A single Hyper-V or Azure Local cluster can host hundreds of virtual machines (VMs).
According to Rubrik Zero Labs 83% of encrypted data across industries sat within virtualized architecture. Hypervisor layers often lack endpoint protection, which gives attackers blind spots to work in, and hypervisor modernization adds new platforms and new blind spots. Ransomware needs only one encryption event to reach the disk and configuration files behind them, and entire application stacks go down together.
In regulated industries, proof of recovery is often a regulatory mandate, and boards and executives want answers: Are we prepared to respond to a large-scale cyberattack? How quickly can we get the business back up and running? When did we last prove it? Many organizations don't have firm answers until a breach forces them to review existing recovery policies ad processes.
Speed on recovery day comes from advance work done before the incident. Rubrik Cyber Recovery lets your team build the plan while everything is calm: choose the VMs, set the boot order, and map compute, storage, and network for the recovery target. Schedule rehearsals and the day ransomware hits, your team runs a plan it has already tested, finding the last clean snapshot, validating it in a clean room, and recovering your Microsoft estate at machine speed.
Five Requirements for Recovery After An Attack
Once an attack is confirmed, the clock starts. Recovery comes down to five things:
Find the last clean copy: Restore the wrong recovery point and the malware goes back into production.
Recover what was hit, in order: The affected VMs return in the right order, onto the right compute, storage and networks.
Investigate without delaying recovery: An isolated environment lets your team investigate while the business restores.
On Azure Local, come back as an Azure managed Azure Local (Arc) VM: A VM recovered as a Hyper-V VM no longer appears in the Azure portal.
Prove it works: Auditors, insurers and regulators expect evidence of tested, timely recovery.
Rubrik Cyber Recovery covers for all five. Cyber Recovery for Hyper-V is in limited availability, with Azure Local plans coming soon.
Detection That Hands Off to Recovery
Rubrik Data Threat Analytics already flags anomalous snapshots and quarantines those with detected threats across your Hyper-V and Azure Local backups. Cyber Recovery picks up where it stops. Snapshot selection filters by anomaly and quarantine status, so you can exclude flagged snapshots before you recover. You launch recovery straight from the Anomaly Detection pages in Rubrik Security Cloud, so your team moves from a flagged snapshot to recovery in one console.
Hyper-V & Azure Local Recovery Plans
During an incident, every open question costs time. A recovery plan answers key questions in advance: which VMs return, in what order, and onto which infrastructure.
Building an effective recovery plan requires four steps:
Define the plan: Name it, pick the target cluster, and select the VMs. A plan can represent a single application or your minimum viable business.
Set the boot order: Priority groups bring the database up before the application that needs it.
Map the recovery target: Assign compute, storage, and network, then review the plan once and save it.
Test and refine: Run the plan on a regular basis and update it based on the results.
Plans recover Hyper-V VMs with Export or Live Mount, and they can draw on replicas as well as your primary snapshots. Role-based access controls decide who can build and run plans.
Clean Room Investigation During Recovery
Teams often face a trade-off after an attack: recover fast, or investigate first so nothing reinfects production.
Cyber Recovery removes that trade-off. Data Threat Analytics helps you identify a recovery point to start from. Live Mount brings a snapshot up in an isolated environment outside production. Your team can run forensics and validate the recovery there while the business restores from a safe point.
Azure Local Recovery With Its Azure Identity Intact
Cyber Recovery for Azure Local is coming soon.
Azure Local VMs are Azure resources, managed through the Azure Portal. When recovered as a Hyper-V VM they lose Azure governance and manageability from Azure Portal.
Export to Azure Local (Arc) VM is in limited availability today. It brings the recovered VM back as an Azure Local VM, managed in Azure again. With Cyber Recovery for Azure Local, which is coming soon, that recovery type and target become part of your plans. When you build a plan, you choose the target VM type, Hyper-V or Azure Local (Arc), so the VM lands in the state you want before the attack happens.
Want the full story on Arc recovery? Read Export to Azure Local (Arc) VM.
Prove Recovery to Auditors, Insurers and Boards
Recovery that has never been tested is a guess. A guess won't suffice when you want to prove your recovery capabilites to auditors.
If you schedule recoveries to run on their own, and every run produces a recovery report. Role-based access controls and audit logs record who built and ran each plan. So when your board, auditors or insurers ask when you last proved recovery works, you have the answer and the evidence, without assembling it by hand (or guessing).
One Recovery Playbook Across Hypervisors
Many teams run Hyper-V and Azure Local alongside other hypervisors, and recovery has to keep pace with an estate that keeps changing. Cyber Recovery workflows, reporting, and audit logging follow the model Rubrik customers already use on VMware vSphere and Nutanix AHV, so teams that run more than one hypervisor work from a familiar playbook in Rubrik Security Cloud.
You can't control when ransomware will attack. But you can plan your response. Build it now, rehearse it on a schedule, and when the attack comes, recover your Hyper-V and Azure Local estate at machine speed.
Cyber Recovery for Hyper-V is in limited availability with Rubrik Cloud Data Management (CDM) 9.6.1. Azure Local plans are coming soon. Talk to your Rubrik account team to learn how to get access.
Meet Us at Microsoft Ignite
See Rubrik cyber recovery for Hyper-V and Azure Local in action at booth #1159 at Microsoft Ignite, or request a meeting with a Rubrik expert.
Safe Harbor Statement: Any unreleased services or features referenced in this document are not currently available and may not be made generally available on time or at all, as may be determined in our sole discretion. Any such referenced services or features do not represent promises to deliver, commitments, or obligations of Rubrik, Inc. and may not be incorporated into any contract. Customers should make their purchase decisions based upon services and features that are currently generally available.