What determines how bad it gets isn’t whether you’re hit, but what you can restore to. The organizations that fare best have one thing in common: a copy of the data that the attacker couldn’t access.
Why regular backup isn’t enough
Modern ransomware actively searches for backups. The attacker is often in the environment for weeks before encryption starts, using that time to find the backups and delete or encrypt them first. Only then is production taken down.
A backup that resides on the same network, is accessed with the same credentials, and can be overwritten is therefore not insurance. It is part of the same attack surface.
The three properties that actually provide protection:
Immutability. An immutable backup cannot be changed or deleted during its lifespan, not even by someone with administrative privileges. This eliminates the entire attack vector.
Isolation. Air-gapping means the copy is physically or logically separated from the production environment. If the attacker cannot access it, it doesn’t matter which permissions have been compromised.
Redundancy. The 3-2-1 rule — three copies, two media types, one off-site — is old but still holds up. It protects against a single point of failure taking everything out.
The question no one wants to ask until it’s too late
How long does it take to get the business up and running again? Not just starting a restore, but actually invoicing, delivering, and responding to customers.
The difference between four hours and four days is rarely technical. It lies in whether someone has tested it, if the sequence between systems is documented, and if the right people know what to do.
Calculate the cost of downtime
Before you decide how much protection is reasonable, you need to know what a 24-hour downtime actually costs. Factor in lost billing, staff unable to work, contractual penalties, and the time management spends on dealing with the disruption rather than running operations.
The total usually comes as a surprise, and it makes the rest of the discussion straightforward. When a single day costs more than a full year of protection, the question is no longer if, but how quickly.
How we build the protection
Savecore BaaS is based on immutable backups in our own data centers in Sweden. The copies cannot be altered during their retention period and cannot be accessed using your production credentials.
For organizations where downtime is too costly, we complement our services with DRaaS, where the entire environment can be restarted at our facilities within an agreed timeframe. It is the difference between having your data intact and being up and running.
If you are affected right now
The order of operations matters in incident response: isolate what can be isolated — disconnect networks and turn off wireless on affected devices, but do not shut them down, as the memory may contain necessary traces. Do not pay without first speaking to someone who has done this before. Report it to the police.
Contact us if you need help assessing what can be restored. We will also let you know if you are better served turning elsewhere.
Frequently asked questions about ransomware protection
Can an attacker access an immutable backup?
No, not while the immutability period is active. That is the whole point — even a compromised administrator account can neither modify nor delete the copy.
Should you pay the ransom?
The police and relevant authorities advise against it. There is no guarantee that you will recover your data, and paying finances further criminal activity. A tested recovery process makes the question irrelevant.
How often should we test recovery?
At least once a year for the entire environment, and after every major change. Many frameworks also require documented testing.
Never pay the ransom—restore instead.
With immutable backup in Swedish data centers, you can recover after an attack without negotiating.