Immutable Cloud Backup and Ransomware Recovery

Immutable cloud backup and ransomware recovery you've actually tested

Ransomware is designed to destroy your backups first. Upfortify sets up immutable backups for cloud apps, employee laptops and critical databases, copies that can't be changed or deleted even with stolen admin credentials, and tests recovery so you know it works before you need it.

Backups are ransomware’s first target

Modern ransomware doesn’t just encrypt your files. Attackers look for your backups first and delete or encrypt them, because a company that can restore doesn’t pay. If your backup is reachable with the same admin password that just got stolen, it isn’t protection.

What we back up

Microsoft 365 and Google Workspace: email, OneDrive and Google Drive, SharePoint and shared drives, Teams and calendars.
Employee laptops: work data on remote devices, wherever they connect from.
Cloud workloads: servers and storage in AWS and other clouds.
Critical databases: the systems your business can’t run without.

What makes it ransomware-resistant

Immutability. Backup copies are locked for a retention period and can’t be changed or deleted.
Separation. Backups live outside your main tenant and admin accounts, with their own MFA-protected access.
Retention you choose. Point-in-time restore going back far enough to get before an infection started.
Monitoring. Alerts on failed jobs and on unusual deletion or encryption activity.
Tested restores. Scheduled restore tests with results reported, so recovery is proven.

The 3-2-1-1-0 rule

Rule	Meaning
3	Three copies of your data
2	On two different types of storage
1	One copy offsite
1	One copy immutable or offline
0	Zero errors, verified by restore testing

Recovery, step by step

Plan

Agree what must come back first and how far back you need to go.

Protect

Immutable, separated backups configured for every critical system and app.

Test

Regular restore tests prove files, mailboxes and systems really come back.

Recover

If ransomware hits, clean data is restored in priority order alongside incident response.

Part of a complete defense

Backup is the safety net. MDR aims to stop ransomware before it spreads, and data loss prevention reduces what can leak in the first place.

Frequently asked questions

What is an immutable backup?

An immutable backup is a copy that can't be modified or deleted for a set retention period, even by an administrator. If attackers steal admin credentials, they still can't encrypt or erase it, which is what makes recovery possible.

Doesn't Microsoft 365 already back up our data?

Microsoft keeps your service running and offers retention features, but those aren't the same as an independent backup you control. Deleted, overwritten or encrypted data can be hard or impossible to restore without a separate backup.

What is the 3-2-1-1-0 backup rule?

Keep 3 copies of your data, on 2 different types of storage, with 1 offsite, 1 immutable or offline, and 0 errors verified by restore testing. It's a simple checklist for backups that survive ransomware.

How often do you test restores?

Restore tests are scheduled regularly and after major changes, and the results are reported. A backup that hasn't been restored is a hope, not a plan.

Do you back up employee laptops?

Yes, for work data on remote devices, so a lost, stolen or encrypted laptop doesn't mean lost work. Most work data should also live in cloud storage, which is backed up separately.