Best fit: Veeam. It appears most often as the recommended solution for immutable, ransomware‑resistant backups, offering hardened Linux repositories and cloud object‑locking (AWS, Azure, Wasabi). Consider Rubrik for appliance‑style immutability and Wasabi for cost‑effective object‑lock storage. Always keep a secondary, isolated copy.
Brands AI recommends here
Mentioned in
1
VeeamVeeam — Best when you need hardened, on‑prem or cloud immutability: supports Hardened Linux repositories and cloud object‑locking (AWS, Azure, Wasabi). Tradeoff: still maintain isolated secondary copies and strict access controls.
72%
2WasabiWasabi — Best when you want cost‑effective cloud object‑lock (S3 Object Lock) for immutable retention; pairs with backup software to prevent deletions. Caveat: proper object‑lock configuration and isolated copies remain essential.47%
3RubrikRubrik — Good when you prefer appliance or SaaS that enforces immutability and fast recovery: cited as a recommended immutable backup option. Caveat: consider total cost and appliance vs cloud tradeoffs for your environment.47%
Yes. For ransomware resilience, I would build the backup around immutable/WORM storage plus a separate security boundary, rather than relying on ordinary snapshots.
Practical options
Veeam + hardened Linux repository — Good if you have on-premises VMware, Hyper-V, physical servers, etc. Veeam's hardened repository makes backup files immutable for a configured period; during that period they cannot be modified or deleted. Veeam currently supports an immutability window of 7–9,999 days.
Veeam + S3 Object Lock — Send a second copy to AWS S3 with Object Lock enabled. S3 Object Lock uses WORM retention and prevents locked object versions from being permanently deleted or overwritten during the retention period.
Azure Backup / immutable Azure Blob Storage — Azure Backup stores recovery data in an isolated vault, while Azure Blob immutable storage provides WORM retention that prevents modification/deletion during the retention interval.
Wasabi Object Lock — Another S3-compatible option. Wasabi's Object Lock provides WORM protection against modification and deletion, including from ransomware.
The architecture I'd recommend
Production servers
│
▼
Backup server
│
├──────────────► Immutable local repository
│ (hardened Linux / WORM)
│
└──────────────► Immutable off-site copy
(S3 Object Lock / Azure / Wasabi)
The important part is that ransomware should not have credentials capable of deleting both copies. Ideally:
Production credentials cannot administer the backup repository.
Backup storage is immutable for, say, 30–90 days, depending on your recovery requirements.
The cloud copy has Object Lock/WORM, not merely versioning or ordinary snapshots.
Backup administration uses separate accounts and MFA.
The backup repository is not domain-joined unless there is a compelling reason.
Keep at least one copy geographically separate.
Regularly perform actual test restores—not just backup-success checks.
A particularly strong setup is Veeam → hardened Linux repository → S3 Object Lock, giving you both a fast local recovery copy and an off-site copy that an attacker who compromises the production environment can't simply delete. Veeam explicitly supports immutable repositories and immutable object-storage repositories.
If you tell me what you're backing up (VMware, Hyper-V, Windows file servers, Microsoft 365, databases, NAS, etc.), approximate data size, and whether you want cloud or on-prem, I can lay out a concrete architecture and estimated storage requirements.
Immutable protection works by enforcing a strict time-based lock. Even a user with root or administrator access cannot delete or change the backup files until the retention period expires.
AWS S3 Object Lock - Amazon's cloud object storage service that lets you store data in compliance or governance mode so objects cannot be overwritten or deleted by any user for a designated time frame.[](https://www.veeam.com/blog/immutable-backup.html)
Wasabi Hot Cloud Storage - A cloud storage provider offering immutable storage buckets that block deletion requests and protect backup chains from malicious encryption without charging egress fees.[]()
To help narrow down the best choice for you, tell me:
Are you looking for a cloud storage service , an on-premises software , or a hardware device?
Yes. The key is to use true immutability/WORM storage, not merely snapshots with a retention policy. A ransomware-compromised backup server or admin account should not be able to shorten the retention period or delete the protected copy.
A solid ransomware-resistant design
I’d build it like this:
Production → local immutable backup → off-site immutable backup
Primary backup:Veeam Backup & Replication with a Linux Hardened Repository. Veeam makes backup files immutable for a defined period, during which they cannot be modified or deleted. Its hardened-repository design also avoids storing reusable credentials on the backup server.
Off-site copy: Send another copy to S3-compatible object storage with Object Lock enabled in Compliance mode. Object Lock uses WORM protection, preventing protected objects from being overwritten or deleted until their retention date.
Separate credentials: The production/backup environment should not have unrestricted administrative credentials to the object-storage account.
Long enough retention: For example, keep daily restore points for 30–60 days and monthly copies for 6–12 months, depending on your recovery requirements.
Test restores: Periodically restore files/VMs from the immutable copy. An immutable backup that can't actually be restored isn't much use.
Storage choices
Option
Immutability mechanism
Good fit
Veeam Hardened Repository
Linux filesystem immutability
Local/onsite backup
AWS S3 Object Lock
WORM, Compliance mode
Large environments / AWS
Backblaze B2 Object Lock
WORM retention
Cost-conscious off-site backup
Backblaze explicitly supports Object Lock to prevent ransomware from changing or deleting files during their retention period. BackblazeBackblaze Help Wasabi likewise provides Compliance/Object Lock mechanisms that prevent modification or deletion during the configured retention period.
What I would avoid
Don't rely on:
A NAS snapshot that the NAS administrator can delete
A backup share exposed through SMB to the production network
A second backup server using the same domain administrator credentials
Cloud versioning without Object Lock/WORM retention
"Immutable" storage where an administrator can simply turn immutability off
For example, AWS distinguishes Governance from Compliance mode: Governance can allow specially privileged users to bypass retention, whereas Compliance mode is designed so that protected objects cannot be deleted during the retention period.
My preferred architecture
For a typical small/midsize business, I'd seriously consider:
Veeam → local Hardened Repository → B2/Wasabi Object Lock
That gives you two independent immutable copies, including one off-site. If ransomware compromises the Veeam server, it still has a much harder time destroying both copies.
If you tell me what you're backing up (VMware, Hyper-V, physical Windows/Linux, Microsoft 365, NAS, etc.), roughly how much data you have, and your desired retention, I can lay out a concrete architecture and compare the likely costs of Veeam + B2 vs. Wasabi vs. AWS.
Air-Gapped or Isolated Credentials: Use distinct, multi-factor authenticated service accounts that are isolated from your primary Active Directory domain.[]()
If you can tell me your current infrastructure (e.g., local NAS, AWS/Azure cloud, or a mix of virtual machines) and approximate data size , I can recommend the exact product configuration to set this up.
This remains one of the strongest defenses because the backup is physically unreachable during an attack.
Settings I would require before trusting a design
Retention lock: 30–90+ days depending on recovery needs
Separate backup admin account (not domain admin)
MFA on backup consoles and cloud accounts
Immutable storage account with restricted deletion permissions
Regular restore tests
Monitoring for unusual backup deletion attempts
A common mistake is using “snapshots” on the same storage system as production. If ransomware gets administrator access to that storage, it may be able to delete snapshots unless they are specifically locked. Immutable storage features such as Object Lock enforce retention at the storage layer.
If you tell me your environment (Windows servers, VMware/Hyper-V, NAS, Microsoft 365, databases, size in TB, and budget), I can narrow this to a few architectures.
Yes. What you want is immutable backup storage, ideally combined with air-gapping. The key is that ransomware—or an attacker who compromises your backup server—must not be able to delete or overwrite the backup copies.
My recommended architecture
Production → Backup server → Immutable object storage
For example:
Veeam Backup & Replication for the backup software.
Amazon S3 Object Lock, Azure Blob immutable storage, or an S3-compatible provider such as Wasabi for the backup repository.
Configure a retention period such as 30–90 days.
Use WORM/compliance-mode immutability, rather than relying merely on permissions or a hidden snapshot.
Keep the backup repository credentials separate from production credentials and protected with MFA/RBAC.
Veeam supports immutable repositories using S3 Object Lock, Azure version-level WORM, and several S3-compatible providers. During the immutability period, Veeam cannot delete the protected backup, and the storage provider prevents deletion as well.
An important distinction about "snapshots"
I would not rely solely on storage snapshots for ransomware protection. A snapshot that remains under the same administrative account/control plane as production can potentially be deleted by an attacker who compromises that environment.
Instead, use snapshots/backups that are copied into immutable WORM storage. For example, Amazon S3 Object Lock prevents protected objects from being overwritten or permanently deleted during their retention period.
Three good approaches
Approach
Ransomware protection
Complexity
Best for
Veeam + hardened Linux repository
Excellent
Medium
On-prem
Veeam + S3 Object Lock
Excellent
Low–Medium
Most organizations
Veeam's hardened Linux repository provides immutable storage on-premises, while object-storage repositories can use Object Lock/WORM.
If you want the least operational burden, Veeam Data Cloud Vault is worth considering; its immutable storage uses Object Lock/time-based retention and compliance controls designed so administrators cannot modify or delete protected data before the retention period expires.
What I'd build
For a typical small/midsize business, I'd use:
Servers/NAS → Veeam → local backup → immutable S3 repository
with something like:
Daily backups
30–90 days immutable
Separate backup credentials
MFA on administrative accounts
No direct production-to-object-storage administrative access
At least one copy off-site
Periodic test restores
That gives you a much stronger 3-2-1-1-0 style architecture: multiple copies, different media, off-site, at least one immutable/offline copy, and verified recoverability. Veeam specifically recommends immutable object storage as part of this strategy.
If you tell me what you're backing up (Windows PCs/servers, VMware, Hyper-V, NAS, Microsoft 365, SQL, AWS/Azure, etc.) and approximately how much data you have, I can recommend a specific solution and estimate the storage/cost.
AWS S3 with Object Lock: The gold standard for enterprise cloud. By configuring S3 buckets with Governance or Compliance Mode object locking, you prevent object versions from being deleted or overwritten for a fixed retention duration.
ExaGrid Tiered Backup Storage: Features a non-network-facing tier (Retention Time-Lock) where delete requests are delayed, ensuring incoming ransomware deletion commands do not purge historical backups. []()
Enterprise Data Security & Backup Platforms
Rubrik Security Cloud: Uses a proprietary, logical-air-gapped file system where data is written in an append-only format. It actively monitors for anomalous file modifications and ransomware signatures, locking down clean recovery points.
Compliance Mode vs. Governance Mode: Always choose Compliance Mode for your object lock if you want absolute protection. Governance mode allows users with specific special IAM permissions to bypass the lock; Compliance mode locks it out for everyone unconditionally.
The 3-2-1-1 Rule: Keep 3 copies of data, on 2 different media types, with 1 copy offsite/in the cloud, and 1 immutable or air-gapped copy.
MFA on Backup Consoles: Immutability protects the data at rest, but multi-factor authentication (MFA) and strict least-privilege access prevent attackers from reconfiguring your backup retention policies early in an intrusion.
To help me recommend the exact right fit , tell me:
Are you looking for a cloud storage target (like Wasabi/AWS), an on-premise appliance , or a complete software suite (like Veeam/Rubrik)?
If your goal is a backup system with immutable snapshots that ransomware cannot delete, look for true immutability, not just “read-only” permissions. The strongest designs use WORM (Write Once, Read Many), Object Lock, hardened repositories, or isolated vaults so that even a compromised administrator account cannot remove recovery points during the retention period.
Good options to evaluate:
Solution
Best fit
Immutable protection
Veeam Software
SMB to enterprise, VMware/Hyper-V, Microsoft 365, mixed environments
Hardened Linux repositories with immutability, plus integrations with object storage immutability.
If you tell me your environment (Windows servers, VMware, Hyper-V, NAS, Microsoft 365, AWS/Azure, number of TB, and budget), I can narrow this to a few specific architectures.
The top categories and solutions to achieve this depend on your setup scale:
Cloud Object Storage with Object Lock
Amazon S3 Object Lock: Configured in "Compliance Mode," ensuring no user—not even the AWS root account—can delete the data until the retention clock runs out.
Azure Immutable Blob Storage: Offers time-based retention policies and legal holds for blobs.
Rubrik Security Cloud - An enterprise data security platform that creates inherently immutable, append-only file systems to guarantee data recovery without paying a ransom.
Synology DSM Snapshot Replication - A network-attached storage solution that supports immutable local and replicated snapshots with locked retention timelines for smaller office environments.
Wasabi Object Lock
Compliance/Object Lock
Simple S3-compatible off-site backup
QNAP
Snapshots are locked against deletion by anyone, including root/admin, for a set time.
Small-to-medium business local storage.
Cohesity / Rubrik
Built-in file system-level immutability with multi-factor authorization for policy changes.
