Is an immutable backup enough to stop ransomware?

It raises the level of protection, but immutability relies on policy. It can be misconfigured, expire or be disabled through a compromised administration plane. With an append-only write path, compromised credentials cannot overwrite or delete validated restore points.

What is the difference between an immutable and an incorruptible backup?

An immutable backup cannot be changed during a configured retention window. Protection based on an append-only write path and a retention floor that can only be extended prevents validated points from being overwritten, encrypted or deleted. There is no retention flag to turn off.

Can ransomware delete an immutable backup?

It can if the attacker reaches the control plane that governs immutability, for example through stolen administrator credentials, or waits until the retention window ends. Incorruptible append-only storage does not expose that control.

Immutable backup: definition, limits and alternative

Definition

An immutable backup cannot be modified or deleted during a defined retention period. Immutability is generally implemented through object locking (WORM, write once read many) on the storage layer, or through a retention flag on a backup repository. Its purpose is to prevent ransomware or human error from encrypting or deleting restore points.

Why immutability matters

Backups are a primary target in modern ransomware attacks. In Sophos's State of Ransomware 2024 report, 94% of affected organisations said attackers had attempted to compromise their backups. Before encrypting production, an attacker goes after the recovery point because a victim with healthy backups is less likely to pay. Immutability directly addresses that threat.

The limits of policy-based immutability

Immutability is a meaningful advance, but it has structural limits:

It is a setting. Someone must enable it, define the scope correctly and choose a retention window. An incomplete scope leaves a gap in the protection.
It can expire. Locking windows end, and a patient attacker may outlast a short retention period.
It can be disabled. If immutability is governed through the same administration plane that an attacker has compromised, the off switch may be within reach. Credential theft is a leading initial-access vector.

Immutable or incorruptible: the distinction that shapes recovery

This is where immutable and incorruptible cease to mean the same thing. Oxibox builds protection into the file system itself. Oxibox Backup Guardian (OBG) uses a software air gap and an append-only write path with a retention floor that can only be extended. Once a restore point has been validated, neither the backup interface nor the administration interface exposes a command to overwrite or delete it. Behavioural analysis flags abnormal writes, while disconnection and rewrite blocking apply systematically.

Policy-based protection depends on every setting being correct. File-system-level protection remains active even when a configuration step is missed.

What is an immutable backup?