When you start a VM in ransomware recovery on the recovery SDDC, a next generation antivirus scan looks for known vulnerabilities and malware signatures, and a deep behavior analysis begins of all running software and processes on the VM guest OS, looking for suspicious behavior.

To learn about how VMware Live Cyber Recovery analyzes VMs during ransomware recovery, watch this short video: