Ransomware recovery: what your backup needs to survive it

Modern ransomware actively hunts for and encrypts or deletes backups it can reach, so at least one copy needs to be immutable (unable to be altered or deleted for a set period) or fully offline and air-gapped. A backup sitting on a constantly-connected network share is not meaningfully safer than the data it's protecting.

Coach's tip: ask your backup provider directly whether your backups are immutable — if they hesitate, they're probably not.