IBM says eligible FlashSystem 5600, 7600 and 9600 configurations can detect suspected data exfiltration by learning each storage volume’s usual read patterns. The capability runs in the fifth-generation FlashCore Module with firmware 9.1.2 or later, and IBM describes it as detection and notification, not an automatic way to stop data transfers. IBM’s description also puts its false-positive figure in the context of customer field telemetry.
How FlashSystem identifies unusual reads
IBM says the FlashCore Module analyzes input and output operations and learns the normal read patterns for each volume. It can recognize routine backup passes and analytics scans while flagging unusual read activity. A suspected event then goes through a 30-minute confidence window before IBM classifies it as verified.
IBM says the analysis happens in the storage hardware, without endpoint agents, host logs or application changes. That puts the monitoring at the storage layer, rather than relying on software installed on individual endpoints.
Eligible systems and IBM’s stated timing
The feature applies to eligible configurations of FlashSystem 5600, FlashSystem 7600 and FlashSystem 9600 powered by a fifth-generation FlashCore Module and running firmware 9.1.2 or later. IBM said availability for these configurations would start in October 2026.
What IBM’s below-1% figure describes
IBM reports a false-positive rate below 1% based on field telemetry from customers running firmware 9.1.2 or later on the named systems. IBM also says results vary by customer. The figure is a vendor-reported field result, not a guarantee that every installation will see the same rate.
The feature identifies and reports suspected activity. IBM describes notification and support for investigation and response; the detection capability itself is not described as automatically blocking transfers or containing an attacker. A security team would still need to act on an alert.
Cryptography and FlashSystem.ai
IBM says AES-256 remains in use for data at rest. In the fifth-generation FlashCore Module, hybrid ML-KEM (FIPS 203) transports the unlock PIN from the storage controller to the module. Hybrid ML-DSA (FIPS 204) signatures verify firmware authenticity. Those are the specific cryptographic functions IBM attributes to the algorithms.
IBM also describes new FlashSystem.ai functions, including contextual recommendations, task context carried across sessions and suggested next actions. For routine multi-volume provisioning with Safeguarded Copy and disaster-recovery policies, IBM reports up to 90% less effort in an internal lab comparison against the same latest-generation systems without FlashSystem.ai. IBM says actual results vary with the environment, integrations, policies and user proficiency.
IBM frames Secure HBAs and session-level encryption across Fibre Channel as future extensions. The HBA plan is separate from the stated availability start for exfiltration detection.
