Cohesity continued its security push — and its novel approach to preventing attacks via backup data — with CyberScan, a new application that assesses vulnerabilities within an enterprise’s IT environment.

Using backup data is a unique way to improve security posture, and it’s something that both Cohesity and its top competitor Rubrik initially moved into with their their respective ransomware prevention and response products, which they rolled out last summer (Rubrik) and in January (Cohesity).

Still, the company's new CyberScan application doesn’t signal a pivot into the security sector, said Raj Dutt, director of product marketing at Cohesity.

“At our heart we are a data management company,” he said. “We start by backing up the data. That’s how we make it available for other use cases, and data management will continue to be a core focus for us. But the important aspect is how do you make that backup data productive? Before us, no one was using backup data for anything — it was just an expensive insurance policy. We are the first ones to make backup data useful.”

The application, which is available on the Cohesity MarketPlace, works by scanning backup copies on the vendor’s DataPlatform (instead of the live production copy) to identify any vulnerabilities. This includes looking for flaws across the operating system, computer, network devices, and configurations.

It then provides a global view of all vulnerabilities through a security dashboard along, and recommends action to fix these exposures.

CyberScan also uses Tenable.io for vulnerability management in the cloud. Tenable’s vulnerability management product uses the public Common Vulnerabilities and Exposures (CVE) database to locate exposures. “This is the first application we’ve seen that focuses on assessing systems for exposures, such as vulnerabilities, within backup data,” said Ray Komar, vice president of technical alliances at Tenable, in a statement.

The application runs directly on the Cohesity cluster, where the data sits, rather than moving it to a separate environment. “Our unique architecture allows us to do this — remember we are looking at the data, not the metadata,” Dutt said. “We are able to actually derive more insights from the actual backup data without moving it, without copying it.”

CyberScan also compliments Cohesity’s other security tools, Dutt said. Customers can access the earlier anti-ransomware capabilities from the same security dashboard as the new vulnerability scan. And SentinelOne, which is also available in the vendor’s MarketPlace, provides virus libraries based on machine-learning algorithms directly on the Cohesity DataPlatform.