Integration of inline malware discovery and offline vault ransomware prediction

A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:

• by a first malware detection process that is performed, at a datacenter, inline with a production data backup process as production data is being backed up from the datacenter to a vault:
• in a production system that performs the data backup process, checking the production data, as the production data is being backed up to the vault, for evidence of a malware process;
• identifying the production system as possibly affected by the malware process by identifying production data that has interacted with a process suspected to be the malware process;
• and
• generating one or more cues comprising metadata associated with the production data that has interacted with the suspected malware process, the one or more cues being generated in real time as the production data is being backed up, and the one or more cues prioritizing particular data, of the production data that is being backed up, for inspection;
• transmitting the cues to the vault during the backup process;
• and
• by a second malware detection process that is performed at the vault, offline from the first malware detection process:
• checking the cues to identify the particular data prioritized for inspection;
• and
• performing an offline inspection of the particular data identified by the cues, to the exclusion of uncued data during an inspection cycle, the offline inspection being deeper than the checking performed by the first malware detection process, and determining, based on the offline inspection, that the malware process has affected the production system.