Rubrik adds cyber recovery tools for GitHub & Azure

Rubrik has introduced cyber recovery tools for Microsoft Azure DevOps and GitHub, extending its protection for software development environments.

The new functions are designed to help organisations identify suspicious activity in code repositories, assess which assets have been affected and reverse malicious changes from air-gapped, immutable backups. The tools are intended to let businesses recover from attacks without interrupting legitimate developer work.

The move reflects growing concern over attacks on software development platforms that rely on stolen credentials and other identity-based methods rather than traditional perimeter breaches. In these incidents, attackers can mimic normal developer behaviour and insert harmful changes into repositories, pipelines and related systems.

Rubrik said artificial intelligence is increasing the speed and scale of such attacks, allowing malicious code to spread across large numbers of repositories. That has pushed security suppliers and software teams to focus more closely on protecting source code, development workflows and collaboration tools.

Under the release, Rubrik's DevOps Protection Enterprise Edition adds anomaly detection, blast radius investigation and what the company describes as surgical recovery in a single workflow within Rubrik Security Cloud. The anomaly detection feature baselines audit logs from GitHub and Azure DevOps and matches them with backup metadata to flag suspicious identity activity.

Alerts can then be sent to existing security and ticketing systems. The investigation feature is designed to present a categorised view of affected assets, including repositories, commits, pipelines, workflows, pull requests and settings, so teams can identify the extent of an incident.

The recovery element focuses on restoring only the changes made by an attacker while preserving legitimate work by other developers. Rubrik said this approach is intended to help teams avoid broad code freezes or time-consuming manual rebuilds after an attack.

A separate update broadens the coverage of Rubrik DevOps Protection Foundation Edition. It now backs up a wider set of platform metadata, settings and collaboration tools across Azure DevOps and GitHub.

That includes issues, pull requests, Azure Boards, wikis, packages and organisation settings. The broader scope is intended to give customers enough context to restore not only source code but also the wider record of how software is planned, discussed and delivered.

Rubrik framed the launch as a response to the strategic importance of developer platforms inside large organisations. These environments often contain source code, continuous integration and continuous delivery pipelines, and infrastructure definitions, making them a concentrated store of valuable intellectual property and an attractive target for attackers.

Anneka Gupta, Chief Product Officer at Rubrik, said the issue is no longer limited to the theft of code itself. "An organisation's source code is where innovation lives, and attackers know it," Gupta said.

She said a single compromise can affect software assets at considerable scale before security teams notice. "One stolen token or poisoned dependency can impact thousands of repositories before anyone notices. Our new cyber recovery capabilities for DevOps allow organisations to detect suspicious activity, see what was impacted, and recover only the unwanted changes, using the air-gapped backups they already trust Rubrik to protect," Gupta said.

The announcement also highlights a broader shift in cyber security spending towards resilience and recovery, particularly in systems closely tied to core intellectual property. While backup and recovery tools have long been associated with business continuity in infrastructure and business applications, vendors are now trying to apply similar models to collaborative software development environments, where change is constant and rollbacks can be complex.

For customers using GitHub and Azure DevOps, the appeal will depend on whether recovery can be carried out with enough precision to remove malicious changes without erasing valid code or process history. In modern software teams, where multiple developers may be working across repositories and branches at the same time, that distinction is critical.

Rubrik said the product is intended to give organisations a way to investigate and recover incidents inside development platforms, with the context needed to determine what changed, who was affected and what should be restored. The expanded coverage of metadata and collaboration artefacts suggests the company is positioning recovery as a record of the full software development process rather than a simple code backup function.