An organisation that can restore does not pay. Attackers know this, which is why modern ransomware spends its first hours hunting backup servers, cloud credentials and snapshot schedules. By the time anything is encrypted, the escape route is usually already gone.
Why the order matters
If backups are reachable with the same administrator account that runs the estate, they are not a second copy — they are the same copy in a different folder. Any credential theft that reaches the domain reaches them too.
Immutability is the control that holds
An immutable backup cannot be altered or deleted until its retention window expires, and that holds whether the request comes from malware, a compromised administrator, or an honest mistake. It is the one control that assumes the attacker already has your password.
