Everpure Adds Post-Quantum Encryption and Faster Recovery to Storage Security

Why storage is being positioned as an active defender

In a blog post marking Cybersecurity Awareness Month, Everpure argues that the adversary is now automated. According to the company, agentic AI writes malware, probes for misconfigurations and adapts mid-attack without waiting for a human operator. It points to an incident in July in which OpenAI models evaluated for cyber capability exploited a zero-day and ran roughly 17,600 actions inside Hugging Face's network before being contained. It also cites a figure that 53% of security leaders named AI-powered attacks as their primary challenge this year.

A second concern is longer term. Everpure says nation-state actors and well-resourced criminal groups are exfiltrating encrypted data now, assuming quantum computing will break current encryption within the decade. Data stolen this month could therefore be readable in plaintext five years from now.

Everpure describes an active defender architecture as one that assumes the perimeter will be breached, embeds security and anomaly detection at the data layer, and recovers automatically when something gets through.

Built-in security and connected detection

On the security side, Everpure is adding post-quantum cryptography for data in flight and at rest, which it says closes the harvest-now-decrypt-later exposure on hardware customers already have installed. The company notes that AES-256, the standard for encrypting data at rest, is already built to withstand quantum attacks, while public-key exchange is not, so in-flight data is where the exposure sits. It references the Commercial National Security Algorithm Suite (CNSA) 2.0, which phases out non-compliant equipment by December 31, 2030. Because the encryption is software-defined, moving to new algorithms happens through library and protocol updates, and the Evergreen subscription covers hardware upgrades that firmware cannot.

KMIP support for Portworx keeps encryption keys in a customer's own external key manager. Each tenant gets its own key, and rotation happens server-side with no data re-encryption. A PCI-DSS assessment in Pure1 brings fleet-level security scores, compliance checks and appliance-level findings into one view.

For detection, enhanced anomaly detection in Pure1 monitors data reduction ratio, capacity, latency, IOPS, bandwidth, volume changes and snapshot counts. It now also watches identity behavior, including failed and unusual logins, unseen IP addresses, unusual time zones, brute-force behavior and password spraying. Appliance-level insight names affected volumes and their recent snapshots, so triage and the choice of a recovery point happen in one place.

Integrations extend this to backup tools:

• Veeam: the Everpure Fusion fleet can be registered once and protection managed across all FlashArray systems from Veeam.
• Commvault: a Pure1 storage anomaly becomes workload-aware context, with events raised in Commvault Cloud where Threat Scan and other workflows can take over.
• Rubrik: FlashArray volumes and protection groups appear in Rubrik Security Cloud as protected objects under the same SLA policies, RBAC and reporting as other workloads.

Dynamic response and recovery

The Unified Data Protection Catalog in Pure1 combines snapshots, SafeMode settings, replication, recovery points and protection metadata in one fleet-wide view with RPO and expiration. Protection gaps, policy drift, immutability issues and RPO exposure surface as findings, and each object has downloadable evidence of how data was recovered.

Portworx DR with Red Hat Advanced Cluster Management moves Kubernetes disaster recovery from a multi-step CLI workflow into the OpenShift ACM console. According to Everpure, asynchronous DR is qualified on OpenShift 4.18 and later, at an RPO of 15 minutes and an RTO under 60 seconds.

ActiveDR for Everpure Resilience Service is now generally available. It streams changes to the recovery site as they happen, keeping the recovery point close to current. Test failover, production failover and failback are built in. Everpure says that at scale this means RPO down to near-zero and RTO under 30 minutes for hundreds of VMs, which it calls among the fastest SLAs in the industry for cyber recovery.

What it means for security teams

Everpure frames the central question for security owners as what happens in the hour after prevention fails. It asks whether storage signals reach the console where responders work, and whether the architecture knows which volumes should come back first. For customers, the announced changes aim to put anomaly detection, compliance views and recovery readiness at the storage layer and connect them with the backup and Kubernetes tools they already use. The performance figures are the company's own claims.