Free tools · Free · 2 minutes
Would your backups survive a ransomware attack?
In modern attacks, backups are the first target — hit before encryption even starts. Tick what is genuinely true in your organisation: your score and weak spots appear immediately, and nothing leaves your browser without your consent.
At least one immutable copy (object lock / WORM) A copy that no account, even an admin, can modify or delete during retention: it is the one that survives when everything else is encrypted. At least one off-site copy on independent infrastructure If the main site burns, floods or is compromised, the remote copy remains; on an island, "off-site" takes real planning. Backup repository outside the production domain (dedicated accounts + MFA) Attackers who take the directory take everything attached to it: the repository must live in a separate world with its own credentials. No write access to the repository from the production network That is the airlock: production pushes data through a controlled channel, never the other way — a compromised machine cannot reach the copies. A full restore test, less than six months old, timed A backup that has never been restored is an assumption, not a protection. The stopwatch turns hope into a measured RTO. RTO and RPO written down, approved by management, per application Without written objectives, everyone discovers during the crisis what "fast" means. Numbers settle investment debates before the incident. Backup jobs monitored, with alerts on failure or abnormal purge Backups fail silently — and a massive purge of restore points is often the first sign of an attack in progress. Retention covering a slow compromise (30 days or more) Attackers sometimes wait weeks inside the network before acting: if all your copies are recent, they may already be contaminated. Documented rebuild order (directory, DNS, databases, applications) Restoring is not just retrieving files: it is rebuilding an information system in the right order, under pressure. Standby compute capacity identified, to restart without waiting for hardware Healthy data with no servers to run it means an exploding RTO: know where you will restart before you need to.
See my result
The companion article: 76% of Backups Compromised: Why Your Backup Is Not a DR Plan