Backup is necessary. It is not a security control.

There is a comfortable assumption in a lot of security programs: if we have immutable backups, we are covered. Backups are essential, and immutability is a real improvement over what came before. But a backup is a recovery target, not a control. It cannot see what is happening to production data, cannot stop an attack in progress, and cannot tell you that sensitive files were copied before they were encrypted.

This distinction is not pedantry. It determines what actually happens on the day an attack lands, and it explains why organizations with disciplined, tested, immutable backup programs still end up in ransom negotiations.

Modern intruders read the same best-practice guides defenders do, and they plan accordingly. Sophos research on ransomware incidents found that attackers attempted to compromise the victim’s backups in 94% of cases, and that victims whose backups were successfully compromised faced dramatically worse outcomes: ransom demands more than double, nearly twice the likelihood of paying, and median recovery costs roughly eight times higher. Disabling backup infrastructure, deleting snapshots, and encrypting repositories are standard steps in the playbook, executed before the visible attack begins, because a victim with no recovery path negotiates from nothing.

Immutability is the right response to that tactic, and it works: a copy that cannot be altered or deleted survives the attempt. But notice what was defended. The copy survived. The live data, the thing the business actually runs on, was encrypted or stolen exactly as it would have been otherwise. Immutability raised the floor under recovery; it did not add a single defensive capability in front of the data.

It helps to be blunt about the boundaries. Laid out side by side, the pattern is hard to miss: everything backup does well happens after the damage, and everything it cannot do is the damage.

Modern extortion frequently steals data before encrypting it, and a growing share of incidents skip encryption entirely. By the time you restore from a clean backup, the attacker still has the data and the leverage. Backup does nothing about that. It also does nothing about a credentialed insider quietly reading files they should not, because nothing in the backup workflow watches live access. The half of the modern attack that hurts longest, disclosure of what was taken, is entirely outside backup’s reach.

The point is not to trust backups less. It is to stop treating them as the whole strategy. The window between when an attack starts and when you reach for the backup is exactly where the damage happens: encryption, theft, exposure.

Even when recovery is the right tool, its economics are routinely underestimated. Restoring a multi-terabyte file estate is measured in days, sometimes weeks, and a full rollback to the last clean backup discards every legitimate write between that backup and the attack. Recovery time and recovery point are business numbers, not IT numbers: they are the outage and the lost work. The organizations that publish confident recovery objectives and then miss them by an order of magnitude in a real incident usually tested restoring a file, not an estate.

A security control observes live activity, decides in real time, and acts before harm completes. Applied to data, that means watching every read and write as it happens, judging it against policy and behavior, and stopping the session while the blast radius is still a handful of files. Nothing in a backup architecture, however hardened, is positioned to do any of those three things, because backup by design engages with data only on a schedule, after the fact.

Active defense on production data closes the window. Detect the malicious behavior inline, stop the session, preserve the evidence, and then recover surgically from immutable copies, restoring only the files the attack touched, with a 1-minute recovery point and 3-minute recovery time target instead of a multi-day rebuild. Backup is the last step of that chain, not a substitute for the rest of it.

This is also where cyber vaulting earns its distinction from backup. A vault like ImmutaVault holds isolated, immutable, manifest-backed copies inside the platform, designed to survive administrative compromise, with provenance for forensics; it complements the defense rather than standing in for it. Keep the backups. Keep them immutable. Test them against the whole estate, not a sample. And then put a control in front of the data they copy, so the next incident is something you stopped rather than something you restored from.