IBM FlashSystem 5600, 7600, and 9600 arrays built on the fifth-generation IBM FlashCore Module now detect data exfiltration inside the drive, next to the ransomware encryption detection the modules already run. IBM says the module learns each volume’s normal read pattern, flags reads that break from it, and confirms a suspected event over a 30-minute confidence window with a validated false-positive rate below 1%. The capability is available starting in October 2026 on eligible configurations running firmware 9.1.2 or later.
The case IBM makes is that recovery answers the wrong question when data has already left. Recovery brings the volumes back, but it cannot tell an operator what was read out before the encryption started or how large the exposure is. IBM cites Google Cloud’s M-Trends 2026 for attackers typically spending 11 to 14 days inside a network before deploying ransomware, and its Cost of a Data Breach 2026 report for an average of 247 days to identify a breach.
Inline FlashCore Module Telemetry and Threat Detection
Exfiltration is harder to catch than encryption because it is meant to look like ordinary reads. The FlashCore Module analyzes every I/O at the drive, builds a baseline for each volume, and recognizes routine backup passes and analytics scans so a scheduled full read does not trip an alert. Because the analysis runs in the module, it does not depend on endpoint agents or host logs an attacker may control, requires no application changes, and IBM says it adds no measurable performance impact.
“The future of cyber resilience is not simply recovering after an attack,” said Sam Werner, General Manager, IBM Storage. He framed the goal as identifying risk before damage occurs, with earlier insight into potential data theft and a faster response. Laurence Horrocks-Barlow, Technical Director at OCF Limited, described storage-layer detection as another stage of defense: “The sooner you know something is wrong, the sooner you can act.”
FIPS Post-Quantum Cryptography and Secure Fibre Channel HBAs
The second change targets harvest-now, decrypt-later attacks, where encrypted data stolen today is held until quantum hardware can break the key. FlashSystem keeps AES-256 for data at rest, and the fifth-generation FlashCore Module adds ML-KEM under FIPS 203 and ML-DSA under FIPS 204, two algorithms developed with IBM researchers. ML-KEM runs in hybrid mode to transport the unlock PIN to the module, and hybrid ML-DSA signatures verify firmware authenticity.
IBM says Secure HBAs will carry the post-quantum protections into the Fibre Channel data path and enable quantum-safe, session-level encryption on the fabric, without affecting efficiency, performance, or the ransomware detection running in the modules. IBM has not given a date for the HBA piece, and the session-level encryption is described as a future capability.
FlashSystem.ai Operational Governance
FlashSystem.ai, introduced with the 5600, 7600, and 9600 launch, picks up advisory capabilities in this update: contextual recommendations, task context that carries across management sessions, and suggested next-best actions. Administrators work in natural language, can see the reasoning behind a recommendation, and keep approval authority through policy-based governance. IBM puts the effort reduction for routine provisioning at up to 90%, a figure from lab-controlled evaluations of multi-volume provisioning with Safeguarded Copy and disaster recovery policies.
Specification
IBM FlashSystem October 2026 Update
Data Exfiltration Detection
Applicable Systems
IBM FlashSystem 5600, 7600, 9600
Detection Engine
Fifth-generation IBM FlashCore Module, in-drive analysis of every I/O
Method
Per-volume read baseline with recognition of routine backups and analytics scans
Confirmation Window
30 minutes
False-Positive Rate
Below 1% (IBM field telemetry, firmware 9.1.2 or later)
Availability
Starting October 2026 on eligible configurations
Cryptography
Data at Rest
AES-256
Post-Quantum Algorithms
ML-KEM (FIPS 203), hybrid, unlock PIN transport to FCM5ML-DSA (FIPS 204), hybrid signatures, firmware authenticity
Fabric Extension
Secure HBAs for the Fibre Channel data path, future session-level encryption
Management
FlashSystem.ai
Contextual recommendationsTask context across sessionsSuggested next-best actionsPolicy-based governance
Claimed Effort Reduction
Up to 90% for routine provisioning (IBM lab evaluation)
IBM FlashSystem
Engage with StorageReview
Newsletter | YouTube | Podcast iTunes/Spotify | Instagram | Twitter | TikTok | RSS Feed
——————————————————–
Click Here For The Original Source.
