The Chief Information Security Officer (CISO) is concerned about business application availability. The organization was recently subject to a ransomware attack that resulted in the unavailability of

Virtualization enables rapid recovery through VM snapshots (frequent point-in-time data captures), live migration, and the ability to quickly spin up new virtual instances from clean snapshots, dramatically reducing RTO from days to hours or minutes. Virtual environments also support replication to secondary sites and easy rollback to pre-attack states, directly addressing both the RTO improvement goal and the need for more frequent data captures.

Antivirus is a preventative control that detects and removes malware but does not improve RTO or provide mechanisms for frequent data captures or rapid system restoration after an attack.

Process isolation is a security technique that limits the blast radius of a compromised process but does not address recovery time objectives or provide data capture/backup capabilities needed after a ransomware event.

A Host-based Intrusion Prevention System (HIPS) monitors and blocks suspicious activity on endpoints as a preventative and detective control, but it provides no functionality for improving recovery time or enabling frequent data snapshots.