There is a piece of advice that gets repeated so often it has almost become background noise: keep a backup and you will recover from ransomware. It is true advice. The problem is that attackers have been reading the same guidance, and in recent years they have quietly changed their playbook to account for it.
Before triggering the encryption on your main systems, a modern ransomware attack will typically spend days or even weeks moving quietly through your network. One of the first things it looks for is your backup. Not to avoid it. To destroy or encrypt it first. If your backup goes down before you know you have been hit, the leverage shifts entirely to the attacker.
Why backups became a target
The logic from an attacker's perspective is straightforward. If you have a clean, tested backup, you can restore and walk away without paying. If you do not, your options narrow fast. Eliminating your recovery option is not an afterthought in a ransomware campaign any more. It is an early priority.
For small and medium businesses, this creates a real problem. Many SMEs invested in backup solutions several years ago, set them up, and have largely left them running in the background. The backup job runs each night. The green tick appears each morning. That feels reassuring. But it tells you very little about whether the backup itself is protected from tampering, whether the data inside it is actually recoverable, or whether someone with access to your network has already started working on it.
What intelligent backup protection actually does differently
Newer backup platforms are starting to apply behavioural monitoring and anomaly detection directly to the backup environment itself. Rather than simply recording what data has changed, they watch for patterns that do not match normal business activity. A sudden spike in files being modified across multiple systems at three in the morning is not business as usual. A process attempting to access and overwrite previous backup versions is not normal either.
When the backup platform spots something like that, it can alert your IT team or managed security provider before the encryption spreads, rather than after you have already noticed the damage on your production systems.
This kind of active monitoring sits alongside a feature that has become a genuine baseline requirement for any serious backup strategy: immutability. An immutable backup is one that cannot be altered or deleted for a defined period, even by someone with administrator credentials. It is a hard technical constraint, not a policy you rely on people to follow. If ransomware or a compromised account tries to overwrite or erase the backup, it simply cannot. The data stays where it is.
The 3-2-1-1-0 rule: what it means in plain English
You may have heard of the 3-2-1 backup rule. Three copies of your data, on two different types of storage, with one copy kept offsite. That has been good practice for years. The updated version adds two more steps that matter specifically in a ransomware context.
- 3 copies of your data in total
- 2 different storage types or locations
- 1 copy offsite or in the cloud
- 1 copy that is air-gapped or immutable, completely isolated from your network
- 0 unverified backups, meaning you have tested recovery and confirmed it works
That last point is where most small businesses fall down, and it is the one that matters most when the pressure is on. A backup that has never been restored is not a backup. It is a file that might restore. The distinction only becomes clear at the worst possible moment.
What this means for your business right now
You do not need to be running enterprise infrastructure to take this seriously. Backup platforms designed for smaller organisations now include immutability options, anomaly alerts, and scheduled restore testing as standard features rather than add-ons. The gap between what a large organisation can do and what an SME can afford to do has closed considerably.
The questions worth asking about your current setup are practical ones. When did someone last actually restore a file or a system from your backup, not just check that the job completed? Is any copy of your backup protected against deletion by a compromised account? Does someone get alerted if your backup behaviour changes unexpectedly?
If the honest answer to any of those is that you are not sure, that is the gap worth closing. The technology to close it is available and not prohibitively expensive. The cost of not closing it, when a ransomware incident hits a business without a clean, recoverable backup, is a different conversation entirely.
A practical place to start
Review your backup strategy against the 3-2-1-1-0 framework. Schedule a test restore if one has not been done in the last three months. Check whether your current backup solution has immutability and alerting features switched on, not just available. If you are unsure where your backup sits against these requirements, a straightforward assessment will tell you quickly where the gaps are and what it would take to address them.