CyberSnap · Cyber recovery control

Your control and
decision center during a cyberattack.

Expose the attack. Identify the recovery point. Regain control.

CyberSnap opens the snapshots you already keep, examines the files and systems inside, and combines cyber detection with AI analysis. Your team sees what the attack touched and where each system can return from.

Book a Demo → Explore the platform
Production servers
No agents
Works from
Your snapshots
Final decision
Your team
app.cybersnap.io · SnapMap
CyberSnap SnapMap: scanned snapshots per server, with threat findings and a suitable recovery point for each server

SnapMap, demonstration scenario. Each column is a scanned snapshot, newest on the left. Red: threat findings. Green: no findings detected.

In production at
Government ministries National institutions Healthcare organizations
Works with
VMware vSphere NetApp ONTAP AWS EC2 · EBS · S3 NAS · CIFS/SMB Windows · Linux
Why it matters

The business cannot wait for trial-and-error recovery.

A cyberattack is one of the hardest moments in the life of a company. The defenses have already been breached, and the organization has to decide fast how to get back to work. Even with backups, nobody can say which recovery point is free of the attacker. So recovery takes too long, and decisions are made without evidence.

3 weeks
average time to recover from ransomware
16%
of organizations recovered in less than a day
$1.7M
average recovery cost, before any ransom

Source: Sophos, The State of Ransomware 2026. 2,158 organizations in 17 countries.

The control center

Three questions. Answered fast.

CyberSnap is the place where your team takes control of the incident while it is happening. It works at the source, where the evidence closest to the attack already sits: the snapshots on your production storage.

01

Where do we see signs of the attack?

Encryption, suspicious extensions, ransom notes, detection-rule matches and abnormal file changes, across every scanned snapshot.

02

What is still suspicious?

Which servers show findings, which need further investigation, and how far back the indicators go in the inspected history.

03

Where can each system return from?

A suitable recovery point for each server or folder, as close to the present as the evidence allows.

A faster return to operations.The investigation happens where the copies already are, and it leads straight to the restore decision. No trial-and-error restores.
Lights on in the middle of the attack.When signs first appear, which systems were hit, which points show no findings and how close to the present each system can return.
Confidence in what returns.The content of a copy is inspected before it is restored, reducing the risk of bringing the attack back with the data.
A walk through an incident

Why the encryption time is the wrong place to restart.

Most teams pick a restore point by the time the files were encrypted. But the attacker was usually inside before that. Here is what the team sees in CyberSnap instead.

Demonstration scenario.

  1. The newest point shows encryption.Mass file changes, new extensions and ransom notes. Clearly not a restore point.
  2. An earlier point looks normal, but is not.The files open as usual, yet a suspicious executable is already there. Choosing by encryption time alone would restore it.
  3. Open the finding.Which file, which path, which rule matched and in which recovery point. The evidence behind every mark is visible.
  4. Go further back.A point with no findings in the scan that ran becomes the restore candidate, shown with its scan coverage.
  5. Validate, then return.Where supported, start the server from that point in an isolated environment first. The incident manager can explain why one point was rejected, why another needs investigation and why this one is the basis for the return.
How it works

Beside your storage. Inside your snapshots.

In a typical deployment, CyberSnap runs on two virtual machines: one connects to the storage through its API, the other to the virtualization management layer. Nothing is installed on the production servers, and inspection works on snapshot copies, never on the running workloads.

01

Open existing snapshots

Point-in-time copies already kept on your production storage, opened automatically by scan policy.

02

Detect cyber evidence

Ransomware indicators, malicious file patterns and forensic evidence inside the copies.

03

Trace findings over time

Compare snapshots from different dates to see when indicators first appear and how they spread.

04

Return with greater confidence

Choose a suitable recovery point per server or folder and validate selected workloads first.

A different layer from prevention. Prevention tools work in real time at the perimeter and have milliseconds to decide whether to block. CyberSnap works on copies of the environment, so it has the time to investigate thoroughly, analyze the history and find an attack that has already got in. Because the restore runs from the storage already in your production environment, the return to operations can start sooner.

The first indicator in the inspected history is not necessarily when the intrusion began. Recovery time depends on storage availability, snapshot integrity, containment and validation.

What changes during an incident

One picture for every team.

Without CyberSnap
With CyberSnap
Which point to restore
A guess based on the encryption time
A suitable point per server, based on evidence
What is inside the copy
Unknown until it is restored
Scanned before the restore, with no agent in production
When signs first appear
No answer
A timeline of findings across snapshots
What returns with the data
Malware and the attacker's way back in
Findings and severity per file and server
Who decides, on what basis
Debate between cyber, infrastructure and management
One shared view of the evidence
A failed restore
Lost hours, and a second incident
Validation in an isolated environment first, where supported
The product

Return with confidence. Detect hidden threats earlier.

Two business modules and one research layer that keeps both of them current.

Module 1 · Ransom Recovery

Find the source. Return to the right point.

Scans the files inside your recovery points for evidence of ransomware and malware, adds forensic findings and AI recommendations, and shows where the attack came from and when it started. The result: a suitable recovery point for each server or folder, chosen on evidence rather than estimates.

  • Triage Scan
  • Threat Hunt Scan
  • Forensic Scan
  • SnapMap
  • Cyber Sandbox, where supported
Module 2 · Damage Prevention

Discover quiet attacks before the damage.

Not every attack starts with encryption. Damage Prevention looks across time for each server and across the whole infrastructure, to expose attacks that develop slowly: persistence, espionage and gradual disruption, including patterns that can appear in AI-assisted attacks.

  • Deep forensic evidence
  • Cross-system correlation
  • Slow-moving attack detection
  • AI analysis agents

Cross-system correlation, slow-moving attack detection and the AI analysis agents are in development.

Shared layer · CyberSnap AI Research

Detection that keeps learning.

Follows new threats, intelligence sources and AI-based attack methods, learns the customer's infrastructure and findings, and turns that knowledge into new detection rules and engine updates, validated before release. The research foundation is in place. Its connection to the customer environment is in development.

All capabilities →
What CyberSnap looks for

Three scan levels. Each with its own job.

Every level adds a different kind of evidence. Together they tell the team which points to reject, where to dig deeper and which point is suitable for further validation.

Level 1 · Triage Scan

Where to focus

Broad signs of attack across every snapshot in the policy: thousands of files changed in the same window, ransomware extensions, possible ransom notes, high entropy that may point to encryption, and executables disguised as data files.

Output: an evidence-based first sort of where to look.

Level 2 · Threat Hunt Scan

Inside file contents

YARA-X detection rules from CyberSnap or your own team, indicators of compromise and file fingerprints. A rule keeps matching after a file is renamed, so malware is found even before the visible encryption.

Output: which file, which rule, which recovery point.

Level 3 · Forensic Scan

The attacker's way back

Operating-system evidence on Windows and Linux: services, scheduled tasks, auto-start entries, cron and systemd. A file on disk is one finding. A mechanism set to run it again is the reason a restore can bring the attack back.

Output: persistence evidence and a timeline of findings.

How each scan level works →
When teams use CyberSnap

Before, during and after an attack.

Every day

Scheduled scanning

Policies scan snapshots automatically, so when a crisis hits the history and the findings are already there.

During an attack

Ransomware response

See which systems were hit, how far back the indicators go and which points show no findings.

Before the restore

Recovery point validation

Inspect the copy before it returns to production, and start selected servers in isolation where supported.

Over time

Hunting quiet attacks

Connect findings across servers and time to expose persistence and slow-moving activity.

Who it serves

One picture for cyber, infrastructure and management.

Cyber & IR

Evidence of how the attack developed

Findings, suspicious files and a timeline to focus the investigation.

Infrastructure & storage

Which workloads need attention

Which servers and snapshots show findings, and which show none.

DR & recovery

Where to restore from

Prioritized recovery points per system before the return to operations.

CIO, CISO, management

A decision you can explain

A documented, evidence-based basis for the decision, during the incident.

Solutions by industry → For MSPs and service providers → Partner programs →
▸ AI-ASSISTED INVESTIGATION

AI connects the evidence. You regain control.

A single suspicious file tells only part of the story. CyberSnap's AI engine connects findings across systems and scan history, explains what they mean and recommends where to look next. It never overrides the evidence.

Cyber engineProduces traceable findings. Same input, same result.
AI engineAnalyzes findings and metadata, not raw files.
Your teamMakes the operational decision.
app.cybersnap.io · AI analysis
CyberSnap AI analysis: AI notes, recommended actions and AI second opinion per VM
Questions we hear

Straight answers.

Does CyberSnap replace our backup or DR?

No. Backup and DR stay essential, and CyberSnap works alongside them. They answer whether a copy exists. CyberSnap answers what is inside it, and which point is suitable for each system to return from.

Do we need to install anything on our servers?

No. There are no scanning agents on production servers. CyberSnap reads the snapshots already kept on your storage, through the storage API and the virtualization management layer.

Does the AI see our files?

No. The AI engine receives findings and metadata, such as the detection method, file names and paths, severity and scan history, together with context like the server role. Raw files are inspected by the deterministic cyber engine.

Who makes the final decision?

Your team. The cyber engine produces the evidence, the AI explains and recommends, and the people responsible for recovery decide. An AI recommendation never deletes a finding.

What does "no findings" mean?

That the scan which ran found no indicators in that recovery point. SnapMap shows what was scanned, what was excluded and whether the scan completed, because a partial scan is not the same as a full one. It is a restore candidate, not a promise that no threat exists.

Is it only for ransomware?

Ransom Recovery focuses on ransomware and malware. Damage Prevention extends the investigation to quiet, slow-moving attacks such as persistence, espionage and gradual disruption. Parts of Damage Prevention are in development.

Which environments are supported?

VMware vSphere, NetApp ONTAP, NAS and CIFS/SMB file shares, AWS EC2, EBS and S3, with Windows and Linux servers. Nutanix AHV is in development and Google Cloud is planned.

How do we start?

With one system that matters to your business. We install, scan the snapshots you already keep, and review the findings with your team: what was found, what needs checking and where to return from.

Company

Built AI-first. Led by cyber expertise.

CyberSnap began as a cyber recovery solution for demanding Israeli government environments. Today it serves government, national institutions and healthcare, and works with MSPs and technology partners. Based in Fort Lauderdale, Florida.

Meet CyberSnap →

Start with one system that matters to your business.

01InstallOne system. The snapshots you already keep.
02Review the findingsWhat was found, what to check, where to return from.
03DecideBefore the business stops.
Which system should we start with? →