When every storage product claims Cyberstorage: seven tests that tell them apart

When every storage vendor claims Cyberstorage, one question still separates them: what does the product do, on its own, when a valid account starts encrypting or copying your files? That question is about to matter more. According to Gartner’s 2026 Strategic Roadmap for Storage, as reported by Blocks and Files in December 2025, about 20 percent of deployed enterprise storage includes active, defense-focused Cyberstorage capabilities today, and Gartner forecasts 100 percent by 2029.

For the category, that is a success. For a buyer, it means the word on the datasheet stops telling you anything. The products behind it range from ones that stop an attack in progress to ones that help you clean up afterward, and the difference shows up on the worst day your organization will have: whether files were encrypted or merely targeted, whether data left the building, and whether you can tell regulators exactly whose records were exposed. The only reliable way to see that difference is to test it, on your own data, under conditions that look like a real intrusion. This guide gives you the tests.

Most products sold as Cyberstorage fall into one of four approaches. Each is useful for something, and each has limits that come from where it sits. Recovery features work from copies of the data. Add-on monitors work from activity logs that the storage system exports to them. Malware scanners inspect files as they arrive. Only the fourth approach sits in the data path, meaning inside the storage system that handles every file request, where it can judge each request and refuse it.

Run every test from a valid account. Stolen passwords, hijacked logins, and compromised service accounts reach file storage already authorized, so a test that only proves a product can catch known malware on an unknown account measures the part of the problem other tools already cover. Score each vendor with the scorecard at the end of this guide.

Test 1, bulk read. From a normal user account, copy several thousand files from a share that account can reach but rarely uses. Nothing gets encrypted. A pass means the storage stops the session, the user or program’s connection to the storage, while the copy is still running. Many ransomware features watch only for files being changed, and data-theft extortion needs nothing but reads. Fail this test and your data leaves without an alarm.

Test 2, every protocol. Run an encryption script against a share over SMB, then repeat it over NFS, S3, and Web Drive. A pass means the same result on all four. Protection that covers one protocol leaves the rest of your data to whichever path an attacker tries next.

Test 3, time to stop. Repeat Test 2 with nobody watching the consoles. Measure the seconds from the first malicious change to the session ending, and count the files changed along the way. A product that waits for a person to act on an alert turns seconds of attack into hours of damage.

Test 4, behavior nobody has seen. Write a new encryption script for the test, with an unfamiliar file extension, no known malware signature, and no contact with any canary file, the decoy files some products plant as tripwires. Run it on a system installed that week. A pass means the product catches it by what it is doing, with no signature to match and no learning period to wait out.

Test 5, administrator compromise. Log in with an administrator account and try to delete snapshots, shorten retention, turn off the protection, and erase the audit log. A pass means your recovery copies and records survive. Attackers go after backups and snapshots early, so a vault the storage administrator can empty is only as safe as that one password.

Test 6, surgical recovery. After Test 3, restore only the files the attack changed, and keep every legitimate edit other people made in the same window. A pass means exactly the damaged files come back, in minutes. The alternative, rolling a whole volume back to last night, trades an attack for a day of lost work.

Test 7, evidence. Ask the product to list every file the Test 1 session read, with times and the machine it came from. A pass is a complete answer from a record that nobody, including an administrator, could have altered. That list decides whether a real incident ends with notices to a precise set of people or to everyone whose data might have been on the system, which is slower, costlier, and harder to explain.

Copy the first two columns into your evaluation and fill them in for every vendor on your shortlist. The third column is what RackTop BrickStor SP does in each test. Active Defense, the detection and response engine behind those results, has run inside the storage data path since October 2020.

NAS ransomware protection is often sold as a recovery promise: snapshots, retention, a fast restore. Recovery matters, and Tests 5 and 6 measure it. But a product that passes only those two has shown it can clean up. Real NAS ransomware protection stops the attack on live data, restores exactly what it touched, and proves what happened, and the seven tests check all three.

The fastest way to see the difference is to run the tests yourself. Put BrickStor SP in your own environment for 90 days, point it at a copy of your data, and a RackTop engineer will work through all seven tests with you. Run them against any vendor, including us.