endpoints. It provides visibility into vulnerabilities and exposures, continuous security posture validation, and detection of misconfigurations and drift.

How is this different from Oracle’s built-in capabilities?

Oracle provides strong infrastructure, performance, and patching tools. StorageGuard adds: security posture management, continuous compliance validation, and multi-vendor visibility across storage environments. It complements – not replaces – native Oracle capabilities.

What are the most common risks in Oracle ZFS environments?

Security misconfigurations, lack of continuous validation, exposure to unpatched vulnerabilities, and limited visibility into compliance posture. These gaps increase the risk of ransomware impact and data loss.

The post Why Oracle ZFS Security Matters More in the Age of AI appeared first on Core6.

The first wave of CVEs linked to Anthropic’s Claude Mythos Preview is now beginning to emerge. Several sit inside the components that storage and backup products are built on – TLS libraries, kernel subsystems, cryptographic providers, BSD-derived protocol stacks.

Vendor advisories specific to storage and backup have been limited so far.

What follows is our informed assessment of seven CVEs we believe warrant attention. The assessments below are based on previously reported advisories in storage and backup products and on public information about each CVE. They are not confirmed vendor guidance.

Based on this assessment, we also outline practical mitigation considerations and recommended next steps for storage and backup environments.

CVE-2026-31402 – Linux Kernel nfsd Heap Overflow

Critical, kernel.org: 9.8

A remote, unauthenticated attacker can corrupt kernel memory by sending two coordinated NFSv4.0 lock requests that overflow a buffer in the NFS server.

Linux underpins many storage and backup platforms (NAS controllers, backup appliances, HCI nodes). Exposure depends on whether the product uses in-kernel nfsd or a user-space implementation such as NFS-Ganesha. As a precaution, treat Linux-based systems serving NFS as potentially affected until vendors confirm otherwise.

CVE-2026-5194 – wolfSSL Certificate Validation Flaw.

Critical, NVD: 9.1

A signature verification flaw affecting both classical (ECDSA, Ed25519, Ed448) and post-quantum (ML-DSA) algorithms in wolfSSL could allow forged digital identities. Patched in 5.9.1; the bug had been present since 2017.

wolfSSL has appeared in past storage and backup security advisories. While this does not confirm exposure to CVE-2026-5194, it indicates that some vendors may embed the library and is a reason to investigate.

CVE-2026-5588 – Bouncy Castle BC-JAVA Signature Validation Flaw.

High, Redhat: 7.5

A signature verification flaw in Bouncy Castle’s post-quantum certificate code, patched in BC-JAVA 1.84. Most applications don’t use the affected path. More notable in the same release: CVE-2026-3505 (PGP DoS) and CVE-2026-5598.

Bouncy Castle has appeared in past storage and backup vendor advisories. Without a Software Bill of Materials (SBOM), exposure is hard to assess – and fixes arrive only when the vendor ships a refreshed build.

CVE-2026-28386 – OpenSSL AES-CFB-128 Out-of-Bounds Read. 

Critical, CISA-ADP: 9.1

An out-of-bounds read leading to denial of service, affecting systems running on modern x86-64 CPUs with AVX-512. Fixed in OpenSSL 3.6.2 and backports. AES-CFB-128 is uncommon in modern TLS but still appears in S/MIME and some IPsec deployments.

Given OpenSSL’s ubiquity, most vendors will need to assess this – even if urgency is limited by the DoS-only impact – and likely issue an advisory.

CVE-2026-5398 – FreeBSD TIOCNOTTY Use-After-Free.

High, CISA-ADP: 8.4

A local privilege escalation via a dangling pointer in FreeBSD’s terminal handling. Patched in FreeBSD-SA-26:10.tty. Realistic exploitation requires chaining with another vulnerability that provides initial access. FreeBSD-derived storage and backup appliances may be affected.

CVE-2026-6386 – FreeBSD amd64 Local Privilege Escalation

Medium, CISA-ADP: 6.2

Another local privilege escalation issue (FreeBSD-SA-26:11.amd64). Like CVE-2026-5398, it becomes meaningful when combined with an initial foothold, potentially enabling full system compromise.

CVE-2026-4747 – Remote Code Execution in FreeBSD NFS/RPCSEC_GSS

Critical, CISA-ADP: 8.8

We covered this in depth in our previous post. A long-standing stack buffer overflow in RPCSEC_GSS. While patched prior to Mythos, it was highlighted by Anthropic as part of Mythos’s autonomous exploit generation capability. Huawei and NetApp have both published notices confirming their products are not affected.

What to Watch for Next

We expect storage and backup vendors to publish impact assessments as analysis progresses. Monitor vendor security advisory channels closely over the coming weeks.

Five Things To Do While Waiting for Vendor Guidance

These CVEs share a pattern: they affect embedded components in the data and management planes. That shapes the mitigation posture.

1. Start with inventory. Before applying controls, know what you actually have. Build a list of which storage and backup systems are exposed to NFS, expose management interfaces, run Java-based management planes, or are FreeBSD-derived.
2. Revisit protocol hardening. The protocol-level recommendations from our previous post – NFS access restriction, network segmentation, export policy hardening — remain applicable and are worth revisiting in light of this broader pattern.
3. Prefer NFSv4.1+ where possible. CVE-2026-31402 specifically affects NFSv4.0. NFSv4.1 and later use a different session model that doesn’t go through the vulnerable code path.
4. Harden TLS and certificates. Replace broad public CA trust with an internal CA and a small, explicit allowlist. Enable mutual TLS where supported.
5. Isolate the management plane. Restrict management access to the minimum necessary. Block management interfaces on non-management network interfaces. Isolate the management plane at the network level.

Ask Your Vendors for an SBOM

All of these CVEs originate in foundational components and embedded dependencies – not in vendor product code itself.

Without a Software Bill of Materials, determining exposure is difficult before vendors issue advisories.

Ask your vendors for an SBOM, and if they can’t provide one, ask them specifically whether their products include the affected components. A targeted question is more likely to get a useful answer today than a broad SBOM request.

Keeping Pace with Faster Disclosure

This batch is an early indicator of how AI-assisted vulnerability research will reshape disclosure – more CVEs, surfacing faster, in deeper layers of the stack. Before advisories arrive, the only defense is continuous hardening and configuration discipline. Once they land, what matters is the speed of identifying affected systems and prioritizing remediation. Periodic checks won’t keep pace. This is where Core6 focuses with StorageGuard – continuous, real-time posture awareness for storage and backup systems.

For official guidance, refer directly to your storage & backup vendors’ security advisory pages.

References:

• Tracking CVEs Attributed to Anthropic Researchers and Project Glasswing | Blog | VulnCheck
• GitHub – patrickmgarrity/Anthropic-Credited-CVEs: Tracking Vulnerabilities That Appear to be Credited to the Anthropic Research Team · GitHub
• freebsd.org/security/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc
• NetApp Product Security – NTAP-20260410-0014
• NetApp Statement Regarding Anthropic Disclosure and Mythos Research Model
• CVE-2026-5588 – Red Hat Customer Portal

Frequently Asked Questions (FAQs)

What should you ask your storage or backup vendor right now?

Instead of asking broadly, ask targeted questions:

• “Do your products include wolfSSL / Bouncy Castle / OpenSSL versions affected by these CVEs?”
• “Are you using in-kernel NFS or a user-space implementation?”
• “Are any products based on FreeBSD and affected by SA-26 advisories?”

Also request: SBOM (Software Bill of Materials). This is the fastest way to validate risk across your environment.

How will AI-driven vulnerability discovery change storage security?

Expect:

• More CVEs
• Faster disclosure cycles
• Vulnerabilities in deeper infrastructure layers

Traditional approaches (quarterly reviews, manual audits) will struggle to keep up.

New requirement:

• Continuous visibility into storage security posture
• Real-time detection of configuration risks and exposure

What is the biggest takeaway for storage and backup teams?

These CVEs highlight a shift:

• Risk is increasingly in dependencies, not product code
• Exposure exists before vendor advisories are published

Actionable takeaway:

• Focus on hardening, segmentation, and visibility
• Reduce reliance on reactive patch cycles
• Speed up identification of affected systems

The post Anthropic-Associated CVEs Worth Watching for Storage and Backup appeared first on Core6.

CVE-2026-4747, a remote code execution (RCE) vulnerability in the FreeBSD NFS/RPC stack, is one of the early vulnerabilities publicly highlighted by Anthropic in connection with Claude Mythos Preview - their frontier AI model announced April 7, 2026.

While the vulnerability was patched by FreeBSD before the Mythos launch, Anthropic featured it as a demonstration of Mythos’s ability to autonomously construct sophisticated, working exploits for deeply embedded protocol-level flaws.

While Mythos has reportedly identified many vulnerabilities across software stacks, this case is notable because it targets core infrastructure protocols that are deeply embedded in enterprise storage environments. 

What Was Discovered? 

CVE-2026-4747 affects the NFS / RPCSEC_GSS (Kerberos-backed) implementation, and under certain conditions, the vulnerability may allow a remote attacker to achieve root-level code execution.

Triggering the overflow does not require prior authentication at the RPC level, but successful exploitation depends on specific configuration and exposure—including access to the NFS service and the use of RPCSEC_GSS (Kerberos) functionality. 

Key characteristics:

• Located in core NFS/RPC protocol handling 

• Present in production code for many years 

• Triggered via network-accessible services 

Taken together, these characteristics indicate this is not an edge-case issue but a flaw in foundational protocol logic. 

Why This Matters for Storage 

This should not be viewed narrowly as a FreeBSD issue. 

1. Some storage platforms retain FreeBSD lineage 

Some of the leading enterprise storage platforms have evolved from BSD-derived foundations, particularly in their networking and protocol implementations. 

2. FreeBSD contributed to NFS/RPC implementations 

FreeBSD and earlier BSD systems have long maintained widely used NFS and RPC implementations that are still foundational in storage environments today. The vulnerability affects a specific implementation of NFS/RPC, but similar flaws may exist in other implementations of the same protocol. 

3. NFS is ubiquitous in storage and backup 

NFS remains a core protocol across: 

• NAS systems 

• Backup appliances 

• Data protection repositories 

• Archive / object gateways 

Similar classes of vulnerabilities may exist in other storage systems that implement NFS/RPC, regardless of whether they run FreeBSD, Linux, or proprietary operating systems. 

 Who Is Potentially Affected? 

While CVE-2026-4747 is confirmed in FreeBSD and already patched in FreeBSD, broader exposure may include: 

• Storage systems with FreeBSD lineage 

• Platforms implementing NFS with RPCSEC_GSS / Kerberos authentication 

• Backup systems exposing NFS services 

• Storage environments with long-lived or lightly modified protocol stacks 

We expect storage and backup vendors to assess exposure internally and issue security advisories where applicable. Huawei and NetApp, for instance, already announced their products are not affected. Early community discussions, such as the one in the TrueNAS forums, have already surfaced concerns about exposure in storage platforms running older FreeBSD versions, particularly where patch adoption may lag. 

 What Should You Do in the Meantime? 

Focus on exposure reduction and protocol hardening: 

• Restrict NFS access 
  Limit to trusted internal networks; avoid external exposure 

• Segment storage networks 
  Isolate storage, backup, and management traffic 

• Harden export policies 
  Enforce least privilege; avoid overly broad or wildcard exports 

• Use Kerberos correctly  
  if RPCSEC_GSS is required in your environment, prefer krb5i or krb5p – but audit whether it is actually needed before assuming it provides protection here. 

• Minimize attack surface 
  Disable unused protocols and services; close unnecessary ports 

• Monitor for anomalous behavior 
  Watch for unusual RPC/NFS traffic patterns and authentication activity 

And Of Course, Patch When Available 

As Storage and Backup vendors release security advisories and fixes: 

Apply patches or firmware updates as soon as they are available and validated. 

Given the nature of this vulnerability – remote, protocol-level, and long-lived - timely remediation is critical. 

What Mythos Signals for Storage Security 

This is only a first glimpse of how tools like Mythos will impact IT security. Early reports already point to a significant increase in the volume of vulnerabilities being discovered across software stacks. The bigger question becomes: how do we protect storage and backup systems in this reality? 

Before advisories and patches are available, prevention relies on continuous hardening and configuration discipline. Without ongoing validation, it is difficult to ensure that critical controls – such as restricting NFS access, enforcing correct Kerberos configurations, limiting exposed services, and tightening management access – are consistently applied and remain effective over time.

Configuration drift becomes a primary risk factor. 

Once an advisory is published, organizations can begin impact analysis to identify affected systems. And when a patch becomes available, the process shifts to testing, change control, and deployment. 

At this stage, speed becomes critical: 

• How quickly can you determine exposure across your environment? 

• How fast can you understand mitigation steps and compensating controls? 

• How effectively can you prioritize and remediate? 

These challenges call for greater automation and continuous visibility – moving beyond periodic checks to real-time posture awareness, an area we’re actively focusing on at Core6 with StorageGuard. 

Summary 

CVE-2026-4747 is not just about FreeBSD. It highlights a broader shift: 

AI – including models well below the frontier – can now detect deeply embedded vulnerabilities in foundational protocols. Mythos Preview demonstrated that frontier AI can go further, autonomously constructing working exploits, but the discovery capability itself is increasingly broad-based. 

This is a signal that core IT infrastructure layers must now be continuously re-examined. 

Frequently Asked Questions (FAQs)

Why did Anthropic mention CVE‑2026‑4747 in the Claude Mythos Preview?

Anthropic highlighted CVE‑2026‑4747 as an example of Mythos’s ability to autonomously build a working exploit for a deeply embedded, protocol-level flaw. Even though FreeBSD patched the issue before the Mythos launch, the showcase signaled a shift: advanced AI can accelerate discovery and exploitation of foundational infrastructure vulnerabilities.

Why is this vulnerability relevant to enterprise storage and backup systems?

Because NFS remains ubiquitous across:

• NAS platforms
• Backup appliances
• Data protection repositories
• Archive systems and gateways

When a vulnerability targets network-accessible, long-standing protocol implementations, it can affect storage environments broadly—even if only one OS vendor has a confirmed CVE at first.

What immediate mitigations help reduce exposure before patches are available?

The most effective “now” actions are exposure reduction and hardening:

• Monitor for anomalies (unusual NFS/RPC traffic and auth behavior)

• Restrict NFS access to trusted internal networks (avoid external exposure)

• Segment storage networks (separate storage, backup, and management traffic)

• Harden exports (least privilege; avoid broad or wildcard exports)

• Minimize attack surface (disable unused services; close unnecessary ports)

What should storage teams do when security advisories arrive?

A practical sequence looks like:

• Rapid rollout: deploy fixes quickly, prioritizing exposed and high-value systems

• Impact analysis: identify potentially affected systems and configurations

• Compensating controls: enforce segmentation and restrictive access while evaluating

• Patch planning: test firmware/OS updates under change control

The post One of the First Public Mythos Showcases – and Its Impact on Storage  appeared first on Core6.

And then AI started to change the economics of attack.

AI didn’t invent ransomware or exploitation – but it compressed time, expanded scale, and lowered the cost of finding weak systems. The result is something we’re starting to see play out: attackers no longer look for the most sophisticated target. They look for the most consequential one.

And increasingly, that target is storage and backup systems.

This shift reflects a deeper pattern – what you might call an Anthropic Mythos of AI in cybersecurity. Not the myth of superintelligence, but the reality that AI accelerates whatever incentives already exist.

Attackers want leverage. And guess what; storage and backup systems provide it. AI simply helps them find the cracks faster.

The Blind Spot AI Loves

One of the most uncomfortable truths in modern security programs is how uneven our visibility really is.

Endpoints, networks, applications – these are continuously scanned, prioritized, scored. Storage and backup systems? Often assumed safe. Too complex. Too sensitive. Too “infrastructure‑owned” to fit neatly into exposure management programs.

Attackers have figured this out.

Research shows that the majority of ransomware incidents now explicitly target storage and backup repositories to prevent recovery and force payment. When backups are compromised, incidents turn into crises: longer downtime, regulatory fallout, operational paralysis.

AI doesn’t need to “break” storage and backup systems. It just needs to identify which ones haven’t been treated like first‑class citizens in the security model.

From Feature AI to Risk AI

One of the most important AI trends in cybersecurity isn’t about flashy capabilities – it’s about context.

AI is shifting security away from isolated findings and toward risk understanding:

• Which weaknesses matter most?
• Which systems amplify business impact?
• Which issues collapse recovery options?

This is where storage and backup security finally enters the risk conversation, rather than sitting outside it.

The joint approach from Qualys Enterprise TruRisk™ and Core6’s StorageGuard reflects this shift. Instead of treating storage as an architectural special case, it becomes another – critically important – risk domain that can be assessed, prioritized, and acted on alongside endpoints and applications.

Not more data. More meaning.

Why AI-Driven Attackers Go After Recovery

There’s something almost narratively predictable about modern ransomware campaigns.

If you think in Anthropic terms – systems shaped by incentives – the logic is clear:

• Attackers don’t want denial of service.
• They want negotiation advantage.
• Recovery infrastructure is the leverage point.

AI accelerates reconnaissance and vulnerability clustering. It surfaces misconfigurations, exposed interfaces, and hardening gaps – especially in complex, multi‑vendor storage and backup environments that rarely get consistent scrutiny. That’s why continuous autonomous validation matters more than episodic checks. StorageGuard’s scan of storage and backup systems – aligned to vendor hardening guides and industry standards – feeds directly into Qualys’ risk context, turning “invisible infrastructure” into actionable cyber risk.

One Risk Model, Not Two Worlds

Another quiet AI trend in cybersecurity is consolidation – not of vendors, but of decision models.

Security teams don’t need separate mental frameworks for infrastructure risk and cyber risk. They need one shared language of exposure and impact.

By surfacing storage and backup security advisories, vulnerabilities, security misconfigurations and compliance issues directly inside Qualys workflows, organizations can:

• Prioritize remediation based on business risk, not just technical severity
• Align Infrastructure and SecOps teams around the same risk signals
• Reduce friction caused by siloed tools and disconnected ownership

This matters because AI-driven attacks don’t respect org charts. Defense shouldn’t either.

The End of “Safe by Assumption”

If there’s one myth AI is breaking in cybersecurity, it’s the idea that anything is secure simply because it’s complex, critical, or historically untouched.

Storage and backup systems are no longer passive repositories. They’re active battlegrounds in modern attacks.

The organizations that adapt fastest aren’t chasing AI hype. They’re asking better questions:

• Where do attackers gain leverage?
• Which systems eliminate recovery when they fail?
• Which risks have we normalized for too long?

AI doesn’t answer those questions for us. But it ensures attackers are asking them already.

The only real choice is whether defenders catch up.

Visit the Core6 profile on the Qualys Partner Portal: https://technologypartners.qualys.com/partners/core6

Frequently Asked Questions (FAQs)

1. How does Qualys address storage and backup security risk?

Qualys integrates storage and backup risks into its Enterprise TruRisk™ model, allowing organizations to assess, prioritize, and remediate recovery‑related exposures using the same workflows applied to endpoints, networks, and applications.

2. What role does Core6 StorageGuard play in cyber risk management?

Core6 StorageGuard continuously evaluates storage and backup systems against vendor hardening guidelines and security standards, surfacing misconfigurations and vulnerabilities that feed directly into enterprise risk workflows.

3. What does “one risk model” mean in cybersecurity?

A single risk model unifies infrastructure and cybersecurity risk, helping security, infrastructure, and operations teams prioritize remediation based on business impact instead of working in disconnected silos.

4. How is AI shifting cybersecurity toward risk‑based decision making?

AI is moving cybersecurity from isolated vulnerability findings to risk understanding—helping teams assess which weaknesses create the greatest operational, financial, and recovery impact rather than prioritizing issues based only on technical severity.

The post How Qualys and Core6 Are Redefining Risk Visibility in the Age of AI appeared first on Core6.

While many storage and backup platforms are rightly classified as critical, criticality is not a single tier but a spectrum.

Differences in failure modes, recoverability impact, exposure, maturity, and regulatory scope mean that some systems demand earlier attention, deeper validation, or stronger controls than others.

A structured, multi‑dimensional approach enables security teams to make deliberate, risk‑based prioritization decisions – even within the critical asset set – across both steady‑state operations and worst‑case recovery scenarios.

Below we outline practical criteria to assess and compare criticality across the enterprise storage and backup estate.

Storage & Backup Asset Criticality Criteria

The criterions are divided into four categories: Operational, Technological, Physical Characteristics and finally Governance Compliance and regulatory considerations.

Category 1: Operational context

Category 2: Technology context

Category 3: Physical Characteristics

Category 4: Governance Compliance and regulatory considerations

Final Thought

Storage and backup systems are no longer passive infrastructure components. They are primary security assets, with risk profiles that change dramatically under failure or attack. In a world where the control plane is the new perimeter, these systems have become prime targets.

By applying a structured criticality model – one that balances operational importance, recoverability impact, and security maturity – organizations can:

• Prioritize hardening and validation efforts
• Reduce blind spots attackers increasingly exploit
• Make defensible, risk‑based decisions aligned with business impact

Frequently Asked Questions (FAQ)

1. Why do storage and backup systems need their own criticality model?

Storage and backup platforms (from the likes of Dell, NetApp, Hitachi Vantara, HPE, IBM, Everpure (formerly Pure), VAST Data, Rubrik, Commvault, Cohesity, Broadcom, Cisco, etc.) differ fundamentally from traditional applications or servers. They often protect hundreds or thousands of workloads, store highly sensitive data, and become the last line of defense during ransomware or destructive attacks. Applying a generic asset classification model usually underestimates their blast radius, recovery impact, and attacker value.

2. Aren’t all storage and backup systems already “critical”?

They are – but not equally so. Criticality is a spectrum, not a single tier. Differences in data sensitivity, dependency density, recoverability role, exposure, and governance maturity mean some systems demand earlier hardening, deeper validation, or stricter controls than others—especially under worst‑case recovery scenarios.

3. Why does “access density” matter so much?

High fan‑in systems – those connected to many servers, applications, and management tools—have an amplified blast radius. A single misconfiguration or compromise can cascade across large portions of the environment, making access density one of the strongest predictors of risk.

4. How do AI and ML workloads change storage and backup criticality?

AI/ML systems often store high‑value datasets, model artifacts, and training pipelines that are reused across teams and products. Compromise can affect model integrity, business decisions, and downstream systems, elevating both the security and operational impact of the supporting storage platforms.

The post Determining Asset Criticality in Enterprise Storage and Backup Environments appeared first on Core6.

In fact, Gartner reports a 187% year‑over‑year increase in client inquiries related to data resiliency in 2025 compared with 2024, underscoring how urgently organizations are rethinking their ability to protect and recover business‑critical data.

In parallel, inquiries explicitly focused on cyberstorage grew by 167% over the same period, highlighting the acceleration of storage‑layer security as a standalone priority – not just an extension of backup or recovery tools.

From Backup-Centric Recovery to Active Storage Defense

Traditional cyber resilience approaches focused heavily on backup frequency, immutable snapshots, and recovery time objectives. While these capabilities remain essential, they are no longer sufficient on their own.

Modern ransomware and data‑centric attacks are designed to evade detection, compromise administrative credentials, and directly target storage & backup systems

The Market Guide for Cyberstorage describes how cyberstorage embeds security directly into storage and backup platforms, focusing on posture hardening, continuous validation, and recovery assurance.

Put simply: backup is reactive by nature; storage must now participate proactively in cyber defense.

Why Storage & Backup Security Posture Management Matters

As cyberstorage capabilities mature, Gartner emphasizes that consistent execution and hardened security posture across different storage and backup platforms are far more important than individual features, especially in large enterprises operating multivendor storage and backup ecosystems and legacy infrastructure alongside newer platforms.

In practice, this complexity leads to uneven protection. Native security features may exist on some platforms but not others. Policies drift over time. Privileged access expands quietly. Recovery assumptions go untested.

Storage and backup security posture management addresses these realities by continuously assessing and validating:

• Configuration baselines across storage and backup platforms – and deviations or drifts that happen over time
• Exposure to security advisories, vulnerabilities, and security misconfigurations
• Alignment with industry standards, regulation, and cybersecurity frameworks

Without posture management, organizations often discover gaps only during an incident – when it is already too late.

Cyberstorage in Multivendor, Legacy, and Hybrid Environments

A key insight from the Market Guide is that, while many storage vendors are embedding baseline cyberstorage features, capability depth and maturity remain uneven – particularly across:

• Multivendor environments
• Older or legacy storage platforms
• Complex hybrid cloud architectures

As a result, many enterprises continue to adopt specialized cyberstorage solutions to provide independent validation, consistent policy enforcement, and unified visibility across their entire storage and backup estate.

These solutions are especially important in environments where organizations must assume that administrative credentials may be compromised – and where recovery workflows must remain trusted and operable under active attack conditions.

StorageGuard by Core6: A Representative Vendor in Cyberstorage

In the Gartner Market Guide for Cyberstorage, Core6 (previously ‘Continuity’)  is named as a Representative Vendor based on our StorageGuard solution, reflecting its role in addressing the growing need for security posture management.

StorageGuard focuses on continuously assessing and hardening storage and backup environments, helping organizations uncover misconfigurations, security gaps, and latent risks across diverse platforms. By delivering cross‑vendor visibility and posture enforcement, StorageGuard supports the core cyberstorage outcomes highlighted in the Market Guide.

This posture‑driven approach is particularly valuable for large enterprises, where operational complexity – not lack of technology – is often the biggest obstacle to cyber resilience.

Download the Gartner® Market Guide for Cyberstorage

Attribution: Gartner, Market Guide for Cyberstorage, Vishesh Divya, 23 February 2026.

Disclaimer: GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Frequently Asked Questions (FAQ)

1. What is cyberstorage?

Cyberstorage is an approach to securing enterprise storage that embeds active detection, containment, and recovery assurance directly at the data layer, rather than relying solely on backup or perimeter security. It treats storage systems as active participants in cyber defense, capable of detecting early-stage attacks, limiting blast radius, and validating recovery readiness.

2. What is security posture management for storage and backup?

Storage and backup security posture management is the continuous assessment and hardening of storage and backup environments to ensure they are securely configured, resilient to attack, and aligned with cyber resilience best practices. It focuses on identifying misconfigurations, privilege risks, policy gaps, and exposure that could undermine recovery during a cyber incident.

3. Why are multivendor storage environments harder to secure?

Multivendor environments often have inconsistent security models, visibility gaps, and uneven maturity across platforms. Native protection features vary widely between vendors, making it difficult to maintain a unified security posture. This complexity increases the risk of misconfiguration and blind spots that attackers can exploit.

4. What types of organizations benefit most from cyberstorage – and specifically security posture management?

Cyberstorage and storage security posture management are especially valuable for:

• Large enterprises
• Organizations with multivendor or hybrid storage environments
• Regulated industries with strict recovery and compliance requirements
• Businesses reliant on uninterrupted access to critical data

The post Cyberstorage Comes of Age: Why Security Posture Management Is Now Critical for Storage & Backup appeared first on Core6.

AI-Powered Security Operations for Storage & Backup

Imagine prompting your favorite AI tool to:

• “List all administrator user accounts and groups on my NY-based storage systems”
• “Remediate incorrect session-limit settings on my backup appliances”
• “Check whether my storage systems comply with the proposed 2025 HIPAA regulation updates”
• “Determine whether my backup system is vulnerable to CVE-2025-3928”
• “Identify which hardening guidelines are still missing on my NAS platforms”

By connecting your AI environment to the StorageGuard MCP Server, teams can query configurations, investigate findings, generate reports, and validate compliance—all through natural language. This dramatically reduces the learning curve and streamlines IT hardening, security operations, and audit-related tasks.

What’s Next: Cross-Layer Intelligence With MCP

The real power of MCP emerges when your AI application can access multiple MCP-enabled systems – StorageGuard alongside platforms such as ServiceNow, Varonis, Check Point, Netwrix, and others.

Correlating insights across these layers unlocks new possibilities:

• Advanced risk-based vulnerability prioritization using layered-defense analysis and attack-path insights
• Streamlined compliance reporting by bringing data-classification context into Storage and Backup posture assessments
• Business-aware remediation by attaching business-unit, service, and application context to Storage and Backup environments

This cross-layer intelligence drives faster, more accurate decisions and elevates both security and operational efficiency.

Availability

The StorageGuard MCP Server is currently offered in limited-availability beta as part of the StorageGuard Enterprise + AI edition.

If you’d like to learn more or explore what MCP can enable for your environment, contact us today!

Frequently Asked Questions (FAQ)

1. Why do AI-driven threats require a new cyber defense strategy?

AI empowers attackers to instantly map environments, detect misconfigurations, and launch targeted exploits at machine speed, far beyond traditional manual reconnaissance approaches. This renders periodic security checks insufficient and demands continuous security posture management.

2. What makes data infrastructure such a critical target for AI-powered attacks?

Data infrastructure — especially storage and backup systems — houses sensitive workloads and cyber-recovery capabilities. AI can quickly identify subtle vulnerabilities in these systems, making compromise catastrophic without proactive defense.

3. How does automated remediation improve cyber defenses?

Automated remediation — such as StorageGuard’s Fix It capability – allows organizations to correct security misconfigurations automatically, reducing exposure windows and scaling security without proportionally increasing headcount.

4. How does StorageGuard help organizations defend against AI-driven cyber threats?

By connecting our customers’ AI environments to the StorageGuard MCP Server, teams can inspect and harden security configurations, investigate and resolve weaknesses, and validate compliance – all through natural language.

The post AI-Powered Security for Storage & Backup: Introducing the StorageGuard MCP Server appeared first on Core6.