Modern ransomware doesn't just encrypt production data — it specifically hunts for backup systems first, because a working backup is what lets a company refuse to pay. If your backup is reachable from the same network as everything else, an attacker who gets in can encrypt or delete it right alongside the primary data, and the entire point of having a backup disappears. That's the problem enterprise-grade disaster recovery is actually built to solve, and it's a different problem than "storing a copy of your files somewhere."
Immutability Is the Feature That Actually Matters
An immutable backup can't be altered or deleted for a defined retention window — not by an admin account, and not by ransomware that's compromised admin credentials. Some platforms go further with air-gapped backups, physically or logically isolated from the production network so there's no path for an attacker to reach them at all, even with valid credentials. If a backup solution can't guarantee immutability, everything else it offers is secondary.
RTO and RPO: The Numbers That Decide How Bad a Bad Day Gets
Two figures determine what a disaster actually costs a business: Recovery Time Objective (RTO) — how long until systems are back up — and Recovery Point Objective (RPO) — how much data gets lost in the gap since the last backup. A platform promising a four-hour RTO and a fifteen-minute RPO is a fundamentally different product than one promising a two-day RTO and a 24-hour RPO, even if both are technically "cloud backup." For a business running live transactions, that difference can be the gap between a bad afternoon and a bad quarter.
Questions worth asking any backup vendor
- Can backups be deleted or modified by a compromised admin account?
- What's the actual, tested RTO — not the marketed number, but what's been verified in a real restore?
- How often are restores actually tested, and by whom?
The Bottom Line
Cloud backup for disaster recovery isn't really a storage decision — it's a resilience decision. Immutability determines whether ransomware can take the backup down with everything else, and RTO/RPO determine how expensive the outage actually is. Any evaluation that skips those two questions and focuses on storage price per gigabyte is evaluating the wrong thing entirely.