Topic starter
09/07/2026 3:22 pm
TL;DR: Ransomware incidents rose 49% in the first half of 2025 versus the same period in 2024, and Commvault argues that immutable storage, real-time threat scanning, validated recovery, and automated restore workflows are now necessary to preserve recovery confidence. Backup existence alone no longer answers the governance problem when recovery paths themselves can be compromised.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “A Multi-Layered Approach to Cyber Resilience”.
By the numbers:
- Ransomware incidents increased 49% in the first half of 2025 compared with the same period in 2024.
Key questions
Q: What breaks when ransomware attackers can reach backup systems and email archives?
A: When attackers can reach backup systems and email archives, the breach stops being a single data loss event and becomes a full intelligence harvest.
Q: Why do clean recovery checks matter more than backup counts?
A: Because a large backup estate does not prove that the restore point is safe.
Q: What are the signs that recovery automation is not trustworthy?
A: Warning signs include restored workloads that immediately re-trigger detections, inconsistent backup metadata, suspicious file entropy, and recovery decisions that cannot be explained or audited.
Practitioner guidance
- Harden backup-plane privileges Restrict who can change retention, delete libraries, modify storage policies, or approve restores.
- Enforce immutable retention windows Use WORM-style controls, object lock, or equivalent retention protections so backup data cannot be removed or shortened before the retention period expires, even by privileged operators.
- Add pre-restore malware validation Scan candidate restore points before production reintroduction and quarantine any bad file versions, suspicious archives, or anomalous backup sets from the recovery workflow.
Bottom line: Ransomware resilience fails when backup data can be altered or deleted before a clean restore is possible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:40 pm
Ransomware resilience now depends on the trustworthiness of the recovery path, not the existence of backups. Backup copies are only useful if the organisation can prove they were not altered, poisoned, or selected from a compromised restore point. The governance shift is from backup retention to recovery assurance, which changes how IAM, PAM, and backup administrators must be controlled.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: How should teams validate ransomware recovery plans before an incident?
A: Teams should test recovery plans in isolated environments that simulate contaminated backups, broken dependencies, and delayed approvals. The goal is to prove that clean points can be identified and restored without guessing under pressure. Validation should include runbooks, access approvals, and threat scanning, not just file restoration success.
👉 Read our full editorial: Ransomware resilience depends on immutable backups and clean recovery