CloudState

Coming soon

Ransomware detection for Google Cloud. Your data stays with you.

We are a startup building a solution that watches databases, object storage, VM disks and clusters in Google Cloud, spots the first signs of data being encrypted or destroyed, tracks policy and configuration changes, and collects the evidence you need for DORA and NIS2.

What we are building

  • Runs in your environment

    Everything runs in your own Google Cloud projects, read-only. The content of your databases and files never leaves your organisation, and we do not store your data.

  • Sees deeper than logs

    Changes inside Cloud SQL databases, the content of Cloud Storage objects, VM disks and container images: signals your SIEM cannot produce on its own.

  • Early warning

    Disabled backups, destroyed encryption keys and malware such as web shells and backdoors, which usually come before encryption.

  • Policy and configuration history

    Changes to organisation policies, permissions, keys and network perimeters: who changed what and when, a full version history, and an assessment of whether a change weakens your defences.

  • Configuration and vulnerabilities

    Configuration assessment against good practice, comparison with an approved baseline, and vulnerability information for VMs and container images, starting with those exploited in real attacks.

  • Watches itself

    Detects attempts to disable or tamper with monitoring, and keeps evidence in an archive locked against deletion and modification.

  • Ready for DORA

    An incident register with classification and reporting deadlines, a register of information on ICT services, access reviews and evidence from resilience testing.

  • Works with your SIEM

    Works on its own, with its own dashboard and reports, and if you have a SIEM or an external SOC, it forwards events and ready-made detection rules to them.

  • Response on your terms

    By default it only notifies. If you choose, it can take safe actions such as a database backup or a disk snapshot, and anything else only after a second person approves.

Who it is for

Any organisation that keeps important data in Google Cloud, and in particular:

  • financial entities subject to DORA, including those outside banking: insurers, payment institutions, investment firms and fintechs,
  • ICT and SaaS providers serving the financial sector,
  • essential and important entities under NIS2, including energy, transport, health and digital infrastructure,
  • suppliers to these entities whose clients ask for proof of data security,
  • healthcare providers and companies processing medical or other sensitive data,
  • public administration and local government,
  • SaaS companies, software houses and online shops whose business depends on customer data,
  • organisations preparing for cyber insurance,
  • managed security service providers (MSSPs) protecting their clients' environments.

Get in touch

Want to learn more about the project or talk about protecting data in Google Cloud? Write to us: