---
description: IBM FlashSystem 5600, 7600, and 9600 add in-drive data exfiltration detection with under 1% false positives, plus FIPS post-quantum crypto.
title: IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives
image: https://www.storagereview.com/wp-content/uploads/2026/09/StorageReview-IBM-FlashSystem-1.jpg
---
[![Storage Review]()](https://storagereview.com/)
---
[Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview)
[Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview)
[](https://www.storagereview.com)
≡ Menu
- [Home](https://www.storagereview.com/)
- [Storage Reviews](https://www.storagereview.com/review)
- [End User Reviews](https://www.storagereview.com/consumer)
- [Enterprise Reviews](https://www.storagereview.com/enterprise)
- [Ubiquiti Reviews](https://www.storagereview.com/best/ubiquiti-reviews)
- [SR Merch](https://store.storagereview.com)
- [Leaderboards](https://www.storagereview.com/best)
- [Best Storage Arrays](https://www.storagereview.com/best/storage-arrays)
- [Best Enterprise SSDs](https://www.storagereview.com/best/enterprise-ssds)
- [Best Servers](https://www.storagereview.com/best/servers)
- [Best Enterprise GPUs](https://www.storagereview.com/best/enterprise-gpus)
- [Best Desktops for Local AI](https://www.storagereview.com/best/desktops-local-ai)
- [Best Laptops for Local AI](https://www.storagereview.com/best/laptops-local-ai)
- [Best Local LLM Tools](https://www.storagereview.com/best/local-llm-tools)
- [Agentic AI Hardware](https://www.storagereview.com/best/agentic-ai-hardware)
- [Best SSDs & Hard Drives](https://www.storagereview.com/best_drives)
- [Best Portable SSDs](https://www.storagereview.com/best/portable-ssds)
- [Best Business Laptops](https://www.storagereview.com/best/business-laptops)
- [Best Mobile Workstations](https://www.storagereview.com/best/mobile-workstations)
- [Best Desktop Workstations](https://www.storagereview.com/best/desktop-workstations)
- [Best Mini PCs](https://www.storagereview.com/best/mini-pcs)
- [Best Laptop Battery Life](https://www.storagereview.com/best/laptop-battery-life)
- [Storage Reference Guide](https://www.storagereview.com/storage-reference-guide)
- [About SR](https://www.storagereview.com/about-storagereview)
- [StorageReview.com Sweepstakes Rules and Regulations](https://www.storagereview.com/storagereview-com-sweepstakes-rules-and-regulations)
Search
[Home](https://www.storagereview.com/) » [News](https://www.storagereview.com/news) » IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives
# IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives
by Harold Fritts on October 29, 2026
[Enterprise](https://www.storagereview.com/enterprise) ◇ [Enterprise Storage](https://www.storagereview.com/enterprise/enterprise-storage)
[IBM FlashSystem](https://www.storagereview.com/news/ibm-introduces-next-generation-flashsystem-with-agentic-ai-for-autonomous-storage-operations-2-107am) 5600, 7600, and 9600 arrays built on the fifth-generation [IBM FlashCore Module](https://www.storagereview.com/news/ibm-ds8000-release-10-2-brings-fcm5-in-edsff-doubled-back-end-throughput-and-automated-ransomware-containment) now detect data exfiltration inside the drive, next to the ransomware encryption detection the modules already run. IBM says the module learns each volume’s normal read pattern, flags reads that break from it, and confirms a suspected event over a 30-minute confidence window with a validated false-positive rate below 1%. The capability is available starting in October 2026 on eligible configurations running firmware 9.1.2 or later.
The case IBM makes is that recovery answers the wrong question when data has already left. Recovery brings the volumes back, but it cannot tell an operator what was read out before the encryption started or how large the exposure is. IBM cites Google Cloud’s M-Trends 2026 for attackers typically spending 11 to 14 days inside a network before deploying ransomware, and its Cost of a Data Breach 2026 report for an average of 247 days to identify a breach.
## Inline FlashCore Module Telemetry and Threat Detection
Exfiltration is harder to catch than encryption because it is meant to look like ordinary reads. The FlashCore Module analyzes every I/O at the drive, builds a baseline for each volume, and recognizes routine backup passes and analytics scans so a scheduled full read does not trip an alert. Because the analysis runs in the module, it does not depend on endpoint agents or host logs an attacker may control, requires no application changes, and IBM says it adds no measurable performance impact.
![Stack of IBM FlashCore Module 5 drives from an IBM FlashSystem array on a lab bench]()
“The future of cyber resilience is not simply recovering after an attack,” said Sam Werner, General Manager, IBM Storage. He framed the goal as identifying risk before damage occurs, with earlier insight into potential data theft and a faster response. Laurence Horrocks-Barlow, Technical Director at OCF Limited, described storage-layer detection as another stage of defense: “The sooner you know something is wrong, the sooner you can act.”
## FIPS Post-Quantum Cryptography and Secure Fibre Channel HBAs
The second change targets harvest-now, decrypt-later attacks, where encrypted data stolen today is held until quantum hardware can break the key. FlashSystem keeps AES-256 for data at rest, and the fifth-generation FlashCore Module adds ML-KEM under FIPS 203 and ML-DSA under FIPS 204, two algorithms developed with IBM researchers. ML-KEM runs in hybrid mode to transport the unlock PIN to the module, and hybrid ML-DSA signatures verify firmware authenticity.
IBM says Secure HBAs will carry the post-quantum protections into the Fibre Channel data path and enable quantum-safe, session-level encryption on the fabric, without affecting efficiency, performance, or the ransomware detection running in the modules. IBM has not given a date for the HBA piece, and the session-level encryption is described as a future capability.
## FlashSystem.ai Operational Governance
FlashSystem.ai, introduced with the 5600, 7600, and 9600 launch, picks up advisory capabilities in this update: contextual recommendations, task context that carries across management sessions, and suggested next-best actions. Administrators work in natural language, can see the reasoning behind a recommendation, and keep approval authority through policy-based governance. IBM puts the effort reduction for routine provisioning at up to 90%, a figure from lab-controlled evaluations of multi-volume provisioning with Safeguarded Copy and disaster recovery policies.
| **Specification** | **IBM FlashSystem October 2026 Update** |
| --- | --- |
| **Data Exfiltration Detection** | |
| **Applicable Systems** | IBM FlashSystem 5600, 7600, 9600 |
| **Detection Engine** | Fifth-generation IBM FlashCore Module, in-drive analysis of every I/O |
| **Method** | Per-volume read baseline with recognition of routine backups and analytics scans |
| **Confirmation Window** | 30 minutes |
| **False-Positive Rate** | Below 1% (IBM field telemetry, firmware 9.1.2 or later) |
| **Availability** | Starting October 2026 on eligible configurations |
| **Cryptography** | |
| **Data at Rest** | AES-256 |
| **Post-Quantum Algorithms** | ML-KEM (FIPS 203), hybrid, unlock PIN transport to FCM5
ML-DSA (FIPS 204), hybrid signatures, firmware authenticity |
| **Fabric Extension** | Secure HBAs for the Fibre Channel data path, future session-level encryption |
| **Management** | |
| **FlashSystem.ai** | Contextual recommendations
Task context across sessions
Suggested next-best actions
Policy-based governance |
| **Claimed Effort Reduction** | Up to 90% for routine provisioning (IBM lab evaluation) |
### [IBM FlashSystem](https://www.ibm.com/products/flashsystem)
**Engage with StorageReview**
[Newsletter](https://www.storagereview.com/storage_newsletter) | [YouTube](https://www.youtube.com/user/StorageReview "Opens in a new window") | Podcast [iTunes](https://podcasts.apple.com/gb/podcast/storagereview-com-storage-reviews/id1060681115 "Opens in a new window")/ [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0 "Opens in a new window") | [Instagram](https://www.instagram.com/storagereview/ "Opens in a new window") | [Twitter](https://twitter.com/storagereview "Opens in a new window") | [TikTok](https://www.tiktok.com/@storagereview? "Opens in a new window") | [RSS Feed](https://www.storagereview.com/rss.xml)
![]()
### Harold Fritts
I have been in the tech industry since IBM created Selectric. My background, though, is writing. So I decided to get out of the pre-sales biz and return to my roots, doing a bit of writing but still being involved in technology.
Previous post: [Seagate Exos M HAMR SMR Drives Join Broadcom’s eHBA 9600 Approved Vendor List After Azure Qualification](https://www.storagereview.com/news/seagate-exos-m-hamr-smr-broadcom-ehba-9600-approved-vendor-list-azure)
Next post: [72-GPU NVIDIA Vera Rubin NVL72 Racks Anchor OCI’s Planned Multi-Gigawatt Expansion](https://www.storagereview.com/news/nvidia-vera-rubin-nvl72-vera-cpus-generally-available-oci-multi-gigawatt-superclusters)
Trusted Vendors
Products and solutions from our affiliate partners:
- [
Ubiquiti
](https://store.ui.com/us/en?a_aid=StorageReview "Opens in a new window")
- [
Newegg
](https://click.linksynergy.com/fs-bin/click?id=g5terNMDhz0&offerid=1207190.18&subid=0&type=4 "Opens in a new window")
- [
 Amazon
](https://amzn.to/4fLJUEW "Opens in a new window")
Newsletter
Subscribe to the StorageReview newsletter to stay up to date on the latest news and reviews. We promise no spam!
1
Leave this field empty if you’re human:
## Advertisement
Content Categories
[Facebook](https://www.facebook.com/@storagereview) [X](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview)
Copyright © 1998-2025 Flying Pig Ventures, LLC Cincinnati, Ohio. All rights reserved.
Manage your privacy
To provide the best experiences, we and our partners use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us and our partners to process personal data such as browsing behavior or unique IDs on this site and show (non-) personalized ads. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Click below to consent to the above or make granular choices. Your choices will be applied to this site only. You can change your settings at any time, including withdrawing your consent, by using the toggles on the Cookie Policy, or by clicking on the manage consent button at the bottom of the screen.
Functional Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Statistics
Marketing
Features
Always active
Special features
Special purposes
Always active
- Manage options
- Manage services
- Manage {vendor\_count} vendors
- [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/)
Accept Deny Manage options Save preferences Manage options
- {title}
- {title}
- {title}
Manage your privacy
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Statistics
Marketing
Features
Always active
Special features
Special purposes
Always active
- Manage options
- Manage services
- Manage {vendor\_count} vendors
- [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/)
Accept Deny Manage options Save preferences Manage options
- {title}
- {title}
- {title}
Manage consent Manage consent
```json
{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography","url":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography","name":"IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives - StorageReview.com","isPartOf":{"@id":"https:\/\/www.storagereview.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography#primaryimage"},"image":{"@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography#primaryimage"},"thumbnailUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/09\/StorageReview-IBM-FlashSystem-1.jpg","datePublished":"2026-10-29T15:25:37+00:00","description":"IBM FlashSystem 5600, 7600, and 9600 add in-drive data exfiltration detection with under 1% false positives, plus FIPS post-quantum crypto.","breadcrumb":{"@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography#primaryimage","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/09\/StorageReview-IBM-FlashSystem-1.jpg","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2026\/09\/StorageReview-IBM-FlashSystem-1.jpg","width":1500,"height":726,"caption":"IBM FlashCore Module 5 drive standing in front of an IBM FlashSystem array in a lab rack"},{"@type":"BreadcrumbList","@id":"https:\/\/www.storagereview.com\/news\/ibm-flashsystem-data-exfiltration-detection-post-quantum-cryptography#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.storagereview.com\/"},{"@type":"ListItem","position":2,"name":"News","item":"https:\/\/www.storagereview.com\/news"},{"@type":"ListItem","position":3,"name":"IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives"}]},{"@type":"WebSite","@id":"https:\/\/www.storagereview.com\/#website","url":"https:\/\/www.storagereview.com\/","name":"StorageReview.com","description":"StorageReview.com is a leading provider of news and reviews throughout the entire IT stack - from the datacenter to the edge, and all points in between.","publisher":{"@id":"https:\/\/www.storagereview.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.storagereview.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.storagereview.com\/#organization","name":"StorageReview.com","url":"https:\/\/www.storagereview.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","width":344,"height":61,"caption":"StorageReview.com"},"image":{"@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/storagereview","http:\/\/youtube.com\/user\/storagereview"]}]}
```