SnapMirror synchronous and SnapMirror active sync support: ARP/AI now supports volumes in SnapMirror synchronous and SnapMirror active sync relationships. ARP/AI runs on the active, read/write primary volume in the relationship, creating primary-only ARP/AI snapshots and providing machine-learning-based ransomware detection.

System Manager workload characteristics display removed: System Manager no longer displays Autonomous Ransomware Protection with AI (ARP/AI) workload characteristics, including baseline and surge statistics. Surge activity is frequently misinterpreted as a ransomware attack or as requiring manual adjustment, so this information is removed. ARP/AI behavior and detection are unchanged, and surge statistics remain available using ONTAP CLI and REST API options for advanced analysis.

ARP/AI automatic default enablement: ARP/AI is enabled by default automatically on all new volumes for AFF A-series and AFF C-series, ASA, and ASA r2 systems. After upgrading to ONTAP 9.18.1, a 12-hour grace period allows you to opt out of default enablement. If you do not opt out, ARP/AI is automatically enabled for all new volumes created after the grace period ends.

ARP/AI FlexGroup parity: FlexGroup volumes now have parity with FlexVol volumes for ARP/AI support on on-premises ONTAP platforms (AFF and FAS) and virtual ONTAP deployments (Cloud Volumes ONTAP and ONTAP Select). Beginning with ONTAP 9.18.1, FlexGroup volumes use the ARP/AI model by default.

SAN block-device support: ARP/AI supports SAN volumes with encryption-based anomaly detection, introducing advanced ransomware protection capabilities for block-level workloads. Supported volumes include those containing LUNs (block storage) and NVMe namespaces. ARP/AI also detects NAS volumes containing VMware vSphere hypervisor virtual disks.

System Manager ransomware monitoring extended to SAN: System Manager now displays ARP status, entropy spike details, and threat alerts for SAN volumes alongside NAS volumes, providing a single view of ransomware protection across all storage types.

Block-device evaluation period: SAN workloads undergo a two- to four-week evaluation period during which ARP/AI establishes baseline encryption behavior. Detection and alerts occur while ARP/AI establishes baseline thresholds, providing immediate active protection during this evaluation period.

Configurable detection thresholds for SAN volumes: After the evaluation period establishes a baseline encryption threshold for a SAN volume, you can modify the threshold to tune detection for specific workload characteristics.

Entropy statistics for SAN volumes: New CLI commands provide visibility into volume-level encryption statistics for SAN workloads, allowing you to view encryption percentage histograms and recent high-encryption events to support threat investigation.

Updated ARP snapshot naming: ARP snapshot naming convention now distinguishes between periodic automatic backups (named Anti_ransomware_periodic_backup.YYYY-MM-DD_HHMM) and snapshots created in response to detected attacks (named Anti_ransomware_attack_backup.YYYY-MM-DD_HHMM).

Hypervisor support: ARP/AI supports NAS volumes containing VMware vSphere virtual disks. Beginning with ONTAP 9.17.1 P5, ARP/AI also supports Hyper-V, KVM, and OpenStack hypervisors.

ARP/AI model introduction: A new AI-based detection model replaces the earlier ARP model for FlexVol volumes. ARP/AI eliminates the learning period requirement. Active protection begins immediately upon enablement, providing faster ransomware protection.

Unlimited file extension detection: ARP/AI removes the 4,000 unique file extension limit that applied to the earlier ARP model, so workloads with many file types are better protected.

Automatic security bundle updates: NetApp delivers ARP/AI security updates outside the regular ONTAP release schedule. If your cluster is enrolled in automatic system and firmware updates, you are automatically notified when ARP/AI security updates become available. You can also configure automatic installation of these updates to maintain continuous protection against the latest threats.

Tunable alerts: Configure Autonomous Ransomware Protection to receive notifications when a new file extension is detected or when an ARP snapshot is taken, providing earlier warning of possible ransomware events and enabling faster response to threats.

FlexGroup volume support: ARP protection is now available for FlexGroup volumes, extending ransomware protection beyond traditional FlexVol volumes to large-scale, massively scalable storage environments.

Automatic learning-to-active mode transition: ARP automatically determines the optimal learning interval and switches from learning mode to active mode, which can occur before the traditional 30-day recommendation. This automation reduces manual steps and speeds up full protection.

Multi-admin verification integration: Multi-admin verification (MAV) can now protect Autonomous Ransomware Protection operations, ensuring that sensitive ARP actions require approval from multiple administrators before they run.

SnapMirror interoperability: ARP now supports volumes protected with SnapMirror asynchronous relationships, enabling ransomware protection for replicated data. Support also extends to SVMs protected with SnapMirror (SVM disaster recovery) and SVMs enabled for SVM data mobility.

Enhanced detection algorithm: ONTAP enhances the ARP detection algorithm to detect additional malware threats, improving the accuracy and scope of ransomware threat identification.

Modifiable attack detection parameters: Modify ARP detection thresholds for file extensions, entropy, and IOPS to tune detection behavior for specific workload characteristics. By default, ARP flags when 20 or more unseen file extensions appear within a short time period.

Configurable snapshot retention: Adjust settings for automatically generated ARP snapshots, including maximum snapshot count and retention behavior.

License update: A new Anti_ransomware license key activates Autonomous Ransomware Protection. Systems upgrading from ONTAP 9.10.1 continue to work with the previous license key, which provides the same functionality.

Initial release of Autonomous Ransomware Protection: Autonomous Ransomware Protection uses workload analysis in NAS environments to alert you about abnormal activity that might indicate a ransomware attack. Supported on NAS (NFS and SMB) FlexVol volumes with ONTAP 9.10.1 and later. ARP operates in learning mode initially, analyzing system metrics to develop an alert profile, then transitions to active detection mode for real-time ransomware threat monitoring and response.