Data immutability: The last bastion against ransomware and human error

When an attack happens, things rarely fail all at once. They fail in a chain. First, a wrong click. Then, compromised credentials. Next, abused permissions. And finally, encrypted or deleted backups. At this point, when all the traditional layers have already failed, data immutability decides whether the company recovers… or grinds to a halt.

In 2026, the question is no longer “do we have backups?”. The right question is: “is there a copy that nobody can change?”

 

Why ransomware and human error keep winning

Despite investment in security, incidents still follow an uncomfortable pattern:

• Ransomware that attacks backups before production

• Administrators with excessive permissions

• Accidental deletions replicated to every copy

• Automated scripts that spread errors in seconds

The problem is not a lack of technology, but rather overconfidence in rewritable systems.

The rule is simple: if something can be deleted, someone, or something, will eventually delete it.

 

What data immutability really is (without the technical hype)

Immutability means something very concrete:
data cannot be changed or deleted for a defined period, regardless of who tries to do so.

Not administrators, not malware, not automated scripts.

It is not encryption, access control or redundancy.

Rather, it is a structural block on change.

 

Ways to ensure data immutability

Approach	How it works	Points to watch
Object storage with locking	Objects are protected against modification and deletion for a defined period	Prefer modes in which not even the administrator can shorten the period
Offline copies	A copy is physically disconnected from the network, for example on magnetic tapes stored off site	Ensure rotation, secure transport and read tests
Immutable snapshots	System images at defined points in time that cannot be deleted before the deadline	Confirm that they are protected from production credentials
Managed services with protected retention	The provider guarantees retention, both contractually and technically	Check in the contract what is covered and how recovery is tested

The choice depends on data volume, budget and technical capacity. In every case, however, the principle is the same: there must be a copy that nobody can change, whether by mistake or on purpose.

 

How long should immutability last?

The period should cover at least the time the organisation takes to detect an attack. For example, if an attacker can remain on the network for weeks before being discovered, immutability of just a few days only protects copies that may already be compromised. On the other hand, very long periods increase storage costs. The decision should therefore balance risk, cost and legal requirements, and be reviewed as the organisation gets to know its threat profile better.

 

Immutability and GDPR: An apparent tension

The GDPR gives data subjects the right to have their data erased in certain situations. However, an immutable copy cannot be changed during the defined period. In practice, the solution is to ensure that data erased in the main system is not reintroduced during a restore, that the immutable copy has a limited and proportionate retention period and that this approach is documented. In this way, the organisation protects data availability without undermining data subjects’ rights.

 

Example: A maintenance script error

One night, a misconfigured clean-up script deleted several project folders in a company’s document platform. Automatic synchronisation replicated the deletion to the rewritable copies before anyone noticed. Because there was a daily immutable copy, the team recovered the folders from the previous night’s version. As a result, the incident cost a few hours of work, not months of lost documentation.

 

Frequently asked questions about data immutability

Does immutability replace other security measures?

No. On the contrary, it is the last layer, which only becomes decisive when the others fail. Antivirus software, access control, network segmentation and training remain essential.

Does a small company need immutability?

Yes, at its own scale. After all, many affordable backup services already offer protected retention, and the impact of an attack on a small company can be even more severe.

How do we know whether immutability is working?

By testing it: for example, an attempt to delete a protected copy with an administrator account should fail, and a restore from that copy should work. In addition, the results of these tests should be documented.

Who should be able to change immutability policies?

As few people as possible, with accounts separate from production accounts and strong authentication. In many cases, a change should require two people, so that a single compromised account is not enough.

 

Indicators to monitor

• percentage of critical data with an immutable copy;
• immutability period compared with the estimated time to detect attacks;
• date and result of the last recovery test from the immutable copy.

 

Questions for senior management

• Do we have a copy of critical data that not even an administrator can delete?
• Does the immutability period cover the time it would take us to detect an attack?

In short, immutability turns the worst-case scenario into a recoverable one. It should therefore be decided, configured and tested before an incident, because during an incident there is no longer time to create it.

Furthermore, immutability should be part of the business continuity plan and be reviewed whenever critical systems, storage providers or the organisation’s threat profile change.

Read also: Proof of Restore: The test that separates useless backups from real continuity and Ransomware and backups: How to ensure recovery is really possible.

For European recommendations on ransomware and resilience, visit the ENISA website.