# IBM FlashSystem Flags Data Theft in the Drive Before Ransomware Encrypts, Under 1% False Positives > Source: > Published: 2026-10-29 15:25:37+00:00 [IBM FlashSystem](https://www.storagereview.com/news/ibm-introduces-next-generation-flashsystem-with-agentic-ai-for-autonomous-storage-operations-2-107am) 5600, 7600, and 9600 arrays built on the fifth-generation [IBM FlashCore Module](https://www.storagereview.com/news/ibm-ds8000-release-10-2-brings-fcm5-in-edsff-doubled-back-end-throughput-and-automated-ransomware-containment) now detect data exfiltration inside the drive, next to the ransomware encryption detection the modules already run. IBM says the module learns each volume’s normal read pattern, flags reads that break from it, and confirms a suspected event over a 30-minute confidence window with a validated false-positive rate below 1%. The capability is available starting in October 2026 on eligible configurations running firmware 9.1.2 or later. The case IBM makes is that recovery answers the wrong question when data has already left. Recovery brings the volumes back, but it cannot tell an operator what was read out before the encryption started or how large the exposure is. IBM cites Google Cloud’s M-Trends 2026 for attackers typically spending 11 to 14 days inside a network before deploying ransomware, and its Cost of a Data Breach 2026 report for an average of 247 days to identify a breach. ## Inline FlashCore Module Telemetry and Threat Detection Exfiltration is harder to catch than encryption because it is meant to look like ordinary reads. The FlashCore Module analyzes every I/O at the drive, builds a baseline for each volume, and recognizes routine backup passes and analytics scans so a scheduled full read does not trip an alert. Because the analysis runs in the module, it does not depend on endpoint agents or host logs an attacker may control, requires no application changes, and IBM says it adds no measurable performance impact. “The future of cyber resilience is not simply recovering after an attack,” said Sam Werner, General Manager, IBM Storage. He framed the goal as identifying risk before damage occurs, with earlier insight into potential data theft and a faster response. Laurence Horrocks-Barlow, Technical Director at OCF Limited, described storage-layer detection as another stage of defense: “The sooner you know something is wrong, the sooner you can act.” ## FIPS Post-Quantum Cryptography and Secure Fibre Channel HBAs The second change targets harvest-now, decrypt-later attacks, where encrypted data stolen today is held until quantum hardware can break the key. FlashSystem keeps AES-256 for data at rest, and the fifth-generation FlashCore Module adds ML-KEM under FIPS 203 and ML-DSA under FIPS 204, two algorithms developed with IBM researchers. ML-KEM runs in hybrid mode to transport the unlock PIN to the module, and hybrid ML-DSA signatures verify firmware authenticity. IBM says Secure HBAs will carry the post-quantum protections into the Fibre Channel data path and enable quantum-safe, session-level encryption on the fabric, without affecting efficiency, performance, or the ransomware detection running in the modules. IBM has not given a date for the HBA piece, and the session-level encryption is described as a future capability. ## FlashSystem.ai Operational Governance FlashSystem.ai, introduced with the 5600, 7600, and 9600 launch, picks up advisory capabilities in this update: contextual recommendations, task context that carries across management sessions, and suggested next-best actions. Administrators work in natural language, can see the reasoning behind a recommendation, and keep approval authority through policy-based governance. IBM puts the effort reduction for routine provisioning at up to 90%, a figure from lab-controlled evaluations of multi-volume provisioning with Safeguarded Copy and disaster recovery policies. | **Specification** | **IBM FlashSystem October 2026 Update** | |---|---| | **Data Exfiltration Detection** | | | **Applicable Systems** | IBM FlashSystem 5600, 7600, 9600 | | **Detection Engine** | Fifth-generation IBM FlashCore Module, in-drive analysis of every I/O | | **Method** | Per-volume read baseline with recognition of routine backups and analytics scans | | **Confirmation Window** | 30 minutes | | **False-Positive Rate** | Below 1% (IBM field telemetry, firmware 9.1.2 or later) | | **Availability** | Starting October 2026 on eligible configurations | | **Cryptography** | | | **Data at Rest** | AES-256 | | **Post-Quantum Algorithms** | ML-KEM (FIPS 203), hybrid, unlock PIN transport to FCM5 ML-DSA (FIPS 204), hybrid signatures, firmware authenticity | | **Fabric Extension** | Secure HBAs for the Fibre Channel data path, future session-level encryption | | **Management** | | | **FlashSystem.ai** | Contextual recommendations Task context across sessions Suggested next-best actions Policy-based governance | | **Claimed Effort Reduction** | Up to 90% for routine provisioning (IBM lab evaluation) |