Immutable Backup: The Last Line of Defense Against Ransomware. Critical considerations for a resilient backup strategy

Every so often, a single incident reminds an entire industry of something it already knew but preferred not to dwell on. The recent cyberattack against Romania's National Agency for Cadastre and Land Registration (ANCPI) is one of those reminders. Without getting into the specifics of what happened—those details belong to the investigation, not to a technology article—the episode reinforces a simple, uncomfortable truth: ransomware is not a theoretical risk. It is a real, recurring, and rapidly worsening threat. According to Check Point's 2026 Cyber Security Report, the number of ransomware victims extorted globally grew 53% year-over-year, while the number of active ransomware-as-a-service groups expanded by 50% over the same period. And no security architecture, however carefully designed, can offer a 100% guarantee against it.

This is not a failure of security teams. It's the nature of the threat. Given enough time, enough persistence, and enough sophistication, attackers can find a way in—through a compromised credential, a misconfigured system, a supply-chain weakness, or simple human error. The question organizations should be asking isn't "can we prevent every breach?" but "when a breach happens, can we recover?"

The new front line: your backup

For years, backup was treated as the safety net that made ransomware survivable. Encrypt the production environment, restore from a clean copy, move on. Attackers have caught up. Today's ransomware operators routinely spend days—sometimes weeks—inside a compromised network before triggering encryption, using that time to locate, corrupt, or delete backup repositories first. If the backup goes down with the production system, the victim is left with two options: pay, or rebuild from nothing.

That's why the center of gravity in cyber resilience has shifted. It's no longer just about stopping the intrusion—it's about ensuring that whatever happens to production, a clean, isolated, restorable copy of the data survives. Backup has become both the primary target of modern ransomware operators and, when properly architected, the primary reason an organization survives an attack with its data intact.

The good news is that this shift matters. Organizations that maintain isolated, verified, and regularly tested backups consistently recover faster and with far fewer losses than those relying on backups that live inside the same network perimeter as production. The bad news is that "having a backup" is no longer enough on its own—the backup itself has to be built to withstand an attacker who is actively hunting for it.

The numbers back this up. According to Sophos's State of Ransomware 2026 report, based on a survey of 2,158 IT and security leaders whose organizations were hit by ransomware in the past year, backup-based recovery was used in 66% of encrypted-data cases—up 12 percentage points from 2025. As a direct result, only 48% of victims with encrypted data ended up paying the ransom, and the median ransom demand itself fell to $698,000, down 65% over two years. In other words, as backup and recovery practices improve, the leverage ransomware operators hold over their victims keeps shrinking.

Why immutability is non-negotiable

An immutable backup is a copy of data written in WORM format—Write Once, Read Many—that cannot be modified, encrypted, or deleted for a defined retention period, regardless of who holds the credentials. Even if an attacker gains full administrative access to a network, an immutable backup repository simply won't accept a deletion or an overwrite request until its retention lock expires. This is precisely why organizations following the CISA-recommended approach to ransomware resilience treat immutable, offline, or air-gapped backup copies as a baseline control rather than an optional extra.

The practical difference between the two approaches becomes clear when placed side by side:

Veeam, whose technology underpins M247 Global's own backup service, supports immutability across multiple layers of infrastructure: hardened Linux repositories using xattr-based file locking, object storage with S3-compatible object lock (AWS, Azure Blob, Wasabi, and similar providers), and fully managed cloud vaults that are immutable and logically air-gapped by default. The recommended framework behind all of it is the well-known 3-2-1-1-0 rule: three copies of data, on two different media, with one copy off-site, one copy immutable or air-gapped, and zero errors confirmed through regular recovery testing.

The last point deserves emphasis. An untested backup is a hypothesis, not a safeguard. Immutability protects the data from being altered—but only structured, automated verification confirms that the data can actually be restored when it matters.

M247 Global Backup-as-a-Service: immutability, built in

M247 Global's Backup-as-a-Service (BaaS) is designed around exactly this principle. Built on Dell enterprise hardware and powered by Veeam, the service delivers automated backup, immutable storage, end-to-end encryption, and fast recovery as a fully managed cloud offering—no additional hardware investment required on the customer's side. Because it runs on Veeam's platform, it inherits the same immutability mechanisms used across Veeam's ecosystem: backup data that, once written, cannot be tampered with by ransomware, a rogue insider, or a compromised credential.

Geography adds another layer of resilience. M247 Global's BaaS is hosted in Tier 3 data centers in Bucharest, and the company's recent acquisition of a second facility in Brașov—roughly 170 kilometers away, on a distinct seismic profile and power grid—gives customers the option of true multi-site redundancy within Romania. For organizations that need their backup infrastructure physically and operationally separated from their primary systems, that geographic spread is not a marketing detail; it's a structural requirement for surviving a regional outage, a targeted attack, or a natural disaster.

Backup is not enough—you need a restoration strategy

Here's the part that gets overlooked in most conversations about ransomware resilience: having a backup, even an immutable one, solves only half the problem. The other half is restoring it fast enough for the business to keep functioning. For a small company with a few hundred gigabytes of data, that's rarely a challenge. For a large enterprise or a public institution managing tens of terabytes across dozens of systems, restoration speed becomes the real battlefield.

This is where two often-misunderstood metrics become essential: RTO (Recovery Time Objective) and RPO (Recovery Point Objective). RTO defines how long the business can tolerate being down before recovery must be complete. RPO defines how much data loss is acceptable, measured in time—the gap between the last valid backup and the moment of failure. Together, they turn "we have backups" into a measurable, business-aligned commitment: recovery within X hours, with no more than Y minutes of data loss. Without clearly defined RTO and RPO targets, a backup strategy has no way of proving whether it actually protects the business or merely gives the appearance of doing so.

Meeting aggressive RTO and RPO targets at scale requires more than periodic backup jobs. Veeam achieves this through live backup technology—capturing data while systems and virtual machines remain fully operational, with no downtime. This relies on native hypervisor snapshots (VMware, Microsoft Hyper-V VSS) combined with application-aware processing, so that databases and applications are captured in a consistent state rather than mid-transaction. For environments that can't tolerate even brief gaps between restore points, continuous data protection (CDP) pushes RPOs down to seconds by replicating changes in near real time, rather than waiting for the next scheduled backup window. Together, these technologies allow organizations to protect large, complex, always-on environments without the trade-off between protection and performance that older backup approaches forced them into.

M247 Global advice: see resilience as a business discipline

None of this works as a set of disconnected technologies. Immutable storage without tested restoration procedures is a false sense of security. Fast restoration without immutable, isolated copies is recovery built on sand. RTO and RPO targets set on paper but never validated against real infrastructure are just numbers in a slide deck.

The organizations that come through a ransomware attack intact are the ones that treat backup, immutability, and recovery as a single, integrated business continuity strategy—not as isolated technical checkboxes owned by different teams. That means defining recovery objectives in business terms, choosing infrastructure that enforces immutability by design, and testing the entire chain regularly enough to trust it under pressure.

Ransomware isn't going away, and no architecture is immune. But with the right combination of immutable backup, a coherent restoration strategy, and geographically redundant infrastructure, an attack stops being an existential threat and becomes what it should be: a serious incident that the business is prepared to recover from.

Don't wait for the next attack to test your backups.

Get your personalized Backup-as-a-Service quotation from M247 Global today: www.m247global.com/buaas

FAQs

What makes a backup "immutable"? It's written in WORM (write-once, read-many) format, so once saved it can't be modified, encrypted, or deleted until a set retention period passes—even by someone with admin credentials.

Can ransomware still delete an immutable backup? No. As long as the retention lock hasn't expired, the storage layer itself rejects deletion or overwrite requests, regardless of what access an attacker has gained elsewhere in the network.

What's the difference between RTO and RPO? RTO is how long you can afford to be down before systems are back up; RPO is how much data you can afford to lose, measured in time since the last valid backup.

Is immutable backup alone enough to survive a ransomware attack? No. It has to be paired with regular recovery testing and clear RTO/RPO targets—an immutable backup that hasn't been proven to restore is still a risk, not a guarantee.