If you run Google Cloud NetApp Volumes (GCNV), you already have snapshots. They are fast, space-efficient, and they have pulled plenty of teams out of trouble.
But a snapshot answers only one question: can I get my data back?
During a ransomware incident, that is the last question you ask, not the first. Before you restore anything you need to know when the encryption started, which of your volumes had detection turned on in the first place, and which recovery point sits safely before the damage. If you are running dozens of volumes across several Google Cloud projects, working that out means checking pool by pool, usually at the worst possible moment.
NetApp Ransomware Resilience for Google Cloud NetApp Volumes, now generally available through NetApp Console following its public preview, closes that gap.
This is less new technology than newly available technology. If you have run ONTAP, the ransomware intelligence underneath it is something you already trust; what changes is that it now covers your GCNV volumes and is managed from NetApp Console, NetApp’s central platform for managing data across hybrid and multi-cloud environments. Security tends to hold up better when it is part of the infrastructure rather than bolted on afterwards, and as you migrate and modernise on Google Cloud, ransomware stops being a hypothetical security topic and becomes a business-continuity one.
The short version
In one sentence:
ARP/AI is the detector on the volume. Ransomware Resilience is the service in NetApp Console that turns it on everywhere, watches the whole estate, and tells you what to do when it fires.
Ransomware Resilience discovers your supported workloads, tells you which have detection enabled and which do not, applies protection policies at scale, raises an alert the moment suspicious encryption shows up, and links that alert to the recovery points available to you.
Console is a control plane. Detection runs on the storage itself, and your data never leaves your Google Cloud project. Google Cloud continues to provision and operate your volumes exactly as before — nothing about how you consume GCNV as a managed service changes.
Ransomware Resilience orchestrates through a Console agent you deploy once in your own project. The data path between your applications and your volumes is untouched.
How it works: six phases
The service is organised around the identify–protect–detect–respond–recover–govern model, and each phase maps to a page in the Console navigation.
The six phases and where each one lives in NetApp Console
A few details worth drawing out:
Discovery covers both file and block. Supported NFS and SMB file shares and block (iSCSI) volumes, across connected Google Cloud projects.
Policies apply at scale. Choose a snapshot schedule, a backup schedule, or both, plus detection where the underlying pool supports it — for one workload or a whole protection group. Critical, Important and Standard templates line up with supported GCNV snapshot limits, so you are not hand-building schedules per volume.
Detection runs on the storage. ARP/AI analyses volume activity in real time for abnormal encryption, unusual file extensions and suspicious I/O. Because it lives on GCNV rather than inside your VMs, it does not depend on an agent on every host or on network monitoring. It also is not a replacement for your endpoint, identity or network controls — it adds a storage-layer signal to defence in depth.
Alerts reach you where you already work. Console emails them, and they can be forwarded to Splunk and Google SecOps so your security operations team sees storage signals alongside everything else.
What “protected” actually means
This one matters, so it is worth being precise: a workload counts as protected when ransomware detection is enabled on it.
A snapshot schedule alone does not make a workload protected. Nor does a backup schedule, and nor does FPolicy extension blocking. Those are valuable — they give you recovery points and they block known bad files — but none of them is watching for an attack.
Full encryption detection requires the ONTAP detection capability to be exposed on the underlying storage pool, and Flex in ONTAP-mode is the path to that capability. If your workloads are on other service levels, Ransomware Resilience still discovers them, applies snapshot and backup schedules, and includes them in your posture view and governance — you just will not get encryption detection until the workload sits on a pool that supports it.
Detection and prevention are not the same thing
Two capabilities often get blurred together:
| FPolicy extension blocking | ARP/AI encryption detection |
|---|
Question it answers | “Is this a known bad file type?” | “Is data being encrypted abnormally?” |
When it acts | Before the file is written | While the activity is happening |
Type | Preventive — block list | Detective — pattern analysis |
Catches | Known ransomware extensions | Unknown and zero-day encryption patterns |
Applies to | File shares | File shares and block workloads |
You want both. A block list cannot catch an attack that does not announce itself with a recognisable extension, and detection is not a substitute for blocking the ones that do.
What happens when it fires
From first encrypted block to a restored volume
Everything up to the notification is automatic. Investigation and restore stay with you.
When detection flags suspected ransomware activity, Ransomware Resilience automatically creates a locked snapshot — one that cannot be deleted by you or by any other process until its retention period expires — and raises an alert tied to the specific volume and Google Cloud project. The alert carries the evidence that triggered it, how much data is impacted, and a first detected timestamp.
That timestamp is the one you work from. Ransomware Resilience presents the recovery points for the affected workload — snapshots on the volume, plus backup copies if you included a backup schedule in the policy — next to the detection context, so you are not reconstructing the timeline by hand. The rule is simply to pick the newest recovery point earlier than first detected.
How you restore depends on the workload. Volume revert recovers the whole volume, for both file-share and block workloads. File and folder restore from local snapshots is available for NFS and SMB file shares, so you can bring back what was hit without reverting the entire volume. You choose the recovery point and you trigger the restore — Ransomware Resilience does not restore production data automatically.
What you get
- Discovery of supported NFS, SMB and block (iSCSI) workloads across Google Cloud projects
- Protected versus at-risk visibility based on whether detection is enabled
- Snapshot, backup and detection policies, individually or by protection group
- ARP/AI encryption-anomaly detection on supported Flex ONTAP-mode pools
- FPolicy file-extension blocking on supported file-share configurations
- Automatic locked snapshots and volume-level alerts on suspected attack
- Volume revert for full-volume recovery, and file and folder restore from local snapshots on NFS and SMB file shares
- Posture dashboards, reports, role-based access, and alert forwarding to Splunk and Google SecOps
Try it for 30 days
The fastest way to judge any of this is against your own workloads. Ransomware Resilience includes a 30-day free trial with full feature access, no capacity limits, and the same level of support paying customers receive. It does not convert to a paid subscription automatically.
Getting to a monitored workload takes four things: a NetApp Console organization, a Console agent connected to your Google Cloud environment, discovery to pick up your GCNV volumes, and a protection policy applied to the ones that matter. Only the second step involves any deployment, and it is once per environment rather than once per workload.
A good first test is to run that sequence on a non-production volume, confirm the workload flips from at risk to protected, and get familiar with the Alerts and Recovery pages before you ever need them.
Google Cloud NetApp Volumes gives you the recovery points. Ransomware Resilience adds the detection, the automatic locked snapshot, the central alerts, and the posture view that tell you when something is wrong and which recovery point to reach for.
Snapshots answer “can I recover?” Ransomware Resilience helps you answer “am I protected, is something happening right now, and where do I restore from?”
Get started with Ransomware Resilience for Google Cloud NetApp Volumes →
