Backup Security Blog
Field notes on backup strategy, ransomware resilience, and recovery — from the BackupSec team.
Latest
- Oct 27, 20267 min read
DORA Backup Requirements: Article 12 Mapped to Veeam Controls
DORA Article 12 for backup engineers: documented backup policy, periodic restore tests, segregated restore systems, RTO and RPO, mapped to Veeam controls, and what DORA never says.
by BackupSec Team
- Sep 28, 202613 min read
What Is Backup Security? Definition, Eight Controls and a Self-Check
Backup security protects backup systems and copies from ransomware, deletion and unauthorised change, and proves restores work. Eight controls for Veeam, each with the pitfall that breaks it and a check.
by BackupSec Team
- Sep 27, 202619 min read
RTO vs RPO: Definitions, a Worked Example and Veeam v13 Mapping
RTO is how long you can be down; RPO is how much data you can lose. NIST definitions, a worked example, Veeam v13 mapping and why ransomware breaks both.
by BackupSec Team
- Sep 24, 202610 min read
S3-Compatible Storage for Veeam Immutability: Provider Matrix
Compare six storage options against Veeam 13 immutability requirements, with tested builds and read-only checks for Object Lock, versioning and retention.
by BackupSec Team
- Sep 22, 202626 min read
How to Prove Your Immutable Backups Are Actually Immutable
Verify Veeam immutability with read-only storage checks, isolated enforcement tests, IAM review and a reproducible evidence pack. A refused delete alone is not proof.
by BackupSec Team
- Aug 2, 20269 min read
The 3-2-1-1-0 rule, explained
The classic 3-2-1 rule grew two digits for a reason. Here is what the extra 1 and 0 buy you.
by BackupSec Team
- Jul 14, 202613 min read
The Fibonacci Rule of Backup Security: Extending 3-2-1-1-0 for Modern Backup Security
Why 3-2-1-1-0 remains a strong operational baseline, and why modern backup security needs an architectural layer around it.
by BackupSec Team
- Jul 13, 202611 min read
The 31-Second Attacker: What the First Autonomous Ransomware Attack Means for Recovery
Sysdig assesses JADEPUFFER as the first documented case of agentic ransomware: an LLM agent ran an extortion chain end to end and, in one sequence, went from a failed login to a working fix in 31 seconds. What that compression means for backup architecture.
by BackupSec Team
- Jun 20, 20269 min read
Building ransomware-resilient backups
Immutability, isolation, and tested recovery are the three pillars that keep backups useful when ransomware hits.
by BackupSec Team
- May 27, 202613 min read
Three Years, One Root Cause: What Vulnerability Exploitation's Run Means for Ransomware Recovery
Exploited vulnerabilities topped Sophos's ransomware root-cause list three years running (32% in 2025), then fell to 18% in 2026. Why prevention can't close the gap, and what does.
by BackupSec Team
- May 20, 202612 min read
The 2.7 Problem: Why Ransomware Victims Typically Face More Than One Weakness
Victims in Sophos's 2025 ransomware survey named 2.7 contributing factors on average. Why single-control defense falls short and backup is the compensating control.
by BackupSec Team
- May 13, 202612 min read
What Sophos Got Right About Ransomware in 2025, and the Backup Question Nobody Is Asking
In Sophos's 2025 enterprise ransomware data, the share of victims that restored encrypted data from backups fell from 73% to 53%, a four-year low. Why backup confidence is now the metric that matters.
by BackupSec Team
