An immutable backup is a backup copy that cannot be altered or deleted once it is written, for a defined retention period. Because ransomware cannot encrypt or destroy it, it guarantees a clean copy of your data to recover from.
Why ordinary backups are not enough
Backups have always been the last line of defense against data loss, and for years the logic against ransomware was simple: keep good backups, and you can restore instead of paying. Attackers understood this just as well as defenders did, and they adapted. In a modern ransomware campaign, one of the attacker's explicit goals during the weeks they spend inside a network is to find and destroy the backups. They encrypt them, delete them, or corrupt the backup system itself, so that when they finally trigger the main encryption, the victim has no clean copy to fall back on and no option but to pay.
This is why ordinary backups, however diligently maintained, are no longer sufficient on their own. A backup that the attacker can reach is a backup the attacker can destroy. If it sits on the same network, under the same administrative credentials, it is within the blast radius of the very attack it is supposed to protect against. The defense has to be a backup the attacker cannot touch even after they have taken over the environment.
What immutability means
Immutability is the property that solves this. An immutable backup cannot be changed or deleted once it is written, for a defined retention period, by anyone, including an administrator and including an attacker who has stolen administrator credentials. The storage enforces this at a level that sits below normal access controls, often described as write-once, read-many. You can create the backup and you can read it to restore, but during its retention window no process can modify or erase it.
This directly defeats the attacker's backup-destruction tactic. Even an intruder who has taken full control of the environment, with the highest privileges, cannot encrypt or delete an immutable copy, because the immutability is enforced by the storage itself rather than by permissions the attacker could override. When it is time to recover, the organization still has a clean, intact copy of its data from before the attack.
Immutable and air-gapped together
Immutability is strongest when combined with an air gap. Where immutability means the backup cannot be changed, an air gap means it cannot easily be reached in the first place, because it is isolated from the production network, logically or physically. The two properties reinforce each other: the air gap keeps the attacker away from the backup, and immutability ensures that even if they somehow reach it, they cannot alter it.
Together, immutable and air-gapped backups give an organization what it most needs after an attack: a verified, clean copy of its data that provably predates the compromise and that the attacker could neither corrupt nor delete. This is the foundation on which real recovery is built. Guidance from CISA and NIST on recovering from ransomware consistently emphasizes exactly this combination.
Why it is the decisive capability
Immutable backups matter so much because recovery is the capability that most often decides whether a successful ransomware attack is a crisis or an inconvenience. An organization that can restore clean systems on its own has a genuine alternative to paying, which removes the attacker's primary leverage over the encryption. The ransom demand only works if the victim has no other way back; immutable backups ensure they do.
There are two important caveats. First, a backup is only as good as its tested restore; immutability guarantees the copy survives, but the organization still has to be able to recover from it quickly and in the right order, which is where self-healing recovery comes in. Second, immutable backups defend against the encryption half of a modern attack but not the data-theft half. If data was exfiltrated before encryption, restoring from a clean backup does not un-steal it, which is why immutable backups are necessary but not sufficient on their own against double extortion. Even so, as the thing that preserves recovery as a real option, immutable backups are one of the single most valuable investments an organization can make against ransomware.
How immutability is actually enforced
It helps to understand that immutability is not a single technology but a property that can be achieved in several ways, with different strengths. Some storage systems implement it in software, applying a retention lock that prevents the data from being modified or deleted until a set period expires. Cloud object storage often offers an object-lock feature that does the same in a hosted environment. At the strongest end, some systems use genuinely write-once media or hardware-enforced locks that make alteration physically impossible. What these share is that the protection sits below the level of ordinary user and administrator permissions, so it cannot be overridden by stealing credentials, which is the whole point.
A practical caution is that not all immutability is equal, and the details matter. An implementation that an administrator can switch off, or whose retention period an attacker with high privileges could shorten, offers far weaker protection than one that is genuinely locked for its full retention window regardless of who asks. When evaluating backup immutability, the key questions are whether it can be disabled or shortened by any account, including a compromised administrator, and whether it is independently verifiable. The strongest posture combines true immutability with an air gap and with regular, tested restores, so that the clean copy is protected, unreachable, and proven to work, rather than merely assumed to be all three.
See also
Sources
- CISA: #StopRansomware Guide (data backup guidance)
- NIST: Data Integrity — recovering from ransomware (SP 1800-11)
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.