Ransomware doesn’t go after the file server first anymore. According to Sophos’s 2026 State of Ransomware report, backup repositories are targeted in 94% of attacks, and succeeded in 57% of attempts. If your backups are still sitting somewhere an admin credential can reach, they’re not a safety net. They’re the first thing on the list.
What immutable backup means
Immutability means a backup file physically cannot be altered, deleted, or encrypted for a set period of time, no matter who’s logged in or what credentials they’re using. It’s a write-once, read-many state: the same principle behind old-school WORM tape, applied to modern disk and object storage. Once a restore point is locked in, it stays exactly as it was until its retention window genuinely expires. Not “unless an administrator overrides it.” Not “unless someone has the right permissions.” Locked, full stop.
Why attackers go after backups first
It’s not a theoretical risk. Veeam’s own research found 89% of organisations have had their backup repositories directly targeted in an attack. Sophos’s numbers explain why it’s worth the effort: organisations that keep their backups intact recover without paying a ransom in two-thirds of encryption cases. Once backups are compromised, recovery costs run roughly eight times higher, and the average total cost of a ransomware incident has reached $1.7 million. Attackers know exactly where the leverage sits, and it isn’t your production data.
How immutability is implemented
There are a few routes to get there, and most credible backup platforms, Veeam among them, support more than one:
- A hardened Linux repository: on-premises, with file locking enforced at the filesystem level (Veeam uses XFS with restricted credentials), so even someone with root access can’t shorten a retention period early.
- Object storage with Object Lock: cloud-based, using S3-compatible storage such as AWS, Azure Blob or Wasabi, where the lock and retention settings are enforced by the storage platform itself rather than the backup software.
- A managed cloud vault: a fully managed immutable target that arrives pre-configured, useful if you’d rather not run and harden the infrastructure yourself.
None of these help much if you don’t also keep at least one copy genuinely offline or air-gapped. Immutability protects against alteration. It doesn’t help if an attacker simply waits out the retention window, or goes after a connected copy some other way.
How long should the immutability window be
Veeam’s hardened repository supports anywhere from 7 to 9,999 days of immutability, with one hard rule enforced by the platform: the immutability period has to be longer than the backup job’s own retention policy, or restore points will expire on schedule right when you need them. There’s no universal right answer. It depends on how long a compromise might sit undetected in your environment before anyone notices, which for a lot of organisations is longer than they’d like to admit. Most teams we work with land somewhere between 14 and 30 days as a working minimum, with longer windows reserved for anything that would be genuinely catastrophic to lose.
Start your immutability journey today. Book a meeting with a Nexstor backup specialist.
Immutability is one piece of the rule, not the whole rule
Immutable backup sits inside the wider 3-2-1-1-0 approach: three copies of your data, on two different types of media, one of them off-site, one of them offline or immutable, and zero errors. That means testing recoverability, not just assuming a job succeeded because nobody flagged an alert. Immutability covers the “1” that used to mean a tape sitting in a safe. It does the same job, just without needing someone to physically swap media every night.
Does your current setup support this
This is worth checking rather than assuming. Immutability has to be explicitly configured. A backup platform that’s technically capable of it isn’t protecting you if the setting was never turned on, or if the retention window was left at a default that doesn’t match your risk profile. Veeam has supported hardened repositories since V10 and has expanded the options considerably since; other platforms vary. It’s worth asking plainly: where do our immutable copies live, who set the retention window, and when did we last test that they genuinely can’t be deleted early?
Test it, don’t assume it
The only way to know immutability is working is to try and break it. Attempt to delete a locked restore point before its window expires. If it lets you, something’s misconfigured. Run a full recovery test from an immutable copy on a schedule, not only when there’s an incident. A backup strategy that’s never been tested under pressure is a hope, not a plan.
The picture in the UK right now
This isn’t an abstract threat for UK organisations. City of London Police’s Report Fraud data recorded 323 confirmed ransomware attacks against UK businesses in the twelve months to March 2026, more than 26 a month, with average losses up around 50% year-on-year to roughly £270,000. Over half of those reports came from small and mid-sized organisations, not the large enterprises that tend to make the headlines.
Getting your backup environment reviewed
If you’re not completely sure your backups are immutable (properly, technically immutable, not just “stored somewhere separate”), that’s a conversation worth having before you need to test it for real. We review backup and recovery environments against exactly this kind of ransomware scenario as part of our managed backup services. Get in touch and we’ll take a proper look at what you’ve got.
Book a Nexstor backup review now.
