Immutable backup gap leaves firms exposed to ransomware

Object First has published Omdia research showing a sharp gap between demand for immutable backup storage and the level of protection organisations say they have. The survey covered 700 IT decision-makers and business leaders across the US and Europe.

The findings suggest weaker recovery outcomes even as concern about ransomware remains high. While 93% of respondents said absolutely immutable backup storage is critical for ransomware protection, only 16% said their current backup environment meets that standard.

Omdia described the shortfall as an "immutability gap" - the difference between organisations' stated reliance on backup systems as a final safeguard and the small number with storage that cannot be changed or deleted by administrators or attackers using compromised credentials.

The data also suggests ransomware incidents have become more common. Some 83% of organisations said they had suffered a successful ransomware attack in the past two years, up from 66% in 2024.

Recovery rates, however, have moved in the opposite direction. Only 39% of respondents said they recovered at least 75% of their data after an attack, down from 57% in 2024.

Operational disruption remains a major issue. The study found that 64% of organisations experienced an outage that exceeded their Recovery Time Objective targets, while 76% said their largest data-loss incident went beyond Recovery Point Objective targets.

The report also found that 75% of organisations hit by an attack went through multiple service interruptions, pointing to a widening disconnect between investment in backup systems and actual resilience.

Trust issues

Confidence in supplier claims also appears limited. Nearly nine in 10 respondents, or 89%, said vendors' claims about immutability need independent third-party validation before they can be trusted.

The survey suggests that concern extends beyond technical teams. Among line-of-business leaders and C-suite executives, 73% said backups with absolute immutability are required for an effective business resilience strategy.

At the same time, 83% of those surveyed said they view backup storage as the last line of defence against ransomware. That mix of reliance and scepticism helps explain why the issue is moving beyond storage architecture and into broader operational risk planning.

The research covered organisations with between 1,000 and 9,999 employees in the US, UK, Ireland, France and the DACH region. Respondents included 500 IT decision-makers involved in cyber security, data centre infrastructure, and business continuity or disaster recovery purchasing, alongside 200 business leaders familiar with resilience and security policies.

Recovery pressure

The report adds to signs that restoring operations after an attack is becoming more difficult. Only 39% of respondents said they maintained a Recovery Time Objective of five days or less, down from 49% in 2024.

For many companies, the challenge is no longer limited to preventing intrusion. It also involves proving that backup data can survive a breach intact and remain usable when production systems and privileged access have been compromised.

Omdia defines absolute immutability as a condition in which nobody can modify or delete backup data, including highly privileged administrators or attackers with access to internal credentials. That distinction is central to the report's argument that some existing backup environments may offer less protection than buyers assume.

Simon Robinson, Principal Analyst at Omdia, said the figures show many organisations are still falling short on recovery readiness. "Ransomware can lead to a business continuity crisis, and the data shows that many organisations fall short when it comes to reliable recovery," he said. "While most technology leaders recognise the importance of immutable backups, the research points to a clear gap between perceived immutability and Absolute Immutability. Closing that gap is essential for organisations that need confidence their backup data will remain recoverable when attacks occur."

Object First, which commissioned the research, sells on-premises backup storage focused on immutable data protection. It said the findings show organisations need stronger assurance that backup repositories cannot be altered after an attack.

David Bennett, Chief Executive Officer of Object First, said backup systems must remain protected even if attackers gain privileged access. "When ransomware strikes, recovery can't depend on backups that can still be altered, deleted, or compromised," he said. "Omdia's research reinforces what we hear from our customers every day: absolutely immutable backup storage is the last line of defense against ransomware. Organisations need confidence that even if attackers gain access to IT credentials or compromise production systems, their backup data remains protected and recoverable."