What Is Immutable Backup and Why Insurers Now Ask About It

Q: What does immutable backup mean in simple terms?

An immutable backup is a copy of your data that is locked so it cannot be changed, encrypted, or deleted by anyone until a set retention period passes, even by an administrator or an attacker who has stolen administrator credentials. It is typically stored in cloud object storage with an object lock or on a hardened backup appliance, and it exists so ransomware cannot destroy your ability to recover.

Q: Is immutable backup the same as an air-gapped backup?

They solve the same problem differently. An air-gapped backup is physically disconnected, such as a tape in a safe, so malware cannot reach it. An immutable backup stays connected but is locked against modification or deletion by the storage system itself. For small businesses, cloud immutable storage is more practical than tape rotation because it is automatic, offsite, and does not rely on someone remembering to swap media.

Q: Why do cyber insurance companies ask about immutable backups?

Because most modern ransomware attacks delete or encrypt backups before encrypting production systems, leaving victims with no way to recover except paying. Insurers have paid those claims and now ask whether backups are immutable, offline, or air-gapped and whether restores are tested. A verified immutable backup lowers the chance of a large ransomware claim, so carriers often price coverage more favorably when it is in place.

An immutable backup is a copy of your data that cannot be changed, encrypted, or deleted by anyone, including an administrator or an attacker holding admin credentials, until a set retention period expires. It works by storing the backup on write-once media or in cloud storage with an object lock, so the only thing anyone can do is read it. Insurers ask about it because modern ransomware deletes or encrypts backups first, and an immutable copy is what turns a catastrophe into a recovery.

Why is immutable backup suddenly on every insurance form?

Ten years ago ransomware encrypted your files and demanded payment. Today's attackers spend days inside a network before they strike. They find the backup server, log in with stolen credentials, delete the backup jobs and the backup files, and only then encrypt production. Widely reported incident analyses show backup destruction is a standard step in most modern ransomware playbooks. When it works, the victim has no choice but to pay or start over.

Cyber insurers absorbed those losses and changed their applications. Alongside MFA and endpoint detection, most now ask whether your backups are immutable, offline, or air-gapped, and whether they are tested. Some carriers reduce ransomware coverage or raise premiums without a yes.

What is immutable backup and how does it work?

The idea is simple: once written, the data is locked. The implementation varies.

Cloud object storage with object lock

Services such as Azure Blob Storage, Amazon S3, and specialist backup clouds offer a setting that locks each backup object for a defined period, commonly 14 to 90 days. During that window no user, API call, or administrator can delete or overwrite it, even the account owner. In compliance mode, the storage provider itself will not remove it early. This is the most practical option for small businesses on the Treasure Coast because it is offsite by nature, which also covers hurricane and flood risk.

Hardened backup appliances

Purpose-built backup servers, often running a locked-down Linux system, store backups in a repository that the operating system marks immutable. The backup software can add new data but cannot modify or delete existing data before the retention period ends. These are good for fast local restores, and they should be paired with an offsite immutable copy.

Tape and true air gap

A tape sitting in a fireproof safe cannot be reached by malware. Tape is still used by some larger organizations, but for a 20-person office it is slow, manual, and depends on someone remembering to rotate it. Rotated external drives are the small-business equivalent and share the same weakness: the drive that is plugged in is not air-gapped.

Snapshots on storage systems

Some storage arrays and cloud file services keep read-only snapshots that can be locked. Useful as a first line of recovery, but if the snapshots live on the same system as the data, a compromised storage administrator account can still destroy both. Treat them as convenient, not as your immutable copy.

What immutable backup does and does not protect against

It protects against:

Ransomware that encrypts or deletes backups.
A malicious or careless administrator deleting data.
Compromised credentials for your backup software.
Accidental deletion of backup sets during cleanup.

It does not protect against:

Backing up already-encrypted or corrupted data. Retention must be longer than the time an attacker could sit undetected, which is why 30 days or more is a sensible minimum.
A backup that was never tested and does not restore.
Losing the encryption key to your own backups.
Missing systems that were never in the backup job in the first place.

Immutability is one layer of a proper backup and disaster recovery design, alongside offsite copies, monitoring, and regular restore tests. The familiar 3-2-1 rule (three copies, two media, one offsite) now usually gets a fourth number: one immutable.

How do you verify a vendor's immutability claim?

Many products say immutable on the box. Ask these questions, and ask to see the answers demonstrated.

Can an administrator with full rights delete a backup before retention expires? The correct answer is no. If the vendor says only a support ticket can do it, that is a soft lock, not immutability.
Is the lock enforced by the storage layer or by the backup software? Storage-layer enforcement (object lock, immutable file system flags) is stronger. If the backup application is the only thing enforcing it, compromising the application defeats it.
Is it governance mode or compliance mode? In cloud object storage, governance mode can be overridden by privileged accounts; compliance mode cannot. Know which you have.
What is the retention period, and who set it? It should be documented and long enough to outlast a slow-moving intrusion.
Is the backup account protected with MFA and separate credentials? Immutability protects the data; MFA protects the console that manages it. Both are necessary.
Show me a restore. Have the vendor or your provider restore a file, a mailbox, and a full server from the immutable copy while you watch, and record how long it took.

Have someone independent of the vendor check this. We routinely find during assessments that a business bought an immutable-capable product and the feature was never turned on.

What does immutable backup cost a small business?

The main cost is storage, and locked storage costs about the same as unlocked storage; you simply cannot reclaim it early. For most small offices the increase over an ordinary offsite backup is small compared with the cost of a single day without data. The bigger investment is doing it properly: a hardened repository, separate credentials, MFA, monitoring, and a quarterly test restore. If your data is in Microsoft 365, remember that immutable protection for mail and SharePoint requires a dedicated Microsoft 365 backup; the recycle bin does not count.

If you are not certain whether your backups would survive an attacker with your administrator password, or your insurance renewal is asking about immutability, call MainSail Data at (772) 794-1194 or request a free backup review. We will check what you have and show you what is actually locked.