Backup & Recovery

Immutable backup and recovery

Ransomware cannot delete or encrypt your way back.

Addresses 77 stories in our coverage in the last 90 days 4 products that provide it

What it is

Backups that cannot be changed or deleted for a set period, kept apart from the production environment, with regular restore tests.

How to value it

Ransomware groups go after backups first, because without them the victim has to pay or rebuild. Immutable, separated backups and tested restores turn a ransomware attack from an existential event into a recovery project, and cyber insurers routinely ask about them.

Questions to ask a vendor

  1. 1Is immutability enforced by the storage itself, so that even an admin account cannot delete backups?
  2. 2Are backup systems run with credentials separate from production?
  3. 3How fast can we restore our critical systems at scale, and have you shown it?
  4. 4Does it cover SaaS data such as Microsoft 365?

For your risk register

Risk
Ransomware destroys data and backups, forcing a payment or a rebuild.
Control
Immutable, separated backups with quarterly restore tests.
Owner
Infrastructure lead.
Measure
Time to restore critical systems in the latest test.

A starting point: set the owner and measure to fit your organisation.

Products that provide it

Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.

Rubrik

Rubrik Zero Trust Data Protection

Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.

Veeam

Veeam Data Platform

Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.

Recent stories it addresses

340 stories in total

How we list vendors

  • A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
  • Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
  • Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
  • Logos, product names and quoted text belong to the vendors and are shown to identify them.
  • Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.